Skip to content

Commit bb7316b

Browse files
stgraberstgraber
authored
Merge pull request #1770 from accuser/use-lego-binary-for-http-01-challenge
Use lego binary for http 01 challenge
2 parents 7af3ea4 + 8e67b03 commit bb7316b

File tree

14 files changed

+230
-357
lines changed

14 files changed

+230
-357
lines changed

‎cmd/incusd/acme.go ‎cmd/incusd/api_acme.go

+38-12
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,10 @@ package main
22

33
import (
44
"context"
5+
"io"
6+
"net"
57
"net/http"
6-
"net/url"
7-
8-
"github.com/gorilla/mux"
8+
"strings"
99

1010
"github.com/lxc/incus/v6/internal/server/acme"
1111
"github.com/lxc/incus/v6/internal/server/cluster"
@@ -32,11 +32,7 @@ var acmeChallengeCmd = APIEndpoint{
3232
func acmeProvideChallenge(d *Daemon, r *http.Request) response.Response {
3333
s := d.State()
3434

35-
token, err := url.PathUnescape(mux.Vars(r)["token"])
36-
if err != nil {
37-
return response.SmartError(err)
38-
}
39-
35+
// Redirect to the leader when clustered.
4036
if s.ServerClustered {
4137
leader, err := s.Cluster.LeaderAddress()
4238
if err != nil {
@@ -57,14 +53,44 @@ func acmeProvideChallenge(d *Daemon, r *http.Request) response.Response {
5753
}
5854
}
5955

60-
if d.http01Provider == nil || d.http01Provider.Token() != token {
61-
return response.NotFound(nil)
56+
// Forward to the lego listener.
57+
addr := s.GlobalConfig.ACMEHTTP()
58+
if strings.HasPrefix(addr, ":") {
59+
addr = "127.0.0.1" + addr
60+
}
61+
62+
domain, _, _, _, _ := s.GlobalConfig.ACME()
63+
64+
client := http.Client{}
65+
client.Transport = &http.Transport{
66+
DialContext: func(_ context.Context, _, _ string) (net.Conn, error) {
67+
return net.Dial("tcp", addr)
68+
},
69+
}
70+
71+
req, err := http.NewRequest("GET", "http://"+domain+r.URL.String(), nil)
72+
if err != nil {
73+
return response.InternalError(err)
74+
}
75+
76+
req.Header = r.Header
77+
78+
resp, err := client.Do(req)
79+
if err != nil {
80+
return response.InternalError(err)
81+
}
82+
83+
defer resp.Body.Close()
84+
85+
challenge, err := io.ReadAll(resp.Body)
86+
if err != nil {
87+
return response.InternalError(err)
6288
}
6389

6490
return response.ManualResponse(func(w http.ResponseWriter) error {
6591
w.Header().Set("Content-Type", "text/plain")
6692

67-
_, err := w.Write([]byte(d.http01Provider.KeyAuth()))
93+
_, err = w.Write(challenge)
6894
if err != nil {
6995
return err
7096
}
@@ -98,7 +124,7 @@ func autoRenewCertificate(ctx context.Context, d *Daemon, force bool) error {
98124
}
99125

100126
opRun := func(op *operations.Operation) error {
101-
newCert, err := acme.UpdateCertificate(s, challengeType, d.http01Provider, s.ServerClustered, domain, email, caURL, force)
127+
newCert, err := acme.UpdateCertificate(s, challengeType, s.ServerClustered, domain, email, caURL, force)
102128
if err != nil {
103129
return err
104130
}

‎cmd/incusd/daemon.go

-5
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,6 @@ import (
3030
internalIO "github.com/lxc/incus/v6/internal/io"
3131
"github.com/lxc/incus/v6/internal/linux"
3232
"github.com/lxc/incus/v6/internal/rsync"
33-
"github.com/lxc/incus/v6/internal/server/acme"
3433
"github.com/lxc/incus/v6/internal/server/apparmor"
3534
"github.com/lxc/incus/v6/internal/server/auth"
3635
"github.com/lxc/incus/v6/internal/server/auth/oidc"
@@ -156,9 +155,6 @@ type Daemon struct {
156155

157156
lokiClient *loki.Client
158157

159-
// HTTP-01 challenge provider for ACME
160-
http01Provider acme.HTTP01Provider
161-
162158
// Authorization.
163159
authorizer auth.Authorizer
164160

@@ -198,7 +194,6 @@ func newDaemon(config *DaemonConfig, os *sys.OS) *Daemon {
198194
devIncusEvents: devIncusEvents,
199195
events: incusEvents,
200196
db: &db.DB{},
201-
http01Provider: acme.NewHTTP01Provider(),
202197
os: os,
203198
setupChan: make(chan struct{}),
204199
waitReady: cancel.New(context.Background()),

‎doc/api-extensions.md

+4
Original file line numberDiff line numberDiff line change
@@ -2740,3 +2740,7 @@ This is used to get the OVN logical switch name.
27402740

27412741
Introduces the `dns.nameservers` configuration option on bridged and OVN networks.
27422742
This allows specifying IPv4 and IPv6 DNS server addresses to be announced by the DHCP server and via Router Advertisements.
2743+
2744+
## `acme_http01_port`
2745+
2746+
Adds `acme.http.port` to control an alternative HTTP port for `HTTP-01` validation.

‎doc/config_options.txt

+8
Original file line numberDiff line numberDiff line change
@@ -2097,6 +2097,14 @@ Possible values are `DNS-01` and `HTTP-01`.
20972097

20982098
```
20992099

2100+
```{config:option} acme.http.port server-acme
2101+
:defaultdesc: "`:80`"
2102+
:scope: "global"
2103+
:shortdesc: "Port and interface for HTTP server (used by HTTP-01)"
2104+
:type: "string"
2105+
Set the port and interface to use for HTTP-01 based challenges to listen on
2106+
```
2107+
21002108
```{config:option} acme.provider server-acme
21012109
:defaultdesc: "``"
21022110
:scope: "global"

‎go.mod

+23-26
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,6 @@ require (
1313
github.com/dustinkirkland/golang-petname v0.0.0-20240428194347-eebcea082ee0
1414
github.com/flosch/pongo2/v6 v6.0.0
1515
github.com/fvbommel/sortorder v1.1.0
16-
github.com/go-acme/lego/v4 v4.22.2
1716
github.com/go-chi/chi/v5 v5.2.1
1817
github.com/go-jose/go-jose/v4 v4.0.5
1918
github.com/go-logr/logr v1.4.2
@@ -35,15 +34,15 @@ require (
3534
github.com/mdlayher/netx v0.0.0-20230430222610-7e21880baee8
3635
github.com/mdlayher/vsock v1.2.1
3736
github.com/miekg/dns v1.1.63
38-
github.com/minio/minio-go/v7 v7.0.87
37+
github.com/minio/minio-go/v7 v7.0.88
3938
github.com/mitchellh/mapstructure v1.5.0
4039
github.com/olekukonko/tablewriter v0.0.5
41-
github.com/opencontainers/runtime-spec v1.2.0
40+
github.com/opencontainers/runtime-spec v1.2.1
4241
github.com/openfga/go-sdk v0.6.5
43-
github.com/osrg/gobgp/v3 v3.34.0
42+
github.com/osrg/gobgp/v3 v3.35.0
4443
github.com/ovn-org/libovsdb v0.7.0
4544
github.com/pierrec/lz4/v4 v4.1.22
46-
github.com/pkg/sftp v1.13.7
45+
github.com/pkg/sftp v1.13.8
4746
github.com/pkg/xattr v0.4.10
4847
github.com/robfig/cron/v3 v3.0.1
4948
github.com/sirupsen/logrus v1.9.3
@@ -52,16 +51,16 @@ require (
5251
github.com/stretchr/testify v1.10.0
5352
github.com/syndtr/gocapability v0.0.0-20200815063812-42c35b437635
5453
github.com/vishvananda/netlink v1.3.0
55-
github.com/zitadel/oidc/v3 v3.35.0
54+
github.com/zitadel/oidc/v3 v3.36.1
5655
go.starlark.net v0.0.0-20250225190231-0d3f41d403af
57-
golang.org/x/crypto v0.35.0
58-
golang.org/x/exp v0.0.0-20250218142911-aa4b98e5adaa
59-
golang.org/x/oauth2 v0.27.0
60-
golang.org/x/sync v0.11.0
61-
golang.org/x/sys v0.30.0
62-
golang.org/x/term v0.29.0
63-
golang.org/x/text v0.22.0
64-
golang.org/x/tools v0.30.0
56+
golang.org/x/crypto v0.36.0
57+
golang.org/x/exp v0.0.0-20250305212735-054e65f0b394
58+
golang.org/x/oauth2 v0.28.0
59+
golang.org/x/sync v0.12.0
60+
golang.org/x/sys v0.31.0
61+
golang.org/x/term v0.30.0
62+
golang.org/x/text v0.23.0
63+
golang.org/x/tools v0.31.0
6564
google.golang.org/protobuf v1.36.5
6665
gopkg.in/tomb.v2 v2.0.0-20161208151619-d5d1b5820637
6766
gopkg.in/yaml.v2 v2.4.0
@@ -77,15 +76,14 @@ require (
7776
github.com/cpuguy83/go-md2man/v2 v2.0.6 // indirect
7877
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
7978
github.com/dgryski/go-farm v0.0.0-20240924180020-3414d57e47da // indirect
80-
github.com/digitalocean/go-libvirt v0.0.0-20250226181018-4d5f24afb7c2 // indirect
79+
github.com/digitalocean/go-libvirt v0.0.0-20250313214939-3c0f2fe97d18 // indirect
8180
github.com/dustin/go-humanize v1.0.1 // indirect
8281
github.com/eapache/channels v1.1.0 // indirect
8382
github.com/eapache/queue v1.1.0 // indirect
8483
github.com/fsnotify/fsnotify v1.8.0 // indirect
8584
github.com/go-ini/ini v1.67.0 // indirect
8685
github.com/go-logr/stdr v1.2.2 // indirect
8786
github.com/goccy/go-json v0.10.5 // indirect
88-
github.com/google/go-cmp v0.7.0 // indirect
8987
github.com/google/renameio v1.0.1 // indirect
9088
github.com/gorilla/securecookie v1.1.2 // indirect
9189
github.com/hashicorp/hcl v1.0.0 // indirect
@@ -110,9 +108,9 @@ require (
110108
github.com/pelletier/go-toml/v2 v2.2.3 // indirect
111109
github.com/pkg/errors v0.9.1 // indirect
112110
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
113-
github.com/prometheus/client_golang v1.21.0 // indirect
111+
github.com/prometheus/client_golang v1.21.1 // indirect
114112
github.com/prometheus/client_model v0.6.1 // indirect
115-
github.com/prometheus/common v0.62.0 // indirect
113+
github.com/prometheus/common v0.63.0 // indirect
116114
github.com/prometheus/procfs v0.15.1 // indirect
117115
github.com/rivo/uniseg v0.4.7 // indirect
118116
github.com/rs/cors v1.11.1 // indirect
@@ -130,15 +128,14 @@ require (
130128
github.com/zitadel/logging v0.6.1 // indirect
131129
github.com/zitadel/schema v1.3.0 // indirect
132130
go.opentelemetry.io/auto/sdk v1.1.0 // indirect
133-
go.opentelemetry.io/otel v1.34.0 // indirect
134-
go.opentelemetry.io/otel/metric v1.34.0 // indirect
135-
go.opentelemetry.io/otel/sdk v1.34.0 // indirect
136-
go.opentelemetry.io/otel/trace v1.34.0 // indirect
131+
go.opentelemetry.io/otel v1.35.0 // indirect
132+
go.opentelemetry.io/otel/metric v1.35.0 // indirect
133+
go.opentelemetry.io/otel/trace v1.35.0 // indirect
137134
go.uber.org/multierr v1.11.0 // indirect
138-
golang.org/x/mod v0.23.0 // indirect
139-
golang.org/x/net v0.35.0 // indirect
140-
google.golang.org/genproto/googleapis/rpc v0.0.0-20250224174004-546df14abb99 // indirect
141-
google.golang.org/grpc v1.70.0 // indirect
135+
golang.org/x/mod v0.24.0 // indirect
136+
golang.org/x/net v0.37.0 // indirect
137+
google.golang.org/genproto/googleapis/rpc v0.0.0-20250313205543-e70fdf4c4cb4 // indirect
138+
google.golang.org/grpc v1.71.0 // indirect
142139
gopkg.in/ini.v1 v1.67.0 // indirect
143140
gopkg.in/yaml.v3 v3.0.1 // indirect
144141
)

0 commit comments

Comments
 (0)