diff --git a/index.js b/index.js index e2d827e..59a51c5 100644 --- a/index.js +++ b/index.js @@ -19,7 +19,7 @@ ACME.splitPemChain = function splitPemChain(str) { return str .trim() .split(/[\r\n]{2,}/g) - .map(function(str) { + .map(function (str) { return str + '\n'; }); }; @@ -31,14 +31,14 @@ ACME.challengePrefixes = { 'dns-01': '_acme-challenge' }; ACME.challengeTests = { - 'http-01': function(me, auth) { + 'http-01': function (me, auth) { var url = 'http://' + auth.hostname + ACME.challengePrefixes['http-01'] + '/' + auth.token; - return me._request({ url: url }).then(function(resp) { + return me._request({ url: url }).then(function (resp) { var err; // TODO limit the number of bytes that are allowed to be downloaded @@ -63,18 +63,18 @@ ACME.challengeTests = { return Promise.reject(err); }); }, - 'dns-01': function(me, auth) { + 'dns-01': function (me, auth) { // remove leading *. on wildcard domains return me ._dig({ type: 'TXT', name: auth.dnsHost }) - .then(function(ans) { + .then(function (ans) { var err; if ( - ans.answer.some(function(txt) { + ans.answer.some(function (txt) { return auth.dnsAuthorization === txt.data[0]; }) ) { @@ -96,7 +96,7 @@ ACME.challengeTests = { } }; -ACME._getUserAgentString = function(deps) { +ACME._getUserAgentString = function (deps) { var uaDefaults = { pkg: 'Greenlock/' + deps.pkg.version, os: @@ -116,7 +116,7 @@ ACME._getUserAgentString = function(deps) { var userAgent = []; //Object.keys(currentUAProps) - Object.keys(uaDefaults).forEach(function(key) { + Object.keys(uaDefaults).forEach(function (key) { if (uaDefaults[key]) { userAgent.push(uaDefaults[key]); } @@ -124,19 +124,19 @@ ACME._getUserAgentString = function(deps) { return userAgent.join(' ').trim(); }; -ACME._directory = function(me) { +ACME._directory = function (me) { return me._request({ url: me.directoryUrl, json: true }); }; -ACME._getNonce = function(me) { +ACME._getNonce = function (me) { if (me._nonce) { - return new Promise(function(resolve) { + return new Promise(function (resolve) { resolve(me._nonce); return; }); } return me ._request({ method: 'HEAD', url: me._directoryUrls.newNonce }) - .then(function(resp) { + .then(function (resp) { me._nonce = resp.toJSON().headers['replay-nonce']; return me._nonce; }); @@ -161,13 +161,13 @@ ACME._getNonce = function(me) { "signature": "RZPOnYoPs1PhjszF...-nh6X1qtOFPB519I" } */ -ACME._registerAccount = function(me, options) { +ACME._registerAccount = function (me, options) { if (me.debug) { console.debug('[acme-v2] accounts.create'); } - return ACME._getNonce(me).then(function() { - return new Promise(function(resolve, reject) { + return ACME._getNonce(me).then(function () { + return new Promise(function (resolve, reject) { function agree(tosUrl) { var err; if (me._tos !== tosUrl) { @@ -230,7 +230,7 @@ ACME._registerAccount = function(me, options) { headers: { 'Content-Type': 'application/jose+json' }, json: jws }) - .then(function(resp) { + .then(function (resp) { var account = resp.body; if (2 !== Math.floor(resp.statusCode / 100)) { @@ -292,7 +292,7 @@ ACME._registerAccount = function(me, options) { ); } else if (2 === options.agreeToTerms.length) { // backwards compat cb API - return options.agreeToTerms(me._tos, function(err, tosUrl) { + return options.agreeToTerms(me._tos, function (err, tosUrl) { if (!err) { agree(tosUrl); return; @@ -330,26 +330,24 @@ ACME._registerAccount = function(me, options) { "signature": "H6ZXtGjTZyUnPeKn...wEA4TklBdh3e454g" } */ -ACME._getChallenges = function(me, options, auth) { +ACME._getChallenges = function (me, options, auth) { if (me.debug) { console.debug('\n[DEBUG] getChallenges\n'); } return me ._request({ method: 'GET', url: auth, json: true }) - .then(function(resp) { + .then(function (resp) { return resp.body; }); }; ACME._wait = function wait(ms) { - return new Promise(function(resolve) { + return new Promise(function (resolve) { setTimeout(resolve, ms || 1100); }); }; -ACME._testChallengeOptions = function() { - var chToken = require('crypto') - .randomBytes(16) - .toString('hex'); +ACME._testChallengeOptions = function () { + var chToken = require('crypto').randomBytes(16).toString('hex'); return [ { type: 'http-01', @@ -378,18 +376,18 @@ ACME._testChallengeOptions = function() { } ]; }; -ACME._testChallenges = function(me, options) { +ACME._testChallenges = function (me, options) { if (me.skipChallengeTest) { return Promise.resolve(); } var CHECK_DELAY = 0; return Promise.all( - options.domains.map(function(identifierValue) { + options.domains.map(function (identifierValue) { // TODO we really only need one to pass, not all to pass var challenges = ACME._testChallengeOptions(); if (identifierValue.includes('*')) { - challenges = challenges.filter(function(ch) { + challenges = challenges.filter(function (ch) { return ch._wildcard; }); } @@ -402,7 +400,7 @@ ACME._testChallenges = function(me, options) { var enabled = options.challengeTypes.join(', ') || 'none'; var suitable = challenges - .map(function(r) { + .map(function (r) { return r.type; }) .join(', ') || 'none'; @@ -425,7 +423,7 @@ ACME._testChallenges = function(me, options) { CHECK_DELAY = 1.5 * 1000; } - return Promise.resolve().then(function() { + return Promise.resolve().then(function () { var results = { identifier: { type: 'dns', @@ -443,27 +441,27 @@ ACME._testChallenges = function(me, options) { challenge, dryrun ); - return ACME._setChallenge(me, options, auth).then(function() { + return ACME._setChallenge(me, options, auth).then(function () { return auth; }); }); }) - ).then(function(auths) { - return ACME._wait(CHECK_DELAY).then(function() { + ).then(function (auths) { + return ACME._wait(CHECK_DELAY).then(function () { return Promise.all( - auths.map(function(auth) { + auths.map(function (auth) { return ACME.challengeTests[auth.type](me, auth); }) ); }); }); }; -ACME._chooseChallenge = function(options, results) { +ACME._chooseChallenge = function (options, results) { // For each of the challenge types that we support var challenge; - options.challengeTypes.some(function(chType) { + options.challengeTypes.some(function (chType) { // And for each of the challenge types that are allowed - return results.challenges.some(function(ch) { + return results.challenges.some(function (ch) { // Check to see if there are any matches if (ch.type === chType) { challenge = ch; @@ -474,9 +472,9 @@ ACME._chooseChallenge = function(options, results) { return challenge; }; -ACME._depInit = function(me, options) { +ACME._depInit = function (me, options) { if ('function' !== typeof options.init) { - options.init = function() { + options.init = function () { return Promise.resolve(null); }; } @@ -489,9 +487,9 @@ ACME._depInit = function(me, options) { 'null' ); }; -ACME._getZones = function(me, options, dnsHosts) { +ACME._getZones = function (me, options, dnsHosts) { if ('function' !== typeof options.getZones) { - options.getZones = function() { + options.getZones = function () { return Promise.resolve([]); }; } @@ -507,15 +505,15 @@ ACME._getZones = function(me, options, dnsHosts) { ); }; -ACME._wrapCb = function(me, options, _name, stuff, _desc) { - return new Promise(function(resolve, reject) { +ACME._wrapCb = function (me, options, _name, stuff, _desc) { + return new Promise(function (resolve, reject) { try { if (options[_name].length <= 1) { return Promise.resolve(options[_name](stuff)) .then(resolve) .catch(reject); } else if (2 === options[_name].length) { - options[_name](stuff, function(err, zonenames) { + options[_name](stuff, function (err, zonenames) { if (err) { reject(err); } else { @@ -544,26 +542,23 @@ function newZoneRegExp(zonename) { } function pluckZone(zonenames, dnsHost) { return zonenames - .filter(function(zonename) { + .filter(function (zonename) { // the only character that needs to be escaped for regex // and is allowed in a domain name is '.' return newZoneRegExp(zonename).test(dnsHost); }) - .sort(function(a, b) { + .sort(function (a, b) { // longest match first return b.length - a.length; })[0]; } -ACME._challengeToAuth = function(me, options, request, challenge, dryrun) { +ACME._challengeToAuth = function (me, options, request, challenge, dryrun) { // we don't poison the dns cache with our dummy request var dnsPrefix = ACME.challengePrefixes['dns-01']; if (dryrun) { dnsPrefix = dnsPrefix.replace( 'acme-challenge', - 'greenlock-dryrun-' + - Math.random() - .toString() - .slice(2, 6) + 'greenlock-dryrun-' + Math.random().toString().slice(2, 6) ); } @@ -571,14 +566,14 @@ ACME._challengeToAuth = function(me, options, request, challenge, dryrun) { // straight copy from the new order response // { identifier, status, expires, challenges, wildcard } - Object.keys(request).forEach(function(key) { + Object.keys(request).forEach(function (key) { auth[key] = request[key]; }); // copy from the challenge we've chosen // { type, status, url, token } // (note the duplicate status overwrites the one above, but they should be the same) - Object.keys(challenge).forEach(function(key) { + Object.keys(challenge).forEach(function (key) { // don't confused devs with the id url auth[key] = challenge[key]; }); @@ -618,7 +613,7 @@ ACME._challengeToAuth = function(me, options, request, challenge, dryrun) { return auth; }; -ACME._untame = function(name, wild) { +ACME._untame = function (name, wild) { if (wild) { name = '*.' + name.replace('*.', ''); } @@ -626,7 +621,7 @@ ACME._untame = function(name, wild) { }; // https://tools.ietf.org/html/draft-ietf-acme-acme-10#section-7.5.1 -ACME._postChallenge = function(me, options, auth) { +ACME._postChallenge = function (me, options, auth) { var RETRY_INTERVAL = me.retryInterval || 1000; var DEAUTH_INTERVAL = me.deauthWait || 10 * 1000; var MAX_POLL = me.retryPoll || 8; @@ -673,7 +668,7 @@ ACME._postChallenge = function(me, options, auth) { headers: { 'Content-Type': 'application/jose+json' }, json: jws }) - .then(function(resp) { + .then(function (resp) { if (me.debug) { console.debug('[acme-v2.js] deactivate:'); } @@ -716,7 +711,7 @@ ACME._postChallenge = function(me, options, auth) { } return me ._request({ method: 'GET', url: auth.url, json: true }) - .then(function(resp) { + .then(function (resp) { if ('processing' === resp.body.status) { if (me.debug) { console.debug('poll: again'); @@ -744,9 +739,12 @@ ACME._postChallenge = function(me, options, auth) { try { if (1 === options.removeChallenge.length) { - options.removeChallenge(auth).then(function() {}, function() {}); + options.removeChallenge(auth).then( + function () {}, + function () {} + ); } else if (2 === options.removeChallenge.length) { - options.removeChallenge(auth, function(err) { + options.removeChallenge(auth, function (err) { return err; }); } else { @@ -762,7 +760,7 @@ ACME._postChallenge = function(me, options, auth) { options.removeChallenge( auth.request.identifier, auth.token, - function() {} + function () {} ); } } catch (e) {} @@ -815,7 +813,7 @@ ACME._postChallenge = function(me, options, auth) { headers: { 'Content-Type': 'application/jose+json' }, json: jws }) - .then(function(resp) { + .then(function (resp) { if (me.debug) { console.debug('[acme-v2.js] challenge accepted!'); } @@ -842,16 +840,13 @@ ACME._postChallenge = function(me, options, auth) { return respondToChallenge(); }; -ACME._setChallenge = function(me, options, auth) { - return new Promise(function(resolve, reject) { +ACME._setChallenge = function (me, options, auth) { + return new Promise(function (resolve, reject) { try { if (1 === options.setChallenge.length) { - options - .setChallenge(auth) - .then(resolve) - .catch(reject); + options.setChallenge(auth).then(resolve).catch(reject); } else if (2 === options.setChallenge.length) { - options.setChallenge(auth, function(err) { + options.setChallenge(auth, function (err) { if (err) { reject(err); } else { @@ -859,7 +854,7 @@ ACME._setChallenge = function(me, options, auth) { } }); } else { - var challengeCb = function(err) { + var challengeCb = function (err) { if (err) { reject(err); } else { @@ -867,7 +862,7 @@ ACME._setChallenge = function(me, options, auth) { } }; // for backwards compat adding extra keys without changing params length - Object.keys(auth).forEach(function(key) { + Object.keys(auth).forEach(function (key) { challengeCb[key] = auth[key]; }); if (!ACME._setChallengeWarn) { @@ -889,7 +884,7 @@ ACME._setChallenge = function(me, options, auth) { } catch (e) { reject(e); } - }).then(function() { + }).then(function () { // TODO: Do we still need this delay? Or shall we leave it to plugins to account for themselves? var DELAY = me.setChallengeWait || 500; if (me.debug) { @@ -898,7 +893,7 @@ ACME._setChallenge = function(me, options, auth) { return ACME._wait(DELAY); }); }; -ACME._finalizeOrder = function(me, options, validatedDomains) { +ACME._finalizeOrder = function (me, options, validatedDomains) { if (me.debug) { console.debug('finalizeOrder:'); } @@ -930,7 +925,7 @@ ACME._finalizeOrder = function(me, options, validatedDomains) { headers: { 'Content-Type': 'application/jose+json' }, json: jws }) - .then(function(resp) { + .then(function (resp) { // https://tools.ietf.org/html/draft-ietf-acme-acme-12#section-7.1.3 // Possible values are: "pending" => ("invalid" || "ready") => "processing" => "valid" me._nonce = resp.toJSON().headers['replay-nonce']; @@ -1033,7 +1028,7 @@ ACME._finalizeOrder = function(me, options, validatedDomains) { return pollCert(); }; -ACME._getCertificate = function(me, options) { +ACME._getCertificate = function (me, options) { if (me.debug) { console.debug('[acme-v2] DEBUG get cert 1'); } @@ -1046,7 +1041,7 @@ ACME._getCertificate = function(me, options) { options.challengeTypes = [options.challengeType].filter(Boolean); } if (options.challengeType) { - options.challengeTypes.sort(function(a, b) { + options.challengeTypes.sort(function (a, b) { if (a === options.challengeType) { return -1; } @@ -1093,36 +1088,32 @@ ACME._getCertificate = function(me, options) { } else { //return Promise.reject(new Error("must include KeyID")); // This is an idempotent request. It'll return the same account for the same public key. - return ACME._registerAccount(me, options).then(function() { + return ACME._registerAccount(me, options).then(function () { // start back from the top return ACME._getCertificate(me, options); }); } } - var dnsHosts = options.domains.map(function(d) { - return ( - require('crypto') - .randomBytes(2) - .toString('hex') + d - ); + var dnsHosts = options.domains.map(function (d) { + return require('crypto').randomBytes(2).toString('hex') + d; }); - return ACME._depInit(me, options, dnsHosts).then(function(nada) { + return ACME._depInit(me, options, dnsHosts).then(function (nada) { if (nada) { // fake use of nada to make both _wrapCb and jshint happy } - return ACME._getZones(me, options, dnsHosts).then(function(zonenames) { + return ACME._getZones(me, options, dnsHosts).then(function (zonenames) { options.zonenames = zonenames; // Do a little dry-run / self-test - return ACME._testChallenges(me, options).then(function() { + return ACME._testChallenges(me, options).then(function () { if (me.debug) { console.debug('[acme-v2] certificates.create'); } - return ACME._getNonce(me).then(function() { + return ACME._getNonce(me).then(function () { var body = { // raw wildcard syntax MUST be used here identifiers: options.domains - .sort(function(a, b) { + .sort(function (a, b) { // the first in the list will be the subject of the certificate, I believe (and hope) if (!options.subject) { return 0; @@ -1135,7 +1126,7 @@ ACME._getCertificate = function(me, options) { } return 0; }) - .map(function(hostname) { + .map(function (hostname) { return { type: 'dns', value: hostname }; }) //, "notBefore": "2016-01-01T00:00:00Z" @@ -1172,7 +1163,7 @@ ACME._getCertificate = function(me, options) { headers: { 'Content-Type': 'application/jose+json' }, json: jws }) - .then(function(resp) { + .then(function (resp) { me._nonce = resp.toJSON().headers['replay-nonce']; var location = resp.toJSON().headers.location; var setAuths; @@ -1209,41 +1200,41 @@ ACME._getCertificate = function(me, options) { return; } - return ACME._getChallenges(me, options, authUrl).then(function( - results - ) { - // var domain = options.domains[i]; // results.identifier.value + return ACME._getChallenges(me, options, authUrl).then( + function (results) { + // var domain = options.domains[i]; // results.identifier.value - // If it's already valid, we're golden it regardless - if ( - results.challenges.some(function(ch) { - return 'valid' === ch.status; - }) - ) { - return setNext(); - } + // If it's already valid, we're golden it regardless + if ( + results.challenges.some(function (ch) { + return 'valid' === ch.status; + }) + ) { + return setNext(); + } - var challenge = ACME._chooseChallenge(options, results); - if (!challenge) { - // For example, wildcards require dns-01 and, if we don't have that, we have to bail - return Promise.reject( - new Error( - "Server didn't offer any challenge we can handle for '" + - options.domains.join() + - "'." - ) + var challenge = ACME._chooseChallenge(options, results); + if (!challenge) { + // For example, wildcards require dns-01 and, if we don't have that, we have to bail + return Promise.reject( + new Error( + "Server didn't offer any challenge we can handle for '" + + options.domains.join() + + "'." + ) + ); + } + + var auth = ACME._challengeToAuth( + me, + options, + results, + challenge ); + auths.push(auth); + return ACME._setChallenge(me, options, auth).then(setNext); } - - var auth = ACME._challengeToAuth( - me, - options, - results, - challenge - ); - auths.push(auth); - return ACME._setChallenge(me, options, auth).then(setNext); - }); + ); } function challengeNext() { @@ -1261,17 +1252,17 @@ ACME._getCertificate = function(me, options) { // Doing otherwise would potentially cause us to poison our own DNS cache with misses return setNext() .then(challengeNext) - .then(function() { + .then(function () { if (me.debug) { console.debug('[getCertificate] next.then'); } - var validatedDomains = body.identifiers.map(function(ident) { + var validatedDomains = body.identifiers.map(function (ident) { return ident.value; }); return ACME._finalizeOrder(me, options, validatedDomains); }) - .then(function(order) { + .then(function (order) { if (me.debug) { console.debug('acme-v2: order was finalized'); } @@ -1281,7 +1272,7 @@ ACME._getCertificate = function(me, options) { url: me._certificate, json: true }) - .then(function(resp) { + .then(function (resp) { if (me.debug) { console.debug( 'acme-v2: csr submitted and cert received:' @@ -1322,18 +1313,18 @@ ACME.create = function create(me) { me.RSA = me.RSA || require('rsa-compat').RSA; //me.Keypairs = me.Keypairs || require('keypairs'); me.request = me.request || require('@root/request'); - me._dig = function(query) { + me._dig = function (query) { // TODO use digd.js - return new Promise(function(resolve, reject) { + return new Promise(function (resolve, reject) { var dns = require('dns'); - dns.resolveTxt(query.name, function(err, records) { + dns.resolveTxt(query.name, function (err, records) { if (err) { reject(err); return; } resolve({ - answer: records.map(function(rr) { + answer: records.map(function (rr) { return { data: rr }; @@ -1371,7 +1362,7 @@ ACME.create = function create(me) { me._request = me.promisify(getRequest({})); } - me.init = function(_directoryUrl) { + me.init = function (_directoryUrl) { if (_directoryUrl) { _directoryUrl = _directoryUrl.directoryUrl || _directoryUrl; } @@ -1393,28 +1384,25 @@ ACME.create = function create(me) { console.warn('\t' + me.directoryUrl.replace('-staging', '')); console.warn(); } - return ACME._directory(me).then(function(resp) { + return ACME._directory(me).then(function (resp) { me._directoryUrls = resp.body; me._tos = me._directoryUrls.meta.termsOfService; return me._directoryUrls; }); }; me.accounts = { - create: function(options) { + create: function (options) { return ACME._registerAccount(me, options); } }; me.certificates = { - create: function(options) { + create: function (options) { return ACME._getCertificate(me, options); } }; return me; }; -ACME._toWebsafeBase64 = function(b64) { - return b64 - .replace(/\+/g, '-') - .replace(/\//g, '_') - .replace(/=/g, ''); +ACME._toWebsafeBase64 = function (b64) { + return b64.replace(/\+/g, '-').replace(/\//g, '_').replace(/=/g, ''); };