greenlock.js/utils.js

'use strict';

var U = module.exports;

var promisify = require('util').promisify;
//var resolveSoa = promisify(require('dns').resolveSoa);
var resolveMx = promisify(require('dns').resolveMx);
var punycode = require('punycode');
var Keypairs = require('@root/keypairs');
// TODO move to @root
var certParser = require('cert-info');

U._parseDuration = function(str) {
    if ('number' === typeof str) {
        return str;
    }

    var pattern = /^(\-?\d+(\.\d+)?)([wdhms]|ms)$/;
    var matches = str.match(pattern);
    if (!matches || !matches[0]) {
        throw new Error('invalid duration string: ' + str);
    }

    var n = parseInt(matches[1], 10);
    var unit = matches[3];

    switch (unit) {
        case 'w':
            n *= 7;
        /*falls through*/
        case 'd':
            n *= 24;
        /*falls through*/
        case 'h':
            n *= 60;
        /*falls through*/
        case 'm':
            n *= 60;
        /*falls through*/
        case 's':
            n *= 1000;
        /*falls through*/
        case 'ms':
            n *= 1; // for completeness
    }

    return n;
};

U._encodeName = function(str) {
    return punycode.toASCII(str.toLowerCase(str));
};

U._validName = function(str) {
    // A quick check of the 38 and two ½ valid characters
    // 253 char max full domain, including dots
    // 63 char max each label segment
    // Note: * is not allowed, but it's allowable here
    // Note: _ (underscore) is only allowed for "domain names", not "hostnames"
    // Note: - (hyphen) is not allowed as a first character (but a number is)
    return (
        /^(\*\.)?[a-z0-9_\.\-]+$/.test(str) &&
        str.length < 254 &&
        str.split('.').every(function(label) {
            return label.length > 0 && label.length < 64;
        })
    );
};

U._validMx = function(email) {
    var host = email.split('@').slice(1)[0];
    // try twice, just because DNS hiccups sometimes
    // Note: we don't care if the domain exists, just that it *can* exist
    return resolveMx(host).catch(function() {
        return U._timeout(1000).then(function() {
            return resolveMx(host);
        });
    });
};

// should be called after _validName
U._validDomain = function(str) {
    // TODO use @root/dns (currently dns-suite)
    // because node's dns can't read Authority records
    return Promise.resolve(str);
    /*
	// try twice, just because DNS hiccups sometimes
	// Note: we don't care if the domain exists, just that it *can* exist
	return resolveSoa(str).catch(function() {
		return U._timeout(1000).then(function() {
			return resolveSoa(str);
		});
	});
  */
};

// foo.example.com and *.example.com overlap
// should be called after _validName
// (which enforces *. or no *)
U._uniqueNames = function(altnames) {
    var dups = {};
    var wilds = {};
    if (
        altnames.some(function(w) {
            if ('*.' !== w.slice(0, 2)) {
                return;
            }
            if (wilds[w]) {
                return true;
            }
            wilds[w] = true;
        })
    ) {
        return false;
    }

    return altnames.every(function(name) {
        var w;
        if ('*.' !== name.slice(0, 2)) {
            w =
                '*.' +
                name
                    .split('.')
                    .slice(1)
                    .join('.');
        } else {
            return true;
        }

        if (!dups[name] && !dups[w]) {
            dups[name] = true;
            return true;
        }
    });
};

U._timeout = function(d) {
    return new Promise(function(resolve) {
        setTimeout(resolve, d);
    });
};

U._genKeypair = function(keyType) {
    var keyopts;
    var len = parseInt(keyType.replace(/.*?(\d)/, '$1') || 0, 10);
    if (/RSA/.test(keyType)) {
        keyopts = {
            kty: 'RSA',
            modulusLength: len || 2048
        };
    } else if (/^(EC|P\-?\d)/i.test(keyType)) {
        keyopts = {
            kty: 'EC',
            namedCurve: 'P-' + (len || 256)
        };
    } else {
        // TODO put in ./errors.js
        throw new Error('invalid key type: ' + keyType);
    }

    return Keypairs.generate(keyopts).then(function(pair) {
        return U._jwkToSet(pair.private);
    });
};

// TODO use ACME._importKeypair ??
U._importKeypair = function(keypair) {
    // this should import all formats equally well:
    // 'object' (JWK), 'string' (private key pem), kp.privateKeyPem, kp.privateKeyJwk
    if (keypair.private || keypair.d) {
        return U._jwkToSet(keypair.private || keypair);
    }
    if (keypair.privateKeyJwk) {
        return U._jwkToSet(keypair.privateKeyJwk);
    }

    if ('string' !== typeof keypair && !keypair.privateKeyPem) {
        // TODO put in errors
        throw new Error('missing private key');
    }

    return Keypairs.import({ pem: keypair.privateKeyPem || keypair }).then(
        function(priv) {
            if (!priv.d) {
                throw new Error('missing private key');
            }
            return U._jwkToSet(priv);
        }
    );
};

U._jwkToSet = function(jwk) {
    var keypair = {
        privateKeyJwk: jwk
    };
    return Promise.all([
        Keypairs.export({
            jwk: jwk,
            encoding: 'pem'
        }).then(function(pem) {
            keypair.privateKeyPem = pem;
        }),
        Keypairs.export({
            jwk: jwk,
            encoding: 'pem',
            public: true
        }).then(function(pem) {
            keypair.publicKeyPem = pem;
        }),
        Keypairs.publish({
            jwk: jwk
        }).then(function(pub) {
            keypair.publicKeyJwk = pub;
        })
    ]).then(function() {
        return keypair;
    });
};

U._attachCertInfo = function(results) {
    var certInfo = certParser.info(results.cert);

    // subject, altnames, issuedAt, expiresAt
    Object.keys(certInfo).forEach(function(key) {
        results[key] = certInfo[key];
    });

    return results;
};

U._certHasDomain = function(certInfo, _domain) {
    var names = (certInfo.altnames || []).slice(0);
    return names.some(function(name) {
        var domain = _domain.toLowerCase();
        name = name.toLowerCase();
        if ('*.' === name.substr(0, 2)) {
            name = name.substr(2);
            domain = domain
                .split('.')
                .slice(1)
                .join('.');
        }
        return name === domain;
    });
};

// a bit heavy to be labeled 'utils'... perhaps 'common' would be better?
U._getOrCreateKeypair = function(db, subject, query, keyType, mustExist) {
    var exists = false;
    return db
        .checkKeypair(query)
        .then(function(kp) {
            if (kp) {
                exists = true;
                return U._importKeypair(kp);
            }

            if (mustExist) {
                // TODO put in errors
                throw new Error(
                    'required keypair not found: ' +
                        (subject || '') +
                        ' ' +
                        JSON.stringify(query)
                );
            }

            return U._genKeypair(keyType);
        })
        .then(function(keypair) {
            return { exists: exists, keypair: keypair };
        });
};

U._getKeypair = function(db, subject, query) {
    return U._getOrCreateKeypair(db, subject, query, '', true).then(function(
        result
    ) {
        return result.keypair;
    });
};