ndncert: ServerDnsChallenge

Author: yoursunny

pkg/ndncert/README.md

@@ -21,7 +21,7 @@ Challenges:
 * [X] PIN
 * [X] email, with name assignment policy
 * [X] proof of possession, with name assignment policy
-* [ ] DNS
+* [X] DNS
 * [X] "nop" (not in NDNCERT spec)
 
 `@ndn/keychain-cli` package offers `ndnts-keychain ndncert03-make-profile`, `ndnts-keychain ndncert03-show-profile`, `ndnts-keychain ndncert03-ca`, `ndnts-keychain ndncert03-probe`, and `ndnts-keychain ndncert03-client` commands that use this implementation.

pkg/ndncert/package.json

@@ -38,6 +38,7 @@
     "ajv": "^8.20.0",
     "b64-lite": "^1.4.0",
     "imap-emails": "^1.0.4",
+    "is-valid-hostname": "^1.0.2",
     "nodemailer": "^9.0.1",
     "p-timeout": "^7.0.1",
     "tslib": "^2.8.1",
@@ -48,6 +49,9 @@
     "@ndn/fw": "workspace:^",
     "@ndn/repo": "workspace:*",
     "@types/b64-lite": "^1.4.2",
-    "@types/mailparser": "^3.4.6"
+    "@types/koa": "^3.0.3",
+    "@types/mailparser": "^3.4.6",
+    "cf-doh": "^1.1.1",
+    "koa": "^3.2.1"
   }
 }

pkg/ndncert/src/client/request.ts

@@ -49,7 +49,7 @@ export async function requestCertificate({
 }: ClientOptions): Promise<Certificate> {
   cOpts = {
     describe: `NDNCERT-client(${profile.prefix}, REQUEST, ${privateKey.name})`,
-    retx: 4,
+    retx: 4, // XXX retransmission may cause server rejection for duplicate SigNonce
     ...cOpts,
     verifier: profile.publicKey,
   };

pkg/ndncert/src/packet/challenge-response.ts

@@ -66,7 +66,7 @@ function checkFieldsByStatus({
       ];
     }
     default: {
-      if (!challengeStatus || !remainingTries || !remainingTime) {
+      if (!challengeStatus || remainingTries === undefined || remainingTime === undefined) {
         throw new Error("challengeStatus, remainingTries, remainingTime missing");
       }
       return () => [

pkg/ndncert/src/server/challenge.ts

@@ -1,6 +1,6 @@
 import type { Name } from "@ndn/packet";
 
-import type { CaProfile, ChallengeRequest, ParameterKV } from "../packet/mod";
+import type { CaProfile, ChallengeRequest, ErrorCode, ParameterKV } from "../packet/mod";
 
 /** Server side of a challenge. */
 export interface ServerChallenge<State = any> {
@@ -47,6 +47,9 @@ export interface ServerChallengeResponse {
    */
   success?: boolean;
 
+  /** If specified, challenge has failed permanently and server will return error. */
+  fail?: ErrorCode;
+
   /**
    * If true, this request counts as one failed try and decrements remaining tries.
    * @defaultValue false

pkg/ndncert/src/server/dns-challenge.ts

@@ -0,0 +1,115 @@
+import { SigInfo } from "@ndn/packet";
+import { fromUtf8, toHex, toUtf8 } from "@ndn/util";
+import type { DOHResponse } from "cf-doh";
+import isValidHostname from "is-valid-hostname";
+
+import { type ChallengeRequest, ErrorCode } from "../packet/mod";
+import type { ServerChallenge, ServerChallengeContext, ServerChallengeResponse } from "./challenge";
+
+interface State {
+  record: string;
+  token: string;
+}
+
+/** The "dns" challenge where client creates a DNS TXT record. */
+export class ServerDnsChallenge implements ServerChallenge<State> {
+  public readonly challengeId = "dns";
+  public readonly timeLimit = 300000;
+  public readonly retryLimit = 3;
+
+  private readonly dohServer: string;
+
+  constructor({
+    dohServer = "https://cloudflare-dns.com/dns-query",
+  }: ServerDnsChallenge.Options = {}) {
+    this.dohServer = dohServer;
+  }
+
+  public async process(request: ChallengeRequest, context: ServerChallengeContext<State>): Promise<ServerChallengeResponse> {
+    if (!context.challengeState) {
+      return this.process0(request, context);
+    }
+    return this.process1(request, context);
+  }
+
+  private async process0(request: ChallengeRequest, context: ServerChallengeContext<State>): Promise<ServerChallengeResponse> {
+    const { domain: domainWire } = request.parameters;
+    let domain: string;
+    if (!domainWire || !isValidHostname(domain = fromUtf8(domainWire))) {
+      return { fail: ErrorCode.InvalidParameters };
+    }
+
+    const record = `_ndncert-challenge.${domain}`;
+    const token = toHex(SigInfo.generateNonce(16));
+    context.challengeState = { record, token };
+    return {
+      challengeStatus: "need-record",
+      parameters: {
+        "record-name": toUtf8(record),
+        "expected-value": toUtf8(token),
+      },
+    };
+  }
+
+  private async process1(
+      request: ChallengeRequest,
+      { challengeState }: ServerChallengeContext<State>,
+  ): Promise<ServerChallengeResponse> {
+    const { confirmation } = request.parameters;
+    if (!confirmation) {
+      return { fail: ErrorCode.InvalidParameters };
+    }
+
+    let ok: boolean;
+    try {
+      ok = await this.checkRecord(challengeState!);
+    } catch {
+      ok = false;
+    }
+    return ok ? { success: true } : {
+      decrementRetry: true,
+      challengeStatus: "wrong-record",
+    };
+  }
+
+  private async checkRecord({ record, token }: State): Promise<boolean> {
+    const url = new URL(this.dohServer);
+    url.searchParams.set("name", record);
+    url.searchParams.set("type", "TXT");
+
+    console.log("sdccr", url);
+    const res = await fetch(url, { headers: { Accept: "application/dns-json" } });
+    console.log("sdccr", res);
+    if (res.status !== 200) {
+      return false;
+    }
+    const j: DOHResponse = await res.json();
+    console.log("sdccr", j);
+
+    if (Number(j.Status) !== 0) {
+      return false;
+    }
+    for (const answer of j.Answer ?? []) {
+      if (
+        [record, `${record}.`].includes(answer.name) &&
+        Number(answer.type) === 16 &&
+        [token, `"${token}"`].includes(answer.data)
+      ) {
+        return true;
+      }
+    }
+    return false;
+  }
+}
+
+export namespace ServerDnsChallenge {
+  export interface Options {
+    /**
+     * DNS-over-HTTPS server with application/dns-json capability.
+     * Common choices includes:
+     * - https://cloudflare-dns.com/dns-query
+     * - https://dns.google/resolve
+     */
+    dohServer?: string;
+  }
+}

pkg/ndncert/src/server/mod.ts

@@ -1,4 +1,5 @@
 export type * from "./challenge";
+export * from "./dns-challenge";
 export * from "./email-challenge_node";
 export * from "./nop-challenge";
 export * from "./pin-challenge";

pkg/ndncert/src/server/server.ts

@@ -232,17 +232,32 @@ export class Server {
 
   private async continueChallenge(now: number, request: ChallengeRequest, context: Context) {
     const challenge = this.challenges.get(context.challengeId!)!;
-    const {
+    let {
       success = false,
+      fail,
       decrementRetry = false,
       challengeStatus = "error",
       parameters,
     } = await challenge.process(request, context);
     if (success) {
       return this.finishChallenge(now, request, context);
     }
+
     if (decrementRetry) {
       context.challengeRemainingTries! -= 1;
+      if (context.challengeRemainingTries! <= 0) {
+        fail ??= ErrorCode.OutOfTries;
+      }
+    }
+
+    const remainingTime = context.expiry - now;
+    if (remainingTime <= 0) {
+      fail ??= ErrorCode.OutOfTime;
+    }
+
+    if (fail) {
+      this.deleteContext(request);
+      return ErrorMsg.makeData(fail, request.interest, this.signer);
     }
 
     const response = await ChallengeResponse.build({
@@ -251,7 +266,7 @@ export class Server {
       challengeStatus,
       parameters,
       remainingTries: context.challengeRemainingTries!,
-      remainingTime: context.expiry - now,
+      remainingTime,
     });
     return response.data;
   }