ndncert: ServerDnsChallenge

Author: yoursunny

pkg/ndncert/package.json

@@ -38,6 +38,7 @@
     "ajv": "^8.20.0",
     "b64-lite": "^1.4.0",
     "imap-emails": "^1.0.4",
+    "is-valid-hostname": "^1.0.2",
     "nodemailer": "^9.0.1",
     "p-timeout": "^7.0.1",
     "tslib": "^2.8.1",
@@ -48,6 +49,9 @@
     "@ndn/fw": "workspace:^",
     "@ndn/repo": "workspace:*",
     "@types/b64-lite": "^1.4.2",
-    "@types/mailparser": "^3.4.6"
+    "@types/koa": "^3.0.3",
+    "@types/mailparser": "^3.4.6",
+    "cf-doh": "^1.1.1",
+    "koa": "^3.2.1"
   }
 }

pkg/ndncert/src/client/request.ts

@@ -49,7 +49,7 @@ export async function requestCertificate({
 }: ClientOptions): Promise<Certificate> {
   cOpts = {
     describe: `NDNCERT-client(${profile.prefix}, REQUEST, ${privateKey.name})`,
-    retx: 4,
+    retx: 4, // XXX retransmission may cause server rejection for duplicate SigNonce
     ...cOpts,
     verifier: profile.publicKey,
   };

pkg/ndncert/src/packet/challenge-response.ts

@@ -66,7 +66,7 @@ function checkFieldsByStatus({
       ];
     }
     default: {
-      if (!challengeStatus || !remainingTries || !remainingTime) {
+      if (!challengeStatus || remainingTries === undefined || remainingTime === undefined) {
         throw new Error("challengeStatus, remainingTries, remainingTime missing");
       }
       return () => [

pkg/ndncert/src/server/dns-challenge.ts

@@ -0,0 +1,118 @@
+import { SigInfo } from "@ndn/packet";
+import { fromUtf8, toHex, toUtf8 } from "@ndn/util";
+import type { DOHResponse } from "cf-doh";
+import isValidHostname from "is-valid-hostname";
+
+import type { ChallengeRequest } from "../packet/mod";
+import type { ServerChallenge, ServerChallengeContext, ServerChallengeResponse } from "./challenge";
+
+interface State {
+  record: string;
+  token: string;
+}
+
+/** The "dns" challenge where client creates a DNS TXT record. */
+export class ServerDnsChallenge implements ServerChallenge<State> {
+  public readonly challengeId = "dns";
+  public readonly timeLimit = 300000;
+  public readonly retryLimit = 3;
+
+  private readonly dohServer: string;
+
+  constructor({
+    dohServer = "https://cloudflare-dns.com/dns-query",
+  }: ServerDnsChallenge.Options = {}) {
+    this.dohServer = dohServer;
+  }
+
+  public async process(request: ChallengeRequest, context: ServerChallengeContext<State>): Promise<ServerChallengeResponse> {
+    if (!context.challengeState) {
+      return this.process0(request, context);
+    }
+    return this.process1(request, context);
+  }
+
+  private async process0(request: ChallengeRequest, context: ServerChallengeContext<State>): Promise<ServerChallengeResponse> {
+    const { domain: domainWire } = request.parameters;
+    if (!domainWire) {
+      return { challengeStatus: "missing-domain" };
+    }
+    const domain = fromUtf8(domainWire);
+    if (!isValidHostname(domain)) {
+      return { challengeStatus: "invalid-domain" };
+    }
+
+    const record = `_ndncert-challenge.${domain}`;
+    const token = toHex(SigInfo.generateNonce(16));
+    context.challengeState = { record, token };
+    return {
+      challengeStatus: "need-record",
+      parameters: {
+        "record-name": toUtf8(record),
+        "expected-value": toUtf8(token),
+      },
+    };
+  }
+
+  private async process1(
+      request: ChallengeRequest,
+      { challengeState }: ServerChallengeContext<State>,
+  ): Promise<ServerChallengeResponse> {
+    const { confirmation } = request.parameters;
+    if (!confirmation) {
+      return { challengeStatus: "missing-confirmation" };
+    }
+
+    let ok: boolean;
+    try {
+      ok = await this.checkRecord(challengeState!);
+    } catch {
+      ok = false;
+    }
+    return ok ? { success: true } : {
+      decrementRetry: true,
+      challengeStatus: "wrong-record",
+    };
+  }
+
+  private async checkRecord({ record, token }: State): Promise<boolean> {
+    const url = new URL(this.dohServer);
+    url.searchParams.set("name", record);
+    url.searchParams.set("type", "TXT");
+
+    console.log("sdccr", url);
+    const res = await fetch(url, { headers: { Accept: "application/dns-json" } });
+    console.log("sdccr", res);
+    if (res.status !== 200) {
+      return false;
+    }
+    const j: DOHResponse = await res.json();
+    console.log("sdccr", j);
+
+    if (Number(j.Status) !== 0) {
+      return false;
+    }
+    for (const answer of j.Answer ?? []) {
+      if (
+        [record, `${record}.`].includes(answer.name) &&
+        Number(answer.type) === 16 &&
+        [token, `"${token}"`].includes(answer.data)
+      ) {
+        return true;
+      }
+    }
+    return false;
+  }
+}
+
+export namespace ServerDnsChallenge {
+  export interface Options {
+    /**
+     * DNS-over-HTTPS server with application/dns-json capability.
+     * Common choices includes:
+     * - https://cloudflare-dns.com/dns-query
+     * - https://dns.google/resolve
+     */
+    dohServer?: string;
+  }
+}

pkg/ndncert/src/server/mod.ts

@@ -1,4 +1,5 @@
 export type * from "./challenge";
+export * from "./dns-challenge";
 export * from "./email-challenge_node";
 export * from "./nop-challenge";
 export * from "./pin-challenge";

pkg/ndncert/src/server/server.ts

@@ -245,13 +245,23 @@ export class Server {
       context.challengeRemainingTries! -= 1;
     }
 
+    if (context.challengeRemainingTries! <= 0) {
+      this.deleteContext(request);
+      return ErrorMsg.makeData(ErrorCode.OutOfTries, request.interest, this.signer);
+    }
+    const remainingTime = context.expiry - now;
+    if (remainingTime <= 0) {
+      this.deleteContext(request);
+      return ErrorMsg.makeData(ErrorCode.OutOfTime, request.interest, this.signer);
+    }
+
     const response = await ChallengeResponse.build({
       ...this.makeResponseCommon(request, context),
       status: Status.CHALLENGE,
       challengeStatus,
       parameters,
       remainingTries: context.challengeRemainingTries!,
-      remainingTime: context.expiry - now,
+      remainingTime,
     });
     return response.data;
   }