ndncert: dns-01 challenge

Author: yoursunny

pkg/ndncert/README.md

@@ -2,7 +2,7 @@
 
 This package is part of [NDNts](https://yoursunny.com/p/NDNts/), Named Data Networking libraries for the modern web.
 
-This package partially implements [NDN Certificate Management protocol v0.3](https://github.com/named-data/ndncert/wiki/NDNCERT-Protocol-0.3/841f2a2e66cc3256d113cfe61242420b9cdab6c1) and [challenges](https://github.com/named-data/ndncert/wiki/NDNCERT-Protocol-0.3-Challenges/06ba3d415479b6a58ecb132ba54dbee7617668d5).
+This package partially implements [NDN Certificate Management protocol v0.3](https://github.com/named-data/ndncert/wiki/NDNCERT-Protocol-0.3/841f2a2e66cc3256d113cfe61242420b9cdab6c1) and [challenges](https://github.com/named-data/ndncert/wiki/NDNCERT-Protocol-0.3-Challenges/39bde7f94301e251def53b6a9958ae321acb108f).
 This implementation is validated against the reference implementation using [ndncert-interop](../../integ/ndncert-interop).
 
 Features:
@@ -21,7 +21,7 @@ Challenges:
 * [X] PIN
 * [X] email, with name assignment policy
 * [X] proof of possession, with name assignment policy
-* [X] DNS, with name assignment policy
+* [X] DNS and DNS-01, with name assignment policy
 * [X] "nop" (not in NDNCERT spec)
 
 `@ndn/keychain-cli` package offers `ndnts-keychain ndncert03-make-profile`, `ndnts-keychain ndncert03-show-profile`, `ndnts-keychain ndncert03-ca`, `ndnts-keychain ndncert03-probe`, and `ndnts-keychain ndncert03-client` commands that use this implementation.

pkg/ndncert/package.json

@@ -38,6 +38,7 @@
     "@types/nodemailer": "^8.0.1",
     "ajv": "^8.20.0",
     "b64-lite": "^1.4.0",
+    "b64u-lite": "^1.1.0",
     "imap-emails": "^1.0.4",
     "is-valid-hostname": "^1.0.2",
     "nodemailer": "^9.0.3",

pkg/ndncert/src/client/challenge.ts

@@ -1,3 +1,4 @@
+import type { Certificate } from "@ndn/keychain";
 import type { Name } from "@ndn/packet";
 
 import type { ParameterKV } from "../packet/mod";
@@ -23,29 +24,35 @@ export interface ClientChallenge {
 /** Contextual information for challenge selection. */
 export interface ClientChallengeStartContext {
   /** Request session ID. */
-  requestId: Uint8Array;
+  readonly requestId: Uint8Array;
+
+  /** Self-signed certificate request. */
+  readonly certRequest: Certificate;
 
   /** Certificate name of the self-signed certificate. */
-  certRequestName: Name;
+  readonly certRequestName: Name;
 }
 
 /** Contextual information for challenge continuation. */
 export interface ClientChallengeContext {
   /** Request session ID. */
-  requestId: Uint8Array;
+  readonly requestId: Uint8Array;
+
+  /** Self-signed certificate request. */
+  readonly certRequest: Certificate;
 
   /** Certificate name of the self-signed certificate. */
-  certRequestName: Name;
+  readonly certRequestName: Name;
 
   /** Challenge specific status string. */
-  challengeStatus: string;
+  readonly challengeStatus: string;
 
   /** Number of remaining tries to complete challenge. */
-  remainingTries: number;
+  readonly remainingTries: number;
 
   /** Remaining time to complete challenge, in milliseconds. */
-  remainingTime: number;
+  readonly remainingTime: number;
 
   /** Challenge parameter key-value pairs, from CHALLENGE response packet. */
-  parameters: ParameterKV;
+  readonly parameters: ParameterKV;
 }

pkg/ndncert/src/client/dns-challenge.ts

@@ -1,16 +1,16 @@
+import type { Promisable } from "type-fest";
 
+import * as ndncert_dns01 from "../dns01-common";
 import { ParameterKV } from "../packet/mod";
 import type { ClientChallenge, ClientChallengeContext } from "./challenge";
 
-/** The "dns" challenge where client creates a DNS TXT record. */
-export class ClientDnsChallenge implements ClientChallenge {
-  public readonly challengeId = "dns";
-  private record = "";
-  private token = "";
+abstract class ClientDnsChallengeBase {
+  private recordName = "";
+  private recordValue = "";
 
   constructor(
-      private readonly domain: string,
-      private readonly prompt: ClientDnsChallenge.Prompt,
+      protected readonly domain: string,
+      protected readonly prompt: ClientDnsChallenge.Prompt,
   ) {}
 
   public async start(): Promise<ParameterKV> {
@@ -19,16 +19,40 @@ export class ClientDnsChallenge implements ClientChallenge {
 
   public async next(context: ClientChallengeContext): Promise<ParameterKV> {
     if (context.challengeStatus === "need-record") {
-      this.record = ParameterKV.getString(context.parameters, "record-name");
-      this.token = ParameterKV.getString(context.parameters, "expected-value");
+      [this.recordName, this.recordValue] = await this.handleNeedRecord(context);
     }
 
-    await this.prompt(context, this.record, this.token);
+    await this.prompt(context, this.recordName, this.recordValue);
     return ParameterKV.from({ confirmation: "ready" });
   }
+
+  protected abstract handleNeedRecord(context: ClientChallengeContext): Promisable<[recordName: string, recordValue: string]>;
+}
+
+/** The "dns" challenge where client creates a DNS TXT record containing a challenge token. */
+export class ClientDnsChallenge extends ClientDnsChallengeBase implements ClientChallenge {
+  public readonly challengeId = "dns";
+
+  protected override handleNeedRecord({ parameters }: ClientChallengeContext): [record: string, expected: string] {
+    return [ParameterKV.getString(parameters, "record-name"),
+      ParameterKV.getString(parameters, "expected-value")];
+  }
 }
 
 export namespace ClientDnsChallenge {
   /** Callback to prompt the user to insert a DNS TXT record. */
-  export type Prompt = (context: ClientChallengeContext, recordName: string, expectedValue: string) => Promise<void>;
+  export type Prompt = (context: ClientChallengeContext, recordName: string, recordValue: string) => Promise<void>;
+}
+
+/** The "dns-01" challenge where client creates a DNS TXT record containing a key authorization value. */
+export class ClientDns01Challenge extends ClientDnsChallengeBase implements ClientChallenge {
+  public readonly challengeId = "dns-01";
+
+  protected override async handleNeedRecord({ certRequest, parameters }: ClientChallengeContext): Promise<[recordName: string, recordValue: string]> {
+    const token = ParameterKV.getString(parameters, "token");
+    return [
+      ndncert_dns01.toRecordName(this.domain),
+      await ndncert_dns01.computeRecordValue(token, certRequest.publicKeySpki),
+    ];
+  }
 }

pkg/ndncert/src/client/request.ts

@@ -64,7 +64,7 @@ export async function requestCertificate({
     privateKey,
     validity,
   });
-  const certRequestName = newRequest.certRequest.name;
+  const { certRequest } = newRequest;
   const newData = await consume(newRequest.interest, cOpts);
   ErrorMsg.throwOnError(newData);
   const newResponse = await NewResponse.fromData(newData, profile);
@@ -82,7 +82,8 @@ export async function requestCertificate({
     throw new Error(`no acceptable challenge in [${serverChallenges.join(",")}]`);
   }
 
-  let challengeParameters = await challenge.start({ requestId, certRequestName });
+  const challengeContext = { requestId, certRequest, certRequestName: certRequest.name };
+  let challengeParameters = await challenge.start(challengeContext);
   const issuedCertInterest = new Interest();
   while (true) {
     const challengeRequest = await ChallengeRequest.build({
@@ -107,8 +108,7 @@ export async function requestCertificate({
     }
 
     challengeParameters = await challenge.next({
-      requestId,
-      certRequestName,
+      ...challengeContext,
       challengeStatus: challengeResponse.challengeStatus!,
       remainingTries: challengeResponse.remainingTries!,
       remainingTime: challengeResponse.remainingTime!,

pkg/ndncert/src/dns01-common.ts

@@ -0,0 +1,13 @@
+import { sha256, toUtf8 } from "@ndn/util";
+// @ts-expect-error no types
+import { toBase64Url } from "b64u-lite";
+
+export function toRecordName(domain: string): string {
+  return `_ndncert-challenge.${domain}`;
+}
+
+export async function computeRecordValue(token: string, requesterPublicKey: Uint8Array): Promise<string> {
+  const pubHash = toBase64Url(await sha256(requesterPublicKey));
+  const keyAuthorization = `${token}.${pubHash}`;
+  return toBase64Url(await sha256(toUtf8(keyAuthorization)));
+}

pkg/ndncert/src/packet/parameter-kv.ts

@@ -12,7 +12,7 @@ export namespace ParameterKV {
   }
 
   /** Retrieve parameter as UTF-8 string. */
-  export function getString(kv: ParameterKV, key: string): string {
+  export function getString(kv: Readonly<ParameterKV>, key: string): string {
     if (!(key in kv)) {
       throw new Error(`missing parameter ${key}`);
     }
@@ -53,7 +53,7 @@ export function parseEvDecoder<R extends { parameters?: ParameterKV }>(evd: EvDe
 }
 
 /** Encode pairs of ParameterKey and ParameterValue TLVs. */
-export function encode(kv: ParameterKV = {}): Encodable[] {
+export function encode(kv: Readonly<ParameterKV> = {}): Encodable[] {
   return Object.entries(kv).flatMap(([key, value]) => [
     [TT.ParameterKey, toUtf8(key)],
     [TT.ParameterValue, value],

pkg/ndncert/src/server/challenge.ts

@@ -1,3 +1,4 @@
+import type { Certificate } from "@ndn/keychain";
 import type { Name } from "@ndn/packet";
 import type { Promisable } from "type-fest";
 
@@ -46,6 +47,9 @@ export interface ServerChallengeContext<State = unknown> {
   /** CA profile packet. */
   readonly profile: CaProfile;
 
+  /** Self-signed certificate request. */
+  readonly certRequest: Certificate;
+
   /** Subject name of the requested certificate. */
   readonly subjectName: Name;
 

pkg/ndncert/src/server/dns-challenge.ts

@@ -2,21 +2,18 @@ import { SigInfo } from "@ndn/packet";
 import { fromUtf8, toHex, toUtf8 } from "@ndn/util";
 import type { DOHResponse } from "cf-doh";
 import isValidHostname from "is-valid-hostname";
+import type { Promisable } from "type-fest";
 
-import { type ChallengeRequest, ErrorCode } from "../packet/mod";
+import * as ndncert_dns01 from "../dns01-common";
+import { type ChallengeRequest, ErrorCode, type ParameterKV } from "../packet/mod";
 import { ServerChallenge, type ServerChallengeContext, type ServerChallengeResponse } from "./challenge";
 
 interface State {
-  record: string;
-  token: string;
+  recordName: string;
+  recordValue: string;
 }
 
-/** The "dns" challenge where client creates a DNS TXT record. */
-export class ServerDnsChallenge implements ServerChallenge<State> {
-  public readonly challengeId = "dns";
-  public readonly timeLimit = 300000;
-  public readonly retryLimit = 3;
-
+abstract class ServerDnsChallengeBase {
   private readonly assignmentPolicy?: ServerDnsChallenge.AssignmentPolicy;
   private readonly dohServer: string;
 
@@ -48,18 +45,22 @@ export class ServerDnsChallenge implements ServerChallenge<State> {
       return { fail: ErrorCode.NameNotAllowed };
     }
 
-    const record = `_ndncert-challenge.${domain}`;
+    const recordName = ndncert_dns01.toRecordName(domain);
     const token = toHex(SigInfo.generateNonce(16));
-    context.challengeState = { record, token };
+    const [parameters, recordValue] = await this.makeNeedRecord(context, recordName, token);
+    context.challengeState = { recordName, recordValue };
     return {
       challengeStatus: "need-record",
-      parameters: {
-        "record-name": toUtf8(record),
-        "expected-value": toUtf8(token),
-      },
+      parameters,
     };
   }
 
+  protected abstract makeNeedRecord(
+    context: ServerChallengeContext<State>,
+    recordName: string,
+    token: string,
+  ): Promisable<[parameters: ParameterKV, recordValue: string]>;
+
   private async process1(
       request: ChallengeRequest,
       { challengeState }: ServerChallengeContext<State>,
@@ -81,9 +82,9 @@ export class ServerDnsChallenge implements ServerChallenge<State> {
     };
   }
 
-  private async checkRecord({ record, token }: State): Promise<boolean> {
+  private async checkRecord({ recordName, recordValue }: State): Promise<boolean> {
     const url = new URL(this.dohServer);
-    url.searchParams.set("name", record);
+    url.searchParams.set("name", recordName);
     url.searchParams.set("type", "TXT");
 
     const res = await fetch(url, { headers: { Accept: "application/dns-json" } });
@@ -97,9 +98,9 @@ export class ServerDnsChallenge implements ServerChallenge<State> {
     }
     for (const answer of j.Answer ?? []) {
       if (
-        [record, `${record}.`].includes(answer.name) &&
+        [recordName, `${recordName}.`].includes(answer.name) &&
         Number(answer.type) === 16 &&
-        [token, `"${token}"`].includes(answer.data)
+        [recordValue, `"${recordValue}"`].includes(answer.data)
       ) {
         return true;
       }
@@ -108,6 +109,28 @@ export class ServerDnsChallenge implements ServerChallenge<State> {
   }
 }
 
+/** The "dns" challenge where client creates a DNS TXT record containing a challenge token. */
+export class ServerDnsChallenge extends ServerDnsChallengeBase implements ServerChallenge<State> {
+  public readonly challengeId = "dns";
+  public readonly timeLimit = 300000;
+  public readonly retryLimit = 3;
+
+  protected override makeNeedRecord(
+      context: ServerChallengeContext<State>,
+      recordName: string,
+      token: string,
+  ): [parameters: ParameterKV, expected: string] {
+    void context;
+    return [
+      {
+        "record-name": toUtf8(recordName),
+        "expected-value": toUtf8(token),
+      },
+      token,
+    ];
+  }
+}
+
 export namespace ServerDnsChallenge {
   /**
    * Callback to determine whether the owner of a DNS domain is allowed to obtain
@@ -131,3 +154,24 @@ export namespace ServerDnsChallenge {
     dohServer?: string;
   }
 }
+
+/** The "dns-01" challenge where client creates a DNS TXT record containing a key authorization value. */
+export class ServerDns01Challenge extends ServerDnsChallengeBase implements ServerChallenge<State> {
+  public readonly challengeId = "dns-01";
+  public readonly timeLimit = 3600000;
+  public readonly retryLimit = 5;
+
+  protected override async makeNeedRecord(
+      context: ServerChallengeContext<State>,
+      record: string,
+      token: string,
+  ): Promise<[parameters: ParameterKV, recordValue: string]> {
+    void record;
+    return [
+      {
+        token: toUtf8(token),
+      },
+      await ndncert_dns01.computeRecordValue(token, context.certRequest.publicKeySpki),
+    ];
+  }
+}

pkg/ndncert/src/server/server.ts

@@ -331,6 +331,7 @@ class Context implements ServerChallengeContext {
       public readonly sessionKey: ndncert_crypto.SessionKey,
       public readonly profile: CaProfile,
   ) {
+    this.certRequest = request.certRequest;
     this.certRequestPub = request.publicKey;
     this.validityPeriod = request.certRequest.validity;
   }
@@ -344,6 +345,7 @@ class Context implements ServerChallengeContext {
   }
 
   public expiry = Date.now() + BEFORE_CHALLENGE_EXPIRY;
+  public readonly certRequest: Certificate;
   public readonly certRequestPub: NamedVerifier.PublicKey;
   public readonly validityPeriod: ValidityPeriod;
   public status = Status.BEFORE_CHALLENGE;