mirrors/acme4j
1
0
Fork 0
mirror of https://github.com/shred/acme4j.git synced 2025-12-13 11:14:02 +08:00
Code Issues Packages Projects Releases Wiki Activity

Add Google CA provider

Browse Source
This commit is contained in:
Richard Körber
2024-09-22 16:32:00 +02:00
parent 0ccd68c09a
commit beec5156c2
12 changed files with 278 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
acme4j-client/src/main/java/org/shredzone/acme4j/AccountBuilder.java
View File

@@ -21,6 +21,7 @@ import java.net.URI;
import java.security.KeyPair;
import java.util.ArrayList;
import java.util.List;
import java.util.Optional;
import java.util.Set;
import javax.crypto.SecretKey;
@@ -279,7 +280,10 @@ public class AccountBuilder {
claims.put("termsOfServiceAgreed", termsOfServiceAgreed);
}
if (keyIdentifier != null && macKey != null) {
var algorithm = macAlgorithm != null ? macAlgorithm : macKeyAlgorithm(macKey);
var algorithm = Optional.ofNullable(macAlgorithm)
.or(session.provider()::getProposedEabMacAlgorithm)
// FIXME: Cannot use a Supplier here due to a Spotbugs false positive "null pointer dereference"
.orElse(macKeyAlgorithm(macKey));
claims.put("externalAccountBinding", JoseUtils.createExternalAccountBinding(
keyIdentifier, keyPair.getPublic(), macKey, algorithm, resourceUrl));
}

14
acme4j-client/src/main/java/org/shredzone/acme4j/provider/AcmeProvider.java
View File

@@ -15,6 +15,7 @@ package org.shredzone.acme4j.provider;
import java.net.URI;
import java.net.URL;
import java.util.Optional;
import java.util.ServiceLoader;
import edu.umd.cs.findbugs.annotations.Nullable;
@@ -96,4 +97,17 @@ public interface AcmeProvider {
@Nullable
Challenge createChallenge(Login login, JSON data);
/**
* Returns a proposal for the EAB MAC algorithm to be used. Only set if the CA
* requires External Account Binding and the MAC algorithm cannot be correctly derived
* from the MAC key. Empty otherwise.
*
* @return Proposed MAC algorithm to be used for EAB, or empty for the default
* behavior.
* @since 3.5.0
*/
default Optional<String> getProposedEabMacAlgorithm() {
return Optional.empty();
}
}

70
acme4j-client/src/main/java/org/shredzone/acme4j/provider/google/GoogleAcmeProvider.java Normal file
View File

@@ -0,0 +1,70 @@
/*
* acme4j - Java ACME client
*
* Copyright (C) 2024 Richard "Shred" Körber
* http://acme4j.shredzone.org
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
*/
package org.shredzone.acme4j.provider.google;
import java.net.MalformedURLException;
import java.net.URI;
import java.net.URL;
import java.util.Optional;
import org.jose4j.jws.AlgorithmIdentifiers;
import org.shredzone.acme4j.exception.AcmeProtocolException;
import org.shredzone.acme4j.provider.AbstractAcmeProvider;
import org.shredzone.acme4j.provider.AcmeProvider;
/**
* An {@link AcmeProvider} for the <em>Google Trust Services</em>.
* <p>
* The {@code serverUri} is {@code "acme://pki.goog"} for the production server,
* and {@code "acme://pki.goog/staging"} for the staging server.
*
* @see <a href="https://pki.goog/">https://pki.goog/</a>
* @since 3.5.0
*/
public class GoogleAcmeProvider extends AbstractAcmeProvider {
private static final String PRODUCTION_DIRECTORY_URL = "https://dv.acme-v02.api.pki.goog/directory";
private static final String STAGING_DIRECTORY_URL = "https://dv.acme-v02.test-api.pki.goog/directory";
@Override
public boolean accepts(URI serverUri) {
return "acme".equals(serverUri.getScheme())
&& "pki.goog".equals(serverUri.getHost());
}
@Override
public URL resolve(URI serverUri) {
var path = serverUri.getPath();
String directoryUrl;
if (path == null || path.isEmpty() || "/".equals(path)) {
directoryUrl = PRODUCTION_DIRECTORY_URL;
} else if ("/staging".equals(path)) {
directoryUrl = STAGING_DIRECTORY_URL;
} else {
throw new IllegalArgumentException("Unknown URI " + serverUri);
}
try {
return new URL(directoryUrl);
} catch (MalformedURLException ex) {
throw new AcmeProtocolException(directoryUrl, ex);
}
}
@Override
public Optional<String> getProposedEabMacAlgorithm() {
return Optional.of(AlgorithmIdentifiers.HMAC_SHA256);
}
}

29
acme4j-client/src/main/java/org/shredzone/acme4j/provider/google/package-info.java Normal file
View File

@@ -0,0 +1,29 @@
/*
* acme4j - Java ACME client
*
* Copyright (C) 2024 Richard "Shred" Körber
* http://acme4j.shredzone.org
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
*/
/**
* This package contains the {@link org.shredzone.acme4j.provider.AcmeProvider} for the
* Google Trust Services.
*
* @see <a href="https://pki.goog/">https://pki.goog/</a>
*/
@ReturnValuesAreNonnullByDefault
@DefaultAnnotationForParameters(NonNull.class)
@DefaultAnnotationForFields(NonNull.class)
package org.shredzone.acme4j.provider.google;
import edu.umd.cs.findbugs.annotations.DefaultAnnotationForFields;
import edu.umd.cs.findbugs.annotations.DefaultAnnotationForParameters;
import edu.umd.cs.findbugs.annotations.NonNull;
import edu.umd.cs.findbugs.annotations.ReturnValuesAreNonnullByDefault;

3
acme4j-client/src/main/resources/META-INF/services/org.shredzone.acme4j.provider.AcmeProvider
View File

@@ -1,4 +1,7 @@
# Google Trust Services: https://pki.goog/
org.shredzone.acme4j.provider.google.GoogleAcmeProvider
# Let's Encrypt: https://letsencrypt.org
org.shredzone.acme4j.provider.letsencrypt.LetsEncryptAcmeProvider

32
acme4j-client/src/test/java/org/shredzone/acme4j/AccountBuilderTest.java
View File

@@ -22,6 +22,7 @@ import static org.shredzone.acme4j.toolbox.TestUtils.url;
import java.net.HttpURLConnection;
import java.net.URL;
import java.security.KeyPair;
import java.util.Optional;
import edu.umd.cs.findbugs.annotations.Nullable;
import org.jose4j.jwx.CompactSerializer;
@@ -113,11 +114,29 @@ public class AccountBuilderTest {
*/
@ParameterizedTest
@CsvSource({
"SHA-256,HS256,", "SHA-384,HS384,", "SHA-512,HS512,",
"SHA-256,HS256,HS256", "SHA-384,HS384,HS384", "SHA-512,HS512,HS512",
"SHA-512,HS256,HS256"
// Derived from key size
"SHA-256,HS256,,",
"SHA-384,HS384,,",
"SHA-512,HS512,,",
// Enforced, but same as key size
"SHA-256,HS256,HS256,",
"SHA-384,HS384,HS384,",
"SHA-512,HS512,HS512,",
// Enforced, different from key size
"SHA-512,HS256,HS256,",
// Proposed by provider
"SHA-256,HS256,,HS256",
"SHA-512,HS256,,HS256",
"SHA-512,HS512,HS512,HS256",
})
public void testRegistrationWithKid(String keyAlg, String expectedMacAlg, @Nullable String macAlg) throws Exception {
public void testRegistrationWithKid(String keyAlg,
String expectedMacAlg,
@Nullable String macAlg,
@Nullable String providerAlg
) throws Exception {
var accountKey = TestUtils.createKeyPair();
var keyIdentifier = "NCC-1701";
var macKey = TestUtils.createSecretKey(keyAlg);
@@ -152,6 +171,11 @@ public class AccountBuilderTest {
public JSON readJsonResponse() {
return JSON.empty();
}
@Override
public Optional<String> getProposedEabMacAlgorithm() {
return Optional.ofNullable(providerAlg);
}
};
provider.putTestResource(Resource.NEW_ACCOUNT, resourceUrl);

75
acme4j-client/src/test/java/org/shredzone/acme4j/provider/google/GoogleAcmeProviderTest.java Normal file
View File

@@ -0,0 +1,75 @@
/*
* acme4j - Java ACME client
*
* Copyright (C) 2024 Richard "Shred" Körber
* http://acme4j.shredzone.org
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
*/
package org.shredzone.acme4j.provider.google;
import static org.assertj.core.api.Assertions.assertThat;
import static org.junit.jupiter.api.Assertions.assertThrows;
import static org.shredzone.acme4j.toolbox.TestUtils.url;
import java.net.URI;
import java.net.URISyntaxException;
import org.assertj.core.api.AutoCloseableSoftAssertions;
import org.junit.jupiter.api.Test;
/**
* Unit tests for {@link GoogleAcmeProvider}.
*/
public class GoogleAcmeProviderTest {
private static final String PRODUCTION_DIRECTORY_URL = "https://dv.acme-v02.api.pki.goog/directory";
private static final String STAGING_DIRECTORY_URL = "https://dv.acme-v02.test-api.pki.goog/directory";
/**
* Tests if the provider accepts the correct URIs.
*/
@Test
public void testAccepts() throws URISyntaxException {
var provider = new GoogleAcmeProvider();
try (var softly = new AutoCloseableSoftAssertions()) {
softly.assertThat(provider.accepts(new URI("acme://pki.goog"))).isTrue();
softly.assertThat(provider.accepts(new URI("acme://pki.goog/"))).isTrue();
softly.assertThat(provider.accepts(new URI("acme://pki.goog/staging"))).isTrue();
softly.assertThat(provider.accepts(new URI("acme://example.com"))).isFalse();
softly.assertThat(provider.accepts(new URI("http://example.com/acme"))).isFalse();
softly.assertThat(provider.accepts(new URI("https://example.com/acme"))).isFalse();
}
}
/**
* Test if acme URIs are properly resolved.
*/
@Test
public void testResolve() throws URISyntaxException {
var provider = new GoogleAcmeProvider();
assertThat(provider.resolve(new URI("acme://pki.goog"))).isEqualTo(url(PRODUCTION_DIRECTORY_URL));
assertThat(provider.resolve(new URI("acme://pki.goog/"))).isEqualTo(url(PRODUCTION_DIRECTORY_URL));
assertThat(provider.resolve(new URI("acme://pki.goog/staging"))).isEqualTo(url(STAGING_DIRECTORY_URL));
assertThrows(IllegalArgumentException.class, () -> provider.resolve(new URI("acme://pki.goog/v99")));
}
/**
* Test if correct MAC algorithm is proposed.
*/
@Test
public void testMacAlgorithm() {
var provider = new GoogleAcmeProvider();
assertThat(provider.getProposedEabMacAlgorithm()).isNotEmpty().contains("HS256");
}
}