aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorGuilhem Moulin <guilhem@fripost.org>2021-02-16 00:00:40 +0100
committerGuilhem Moulin <guilhem@fripost.org>2021-02-21 00:03:59 +0100
commitcf3d42c066d2f54d4a57aa38907a7c6c7d06aeb6 (patch)
tree72fd538bf5fd381b408f540c4060bce5480ee935
parentf5a8ada638d9fcef9939b00f941588288f6287cc (diff)
lacme-accountd(1): base64url-decode incoming signature requests.
Before printing them to the standard error.
-rw-r--r--Changelog2
-rwxr-xr-xlacme-accountd20
2 files changed, 20 insertions, 2 deletions
diff --git a/Changelog b/Changelog
index baf67b9..c69d0d0 100644
--- a/Changelog
+++ b/Changelog
@@ -48,6 +48,8 @@ lacme (0.7.1) upstream;
drop).
* lacme-accountd(1): add %-specifiers support for --config=, --socket=
and --privkey= (and 'socket'/'privkey' configuration options).
+ * lacme-accountd(1): base64url-decode incoming signature requests shown
+ in messages to the standard error.
+ Improve nginx/apache2 snippets for direct serving of challenge files
(with the new 'challenge-directory' logic symlinks can be disabled).
+ Split Nginx and Apapche2 static configuration snippets into seperate
diff --git a/lacme-accountd b/lacme-accountd
index e170637..0adfe38 100755
--- a/lacme-accountd
+++ b/lacme-accountd
@@ -30,7 +30,7 @@ my $NAME = 'lacme-accountd';
use Errno 'EINTR';
use File::Basename 'dirname';
use Getopt::Long qw/:config posix_default no_ignore_case gnu_getopt auto_version/;
-use MIME::Base64 'encode_base64url';
+use MIME::Base64 qw/decode_base64url encode_base64url/;
use Socket qw/PF_UNIX SOCK_STREAM SHUT_RDWR/;
use Config::Tiny ();
@@ -195,7 +195,23 @@ sub conn($$;$) {
# sign whatever comes in
while (defined (my $data = $in->getline())) {
$data =~ s/\r\n\z// or die;
- print STDERR "[$id] >>> Issuing SHA-256 signature for: $data\n" unless $OPTS{quiet};
+
+ my ($protected, $payload) = split(/\./, $data, 2);
+ unless (defined $protected and $protected =~ /\A[A-Za-z0-9\-_]+\z/) {
+ print STDERR "[$id] >>> Error: Malformed protected data, refusing to sign!\n";
+ last;
+ }
+ unless (defined $payload and $payload =~ /\A[A-Za-z0-9\-_]*\z/) {
+ # payload can be empty, for instance for POST-as-GET
+ print STDERR "[$id] >>> Error: Malformed payload data, refusing to sign!\n";
+ last;
+ }
+
+ print STDERR "[$id] >>> Incoming signature request for ",
+ "base64url(", decode_base64url($protected), ") . ",
+ "base64url(", decode_base64url($payload), ")"
+ unless $OPTS{quiet};
+
my $sig = $SIGN->($data);
$out->printflush( encode_base64url($sig), "\r\n" ) or warn "print: $!";
}