Link Target parsing in ACME clients

elDez · November 10, 2020, 10:32pm

Hello,

I'm a maintainer of lego.

A user has opened an issue that concerns Link parsing.
This issue makes me wonder about the implementation by the ACME clients of the RFC8288 concerning the parsing of these links.

I'm curious to know the opinion of the maintainers of the other ACME clients and the Let's Encrypt team on this point.

Thanks in advance.

eggsampler · November 10, 2020, 11:06pm

Interesting, thanks for the heads up. I've been using a similar regex to parse the link relation and haven't come across an issue with boulder or pebble.

github.com

eggsampler/acme/blob/master/acme.go#L237



	if len(body) > 0 && out != nil {
		if err := json.Unmarshal(body, out); err != nil {
			return resp, fmt.Errorf("acme: error parsing response: %v - %s", err, string(body))
		}
	}

	return resp, nil
}

var regLink = regexp.MustCompile(`<(.+?)>;\s*rel="(.+?)"`)

// Fetches a http Link header from a http response
func fetchLink(resp *http.Response, wantedLink string) string {
	if resp == nil {
		return ""
	}
	linkHeader := resp.Header["Link"]
	if len(linkHeader) == 0 {
		return ""
	}

Your regex change makes sense, but I guess this is just an example of where we should be properly parsing the url instead of using a regex to extract what we need. That is, use go's url parser and extract the relations from the url fragment. EDIT: Thinking about this, it looks like go won't parse these urls properly anyway, so short of rolling your own or using an external url parser which supports these relations, the modified regex might be the easiest solution.

It would be interesting to see what acme server implementation is being used here and how.

griffin · November 10, 2020, 11:38pm

Hello Fernandez

I noticed that jillian liked your original post, eggsampler responded to you, and _az liked that response, so it appears that you've already gotten the attention of Let's Encrypt and Certbot. I know that @jsha has been around today and might have something to say here. I'll try to ping some of the ACME client developers that frequent our community to respond if they wish.

@certbot-devs, @rmbolger, @webprofusion

Any thoughts here to add?

rmbolger · November 11, 2020, 12:39am

For what it's worth, the only time my client currently tries to parse Link headers in a response is when downloading the finalized cert and looking for alternate chains. So my (PowerShell/.NET based) regex is tailored for that scenario rather than more generic Link header parsing.

$reAltLink = '<(?<uri>\S+)>;rel="alternate"'

So it basically captures any non-whitespace characters between the <> characters. But the <> are definitely assumed to be there and wouldn't match if they were missing.

felixf · November 12, 2020, 7:53pm

The client I'm maintaining uses a similar regex:
<?(\S+?)>?(?:;[^;]+)*?;\s*rel="(.+?)"

github.com

ansible-collections/community.crypto/blob/main/plugins/module_utils/acme.py#L1114


        module.debug('Using OpenSSL binary backend')
        return 'openssl'


def process_links(info, callback):
    '''
    Process link header, calls callback for every link header with the URL and relation as options.
    '''
    if 'link' in info:
        link = info['link']
        for url, relation in re.findall(r'<([^>]+)>;\s*rel="(\w+)"', link):
            callback(unquote(url), relation)


def get_default_argspec():
    '''
    Provides default argument spec for the options documented in the acme doc fragment.
    '''
    return dict(
        account_key_src=dict(type='path', aliases=['account_key']),
        account_key_content=dict(type='str', no_log=True),

griffin · November 12, 2020, 8:12pm

Thanks felixf. I'll try to keep you in mind for future questions to ACME client developers.

system · December 12, 2020, 8:13pm

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.