I have been toying with the idea of using nfqueue as a strategy to write an ACME HTTP authenticator which would work regardless of what webserver you have running on port 80. We often see users on this forum who are struggling with getting Apache/nginx/Tomcat/whatever to play nicely with their webr…

[image] _az: I don't think this change should be necessary, because the plugin sets the TCP dport and sport explicitly. For me just setting the regular Certbot --http-01-port 5002 flag works okay. For me it actually was necessary for some reason. Otherwise pkt_ip.haslayer(HTTPRequest) will ne…

Interesting that we get different results. If the scapy API is public, maybe the plugin can add the extra binds in prepare for whatever the value of --http-01-port is.

from scapy.packet import bind_bottom_up from scapy.packet import bind_layers ... def prepare(self) -> None: scapy_conf.L3socket = L3RawSocket if self.http_port != 80: bind_bottom_up(TCP, HTTP, sport=self.http_port) bind_bottom_up(TCP, HTTP, dport=self.ht…

I wouldn't be surprised if scapy layer detection is a bit sensitive to the payload, so it's probably a good idea to have the binds in, or even use a lower-level method of detecting the request. I'll put that in for good measure. About the off-by-one, apparently I don't know what lstrip does haha: p…

Maybe my Scapy is more sensitive :stuck_out_tongue:

[image] _az: I'd be curious to hear what other client authors on Linux think. My feeling for a long time has been that fulfilling ACME challenges often requires an outsized effort to "make it work" and it'd be nice to find further ways to reduce friction on the sysadmin side. I absolutely lov…

while messing with this I just realized this is literally forging acme challenge reply out of band, just happens to be on real web server and middleman happens runs on same box. not sure how picky LE (and golang as that's what calls ) catches oddity on TCP layer, and how well we forged in this chal…

btw can I ask why it used iptable command if nfqueue (from name) requires to run nftable?

From what I've observed, the iptables CLI is more ubiquitous than the nft CLI on most Linux distros, even though it is usually just a frontend into the nftables backend. Certainly there are a number of equivalent methods of adding and removing the required rule, and a production version of such a p…

ported equivalent solver for lego: DPI Http01 solver for linux with nfqueue go-acme:master ← orangepizza:http01-dpi opened 12:35PM - 21 Feb 23 UTC (UTC) [or…

Using nfqueue on Linux as a novel, webserver-agnostic HTTP authenticator

Client dev

jvanasco February 13, 2023, 9:33am 20

I absolutely love this, and it solves a lot of the issues I was talking about in Http challange on port 25? - #20 by webprofusion without having to create a new challenge type. I still think a new challenge type is needed, but this would address a very large amount of the use cases.

Topic		Replies	Views
Solution: Client with the currently selected authenticator does not support any combination of challenges that will satisfy the CA Help	72	274232	February 2, 2018
Data Communication Paths for the Lets Encrypt and Certify the Web Apps Help	34	2336	August 19, 2022
Certbot ACME challenge not attempted but reported ad 403 error Help	17	842	March 31, 2024
DEBUG:certbot._internal.error_handler:Encountered exception: Help	2	921	July 18, 2023
CERTBOT REQUEST: Open Firewall only for Specific IPs Feature Requests	17	23889	May 24, 2020

Using nfqueue on Linux as a novel, webserver-agnostic HTTP authenticator

Related topics