Skip to content

Instantly share code, notes, and snippets.

@rjsalts
Created March 28, 2018 05:26
Show Gist options
  • Save rjsalts/732994772e1c6d73d989b01c52b48ada to your computer and use it in GitHub Desktop.
Save rjsalts/732994772e1c6d73d989b01c52b48ada to your computer and use it in GitHub Desktop.
update-policy authentication helper for acme-challenge inside kerberos realm
#!/usr/bin/perl
use strict;
use IO::Socket::UNIX;
use Net::DNS;
my $path = '/tmp/acme.sock';
my $realm = 'EXAMPLE.ORG';
unlink($path);
my $server = IO::Socket::UNIX->new(Local => $path, Type => SOCK_STREAM, Listen => 8) or
die "unable to create socket $path";
chmod 0777, $path;
while (my $client = $server->accept()) {
$client->recv(my $buf, 8, 0);
my ($version, $req_len) = unpack('N N', $buf);
if ($version != 1 || $req_len < 17) {
printf("Badly formatted request\n");
$client->send(pack('N', 2));
next;
}
$client->recv(my $buf, $req_len - 8, 0);
my ($signer,
$name,
$addr,
$type,
$key,
$key_data) = unpack('Z* Z* Z* Z* Z* N/a', $buf);
if ($req_len != length($buf)+8) {
printf("Length mismatch %u %u\n", $req_len, length($buf)+8);
$client->send(pack('N', 2));
next;
}
printf("Update by %s for name=%s, type=%s at address %s\n",
$signer, $name, $type, $addr);
my $norm_signer;
if($signer =~ m/host\/([^\\]+)\\\@\Q$realm\E$/) {
$norm_signer = $1;
}
my $target_host;
if($name =~ m/_acme-challenge.(.*)/) {
$target_host = $1;
}
printf("Normalised form of signer is %s\n",$norm_signer);
printf("Target host is %s\n",$target_host);
my $result;
if($norm_signer eq $target_host) {
$result = 1
} else {
$result = 0;
}
my $reply = pack('N', $result);
$client->send($reply);
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment