klibs: Add Automatic Certificate Management Environment (ACME) client

klib/azure.c

@@ -15,7 +15,6 @@
 typedef struct az_instance_md_req {
     az_instance_md_handler complete;
     tuple req;
-    struct buffer query;
     struct buffer md_header;
     closure_struct(value_handler, vh);
 } *az_instance_md_req;
@@ -104,6 +103,7 @@ void azure_instance_md_get(az_instance_md_handler complete)
     req_params.port = 80;
     req_params.tls = false;
     req_params.method = HTTP_REQUEST_METHOD_GET;
+    req_params.query = ss("/metadata/instance?api-version=2025-04-07&format=json");
     az_instance_md_req req_data = allocate(azure.h, sizeof(*req_data));
     if (req_data == INVALID_ADDRESS) {
         msg_err("%s: out of memory", func_ss);
@@ -115,9 +115,6 @@ void azure_instance_md_get(az_instance_md_handler complete)
         deallocate(azure.h, req_data, sizeof(*req_data));
         goto error;
     }
-    buffer_init_from_string(&req_data->query,
-                            "/metadata/instance?api-version=2025-04-07&format=json");
-    set(req, sym_this("url"), &req_data->query);
     buffer_init_from_string(&req_data->md_header, "true");
     set(req, sym_this("Metadata"), &req_data->md_header);
     req_data->req = req_params.req = req;

klib/cloud_azure.c

@@ -13,7 +13,6 @@
 typedef struct azure {
     heap h;
     struct buffer ms_version;
-    struct buffer goalstate_query;
     closure_struct(value_handler, goalstate_vh);
     struct net_http_req_params goalstate_req_params;
     char container_id[64];
@@ -49,7 +48,6 @@ typedef struct azure {
 
 typedef struct azure_ready_data {
     azure az;
-    struct buffer query;
     struct buffer content_type;
     tuple req;
     closure_struct(value_handler, vh);
@@ -166,6 +164,7 @@ static void az_report_status(azure az)
     tuple req = az->status_upload.create_req;
     net_http_req_params req_params = &az->status_upload.params;
     req_params->host = buffer_to_sstring(&az->status_upload.host);
+    req_params->query = buffer_to_sstring(&az->status_upload.create_query);
     req_params->req = req;
     req_params->body = 0;
     req_params->resp_handler = (value_handler)&az->status_upload.vh;
@@ -316,8 +315,8 @@ static void az_get_ext_config(azure az)
     bprintf(query, "/machine/%s/%s?comp=config&type=extensionsConfig&incarnation=%b",
             isstring(az->container_id, az->container_id_len),
             isstring(az->instance_id, az->instance_id_len), &az->goalstate_incarnation);
+    req_params.query = buffer_to_sstring(query);
     req_data->query = query;
-    set(req, sym_this("url"), query);
     set(req, sym_this("x-ms-version"), &az->ms_version);
     req_data->req = req_params.req = req;
     req_params.body = 0;
@@ -351,6 +350,7 @@ closure_func_basic(value_handler, void, az_status_upload_vh,
     if (status_code && !buffer_strcmp(status_code, "201")) {
         tuple req = az->status_upload.data_req;
         net_http_req_params req_params = &az->status_upload.params;
+        req_params->query = buffer_to_sstring(&az->status_upload.data_query);
         req_params->req = req;
         req_params->body = az->status_upload.blob;
         req_params->resp_handler = 0;
@@ -459,8 +459,7 @@ static void azure_report_ready(azure az)
     req_params.port = 80;
     req_params.tls = false;
     req_params.method = HTTP_REQUEST_METHOD_POST;
-    buffer_init_from_string(&req_data->query, "/machine?comp=health");
-    set(req, sym_this("url"), &req_data->query);
+    req_params.query = ss("/machine?comp=health");
     set(req, sym_this("x-ms-version"), &az->ms_version);
     buffer_init_from_string(&req_data->content_type, "text/xml;charset=utf-8");
     set(req, sym_this("Content-Type"), &req_data->content_type);
@@ -513,7 +512,6 @@ static void az_status_upload_init(azure az)
     /* Put Blob request */
     tuple req = allocate_tuple();
     assert(req != INVALID_ADDRESS);
-    set(req, sym_this("url"), &az->status_upload.create_query);
     set(req, sym_this("x-ms-version"), &az->ms_version);
     buffer_init_from_string(&az->status_upload.blob_type, "PageBlob");
     set(req, sym_this("x-ms-blob-type"), &az->status_upload.blob_type);
@@ -523,7 +521,6 @@ static void az_status_upload_init(azure az)
     /* Put Page request */
     req = allocate_tuple();
     assert(req != INVALID_ADDRESS);
-    set(req, sym_this("url"), &az->status_upload.data_query);
     set(req, sym_this("x-ms-version"), &az->ms_version);
     buffer_init_from_string(&az->status_upload.content_type, "application/json");
     set(req, sym_this("Content-Type"), &az->status_upload.content_type);
@@ -547,16 +544,15 @@ boolean azure_cloud_init(heap h)
         return false;
     az->h = h;
     buffer_init_from_string(&az->ms_version, AZURE_MS_VERSION);
-    buffer_init_from_string(&az->goalstate_query, "/machine?comp=goalstate");
     init_buffer(&az->goalstate_incarnation, 0, false, h, 0);
     net_http_req_params params = &az->goalstate_req_params;
     params->host = AZURE_WIRESERVER_ADDR;
     params->port = 80;
     params->tls = false;
     params->method = HTTP_REQUEST_METHOD_GET;
+    params->query = ss("/machine?comp=goalstate");
     tuple req = allocate_tuple();
     assert(req != INVALID_ADDRESS);
-    set(req, sym_this("url"), &az->goalstate_query);
     set(req, sym_this("x-ms-version"), &az->ms_version);
     params->req = req;
     params->body = 0;

klib/firewall.c

@@ -40,7 +40,6 @@ typedef struct firewall_constraint_buf {
 
 typedef struct fw_radar {
     heap h;
-    struct buffer url;
     closure_struct(value_handler, resp_handler);
     struct timer retry_timer;
     closure_struct(timer_handler, retry_func);
@@ -728,7 +727,7 @@ closure_func_basic(timer_handler, void, fw_radar_get,
     if (overruns == timer_disabled)
         return;
     fw_radar fwr = struct_from_closure(fw_radar, retry_func);
-    status s = radar_get(&fwr->url,
+    status s = radar_get(ss("/api/v1/threats"),
                          init_closure_func(&fwr->resp_handler, value_handler, fw_radar_handler));
     if (!is_ok(s)) {
         if (fwr->retry_backoff > seconds(2))
@@ -746,7 +745,6 @@ static boolean firewall_radar_init(heap h)
         return false;
     }
     fwr->h = h;
-    buffer_init_from_string(&fwr->url, "/api/v1/threats");
     init_timer(&fwr->retry_timer);
     fwr->retry_backoff = seconds(1);
     apply(init_closure_func(&fwr->retry_func, timer_handler, fw_radar_get), 0, 0);

klib/klib.mk

@@ -3,6 +3,7 @@ KLIB_DIR= $(ROOTDIR)/klib
 MBEDTLS_DIR=	$(VENDORDIR)/mbedtls
 
 KLIBS= \
+	acme \
 	azure \
 	cloud_init \
 	cloudwatch \
@@ -22,6 +23,10 @@ KLIBS= \
 	tun \
 	userdata \
 
+SRCS-acme= \
+	$(KLIB_DIR)/acme.c \
+	$(KLIB_DIR)/net_utils.c \
+
 SRCS-azure= \
 	$(KLIB_DIR)/azure.c \
 	$(KLIB_DIR)/azure_diagnostics.c \
@@ -171,7 +176,9 @@ SRCS-mbedtls-x509= \
 	$(MBEDTLS_DIR)/library/certs.c \
 	$(MBEDTLS_DIR)/library/pkcs11.c \
 	$(MBEDTLS_DIR)/library/x509.c \
+	$(MBEDTLS_DIR)/library/x509_create.c \
 	$(MBEDTLS_DIR)/library/x509_crt.c \
+	$(MBEDTLS_DIR)/library/x509write_csr.c \
 
 SRCS-mbedtls-tls= \
 	$(MBEDTLS_DIR)/library/ssl_cache.c \

klib/net_utils.c

@@ -69,6 +69,7 @@ closure_func_basic(connection_handler, input_buffer_handler, net_http_ch,
         net_http_req_params params = &req_data->params;
         tuple req = params->req;
         /* Use lowercase host header in order to be compatible with AWS SigV4 protocol. */
+        set(req, sym(url), alloca_wrap_sstring(params->query));
         set(req, sym(host), alloca_wrap_sstring(params->host));
         set(req, sym(Connection), alloca_wrap_cstring("close"));
         status s = http_request(req_data->h, out, params->method, req, params->body);
@@ -154,6 +155,43 @@ boolean net_uri_encode(buffer dest, char *src, bytes len)
     return true;
 }
 
+boolean net_url_to_reqparams(sstring url, net_http_req_params params)
+{
+    int host_offset;
+    if ((url.len >= 8) && (runtime_memcmp(url.ptr, "https://", 8) == 0)) {
+        params->tls = true;
+        params->port = 443;
+        host_offset = 8;
+    } else  if ((url.len >= 7) && (runtime_memcmp(url.ptr, "http://", 7) == 0)) {
+        params->tls = false;
+        params->port = 80;
+        host_offset = 7;
+    } else if (runtime_strstr(url, ss("://"))) {
+        /* unsupported protocol */
+        return false;
+    } else {    /* no protocol: default to HTTP */
+        params->tls = false;
+        params->port = 80;
+        host_offset = 0;
+    }
+    char *server_start = url.ptr + host_offset;
+    bytes server_len = url.ptr + url.len - server_start;
+    char *slash = runtime_strchr(isstring(server_start, server_len), '/');
+    sstring host;
+    host.ptr = server_start;
+    sstring query;
+    if (slash) {
+        host.len = slash - server_start;
+        query = isstring(slash, url.ptr + url.len - slash);
+    } else {
+        host.len = server_len;
+        query = ss("/");
+    }
+    params->host = host;
+    params->query = query;
+    return true;
+}
+
 status net_http_req(net_http_req_params params)
 {
     heap h = heap_locked(get_kernel_heaps());
@@ -191,3 +229,45 @@ status net_http_req(net_http_req_params params)
     }
     return s;
 }
+
+status net_http_get(sstring url, tuple req, value_handler resp_handler)
+{
+    struct net_http_req_params params;
+    if (!net_url_to_reqparams(url, &params))
+        return timm("result", "unsupported URL");
+    params.req = req;
+    params.body = 0;
+    params.resp_handler = resp_handler;
+    params.method = HTTP_REQUEST_METHOD_GET;
+    return net_http_req(&params);
+}
+
+status net_http_post(sstring url, tuple req, buffer body, value_handler resp_handler)
+{
+    struct net_http_req_params params;
+    if (!net_url_to_reqparams(url, &params))
+        return timm("result", "unsupported URL");
+    params.req = req;
+    params.body = body;
+    params.resp_handler = resp_handler;
+    params.method = HTTP_REQUEST_METHOD_POST;
+    return net_http_req(&params);
+}
+
+boolean base64url_encode(buffer dest, void *src, bytes len)
+{
+    static const char table[] = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
+    u8 *p = src;
+    for (bytes i = 0; i < len; i += 3) {
+        u32 val = (p[i] << 16);
+        if (i + 1 < len) val |= (p[i + 1] << 8);
+        if (i + 2 < len) val |= p[i + 2];
+        if (!push_character(dest, table[(val >> 18) & 0x3f])) return false;
+        if (!push_character(dest, table[(val >> 12) & 0x3f])) return false;
+        if (i + 1 < len)
+            if (!push_character(dest, table[(val >> 6) & 0x3f])) return false;
+        if (i + 2 < len)
+            if (!push_character(dest, table[val & 0x3f])) return false;
+    }
+    return true;
+}

klib/net_utils.h

@@ -4,8 +4,12 @@
 #include <http.h>
 #include <lwip/ip_addr.h>
 
+#define FQDN_MAX_LEN        253             /* RFC 2181 */
+#define EMAIL_ADDR_MAX_LEN  (64 + 1 + 255)  /* RFC 5321 */
+
 typedef struct net_http_req_params {
     sstring host;
+    sstring query;
     tuple req;
     buffer body;
     value_handler resp_handler;
@@ -18,7 +22,12 @@ void net_resolve(sstring host, void (*cb)(sstring host, const ip_addr_t *addr, v
                  void *cb_arg);
 
 boolean net_uri_encode(buffer dest, char *src, bytes len);
+boolean net_url_to_reqparams(sstring url, net_http_req_params params);
 
 status net_http_req(net_http_req_params params);
+status net_http_get(sstring url, tuple req, value_handler resp_handler);
+status net_http_post(sstring url, tuple req, buffer body, value_handler resp_handler);
+
+boolean base64url_encode(buffer dest, void *src, bytes len);
 
 #endif

klib/radar.c

@@ -433,17 +433,17 @@ closure_func_basic(status_handler, void, klog_dump_loaded,
     closure_finish();
 }
 
-status radar_get(string url, value_handler handler)
+status radar_get(sstring query, value_handler handler)
 {
     struct net_http_req_params p;
     p.host = ss(RADAR_HOSTNAME);
+    p.query = query;
     p.port = RADAR_PORT;
     p.tls = true;
     p.method = HTTP_REQUEST_METHOD_GET;
     p.req = allocate_tuple();
     if (p.req == INVALID_ADDRESS)
         return timm_oom;
-    set(p.req, sym(url), url);
     if (telemetry.auth_header)
         set(p.req, sym(RADAR-KEY), telemetry.auth_header);
     p.body = 0;

klib/radar.h

@@ -1,6 +1,6 @@
 #ifndef RADAR_H_
 #define RADAR_H_
 
-status radar_get(string url, value_handler handler);
+status radar_get(sstring query, value_handler handler);
 
 #endif