ACME: tls-alpn-01 challenge implementation

.github/workflows/ci.yaml

@@ -60,6 +60,13 @@ jobs:
             nginx-ref: stable-1.28
             build: debug
 
+    env:
+      testTarget: >-
+        ${{ (matrix.nginx-ref == 'stable-1.28' && matrix.build == 'debug')
+          && 'full-test'
+          || 'test'
+        }}
+
     runs-on: ${{ matrix.runner }}-latest
 
     steps:
@@ -73,8 +80,6 @@ jobs:
         with:
           repository: 'nginx/nginx-tests'
           path: 'nginx/tests'
-          sparse-checkout: |
-            lib
 
       - uses: dtolnay/rust-toolchain@b3b07ba8b418998c39fb20f53e8b695cdcc8de1b
         with:
@@ -117,4 +122,4 @@ jobs:
       - name: run tests
         # always run if build succeeds
         if: ${{ !cancelled() && steps.build.outcome == 'success' }}
-        run: make BUILD=${{ matrix.build }} TEST_PREREQ= test
+        run: make BUILD=${{ matrix.build }} TEST_PREREQ= ${{ env.testTarget }}

Makefile

@@ -99,7 +99,11 @@ unittest: $(NGINX_BUILD_DIR)/Makefile  ## Run unit-tests
 	$(BUILD_ENV) $(NGX_CARGO) test
 
 test: $(TEST_PREREQ) ## Run the integration test suite
-	env $(TEST_ENV) prove -I $(NGINX_TESTS_DIR)/lib --state=save $(TESTS) ||\
+	env $(TEST_ENV) prove -I $(NGINX_TESTS_DIR)/lib -v $(TESTS)
+
+full-test: $(TEST_PREREQ) ## Run the module and NGINX integration test suites
+	env $(TEST_ENV) prove -I $(NGINX_TESTS_DIR)/lib --state=save \
+		-j $(TEST_JOBS) $(TESTS) $(NGINX_TESTS_DIR) ||\
 	env $(TEST_ENV) prove -I $(NGINX_TESTS_DIR)/lib --state=failed -v
 
 clean: ## Cleanup everything

README.md

@@ -11,11 +11,14 @@ certificate management (ACMEv2) protocol.
 
 The module implements following specifications:
 
- * [RFC8555] (Automatic Certificate Management Environment) with limitations:
-     * Only HTTP-01 challenge type is supported
+- [RFC8555] (Automatic Certificate Management Environment) with limitations:
+    - Only HTTP-01 challenge type is supported
+- [RFC8737] (ACME TLS Application-Layer Protocol Negotiation (ALPN) Challenge
+  Extension)
 
 [NGINX]: https://nginx.org/
 [RFC8555]: https://www.rfc-editor.org/rfc/rfc8555.html
+[RFC8737]: https://www.rfc-editor.org/rfc/rfc8737.html
 
 ## Getting Started
 
@@ -165,6 +168,19 @@ Accepted values:
 The generated account keys are preserved across reloads, but will be lost on
 restart unless [state_path](#state_path) is configured.
 
+### challenge
+
+**Syntax:** challenge `type`
+
+**Default:** http-01
+
+**Context:** acme_issuer
+
+Sets challenge type used for this issuer. Allowed values:
+
+- `http-01`
+- `tls-alpn-01`
+
 ### contact
 
 **Syntax:** contact `url`

build/compat-gnu.mk

@@ -1,4 +1,5 @@
 HOST_TUPLE	:= $(shell $(NGX_CARGO) -vV | awk '/^host: / { print $$2; }')
+TEST_JOBS	:= $(shell nproc 2>/dev/null || getconf NPROCESSORS_ONLN 2>/dev/null || echo 1)
 
 # extension for Rust cdylib targets
 ifeq ($(shell uname), Darwin)

build/compat-posix.mk

@@ -1,4 +1,5 @@
 HOST_TUPLE	!= $(NGX_CARGO) -vV | awk '/^host: / { print $$2; }'
+TEST_JOBS	!= nproc 2>/dev/null || getconf NPROCESSORS_ONLN 2>/dev/null || echo 1
 
 # bsd make compatibility
 CURDIR		?= $(.CURDIR)

src/acme.rs

@@ -40,7 +40,13 @@ pub struct NewCertificateOutput {
 }
 
 pub struct AuthorizationContext<'a> {
+    /// Account key thumbprint.
     pub thumbprint: &'a [u8],
+    /// A private key generated for the new certificate request.
+    ///
+    /// This is used in tls-alpn-01 challenge to avoid generating a new key on each verification
+    /// attempt.
+    pub pkey: &'a PKeyRef<Private>,
 }
 
 pub struct AcmeClient<'a, Http>
@@ -351,6 +357,7 @@ where
 
         let order = AuthorizationContext {
             thumbprint: self.key.thumbprint(),
+            pkey: &pkey,
         };
 
         for (url, authorization) in authorizations {

src/acme/solvers.rs

@@ -10,6 +10,7 @@ use super::AuthorizationContext;
 use crate::conf::identifier::Identifier;
 
 pub mod http;
+pub mod tls_alpn;
 
 #[derive(Debug, Error)]
 #[error("challenge registration failed: {0}")]