Harden ACME lifecycle transactions

Author: eldryoth

CHANGELOG.md

@@ -13,7 +13,21 @@ behavior when the change improves security or project direction.
 
 - Add bounded ACME HTTP transport, RFC 9773 ARI scheduling, explicit
   terms-of-service records, per-issuer CA bundles, `fluxheim-acme doctor`, and
-  confirmation-gated account rollover/deactivation and certificate revocation.
+  confirmation-gated account deactivation and certificate revocation. Account
+  rollover now fails before remote mutation until the client supports a
+  caller-generated, pre-journaled replacement key.
+- Serialize TLS-ALPN challenge install and cleanup under the ACME mutation lock,
+  with race coverage proving cleanup cannot leave a partial certificate pair.
+- Bound ARI planning by lookup concurrency, per-target timeout, and total budget;
+  execute due work progressively and cache issuer guidance through Retry-After.
+- Make account deactivation and certificate revocation transactional. Pending
+  account state fails closed, while revocation quarantines the active pair before
+  the remote operation, restores it on failure, and requests live reload after
+  success even when scheduled renewal is disabled.
+- Validate online ACME directories structurally and require exact advertised ToS
+  agreement, with an explicit private-directory override only for omitted terms.
+- Remove the unmaintained direct `rustls-pemfile` dependency in favor of the
+  maintained `rustls-pki-types` PEM parser already provided through rustls.
 
 - Add the checked-in F5 iRules-style route access policy and configuration
   example, with real listener coverage for normal origin traffic, pre-origin

Cargo.lock

@@ -14,11 +14,11 @@ acme-client = [
     "dep:bytes",
     "dep:http",
     "dep:http-body-util",
+    "dep:futures",
     "dep:hyper",
     "dep:hyper-rustls",
     "dep:hyper-util",
     "dep:rustls",
-    "dep:rustls-pemfile",
     "dep:tokio",
     "instant-acme/hyper-rustls",
 ]
@@ -28,6 +28,7 @@ base64-ng = { version = "1.3.7", optional = true }
 bytes = { version = "1.12.1", optional = true }
 fluxheim-config = { path = "../fluxheim-config", features = ["acme"] }
 getrandom = "0.4.3"
+futures = { version = "0.3.32", optional = true }
 http = { version = "1.4.2", optional = true }
 http-body-util = { version = "0.1.3", optional = true }
 hyper = { version = "1.10.1", default-features = false, features = ["client", "http1", "http2"], optional = true }
@@ -38,7 +39,6 @@ log = "0.4.33"
 rcgen = { version = "0.14.8", default-features = false, features = ["pem", "ring"] }
 rustix = { version = "1.1.4", features = ["fs", "process"] }
 rustls = { version = "0.23.41", default-features = false, features = ["ring", "std", "tls12"], optional = true }
-rustls-pemfile = { version = "2.2.0", optional = true }
 sanitization = { version = "1.2.4", features = ["alloc"] }
 serde = { version = "1.0.228", features = ["derive"] }
 serde_json = "1.0.150"

crates/fluxheim-acme/Cargo.toml

@@ -14,6 +14,15 @@ use super::{
 
 const ACME_ACCOUNT_DIR: &str = "accounts";
 const ACME_ACCOUNT_CREDENTIALS_FILE: &str = "credentials.json";
+const ACME_ACCOUNT_DEACTIVATION_FILE: &str = ".credentials.deactivation.pending";
+
+#[cfg(feature = "acme-client")]
+pub(crate) struct AccountDeactivationTransaction {
+    directory: PathBuf,
+    active: PathBuf,
+    pending: PathBuf,
+    _lock: AcmeMutationLock,
+}
 
 pub fn account_credentials_path(storage: &Path, issuer_name: &str) -> AcmeAccountCredentialsPath {
     AcmeAccountCredentialsPath {
@@ -29,6 +38,36 @@ pub fn load_account_credentials(
     issuer_name: &str,
 ) -> Result<Option<instant_acme::AccountCredentials>, AcmeAccountStoreError> {
     let path = account_credentials_path(storage, issuer_name).path;
+    let directory = path
+        .parent()
+        .ok_or_else(|| AcmeAccountStoreError::UnsafePath {
+            path: path.clone(),
+            message: "credentials path has no parent directory".to_owned(),
+        })?;
+    match fs::symlink_metadata(directory) {
+        Ok(metadata) if metadata.file_type().is_symlink() || !metadata.is_dir() => {
+            return Err(AcmeAccountStoreError::UnsafePath {
+                path: directory.to_path_buf(),
+                message: "account directory is not a real directory".to_owned(),
+            });
+        }
+        Ok(_) => {}
+        Err(error) if error.kind() == io::ErrorKind::NotFound => return Ok(None),
+        Err(error) => return Err(account_store_io_error(directory, error)),
+    }
+    let _lock = AcmeMutationLock::acquire(directory)
+        .map_err(|error| account_store_io_error(&directory.join(".fluxheim-acme.lock"), error))?;
+    let pending = directory.join(ACME_ACCOUNT_DEACTIVATION_FILE);
+    if pending
+        .try_exists()
+        .map_err(|error| account_store_io_error(&pending, error))?
+    {
+        return Err(AcmeAccountStoreError::UnsafePath {
+            path: pending,
+            message: "account deactivation is in an ambiguous pending state; operator recovery is required"
+                .to_owned(),
+        });
+    }
     let metadata = match fs::symlink_metadata(&path) {
         Ok(metadata) => metadata,
         Err(error) if error.kind() == io::ErrorKind::NotFound => return Ok(None),
@@ -80,6 +119,61 @@ pub fn load_account_credentials(
         })
 }
 
+#[cfg(feature = "acme-client")]
+pub(crate) fn begin_account_deactivation(
+    storage: &Path,
+    issuer_name: &str,
+) -> Result<AccountDeactivationTransaction, AcmeAccountStoreError> {
+    let active = account_credentials_path(storage, issuer_name).path;
+    let directory = active
+        .parent()
+        .ok_or_else(|| AcmeAccountStoreError::UnsafePath {
+            path: active.clone(),
+            message: "credentials path has no parent directory".to_owned(),
+        })?;
+    ensure_safe_account_directory(directory)?;
+    let lock = AcmeMutationLock::acquire(directory)
+        .map_err(|error| account_store_io_error(&directory.join(".fluxheim-acme.lock"), error))?;
+    ensure_safe_account_destination(&active)?;
+    let pending = directory.join(ACME_ACCOUNT_DEACTIVATION_FILE);
+    match fs::symlink_metadata(&pending) {
+        Ok(_) => {
+            return Err(AcmeAccountStoreError::UnsafePath {
+                path: pending,
+                message: "account deactivation transaction already exists".to_owned(),
+            });
+        }
+        Err(error) if error.kind() == io::ErrorKind::NotFound => {}
+        Err(error) => return Err(account_store_io_error(&pending, error)),
+    }
+    fs::rename(&active, &pending).map_err(|error| account_store_io_error(&active, error))?;
+    sync_account_directory(directory)?;
+    Ok(AccountDeactivationTransaction {
+        directory: directory.to_path_buf(),
+        active,
+        pending,
+        _lock: lock,
+    })
+}
+
+#[cfg(feature = "acme-client")]
+impl AccountDeactivationTransaction {
+    #[cfg(test)]
+    pub(crate) fn abandon(self) {}
+
+    pub(crate) fn rollback(self) -> Result<(), AcmeAccountStoreError> {
+        fs::rename(&self.pending, &self.active)
+            .map_err(|error| account_store_io_error(&self.active, error))?;
+        sync_account_directory(&self.directory)
+    }
+
+    pub(crate) fn complete(self) -> Result<(), AcmeAccountStoreError> {
+        fs::remove_file(&self.pending)
+            .map_err(|error| account_store_io_error(&self.pending, error))?;
+        sync_account_directory(&self.directory)
+    }
+}
+
 pub fn store_account_credentials(
     storage: &Path,
     issuer_name: &str,