<commit_before>package acme

import (
	"crypto/rsa"
	"crypto/sha256"
	"crypto/tls"
	"encoding/hex"
	"fmt"
	"net"
	"net/http"
)

type tlsSNIChallenge struct {
	jws     *jws
	optPort string
	start   chan net.Listener
	end     chan error
}

func (t *tlsSNIChallenge) Solve(chlng challenge, domain string) error {
	// FIXME: https://github.com/ietf-wg-acme/acme/pull/22
	// Currently we implement this challenge to track boulder, not the current spec!

	logf("[INFO] acme: Trying to solve TLS-SNI-01")

	t.start = make(chan net.Listener)
	t.end = make(chan error)

	// Generate the Key Authorization for the challenge
	keyAuth, err := getKeyAuthorization(chlng.Token, &t.jws.privKey.PublicKey)
	if err != nil {
		return err
	}

	certificate, err := t.generateCertificate(keyAuth)
	if err != nil {
		return err
	}

	go t.startSNITLSServer(certificate)
	var listener net.Listener
	select {
	case listener = <-t.start:
		break
	case err := <-t.end:
		return fmt.Errorf("Could not start HTTPS server for challenge -> %v", err)
	}

	// Make sure we properly close the HTTP server before we return
	defer func() {
		listener.Close()
		err = <-t.end
		close(t.start)
		close(t.end)
	}()

	return validate(t.jws, chlng.URI, challenge{Resource: "challenge", Type: chlng.Type, Token: chlng.Token, KeyAuthorization: keyAuth})
}

func (t *tlsSNIChallenge) generateCertificate(keyAuth string) (tls.Certificate, error) {

	zBytes := sha256.Sum256([]byte(keyAuth))
	z := hex.EncodeToString(zBytes[:sha256.Size])

	// generate a new RSA key for the certificates
	tempPrivKey, err := generatePrivateKey(rsakey, 2048)
	if err != nil {
		return tls.Certificate{}, err
	}
	rsaPrivKey := tempPrivKey.(*rsa.PrivateKey)
	rsaPrivPEM := pemEncode(rsaPrivKey)

	domain := fmt.Sprintf("%s.%s.acme.invalid", z[:32], z[32:])
	tempCertPEM, err := generatePemCert(rsaPrivKey, domain)
	if err != nil {
		return tls.Certificate{}, err
	}

	certificate, err := tls.X509KeyPair(tempCertPEM, rsaPrivPEM)
	if err != nil {
		return tls.Certificate{}, err
	}

	return certificate, nil
}

func (t *tlsSNIChallenge) startSNITLSServer(cert tls.Certificate) {

	// Allow for CLI port override
	port := ":443"
	if t.optPort != "" {
		port = ":" + t.optPort
	}

	tlsConf := new(tls.Config)
	tlsConf.Certificates = []tls.Certificate{cert}

	tlsListener, err := tls.Listen("tcp", port, tlsConf)
	if err != nil {
		t.end <- err
	}
	// Signal successfull start
	t.start <- tlsListener

	http.Serve(tlsListener, nil)

	t.end <- nil
}<commit_msg>Simplify tlsSNIChallenge code.<commit_after>package acme

import (
	"crypto/rsa"
	"crypto/sha256"
	"crypto/tls"
	"encoding/hex"
	"fmt"
	"net/http"
)

type tlsSNIChallenge struct {
	jws     *jws
	optPort string
}

func (t *tlsSNIChallenge) Solve(chlng challenge, domain string) error {
	// FIXME: https://github.com/ietf-wg-acme/acme/pull/22
	// Currently we implement this challenge to track boulder, not the current spec!

	logf("[INFO] acme: Trying to solve TLS-SNI-01")

	// Generate the Key Authorization for the challenge
	keyAuth, err := getKeyAuthorization(chlng.Token, &t.jws.privKey.PublicKey)
	if err != nil {
		return err
	}

	cert, err := t.generateCertificate(keyAuth)
	if err != nil {
		return err
	}

	// Allow for CLI port override
	port := ":443"
	if t.optPort != "" {
		port = ":" + t.optPort
	}

	tlsConf := new(tls.Config)
	tlsConf.Certificates = []tls.Certificate{cert}

	listener, err := tls.Listen("tcp", port, tlsConf)
	if err != nil {
		return fmt.Errorf("Could not start HTTPS server for challenge -> %v", err)
	}
	defer listener.Close()

	go http.Serve(listener, nil)

	return validate(t.jws, chlng.URI, challenge{Resource: "challenge", Type: chlng.Type, Token: chlng.Token, KeyAuthorization: keyAuth})
}

func (t *tlsSNIChallenge) generateCertificate(keyAuth string) (tls.Certificate, error) {

	zBytes := sha256.Sum256([]byte(keyAuth))
	z := hex.EncodeToString(zBytes[:sha256.Size])

	// generate a new RSA key for the certificates
	tempPrivKey, err := generatePrivateKey(rsakey, 2048)
	if err != nil {
		return tls.Certificate{}, err
	}
	rsaPrivKey := tempPrivKey.(*rsa.PrivateKey)
	rsaPrivPEM := pemEncode(rsaPrivKey)

	domain := fmt.Sprintf("%s.%s.acme.invalid", z[:32], z[32:])
	tempCertPEM, err := generatePemCert(rsaPrivKey, domain)
	if err != nil {
		return tls.Certificate{}, err
	}

	certificate, err := tls.X509KeyPair(tempCertPEM, rsaPrivPEM)
	if err != nil {
		return tls.Certificate{}, err
	}

	return certificate, nil
}
{'fraction_non_alphanumeric': 0.13766000449135415, 'fraction_numerical': 0.013474062429822591, 'mean_word_length': 4.078677309007982, 'pattern_counts': {'":': 4, '<': 9, '<?xml version=': 0, '>': 5, 'https://': 2, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '5751949', 'n_tokens_mistral': 1737, 'n_tokens_neox': 1612, 'n_words': 411}