diff --git a/.gitignore b/.gitignore index b653cb06c..ac2842e27 100644 --- a/.gitignore +++ b/.gitignore @@ -17,11 +17,14 @@ letsencrypt-auto-source/letsencrypt-auto.sig.lzma.base64 /.vagrant +tags + # editor temporary files *~ -*.swp +*.sw? \#*# .idea +.ropeproject # auth --cert-path --chain-path /*.pem diff --git a/.travis.yml b/.travis.yml index 6f964dbec..3a9a994a9 100644 --- a/.travis.yml +++ b/.travis.yml @@ -4,9 +4,6 @@ cache: directories: - $HOME/.cache/pip -# This makes sure we get a host with docker-compose present. -dist: trusty - before_install: - 'dpkg -s libaugeas0' @@ -19,48 +16,80 @@ env: matrix: include: - - python: "2.6" - env: TOXENV=py26 BOULDER_INTEGRATION=1 - sudo: true - after_failure: - - sudo cat /var/log/mysql/error.log - - ps aux | grep mysql - - python: "2.6" - env: TOXENV=py26-oldest BOULDER_INTEGRATION=1 - sudo: true - after_failure: - - sudo cat /var/log/mysql/error.log - - ps aux | grep mysql - python: "2.7" - env: TOXENV=apacheconftest - sudo: required - - python: "2.7" - env: TOXENV=py27 BOULDER_INTEGRATION=1 - sudo: true - after_failure: - - sudo cat /var/log/mysql/error.log - - ps aux | grep mysql - - python: "2.7" - env: TOXENV=py27-oldest BOULDER_INTEGRATION=1 - sudo: true - after_failure: - - sudo cat /var/log/mysql/error.log - - ps aux | grep mysql + env: TOXENV=cover - python: "2.7" env: TOXENV=lint + - python: "2.7" + env: TOXENV=py27-oldest BOULDER_INTEGRATION=1 + sudo: required + after_failure: + - sudo cat /var/log/mysql/error.log + - ps aux | grep mysql + services: docker + - python: "2.6" + env: TOXENV=py26 BOULDER_INTEGRATION=1 + sudo: required + after_failure: + - sudo cat /var/log/mysql/error.log + - ps aux | grep mysql + services: docker + - python: "2.6" + env: TOXENV=py26-oldest BOULDER_INTEGRATION=1 + sudo: required + after_failure: + - sudo cat /var/log/mysql/error.log + - ps aux | grep mysql + services: docker + - python: "2.7" + env: TOXENV=py27_install BOULDER_INTEGRATION=1 + sudo: required + after_failure: + - sudo cat /var/log/mysql/error.log + - ps aux | grep mysql + services: docker - sudo: required - env: TOXENV=le_auto + env: TOXENV=apache_compat + services: docker + before_install: + addons: + - sudo: required + env: TOXENV=nginx_compat + services: docker + before_install: + addons: + - sudo: required + env: TOXENV=le_auto_precise + services: docker + before_install: + addons: + - sudo: required + env: TOXENV=le_auto_trusty + services: docker + before_install: + addons: + - sudo: required + env: TOXENV=le_auto_wheezy + services: docker + before_install: + addons: + - sudo: required + env: TOXENV=le_auto_centos6 services: docker before_install: addons: - python: "2.7" - env: TOXENV=cover + env: TOXENV=apacheconftest + sudo: required - python: "3.3" env: TOXENV=py33 - python: "3.4" env: TOXENV=py34 - python: "3.5" env: TOXENV=py35 + - python: "2.7" + env: TOXENV=nginxroundtrip + # Only build pushes to the master branch, PRs, and branches beginning with # `test-`. This reduces the number of simultaneous Travis runs, which speeds @@ -92,7 +121,6 @@ addons: - python-dev - python-virtualenv - gcc - - dialog - libaugeas0 - libssl-dev - libffi-dev @@ -104,7 +132,6 @@ addons: - apache2 - libapache2-mod-wsgi - libapache2-mod-macro - - sudo install: "travis_retry pip install tox coveralls" script: 'travis_retry tox && ([ "xxx$BOULDER_INTEGRATION" = "xxx" ] || ./tests/travis-integration.sh)' diff --git a/CHANGES.rst b/CHANGES.rst index 4ce41a8bc..3b92c125f 100644 --- a/CHANGES.rst +++ b/CHANGES.rst @@ -1,11 +1,8 @@ ChangeLog ========= -Please note: -the change log will only get updated after first release - for now please use the -`commit log `_. +To see the changes in a given release, view the issues closed in a given +release's GitHub milestone: -To see the changes in a given release, inspect the github milestone for the -release. For instance: - -https://github.com/certbot/certbot/issues?utf8=%E2%9C%93&q=milestone%3A0.3.0 + - `Past releases `_ + - `Upcoming releases `_ diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 5f1625658..d740b7d89 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -15,4 +15,21 @@ to the Sphinx generated docs is provided below. --> -https://certbot.eff.org/docs/contributing.html +# Certbot Contributing Guide + +Hi! Welcome to the Certbot project. We look forward to collaborating with you. + +If you're reporting a bug in Certbot, please make sure to include: + - The version of Certbot you're running. + - The operating system you're running it on. + - The commands you ran. + - What you expected to happen, and + - What actually happened. + +If you're a developer, we have some helpful information in our +[Developer's Guide](https://certbot.eff.org/docs/contributing.html) to get you +started. In particular, we recommend you read these sections + + - [Finding issues to work on](https://certbot.eff.org/docs/contributing.html#find-issues-to-work-on) + - [Coding style](https://certbot.eff.org/docs/contributing.html#coding-style) + - [Submitting a pull request](https://certbot.eff.org/docs/contributing.html#submitting-a-pull-request) diff --git a/README.rst b/README.rst index 72188608b..f986703ac 100644 --- a/README.rst +++ b/README.rst @@ -1,4 +1,4 @@ -.. This file contains of a series of comments that are used to include sections of this README in other files. Do not modify these comments unless you know what you are doing. tag:intro-begin +.. This file contains a series of comments that are used to include sections of this README in other files. Do not modify these comments unless you know what you are doing. tag:intro-begin Certbot is part of EFF’s effort to encrypt the entire Internet. Secure communication over the Web relies on HTTPS, which requires the use of a digital certificate that lets browsers verify the identify of web servers (e.g., is that really google.com?). Web servers obtain their certificates from trusted third parties called certificate authorities (CAs). Certbot is an easy-to-use client that fetches a certificate from Let’s Encrypt—an open certificate authority launched by the EFF, Mozilla, and others—and deploys it to a web server. @@ -8,6 +8,141 @@ How you use Certbot depends on the configuration of your web server. The best wa If you’re using a hosted service and don’t have direct access to your web server, you might not be able to use Certbot. Check with your hosting provider for documentation about uploading certificates or using certificates issues by Let’s Encrypt. +Certbot is a fully-featured, extensible client for the Let's +Encrypt CA (or any other CA that speaks the `ACME +`_ +protocol) that can automate the tasks of obtaining certificates and +configuring webservers to use them. This client runs on Unix-based operating +systems. + +Until May 2016, Certbot was named simply ``letsencrypt`` or ``letsencrypt-auto``, +depending on install method. Instructions on the Internet, and some pieces of the +software, may still refer to this older name. + +Contributing +------------ + +If you'd like to contribute to this project please read `Developer Guide +`_. + +.. _installation: + +Installation +------------ + +The easiest way to install Certbot is by visiting `certbot.eff.org`_, where you can +find the correct installation instructions for many web server and OS combinations. +For more information, see `Get Certbot `_. + +.. _certbot.eff.org: https://certbot.eff.org/ + +How to run the client +--------------------- + +In many cases, you can just run ``certbot-auto`` or ``certbot``, and the +client will guide you through the process of obtaining and installing certs +interactively. + +For full command line help, you can type:: + + ./certbot-auto --help all + + +You can also tell it exactly what you want it to do from the command line. +For instance, if you want to obtain a cert for ``example.com``, +``www.example.com``, and ``other.example.net``, using the Apache plugin to both +obtain and install the certs, you could do this:: + + ./certbot-auto --apache -d example.com -d www.example.com -d other.example.net + +(The first time you run the command, it will make an account, and ask for an +email and agreement to the Let's Encrypt Subscriber Agreement; you can +automate those with ``--email`` and ``--agree-tos``) + +If you want to use a webserver that doesn't have full plugin support yet, you +can still use "standalone" or "webroot" plugins to obtain a certificate:: + + ./certbot-auto certonly --standalone --email admin@example.com -d example.com -d www.example.com -d other.example.net + + +Understanding the client in more depth +-------------------------------------- + +To understand what the client is doing in detail, it's important to +understand the way it uses plugins. Please see the `explanation of +plugins `_ in +the User Guide. + +Links +===== + +.. Do not modify this comment unless you know what you're doing. tag:links-begin + +Documentation: https://certbot.eff.org/docs + +Software project: https://github.com/certbot/certbot + +Notes for developers: https://certbot.eff.org/docs/contributing.html + +Main Website: https://certbot.eff.org + +Let's Encrypt Website: https://letsencrypt.org + +IRC Channel: #letsencrypt on `Freenode`_ or #certbot on `OFTC`_ + +Community: https://community.letsencrypt.org + +ACME spec: http://ietf-wg-acme.github.io/acme/ + +ACME working area in github: https://github.com/ietf-wg-acme/acme + + +Mailing list: `client-dev`_ (to subscribe without a Google account, send an +email to client-dev+subscribe@letsencrypt.org) + +|build-status| |coverage| |docs| |container| + +.. _Freenode: https://webchat.freenode.net?channels=%23letsencrypt + +.. _OFTC: https://webchat.oftc.net?channels=%23certbot + +.. _client-dev: https://groups.google.com/a/letsencrypt.org/forum/#!forum/client-dev + +.. |build-status| image:: https://travis-ci.org/certbot/certbot.svg?branch=master + :target: https://travis-ci.org/certbot/certbot + :alt: Travis CI status + +.. |coverage| image:: https://coveralls.io/repos/certbot/certbot/badge.svg?branch=master + :target: https://coveralls.io/r/certbot/certbot + :alt: Coverage status + +.. |docs| image:: https://readthedocs.org/projects/letsencrypt/badge/ + :target: https://readthedocs.org/projects/letsencrypt/ + :alt: Documentation status + +.. |container| image:: https://quay.io/repository/letsencrypt/letsencrypt/status + :target: https://quay.io/repository/letsencrypt/letsencrypt + :alt: Docker Repository on Quay.io + +.. Do not modify this comment unless you know what you're doing. tag:links-end + +System Requirements +=================== + +The Let's Encrypt Client presently only runs on Unix-ish OSes that include +Python 2.6 or 2.7; Python 3.x support will hopefully be added in the future. The +client requires root access in order to write to ``/etc/letsencrypt``, +``/var/log/letsencrypt``, ``/var/lib/letsencrypt``; to bind to ports 80 and 443 +(if you use the ``standalone`` plugin) and to read and modify webserver +configurations (if you use the ``apache`` or ``nginx`` plugins). If none of +these apply to you, it is theoretically possible to run without root privileges, +but for most users who want to avoid running an ACME client as root, either +`letsencrypt-nosudo `_ or +`simp_le `_ are more appropriate choices. + +The Apache plugin currently requires a Debian-based OS with augeas version +1.0; this includes Ubuntu 12.04+ and Debian 7+. + .. Do not modify this comment unless you know what you're doing. tag:intro-end .. Do not modify this comment unless you know what you're doing. tag:features-begin @@ -17,11 +152,12 @@ Current Features * Supports multiple web servers: - - apache/2.x (working on Debian 8+ and Ubuntu 12.04+) - - standalone (runs its own simple webserver to prove you control a domain) + - apache/2.x (beta support for auto-configuration) + - nginx/0.8.48+ (alpha support for auto-configuration) - webroot (adds files to webroot directories in order to prove control of domains and obtain certs) - - nginx/0.8.48+ (highly experimental, not included in certbot-auto) + - standalone (runs its own simple webserver to prove you control a domain) + - other server software via `third party plugins `_ * The private key is generated locally on your system. * Can talk to the Let's Encrypt CA or optionally to other ACME diff --git a/Vagrantfile b/Vagrantfile index e5975442f..23d3ddf13 100644 --- a/Vagrantfile +++ b/Vagrantfile @@ -29,6 +29,7 @@ Vagrant.configure(VAGRANTFILE_API_VERSION) do |config| # VM needs more memory to run test suite, got "OSError: [Errno 12] # Cannot allocate memory" when running # letsencrypt.client.tests.display.util_test.NcursesDisplayTest + # We may no longer need this. v.memory = 1024 # Handle cases when the host is behind a private network by making the diff --git a/acme/acme/challenges.py b/acme/acme/challenges.py index 6242c376c..9f9cc05b8 100644 --- a/acme/acme/challenges.py +++ b/acme/acme/challenges.py @@ -9,6 +9,7 @@ from cryptography.hazmat.primitives import hashes import OpenSSL import requests +from acme import dns_resolver from acme import errors from acme import crypto_util from acme import fields @@ -232,11 +233,11 @@ class DNS01Response(KeyAuthorizationChallengeResponse): logger.debug("Verifying %s at %s...", chall.typ, validation_domain_name) try: - from acme import dns_resolver - except ImportError: # pragma: no cover - raise errors.Error("Local validation for 'dns-01' challenges " - "requires 'dnspython'") - txt_records = dns_resolver.txt_records_for_name(validation_domain_name) + txt_records = dns_resolver.txt_records_for_name( + validation_domain_name) + except errors.DependencyError: + raise errors.DependencyError("Local validation for 'dns-01' " + "challenges requires 'dnspython'") exists = validation in txt_records if not exists: logger.debug("Key authorization from response (%r) doesn't match " diff --git a/acme/acme/challenges_test.py b/acme/acme/challenges_test.py index 27976931a..5ac07abdd 100644 --- a/acme/acme/challenges_test.py +++ b/acme/acme/challenges_test.py @@ -10,7 +10,7 @@ from six.moves.urllib import parse as urllib_parse # pylint: disable=import-err from acme import errors from acme import jose from acme import test_util - +from acme.dns_resolver import DNS_REQUIREMENT CERT = test_util.load_comparable_cert('cert.pem') KEY = jose.JWKRSA(key=test_util.load_rsa_private_key('rsa512_key.pem')) @@ -92,6 +92,7 @@ class DNS01ResponseTest(unittest.TestCase): from acme.challenges import DNS01 self.chall = DNS01(token=(b'x' * 16)) self.response = self.chall.response(KEY) + self.records_for_name_path = "acme.dns_resolver.txt_records_for_name" def test_to_partial_json(self): self.assertEqual(self.jmsg, self.msg.to_partial_json()) @@ -108,28 +109,41 @@ class DNS01ResponseTest(unittest.TestCase): key2 = jose.JWKRSA.load(test_util.load_vector('rsa256_key.pem')) self.response.simple_verify(self.chall, "local", key2.public_key()) - @mock.patch("acme.dns_resolver.txt_records_for_name") - def test_simple_verify_good_validation(self, mock_resolver): - mock_resolver.return_value = [self.chall.validation(KEY.public_key())] - self.assertTrue(self.response.simple_verify( - self.chall, "local", KEY.public_key())) - mock_resolver.assert_called_once_with( - self.chall.validation_domain_name("local")) + @mock.patch('acme.dns_resolver.DNS_AVAILABLE', False) + def test_simple_verify_without_dns(self): + self.assertRaises( + errors.DependencyError, self.response.simple_verify, + self.chall, 'local', KEY.public_key()) - @mock.patch("acme.dns_resolver.txt_records_for_name") - def test_simple_verify_good_validation_multiple_txts(self, mock_resolver): - mock_resolver.return_value = [ - "!", self.chall.validation(KEY.public_key())] - self.assertTrue(self.response.simple_verify( - self.chall, "local", KEY.public_key())) - mock_resolver.assert_called_once_with( - self.chall.validation_domain_name("local")) + @test_util.skip_unless(test_util.requirement_available(DNS_REQUIREMENT), + "optional dependency dnspython is not available") + def test_simple_verify_good_validation(self): # pragma: no cover + with mock.patch(self.records_for_name_path) as mock_resolver: + mock_resolver.return_value = [ + self.chall.validation(KEY.public_key())] + self.assertTrue(self.response.simple_verify( + self.chall, "local", KEY.public_key())) + mock_resolver.assert_called_once_with( + self.chall.validation_domain_name("local")) - @mock.patch("acme.dns_resolver.txt_records_for_name") - def test_simple_verify_bad_validation(self, mock_dns): - mock_dns.return_value = ["!"] - self.assertFalse(self.response.simple_verify( - self.chall, "local", KEY.public_key())) + @test_util.skip_unless(test_util.requirement_available(DNS_REQUIREMENT), + "optional dependency dnspython is not available") + def test_simple_verify_good_validation_multitxts(self): # pragma: no cover + with mock.patch(self.records_for_name_path) as mock_resolver: + mock_resolver.return_value = [ + "!", self.chall.validation(KEY.public_key())] + self.assertTrue(self.response.simple_verify( + self.chall, "local", KEY.public_key())) + mock_resolver.assert_called_once_with( + self.chall.validation_domain_name("local")) + + @test_util.skip_unless(test_util.requirement_available(DNS_REQUIREMENT), + "optional dependency dnspython is not available") + def test_simple_verify_bad_validation(self): # pragma: no cover + with mock.patch(self.records_for_name_path) as mock_resolver: + mock_resolver.return_value = ["!"] + self.assertFalse(self.response.simple_verify( + self.chall, "local", KEY.public_key())) class DNS01Test(unittest.TestCase): diff --git a/acme/acme/client.py b/acme/acme/client.py index 117ee6b7d..d041cc7d7 100644 --- a/acme/acme/client.py +++ b/acme/acme/client.py @@ -1,4 +1,5 @@ """ACME client API.""" +import base64 import collections import datetime from email.utils import parsedate_tz @@ -28,6 +29,8 @@ logger = logging.getLogger(__name__) if sys.version_info < (2, 7, 9): # pragma: no cover requests.packages.urllib3.contrib.pyopenssl.inject_into_urllib3() +DER_CONTENT_TYPE = 'application/pkix-cert' + class Client(object): # pylint: disable=too-many-instance-attributes """ACME client. @@ -45,7 +48,6 @@ class Client(object): # pylint: disable=too-many-instance-attributes `verify_ssl`. """ - DER_CONTENT_TYPE = 'application/pkix-cert' def __init__(self, directory, key, alg=jose.RS256, verify_ssl=True, net=None): @@ -89,8 +91,6 @@ class Client(object): # pylint: disable=too-many-instance-attributes :returns: Registration Resource. :rtype: `.RegistrationResource` - :raises .UnexpectedUpdate: - """ new_reg = messages.NewRegistration() if new_reg is None else new_reg assert isinstance(new_reg, messages.NewRegistration) @@ -101,12 +101,7 @@ class Client(object): # pylint: disable=too-many-instance-attributes # "Instance of 'Field' has no key/contact member" bug: # pylint: disable=no-member - regr = self._regr_from_response(response) - if (regr.body.key != self.key.public_key() or - regr.body.contact != new_reg.contact): - raise errors.UnexpectedUpdate(regr) - - return regr + return self._regr_from_response(response) def _send_recv_regr(self, regr, body): response = self.net.post(regr.uri, body) @@ -311,7 +306,7 @@ class Client(object): # pylint: disable=too-many-instance-attributes # TODO: assert len(authzrs) == number of SANs req = messages.CertificateRequest(csr=csr) - content_type = self.DER_CONTENT_TYPE # TODO: add 'cert_type 'argument + content_type = DER_CONTENT_TYPE # TODO: add 'cert_type 'argument response = self.net.post( authzrs[0].new_cert_uri, # TODO: acme-spec #90 req, @@ -413,7 +408,7 @@ class Client(object): # pylint: disable=too-many-instance-attributes :rtype: tuple """ - content_type = self.DER_CONTENT_TYPE # TODO: make it a param + content_type = DER_CONTENT_TYPE # TODO: make it a param response = self.net.get(uri, headers={'Accept': content_type}, content_type=content_type) return response, jose.ComparableX509(OpenSSL.crypto.load_certificate( @@ -502,6 +497,7 @@ class Client(object): # pylint: disable=too-many-instance-attributes class ClientNetwork(object): # pylint: disable=too-many-instance-attributes """Client network.""" JSON_CONTENT_TYPE = 'application/json' + JOSE_CONTENT_TYPE = 'application/jose+json' JSON_ERROR_CONTENT_TYPE = 'application/problem+json' REPLAY_NONCE_HEADER = 'Replay-Nonce' @@ -527,10 +523,11 @@ class ClientNetwork(object): # pylint: disable=too-many-instance-attributes :rtype: `.JWS` """ - jobj = obj.json_dumps().encode() - logger.debug('Serialized JSON: %s', jobj) + jobj = obj.json_dumps(indent=2).encode() + logger.debug('JWS payload:\n%s', jobj) return jws.JWS.sign( - payload=jobj, key=self.key, alg=self.alg, nonce=nonce).json_dumps() + payload=jobj, key=self.key, alg=self.alg, + nonce=nonce).json_dumps(indent=2) @classmethod def _check_response(cls, response, content_type=None): @@ -551,9 +548,6 @@ class ClientNetwork(object): # pylint: disable=too-many-instance-attributes :raises .ClientError: In case of other networking errors. """ - logger.debug('Received response %s (headers: %s): %r', - response, response.headers, response.content) - response_ct = response.headers.get('Content-Type') try: # TODO: response.json() is called twice, once here, and @@ -605,14 +599,26 @@ class ClientNetwork(object): # pylint: disable=too-many-instance-attributes """ - logging.debug('Sending %s request to %s. args: %r, kwargs: %r', - method, url, args, kwargs) + if method == "POST": + logging.debug('Sending POST request to %s:\n%s', + url, kwargs['data']) + else: + logging.debug('Sending %s request to %s.', method, url) kwargs['verify'] = self.verify_ssl kwargs.setdefault('headers', {}) kwargs['headers'].setdefault('User-Agent', self.user_agent) response = self.session.request(method, url, *args, **kwargs) - logging.debug('Received %s. Headers: %s. Content: %r', - response, response.headers, response.content) + # If content is DER, log the base64 of it instead of raw bytes, to keep + # binary data out of the logs. + if response.headers.get("Content-Type") == DER_CONTENT_TYPE: + debug_content = base64.b64encode(response.content) + else: + debug_content = response.content + logger.debug('Received response:\nHTTP %d\n%s\n\n%s', + response.status_code, + "\n".join(["{0}: {1}".format(k, v) + for k, v in response.headers.items()]), + debug_content) return response def head(self, *args, **kwargs): @@ -637,7 +643,7 @@ class ClientNetwork(object): # pylint: disable=too-many-instance-attributes decoded_nonce = jws.Header._fields['nonce'].decode(nonce) except jose.DeserializationError as error: raise errors.BadNonce(nonce, error) - logger.debug('Storing nonce: %r', decoded_nonce) + logger.debug('Storing nonce: %s', nonce) self._nonces.add(decoded_nonce) else: raise errors.MissingNonce(response) @@ -648,9 +654,10 @@ class ClientNetwork(object): # pylint: disable=too-many-instance-attributes self._add_nonce(self.head(url)) return self._nonces.pop() - def post(self, url, obj, content_type=JSON_CONTENT_TYPE, **kwargs): + def post(self, url, obj, content_type=JOSE_CONTENT_TYPE, **kwargs): """POST object wrapped in `.JWS` and check response.""" data = self._wrap_in_jws(obj, self._get_nonce(url)) + kwargs.setdefault('headers', {'Content-Type': content_type}) response = self._send_request('POST', url, data=data, **kwargs) self._add_nonce(response) return self._check_response(response, content_type=content_type) diff --git a/acme/acme/client_test.py b/acme/acme/client_test.py index a526a0984..e0403ef28 100644 --- a/acme/acme/client_test.py +++ b/acme/acme/client_test.py @@ -102,12 +102,6 @@ class ClientTest(unittest.TestCase): self.assertEqual(self.regr, self.client.register(self.new_reg)) # TODO: test POST call arguments - # TODO: split here and separate test - reg_wrong_key = self.regr.body.update(key=KEY2.public_key()) - self.response.json.return_value = reg_wrong_key.to_json() - self.assertRaises( - errors.UnexpectedUpdate, self.client.register, self.new_reg) - def test_register_missing_next(self): self.response.status_code = http_client.CREATED self.assertRaises( @@ -540,6 +534,29 @@ class ClientNetworkTest(unittest.TestCase): 'HEAD', 'http://example.com/', 'foo', headers=mock.ANY, verify=mock.ANY, bar='baz') + @mock.patch('acme.client.logger') + def test_send_request_get_der(self, mock_logger): + self.net.session = mock.MagicMock() + self.net.session.request.return_value = mock.MagicMock( + ok=True, status_code=http_client.OK, + headers={"Content-Type": "application/pkix-cert"}, + content=b"hi") + # pylint: disable=protected-access + self.net._send_request('HEAD', 'http://example.com/', 'foo', bar='baz') + mock_logger.debug.assert_called_once_with( + 'Received response:\nHTTP %d\n%s\n\n%s', 200, + 'Content-Type: application/pkix-cert', b'aGk=') + + def test_send_request_post(self): + self.net.session = mock.MagicMock() + self.net.session.request.return_value = self.response + # pylint: disable=protected-access + self.assertEqual(self.response, self.net._send_request( + 'POST', 'http://example.com/', 'foo', data='qux', bar='baz')) + self.net.session.request.assert_called_once_with( + 'POST', 'http://example.com/', 'foo', + headers=mock.ANY, verify=mock.ANY, data='qux', bar='baz') + def test_send_request_verify_ssl(self): # pylint: disable=protected-access for verify in True, False: @@ -636,6 +653,10 @@ class ClientNetworkWithMockedResponseTest(unittest.TestCase): self.send_request.assert_called_once_with( 'GET', 'http://example.com/', bar='baz') + def test_post_no_content_type(self): + self.content_type = self.net.JOSE_CONTENT_TYPE + self.assertEqual(self.checked_response, self.net.post('uri', self.obj)) + def test_post(self): # pylint: disable=protected-access self.assertEqual(self.checked_response, self.net.post( diff --git a/acme/acme/crypto_util.py b/acme/acme/crypto_util.py index 2b2133475..266f2c0c7 100644 --- a/acme/acme/crypto_util.py +++ b/acme/acme/crypto_util.py @@ -63,6 +63,8 @@ class SSLSocket(object): # pylint: disable=too-few-public-methods server_name) return new_context = OpenSSL.SSL.Context(self.method) + new_context.set_options(OpenSSL.SSL.OP_NO_SSLv2) + new_context.set_options(OpenSSL.SSL.OP_NO_SSLv3) new_context.use_privatekey(key) new_context.use_certificate(cert) connection.set_context(new_context) @@ -86,6 +88,8 @@ class SSLSocket(object): # pylint: disable=too-few-public-methods sock, addr = self.sock.accept() context = OpenSSL.SSL.Context(self.method) + context.set_options(OpenSSL.SSL.OP_NO_SSLv2) + context.set_options(OpenSSL.SSL.OP_NO_SSLv3) context.set_tlsext_servername_callback(self._pick_certificate_cb) ssl_sock = self.FakeConnection(OpenSSL.SSL.Connection(context, sock)) diff --git a/acme/acme/crypto_util_test.py b/acme/acme/crypto_util_test.py index 75a908d4f..bd93ae0e1 100644 --- a/acme/acme/crypto_util_test.py +++ b/acme/acme/crypto_util_test.py @@ -18,9 +18,11 @@ from acme import test_util class SSLSocketAndProbeSNITest(unittest.TestCase): """Tests for acme.crypto_util.SSLSocket/probe_sni.""" + _multiprocess_can_split_ = True + def setUp(self): - self.cert = test_util.load_comparable_cert('cert.pem') - key = test_util.load_pyopenssl_private_key('rsa512_key.pem') + self.cert = test_util.load_comparable_cert('rsa2048_cert.pem') + key = test_util.load_pyopenssl_private_key('rsa2048_key.pem') # pylint: disable=protected-access certs = {b'foo': (key, self.cert.wrapped)} @@ -67,6 +69,8 @@ class SSLSocketAndProbeSNITest(unittest.TestCase): class PyOpenSSLCertOrReqSANTest(unittest.TestCase): """Test for acme.crypto_util._pyopenssl_cert_or_req_san.""" + _multiprocess_can_split_ = True + @classmethod def _call(cls, loader, name): # pylint: disable=protected-access @@ -131,6 +135,8 @@ class PyOpenSSLCertOrReqSANTest(unittest.TestCase): class RandomSnTest(unittest.TestCase): """Test for random certificate serial numbers.""" + _multiprocess_can_split_ = True + def setUp(self): self.cert_count = 5 self.serial_num = [] diff --git a/acme/acme/dns_resolver.py b/acme/acme/dns_resolver.py index f551c6095..2677d92ad 100644 --- a/acme/acme/dns_resolver.py +++ b/acme/acme/dns_resolver.py @@ -3,8 +3,20 @@ Required only for local validation of 'dns-01' challenges. """ import logging -import dns.resolver -import dns.exception +from acme import errors +from acme import util + +DNS_REQUIREMENT = 'dnspython>=1.12' + +try: + util.activate(DNS_REQUIREMENT) + # pragma: no cover + import dns.exception + import dns.resolver + DNS_AVAILABLE = True +except errors.DependencyError: # pragma: no cover + DNS_AVAILABLE = False + logger = logging.getLogger(__name__) @@ -18,6 +30,9 @@ def txt_records_for_name(name): :rtype: list of unicode """ + if not DNS_AVAILABLE: + raise errors.DependencyError( + '{0} is required to use this function'.format(DNS_REQUIREMENT)) try: dns_response = dns.resolver.query(name, 'TXT') except dns.resolver.NXDOMAIN as error: diff --git a/acme/acme/dns_resolver_test.py b/acme/acme/dns_resolver_test.py index 53fc0cc77..2e2edd0e7 100644 --- a/acme/acme/dns_resolver_test.py +++ b/acme/acme/dns_resolver_test.py @@ -1,13 +1,16 @@ """Tests for acme.dns_resolver.""" import unittest + import mock +from six.moves import reload_module # pylint: disable=import-error -from acme import dns_resolver +from acme import errors +from acme import test_util +from acme.dns_resolver import DNS_REQUIREMENT -try: + +if test_util.requirement_available(DNS_REQUIREMENT): import dns -except ImportError: # pragma: no cover - dns = None def create_txt_response(name, txt_records): @@ -22,32 +25,53 @@ def create_txt_response(name, txt_records): class TxtRecordsForNameTest(unittest.TestCase): + """Tests for acme.dns_resolver.txt_records_for_name.""" + @classmethod + def _call(cls, *args, **kwargs): + from acme.dns_resolver import txt_records_for_name + return txt_records_for_name(*args, **kwargs) + +@test_util.skip_unless(test_util.requirement_available(DNS_REQUIREMENT), + "optional dependency dnspython is not available") +class TxtRecordsForNameWithDnsTest(TxtRecordsForNameTest): + """Tests for acme.dns_resolver.txt_records_for_name with dns.""" @mock.patch("acme.dns_resolver.dns.resolver.query") def test_txt_records_for_name_with_single_response(self, mock_dns): mock_dns.return_value = create_txt_response('name', ['response']) - self.assertEqual(['response'], - dns_resolver.txt_records_for_name('name')) + self.assertEqual(['response'], self._call('name')) @mock.patch("acme.dns_resolver.dns.resolver.query") def test_txt_records_for_name_with_multiple_responses(self, mock_dns): mock_dns.return_value = create_txt_response( 'name', ['response1', 'response2']) - self.assertEqual(['response1', 'response2'], - dns_resolver.txt_records_for_name('name')) + self.assertEqual(['response1', 'response2'], self._call('name')) @mock.patch("acme.dns_resolver.dns.resolver.query") def test_txt_records_for_name_domain_not_found(self, mock_dns): mock_dns.side_effect = dns.resolver.NXDOMAIN - self.assertEquals([], dns_resolver.txt_records_for_name('name')) + self.assertEquals([], self._call('name')) @mock.patch("acme.dns_resolver.dns.resolver.query") def test_txt_records_for_name_domain_other_error(self, mock_dns): mock_dns.side_effect = dns.exception.DNSException - self.assertEquals([], dns_resolver.txt_records_for_name('name')) + self.assertEquals([], self._call('name')) - def run(self, result=None): - if dns is None: # pragma: no cover - print(self, "... SKIPPING, no dnspython available") - return - super(TxtRecordsForNameTest, self).run(result) + +class TxtRecordsForNameWithoutDnsTest(TxtRecordsForNameTest): + """Tests for acme.dns_resolver.txt_records_for_name without dns.""" + def setUp(self): + from acme import dns_resolver + dns_resolver.DNS_AVAILABLE = False + + def tearDown(self): + from acme import dns_resolver + reload_module(dns_resolver) + + def test_exception_raised(self): + self.assertRaises( + errors.DependencyError, self._call, "example.org") + + +if __name__ == '__main__': + unittest.main() # pragma: no cover diff --git a/acme/acme/errors.py b/acme/acme/errors.py index 70894a808..7446b60fc 100644 --- a/acme/acme/errors.py +++ b/acme/acme/errors.py @@ -6,6 +6,10 @@ class Error(Exception): """Generic ACME error.""" +class DependencyError(Error): + """Dependency error""" + + class SchemaValidationError(jose_errors.DeserializationError): """JSON schema ACME object validation error.""" diff --git a/acme/acme/jose/json_util.py b/acme/acme/jose/json_util.py index da38b55ba..cc66d77ff 100644 --- a/acme/acme/jose/json_util.py +++ b/acme/acme/jose/json_util.py @@ -253,10 +253,6 @@ class JSONObjectWithFields(util.ImmutableMap, interfaces.JSONDeSerializable): raise errors.SerializationError( 'Could not encode {0} ({1}): {2}'.format( slot, value, error)) - if omitted: - # pylint: disable=star-args - logger.debug('Omitted empty fields: %s', ', '.join( - '{0!s}={1!r}'.format(*field) for field in omitted)) return jobj def to_partial_json(self): diff --git a/acme/acme/messages.py b/acme/acme/messages.py index 56bcb1de2..a7c86a10c 100644 --- a/acme/acme/messages.py +++ b/acme/acme/messages.py @@ -7,6 +7,37 @@ from acme import fields from acme import jose from acme import util +OLD_ERROR_PREFIX = "urn:acme:error:" +ERROR_PREFIX = "urn:ietf:params:acme:error:" + +ERROR_CODES = { + 'badCSR': 'The CSR is unacceptable (e.g., due to a short key)', + 'badNonce': 'The client sent an unacceptable anti-replay nonce', + 'connection': ('The server could not connect to the client to verify the' + ' domain'), + 'dnssec': 'The server could not validate a DNSSEC signed domain', + # deprecate invalidEmail + 'invalidEmail': 'The provided email for a registration was invalid', + 'invalidContact': 'The provided contact URI was invalid', + 'malformed': 'The request message was malformed', + 'rateLimited': 'There were too many requests of a given type', + 'serverInternal': 'The server experienced an internal error', + 'tls': 'The server experienced a TLS error during domain verification', + 'unauthorized': 'The client lacks sufficient authorization', + 'unknownHost': 'The server could not resolve a domain name', +} + +ERROR_TYPE_DESCRIPTIONS = dict( + (ERROR_PREFIX + name, desc) for name, desc in ERROR_CODES.items()) + +ERROR_TYPE_DESCRIPTIONS.update(dict( # add errors with old prefix, deprecate me + (OLD_ERROR_PREFIX + name, desc) for name, desc in ERROR_CODES.items())) + + +def is_acme_error(err): + """Check if argument is an ACME error.""" + return (ERROR_PREFIX in str(err)) or (OLD_ERROR_PREFIX in str(err)) + class Error(jose.JSONObjectWithFields, errors.Error): """ACME error. @@ -18,29 +49,24 @@ class Error(jose.JSONObjectWithFields, errors.Error): :ivar unicode detail: """ - ERROR_TYPE_DESCRIPTIONS = dict( - ('urn:acme:error:' + name, description) for name, description in ( - ('badCSR', 'The CSR is unacceptable (e.g., due to a short key)'), - ('badNonce', 'The client sent an unacceptable anti-replay nonce'), - ('connection', 'The server could not connect to the client to ' - 'verify the domain'), - ('dnssec', 'The server could not validate a DNSSEC signed domain'), - ('invalidEmail', - 'The provided email for a registration was invalid'), - ('malformed', 'The request message was malformed'), - ('rateLimited', 'There were too many requests of a given type'), - ('serverInternal', 'The server experienced an internal error'), - ('tls', 'The server experienced a TLS error during domain ' - 'verification'), - ('unauthorized', 'The client lacks sufficient authorization'), - ('unknownHost', 'The server could not resolve a domain name'), - ) - ) - typ = jose.Field('type', omitempty=True, default='about:blank') title = jose.Field('title', omitempty=True) detail = jose.Field('detail', omitempty=True) + @classmethod + def with_code(cls, code, **kwargs): + """Create an Error instance with an ACME Error code. + + :unicode code: An ACME error code, like 'dnssec'. + :kwargs: kwargs to pass to Error. + + """ + if code not in ERROR_CODES: + raise ValueError("The supplied code: %s is not a known ACME error" + " code" % code) + typ = ERROR_PREFIX + code + return cls(typ=typ, **kwargs) + @property def description(self): """Hardcoded error description based on its type. @@ -49,7 +75,21 @@ class Error(jose.JSONObjectWithFields, errors.Error): :rtype: unicode """ - return self.ERROR_TYPE_DESCRIPTIONS.get(self.typ) + return ERROR_TYPE_DESCRIPTIONS.get(self.typ) + + @property + def code(self): + """ACME error code. + + Basically self.typ without the ERROR_PREFIX. + + :returns: error code if standard ACME code or ``None``. + :rtype: unicode + + """ + code = str(self.typ).split(':')[-1] + if code in ERROR_CODES: + return code def __str__(self): return ' :: '.join( diff --git a/acme/acme/messages_test.py b/acme/acme/messages_test.py index 36d0dd618..a0322968c 100644 --- a/acme/acme/messages_test.py +++ b/acme/acme/messages_test.py @@ -17,13 +17,13 @@ class ErrorTest(unittest.TestCase): """Tests for acme.messages.Error.""" def setUp(self): - from acme.messages import Error + from acme.messages import Error, ERROR_PREFIX self.error = Error( - detail='foo', typ='urn:acme:error:malformed', title='title') + detail='foo', typ=ERROR_PREFIX + 'malformed', title='title') self.jobj = { 'detail': 'foo', 'title': 'some title', - 'type': 'urn:acme:error:malformed', + 'type': ERROR_PREFIX + 'malformed', } self.error_custom = Error(typ='custom', detail='bar') self.jobj_cusom = {'type': 'custom', 'detail': 'bar'} @@ -47,10 +47,27 @@ class ErrorTest(unittest.TestCase): def test_str(self): self.assertEqual( - 'urn:acme:error:malformed :: The request message was ' + 'urn:ietf:params:acme:error:malformed :: The request message was ' 'malformed :: foo :: title', str(self.error)) self.assertEqual('custom :: bar', str(self.error_custom)) + def test_code(self): + from acme.messages import Error + self.assertEqual('malformed', self.error.code) + self.assertEqual(None, self.error_custom.code) + self.assertEqual(None, Error().code) + + def test_is_acme_error(self): + from acme.messages import is_acme_error + self.assertTrue(is_acme_error(self.error)) + self.assertTrue(is_acme_error(str(self.error))) + self.assertFalse(is_acme_error(self.error_custom)) + + def test_with_code(self): + from acme.messages import Error, is_acme_error + self.assertTrue(is_acme_error(Error.with_code('badCSR'))) + self.assertRaises(ValueError, Error.with_code, 'not an ACME error code') + class ConstantTest(unittest.TestCase): """Tests for acme.messages._Constant.""" @@ -240,7 +257,7 @@ class ChallengeBodyTest(unittest.TestCase): from acme.messages import Error from acme.messages import STATUS_INVALID self.status = STATUS_INVALID - error = Error(typ='urn:acme:error:serverInternal', + error = Error(typ='urn:ietf:params:acme:error:serverInternal', detail='Unable to communicate with DNS server') self.challb = ChallengeBody( uri='http://challb', chall=self.chall, status=self.status, @@ -256,7 +273,7 @@ class ChallengeBodyTest(unittest.TestCase): self.jobj_from = self.jobj_to.copy() self.jobj_from['status'] = 'invalid' self.jobj_from['error'] = { - 'type': 'urn:acme:error:serverInternal', + 'type': 'urn:ietf:params:acme:error:serverInternal', 'detail': 'Unable to communicate with DNS server', } diff --git a/acme/acme/standalone_test.py b/acme/acme/standalone_test.py index 85cd9d11d..58469d470 100644 --- a/acme/acme/standalone_test.py +++ b/acme/acme/standalone_test.py @@ -21,6 +21,8 @@ from acme import test_util class TLSServerTest(unittest.TestCase): """Tests for acme.standalone.TLSServer.""" + _multiprocess_can_split_ = True + def test_bind(self): # pylint: disable=no-self-use from acme.standalone import TLSServer server = TLSServer( @@ -31,10 +33,12 @@ class TLSServerTest(unittest.TestCase): class TLSSNI01ServerTest(unittest.TestCase): """Test for acme.standalone.TLSSNI01Server.""" + _multiprocess_can_split_ = True + def setUp(self): self.certs = {b'localhost': ( - test_util.load_pyopenssl_private_key('rsa512_key.pem'), - test_util.load_cert('cert.pem'), + test_util.load_pyopenssl_private_key('rsa2048_key.pem'), + test_util.load_cert('rsa2048_cert.pem'), )} from acme.standalone import TLSSNI01Server self.server = TLSSNI01Server(("", 0), certs=self.certs) @@ -57,6 +61,8 @@ class TLSSNI01ServerTest(unittest.TestCase): class HTTP01ServerTest(unittest.TestCase): """Tests for acme.standalone.HTTP01Server.""" + _multiprocess_can_split_ = True + def setUp(self): self.account_key = jose.JWK.load( test_util.load_vector('rsa1024_key.pem')) @@ -109,13 +115,16 @@ class HTTP01ServerTest(unittest.TestCase): class TestSimpleTLSSNI01Server(unittest.TestCase): """Tests for acme.standalone.simple_tls_sni_01_server.""" + _multiprocess_can_split_ = True + def setUp(self): # mirror ../examples/standalone self.test_cwd = tempfile.mkdtemp() localhost_dir = os.path.join(self.test_cwd, 'localhost') os.makedirs(localhost_dir) - shutil.copy(test_util.vector_path('cert.pem'), localhost_dir) - shutil.copy(test_util.vector_path('rsa512_key.pem'), + shutil.copy(test_util.vector_path('rsa2048_cert.pem'), + os.path.join(localhost_dir, 'cert.pem')) + shutil.copy(test_util.vector_path('rsa2048_key.pem'), os.path.join(localhost_dir, 'key.pem')) from acme.standalone import simple_tls_sni_01_server @@ -147,7 +156,8 @@ class TestSimpleTLSSNI01Server(unittest.TestCase): time.sleep(1) # wait until thread starts else: self.assertEqual(jose.ComparableX509(cert), - test_util.load_comparable_cert('cert.pem')) + test_util.load_comparable_cert( + 'rsa2048_cert.pem')) break diff --git a/acme/acme/test_util.py b/acme/acme/test_util.py index 24eceff5a..ba968511f 100644 --- a/acme/acme/test_util.py +++ b/acme/acme/test_util.py @@ -5,12 +5,15 @@ """ import os import pkg_resources +import unittest from cryptography.hazmat.backends import default_backend from cryptography.hazmat.primitives import serialization import OpenSSL +from acme import errors from acme import jose +from acme import util def vector_path(*names): @@ -73,3 +76,38 @@ def load_pyopenssl_private_key(*names): loader = _guess_loader( names[-1], OpenSSL.crypto.FILETYPE_PEM, OpenSSL.crypto.FILETYPE_ASN1) return OpenSSL.crypto.load_privatekey(loader, load_vector(*names)) + + +def requirement_available(requirement): + """Checks if requirement can be imported. + + :rtype: bool + :returns: ``True`` iff requirement can be imported + + """ + try: + util.activate(requirement) + except errors.DependencyError: # pragma: no cover + return False + return True # pragma: no cover + + +def skip_unless(condition, reason): # pragma: no cover + """Skip tests unless a condition holds. + + This implements the basic functionality of unittest.skipUnless + which is only available on Python 2.7+. + + :param bool condition: If ``False``, the test will be skipped + :param str reason: the reason for skipping the test + + :rtype: callable + :returns: decorator that hides tests unless condition is ``True`` + + """ + if hasattr(unittest, "skipUnless"): + return unittest.skipUnless(condition, reason) + elif condition: + return lambda cls: cls + else: + return lambda cls: None diff --git a/acme/acme/testdata/rsa2048_cert.pem b/acme/acme/testdata/rsa2048_cert.pem new file mode 100644 index 000000000..3944cd1db --- /dev/null +++ b/acme/acme/testdata/rsa2048_cert.pem @@ -0,0 +1,22 @@ +-----BEGIN CERTIFICATE----- +MIIDjjCCAnagAwIBAgIJALVG/VbBb5U7MA0GCSqGSIb3DQEBCwUAMFsxCzAJBgNV +BAYTAkFVMQswCQYDVQQIDAJXQTEeMBwGA1UEBwwVVGhlIG1pZGRsZSBvZiBub3do +ZXJlMR8wHQYDVQQKDBZDZXJ0Ym90IFRlc3QgQ2VydHMgSW5jMCAXDTE2MTEyODIx +MzUzN1oYDzIyOTAwOTEzMjEzNTM3WjBbMQswCQYDVQQGEwJBVTELMAkGA1UECAwC +V0ExHjAcBgNVBAcMFVRoZSBtaWRkbGUgb2Ygbm93aGVyZTEfMB0GA1UECgwWQ2Vy +dGJvdCBUZXN0IENlcnRzIEluYzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC +ggEBANoVT1pdvRUUBOqvm7M2ebLEHV7higUH7qAGUZEkfP6W4YriYVY+IHrH1svN +PSa+oPTK7weDNmT11ehWnGyECIM9z2r2Hi9yVV0ycxh4hWQ4Nt8BAKZwCwaXpyWm +7Gj6m2EzpSN5Dd67g5YAQBrUUh1+RRbFi9c0Ls/6ZOExMvfg8kqt4c2sXCgH1IFn +xvvOjBYop7xh0x3L1Akyax0tw8qgQp/z5mkupmVDNJYPFmbzFPMNyDR61ed6QUTD +g7P4UAuFkejLLzFvz5YaO7vC+huaTuPhInAhpzqpr4yU97KIjos2/83Itu/Cv8U1 +RAeEeRTkh0WjUfltoem/5f8bIdsCAwEAAaNTMFEwHQYDVR0OBBYEFHy+bEYqwvFU +uQLTkIfQ36AM2DQiMB8GA1UdIwQYMBaAFHy+bEYqwvFUuQLTkIfQ36AM2DQiMA8G +A1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAH3ANVzB59FcunZV/F8T +RiCD6/gV7Jc3CswU8N8tVjzMCg2jOdTFF9iYZzNNKQvG13o/n5LkQr/lkKRQkWTx +nkE5WZbR7vNqlzXgPa9NBiK5rPjgSt8azPW+Skct3Bj4B3PhTMSpoQ7PsUJ8UeV8 +kTNR5xrRLt6/mLfRJTXWXBM43GEZi8lL5q0nqz0tPGISADshHMo6ZlUu5Hvfp5v+ +aonpO4sVS9hGOVxjGNMXYApEUy4jid9jjAfEk6jeELJMbXGLy/botFgIJK/QPe6P +AfbdFgtg/qzG7Uy0A1iXXfWdgwmVrhCoGYYWCn4yWCAm894QKtdim87CHSDP0WUf +Esg= +-----END CERTIFICATE----- diff --git a/acme/acme/testdata/rsa2048_key.pem b/acme/acme/testdata/rsa2048_key.pem index 33efd3467..5847aed55 100644 --- a/acme/acme/testdata/rsa2048_key.pem +++ b/acme/acme/testdata/rsa2048_key.pem @@ -1,27 +1,28 @@ ------BEGIN RSA PRIVATE KEY----- -MIIEowIBAAKCAQEA8HwZMHeImB/iM8/n8CTCR4KeYQB2gLGO3v8xLms+PWH3Zbxc -dVtEn25Y34scIh+iOuEXBcSBalBddLHKBGVN3nCfmpupoLm52xgRG44q9OWODpg4 -FSi4afqVw2agMx0RHi0v3GVcdpqB83UW42kK1ESZHUuq7mxLg8u3IMYZFm6Amsf+ -YQjBbDNn8NczJOFhsExP2EdM5ykgM1Om8aqTqqPMgPub68/r4Sym+BjLnvRq5Qtz -h/jCfOBIIpAwg3lj7l8OyE3kkD3ALtuiuminNUqLHEkUaLq/Xiv8V8mvnrhG7h3Q -+L1Xc707P0dz5YM5XxTMhmUE1cae/lQ0KbNrpwIDAQABAoIBAAiDXCDrGlrIRimv -YnaN1pLRfOnSKl/D6VrbjdIm2b0yip9/W4aMBJHgRiUjt4s9s3CCJ1585lftIGHR -KWWecHM/aWb/u7GE4Z9v6qsfDUY+GhlKKjIVjvGxfTu9lk446TI4R0l2DR/luFP2 -ASlrvoZlJ0ZyN0rZapLv0zvFx32Tukd+3rcMmXfHl7aRGMZG1YTKNmBJ4d9iJ6cP -HG3fgSzLQMPLNO/20MzbXdREG5FNQtwaMuFnIcVbtMCvc/71lQQEfANMLCUweEed -YWGOjgDeh+731nJsopel+2TSTgnf5VhcFrgChZZdqeKvP+HbXjTE2VkWo7BrzoM7 -xICYBwECgYEA/ZF/JOjZfwIMUdikv8vldJzRMdFryl4NJWnh4NeThNOEpUcpxnyK -wyMnnQaGJa51u9EEnzl0sZ2h2ODjD6KFpz6fkWaVRq5SWalVPAoKZGaoPZV3IUOI -8Tm0xkXho+A/FUUEcxCLME+3V9EdPfHaVRJOrbfDyxvNhsj4w9F0aAkCgYEA8sp7 -XTrolOknJGv4Qt1w6gcm5+cMtLaRfi8ZHPHujl2x9eWE8/s2818az7jc0Xr/G4HQ -NeU+3Es4BblEckSHmhUZhx26cZgkLSIIDofEtaEc6u8CyWfxsWvn3l4T3kMdeSLC -9UoLk59AH2tkMIh8vzV8LSisLJa341lMdgryQi8CgYAlJKr7PSCe+i3Tz2hSsAts -iYwbQBIKErzaPihYRzvUuSc1DreP26535y5mUg5UdrnISVXj/Qaa/fw3SLn6EFSD -qyi0o9I6CE8H00YpBU+AZYk/fCV3Oe1VaJ6SbKog1zhmZTXBpSq+aO7ybi9aY5MX -4xajW8fSeMAifk3yYTwsAQKBgErcEcOCOVpItU/uloKPYpRWFjHktK83p46fmP+q -vOJak1d9KExOBfhuN4caucNBSE1D7l3fzE0CSEjDgg41gRYKMW/Ow8DopybfWlqY -lBdokNEDVvmgug35dmnC2h9q1DiYdkJJTV57+Lp3U1H/k28lX59Q7h1lb1eDHic7 -YszzAoGBAOx05dhOiYbzAJSTQu3oBHFn4mTYIqCcDO6cQrEJwPKAq7mAhT0yOk9N -CrqRV/1aes665829cyTwcAZl6nqbzHv5XjX5+g6vmooCb4oCkq49rumHjoQdrX8D -RR5b+Spkc1jo4rctCcExzSkgo+K5N3oBVYznecje7O7Z0/qiJE/8 ------END RSA PRIVATE KEY----- +-----BEGIN PRIVATE KEY----- +MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQDaFU9aXb0VFATq +r5uzNnmyxB1e4YoFB+6gBlGRJHz+luGK4mFWPiB6x9bLzT0mvqD0yu8HgzZk9dXo +VpxshAiDPc9q9h4vclVdMnMYeIVkODbfAQCmcAsGl6clpuxo+pthM6UjeQ3eu4OW +AEAa1FIdfkUWxYvXNC7P+mThMTL34PJKreHNrFwoB9SBZ8b7zowWKKe8YdMdy9QJ +MmsdLcPKoEKf8+ZpLqZlQzSWDxZm8xTzDcg0etXnekFEw4Oz+FALhZHoyy8xb8+W +Gju7wvobmk7j4SJwIac6qa+MlPeyiI6LNv/NyLbvwr/FNUQHhHkU5IdFo1H5baHp +v+X/GyHbAgMBAAECggEAURFe4C68XRuGAF+rN2Fmt+djK6QXlGswb1gp9hRkSpd3 +3BLvMAoENOAYnsX6l26Bkr3lQRurmrgv/iBEIaqrJ25QrmgzLFwKE4zvcAdNPsYO +z7MltLktwBOb1MlKVHPkUqvKFXeoikWWUqphKhgHNmN7900UALmrNTDVU0jgs3fB +o35o8d5SjoC52K4wCTjhPyjt4cdbfbziRs2qFhfGdawidRO1xLlDM4tTTW+5yWGK +lt0SwyvDVC6XWeNoT3nXyKjXWP7hcYqm0iS7ffL9YzEC2RXNGQUqeR50i9Y0rDdH +Vqcr+Rqio2ww68zbDWBpC/jU133BSoHuSE1wstxIkQKBgQDxlEr42WJfgdajbZ1a +hUIeLEgvhezLmD1hcYwZuQCLgizmY2ovvmeAH74koCDEsUUQunPYHsRla7wT3q1/ +IkR1KgJPwESpkQaKuAqxeEAkv7Gn8Lzcn22jCoRCfGA68wKJz2ECFZDc0RDvRrT/ +9GhiiGUoO47jv9ezrSDO1eu5/QKBgQDnGfYVMNLiA0fy4AxSyY2vdo7vruOFGpRP +n94gwxZ+0dQDWHzn3J4rHivxtcyd/MOZv4I8PtYK7tmmjYv1ngQ6sGl4p8bpUtwj +9++/B1CyB1W5/VPqMkd+Sj0dbejycME55+F6/r4basPXxBFFCfknjAlVvyvbBhUy +ftNpHxZGtwKBgChJM4t2LPqCW3nbgL8ks9b2SX9rVQbKt4m1dsifWmDpb3VoJMAb +f4UVRg8ziONkMIFOppzm3JeRNMcXflVSMJpdTA9in9CrN60QbfAUfpXiRc0cz1H3 +YEAtM8smlKGf/s9efu3rDMJWNv3AC9UXPAUae8wOypBeYKk8+NilQe89AoGAXEA3 +xFO+CqyGnwQixzVf0qf//NuSRQLMK1DEyc02gJ9gA4niKmgd11Zu8kjBClvo9MnG +wifPJ4Qa6+pa8UwHoinjoF9Q/rit2cnSMS5JXxegd+MRCU7SzS3zYXkLYSPzbhsL +Hh7sYmNnFA1XW3jUtZ2n6EusxPyTn5mS6MaZDNcCgYBelFKFjNIQ50NbOnm8DewK +jUd5OFKowKodlQVcHiF9CVbjvpN8ZPRcBSmqDU4kpT/rmcybVoL6Zfa/zWkw8+Oh +QxKb3BYf5vRUMd/RA+/t5KG4ZOIIYB3qoltAYlhVaINukL6cGVG1qvV/ntcsfsn6 +kmf1UgGFcKrJuXgwEtTVxw== +-----END PRIVATE KEY----- diff --git a/acme/acme/util.py b/acme/acme/util.py index 1fff89a9e..ac445b271 100644 --- a/acme/acme/util.py +++ b/acme/acme/util.py @@ -1,7 +1,25 @@ """ACME utilities.""" +import pkg_resources import six +from acme import errors + def map_keys(dikt, func): """Map dictionary keys.""" return dict((func(key), value) for key, value in six.iteritems(dikt)) + + +def activate(requirement): + """Make requirement importable. + + :param str requirement: the distribution and version to activate + + :raises acme.errors.DependencyError: if cannot activate requirement + + """ + try: + for distro in pkg_resources.require(requirement): # pylint: disable=not-callable + distro.activate() + except (pkg_resources.DistributionNotFound, pkg_resources.VersionConflict): + raise errors.DependencyError('{0} is unavailable'.format(requirement)) diff --git a/acme/acme/util_test.py b/acme/acme/util_test.py index 00aa8b02d..ba6465409 100644 --- a/acme/acme/util_test.py +++ b/acme/acme/util_test.py @@ -1,6 +1,8 @@ """Tests for acme.util.""" import unittest +from acme import errors + class MapKeysTest(unittest.TestCase): """Tests for acme.util.map_keys.""" @@ -12,5 +14,21 @@ class MapKeysTest(unittest.TestCase): self.assertEqual({2: 2, 4: 4}, map_keys({1: 2, 3: 4}, lambda x: x + 1)) +class ActivateTest(unittest.TestCase): + """Tests for acme.util.activate.""" + + @classmethod + def _call(cls, *args, **kwargs): + from acme.util import activate + return activate(*args, **kwargs) + + def test_failure(self): + self.assertRaises(errors.DependencyError, self._call, 'acme>99.0.0') + + def test_success(self): + self._call('acme') + import acme as unused_acme + + if __name__ == '__main__': unittest.main() # pragma: no cover diff --git a/acme/docs/conf.py b/acme/docs/conf.py index 55f5eee3f..dea23a8ca 100644 --- a/acme/docs/conf.py +++ b/acme/docs/conf.py @@ -39,7 +39,6 @@ extensions = [ 'sphinx.ext.todo', 'sphinx.ext.coverage', 'sphinx.ext.viewcode', - 'sphinxcontrib.programoutput', ] autodoc_member_order = 'bysource' diff --git a/acme/docs/jws-help.txt b/acme/docs/jws-help.txt new file mode 100644 index 000000000..34cf5ce23 --- /dev/null +++ b/acme/docs/jws-help.txt @@ -0,0 +1,8 @@ +usage: jws [-h] [--compact] {sign,verify} ... + +positional arguments: + {sign,verify} + +optional arguments: + -h, --help show this help message and exit + --compact diff --git a/acme/docs/man/jws.rst b/acme/docs/man/jws.rst index fb3121a96..d7ff8f405 100644 --- a/acme/docs/man/jws.rst +++ b/acme/docs/man/jws.rst @@ -1 +1 @@ -.. program-output:: jws --help all +.. literalinclude:: ../jws-help.txt diff --git a/acme/examples/standalone/localhost/cert.pem b/acme/examples/standalone/localhost/cert.pem index 569366af9..1cca87af5 120000 --- a/acme/examples/standalone/localhost/cert.pem +++ b/acme/examples/standalone/localhost/cert.pem @@ -1 +1 @@ -../../../acme/testdata/cert.pem \ No newline at end of file +../../../acme/testdata/rsa2048_cert.pem \ No newline at end of file diff --git a/acme/examples/standalone/localhost/key.pem b/acme/examples/standalone/localhost/key.pem index 870f4f876..ee3dd2847 120000 --- a/acme/examples/standalone/localhost/key.pem +++ b/acme/examples/standalone/localhost/key.pem @@ -1 +1 @@ -../../../acme/testdata/rsa512_key.pem \ No newline at end of file +../../../acme/testdata/rsa2048_key.pem \ No newline at end of file diff --git a/acme/setup.py b/acme/setup.py index 94f78d4cd..5524a6734 100644 --- a/acme/setup.py +++ b/acme/setup.py @@ -4,20 +4,18 @@ from setuptools import setup from setuptools import find_packages -version = '0.9.0.dev0' +version = '0.10.0.dev0' # Please update tox.ini when modifying dependency version requirements install_requires = [ # load_pem_private/public_key (>=0.6) # rsa_recover_prime_factors (>=0.8) 'cryptography>=0.8', - 'ndg-httpsclient', # urllib3 InsecurePlatformWarning (#304) - 'pyasn1', # urllib3 InsecurePlatformWarning (#304) # Connection.set_tlsext_host_name (>=0.13) 'PyOpenSSL>=0.13', 'pyrfc3339', 'pytz', - 'requests', + 'requests[security]>=2.4.1', # security extras added in 2.4.1 # For pkg_resources. >=1.0 so pip resolves it to a version cryptography # will tolerate; see #2599: 'setuptools>=1.0', @@ -49,7 +47,6 @@ dev_extras = [ docs_extras = [ 'Sphinx>=1.0', # autodoc_member_order = 'bysource', autodoc_default_flags 'sphinx_rtd_theme', - 'sphinxcontrib-programoutput', ] diff --git a/certbot-apache/certbot_apache/configurator.py b/certbot-apache/certbot_apache/configurator.py index 02602ace6..27e214362 100644 --- a/certbot-apache/certbot_apache/configurator.py +++ b/certbot-apache/certbot_apache/configurator.py @@ -1,6 +1,7 @@ """Apache Configuration based off of Augeas Configurator.""" # pylint: disable=too-many-lines import filecmp +import fnmatch import logging import os import re @@ -84,7 +85,7 @@ class ApacheConfigurator(augeas_configurator.AugeasConfigurator): """ - description = "Apache Web Server - Alpha" + description = "Apache Web Server plugin - Beta" @classmethod def add_parser_arguments(cls, add): @@ -98,6 +99,8 @@ class ApacheConfigurator(augeas_configurator.AugeasConfigurator): help="Apache server root directory.") add("vhost-root", default=constants.os_constant("vhost_root"), help="Apache server VirtualHost configuration root") + add("logs-root", default=constants.os_constant("logs_root"), + help="Apache server logs directory") add("challenge-location", default=constants.os_constant("challenge_location"), help="Directory path for challenge configuration.") @@ -360,18 +363,24 @@ class ApacheConfigurator(augeas_configurator.AugeasConfigurator): return vhost def included_in_wildcard(self, names, target_name): - """Helper function to see if alias is covered by wildcard""" - target_name = target_name.split(".")[::-1] - wildcards = [domain.split(".")[1:] for domain in - names if domain.startswith("*")] - for wildcard in wildcards: - if len(wildcard) > len(target_name): - continue - for idx, segment in enumerate(wildcard[::-1]): - if segment != target_name[idx]: - break - else: - # https://docs.python.org/2/tutorial/controlflow.html#break-and-continue-statements-and-else-clauses-on-loops + """Is target_name covered by a wildcard? + + :param names: server aliases + :type names: `collections.Iterable` of `str` + :param str target_name: name to compare with wildcards + + :returns: True if target_name is covered by a wildcard, + otherwise, False + :rtype: bool + + """ + # use lowercase strings because fnmatch can be case sensitive + target_name = target_name.lower() + for name in names: + name = name.lower() + # fnmatch treats "[seq]" specially and [ or ] characters aren't + # valid in Apache but Apache doesn't error out if they are present + if "[" not in name and fnmatch.fnmatch(target_name, name): return True return False @@ -461,7 +470,7 @@ class ApacheConfigurator(augeas_configurator.AugeasConfigurator): zope.component.getUtility(interfaces.IDisplay).notification( "Apache mod_macro seems to be in use in file(s):\n{0}" "\n\nUnfortunately mod_macro is not yet supported".format( - "\n ".join(vhost_macro))) + "\n ".join(vhost_macro)), force_interactive=True) return all_names @@ -1010,6 +1019,8 @@ class ApacheConfigurator(augeas_configurator.AugeasConfigurator): self.parser.find_dir("ServerAlias", target_name, start=vh_path, exclude=False)): return + if self._has_matching_wildcard(vh_path, target_name): + return if not self.parser.find_dir("ServerName", None, start=vh_path, exclude=False): self.parser.add_dir(vh_path, "ServerName", target_name) @@ -1017,6 +1028,22 @@ class ApacheConfigurator(augeas_configurator.AugeasConfigurator): self.parser.add_dir(vh_path, "ServerAlias", target_name) self._add_servernames(vhost) + def _has_matching_wildcard(self, vh_path, target_name): + """Is target_name already included in a wildcard in the vhost? + + :param str vh_path: Augeas path to the vhost + :param str target_name: name to compare with wildcards + + :returns: True if there is a wildcard covering target_name in + the vhost in vhost_path, otherwise, False + :rtype: bool + + """ + matches = self.parser.find_dir( + "ServerAlias", start=vh_path, exclude=False) + aliases = (self.aug.get(match) for match in matches) + return self.included_in_wildcard(aliases, target_name) + def _add_name_vhost_if_necessary(self, vhost): """Add NameVirtualHost Directives if necessary for new vhost. @@ -1425,13 +1452,14 @@ class ApacheConfigurator(augeas_configurator.AugeasConfigurator): "RewriteEngine On\n" "RewriteRule %s\n" "\n" - "ErrorLog /var/log/apache2/redirect.error.log\n" + "ErrorLog %s/redirect.error.log\n" "LogLevel warn\n" "\n" % (" ".join(str(addr) for addr in self._get_proposed_addrs(ssl_vhost)), servername, serveralias, - " ".join(rewrite_rule_args))) + " ".join(rewrite_rule_args), + self.conf("logs-root"))) def _write_out_redirect(self, ssl_vhost, text): # This is the default name @@ -1491,38 +1519,6 @@ class ApacheConfigurator(augeas_configurator.AugeasConfigurator): return redirects - def get_all_certs_keys(self): - """Find all existing keys, certs from configuration. - - Retrieve all certs and keys set in VirtualHosts on the Apache server - - :returns: list of tuples with form [(cert, key, path)] - cert - str path to certificate file - key - str path to associated key file - path - File path to configuration file. - :rtype: list - - """ - c_k = set() - - for vhost in self.vhosts: - if vhost.ssl: - cert_path = self.parser.find_dir( - "SSLCertificateFile", None, - start=vhost.path, exclude=False) - key_path = self.parser.find_dir( - "SSLCertificateKeyFile", None, - start=vhost.path, exclude=False) - - if cert_path and key_path: - cert = os.path.abspath(self.parser.get_arg(cert_path[-1])) - key = os.path.abspath(self.parser.get_arg(key_path[-1])) - c_k.add((cert, key, get_file_path(cert_path[-1]))) - else: - logger.warning( - "Invalid VirtualHost configuration - %s", vhost.filep) - return c_k - def is_site_enabled(self, avail_fp): """Checks to see if the given site is enabled. diff --git a/certbot-apache/certbot_apache/constants.py b/certbot-apache/certbot_apache/constants.py index ba545c613..dcc635c4b 100644 --- a/certbot-apache/certbot_apache/constants.py +++ b/certbot-apache/certbot_apache/constants.py @@ -6,6 +6,7 @@ CLI_DEFAULTS_DEFAULT = dict( server_root="/etc/apache2", vhost_root="/etc/apache2/sites-available", vhost_files="*", + logs_root="/var/log/apache2", version_cmd=['apache2ctl', '-v'], define_cmd=['apache2ctl', '-t', '-D', 'DUMP_RUN_CFG'], restart_cmd=['apache2ctl', 'graceful'], @@ -23,6 +24,7 @@ CLI_DEFAULTS_DEBIAN = dict( server_root="/etc/apache2", vhost_root="/etc/apache2/sites-available", vhost_files="*", + logs_root="/var/log/apache2", version_cmd=['apache2ctl', '-v'], define_cmd=['apache2ctl', '-t', '-D', 'DUMP_RUN_CFG'], restart_cmd=['apache2ctl', 'graceful'], @@ -40,6 +42,7 @@ CLI_DEFAULTS_CENTOS = dict( server_root="/etc/httpd", vhost_root="/etc/httpd/conf.d", vhost_files="*.conf", + logs_root="/var/log/httpd", version_cmd=['apachectl', '-v'], define_cmd=['apachectl', '-t', '-D', 'DUMP_RUN_CFG'], restart_cmd=['apachectl', 'graceful'], @@ -57,6 +60,7 @@ CLI_DEFAULTS_GENTOO = dict( server_root="/etc/apache2", vhost_root="/etc/apache2/vhosts.d", vhost_files="*.conf", + logs_root="/var/log/apache2", version_cmd=['/usr/sbin/apache2', '-v'], define_cmd=['apache2ctl', 'virtualhosts'], restart_cmd=['apache2ctl', 'graceful'], @@ -74,6 +78,7 @@ CLI_DEFAULTS_DARWIN = dict( server_root="/etc/apache2", vhost_root="/etc/apache2/other", vhost_files="*.conf", + logs_root="/var/log/apache2", version_cmd=['/usr/sbin/httpd', '-v'], define_cmd=['/usr/sbin/httpd', '-t', '-D', 'DUMP_RUN_CFG'], restart_cmd=['apachectl', 'graceful'], @@ -91,6 +96,7 @@ CLI_DEFAULTS_SUSE = dict( server_root="/etc/apache2", vhost_root="/etc/apache2/vhosts.d", vhost_files="*.conf", + logs_root="/var/log/apache2", version_cmd=['apache2ctl', '-v'], define_cmd=['apache2ctl', '-t', '-D', 'DUMP_RUN_CFG'], restart_cmd=['apache2ctl', 'graceful'], diff --git a/certbot-apache/certbot_apache/display_ops.py b/certbot-apache/certbot_apache/display_ops.py index d7b76f83d..22aafc0fe 100644 --- a/certbot-apache/certbot_apache/display_ops.py +++ b/certbot-apache/certbot_apache/display_ops.py @@ -85,7 +85,8 @@ def _vhost_menu(domain, vhosts): "or Address of {0}.{1}Which virtual host would you " "like to choose?\n(note: conf files with multiple " "vhosts are not yet supported)".format(domain, os.linesep), - choices, help_label="More Info", ok_label="Select") + choices, help_label="More Info", + ok_label="Select", force_interactive=True) except errors.MissingCommandlineFlag: msg = ("Encountered vhost ambiguity but unable to ask for user guidance in " "non-interactive mode. Currently Certbot needs each vhost to be " @@ -101,4 +102,4 @@ def _more_info_vhost(vhost): zope.component.getUtility(interfaces.IDisplay).notification( "Virtual Host Information:{0}{1}{0}{2}".format( os.linesep, "-" * (display_util.WIDTH - 4), str(vhost)), - height=display_util.HEIGHT) + force_interactive=True) diff --git a/certbot-apache/certbot_apache/tests/augeas_configurator_test.py b/certbot-apache/certbot_apache/tests/augeas_configurator_test.py index c55f27ff0..66da017ec 100644 --- a/certbot-apache/certbot_apache/tests/augeas_configurator_test.py +++ b/certbot-apache/certbot_apache/tests/augeas_configurator_test.py @@ -13,6 +13,8 @@ from certbot_apache.tests import util class AugeasConfiguratorTest(util.ApacheTest): """Test for Augeas Configurator base class.""" + _multiprocess_can_split_ = True + def setUp(self): # pylint: disable=arguments-differ super(AugeasConfiguratorTest, self).setUp() diff --git a/certbot-apache/certbot_apache/tests/configurator_test.py b/certbot-apache/certbot_apache/tests/configurator_test.py index dc953174e..1af425824 100644 --- a/certbot-apache/certbot_apache/tests/configurator_test.py +++ b/certbot-apache/certbot_apache/tests/configurator_test.py @@ -24,6 +24,8 @@ from certbot_apache.tests import util class MultipleVhostsTest(util.ApacheTest): """Test two standard well-configured HTTP vhosts.""" + _multiprocess_can_split_ = True + def setUp(self): # pylint: disable=arguments-differ super(MultipleVhostsTest, self).setUp() @@ -218,10 +220,6 @@ class MultipleVhostsTest(util.ApacheTest): self.assertRaises( errors.PluginError, self.config.choose_vhost, "none.com") - def test_choosevhost_select_vhost_with_wildcard(self): - chosen_vhost = self.config.choose_vhost("blue.purple.com", temp=True) - self.assertEqual(self.vh_truth[6], chosen_vhost) - def test_findbest_continues_on_short_domain(self): # pylint: disable=protected-access chosen_vhost = self.config._find_best_vhost("purple.com") @@ -775,21 +773,6 @@ class MultipleVhostsTest(util.ApacheTest): self.assertRaises(errors.MisconfigurationError, self.config.config_test) - def test_get_all_certs_keys(self): - c_k = self.config.get_all_certs_keys() - self.assertEqual(len(c_k), 3) - cert, key, path = next(iter(c_k)) - self.assertTrue("cert" in cert) - self.assertTrue("key" in key) - self.assertTrue("default-ssl" in path or "ocsp-ssl" in path) - - def test_get_all_certs_keys_malformed_conf(self): - self.config.parser.find_dir = mock.Mock( - side_effect=[["path"], [], ["path"], [], ["path"], []]) - c_k = self.config.get_all_certs_keys() - - self.assertFalse(c_k) - def test_more_info(self): self.assertTrue(self.config.more_info()) @@ -1256,6 +1239,7 @@ class MultipleVhostsTest(util.ApacheTest): class AugeasVhostsTest(util.ApacheTest): """Test vhosts with illegal names dependant on augeas version.""" # pylint: disable=protected-access + _multiprocess_can_split_ = True def setUp(self): # pylint: disable=arguments-differ td = "debian_apache_2_4/augeas_vhosts" @@ -1267,8 +1251,6 @@ class AugeasVhostsTest(util.ApacheTest): self.config = util.get_apache_configurator( self.config_path, self.vhost_path, self.config_dir, self.work_dir) - self.vh_truth = util.get_vh_truth( - self.temp_dir, "debian_apache_2_4/augeas_vhosts") def tearDown(self): shutil.rmtree(self.temp_dir) @@ -1293,5 +1275,41 @@ class AugeasVhostsTest(util.ApacheTest): vhs = self.config.get_virtual_hosts() self.assertEqual([], vhs) + def test_choose_vhost_with_matching_wildcard(self): + names = ( + "an.example.net", "another.example.net", "an.other.example.net") + for name in names: + self.assertFalse(name in self.config.choose_vhost(name).aliases) + + def test_choose_vhost_without_matching_wildcard(self): + mock_path = "certbot_apache.display_ops.select_vhost" + with mock.patch(mock_path, lambda _, vhosts: vhosts[0]): + for name in ("a.example.net", "other.example.net"): + self.assertTrue(name in self.config.choose_vhost(name).aliases) + + def test_choose_vhost_wildcard_not_found(self): + mock_path = "certbot_apache.display_ops.select_vhost" + names = ( + "abc.example.net", "not.there.tld", "aa.wildcard.tld" + ) + with mock.patch(mock_path) as mock_select: + mock_select.return_value = self.config.vhosts[0] + for name in names: + orig_cc = mock_select.call_count + self.config.choose_vhost(name) + self.assertEqual(mock_select.call_count - orig_cc, 1) + + def test_choose_vhost_wildcard_found(self): + mock_path = "certbot_apache.display_ops.select_vhost" + names = ( + "ab.example.net", "a.wildcard.tld", "yetanother.example.net" + ) + with mock.patch(mock_path) as mock_select: + mock_select.return_value = self.config.vhosts[0] + for name in names: + self.config.choose_vhost(name) + self.assertEqual(mock_select.call_count, 0) + + if __name__ == "__main__": unittest.main() # pragma: no cover diff --git a/certbot-apache/certbot_apache/tests/constants_test.py b/certbot-apache/certbot_apache/tests/constants_test.py index 1c842aee9..5ab324101 100644 --- a/certbot-apache/certbot_apache/tests/constants_test.py +++ b/certbot-apache/certbot_apache/tests/constants_test.py @@ -20,25 +20,25 @@ class ConstantsTest(unittest.TestCase): self.assertEqual(constants.os_constant("vhost_root"), "/etc/httpd/conf.d") + @mock.patch("certbot.util.get_systemd_os_like") @mock.patch("certbot.util.get_os_info") - def test_get_default_value(self, os_info): + def test_get_default_values(self, os_info, os_like): os_info.return_value = ('Nonexistent Linux', '', '') + os_like.return_value = {} + self.assertFalse(constants.os_constant("handle_mods")) + self.assertEqual(constants.os_constant("server_root"), "/etc/apache2") self.assertEqual(constants.os_constant("vhost_root"), "/etc/apache2/sites-available") + @mock.patch("certbot.util.get_systemd_os_like") @mock.patch("certbot.util.get_os_info") - def test_get_default_constants(self, os_info): + def test_get_darwin_like_values(self, os_info, os_like): os_info.return_value = ('Nonexistent Linux', '', '') - with mock.patch("certbot.util.get_systemd_os_like") as os_like: - # Get defaults - os_like.return_value = False - c_hm = constants.os_constant("handle_mods") - c_sr = constants.os_constant("server_root") - self.assertFalse(c_hm) - self.assertEqual(c_sr, "/etc/apache2") - # Use darwin as like test target - os_like.return_value = ["something", "nonexistent", "darwin"] - d_vr = constants.os_constant("vhost_root") - d_em = constants.os_constant("enmod") - self.assertFalse(d_em) - self.assertEqual(d_vr, "/etc/apache2/other") + os_like.return_value = ["something", "nonexistent", "darwin"] + self.assertFalse(constants.os_constant("enmod")) + self.assertEqual(constants.os_constant("vhost_root"), + "/etc/apache2/other") + + +if __name__ == "__main__": + unittest.main() # pragma: no cover diff --git a/certbot-apache/certbot_apache/tests/display_ops_test.py b/certbot-apache/certbot_apache/tests/display_ops_test.py index 585661c7f..dea1e4433 100644 --- a/certbot-apache/certbot_apache/tests/display_ops_test.py +++ b/certbot-apache/certbot_apache/tests/display_ops_test.py @@ -17,7 +17,8 @@ class SelectVhostTest(unittest.TestCase): """Tests for certbot_apache.display_ops.select_vhost.""" def setUp(self): - zope.component.provideUtility(display_util.FileDisplay(sys.stdout)) + zope.component.provideUtility(display_util.FileDisplay(sys.stdout, + False)) self.base_dir = "/example_path" self.vhosts = util.get_vh_truth( self.base_dir, "debian_apache_2_4/multiple_vhosts") diff --git a/certbot-apache/certbot_apache/tests/testdata/debian_apache_2_4/augeas_vhosts/apache2/sites-available/another_wildcard.conf b/certbot-apache/certbot_apache/tests/testdata/debian_apache_2_4/augeas_vhosts/apache2/sites-available/another_wildcard.conf new file mode 100644 index 000000000..1a5b7de47 --- /dev/null +++ b/certbot-apache/certbot_apache/tests/testdata/debian_apache_2_4/augeas_vhosts/apache2/sites-available/another_wildcard.conf @@ -0,0 +1,11 @@ + + ServerName wildcard.tld + ServerAlias ?.wildcard.tld + ServerAdmin webmaster@localhost + DocumentRoot /var/www/html + + ErrorLog ${APACHE_LOG_DIR}/error.log + CustomLog ${APACHE_LOG_DIR}/access.log combined + + +# vim: syntax=apache ts=4 sw=4 sts=4 sr noet diff --git a/certbot-apache/certbot_apache/tests/testdata/debian_apache_2_4/augeas_vhosts/apache2/sites-available/wildcard.conf b/certbot-apache/certbot_apache/tests/testdata/debian_apache_2_4/augeas_vhosts/apache2/sites-available/wildcard.conf new file mode 100644 index 000000000..b8046e6c9 --- /dev/null +++ b/certbot-apache/certbot_apache/tests/testdata/debian_apache_2_4/augeas_vhosts/apache2/sites-available/wildcard.conf @@ -0,0 +1,11 @@ + + ServerName example.net + ServerAlias ??.example.net *.other.example.net *another.example.net + ServerAdmin webmaster@localhost + DocumentRoot /var/www/html + + ErrorLog ${APACHE_LOG_DIR}/error.log + CustomLog ${APACHE_LOG_DIR}/access.log combined + + +# vim: syntax=apache ts=4 sw=4 sts=4 sr noet diff --git a/certbot-apache/certbot_apache/tests/util.py b/certbot-apache/certbot_apache/tests/util.py index 050876687..3c33a0e19 100644 --- a/certbot-apache/certbot_apache/tests/util.py +++ b/certbot-apache/certbot_apache/tests/util.py @@ -13,7 +13,7 @@ from certbot.display import util as display_util from certbot.plugins import common -from certbot.tests import test_util +from certbot.tests import util as test_util from certbot_apache import configurator from certbot_apache import constants @@ -64,7 +64,8 @@ class ParserTest(ApacheTest): # pytlint: disable=too-few-public-methods vhost_root="debian_apache_2_4/multiple_vhosts/apache2/sites-available"): super(ParserTest, self).setUp(test_dir, config_root, vhost_root) - zope.component.provideUtility(display_util.FileDisplay(sys.stdout)) + zope.component.provideUtility(display_util.FileDisplay(sys.stdout, + False)) from certbot_apache.parser import ApacheParser self.aug = augeas.Augeas( diff --git a/certbot-apache/setup.py b/certbot-apache/setup.py index e3dbe4563..2b4ac8563 100644 --- a/certbot-apache/setup.py +++ b/certbot-apache/setup.py @@ -4,7 +4,7 @@ from setuptools import setup from setuptools import find_packages -version = '0.9.0.dev0' +version = '0.10.0.dev0' # Please update tox.ini when modifying dependency version requirements install_requires = [ diff --git a/certbot-auto b/certbot-auto index 80f39cf59..cba185eae 100755 --- a/certbot-auto +++ b/certbot-auto @@ -19,7 +19,7 @@ XDG_DATA_HOME=${XDG_DATA_HOME:-~/.local/share} VENV_NAME="letsencrypt" VENV_PATH=${VENV_PATH:-"$XDG_DATA_HOME/$VENV_NAME"} VENV_BIN="$VENV_PATH/bin" -LE_AUTO_VERSION="0.8.1" +LE_AUTO_VERSION="0.9.3" BASENAME=$(basename $0) USAGE="Usage: $BASENAME [OPTIONS] A self-updating wrapper script for the Certbot ACME client. When run, updates @@ -34,6 +34,7 @@ Help for certbot itself cannot be provided until it is installed. -n, --non-interactive, --noninteractive run without asking for user input --no-self-upgrade do not download updates --os-packages-only install OS dependencies and exit + -q, --quiet provide only update/error output -v, --verbose provide more output All arguments are accepted and forwarded to the Certbot client when run." @@ -52,15 +53,19 @@ for arg in "$@" ; do HELP=1;; --noninteractive|--non-interactive) ASSUME_YES=1;; + --quiet) + QUIET=1;; --verbose) VERBOSE=1;; -[!-]*) - while getopts ":hnv" short_arg $arg; do + while getopts ":hnvq" short_arg $arg; do case "$short_arg" in h) HELP=1;; n) ASSUME_YES=1;; + q) + QUIET=1;; v) VERBOSE=1;; esac @@ -121,7 +126,7 @@ ExperimentalBootstrap() { $2 fi else - echo "WARNING: $1 support is very experimental at present..." + echo "FATAL: $1 support is very experimental at present..." echo "if you would like to work on improving it, please ensure you have backups" echo "and then run this script again with the --debug flag!" exit 1 @@ -276,6 +281,30 @@ BootstrapRpmCommon() { exit 1 fi + if [ "$ASSUME_YES" = 1 ]; then + yes_flag="-y" + fi + + if ! $SUDO $tool list *virtualenv >/dev/null 2>&1; then + echo "To use Certbot, packages from the EPEL repository need to be installed." + if ! $SUDO $tool list epel-release >/dev/null 2>&1; then + echo "Please enable this repository and try running Certbot again." + exit 1 + fi + if [ "$ASSUME_YES" = 1 ]; then + /bin/echo -n "Enabling the EPEL repository in 3 seconds..." + sleep 1s + /bin/echo -ne "\e[0K\rEnabling the EPEL repository in 2 seconds..." + sleep 1s + /bin/echo -e "\e[0K\rEnabling the EPEL repository in 1 seconds..." + sleep 1s + fi + if ! $SUDO $tool install $yes_flag epel-release; then + echo "Could not enable EPEL. Aborting bootstrap!" + exit 1 + fi + fi + pkgs=" gcc dialog @@ -313,10 +342,6 @@ BootstrapRpmCommon() { " fi - if [ "$ASSUME_YES" = 1 ]; then - yes_flag="-y" - fi - if ! $SUDO $tool install $yes_flag $pkgs; then echo "Could not install OS dependencies. Aborting bootstrap!" exit 1 @@ -565,8 +590,9 @@ if [ "$1" = "--le-auto-phase2" ]; then # ------------------------------------------------------------------------- cat << "UNLIKELY_EOF" > "$TEMP_DIR/letsencrypt-auto-requirements.txt" # This is the flattened list of packages certbot-auto installs. To generate -# this, do `pip install --no-cache-dir -e acme -e . -e certbot-apache`, and -# then use `hashin` or a more secure method to gather the hashes. +# this, do +# `pip install --no-cache-dir -e acme -e . -e certbot-apache -e certbot-nginx`, +# and then use `hashin` or a more secure method to gather the hashes. argparse==1.4.0 \ --hash=sha256:c31647edb69fd3d465a847ea3157d37bed1f95f19760b11a47aa91c04b666314 \ @@ -598,28 +624,29 @@ ConfigArgParse==0.10.0 \ --hash=sha256:3b50a83dd58149dfcee98cb6565265d10b53e9c0a2bca7eeef7fb5f5524890a7 configobj==5.0.6 \ --hash=sha256:a2f5650770e1c87fb335af19a9b7eb73fc05ccf22144eb68db7d00cd2bcb0902 -cryptography==1.2.3 \ - --hash=sha256:031938f73a5c5eb3e809e18ff7caeb6865351871417be6050cb8c86a9a202b9a \ - --hash=sha256:a179a38d50f8d68b491d7a313db78f8cabe290842cecddddc7b34d408e59db0a \ - --hash=sha256:906c88b2aadcf99cfabb24098263d1bf65ab0c8688acde10dae1f09d865920f1 \ - --hash=sha256:6e706c5c6088770b1d1b634e959e21963e315b0255f5f4777125ad3d54082977 \ - --hash=sha256:f5ebf8e31c48f8707921dca0e994de77813a9c9b9bf03c119c5ddf97bdcffe73 \ - --hash=sha256:c7b89e42288cc7fbee3812e99ef5c744f22452e11d6822f6807afc6d6b3be83e \ - --hash=sha256:8408d29865947109d8b68f1837a7cde1aa4dc86e0f79ca3ba58c0c44e443d6a5 \ - --hash=sha256:c7e76cf3c3d925dd31fa238cfb806cffba718c0f08707d77a538768477969956 \ - --hash=sha256:7d8de35380f31702758b7753bb5c40723832c73006dedb2f9099bf61a37f7287 \ - --hash=sha256:5edbee71fae5469ee83fe0a37866b9398c8ce3a46325c24fcedfbf097bb48a19 \ - --hash=sha256:594edafe4801c13bdc1cc305e7704a90c19617e95936f6ab457ee4ffe000ba50 \ - --hash=sha256:b7fdb16a0a7f481be42da744bfe1ea2163025de21f90f2c688a316f3c354da9c \ - --hash=sha256:207b8bf0fe0907336df38b733b487521cf9e138189aba9234ad54fe545dd0db8 \ - --hash=sha256:509a2f05386270cf783993c90d49ffefb3dd62aee45bf1ea8ce3d2cde7271c21 \ - --hash=sha256:ac69b65dd1af0179ede40c9f15788c88f73e628ea6c0519de3838e279bb388c6 \ - --hash=sha256:8df6fad6c6ae12fd7004ea29357f0a2b4d3774eaeca7656530d08d2d90cd41aa \ - --hash=sha256:0b8b96dd81cc1533a04f30382c0fe21c1972e189f794d0c4261a18cec08fd9b5 \ - --hash=sha256:cae8fca1883f23c50ea78d89de6fe4fefdb4cea83177760f47177559414ded93 \ - --hash=sha256:1a471ca576a9cdce1b1cd9f3a22b1d09ee44d46862037557de17919c0db44425 \ - --hash=sha256:8ec4e8e3d453b3a1b63b5f57737a434dcf1ee4a2f26f6ff7c5a37c3f679104d2 \ - --hash=sha256:8eb11c77dd8e73f48df6b2f7a7e16173fe0fe8fdfe266232832e88477e08454e +cryptography==1.3.4 \ + --hash=sha256:bede00edd11a2a62c8c98c271cc103fa3a3d72acf64f6e5e4eaf251128897b17 \ + --hash=sha256:53b39e687b744bb548a98f40736cc529d9f60959b4e6cc551322cf9505d35eb3 \ + --hash=sha256:474b73ad1139b4e423e46bbd818efd0d5c0df1c65d9f7c957d64c9215d77afde \ + --hash=sha256:aaddf9592d5b99e32dd518bb4a25b147c124f9d6b4ad64b94f01b15d1666b8c8 \ + --hash=sha256:6dcad2f407db8c3cd6ecd78361439c449a4f94786b46c54507e7e68f51e1709d \ + --hash=sha256:475c153fc622e656f1f10a9c9941d0ac7ab18df7c38d35d563a437c1c0e34f24 \ + --hash=sha256:86dd61df581cba04e89e45081efbc531faff1c9d99c77b1ce97f87216c356353 \ + --hash=sha256:75cc697e4ef5fdd0102ca749114c6370dbd11db0c9132a18834858c2566247e3 \ + --hash=sha256:ea03ad5b9df6d79fc9fc1ab23729e01e1c920d2974c5e3c634ccf45a5c378452 \ + --hash=sha256:c8872b8fe4f3416d6338ab99612f49ab314f7856cb43bffab2a32d28a6267be8 \ + --hash=sha256:468fc6e16eaec6ceaa6bc341273e6e9912d01b42b740f8cf896ace7fcd6a321d \ + --hash=sha256:d6fea3c6502735011c5d61a62aef1c1d770fc6a2def45d9e6c0d94c9651e3317 \ + --hash=sha256:3cf95f179f4bead3d5649b91860ef4cf60ad4244209190fc405908272576d961 \ + --hash=sha256:141f77e60a5b9158309b2b60288c7f81d37faa15c22a69b94c190ceefaaa6236 \ + --hash=sha256:87b7a1fe703c6424451f3372d1879dae91c7fe5e13375441a72833db76fee30e \ + --hash=sha256:f5ee3cb0cf1a6550bf483ccffa6608db267a377b45f7e3a8201a86d1d8feb19f \ + --hash=sha256:4e097286651ea318300af3251375d48b71b8228481c56cd617ddd4459a1ff261 \ + --hash=sha256:1e3d3ae3f22f22d50d340f47f25227511326f3f1396c6d2446a5b45b516c4313 \ + --hash=sha256:6a057941cb64d79834ea3cf99093fcc4787c2a5d44f686c4f297361ddc419bcd \ + --hash=sha256:68b3d5390b92559ddd3353c73ab2dfcff758f9c4ec4f5d5226ccede0e5d779f4 \ + --hash=sha256:545dc003b4b6081f9c3e452da15d819b04b696f49484aff64c0a2aedf766bef8 \ + --hash=sha256:423ff890c01be7c70dbfeaa967eeef5146f1a43a5f810ffdc07b178e48a105a9 enum34==1.1.2 \ --hash=sha256:2475d7fcddf5951e92ff546972758802de5260bf409319a9f1934e6bbc8b1dc7 \ --hash=sha256:35907defb0f992b75ab7788f65fedc1cf20ffa22688e0e6f6f12afc06b3ea501 @@ -645,28 +672,6 @@ parsedatetime==2.1 \ pbr==1.8.1 \ --hash=sha256:46c8db75ae75a056bd1cc07fa21734fe2e603d11a07833ecc1eeb74c35c72e0c \ --hash=sha256:e2127626a91e6c885db89668976db31020f0af2da728924b56480fc7ccf09649 -psutil==3.3.0 \ - --hash=sha256:584f0b29fcc5d523b433cb8918b2fc74d67e30ee0b44a95baf031528f424619f \ - --hash=sha256:28ca0b6e9d99aa8dc286e8747a4471362b69812a25291de29b6a8d70a1545a0d \ - --hash=sha256:167ad5fff52a672c4ddc1c1a0b25146d6813ebb08a9aab0a3ac45f8a5b669c3b \ - --hash=sha256:e6dea6173a988727bb223d3497349ad5cdef5c0b282eff2d83e5f9065c53f85f \ - --hash=sha256:2af5e0a4aad66049955d0734aa4e3dc8caa17a9eaf8b4c1a27a5f1ee6e40f6fc \ - --hash=sha256:d9884dc0dc2e55e2448e495778dc9899c1c8bf37aeb2f434c1bea74af93c2683 \ - --hash=sha256:e27c2fe6dfcc8738be3d2c5a022f785eb72971057e1a9e1e34fba73bce8a71a6 \ - --hash=sha256:65afd6fecc8f3aed09ee4be63583bc8eb472f06ceaa4fe24c4d1d5a1a3c0e13f \ - --hash=sha256:ba1c558fbfcdf94515c2394b1155c1dc56e2bc2a9c17d30349827c9ed8a67e46 \ - --hash=sha256:ba95ea0022dcb64d36f0c1335c0605fae35bdf3e0fea8d92f5d0f6456a35e55b \ - --hash=sha256:421b6591d16b509aaa8d8c15821d66bb94cb4a8dc4385cad5c51b85d4a096d85 \ - --hash=sha256:326b305cbdb6f94dafbfe2c26b11da88b0ab07b8a07f8188ab9d75ff0c6e841a \ - --hash=sha256:9aede5b2b6fe46b3748ea8e5214443890d1634027bef3d33b7dad16556830278 \ - --hash=sha256:73bed1db894d1aa9c3c7e611d302cdeab7ae8a0dc0eeaf76727878db1ac5cd87 \ - --hash=sha256:935b5dd6d558af512f42501a7c08f41d7aff139af1bb3959daa3abb859234d6c \ - --hash=sha256:4ca0111cf157dcc0f2f69a323c5b5478718d68d45fc9435d84be0ec0f186215b \ - --hash=sha256:b6f13c95398a3fcf0226c4dcfa448560ba5865259cd96ec2810658651e932189 \ - --hash=sha256:ee6be30d1635bbdea4c4325d507dc8a0dbbde7e1c198bd62ddb9f43198b9e214 \ - --hash=sha256:dfa786858c268d7fbbe1b6175e001ec02738d7cfae0a7ce77bf9b651af676729 \ - --hash=sha256:aa77f9de72af9c16cc288cd4a24cf58824388f57d7a81e400c4616457629870e \ - --hash=sha256:f500093357d04da8140d87932cac2e54ef592a54ca8a743abb2850f60c2c22eb pyasn1==0.1.9 \ --hash=sha256:61f9d99e3cef65feb1bfe3a2eef7a93eb93819d345bf54bcd42f4e63d5204dae \ --hash=sha256:1802a6dd32045e472a419db1441aecab469d33e0d2749e192abdec52101724af \ @@ -679,9 +684,18 @@ pyasn1==0.1.9 \ --hash=sha256:5191ff6b9126d2c039dd87f8ff025bed274baf07fa78afa46f556b1ad7265d6e \ --hash=sha256:8323e03637b2d072cc7041300bac6ec448c3c28950ab40376036788e9a1af629 \ --hash=sha256:853cacd96d1f701ddd67aa03ecc05f51890135b7262e922710112f12a2ed2a7f -pyOpenSSL==0.15.1 \ - --hash=sha256:88e45e6bb25dfed272a1ef2e728461d44b634c2cd689e989b6e56a349c5a3ae5 \ - --hash=sha256:f0a26070d6db0881de8bcc7846934b7c3c930d8f9c79d45883ee48984bc0d672 +pyopenssl==16.0.0 \ + --hash=sha256:5add70cf00273bf957ca31fdb0df9b0ae4639e081897d5f86a0ae1f104901230 \ + --hash=sha256:363d10ee43d062285facf4e465f4f5163f9f702f9134f0a5896f134cbb92d17d +pyparsing==2.1.8 \ + --hash=sha256:2f0f5ceb14eccd5aef809d6382e87df22ca1da583c79f6db01675ce7d7f49c18 \ + --hash=sha256:03a4869b9f3493807ee1f1cb405e6d576a1a2ca4d81a982677c0c1ad6177c56b \ + --hash=sha256:ab09aee814c0241ff0c503cff30018219fe1fc14501d89f406f4664a0ec9fbcd \ + --hash=sha256:6e9a7f052f8e26bcf749e4033e3115b6dc7e3c85aafcb794b9a88c9d9ef13c97 \ + --hash=sha256:9f463a6bcc4eeb6c08f1ed84439b17818e2085937c0dee0d7674ac127c67c12b \ + --hash=sha256:3626b4d81cfb300dad57f52f2f791caaf7b06c09b368c0aa7b868e53a5775424 \ + --hash=sha256:367b90cc877b46af56d4580cd0ae278062903f02b8204ab631f5a2c0f50adfd0 \ + --hash=sha256:9f1ea360086cd68681e7f4ca8f1f38df47bf81942a0d76a9673c2d23eff35b13 pyRFC3339==1.0 \ --hash=sha256:eea31835c56e2096af4363a5745a784878a61d043e247d3a6d6a0a32a9741f56 \ --hash=sha256:8dfbc6c458b8daba1c0f3620a8c78008b323a268b27b7359e92a4ae41325f535 @@ -747,15 +761,18 @@ letsencrypt==0.7.0 \ # THE LINES BELOW ARE EDITED BY THE RELEASE SCRIPT; ADD ALL DEPENDENCIES ABOVE. -acme==0.8.1 \ - --hash=sha256:ccd7883772efbf933f91713b8241455993834f3620c8fbd459d9ed5e50bbaaca \ - --hash=sha256:d3ea4acf280bf6253ad7d641cb0970f230a19805acfed809e7a8ddcf62157d9f -certbot==0.8.1 \ - --hash=sha256:89805d9f70249ae859ec4d7a99c00b4bb7083ca90cd12d4d202b76dfc284f7c5 \ - --hash=sha256:6ca8df3d310ced6687d38aac17c0fb8c1b2ec7a3bea156a254e4cc2a1c132771 -certbot-apache==0.8.1 \ - --hash=sha256:c9e3fdc15e65589c2e39eb0e6b1f61f0c0a1db3c17b00bb337f0ff636cc61cb3 \ - --hash=sha256:0faf2879884d3b7a58b071902fba37d4b8b58a50e2c3b8ac262c0a74134045ed +acme==0.9.3 \ + --hash=sha256:d18ce17a75ad24d27981dfaef0524aa905eab757b267e027162b56a8967ab8fb \ + --hash=sha256:a6eff1f955eb2e4316abd9aa2fedb6d9345e6b5b8a2d64ea0ad35e05d6124099 +certbot==0.9.3 \ + --hash=sha256:a87ef4c53c018df4e52ee2f2e906ad16bbb37789f29e6f284c495a2eb4d9b243 \ + --hash=sha256:68149cb8392b29f5d5246e7226d25f913f2b10482bf3bc7368e8c8821d25f3b0 +certbot-apache==0.9.3 \ + --hash=sha256:f379b1053e10709692654d7a6fcea9eaed19b66c49a753b61e31bd06a04b0aac \ + --hash=sha256:a5d98cf972072de08f984db4e6a7f20269f3f023c43f6d4e781fe43be7c10086 +certbot-nginx==0.9.3 \ + --hash=sha256:3c26f18f0b57550f069263bd9b2984ef33eab6693e7796611c1b2cc16574069c \ + --hash=sha256:7337a2e90e0b28a1ab09e31d9fb81c6d78e6453500c824c0f18bab5d31b63058 UNLIKELY_EOF # ------------------------------------------------------------------------- @@ -912,13 +929,19 @@ UNLIKELY_EOF # Set PATH so pipstrap upgrades the right (v)env: PATH="$VENV_BIN:$PATH" "$VENV_BIN/python" "$TEMP_DIR/pipstrap.py" set +e - PIP_OUT=`"$VENV_BIN/pip" install --no-cache-dir --require-hashes -r "$TEMP_DIR/letsencrypt-auto-requirements.txt" 2>&1` + if [ "$VERBOSE" = 1 ]; then + "$VENV_BIN/pip" install --no-cache-dir --require-hashes -r "$TEMP_DIR/letsencrypt-auto-requirements.txt" + else + PIP_OUT=`"$VENV_BIN/pip" install --no-cache-dir --require-hashes -r "$TEMP_DIR/letsencrypt-auto-requirements.txt" 2>&1` + fi PIP_STATUS=$? set -e if [ "$PIP_STATUS" != 0 ]; then # Report error. (Otherwise, be quiet.) - echo "Had a problem while installing Python packages:" - echo "$PIP_OUT" + echo "Had a problem while installing Python packages." + if [ "$VERBOSE" != 1 ]; then + echo "$PIP_OUT" + fi rm -rf "$VENV_PATH" exit 1 fi @@ -926,8 +949,10 @@ UNLIKELY_EOF fi if [ -n "$SUDO" ]; then # SUDO is su wrapper or sudo - echo "Requesting root privileges to run certbot..." - echo " $VENV_BIN/letsencrypt" "$@" + if [ "$QUIET" != 1 ]; then + echo "Requesting root privileges to run certbot..." + echo " $VENV_BIN/letsencrypt" "$@" + fi fi if [ -z "$SUDO_ENV" ] ; then # SUDO is su wrapper / noop @@ -967,7 +992,7 @@ else # Print latest released version of LE to stdout: python fetch.py --latest-version - + # Download letsencrypt-auto script from git tag v1.2.3 into the folder I'm # in, and make sure its signature verifies: python fetch.py --le-auto-script v1.2.3 diff --git a/certbot-compatibility-test/Dockerfile b/certbot-compatibility-test/Dockerfile new file mode 100644 index 000000000..c8ef62696 --- /dev/null +++ b/certbot-compatibility-test/Dockerfile @@ -0,0 +1,50 @@ +FROM debian:jessie +MAINTAINER Brad Warren + +# no need to mkdir anything: +# https://docs.docker.com/reference/builder/#copy +# If doesn't exist, it is created along with all missing +# directories in its path. + +# TODO: Install non-default Python versions for tox. +# TODO: Install Apache/Nginx for plugin development. +COPY certbot-auto /opt/certbot/src/certbot-auto +RUN /opt/certbot/src/certbot-auto -n --os-packages-only + +# the above is not likely to change, so by putting it further up the +# Dockerfile we make sure we cache as much as possible + +COPY setup.py README.rst CHANGES.rst MANIFEST.in linter_plugin.py tox.cover.sh tox.ini pep8.travis.sh .pep8 .pylintrc /opt/certbot/src/ + +# all above files are necessary for setup.py, however, package source +# code directory has to be copied separately to a subdirectory... +# https://docs.docker.com/reference/builder/#copy: "If is a +# directory, the entire contents of the directory are copied, +# including filesystem metadata. Note: The directory itself is not +# copied, just its contents." Order again matters, three files are far +# more likely to be cached than the whole project directory + +COPY certbot /opt/certbot/src/certbot/ +COPY acme /opt/certbot/src/acme/ +COPY certbot-apache /opt/certbot/src/certbot-apache/ +COPY certbot-nginx /opt/certbot/src/certbot-nginx/ +COPY certbot-compatibility-test /opt/certbot/src/certbot-compatibility-test/ + +RUN virtualenv --no-site-packages -p python2 /opt/certbot/venv && \ + /opt/certbot/venv/bin/pip install -U setuptools && \ + /opt/certbot/venv/bin/pip install -U pip && \ + /opt/certbot/venv/bin/pip install \ + -e /opt/certbot/src/acme \ + -e /opt/certbot/src \ + -e /opt/certbot/src/certbot-apache \ + -e /opt/certbot/src/certbot-nginx \ + -e /opt/certbot/src/certbot-compatibility-test + +# install in editable mode (-e) to save space: it's not possible to +# "rm -rf /opt/certbot/src" (it's stays in the underlaying image); +# this might also help in debugging: you can "docker run --entrypoint +# bash" and investigate, apply patches, etc. + +WORKDIR /opt/certbot/src/certbot-compatibility-test/certbot_compatibility_test/testdata + +ENV PATH /opt/certbot/venv/bin:$PATH diff --git a/certbot-compatibility-test/Dockerfile-apache b/certbot-compatibility-test/Dockerfile-apache new file mode 100644 index 000000000..5c0495966 --- /dev/null +++ b/certbot-compatibility-test/Dockerfile-apache @@ -0,0 +1,6 @@ +FROM certbot-compatibility-test +MAINTAINER Brad Warren + +RUN apt-get install apache2 -y + +ENTRYPOINT [ "certbot-compatibility-test", "-p", "apache" ] diff --git a/certbot-compatibility-test/Dockerfile-nginx b/certbot-compatibility-test/Dockerfile-nginx new file mode 100644 index 000000000..4ade03065 --- /dev/null +++ b/certbot-compatibility-test/Dockerfile-nginx @@ -0,0 +1,6 @@ +FROM certbot-compatibility-test +MAINTAINER Brad Warren + +RUN apt-get install nginx -y + +ENTRYPOINT [ "certbot-compatibility-test", "-p", "nginx" ] diff --git a/certbot-compatibility-test/certbot_compatibility_test/configurators/apache/Dockerfile b/certbot-compatibility-test/certbot_compatibility_test/configurators/apache/Dockerfile deleted file mode 100644 index ea9bb857f..000000000 --- a/certbot-compatibility-test/certbot_compatibility_test/configurators/apache/Dockerfile +++ /dev/null @@ -1,20 +0,0 @@ -FROM httpd -MAINTAINER Brad Warren - -RUN mkdir /var/run/apache2 - -ENV APACHE_RUN_USER=daemon \ - APACHE_RUN_GROUP=daemon \ - APACHE_PID_FILE=/usr/local/apache2/logs/httpd.pid \ - APACHE_RUN_DIR=/var/run/apache2 \ - APACHE_LOCK_DIR=/var/lock \ - APACHE_LOG_DIR=/usr/local/apache2/logs - -COPY certbot-compatibility-test/certbot_compatibility_test/configurators/apache/a2enmod.sh /usr/local/bin/ -COPY certbot-compatibility-test/certbot_compatibility_test/configurators/apache/a2dismod.sh /usr/local/bin/ -COPY certbot-compatibility-test/certbot_compatibility_test/testdata/rsa1024_key2.pem /usr/local/apache2/conf/ -COPY certbot-compatibility-test/certbot_compatibility_test/testdata/empty_cert.pem /usr/local/apache2/conf/ - -# Note: this only exposes the port to other docker containers. You -# still have to bind to 443@host at runtime. -EXPOSE 443 diff --git a/certbot-compatibility-test/certbot_compatibility_test/configurators/apache/common.py b/certbot-compatibility-test/certbot_compatibility_test/configurators/apache/common.py index ed3d9d67a..64170ca72 100644 --- a/certbot-compatibility-test/certbot_compatibility_test/configurators/apache/common.py +++ b/certbot-compatibility-test/certbot_compatibility_test/configurators/apache/common.py @@ -1,5 +1,4 @@ """Provides a common base for Apache proxies""" -import re import os import shutil import subprocess @@ -17,10 +16,6 @@ from certbot_compatibility_test import util from certbot_compatibility_test.configurators import common as configurators_common -APACHE_VERSION_REGEX = re.compile(r"Apache/([0-9\.]*)", re.IGNORECASE) -APACHE_COMMANDS = ["apachectl", "a2enmod", "a2dismod"] - - @zope.interface.implementer(interfaces.IConfiguratorProxy) class Proxy(configurators_common.Proxy): # pylint: disable=too-many-instance-attributes @@ -32,37 +27,25 @@ class Proxy(configurators_common.Proxy): self.le_config.apache_le_vhost_ext = "-le-ssl.conf" self.modules = self.server_root = self.test_conf = self.version = None - self._apache_configurator = self._all_names = self._test_names = None patch = mock.patch( "certbot_apache.configurator.display_ops.select_vhost") mock_display = patch.start() mock_display.side_effect = le_errors.PluginError( "Unable to determine vhost") - def __getattr__(self, name): - """Wraps the Apache Configurator methods""" - method = getattr(self._apache_configurator, name, None) - if callable(method): - return method - else: - raise AttributeError() - def load_config(self): """Loads the next configuration for the plugin to test""" - config = super(Proxy, self).load_config() self._all_names, self._test_names = _get_names(config) server_root = _get_server_root(config) - # with open(os.path.join(config, "config_file")) as f: - # config_file = os.path.join(server_root, f.readline().rstrip()) shutil.rmtree("/etc/apache2") shutil.copytree(server_root, "/etc/apache2", symlinks=True) self._prepare_configurator() try: - subprocess.check_call("apachectl -k start".split()) + subprocess.check_call("apachectl -k restart".split()) except errors.Error: raise errors.Error( "Apache failed to load {0} before tests started".format( @@ -78,38 +61,16 @@ class Proxy(configurators_common.Proxy): # An alias self.le_config.apache_handle_modules = self.le_config.apache_handle_mods - self._apache_configurator = configurator.ApacheConfigurator( + self._configurator = configurator.ApacheConfigurator( config=configuration.NamespaceConfig(self.le_config), name="apache") - self._apache_configurator.prepare() + self._configurator.prepare() def cleanup_from_tests(self): """Performs any necessary cleanup from running plugin tests""" super(Proxy, self).cleanup_from_tests() mock.patch.stopall() - def get_all_names_answer(self): - """Returns the set of domain names that the plugin should find""" - if self._all_names: - return self._all_names - else: - raise errors.Error("No configuration file loaded") - - def get_testable_domain_names(self): - """Returns the set of domain names that can be tested against""" - if self._test_names: - return self._test_names - else: - return {"example.com"} - - def deploy_cert(self, domain, cert_path, key_path, chain_path=None, - fullchain_path=None): - """Installs cert""" - cert_path, key_path, chain_path = self.copy_certs_and_keys( - cert_path, key_path, chain_path) - self._apache_configurator.deploy_cert( - domain, cert_path, key_path, chain_path, fullchain_path) - def _get_server_root(config): """Returns the server root directory in config""" diff --git a/certbot-compatibility-test/certbot_compatibility_test/configurators/common.py b/certbot-compatibility-test/certbot_compatibility_test/configurators/common.py index 03128cc86..2a800c1c2 100644 --- a/certbot-compatibility-test/certbot_compatibility_test/configurators/common.py +++ b/certbot-compatibility-test/certbot_compatibility_test/configurators/common.py @@ -5,6 +5,7 @@ import shutil import tempfile from certbot import constants +from certbot_compatibility_test import errors from certbot_compatibility_test import util @@ -31,6 +32,18 @@ class Proxy(object): self.args = args self.http_port = 80 self.https_port = 443 + self._configurator = self._all_names = self._test_names = None + + def __getattr__(self, name): + """Wraps the configurator methods""" + if self._configurator is None: + raise AttributeError() + + method = getattr(self._configurator, name, None) + if callable(method): + return method + else: + raise AttributeError() def has_more_configs(self): """Returns true if there are more configs to test""" @@ -63,3 +76,25 @@ class Proxy(object): chain = None return cert, key, chain + + def get_all_names_answer(self): + """Returns the set of domain names that the plugin should find""" + if self._all_names: + return self._all_names + else: + raise errors.Error("No configuration file loaded") + + def get_testable_domain_names(self): + """Returns the set of domain names that can be tested against""" + if self._test_names: + return self._test_names + else: + return {"example.com"} + + def deploy_cert(self, domain, cert_path, key_path, chain_path=None, + fullchain_path=None): + """Installs cert""" + cert_path, key_path, chain_path = self.copy_certs_and_keys( + cert_path, key_path, chain_path) + self._configurator.deploy_cert( + domain, cert_path, key_path, chain_path, fullchain_path) diff --git a/certbot-compatibility-test/certbot_compatibility_test/configurators/nginx/__init__.py b/certbot-compatibility-test/certbot_compatibility_test/configurators/nginx/__init__.py new file mode 100644 index 000000000..ed294abe6 --- /dev/null +++ b/certbot-compatibility-test/certbot_compatibility_test/configurators/nginx/__init__.py @@ -0,0 +1 @@ +"""Certbot compatibility test Nginx configurators""" diff --git a/certbot-compatibility-test/certbot_compatibility_test/configurators/nginx/common.py b/certbot-compatibility-test/certbot_compatibility_test/configurators/nginx/common.py new file mode 100644 index 000000000..3622bee41 --- /dev/null +++ b/certbot-compatibility-test/certbot_compatibility_test/configurators/nginx/common.py @@ -0,0 +1,84 @@ +"""Provides a common base for Nginx proxies""" +import os +import shutil +import subprocess + +import zope.interface + +from certbot import configuration +from certbot_nginx import configurator +from certbot_nginx import constants +from certbot_compatibility_test import errors +from certbot_compatibility_test import interfaces +from certbot_compatibility_test import util +from certbot_compatibility_test.configurators import common as configurators_common + + +@zope.interface.implementer(interfaces.IConfiguratorProxy) +class Proxy(configurators_common.Proxy): + # pylint: disable=too-many-instance-attributes + """A common base for Nginx test configurators""" + + def __init__(self, args): + """Initializes the plugin with the given command line args""" + super(Proxy, self).__init__(args) + + def load_config(self): + """Loads the next configuration for the plugin to test""" + config = super(Proxy, self).load_config() + self._all_names, self._test_names = _get_names(config) + + server_root = _get_server_root(config) + + # XXX: Deleting all of this is kind of scary unless the test + # instances really each have a complete configuration! + shutil.rmtree("/etc/nginx") + shutil.copytree(server_root, "/etc/nginx", symlinks=True) + + self._prepare_configurator() + + try: + subprocess.check_call("service nginx reload".split()) + except errors.Error: + raise errors.Error( + "Nginx failed to load {0} before tests started".format( + config)) + + return config + + def _prepare_configurator(self): + """Prepares the Nginx plugin for testing""" + for k in constants.CLI_DEFAULTS.keys(): + setattr(self.le_config, "nginx_" + k, constants.os_constant(k)) + + conf = configuration.NamespaceConfig(self.le_config) + zope.component.provideUtility(conf) + self._configurator = configurator.NginxConfigurator( + config=conf, name="nginx") + self._configurator.prepare() + + +def _get_server_root(config): + """Returns the server root directory in config""" + subdirs = [ + name for name in os.listdir(config) + if os.path.isdir(os.path.join(config, name))] + + if len(subdirs) != 1: + raise errors.Error("Malformed configuration directory {0}".format(config)) + + return os.path.join(config, subdirs[0].rstrip()) + + +def _get_names(config): + """Returns all and testable domain names in config""" + all_names = set() + for root, _dirs, files in os.walk(config): + for this_file in files: + for line in open(os.path.join(root, this_file)): + if line.strip().startswith("server_name"): + names = line.partition("server_name")[2].rpartition(";")[0] + for n in names.split(): + all_names.add(n) + non_ip_names = set(n for n in all_names if not util.IP_REGEX.match(n)) + return all_names, non_ip_names diff --git a/certbot-compatibility-test/certbot_compatibility_test/test_driver.py b/certbot-compatibility-test/certbot_compatibility_test/test_driver.py index 2c78eea1f..b5e023f36 100644 --- a/certbot-compatibility-test/certbot_compatibility_test/test_driver.py +++ b/certbot-compatibility-test/certbot_compatibility_test/test_driver.py @@ -22,7 +22,8 @@ from certbot_compatibility_test import errors from certbot_compatibility_test import util from certbot_compatibility_test import validator -from certbot_compatibility_test.configurators.apache import common +from certbot_compatibility_test.configurators.apache import common as a_common +from certbot_compatibility_test.configurators.nginx import common as n_common DESCRIPTION = """ @@ -32,7 +33,7 @@ tests that the plugin supports are performed. """ -PLUGINS = {"apache": common.Proxy} +PLUGINS = {"apache": a_common.Proxy, "nginx": n_common.Proxy} logger = logging.getLogger(__name__) @@ -143,7 +144,7 @@ def test_deploy_cert(plugin, temp_dir, domains): for domain in domains: try: - plugin.deploy_cert(domain, cert_path, util.KEY_PATH, cert_path) + plugin.deploy_cert(domain, cert_path, util.KEY_PATH, cert_path, cert_path) plugin.save() # Needed by the Apache plugin except le_errors.Error as error: logger.error("Plugin failed to deploy ceritificate for %s:", domain) diff --git a/certbot-compatibility-test/certbot_compatibility_test/testdata/configs.tar.gz b/certbot-compatibility-test/certbot_compatibility_test/testdata/apache.tar.gz similarity index 100% rename from certbot-compatibility-test/certbot_compatibility_test/testdata/configs.tar.gz rename to certbot-compatibility-test/certbot_compatibility_test/testdata/apache.tar.gz diff --git a/certbot-compatibility-test/certbot_compatibility_test/testdata/nginx.tar.gz b/certbot-compatibility-test/certbot_compatibility_test/testdata/nginx.tar.gz new file mode 100644 index 000000000..4ca5cc977 Binary files /dev/null and b/certbot-compatibility-test/certbot_compatibility_test/testdata/nginx.tar.gz differ diff --git a/certbot-compatibility-test/certbot_compatibility_test/validator.py b/certbot-compatibility-test/certbot_compatibility_test/validator.py index e82b2c049..333b47296 100644 --- a/certbot-compatibility-test/certbot_compatibility_test/validator.py +++ b/certbot-compatibility-test/certbot_compatibility_test/validator.py @@ -40,8 +40,15 @@ class Validator(object): return False redirect_location = response.headers.get("location", "") + # We're checking that the redirect we added behaves correctly. + # It's okay for some server configuration to redirect to an + # http URL, as long as it's on some other domain. if not redirect_location.startswith("https://"): - return False + if not redirect_location.startswith("http://"): + return False + else: + if redirect_location[len("http://"):] == name: + return False if response.status_code != 301: logger.error("Server did not redirect with permanent code") diff --git a/certbot-compatibility-test/setup.py b/certbot-compatibility-test/setup.py index fb56be65f..32e5935fb 100644 --- a/certbot-compatibility-test/setup.py +++ b/certbot-compatibility-test/setup.py @@ -4,7 +4,7 @@ from setuptools import setup from setuptools import find_packages -version = '0.9.0.dev0' +version = '0.10.0.dev0' install_requires = [ 'certbot', diff --git a/certbot-nginx/certbot_nginx/configurator.py b/certbot-nginx/certbot_nginx/configurator.py index 31ffa0041..b9d5148b5 100644 --- a/certbot-nginx/certbot_nginx/configurator.py +++ b/certbot-nginx/certbot_nginx/configurator.py @@ -24,12 +24,41 @@ from certbot.plugins import common from certbot_nginx import constants from certbot_nginx import tls_sni_01 -from certbot_nginx import obj from certbot_nginx import parser logger = logging.getLogger(__name__) +REDIRECT_BLOCK = [[ + ['\n ', 'if', ' ', '($scheme != "https") '], + [['\n ', 'return', ' ', '301 https://$host$request_uri'], + '\n '] +], ['\n']] + +TEST_REDIRECT_BLOCK = [ + [ + ['if', '($scheme != "https")'], + [ + ['return', '301 https://$host$request_uri'] + ] + ], + ['#', ' managed by Certbot'] +] + +REDIRECT_COMMENT_BLOCK = [ + ['\n ', '#', ' Redirect non-https traffic to https'], + ['\n ', '#', ' if ($scheme != "https") {'], + ['\n ', '#', " return 301 https://$host$request_uri;"], + ['\n ', '#', " } # managed by Certbot"], + ['\n'] +] + +TEST_REDIRECT_COMMENT_BLOCK = [ + ['#', ' Redirect non-https traffic to https'], + ['#', ' if ($scheme != "https") {'], + ['#', " return 301 https://$host$request_uri;"], + ['#', " } # managed by Certbot"], +] @zope.interface.implementer(interfaces.IAuthenticator, interfaces.IInstaller) @zope.interface.provider(interfaces.IPluginFactory) @@ -55,7 +84,11 @@ class NginxConfigurator(common.Plugin): """ - description = "Nginx Web Server - currently doesn't work" + description = "Nginx Web Server plugin - Alpha" + + hidden = True + + DEFAULT_LISTEN_PORT = '80' @classmethod def add_parser_arguments(cls, add): @@ -92,7 +125,8 @@ class NginxConfigurator(common.Plugin): # These will be set in the prepare function self.parser = None self.version = version - self._enhance_func = {"redirect": self._enable_redirect} + self._enhance_func = {"redirect": self._enable_redirect, + "staple-ocsp": self._enable_ocsp_stapling} # Set up reverter self.reverter = reverter.Reverter(self.config) @@ -117,6 +151,8 @@ class NginxConfigurator(common.Plugin): # Make sure configuration is valid self.config_test() + # temp_install must be run before creating the NginxParser + temp_install(self.mod_ssl_conf) self.parser = parser.NginxParser( self.conf('server-root'), self.mod_ssl_conf) @@ -124,8 +160,6 @@ class NginxConfigurator(common.Plugin): if self.version is None: self.version = self.get_version() - temp_install(self.mod_ssl_conf) - # Entry point in main.py for installing cert def deploy_cert(self, domain, cert_path, key_path, chain_path=None, fullchain_path=None): @@ -135,11 +169,6 @@ class NginxConfigurator(common.Plugin): .. note:: Aborts if the vhost is missing ssl_certificate or ssl_certificate_key. - .. note:: Nginx doesn't have a cert chain directive. - It expects the cert file to have the concatenated chain. - However, we use the chain file as input to the - ssl_trusted_certificate directive, used for verify OCSP responses. - .. note:: This doesn't save the config files! :raises errors.PluginError: When unable to deploy certificate due to @@ -155,26 +184,9 @@ class NginxConfigurator(common.Plugin): cert_directives = [['\n', 'ssl_certificate', ' ', fullchain_path], ['\n', 'ssl_certificate_key', ' ', key_path]] - # OCSP stapling was introduced in Nginx 1.3.7. If we have that version - # or greater, add config settings for it. - stapling_directives = [] - if self.version >= (1, 3, 7): - stapling_directives = [ - ['\n ', 'ssl_trusted_certificate', ' ', chain_path], - ['\n ', 'ssl_stapling', ' ', 'on'], - ['\n ', 'ssl_stapling_verify', ' ', 'on'], ['\n']] - - if len(stapling_directives) != 0 and not chain_path: - raise errors.PluginError( - "--chain-path is required to enable " - "Online Certificate Status Protocol (OCSP) stapling " - "on nginx >= 1.3.7.") - try: - self.parser.add_server_directives(vhost.filep, vhost.names, + self.parser.add_server_directives(vhost, cert_directives, replace=True) - self.parser.add_server_directives(vhost.filep, vhost.names, - stapling_directives, replace=False) logger.info("Deployed Certificate to VirtualHost %s for %s", vhost.filep, vhost.names) except errors.MisconfigurationError as error: @@ -190,12 +202,6 @@ class NginxConfigurator(common.Plugin): ", ".join(str(addr) for addr in vhost.addrs))) self.save_notes += "\tssl_certificate %s\n" % fullchain_path self.save_notes += "\tssl_certificate_key %s\n" % key_path - if len(stapling_directives) > 0: - self.save_notes += "\tssl_trusted_certificate %s\n" % chain_path - self.save_notes += "\tssl_stapling on\n" - self.save_notes += "\tssl_stapling_verify on\n" - - ####################### # Vhost parsing methods @@ -222,22 +228,13 @@ class NginxConfigurator(common.Plugin): vhost = None matches = self._get_ranked_matches(target_name) - if not matches: - # No matches. Create a new vhost with this name in nginx.conf. - filep = self.parser.loc["root"] - new_block = [['server'], [['\n', 'server_name', ' ', target_name]]] - self.parser.add_http_directives(filep, new_block) - vhost = obj.VirtualHost(filep, set([]), False, True, - set([target_name]), list(new_block[1])) - elif matches[0]['rank'] in xrange(2, 6): - # Wildcard match - need to find the longest one - rank = matches[0]['rank'] - wildcards = [x for x in matches if x['rank'] == rank] - vhost = max(wildcards, key=lambda x: len(x['name']))['vhost'] + vhost = self._select_best_name_match(matches) + if not vhost: + # No matches. Raise a misconfiguration error. + raise errors.MisconfigurationError( + "Cannot find a VirtualHost matching domain %s." % (target_name)) else: - vhost = matches[0]['vhost'] - - if vhost is not None: + # Note: if we are enhancing with ocsp, vhost should already be ssl. if not vhost.ssl: self._make_server_ssl(vhost) @@ -252,6 +249,41 @@ class NginxConfigurator(common.Plugin): the numerical rank :rtype: list + """ + vhost_list = self.parser.get_vhosts() + return self._rank_matches_by_name_and_ssl(vhost_list, target_name) + + def _select_best_name_match(self, matches): + """Returns the best name match of a ranked list of vhosts. + + :param list matches: list of dicts containing the vhost, the matching name, + and the numerical rank + :returns: the most matching vhost + :rtype: :class:`~certbot_nginx.obj.VirtualHost` + + """ + if not matches: + return None + elif matches[0]['rank'] in xrange(2, 6): + # Wildcard match - need to find the longest one + rank = matches[0]['rank'] + wildcards = [x for x in matches if x['rank'] == rank] + return max(wildcards, key=lambda x: len(x['name']))['vhost'] + else: + # Exact or regex match + return matches[0]['vhost'] + + + def _rank_matches_by_name_and_ssl(self, vhost_list, target_name): + """Returns a ranked list of vhosts from vhost_list that match target_name. + The ranking gives preference to SSL vhosts. + + :param list vhost_list: list of vhosts to filter and rank + :param str target_name: The name to match + :returns: list of dicts containing the vhost, the matching name, and + the numerical rank + :rtype: list + """ # Nginx chooses a matching server name for a request with precedence: # 1. exact name match @@ -259,7 +291,7 @@ class NginxConfigurator(common.Plugin): # 3. longest wildcard name ending with * # 4. first matching regex in order of appearance in the file matches = [] - for vhost in self.parser.get_vhosts(): + for vhost in vhost_list: name_type, name = parser.get_best_match(target_name, vhost.names) if name_type == 'exact': matches.append({'vhost': vhost, @@ -279,6 +311,73 @@ class NginxConfigurator(common.Plugin): 'rank': 6 if vhost.ssl else 7}) return sorted(matches, key=lambda x: x['rank']) + + def choose_redirect_vhost(self, target_name, port): + """Chooses a single virtual host for redirect enhancement. + + Chooses the vhost most closely matching target_name that is + listening to port without using ssl. + + .. todo:: This should maybe return list if no obvious answer + is presented. + + .. todo:: The special name "$hostname" corresponds to the machine's + hostname. Currently we just ignore this. + + :param str target_name: domain name + :param str port: port number + :returns: vhost associated with name + :rtype: :class:`~certbot_nginx.obj.VirtualHost` + + """ + matches = self._get_redirect_ranked_matches(target_name, port) + return self._select_best_name_match(matches) + + def _get_redirect_ranked_matches(self, target_name, port): + """Gets a ranked list of plaintextish port-listening vhosts matching target_name + + Filter all hosts for those listening on port without using ssl. + Rank by how well these match target_name. + + :param str target_name: The name to match + :param str port: port number + :returns: list of dicts containing the vhost, the matching name, and + the numerical rank + :rtype: list + + """ + all_vhosts = self.parser.get_vhosts() + def _port_matches(test_port, matching_port): + # test_port is a number, matching is a number or "" or None + if matching_port == "" or matching_port is None: + # if no port is specified, Nginx defaults to listening on port 80. + return test_port == self.DEFAULT_LISTEN_PORT + else: + return test_port == matching_port + + def _vhost_matches(vhost, port): + found_matching_port = False + if len(vhost.addrs) == 0: + # if there are no listen directives at all, Nginx defaults to + # listening on port 80. + found_matching_port = (port == self.DEFAULT_LISTEN_PORT) + else: + for addr in vhost.addrs: + if _port_matches(port, addr.get_port()) and addr.ssl == False: + found_matching_port = True + + if found_matching_port: + # make sure we don't have an 'ssl on' directive + return not self.parser.has_ssl_on_directive(vhost) + else: + return False + + matching_vhosts = [vhost for vhost in all_vhosts if _vhost_matches(vhost, port)] + + # We can use this ranking function because sslishness doesn't matter to us, and + # there shouldn't be conflicting plaintextish servers listening on 80. + return self._rank_matches_by_name_and_ssl(matching_vhosts, target_name) + def get_all_names(self): """Returns all names found in the Nginx Configuration. @@ -306,7 +405,25 @@ class NginxConfigurator(common.Plugin): except (socket.error, socket.herror, socket.timeout): continue - return all_names + return self._get_filtered_names(all_names) + + def _get_filtered_names(self, all_names): + """Removes names that aren't considered valid by Let's Encrypt. + + :param set all_names: all names found in the Nginx configuration + + :returns: all found names that are considered valid by LE + :rtype: set + + """ + filtered_names = set() + for name in all_names: + try: + filtered_names.add(util.enforce_le_validity(name)) + except errors.ConfigurationError as error: + logger.debug('Not suggesting name "%s"', name) + logger.debug(error) + return filtered_names def _get_snakeoil_paths(self): # TODO: generate only once @@ -319,7 +436,8 @@ class NginxConfigurator(common.Plugin): cert = acme_crypto_util.gen_ss_cert(key, domains=[socket.gethostname()]) cert_pem = OpenSSL.crypto.dump_certificate( OpenSSL.crypto.FILETYPE_PEM, cert) - cert_file, cert_path = util.unique_file(os.path.join(tmp_dir, "cert.pem")) + cert_file, cert_path = util.unique_file( + os.path.join(tmp_dir, "cert.pem"), mode="wb") with cert_file: cert_file.write(cert_pem) return cert_path, le_key.file @@ -337,36 +455,32 @@ class NginxConfigurator(common.Plugin): :type vhost: :class:`~certbot_nginx.obj.VirtualHost` """ + # If the vhost was implicitly listening on the default Nginx port, + # have it continue to do so. + if len(vhost.addrs) == 0: + listen_block = [['\n ', 'listen', ' ', self.DEFAULT_LISTEN_PORT]] + self.parser.add_server_directives(vhost, listen_block, replace=False) + snakeoil_cert, snakeoil_key = self._get_snakeoil_paths() - ssl_block = [['\n ', 'listen', ' ', '{0} ssl'.format(self.config.tls_sni_01_port)], - ['\n ', 'ssl_certificate', ' ', snakeoil_cert], - ['\n ', 'ssl_certificate_key', ' ', snakeoil_key], - ['\n ', 'include', ' ', self.parser.loc["ssl_options"]]] + + # the options file doesn't have a newline at the beginning, but there + # needs to be one when it's dropped into the file + ssl_block = ( + [['\n ', 'listen', ' ', '{0} ssl'.format(self.config.tls_sni_01_port)], + ['\n ', 'ssl_certificate', ' ', snakeoil_cert], + ['\n ', 'ssl_certificate_key', ' ', snakeoil_key], + ['\n']] + + self.parser.loc["ssl_options"]) + self.parser.add_server_directives( - vhost.filep, vhost.names, ssl_block, replace=False) - vhost.ssl = True - vhost.raw.extend(ssl_block) - vhost.addrs.add(obj.Addr( - '', str(self.config.tls_sni_01_port), True, False)) - - def get_all_certs_keys(self): - """Find all existing keys, certs from configuration. - - :returns: list of tuples with form [(cert, key, path)] - cert - str path to certificate file - key - str path to associated key file - path - File path to configuration file. - :rtype: set - - """ - return self.parser.get_all_certs_keys() + vhost, ssl_block, replace=False) ################################## # enhancement methods (IInstaller) ################################## def supported_enhancements(self): # pylint: disable=no-self-use """Returns currently supported enhancements.""" - return ['redirect'] + return ['redirect', 'staple-ocsp'] def enhance(self, domain, enhancement, options=None): """Enhance configuration. @@ -380,35 +494,105 @@ class NginxConfigurator(common.Plugin): """ try: - return self._enhance_func[enhancement]( - self.choose_vhost(domain), options) + return self._enhance_func[enhancement](domain, options) except (KeyError, ValueError): raise errors.PluginError( "Unsupported enhancement: {0}".format(enhancement)) except errors.PluginError: logger.warning("Failed %s for %s", enhancement, domain) + raise - def _enable_redirect(self, vhost, unused_options): + def _has_certbot_redirect(self, vhost): + return vhost.contains_list(TEST_REDIRECT_BLOCK) + + def _has_certbot_redirect_comment(self, vhost): + return vhost.contains_list(TEST_REDIRECT_COMMENT_BLOCK) + + def _add_redirect_block(self, vhost, active=True): + """Add redirect directive to vhost + """ + if active: + redirect_block = REDIRECT_BLOCK + else: + redirect_block = REDIRECT_COMMENT_BLOCK + + self.parser.add_server_directives( + vhost, redirect_block, replace=False) + + def _enable_redirect(self, domain, unused_options): """Redirect all equivalent HTTP traffic to ssl_vhost. Add rewrite directive to non https traffic .. note:: This function saves the configuration - :param vhost: Destination of traffic, an ssl enabled vhost - :type vhost: :class:`~certbot_nginx.obj.VirtualHost` - + :param str domain: domain to enable redirect for :param unused_options: Not currently used :type unused_options: Not Available """ - redirect_block = [[ - ['\n ', 'if', ' ', '($scheme != "https") '], - [['\n ', 'return', ' ', '301 https://$host$request_uri'], - '\n '] - ], ['\n']] - self.parser.add_server_directives( - vhost.filep, vhost.names, redirect_block, replace=False) - logger.info("Redirecting all traffic to ssl in %s", vhost.filep) + + port = self.DEFAULT_LISTEN_PORT + vhost = None + # If there are blocks listening plaintextishly on self.DEFAULT_LISTEN_PORT, + # choose the most name-matching one. + vhost = self.choose_redirect_vhost(domain, port) + + if vhost is None: + logger.info("No matching insecure server blocks listening on port %s found.", + self.DEFAULT_LISTEN_PORT) + else: + if self._has_certbot_redirect(vhost): + logger.info("Traffic on port %s already redirecting to ssl in %s", + self.DEFAULT_LISTEN_PORT, vhost.filep) + elif vhost.has_redirect(): + if not self._has_certbot_redirect_comment(vhost): + self._add_redirect_block(vhost, active=False) + logger.info("The appropriate server block is already redirecting " + "traffic. To enable redirect anyway, uncomment the " + "redirect lines in %s.", vhost.filep) + else: + # Redirect plaintextish host to https + self._add_redirect_block(vhost, active=True) + logger.info("Redirecting all traffic on port %s to ssl in %s", + self.DEFAULT_LISTEN_PORT, vhost.filep) + + def _enable_ocsp_stapling(self, domain, chain_path): + """Include OCSP response in TLS handshake + + :param str domain: domain to enable OCSP response for + :param chain_path: chain file path + :type chain_path: `str` or `None` + + """ + vhost = self.choose_vhost(domain) + if self.version < (1, 3, 7): + raise errors.PluginError("Version 1.3.7 or greater of nginx " + "is needed to enable OCSP stapling") + + if chain_path is None: + raise errors.PluginError( + "--chain-path is required to enable " + "Online Certificate Status Protocol (OCSP) stapling " + "on nginx >= 1.3.7.") + + stapling_directives = [ + ['\n ', 'ssl_trusted_certificate', ' ', chain_path], + ['\n ', 'ssl_stapling', ' ', 'on'], + ['\n ', 'ssl_stapling_verify', ' ', 'on'], ['\n']] + + try: + self.parser.add_server_directives(vhost, + stapling_directives, replace=False) + except errors.MisconfigurationError as error: + logger.debug(error) + raise errors.PluginError("An error occurred while enabling OCSP " + "stapling for {0}.".format(vhost.names)) + + self.save_notes += ("OCSP Stapling was enabled " + "on SSL Vhost: {0}.\n".format(vhost.filep)) + self.save_notes += "\tssl_trusted_certificate {0}\n".format(chain_path) + self.save_notes += "\tssl_stapling on\n" + self.save_notes += "\tssl_stapling_verify on\n" ###################################### # Nginx server management (IInstaller) @@ -527,14 +711,16 @@ class NginxConfigurator(common.Plugin): """ save_files = set(self.parser.parsed.keys()) - try: + try: # TODO: make a common base for Apache and Nginx plugins # Create Checkpoint if temporary: self.reverter.add_to_temp_checkpoint( save_files, self.save_notes) + # how many comments does it take else: self.reverter.add_to_checkpoint(save_files, self.save_notes) + # to confuse a linter? except errors.ReverterError as err: raise errors.PluginError(str(err)) diff --git a/certbot-nginx/certbot_nginx/constants.py b/certbot-nginx/certbot_nginx/constants.py index 5dde30efc..8cf1f6bc9 100644 --- a/certbot-nginx/certbot_nginx/constants.py +++ b/certbot-nginx/certbot_nginx/constants.py @@ -16,3 +16,17 @@ MOD_SSL_CONF_SRC = pkg_resources.resource_filename( "certbot_nginx", "options-ssl-nginx.conf") """Path to the nginx mod_ssl config file found in the Certbot distribution.""" + +def os_constant(key): + # XXX TODO: In the future, this could return different constants + # based on what OS we are running under. To see an + # approach to how to handle different OSes, see the + # apache version of this file. Currently, we do not + # actually have any OS-specific constants on Nginx. + """ + Get a constant value for operating system + + :param key: name of cli constant + :return: value of constant for active os + """ + return CLI_DEFAULTS[key] diff --git a/certbot-nginx/certbot_nginx/nginxparser.py b/certbot-nginx/certbot_nginx/nginxparser.py index c7a9f0c75..6f2a3ec70 100644 --- a/certbot-nginx/certbot_nginx/nginxparser.py +++ b/certbot-nginx/certbot_nginx/nginxparser.py @@ -227,7 +227,8 @@ class UnspacedList(list): def insert(self, i, x): item, spaced_item = self._coerce(x) - self.spaced.insert(self._spaced_position(i), spaced_item) + slicepos = self._spaced_position(i) if i < len(self) else len(self.spaced) + self.spaced.insert(slicepos, spaced_item) list.insert(self, i, item) self.dirty = True diff --git a/certbot-nginx/certbot_nginx/obj.py b/certbot-nginx/certbot_nginx/obj.py index f5ac88f6c..29fa976f3 100644 --- a/certbot-nginx/certbot_nginx/obj.py +++ b/certbot-nginx/certbot_nginx/obj.py @@ -3,6 +3,7 @@ import re from certbot.plugins import common +REDIRECT_DIRECTIVES = ['return', 'rewrite'] class Addr(common.Addr): r"""Represents an Nginx address, i.e. what comes after the 'listen' @@ -28,10 +29,14 @@ class Addr(common.Addr): :param bool default: Whether the directive includes 'default_server' """ + UNSPECIFIED_IPV4_ADDRESSES = ('', '*', '0.0.0.0') + CANONICAL_UNSPECIFIED_ADDRESS = UNSPECIFIED_IPV4_ADDRESSES[0] + def __init__(self, host, port, ssl, default): super(Addr, self).__init__((host, port)) self.ssl = ssl self.default = default + self.unspecified_address = host in self.UNSPECIFIED_IPV4_ADDRESSES @classmethod def fromstring(cls, str_addr): @@ -69,7 +74,8 @@ class Addr(common.Addr): return cls(host, port, ssl, default) - def __str__(self): + def to_string(self, include_default=True): + """Return string representation of Addr""" parts = '' if self.tup[0] and self.tup[1]: parts = "%s:%s" % self.tup @@ -78,19 +84,36 @@ class Addr(common.Addr): else: parts = self.tup[1] - if self.default: + if self.default and include_default: parts += ' default_server' if self.ssl: parts += ' ssl' return parts + def __str__(self): + return self.to_string() + def __repr__(self): return "Addr(" + self.__str__() + ")" + def super_eq(self, other): + """Check ip/port equality, with IPv6 support. + """ + # If both addresses got an unspecified address, then make sure the + # host representation in each match when doing the comparison. + if self.unspecified_address and other.unspecified_address: + return common.Addr((self.CANONICAL_UNSPECIFIED_ADDRESS, + self.tup[1]), self.ipv6) == \ + common.Addr((other.CANONICAL_UNSPECIFIED_ADDRESS, + other.tup[1]), other.ipv6) + # Nginx plugin currently doesn't support IPv6 but this will + # future-proof it + return super(Addr, self).__eq__(other) + def __eq__(self, other): if isinstance(other, self.__class__): - return (self.tup == other.tup and + return (self.super_eq(other) and self.ssl == other.ssl and self.default == other.default) return False @@ -107,10 +130,12 @@ class VirtualHost(object): # pylint: disable=too-few-public-methods :ivar bool ssl: SSLEngine on in vhost :ivar bool enabled: Virtual host is enabled + :ivar list path: The indices into the parsed file used to access + the server block defining the vhost """ - def __init__(self, filep, addrs, ssl, enabled, names, raw): + def __init__(self, filep, addrs, ssl, enabled, names, raw, path): # pylint: disable=too-many-arguments """Initialize a VH.""" self.filep = filep @@ -119,6 +144,7 @@ class VirtualHost(object): # pylint: disable=too-few-public-methods self.ssl = ssl self.enabled = enabled self.raw = raw + self.path = path def __str__(self): addr_str = ", ".join(str(addr) for addr in self.addrs) @@ -137,6 +163,37 @@ class VirtualHost(object): # pylint: disable=too-few-public-methods return (self.filep == other.filep and list(self.addrs) == list(other.addrs) and self.names == other.names and - self.ssl == other.ssl and self.enabled == other.enabled) + self.ssl == other.ssl and + self.enabled == other.enabled and + self.path == other.path) return False + + def has_redirect(self): + """Determine if this vhost has a redirecting statement + """ + for directive_name in REDIRECT_DIRECTIVES: + found = _find_directive(self.raw, directive_name) + if found is not None: + return True + return False + + def contains_list(self, test): + """Determine if raw server block contains test list at top level + """ + for i in xrange(0, len(self.raw) - len(test)): + if self.raw[i:i + len(test)] == test: + return True + return False + +def _find_directive(directives, directive_name): + """Find a directive of type directive_name in directives + """ + if not directives or isinstance(directives, str) or len(directives) == 0: + return None + + if directives[0] == directive_name: + return directives + + matches = (_find_directive(line, directive_name) for line in directives) + return next((m for m in matches if m is not None), None) diff --git a/certbot-nginx/certbot_nginx/options-ssl-nginx.conf b/certbot-nginx/certbot_nginx/options-ssl-nginx.conf index f0081c1fc..89c920b3e 100644 --- a/certbot-nginx/certbot_nginx/options-ssl-nginx.conf +++ b/certbot-nginx/certbot_nginx/options-ssl-nginx.conf @@ -1,8 +1,7 @@ -ssl_session_cache shared:SSL:1m; +ssl_session_cache shared:le_nginx_SSL:1m; ssl_session_timeout 1440m; ssl_protocols TLSv1 TLSv1.1 TLSv1.2; ssl_prefer_server_ciphers on; -# Using list of ciphers from "Bulletproof SSL and TLS" ssl_ciphers "ECDHE-ECDSA-AES128-GCM-SHA256 ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-ECDSA-AES128-SHA ECDHE-ECDSA-AES256-SHA ECDHE-ECDSA-AES128-SHA256 ECDHE-ECDSA-AES256-SHA384 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES128-SHA ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES256-SHA384 DHE-RSA-AES128-GCM-SHA256 DHE-RSA-AES256-GCM-SHA384 DHE-RSA-AES128-SHA DHE-RSA-AES256-SHA DHE-RSA-AES128-SHA256 DHE-RSA-AES256-SHA256 EDH-RSA-DES-CBC3-SHA"; diff --git a/certbot-nginx/certbot_nginx/parser.py b/certbot-nginx/certbot_nginx/parser.py index aae6ce122..1a2c85c2c 100644 --- a/certbot-nginx/certbot_nginx/parser.py +++ b/certbot-nginx/certbot_nginx/parser.py @@ -82,6 +82,43 @@ class NginxParser(object): else: return path + def _build_addr_to_ssl(self): + """Builds a map from address to whether it listens on ssl in any server block + """ + servers = self._get_raw_servers() + + addr_to_ssl = {} + for filename in servers: + for server, _ in servers[filename]: + # Parse the server block to save addr info + parsed_server = _parse_server_raw(server) + for addr in parsed_server['addrs']: + addr_tuple = addr.normalized_tuple() + if addr_tuple not in addr_to_ssl: + addr_to_ssl[addr_tuple] = addr.ssl + addr_to_ssl[addr_tuple] = addr.ssl or addr_to_ssl[addr_tuple] + return addr_to_ssl + + def _get_raw_servers(self): + # pylint: disable=cell-var-from-loop + """Get a map of unparsed all server blocks + """ + servers = {} + for filename in self.parsed: + tree = self.parsed[filename] + servers[filename] = [] + srv = servers[filename] # workaround undefined loop var in lambdas + + # Find all the server blocks + _do_for_subarray(tree, lambda x: x[0] == ['server'], + lambda x, y: srv.append((x[1], y))) + + # Find 'include' statements in server blocks and append their trees + for i, (server, path) in enumerate(servers[filename]): + new_server = self._get_included_directives(server) + servers[filename][i] = (new_server, path) + return servers + def get_vhosts(self): # pylint: disable=cell-var-from-loop """Gets list of all 'virtual hosts' found in Nginx configuration. @@ -94,38 +131,37 @@ class NginxParser(object): """ enabled = True # We only look at enabled vhosts for now + servers = self._get_raw_servers() + vhosts = [] - servers = {} - - for filename in self.parsed: - tree = self.parsed[filename] - servers[filename] = [] - srv = servers[filename] # workaround undefined loop var in lambdas - - # Find all the server blocks - _do_for_subarray(tree, lambda x: x[0] == ['server'], - lambda x: srv.append(x[1])) - - # Find 'include' statements in server blocks and append their trees - for i, server in enumerate(servers[filename]): - new_server = self._get_included_directives(server) - servers[filename][i] = new_server - for filename in servers: - for server in servers[filename]: + for server, path in servers[filename]: # Parse the server block into a VirtualHost object - parsed_server = parse_server(server) + parsed_server = _parse_server_raw(server) vhost = obj.VirtualHost(filename, parsed_server['addrs'], parsed_server['ssl'], enabled, parsed_server['names'], - server) + server, + path) vhosts.append(vhost) + self._update_vhosts_addrs_ssl(vhosts) + return vhosts + def _update_vhosts_addrs_ssl(self, vhosts): + """Update a list of raw parsed vhosts to include global address sslishness + """ + addr_to_ssl = self._build_addr_to_ssl() + for vhost in vhosts: + for addr in vhost.addrs: + addr.ssl = addr_to_ssl[addr.normalized_tuple()] + if addr.ssl: + vhost.ssl = True + def _get_included_directives(self, block): """Returns array with the "include" directives expanded out by concatenating the contents of the included file to the block. @@ -173,6 +209,17 @@ class NginxParser(object): logger.debug("Could not parse file: %s", item) return trees + def _parse_ssl_options(self, ssl_options): + if ssl_options is not None: + try: + with open(ssl_options) as _file: + return nginxparser.load(_file).spaced + except IOError: + logger.warn("Missing NGINX TLS options file: %s", ssl_options) + except pyparsing.ParseBaseException: + logger.debug("Could not parse file: %s", ssl_options) + return [] + def _set_locations(self, ssl_options): """Set default location for directives. @@ -192,7 +239,7 @@ class NginxParser(object): name = default return {"root": root, "default": default, "listen": listen, - "name": name, "ssl_options": ssl_options} + "name": name, "ssl_options": self._parse_ssl_options(ssl_options)} def _find_config_root(self): """Find the Nginx Configuration Root file.""" @@ -229,42 +276,39 @@ class NginxParser(object): except IOError: logger.error("Could not open file for writing: %s", filename) - def _has_server_names(self, entry, names): - """Checks if a server block has the given set of server_names. This - is the primary way of identifying server blocks in the configurator. - Returns false if 'entry' doesn't look like a server block at all. + def parse_server(self, server): + """Parses a list of server directives, accounting for global address sslishness. - ..todo :: Doesn't match server blocks whose server_name directives are - split across multiple conf files. + :param list server: list of directives in a server block + :rtype: dict + """ + addr_to_ssl = self._build_addr_to_ssl() + parsed_server = _parse_server_raw(server) + _apply_global_addr_ssl(addr_to_ssl, parsed_server) + return parsed_server - :param list entry: The block to search - :param set names: The names to match + def has_ssl_on_directive(self, vhost): + """Does vhost have ssl on for all ports? + + :param :class:`~certbot_nginx.obj.VirtualHost` vhost: The vhost in question + + :returns: True if 'ssl on' directive is included :rtype: bool """ - if len(names) == 0: - # Nothing to identify blocks with - return False + server = vhost.raw + for directive in server: + if not directive or len(directive) < 2: + continue + elif directive[0] == 'ssl' and directive[1] == 'on': + return True - if not isinstance(entry, list): - # Can't be a server block - return False + return False - new_entry = self._get_included_directives(entry) - server_names = set() - for item in new_entry: - if not isinstance(item, list): - # Can't be a server block - return False + def add_server_directives(self, vhost, directives, replace): + """Add or replace directives in the server block identified by vhost. - if len(item) > 0 and item[0] == 'server_name': - server_names.update(_get_servernames(item[1])) - - return server_names == names - - def add_server_directives(self, filename, names, directives, - replace): - """Add or replace directives in the first server block with names. + This method modifies vhost to be fully consistent with the new directives. ..note :: If replace is True, this raises a misconfiguration error if the directive does not already exist. @@ -274,60 +318,34 @@ class NginxParser(object): ..todo :: Doesn't match server blocks whose server_name directives are split across multiple conf files. - :param str filename: The absolute filename of the config file - :param set names: The server_name to match + :param :class:`~certbot_nginx.obj.VirtualHost` vhost: The vhost + whose information we use to match on :param list directives: The directives to add :param bool replace: Whether to only replace existing directives """ + filename = vhost.filep try: - _do_for_subarray(self.parsed[filename], - lambda x: self._has_server_names(x, names), - lambda x: _add_directives(x, directives, replace)) + result = self.parsed[filename] + for index in vhost.path: + result = result[index] + if not isinstance(result, list) or len(result) != 2: + raise errors.MisconfigurationError("Not a server block.") + result = result[1] + _add_directives(result, directives, replace) + + # update vhost based on new directives + new_server = self._get_included_directives(result) + parsed_server = self.parse_server(new_server) + vhost.addrs = parsed_server['addrs'] + vhost.ssl = parsed_server['ssl'] + vhost.names = parsed_server['names'] + vhost.raw = new_server except errors.MisconfigurationError as err: raise errors.MisconfigurationError("Problem in %s: %s" % (filename, err.message)) - def add_http_directives(self, filename, directives): - """Adds directives to the first encountered HTTP block in filename. - We insert new directives at the top of the block to work around - https://trac.nginx.org/nginx/ticket/810: If the first server block - doesn't enable OCSP stapling, stapling is broken for all blocks. - - :param str filename: The absolute filename of the config file - :param list directives: The directives to add - - """ - _do_for_subarray(self.parsed[filename], - lambda x: x[0] == ['http'], - lambda x: x[1].insert(0, directives)) - - def get_all_certs_keys(self): - """Gets all certs and keys in the nginx config. - - :returns: list of tuples with form [(cert, key, path)] - cert - str path to certificate file - key - str path to associated key file - path - File path to configuration file. - :rtype: set - - """ - c_k = set() - vhosts = self.get_vhosts() - for vhost in vhosts: - tup = [None, None, vhost.filep] - if vhost.ssl: - for directive in vhost.raw: - if directive[0] == 'ssl_certificate': - tup[0] = directive[1] - elif directive[0] == 'ssl_certificate_key': - tup[1] = directive[1] - if tup[0] is not None and tup[1] is not None: - c_k.add(tuple(tup)) - return c_k - - -def _do_for_subarray(entry, condition, func): +def _do_for_subarray(entry, condition, func, path=None): """Executes a function for a subarray of a nested array if it matches the given condition. @@ -336,12 +354,14 @@ def _do_for_subarray(entry, condition, func): :param function func: The function to call for each matching item """ + if path is None: + path = [] if isinstance(entry, list): if condition(entry): - func(entry) + func(entry, path) else: - for item in entry: - _do_for_subarray(item, condition, func) + for index, item in enumerate(entry): + _do_for_subarray(item, condition, func, path + [index]) def get_best_match(target_name, names): @@ -460,35 +480,6 @@ def _get_servernames(names): names = re.sub(whitespace_re, ' ', names) return names.split(' ') - -def parse_server(server): - """Parses a list of server directives. - - :param list server: list of directives in a server block - :rtype: dict - - """ - parsed_server = {'addrs': set(), - 'ssl': False, - 'names': set()} - - for directive in server: - if not directive: - continue - if directive[0] == 'listen': - addr = obj.Addr.fromstring(directive[1]) - parsed_server['addrs'].add(addr) - if not parsed_server['ssl'] and addr.ssl: - parsed_server['ssl'] = True - elif directive[0] == 'server_name': - parsed_server['names'].update( - _get_servernames(directive[1])) - elif directive[0] == 'ssl' and directive[1] == 'on': - parsed_server['ssl'] = True - - return parsed_server - - def _add_directives(block, directives, replace): """Adds or replaces directives in a config block. @@ -506,8 +497,30 @@ def _add_directives(block, directives, replace): """ for directive in directives: _add_directive(block, directive, replace) + if block and '\n' not in block[-1]: # could be " \n " or ["\n"] ! + block.append(nginxparser.UnspacedList('\n')) + + +REPEATABLE_DIRECTIVES = set(['server_name', 'listen', 'include']) +COMMENT = ' managed by Certbot' +COMMENT_BLOCK = [' ', '#', COMMENT] + + +def _comment_directive(block, location): + """Add a comment to the end of the line at location.""" + next_entry = block[location + 1] if location + 1 < len(block) else None + if isinstance(next_entry, list) and next_entry: + if len(next_entry) >= 2 and next_entry[-2] == "#" and COMMENT in next_entry[-1]: + return + elif isinstance(next_entry, nginxparser.UnspacedList): + next_entry = next_entry.spaced[0] + else: + next_entry = next_entry[0] + + block.insert(location + 1, COMMENT_BLOCK[:]) + if next_entry is not None and "\n" not in next_entry: + block.insert(location + 2, '\n') -repeatable_directives = set(['server_name', 'listen', 'include']) def _add_directive(block, directive, replace): """Adds or replaces a single directive in a config block. @@ -516,37 +529,75 @@ def _add_directive(block, directive, replace): """ directive = nginxparser.UnspacedList(directive) - if len(directive) == 0: - # whitespace + if len(directive) == 0 or directive[0] == '#': + # whitespace or comment block.append(directive) return - location = -1 + # Find the index of a config line where the name of the directive matches - # the name of the directive we want to add. - for index, line in enumerate(block): - if len(line) > 0 and line[0] == directive[0]: - location = index - break + # the name of the directive we want to add. If no line exists, use None. + location = next((index for index, line in enumerate(block) + if line and line[0] == directive[0]), None) if replace: - if location == -1: + if location is None: raise errors.MisconfigurationError( - 'expected directive for %s in the Nginx ' - 'config but did not find it.' % directive[0]) + 'expected directive for {0} in the Nginx ' + 'config but did not find it.'.format(directive[0])) block[location] = directive + _comment_directive(block, location) else: # Append directive. Fail if the name is not a repeatable directive name, # and there is already a copy of that directive with a different value # in the config file. directive_name = directive[0] directive_value = directive[1] - if location != -1 and directive_name.__str__() not in repeatable_directives: - if block[location][1] == directive_value: - # There's a conflict, but the existing value matches the one we - # want to insert, so it's fine. - pass - else: - raise errors.MisconfigurationError( - 'tried to insert directive "%s" but found conflicting "%s".' % ( - directive, block[location])) - else: + if location is None or (isinstance(directive_name, str) and + directive_name in REPEATABLE_DIRECTIVES): block.append(directive) + _comment_directive(block, len(block) - 1) + elif block[location][1] != directive_value: + raise errors.MisconfigurationError( + 'tried to insert directive "{0}" but found ' + 'conflicting "{1}".'.format(directive, block[location])) + +def _apply_global_addr_ssl(addr_to_ssl, parsed_server): + """Apply global sslishness information to the parsed server block + """ + for addr in parsed_server['addrs']: + addr.ssl = addr_to_ssl[addr.normalized_tuple()] + if addr.ssl: + parsed_server['ssl'] = True + +def _parse_server_raw(server): + """Parses a list of server directives. + + :param list server: list of directives in a server block + :rtype: dict + + """ + parsed_server = {'addrs': set(), + 'ssl': False, + 'names': set()} + + apply_ssl_to_all_addrs = False + + for directive in server: + if not directive: + continue + if directive[0] == 'listen': + addr = obj.Addr.fromstring(directive[1]) + parsed_server['addrs'].add(addr) + if addr.ssl: + parsed_server['ssl'] = True + elif directive[0] == 'server_name': + parsed_server['names'].update( + _get_servernames(directive[1])) + elif directive[0] == 'ssl' and directive[1] == 'on': + parsed_server['ssl'] = True + apply_ssl_to_all_addrs = True + + if apply_ssl_to_all_addrs: + for addr in parsed_server['addrs']: + addr.ssl = True + + return parsed_server diff --git a/certbot-nginx/certbot_nginx/tests/configurator_test.py b/certbot-nginx/certbot_nginx/tests/configurator_test.py index fede3bc08..6886127d7 100644 --- a/certbot-nginx/certbot_nginx/tests/configurator_test.py +++ b/certbot-nginx/certbot_nginx/tests/configurator_test.py @@ -13,12 +13,16 @@ from acme import messages from certbot import achallenges from certbot import errors +from certbot_nginx import obj +from certbot_nginx import parser from certbot_nginx.tests import util class NginxConfiguratorTest(util.NginxTest): """Test a semi complex vhost configuration.""" + _multiprocess_can_split_ = True + def setUp(self): super(NginxConfiguratorTest, self).setUp() @@ -38,7 +42,9 @@ class NginxConfiguratorTest(util.NginxTest): def test_prepare(self): self.assertEqual((1, 6, 2), self.config.version) - self.assertEqual(5, len(self.config.parser.parsed)) + self.assertEqual(8, len(self.config.parser.parsed)) + # ensure we successfully parsed a file for ssl_options + self.assertTrue(self.config.parser.loc["ssl_options"]) @mock.patch("certbot_nginx.configurator.util.exe_exists") @mock.patch("certbot_nginx.configurator.subprocess.Popen") @@ -63,13 +69,13 @@ class NginxConfiguratorTest(util.NginxTest): mock_gethostbyaddr.return_value = ('155.225.50.69.nephoscale.net', [], []) names = self.config.get_all_names() self.assertEqual(names, set( - ["*.www.foo.com", "somename", "another.alias", - "alias", "localhost", ".example.com", r"~^(www\.)?(example|bar)\.", - "155.225.50.69.nephoscale.net", "*.www.example.com", - "example.*", "www.example.org", "myhost"])) + ["155.225.50.69.nephoscale.net", "www.example.org", "another.alias", + "migration.com", "summer.com", "geese.com", "sslon.com", + "globalssl.com", "globalsslsetssl.com"])) def test_supported_enhancements(self): - self.assertEqual(['redirect'], self.config.supported_enhancements()) + self.assertEqual(['redirect', 'staple-ocsp'], + self.config.supported_enhancements()) def test_enhance(self): self.assertRaises( @@ -81,21 +87,25 @@ class NginxConfiguratorTest(util.NginxTest): def test_save(self): filep = self.config.parser.abs_path('sites-enabled/example.com') + mock_vhost = obj.VirtualHost(filep, + None, None, None, + set(['.example.com', 'example.*']), + None, [0]) self.config.parser.add_server_directives( - filep, set(['.example.com', 'example.*']), + mock_vhost, [['listen', ' ', '5001 ssl']], replace=False) self.config.save() # pylint: disable=protected-access parsed = self.config.parser._parse_files(filep, override=True) - self.assertEqual([[['server'], [ - ['listen', '69.50.225.155:9000'], - ['listen', '127.0.0.1'], - ['server_name', '.example.com'], - ['server_name', 'example.*'], - ['listen', '5001 ssl'] - ]]], + self.assertEqual([[['server'], + [['listen', '69.50.225.155:9000'], + ['listen', '127.0.0.1'], + ['server_name', '.example.com'], + ['server_name', 'example.*'], + ['listen', '5001 ssl'], + ['#', parser.COMMENT]]]], parsed[0]) def test_choose_vhost(self): @@ -133,42 +143,12 @@ class NginxConfiguratorTest(util.NginxTest): self.assertEqual(conf_path[name], path) for name in bad_results: - self.assertEqual(set([name]), self.config.choose_vhost(name).names) + self.assertRaises(errors.MisconfigurationError, + self.config.choose_vhost, name) def test_more_info(self): self.assertTrue('nginx.conf' in self.config.more_info()) - def test_deploy_cert_stapling(self): - # Choose a version of Nginx greater than 1.3.7 so stapling code gets - # invoked. - self.config.version = (1, 9, 6) - example_conf = self.config.parser.abs_path('sites-enabled/example.com') - self.config.deploy_cert( - "www.example.com", - "example/cert.pem", - "example/key.pem", - "example/chain.pem", - "example/fullchain.pem") - self.config.save() - self.config.parser.load() - generated_conf = self.config.parser.parsed[example_conf] - - self.assertTrue(util.contains_at_depth(generated_conf, - ['ssl_stapling', 'on'], 2)) - self.assertTrue(util.contains_at_depth(generated_conf, - ['ssl_stapling_verify', 'on'], 2)) - self.assertTrue(util.contains_at_depth(generated_conf, - ['ssl_trusted_certificate', 'example/chain.pem'], 2)) - - def test_deploy_cert_stapling_requires_chain_path(self): - self.config.version = (1, 3, 7) - self.assertRaises(errors.PluginError, self.config.deploy_cert, - "www.example.com", - "example/cert.pem", - "example/key.pem", - None, - "example/fullchain.pem") - def test_deploy_cert_requires_fullchain_path(self): self.config.version = (1, 3, 1) self.assertRaises(errors.PluginError, self.config.deploy_cert, @@ -182,8 +162,6 @@ class NginxConfiguratorTest(util.NginxTest): server_conf = self.config.parser.abs_path('server.conf') nginx_conf = self.config.parser.abs_path('nginx.conf') example_conf = self.config.parser.abs_path('sites-enabled/example.com') - # Choose a version of Nginx less than 1.3.7 so stapling code doesn't get - # invoked. self.config.version = (1, 3, 1) # Get the default SSL vhost @@ -216,9 +194,9 @@ class NginxConfiguratorTest(util.NginxTest): ['listen', '5001 ssl'], ['ssl_certificate', 'example/fullchain.pem'], - ['ssl_certificate_key', 'example/key.pem'], - ['include', self.config.parser.loc["ssl_options"]] - ]]], + ['ssl_certificate_key', 'example/key.pem']] + + util.filter_comments(self.config.parser.loc["ssl_options"]) + ]], parsed_example_conf) self.assertEqual([['server_name', 'somename alias another.alias']], parsed_server_conf) @@ -234,34 +212,34 @@ class NginxConfiguratorTest(util.NginxTest): ['index', 'index.html index.htm']]], ['listen', '5001 ssl'], ['ssl_certificate', '/etc/nginx/fullchain.pem'], - ['ssl_certificate_key', '/etc/nginx/key.pem'], - ['include', self.config.parser.loc["ssl_options"]]]], + ['ssl_certificate_key', '/etc/nginx/key.pem']] + + util.filter_comments(self.config.parser.loc["ssl_options"]) + ], 2)) - def test_get_all_certs_keys(self): - nginx_conf = self.config.parser.abs_path('nginx.conf') - example_conf = self.config.parser.abs_path('sites-enabled/example.com') - - # Get the default SSL vhost + def test_deploy_cert_add_explicit_listen(self): + migration_conf = self.config.parser.abs_path('sites-enabled/migration.com') self.config.deploy_cert( - "www.example.com", - "example/cert.pem", - "example/key.pem", - "example/chain.pem", - "example/fullchain.pem") - self.config.deploy_cert( - "another.alias", - "/etc/nginx/cert.pem", - "/etc/nginx/key.pem", - "/etc/nginx/chain.pem", - "/etc/nginx/fullchain.pem") + "summer.com", + "summer/cert.pem", + "summer/key.pem", + "summer/chain.pem", + "summer/fullchain.pem") self.config.save() - self.config.parser.load() - self.assertEqual(set([ - ('example/fullchain.pem', 'example/key.pem', example_conf), - ('/etc/nginx/fullchain.pem', '/etc/nginx/key.pem', nginx_conf), - ]), self.config.get_all_certs_keys()) + parsed_migration_conf = util.filter_comments(self.config.parser.parsed[migration_conf]) + self.assertEqual([['server'], + [ + ['server_name', 'migration.com'], + ['server_name', 'summer.com'], + + ['listen', '80'], + ['listen', '5001 ssl'], + ['ssl_certificate', 'summer/fullchain.pem'], + ['ssl_certificate_key', 'summer/key.pem']] + + util.filter_comments(self.config.parser.loc["ssl_options"]) + ], + parsed_migration_conf[0]) @mock.patch("certbot_nginx.configurator.tls_sni_01.NginxTlsSni01.perform") @mock.patch("certbot_nginx.configurator.NginxConfigurator.restart") @@ -367,15 +345,15 @@ class NginxConfiguratorTest(util.NginxTest): mock_popen.side_effect = OSError("Can't find program") self.assertRaises(errors.MisconfigurationError, self.config.restart) - @mock.patch("certbot.util.run_script") - def test_config_test(self, _): - self.config.config_test() - @mock.patch("certbot.util.run_script") def test_config_test_bad_process(self, mock_run_script): mock_run_script.side_effect = errors.SubprocessError self.assertRaises(errors.MisconfigurationError, self.config.config_test) + @mock.patch("certbot.util.run_script") + def test_config_test(self, _): + self.config.config_test() + @mock.patch("certbot.reverter.Reverter.recovery_routine") def test_recovery_routine_throws_error_from_reverter(self, mock_recovery_routine): mock_recovery_routine.side_effect = errors.ReverterError("foo") @@ -414,6 +392,8 @@ class NginxConfiguratorTest(util.NginxTest): OpenSSL.crypto.FILETYPE_PEM, key_file.read()) def test_redirect_enhance(self): + # Test that we successfully add a redirect when there is + # a listen directive expected = [ ['if', '($scheme != "https") '], [['return', '301 https://$host$request_uri']] @@ -425,5 +405,109 @@ class NginxConfiguratorTest(util.NginxTest): generated_conf = self.config.parser.parsed[example_conf] self.assertTrue(util.contains_at_depth(generated_conf, expected, 2)) + # Test that we successfully add a redirect when there is + # no listen directive + migration_conf = self.config.parser.abs_path('sites-enabled/migration.com') + self.config.enhance("migration.com", "redirect") + + generated_conf = self.config.parser.parsed[migration_conf] + self.assertTrue(util.contains_at_depth(generated_conf, expected, 2)) + + @mock.patch('certbot_nginx.obj.VirtualHost.contains_list') + @mock.patch('certbot_nginx.obj.VirtualHost.has_redirect') + def test_certbot_redirect_exists(self, mock_has_redirect, mock_contains_list): + # Test that we add no redirect statement if there is already a + # redirect in the block that is managed by certbot + # Has a certbot redirect + mock_has_redirect.return_value = True + mock_contains_list.return_value = True + with mock.patch("certbot_nginx.configurator.logger") as mock_logger: + self.config.enhance("www.example.com", "redirect") + self.assertEqual(mock_logger.info.call_args[0][0], + "Traffic on port %s already redirecting to ssl in %s") + + @mock.patch('certbot_nginx.obj.VirtualHost.contains_list') + @mock.patch('certbot_nginx.obj.VirtualHost.has_redirect') + def test_non_certbot_redirect_exists(self, mock_has_redirect, mock_contains_list): + # Test that we add a redirect as a comment if there is already a + # redirect-class statement in the block that isn't managed by certbot + example_conf = self.config.parser.abs_path('sites-enabled/example.com') + + # Has a non-Certbot redirect, and has no existing comment + mock_contains_list.return_value = False + mock_has_redirect.return_value = True + with mock.patch("certbot_nginx.configurator.logger") as mock_logger: + self.config.enhance("www.example.com", "redirect") + self.assertEqual(mock_logger.info.call_args[0][0], + "The appropriate server block is already redirecting " + "traffic. To enable redirect anyway, uncomment the " + "redirect lines in %s.") + generated_conf = self.config.parser.parsed[example_conf] + expected = [ + ['#', ' Redirect non-https traffic to https'], + ['#', ' if ($scheme != "https") {'], + ['#', ' return 301 https://$host$request_uri;'], + ['#', ' } # managed by Certbot'] + ] + for line in expected: + self.assertTrue(util.contains_at_depth(generated_conf, line, 2)) + + @mock.patch('certbot_nginx.obj.VirtualHost.contains_list') + @mock.patch('certbot_nginx.obj.VirtualHost.has_redirect') + @mock.patch('certbot_nginx.configurator.NginxConfigurator._has_certbot_redirect_comment') + @mock.patch('certbot_nginx.configurator.NginxConfigurator._add_redirect_block') + def test_redirect_comment_exists(self, mock_add_redirect_block, + mock_has_cb_redirect_comment, mock_has_redirect, mock_contains_list): + # Test that we add nothing if there is a non-Certbot redirect and a + # preexisting comment + # Has a non-Certbot redirect and a comment + mock_has_redirect.return_value = True + mock_contains_list.return_value = False # self._has_certbot_redirect(vhost): + mock_has_cb_redirect_comment.return_value = True + + # assert _add_redirect_block not called + with mock.patch("certbot_nginx.configurator.logger") as mock_logger: + self.config.enhance("www.example.com", "redirect") + self.assertFalse(mock_add_redirect_block.called) + self.assertTrue(mock_logger.info.called) + + def test_redirect_dont_enhance(self): + # Test that we don't accidentally add redirect to ssl-only block + with mock.patch("certbot_nginx.configurator.logger") as mock_logger: + self.config.enhance("geese.com", "redirect") + self.assertEqual(mock_logger.info.call_args[0][0], + 'No matching insecure server blocks listening on port %s found.') + + def test_staple_ocsp_bad_version(self): + self.config.version = (1, 3, 1) + self.assertRaises(errors.PluginError, self.config.enhance, + "www.example.com", "staple-ocsp", "chain_path") + + def test_staple_ocsp_no_chain_path(self): + self.assertRaises(errors.PluginError, self.config.enhance, + "www.example.com", "staple-ocsp", None) + + def test_staple_ocsp_internal_error(self): + self.config.enhance("www.example.com", "staple-ocsp", "chain_path") + # error is raised because the server block has conflicting directives + self.assertRaises(errors.PluginError, self.config.enhance, + "www.example.com", "staple-ocsp", "different_path") + + def test_staple_ocsp(self): + chain_path = "example/chain.pem" + self.config.enhance("www.example.com", "staple-ocsp", chain_path) + + example_conf = self.config.parser.abs_path('sites-enabled/example.com') + generated_conf = self.config.parser.parsed[example_conf] + + self.assertTrue(util.contains_at_depth( + generated_conf, + ['ssl_trusted_certificate', 'example/chain.pem'], 2)) + self.assertTrue(util.contains_at_depth( + generated_conf, ['ssl_stapling', 'on'], 2)) + self.assertTrue(util.contains_at_depth( + generated_conf, ['ssl_stapling_verify', 'on'], 2)) + + if __name__ == "__main__": unittest.main() # pragma: no cover diff --git a/certbot-nginx/certbot_nginx/tests/nginxparser_test.py b/certbot-nginx/certbot_nginx/tests/nginxparser_test.py index 5fa9a7d1e..e83b414cf 100644 --- a/certbot-nginx/certbot_nginx/tests/nginxparser_test.py +++ b/certbot-nginx/certbot_nginx/tests/nginxparser_test.py @@ -1,7 +1,7 @@ """Test for certbot_nginx.nginxparser.""" import copy import operator -import os +import tempfile import unittest from pyparsing import ParseException @@ -128,44 +128,34 @@ class TestRawNginxParser(unittest.TestCase): [['root', ' ', 'html'], ['index', ' ', 'index.html index.htm']]]]])) - with open(util.get_data_filename('nginx.new.conf'), 'w') as handle: - dump(parsed, handle) - with open(util.get_data_filename('nginx.new.conf')) as handle: - parsed_new = load(handle) - try: - self.maxDiff = None - self.assertEqual(parsed[0], parsed_new[0]) - self.assertEqual(parsed[1:], parsed_new[1:]) - finally: - os.unlink(util.get_data_filename('nginx.new.conf')) + with tempfile.TemporaryFile() as f: + dump(parsed, f) + f.seek(0) + parsed_new = load(f) + self.assertEqual(parsed, parsed_new) def test_comments(self): with open(util.get_data_filename('minimalistic_comments.conf')) as handle: parsed = load(handle) - with open(util.get_data_filename('minimalistic_comments.new.conf'), 'w') as handle: - dump(parsed, handle) + with tempfile.TemporaryFile() as f: + dump(parsed, f) + f.seek(0) + parsed_new = load(f) - with open(util.get_data_filename('minimalistic_comments.new.conf')) as handle: - parsed_new = load(handle) - - try: - self.assertEqual(parsed, parsed_new) - - self.assertEqual(parsed_new, [ - ['#', " Use bar.conf when it's a full moon!"], - ['include', 'foo.conf'], - ['#', ' Kilroy was here'], - ['check_status'], - [['server'], - [['#', ''], - ['#', " Don't forget to open up your firewall!"], - ['#', ''], - ['listen', '1234'], - ['#', ' listen 80;']]], - ]) - finally: - os.unlink(util.get_data_filename('minimalistic_comments.new.conf')) + self.assertEqual(parsed, parsed_new) + self.assertEqual(parsed_new, [ + ['#', " Use bar.conf when it's a full moon!"], + ['include', 'foo.conf'], + ['#', ' Kilroy was here'], + ['check_status'], + [['server'], + [['#', ''], + ['#', " Don't forget to open up your firewall!"], + ['#', ''], + ['listen', '1234'], + ['#', ' listen 80;']]], + ]) def test_issue_518(self): parsed = loads('if ($http_accept ~* "webp") { set $webp "true"; }') @@ -223,6 +213,26 @@ class TestUnspacedList(unittest.TestCase): self.assertRaises(IndexError, self.ul2.__getitem__, 2) self.assertRaises(IndexError, self.ul2.__getitem__, -3) + def test_insert(self): + x = UnspacedList( + [['\n ', 'listen', ' ', '69.50.225.155:9000'], + ['\n ', 'listen', ' ', '127.0.0.1'], + ['\n ', 'server_name', ' ', '.example.com'], + ['\n ', 'server_name', ' ', 'example.*'], '\n', + ['listen', ' ', '5001 ssl']]) + x.insert(5, "FROGZ") + self.assertEqual(x, + [['listen', '69.50.225.155:9000'], ['listen', '127.0.0.1'], + ['server_name', '.example.com'], ['server_name', 'example.*'], + ['listen', '5001 ssl'], 'FROGZ']) + self.assertEqual(x.spaced, + [['\n ', 'listen', ' ', '69.50.225.155:9000'], + ['\n ', 'listen', ' ', '127.0.0.1'], + ['\n ', 'server_name', ' ', '.example.com'], + ['\n ', 'server_name', ' ', 'example.*'], '\n', + ['listen', ' ', '5001 ssl'], + 'FROGZ']) + def test_rawlists(self): ul3 = copy.deepcopy(self.ul) ul3.insert(0, "some") diff --git a/certbot-nginx/certbot_nginx/tests/obj_test.py b/certbot-nginx/certbot_nginx/tests/obj_test.py index e7a993d1b..b0a2d5ad8 100644 --- a/certbot-nginx/certbot_nginx/tests/obj_test.py +++ b/certbot-nginx/certbot_nginx/tests/obj_test.py @@ -1,5 +1,6 @@ """Test the helper objects in certbot_nginx.obj.""" import unittest +import itertools class AddrTest(unittest.TestCase): @@ -55,6 +56,16 @@ class AddrTest(unittest.TestCase): self.assertEqual(str(self.addr5), "myhost") self.assertEqual(str(self.addr6), "80 default_server") + def test_to_string(self): + self.assertEqual(self.addr1.to_string(), "192.168.1.1") + self.assertEqual(self.addr2.to_string(), "192.168.1.1:* ssl") + self.assertEqual(self.addr3.to_string(), "192.168.1.1:80") + self.assertEqual(self.addr4.to_string(), "*:80 default_server ssl") + self.assertEqual(self.addr4.to_string(include_default=False), "*:80 ssl") + self.assertEqual(self.addr5.to_string(), "myhost") + self.assertEqual(self.addr6.to_string(), "80 default_server") + self.assertEqual(self.addr6.to_string(include_default=False), "80") + def test_eq(self): from certbot_nginx.obj import Addr new_addr1 = Addr.fromstring("192.168.1.1 spdy") @@ -62,6 +73,24 @@ class AddrTest(unittest.TestCase): self.assertNotEqual(self.addr1, self.addr2) self.assertFalse(self.addr1 == 3333) + def test_equivalent_any_addresses(self): + from certbot_nginx.obj import Addr + any_addresses = ("0.0.0.0:80 default_server ssl", + "80 default_server ssl", + "*:80 default_server ssl") + for first, second in itertools.combinations(any_addresses, 2): + self.assertEqual(Addr.fromstring(first), Addr.fromstring(second)) + + # Also, make sure ports are checked. + self.assertNotEqual(Addr.fromstring(any_addresses[0]), + Addr.fromstring("0.0.0.0:443 default_server ssl")) + + # And they aren't equivalent to a specified address. + for any_address in any_addresses: + self.assertNotEqual( + Addr.fromstring("192.168.1.2:80 default_server ssl"), + Addr.fromstring(any_address)) + def test_set_inclusion(self): from certbot_nginx.obj import Addr set_a = set([self.addr1, self.addr2]) @@ -77,10 +106,43 @@ class VirtualHostTest(unittest.TestCase): def setUp(self): from certbot_nginx.obj import VirtualHost from certbot_nginx.obj import Addr + raw1 = [ + ['listen', '69.50.225.155:9000'], + [['if', '($scheme != "https") '], + [['return', '301 https://$host$request_uri']] + ], + ['#', ' managed by Certbot'] + ] self.vhost1 = VirtualHost( "filep", set([Addr.fromstring("localhost")]), False, False, - set(['localhost']), []) + set(['localhost']), raw1, []) + raw2 = [ + ['listen', '69.50.225.155:9000'], + [['if', '($scheme != "https") '], + [['return', '301 https://$host$request_uri']] + ] + ] + self.vhost2 = VirtualHost( + "filep", + set([Addr.fromstring("localhost")]), False, False, + set(['localhost']), raw2, []) + raw3 = [ + ['listen', '69.50.225.155:9000'], + ['rewrite', '^(.*)$ $scheme://www.domain.com$1 permanent;'] + ] + self.vhost3 = VirtualHost( + "filep", + set([Addr.fromstring("localhost")]), False, False, + set(['localhost']), raw3, []) + raw4 = [ + ['listen', '69.50.225.155:9000'], + ['server_name', 'return.com'] + ] + self.vhost4 = VirtualHost( + "filp", + set([Addr.fromstring("localhost")]), False, False, + set(['localhost']), raw4, []) def test_eq(self): from certbot_nginx.obj import Addr @@ -88,7 +150,7 @@ class VirtualHostTest(unittest.TestCase): vhost1b = VirtualHost( "filep", set([Addr.fromstring("localhost blah")]), False, False, - set(['localhost']), []) + set(['localhost']), [], []) self.assertEqual(vhost1b, self.vhost1) self.assertEqual(str(vhost1b), str(self.vhost1)) @@ -100,6 +162,47 @@ class VirtualHostTest(unittest.TestCase): 'enabled: False']) self.assertEqual(stringified, str(self.vhost1)) + def test_has_redirect(self): + self.assertTrue(self.vhost1.has_redirect()) + self.assertTrue(self.vhost2.has_redirect()) + self.assertTrue(self.vhost3.has_redirect()) + self.assertFalse(self.vhost4.has_redirect()) + + def test_contains_list(self): + from certbot_nginx.obj import VirtualHost + from certbot_nginx.obj import Addr + from certbot_nginx.configurator import TEST_REDIRECT_BLOCK + test_needle = TEST_REDIRECT_BLOCK + test_haystack = [['listen', '80'], ['root', '/var/www/html'], + ['index', 'index.html index.htm index.nginx-debian.html'], + ['server_name', 'two.functorkitten.xyz'], ['listen', '443 ssl'], + ['#', ' managed by Certbot'], + ['ssl_certificate', '/etc/letsencrypt/live/two.functorkitten.xyz/fullchain.pem'], + ['#', ' managed by Certbot'], + ['ssl_certificate_key', '/etc/letsencrypt/live/two.functorkitten.xyz/privkey.pem'], + ['#', ' managed by Certbot'], + [['if', '($scheme != "https")'], [['return', '301 https://$host$request_uri']]], + ['#', ' managed by Certbot'], []] + vhost_haystack = VirtualHost( + "filp", + set([Addr.fromstring("localhost")]), False, False, + set(['localhost']), test_haystack, []) + test_bad_haystack = [['listen', '80'], ['root', '/var/www/html'], + ['index', 'index.html index.htm index.nginx-debian.html'], + ['server_name', 'two.functorkitten.xyz'], ['listen', '443 ssl'], + ['#', ' managed by Certbot'], + ['ssl_certificate', '/etc/letsencrypt/live/two.functorkitten.xyz/fullchain.pem'], + ['#', ' managed by Certbot'], + ['ssl_certificate_key', '/etc/letsencrypt/live/two.functorkitten.xyz/privkey.pem'], + ['#', ' managed by Certbot'], + [['if', '($scheme != "https")'], [['return', '302 https://$host$request_uri']]], + ['#', ' managed by Certbot'], []] + vhost_bad_haystack = VirtualHost( + "filp", + set([Addr.fromstring("localhost")]), False, False, + set(['localhost']), test_bad_haystack, []) + self.assertTrue(vhost_haystack.contains_list(test_needle)) + self.assertFalse(vhost_bad_haystack.contains_list(test_needle)) if __name__ == "__main__": unittest.main() # pragma: no cover diff --git a/certbot-nginx/certbot_nginx/tests/parser_test.py b/certbot-nginx/certbot_nginx/tests/parser_test.py index 77b4a877a..921cc3c5a 100644 --- a/certbot-nginx/certbot_nginx/tests/parser_test.py +++ b/certbot-nginx/certbot_nginx/tests/parser_test.py @@ -47,7 +47,10 @@ class NginxParserTest(util.NginxTest): self.assertEqual(set([nparser.abs_path(x) for x in ['foo.conf', 'nginx.conf', 'server.conf', 'sites-enabled/default', - 'sites-enabled/example.com']]), + 'sites-enabled/example.com', + 'sites-enabled/migration.com', + 'sites-enabled/sslon.com', + 'sites-enabled/globalssl.com']]), set(nparser.parsed.keys())) self.assertEqual([['server_name', 'somename alias another.alias']], nparser.parsed[nparser.abs_path('server.conf')]) @@ -71,7 +74,7 @@ class NginxParserTest(util.NginxTest): parsed = nparser._parse_files(nparser.abs_path( 'sites-enabled/example.com.test')) self.assertEqual(3, len(glob.glob(nparser.abs_path('*.test')))) - self.assertEqual(2, len( + self.assertEqual(5, len( glob.glob(nparser.abs_path('sites-enabled/*.test')))) self.assertEqual([[['server'], [['listen', '69.50.225.155:9000'], ['listen', '127.0.0.1'], @@ -79,6 +82,40 @@ class NginxParserTest(util.NginxTest): ['server_name', 'example.*']]]], parsed[0]) + def test__do_for_subarray(self): + # pylint: disable=protected-access + mylists = [([[2], [3], [2]], [[0], [2]]), + ([[2], [3], [4]], [[0]]), + ([[4], [3], [2]], [[2]]), + ([], []), + (2, []), + ([[[2], [3], [2]], [[2], [3], [2]]], + [[0, 0], [0, 2], [1, 0], [1, 2]]), + ([[[0], [3], [2]], [[2], [3], [2]]], [[0, 2], [1, 0], [1, 2]]), + ([[[0], [3], [4]], [[2], [3], [2]]], [[1, 0], [1, 2]]), + ([[[0], [3], [4]], [[5], [3], [2]]], [[1, 2]]), + ([[[0], [3], [4]], [[5], [3], [0]]], [])] + + for mylist, result in mylists: + paths = [] + parser._do_for_subarray(mylist, + lambda x: isinstance(x, list) and + len(x) >= 1 and + x[0] == 2, + lambda x, y, pts=paths: pts.append(y)) + self.assertEqual(paths, result) + + def test_get_vhosts_global_ssl(self): + nparser = parser.NginxParser(self.config_path, self.ssl_options) + vhosts = nparser.get_vhosts() + + vhost = obj.VirtualHost(nparser.abs_path('sites-enabled/globalssl.com'), + [obj.Addr('4.8.2.6', '57', True, False)], + True, True, set(['globalssl.com']), [], [0]) + + globalssl_com = [x for x in vhosts if 'globalssl.com' in x.filep][0] + self.assertEqual(vhost, globalssl_com) + def test_get_vhosts(self): nparser = parser.NginxParser(self.config_path, self.ssl_options) vhosts = nparser.get_vhosts() @@ -88,28 +125,30 @@ class NginxParserTest(util.NginxTest): False, True, set(['localhost', r'~^(www\.)?(example|bar)\.']), - []) + [], [9, 1, 9]) vhost2 = obj.VirtualHost(nparser.abs_path('nginx.conf'), [obj.Addr('somename', '8080', False, False), obj.Addr('', '8000', False, False)], False, True, set(['somename', 'another.alias', 'alias']), - []) + [], [9, 1, 12]) vhost3 = obj.VirtualHost(nparser.abs_path('sites-enabled/example.com'), [obj.Addr('69.50.225.155', '9000', False, False), obj.Addr('127.0.0.1', '', False, False)], False, True, - set(['.example.com', 'example.*']), []) + set(['.example.com', 'example.*']), [], [0]) vhost4 = obj.VirtualHost(nparser.abs_path('sites-enabled/default'), [obj.Addr('myhost', '', False, True)], - False, True, set(['www.example.org']), []) + False, True, set(['www.example.org']), + [], [0]) vhost5 = obj.VirtualHost(nparser.abs_path('foo.conf'), [obj.Addr('*', '80', True, True)], True, True, set(['*.www.foo.com', - '*.www.example.com']), []) + '*.www.example.com']), + [], [2, 1, 0]) - self.assertEqual(5, len(vhosts)) + self.assertEqual(10, len(vhosts)) example_com = [x for x in vhosts if 'example.com' in x.filep][0] self.assertEqual(vhost3, example_com) default = [x for x in vhosts if 'default' in x.filep][0] @@ -121,11 +160,34 @@ class NginxParserTest(util.NginxTest): somename = [x for x in vhosts if 'somename' in x.names][0] self.assertEqual(vhost2, somename) + def test_has_ssl_on_directive(self): + nparser = parser.NginxParser(self.config_path, self.ssl_options) + mock_vhost = obj.VirtualHost(None, None, None, None, None, + [['listen', 'myhost default_server'], + ['server_name', 'www.example.org'], + [['location', '/'], [['root', 'html'], ['index', 'index.html index.htm']]] + ], None) + self.assertFalse(nparser.has_ssl_on_directive(mock_vhost)) + mock_vhost.raw = [['listen', '*:80 default_server ssl'], + ['server_name', '*.www.foo.com *.www.example.com'], + ['root', '/home/ubuntu/sites/foo/']] + self.assertFalse(nparser.has_ssl_on_directive(mock_vhost)) + mock_vhost.raw = [['listen', '80 ssl'], + ['server_name', '*.www.foo.com *.www.example.com']] + self.assertFalse(nparser.has_ssl_on_directive(mock_vhost)) + mock_vhost.raw = [['listen', '80'], + ['ssl', 'on'], + ['server_name', '*.www.foo.com *.www.example.com']] + self.assertTrue(nparser.has_ssl_on_directive(mock_vhost)) + def test_add_server_directives(self): nparser = parser.NginxParser(self.config_path, self.ssl_options) - nparser.add_server_directives(nparser.abs_path('nginx.conf'), - set(['localhost', + mock_vhost = obj.VirtualHost(nparser.abs_path('nginx.conf'), + None, None, None, + set(['localhost', r'~^(www\.)?(example|bar)\.']), + None, [9, 1, 9]) + nparser.add_server_directives(mock_vhost, [['foo', 'bar'], ['\n ', 'ssl_certificate', ' ', '/etc/ssl/cert.pem']], replace=False) @@ -133,53 +195,60 @@ class NginxParserTest(util.NginxTest): dump = nginxparser.dumps(nparser.parsed[nparser.abs_path('nginx.conf')]) self.assertEqual(1, len(re.findall(ssl_re, dump))) - server_conf = nparser.abs_path('server.conf') - names = set(['alias', 'another.alias', 'somename']) - nparser.add_server_directives(server_conf, names, + example_com = nparser.abs_path('sites-enabled/example.com') + names = set(['.example.com', 'example.*']) + mock_vhost.filep = example_com + mock_vhost.names = names + mock_vhost.path = [0] + nparser.add_server_directives(mock_vhost, [['foo', 'bar'], ['ssl_certificate', '/etc/ssl/cert2.pem']], replace=False) - nparser.add_server_directives(server_conf, names, [['foo', 'bar']], + nparser.add_server_directives(mock_vhost, [['foo', 'bar']], replace=False) - self.assertEqual(nparser.parsed[server_conf], - [['server_name', 'somename alias another.alias'], - ['foo', 'bar'], - ['ssl_certificate', '/etc/ssl/cert2.pem'] - ]) + from certbot_nginx.parser import COMMENT + self.assertEqual(nparser.parsed[example_com], + [[['server'], [['listen', '69.50.225.155:9000'], + ['listen', '127.0.0.1'], + ['server_name', '.example.com'], + ['server_name', 'example.*'], + ['foo', 'bar'], + ['#', COMMENT], + ['ssl_certificate', '/etc/ssl/cert2.pem'], + ['#', COMMENT], [], [] + ]]]) - def test_add_http_directives(self): - nparser = parser.NginxParser(self.config_path, self.ssl_options) - filep = nparser.abs_path('nginx.conf') - block = [['server'], - [['listen', '80'], - ['server_name', 'localhost']]] - nparser.add_http_directives(filep, block) - root = nparser.parsed[filep] - self.assertTrue(util.contains_at_depth(root, ['http'], 1)) - self.assertTrue(util.contains_at_depth(root, block, 2)) - - # Check that our server block got inserted first among all server - # blocks. - http_block = [x for x in root if x[0] == ['http']][0][1] - server_blocks = [x for x in http_block if x[0] == ['server']] - self.assertEqual(server_blocks[0], block) + server_conf = nparser.abs_path('server.conf') + names = set(['alias', 'another.alias', 'somename']) + mock_vhost.filep = server_conf + mock_vhost.names = names + mock_vhost.path = [] + self.assertRaises(errors.MisconfigurationError, + nparser.add_server_directives, + mock_vhost, + [['foo', 'bar'], + ['ssl_certificate', '/etc/ssl/cert2.pem']], + replace=False) def test_replace_server_directives(self): nparser = parser.NginxParser(self.config_path, self.ssl_options) target = set(['.example.com', 'example.*']) filep = nparser.abs_path('sites-enabled/example.com') + mock_vhost = obj.VirtualHost(filep, None, None, None, target, None, [0]) nparser.add_server_directives( - filep, target, [['server_name', 'foobar.com']], replace=True) + mock_vhost, [['server_name', 'foobar.com']], replace=True) + from certbot_nginx.parser import COMMENT self.assertEqual( nparser.parsed[filep], [[['server'], [['listen', '69.50.225.155:9000'], ['listen', '127.0.0.1'], - ['server_name', 'foobar.com'], - ['server_name', 'example.*'], + ['server_name', 'foobar.com'], ['#', COMMENT], + ['server_name', 'example.*'], [] ]]]) + mock_vhost.names = set(['foobar.com', 'example.*']) self.assertRaises(errors.MisconfigurationError, nparser.add_server_directives, - filep, set(['foobar.com', 'example.*']), + mock_vhost, [['ssl_certificate', 'cert.pem']], replace=True) @@ -216,38 +285,67 @@ class NginxParserTest(util.NginxTest): self.assertEqual(winner, parser.get_best_match(target_name, names[i])) - def test_get_all_certs_keys(self): - nparser = parser.NginxParser(self.config_path, self.ssl_options) - filep = nparser.abs_path('sites-enabled/example.com') - nparser.add_server_directives(filep, - set(['.example.com', 'example.*']), - [['ssl_certificate', 'foo.pem'], - ['ssl_certificate_key', 'bar.key'], - ['listen', '443 ssl']], - replace=False) - c_k = nparser.get_all_certs_keys() - self.assertEqual(set([('foo.pem', 'bar.key', filep)]), c_k) + def test_comment_directive(self): + # pylint: disable=protected-access + block = nginxparser.UnspacedList([ + ["\n", "a", " ", "b", "\n"], + ["c", " ", "d"], + ["\n", "e", " ", "f"]]) + from certbot_nginx.parser import _comment_directive, COMMENT_BLOCK + _comment_directive(block, 1) + _comment_directive(block, 0) + self.assertEqual(block.spaced, [ + ["\n", "a", " ", "b", "\n"], + COMMENT_BLOCK, + "\n", + ["c", " ", "d"], + COMMENT_BLOCK, + ["\n", "e", " ", "f"]]) - def test_parse_server_ssl(self): - server = parser.parse_server([ + def test_parse_server_raw_ssl(self): + server = parser._parse_server_raw([ #pylint: disable=protected-access ['listen', '443'] ]) self.assertFalse(server['ssl']) - server = parser.parse_server([ + server = parser._parse_server_raw([ #pylint: disable=protected-access ['listen', '443 ssl'] ]) self.assertTrue(server['ssl']) - server = parser.parse_server([ + server = parser._parse_server_raw([ #pylint: disable=protected-access ['listen', '443'], ['ssl', 'off'] ]) self.assertFalse(server['ssl']) - server = parser.parse_server([ + server = parser._parse_server_raw([ #pylint: disable=protected-access ['listen', '443'], ['ssl', 'on'] ]) self.assertTrue(server['ssl']) + def test_parse_server_global_ssl_applied(self): + nparser = parser.NginxParser(self.config_path, self.ssl_options) + server = nparser.parse_server([ + ['listen', '443'] + ]) + self.assertTrue(server['ssl']) + + def test_ssl_options_should_be_parsed_ssl_directives(self): + nparser = parser.NginxParser(self.config_path, self.ssl_options) + self.assertEqual(nginxparser.UnspacedList(nparser.loc["ssl_options"]), + [['ssl_session_cache', 'shared:le_nginx_SSL:1m'], + ['ssl_session_timeout', '1440m'], + ['ssl_protocols', 'TLSv1 TLSv1.1 TLSv1.2'], + ['ssl_prefer_server_ciphers', 'on'], + ['ssl_ciphers', '"ECDHE-ECDSA-AES128-GCM-SHA256 ECDHE-ECDSA-'+ + 'AES256-GCM-SHA384 ECDHE-ECDSA-AES128-SHA ECDHE-ECDSA-AES256'+ + '-SHA ECDHE-ECDSA-AES128-SHA256 ECDHE-ECDSA-AES256-SHA384'+ + ' ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES256-GCM-SHA384'+ + ' ECDHE-RSA-AES128-SHA ECDHE-RSA-AES128-SHA256 ECDHE-RSA-'+ + 'AES256-SHA384 DHE-RSA-AES128-GCM-SHA256 DHE-RSA-AES256-GCM'+ + '-SHA384 DHE-RSA-AES128-SHA DHE-RSA-AES256-SHA DHE-RSA-'+ + 'AES128-SHA256 DHE-RSA-AES256-SHA256 EDH-RSA-DES-CBC3-SHA"'] + ]) + if __name__ == "__main__": unittest.main() # pragma: no cover diff --git a/certbot-nginx/certbot_nginx/tests/testdata/etc_nginx/sites-enabled/globalssl.com b/certbot-nginx/certbot_nginx/tests/testdata/etc_nginx/sites-enabled/globalssl.com new file mode 100644 index 000000000..969447d6e --- /dev/null +++ b/certbot-nginx/certbot_nginx/tests/testdata/etc_nginx/sites-enabled/globalssl.com @@ -0,0 +1,9 @@ +server { + server_name globalssl.com; + listen 4.8.2.6:57; +} + +server { + server_name globalsslsetssl.com; + listen 4.8.2.6:57 ssl; +} diff --git a/certbot-nginx/certbot_nginx/tests/testdata/etc_nginx/sites-enabled/migration.com b/certbot-nginx/certbot_nginx/tests/testdata/etc_nginx/sites-enabled/migration.com new file mode 100644 index 000000000..17bc6d0c3 --- /dev/null +++ b/certbot-nginx/certbot_nginx/tests/testdata/etc_nginx/sites-enabled/migration.com @@ -0,0 +1,19 @@ +server { + server_name migration.com; + server_name summer.com; +} + +server { + listen 443 ssl; + server_name migration.com; + server_name geese.com; + + ssl_certificate cert.pem; + ssl_certificate_key cert.key; + + ssl_session_cache shared:SSL:1m; + ssl_session_timeout 5m; + + ssl_ciphers HIGH:!aNULL:!MD5; + ssl_prefer_server_ciphers on; +} diff --git a/certbot-nginx/certbot_nginx/tests/testdata/etc_nginx/sites-enabled/sslon.com b/certbot-nginx/certbot_nginx/tests/testdata/etc_nginx/sites-enabled/sslon.com new file mode 100644 index 000000000..b93e6ba2d --- /dev/null +++ b/certbot-nginx/certbot_nginx/tests/testdata/etc_nginx/sites-enabled/sslon.com @@ -0,0 +1,6 @@ +server { + server_name sslon.com; + ssl on; + ssl_certificate snakeoil.cert; + ssl_certificate_key snakeoil.key; +} diff --git a/certbot-nginx/certbot_nginx/tests/tls_sni_01_test.py b/certbot-nginx/certbot_nginx/tests/tls_sni_01_test.py index a92caf788..e7dacb400 100644 --- a/certbot-nginx/certbot_nginx/tests/tls_sni_01_test.py +++ b/certbot-nginx/certbot_nginx/tests/tls_sni_01_test.py @@ -31,7 +31,7 @@ class TlsSniPerformTest(util.NginxTest): token="\xba\xa9\xda? 1 else None + else: + key = values = "" if isinstance(key, list): new = copy.deepcopy(entry) new[1] = filter_comments(values) yield new else: - if key != '#': - yield entry + if key != '#' and spaceless: + yield spaceless return list(traverse(tree)) diff --git a/certbot-nginx/certbot_nginx/tls_sni_01.py b/certbot-nginx/certbot_nginx/tls_sni_01.py index ebc92f5e3..dec21e791 100644 --- a/certbot-nginx/certbot_nginx/tls_sni_01.py +++ b/certbot-nginx/certbot_nginx/tls_sni_01.py @@ -47,7 +47,7 @@ class NginxTlsSni01(common.TLSSNI01): return [] addresses = [] - default_addr = "{0} default_server ssl".format( + default_addr = "{0} ssl".format( self.configurator.config.tls_sni_01_port) for achall in self.achalls: @@ -59,12 +59,10 @@ class NginxTlsSni01(common.TLSSNI01): achall.domain) return None - for addr in vhost.addrs: - if addr.default: - addresses.append([obj.Addr.fromstring(default_addr)]) - break - else: + if vhost.addrs: addresses.append(list(vhost.addrs)) + else: + addresses.append([obj.Addr.fromstring(default_addr)]) # Create challenge certs responses = [self._setup_challenge_cert(x) for x in self.achalls] @@ -91,17 +89,17 @@ class NginxTlsSni01(common.TLSSNI01): # Add the 'include' statement for the challenges if it doesn't exist # already in the main config included = False - include_directive = ['include', ' ', self.challenge_conf] + include_directive = ['\n', 'include', ' ', self.challenge_conf] root = self.configurator.parser.loc["root"] - bucket_directive = ['server_names_hash_bucket_size', ' ', '128'] + bucket_directive = ['\n', 'server_names_hash_bucket_size', ' ', '128'] main = self.configurator.parser.parsed[root] for key, body in main: if key == ['http']: found_bucket = False for k, _ in body: - if k == bucket_directive[0]: + if k == bucket_directive[1]: found_bucket = True if not found_bucket: body.insert(0, bucket_directive) @@ -141,11 +139,10 @@ class NginxTlsSni01(common.TLSSNI01): document_root = os.path.join( self.configurator.config.work_dir, "tls_sni_01_page") - block = [['listen', ' ', str(addr)] for addr in addrs] + block = [['listen', ' ', addr.to_string(include_default=False)] for addr in addrs] block.extend([['server_name', ' ', achall.response(achall.account_key).z_domain], - ['include', ' ', self.configurator.parser.loc["ssl_options"]], # access and error logs necessary for # integration testing (non-root) ['access_log', ' ', os.path.join( @@ -154,6 +151,6 @@ class NginxTlsSni01(common.TLSSNI01): self.configurator.config.work_dir, 'error.log')], ['ssl_certificate', ' ', self.get_cert_path(achall)], ['ssl_certificate_key', ' ', self.get_key_path(achall)], - [['location', ' ', '/'], [['root', ' ', document_root]]]]) - + [['location', ' ', '/'], [['root', ' ', document_root]]]] + + self.configurator.parser.loc["ssl_options"]) return [['server'], block] diff --git a/certbot-nginx/setup.py b/certbot-nginx/setup.py index 62c705b4c..4c39d37c2 100644 --- a/certbot-nginx/setup.py +++ b/certbot-nginx/setup.py @@ -4,7 +4,7 @@ from setuptools import setup from setuptools import find_packages -version = '0.9.0.dev0' +version = '0.10.0.dev0' # Please update tox.ini when modifying dependency version requirements install_requires = [ diff --git a/certbot-nginx/tests/boulder-integration.conf.sh b/certbot-nginx/tests/boulder-integration.conf.sh index d77669a76..5295e3681 100755 --- a/certbot-nginx/tests/boulder-integration.conf.sh +++ b/certbot-nginx/tests/boulder-integration.conf.sh @@ -52,6 +52,7 @@ http { listen 8081; # IPv6. listen [::]:8081 default ipv6only=on; + server_name nginx.wtf; root $root/webroot; diff --git a/certbot/__init__.py b/certbot/__init__.py index 34358a5d9..45892e269 100644 --- a/certbot/__init__.py +++ b/certbot/__init__.py @@ -1,4 +1,4 @@ """Certbot client.""" # version number like 1.2.3a0, must have at least 2 parts, like 1.2 -__version__ = '0.9.0.dev0' +__version__ = '0.10.0.dev0' diff --git a/certbot/account.py b/certbot/account.py index 798f8664e..71951d8e0 100644 --- a/certbot/account.py +++ b/certbot/account.py @@ -8,6 +8,7 @@ import socket from cryptography.hazmat.primitives import serialization import pyrfc3339 import pytz +import six import zope.component from acme import fields as acme_fields @@ -108,7 +109,7 @@ class AccountMemoryStorage(interfaces.AccountStorage): self.accounts = initial_accounts if initial_accounts is not None else {} def find_all(self): - return self.accounts.values() + return list(six.itervalues(self.accounts)) def save(self, account): if account.id in self.accounts: diff --git a/certbot/auth_handler.py b/certbot/auth_handler.py index a94734572..aad971eb6 100644 --- a/certbot/auth_handler.py +++ b/certbot/auth_handler.py @@ -33,14 +33,18 @@ class AuthHandler(object): and values are :class:`acme.messages.AuthorizationResource` :ivar list achalls: DV challenges in the form of :class:`certbot.achallenges.AnnotatedChallenge` + :ivar list pref_challs: sorted user specified preferred challenges + in the form of subclasses of :class:`acme.challenges.Challenge` + with the most preferred challenge listed first """ - def __init__(self, auth, acme, account): + def __init__(self, auth, acme, account, pref_challs): self.auth = auth self.acme = acme self.account = account self.authzr = dict() + self.pref_challs = pref_challs # List must be used to keep responses straight. self.achalls = [] @@ -244,9 +248,18 @@ class AuthHandler(object): :param str domain: domain for which you are requesting preferences """ - # Make sure to make a copy... chall_prefs = [] - chall_prefs.extend(self.auth.get_chall_pref(domain)) + # Make sure to make a copy... + plugin_pref = self.auth.get_chall_pref(domain) + if self.pref_challs: + chall_prefs.extend(pref for pref in self.pref_challs + if pref in plugin_pref) + if chall_prefs: + return chall_prefs + raise errors.AuthorizationError( + "None of the preferred challenges " + "are supported by the selected plugin") + chall_prefs.extend(plugin_pref) return chall_prefs def _cleanup_challenges(self, achall_list=None): @@ -424,9 +437,6 @@ def _report_no_chall_path(): raise errors.AuthorizationError(msg) -_ACME_PREFIX = "urn:acme:error:" - - _ERROR_HELP_COMMON = ( "To fix these errors, please make sure that your domain name was entered " "correctly and the DNS A record(s) for that domain contain(s) the " @@ -488,9 +498,10 @@ def _generate_failed_chall_msg(failed_achalls): :rtype: str """ - typ = failed_achalls[0].error.typ - if typ.startswith(_ACME_PREFIX): - typ = typ[len(_ACME_PREFIX):] + error = failed_achalls[0].error + typ = error.typ + if messages.is_acme_error(error): + typ = error.code msg = ["The following errors were reported by the server:"] for achall in failed_achalls: diff --git a/certbot/cert_manager.py b/certbot/cert_manager.py new file mode 100644 index 000000000..09798e3bc --- /dev/null +++ b/certbot/cert_manager.py @@ -0,0 +1,252 @@ +"""Tools for managing certificates.""" +import datetime +import logging +import os +import pytz +import traceback +import zope.component + +from certbot import errors +from certbot import interfaces +from certbot import ocsp +from certbot import storage +from certbot import util + +from certbot.display import util as display_util + +logger = logging.getLogger(__name__) + +################### +# Commands +################### + +def update_live_symlinks(config): + """Update the certificate file family symlinks to use archive_dir. + + Use the information in the config file to make symlinks point to + the correct archive directory. + + .. note:: This assumes that the installation is using a Reverter object. + + :param config: Configuration. + :type config: :class:`certbot.configuration.NamespaceConfig` + + """ + for renewal_file in storage.renewal_conf_files(config): + storage.RenewableCert(renewal_file, config, update_symlinks=True) + +def rename_lineage(config): + """Rename the specified lineage to the new name. + + :param config: Configuration. + :type config: :class:`certbot.configuration.NamespaceConfig` + + """ + disp = zope.component.getUtility(interfaces.IDisplay) + + certname = _get_certname(config, "rename") + + new_certname = config.new_certname + if not new_certname: + code, new_certname = disp.input( + "Enter the new name for certificate {0}".format(certname), + flag="--updated-cert-name", force_interactive=True) + if code != display_util.OK or not new_certname: + raise errors.Error("User ended interaction.") + + lineage = lineage_for_certname(config, certname) + if not lineage: + raise errors.ConfigurationError("No existing certificate with name " + "{0} found.".format(certname)) + storage.rename_renewal_config(certname, new_certname, config) + disp.notification("Successfully renamed {0} to {1}." + .format(certname, new_certname), pause=False) + +def certificates(config): + """Display information about certs configured with Certbot + + :param config: Configuration. + :type config: :class:`certbot.configuration.NamespaceConfig` + """ + parsed_certs = [] + parse_failures = [] + for renewal_file in storage.renewal_conf_files(config): + try: + renewal_candidate = storage.RenewableCert(renewal_file, config) + parsed_certs.append(renewal_candidate) + except Exception as e: # pylint: disable=broad-except + logger.warning("Renewal configuration file %s produced an " + "unexpected error: %s. Skipping.", renewal_file, e) + logger.debug("Traceback was:\n%s", traceback.format_exc()) + parse_failures.append(renewal_file) + + # Describe all the certs + _describe_certs(config, parsed_certs, parse_failures) + +def delete(config): + """Delete Certbot files associated with a certificate lineage.""" + certname = _get_certname(config, "delete") + storage.delete_files(config, certname) + disp = zope.component.getUtility(interfaces.IDisplay) + disp.notification("Deleted all files relating to certificate {0}." + .format(certname), pause=False) + +################### +# Public Helpers +################### + +def lineage_for_certname(config, certname): + """Find a lineage object with name certname.""" + def update_cert_for_name_match(candidate_lineage, rv): + """Return cert if it has name certname, else return rv + """ + matching_lineage_name_cert = rv + if candidate_lineage.lineagename == certname: + matching_lineage_name_cert = candidate_lineage + return matching_lineage_name_cert + return _search_lineages(config, update_cert_for_name_match, None) + +def domains_for_certname(config, certname): + """Find the domains in the cert with name certname.""" + def update_domains_for_name_match(candidate_lineage, rv): + """Return domains if certname matches, else return rv + """ + matching_domains = rv + if candidate_lineage.lineagename == certname: + matching_domains = candidate_lineage.names() + return matching_domains + return _search_lineages(config, update_domains_for_name_match, None) + +def find_duplicative_certs(config, domains): + """Find existing certs that duplicate the request.""" + def update_certs_for_domain_matches(candidate_lineage, rv): + """Return cert as identical_names_cert if it matches, + or subset_names_cert if it matches as subset + """ + # TODO: Handle these differently depending on whether they are + # expired or still valid? + identical_names_cert, subset_names_cert = rv + candidate_names = set(candidate_lineage.names()) + if candidate_names == set(domains): + identical_names_cert = candidate_lineage + elif candidate_names.issubset(set(domains)): + # This logic finds and returns the largest subset-names cert + # in the case where there are several available. + if subset_names_cert is None: + subset_names_cert = candidate_lineage + elif len(candidate_names) > len(subset_names_cert.names()): + subset_names_cert = candidate_lineage + return (identical_names_cert, subset_names_cert) + + return _search_lineages(config, update_certs_for_domain_matches, (None, None)) + + +################### +# Private Helpers +################### + +def _get_certname(config, verb): + """Get certname from flag, interactively, or error out. + """ + certname = config.certname + if not certname: + disp = zope.component.getUtility(interfaces.IDisplay) + filenames = storage.renewal_conf_files(config) + choices = [storage.lineagename_for_filename(name) for name in filenames] + if not choices: + raise errors.Error("No existing certificates found.") + code, index = disp.menu("Which certificate would you like to {0}?".format(verb), + choices, ok_label="Select", flag="--cert-name") + if code != display_util.OK or not index in range(0, len(choices)): + raise errors.Error("User ended interaction.") + certname = choices[index] + return certname + +def _report_lines(msgs): + """Format a results report for a category of single-line renewal outcomes""" + return " " + "\n ".join(str(msg) for msg in msgs) + +def _report_human_readable(config, parsed_certs): + """Format a results report for a parsed cert""" + certinfo = [] + checker = ocsp.RevocationChecker() + for cert in parsed_certs: + if config.certname and cert.lineagename != config.certname: + continue + if config.domains and not set(config.domains).issubset(cert.names()): + continue + now = pytz.UTC.fromutc(datetime.datetime.utcnow()) + + reasons = [] + if cert.is_test_cert: + reasons.append('TEST_CERT') + if cert.target_expiry <= now: + reasons.append('EXPIRED') + if checker.ocsp_revoked(cert.cert, cert.chain): + reasons.append('REVOKED') + + if reasons: + status = "INVALID: " + ", ".join(reasons) + else: + diff = cert.target_expiry - now + if diff.days == 1: + status = "VALID: 1 day" + elif diff.days < 1: + status = "VALID: {0} hour(s)".format(diff.seconds // 3600) + else: + status = "VALID: {0} days".format(diff.days) + + valid_string = "{0} ({1})".format(cert.target_expiry, status) + certinfo.append(" Certificate Name: {0}\n" + " Domains: {1}\n" + " Expiry Date: {2}\n" + " Certificate Path: {3}\n" + " Private Key Path: {4}".format( + cert.lineagename, + " ".join(cert.names()), + valid_string, + cert.fullchain, + cert.privkey)) + return "\n".join(certinfo) + +def _describe_certs(config, parsed_certs, parse_failures): + """Print information about the certs we know about""" + out = [] + + notify = out.append + + if not parsed_certs and not parse_failures: + notify("No certs found.") + else: + if parsed_certs: + match = "matching " if config.certname or config.domains else "" + notify("Found the following {0}certs:".format(match)) + notify(_report_human_readable(config, parsed_certs)) + if parse_failures: + notify("\nThe following renewal configuration files " + "were invalid:") + notify(_report_lines(parse_failures)) + + disp = zope.component.getUtility(interfaces.IDisplay) + disp.notification("\n".join(out), pause=False, wrap=False) + +def _search_lineages(cli_config, func, initial_rv): + """Iterate func over unbroken lineages, allowing custom return conditions. + + Allows flexible customization of return values, including multiple + return values and complex checks. + """ + configs_dir = cli_config.renewal_configs_dir + # Verify the directory is there + util.make_or_verify_dir(configs_dir, mode=0o755, uid=os.geteuid()) + + rv = initial_rv + for renewal_file in storage.renewal_conf_files(cli_config): + try: + candidate_lineage = storage.RenewableCert(renewal_file, cli_config) + except (errors.CertStorageError, IOError): + logger.debug("Renewal conf file %s is broken. Skipping.", renewal_file) + logger.debug("Traceback was:\n%s", traceback.format_exc()) + continue + rv = func(candidate_lineage, rv) + return rv diff --git a/certbot/cli.py b/certbot/cli.py index 78e24f698..45b7bf746 100644 --- a/certbot/cli.py +++ b/certbot/cli.py @@ -11,6 +11,8 @@ import sys import configargparse import six +from acme import challenges + import certbot from certbot import constants @@ -49,47 +51,56 @@ cli_command = LEAUTO if fragment in sys.argv[0] else "certbot" # to replace as much of it as we can... # This is the stub to include in help generated by argparse - SHORT_USAGE = """ - {0} [SUBCOMMAND] [options] [-d domain] [-d domain] ... + {0} [SUBCOMMAND] [options] [-d DOMAIN] [-d DOMAIN] ... Certbot can obtain and install HTTPS/TLS/SSL certificates. By default, it will attempt to use a webserver both for obtaining and installing the -cert. Major SUBCOMMANDS are: +cert. """.format(cli_command) - (default) run Obtain & install a cert in your current webserver - certonly Obtain cert, but do not install it (aka "auth") - install Install a previously obtained cert in a server - renew Renew previously obtained certs that are near expiry - revoke Revoke a previously obtained certificate - register Perform tasks related to registering with the CA - rollback Rollback server configuration changes made during install - config_changes Show changes made to server config during installation - plugins Display information about installed plugins +# This section is used for --help and --help all ; it needs information +# about installed plugins to be fully formatted +COMMAND_OVERVIEW = """The most common SUBCOMMANDS and flags are: -""".format(cli_command) - -# This is the short help for certbot --help, where we disable argparse -# altogether -USAGE = SHORT_USAGE + """Choice of server plugins for obtaining and installing cert: +obtain, install, and renew certificates: + (default) run Obtain & install a cert in your current webserver + certonly Obtain or renew a cert, but do not install it + renew Renew all previously obtained certs that are near expiry + -d DOMAINS Comma-separated list of domains to obtain a cert for %s --standalone Run a standalone webserver for authentication %s --webroot Place files in a server's webroot folder for authentication + --manual Obtain certs interactively, or using shell script hooks -OR use different plugins to obtain (authenticate) the cert and then install it: + -n Run non-interactively + --test-cert Obtain a test cert from a staging server + --dry-run Test "renew" or "certonly" without saving any certs to disk - --authenticator standalone --installer apache +manage certificates: + certificates Display information about certs you have from Certbot + revoke Revoke a certificate (supply --cert-path) + rename Rename a certificate + delete Delete a certificate +manage your account with Let's Encrypt: + register Create a Let's Encrypt ACME account + --agree-tos Agree to the ACME server's Subscriber Agreement + -m EMAIL Email address for important account notifications +""" + +# This is the short help for certbot --help, where we disable argparse +# altogether +HELP_USAGE = """ More detailed help: - -h, --help [topic] print this message, or detailed help on a topic; - the available topics are: + -h, --help [TOPIC] print this message, or detailed help on a topic; + the available TOPICS are: - all, automation, paths, security, testing, or any of the subcommands or - plugins (certonly, install, register, nginx, apache, standalone, webroot, - etc.) + all, automation, commands, paths, security, testing, or any of the + subcommands or plugins (certonly, renew, install, register, nginx, + apache, standalone, webroot, etc.) """ @@ -135,19 +146,6 @@ def report_config_interaction(modified, modifiers): VAR_MODIFIERS.setdefault(var, set()).update(modifiers) -def usage_strings(plugins): - """Make usage strings late so that plugins can be initialised late""" - if "nginx" in plugins: - nginx_doc = "--nginx Use the Nginx plugin for authentication & installation" - else: - nginx_doc = "(nginx support is experimental, buggy, and not installed by default)" - if "apache" in plugins: - apache_doc = "--apache Use the Apache plugin for authentication & installation" - else: - apache_doc = "(the apache plugin is not installed)" - return USAGE % (apache_doc, nginx_doc), SHORT_USAGE - - def possible_deprecation_warning(config): "A deprecation warning for users with the old, not-self-upgrading letsencrypt-auto." if cli_command != LEAUTO: @@ -303,6 +301,103 @@ class HelpfulArgumentGroup(object): """Add a new command line argument to the argument group.""" self._parser.add(self._topic, *args, **kwargs) +class CustomHelpFormatter(argparse.HelpFormatter): + """This is a clone of ArgumentDefaultsHelpFormatter, with bugfixes. + + In particular we fix https://bugs.python.org/issue28742 + """ + + def _get_help_string(self, action): + helpstr = action.help + if '%(default)' not in action.help and '(default:' not in action.help: + if action.default != argparse.SUPPRESS: + defaulting_nargs = [argparse.OPTIONAL, argparse.ZERO_OR_MORE] + if action.option_strings or action.nargs in defaulting_nargs: + helpstr += ' (default: %(default)s)' + return helpstr + +# The attributes here are: +# short: a string that will be displayed by "certbot -h commands" +# opts: a string that heads the section of flags with which this command is documented, +# both for "cerbot -h SUBCOMMAND" and "certbot -h all" +# usage: an optional string that overrides the header of "certbot -h SUBCOMMAND" +VERB_HELP = [ + ("run (default)", { + "short": "Obtain/renew a certificate, and install it", + "opts": "Options for obtaining & installing certs", + "usage": SHORT_USAGE.replace("[SUBCOMMAND]", ""), + "realname": "run" + }), + ("certonly", { + "short": "Obtain or renew a certificate, but do not install it", + "opts": "Options for modifying how a cert is obtained", + "usage": ("\n\n certbot certonly [options] [-d DOMAIN] [-d DOMAIN] ...\n\n" + "This command obtains a TLS/SSL certificate without installing it anywhere.") + }), + ("renew", { + "short": "Renew all certificates (or one specifed with --cert-name)", + "opts": ("The 'renew' subcommand will attempt to renew all" + " certificates (or more precisely, certificate lineages) you have" + " previously obtained if they are close to expiry, and print a" + " summary of the results. By default, 'renew' will reuse the options" + " used to create obtain or most recently successfully renew each" + " certificate lineage. You can try it with `--dry-run` first. For" + " more fine-grained control, you can renew individual lineages with" + " the `certonly` subcommand. Hooks are available to run commands" + " before and after renewal; see" + " https://certbot.eff.org/docs/using.html#renewal for more" + " information on these."), + "usage": "\n\n certbot renew [--cert-name NAME] [options]\n\n" + }), + ("certificates", { + "short": "List certificates managed by Certbot", + "opts": "List certificates managed by Certbot", + "usage": ("\n\n certbot certificates [options] ...\n\n" + "Print information about the status of certificates managed by Certbot.") + }), + ("delete", { + "short": "Clean up all files related to a certificate", + "opts": "Options for deleting a certificate" + }), + ("revoke", { + "short": "Revoke a certificate specified with --cert-path", + "opts": "Options for revocation of certs" + }), + ("rename", { + "short": "Change a certificate's name (for management purposes)", + "opts": "Options for changing certificate names" + }), + ("register", { + "short": "Register for account with Let's Encrypt / other ACME server", + "opts": "Options for account registration & modification" + }), + ("install", { + "short": "Install an arbitrary cert in a server", + "opts": "Options for modifying how a cert is deployed" + }), + ("config_changes", { + "short": "Show changes that Certbot has made to server configurations", + "opts": "Options for controlling which changes are displayed" + }), + ("rollback", { + "short": "Roll back server conf changes made during cert installation", + "opts": "Options for rolling back server configuration changes" + }), + ("plugins", { + "short": "List plugins that are installed and available on your system", + "opts": 'Options for for the "plugins" subcommand' + }), + ("update_symlinks", { + "short": "Recreate symlinks in your /live/ directory", + "opts": ("Recreates cert and key symlinks in {0}, if you changed them by hand " + "or edited a renewal configuration file".format( + os.path.join(flag_default("config_dir"), "live"))) + }), + +] +# VERB_HELP is a list in order to preserve order, but a dict is sometimes useful +VERB_HELP_MAP = dict(VERB_HELP) + class HelpfulArgumentParser(object): """Argparse Wrapper. @@ -313,6 +408,7 @@ class HelpfulArgumentParser(object): """ + def __init__(self, args, plugins, detect_defaults=False): from certbot import main self.VERBS = {"auth": main.obtain_cert, "certonly": main.obtain_cert, @@ -320,25 +416,18 @@ class HelpfulArgumentParser(object): "install": main.install, "plugins": main.plugins_cmd, "register": main.register, "renew": main.renew, "revoke": main.revoke, "rollback": main.rollback, - "everything": main.run} + "everything": main.run, "update_symlinks": main.update_symlinks, + "certificates": main.certificates, "rename": main.rename, + "delete": main.delete} # List of topics for which additional help can be provided HELP_TOPICS = ["all", "security", "paths", "automation", "testing"] + list(self.VERBS) + HELP_TOPICS += self.COMMANDS_TOPICS + ["manage"] plugin_names = list(plugins) self.help_topics = HELP_TOPICS + plugin_names + [None] - usage, short_usage = usage_strings(plugins) - self.parser = configargparse.ArgParser( - usage=short_usage, - formatter_class=argparse.ArgumentDefaultsHelpFormatter, - args_for_setting_config_path=["-c", "--config"], - default_config_files=flag_default("config_files")) - - # This is the only way to turn off overly verbose config flag documentation - self.parser._add_config_file_help = False # pylint: disable=protected-access self.detect_defaults = detect_defaults - self.args = args self.determine_verb() help1 = self.prescan_for_flag("-h", self.help_topics) @@ -347,13 +436,72 @@ class HelpfulArgumentParser(object): self.help_arg = help1 or help2 else: self.help_arg = help1 if isinstance(help1, str) else help2 - if self.help_arg is True: - # just --help with no topic; avoid argparse altogether - print(usage) - sys.exit(0) + + short_usage = self._usage_string(plugins, self.help_arg) + self.visible_topics = self.determine_help_topics(self.help_arg) self.groups = {} # elements are added by .add_group() - self.defaults = {} # elements are added by .parse_args() + self.defaults = {} # elements are added by .parse_args() + + self.parser = configargparse.ArgParser( + prog="certbot", + usage=short_usage, + formatter_class=CustomHelpFormatter, + args_for_setting_config_path=["-c", "--config"], + default_config_files=flag_default("config_files"), + config_arg_help_message="path to config file (default: {0})".format( + " and ".join(flag_default("config_files")))) + + # This is the only way to turn off overly verbose config flag documentation + self.parser._add_config_file_help = False # pylint: disable=protected-access + + # Help that are synonyms for --help subcommands + COMMANDS_TOPICS = ["command", "commands", "subcommand", "subcommands", "verbs"] + def _list_subcommands(self): + longest = max(len(v) for v in VERB_HELP_MAP.keys()) + + text = "The full list of available SUBCOMMANDS is:\n\n" + for verb, props in sorted(VERB_HELP): + doc = props.get("short", "") + text += '{0:<{length}} {1}\n'.format(verb, doc, length=longest) + + text += "\nYou can get more help on a specific subcommand with --help SUBCOMMAND\n" + return text + + def _usage_string(self, plugins, help_arg): + """Make usage strings late so that plugins can be initialised late + + :param plugins: all discovered plugins + :param help_arg: False for none; True for --help; "TOPIC" for --help TOPIC + :rtype: str + :returns: a short usage string for the top of --help TOPIC) + """ + if "nginx" in plugins: + nginx_doc = "--nginx Use the Nginx plugin for authentication & installation" + else: + nginx_doc = "(the certbot nginx plugin is not installed)" + if "apache" in plugins: + apache_doc = "--apache Use the Apache plugin for authentication & installation" + else: + apache_doc = "(the cerbot apache plugin is not installed)" + + usage = SHORT_USAGE + if help_arg == True: + print(usage + COMMAND_OVERVIEW % (apache_doc, nginx_doc) + HELP_USAGE) + sys.exit(0) + elif help_arg in self.COMMANDS_TOPICS: + print(usage + self._list_subcommands()) + sys.exit(0) + elif help_arg == "all": + # if we're doing --help all, the OVERVIEW is part of the SHORT_USAGE at + # the top; if we're doing --help someothertopic, it's OT so it's not + usage += COMMAND_OVERVIEW % (apache_doc, nginx_doc) + else: + custom = VERB_HELP_MAP.get(help_arg, {}).get("usage", None) + usage = custom if custom else usage + + return usage + def parse_args(self): """Parses command line arguments and returns the result. @@ -374,9 +522,18 @@ class HelpfulArgumentParser(object): # Do any post-parsing homework here - if self.verb == "renew" and not parsed_args.dialog_mode: + if self.verb == "renew": + if parsed_args.force_interactive: + raise errors.Error( + "{0} cannot be used with renew".format( + constants.FORCE_INTERACTIVE_FLAG)) parsed_args.noninteractive_mode = True + if parsed_args.force_interactive and parsed_args.noninteractive_mode: + raise errors.Error( + "Flag for non-interactive mode and {0} conflict".format( + constants.FORCE_INTERACTIVE_FLAG)) + if parsed_args.staging or parsed_args.dry_run: self.set_test_server(parsed_args) @@ -386,18 +543,6 @@ class HelpfulArgumentParser(object): if parsed_args.must_staple: parsed_args.staple = True - # Avoid conflicting args - conficting_args = ["quiet", "noninteractive_mode", "text_mode"] - if parsed_args.dialog_mode: - for arg in conficting_args: - if getattr(parsed_args, arg): - raise errors.Error( - ("Conflicting values for displayer." - " {0} conflicts with dialog_mode").format(arg) - ) - elif parsed_args.verbose_count > flag_default("verbose_count"): - parsed_args.text_mode = True - if parsed_args.validate_hooks: hooks.validate_hooks(parsed_args) @@ -502,16 +647,25 @@ class HelpfulArgumentParser(object): pass return True - def add(self, topic, *args, **kwargs): + def add(self, topics, *args, **kwargs): """Add a new command line argument. - :param str: help topic this should be listed under, can be None for - "always documented" + :param topics: str or [str] help topic(s) this should be listed under, + or None for "always documented". The first entry + determines where the flag lives in the "--help all" + output (None -> "optional arguments"). :param list *args: the names of this argument flag :param dict **kwargs: various argparse settings for this argument """ + if isinstance(topics, list): + # if this flag can be listed in multiple sections, try to pick the one + # that the user has asked for help about + topic = self.help_arg if self.help_arg in topics else topics[0] + else: + topic = topics # there's only one + if self.detect_defaults: kwargs = self.modify_kwargs_for_default_detection(**kwargs) @@ -561,7 +715,7 @@ class HelpfulArgumentParser(object): util.add_deprecated_argument( self.parser.add_argument, argument_name, num_args) - def add_group(self, topic, **kwargs): + def add_group(self, topic, verbs=(), **kwargs): """Create a new argument group. This method must be called once for every topic, however, calls @@ -569,6 +723,8 @@ class HelpfulArgumentParser(object): clarity. :param str topic: Name of the new argument group. + :param str verbs: List of subcommands that should be documented as part of + this help group / topic :returns: The new argument group. :rtype: `HelpfulArgumentGroup` @@ -576,6 +732,9 @@ class HelpfulArgumentParser(object): """ if self.visible_topics[topic]: self.groups[topic] = self.parser.add_argument_group(topic, **kwargs) + if self.help_arg: + for v in verbs: + self.groups[topic].add_argument(v, help=VERB_HELP_MAP[v]["short"]) return HelpfulArgumentGroup(self, topic) @@ -587,7 +746,8 @@ class HelpfulArgumentParser(object): """ for name, plugin_ep in six.iteritems(plugins): - parser_or_group = self.add_group(name, description=plugin_ep.description) + parser_or_group = self.add_group(name, + description=plugin_ep.long_description) plugin_ep.plugin_cls.inject_parser_options(parser_or_group, name) def determine_help_topics(self, chosen_topic): @@ -612,6 +772,21 @@ class HelpfulArgumentParser(object): else: return dict([(t, t == chosen_topic) for t in self.help_topics]) +def _add_all_groups(helpful): + helpful.add_group("automation", description="Arguments for automating execution & other tweaks") + helpful.add_group("security", description="Security parameters & server settings") + helpful.add_group("testing", + description="The following flags are meant for testing and integration purposes only.") + helpful.add_group("paths", description="Arguments changing execution paths & servers") + helpful.add_group("manage", + description="Various subcommands and flags are available for managing your certificates:", + verbs=["certificates", "delete", "renew", "revoke", "rename"]) + + # VERBS + for verb, docs in VERB_HELP: + name = docs.get("realname", verb) + helpful.add_group(name, description=docs["opts"]) + def prepare_and_parse_args(plugins, args, detect_defaults=False): # pylint: disable=too-many-statements """Returns parsed command line arguments. @@ -627,6 +802,7 @@ def prepare_and_parse_args(plugins, args, detect_defaults=False): # pylint: dis # pylint: disable=too-many-statements helpful = HelpfulArgumentParser(args, plugins, detect_defaults) + _add_all_groups(helpful) # --help is automatically provided by argparse helpful.add( @@ -636,18 +812,41 @@ def prepare_and_parse_args(plugins, args, detect_defaults=False): # pylint: dis "e.g. -vvv.") helpful.add( None, "-t", "--text", dest="text_mode", action="store_true", - help="Use the text output instead of the curses UI.") + help=argparse.SUPPRESS) helpful.add( - None, "-n", "--non-interactive", "--noninteractive", + [None, "automation", "run", "certonly"], "-n", "--non-interactive", "--noninteractive", dest="noninteractive_mode", action="store_true", help="Run without ever asking for user input. This may require " "additional command line flags; the client will try to explain " "which ones are required if it finds one missing") helpful.add( - None, "--dialog", dest="dialog_mode", action="store_true", - help="Run using dialog") + [None, "register", "run", "certonly"], + constants.FORCE_INTERACTIVE_FLAG, action="store_true", + help="Force Certbot to be interactive even if it detects it's not " + "being run in a terminal. This flag cannot be used with the " + "renew subcommand.") helpful.add( - None, "--dry-run", action="store_true", dest="dry_run", + [None, "run", "certonly", "certificates"], + "-d", "--domains", "--domain", dest="domains", + metavar="DOMAIN", action=_DomainsAction, default=[], + help="Domain names to apply. For multiple domains you can use " + "multiple -d flags or enter a comma separated list of domains " + "as a parameter. (default: Ask)") + helpful.add( + [None, "run", "certonly", "manage", "rename", "delete", "certificates"], + "--cert-name", dest="certname", + metavar="CERTNAME", default=None, + help="Certificate name to apply. Only one certificate name can be used " + "per Certbot run. To see certificate names, run 'certbot certificates'. " + "When creating a new certificate, specifies the new certificate's name.") + helpful.add( + ["rename", "manage"], + "--updated-cert-name", dest="new_certname", + metavar="NEW_CERTNAME", default=None, + help="New name for the certificate. Must be a valid filename.") + helpful.add( + [None, "testing", "renew", "certonly"], + "--dry-run", action="store_true", dest="dry_run", help="Perform a test run of the client, obtaining test (invalid) certs" " but not saving them to disk. This can currently only be used" " with the 'certonly' and 'renew' subcommands. \nNote: Although --dry-run" @@ -659,7 +858,7 @@ def prepare_and_parse_args(plugins, args, detect_defaults=False): # pylint: dis " if they are defined because they may be necessary to accurately simulate" " renewal. --renew-hook commands are not called.") helpful.add( - None, "--register-unsafely-without-email", action="store_true", + ["register", "automation"], "--register-unsafely-without-email", action="store_true", help="Specifying this flag enables registering an account with no " "email address. This is strongly discouraged, because in the " "event of key loss or account compromise you will irrevocably " @@ -673,42 +872,39 @@ def prepare_and_parse_args(plugins, args, detect_defaults=False): # pylint: dis help="With the register verb, indicates that details associated " "with an existing registration, such as the e-mail address, " "should be updated, rather than registering a new account.") - helpful.add(None, "-m", "--email", help=config_help("email")) - # positional arg shadows --domains, instead of appending, and - # --domains is useful, because it can be stored in config - #for subparser in parser_run, parser_auth, parser_install: - # subparser.add_argument("domains", nargs="*", metavar="domain") - helpful.add(None, "-d", "--domains", "--domain", dest="domains", - metavar="DOMAIN", action=_DomainsAction, default=[], - help="Domain names to apply. For multiple domains you can use " - "multiple -d flags or enter a comma separated list of domains " - "as a parameter.") - helpful.add_group( - "automation", - description="Arguments for automating execution & other tweaks") + helpful.add(["register", "automation"], "-m", "--email", help=config_help("email")) helpful.add( - "automation", "--keep-until-expiring", "--keep", "--reinstall", + ["automation", "certonly", "run"], + "--keep-until-expiring", "--keep", "--reinstall", dest="reinstall", action="store_true", help="If the requested cert matches an existing cert, always keep the " "existing one until it is due for renewal (for the " - "'run' subcommand this means reinstall the existing cert)") + "'run' subcommand this means reinstall the existing cert). (default: Ask)") helpful.add( "automation", "--expand", action="store_true", help="If an existing cert covers some subset of the requested names, " - "always expand and replace it with the additional names.") + "always expand and replace it with the additional names. (default: Ask)") helpful.add( "automation", "--version", action="version", version="%(prog)s {0}".format(certbot.__version__), help="show program's version number and exit") helpful.add( - "automation", "--force-renewal", "--renew-by-default", + ["automation", "renew"], + "--force-renewal", "--renew-by-default", action="store_true", dest="renew_by_default", help="If a certificate " "already exists for the requested domains, renew it now, " "regardless of whether it is near expiry. (Often " "--keep-until-expiring is more appropriate). Also implies " "--expand.") helpful.add( - "automation", "--allow-subset-of-names", action="store_true", + "automation", "--renew-with-new-domains", + action="store_true", dest="renew_with_new_domains", help="If a " + "certificate already exists for the requested certificate name " + "but does not match the requested domains, renew it now, " + "regardless of whether it is near expiry.") + helpful.add( + ["automation", "renew", "certonly"], + "--allow-subset-of-names", action="store_true", help="When performing domain validation, do not consider it a failure " "if authorizations can not be obtained for a strict subset of " "the requested domains. This may be useful for allowing renewals for " @@ -716,7 +912,7 @@ def prepare_and_parse_args(plugins, args, detect_defaults=False): # pylint: dis "at this system. This option cannot be used with --csr.") helpful.add( "automation", "--agree-tos", dest="tos", action="store_true", - help="Agree to the ACME Subscriber Agreement") + help="Agree to the ACME Subscriber Agreement (default: Ask)") helpful.add( "automation", "--account", metavar="ACCOUNT_ID", help="Account ID to use") @@ -730,16 +926,17 @@ def prepare_and_parse_args(plugins, args, detect_defaults=False): # pylint: dis helpful.add( "automation", "--no-self-upgrade", action="store_true", help="(certbot-auto only) prevent the certbot-auto script from" - " upgrading itself to newer released versions") + " upgrading itself to newer released versions (default: Upgrade" + " automatically)") helpful.add( - "automation", "-q", "--quiet", dest="quiet", action="store_true", + ["automation", "renew", "certonly", "run"], + "-q", "--quiet", dest="quiet", action="store_true", help="Silence all output except errors. Useful for automation via cron." " Implies --non-interactive.") - - helpful.add_group( - "testing", description="The following flags are meant for " - "testing purposes only! Do NOT change them, unless you " - "really know what you're doing!") + # overwrites server, handled in HelpfulArgumentParser.parse_args() + helpful.add("testing", "--test-cert", "--staging", action='store_true', dest='staging', + help='Use the staging server to obtain test (invalid) certs; equivalent' + ' to --server ' + constants.STAGING_URI) helpful.add( "testing", "--debug", action="store_true", help="Show tracebacks in case of errors, and allow certbot-auto " @@ -749,18 +946,17 @@ def prepare_and_parse_args(plugins, args, detect_defaults=False): # pylint: dis help=config_help("no_verify_ssl"), default=flag_default("no_verify_ssl")) helpful.add( - "testing", "--tls-sni-01-port", type=int, + ["testing", "standalone", "apache", "nginx"], "--tls-sni-01-port", type=int, default=flag_default("tls_sni_01_port"), help=config_help("tls_sni_01_port")) helpful.add( - "testing", "--http-01-port", type=int, dest="http01_port", + ["testing", "standalone", "manual"], "--http-01-port", type=int, + dest="http01_port", default=flag_default("http01_port"), help=config_help("http01_port")) helpful.add( "testing", "--break-my-certs", action="store_true", help="Be willing to replace or renew valid certs with invalid " "(testing/staging) certs") - helpful.add_group( - "security", description="Security parameters & server settings") helpful.add( "security", "--rsa-key-size", type=int, metavar="N", default=flag_default("rsa_key_size"), help=config_help("rsa_key_size")) @@ -776,11 +972,11 @@ def prepare_and_parse_args(plugins, args, detect_defaults=False): # pylint: dis helpful.add( "security", "--redirect", action="store_true", help="Automatically redirect all HTTP traffic to HTTPS for the newly " - "authenticated vhost.", dest="redirect", default=None) + "authenticated vhost. (default: Ask)", dest="redirect", default=None) helpful.add( "security", "--no-redirect", action="store_false", help="Do not automatically redirect all HTTP traffic to HTTPS for the newly " - "authenticated vhost.", dest="redirect", default=None) + "authenticated vhost. (default: Ask)", dest="redirect", default=None) helpful.add( "security", "--hsts", action="store_true", help="Add the Strict-Transport-Security header to every HTTP response." @@ -788,8 +984,7 @@ def prepare_and_parse_args(plugins, args, detect_defaults=False): # pylint: dis " Defends against SSL Stripping.", dest="hsts", default=False) helpful.add( "security", "--no-hsts", action="store_false", - help="Do not automatically add the Strict-Transport-Security header" - " to every HTTP response.", dest="hsts", default=False) + help=argparse.SUPPRESS, dest="hsts", default=False) helpful.add( "security", "--uir", action="store_true", help="Add the \"Content-Security-Policy: upgrade-insecure-requests\"" @@ -797,9 +992,7 @@ def prepare_and_parse_args(plugins, args, detect_defaults=False): # pylint: dis " https:// for every http:// resource.", dest="uir", default=None) helpful.add( "security", "--no-uir", action="store_false", - help="Do not automatically set the \"Content-Security-Policy:" - " upgrade-insecure-requests\" header to every HTTP response.", - dest="uir", default=None) + help=argparse.SUPPRESS, dest="uir", default=None) helpful.add( "security", "--staple-ocsp", action="store_true", help="Enables OCSP Stapling. A valid OCSP response is stapled to" @@ -807,55 +1000,56 @@ def prepare_and_parse_args(plugins, args, detect_defaults=False): # pylint: dis dest="staple", default=None) helpful.add( "security", "--no-staple-ocsp", action="store_false", - help="Do not automatically enable OCSP Stapling.", - dest="staple", default=None) - - + help=argparse.SUPPRESS, dest="staple", default=None) helpful.add( "security", "--strict-permissions", action="store_true", help="Require that all configuration files are owned by the current " "user; only needed if your config is somewhere unsafe like /tmp/") - - helpful.add_group( - "renew", description="The 'renew' subcommand will attempt to renew all" - " certificates (or more precisely, certificate lineages) you have" - " previously obtained if they are close to expiry, and print a" - " summary of the results. By default, 'renew' will reuse the options" - " used to create obtain or most recently successfully renew each" - " certificate lineage. You can try it with `--dry-run` first. For" - " more fine-grained control, you can renew individual lineages with" - " the `certonly` subcommand. Hooks are available to run commands " - " before and after renewal; see" - " https://certbot.eff.org/docs/using.html#renewal for more information on these.") - + helpful.add( + ["manual", "standalone", "certonly", "renew"], + "--preferred-challenges", dest="pref_challs", + action=_PrefChallAction, default=[], + help='A sorted, comma delimited list of the preferred challenge to ' + 'use during authorization with the most preferred challenge ' + 'listed first (Eg, "dns" or "tls-sni-01,http,dns"). ' + 'Not all plugins support all challenges. See ' + 'https://certbot.eff.org/docs/using.html#plugins for details. ' + 'ACME Challenges are versioned, but if you pick "http" rather ' + 'than "http-01", Certbot will select the latest version ' + 'automatically.') helpful.add( "renew", "--pre-hook", - help="Command to be run in a shell before obtaining any certificates. Intended" - " primarily for renewal, where it can be used to temporarily shut down a" - " webserver that might conflict with the standalone plugin. This will " - " only be called if a certificate is actually to be obtained/renewed. ") + help="Command to be run in a shell before obtaining any certificates." + " Intended primarily for renewal, where it can be used to temporarily" + " shut down a webserver that might conflict with the standalone" + " plugin. This will only be called if a certificate is actually to be" + " obtained/renewed.") helpful.add( "renew", "--post-hook", - help="Command to be run in a shell after attempting to obtain/renew " - " certificates. Can be used to deploy renewed certificates, or to restart" - " any servers that were stopped by --pre-hook. This is only run if" - " an attempt was made to obtain/renew a certificate.") + help="Command to be run in a shell after attempting to obtain/renew" + " certificates. Can be used to deploy renewed certificates, or to" + " restart any servers that were stopped by --pre-hook. This is only" + " run if an attempt was made to obtain/renew a certificate.") helpful.add( "renew", "--renew-hook", - help="Command to be run in a shell once for each successfully renewed certificate." - "For this command, the shell variable $RENEWED_LINEAGE will point to the" - "config live subdirectory containing the new certs and keys; the shell variable " - "$RENEWED_DOMAINS will contain a space-delimited list of renewed cert domains") + help="Command to be run in a shell once for each successfully renewed" + " certificate. For this command, the shell variable $RENEWED_LINEAGE" + " will point to the config live subdirectory containing the new certs" + " and keys; the shell variable $RENEWED_DOMAINS will contain a" + " space-delimited list of renewed cert domains") helpful.add( "renew", "--disable-hook-validation", action='store_false', dest='validate_hooks', default=True, - help="Ordinarily the commands specified for --pre-hook/--post-hook/--renew-hook" - " will be checked for validity, to see if the programs being run are in the $PATH," - " so that mistakes can be caught early, even when the hooks aren't being run just yet." - " The validation is rather simplistic and fails if you use more advanced" - " shell constructs, so you can use this switch to disable it.") + help="Ordinarily the commands specified for" + " --pre-hook/--post-hook/--renew-hook will be checked for validity, to" + " see if the programs being run are in the $PATH, so that mistakes can" + " be caught early, even when the hooks aren't being run just yet. The" + " validation is rather simplistic and fails if you use more advanced" + " shell constructs, so you can use this switch to disable it." + " (default: False)") helpful.add_deprecated_argument("--agree-dev-preview", 0) + helpful.add_deprecated_argument("--dialog", 0) _create_subparsers(helpful) _paths_parser(helpful) @@ -870,27 +1064,21 @@ def prepare_and_parse_args(plugins, args, detect_defaults=False): # pylint: dis def _create_subparsers(helpful): - helpful.add_group("certonly", description="Options for modifying how a cert is obtained") - helpful.add_group("install", description="Options for modifying how a cert is deployed") - helpful.add_group("revoke", description="Options for revocation of certs") - helpful.add_group("rollback", description="Options for reverting config changes") - helpful.add_group("plugins", description="Plugin options") - helpful.add_group("config_changes", - description="Options for showing a history of config changes") helpful.add("config_changes", "--num", type=int, help="How many past revisions you want to be displayed") + + from certbot.client import sample_user_agent # avoid import loops helpful.add( None, "--user-agent", default=None, help="Set a custom user agent string for the client. User agent strings allow " "the CA to collect high level statistics about success rates by OS and " "plugin. If you wish to hide your server OS version from the Let's " - 'Encrypt server, set this to "".') + 'Encrypt server, set this to "". ' + '(default: {0})'.format(sample_user_agent())) helpful.add("certonly", "--csr", type=read_file, - help="Path to a Certificate Signing Request (CSR) in DER" - " format; note that the .csr file *must* contain a Subject" - " Alternative Name field for each domain you want certified." - " Currently --csr only works with the 'certonly' subcommand'") + help="Path to a Certificate Signing Request (CSR) in DER or PEM format." + " Currently --csr only works with the 'certonly' subcommand.") helpful.add("rollback", "--checkpoints", type=int, metavar="N", default=flag_default("rollback_checkpoints"), @@ -912,13 +1100,9 @@ def _paths_parser(helpful): verb = helpful.verb if verb == "help": verb = helpful.help_arg - helpful.add_group( - "paths", description="Arguments changing execution paths & servers") - cph = "Path to where cert is saved (with auth --csr), installed from or revoked." - section = "paths" - if verb in ("install", "revoke", "certonly"): - section = verb + cph = "Path to where cert is saved (with auth --csr), installed from, or revoked." + section = ["paths", "install", "revoke", "certonly", "manage"] if verb == "certonly": add(section, "--cert-path", type=os.path.abspath, default=flag_default("auth_cert_path"), help=cph) @@ -940,7 +1124,7 @@ def _paths_parser(helpful): default_cp = None if verb == "certonly": default_cp = flag_default("auth_chain_path") - add("paths", "--fullchain-path", default=default_cp, type=os.path.abspath, + add(["install", "paths"], "--fullchain-path", default=default_cp, type=os.path.abspath, help="Accompanying path to a full certificate chain (cert plus chain).") add("paths", "--chain-path", default=default_cp, type=os.path.abspath, help="Accompanying path to a certificate chain.") @@ -952,36 +1136,34 @@ def _paths_parser(helpful): help="Logs directory.") add("paths", "--server", default=flag_default("server"), help=config_help("server")) - # overwrites server, handled in HelpfulArgumentParser.parse_args() - add("testing", "--test-cert", "--staging", action='store_true', dest='staging', - help='Use the staging server to obtain test (invalid) certs; equivalent' - ' to --server ' + constants.STAGING_URI) def _plugins_parsing(helpful, plugins): + # It's nuts, but there are two "plugins" topics. Somehow this works helpful.add_group( - "plugins", description="Certbot client supports an " + "plugins", description="Plugin Selection: Certbot client supports an " "extensible plugins architecture. See '%(prog)s plugins' for a " "list of all installed plugins and their names. You can force " "a particular plugin by setting options provided below. Running " "--help will list flags specific to that plugin.") - helpful.add( - "plugins", "-a", "--authenticator", help="Authenticator plugin name.") - helpful.add( - "plugins", "-i", "--installer", help="Installer plugin name (also used to find domains).") - helpful.add( - "plugins", "--configurator", help="Name of the plugin that is " - "both an authenticator and an installer. Should not be used " - "together with --authenticator or --installer.") - helpful.add("plugins", "--apache", action="store_true", + + helpful.add("plugins", "--configurator", + help="Name of the plugin that is both an authenticator and an installer." + " Should not be used together with --authenticator or --installer. " + "(default: Ask)") + helpful.add("plugins", "-a", "--authenticator", help="Authenticator plugin name.") + helpful.add("plugins", "-i", "--installer", + help="Installer plugin name (also used to find domains).") + helpful.add(["plugins", "certonly", "run", "install", "config_changes"], + "--apache", action="store_true", help="Obtain and install certs using Apache") - helpful.add("plugins", "--nginx", action="store_true", - help="Obtain and install certs using Nginx") - helpful.add("plugins", "--standalone", action="store_true", + helpful.add(["plugins", "certonly", "run", "install", "config_changes"], + "--nginx", action="store_true", help="Obtain and install certs using Nginx") + helpful.add(["plugins", "certonly"], "--standalone", action="store_true", help='Obtain certs using a "standalone" webserver.') - helpful.add("plugins", "--manual", action="store_true", + helpful.add(["plugins", "certonly"], "--manual", action="store_true", help='Provide laborious manual instructions for obtaining a cert') - helpful.add("plugins", "--webroot", action="store_true", + helpful.add(["plugins", "certonly"], "--webroot", action="store_true", help='Obtain certs by placing files in a webroot directory.') # things should not be reorder past/pre this comment: @@ -998,7 +1180,6 @@ class _DomainsAction(argparse.Action): """Just wrap add_domains in argparseese.""" add_domains(namespace, domain) - def add_domains(args_or_config, domains): """Registers new domains to be used during the current client run. @@ -1022,3 +1203,18 @@ def add_domains(args_or_config, domains): args_or_config.domains.append(domain) return validated_domains + +class _PrefChallAction(argparse.Action): + """Action class for parsing preferred challenges.""" + + def __call__(self, parser, namespace, pref_challs, option_string=None): + aliases = {"dns": "dns-01", "http": "http-01", "tls-sni": "tls-sni-01"} + challs = [c.strip() for c in pref_challs.split(",")] + challs = [aliases[c] if c in aliases else c for c in challs] + unrecognized = ", ".join(name for name in challs + if name not in challenges.Challenge.TYPES) + if unrecognized: + raise argparse.ArgumentTypeError( + "Unrecognized challenges: {0}".format(unrecognized)) + namespace.pref_challs.extend(challenges.Challenge.TYPES[name] + for name in challs) diff --git a/certbot/client.py b/certbot/client.py index fa0b8c71d..11385e338 100644 --- a/certbot/client.py +++ b/certbot/client.py @@ -15,7 +15,6 @@ import certbot from certbot import account from certbot import auth_handler -from certbot import configuration from certbot import constants from certbot import crypto_util from certbot import errors @@ -38,11 +37,11 @@ def acme_from_config_key(config, key): "Wrangle ACME client construction" # TODO: Allow for other alg types besides RS256 net = acme_client.ClientNetwork(key, verify_ssl=(not config.no_verify_ssl), - user_agent=_determine_user_agent(config)) + user_agent=determine_user_agent(config)) return acme_client.Client(config.server, key=key, net=net) -def _determine_user_agent(config): +def determine_user_agent(config): """ Set a user_agent string in the config based on the choice of plugins. (this wasn't knowable at construction time) @@ -59,6 +58,16 @@ def _determine_user_agent(config): ua = config.user_agent return ua +def sample_user_agent(): + "Document what this Certbot's user agent string will be like." + class DummyConfig(object): + "Shim for computing a sample user agent." + def __init__(self): + self.authenticator = "XXX" + self.installer = "YYY" + self.user_agent = None + return determine_user_agent(DummyConfig()) + def register(config, account_storage, tos_cb=None): """Register new account with an ACME CA. @@ -149,9 +158,15 @@ def perform_registration(acme, config): try: return acme.register(messages.NewRegistration.from_data(email=config.email)) except messages.Error as e: - if e.typ == "urn:acme:error:invalidEmail": - config.namespace.email = display_ops.get_email(invalid=True) - return perform_registration(acme, config) + if e.code == "invalidEmail" or e.code == "invalidContact": + if config.noninteractive_mode: + msg = ("The ACME server believes %s is an invalid email address. " + "Please ensure it is a valid email and attempt " + "registration again." % config.email) + raise errors.Error(msg) + else: + config.namespace.email = display_ops.get_email(invalid=True) + return perform_registration(acme, config) else: raise @@ -186,7 +201,7 @@ class Client(object): if auth is not None: self.auth_handler = auth_handler.AuthHandler( - auth, self.acme, self.account) + auth, self.acme, self.account, self.config.pref_challs) else: self.auth_handler = None @@ -248,8 +263,7 @@ class Client(object): domains, self.config.allow_subset_of_names) - auth_domains = set(a.body.identifier.value.encode('ascii') - for a in authzr) + auth_domains = set(a.body.identifier.value for a in authzr) domains = [d for d in domains if d in auth_domains] # Create CSR from names @@ -292,7 +306,7 @@ class Client(object): return (self.obtain_certificate_from_csr(domains, csr, authzr=authzr) + (key, csr)) - def obtain_and_enroll_certificate(self, domains): + def obtain_and_enroll_certificate(self, domains, certname): """Obtain and enroll certificate. Get a new certificate for the specified domains using the specified @@ -301,6 +315,7 @@ class Client(object): :param list domains: Domains to request. :param plugins: A PluginsFactory object. + :param str certname: Name of new cert :returns: A new :class:`certbot.storage.RenewableCert` instance referred to the enrolled cert lineage, False if the cert could not @@ -315,16 +330,17 @@ class Client(object): "Non-standard path(s), might not work with crontab installed " "by your operating system package manager") + new_name = certname if certname else domains[0] if self.config.dry_run: logger.debug("Dry run: Skipping creating new lineage for %s", - domains[0]) + new_name) return None else: return storage.RenewableCert.new_lineage( - domains[0], OpenSSL.crypto.dump_certificate( + new_name, OpenSSL.crypto.dump_certificate( OpenSSL.crypto.FILETYPE_PEM, certr.body.wrapped), key.pem, crypto_util.dump_pyopenssl_chain(chain), - configuration.RenewerConfiguration(self.config.namespace)) + self.config) def save_certificate(self, certr, chain_cert, cert_path, chain_path, fullchain_path): @@ -411,53 +427,46 @@ class Client(object): with error_handler.ErrorHandler(self._rollback_and_restart, msg): # sites may have been enabled / final cleanup self.installer.restart() - def enhance_config(self, domains, config): + + def enhance_config(self, domains, chain_path): """Enhance the configuration. :param list domains: list of domains to configure - - :ivar config: Namespace typically produced by - :meth:`argparse.ArgumentParser.parse_args`. - it must have the redirect, hsts and uir attributes. - :type namespace: :class:`argparse.Namespace` + :param chain_path: chain file path + :type chain_path: `str` or `None` :raises .errors.Error: if no installer is specified in the client. """ - if self.installer is None: logger.warning("No installer is specified, there isn't any " "configuration to enhance.") raise errors.Error("No installer available") - if config is None: - logger.warning("No config is specified.") - raise errors.Error("No config available") - + enhanced = False + enhancement_info = ( + ("hsts", "ensure-http-header", "Strict-Transport-Security"), + ("redirect", "redirect", None), + ("staple", "staple-ocsp", chain_path), + ("uir", "ensure-http-header", "Upgrade-Insecure-Requests"),) supported = self.installer.supported_enhancements() - redirect = config.redirect if "redirect" in supported else False - hsts = config.hsts if "ensure-http-header" in supported else False - uir = config.uir if "ensure-http-header" in supported else False - staple = config.staple if "staple-ocsp" in supported else False - if redirect is None: - redirect = enhancements.ask("redirect") - - if redirect: - self.apply_enhancement(domains, "redirect") - - if hsts: - self.apply_enhancement(domains, "ensure-http-header", - "Strict-Transport-Security") - if uir: - self.apply_enhancement(domains, "ensure-http-header", - "Upgrade-Insecure-Requests") - if staple: - self.apply_enhancement(domains, "staple-ocsp") + for config_name, enhancement_name, option in enhancement_info: + config_value = getattr(self.config, config_name) + if enhancement_name in supported: + if config_name == "redirect" and config_value is None: + config_value = enhancements.ask(enhancement_name) + if config_value: + self.apply_enhancement(domains, enhancement_name, option) + enhanced = True + elif config_value: + logger.warning( + "Option %s is not supported by the selected installer. " + "Skipping enhancement.", config_name) msg = ("We were unable to restart web server") - if redirect or hsts or uir or staple: + if enhanced: with error_handler.ErrorHandler(self._rollback_and_restart, msg): self.installer.restart() @@ -620,10 +629,10 @@ def _open_pem_file(cli_arg_path, pem_path): """ if cli.set_by_cli(cli_arg_path): - return util.safe_open(pem_path, chmod=0o644),\ + return util.safe_open(pem_path, chmod=0o644, mode="wb"),\ os.path.abspath(pem_path) else: - uniq = util.unique_file(pem_path, 0o644) + uniq = util.unique_file(pem_path, 0o644, "wb") return uniq[0], os.path.abspath(uniq[1]) def _save_chain(chain_pem, chain_file): diff --git a/certbot/configuration.py b/certbot/configuration.py index 712135b8d..d25378922 100644 --- a/certbot/configuration.py +++ b/certbot/configuration.py @@ -25,9 +25,16 @@ class NamespaceConfig(object): - `csr_dir` - `in_progress_dir` - `key_dir` - - `renewer_config_file` - `temp_checkpoint_dir` + And the following paths are dynamically resolved using + :attr:`~certbot.interfaces.IConfig.config_dir` and relative + paths defined in :py:mod:`certbot.constants`: + + - `default_archive_dir` + - `live_dir` + - `renewal_configs_dir` + :ivar namespace: Namespace typically produced by :meth:`argparse.ArgumentParser.parse_args`. :type namespace: :class:`argparse.Namespace` @@ -85,18 +92,8 @@ class NamespaceConfig(object): new_ns = copy.deepcopy(self.namespace) return type(self)(new_ns) - -class RenewerConfiguration(object): - """Configuration wrapper for renewer.""" - - def __init__(self, namespace): - self.namespace = namespace - - def __getattr__(self, name): - return getattr(self.namespace, name) - @property - def archive_dir(self): # pylint: disable=missing-docstring + def default_archive_dir(self): # pylint: disable=missing-docstring return os.path.join(self.namespace.config_dir, constants.ARCHIVE_DIR) @property @@ -108,11 +105,6 @@ class RenewerConfiguration(object): return os.path.join( self.namespace.config_dir, constants.RENEWAL_CONFIGS_DIR) - @property - def renewer_config_file(self): # pylint: disable=missing-docstring - return os.path.join( - self.namespace.config_dir, constants.RENEWER_CONFIG_FILENAME) - def check_config_sanity(config): """Validate command line options and display error message if diff --git a/certbot/constants.py b/certbot/constants.py index 5548f398e..6d6319de2 100644 --- a/certbot/constants.py +++ b/certbot/constants.py @@ -39,6 +39,9 @@ STAGING_URI = "https://acme-staging.api.letsencrypt.org/directory" """Defaults for CLI flags and `.IConfig` attributes.""" +QUIET_LOGGING_LEVEL = logging.WARNING +"""Logging level to use in quiet mode.""" + RENEWER_DEFAULTS = dict( renewer_enabled="yes", renew_before_expiry="30 days", @@ -56,7 +59,7 @@ enhancements. List of expected options parameters: - redirect: None - http-header: TODO -- ocsp-stapling: TODO +- ocsp-stapling: certificate chain file path - spdy: TODO """ @@ -92,5 +95,5 @@ TEMP_CHECKPOINT_DIR = "temp_checkpoint" RENEWAL_CONFIGS_DIR = "renewal" """Renewal configs directory, relative to `IConfig.config_dir`.""" -RENEWER_CONFIG_FILENAME = "renewer.conf" -"""Renewer config file name (relative to `IConfig.config_dir`).""" +FORCE_INTERACTIVE_FLAG = "--force-interactive" +"""Flag to disable TTY checking in IDisplay.""" diff --git a/certbot/crypto_util.py b/certbot/crypto_util.py index 72797c615..b615de2dd 100644 --- a/certbot/crypto_util.py +++ b/certbot/crypto_util.py @@ -10,6 +10,7 @@ import traceback import OpenSSL import pyrfc3339 +import six import zope.component from acme import crypto_util as acme_crypto_util @@ -48,7 +49,8 @@ def save_key(key_pem, key_dir, keyname="key-certbot.pem"): # Save file util.make_or_verify_dir(key_dir, 0o700, os.geteuid(), config.strict_permissions) - key_f, key_path = util.unique_file(os.path.join(key_dir, keyname), 0o600) + key_f, key_path = util.unique_file( + os.path.join(key_dir, keyname), 0o600, "wb") with key_f: logger.info("Saving key to: %s", key_path) key_f.write(key_pem) @@ -79,7 +81,7 @@ def init_save_csr(privkey, names, path, csrname="csr-certbot.pem"): util.make_or_verify_dir(path, 0o755, os.geteuid(), config.strict_permissions) csr_f, csr_filename = util.unique_file( - os.path.join(path, csrname), 0o644) + os.path.join(path, csrname), 0o644, "wb") csr_f.write(csr_pem) csr_f.close() @@ -110,16 +112,16 @@ def make_csr(key_str, domains, must_staple=False): # TODO: put SAN if len(domains) > 1 extensions = [ OpenSSL.crypto.X509Extension( - "subjectAltName", + b"subjectAltName", critical=False, - value=", ".join("DNS:%s" % d for d in domains) + value=", ".join("DNS:%s" % d for d in domains).encode('ascii') ) ] if must_staple: extensions.append(OpenSSL.crypto.X509Extension( - "1.3.6.1.5.5.7.1.24", + b"1.3.6.1.5.5.7.1.24", critical=False, - value="DER:30:03:02:01:05")) + value=b"DER:30:03:02:01:05")) req.add_extensions(extensions) req.set_version(2) req.set_pubkey(pkey) @@ -373,7 +375,7 @@ def dump_pyopenssl_chain(chain, filetype=OpenSSL.crypto.FILETYPE_PEM): # assumes that OpenSSL.crypto.dump_certificate includes ending # newline character - return "".join(_dump_cert(cert) for cert in chain) + return b"".join(_dump_cert(cert) for cert in chain) def notBefore(cert_path): @@ -414,8 +416,14 @@ def _notAfterBefore(cert_path, method): with open(cert_path) as f: x509 = OpenSSL.crypto.load_certificate(OpenSSL.crypto.FILETYPE_PEM, f.read()) + # pyopenssl always returns bytes timestamp = method(x509) - reformatted_timestamp = [timestamp[0:4], "-", timestamp[4:6], "-", - timestamp[6:8], "T", timestamp[8:10], ":", - timestamp[10:12], ":", timestamp[12:]] - return pyrfc3339.parse("".join(reformatted_timestamp)) + reformatted_timestamp = [timestamp[0:4], b"-", timestamp[4:6], b"-", + timestamp[6:8], b"T", timestamp[8:10], b":", + timestamp[10:12], b":", timestamp[12:]] + timestamp_str = b"".join(reformatted_timestamp) + # pyrfc3339 uses "native" strings. That is, bytes on Python 2 and unicode + # on Python 3 + if six.PY3: + timestamp_str = timestamp_str.decode('ascii') + return pyrfc3339.parse(timestamp_str) diff --git a/certbot/display/enhancements.py b/certbot/display/enhancements.py index 3b128a874..d2ffe2e0d 100644 --- a/certbot/display/enhancements.py +++ b/certbot/display/enhancements.py @@ -48,7 +48,8 @@ def redirect_by_default(): code, selection = util(interfaces.IDisplay).menu( "Please choose whether HTTPS access is required or optional.", - choices, default=0, cli_flag="--redirect / --no-redirect") + choices, default=0, + cli_flag="--redirect / --no-redirect", force_interactive=True) if code != display_util.OK: return False diff --git a/certbot/display/ops.py b/certbot/display/ops.py index c7e566256..85343fdc3 100644 --- a/certbot/display/ops.py +++ b/certbot/display/ops.py @@ -29,7 +29,7 @@ def get_email(invalid=False, optional=True): """ invalid_prefix = "There seem to be problems with that address. " - msg = "Enter email address (used for urgent notices and lost key recovery)" + msg = "Enter email address (used for urgent renewal and security notices)" unsafe_suggestion = ("\n\nIf you really want to skip this, you can run " "the client with --register-unsafely-without-email " "but make sure you then backup your account key from " @@ -37,6 +37,7 @@ def get_email(invalid=False, optional=True): if optional: if invalid: msg += unsafe_suggestion + suggest_unsafe = False else: suggest_unsafe = True else: @@ -45,10 +46,11 @@ def get_email(invalid=False, optional=True): while True: try: code, email = z_util(interfaces.IDisplay).input( - invalid_prefix + msg if invalid else msg) + invalid_prefix + msg if invalid else msg, + force_interactive=True) except errors.MissingCommandlineFlag: msg = ("You should register before running non-interactively, " - "or provide --agree-tos and --email flags") + "or provide --agree-tos and --email flags.") raise errors.MissingCommandlineFlag(msg) if code != display_util.OK: @@ -78,7 +80,7 @@ def choose_account(accounts): labels = [acc.slug for acc in accounts] code, index = z_util(interfaces.IDisplay).menu( - "Please choose an account", labels) + "Please choose an account", labels, force_interactive=True) if code == display_util.OK: return accounts[index] else: @@ -103,18 +105,8 @@ def choose_names(installer): names = get_valid_domains(domains) if not names: - manual = z_util(interfaces.IDisplay).yesno( - "No names were found in your configuration files.{0}You should " - "specify ServerNames in your config files in order to allow for " - "accurate installation of your certificate.{0}" - "If you do use the default vhost, you may specify the name " - "manually. Would you like to continue?{0}".format(os.linesep), - default=True) - - if manual: - return _choose_names_manually() - else: - return [] + return _choose_names_manually( + "No names were found in your configuration files. ") code, names = _filter_names(names) if code == display_util.OK and names: @@ -139,6 +131,16 @@ def get_valid_domains(domains): continue return valid_domains +def _sort_names(FQDNs): + """Sort FQDNs by SLD (and if many, by their subdomains) + + :param list FQDNs: list of domain names + + :returns: Sorted list of domain names + :rtype: list + """ + return sorted(FQDNs, key=lambda fqdn: fqdn.split('.')[::-1][1:]) + def _filter_names(names): """Determine which names the user would like to select from a list. @@ -151,18 +153,28 @@ def _filter_names(names): :rtype: tuple """ + #Sort by domain first, and then by subdomain + sorted_names = _sort_names(names) + code, names = z_util(interfaces.IDisplay).checklist( "Which names would you like to activate HTTPS for?", - tags=names, cli_flag="--domains") + tags=sorted_names, cli_flag="--domains", force_interactive=True) return code, [str(s) for s in names] -def _choose_names_manually(): - """Manually input names for those without an installer.""" +def _choose_names_manually(prompt_prefix=""): + """Manually input names for those without an installer. + :param str prompt_prefix: string to prepend to prompt for domains + + :returns: list of provided names + :rtype: `list` of `str` + + """ code, input_ = z_util(interfaces.IDisplay).input( + prompt_prefix + "Please enter in your domain name(s) (comma and/or space separated) ", - cli_flag="--domains") + cli_flag="--domains", force_interactive=True) if code == display_util.OK: invalid_domains = dict() @@ -180,7 +192,12 @@ def _choose_names_manually(): try: domain_list[i] = util.enforce_domain_sanity(domain) except errors.ConfigurationError as e: - invalid_domains[domain] = e.message + try: # Python 2 + # pylint: disable=no-member + err_msg = e.message.encode('utf-8') + except AttributeError: + err_msg = str(e) + invalid_domains[domain] = err_msg if len(invalid_domains): retry_message = ( @@ -195,7 +212,8 @@ def _choose_names_manually(): if retry_message: # We had error in input - retry = z_util(interfaces.IDisplay).yesno(retry_message) + retry = z_util(interfaces.IDisplay).yesno(retry_message, + force_interactive=True) if retry: return _choose_names_manually() else: @@ -206,8 +224,6 @@ def _choose_names_manually(): def success_installation(domains): """Display a box confirming the installation of HTTPS. - .. todo:: This should be centered on the screen - :param list domains: domain names which were enabled """ @@ -217,29 +233,36 @@ def success_installation(domains): _gen_https_names(domains), os.linesep, os.linesep.join(_gen_ssl_lab_urls(domains))), - height=(10 + len(domains)), pause=False) -def success_renewal(domains, action): +def success_renewal(domains): """Display a box confirming the renewal of an existing certificate. - .. todo:: This should be centered on the screen - :param list domains: domain names which were renewed - :param str action: can be "reinstall" or "renew" """ z_util(interfaces.IDisplay).notification( - "Your existing certificate has been successfully {3}ed, and the " + "Your existing certificate has been successfully renewed, and the " "new certificate has been installed.{1}{1}" "The new certificate covers the following domains: {0}{1}{1}" "You should test your configuration at:{1}{2}".format( _gen_https_names(domains), os.linesep, - os.linesep.join(_gen_ssl_lab_urls(domains)), - action), - height=(14 + len(domains)), + os.linesep.join(_gen_ssl_lab_urls(domains))), + pause=False) + +def success_revocation(cert_path): + """Display a box confirming a certificate has been revoked. + + :param list cert_path: path to certificate which was revoked. + + """ + z_util(interfaces.IDisplay).notification( + "Congratulations! You have successfully revoked the certificate " + "that was located at {0}{1}{1}".format( + cert_path, + os.linesep), pause=False) diff --git a/certbot/display/util.py b/certbot/display/util.py index 39486b2bd..ebfce78e2 100644 --- a/certbot/display/util.py +++ b/certbot/display/util.py @@ -2,26 +2,19 @@ import logging import os import textwrap +import sys -import dialog +import six import zope.interface +from certbot import constants from certbot import interfaces from certbot import errors from certbot.display import completer - logger = logging.getLogger(__name__) WIDTH = 72 -HEIGHT = 20 - -DSELECT_HELP = ( - "Use the arrow keys or Tab to move between window elements. Space can be " - "used to complete the input path with the selected element in the " - "directory window. Pressing enter will select the currently highlighted " - "button.") -"""Help text on how to use dialog's dselect.""" # Display exit codes OK = "ok" @@ -58,205 +51,45 @@ def _wrap_lines(msg): return os.linesep.join(fixed_l) - -def _clean(dialog_result): - """Treat sundy python-dialog return codes as CANCEL - - :param tuple dialog_result: (code, result) - :returns: the argument but with unknown codes set to -1 (Error) - :rtype: tuple - """ - code, result = dialog_result - if code in (OK, HELP): - return dialog_result - elif code in (CANCEL, ESC): - return (CANCEL, result) - else: - logger.debug("Surprising dialog return code %s", code) - return (CANCEL, result) - - -@zope.interface.implementer(interfaces.IDisplay) -class NcursesDisplay(object): - """Ncurses-based display.""" - - def __init__(self, width=WIDTH, height=HEIGHT): - super(NcursesDisplay, self).__init__() - self.dialog = dialog.Dialog() - assert OK == self.dialog.DIALOG_OK, "What kind of absurdity is this?" - self.width = width - self.height = height - - def notification(self, message, height=10, pause=False): - # pylint: disable=unused-argument - """Display a notification to the user and wait for user acceptance. - - .. todo:: It probably makes sense to use one of the transient message - types for pause. It isn't straightforward how best to approach - the matter though given the context of our messages. - http://pythondialog.sourceforge.net/doc/widgets.html#displaying-transient-messages - - :param str message: Message to display - :param int height: Height of the dialog box - :param bool pause: Not applicable to NcursesDisplay - - """ - self.dialog.msgbox(message, height, width=self.width) - - def menu(self, message, choices, ok_label="OK", cancel_label="Cancel", - help_label="", **unused_kwargs): - """Display a menu. - - :param str message: title of menu - - :param choices: menu lines, len must be > 0 - :type choices: list of tuples (`tag`, `item`) tags must be unique or - list of items (tags will be enumerated) - - :param str ok_label: label of the OK button - :param str help_label: label of the help button - :param dict unused_kwargs: absorbs default / cli_args - - :returns: tuple of the form (`code`, `index`) where - `code` - display exit code - `int` - index of the selected item - :rtype: tuple - - """ - menu_options = { - "choices": choices, - "ok_label": ok_label, - "cancel_label": cancel_label, - "help_button": bool(help_label), - "help_label": help_label, - "width": self.width, - "height": self.height, - "menu_height": self.height - 6, - } - - # Can accept either tuples or just the actual choices - if choices and isinstance(choices[0], tuple): - # pylint: disable=star-args - code, selection = _clean(self.dialog.menu(message, **menu_options)) - - # Return the selection index - for i, choice in enumerate(choices): - if choice[0] == selection: - return code, i - - return code, -1 - - else: - # "choices" is not formatted the way the dialog.menu expects... - menu_options["choices"] = [ - (str(i), choice) for i, choice in enumerate(choices, 1) - ] - # pylint: disable=star-args - code, index = _clean(self.dialog.menu(message, **menu_options)) - - if code == CANCEL or index == "": - return code, -1 - - return code, int(index) - 1 - - def input(self, message, **unused_kwargs): - """Display an input box to the user. - - :param str message: Message to display that asks for input. - :param dict _kwargs: absorbs default / cli_args - - :returns: tuple of the form (`code`, `string`) where - `code` - display exit code - `string` - input entered by the user - - """ - sections = message.split("\n") - # each section takes at least one line, plus extras if it's longer than self.width - wordlines = [1 + (len(section) / self.width) for section in sections] - height = 6 + sum(wordlines) + len(sections) - return _clean(self.dialog.inputbox(message, width=self.width, height=height)) - - def yesno(self, message, yes_label="Yes", no_label="No", **unused_kwargs): - """Display a Yes/No dialog box. - - Yes and No label must begin with different letters. - - :param str message: message to display to user - :param str yes_label: label on the "yes" button - :param str no_label: label on the "no" button - :param dict _kwargs: absorbs default / cli_args - - :returns: if yes_label was selected - :rtype: bool - - """ - return self.dialog.DIALOG_OK == self.dialog.yesno( - message, self.height, self.width, - yes_label=yes_label, no_label=no_label) - - def checklist(self, message, tags, default_status=True, **unused_kwargs): - """Displays a checklist. - - :param message: Message to display before choices - :param list tags: where each is of type :class:`str` len(tags) > 0 - :param bool default_status: If True, items are in a selected state by - default. - :param dict _kwargs: absorbs default / cli_args - - - :returns: tuple of the form (`code`, `list_tags`) where - `code` - display exit code - `list_tags` - list of str tags selected by the user - - """ - choices = [(tag, "", default_status) for tag in tags] - return _clean(self.dialog.checklist( - message, width=self.width, height=self.height, choices=choices)) - - def directory_select(self, message, **unused_kwargs): - """Display a directory selection screen. - - :param str message: prompt to give the user - - :returns: tuple of the form (`code`, `string`) where - `code` - display exit code - `string` - input entered by the user - - """ - root_directory = os.path.abspath(os.sep) - return _clean(self.dialog.dselect( - filepath=root_directory, width=self.width, - height=self.height, help_button=True, title=message)) - - @zope.interface.implementer(interfaces.IDisplay) class FileDisplay(object): """File-based display.""" + # pylint: disable=too-many-arguments + # see https://github.com/certbot/certbot/issues/3915 - def __init__(self, outfile): + def __init__(self, outfile, force_interactive): super(FileDisplay, self).__init__() self.outfile = outfile + self.force_interactive = force_interactive + self.skipped_interaction = False - def notification(self, message, height=10, pause=True): - # pylint: disable=unused-argument + def notification(self, message, pause=True, + wrap=True, force_interactive=False): """Displays a notification and waits for user acceptance. :param str message: Message to display - :param int height: No effect for FileDisplay :param bool pause: Whether or not the program should pause for the user's confirmation + :param bool wrap: Whether or not the application should wrap text + :param bool force_interactive: True if it's safe to prompt the user + because it won't cause any workflow regressions """ side_frame = "-" * 79 - message = _wrap_lines(message) + if wrap: + message = _wrap_lines(message) self.outfile.write( "{line}{frame}{line}{msg}{line}{frame}{line}".format( line=os.linesep, frame=side_frame, msg=message)) if pause: - raw_input("Press Enter to Continue") + if self._can_interact(force_interactive): + six.moves.input("Press Enter to Continue") + else: + logger.debug("Not pausing for user confirmation") def menu(self, message, choices, ok_label="", cancel_label="", - help_label="", **unused_kwargs): + help_label="", default=None, + cli_flag=None, force_interactive=False, **unused_kwargs): # pylint: disable=unused-argument """Display a menu. @@ -267,7 +100,10 @@ class FileDisplay(object): :param choices: Menu lines, len must be > 0 :type choices: list of tuples (tag, item) or list of descriptions (tags will be enumerated) - :param dict _kwargs: absorbs default / cli_args + :param default: default value to return (if one exists) + :param str cli_flag: option used to set this value with the CLI + :param bool force_interactive: True if it's safe to prompt the user + because it won't cause any workflow regressions :returns: tuple of (`code`, `index`) where `code` - str display exit code @@ -276,18 +112,25 @@ class FileDisplay(object): :rtype: tuple """ + if self._return_default(message, default, cli_flag, force_interactive): + return OK, default + self._print_menu(message, choices) code, selection = self._get_valid_int_ans(len(choices)) return code, selection - 1 - def input(self, message, **unused_kwargs): + def input(self, message, default=None, + cli_flag=None, force_interactive=False, **unused_kwargs): # pylint: disable=no-self-use """Accept input from the user. :param str message: message to display to the user - :param dict _kwargs: absorbs default / cli_args + :param default: default value to return (if one exists) + :param str cli_flag: option used to set this value with the CLI + :param bool force_interactive: True if it's safe to prompt the user + because it won't cause any workflow regressions :returns: tuple of (`code`, `input`) where `code` - str display exit code @@ -295,7 +138,10 @@ class FileDisplay(object): :rtype: tuple """ - ans = raw_input( + if self._return_default(message, default, cli_flag, force_interactive): + return OK, default + + ans = six.moves.input( textwrap.fill( "%s (Enter 'c' to cancel): " % message, 80, @@ -307,7 +153,8 @@ class FileDisplay(object): else: return OK, ans - def yesno(self, message, yes_label="Yes", no_label="No", **unused_kwargs): + def yesno(self, message, yes_label="Yes", no_label="No", default=None, + cli_flag=None, force_interactive=False, **unused_kwargs): """Query the user with a yes/no question. Yes and No label must begin with different letters, and must contain at @@ -316,12 +163,18 @@ class FileDisplay(object): :param str message: question for the user :param str yes_label: Label of the "Yes" parameter :param str no_label: Label of the "No" parameter - :param dict _kwargs: absorbs default / cli_args + :param default: default value to return (if one exists) + :param str cli_flag: option used to set this value with the CLI + :param bool force_interactive: True if it's safe to prompt the user + because it won't cause any workflow regressions :returns: True for "Yes", False for "No" :rtype: bool """ + if self._return_default(message, default, cli_flag, force_interactive): + return default + side_frame = ("-" * 79) + os.linesep message = _wrap_lines(message) @@ -330,7 +183,7 @@ class FileDisplay(object): os.linesep, frame=side_frame, msg=message)) while True: - ans = raw_input("{yes}/{no}: ".format( + ans = six.moves.input("{yes}/{no}: ".format( yes=_parens_around_char(yes_label), no=_parens_around_char(no_label))) @@ -343,14 +196,18 @@ class FileDisplay(object): ans.startswith(no_label[0].upper())): return False - def checklist(self, message, tags, default_status=True, **unused_kwargs): + def checklist(self, message, tags, default_status=True, default=None, + cli_flag=None, force_interactive=False, **unused_kwargs): # pylint: disable=unused-argument """Display a checklist. :param str message: Message to display to user :param list tags: `str` tags to select, len(tags) > 0 :param bool default_status: Not used for FileDisplay - :param dict _kwargs: absorbs default / cli_args + :param default: default value to return (if one exists) + :param str cli_flag: option used to set this value with the CLI + :param bool force_interactive: True if it's safe to prompt the user + because it won't cause any workflow regressions :returns: tuple of (`code`, `tags`) where `code` - str display exit code @@ -358,13 +215,20 @@ class FileDisplay(object): :rtype: tuple """ + if self._return_default(message, default, cli_flag, force_interactive): + return OK, default + while True: self._print_menu(message, tags) code, ans = self.input("Select the appropriate numbers separated " - "by commas and/or spaces") + "by commas and/or spaces, or leave input " + "blank to select all options shown", + force_interactive=True) if code == OK: + if len(ans.strip()) == 0: + ans = " ".join(str(x) for x in range(1, len(tags)+1)) indices = separate_list_input(ans) selected_tags = self._scrub_checklist_input(indices, tags) if selected_tags: @@ -375,10 +239,65 @@ class FileDisplay(object): else: return code, [] - def directory_select(self, message, **unused_kwargs): + def _return_default(self, prompt, default, cli_flag, force_interactive): + """Should we return the default instead of prompting the user? + + :param str prompt: prompt for the user + :param default: default answer to prompt + :param str cli_flag: command line option for setting an answer + to this question + :param bool force_interactive: if interactivity is forced by the + IDisplay call + + :returns: True if we should return the default without prompting + :rtype: bool + + """ + msg = "Invalid IDisplay call for this prompt:\n{0}".format(prompt) + if cli_flag: + msg += ("\nYou can set an answer to " + "this prompt with the {0} flag".format(cli_flag)) + assert default is not None or force_interactive, msg + + if self._can_interact(force_interactive): + return False + else: + logger.debug( + "Falling back to default %s for the prompt:\n%s", + default, prompt) + return True + + def _can_interact(self, force_interactive): + """Can we safely interact with the user? + + :param bool force_interactive: if interactivity is forced by the + IDisplay call + + :returns: True if the display can interact with the user + :rtype: bool + + """ + if (self.force_interactive or force_interactive or + sys.stdin.isatty() and self.outfile.isatty()): + return True + elif not self.skipped_interaction: + logger.warning( + "Skipped user interaction because Certbot doesn't appear to " + "be running in a terminal. You should probably include " + "--non-interactive or %s on the command line.", + constants.FORCE_INTERACTIVE_FLAG) + self.skipped_interaction = True + return False + + def directory_select(self, message, default=None, cli_flag=None, + force_interactive=False, **unused_kwargs): """Display a directory selection screen. :param str message: prompt to give the user + :param default: default value to return (if one exists) + :param str cli_flag: option used to set this value with the CLI + :param bool force_interactive: True if it's safe to prompt the user + because it won't cause any workflow regressions :returns: tuple of the form (`code`, `string`) where `code` - display exit code @@ -386,7 +305,7 @@ class FileDisplay(object): """ with completer.Completer(): - return self.input(message) + return self.input(message, default, cli_flag, force_interactive) def _scrub_checklist_input(self, indices, tags): # pylint: disable=no-self-use @@ -468,7 +387,7 @@ class FileDisplay(object): input_msg = ("Press 1 [enter] to confirm the selection " "(press 'c' to cancel): ") while selection < 1: - ans = raw_input(input_msg) + ans = six.moves.input(input_msg) if ans.startswith("c") or ans.startswith("C"): return CANCEL, -1 try: @@ -488,7 +407,7 @@ class FileDisplay(object): class NoninteractiveDisplay(object): """An iDisplay implementation that never asks for interactive user input""" - def __init__(self, outfile): + def __init__(self, outfile, *unused_args, **unused_kwargs): super(NoninteractiveDisplay, self).__init__() self.outfile = outfile @@ -502,23 +421,24 @@ class NoninteractiveDisplay(object): msg += "\n\n(You can set this with the {0} flag)".format(cli_flag) raise errors.MissingCommandlineFlag(msg) - def notification(self, message, height=10, pause=False): + def notification(self, message, pause=False, wrap=True, **unused_kwargs): # pylint: disable=unused-argument """Displays a notification without waiting for user acceptance. :param str message: Message to display to stdout - :param int height: No effect for NoninteractiveDisplay :param bool pause: The NoninteractiveDisplay waits for no keyboard + :param bool wrap: Whether or not the application should wrap text """ side_frame = "-" * 79 - message = _wrap_lines(message) + if wrap: + message = _wrap_lines(message) self.outfile.write( "{line}{frame}{line}{msg}{line}{frame}{line}".format( line=os.linesep, frame=side_frame, msg=message)) def menu(self, message, choices, ok_label=None, cancel_label=None, - help_label=None, default=None, cli_flag=None): + help_label=None, default=None, cli_flag=None, *unused_kwargs): # pylint: disable=unused-argument,too-many-arguments """Avoid displaying a menu. @@ -541,7 +461,7 @@ class NoninteractiveDisplay(object): return OK, default - def input(self, message, default=None, cli_flag=None): + def input(self, message, default=None, cli_flag=None, **unused_kwargs): """Accept input from the user. :param str message: message to display to the user @@ -558,7 +478,8 @@ class NoninteractiveDisplay(object): else: return OK, default - def yesno(self, message, yes_label=None, no_label=None, default=None, cli_flag=None): + def yesno(self, message, yes_label=None, no_label=None, + default=None, cli_flag=None, **unused_kwargs): # pylint: disable=unused-argument """Decide Yes or No, without asking anybody @@ -575,8 +496,8 @@ class NoninteractiveDisplay(object): else: return default - def checklist(self, message, tags, default=None, cli_flag=None, **kwargs): - # pylint: disable=unused-argument + def checklist(self, message, tags, default=None, + cli_flag=None, **unused_kwargs): """Display a checklist. :param str message: Message to display to user @@ -594,7 +515,8 @@ class NoninteractiveDisplay(object): else: return OK, default - def directory_select(self, message, default=None, cli_flag=None): + def directory_select(self, message, default=None, + cli_flag=None, **unused_kwargs): """Simulate prompting the user for a directory. This function returns default if it is not ``None``, otherwise, diff --git a/certbot/error_handler.py b/certbot/error_handler.py index 4e6f6afac..819d32405 100644 --- a/certbot/error_handler.py +++ b/certbot/error_handler.py @@ -15,9 +15,14 @@ logger = logging.getLogger(__name__) # potentially occur from inside Python. Signals such as SIGILL were not # included as they could be a sign of something devious and we should terminate # immediately. -_SIGNALS = ([signal.SIGTERM] if os.name == "nt" else - [signal.SIGTERM, signal.SIGHUP, signal.SIGQUIT, - signal.SIGXCPU, signal.SIGXFSZ]) +_SIGNALS = [signal.SIGTERM] +if os.name != "nt": + for signal_code in [signal.SIGHUP, signal.SIGQUIT, + signal.SIGXCPU, signal.SIGXFSZ]: + # Adding only those signals that their default action is not Ignore. + # This is platform-dependent, so we check it dynamically. + if signal.getsignal(signal_code) != signal.SIG_IGN: + _SIGNALS.append(signal_code) class ErrorHandler(object): diff --git a/certbot/hooks.py b/certbot/hooks.py index f37f81c6e..63afba091 100644 --- a/certbot/hooks.py +++ b/certbot/hooks.py @@ -12,16 +12,16 @@ logger = logging.getLogger(__name__) def validate_hooks(config): """Check hook commands are executable.""" - _validate_hook(config.pre_hook, "pre") - _validate_hook(config.post_hook, "post") - _validate_hook(config.renew_hook, "renew") + validate_hook(config.pre_hook, "pre") + validate_hook(config.post_hook, "post") + validate_hook(config.renew_hook, "renew") def _prog(shell_cmd): """Extract the program run by a shell command""" cmd = _which(shell_cmd) return os.path.basename(cmd) if cmd else None -def _validate_hook(shell_cmd, hook_name): +def validate_hook(shell_cmd, hook_name): """Check that a command provided as a hook is plausibly executable. :raises .errors.HookCommandNotFound: if the command is not found @@ -69,17 +69,33 @@ def renew_hook(config, domains, lineage_path): else: logger.warning("Dry run: skipping renewal hook command: %s", config.renew_hook) + def _run_hook(shell_cmd): """Run a hook command. :returns: stderr if there was any""" - cmd = Popen(shell_cmd, shell=True, stdout=PIPE, stderr=PIPE, stdin=PIPE) - _out, err = cmd.communicate() + err, _ = execute(shell_cmd) + return err + + +def execute(shell_cmd): + """Run a command. + + :returns: `tuple` (`str` stderr, `str` stdout)""" + + # universal_newlines causes Popen.communicate() + # to return str objects instead of bytes in Python 3 + cmd = Popen(shell_cmd, shell=True, stdout=PIPE, + stderr=PIPE, universal_newlines=True) + out, err = cmd.communicate() if cmd.returncode != 0: - logger.error('Hook command "%s" returned error code %d', shell_cmd, cmd.returncode) + logger.error('Hook command "%s" returned error code %d', + shell_cmd, cmd.returncode) if err: logger.error('Error output from %s:\n%s', _prog(shell_cmd), err) + return (err, out) + def _is_exe(fpath): return os.path.isfile(fpath) and os.access(fpath, os.X_OK) diff --git a/certbot/interfaces.py b/certbot/interfaces.py index 1ee1fb689..48828f35e 100644 --- a/certbot/interfaces.py +++ b/certbot/interfaces.py @@ -138,15 +138,15 @@ class IAuthenticator(IPlugin): """ def get_chall_pref(domain): - """Return list of challenge preferences. + """Return `collections.Iterable` of challenge preferences. :param str domain: Domain for which challenge preferences are sought. - :returns: List of challenge types (subclasses of + :returns: `collections.Iterable` of challenge types (subclasses of :class:`acme.challenges.Challenge`) with the most preferred challenges first. If a type is not specified, it means the Authenticator cannot perform the challenge. - :rtype: list + :rtype: `collections.Iterable` """ @@ -158,7 +158,7 @@ class IAuthenticator(IPlugin): instances, such that it contains types found within :func:`get_chall_pref` only. - :returns: List of ACME + :returns: `collections.Iterable` of ACME :class:`~acme.challenges.ChallengeResponse` instances or if the :class:`~acme.challenges.Challenge` cannot be fulfilled then: @@ -168,7 +168,7 @@ class IAuthenticator(IPlugin): ``False`` Authenticator will never be able to perform (error). - :rtype: :class:`list` of + :rtype: :class:`collections.Iterable` of :class:`acme.challenges.ChallengeResponse`, where responses are required to be returned in the same order as corresponding input challenges @@ -201,7 +201,7 @@ class IConfig(zope.interface.Interface): """ server = zope.interface.Attribute("ACME Directory Resource URI.") email = zope.interface.Attribute( - "Email used for registration and recovery contact.") + "Email used for registration and recovery contact. (default: Ask)") rsa_key_size = zope.interface.Attribute("Size of the RSA key.") ecdsa_curve = zope.interface.Attribute( "Set the certificate ECDSA curve. Current possible curves: " @@ -231,17 +231,17 @@ class IConfig(zope.interface.Interface): temp_checkpoint_dir = zope.interface.Attribute( "Temporary checkpoint directory.") - renewer_config_file = zope.interface.Attribute( - "Location of renewal configuration file.") - no_verify_ssl = zope.interface.Attribute( - "Disable SSL certificate verification.") + "Disable verification of the ACME server's certificate.") tls_sni_01_port = zope.interface.Attribute( - "Port number to perform tls-sni-01 challenge. " - "Boulder in testing mode defaults to 5001.") + "Port used during tls-sni-01 challenge. " + "This only affects the port Certbot listens on. " + "A conforming ACME server will still attempt to connect on port 443.") http01_port = zope.interface.Attribute( - "Port used in the SimpleHttp challenge.") + "Port used in the http-01 challenge. " + "This only affects the port Certbot listens on. " + "A conforming ACME server will still attempt to connect on port 80.") class IInstaller(IPlugin): @@ -262,7 +262,7 @@ class IInstaller(IPlugin): def get_all_names(): """Returns all names that may be authenticated. - :rtype: `list` of `str` + :rtype: `collections.Iterable` of `str` """ @@ -297,24 +297,11 @@ class IInstaller(IPlugin): """ def supported_enhancements(): - """Returns a list of supported enhancements. + """Returns a `collections.Iterable` of supported enhancements. :returns: supported enhancements which should be a subset of :const:`~certbot.constants.ENHANCEMENTS` - :rtype: :class:`list` of :class:`str` - - """ - - def get_all_certs_keys(): - """Retrieve all certs and keys set in configuration. - - :returns: tuples with form `[(cert, key, path)]`, where: - - - `cert` - str path to certificate file - - `key` - str path to associated key file - - `path` - file path to configuration file - - :rtype: list + :rtype: :class:`collections.Iterable` of :class:`str` """ @@ -382,21 +369,29 @@ class IInstaller(IPlugin): class IDisplay(zope.interface.Interface): """Generic display.""" + # pylint: disable=too-many-arguments + # see https://github.com/certbot/certbot/issues/3915 - def notification(message, height, pause): + def notification(message, pause, wrap=True, force_interactive=False): """Displays a string message :param str message: Message to display - :param int height: Height of dialog box if applicable :param bool pause: Whether or not the application should pause for confirmation (if available) + :param bool wrap: Whether or not the application should wrap text + :param bool force_interactive: True if it's safe to prompt the user + because it won't cause any workflow regressions """ - def menu(message, choices, ok_label="OK", # pylint: disable=too-many-arguments - cancel_label="Cancel", help_label="", default=None, cli_flag=None): + def menu(message, choices, ok_label="OK", + cancel_label="Cancel", help_label="", + default=None, cli_flag=None, force_interactive=False): """Displays a generic menu. + When not setting force_interactive=True, you must provide a + default value. + :param str message: message to display :param choices: choices @@ -407,6 +402,8 @@ class IDisplay(zope.interface.Interface): :param str help_label: label for Help button :param int default: default (non-interactive) choice from the menu :param str cli_flag: to automate choice from the menu, eg "--keep" + :param bool force_interactive: True if it's safe to prompt the user + because it won't cause any workflow regressions :returns: tuple of (`code`, `index`) where `code` - str display exit code @@ -417,10 +414,16 @@ class IDisplay(zope.interface.Interface): """ - def input(message, default=None, cli_args=None): + def input(message, default=None, cli_args=None, force_interactive=False): """Accept input from the user. + When not setting force_interactive=True, you must provide a + default value. + :param str message: message to display to the user + :param str default: default (non-interactive) response to prompt + :param bool force_interactive: True if it's safe to prompt the user + because it won't cause any workflow regressions :returns: tuple of (`code`, `input`) where `code` - str display exit code @@ -433,14 +436,19 @@ class IDisplay(zope.interface.Interface): """ def yesno(message, yes_label="Yes", no_label="No", default=None, - cli_args=None): + cli_args=None, force_interactive=False): """Query the user with a yes/no question. Yes and No label must begin with different letters. + When not setting force_interactive=True, you must provide a + default value. + :param str message: question for the user :param str default: default (non-interactive) choice from the menu :param str cli_flag: to automate choice from the menu, eg "--redirect / --no-redirect" + :param bool force_interactive: True if it's safe to prompt the user + because it won't cause any workflow regressions :returns: True for "Yes", False for "No" :rtype: bool @@ -450,14 +458,20 @@ class IDisplay(zope.interface.Interface): """ - def checklist(message, tags, default_state, default=None, cli_args=None): + def checklist(message, tags, default_state, + default=None, cli_args=None, force_interactive=False): """Allow for multiple selections from a menu. + When not setting force_interactive=True, you must provide a + default value. + :param str message: message to display to the user :param list tags: where each is of type :class:`str` len(tags) > 0 :param bool default_status: If True, items are in a selected state by default. :param str default: default (non-interactive) state of the checklist :param str cli_flag: to automate choice from the menu, eg "--domains" + :param bool force_interactive: True if it's safe to prompt the user + because it won't cause any workflow regressions :returns: tuple of the form (code, list_tags) where `code` - int display exit code @@ -469,15 +483,21 @@ class IDisplay(zope.interface.Interface): """ - def directory_select(self, message, default=None, cli_flag=None): + def directory_select(self, message, default=None, + cli_flag=None, force_interactive=False): """Display a directory selection screen. + When not setting force_interactive=True, you must provide a + default value. + :param str message: prompt to give the user :param default: the default value to return, if one exists, when using the NoninteractiveDisplay :param str cli_flag: option used to set this value with the CLI, if one exists, to be included in error messages given by NoninteractiveDisplay + :param bool force_interactive: True if it's safe to prompt the user + because it won't cause any workflow regressions :returns: tuple of the form (`code`, `string`) where `code` - int display exit code diff --git a/certbot/log.py b/certbot/log.py deleted file mode 100644 index 62241254a..000000000 --- a/certbot/log.py +++ /dev/null @@ -1,64 +0,0 @@ -"""Logging utilities.""" -import logging - -import dialog - -from certbot.display import util as display_util - - -class DialogHandler(logging.Handler): # pylint: disable=too-few-public-methods - """Logging handler using dialog info box. - - :ivar int height: Height of the info box (without padding). - :ivar int width: Width of the info box (without padding). - :ivar list lines: Lines to be displayed in the info box. - :ivar d: Instance of :class:`dialog.Dialog`. - - """ - - PADDING_HEIGHT = 2 - PADDING_WIDTH = 4 - - def __init__(self, level=logging.NOTSET, height=display_util.HEIGHT, - width=display_util.WIDTH - 4, d=None): - # Handler not new-style -> no super - logging.Handler.__init__(self, level) - self.height = height - self.width = width - # "dialog" collides with module name... - self.d = dialog.Dialog() if d is None else d - self.lines = [] - - def emit(self, record): - """Emit message to a dialog info box. - - Only show the last (self.height) lines; note that lines can wrap - at self.width, so a single line could actually be multiple - lines. - - """ - for line in self.format(record).splitlines(): - # check for lines that would wrap - cur_out = line - while len(cur_out) > self.width: - # find first space before self.width chars into cur_out - last_space_pos = cur_out.rfind(' ', 0, self.width) - - if last_space_pos == -1: - # no spaces, just cut them off at whatever - self.lines.append(cur_out[0:self.width]) - cur_out = cur_out[self.width:] - else: - # cut off at last space - self.lines.append(cur_out[0:last_space_pos]) - cur_out = cur_out[last_space_pos + 1:] - if cur_out != '': - self.lines.append(cur_out) - - # show last 16 lines - content = '\n'.join(self.lines[-self.height:]) - - # add the padding around the box - self.d.infobox( - content, self.height + self.PADDING_HEIGHT, - self.width + self.PADDING_WIDTH) diff --git a/certbot/main.py b/certbot/main.py index 511046df0..838416822 100644 --- a/certbot/main.py +++ b/certbot/main.py @@ -1,7 +1,6 @@ """Certbot main entry point.""" from __future__ import print_function import atexit -import dialog import functools import logging.handlers import os @@ -12,10 +11,13 @@ import traceback import zope.component from acme import jose +from acme import messages +from acme import errors as acme_errors import certbot from certbot import account +from certbot import cert_manager from certbot import client from certbot import cli from certbot import crypto_util @@ -26,10 +28,8 @@ from certbot import errors from certbot import hooks from certbot import interfaces from certbot import util -from certbot import log from certbot import reporter from certbot import renewal -from certbot import storage from certbot.display import util as display_util, ops as display_ops from certbot.plugins import disco as plugins_disco @@ -41,6 +41,9 @@ _PERM_ERR_FMT = os.linesep.join(( "If running as non-root, set --config-dir, " "--logs-dir, and --work-dir to writeable paths.")) +USER_CANCELLED = ("User chose to cancel the operation and may " + "reinvoke the client.") + logger = logging.getLogger(__name__) @@ -67,21 +70,21 @@ def _report_successful_dry_run(config): reporter_util.HIGH_PRIORITY, on_crash=False) +def _auth_from_available(le_client, config, domains=None, certname=None, lineage=None): + """Authenticate and enroll certificate. -def _auth_from_domains(le_client, config, domains, lineage=None): - """Authenticate and enroll certificate.""" - # Note: This can raise errors... caught above us though. This is now - # a three-way case: reinstall (which results in a no-op here because - # although there is a relevant lineage, we don't do anything to it - # inside this function -- we don't obtain a new certificate), renew - # (which results in treating the request as a renewal), or newcert - # (which results in treating the request as a new certificate request). + This method finds the relevant lineage, figures out what to do with it, + then performs that action. Includes calls to hooks, various reports, + checks, and requests for user input. + :returns: Tuple of (str action, cert_or_None) as per _find_lineage_for_domains_and_certname + action can be: "newcert" | "renew" | "reinstall" + """ # If lineage is specified, use that one instead of looking around for # a matching one. if lineage is None: # This will find a relevant matching lineage that exists - action, lineage = _treat_as_renewal(config, domains) + action, lineage = _find_lineage_for_domains_and_certname(config, domains, certname) else: # Renewal, where we already know the specific lineage we're # interested in @@ -91,17 +94,17 @@ def _auth_from_domains(le_client, config, domains, lineage=None): # The lineage already exists; allow the caller to try installing # it without getting a new certificate at all. logger.info("Keeping the existing certificate") - return lineage, "reinstall" + return "reinstall", lineage hooks.pre_hook(config) try: if action == "renew": logger.info("Renewing an existing certificate") - renewal.renew_cert(config, domains, le_client, lineage) + renewal.renew_cert(config, le_client, lineage) elif action == "newcert": # TREAT AS NEW REQUEST logger.info("Obtaining a new certificate") - lineage = le_client.obtain_and_enroll_certificate(domains) + lineage = le_client.obtain_and_enroll_certificate(domains, certname) if lineage is False: raise errors.Error("Certificate could not be obtained") finally: @@ -110,7 +113,7 @@ def _auth_from_domains(le_client, config, domains, lineage=None): if not config.dry_run and not config.verb == "renew": _report_new_cert(config, lineage.cert, lineage.fullchain) - return lineage, action + return action, lineage def _handle_subset_cert_request(config, domains, cert): @@ -118,7 +121,7 @@ def _handle_subset_cert_request(config, domains, cert): :param storage.RenewableCert cert: - :returns: Tuple of (str action, cert_or_None) as per _treat_as_renewal + :returns: Tuple of (str action, cert_or_None) as per _find_lineage_for_domains_and_certname action can be: "newcert" | "renew" | "reinstall" :rtype: tuple @@ -136,7 +139,8 @@ def _handle_subset_cert_request(config, domains, cert): br=os.linesep) if config.expand or config.renew_by_default or zope.component.getUtility( interfaces.IDisplay).yesno(question, "Expand", "Cancel", - cli_flag="--expand"): + cli_flag="--expand", + force_interactive=True): return "renew", cert else: reporter_util = zope.component.getUtility(interfaces.IReporter) @@ -150,32 +154,32 @@ def _handle_subset_cert_request(config, domains, cert): br=os.linesep ), reporter_util.HIGH_PRIORITY) - raise errors.Error( - "User chose to cancel the operation and may " - "reinvoke the client.") + raise errors.Error(USER_CANCELLED) -def _handle_identical_cert_request(config, cert): - """Figure out what to do if a cert has the same names as a previously obtained one +def _handle_identical_cert_request(config, lineage): + """Figure out what to do if a lineage has the same names as a previously obtained one - :param storage.RenewableCert cert: + :param storage.RenewableCert lineage: - :returns: Tuple of (str action, cert_or_None) as per _treat_as_renewal + :returns: Tuple of (str action, cert_or_None) as per _find_lineage_for_domains_and_certname action can be: "newcert" | "renew" | "reinstall" :rtype: tuple """ - if renewal.should_renew(config, cert): - return "renew", cert + if not lineage.ensure_deployed(): + return "reinstall", lineage + if renewal.should_renew(config, lineage): + return "renew", lineage if config.reinstall: # Set with --reinstall, force an identical certificate to be # reinstalled without further prompting. - return "reinstall", cert + return "reinstall", lineage question = ( - "You have an existing certificate that contains exactly the same " - "domains you requested and isn't close to expiry." + "You have an existing certificate that has exactly the same " + "domains or certificate name you requested and isn't close to expiry." "{br}(ref: {0}){br}{br}What would you like to do?" - ).format(cert.configfile.filename, br=os.linesep) + ).format(lineage.configfile.filename, br=os.linesep) if config.verb == "run": keep_opt = "Attempt to reinstall this existing certificate" @@ -185,7 +189,8 @@ def _handle_identical_cert_request(config, cert): "Renew & replace the cert (limit ~5 per 7 days)"] display = zope.component.getUtility(interfaces.IDisplay) - response = display.menu(question, choices, "OK", "Cancel", default=0) + response = display.menu(question, choices, "OK", "Cancel", + default=0, force_interactive=True) if response[0] == display_util.CANCEL: # TODO: Add notification related to command-line options for # skipping the menu for this case. @@ -193,14 +198,13 @@ def _handle_identical_cert_request(config, cert): "User chose to cancel the operation and may " "reinvoke the client.") elif response[1] == 0: - return "reinstall", cert + return "reinstall", lineage elif response[1] == 1: - return "renew", cert + return "renew", lineage else: assert False, "This is impossible" - -def _treat_as_renewal(config, domains): +def _find_lineage_for_domains(config, domains): """Determine whether there are duplicated names and how to handle them (renew, reinstall, newcert, or raising an error to stop the client run if the user chooses to cancel the operation when @@ -220,7 +224,7 @@ def _treat_as_renewal(config, domains): if config.duplicate: return "newcert", None # TODO: Also address superset case - ident_names_cert, subset_names_cert = _find_duplicative_certs(config, domains) + ident_names_cert, subset_names_cert = cert_manager.find_duplicative_certs(config, domains) # XXX ^ schoen is not sure whether that correctly reads the systemwide # configuration file. if ident_names_cert is None and subset_names_cert is None: @@ -231,51 +235,75 @@ def _treat_as_renewal(config, domains): elif subset_names_cert is not None: return _handle_subset_cert_request(config, domains, subset_names_cert) +def _find_lineage_for_domains_and_certname(config, domains, certname): + """Find appropriate lineage based on given domains and/or certname. -def _find_duplicative_certs(config, domains): - """Find existing certs that duplicate the request.""" + :returns: Two-element tuple containing desired new-certificate behavior as + a string token ("reinstall", "renew", or "newcert"), plus either + a RenewableCert instance or None if renewal shouldn't occur. - identical_names_cert, subset_names_cert = None, None + :raises .Error: If the user would like to rerun the client again. - cli_config = configuration.RenewerConfiguration(config) - configs_dir = cli_config.renewal_configs_dir - # Verify the directory is there - util.make_or_verify_dir(configs_dir, mode=0o755, uid=os.geteuid()) + """ + if not certname: + return _find_lineage_for_domains(config, domains) + else: + lineage = cert_manager.lineage_for_certname(config, certname) + if lineage: + if domains: + if set(cert_manager.domains_for_certname(config, certname)) != set(domains): + _ask_user_to_confirm_new_names(config, domains, certname, + lineage.names()) # raises if no + return "renew", lineage + # unnecessarily specified domains or no domains specified + return _handle_identical_cert_request(config, lineage) + else: + if domains: + return "newcert", None + else: + raise errors.ConfigurationError("No certificate with name {0} found. " + "Use -d to specify domains, or run certbot --certificates to see " + "possible certificate names.".format(certname)) - for renewal_file in renewal.renewal_conf_files(cli_config): - try: - candidate_lineage = storage.RenewableCert(renewal_file, cli_config) - except (errors.CertStorageError, IOError): - logger.warning("Renewal conf file %s is broken. Skipping.", renewal_file) - logger.debug("Traceback was:\n%s", traceback.format_exc()) - continue - # TODO: Handle these differently depending on whether they are - # expired or still valid? - candidate_names = set(candidate_lineage.names()) - if candidate_names == set(domains): - identical_names_cert = candidate_lineage - elif candidate_names.issubset(set(domains)): - # This logic finds and returns the largest subset-names cert - # in the case where there are several available. - if subset_names_cert is None: - subset_names_cert = candidate_lineage - elif len(candidate_names) > len(subset_names_cert.names()): - subset_names_cert = candidate_lineage +def _ask_user_to_confirm_new_names(config, new_domains, certname, old_domains): + """Ask user to confirm update cert certname to contain new_domains. + """ + if config.renew_with_new_domains: + return + msg = ("Confirm that you intend to update certificate {0} " + "to include domains {1}. Note that it previously " + "contained domains {2}.".format( + certname, + new_domains, + old_domains)) + obj = zope.component.getUtility(interfaces.IDisplay) + if not obj.yesno(msg, "Update cert", "Cancel", default=True): + raise errors.ConfigurationError("Specified mismatched cert name and domains.") - return identical_names_cert, subset_names_cert - - -def _find_domains(config, installer): +def _find_domains_or_certname(config, installer): + """Retrieve domains and certname from config or user input. + """ + domains = None + certname = config.certname + # first, try to get domains from the config if config.domains: domains = config.domains - else: + # if we can't do that but we have a certname, get the domains + # with that certname + elif certname: + domains = cert_manager.domains_for_certname(config, certname) + + # that certname might not have existed, or there was a problem. + # try to get domains from the user. + if not domains: domains = display_ops.choose_names(installer) - if not domains: + if not domains and not certname: raise errors.Error("Please specify --domains, or --installer that " - "will help in domain names autodiscovery") + "will help in domain names autodiscovery, or " + "--cert-name for an existing certificate name.") - return domains + return domains, certname def _report_new_cert(config, cert_path, fullchain_path): @@ -348,7 +376,8 @@ def _determine_account(config): "server at {1}".format( regr.terms_of_service, config.server)) obj = zope.component.getUtility(interfaces.IDisplay) - return obj.yesno(msg, "Agree", "Cancel", cli_flag="--agree-tos") + return obj.yesno(msg, "Agree", "Cancel", + cli_flag="--agree-tos", force_interactive=True) try: acc, acme = client.register( @@ -430,13 +459,13 @@ def install(config, plugins): except errors.PluginSelectionError as e: return e.message - domains = _find_domains(config, installer) + domains, _ = _find_domains_or_certname(config, installer) le_client = _init_le_client(config, authenticator=None, installer=installer) assert config.cert_path is not None # required=True in the subparser le_client.deploy_certificate( domains, config.key_path, config.cert_path, config.chain_path, config.fullchain_path) - le_client.enhance_config(domains, config) + le_client.enhance_config(domains, config.chain_path) def plugins_cmd(config, plugins): # TODO: Use IDisplay rather than print @@ -478,6 +507,34 @@ def config_changes(config, unused_plugins): """ client.view_config_changes(config, num=config.num) +def update_symlinks(config, unused_plugins): + """Update the certificate file family symlinks + + Use the information in the config file to make symlinks point to + the correct archive directory. + """ + cert_manager.update_live_symlinks(config) + +def rename(config, unused_plugins): + """Rename a certificate + + Use the information in the config file to rename an existing + lineage. + """ + cert_manager.rename_lineage(config) + +def delete(config, unused_plugins): + """Delete a certificate + + Use the information in the config file to delete an existing + lineage. + """ + cert_manager.delete(config) + +def certificates(config, unused_plugins): + """Display information about certs configured with Certbot + """ + cert_manager.certificates(config) def revoke(config, unused_plugins): # TODO: coop with renewal config """Revoke a previously obtained certificate.""" @@ -493,7 +550,12 @@ def revoke(config, unused_plugins): # TODO: coop with renewal config key = acc.key acme = client.acme_from_config_key(config, key) cert = crypto_util.pyopenssl_load_certificate(config.cert_path[1])[0] - acme.revoke(jose.ComparableX509(cert)) + try: + acme.revoke(jose.ComparableX509(cert)) + except acme_errors.ClientError as e: + return e.message + + display_ops.success_revocation(config.cert_path[0]) def run(config, plugins): # pylint: disable=too-many-branches,too-many-locals @@ -505,23 +567,23 @@ def run(config, plugins): # pylint: disable=too-many-branches,too-many-locals except errors.PluginSelectionError as e: return e.message - domains = _find_domains(config, installer) + domains, certname = _find_domains_or_certname(config, installer) # TODO: Handle errors from _init_le_client? le_client = _init_le_client(config, authenticator, installer) - lineage, action = _auth_from_domains(le_client, config, domains) + action, lineage = _auth_from_available(le_client, config, domains, certname) le_client.deploy_certificate( domains, lineage.privkey, lineage.cert, lineage.chain, lineage.fullchain) - le_client.enhance_config(domains, config) + le_client.enhance_config(domains, lineage.chain) - if len(lineage.available_versions("cert")) == 1: + if action in ("newcert", "reinstall",): display_ops.success_installation(domains) else: - display_ops.success_renewal(domains, action) + display_ops.success_renewal(domains) _suggest_donation_if_appropriate(config, action) @@ -543,7 +605,6 @@ def _csr_obtain_cert(config, le_client): certr, chain, config.cert_path, config.chain_path, config.fullchain_path) _report_new_cert(config, cert_path, cert_fullchain) - def obtain_cert(config, plugins, lineage=None): """Authenticate & obtain cert, but do not install it. @@ -561,8 +622,8 @@ def obtain_cert(config, plugins, lineage=None): # SHOWTIME: Possibly obtain/renew a cert, and set action to renew | newcert | reinstall if config.csr is None: # the common case - domains = _find_domains(config, installer) - _, action = _auth_from_domains(le_client, config, domains, lineage) + domains, certname = _find_domains_or_certname(config, installer) + action, _ = _auth_from_available(le_client, config, domains, certname, lineage) else: assert lineage is None, "Did not expect a CSR with a RenewableCert" _csr_obtain_cert(config, le_client) @@ -591,7 +652,7 @@ def obtain_cert(config, plugins, lineage=None): def renew(config, unused_plugins): """Renew previously-obtained certificates.""" try: - renewal.renew_all_lineages(config) + renewal.handle_renewal_request(config) finally: hooks.post_hook(config, final=True) @@ -601,7 +662,7 @@ def setup_log_file_handler(config, logfile, fmt): log_file_path = os.path.join(config.logs_dir, logfile) try: handler = logging.handlers.RotatingFileHandler( - log_file_path, maxBytes=2 ** 20, backupCount=10) + log_file_path, maxBytes=2 ** 20, backupCount=1000) except IOError as error: raise errors.Error(_PERM_ERR_FMT.format(error)) # rotate on each invocation, rollover only possible when maxBytes @@ -615,26 +676,29 @@ def setup_log_file_handler(config, logfile, fmt): return handler, log_file_path -def _cli_log_handler(config, level, fmt): - if config.text_mode or config.noninteractive_mode or config.verb == "renew": - handler = colored_logging.StreamHandler() - handler.setFormatter(logging.Formatter(fmt)) - else: - handler = log.DialogHandler() - # dialog box is small, display as less as possible - handler.setFormatter(logging.Formatter("%(message)s")) +def _cli_log_handler(level, fmt): + handler = colored_logging.StreamHandler() + handler.setFormatter(logging.Formatter(fmt)) handler.setLevel(level) return handler -def setup_logging(config, cli_handler_factory, logfile): - """Setup logging.""" - file_fmt = "%(asctime)s:%(levelname)s:%(name)s:%(message)s" +def setup_logging(config): + """Sets up logging to logfiles and the terminal. + + :param certbot.interface.IConfig config: Configuration object + + """ cli_fmt = "%(message)s" - level = -config.verbose_count * 10 + file_fmt = "%(asctime)s:%(levelname)s:%(name)s:%(message)s" + logfile = "letsencrypt.log" + if config.quiet: + level = constants.QUIET_LOGGING_LEVEL + else: + level = -config.verbose_count * 10 file_handler, log_file_path = setup_log_file_handler( config, logfile=logfile, fmt=file_fmt) - cli_handler = cli_handler_factory(config, level, cli_fmt) + cli_handler = _cli_log_handler(level, cli_fmt) # TODO: use fileConfig? @@ -658,10 +722,8 @@ def _handle_exception(exc_type, exc_value, trace, config): to the user. sys.exit is always called with a nonzero status. """ - logger.debug( - "Exiting abnormally:%s%s", - os.linesep, - "".join(traceback.format_exception(exc_type, exc_value, trace))) + tb_str = "".join(traceback.format_exception(exc_type, exc_value, trace)) + logger.debug("Exiting abnormally:%s%s", os.linesep, tb_str) if issubclass(exc_type, Exception) and (config is None or not config.debug): if config is None: @@ -670,9 +732,11 @@ def _handle_exception(exc_type, exc_value, trace, config): with open(logfile, "w") as logfd: traceback.print_exception( exc_type, exc_value, trace, file=logfd) + assert "--debug" not in sys.argv # config is None if this explodes except: # pylint: disable=bare-except - sys.exit("".join( - traceback.format_exception(exc_type, exc_value, trace))) + sys.exit(tb_str) + if "--debug" in sys.argv: + sys.exit(tb_str) if issubclass(exc_type, errors.Error): sys.exit(exc_value) @@ -680,16 +744,14 @@ def _handle_exception(exc_type, exc_value, trace, config): # Here we're passing a client or ACME error out to the client at the shell # Tell the user a bit about what happened, without overwhelming # them with a full traceback - if issubclass(exc_type, dialog.error): - err = exc_value.complete_message() - else: - err = traceback.format_exception_only(exc_type, exc_value)[0] + err = traceback.format_exception_only(exc_type, exc_value)[0] # Typical error from the ACME module: - # acme.messages.Error: urn:acme:error:malformed :: The request message was - # malformed :: Error creating new registration :: Validation of contact - # mailto:none@longrandomstring.biz failed: Server failure at resolver - if (("urn:acme" in err and ":: " in err and - config.verbose_count <= cli.flag_default("verbose_count"))): + # acme.messages.Error: urn:ietf:params:acme:error:malformed :: The + # request message was malformed :: Error creating new registration + # :: Validation of contact mailto:none@longrandomstring.biz failed: + # Server failure at resolver + if (messages.is_acme_error(err) and ":: " in err and + config.verbose_count <= cli.flag_default("verbose_count")): # prune ACME error code, we have a human description _code, _sep, err = err.partition(":: ") msg = "An unexpected error occurred:\n" + err + "Please see the " @@ -699,8 +761,7 @@ def _handle_exception(exc_type, exc_value, trace, config): msg += "logfiles in {0} for more details.".format(config.logs_dir) sys.exit(msg) else: - sys.exit("".join( - traceback.format_exception(exc_type, exc_value, trace))) + sys.exit(tb_str) def make_or_verify_core_dir(directory, mode, uid, strict): @@ -719,6 +780,30 @@ def make_or_verify_core_dir(directory, mode, uid, strict): except OSError as error: raise errors.Error(_PERM_ERR_FMT.format(error)) +def make_or_verify_needed_dirs(config): + """Create or verify existance of config, work, or logs directories""" + make_or_verify_core_dir(config.config_dir, constants.CONFIG_DIRS_MODE, + os.geteuid(), config.strict_permissions) + make_or_verify_core_dir(config.work_dir, constants.CONFIG_DIRS_MODE, + os.geteuid(), config.strict_permissions) + # TODO: logs might contain sensitive data such as contents of the + # private key! #525 + make_or_verify_core_dir(config.logs_dir, 0o700, + os.geteuid(), config.strict_permissions) + + +def set_displayer(config): + """Set the displayer""" + if config.quiet: + config.noninteractive_mode = True + displayer = display_util.NoninteractiveDisplay(open(os.devnull, "w")) + elif config.noninteractive_mode: + displayer = display_util.NoninteractiveDisplay(sys.stdout) + else: + displayer = display_util.FileDisplay(sys.stdout, + config.force_interactive) + zope.component.provideUtility(displayer) + def main(cli_args=sys.argv[1:]): """Command line argument parsing and main script execution.""" @@ -730,17 +815,12 @@ def main(cli_args=sys.argv[1:]): config = configuration.NamespaceConfig(args) zope.component.provideUtility(config) - make_or_verify_core_dir(config.config_dir, constants.CONFIG_DIRS_MODE, - os.geteuid(), config.strict_permissions) - make_or_verify_core_dir(config.work_dir, constants.CONFIG_DIRS_MODE, - os.geteuid(), config.strict_permissions) - # TODO: logs might contain sensitive data such as contents of the - # private key! #525 - make_or_verify_core_dir(config.logs_dir, 0o700, - os.geteuid(), config.strict_permissions) + make_or_verify_needed_dirs(config) + # Setup logging ASAP, otherwise "No handlers could be found for # logger ..." TODO: this should be done before plugins discovery - setup_logging(config, _cli_log_handler, logfile='letsencrypt.log') + setup_logging(config) + cli.possible_deprecation_warning(config) logger.debug("certbot version: %s", certbot.__version__) @@ -750,17 +830,7 @@ def main(cli_args=sys.argv[1:]): sys.excepthook = functools.partial(_handle_exception, config=config) - # Displayer - if config.quiet: - config.noninteractive_mode = True - displayer = display_util.NoninteractiveDisplay(open(os.devnull, "w")) - elif config.noninteractive_mode: - displayer = display_util.NoninteractiveDisplay(sys.stdout) - elif config.text_mode: - displayer = display_util.FileDisplay(sys.stdout) - else: - displayer = display_util.NcursesDisplay() - zope.component.provideUtility(displayer) + set_displayer(config) # Reporter report = reporter.Reporter(config) diff --git a/certbot/ocsp.py b/certbot/ocsp.py new file mode 100644 index 000000000..2e0514a44 --- /dev/null +++ b/certbot/ocsp.py @@ -0,0 +1,109 @@ +"""Tools for checking certificate revocation.""" +import logging + +from subprocess import Popen, PIPE + +from certbot import errors +from certbot import util + +logger = logging.getLogger(__name__) + +class RevocationChecker(object): + "This class figures out OCSP checking on this system, and performs it." + + def __init__(self): + self.broken = False + + if not util.exe_exists("openssl"): + logging.info("openssl not installed, can't check revocation") + self.broken = True + return + + # New versions of openssl want -header var=val, old ones want -header var val + test_host_format = Popen(["openssl", "ocsp", "-header", "var", "val"], + stdout=PIPE, stderr=PIPE, universal_newlines=True) + _out, err = test_host_format.communicate() + if "Missing =" in err: + self.host_args = lambda host: ["Host=" + host] + else: + self.host_args = lambda host: ["Host", host] + + + def ocsp_revoked(self, cert_path, chain_path): + """Get revoked status for a particular cert version. + + .. todo:: Make this a non-blocking call + + :param str cert_path: Path to certificate + :param str chain_path: Path to intermediate cert + :rtype bool or None: + :returns: True if revoked; False if valid or the check failed + + """ + if self.broken: + return False + + + logger.debug("Querying OCSP for %s", cert_path) + url, host = self.determine_ocsp_server(cert_path) + if not host: + return False + # jdkasten thanks "Bulletproof SSL and TLS - Ivan Ristic" for documenting this! + cmd = ["openssl", "ocsp", + "-no_nonce", + "-issuer", chain_path, + "-cert", cert_path, + "-url", url, + "-CAfile", chain_path, + "-verify_other", chain_path, + "-header"] + self.host_args(host) + try: + output, err = util.run_script(cmd, log=logging.debug) + except errors.SubprocessError as e: + logger.info("OCSP check failed for %s (are we offline?)", cert_path) + logger.debug("Command was:\n%s\nError was:\n%s", " ".join(cmd), e) + return False + + return _translate_ocsp_query(cert_path, output, err) + + + def determine_ocsp_server(self, cert_path): + """Extract the OCSP server host from a certificate. + + :param str cert_path: Path to the cert we're checking OCSP for + :rtype tuple: + :returns: (OCSP server URL or None, OCSP server host or None) + + """ + try: + url, _err = util.run_script( + ["openssl", "x509", "-in", cert_path, "-noout", "-ocsp_uri"], + log=logging.debug) + except errors.SubprocessError as e: + logger.info("Cannot extract OCSP URI from %s", cert_path) + logger.debug("Error was:\n%s", e) + return None, None + + url = url.rstrip() + host = url.partition("://")[2].rstrip("/") + if host: + return url, host + else: + logger.info("Cannot process OCSP host from URL (%s) in cert at %s", url, cert_path) + return None, None + +def _translate_ocsp_query(cert_path, ocsp_output, ocsp_errors): + """Parse openssl's weird output to work out what it means.""" + + if not "Response verify OK" in ocsp_errors: + logger.info("Revocation status for %s is unknown", cert_path) + logger.debug("Uncertain ouput:\n%s\nstderr:\n%s", ocsp_output, ocsp_errors) + return False + if cert_path + ": good" in ocsp_output: + return False + elif cert_path + ": revoked" in ocsp_output: + return True + else: + logger.warn("Unable to properly parse OCSP output: %s", ocsp_output) + return False + diff --git a/certbot/plugins/common.py b/certbot/plugins/common.py index 007105c7b..46d4c5740 100644 --- a/certbot/plugins/common.py +++ b/certbot/plugins/common.py @@ -127,17 +127,18 @@ class Addr(object): return "%s:%s" % self.tup return self.tup[0] + def normalized_tuple(self): + """Normalized representation of addr/port tuple + """ + if self.ipv6: + return (self._normalize_ipv6(self.tup[0]), self.tup[1]) + return self.tup + def __eq__(self, other): if isinstance(other, self.__class__): - if self.ipv6: - # compare normalized to take different - # styles of representation into account - return (other.ipv6 and - self._normalize_ipv6(self.tup[0]) == - self._normalize_ipv6(other.tup[0]) and - self.tup[1] == other.tup[1]) - else: - return self.tup == other.tup + # compare normalized to take different + # styles of representation into account + return self.normalized_tuple() == other.normalized_tuple() return False diff --git a/certbot/plugins/common_test.py b/certbot/plugins/common_test.py index f3ea714c4..eee768e18 100644 --- a/certbot/plugins/common_test.py +++ b/certbot/plugins/common_test.py @@ -10,7 +10,7 @@ from acme import jose from certbot import achallenges from certbot.tests import acme_util -from certbot.tests import test_util +from certbot.tests import util as test_util class NamespaceFunctionsTest(unittest.TestCase): diff --git a/certbot/plugins/disco.py b/certbot/plugins/disco.py index 59410757c..ba532eb1b 100644 --- a/certbot/plugins/disco.py +++ b/certbot/plugins/disco.py @@ -53,6 +53,14 @@ class PluginEntryPoint(object): """Description with name. Handy for UI.""" return "{0} ({1})".format(self.description, self.name) + @property + def long_description(self): + """Long description of the plugin.""" + try: + return self.plugin_cls.long_description + except AttributeError: + return self.description + @property def hidden(self): """Should this plugin be hidden from UI?""" @@ -255,4 +263,4 @@ class PluginsRegistry(collections.Mapping): def __str__(self): if not self._plugins: return "No plugins" - return "\n\n".join(str(p_ep) for p_ep in self._plugins.itervalues()) + return "\n\n".join(str(p_ep) for p_ep in six.itervalues(self._plugins)) diff --git a/certbot/plugins/disco_test.py b/certbot/plugins/disco_test.py index cef6ede8f..7282c9ec8 100644 --- a/certbot/plugins/disco_test.py +++ b/certbot/plugins/disco_test.py @@ -3,6 +3,7 @@ import unittest import mock import pkg_resources +import six import zope.interface from certbot import errors @@ -50,20 +51,30 @@ class PluginEntryPointTest(unittest.TestCase): EP_SA: "sa", } - for entry_point, name in names.iteritems(): + for entry_point, name in six.iteritems(names): self.assertEqual( name, PluginEntryPoint.entry_point_to_plugin_name(entry_point)) def test_description(self): - self.assertEqual( - "Automatically use a temporary webserver", - self.plugin_ep.description) + self.assertTrue("temporary webserver" in self.plugin_ep.description) def test_description_with_name(self): self.plugin_ep.plugin_cls = mock.MagicMock(description="Desc") self.assertEqual( "Desc (sa)", self.plugin_ep.description_with_name) + def test_long_description(self): + self.plugin_ep.plugin_cls = mock.MagicMock( + long_description="Long desc") + self.assertEqual( + "Long desc", self.plugin_ep.long_description) + + def test_long_description_nonexistent(self): + self.plugin_ep.plugin_cls = mock.MagicMock( + description="Long desc not found", spec=["description"]) + self.assertEqual( + "Long desc not found", self.plugin_ep.long_description) + def test_ifaces(self): self.assertTrue(self.plugin_ep.ifaces((interfaces.IAuthenticator,))) self.assertFalse(self.plugin_ep.ifaces((interfaces.IInstaller,))) diff --git a/certbot/plugins/manual.py b/certbot/plugins/manual.py index 6c7b822ab..1163e7e7e 100644 --- a/certbot/plugins/manual.py +++ b/certbot/plugins/manual.py @@ -1,47 +1,49 @@ -"""Manual plugin.""" +"""Manual authenticator plugin""" import os -import logging -import pipes -import shutil -import signal -import socket -import subprocess -import sys -import tempfile -import time -import six import zope.component import zope.interface from acme import challenges -from certbot import errors from certbot import interfaces +from certbot import errors +from certbot import hooks from certbot.plugins import common -logger = logging.getLogger(__name__) - - @zope.interface.implementer(interfaces.IAuthenticator) @zope.interface.provider(interfaces.IPluginFactory) class Authenticator(common.Plugin): - """Manual Authenticator. + """Manual authenticator - This plugin requires user's manual intervention in setting up a HTTP - server for solving http-01 challenges and thus does not need to be - run as a privileged process. Alternatively shows instructions on how - to use Python's built-in HTTP server. - - .. todo:: Support for `~.challenges.TLSSNI01`. + This plugin allows the user to perform the domain validation + challenge(s) themselves. This either be done manually by the user or + through shell scripts provided to Certbot. """ + + description = 'Manual configuration or run your own shell scripts' hidden = True + long_description = ( + 'Authenticate through manual configuration or custom shell scripts. ' + 'When using shell scripts, an authenticator script must be provided. ' + 'The environment variables available to this script are ' + '$CERTBOT_DOMAIN which contains the domain being authenticated, ' + '$CERTBOT_VALIDATION which is the validation string, and ' + '$CERTBOT_TOKEN which is the filename of the resource requested when ' + 'performing an HTTP-01 challenge. An additional cleanup script can ' + 'also be provided and can use the additional variable ' + '$CERTBOT_AUTH_OUTPUT which contains the stdout output from the auth ' + 'script.') + _DNS_INSTRUCTIONS = """\ +Please deploy a DNS TXT record under the name +{domain} with the following value: - description = "Manually configure an HTTP server" +{validation} - MESSAGE_TEMPLATE = """\ +Once this is deployed,""" + _HTTP_INSTRUCTIONS = """\ Make sure your web server displays the following content at {uri} before continuing: @@ -50,155 +52,114 @@ Make sure your web server displays the following content at If you don't have HTTP server configured, you can run the following command on the target server (as root): -{command} -""" - - # a disclaimer about your current IP being transmitted to Let's Encrypt's servers. - IP_DISCLAIMER = """\ -NOTE: The IP of this machine will be publicly logged as having requested this certificate. \ -If you're running certbot in manual mode on a machine that is not your server, \ -please ensure you're okay with that. - -Are you OK with your IP being logged? -""" - - # "cd /tmp/certbot" makes sure user doesn't serve /root, - # separate "public_html" ensures that cert.pem/key.pem are not - # served and makes it more obvious that Python command will serve - # anything recursively under the cwd - - CMD_TEMPLATE = """\ -mkdir -p {root}/public_html/{achall.URI_ROOT_PATH} -cd {root}/public_html +mkdir -p /tmp/certbot/public_html/{achall.URI_ROOT_PATH} +cd /tmp/certbot/public_html printf "%s" {validation} > {achall.URI_ROOT_PATH}/{encoded_token} # run only once per server: $(command -v python2 || command -v python2.7 || command -v python2.6) -c \\ "import BaseHTTPServer, SimpleHTTPServer; \\ s = BaseHTTPServer.HTTPServer(('', {port}), SimpleHTTPServer.SimpleHTTPRequestHandler); \\ s.serve_forever()" """ - """Command template.""" def __init__(self, *args, **kwargs): super(Authenticator, self).__init__(*args, **kwargs) - self._root = (tempfile.mkdtemp() if self.conf("test-mode") - else "/tmp/certbot") - self._httpd = None + self.env = dict() @classmethod def add_parser_arguments(cls, add): - add("test-mode", action="store_true", - help="Test mode. Executes the manual command in subprocess.") - add("public-ip-logging-ok", action="store_true", - help="Automatically allows public IP logging.") + add('auth-hook', + help='Path or command to execute for the authentication script') + add('cleanup-hook', + help='Path or command to execute for the cleanup script') + add('public-ip-logging-ok', action='store_true', + help='Automatically allows public IP logging (default: Ask)') - def prepare(self): # pylint: disable=missing-docstring,no-self-use - if self.config.noninteractive_mode and not self.conf("test-mode"): - raise errors.PluginError("Running manual mode non-interactively is not supported") + def prepare(self): # pylint: disable=missing-docstring + if self.config.noninteractive_mode and not self.conf('auth-hook'): + raise errors.PluginError( + 'An authentication script must be provided with --{0} when ' + 'using the manual plugin non-interactively.'.format( + self.option_name('auth-hook'))) + self._validate_hooks() + + def _validate_hooks(self): + if self.config.validate_hooks: + for name in ('auth-hook', 'cleanup-hook'): + hook = self.conf(name) + if hook is not None: + hook_prefix = self.option_name(name)[:-len('-hook')] + hooks.validate_hook(hook, hook_prefix) def more_info(self): # pylint: disable=missing-docstring,no-self-use - return ("This plugin requires user's manual intervention in setting " - "up an HTTP server for solving http-01 challenges and thus " - "does not need to be run as a privileged process. " - "Alternatively shows instructions on how to use Python's " - "built-in HTTP server.") + return ( + 'This plugin allows the user to customize setup for domain ' + 'validation challenges either through shell scripts provided by ' + 'the user or by performing the setup manually.') def get_chall_pref(self, domain): # pylint: disable=missing-docstring,no-self-use,unused-argument - return [challenges.HTTP01] + return [challenges.HTTP01, challenges.DNS01] def perform(self, achalls): # pylint: disable=missing-docstring + self._verify_ip_logging_ok() + + if self.conf('auth-hook'): + perform_achall = self._perform_achall_with_script + else: + perform_achall = self._perform_achall_manually + responses = [] - # TODO: group achalls by the same socket.gethostbyname(_ex) - # and prompt only once per server (one "echo -n" per domain) for achall in achalls: - responses.append(self._perform_single(achall)) + perform_achall(achall) + responses.append(achall.response(achall.account_key)) return responses - @classmethod - def _test_mode_busy_wait(cls, port): - while True: - time.sleep(1) - sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) - try: - sock.connect(("localhost", port)) - except socket.error: # pragma: no cover - pass + def _verify_ip_logging_ok(self): + if not self.conf('public-ip-logging-ok'): + cli_flag = '--{0}'.format(self.option_name('public-ip-logging-ok')) + msg = ('NOTE: The IP of this machine will be publicly logged as ' + "having requested this certificate. If you're running " + 'certbot in manual mode on a machine that is not your ' + "server, please ensure you're okay with that.\n\n" + 'Are you OK with your IP being logged?') + display = zope.component.getUtility(interfaces.IDisplay) + if display.yesno(msg, cli_flag=cli_flag, force_interactive=True): + setattr(self.config, self.dest('public-ip-logging-ok'), True) else: - break - finally: - sock.close() + raise errors.PluginError('Must agree to IP logging to proceed') - def _perform_single(self, achall): - # same path for each challenge response would be easier for - # users, but will not work if multiple domains point at the - # same server: default command doesn't support virtual hosts - response, validation = achall.response_and_validation() - - port = (response.port if self.config.http01_port is None - else int(self.config.http01_port)) - command = self.CMD_TEMPLATE.format( - root=self._root, achall=achall, response=response, - # TODO(kuba): pipes still necessary? - validation=pipes.quote(validation), - encoded_token=achall.chall.encode("token"), - port=port) - if self.conf("test-mode"): - logger.debug("Test mode. Executing the manual command: %s", command) - # sh shipped with OS X does't support echo -n, but supports printf - try: - self._httpd = subprocess.Popen( - command, - # don't care about setting stdout and stderr, - # we're in test mode anyway - shell=True, - executable=None, - # "preexec_fn" is UNIX specific, but so is "command" - preexec_fn=os.setsid) - except OSError as error: # ValueError should not happen! - logger.debug( - "Couldn't execute manual command: %s", error, exc_info=True) - return False - logger.debug("Manual command running as PID %s.", self._httpd.pid) - # give it some time to bootstrap, before we try to verify - # (cert generation in case of simpleHttpS might take time) - self._test_mode_busy_wait(port) - if self._httpd.poll() is not None: - raise errors.Error("Couldn't execute manual command") + def _perform_achall_with_script(self, achall): + env = dict(CERTBOT_DOMAIN=achall.domain, + CERTBOT_VALIDATION=achall.validation(achall.account_key)) + if isinstance(achall.chall, challenges.HTTP01): + env['CERTBOT_TOKEN'] = achall.chall.encode('token') else: - if not self.conf("public-ip-logging-ok"): - if not zope.component.getUtility(interfaces.IDisplay).yesno( - self.IP_DISCLAIMER, "Yes", "No", - cli_flag="--manual-public-ip-logging-ok"): - raise errors.PluginError("Must agree to IP logging to proceed") + os.environ.pop('CERTBOT_TOKEN', None) + os.environ.update(env) + _, out = hooks.execute(self.conf('auth-hook')) + env['CERTBOT_AUTH_OUTPUT'] = out.strip() + self.env[achall.domain] = env - self._notify_and_wait(self.MESSAGE_TEMPLATE.format( - validation=validation, response=response, - uri=achall.chall.uri(achall.domain), - command=command)) + def _perform_achall_manually(self, achall): + validation = achall.validation(achall.account_key) + if isinstance(achall.chall, challenges.HTTP01): + msg = self._HTTP_INSTRUCTIONS.format( + achall=achall, encoded_token=achall.chall.encode('token'), + port=self.config.http01_port, + uri=achall.chall.uri(achall.domain), validation=validation) + else: + assert isinstance(achall.chall, challenges.DNS01) + msg = self._DNS_INSTRUCTIONS.format( + domain=achall.validation_domain_name(achall.domain), + validation=validation) + display = zope.component.getUtility(interfaces.IDisplay) + display.notification(msg, wrap=False, force_interactive=True) - if not response.simple_verify( - achall.chall, achall.domain, - achall.account_key.public_key(), self.config.http01_port): - logger.warning("Self-verify of challenge failed.") - - return response - - def _notify_and_wait(self, message): # pylint: disable=no-self-use - # TODO: IDisplay wraps messages, breaking the command - #answer = zope.component.getUtility(interfaces.IDisplay).notification( - # message=message, height=25, pause=True) - sys.stdout.write(message) - six.moves.input("Press ENTER to continue") - - def cleanup(self, achalls): - # pylint: disable=missing-docstring,no-self-use,unused-argument - if self.conf("test-mode"): - assert self._httpd is not None, ( - "cleanup() must be called after perform()") - if self._httpd.poll() is None: - logger.debug("Terminating manual command process") - os.killpg(self._httpd.pid, signal.SIGTERM) - else: - logger.debug("Manual command process already terminated " - "with %s code", self._httpd.returncode) - shutil.rmtree(self._root) + def cleanup(self, achalls): # pylint: disable=missing-docstring + if self.conf('cleanup-hook'): + for achall in achalls: + env = self.env.pop(achall.domain) + if 'CERTBOT_TOKEN' not in env: + os.environ.pop('CERTBOT_TOKEN', None) + os.environ.update(env) + hooks.execute(self.conf('cleanup-hook')) diff --git a/certbot/plugins/manual_test.py b/certbot/plugins/manual_test.py index af1dc9909..247352256 100644 --- a/certbot/plugins/manual_test.py +++ b/certbot/plugins/manual_test.py @@ -1,113 +1,112 @@ -"""Tests for certbot.plugins.manual.""" -import signal +"""Tests for certbot.plugins.manual""" +import os import unittest +import six import mock from acme import challenges -from acme import jose -from certbot import achallenges from certbot import errors - from certbot.tests import acme_util -from certbot.tests import test_util - - -KEY = jose.JWKRSA.load(test_util.load_vector("rsa512_key.pem")) class AuthenticatorTest(unittest.TestCase): """Tests for certbot.plugins.manual.Authenticator.""" def setUp(self): - from certbot.plugins.manual import Authenticator + self.http_achall = acme_util.HTTP01_A + self.dns_achall = acme_util.DNS01_A + self.achalls = [self.http_achall, self.dns_achall] self.config = mock.MagicMock( - http01_port=8080, manual_test_mode=False, - manual_public_ip_logging_ok=False, noninteractive_mode=True) - self.auth = Authenticator(config=self.config, name="manual") - self.achalls = [achallenges.KeyAuthorizationAnnotatedChallenge( - challb=acme_util.HTTP01_P, domain="foo.com", account_key=KEY)] + http01_port=0, manual_auth_hook=None, manual_cleanup_hook=None, + manual_public_ip_logging_ok=False, noninteractive_mode=False, + validate_hooks=False) - config_test_mode = mock.MagicMock( - http01_port=8080, manual_test_mode=True, noninteractive_mode=True) - self.auth_test_mode = Authenticator( - config=config_test_mode, name="manual") + from certbot.plugins.manual import Authenticator + self.auth = Authenticator(self.config, name='manual') - def test_prepare(self): + def test_prepare_no_hook_noninteractive(self): + self.config.noninteractive_mode = True self.assertRaises(errors.PluginError, self.auth.prepare) - self.auth_test_mode.prepare() # error not raised + + def test_prepare_bad_hook(self): + self.config.manual_auth_hook = os.path.abspath(os.sep) # is / on UNIX + self.config.validate_hooks = True + self.assertRaises(errors.HookCommandNotFound, self.auth.prepare) def test_more_info(self): - self.assertTrue(isinstance(self.auth.more_info(), str)) + self.assertTrue(isinstance(self.auth.more_info(), six.string_types)) def test_get_chall_pref(self): - self.assertTrue(all(issubclass(pref, challenges.Challenge) - for pref in self.auth.get_chall_pref("foo.com"))) + self.assertEqual(self.auth.get_chall_pref('example.org'), + [challenges.HTTP01, challenges.DNS01]) - def test_perform_empty(self): - self.assertEqual([], self.auth.perform([])) + @mock.patch('certbot.plugins.manual.zope.component.getUtility') + def test_ip_logging_not_ok(self, mock_get_utility): + mock_get_utility().yesno.return_value = False + self.assertRaises(errors.PluginError, self.auth.perform, []) - @mock.patch("certbot.plugins.manual.zope.component.getUtility") - @mock.patch("certbot.plugins.manual.sys.stdout") - @mock.patch("acme.challenges.HTTP01Response.simple_verify") - @mock.patch("__builtin__.raw_input") - def test_perform(self, mock_raw_input, mock_verify, mock_stdout, mock_interaction): - mock_verify.return_value = True - mock_interaction().yesno.return_value = True + @mock.patch('certbot.plugins.manual.zope.component.getUtility') + def test_ip_logging_ok(self, mock_get_utility): + mock_get_utility().yesno.return_value = True + self.auth.perform([]) + self.assertTrue(self.config.manual_public_ip_logging_ok) - resp = self.achalls[0].response(KEY) - self.assertEqual([resp], self.auth.perform(self.achalls)) - self.assertEqual(1, mock_raw_input.call_count) - mock_verify.assert_called_with( - self.achalls[0].challb.chall, "foo.com", KEY.public_key(), 8080) + def test_script_perform(self): + self.config.manual_public_ip_logging_ok = True + self.config.manual_auth_hook = ( + 'echo $CERTBOT_DOMAIN; echo ${CERTBOT_TOKEN:-notoken}; ' + 'echo $CERTBOT_VALIDATION;') + dns_expected = '{0}\n{1}\n{2}'.format( + self.dns_achall.domain, 'notoken', + self.dns_achall.validation(self.dns_achall.account_key)) + http_expected = '{0}\n{1}\n{2}'.format( + self.http_achall.domain, self.http_achall.chall.encode('token'), + self.http_achall.validation(self.http_achall.account_key)) - message = mock_stdout.write.mock_calls[0][1][0] - self.assertTrue(self.achalls[0].chall.encode("token") in message) + self.assertEqual( + self.auth.perform(self.achalls), + [achall.response(achall.account_key) for achall in self.achalls]) + self.assertEqual( + self.auth.env[self.dns_achall.domain]['CERTBOT_AUTH_OUTPUT'], + dns_expected) + self.assertEqual( + self.auth.env[self.http_achall.domain]['CERTBOT_AUTH_OUTPUT'], + http_expected) - mock_verify.return_value = False - with mock.patch("certbot.plugins.manual.logger") as mock_logger: - self.auth.perform(self.achalls) - mock_logger.warning.assert_called_once_with(mock.ANY) + @mock.patch('certbot.plugins.manual.zope.component.getUtility') + def test_manual_perform(self, mock_get_utility): + self.config.manual_public_ip_logging_ok = True + self.assertEqual( + self.auth.perform(self.achalls), + [achall.response(achall.account_key) for achall in self.achalls]) + for i, (args, kwargs) in enumerate(mock_get_utility().notification.call_args_list): + achall = self.achalls[i] + self.assertTrue(achall.validation(achall.account_key) in args[0]) + self.assertFalse(kwargs['wrap']) - @mock.patch("certbot.plugins.manual.zope.component.getUtility") - @mock.patch("certbot.plugins.manual.Authenticator._notify_and_wait") - def test_disagree_with_ip_logging(self, mock_notify, mock_interaction): - mock_interaction().yesno.return_value = False - mock_notify.side_effect = errors.Error("Exception not raised, \ - continued execution even after disagreeing with IP logging") + def test_cleanup(self): + self.config.manual_public_ip_logging_ok = True + self.config.manual_auth_hook = 'echo foo;' + self.config.manual_cleanup_hook = '# cleanup' + self.auth.perform(self.achalls) - self.assertRaises(errors.PluginError, self.auth.perform, self.achalls) + for achall in self.achalls: + self.auth.cleanup([achall]) + self.assertEqual(os.environ['CERTBOT_AUTH_OUTPUT'], 'foo') + self.assertEqual(os.environ['CERTBOT_DOMAIN'], achall.domain) + self.assertEqual( + os.environ['CERTBOT_VALIDATION'], + achall.validation(achall.account_key)) - @mock.patch("certbot.plugins.manual.subprocess.Popen", autospec=True) - def test_perform_test_command_oserror(self, mock_popen): - mock_popen.side_effect = OSError - self.assertEqual([False], self.auth_test_mode.perform(self.achalls)) - - @mock.patch("certbot.plugins.manual.socket.socket") - @mock.patch("certbot.plugins.manual.time.sleep", autospec=True) - @mock.patch("certbot.plugins.manual.subprocess.Popen", autospec=True) - def test_perform_test_command_run_failure( - self, mock_popen, unused_mock_sleep, unused_mock_socket): - mock_popen.poll.return_value = 10 - mock_popen.return_value.pid = 1234 - self.assertRaises( - errors.Error, self.auth_test_mode.perform, self.achalls) - - def test_cleanup_test_mode_already_terminated(self): - # pylint: disable=protected-access - self.auth_test_mode._httpd = httpd = mock.Mock() - httpd.poll.return_value = 0 - self.auth_test_mode.cleanup(self.achalls) - - @mock.patch("certbot.plugins.manual.os.killpg", autospec=True) - def test_cleanup_test_mode_kills_still_running(self, mock_killpg): - # pylint: disable=protected-access - self.auth_test_mode._httpd = httpd = mock.Mock(pid=1234) - httpd.poll.return_value = None - self.auth_test_mode.cleanup(self.achalls) - mock_killpg.assert_called_once_with(1234, signal.SIGTERM) + if isinstance(achall.chall, challenges.HTTP01): + self.assertEqual( + os.environ['CERTBOT_TOKEN'], + achall.chall.encode('token')) + else: + self.assertFalse('CERTBOT_TOKEN' in os.environ) -if __name__ == "__main__": +if __name__ == '__main__': unittest.main() # pragma: no cover diff --git a/certbot/plugins/null.py b/certbot/plugins/null.py index 995b96274..87c0737a5 100644 --- a/certbot/plugins/null.py +++ b/certbot/plugins/null.py @@ -40,9 +40,6 @@ class Installer(common.Plugin): def supported_enhancements(self): return [] - def get_all_certs_keys(self): - return [] - def save(self, title=None, temporary=False): pass # pragma: no cover diff --git a/certbot/plugins/null_test.py b/certbot/plugins/null_test.py index 305954a2f..0d04a2bc5 100644 --- a/certbot/plugins/null_test.py +++ b/certbot/plugins/null_test.py @@ -15,7 +15,6 @@ class InstallerTest(unittest.TestCase): self.assertTrue(isinstance(self.installer.more_info(), str)) self.assertEqual([], self.installer.get_all_names()) self.assertEqual([], self.installer.supported_enhancements()) - self.assertEqual([], self.installer.get_all_certs_keys()) if __name__ == "__main__": diff --git a/certbot/plugins/selection.py b/certbot/plugins/selection.py index b16515d8f..81387c435 100644 --- a/certbot/plugins/selection.py +++ b/certbot/plugins/selection.py @@ -4,6 +4,7 @@ from __future__ import print_function import os import logging +import six import zope.component from certbot import errors @@ -78,7 +79,7 @@ def pick_plugin(config, default, plugins, question, ifaces): if len(prepared) > 1: logger.debug("Multiple candidate plugins: %s", prepared) - plugin_ep = choose_plugin(prepared.values(), question) + plugin_ep = choose_plugin(list(six.itervalues(prepared)), question) if plugin_ep is None: return None else: @@ -110,7 +111,8 @@ def choose_plugin(prepared, question): while True: disp = z_util(interfaces.IDisplay) - code, index = disp.menu(question, opts, help_label="More Info") + code, index = disp.menu( + question, opts, help_label="More Info", force_interactive=True) if code == display_util.OK: plugin_ep = prepared[index] @@ -118,8 +120,7 @@ def choose_plugin(prepared, question): z_util(interfaces.IDisplay).notification( "The selected plugin encountered an error while parsing " "your server configuration and cannot be used. The error " - "was:\n\n{0}".format(plugin_ep.prepare()), - height=display_util.HEIGHT, pause=False) + "was:\n\n{0}".format(plugin_ep.prepare()), pause=False) else: return plugin_ep elif code == display_util.HELP: @@ -127,8 +128,8 @@ def choose_plugin(prepared, question): msg = "Reported Error: %s" % prepared[index].prepare() else: msg = prepared[index].init().more_info() - z_util(interfaces.IDisplay).notification( - msg, height=display_util.HEIGHT) + z_util(interfaces.IDisplay).notification(msg, + force_interactive=True) else: return None @@ -260,9 +261,12 @@ def diagnose_configurator_problem(cfg_type, requested, plugins): "your existing configuration.\nThe error was: {1!r}" .format(requested, plugins[requested].problem)) elif cfg_type == "installer": - msg = ('No installer plugins seem to be present and working on your system; ' - 'fix that or try running certbot with the "certonly" command to obtain' - ' a certificate you can install manually') + from certbot.cli import cli_command + msg = ('Certbot doesn\'t know how to automatically configure the web ' + 'server on this system. However, it can still get a certificate for ' + 'you. Please run "{0} certonly" to do so. You\'ll need to ' + 'manually configure your web server to use the resulting ' + 'certificate.').format(cli_command) else: msg = "{0} could not be determined or is not installed".format(cfg_type) raise errors.PluginSelectionError(msg) diff --git a/certbot/plugins/selection_test.py b/certbot/plugins/selection_test.py index 001ca5cff..c0494e565 100644 --- a/certbot/plugins/selection_test.py +++ b/certbot/plugins/selection_test.py @@ -110,7 +110,8 @@ class ChoosePluginTest(unittest.TestCase): """Tests for certbot.plugins.selection.choose_plugin.""" def setUp(self): - zope.component.provideUtility(display_util.FileDisplay(sys.stdout)) + zope.component.provideUtility(display_util.FileDisplay(sys.stdout, + False)) self.mock_apache = mock.Mock( description_with_name="a", misconfigured=True) self.mock_stand = mock.Mock( diff --git a/certbot/plugins/standalone.py b/certbot/plugins/standalone.py index 8e1cb72a4..4fc52479f 100644 --- a/certbot/plugins/standalone.py +++ b/certbot/plugins/standalone.py @@ -3,6 +3,7 @@ import argparse import collections import logging import socket +import sys import threading import OpenSSL @@ -12,6 +13,7 @@ import zope.interface from acme import challenges from acme import standalone as acme_standalone +from certbot import cli from certbot import errors from certbot import interfaces @@ -119,6 +121,11 @@ def supported_challenges_validator(data): It should be passed as `type` argument to `add_argument`. """ + if cli.set_by_cli("standalone_supported_challenges"): + sys.stderr.write( + "WARNING: The standalone specific " + "supported challenges flag is deprecated.\n" + "Please use the --preferred-challenges flag instead.\n") challs = data.split(",") # tls-sni-01 was dvsni during private beta @@ -154,7 +161,7 @@ class Authenticator(common.Plugin): rely on any existing server program. """ - description = "Automatically use a temporary webserver" + description = "Spin up a temporary webserver" def __init__(self, *args, **kwargs): super(Authenticator, self).__init__(*args, **kwargs) @@ -177,7 +184,7 @@ class Authenticator(common.Plugin): @classmethod def add_parser_arguments(cls, add): add("supported-challenges", - help="Supported challenges. Preferred in the order they are listed.", + help=argparse.SUPPRESS, type=supported_challenges_validator, default=",".join(chall.typ for chall in SUPPORTED_CHALLENGES)) @@ -187,15 +194,6 @@ class Authenticator(common.Plugin): return [challenges.Challenge.TYPES[name] for name in self.conf("supported-challenges").split(",")] - @property - def _necessary_ports(self): - necessary_ports = set() - if challenges.HTTP01 in self.supported_challenges: - necessary_ports.add(self.config.http01_port) - if challenges.TLSSNI01 in self.supported_challenges: - necessary_ports.add(self.config.tls_sni_01_port) - return necessary_ports - def more_info(self): # pylint: disable=missing-docstring return("This authenticator creates its own ephemeral TCP listener " "on the necessary port in order to respond to incoming " @@ -210,12 +208,30 @@ class Authenticator(common.Plugin): # pylint: disable=unused-argument,missing-docstring return self.supported_challenges - def perform(self, achalls): # pylint: disable=missing-docstring - renewer = self.config.verb == "renew" - if any(util.already_listening(port, renewer) for port in self._necessary_ports): + def _verify_ports_are_available(self, achalls): + """Confirm the ports are available to solve all achalls. + + :param list achalls: list of + :class:`~certbot.achallenges.AnnotatedChallenge` + + :raises .errors.MisconfigurationError: if required port is + unavailable + + """ + ports = [] + if any(isinstance(ac.chall, challenges.HTTP01) for ac in achalls): + ports.append(self.config.http01_port) + if any(isinstance(ac.chall, challenges.TLSSNI01) for ac in achalls): + ports.append(self.config.tls_sni_01_port) + + renewer = (self.config.verb == "renew") + + if any(util.already_listening(port, renewer) for port in ports): raise errors.MisconfigurationError( - "At least one of the (possibly) required ports is " - "already taken.") + "At least one of the required ports is already taken.") + + def perform(self, achalls): # pylint: disable=missing-docstring + self._verify_ports_are_available(achalls) try: return self.perform2(achalls) @@ -227,13 +243,13 @@ class Authenticator(common.Plugin): "Could not bind TCP port {0} because you don't have " "the appropriate permissions (for example, you " "aren't running this program as " - "root).".format(error.port)) + "root).".format(error.port), force_interactive=True) elif error.socket_error.errno == socket.errno.EADDRINUSE: display.notification( "Could not bind TCP port {0} because it is already in " "use by another process on this system (such as a web " "server). Please stop the program in question and then " - "try again.".format(error.port)) + "try again.".format(error.port), force_interactive=True) else: raise # XXX: How to handle unknown errors in binding? diff --git a/certbot/plugins/standalone_test.py b/certbot/plugins/standalone_test.py index eb6631732..249d409b5 100644 --- a/certbot/plugins/standalone_test.py +++ b/certbot/plugins/standalone_test.py @@ -15,7 +15,7 @@ from certbot import errors from certbot import interfaces from certbot.tests import acme_util -from certbot.tests import test_util +from certbot.tests import util as test_util class ServerManagerTest(unittest.TestCase): @@ -67,10 +67,25 @@ class ServerManagerTest(unittest.TestCase): class SupportedChallengesValidatorTest(unittest.TestCase): """Tests for plugins.standalone.supported_challenges_validator.""" + def setUp(self): + self.set_by_cli_patch = mock.patch( + "certbot.plugins.standalone.cli.set_by_cli") + self.stderr_patch = mock.patch("certbot.plugins.standalone.sys.stderr") + + self.set_by_cli_patch.start().return_value = True + self.stderr = self.stderr_patch.start() + + def tearDown(self): + self.set_by_cli_patch.stop() + self.stderr_patch.stop() + def _call(self, data): from certbot.plugins.standalone import ( supported_challenges_validator) - return supported_challenges_validator(data) + return_value = supported_challenges_validator(data) + self.assertTrue(self.stderr.write.called) # pylint: disable=no-member + self.stderr.write.reset_mock() # pylint: disable=no-member + return return_value def test_correct(self): self.assertEqual("tls-sni-01", self._call("tls-sni-01")) @@ -91,13 +106,22 @@ class SupportedChallengesValidatorTest(unittest.TestCase): self.assertEqual("tls-sni-01,http-01", self._call("dvsni,http-01")) +def get_open_port(): + """Gets an open port number from the OS.""" + open_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM, 0) + open_socket.bind(("", 0)) + port = open_socket.getsockname()[1] + open_socket.close() + return port + class AuthenticatorTest(unittest.TestCase): """Tests for certbot.plugins.standalone.Authenticator.""" def setUp(self): from certbot.plugins.standalone import Authenticator + self.config = mock.MagicMock( - tls_sni_01_port=1234, http01_port=4321, + tls_sni_01_port=get_open_port(), http01_port=get_open_port(), standalone_supported_challenges="tls-sni-01,http-01") self.auth = Authenticator(self.config, name="standalone") @@ -122,35 +146,49 @@ class AuthenticatorTest(unittest.TestCase): self.assertEqual(self.auth.get_chall_pref(domain=None), [challenges.TLSSNI01]) + @classmethod + def _get_achalls(cls): + domain = b'localhost' + key = jose.JWK.load(test_util.load_vector('rsa512_key.pem')) + http_01 = achallenges.KeyAuthorizationAnnotatedChallenge( + challb=acme_util.HTTP01_P, domain=domain, account_key=key) + tls_sni_01 = achallenges.KeyAuthorizationAnnotatedChallenge( + challb=acme_util.TLSSNI01_P, domain=domain, account_key=key) + + return [http_01, tls_sni_01] + @mock.patch("certbot.plugins.standalone.util") def test_perform_already_listening(self, mock_util): - for chall, port in ((challenges.TLSSNI01.typ, 1234), - (challenges.HTTP01.typ, 4321)): + http_01, tls_sni_01 = self._get_achalls() + + for achall, port in ((http_01, self.config.http01_port,), + (tls_sni_01, self.config.tls_sni_01_port)): mock_util.already_listening.return_value = True - self.config.standalone_supported_challenges = chall self.assertRaises( - errors.MisconfigurationError, self.auth.perform, []) + errors.MisconfigurationError, self.auth.perform, [achall]) mock_util.already_listening.assert_called_once_with(port, False) mock_util.already_listening.reset_mock() @mock.patch("certbot.plugins.standalone.zope.component.getUtility") def test_perform(self, unused_mock_get_utility): - achalls = [1, 2, 3] + achalls = self._get_achalls() + self.auth.perform2 = mock.Mock(return_value=mock.sentinel.responses) self.assertEqual(mock.sentinel.responses, self.auth.perform(achalls)) self.auth.perform2.assert_called_once_with(achalls) @mock.patch("certbot.plugins.standalone.zope.component.getUtility") def _test_perform_bind_errors(self, errno, achalls, mock_get_utility): + port = get_open_port() def _perform2(unused_achalls): - raise errors.StandaloneBindError(mock.Mock(errno=errno), 1234) + raise errors.StandaloneBindError(mock.Mock(errno=errno), port) self.auth.perform2 = mock.MagicMock(side_effect=_perform2) self.auth.perform(achalls) mock_get_utility.assert_called_once_with(interfaces.IDisplay) notification = mock_get_utility.return_value.notification self.assertEqual(1, notification.call_count) - self.assertTrue("1234" in notification.call_args[0][0]) + self.assertTrue(str(port) in notification.call_args[0][0]) def test_perform_eacces(self): # pylint: disable=no-value-for-parameter @@ -166,12 +204,7 @@ class AuthenticatorTest(unittest.TestCase): socket.errno.ENOTCONN, []) def test_perform2(self): - domain = b'localhost' - key = jose.JWK.load(test_util.load_vector('rsa512_key.pem')) - http_01 = achallenges.KeyAuthorizationAnnotatedChallenge( - challb=acme_util.HTTP01_P, domain=domain, account_key=key) - tls_sni_01 = achallenges.KeyAuthorizationAnnotatedChallenge( - challb=acme_util.TLSSNI01_P, domain=domain, account_key=key) + http_01, tls_sni_01 = self._get_achalls() self.auth.servers = mock.MagicMock() @@ -187,12 +220,12 @@ class AuthenticatorTest(unittest.TestCase): self.assertTrue(isinstance(responses[1], challenges.TLSSNI01Response)) self.assertEqual(self.auth.servers.run.mock_calls, [ - mock.call(4321, challenges.HTTP01), - mock.call(1234, challenges.TLSSNI01), + mock.call(self.config.http01_port, challenges.HTTP01), + mock.call(self.config.tls_sni_01_port, challenges.TLSSNI01), ]) self.assertEqual(self.auth.served, { - "server1234": set([tls_sni_01]), - "server4321": set([http_01]), + "server" + str(self.config.tls_sni_01_port): set([tls_sni_01]), + "server" + str(self.config.http01_port): set([http_01]), }) self.assertEqual(1, len(self.auth.http_01_resources)) self.assertEqual(1, len(self.auth.certs)) diff --git a/certbot/plugins/util.py b/certbot/plugins/util.py index b97ca1afd..1964ae349 100644 --- a/certbot/plugins/util.py +++ b/certbot/plugins/util.py @@ -5,13 +5,19 @@ import socket import zope.component +from acme import errors as acme_errors +from acme import util as acme_util + from certbot import interfaces from certbot import util +PSUTIL_REQUIREMENT = "psutil>=2.2.1" + try: - import psutil + acme_util.activate(PSUTIL_REQUIREMENT) + import psutil # pragma: no cover USE_PSUTIL = True -except ImportError: +except acme_errors.DependencyError: # pragma: no cover USE_PSUTIL = False logger = logging.getLogger(__name__) @@ -85,6 +91,7 @@ def already_listening_socket(port, renewer=False): try: testsocket = socket.socket(socket.AF_INET, socket.SOCK_STREAM, 0) + testsocket.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1) try: testsocket.bind(("", port)) except socket.error: @@ -96,7 +103,7 @@ def already_listening_socket(port, renewer=False): "Port {0} is already in use by another process. This will " "prevent us from binding to that port. Please stop the " "process that is populating the port in question and try " - "again. {1}".format(port, extra), height=13) + "again. {1}".format(port, extra), force_interactive=True) return True finally: testsocket.close() @@ -145,7 +152,7 @@ def already_listening_psutil(port, renewer=False): "on TCP port {2}. This will prevent us from binding to " "that port. Please stop the {0} program temporarily " "and then try again.{3}".format(name, pid, port, extra), - height=13) + force_interactive=True) return True except (psutil.NoSuchProcess, psutil.AccessDenied): # Perhaps the result of a race where the process could have diff --git a/certbot/plugins/util_test.py b/certbot/plugins/util_test.py index a9466ed63..7ec8d6aa8 100644 --- a/certbot/plugins/util_test.py +++ b/certbot/plugins/util_test.py @@ -1,16 +1,12 @@ """Tests for certbot.plugins.util.""" import os +import socket import unittest -import sys import mock -try: - # Python 3.5+ - from importlib import reload as refresh # pylint: disable=no-name-in-module -except ImportError: - # Python 2-3.4 - from imp import reload as refresh +from certbot.plugins.util import PSUTIL_REQUIREMENT +from certbot.tests import util as test_util class PathSurgeryTest(unittest.TestCase): @@ -38,55 +34,47 @@ class PathSurgeryTest(unittest.TestCase): self.assertTrue("/tmp" in os.environ["PATH"]) -class AlreadyListeningTestNoPsutil(unittest.TestCase): +class AlreadyListeningTest(unittest.TestCase): + """Tests for certbot.plugins.already_listening.""" + @classmethod + def _call(cls, *args, **kwargs): + from certbot.plugins.util import already_listening + return already_listening(*args, **kwargs) + + +class AlreadyListeningTestNoPsutil(AlreadyListeningTest): """Tests for certbot.plugins.already_listening when psutil is not available""" - def setUp(self): - import certbot.plugins.util - # Ensure we get importerror - self.psutil = None - if "psutil" in sys.modules: - self.psutil = sys.modules['psutil'] - sys.modules['psutil'] = None - # Reload hackery to ensure getting non-psutil version - # loaded to memory - refresh(certbot.plugins.util) - - def tearDown(self): - # Need to reload the module to ensure - # getting back to normal - import certbot.plugins.util - sys.modules["psutil"] = self.psutil - refresh(certbot.plugins.util) + @classmethod + def _call(cls, *args, **kwargs): + with mock.patch("certbot.plugins.util.USE_PSUTIL", False): + return super( + AlreadyListeningTestNoPsutil, cls)._call(*args, **kwargs) @mock.patch("certbot.plugins.util.zope.component.getUtility") def test_ports_available(self, mock_getutil): - import certbot.plugins.util as plugins_util # Ensure we don't get error - with mock.patch("socket._socketobject.bind"): - self.assertFalse(plugins_util.already_listening(80)) - self.assertFalse(plugins_util.already_listening(80, True)) + with mock.patch("socket.socket.bind"): + self.assertFalse(self._call(80)) + self.assertFalse(self._call(80, True)) self.assertEqual(mock_getutil.call_count, 0) @mock.patch("certbot.plugins.util.zope.component.getUtility") def test_ports_blocked(self, mock_getutil): - sys.modules["psutil"] = None - import certbot.plugins.util as plugins_util - import socket - with mock.patch("socket._socketobject.bind", side_effect=socket.error): - self.assertTrue(plugins_util.already_listening(80)) - self.assertTrue(plugins_util.already_listening(80, True)) - with mock.patch("socket.socket", side_effect=socket.error): - self.assertFalse(plugins_util.already_listening(80)) + with mock.patch("certbot.plugins.util.socket.socket.bind") as mock_bind: + mock_bind.side_effect = socket.error + self.assertTrue(self._call(80)) + self.assertTrue(self._call(80, True)) + with mock.patch("certbot.plugins.util.socket.socket") as mock_socket: + mock_socket.side_effect = socket.error + self.assertFalse(self._call(80)) self.assertEqual(mock_getutil.call_count, 2) -class AlreadyListeningTestPsutil(unittest.TestCase): +@test_util.skip_unless(test_util.requirement_available(PSUTIL_REQUIREMENT), + "optional dependency psutil is not available") +class AlreadyListeningTestPsutil(AlreadyListeningTest): """Tests for certbot.plugins.already_listening.""" - def _call(self, *args, **kwargs): - from certbot.plugins.util import already_listening - return already_listening(*args, **kwargs) - @mock.patch("certbot.plugins.util.psutil.net_connections") @mock.patch("certbot.plugins.util.psutil.Process") @mock.patch("certbot.plugins.util.zope.component.getUtility") diff --git a/certbot/plugins/webroot.py b/certbot/plugins/webroot.py index 624ee2ff4..09671f989 100644 --- a/certbot/plugins/webroot.py +++ b/certbot/plugins/webroot.py @@ -45,7 +45,7 @@ to serve all files under specified web root ({0}).""" "times to handle different domains; each domain will have " "the webroot path that preceded it. For instance: `-w " "/var/www/example -d example.com -d www.example.com -w " - "/var/www/thing -d thing.net -d m.thing.net`") + "/var/www/thing -d thing.net -d m.thing.net` (default: Ask)") add("map", default={}, action=_WebrootMapAction, help="JSON dictionary mapping domains to webroot paths; this " "implies -d for each entry. You may need to escape this from " @@ -129,7 +129,8 @@ to serve all files under specified web root ({0}).""" "public_html or webroot directory. The webroot " "plugin works by temporarily saving necessary " "resources in the HTTP server's webroot directory " - "to pass domain validation challenges.") + "to pass domain validation challenges.", + force_interactive=True) else: # code == display_util.OK return None if index == 0 else known_webroots[index - 1] @@ -138,11 +139,11 @@ to serve all files under specified web root ({0}).""" while True: code, webroot = display.directory_select( - "Input the webroot for {0}:".format(domain)) + "Input the webroot for {0}:".format(domain), + force_interactive=True) if code == display_util.HELP: - # Help can currently only be selected - # when using the ncurses interface - display.notification(display_util.DSELECT_HELP) + # Displaying help is not currently implemented + return None elif code == display_util.CANCEL: return None else: # code == display_util.OK @@ -206,7 +207,7 @@ to serve all files under specified web root ({0}).""" old_umask = os.umask(0o022) try: - with open(validation_path, "w") as validation_file: + with open(validation_path, "wb") as validation_file: validation_file.write(validation.encode()) finally: os.umask(old_umask) diff --git a/certbot/plugins/webroot_test.py b/certbot/plugins/webroot_test.py index 5d784a75c..aca5544c3 100644 --- a/certbot/plugins/webroot_test.py +++ b/certbot/plugins/webroot_test.py @@ -21,7 +21,7 @@ from certbot import errors from certbot.display import util as display_util from certbot.tests import acme_util -from certbot.tests import test_util +from certbot.tests import util as test_util KEY = jose.JWKRSA.load(test_util.load_vector("rsa512_key.pem")) @@ -111,8 +111,7 @@ class AuthenticatorTest(unittest.TestCase): self.assertTrue(mock_display.notification.called) for call in mock_display.notification.call_args_list: - self.assertTrue(imaginary_dir in call[0][0] or - display_util.DSELECT_HELP == call[0][0]) + self.assertTrue(imaginary_dir in call[0][0]) self.assertTrue(mock_display.directory_select.called) for call in mock_display.directory_select.call_args_list: diff --git a/certbot/renewal.py b/certbot/renewal.py index af54b7345..639e6b5a4 100644 --- a/certbot/renewal.py +++ b/certbot/renewal.py @@ -1,7 +1,6 @@ """Functionality for autorenewal and associated juggling of configurations""" from __future__ import print_function import copy -import glob import logging import os import traceback @@ -11,9 +10,7 @@ import zope.component import OpenSSL -from certbot import configuration from certbot import cli -from certbot import constants from certbot import crypto_util from certbot import errors @@ -33,20 +30,15 @@ logger = logging.getLogger(__name__) STR_CONFIG_ITEMS = ["config_dir", "logs_dir", "work_dir", "user_agent", "server", "account", "authenticator", "installer", "standalone_supported_challenges", "ecdsa_curve", - "key_types"] + "key_types", "renew_hook"] INT_CONFIG_ITEMS = ["rsa_key_size", "tls_sni_01_port", "http01_port"] -def renewal_conf_files(config): - """Return /path/to/*.conf in the renewal conf directory""" - return glob.glob(os.path.join(config.renewal_configs_dir, "*.conf")) - - def _reconstitute(config, full_path): """Try to instantiate a RenewableCert, updating config with relevant items. This is specifically for use in renewal and enforces several checks - and policies to ensure that we can try to proceed with the renwal + and policies to ensure that we can try to proceed with the renewal request. The config argument is modified by including relevant options read from the renewal configuration file. @@ -60,8 +52,7 @@ def _reconstitute(config, full_path): """ try: - renewal_candidate = storage.RenewableCert( - full_path, configuration.RenewerConfiguration(config)) + renewal_candidate = storage.RenewableCert(full_path, config) except (errors.CertStorageError, IOError) as exc: logger.warning(exc) logger.warning("Renewal configuration file %s is broken. Skipping.", full_path) @@ -145,6 +136,7 @@ def _restore_plugin_configs(config, renewalparams): if renewalparams.get("installer", None) is not None: plugin_prefixes.append(renewalparams["installer"]) for plugin_prefix in set(plugin_prefixes): + plugin_prefix = plugin_prefix.replace('-', '_') for config_item, config_value in six.iteritems(renewalparams): if config_item.startswith(plugin_prefix + "_") and not cli.set_by_cli(config_item): # Values None, True, and False need to be treated specially, @@ -210,9 +202,6 @@ def should_renew(config, lineage): def _avoid_invalidating_lineage(config, lineage, original_server): "Do not renew a valid cert with one from a staging server!" - def _is_staging(srv): - return srv == constants.STAGING_URI or "staging" in srv - # Some lineages may have begun with --staging, but then had production certs # added to them latest_cert = OpenSSL.crypto.load_certificate( @@ -221,8 +210,8 @@ def _avoid_invalidating_lineage(config, lineage, original_server): # we should test more methodically now_valid = "fake" not in repr(latest_cert.get_issuer()).lower() - if _is_staging(config.server): - if not _is_staging(original_server) or now_valid: + if util.is_staging(config.server): + if not util.is_staging(original_server) or now_valid: if not config.break_my_certs: names = ", ".join(lineage.names()) raise errors.Error( @@ -231,12 +220,12 @@ def _avoid_invalidating_lineage(config, lineage, original_server): "unless you use the --break-my-certs flag!".format(names)) -def renew_cert(config, domains, le_client, lineage): +def renew_cert(config, le_client, lineage): "Renew a certificate lineage." renewal_params = lineage.configuration["renewalparams"] original_server = renewal_params.get("server", cli.flag_default("server")) _avoid_invalidating_lineage(config, lineage, original_server) - new_certr, new_chain, new_key, _ = le_client.obtain_certificate(domains) + new_certr, new_chain, new_key, _ = le_client.obtain_certificate(lineage.names()) if config.dry_run: logger.debug("Dry run: skipping updating lineage at %s", os.path.dirname(lineage.cert)) @@ -245,12 +234,11 @@ def renew_cert(config, domains, le_client, lineage): new_cert = OpenSSL.crypto.dump_certificate( OpenSSL.crypto.FILETYPE_PEM, new_certr.body.wrapped) new_chain = crypto_util.dump_pyopenssl_chain(new_chain) - renewal_conf = configuration.RenewerConfiguration(config.namespace) # TODO: Check return value of save_successor - lineage.save_successor(prior_version, new_cert, new_key.pem, new_chain, renewal_conf) + lineage.save_successor(prior_version, new_cert, new_key.pem, new_chain, config) lineage.update_all_links_to(lineage.latest_common_version()) - hooks.renew_hook(config, domains, lineage.live_dir) + hooks.renew_hook(config, lineage.names(), lineage.live_dir) def report(msgs, category): @@ -301,26 +289,31 @@ def _renew_describe_results(config, renew_successes, renew_failures, print("\n".join(out)) -def renew_all_lineages(config): +def handle_renewal_request(config): """Examine each lineage; renew if due and report results""" # This is trivially False if config.domains is empty if any(domain not in config.webroot_map for domain in config.domains): # If more plugins start using cli.add_domains, # we may want to only log a warning here - raise errors.Error("Currently, the renew verb is only capable of " + raise errors.Error("Currently, the renew verb is capable of either " "renewing all installed certificates that are due " - "to be renewed; individual domains cannot be " - "specified with this action. If you would like to " - "renew specific certificates, use the certonly " + "to be renewed or renewing a single certificate specified " + "by its name. If you would like to renew specific " + "certificates by their domains, use the certonly " "command. The renew verb may provide other options " "for selecting certificates to renew in the future.") - renewer_config = configuration.RenewerConfiguration(config) + + if config.certname: + conf_files = [storage.renewal_file_for_certname(config, config.certname)] + else: + conf_files = storage.renewal_conf_files(config) + renew_successes = [] renew_failures = [] renew_skipped = [] parse_failures = [] - for renewal_file in renewal_conf_files(renewer_config): + for renewal_file in conf_files: disp = zope.component.getUtility(interfaces.IDisplay) disp.notification("Processing " + renewal_file, pause=False) lineage_config = copy.deepcopy(config) @@ -342,6 +335,7 @@ def renew_all_lineages(config): else: # XXX: ensure that each call here replaces the previous one zope.component.provideUtility(lineage_config) + renewal_candidate.ensure_deployed() if should_renew(lineage_config, renewal_candidate): plugins = plugins_disco.PluginsRegistry.find_all() from certbot import main diff --git a/certbot/reverter.py b/certbot/reverter.py index 1c404e29b..32355782e 100644 --- a/certbot/reverter.py +++ b/certbot/reverter.py @@ -7,7 +7,7 @@ import shutil import time import traceback - +import six import zope.component from certbot import constants @@ -15,8 +15,6 @@ from certbot import errors from certbot import interfaces from certbot import util -from certbot.display import util as display_util - logger = logging.getLogger(__name__) @@ -183,7 +181,7 @@ class Reverter(object): if for_logging: return os.linesep.join(output) zope.component.getUtility(interfaces.IDisplay).notification( - os.linesep.join(output), display_util.HEIGHT) + os.linesep.join(output), force_interactive=True) def add_to_temp_checkpoint(self, save_files, save_notes): """Add files to temporary checkpoint. @@ -310,7 +308,9 @@ class Reverter(object): def _run_undo_commands(self, filepath): # pylint: disable=no-self-use """Run all commands in a file.""" - with open(filepath, 'rb') as csvfile: + # NOTE: csv module uses native strings. That is, bytes on Python 2 and + # unicode on Python 3 + with open(filepath, 'r') as csvfile: csvreader = csv.reader(csvfile) for command in reversed(list(csvreader)): try: @@ -408,9 +408,9 @@ class Reverter(object): command_file = None try: if os.path.isfile(commands_fp): - command_file = open(commands_fp, "ab") + command_file = open(commands_fp, "a") else: - command_file = open(commands_fp, "wb") + command_file = open(commands_fp, "w") csvwriter = csv.writer(command_file) csvwriter.writerow(command) @@ -569,7 +569,7 @@ class Reverter(object): # It is possible save checkpoints faster than 1 per second resulting in # collisions in the naming convention. - for _ in xrange(2): + for _ in six.moves.range(2): timestamp = self._checkpoint_timestamp() final_dir = os.path.join(self.config.backup_dir, timestamp) try: diff --git a/certbot/storage.py b/certbot/storage.py index 82fdbfd54..e4fc21a85 100644 --- a/certbot/storage.py +++ b/certbot/storage.py @@ -1,5 +1,6 @@ """Renewable certificates storage.""" import datetime +import glob import logging import os import re @@ -7,6 +8,7 @@ import re import configobj import parsedatetime import pytz +import shutil import six import certbot @@ -20,9 +22,22 @@ from certbot import util logger = logging.getLogger(__name__) ALL_FOUR = ("cert", "privkey", "chain", "fullchain") +README = "README" CURRENT_VERSION = util.get_strict_version(certbot.__version__) +def renewal_conf_files(config): + """Return /path/to/*.conf in the renewal conf directory""" + return glob.glob(os.path.join(config.renewal_configs_dir, "*.conf")) + +def renewal_file_for_certname(config, certname): + """Return /path/to/certname.conf in the renewal conf directory""" + path = os.path.join(config.renewal_configs_dir, "{0}.conf".format(certname)) + if not os.path.exists(path): + raise errors.CertStorageError("No certificate found with name {0} (expected " + "{1}).".format(certname, path)) + return path + def config_with_defaults(config=None): """Merge supplied config, if provided, on top of builtin defaults.""" defaults_copy = configobj.ConfigObj(constants.RENEWER_DEFAULTS) @@ -54,11 +69,12 @@ def add_time_interval(base_time, interval, textparser=parsedatetime.Calendar()): return textparser.parseDT(interval, base_time, tzinfo=tzinfo)[0] -def write_renewal_config(o_filename, n_filename, target, relevant_data): +def write_renewal_config(o_filename, n_filename, archive_dir, target, relevant_data): """Writes a renewal config file with the specified name and values. :param str o_filename: Absolute path to the previous version of config file :param str n_filename: Absolute path to the new destination of config file + :param str archive_dir: Absolute path to the archive directory :param dict target: Maps ALL_FOUR to their symlink paths :param dict relevant_data: Renewal configuration options to save @@ -68,6 +84,7 @@ def write_renewal_config(o_filename, n_filename, target, relevant_data): """ config = configobj.ConfigObj(o_filename) config["version"] = certbot.__version__ + config["archive_dir"] = archive_dir for kind in ALL_FOUR: config[kind] = target[kind] @@ -90,25 +107,42 @@ def write_renewal_config(o_filename, n_filename, target, relevant_data): # TODO: add human-readable comments explaining other available # parameters logger.debug("Writing new config %s.", n_filename) - with open(n_filename, "w") as f: + with open(n_filename, "wb") as f: config.write(outfile=f) return config +def rename_renewal_config(prev_name, new_name, cli_config): + """Renames cli_config.certname's config to cli_config.new_certname. -def update_configuration(lineagename, target, cli_config): + :param .NamespaceConfig cli_config: parsed command line + arguments + """ + prev_filename = renewal_filename_for_lineagename(cli_config, prev_name) + new_filename = renewal_filename_for_lineagename(cli_config, new_name) + if os.path.exists(new_filename): + raise errors.ConfigurationError("The new certificate name " + "is already in use.") + try: + os.rename(prev_filename, new_filename) + except OSError: + raise errors.ConfigurationError("Please specify a valid filename " + "for the new certificate name.") + + +def update_configuration(lineagename, archive_dir, target, cli_config): """Modifies lineagename's config to contain the specified values. :param str lineagename: Name of the lineage being modified + :param str archive_dir: Absolute path to the archive directory :param dict target: Maps ALL_FOUR to their symlink paths - :param .RenewerConfiguration cli_config: parsed command line + :param .NamespaceConfig cli_config: parsed command line arguments :returns: Configuration object for the updated config file :rtype: configobj.ConfigObj """ - config_filename = os.path.join( - cli_config.renewal_configs_dir, lineagename) + ".conf" + config_filename = renewal_filename_for_lineagename(cli_config, lineagename) temp_filename = config_filename + ".new" # If an existing tempfile exists, delete it @@ -117,7 +151,7 @@ def update_configuration(lineagename, target, cli_config): # Save only the config items that are relevant to renewal values = relevant_values(vars(cli_config.namespace)) - write_renewal_config(config_filename, temp_filename, target, values) + write_renewal_config(config_filename, temp_filename, archive_dir, target, values) os.rename(temp_filename, config_filename) return configobj.ConfigObj(config_filename) @@ -168,8 +202,109 @@ def relevant_values(all_values): for option, value in six.iteritems(all_values) if _relevant(option) and cli.option_was_set(option, value)) +def lineagename_for_filename(config_filename): + """Returns the lineagename for a configuration filename. + """ + if not config_filename.endswith(".conf"): + raise errors.CertStorageError( + "renewal config file name must end in .conf") + return os.path.basename(config_filename[:-len(".conf")]) -class RenewableCert(object): # pylint: disable=too-many-instance-attributes +def renewal_filename_for_lineagename(config, lineagename): + """Returns the lineagename for a configuration filename. + """ + return os.path.join(config.renewal_configs_dir, lineagename) + ".conf" + +def _relpath_from_file(archive_dir, from_file): + """Path to a directory from a file""" + return os.path.relpath(archive_dir, os.path.dirname(from_file)) + +def _full_archive_path(config_obj, cli_config, lineagename): + """Returns the full archive path for a lineagename + + Uses cli_config to determine archive path if not available from config_obj. + + :param configobj.ConfigObj config_obj: Renewal conf file contents (can be None) + :param configuration.NamespaceConfig cli_config: Main config file + :param str lineagename: Certificate name + """ + if config_obj and "archive_dir" in config_obj: + return config_obj["archive_dir"] + else: + return os.path.join(cli_config.default_archive_dir, lineagename) + +def _full_live_path(cli_config, lineagename): + """Returns the full default live path for a lineagename""" + return os.path.join(cli_config.live_dir, lineagename) + +def delete_files(config, certname): + """Delete all files related to the certificate. + + If some files are not found, ignore them and continue. + """ + renewal_filename = renewal_file_for_certname(config, certname) + # file exists + full_default_archive_dir = _full_archive_path(None, config, certname) + full_default_live_dir = _full_live_path(config, certname) + try: + renewal_config = configobj.ConfigObj(renewal_filename) + except configobj.ConfigObjError: + # config is corrupted + logger.warning("Could not parse %s. You may wish to manually " + "delete the contents of %s and %s.", renewal_filename, + full_default_live_dir, full_default_archive_dir) + raise errors.CertStorageError( + "error parsing {0}".format(renewal_filename)) + finally: + # we couldn't read it, but let's at least delete it + # if this was going to fail, it already would have. + os.remove(renewal_filename) + logger.debug("Removed %s", renewal_filename) + + # cert files and (hopefully) live directory + # it's not guaranteed that the files are in our default storage + # structure. so, first delete the cert files. + directory_names = set() + for kind in ALL_FOUR: + link = renewal_config.get(kind) + try: + os.remove(link) + logger.debug("Removed %s", link) + except OSError: + logger.debug("Unable to delete %s", link) + directory = os.path.dirname(link) + directory_names.add(directory) + + # if all four were in the same directory, and the only thing left + # is the README file (or nothing), delete that directory. + # this will be wrong in very few but some cases. + if len(directory_names) == 1: + # delete the README file + directory = directory_names.pop() + readme_path = os.path.join(directory, README) + try: + os.remove(readme_path) + logger.debug("Removed %s", readme_path) + except OSError: + logger.debug("Unable to delete %s", readme_path) + # if it's now empty, delete the directory + try: + os.rmdir(directory) # only removes empty directories + logger.debug("Removed %s", directory) + except OSError: + logger.debug("Unable to remove %s; may not be empty.", directory) + + # archive directory + try: + archive_path = _full_archive_path(renewal_config, config, certname) + shutil.rmtree(archive_path) + logger.debug("Removed %s", archive_path) + except OSError: + logger.debug("Unable to remove %s", archive_path) + + +class RenewableCert(object): + # pylint: disable=too-many-instance-attributes,too-many-public-methods """Renewable certificate. Represents a lineage of certificates that is under the management of @@ -204,23 +339,19 @@ class RenewableCert(object): # pylint: disable=too-many-instance-attributes renewal configuration file and/or systemwide defaults. """ - def __init__(self, config_filename, cli_config): + def __init__(self, config_filename, cli_config, update_symlinks=False): """Instantiate a RenewableCert object from an existing lineage. :param str config_filename: the path to the renewal config file that defines this lineage. - :param .RenewerConfiguration: parsed command line arguments + :param .NamespaceConfig: parsed command line arguments :raises .CertStorageError: if the configuration file's name didn't end in ".conf", or the file is missing or broken. """ self.cli_config = cli_config - if not config_filename.endswith(".conf"): - raise errors.CertStorageError( - "renewal config file name must end in .conf") - self.lineagename = os.path.basename( - config_filename[:-len(".conf")]) + self.lineagename = lineagename_for_filename(config_filename) # self.configuration should be used to read parameters that # may have been chosen based on default values from the @@ -256,8 +387,41 @@ class RenewableCert(object): # pylint: disable=too-many-instance-attributes self.live_dir = os.path.dirname(self.cert) self._fix_symlinks() + if update_symlinks: + self._update_symlinks() self._check_symlinks() + @property + def target_expiry(self): + """The current target certificate's expiration datetime + + :returns: Expiration datetime of the current target certificate + :rtype: :class:`datetime.datetime` + """ + return crypto_util.notAfter(self.current_target("cert")) + + @property + def archive_dir(self): + """Returns the default or specified archive directory""" + return _full_archive_path(self.configuration, + self.cli_config, self.lineagename) + + def relative_archive_dir(self, from_file): + """Returns the default or specified archive directory as a relative path + + Used for creating symbolic links. + """ + return _relpath_from_file(self.archive_dir, from_file) + + @property + def is_test_cert(self): + """Returns true if this is a test cert from a staging server.""" + server = self.configuration["renewalparams"].get("server", None) + if server: + return util.is_staging(server) + else: + return False + def _check_symlinks(self): """Raises an exception if a symlink doesn't exist""" for kind in ALL_FOUR: @@ -270,6 +434,17 @@ class RenewableCert(object): # pylint: disable=too-many-instance-attributes raise errors.CertStorageError("target {0} of symlink {1} does " "not exist".format(target, link)) + def _update_symlinks(self): + """Updates symlinks to use archive_dir""" + for kind in ALL_FOUR: + link = getattr(self, kind) + previous_link = get_link_target(link) + new_link = os.path.join(self.relative_archive_dir(link), + os.path.basename(previous_link)) + + os.unlink(link) + os.symlink(new_link, link) + def _consistent(self): """Are the files associated with this lineage self-consistent? @@ -297,16 +472,16 @@ class RenewableCert(object): # pylint: disable=too-many-instance-attributes # Each element's link must point within the cert lineage's # directory within the official archive directory - desired_directory = os.path.join( - self.cli_config.archive_dir, self.lineagename) - if not os.path.samefile(os.path.dirname(target), - desired_directory): + if not os.path.samefile(os.path.dirname(target), self.archive_dir): logger.debug("Element's link does not point within the " "cert lineage's directory within the " "official archive directory. Link: %s, " "target directory: %s, " - "archive directory: %s.", - link, os.path.dirname(target), desired_directory) + "archive directory: %s. If you've specified " + "the archive directory in the renewal configuration " + "file, you may need to update links by running " + "certbot update_symlinks.", + link, os.path.dirname(target), self.archive_dir) return False # The link must point to a file that exists @@ -520,6 +695,22 @@ class RenewableCert(object): # pylint: disable=too-many-instance-attributes # for the others. return max(self.newest_available_version(x) for x in ALL_FOUR) + 1 + def ensure_deployed(self): + """Make sure we've deployed the latest version. + + :returns: False if a change was needed, True otherwise + :rtype: bool + + May need to recover from rare interrupted / crashed states.""" + + if self.has_pending_deployment(): + logger.warn("Found a new cert /archive/ that was not linked to in /live/; " + "fixing...") + self.update_all_links_to(self.latest_common_version()) + return False + return True + + def has_pending_deployment(self): """Is there a later version of all of the managed items? @@ -631,9 +822,8 @@ class RenewableCert(object): # pylint: disable=too-many-instance-attributes if self.has_pending_deployment(): interval = self.configuration.get("deploy_before_expiry", "5 days") - expiry = crypto_util.notAfter(self.current_target("cert")) now = pytz.UTC.fromutc(datetime.datetime.utcnow()) - if expiry < add_time_interval(now, interval): + if self.target_expiry < add_time_interval(now, interval): return True return False @@ -734,7 +924,7 @@ class RenewableCert(object): # pylint: disable=too-many-instance-attributes :param str cert: the initial certificate version in PEM format :param str privkey: the private key in PEM format :param str chain: the certificate chain in PEM format - :param .RenewerConfiguration cli_config: parsed command line + :param .NamespaceConfig cli_config: parsed command line arguments :returns: the newly-created RenewalCert object @@ -743,23 +933,20 @@ class RenewableCert(object): # pylint: disable=too-many-instance-attributes """ # Examine the configuration and find the new lineage's name - for i in (cli_config.renewal_configs_dir, cli_config.archive_dir, + for i in (cli_config.renewal_configs_dir, cli_config.default_archive_dir, cli_config.live_dir): if not os.path.exists(i): os.makedirs(i, 0o700) logger.debug("Creating directory %s.", i) config_file, config_filename = util.unique_lineage_name( cli_config.renewal_configs_dir, lineagename) - if not config_filename.endswith(".conf"): - raise errors.CertStorageError( - "renewal config file name must end in .conf") # Determine where on disk everything will go # lineagename will now potentially be modified based on which # renewal configuration file could actually be created - lineagename = os.path.basename(config_filename)[:-len(".conf")] - archive = os.path.join(cli_config.archive_dir, lineagename) - live_dir = os.path.join(cli_config.live_dir, lineagename) + lineagename = lineagename_for_filename(config_filename) + archive = _full_archive_path(None, cli_config, lineagename) + live_dir = _full_live_path(cli_config, lineagename) if os.path.exists(archive): raise errors.CertStorageError( "archive directory exists for " + lineagename) @@ -770,37 +957,52 @@ class RenewableCert(object): # pylint: disable=too-many-instance-attributes os.mkdir(live_dir) logger.debug("Archive directory %s and live " "directory %s created.", archive, live_dir) - relative_archive = os.path.join("..", "..", "archive", lineagename) # Put the data into the appropriate files on disk target = dict([(kind, os.path.join(live_dir, kind + ".pem")) for kind in ALL_FOUR]) for kind in ALL_FOUR: - os.symlink(os.path.join(relative_archive, kind + "1.pem"), + os.symlink(os.path.join(_relpath_from_file(archive, target[kind]), kind + "1.pem"), target[kind]) - with open(target["cert"], "w") as f: + with open(target["cert"], "wb") as f: logger.debug("Writing certificate to %s.", target["cert"]) f.write(cert) - with open(target["privkey"], "w") as f: + with open(target["privkey"], "wb") as f: logger.debug("Writing private key to %s.", target["privkey"]) f.write(privkey) # XXX: Let's make sure to get the file permissions right here - with open(target["chain"], "w") as f: + with open(target["chain"], "wb") as f: logger.debug("Writing chain to %s.", target["chain"]) f.write(chain) - with open(target["fullchain"], "w") as f: + with open(target["fullchain"], "wb") as f: # assumes that OpenSSL.crypto.dump_certificate includes # ending newline character logger.debug("Writing full chain to %s.", target["fullchain"]) f.write(cert + chain) + # Write a README file to the live directory + readme_path = os.path.join(live_dir, README) + with open(readme_path, "w") as f: + logger.debug("Writing README to %s.", readme_path) + f.write("This directory contains your keys and certificates.\n\n" + "`privkey.pem` : the private key for your certificate.\n" + "`fullchain.pem`: the certificate file used in most server software.\n" + "`chain.pem` : used for OCSP stapling in Nginx >=1.3.7.\n" + "`cert.pem` : will break many server configurations, and " + "should not be used\n" + " without reading further documentation (see link below).\n\n" + "We recommend not moving these files. For more information, see the Certbot\n" + "User Guide at https://certbot.eff.org/docs/using.html#where-are-my-" + "certificates.\n") + # Document what we've done in a new renewal config file config_file.close() # Save only the config items that are relevant to renewal values = relevant_values(vars(cli_config.namespace)) - new_config = write_renewal_config(config_filename, config_filename, target, values) + new_config = write_renewal_config(config_filename, config_filename, archive, + target, values) return cls(new_config.filename, cli_config) def save_successor(self, prior_version, new_cert, @@ -820,7 +1022,7 @@ class RenewableCert(object): # pylint: disable=too-many-instance-attributes :param str new_privkey: the new private key, in PEM format, or ``None``, if the private key has not changed :param str new_chain: the new chain, in PEM format - :param .RenewerConfiguration cli_config: parsed command line + :param .NamespaceConfig cli_config: parsed command line arguments :returns: the new version number that was created @@ -835,14 +1037,9 @@ class RenewableCert(object): # pylint: disable=too-many-instance-attributes self.cli_config = cli_config target_version = self.next_free_version() - archive = self.cli_config.archive_dir - # XXX if anyone ever moves a renewal configuration file, this will - # break... perhaps prefix should be the dirname of the previous - # cert.pem? - prefix = os.path.join(archive, self.lineagename) target = dict( [(kind, - os.path.join(prefix, "{0}{1}.pem".format(kind, target_version))) + os.path.join(self.archive_dir, "{0}{1}.pem".format(kind, target_version))) for kind in ALL_FOUR]) # Distinguish the cases where the privkey has changed and where it @@ -852,7 +1049,7 @@ class RenewableCert(object): # pylint: disable=too-many-instance-attributes # The behavior below keeps the prior key by creating a new # symlink to the old key or the target of the old key symlink. old_privkey = os.path.join( - prefix, "privkey{0}.pem".format(prior_version)) + self.archive_dir, "privkey{0}.pem".format(prior_version)) if os.path.islink(old_privkey): old_privkey = os.readlink(old_privkey) else: @@ -878,7 +1075,7 @@ class RenewableCert(object): # pylint: disable=too-many-instance-attributes symlinks = dict((kind, self.configuration[kind]) for kind in ALL_FOUR) # Update renewal config file self.configfile = update_configuration( - self.lineagename, symlinks, cli_config) + self.lineagename, self.archive_dir, symlinks, cli_config) self.configuration = config_with_defaults(self.configfile) return target_version diff --git a/certbot/tests/account_test.py b/certbot/tests/account_test.py index 4cd2bfebf..1c50025d7 100644 --- a/certbot/tests/account_test.py +++ b/certbot/tests/account_test.py @@ -14,10 +14,10 @@ from acme import messages from certbot import errors -from certbot.tests import test_util +from certbot.tests import util -KEY = jose.JWKRSA.load(test_util.load_vector("rsa512_key_2.pem")) +KEY = jose.JWKRSA.load(util.load_vector("rsa512_key_2.pem")) class AccountTest(unittest.TestCase): @@ -131,8 +131,8 @@ class AccountFileStorageTest(unittest.TestCase): for file_name in "regr.json", "meta.json", "private_key.json": self.assertTrue(os.path.exists( os.path.join(account_path, file_name))) - self.assertEqual("0400", oct(os.stat(os.path.join( - account_path, "private_key.json"))[stat.ST_MODE] & 0o777)) + self.assertTrue(oct(os.stat(os.path.join( + account_path, "private_key.json"))[stat.ST_MODE] & 0o777) in ("0400", "0o400")) # restore self.assertEqual(self.acc, self.storage.load(self.acc.id)) @@ -179,14 +179,14 @@ class AccountFileStorageTest(unittest.TestCase): self.storage.save(self.acc) mock_open = mock.mock_open() mock_open.side_effect = IOError - with mock.patch("__builtin__.open", mock_open): + with mock.patch("six.moves.builtins.open", mock_open): self.assertRaises( errors.AccountStorageError, self.storage.load, self.acc.id) def test_save_ioerrors(self): mock_open = mock.mock_open() mock_open.side_effect = IOError # TODO: [None, None, IOError] - with mock.patch("__builtin__.open", mock_open): + with mock.patch("six.moves.builtins.open", mock_open): self.assertRaises( errors.AccountStorageError, self.storage.save, self.acc) diff --git a/certbot/tests/acme_util.py b/certbot/tests/acme_util.py index 3d33c5723..5e6b190a7 100644 --- a/certbot/tests/acme_util.py +++ b/certbot/tests/acme_util.py @@ -1,24 +1,28 @@ """ACME utilities for testing.""" import datetime -import itertools + +import six from acme import challenges from acme import jose from acme import messages -from certbot.tests import test_util +from certbot import auth_handler + +from certbot.tests import util -KEY = test_util.load_rsa_private_key('rsa512_key.pem') +JWK = jose.JWK.load(util.load_vector('rsa512_key.pem')) +KEY = util.load_rsa_private_key('rsa512_key.pem') # Challenges HTTP01 = challenges.HTTP01( - token="evaGxfADs6pSRb2LAv9IZf17Dt3juxGJ+PCt92wr+oA") + token=b"evaGxfADs6pSRb2LAv9IZf17Dt3juxGJ+PCt92wr+oA") TLSSNI01 = challenges.TLSSNI01( token=jose.b64decode(b"evaGxfADs6pSRb2LAv9IZf17Dt3juxGJyPCt92wrDoA")) -DNS = challenges.DNS(token="17817c66b60ce2e4012dfad92657527a") +DNS01 = challenges.DNS01(token=b"17817c66b60ce2e4012dfad92657527a") -CHALLENGES = [HTTP01, TLSSNI01, DNS] +CHALLENGES = [HTTP01, TLSSNI01, DNS01] def gen_combos(challbs): @@ -44,9 +48,17 @@ def chall_to_challb(chall, status): # pylint: disable=redefined-outer-name # Pending ChallengeBody objects TLSSNI01_P = chall_to_challb(TLSSNI01, messages.STATUS_PENDING) HTTP01_P = chall_to_challb(HTTP01, messages.STATUS_PENDING) -DNS_P = chall_to_challb(DNS, messages.STATUS_PENDING) +DNS01_P = chall_to_challb(DNS01, messages.STATUS_PENDING) -CHALLENGES_P = [HTTP01_P, TLSSNI01_P, DNS_P] +CHALLENGES_P = [HTTP01_P, TLSSNI01_P, DNS01_P] + + +# AnnotatedChallenge objects +HTTP01_A = auth_handler.challb_to_achall(HTTP01_P, JWK, "example.com") +TLSSNI01_A = auth_handler.challb_to_achall(TLSSNI01_P, JWK, "example.net") +DNS01_A = auth_handler.challb_to_achall(DNS01_P, JWK, "example.org") + +ACHALLENGES = [HTTP01_A, TLSSNI01_A, DNS01_A] def gen_authzr(authz_status, domain, challs, statuses, combos=True): @@ -62,7 +74,7 @@ def gen_authzr(authz_status, domain, challs, statuses, combos=True): # pylint: disable=redefined-outer-name challbs = tuple( chall_to_challb(chall, status) - for chall, status in itertools.izip(challs, statuses) + for chall, status in six.moves.zip(challs, statuses) ) authz_kwargs = { "identifier": messages.Identifier( diff --git a/certbot/tests/auth_handler_test.py b/certbot/tests/auth_handler_test.py index eccc36418..9e0add196 100644 --- a/certbot/tests/auth_handler_test.py +++ b/certbot/tests/auth_handler_test.py @@ -4,6 +4,7 @@ import logging import unittest import mock +import six from acme import challenges from acme import client as acme_client @@ -23,7 +24,7 @@ class ChallengeFactoryTest(unittest.TestCase): from certbot.auth_handler import AuthHandler # Account is mocked... - self.handler = AuthHandler(None, None, mock.Mock(key="mock_key")) + self.handler = AuthHandler(None, None, mock.Mock(key="mock_key"), []) self.dom = "test" self.handler.authzr[self.dom] = acme_util.gen_authzr( @@ -73,7 +74,7 @@ class GetAuthorizationsTest(unittest.TestCase): self.mock_net = mock.MagicMock(spec=acme_client.Client) self.handler = AuthHandler( - self.mock_auth, self.mock_net, self.mock_account) + self.mock_auth, self.mock_net, self.mock_account, []) logging.disable(logging.CRITICAL) @@ -93,7 +94,7 @@ class GetAuthorizationsTest(unittest.TestCase): self.assertEqual(mock_poll.call_count, 1) chall_update = mock_poll.call_args[0][0] - self.assertEqual(chall_update.keys(), ["0"]) + self.assertEqual(list(six.iterkeys(chall_update)), ["0"]) self.assertEqual(len(chall_update.values()), 1) self.assertEqual(self.mock_auth.cleanup.call_count, 1) @@ -110,7 +111,7 @@ class GetAuthorizationsTest(unittest.TestCase): mock_poll.side_effect = self._validate_all self.mock_auth.get_chall_pref.return_value.append(challenges.HTTP01) - self.mock_auth.get_chall_pref.return_value.append(challenges.DNS) + self.mock_auth.get_chall_pref.return_value.append(challenges.DNS01) authzr = self.handler.get_authorizations(["0"]) @@ -118,13 +119,13 @@ class GetAuthorizationsTest(unittest.TestCase): self.assertEqual(mock_poll.call_count, 1) chall_update = mock_poll.call_args[0][0] - self.assertEqual(chall_update.keys(), ["0"]) + self.assertEqual(list(six.iterkeys(chall_update)), ["0"]) self.assertEqual(len(chall_update.values()), 1) self.assertEqual(self.mock_auth.cleanup.call_count, 1) # Test if list first element is TLSSNI01, use typ because it is an achall for achall in self.mock_auth.cleanup.call_args[0][0]: - self.assertTrue(achall.typ in ["tls-sni-01", "http-01", "dns"]) + self.assertTrue(achall.typ in ["tls-sni-01", "http-01", "dns-01"]) # Length of authorizations list self.assertEqual(len(authzr), 1) @@ -143,12 +144,12 @@ class GetAuthorizationsTest(unittest.TestCase): # Check poll call self.assertEqual(mock_poll.call_count, 1) chall_update = mock_poll.call_args[0][0] - self.assertEqual(len(chall_update.keys()), 3) - self.assertTrue("0" in chall_update.keys()) + self.assertEqual(len(list(six.iterkeys(chall_update))), 3) + self.assertTrue("0" in list(six.iterkeys(chall_update))) self.assertEqual(len(chall_update["0"]), 1) - self.assertTrue("1" in chall_update.keys()) + self.assertTrue("1" in list(six.iterkeys(chall_update))) self.assertEqual(len(chall_update["1"]), 1) - self.assertTrue("2" in chall_update.keys()) + self.assertTrue("2" in list(six.iterkeys(chall_update))) self.assertEqual(len(chall_update["2"]), 1) self.assertEqual(self.mock_auth.cleanup.call_count, 1) @@ -166,8 +167,31 @@ class GetAuthorizationsTest(unittest.TestCase): def test_no_domains(self): self.assertRaises(errors.AuthorizationError, self.handler.get_authorizations, []) + @mock.patch("certbot.auth_handler.AuthHandler._poll_challenges") + def test_preferred_challenge_choice(self, mock_poll): + self.mock_net.request_domain_challenges.side_effect = functools.partial( + gen_dom_authzr, challs=acme_util.CHALLENGES) + + mock_poll.side_effect = self._validate_all + self.mock_auth.get_chall_pref.return_value.append(challenges.HTTP01) + + self.handler.pref_challs.extend((challenges.HTTP01, challenges.DNS01,)) + + self.handler.get_authorizations(["0"]) + + self.assertEqual(self.mock_auth.cleanup.call_count, 1) + self.assertEqual( + self.mock_auth.cleanup.call_args[0][0][0].typ, "http-01") + + def test_preferred_challenges_not_supported(self): + self.mock_net.request_domain_challenges.side_effect = functools.partial( + gen_dom_authzr, challs=acme_util.CHALLENGES) + self.handler.pref_challs.append(challenges.HTTP01) + self.assertRaises( + errors.AuthorizationError, self.handler.get_authorizations, ["0"]) + def _validate_all(self, unused_1, unused_2): - for dom in self.handler.authzr.keys(): + for dom in six.iterkeys(self.handler.authzr): azr = self.handler.authzr[dom] self.handler.authzr[dom] = acme_util.gen_authzr( messages.STATUS_VALID, @@ -188,7 +212,7 @@ class PollChallengesTest(unittest.TestCase): # Account and network are mocked... self.mock_net = mock.MagicMock() self.handler = AuthHandler( - None, self.mock_net, mock.Mock(key="mock_key")) + None, self.mock_net, mock.Mock(key="mock_key"), []) self.doms = ["0", "1", "2"] self.handler.authzr[self.doms[0]] = acme_util.gen_authzr( @@ -239,7 +263,7 @@ class PollChallengesTest(unittest.TestCase): from certbot.auth_handler import challb_to_achall self.mock_net.poll.side_effect = self._mock_poll_solve_one_valid self.chall_update[self.doms[0]].append( - challb_to_achall(acme_util.DNS_P, "key", self.doms[0])) + challb_to_achall(acme_util.DNS01_P, "key", self.doms[0])) self.assertRaises( errors.AuthorizationError, self.handler._poll_challenges, self.chall_update, False) @@ -317,7 +341,7 @@ class GenChallengePathTest(unittest.TestCase): """ def setUp(self): - logging.disable(logging.fatal) + logging.disable(logging.FATAL) def tearDown(self): logging.disable(logging.NOTSET) @@ -341,7 +365,7 @@ class GenChallengePathTest(unittest.TestCase): self.assertTrue(self._call(challbs[::-1], prefs, None)) def test_not_supported(self): - challbs = (acme_util.DNS_P, acme_util.TLSSNI01_P) + challbs = (acme_util.DNS01_P, acme_util.TLSSNI01_P) prefs = [challenges.TLSSNI01] combos = ((0, 1),) @@ -362,7 +386,7 @@ class ReportFailedChallsTest(unittest.TestCase): "chall": acme_util.HTTP01, "uri": "uri", "status": messages.STATUS_INVALID, - "error": messages.Error(typ="urn:acme:error:tls", detail="detail"), + "error": messages.Error.with_code("tls", detail="detail"), } # Prevent future regressions if the error type changes diff --git a/certbot/tests/cert_manager_test.py b/certbot/tests/cert_manager_test.py new file mode 100644 index 000000000..07f7cedaa --- /dev/null +++ b/certbot/tests/cert_manager_test.py @@ -0,0 +1,472 @@ +"""Tests for certbot.cert_manager.""" +# pylint: disable=protected-access +import os +import re +import shutil +import tempfile +import unittest + +import configobj +import mock + +from certbot import configuration +from certbot import errors + +from certbot.display import util as display_util +from certbot.storage import ALL_FOUR + +from certbot.tests import storage_test +from certbot.tests import util as test_util + +class BaseCertManagerTest(unittest.TestCase): + """Base class for setting up Cert Manager tests. + """ + def setUp(self): + self.tempdir = tempfile.mkdtemp() + + os.makedirs(os.path.join(self.tempdir, "renewal")) + + self.cli_config = configuration.NamespaceConfig(mock.MagicMock( + config_dir=self.tempdir, + work_dir=self.tempdir, + logs_dir=self.tempdir, + quiet=False, + )) + + self.domains = { + "example.org": None, + "other.com": os.path.join(self.tempdir, "specialarchive") + } + self.configs = dict((domain, self._set_up_config(domain, self.domains[domain])) + for domain in self.domains) + + # We also create a file that isn't a renewal config in the same + # location to test that logic that reads in all-and-only renewal + # configs will ignore it and NOT attempt to parse it. + junk = open(os.path.join(self.tempdir, "renewal", "IGNORE.THIS"), "w") + junk.write("This file should be ignored!") + junk.close() + + def _set_up_config(self, domain, custom_archive): + # TODO: maybe provide NamespaceConfig.make_dirs? + # TODO: main() should create those dirs, c.f. #902 + os.makedirs(os.path.join(self.tempdir, "live", domain)) + config = configobj.ConfigObj() + + if custom_archive is not None: + os.makedirs(custom_archive) + config["archive_dir"] = custom_archive + else: + os.makedirs(os.path.join(self.tempdir, "archive", domain)) + + for kind in ALL_FOUR: + config[kind] = os.path.join(self.tempdir, "live", domain, + kind + ".pem") + + config.filename = os.path.join(self.tempdir, "renewal", + domain + ".conf") + config.write() + return config + + def tearDown(self): + shutil.rmtree(self.tempdir) + + +class UpdateLiveSymlinksTest(BaseCertManagerTest): + """Tests for certbot.cert_manager.update_live_symlinks + """ + def test_update_live_symlinks(self): + """Test update_live_symlinks""" + # pylint: disable=too-many-statements + # create files with incorrect symlinks + from certbot import cert_manager + archive_paths = {} + for domain in self.domains: + custom_archive = self.domains[domain] + if custom_archive is not None: + archive_dir_path = custom_archive + else: + archive_dir_path = os.path.join(self.tempdir, "archive", domain) + archive_paths[domain] = dict((kind, + os.path.join(archive_dir_path, kind + "1.pem")) for kind in ALL_FOUR) + for kind in ALL_FOUR: + live_path = self.configs[domain][kind] + archive_path = archive_paths[domain][kind] + open(archive_path, 'a').close() + # path is incorrect but base must be correct + os.symlink(os.path.join(self.tempdir, kind + "1.pem"), live_path) + + # run update symlinks + cert_manager.update_live_symlinks(self.cli_config) + + # check that symlinks go where they should + prev_dir = os.getcwd() + try: + for domain in self.domains: + for kind in ALL_FOUR: + os.chdir(os.path.dirname(self.configs[domain][kind])) + self.assertEqual( + os.path.realpath(os.readlink(self.configs[domain][kind])), + os.path.realpath(archive_paths[domain][kind])) + finally: + os.chdir(prev_dir) + + +class DeleteTest(storage_test.BaseRenewableCertTest): + """Tests for certbot.cert_manager.delete + """ + @mock.patch('zope.component.getUtility') + @mock.patch('certbot.cert_manager.lineage_for_certname') + @mock.patch('certbot.storage.delete_files') + def test_delete(self, mock_delete_files, mock_lineage_for_certname, unused_get_utility): + """Test delete""" + mock_lineage_for_certname.return_value = self.test_rc + self.cli_config.certname = "example.org" + from certbot import cert_manager + cert_manager.delete(self.cli_config) + self.assertTrue(mock_delete_files.called) + + +class CertificatesTest(BaseCertManagerTest): + """Tests for certbot.cert_manager.certificates + """ + def _certificates(self, *args, **kwargs): + from certbot.cert_manager import certificates + return certificates(*args, **kwargs) + + @mock.patch('certbot.cert_manager.logger') + @mock.patch('zope.component.getUtility') + def test_certificates_parse_fail(self, mock_utility, mock_logger): + self._certificates(self.cli_config) + self.assertTrue(mock_logger.warning.called) #pylint: disable=no-member + self.assertTrue(mock_utility.called) + + @mock.patch('certbot.cert_manager.logger') + @mock.patch('zope.component.getUtility') + def test_certificates_quiet(self, mock_utility, mock_logger): + self.cli_config.quiet = True + self._certificates(self.cli_config) + self.assertFalse(mock_utility.notification.called) + self.assertTrue(mock_logger.warning.called) #pylint: disable=no-member + + @mock.patch('certbot.cert_manager.logger') + @mock.patch('zope.component.getUtility') + @mock.patch("certbot.storage.RenewableCert") + @mock.patch('certbot.cert_manager._report_human_readable') + def test_certificates_parse_success(self, mock_report, mock_renewable_cert, + mock_utility, mock_logger): + mock_report.return_value = "" + self._certificates(self.cli_config) + self.assertFalse(mock_logger.warning.called) #pylint: disable=no-member + self.assertTrue(mock_report.called) + self.assertTrue(mock_utility.called) + self.assertTrue(mock_renewable_cert.called) + + @mock.patch('certbot.cert_manager.logger') + @mock.patch('zope.component.getUtility') + def test_certificates_no_files(self, mock_utility, mock_logger): + tempdir = tempfile.mkdtemp() + + cli_config = configuration.NamespaceConfig(mock.MagicMock( + config_dir=tempdir, + work_dir=tempdir, + logs_dir=tempdir, + quiet=False, + )) + + os.makedirs(os.path.join(tempdir, "renewal")) + self._certificates(cli_config) + self.assertFalse(mock_logger.warning.called) #pylint: disable=no-member + self.assertTrue(mock_utility.called) + shutil.rmtree(tempdir) + + @mock.patch('certbot.cert_manager.ocsp.RevocationChecker.ocsp_revoked') + def test_report_human_readable(self, mock_revoked): + mock_revoked.return_value = None + from certbot import cert_manager + import datetime, pytz + expiry = pytz.UTC.fromutc(datetime.datetime.utcnow()) + + cert = mock.MagicMock(lineagename="nameone") + cert.target_expiry = expiry + cert.names.return_value = ["nameone", "nametwo"] + cert.is_test_cert = False + parsed_certs = [cert] + + # pylint: disable=protected-access + get_report = lambda: cert_manager._report_human_readable(mock_config, parsed_certs) + + mock_config = mock.MagicMock(certname=None, lineagename=None) + # pylint: disable=protected-access + out = get_report() + self.assertTrue("INVALID: EXPIRED" in out) + + cert.target_expiry += datetime.timedelta(hours=2) + # pylint: disable=protected-access + out = get_report() + self.assertTrue('1 hour(s)' in out) + self.assertTrue('VALID' in out and not 'INVALID' in out) + + cert.target_expiry += datetime.timedelta(days=1) + # pylint: disable=protected-access + out = get_report() + self.assertTrue('1 day' in out) + self.assertFalse('under' in out) + self.assertTrue('VALID' in out and not 'INVALID' in out) + + cert.target_expiry += datetime.timedelta(days=2) + # pylint: disable=protected-access + out = get_report() + self.assertTrue('3 days' in out) + self.assertTrue('VALID' in out and not 'INVALID' in out) + + cert.is_test_cert = True + mock_revoked.return_value = True + out = get_report() + self.assertTrue('INVALID: TEST_CERT, REVOKED' in out) + + cert = mock.MagicMock(lineagename="indescribable") + cert.target_expiry = expiry + cert.names.return_value = ["nameone", "thrice.named"] + cert.is_test_cert = True + parsed_certs.append(cert) + + out = get_report() + self.assertEqual(len(re.findall("INVALID:", out)), 2) + mock_config.domains = ["thrice.named"] + out = get_report() + self.assertEqual(len(re.findall("INVALID:", out)), 1) + mock_config.domains = ["nameone"] + out = get_report() + self.assertEqual(len(re.findall("INVALID:", out)), 2) + mock_config.certname = "indescribable" + out = get_report() + self.assertEqual(len(re.findall("INVALID:", out)), 1) + mock_config.certname = "horror" + out = get_report() + self.assertEqual(len(re.findall("INVALID:", out)), 0) + + +class SearchLineagesTest(BaseCertManagerTest): + """Tests for certbot.cert_manager._search_lineages.""" + + @mock.patch('certbot.util.make_or_verify_dir') + @mock.patch('certbot.storage.renewal_conf_files') + @mock.patch('certbot.storage.RenewableCert') + def test_cert_storage_error(self, mock_renewable_cert, mock_renewal_conf_files, + mock_make_or_verify_dir): + mock_renewal_conf_files.return_value = ["badfile"] + mock_renewable_cert.side_effect = errors.CertStorageError + from certbot import cert_manager + # pylint: disable=protected-access + self.assertEqual(cert_manager._search_lineages(self.cli_config, lambda x: x, "check"), + "check") + self.assertTrue(mock_make_or_verify_dir.called) + + +class LineageForCertnameTest(BaseCertManagerTest): + """Tests for certbot.cert_manager.lineage_for_certname""" + + @mock.patch('certbot.util.make_or_verify_dir') + @mock.patch('certbot.storage.renewal_conf_files') + @mock.patch('certbot.storage.RenewableCert') + def test_found_match(self, mock_renewable_cert, mock_renewal_conf_files, + mock_make_or_verify_dir): + mock_renewal_conf_files.return_value = ["somefile.conf"] + mock_match = mock.Mock(lineagename="example.com") + mock_renewable_cert.return_value = mock_match + from certbot import cert_manager + self.assertEqual(cert_manager.lineage_for_certname(self.cli_config, "example.com"), + mock_match) + self.assertTrue(mock_make_or_verify_dir.called) + + @mock.patch('certbot.util.make_or_verify_dir') + @mock.patch('certbot.storage.renewal_conf_files') + @mock.patch('certbot.storage.RenewableCert') + def test_no_match(self, mock_renewable_cert, mock_renewal_conf_files, + mock_make_or_verify_dir): + mock_renewal_conf_files.return_value = ["somefile.conf"] + mock_match = mock.Mock(lineagename="other.com") + mock_renewable_cert.return_value = mock_match + from certbot import cert_manager + self.assertEqual(cert_manager.lineage_for_certname(self.cli_config, "example.com"), + None) + self.assertTrue(mock_make_or_verify_dir.called) + + +class DomainsForCertnameTest(BaseCertManagerTest): + """Tests for certbot.cert_manager.domains_for_certname""" + + @mock.patch('certbot.util.make_or_verify_dir') + @mock.patch('certbot.storage.renewal_conf_files') + @mock.patch('certbot.storage.RenewableCert') + def test_found_match(self, mock_renewable_cert, mock_renewal_conf_files, + mock_make_or_verify_dir): + mock_renewal_conf_files.return_value = ["somefile.conf"] + mock_match = mock.Mock(lineagename="example.com") + domains = ["example.com", "example.org"] + mock_match.names.return_value = domains + mock_renewable_cert.return_value = mock_match + from certbot import cert_manager + self.assertEqual(cert_manager.domains_for_certname(self.cli_config, "example.com"), + domains) + self.assertTrue(mock_make_or_verify_dir.called) + + @mock.patch('certbot.util.make_or_verify_dir') + @mock.patch('certbot.storage.renewal_conf_files') + @mock.patch('certbot.storage.RenewableCert') + def test_no_match(self, mock_renewable_cert, mock_renewal_conf_files, + mock_make_or_verify_dir): + mock_renewal_conf_files.return_value = ["somefile.conf"] + mock_match = mock.Mock(lineagename="example.com") + domains = ["example.com", "example.org"] + mock_match.names.return_value = domains + mock_renewable_cert.return_value = mock_match + from certbot import cert_manager + self.assertEqual(cert_manager.domains_for_certname(self.cli_config, "other.com"), + None) + self.assertTrue(mock_make_or_verify_dir.called) + + +class RenameLineageTest(BaseCertManagerTest): + """Tests for certbot.cert_manager.rename_lineage""" + + def setUp(self): + super(RenameLineageTest, self).setUp() + self.mock_config = configuration.NamespaceConfig( + namespace=mock.MagicMock( + config_dir=self.tempdir, + work_dir=self.tempdir, + logs_dir=self.tempdir, + certname="example.org", + new_certname="after", + ) + ) + + def _call(self, *args, **kwargs): + from certbot import cert_manager + return cert_manager.rename_lineage(*args, **kwargs) + + @mock.patch('certbot.storage.renewal_conf_files') + @mock.patch('certbot.main.zope.component.getUtility') + def test_no_certname(self, mock_get_utility, mock_renewal_conf_files): + mock_config = mock.Mock(certname=None, new_certname="two") + + # if not choices + mock_renewal_conf_files.return_value = [] + self.assertRaises(errors.Error, self._call, mock_config) + + mock_renewal_conf_files.return_value = ["one.conf"] + util_mock = mock.Mock() + util_mock.menu.return_value = (display_util.CANCEL, 0) + mock_get_utility.return_value = util_mock + self.assertRaises(errors.Error, self._call, mock_config) + + util_mock.menu.return_value = (display_util.OK, -1) + self.assertRaises(errors.Error, self._call, mock_config) + + @mock.patch('certbot.main.zope.component.getUtility') + def test_no_new_certname(self, mock_get_utility): + mock_config = mock.Mock(certname="one", new_certname=None) + + util_mock = mock.Mock() + util_mock.input.return_value = (display_util.CANCEL, "name") + mock_get_utility.return_value = util_mock + self.assertRaises(errors.Error, self._call, mock_config) + + util_mock = mock.Mock() + util_mock.input.return_value = (display_util.OK, None) + mock_get_utility.return_value = util_mock + self.assertRaises(errors.Error, self._call, mock_config) + + @mock.patch('certbot.main.zope.component.getUtility') + @mock.patch('certbot.cert_manager.lineage_for_certname') + def test_no_existing_certname(self, mock_lineage_for_certname, unused_get_utility): + mock_config = mock.Mock(certname="one", new_certname="two") + mock_lineage_for_certname.return_value = None + self.assertRaises(errors.ConfigurationError, + self._call, mock_config) + + @mock.patch('certbot.main.zope.component.getUtility') + @mock.patch("certbot.storage.RenewableCert._check_symlinks") + def test_rename_cert(self, mock_check, unused_get_utility): + mock_check.return_value = True + mock_config = self.mock_config + self._call(mock_config) + from certbot import cert_manager + updated_lineage = cert_manager.lineage_for_certname(mock_config, mock_config.new_certname) + self.assertTrue(updated_lineage is not None) + self.assertEqual(updated_lineage.lineagename, mock_config.new_certname) + + @mock.patch('certbot.main.zope.component.getUtility') + @mock.patch("certbot.storage.RenewableCert._check_symlinks") + def test_rename_cert_interactive_certname(self, mock_check, mock_get_utility): + mock_check.return_value = True + mock_config = self.mock_config + mock_config.certname = None + util_mock = mock.Mock() + util_mock.menu.return_value = (display_util.OK, 0) + mock_get_utility.return_value = util_mock + self._call(mock_config) + from certbot import cert_manager + updated_lineage = cert_manager.lineage_for_certname(mock_config, mock_config.new_certname) + self.assertTrue(updated_lineage is not None) + self.assertEqual(updated_lineage.lineagename, mock_config.new_certname) + + @mock.patch('certbot.main.zope.component.getUtility') + @mock.patch("certbot.storage.RenewableCert._check_symlinks") + def test_rename_cert_bad_new_certname(self, mock_check, unused_get_utility): + mock_check.return_value = True + mock_config = self.mock_config + + # for example, don't rename to existing certname + mock_config.new_certname = "example.org" + self.assertRaises(errors.ConfigurationError, self._call, mock_config) + + mock_config.new_certname = "one{0}two".format(os.path.sep) + self.assertRaises(errors.ConfigurationError, self._call, mock_config) + + +class DuplicativeCertsTest(storage_test.BaseRenewableCertTest): + """Test to avoid duplicate lineages.""" + + def setUp(self): + super(DuplicativeCertsTest, self).setUp() + self.config.write() + self._write_out_ex_kinds() + + def tearDown(self): + shutil.rmtree(self.tempdir) + + @mock.patch('certbot.util.make_or_verify_dir') + def test_find_duplicative_names(self, unused_makedir): + from certbot.cert_manager import find_duplicative_certs + test_cert = test_util.load_vector('cert-san.pem') + with open(self.test_rc.cert, 'wb') as f: + f.write(test_cert) + + # No overlap at all + result = find_duplicative_certs( + self.cli_config, ['wow.net', 'hooray.org']) + self.assertEqual(result, (None, None)) + + # Totally identical + result = find_duplicative_certs( + self.cli_config, ['example.com', 'www.example.com']) + self.assertTrue(result[0].configfile.filename.endswith('example.org.conf')) + self.assertEqual(result[1], None) + + # Superset + result = find_duplicative_certs( + self.cli_config, ['example.com', 'www.example.com', 'something.new']) + self.assertEqual(result[0], None) + self.assertTrue(result[1].configfile.filename.endswith('example.org.conf')) + + # Partial overlap doesn't count + result = find_duplicative_certs( + self.cli_config, ['example.com', 'something.new']) + self.assertEqual(result, (None, None)) + + +if __name__ == "__main__": + unittest.main() # pragma: no cover diff --git a/certbot/tests/cli_test.py b/certbot/tests/cli_test.py index cb32975e4..9404a8385 100644 --- a/certbot/tests/cli_test.py +++ b/certbot/tests/cli_test.py @@ -1,119 +1,118 @@ """Tests for certbot.cli.""" -from __future__ import print_function - import argparse -import dialog import functools -import itertools -import os -import shutil -import traceback -import tempfile import unittest +import os +import tempfile -import mock import six +import mock from six.moves import reload_module # pylint: disable=import-error -from acme import jose - -from certbot import account from certbot import cli -from certbot import configuration from certbot import constants -from certbot import crypto_util from certbot import errors -from certbot import util -from certbot import main -from certbot import renewal -from certbot import storage - from certbot.plugins import disco -from certbot.plugins import manual -from certbot.tests import storage_test -from certbot.tests import test_util +def reset_set_by_cli(): + '''Reset the state of the `set_by_cli` function''' + cli.set_by_cli.detector = None + +class TestReadFile(unittest.TestCase): + '''Test cli.read_file''' + + _multiprocess_can_split_ = True + + def test_read_file(self): + tmp_dir = tempfile.mkdtemp() + rel_test_path = os.path.relpath(os.path.join(tmp_dir, 'foo')) + self.assertRaises( + argparse.ArgumentTypeError, cli.read_file, rel_test_path) + + test_contents = b'bar\n' + with open(rel_test_path, 'wb') as f: + f.write(test_contents) + + path, contents = cli.read_file(rel_test_path) + self.assertEqual(path, os.path.abspath(path)) + self.assertEqual(contents, test_contents) -CERT = test_util.vector_path('cert.pem') -CSR = test_util.vector_path('csr.der') -KEY = test_util.vector_path('rsa256_key.pem') +class ParseTest(unittest.TestCase): + '''Test the cli args entrypoint''' + _multiprocess_can_split_ = True -class CLITest(unittest.TestCase): # pylint: disable=too-many-public-methods - """Tests for different commands.""" + @classmethod + def setUpClass(cls): + cls.plugins = disco.PluginsRegistry.find_all() + cls.parse = functools.partial(cli.prepare_and_parse_args, cls.plugins) def setUp(self): - self.tmp_dir = tempfile.mkdtemp() - self.config_dir = os.path.join(self.tmp_dir, 'config') - self.work_dir = os.path.join(self.tmp_dir, 'work') - self.logs_dir = os.path.join(self.tmp_dir, 'logs') - self.standard_args = ['--config-dir', self.config_dir, - '--work-dir', self.work_dir, - '--logs-dir', self.logs_dir, '--text'] - - def tearDown(self): - shutil.rmtree(self.tmp_dir) - # Reset globals in cli - # pylint: disable=protected-access - cli._parser = cli.set_by_cli.detector = None - - def _call(self, args, stdout=None): - "Run the cli with output streams and actual client mocked out" - with mock.patch('certbot.main.client') as client: - ret, stdout, stderr = self._call_no_clientmock(args, stdout) - return ret, stdout, stderr, client - - def _call_no_clientmock(self, args, stdout=None): - "Run the client with output streams mocked out" - args = self.standard_args + args - - toy_stdout = stdout if stdout else six.StringIO() - with mock.patch('certbot.main.sys.stdout', new=toy_stdout): - with mock.patch('certbot.main.sys.stderr') as stderr: - ret = main.main(args[:]) # NOTE: parser can alter its args! - return ret, toy_stdout, stderr - - def test_no_flags(self): - with mock.patch('certbot.main.run') as mock_run: - self._call([]) - self.assertEqual(1, mock_run.call_count) + reset_set_by_cli() def _help_output(self, args): "Run a command, and return the ouput string for scrutiny" output = six.StringIO() - self.assertRaises(SystemExit, self._call, args, output) - out = output.getvalue() - return out + with mock.patch('certbot.main.sys.stdout', new=output): + with mock.patch('certbot.main.sys.stderr'): + self.assertRaises(SystemExit, self.parse, args, output) + return output.getvalue() + + def test_install_abspath(self): + cert = 'cert' + key = 'key' + chain = 'chain' + fullchain = 'fullchain' + + with mock.patch('certbot.main.install'): + namespace = self.parse(['install', '--cert-path', cert, + '--key-path', 'key', '--chain-path', + 'chain', '--fullchain-path', 'fullchain']) + + self.assertEqual(namespace.cert_path, os.path.abspath(cert)) + self.assertEqual(namespace.key_path, os.path.abspath(key)) + self.assertEqual(namespace.chain_path, os.path.abspath(chain)) + self.assertEqual(namespace.fullchain_path, os.path.abspath(fullchain)) def test_help(self): - self.assertRaises(SystemExit, self._call, ['--help']) - self.assertRaises(SystemExit, self._call, ['--help', 'all']) - plugins = disco.PluginsRegistry.find_all() + self._help_output(['--help']) # assert SystemExit is raised here out = self._help_output(['--help', 'all']) self.assertTrue("--configurator" in out) self.assertTrue("how a cert is deployed" in out) - self.assertTrue("--manual-test-mode" in out) + self.assertTrue("--webroot-path" in out) + self.assertTrue("--text" not in out) + self.assertTrue("--dialog" not in out) + self.assertTrue("%s" not in out) + self.assertTrue("{0}" not in out) out = self._help_output(['-h', 'nginx']) - if "nginx" in plugins: + if "nginx" in self.plugins: # may be false while building distributions without plugins self.assertTrue("--nginx-ctl" in out) - self.assertTrue("--manual-test-mode" not in out) + self.assertTrue("--webroot-path" not in out) self.assertTrue("--checkpoints" not in out) out = self._help_output(['-h']) - self.assertTrue("letsencrypt-auto" not in out) # test cli.cli_command - if "nginx" in plugins: + self.assertTrue("letsencrypt-auto" not in out) # test cli.cli_command + if "nginx" in self.plugins: self.assertTrue("Use the Nginx plugin" in out) else: - self.assertTrue("(nginx support is experimental" in out) + self.assertTrue("(the certbot nginx plugin is not" in out) out = self._help_output(['--help', 'plugins']) - self.assertTrue("--manual-test-mode" not in out) + self.assertTrue("--webroot-path" not in out) self.assertTrue("--prepare" in out) - self.assertTrue("Plugin options" in out) + self.assertTrue('"plugins" subcommand' in out) + + # test multiple topics + out = self._help_output(['-h', 'renew']) + self.assertTrue("--keep" in out) + out = self._help_output(['-h', 'automation']) + self.assertTrue("--keep" in out) + out = self._help_output(['-h', 'revoke']) + self.assertTrue("--keep" not in out) out = self._help_output(['--help', 'install']) self.assertTrue("--cert-path" in out) @@ -128,339 +127,87 @@ class CLITest(unittest.TestCase): # pylint: disable=too-many-public-methods self.assertTrue("--key-path" not in out) out = self._help_output(['-h']) - self.assertTrue(cli.usage_strings(plugins)[0] in out) - - def _cli_missing_flag(self, args, message): - "Ensure that a particular error raises a missing cli flag error containing message" - exc = None - try: - with mock.patch('certbot.main.sys.stderr'): - main.main(self.standard_args + args[:]) # NOTE: parser can alter its args! - except errors.MissingCommandlineFlag as exc: - self.assertTrue(message in str(exc)) - self.assertTrue(exc is not None) - - def test_noninteractive(self): - args = ['-n', 'certonly'] - self._cli_missing_flag(args, "specify a plugin") - args.extend(['--standalone', '-d', 'eg.is']) - self._cli_missing_flag(args, "register before running") - with mock.patch('certbot.main._auth_from_domains'): - with mock.patch('certbot.main.client.acme_from_config_key'): - args.extend(['--email', 'io@io.is']) - self._cli_missing_flag(args, "--agree-tos") - - @mock.patch('certbot.main.renew') - def test_gui(self, renew): - args = ['renew', '--dialog'] - # --text conflicts with --dialog - self.standard_args.remove('--text') - self._call(args) - self.assertFalse(renew.call_args[0][0].noninteractive_mode) - - @mock.patch('certbot.main.client.acme_client.Client') - @mock.patch('certbot.main._determine_account') - @mock.patch('certbot.main.client.Client.obtain_and_enroll_certificate') - @mock.patch('certbot.main._auth_from_domains') - def test_user_agent(self, afd, _obt, det, _client): - # Normally the client is totally mocked out, but here we need more - # arguments to automate it... - args = ["--standalone", "certonly", "-m", "none@none.com", - "-d", "example.com", '--agree-tos'] + self.standard_args - det.return_value = mock.MagicMock(), None - afd.return_value = mock.MagicMock(), "newcert" - - with mock.patch('certbot.main.client.acme_client.ClientNetwork') as acme_net: - self._call_no_clientmock(args) - os_ver = util.get_os_info_ua() - ua = acme_net.call_args[1]["user_agent"] - self.assertTrue(os_ver in ua) - import platform - plat = platform.platform() - if "linux" in plat.lower(): - self.assertTrue(util.get_os_info_ua() in ua) - - with mock.patch('certbot.main.client.acme_client.ClientNetwork') as acme_net: - ua = "bandersnatch" - args += ["--user-agent", ua] - self._call_no_clientmock(args) - acme_net.assert_called_once_with(mock.ANY, verify_ssl=True, user_agent=ua) - - def test_install_abspath(self): - cert = 'cert' - key = 'key' - chain = 'chain' - fullchain = 'fullchain' - - with mock.patch('certbot.main.install') as mock_install: - self._call(['install', '--cert-path', cert, '--key-path', 'key', - '--chain-path', 'chain', - '--fullchain-path', 'fullchain']) - - args = mock_install.call_args[0][0] - self.assertEqual(args.cert_path, os.path.abspath(cert)) - self.assertEqual(args.key_path, os.path.abspath(key)) - self.assertEqual(args.chain_path, os.path.abspath(chain)) - self.assertEqual(args.fullchain_path, os.path.abspath(fullchain)) - - @mock.patch('certbot.main.plug_sel.record_chosen_plugins') - @mock.patch('certbot.main.plug_sel.pick_installer') - def test_installer_selection(self, mock_pick_installer, _rec): - self._call(['install', '--domains', 'foo.bar', '--cert-path', 'cert', - '--key-path', 'key', '--chain-path', 'chain']) - self.assertEqual(mock_pick_installer.call_count, 1) - - @mock.patch('certbot.util.exe_exists') - def test_configurator_selection(self, mock_exe_exists): - mock_exe_exists.return_value = True - real_plugins = disco.PluginsRegistry.find_all() - args = ['--apache', '--authenticator', 'standalone'] - - # This needed two calls to find_all(), which we're avoiding for now - # because of possible side effects: - # https://github.com/letsencrypt/letsencrypt/commit/51ed2b681f87b1eb29088dd48718a54f401e4855 - #with mock.patch('certbot.cli.plugins_testable') as plugins: - # plugins.return_value = {"apache": True, "nginx": True} - # ret, _, _, _ = self._call(args) - # self.assertTrue("Too many flags setting" in ret) - - args = ["install", "--nginx", "--cert-path", "/tmp/blah", "--key-path", "/tmp/blah", - "--nginx-server-root", "/nonexistent/thing", "-d", - "example.com", "--debug"] - if "nginx" in real_plugins: - # Sending nginx a non-existent conf dir will simulate misconfiguration - # (we can only do that if certbot-nginx is actually present) - ret, _, _, _ = self._call(args) - self.assertTrue("The nginx plugin is not working" in ret) - self.assertTrue("MisconfigurationError" in ret) - - self._cli_missing_flag(["--standalone"], "With the standalone plugin, you probably") - - with mock.patch("certbot.main._init_le_client") as mock_init: - with mock.patch("certbot.main._auth_from_domains") as mock_afd: - mock_afd.return_value = (mock.MagicMock(), mock.MagicMock()) - self._call(["certonly", "--manual", "-d", "foo.bar"]) - unused_config, auth, unused_installer = mock_init.call_args[0] - self.assertTrue(isinstance(auth, manual.Authenticator)) - - with mock.patch('certbot.main.obtain_cert') as mock_certonly: - self._call(["auth", "--standalone"]) - self.assertEqual(1, mock_certonly.call_count) - - def test_rollback(self): - _, _, _, client = self._call(['rollback']) - self.assertEqual(1, client.rollback.call_count) - - _, _, _, client = self._call(['rollback', '--checkpoints', '123']) - client.rollback.assert_called_once_with( - mock.ANY, 123, mock.ANY, mock.ANY) - - def test_config_changes(self): - _, _, _, client = self._call(['config_changes']) - self.assertEqual(1, client.view_config_changes.call_count) - - def test_plugins(self): - flags = ['--init', '--prepare', '--authenticators', '--installers'] - for args in itertools.chain( - *(itertools.combinations(flags, r) - for r in xrange(len(flags)))): - self._call(['plugins'] + list(args)) - - @mock.patch('certbot.main.plugins_disco') - @mock.patch('certbot.main.cli.HelpfulArgumentParser.determine_help_topics') - def test_plugins_no_args(self, _det, mock_disco): - ifaces = [] - plugins = mock_disco.PluginsRegistry.find_all() - - _, stdout, _, _ = self._call(['plugins']) - plugins.visible.assert_called_once_with() - plugins.visible().ifaces.assert_called_once_with(ifaces) - filtered = plugins.visible().ifaces() - self.assertEqual(stdout.getvalue().strip(), str(filtered)) - - @mock.patch('certbot.main.plugins_disco') - @mock.patch('certbot.main.cli.HelpfulArgumentParser.determine_help_topics') - def test_plugins_init(self, _det, mock_disco): - ifaces = [] - plugins = mock_disco.PluginsRegistry.find_all() - - _, stdout, _, _ = self._call(['plugins', '--init']) - plugins.visible.assert_called_once_with() - plugins.visible().ifaces.assert_called_once_with(ifaces) - filtered = plugins.visible().ifaces() - self.assertEqual(filtered.init.call_count, 1) - filtered.verify.assert_called_once_with(ifaces) - verified = filtered.verify() - self.assertEqual(stdout.getvalue().strip(), str(verified)) - - @mock.patch('certbot.main.plugins_disco') - @mock.patch('certbot.main.cli.HelpfulArgumentParser.determine_help_topics') - def test_plugins_prepare(self, _det, mock_disco): - ifaces = [] - plugins = mock_disco.PluginsRegistry.find_all() - _, stdout, _, _ = self._call(['plugins', '--init', '--prepare']) - plugins.visible.assert_called_once_with() - plugins.visible().ifaces.assert_called_once_with(ifaces) - filtered = plugins.visible().ifaces() - self.assertEqual(filtered.init.call_count, 1) - filtered.verify.assert_called_once_with(ifaces) - verified = filtered.verify() - verified.prepare.assert_called_once_with() - verified.available.assert_called_once_with() - available = verified.available() - self.assertEqual(stdout.getvalue().strip(), str(available)) - - def test_certonly_abspath(self): - cert = 'cert' - key = 'key' - chain = 'chain' - fullchain = 'fullchain' - - with mock.patch('certbot.main.obtain_cert') as mock_obtaincert: - self._call(['certonly', '--cert-path', cert, '--key-path', 'key', - '--chain-path', 'chain', - '--fullchain-path', 'fullchain']) - - config, unused_plugins = mock_obtaincert.call_args[0] - self.assertEqual(config.cert_path, os.path.abspath(cert)) - self.assertEqual(config.key_path, os.path.abspath(key)) - self.assertEqual(config.chain_path, os.path.abspath(chain)) - self.assertEqual(config.fullchain_path, os.path.abspath(fullchain)) - - def test_certonly_bad_args(self): - try: - self._call(['-a', 'bad_auth', 'certonly']) - assert False, "Exception should have been raised" - except errors.PluginSelectionError as e: - self.assertTrue('The requested bad_auth plugin does not appear' in e.message) - - def test_check_config_sanity_domain(self): - # Punycode - self.assertRaises(errors.ConfigurationError, - self._call, - ['-d', 'this.is.xn--ls8h.tld']) - # FQDN - self.assertRaises(errors.ConfigurationError, - self._call, - ['-d', 'a' * 64]) - # FQDN 2 - self.assertRaises(errors.ConfigurationError, - self._call, - ['-d', (('a' * 50) + '.') * 10]) - # Wildcard - self.assertRaises(errors.ConfigurationError, - self._call, - ['-d', '*.wildcard.tld']) - - # Bare IP address (this is actually a different error message now) - self.assertRaises(errors.ConfigurationError, - self._call, - ['-d', '204.11.231.35']) - - def test_csr_with_besteffort(self): - self.assertRaises( - errors.Error, self._call, - 'certonly --csr {0} --allow-subset-of-names'.format(CSR).split()) - - def test_run_with_csr(self): - # This is an error because you can only use --csr with certonly - try: - self._call(['--csr', CSR]) - except errors.Error as e: - assert "Please try the certonly" in repr(e) - return - assert False, "Expected supplying --csr to fail with default verb" - - def test_csr_with_no_domains(self): - self.assertRaises( - errors.Error, self._call, - 'certonly --csr {0}'.format( - test_util.vector_path('csr-nonames.pem')).split()) - - def test_csr_with_inconsistent_domains(self): - self.assertRaises( - errors.Error, self._call, - 'certonly -d example.org --csr {0}'.format(CSR).split()) - - def _get_argument_parser(self): - plugins = disco.PluginsRegistry.find_all() - return functools.partial(cli.prepare_and_parse_args, plugins) + self.assertTrue(cli.SHORT_USAGE in out) + self.assertTrue(cli.COMMAND_OVERVIEW[:100] in out) + self.assertTrue("%s" not in out) + self.assertTrue("{0}" not in out) def test_parse_domains(self): - parse = self._get_argument_parser() - short_args = ['-d', 'example.com'] - namespace = parse(short_args) + namespace = self.parse(short_args) self.assertEqual(namespace.domains, ['example.com']) short_args = ['-d', 'trailing.period.com.'] - namespace = parse(short_args) + namespace = self.parse(short_args) self.assertEqual(namespace.domains, ['trailing.period.com']) short_args = ['-d', 'example.com,another.net,third.org,example.com'] - namespace = parse(short_args) + namespace = self.parse(short_args) self.assertEqual(namespace.domains, ['example.com', 'another.net', 'third.org']) long_args = ['--domains', 'example.com'] - namespace = parse(long_args) + namespace = self.parse(long_args) self.assertEqual(namespace.domains, ['example.com']) long_args = ['--domains', 'trailing.period.com.'] - namespace = parse(long_args) + namespace = self.parse(long_args) self.assertEqual(namespace.domains, ['trailing.period.com']) long_args = ['--domains', 'example.com,another.net,example.com'] - namespace = parse(long_args) + namespace = self.parse(long_args) self.assertEqual(namespace.domains, ['example.com', 'another.net']) + def test_preferred_challenges(self): + from acme.challenges import HTTP01, TLSSNI01, DNS01 + + short_args = ['--preferred-challenges', 'http, tls-sni-01, dns'] + namespace = self.parse(short_args) + + self.assertEqual(namespace.pref_challs, [HTTP01, TLSSNI01, DNS01]) + + short_args = ['--preferred-challenges', 'jumping-over-the-moon'] + self.assertRaises(argparse.ArgumentTypeError, self.parse, short_args) + def test_server_flag(self): - parse = self._get_argument_parser() - namespace = parse('--server example.com'.split()) + namespace = self.parse('--server example.com'.split()) self.assertEqual(namespace.server, 'example.com') + def test_must_staple_flag(self): + short_args = ['--must-staple'] + namespace = self.parse(short_args) + self.assertTrue(namespace.must_staple) + self.assertTrue(namespace.staple) + + def test_no_gui(self): + args = ['renew', '--dialog'] + stderr = six.StringIO() + with mock.patch('certbot.main.sys.stderr', new=stderr): + namespace = self.parse(args) + + self.assertTrue(namespace.noninteractive_mode) + self.assertTrue("--dialog is deprecated" in stderr.getvalue()) + def _check_server_conflict_message(self, parser_args, conflicting_args): - parse = self._get_argument_parser() try: - parse(parser_args) + self.parse(parser_args) self.fail( # pragma: no cover "The following flags didn't conflict with " '--server: {0}'.format(', '.join(conflicting_args))) except errors.Error as error: - self.assertTrue('--server' in error.message) + self.assertTrue('--server' in str(error)) for arg in conflicting_args: - self.assertTrue(arg in error.message) - - def test_must_staple_flag(self): - parse = self._get_argument_parser() - short_args = ['--must-staple'] - namespace = parse(short_args) - self.assertTrue(namespace.must_staple) - self.assertTrue(namespace.staple) + self.assertTrue(arg in str(error)) def test_staging_flag(self): - parse = self._get_argument_parser() short_args = ['--staging'] - namespace = parse(short_args) + namespace = self.parse(short_args) self.assertTrue(namespace.staging) self.assertEqual(namespace.server, constants.STAGING_URI) short_args += '--server example.com'.split() self._check_server_conflict_message(short_args, '--staging') - def test_option_was_set(self): - key_size_option = 'rsa_key_size' - key_size_value = cli.flag_default(key_size_option) - self._get_argument_parser()( - '--rsa-key-size {0}'.format(key_size_value).split()) - - self.assertTrue(cli.option_was_set(key_size_option, key_size_value)) - self.assertTrue(cli.option_was_set('no_verify_ssl', True)) - - config_dir_option = 'config_dir' - self.assertFalse(cli.option_was_set( - config_dir_option, cli.flag_default(config_dir_option))) - def _assert_dry_run_flag_worked(self, namespace, existing_account): self.assertTrue(namespace.dry_run) self.assertTrue(namespace.break_my_certs) @@ -475,26 +222,25 @@ class CLITest(unittest.TestCase): # pylint: disable=too-many-public-methods self.assertFalse(namespace.register_unsafely_without_email) def test_dry_run_flag(self): - parse = self._get_argument_parser() config_dir = tempfile.mkdtemp() short_args = '--dry-run --config-dir {0}'.format(config_dir).split() - self.assertRaises(errors.Error, parse, short_args) + self.assertRaises(errors.Error, self.parse, short_args) self._assert_dry_run_flag_worked( - parse(short_args + ['auth']), False) + self.parse(short_args + ['auth']), False) self._assert_dry_run_flag_worked( - parse(short_args + ['certonly']), False) + self.parse(short_args + ['certonly']), False) self._assert_dry_run_flag_worked( - parse(short_args + ['renew']), False) + self.parse(short_args + ['renew']), False) account_dir = os.path.join(config_dir, constants.ACCOUNTS_DIR) os.mkdir(account_dir) os.mkdir(os.path.join(account_dir, 'fake_account_dir')) - self._assert_dry_run_flag_worked(parse(short_args + ['auth']), True) - self._assert_dry_run_flag_worked(parse(short_args + ['renew']), True) + self._assert_dry_run_flag_worked(self.parse(short_args + ['auth']), True) + self._assert_dry_run_flag_worked(self.parse(short_args + ['renew']), True) short_args += ['certonly'] - self._assert_dry_run_flag_worked(parse(short_args), True) + self._assert_dry_run_flag_worked(self.parse(short_args), True) short_args += '--server example.com'.split() conflicts = ['--dry-run'] @@ -504,637 +250,30 @@ class CLITest(unittest.TestCase): # pylint: disable=too-many-public-methods conflicts += ['--staging'] self._check_server_conflict_message(short_args, conflicts) - def _certonly_new_request_common(self, mock_client, args=None): - with mock.patch('certbot.main._treat_as_renewal') as mock_renewal: - mock_renewal.return_value = ("newcert", None) - with mock.patch('certbot.main._init_le_client') as mock_init: - mock_init.return_value = mock_client - if args is None: - args = [] - args += '-d foo.bar -a standalone certonly'.split() - self._call(args) + def test_option_was_set(self): + key_size_option = 'rsa_key_size' + key_size_value = cli.flag_default(key_size_option) + self.parse('--rsa-key-size {0}'.format(key_size_value).split()) - @mock.patch('certbot.main.zope.component.getUtility') - def test_certonly_dry_run_new_request_success(self, mock_get_utility): - mock_client = mock.MagicMock() - mock_client.obtain_and_enroll_certificate.return_value = None - self._certonly_new_request_common(mock_client, ['--dry-run']) - self.assertEqual( - mock_client.obtain_and_enroll_certificate.call_count, 1) - self.assertTrue( - 'dry run' in mock_get_utility().add_message.call_args[0][0]) - # Asserts we don't suggest donating after a successful dry run - self.assertEqual(mock_get_utility().add_message.call_count, 1) + self.assertTrue(cli.option_was_set(key_size_option, key_size_value)) + self.assertTrue(cli.option_was_set('no_verify_ssl', True)) - @mock.patch('certbot.crypto_util.notAfter') - @mock.patch('certbot.main.zope.component.getUtility') - def test_certonly_new_request_success(self, mock_get_utility, mock_notAfter): - cert_path = '/etc/letsencrypt/live/foo.bar' - date = '1970-01-01' - mock_notAfter().date.return_value = date + config_dir_option = 'config_dir' + self.assertFalse(cli.option_was_set( + config_dir_option, cli.flag_default(config_dir_option))) - mock_lineage = mock.MagicMock(cert=cert_path, fullchain=cert_path) - mock_client = mock.MagicMock() - mock_client.obtain_and_enroll_certificate.return_value = mock_lineage - self._certonly_new_request_common(mock_client) - self.assertEqual( - mock_client.obtain_and_enroll_certificate.call_count, 1) - cert_msg = mock_get_utility().add_message.call_args_list[0][0][0] - self.assertTrue(cert_path in cert_msg) - self.assertTrue(date in cert_msg) - self.assertTrue( - 'donate' in mock_get_utility().add_message.call_args[0][0]) - - def test_certonly_new_request_failure(self): - mock_client = mock.MagicMock() - mock_client.obtain_and_enroll_certificate.return_value = False - self.assertRaises(errors.Error, - self._certonly_new_request_common, mock_client) - - def _test_renewal_common(self, due_for_renewal, extra_args, log_out=None, - args=None, should_renew=True, error_expected=False): - # pylint: disable=too-many-locals,too-many-arguments - cert_path = 'certbot/tests/testdata/cert.pem' - chain_path = '/etc/letsencrypt/live/foo.bar/fullchain.pem' - mock_lineage = mock.MagicMock(cert=cert_path, fullchain=chain_path) - mock_lineage.should_autorenew.return_value = due_for_renewal - mock_certr = mock.MagicMock() - mock_key = mock.MagicMock(pem='pem_key') - mock_client = mock.MagicMock() - stdout = None - mock_client.obtain_certificate.return_value = (mock_certr, 'chain', - mock_key, 'csr') - try: - with mock.patch('certbot.main._find_duplicative_certs') as mock_fdc: - mock_fdc.return_value = (mock_lineage, None) - with mock.patch('certbot.main._init_le_client') as mock_init: - mock_init.return_value = mock_client - get_utility_path = 'certbot.main.zope.component.getUtility' - with mock.patch(get_utility_path) as mock_get_utility: - with mock.patch('certbot.main.renewal.OpenSSL') as mock_ssl: - mock_latest = mock.MagicMock() - mock_latest.get_issuer.return_value = "Fake fake" - mock_ssl.crypto.load_certificate.return_value = mock_latest - with mock.patch('certbot.main.renewal.crypto_util'): - if not args: - args = ['-d', 'isnot.org', '-a', 'standalone', 'certonly'] - if extra_args: - args += extra_args - try: - ret, stdout, _, _ = self._call(args) - if ret: - print("Returned", ret) - raise AssertionError(ret) - assert not error_expected, "renewal should have errored" - except: # pylint: disable=bare-except - if not error_expected: - raise AssertionError( - "Unexpected renewal error:\n" + - traceback.format_exc()) - - if should_renew: - mock_client.obtain_certificate.assert_called_once_with(['isnot.org']) - else: - self.assertEqual(mock_client.obtain_certificate.call_count, 0) - except: - self._dump_log() - raise - finally: - if log_out: - with open(os.path.join(self.logs_dir, "letsencrypt.log")) as lf: - self.assertTrue(log_out in lf.read()) - - return mock_lineage, mock_get_utility, stdout - - def test_certonly_renewal(self): - lineage, get_utility, _ = self._test_renewal_common(True, []) - self.assertEqual(lineage.save_successor.call_count, 1) - lineage.update_all_links_to.assert_called_once_with( - lineage.latest_common_version()) - cert_msg = get_utility().add_message.call_args_list[0][0][0] - self.assertTrue('fullchain.pem' in cert_msg) - self.assertTrue('donate' in get_utility().add_message.call_args[0][0]) - - def test_certonly_renewal_triggers(self): - # --dry-run should force renewal - _, get_utility, _ = self._test_renewal_common(False, ['--dry-run', '--keep'], - log_out="simulating renewal") - self.assertEqual(get_utility().add_message.call_count, 1) - self.assertTrue('dry run' in get_utility().add_message.call_args[0][0]) - - self._test_renewal_common(False, ['--renew-by-default', '-tvv', '--debug'], - log_out="Auto-renewal forced") - self.assertEqual(get_utility().add_message.call_count, 1) - - self._test_renewal_common(False, ['-tvv', '--debug', '--keep'], - log_out="not yet due", should_renew=False) - - - def _dump_log(self): - with open(os.path.join(self.logs_dir, "letsencrypt.log")) as lf: - print("Logs:") - print(lf.read()) - - - def _make_test_renewal_conf(self, testfile): - with open(test_util.vector_path(testfile)) as src: - # put the correct path for cert.pem, chain.pem etc in the renewal conf - renewal_conf = src.read().replace("MAGICDIR", test_util.vector_path()) - rd = os.path.join(self.config_dir, "renewal") - if not os.path.exists(rd): - os.makedirs(rd) - rc = os.path.join(rd, "sample-renewal.conf") - with open(rc, "w") as dest: - dest.write(renewal_conf) - return rc - - def test_renew_verb(self): - self._make_test_renewal_conf('sample-renewal.conf') - args = ["renew", "--dry-run", "-tvv"] - self._test_renewal_common(True, [], args=args, should_renew=True) - - def test_quiet_renew(self): - self._make_test_renewal_conf('sample-renewal.conf') - args = ["renew", "--dry-run"] - _, _, stdout = self._test_renewal_common(True, [], args=args, should_renew=True) - out = stdout.getvalue() - self.assertTrue("renew" in out) - - args = ["renew", "--dry-run", "-q"] - _, _, stdout = self._test_renewal_common(True, [], args=args, should_renew=True) - out = stdout.getvalue() - self.assertEqual("", out) - - def test_renew_hook_validation(self): - self._make_test_renewal_conf('sample-renewal.conf') - args = ["renew", "--dry-run", "--post-hook=no-such-command"] - self._test_renewal_common(True, [], args=args, should_renew=False, - error_expected=True) - - def test_renew_no_hook_validation(self): - self._make_test_renewal_conf('sample-renewal.conf') - args = ["renew", "--dry-run", "--post-hook=no-such-command", - "--disable-hook-validation"] - self._test_renewal_common(True, [], args=args, should_renew=True, - error_expected=False) - - @mock.patch("certbot.cli.set_by_cli") - def test_ancient_webroot_renewal_conf(self, mock_set_by_cli): - mock_set_by_cli.return_value = False - rc_path = self._make_test_renewal_conf('sample-renewal-ancient.conf') - args = mock.MagicMock(account=None, email=None, webroot_path=None) - config = configuration.NamespaceConfig(args) - lineage = storage.RenewableCert(rc_path, - configuration.RenewerConfiguration(config)) - renewalparams = lineage.configuration["renewalparams"] - # pylint: disable=protected-access - renewal._restore_webroot_config(config, renewalparams) - self.assertEqual(config.webroot_path, ["/var/www/"]) - - def test_renew_verb_empty_config(self): - rd = os.path.join(self.config_dir, 'renewal') - if not os.path.exists(rd): - os.makedirs(rd) - with open(os.path.join(rd, 'empty.conf'), 'w'): - pass # leave the file empty - args = ["renew", "--dry-run", "-tvv"] - self._test_renewal_common(False, [], args=args, should_renew=False, error_expected=True) - - def _make_dummy_renewal_config(self): - renewer_configs_dir = os.path.join(self.config_dir, 'renewal') - os.makedirs(renewer_configs_dir) - with open(os.path.join(renewer_configs_dir, 'test.conf'), 'w') as f: - f.write("My contents don't matter") - - def _test_renew_common(self, renewalparams=None, names=None, - assert_oc_called=None, **kwargs): - self._make_dummy_renewal_config() - with mock.patch('certbot.storage.RenewableCert') as mock_rc: - mock_lineage = mock.MagicMock() - mock_lineage.fullchain = "somepath/fullchain.pem" - if renewalparams is not None: - mock_lineage.configuration = {'renewalparams': renewalparams} - if names is not None: - mock_lineage.names.return_value = names - mock_rc.return_value = mock_lineage - with mock.patch('certbot.main.obtain_cert') as mock_obtain_cert: - kwargs.setdefault('args', ['renew']) - self._test_renewal_common(True, None, should_renew=False, **kwargs) - - if assert_oc_called is not None: - if assert_oc_called: - self.assertTrue(mock_obtain_cert.called) - else: - self.assertFalse(mock_obtain_cert.called) - - def test_renew_no_renewalparams(self): - self._test_renew_common(assert_oc_called=False, error_expected=True) - - def test_renew_no_authenticator(self): - self._test_renew_common(renewalparams={}, assert_oc_called=False, - error_expected=True) - - def test_renew_with_bad_int(self): - renewalparams = {'authenticator': 'webroot', - 'rsa_key_size': 'over 9000'} - self._test_renew_common(renewalparams=renewalparams, error_expected=True, - assert_oc_called=False) - - def test_renew_with_nonetype_http01(self): - renewalparams = {'authenticator': 'webroot', - 'http01_port': 'None'} - self._test_renew_common(renewalparams=renewalparams, - assert_oc_called=True) - - def test_renew_with_bad_domain(self): - renewalparams = {'authenticator': 'webroot'} - names = ['*.example.com'] - self._test_renew_common(renewalparams=renewalparams, error_expected=True, - names=names, assert_oc_called=False) - - def test_renew_with_configurator(self): - renewalparams = {'authenticator': 'webroot'} - self._test_renew_common( - renewalparams=renewalparams, assert_oc_called=True, - args='renew --configurator apache'.split()) - - def test_renew_plugin_config_restoration(self): - renewalparams = {'authenticator': 'webroot', - 'webroot_path': 'None', - 'webroot_imaginary_flag': '42'} - self._test_renew_common(renewalparams=renewalparams, - assert_oc_called=True) - - def test_renew_with_webroot_map(self): - renewalparams = {'authenticator': 'webroot'} - self._test_renew_common( - renewalparams=renewalparams, assert_oc_called=True, - args=['renew', '--webroot-map', '{"example.com": "/tmp"}']) - - def test_renew_reconstitute_error(self): - # pylint: disable=protected-access - with mock.patch('certbot.main.renewal._reconstitute') as mock_reconstitute: - mock_reconstitute.side_effect = Exception - self._test_renew_common(assert_oc_called=False, error_expected=True) - - def test_renew_obtain_cert_error(self): - self._make_dummy_renewal_config() - with mock.patch('certbot.storage.RenewableCert') as mock_rc: - mock_lineage = mock.MagicMock() - mock_lineage.fullchain = "somewhere/fullchain.pem" - mock_rc.return_value = mock_lineage - mock_lineage.configuration = { - 'renewalparams': {'authenticator': 'webroot'}} - with mock.patch('certbot.main.obtain_cert') as mock_obtain_cert: - mock_obtain_cert.side_effect = Exception - self._test_renewal_common(True, None, error_expected=True, - args=['renew'], should_renew=False) - - def test_renew_with_bad_cli_args(self): - self._test_renewal_common(True, None, args='renew -d example.com'.split(), - should_renew=False, error_expected=True) - self._test_renewal_common(True, None, args='renew --csr {0}'.format(CSR).split(), - should_renew=False, error_expected=True) - - @mock.patch('certbot.main.zope.component.getUtility') - @mock.patch('certbot.main._treat_as_renewal') - @mock.patch('certbot.main._init_le_client') - def test_certonly_reinstall(self, mock_init, mock_renewal, mock_get_utility): - mock_renewal.return_value = ('reinstall', mock.MagicMock()) - mock_init.return_value = mock_client = mock.MagicMock() - self._call(['-d', 'foo.bar', '-a', 'standalone', 'certonly']) - self.assertFalse(mock_client.obtain_certificate.called) - self.assertFalse(mock_client.obtain_and_enroll_certificate.called) - self.assertEqual(mock_get_utility().add_message.call_count, 0) - #self.assertTrue('donate' not in mock_get_utility().add_message.call_args[0][0]) - - def _test_certonly_csr_common(self, extra_args=None): - certr = 'certr' - chain = 'chain' - mock_client = mock.MagicMock() - mock_client.obtain_certificate_from_csr.return_value = (certr, chain) - cert_path = '/etc/letsencrypt/live/example.com/cert.pem' - mock_client.save_certificate.return_value = cert_path, None, None - with mock.patch('certbot.main._init_le_client') as mock_init: - mock_init.return_value = mock_client - get_utility_path = 'certbot.main.zope.component.getUtility' - with mock.patch(get_utility_path) as mock_get_utility: - chain_path = '/etc/letsencrypt/live/example.com/chain.pem' - full_path = '/etc/letsencrypt/live/example.com/fullchain.pem' - args = ('-a standalone certonly --csr {0} --cert-path {1} ' - '--chain-path {2} --fullchain-path {3}').format( - CSR, cert_path, chain_path, full_path).split() - if extra_args: - args += extra_args - with mock.patch('certbot.main.crypto_util'): - self._call(args) - - if '--dry-run' in args: - self.assertFalse(mock_client.save_certificate.called) - else: - mock_client.save_certificate.assert_called_once_with( - certr, chain, cert_path, chain_path, full_path) - - return mock_get_utility - - def test_certonly_csr(self): - mock_get_utility = self._test_certonly_csr_common() - cert_msg = mock_get_utility().add_message.call_args_list[0][0][0] - self.assertTrue('cert.pem' in cert_msg) - self.assertTrue( - 'donate' in mock_get_utility().add_message.call_args[0][0]) - - def test_certonly_csr_dry_run(self): - mock_get_utility = self._test_certonly_csr_common(['--dry-run']) - self.assertEqual(mock_get_utility().add_message.call_count, 1) - self.assertTrue( - 'dry run' in mock_get_utility().add_message.call_args[0][0]) - - @mock.patch('certbot.main.client.acme_client') - def test_revoke_with_key(self, mock_acme_client): - server = 'foo.bar' - self._call_no_clientmock(['--cert-path', CERT, '--key-path', KEY, - '--server', server, 'revoke']) - with open(KEY) as f: - mock_acme_client.Client.assert_called_once_with( - server, key=jose.JWK.load(f.read()), net=mock.ANY) - with open(CERT) as f: - cert = crypto_util.pyopenssl_load_certificate(f.read())[0] - mock_revoke = mock_acme_client.Client().revoke - mock_revoke.assert_called_once_with(jose.ComparableX509(cert)) - - @mock.patch('certbot.main._determine_account') - def test_revoke_without_key(self, mock_determine_account): - mock_determine_account.return_value = (mock.MagicMock(), None) - _, _, _, client = self._call(['--cert-path', CERT, 'revoke']) - with open(CERT) as f: - cert = crypto_util.pyopenssl_load_certificate(f.read())[0] - mock_revoke = client.acme_from_config_key().revoke - mock_revoke.assert_called_once_with(jose.ComparableX509(cert)) - - @mock.patch('certbot.main.sys') - def test_handle_exception(self, mock_sys): - # pylint: disable=protected-access - from acme import messages - - config = mock.MagicMock() - mock_open = mock.mock_open() - - with mock.patch('certbot.main.open', mock_open, create=True): - exception = Exception('detail') - config.verbose_count = 1 - main._handle_exception( - Exception, exc_value=exception, trace=None, config=None) - mock_open().write.assert_called_once_with(''.join( - traceback.format_exception_only(Exception, exception))) - error_msg = mock_sys.exit.call_args_list[0][0][0] - self.assertTrue('unexpected error' in error_msg) - - with mock.patch('certbot.main.open', mock_open, create=True): - mock_open.side_effect = [KeyboardInterrupt] - error = errors.Error('detail') - main._handle_exception( - errors.Error, exc_value=error, trace=None, config=None) - # assert_any_call used because sys.exit doesn't exit in cli.py - mock_sys.exit.assert_any_call(''.join( - traceback.format_exception_only(errors.Error, error))) - - exception = messages.Error(detail='alpha', typ='urn:acme:error:triffid', - title='beta') - config = mock.MagicMock(debug=False, verbose_count=-3) - main._handle_exception( - messages.Error, exc_value=exception, trace=None, config=config) - error_msg = mock_sys.exit.call_args_list[-1][0][0] - self.assertTrue('unexpected error' in error_msg) - self.assertTrue('acme:error' not in error_msg) - self.assertTrue('alpha' in error_msg) - self.assertTrue('beta' in error_msg) - config = mock.MagicMock(debug=False, verbose_count=1) - main._handle_exception( - messages.Error, exc_value=exception, trace=None, config=config) - error_msg = mock_sys.exit.call_args_list[-1][0][0] - self.assertTrue('unexpected error' in error_msg) - self.assertTrue('acme:error' in error_msg) - self.assertTrue('alpha' in error_msg) - - interrupt = KeyboardInterrupt('detail') - main._handle_exception( - KeyboardInterrupt, exc_value=interrupt, trace=None, config=None) - mock_sys.exit.assert_called_with(''.join( - traceback.format_exception_only(KeyboardInterrupt, interrupt))) - - # Test dialog errors - exception = dialog.error(message="test message") - main._handle_exception( - dialog.DialogError, exc_value=exception, trace=None, config=None) - error_msg = mock_sys.exit.call_args_list[-1][0][0] - self.assertTrue("test message" in error_msg) - - def test_read_file(self): - rel_test_path = os.path.relpath(os.path.join(self.tmp_dir, 'foo')) + def test_force_interactive(self): self.assertRaises( - argparse.ArgumentTypeError, cli.read_file, rel_test_path) - - test_contents = 'bar\n' - with open(rel_test_path, 'w') as f: - f.write(test_contents) - - path, contents = cli.read_file(rel_test_path) - self.assertEqual(path, os.path.abspath(path)) - self.assertEqual(contents, test_contents) - - def test_agree_dev_preview_config(self): - with mock.patch('certbot.main.run') as mocked_run: - self._call(['-c', test_util.vector_path('cli.ini')]) - self.assertTrue(mocked_run.called) - - def test_register(self): - with mock.patch('certbot.main.client') as mocked_client: - acc = mock.MagicMock() - acc.id = "imaginary_account" - mocked_client.register.return_value = (acc, "worked") - self._call_no_clientmock(["register", "--email", "user@example.org"]) - # TODO: It would be more correct to explicitly check that - # _determine_account() gets called in the above case, - # but coverage statistics should also show that it did. - with mock.patch('certbot.main.account') as mocked_account: - mocked_storage = mock.MagicMock() - mocked_account.AccountFileStorage.return_value = mocked_storage - mocked_storage.find_all.return_value = ["an account"] - x = self._call_no_clientmock(["register", "--email", "user@example.org"]) - self.assertTrue("There is an existing account" in x[0]) - - def test_update_registration_no_existing_accounts(self): - # with mock.patch('certbot.main.client') as mocked_client: - with mock.patch('certbot.main.account') as mocked_account: - mocked_storage = mock.MagicMock() - mocked_account.AccountFileStorage.return_value = mocked_storage - mocked_storage.find_all.return_value = [] - x = self._call_no_clientmock( - ["register", "--update-registration", "--email", - "user@example.org"]) - self.assertTrue("Could not find an existing account" in x[0]) - - def test_update_registration_unsafely(self): - # This test will become obsolete when register --update-registration - # supports removing an e-mail address from the account - with mock.patch('certbot.main.account') as mocked_account: - mocked_storage = mock.MagicMock() - mocked_account.AccountFileStorage.return_value = mocked_storage - mocked_storage.find_all.return_value = ["an account"] - x = self._call_no_clientmock( - "register --update-registration " - "--register-unsafely-without-email".split()) - self.assertTrue("--register-unsafely-without-email" in x[0]) - - @mock.patch('certbot.main.display_ops.get_email') - @mock.patch('certbot.main.zope.component.getUtility') - def test_update_registration_with_email(self, mock_utility, mock_email): - email = "user@example.com" - mock_email.return_value = email - with mock.patch('certbot.main.client') as mocked_client: - with mock.patch('certbot.main.account') as mocked_account: - with mock.patch('certbot.main._determine_account') as mocked_det: - with mock.patch('certbot.main.client') as mocked_client: - mocked_storage = mock.MagicMock() - mocked_account.AccountFileStorage.return_value = mocked_storage - mocked_storage.find_all.return_value = ["an account"] - mocked_det.return_value = (mock.MagicMock(), "foo") - acme_client = mock.MagicMock() - mocked_client.Client.return_value = acme_client - x = self._call_no_clientmock( - ["register", "--update-registration"]) - # When registration change succeeds, the return value - # of register() is None - self.assertTrue(x[0] is None) - # and we got supposedly did update the registration from - # the server - self.assertTrue( - acme_client.acme.update_registration.called) - # and we saved the updated registration on disk - self.assertTrue(mocked_storage.save_regr.called) - self.assertTrue( - email in mock_utility().add_message.call_args[0][0]) - - def test_conflicting_args(self): - args = ['renew', '--dialog', '--text'] - self.assertRaises(errors.Error, self._call, args) - - def test_text_mode_when_verbose(self): - parse = self._get_argument_parser() - short_args = ['-v'] - namespace = parse(short_args) - self.assertTrue(namespace.text_mode) - - -class DetermineAccountTest(unittest.TestCase): - """Tests for certbot.cli._determine_account.""" - - def setUp(self): - self.args = mock.MagicMock(account=None, email=None, - register_unsafely_without_email=False) - self.config = configuration.NamespaceConfig(self.args) - self.accs = [mock.MagicMock(id='x'), mock.MagicMock(id='y')] - self.account_storage = account.AccountMemoryStorage() - - def _call(self): - # pylint: disable=protected-access - from certbot.main import _determine_account - with mock.patch('certbot.main.account.AccountFileStorage') as mock_storage: - mock_storage.return_value = self.account_storage - return _determine_account(self.config) - - def test_args_account_set(self): - self.account_storage.save(self.accs[1]) - self.config.account = self.accs[1].id - self.assertEqual((self.accs[1], None), self._call()) - self.assertEqual(self.accs[1].id, self.config.account) - self.assertTrue(self.config.email is None) - - def test_single_account(self): - self.account_storage.save(self.accs[0]) - self.assertEqual((self.accs[0], None), self._call()) - self.assertEqual(self.accs[0].id, self.config.account) - self.assertTrue(self.config.email is None) - - @mock.patch('certbot.client.display_ops.choose_account') - def test_multiple_accounts(self, mock_choose_accounts): - for acc in self.accs: - self.account_storage.save(acc) - mock_choose_accounts.return_value = self.accs[1] - self.assertEqual((self.accs[1], None), self._call()) - self.assertEqual( - set(mock_choose_accounts.call_args[0][0]), set(self.accs)) - self.assertEqual(self.accs[1].id, self.config.account) - self.assertTrue(self.config.email is None) - - @mock.patch('certbot.client.display_ops.get_email') - def test_no_accounts_no_email(self, mock_get_email): - mock_get_email.return_value = 'foo@bar.baz' - - with mock.patch('certbot.main.client') as client: - client.register.return_value = ( - self.accs[0], mock.sentinel.acme) - self.assertEqual((self.accs[0], mock.sentinel.acme), self._call()) - client.register.assert_called_once_with( - self.config, self.account_storage, tos_cb=mock.ANY) - - self.assertEqual(self.accs[0].id, self.config.account) - self.assertEqual('foo@bar.baz', self.config.email) - - def test_no_accounts_email(self): - self.config.email = 'other email' - with mock.patch('certbot.main.client') as client: - client.register.return_value = (self.accs[1], mock.sentinel.acme) - self._call() - self.assertEqual(self.accs[1].id, self.config.account) - self.assertEqual('other email', self.config.email) - - -class DuplicativeCertsTest(storage_test.BaseRenewableCertTest): - """Test to avoid duplicate lineages.""" - - def setUp(self): - super(DuplicativeCertsTest, self).setUp() - self.config.write() - self._write_out_ex_kinds() - - def tearDown(self): - shutil.rmtree(self.tempdir) - - @mock.patch('certbot.util.make_or_verify_dir') - def test_find_duplicative_names(self, unused_makedir): - from certbot.main import _find_duplicative_certs - test_cert = test_util.load_vector('cert-san.pem') - with open(self.test_rc.cert, 'w') as f: - f.write(test_cert) - - # No overlap at all - result = _find_duplicative_certs( - self.cli_config, ['wow.net', 'hooray.org']) - self.assertEqual(result, (None, None)) - - # Totally identical - result = _find_duplicative_certs( - self.cli_config, ['example.com', 'www.example.com']) - self.assertTrue(result[0].configfile.filename.endswith('example.org.conf')) - self.assertEqual(result[1], None) - - # Superset - result = _find_duplicative_certs( - self.cli_config, ['example.com', 'www.example.com', 'something.new']) - self.assertEqual(result[0], None) - self.assertTrue(result[1].configfile.filename.endswith('example.org.conf')) - - # Partial overlap doesn't count - result = _find_duplicative_certs( - self.cli_config, ['example.com', 'something.new']) - self.assertEqual(result, (None, None)) + errors.Error, self.parse, "renew --force-interactive".split()) + self.assertRaises( + errors.Error, self.parse, "-n --force-interactive".split()) class DefaultTest(unittest.TestCase): """Tests for certbot.cli._Default.""" + _multiprocess_can_split_ = True + def setUp(self): # pylint: disable=protected-access self.default1 = cli._Default() @@ -1154,6 +293,8 @@ class DefaultTest(unittest.TestCase): class SetByCliTest(unittest.TestCase): """Tests for certbot.set_by_cli and related functions.""" + _multiprocess_can_split_ = True + def setUp(self): reload_module(cli) @@ -1164,22 +305,22 @@ class SetByCliTest(unittest.TestCase): def test_report_config_interaction_str(self): cli.report_config_interaction('manual_public_ip_logging_ok', - 'manual_test_mode') - cli.report_config_interaction('manual_test_mode', 'manual') + 'manual_auth_hook') + cli.report_config_interaction('manual_auth_hook', 'manual') self._test_report_config_interaction_common() def test_report_config_interaction_iterable(self): cli.report_config_interaction(('manual_public_ip_logging_ok',), - ('manual_test_mode',)) - cli.report_config_interaction(('manual_test_mode',), ('manual',)) + ('manual_auth_hook',)) + cli.report_config_interaction(('manual_auth_hook',), ('manual',)) self._test_report_config_interaction_common() def _test_report_config_interaction_common(self): """Tests implied interaction between manual flags. - --manual implies --manual-test-mode which implies + --manual implies --manual-auth-hook which implies --manual-public-ip-logging-ok. These interactions don't actually exist in the client, but are used here for testing purposes. @@ -1187,13 +328,13 @@ class SetByCliTest(unittest.TestCase): args = ['--manual'] verb = 'renew' - for v in ('manual', 'manual_test_mode', 'manual_public_ip_logging_ok'): + for v in ('manual', 'manual_auth_hook', 'manual_public_ip_logging_ok'): self.assertTrue(_call_set_by_cli(v, args, verb)) cli.set_by_cli.detector = None - args = ['--manual-test-mode'] - for v in ('manual_test_mode', 'manual_public_ip_logging_ok'): + args = ['--manual-auth-hook', 'command'] + for v in ('manual_auth_hook', 'manual_public_ip_logging_ok'): self.assertTrue(_call_set_by_cli(v, args, verb)) self.assertFalse(_call_set_by_cli('manual', args, verb)) diff --git a/certbot/tests/client_test.py b/certbot/tests/client_test.py index 4310cb76f..50668a2eb 100644 --- a/certbot/tests/client_test.py +++ b/certbot/tests/client_test.py @@ -13,7 +13,7 @@ from certbot import account from certbot import errors from certbot import util -from certbot.tests import test_util +import certbot.tests.util as test_util KEY = test_util.load_vector("rsa512_key.pem") @@ -64,13 +64,23 @@ class RegisterTest(unittest.TestCase): @mock.patch("certbot.client.display_ops.get_email") def test_email_retry(self, _rep, mock_get_email): from acme import messages + self.config.noninteractive_mode = False msg = "DNS problem: NXDOMAIN looking up MX for example.com" - mx_err = messages.Error(detail=msg, typ="urn:acme:error:invalidEmail") + mx_err = messages.Error.with_code('invalidContact', detail=msg) with mock.patch("certbot.client.acme_client.Client") as mock_client: mock_client().register.side_effect = [mx_err, mock.MagicMock()] self._call() self.assertEqual(mock_get_email.call_count, 1) + @mock.patch("certbot.account.report_new_account") + def test_email_invalid_noninteractive(self, _rep): + from acme import messages + msg = "DNS problem: NXDOMAIN looking up MX for example.com" + mx_err = messages.Error.with_code('invalidContact', detail=msg) + with mock.patch("certbot.client.acme_client.Client") as mock_client: + mock_client().register.side_effect = [mx_err, mock.MagicMock()] + self.assertRaises(errors.Error, self._call) + def test_needs_email(self): self.config.email = None self.assertRaises(errors.Error, self._call) @@ -94,17 +104,18 @@ class RegisterTest(unittest.TestCase): self.assertRaises(messages.Error, self._call) -class ClientTest(unittest.TestCase): - # pylint: disable=too-many-public-methods - """Tests for certbot.client.Client.""" - +class ClientTestCommon(unittest.TestCase): + """Common base class for certbot.client.Client tests.""" def setUp(self): self.config = mock.MagicMock( - no_verify_ssl=False, config_dir="/etc/letsencrypt", allow_subset_of_names=False, + no_verify_ssl=False, + config_dir="/etc/letsencrypt", + work_dir="/var/lib/letsencrypt", + allow_subset_of_names=False, key_types="rsa") + # pylint: disable=star-args self.account = mock.MagicMock(**{"key.pem": KEY}) - self.eg_domains = ["example.com", "www.example.com"] from certbot.client import Client with mock.patch("certbot.client.acme_client.Client") as acme: @@ -114,6 +125,17 @@ class ClientTest(unittest.TestCase): config=self.config, account_=self.account, auth=None, installer=None) + +class ClientTest(ClientTestCommon): + # pylint: disable=too-many-public-methods + """Tests for certbot.client.Client.""" + def setUp(self): + super(ClientTest, self).setUp() + + self.config.allow_subset_of_names = False + self.config.config_dir = "/etc/letsencrypt" + self.eg_domains = ["example.com", "www.example.com"] + def test_init_acme_verify_ssl(self): net = self.acme_client.call_args[1]["net"] self.assertTrue(net.verify_ssl) @@ -335,6 +357,27 @@ class ClientTest(unittest.TestCase): self.assertRaises(errors.Error, self.client.obtain_certificate, domains) + @mock.patch('certbot.client.Client.obtain_certificate') + @mock.patch('certbot.storage.RenewableCert.new_lineage') + @mock.patch('OpenSSL.crypto.dump_certificate') + def test_obtain_and_enroll_certificate(self, mock_dump_certificate, + mock_storage, mock_obtain_certificate): + domains = ["example.com", "www.example.com"] + mock_obtain_certificate.return_value = (mock.MagicMock(), + mock.MagicMock(), mock.MagicMock(), None) + + self.client.config.dry_run = False + self.assertTrue(self.client.obtain_and_enroll_certificate(domains, "example_cert")) + + self.assertTrue(self.client.obtain_and_enroll_certificate(domains, None)) + + self.client.config.dry_run = True + + self.assertFalse(self.client.obtain_and_enroll_certificate(domains, None)) + + self.assertTrue(mock_storage.call_count == 2) + self.assertTrue(mock_dump_certificate.call_count == 2) + @mock.patch("certbot.cli.helpful_parser") def test_save_certificate(self, mock_parser): # pylint: disable=too-many-locals @@ -364,11 +407,11 @@ class ClientTest(unittest.TestCase): self.assertEqual(os.path.dirname(fullchain_path), os.path.dirname(candidate_fullchain_path)) - with open(cert_path, "r") as cert_file: + with open(cert_path, "rb") as cert_file: cert_contents = cert_file.read() self.assertEqual(cert_contents, test_util.load_vector(certs[0])) - with open(chain_path, "r") as chain_file: + with open(chain_path, "rb") as chain_file: chain_contents = chain_file.read() self.assertEqual(chain_contents, test_util.load_vector(certs[1]) + test_util.load_vector(certs[2])) @@ -436,137 +479,109 @@ class ClientTest(unittest.TestCase): installer.rollback_checkpoints.assert_called_once_with() self.assertEqual(installer.restart.call_count, 1) - @mock.patch("certbot.client.enhancements") - def test_enhance_config(self, mock_enhancements): - config = ConfigHelper(redirect=True, hsts=False, uir=False) - self.assertRaises(errors.Error, - self.client.enhance_config, ["foo.bar"], config) - mock_enhancements.ask.return_value = True - installer = mock.MagicMock() - self.client.installer = installer - installer.supported_enhancements.return_value = ["redirect"] +class EnhanceConfigTest(ClientTestCommon): + """Tests for certbot.client.Client.enhance_config.""" + def setUp(self): + super(EnhanceConfigTest, self).setUp() - self.client.enhance_config(["foo.bar"], config) - installer.enhance.assert_called_once_with("foo.bar", "redirect", None) - self.assertEqual(installer.save.call_count, 1) - installer.restart.assert_called_once_with() + self.config.hsts = False + self.config.redirect = False + self.config.staple = False + self.config.uir = False + self.domain = "example.org" + + def test_no_installer(self): + self.assertRaises( + errors.Error, self.client.enhance_config, [self.domain], None) @mock.patch("certbot.client.enhancements") - def test_enhance_config_no_ask(self, mock_enhancements): - config = ConfigHelper(redirect=True, hsts=False, uir=False) - self.assertRaises(errors.Error, - self.client.enhance_config, ["foo.bar"], config) + def test_unsupported(self, mock_enhancements): + self.client.installer = mock.MagicMock() + self.client.installer.supported_enhancements.return_value = [] - mock_enhancements.ask.return_value = True - installer = mock.MagicMock() - self.client.installer = installer - installer.supported_enhancements.return_value = ["redirect", "ensure-http-header"] - - config = ConfigHelper(redirect=True, hsts=False, uir=False) - self.client.enhance_config(["foo.bar"], config) - installer.enhance.assert_called_with("foo.bar", "redirect", None) - - config = ConfigHelper(redirect=False, hsts=True, uir=False) - self.client.enhance_config(["foo.bar"], config) - installer.enhance.assert_called_with("foo.bar", "ensure-http-header", - "Strict-Transport-Security") - - config = ConfigHelper(redirect=False, hsts=False, uir=True) - self.client.enhance_config(["foo.bar"], config) - installer.enhance.assert_called_with("foo.bar", "ensure-http-header", - "Upgrade-Insecure-Requests") - - self.assertEqual(installer.save.call_count, 3) - self.assertEqual(installer.restart.call_count, 3) - - @mock.patch("certbot.client.enhancements") - def test_enhance_config_unsupported(self, mock_enhancements): - installer = mock.MagicMock() - self.client.installer = installer - installer.supported_enhancements.return_value = [] - - config = ConfigHelper(redirect=None, hsts=True, uir=True) - self.client.enhance_config(["foo.bar"], config) - installer.enhance.assert_not_called() + self.config.redirect = None + self.config.hsts = True + with mock.patch("certbot.client.logger") as mock_logger: + self.client.enhance_config([self.domain], None) + self.assertEqual(mock_logger.warning.call_count, 1) + self.client.installer.enhance.assert_not_called() mock_enhancements.ask.assert_not_called() - def test_enhance_config_no_installer(self): - config = ConfigHelper(redirect=True, hsts=False, uir=False) - self.assertRaises(errors.Error, - self.client.enhance_config, ["foo.bar"], config) + def test_no_ask_hsts(self): + self.config.hsts = True + self._test_with_all_supported() + self.client.installer.enhance.assert_called_with( + self.domain, "ensure-http-header", "Strict-Transport-Security") - @mock.patch("certbot.client.zope.component.getUtility") - @mock.patch("certbot.client.enhancements") - def test_enhance_config_enhance_failure(self, mock_enhancements, - mock_get_utility): - mock_enhancements.ask.return_value = True + def test_no_ask_redirect(self): + self.config.redirect = True + self._test_with_all_supported() + self.client.installer.enhance.assert_called_with( + self.domain, "redirect", None) + + def test_no_ask_staple(self): + self.config.staple = True + self._test_with_all_supported() + self.client.installer.enhance.assert_called_with( + self.domain, "staple-ocsp", None) + + def test_no_ask_uir(self): + self.config.uir = True + self._test_with_all_supported() + self.client.installer.enhance.assert_called_with( + self.domain, "ensure-http-header", "Upgrade-Insecure-Requests") + + def test_enhance_failure(self): + self.client.installer = mock.MagicMock() + self.client.installer.enhance.side_effect = errors.PluginError + self._test_error() + self.client.installer.recovery_routine.assert_called_once_with() + + def test_save_failure(self): + self.client.installer = mock.MagicMock() + self.client.installer.save.side_effect = errors.PluginError + self._test_error() + self.client.installer.recovery_routine.assert_called_once_with() + self.client.installer.save.assert_called_once_with(mock.ANY) + + def test_restart_failure(self): + self.client.installer = mock.MagicMock() + self.client.installer.restart.side_effect = [errors.PluginError, None] + self._test_error_with_rollback() + + def test_restart_failure2(self): installer = mock.MagicMock() - self.client.installer = installer - installer.supported_enhancements.return_value = ["redirect"] - installer.enhance.side_effect = errors.PluginError - - config = ConfigHelper(redirect=True, hsts=False, uir=False) - - self.assertRaises(errors.PluginError, - self.client.enhance_config, ["foo.bar"], config) - installer.recovery_routine.assert_called_once_with() - self.assertEqual(mock_get_utility().add_message.call_count, 1) - - @mock.patch("certbot.client.zope.component.getUtility") - @mock.patch("certbot.client.enhancements") - def test_enhance_config_save_failure(self, mock_enhancements, - mock_get_utility): - mock_enhancements.ask.return_value = True - installer = mock.MagicMock() - self.client.installer = installer - installer.supported_enhancements.return_value = ["redirect"] - installer.save.side_effect = errors.PluginError - - config = ConfigHelper(redirect=True, hsts=False, uir=False) - - self.assertRaises(errors.PluginError, - self.client.enhance_config, ["foo.bar"], config) - installer.recovery_routine.assert_called_once_with() - self.assertEqual(mock_get_utility().add_message.call_count, 1) - - @mock.patch("certbot.client.zope.component.getUtility") - @mock.patch("certbot.client.enhancements") - def test_enhance_config_restart_failure(self, mock_enhancements, - mock_get_utility): - mock_enhancements.ask.return_value = True - installer = mock.MagicMock() - self.client.installer = installer - installer.supported_enhancements.return_value = ["redirect"] - installer.restart.side_effect = [errors.PluginError, None] - - config = ConfigHelper(redirect=True, hsts=False, uir=False) - - self.assertRaises(errors.PluginError, - self.client.enhance_config, ["foo.bar"], config) - - self.assertEqual(mock_get_utility().add_message.call_count, 1) - installer.rollback_checkpoints.assert_called_once_with() - self.assertEqual(installer.restart.call_count, 2) - - @mock.patch("certbot.client.zope.component.getUtility") - @mock.patch("certbot.client.enhancements") - def test_enhance_config_restart_failure2(self, mock_enhancements, - mock_get_utility): - mock_enhancements.ask.return_value = True - installer = mock.MagicMock() - self.client.installer = installer - installer.supported_enhancements.return_value = ["redirect"] installer.restart.side_effect = errors.PluginError installer.rollback_checkpoints.side_effect = errors.ReverterError + self.client.installer = installer + self._test_error_with_rollback() - config = ConfigHelper(redirect=True, hsts=False, uir=False) + @mock.patch("certbot.client.enhancements.ask") + def test_ask(self, mock_ask): + self.config.redirect = None + mock_ask.return_value = True + self._test_with_all_supported() - self.assertRaises(errors.PluginError, - self.client.enhance_config, ["foo.bar"], config) - self.assertEqual(mock_get_utility().add_message.call_count, 1) - installer.rollback_checkpoints.assert_called_once_with() - self.assertEqual(installer.restart.call_count, 1) + def _test_error_with_rollback(self): + self._test_error() + self.assertTrue(self.client.installer.restart.called) + + def _test_error(self): + self.config.redirect = True + with mock.patch("certbot.client.zope.component.getUtility") as mock_gu: + self.assertRaises( + errors.PluginError, self._test_with_all_supported) + self.assertEqual(mock_gu().add_message.call_count, 1) + + def _test_with_all_supported(self): + if self.client.installer is None: + self.client.installer = mock.MagicMock() + self.client.installer.supported_enhancements.return_value = [ + "ensure-http-header", "redirect", "staple-ocsp"] + self.client.enhance_config([self.domain], None) + self.assertEqual(self.client.installer.save.call_count, 1) + self.assertEqual(self.client.installer.restart.call_count, 1) class RollbackTest(unittest.TestCase): diff --git a/certbot/tests/configuration_test.py b/certbot/tests/configuration_test.py index 13d85bd9f..183d6a95c 100644 --- a/certbot/tests/configuration_test.py +++ b/certbot/tests/configuration_test.py @@ -60,6 +60,7 @@ class NamespaceConfigTest(unittest.TestCase): config_base = "foo" work_base = "bar" logs_base = "baz" + server = "mock.server" mock_namespace = mock.MagicMock(spec=['config_dir', 'work_dir', 'logs_dir', 'http01_port', @@ -68,6 +69,7 @@ class NamespaceConfigTest(unittest.TestCase): mock_namespace.config_dir = config_base mock_namespace.work_dir = work_base mock_namespace.logs_dir = logs_base + mock_namespace.server = server config = NamespaceConfig(mock_namespace) self.assertTrue(os.path.isabs(config.config_dir)) @@ -86,31 +88,19 @@ class NamespaceConfigTest(unittest.TestCase): self.assertTrue(os.path.isabs(config.key_dir)) self.assertTrue(os.path.isabs(config.temp_checkpoint_dir)) - -class RenewerConfigurationTest(unittest.TestCase): - """Test for certbot.configuration.RenewerConfiguration.""" - - def setUp(self): - self.namespace = mock.MagicMock(config_dir='/tmp/config') - from certbot.configuration import RenewerConfiguration - self.config = RenewerConfiguration(self.namespace) - @mock.patch('certbot.configuration.constants') - def test_dynamic_dirs(self, constants): + def test_renewal_dynamic_dirs(self, constants): constants.ARCHIVE_DIR = 'a' constants.LIVE_DIR = 'l' constants.RENEWAL_CONFIGS_DIR = 'renewal_configs' - constants.RENEWER_CONFIG_FILENAME = 'r.conf' - self.assertEqual(self.config.archive_dir, '/tmp/config/a') + self.assertEqual(self.config.default_archive_dir, '/tmp/config/a') self.assertEqual(self.config.live_dir, '/tmp/config/l') self.assertEqual( self.config.renewal_configs_dir, '/tmp/config/renewal_configs') - self.assertEqual(self.config.renewer_config_file, '/tmp/config/r.conf') - def test_absolute_paths(self): + def test_renewal_absolute_paths(self): from certbot.configuration import NamespaceConfig - from certbot.configuration import RenewerConfiguration config_base = "foo" work_base = "bar" @@ -123,12 +113,11 @@ class RenewerConfigurationTest(unittest.TestCase): mock_namespace.config_dir = config_base mock_namespace.work_dir = work_base mock_namespace.logs_dir = logs_base - config = RenewerConfiguration(NamespaceConfig(mock_namespace)) + config = NamespaceConfig(mock_namespace) - self.assertTrue(os.path.isabs(config.archive_dir)) + self.assertTrue(os.path.isabs(config.default_archive_dir)) self.assertTrue(os.path.isabs(config.live_dir)) self.assertTrue(os.path.isabs(config.renewal_configs_dir)) - self.assertTrue(os.path.isabs(config.renewer_config_file)) if __name__ == '__main__': diff --git a/certbot/tests/crypto_util_test.py b/certbot/tests/crypto_util_test.py index 6d3c91f31..eb76bbff9 100644 --- a/certbot/tests/crypto_util_test.py +++ b/certbot/tests/crypto_util_test.py @@ -11,7 +11,7 @@ import zope.component from certbot import errors from certbot import interfaces from certbot import util -from certbot.tests import test_util +import certbot.tests.util as test_util RSA256_KEY = test_util.load_vector('rsa256_key.pem') RSA512_KEY = test_util.load_vector('rsa512_key.pem') @@ -59,13 +59,13 @@ class InitSaveCSRTest(unittest.TestCase): def test_it(self, unused_mock_verify, mock_csr): from certbot.crypto_util import init_save_csr - mock_csr.return_value = ('csr_pem', 'csr_der') + mock_csr.return_value = (b'csr_pem', b'csr_der') csr = init_save_csr( mock.Mock(pem='dummy_key'), 'example.com', self.csr_dir, 'csr-certbot.pem') - self.assertEqual(csr.data, 'csr_der') + self.assertEqual(csr.data, b'csr_der') self.assertTrue('csr-certbot.pem' in csr.file) @@ -103,7 +103,7 @@ class MakeCSRTest(unittest.TestCase): # OpenSSL.crypto.X509Extension doesn't give us the extension's raw OID, # and the shortname field is just "UNDEF" must_staple_exts = [e for e in csr.get_extensions() - if e.get_data() == "0\x03\x02\x01\x05"] + if e.get_data() == b"0\x03\x02\x01\x05"] self.assertEqual(len(must_staple_exts), 1, "Expected exactly one Must Staple extension") @@ -350,7 +350,7 @@ class CertLoaderTest(unittest.TestCase): def test_load_invalid_cert(self): from certbot.crypto_util import pyopenssl_load_certificate - bad_cert_data = CERT.replace("BEGIN CERTIFICATE", "ASDFASDFASDF!!!") + bad_cert_data = CERT.replace(b"BEGIN CERTIFICATE", b"ASDFASDFASDF!!!") self.assertRaises( errors.Error, pyopenssl_load_certificate, bad_cert_data) diff --git a/certbot/tests/display/ops_test.py b/certbot/tests/display/ops_test.py index 26f67b69f..e2735cbde 100644 --- a/certbot/tests/display/ops_test.py +++ b/certbot/tests/display/ops_test.py @@ -17,7 +17,7 @@ from certbot import interfaces from certbot.display import util as display_util -from certbot.tests import test_util +import certbot.tests.util as test_util KEY = jose.JWKRSA.load(test_util.load_vector("rsa512_key.pem")) @@ -72,11 +72,20 @@ class GetEmailTest(unittest.TestCase): self.assertTrue( "--register-unsafely-without-email" not in call[0][0]) + def test_optional_invalid_unsafe(self): + invalid_txt = "There seem to be problems" + self.input.return_value = (display_util.OK, "foo@bar.baz") + with mock.patch("certbot.display.ops.util.safe_email") as mock_safe_email: + mock_safe_email.side_effect = [False, True] + self._call(invalid=True) + self.assertTrue(invalid_txt in self.input.call_args[0][0]) + class ChooseAccountTest(unittest.TestCase): """Tests for certbot.display.ops.choose_account.""" def setUp(self): - zope.component.provideUtility(display_util.FileDisplay(sys.stdout)) + zope.component.provideUtility(display_util.FileDisplay(sys.stdout, + False)) self.accounts_dir = tempfile.mkdtemp("accounts") self.account_keys_dir = os.path.join(self.accounts_dir, "keys") @@ -119,7 +128,8 @@ class ChooseAccountTest(unittest.TestCase): class GenSSLLabURLs(unittest.TestCase): """Loose test of _gen_ssl_lab_urls. URL can change easily in the future.""" def setUp(self): - zope.component.provideUtility(display_util.FileDisplay(sys.stdout)) + zope.component.provideUtility(display_util.FileDisplay(sys.stdout, + False)) @classmethod def _call(cls, domains): @@ -138,7 +148,8 @@ class GenSSLLabURLs(unittest.TestCase): class GenHttpsNamesTest(unittest.TestCase): """Test _gen_https_names.""" def setUp(self): - zope.component.provideUtility(display_util.FileDisplay(sys.stdout)) + zope.component.provideUtility(display_util.FileDisplay(sys.stdout, + False)) @classmethod def _call(cls, domains): @@ -185,7 +196,8 @@ class GenHttpsNamesTest(unittest.TestCase): class ChooseNamesTest(unittest.TestCase): """Test choose names.""" def setUp(self): - zope.component.provideUtility(display_util.FileDisplay(sys.stdout)) + zope.component.provideUtility(display_util.FileDisplay(sys.stdout, + False)) self.mock_install = mock.MagicMock() @classmethod @@ -206,20 +218,53 @@ class ChooseNamesTest(unittest.TestCase): @mock.patch("certbot.display.ops.z_util") def test_no_names_choose(self, mock_util): self.mock_install().get_all_names.return_value = set() - mock_util().yesno.return_value = True domain = "example.com" mock_util().input.return_value = (display_util.OK, domain) actual_doms = self._call(self.mock_install) self.assertEqual(mock_util().input.call_count, 1) self.assertEqual(actual_doms, [domain]) + self.assertTrue( + "configuration files" in mock_util().input.call_args[0][0]) - @mock.patch("certbot.display.ops.z_util") - def test_no_names_quit(self, mock_util): - self.mock_install().get_all_names.return_value = set() - mock_util().yesno.return_value = False + def test_sort_names_trivial(self): + from certbot.display.ops import _sort_names + + #sort an empty list + self.assertEqual(_sort_names([]), []) + + #sort simple domains + some_domains = ["ex.com", "zx.com", "ax.com"] + self.assertEqual(_sort_names(some_domains), ["ax.com", "ex.com", "zx.com"]) + + #Sort subdomains of a single domain + domain = ".ex.com" + unsorted_short = ["e", "a", "z", "y"] + unsorted_long = [us + domain for us in unsorted_short] + + sorted_short = sorted(unsorted_short) + sorted_long = [us + domain for us in sorted_short] + + self.assertEqual(_sort_names(unsorted_long), sorted_long) + + def test_sort_names_many(self): + from certbot.display.ops import _sort_names + + unsorted_domains = [".cx.com", ".bx.com", ".ax.com", ".dx.com"] + unsorted_short = ["www", "bnother.long.subdomain", "a", "a.long.subdomain", "z", "b"] + #Of course sorted doesn't work here ;-) + sorted_short = ["a", "b", "a.long.subdomain", "bnother.long.subdomain", "www", "z"] + + to_sort = [] + for short in unsorted_short: + for domain in unsorted_domains: + to_sort.append(short+domain) + sortd = [] + for domain in sorted(unsorted_domains): + for short in sorted_short: + sortd.append(short+domain) + self.assertEqual(_sort_names(to_sort), sortd) - self.assertEqual(self._call(self.mock_install), []) @mock.patch("certbot.display.ops.z_util") def test_filter_names_valid_return(self, mock_util): @@ -250,8 +295,8 @@ class ChooseNamesTest(unittest.TestCase): all_valid = ["example.com", "second.example.com", "also.example.com", "under_score.example.com", "justtld"] - all_invalid = ["xn--ls8h.tld", "*.wildcard.com", "uniçodé.com"] - two_valid = ["example.com", "xn--ls8h.tld", "also.example.com"] + all_invalid = ["öóòps.net", "*.wildcard.com", "uniçodé.com"] + two_valid = ["example.com", "úniçøde.com", "also.example.com"] self.assertEqual(get_valid_domains(all_valid), all_valid) self.assertEqual(get_valid_domains(all_invalid), []) self.assertEqual(len(get_valid_domains(two_valid)), 2) @@ -272,10 +317,6 @@ class ChooseNamesTest(unittest.TestCase): unicode_error = UnicodeEncodeError('mock', u'', 0, 1, 'mock') mock_sli.side_effect = unicode_error self.assertEqual(_choose_names_manually(), []) - # Punycode and no retry - mock_util().input.return_value = (display_util.OK, - "xn--ls8h.tld") - self.assertEqual(_choose_names_manually(), []) # Valid domains mock_util().input.return_value = (display_util.OK, ("example.com," @@ -323,7 +364,7 @@ class SuccessRenewalTest(unittest.TestCase): @classmethod def _call(cls, names): from certbot.display.ops import success_renewal - success_renewal(names, "renew") + success_renewal(names) @mock.patch("certbot.display.ops.z_util") def test_success_renewal(self, mock_util): @@ -338,6 +379,21 @@ class SuccessRenewalTest(unittest.TestCase): for name in names: self.assertTrue(name in arg) +class SuccessRevocationTest(unittest.TestCase): + # pylint: disable=too-few-public-methods + """Test the success revocation message.""" + @classmethod + def _call(cls, path): + from certbot.display.ops import success_revocation + success_revocation(path) + + @mock.patch("certbot.display.ops.z_util") + def test_success_revocation(self, mock_util): + mock_util().notification.return_value = None + path = "/path/to/cert.pem" + self._call(path) + mock_util().notification.assert_called_once() + self.assertTrue(path in mock_util().notification.call_args[0][0]) if __name__ == "__main__": unittest.main() # pragma: no cover diff --git a/certbot/tests/display/util_test.py b/certbot/tests/display/util_test.py index a6ced90ab..7b6bd842e 100644 --- a/certbot/tests/display/util_test.py +++ b/certbot/tests/display/util_test.py @@ -13,125 +13,6 @@ CHOICES = [("First", "Description1"), ("Second", "Description2")] TAGS = ["tag1", "tag2", "tag3"] TAGS_CHOICES = [("1", "tag1"), ("2", "tag2"), ("3", "tag3")] - -class NcursesDisplayTest(unittest.TestCase): - """Test ncurses display. - - Since this is mostly a wrapper, it might be more helpful to test the - actual dialog boxes. The test file located in ./tests/display.py - (relative to the root of the repository) will actually display the - various boxes but requires the user to do the verification. If - something seems amiss please use that test script to debug it, the - automatic tests rely on too much mocking. - - """ - def setUp(self): - super(NcursesDisplayTest, self).setUp() - self.displayer = display_util.NcursesDisplay() - - self.default_menu_options = { - "choices": CHOICES, - "ok_label": "OK", - "cancel_label": "Cancel", - "help_button": False, - "help_label": "", - "width": display_util.WIDTH, - "height": display_util.HEIGHT, - "menu_height": display_util.HEIGHT - 6, - } - - @mock.patch("certbot.display.util.dialog.Dialog.msgbox") - def test_notification(self, mock_msgbox): - """Kind of worthless... one liner.""" - self.displayer.notification("message") - self.assertEqual(mock_msgbox.call_count, 1) - - @mock.patch("certbot.display.util.dialog.Dialog.menu") - def test_menu_tag_and_desc(self, mock_menu): - mock_menu.return_value = (display_util.OK, "First") - - ret = self.displayer.menu("Message", CHOICES) - mock_menu.assert_called_with("Message", **self.default_menu_options) - - self.assertEqual(ret, (display_util.OK, 0)) - - @mock.patch("certbot.display.util.dialog.Dialog.menu") - def test_menu_tag_and_desc_cancel(self, mock_menu): - mock_menu.return_value = (display_util.CANCEL, "") - - ret = self.displayer.menu("Message", CHOICES) - - mock_menu.assert_called_with("Message", **self.default_menu_options) - - self.assertEqual(ret, (display_util.CANCEL, -1)) - - @mock.patch("certbot.display.util.dialog.Dialog.menu") - def test_menu_desc_only(self, mock_menu): - mock_menu.return_value = (display_util.OK, "1") - - ret = self.displayer.menu("Message", TAGS, help_label="More Info") - - self.default_menu_options.update( - choices=TAGS_CHOICES, help_button=True, help_label="More Info") - mock_menu.assert_called_with("Message", **self.default_menu_options) - - self.assertEqual(ret, (display_util.OK, 0)) - - @mock.patch("certbot.display.util.dialog.Dialog.menu") - def test_menu_desc_only_help(self, mock_menu): - mock_menu.return_value = (display_util.HELP, "2") - - ret = self.displayer.menu("Message", TAGS, help_label="More Info") - - self.assertEqual(ret, (display_util.HELP, 1)) - - @mock.patch("certbot.display.util.dialog.Dialog.menu") - def test_menu_desc_only_cancel(self, mock_menu): - mock_menu.return_value = (display_util.CANCEL, "") - - ret = self.displayer.menu("Message", TAGS, help_label="More Info") - - self.assertEqual(ret, (display_util.CANCEL, -1)) - - @mock.patch("certbot.display.util." - "dialog.Dialog.inputbox") - def test_input(self, mock_input): - mock_input.return_value = (mock.MagicMock(), mock.MagicMock()) - self.displayer.input("message") - self.assertEqual(mock_input.call_count, 1) - - @mock.patch("certbot.display.util.dialog.Dialog.yesno") - def test_yesno(self, mock_yesno): - mock_yesno.return_value = display_util.OK - - self.assertTrue(self.displayer.yesno("message")) - - mock_yesno.assert_called_with( - "message", display_util.HEIGHT, display_util.WIDTH, - yes_label="Yes", no_label="No") - - @mock.patch("certbot.display.util." - "dialog.Dialog.checklist") - def test_checklist(self, mock_checklist): - mock_checklist.return_value = (mock.MagicMock(), mock.MagicMock()) - self.displayer.checklist("message", TAGS) - - choices = [ - (TAGS[0], "", True), - (TAGS[1], "", True), - (TAGS[2], "", True), - ] - mock_checklist.assert_called_with( - "message", width=display_util.WIDTH, height=display_util.HEIGHT, - choices=choices) - - @mock.patch("certbot.display.util.dialog.Dialog.dselect") - def test_directory_select(self, mock_dselect): - mock_dselect.return_value = (mock.MagicMock(), mock.MagicMock()) - self.displayer.directory_select("message") - self.assertEqual(mock_dselect.call_count, 1) - - class FileOutputDisplayTest(unittest.TestCase): """Test stdout display. @@ -139,85 +20,142 @@ class FileOutputDisplayTest(unittest.TestCase): functions look to a user, uncomment the test_visual function. """ + # pylint:disable=too-many-public-methods def setUp(self): super(FileOutputDisplayTest, self).setUp() self.mock_stdout = mock.MagicMock() - self.displayer = display_util.FileDisplay(self.mock_stdout) + self.displayer = display_util.FileDisplay(self.mock_stdout, False) def test_notification_no_pause(self): - self.displayer.notification("message", 10, False) + self.displayer.notification("message", False) string = self.mock_stdout.write.call_args[0][0] self.assertTrue("message" in string) def test_notification_pause(self): - with mock.patch("__builtin__.raw_input", return_value="enter"): - self.displayer.notification("message") + with mock.patch("six.moves.input", return_value="enter"): + self.displayer.notification("message", force_interactive=True) self.assertTrue("message" in self.mock_stdout.write.call_args[0][0]) + def test_notification_noninteractive(self): + self._force_noninteractive(self.displayer.notification, "message") + string = self.mock_stdout.write.call_args[0][0] + self.assertTrue("message" in string) + + def test_notification_noninteractive2(self): + # The main purpose of this test is to make sure we only call + # logger.warning once which _force_noninteractive checks internally + self._force_noninteractive(self.displayer.notification, "message") + string = self.mock_stdout.write.call_args[0][0] + self.assertTrue("message" in string) + + self.assertTrue(self.displayer.skipped_interaction) + + self._force_noninteractive(self.displayer.notification, "message2") + string = self.mock_stdout.write.call_args[0][0] + self.assertTrue("message2" in string) + @mock.patch("certbot.display.util." "FileDisplay._get_valid_int_ans") def test_menu(self, mock_ans): mock_ans.return_value = (display_util.OK, 1) - ret = self.displayer.menu("message", CHOICES) + ret = self.displayer.menu("message", CHOICES, force_interactive=True) self.assertEqual(ret, (display_util.OK, 0)) + def test_menu_noninteractive(self): + default = 0 + result = self._force_noninteractive( + self.displayer.menu, "msg", CHOICES, default=default) + self.assertEqual(result, (display_util.OK, default)) + def test_input_cancel(self): - with mock.patch("__builtin__.raw_input", return_value="c"): - code, _ = self.displayer.input("message") + with mock.patch("six.moves.input", return_value="c"): + code, _ = self.displayer.input("message", force_interactive=True) self.assertTrue(code, display_util.CANCEL) def test_input_normal(self): - with mock.patch("__builtin__.raw_input", return_value="domain.com"): - code, input_ = self.displayer.input("message") + with mock.patch("six.moves.input", return_value="domain.com"): + code, input_ = self.displayer.input("message", force_interactive=True) self.assertEqual(code, display_util.OK) self.assertEqual(input_, "domain.com") + def test_input_noninteractive(self): + default = "foo" + code, input_ = self._force_noninteractive( + self.displayer.input, "message", default=default) + + self.assertEqual(code, display_util.OK) + self.assertEqual(input_, default) + + def test_input_assertion_fail(self): + self.assertRaises(AssertionError, self._force_noninteractive, + self.displayer.input, "message", cli_flag="--flag") + def test_yesno(self): - with mock.patch("__builtin__.raw_input", return_value="Yes"): - self.assertTrue(self.displayer.yesno("message")) - with mock.patch("__builtin__.raw_input", return_value="y"): - self.assertTrue(self.displayer.yesno("message")) - with mock.patch("__builtin__.raw_input", side_effect=["maybe", "y"]): - self.assertTrue(self.displayer.yesno("message")) - with mock.patch("__builtin__.raw_input", return_value="No"): - self.assertFalse(self.displayer.yesno("message")) - with mock.patch("__builtin__.raw_input", side_effect=["cancel", "n"]): - self.assertFalse(self.displayer.yesno("message")) + with mock.patch("six.moves.input", return_value="Yes"): + self.assertTrue(self.displayer.yesno( + "message", force_interactive=True)) + with mock.patch("six.moves.input", return_value="y"): + self.assertTrue(self.displayer.yesno( + "message", force_interactive=True)) + with mock.patch("six.moves.input", side_effect=["maybe", "y"]): + self.assertTrue(self.displayer.yesno( + "message", force_interactive=True)) + with mock.patch("six.moves.input", return_value="No"): + self.assertFalse(self.displayer.yesno( + "message", force_interactive=True)) + with mock.patch("six.moves.input", side_effect=["cancel", "n"]): + self.assertFalse(self.displayer.yesno( + "message", force_interactive=True)) - with mock.patch("__builtin__.raw_input", return_value="a"): - self.assertTrue(self.displayer.yesno("msg", yes_label="Agree")) + with mock.patch("six.moves.input", return_value="a"): + self.assertTrue(self.displayer.yesno( + "msg", yes_label="Agree", force_interactive=True)) - @mock.patch("certbot.display.util.FileDisplay.input") + def test_yesno_noninteractive(self): + self.assertTrue(self._force_noninteractive( + self.displayer.yesno, "message", default=True)) + + @mock.patch("certbot.display.util.six.moves.input") def test_checklist_valid(self, mock_input): - mock_input.return_value = (display_util.OK, "2 1") - code, tag_list = self.displayer.checklist("msg", TAGS) + mock_input.return_value = "2 1" + code, tag_list = self.displayer.checklist( + "msg", TAGS, force_interactive=True) self.assertEqual( (code, set(tag_list)), (display_util.OK, set(["tag1", "tag2"]))) - @mock.patch("certbot.display.util.FileDisplay.input") - def test_checklist_miss_valid(self, mock_input): - mock_input.side_effect = [ - (display_util.OK, "10"), - (display_util.OK, "tag1 please"), - (display_util.OK, "1") - ] + @mock.patch("certbot.display.util.six.moves.input") + def test_checklist_empty(self, mock_input): + mock_input.return_value = "" + code, tag_list = self.displayer.checklist("msg", TAGS, force_interactive=True) + self.assertEqual( + (code, set(tag_list)), (display_util.OK, set(["tag1", "tag2", "tag3"]))) - ret = self.displayer.checklist("msg", TAGS) + @mock.patch("certbot.display.util.six.moves.input") + def test_checklist_miss_valid(self, mock_input): + mock_input.side_effect = ["10", "tag1 please", "1"] + + ret = self.displayer.checklist("msg", TAGS, force_interactive=True) self.assertEqual(ret, (display_util.OK, ["tag1"])) - @mock.patch("certbot.display.util.FileDisplay.input") + @mock.patch("certbot.display.util.six.moves.input") def test_checklist_miss_quit(self, mock_input): - mock_input.side_effect = [ - (display_util.OK, "10"), - (display_util.CANCEL, "1") - ] - ret = self.displayer.checklist("msg", TAGS) + mock_input.side_effect = ["10", "c"] + + ret = self.displayer.checklist("msg", TAGS, force_interactive=True) self.assertEqual(ret, (display_util.CANCEL, [])) + def test_checklist_noninteractive(self): + default = TAGS + code, input_ = self._force_noninteractive( + self.displayer.checklist, "msg", TAGS, default=default) + + self.assertEqual(code, display_util.OK) + self.assertEqual(input_, default) + def test_scrub_checklist_input_valid(self): # pylint: disable=protected-access indices = [ @@ -235,14 +173,38 @@ class FileOutputDisplayTest(unittest.TestCase): self.displayer._scrub_checklist_input(list_, TAGS)) self.assertEqual(set_tags, exp[i]) - @mock.patch("certbot.display.util.FileDisplay.input") + @mock.patch("certbot.display.util.six.moves.input") def test_directory_select(self, mock_input): - message = "msg" - result = (display_util.OK, "/var/www/html",) - mock_input.return_value = result + # pylint: disable=star-args + args = ["msg", "/var/www/html", "--flag", True] + user_input = "/var/www/html" + mock_input.return_value = user_input - self.assertEqual(self.displayer.directory_select(message), result) - mock_input.assert_called_once_with(message) + returned = self.displayer.directory_select(*args) + self.assertEqual(returned, (display_util.OK, user_input)) + + def test_directory_select_noninteractive(self): + default = "/var/www/html" + code, input_ = self._force_noninteractive( + self.displayer.directory_select, "msg", default=default) + + self.assertEqual(code, display_util.OK) + self.assertEqual(input_, default) + + def _force_noninteractive(self, func, *args, **kwargs): + skipped_interaction = self.displayer.skipped_interaction + + with mock.patch("certbot.display.util.sys.stdin") as mock_stdin: + mock_stdin.isatty.return_value = False + with mock.patch("certbot.display.util.logger") as mock_logger: + result = func(*args, **kwargs) + + if skipped_interaction: + self.assertFalse(mock_logger.warning.called) + else: + self.assertEqual(mock_logger.warning.call_count, 1) + + return result def test_scrub_checklist_input_invalid(self): # pylint: disable=protected-access @@ -275,11 +237,11 @@ class FileOutputDisplayTest(unittest.TestCase): def test_get_valid_int_ans_valid(self): # pylint: disable=protected-access - with mock.patch("__builtin__.raw_input", return_value="1"): + with mock.patch("six.moves.input", return_value="1"): self.assertEqual( self.displayer._get_valid_int_ans(1), (display_util.OK, 1)) ans = "2" - with mock.patch("__builtin__.raw_input", return_value=ans): + with mock.patch("six.moves.input", return_value=ans): self.assertEqual( self.displayer._get_valid_int_ans(3), (display_util.OK, int(ans))) @@ -292,7 +254,7 @@ class FileOutputDisplayTest(unittest.TestCase): ["c"], ] for ans in answers: - with mock.patch("__builtin__.raw_input", side_effect=ans): + with mock.patch("six.moves.input", side_effect=ans): self.assertEqual( self.displayer._get_valid_int_ans(3), (display_util.CANCEL, -1)) diff --git a/certbot/tests/error_handler_test.py b/certbot/tests/error_handler_test.py index fa60d07b8..a548377bd 100644 --- a/certbot/tests/error_handler_test.py +++ b/certbot/tests/error_handler_test.py @@ -7,6 +7,7 @@ import unittest import mock + def get_signals(signums): """Get the handlers for an iterable of signums.""" return dict((s, signal.getsignal(s)) for s in signums) diff --git a/certbot/tests/errors_test.py b/certbot/tests/errors_test.py index 67611ed45..f35a5ea08 100644 --- a/certbot/tests/errors_test.py +++ b/certbot/tests/errors_test.py @@ -16,12 +16,12 @@ class FaiiledChallengesTest(unittest.TestCase): from certbot.errors import FailedChallenges self.error = FailedChallenges(set([achallenges.DNS( domain="example.com", challb=messages.ChallengeBody( - chall=acme_util.DNS, uri=None, + chall=acme_util.DNS01, uri=None, error=messages.Error(typ="tls", detail="detail")))])) def test_str(self): self.assertTrue(str(self.error).startswith( - "Failed authorization procedure. example.com (dns): tls")) + "Failed authorization procedure. example.com (dns-01): tls")) class StandaloneBindErrorTest(unittest.TestCase): diff --git a/certbot/tests/log_test.py b/certbot/tests/log_test.py deleted file mode 100644 index a4f394870..000000000 --- a/certbot/tests/log_test.py +++ /dev/null @@ -1,48 +0,0 @@ -"""Tests for certbot.log.""" -import logging -import unittest - -import mock - - -class DialogHandlerTest(unittest.TestCase): - - def setUp(self): - self.d = mock.MagicMock() - - from certbot.log import DialogHandler - self.handler = DialogHandler(height=2, width=6, d=self.d) - self.handler.PADDING_HEIGHT = 2 - self.handler.PADDING_WIDTH = 4 - - def test_adds_padding(self): - self.handler.emit(logging.makeLogRecord({})) - self.d.infobox.assert_called_once_with(mock.ANY, 4, 10) - - def test_args_in_msg_get_replaced(self): - assert len('123456') <= self.handler.width - self.handler.emit(logging.makeLogRecord( - {'msg': '123%s', 'args': (456,)})) - self.d.infobox.assert_called_once_with('123456', mock.ANY, mock.ANY) - - def test_wraps_nospace_is_greedy(self): - assert len('1234567') > self.handler.width - self.handler.emit(logging.makeLogRecord({'msg': '1234567'})) - self.d.infobox.assert_called_once_with('123456\n7', mock.ANY, mock.ANY) - - def test_wraps_at_whitespace(self): - assert len('123 567') > self.handler.width - self.handler.emit(logging.makeLogRecord({'msg': '123 567'})) - self.d.infobox.assert_called_once_with('123\n567', mock.ANY, mock.ANY) - - def test_only_last_lines_are_printed(self): - assert len('a\nb\nc'.split()) > self.handler.height - self.handler.emit(logging.makeLogRecord({'msg': 'a\n\nb\nc'})) - self.d.infobox.assert_called_once_with('b\nc', mock.ANY, mock.ANY) - - def test_non_str(self): - self.handler.emit(logging.makeLogRecord({'msg': {'foo': 'bar'}})) - - -if __name__ == '__main__': - unittest.main() # pragma: no cover diff --git a/certbot/tests/main_test.py b/certbot/tests/main_test.py index 32df525f0..673952b4e 100644 --- a/certbot/tests/main_test.py +++ b/certbot/tests/main_test.py @@ -1,15 +1,99 @@ """Tests for certbot.main.""" +from __future__ import print_function + +import itertools +import mock import os import shutil import tempfile +import traceback import unittest +import datetime +import pytz -import mock +import six +from acme import jose + +from certbot import account from certbot import cli +from certbot import colored_logging +from certbot import constants from certbot import configuration +from certbot import crypto_util from certbot import errors -from certbot.plugins import disco as plugins_disco +from certbot import main +from certbot import renewal +from certbot import storage +from certbot import util + +from certbot.plugins import disco +from certbot.plugins import manual + +import certbot.tests.util as test_util + +CERT_PATH = test_util.vector_path('cert.pem') +CERT = test_util.vector_path('cert.pem') +CSR = test_util.vector_path('csr.der') +KEY = test_util.vector_path('rsa256_key.pem') +JWK = jose.JWKRSA.load(test_util.load_vector("rsa512_key_2.pem")) + + +class TestHandleIdenticalCerts(unittest.TestCase): + """Test for certbot.main._handle_identical_cert_request""" + def test_handle_identical_cert_request_pending(self): + mock_lineage = mock.Mock() + mock_lineage.ensure_deployed.return_value = False + # pylint: disable=protected-access + ret = main._handle_identical_cert_request(mock.Mock(), mock_lineage) + self.assertEqual(ret, ("reinstall", mock_lineage)) + + +class RunTest(unittest.TestCase): + """Tests for certbot.main.run.""" + + def setUp(self): + self.domain = 'example.org' + self.patches = [ + mock.patch('certbot.main._auth_from_available'), + mock.patch('certbot.main.display_ops.success_installation'), + mock.patch('certbot.main.display_ops.success_renewal'), + mock.patch('certbot.main._init_le_client'), + mock.patch('certbot.main._suggest_donation_if_appropriate')] + + self.mock_auth = self.patches[0].start() + self.mock_success_installation = self.patches[1].start() + self.mock_success_renewal = self.patches[2].start() + self.mock_init = self.patches[3].start() + self.mock_suggest_donation = self.patches[4].start() + + def tearDown(self): + for patch in self.patches: + patch.stop() + + def _call(self): + args = '-a webroot -i null -d {0}'.format(self.domain).split() + plugins = disco.PluginsRegistry.find_all() + config = configuration.NamespaceConfig( + cli.prepare_and_parse_args(plugins, args)) + + from certbot.main import run + run(config, plugins) + + def test_newcert_success(self): + self.mock_auth.return_value = ('newcert', mock.Mock()) + self._call() + self.mock_success_installation.assert_called_once_with([self.domain]) + + def test_reinstall_success(self): + self.mock_auth.return_value = ('reinstall', mock.Mock()) + self._call() + self.mock_success_installation.assert_called_once_with([self.domain]) + + def test_renewal_success(self): + self.mock_auth.return_value = ('renewal', mock.Mock()) + self._call() + self.mock_success_renewal.assert_called_once_with([self.domain]) class ObtainCertTest(unittest.TestCase): @@ -24,27 +108,159 @@ class ObtainCertTest(unittest.TestCase): self.get_utility_patch.stop() def _call(self, args): - plugins = plugins_disco.PluginsRegistry.find_all() + plugins = disco.PluginsRegistry.find_all() config = configuration.NamespaceConfig( cli.prepare_and_parse_args(plugins, args)) - from certbot import main with mock.patch('certbot.main._init_le_client') as mock_init: main.obtain_cert(config, plugins) return mock_init() # returns the client - @mock.patch('certbot.main._auth_from_domains') + @mock.patch('certbot.main._auth_from_available') def test_no_reinstall_text_pause(self, mock_auth): mock_notification = self.mock_get_utility().notification mock_notification.side_effect = self._assert_no_pause - mock_auth.return_value = (mock.ANY, 'reinstall') - self._call('certonly --webroot -d example.com -t'.split()) + mock_auth.return_value = ('reinstall', mock.ANY) + self._call('certonly --webroot -d example.com'.split()) - def _assert_no_pause(self, message, height=42, pause=True): + def _assert_no_pause(self, message, pause=True): # pylint: disable=unused-argument self.assertFalse(pause) + @mock.patch('certbot.cert_manager.lineage_for_certname') + @mock.patch('certbot.cert_manager.domains_for_certname') + @mock.patch('certbot.renewal.renew_cert') + @mock.patch('certbot.main._report_new_cert') + def test_find_lineage_for_domains_and_certname(self, mock_report_cert, + mock_renew_cert, mock_domains, mock_lineage): + domains = ['example.com', 'test.org'] + mock_domains.return_value = domains + mock_lineage.names.return_value = domains + self._call(('certonly --webroot -d example.com -d test.org ' + '--cert-name example.com').split()) + self.assertTrue(mock_lineage.call_count == 1) + self.assertTrue(mock_domains.call_count == 1) + self.assertTrue(mock_renew_cert.call_count == 1) + self.assertTrue(mock_report_cert.call_count == 1) + + # user confirms updating lineage with new domains + self._call(('certonly --webroot -d example.com -d test.com ' + '--cert-name example.com').split()) + self.assertTrue(mock_lineage.call_count == 2) + self.assertTrue(mock_domains.call_count == 2) + self.assertTrue(mock_renew_cert.call_count == 2) + self.assertTrue(mock_report_cert.call_count == 2) + + # error in _ask_user_to_confirm_new_names + util_mock = mock.Mock() + util_mock.yesno.return_value = False + self.mock_get_utility.return_value = util_mock + self.assertRaises(errors.ConfigurationError, self._call, + ('certonly --webroot -d example.com -d test.com --cert-name example.com').split()) + + @mock.patch('certbot.cert_manager.domains_for_certname') + @mock.patch('certbot.display.ops.choose_names') + @mock.patch('certbot.cert_manager.lineage_for_certname') + @mock.patch('certbot.main._report_new_cert') + def test_find_lineage_for_domains_new_certname(self, mock_report_cert, + mock_lineage, mock_choose_names, mock_domains_for_certname): + mock_lineage.return_value = None + + # no lineage with this name but we specified domains so create a new cert + self._call(('certonly --webroot -d example.com -d test.com ' + '--cert-name example.com').split()) + self.assertTrue(mock_lineage.call_count == 1) + self.assertTrue(mock_report_cert.call_count == 1) + + # no lineage with this name and we didn't give domains + mock_choose_names.return_value = ["somename"] + mock_domains_for_certname.return_value = None + self._call(('certonly --webroot --cert-name example.com').split()) + self.assertTrue(mock_choose_names.called) + +class FindDomainsOrCertnameTest(unittest.TestCase): + """Tests for certbot.main._find_domains_or_certname.""" + + @mock.patch('certbot.display.ops.choose_names') + def test_display_ops(self, mock_choose_names): + mock_config = mock.Mock(domains=None, certname=None) + mock_choose_names.return_value = "domainname" + # pylint: disable=protected-access + self.assertEqual(main._find_domains_or_certname(mock_config, None), + ("domainname", None)) + + @mock.patch('certbot.display.ops.choose_names') + def test_no_results(self, mock_choose_names): + mock_config = mock.Mock(domains=None, certname=None) + mock_choose_names.return_value = [] + # pylint: disable=protected-access + self.assertRaises(errors.Error, main._find_domains_or_certname, mock_config, None) + + @mock.patch('certbot.cert_manager.domains_for_certname') + def test_grab_domains(self, mock_domains): + mock_config = mock.Mock(domains=None, certname="one.com") + mock_domains.return_value = ["one.com", "two.com"] + # pylint: disable=protected-access + self.assertEqual(main._find_domains_or_certname(mock_config, None), + (["one.com", "two.com"], "one.com")) + + +class RevokeTest(unittest.TestCase): + """Tests for certbot.main.revoke.""" + + def setUp(self): + self.tempdir_path = tempfile.mkdtemp() + shutil.copy(CERT_PATH, self.tempdir_path) + self.tmp_cert_path = os.path.abspath(os.path.join(self.tempdir_path, + 'cert.pem')) + + self.patches = [ + mock.patch('acme.client.Client'), + mock.patch('certbot.client.Client'), + mock.patch('certbot.main._determine_account'), + mock.patch('certbot.main.display_ops.success_revocation') + ] + self.mock_acme_client = self.patches[0].start() + self.patches[1].start() + self.mock_determine_account = self.patches[2].start() + self.mock_success_revoke = self.patches[3].start() + + from certbot.account import Account + + self.regr = mock.MagicMock() + self.meta = Account.Meta( + creation_host="test.certbot.org", + creation_dt=datetime.datetime( + 2015, 7, 4, 14, 4, 10, tzinfo=pytz.UTC)) + self.acc = Account(self.regr, JWK, self.meta) + + self.mock_determine_account.return_value = (self.acc, None) + + def tearDown(self): + shutil.rmtree(self.tempdir_path) + for patch in self.patches: + patch.stop() + + def _call(self): + args = 'revoke --cert-path={0}'.format(self.tmp_cert_path).split() + plugins = disco.PluginsRegistry.find_all() + config = configuration.NamespaceConfig( + cli.prepare_and_parse_args(plugins, args)) + + from certbot.main import revoke + revoke(config, plugins) + + def test_revocation_success(self): + self._call() + self.mock_success_revoke.assert_called_once_with(self.tmp_cert_path) + + def test_revocation_error(self): + from acme import errors as acme_errors + self.mock_acme_client.side_effect = acme_errors.ClientError() + self.assertRaises(acme_errors.ClientError, self._call) + self.mock_success_revoke.assert_not_called() + class SetupLogFileHandlerTest(unittest.TestCase): """Tests for certbot.main.setup_log_file_handler.""" @@ -67,6 +283,43 @@ class SetupLogFileHandlerTest(unittest.TestCase): self.config, "test.log", "%s") +class SetupLoggingTest(unittest.TestCase): + """Tests for certbot.main.setup_logging.""" + + def setUp(self): + self.config = mock.Mock( + logs_dir=tempfile.mkdtemp(), + noninteractive_mode=False, quiet=False, + verbose_count=constants.CLI_DEFAULTS['verbose_count']) + + def tearDown(self): + shutil.rmtree(self.config.logs_dir) + + @classmethod + def _call(cls, *args, **kwargs): + from certbot.main import setup_logging + return setup_logging(*args, **kwargs) + + @mock.patch('certbot.main.logging.getLogger') + def test_defaults(self, mock_get_logger): + self._call(self.config) + + cli_handler = mock_get_logger().addHandler.call_args_list[0][0][0] + self.assertEqual(cli_handler.level, -self.config.verbose_count * 10) + self.assertTrue( + isinstance(cli_handler, colored_logging.StreamHandler)) + + @mock.patch('certbot.main.logging.getLogger') + def test_quiet_mode(self, mock_get_logger): + self.config.quiet = self.config.noninteractive_mode = True + self._call(self.config) + + cli_handler = mock_get_logger().addHandler.call_args_list[0][0][0] + self.assertEqual(cli_handler.level, constants.QUIET_LOGGING_LEVEL) + self.assertTrue( + isinstance(cli_handler, colored_logging.StreamHandler)) + + class MakeOrVerifyCoreDirTest(unittest.TestCase): """Tests for certbot.main.make_or_verify_core_dir.""" @@ -92,5 +345,858 @@ class MakeOrVerifyCoreDirTest(unittest.TestCase): self.dir, 0o700, os.geteuid(), False) +class DetermineAccountTest(unittest.TestCase): + """Tests for certbot.main._determine_account.""" + + def setUp(self): + self.args = mock.MagicMock(account=None, email=None, + register_unsafely_without_email=False) + self.config = configuration.NamespaceConfig(self.args) + self.accs = [mock.MagicMock(id='x'), mock.MagicMock(id='y')] + self.account_storage = account.AccountMemoryStorage() + + def _call(self): + # pylint: disable=protected-access + from certbot.main import _determine_account + with mock.patch('certbot.main.account.AccountFileStorage') as mock_storage: + mock_storage.return_value = self.account_storage + return _determine_account(self.config) + + def test_args_account_set(self): + self.account_storage.save(self.accs[1]) + self.config.account = self.accs[1].id + self.assertEqual((self.accs[1], None), self._call()) + self.assertEqual(self.accs[1].id, self.config.account) + self.assertTrue(self.config.email is None) + + def test_single_account(self): + self.account_storage.save(self.accs[0]) + self.assertEqual((self.accs[0], None), self._call()) + self.assertEqual(self.accs[0].id, self.config.account) + self.assertTrue(self.config.email is None) + + @mock.patch('certbot.client.display_ops.choose_account') + def test_multiple_accounts(self, mock_choose_accounts): + for acc in self.accs: + self.account_storage.save(acc) + mock_choose_accounts.return_value = self.accs[1] + self.assertEqual((self.accs[1], None), self._call()) + self.assertEqual( + set(mock_choose_accounts.call_args[0][0]), set(self.accs)) + self.assertEqual(self.accs[1].id, self.config.account) + self.assertTrue(self.config.email is None) + + @mock.patch('certbot.client.display_ops.get_email') + def test_no_accounts_no_email(self, mock_get_email): + mock_get_email.return_value = 'foo@bar.baz' + + with mock.patch('certbot.main.client') as client: + client.register.return_value = ( + self.accs[0], mock.sentinel.acme) + self.assertEqual((self.accs[0], mock.sentinel.acme), self._call()) + client.register.assert_called_once_with( + self.config, self.account_storage, tos_cb=mock.ANY) + + self.assertEqual(self.accs[0].id, self.config.account) + self.assertEqual('foo@bar.baz', self.config.email) + + def test_no_accounts_email(self): + self.config.email = 'other email' + with mock.patch('certbot.main.client') as client: + client.register.return_value = (self.accs[1], mock.sentinel.acme) + self._call() + self.assertEqual(self.accs[1].id, self.config.account) + self.assertEqual('other email', self.config.email) + + +class MainTest(unittest.TestCase): # pylint: disable=too-many-public-methods + """Tests for different commands.""" + + def setUp(self): + self.tmp_dir = tempfile.mkdtemp() + self.config_dir = os.path.join(self.tmp_dir, 'config') + self.work_dir = os.path.join(self.tmp_dir, 'work') + self.logs_dir = os.path.join(self.tmp_dir, 'logs') + os.mkdir(self.logs_dir) + self.standard_args = ['--config-dir', self.config_dir, + '--work-dir', self.work_dir, + '--logs-dir', self.logs_dir, '--text'] + + def tearDown(self): + shutil.rmtree(self.tmp_dir) + # Reset globals in cli + # pylint: disable=protected-access + cli._parser = cli.set_by_cli.detector = None + + def _call(self, args, stdout=None): + "Run the cli with output streams and actual client mocked out" + with mock.patch('certbot.main.client') as client: + ret, stdout, stderr = self._call_no_clientmock(args, stdout) + return ret, stdout, stderr, client + + def _call_no_clientmock(self, args, stdout=None): + "Run the client with output streams mocked out" + args = self.standard_args + args + + toy_stdout = stdout if stdout else six.StringIO() + with mock.patch('certbot.main.sys.stdout', new=toy_stdout): + with mock.patch('certbot.main.sys.stderr') as stderr: + ret = main.main(args[:]) # NOTE: parser can alter its args! + return ret, toy_stdout, stderr + + def test_no_flags(self): + with mock.patch('certbot.main.run') as mock_run: + self._call([]) + self.assertEqual(1, mock_run.call_count) + + def test_version_string_program_name(self): + toy_out = six.StringIO() + toy_err = six.StringIO() + with mock.patch('certbot.main.sys.stdout', new=toy_out): + with mock.patch('certbot.main.sys.stderr', new=toy_err): + try: + main.main(["--version"]) + except SystemExit: + pass + finally: + output = toy_out.getvalue() or toy_err.getvalue() + self.assertTrue("certbot" in output, "Output is {0}".format(output)) + toy_out.close() + toy_err.close() + + def _cli_missing_flag(self, args, message): + "Ensure that a particular error raises a missing cli flag error containing message" + exc = None + try: + with mock.patch('certbot.main.sys.stderr'): + main.main(self.standard_args + args[:]) # NOTE: parser can alter its args! + except errors.MissingCommandlineFlag as exc_: + exc = exc_ + self.assertTrue(message in str(exc)) + self.assertTrue(exc is not None) + + def test_noninteractive(self): + args = ['-n', 'certonly'] + self._cli_missing_flag(args, "specify a plugin") + args.extend(['--standalone', '-d', 'eg.is']) + self._cli_missing_flag(args, "register before running") + with mock.patch('certbot.main._auth_from_available'): + with mock.patch('certbot.main.client.acme_from_config_key'): + args.extend(['--email', 'io@io.is']) + self._cli_missing_flag(args, "--agree-tos") + + @mock.patch('certbot.main.client.acme_client.Client') + @mock.patch('certbot.main._determine_account') + @mock.patch('certbot.main.client.Client.obtain_and_enroll_certificate') + @mock.patch('certbot.main._auth_from_available') + def test_user_agent(self, afa, _obt, det, _client): + # Normally the client is totally mocked out, but here we need more + # arguments to automate it... + args = ["--standalone", "certonly", "-m", "none@none.com", + "-d", "example.com", '--agree-tos'] + self.standard_args + det.return_value = mock.MagicMock(), None + afa.return_value = "newcert", mock.MagicMock() + + with mock.patch('certbot.main.client.acme_client.ClientNetwork') as acme_net: + self._call_no_clientmock(args) + os_ver = util.get_os_info_ua() + ua = acme_net.call_args[1]["user_agent"] + self.assertTrue(os_ver in ua) + import platform + plat = platform.platform() + if "linux" in plat.lower(): + self.assertTrue(util.get_os_info_ua() in ua) + + with mock.patch('certbot.main.client.acme_client.ClientNetwork') as acme_net: + ua = "bandersnatch" + args += ["--user-agent", ua] + self._call_no_clientmock(args) + acme_net.assert_called_once_with(mock.ANY, verify_ssl=True, user_agent=ua) + + @mock.patch('certbot.main.plug_sel.record_chosen_plugins') + @mock.patch('certbot.main.plug_sel.pick_installer') + def test_installer_selection(self, mock_pick_installer, _rec): + self._call(['install', '--domains', 'foo.bar', '--cert-path', 'cert', + '--key-path', 'key', '--chain-path', 'chain']) + self.assertEqual(mock_pick_installer.call_count, 1) + + @mock.patch('certbot.util.exe_exists') + def test_configurator_selection(self, mock_exe_exists): + mock_exe_exists.return_value = True + real_plugins = disco.PluginsRegistry.find_all() + args = ['--apache', '--authenticator', 'standalone'] + + # This needed two calls to find_all(), which we're avoiding for now + # because of possible side effects: + # https://github.com/letsencrypt/letsencrypt/commit/51ed2b681f87b1eb29088dd48718a54f401e4855 + #with mock.patch('certbot.cli.plugins_testable') as plugins: + # plugins.return_value = {"apache": True, "nginx": True} + # ret, _, _, _ = self._call(args) + # self.assertTrue("Too many flags setting" in ret) + + args = ["install", "--nginx", "--cert-path", "/tmp/blah", "--key-path", "/tmp/blah", + "--nginx-server-root", "/nonexistent/thing", "-d", + "example.com", "--debug"] + if "nginx" in real_plugins: + # Sending nginx a non-existent conf dir will simulate misconfiguration + # (we can only do that if certbot-nginx is actually present) + ret, _, _, _ = self._call(args) + self.assertTrue("The nginx plugin is not working" in ret) + self.assertTrue("MisconfigurationError" in ret) + + self._cli_missing_flag(["--standalone"], "With the standalone plugin, you probably") + + with mock.patch("certbot.main._init_le_client") as mock_init: + with mock.patch("certbot.main._auth_from_available") as mock_afa: + mock_afa.return_value = (mock.MagicMock(), mock.MagicMock()) + self._call(["certonly", "--manual", "-d", "foo.bar"]) + unused_config, auth, unused_installer = mock_init.call_args[0] + self.assertTrue(isinstance(auth, manual.Authenticator)) + + with mock.patch('certbot.main.obtain_cert') as mock_certonly: + self._call(["auth", "--standalone"]) + self.assertEqual(1, mock_certonly.call_count) + + def test_rollback(self): + _, _, _, client = self._call(['rollback']) + self.assertEqual(1, client.rollback.call_count) + + _, _, _, client = self._call(['rollback', '--checkpoints', '123']) + client.rollback.assert_called_once_with( + mock.ANY, 123, mock.ANY, mock.ANY) + + def test_config_changes(self): + _, _, _, client = self._call(['config_changes']) + self.assertEqual(1, client.view_config_changes.call_count) + + @mock.patch('certbot.cert_manager.update_live_symlinks') + def test_update_symlinks(self, mock_cert_manager): + self._call_no_clientmock(['update_symlinks']) + self.assertEqual(1, mock_cert_manager.call_count) + + @mock.patch('certbot.cert_manager.certificates') + def test_certificates(self, mock_cert_manager): + self._call_no_clientmock(['certificates']) + self.assertEqual(1, mock_cert_manager.call_count) + + @mock.patch('certbot.cert_manager.delete') + def test_delete(self, mock_cert_manager): + self._call_no_clientmock(['delete']) + self.assertEqual(1, mock_cert_manager.call_count) + + def test_plugins(self): + flags = ['--init', '--prepare', '--authenticators', '--installers'] + for args in itertools.chain( + *(itertools.combinations(flags, r) + for r in six.moves.range(len(flags)))): + self._call(['plugins'] + list(args)) + + @mock.patch('certbot.main.plugins_disco') + @mock.patch('certbot.main.cli.HelpfulArgumentParser.determine_help_topics') + def test_plugins_no_args(self, _det, mock_disco): + ifaces = [] + plugins = mock_disco.PluginsRegistry.find_all() + + _, stdout, _, _ = self._call(['plugins']) + plugins.visible.assert_called_once_with() + plugins.visible().ifaces.assert_called_once_with(ifaces) + filtered = plugins.visible().ifaces() + self.assertEqual(stdout.getvalue().strip(), str(filtered)) + + @mock.patch('certbot.main.plugins_disco') + @mock.patch('certbot.main.cli.HelpfulArgumentParser.determine_help_topics') + def test_plugins_init(self, _det, mock_disco): + ifaces = [] + plugins = mock_disco.PluginsRegistry.find_all() + + _, stdout, _, _ = self._call(['plugins', '--init']) + plugins.visible.assert_called_once_with() + plugins.visible().ifaces.assert_called_once_with(ifaces) + filtered = plugins.visible().ifaces() + self.assertEqual(filtered.init.call_count, 1) + filtered.verify.assert_called_once_with(ifaces) + verified = filtered.verify() + self.assertEqual(stdout.getvalue().strip(), str(verified)) + + @mock.patch('certbot.main.plugins_disco') + @mock.patch('certbot.main.cli.HelpfulArgumentParser.determine_help_topics') + def test_plugins_prepare(self, _det, mock_disco): + ifaces = [] + plugins = mock_disco.PluginsRegistry.find_all() + _, stdout, _, _ = self._call(['plugins', '--init', '--prepare']) + plugins.visible.assert_called_once_with() + plugins.visible().ifaces.assert_called_once_with(ifaces) + filtered = plugins.visible().ifaces() + self.assertEqual(filtered.init.call_count, 1) + filtered.verify.assert_called_once_with(ifaces) + verified = filtered.verify() + verified.prepare.assert_called_once_with() + verified.available.assert_called_once_with() + available = verified.available() + self.assertEqual(stdout.getvalue().strip(), str(available)) + + def test_certonly_abspath(self): + cert = 'cert' + key = 'key' + chain = 'chain' + fullchain = 'fullchain' + + with mock.patch('certbot.main.obtain_cert') as mock_obtaincert: + self._call(['certonly', '--cert-path', cert, '--key-path', 'key', + '--chain-path', 'chain', + '--fullchain-path', 'fullchain']) + + config, unused_plugins = mock_obtaincert.call_args[0] + self.assertEqual(config.cert_path, os.path.abspath(cert)) + self.assertEqual(config.key_path, os.path.abspath(key)) + self.assertEqual(config.chain_path, os.path.abspath(chain)) + self.assertEqual(config.fullchain_path, os.path.abspath(fullchain)) + + def test_certonly_bad_args(self): + try: + self._call(['-a', 'bad_auth', 'certonly']) + assert False, "Exception should have been raised" + except errors.PluginSelectionError as e: + self.assertTrue('The requested bad_auth plugin does not appear' in str(e)) + + def test_check_config_sanity_domain(self): + # FQDN + self.assertRaises(errors.ConfigurationError, + self._call, + ['-d', 'a' * 64]) + # FQDN 2 + self.assertRaises(errors.ConfigurationError, + self._call, + ['-d', (('a' * 50) + '.') * 10]) + # Wildcard + self.assertRaises(errors.ConfigurationError, + self._call, + ['-d', '*.wildcard.tld']) + + # Bare IP address (this is actually a different error message now) + self.assertRaises(errors.ConfigurationError, + self._call, + ['-d', '204.11.231.35']) + + def test_csr_with_besteffort(self): + self.assertRaises( + errors.Error, self._call, + 'certonly --csr {0} --allow-subset-of-names'.format(CSR).split()) + + def test_run_with_csr(self): + # This is an error because you can only use --csr with certonly + try: + self._call(['--csr', CSR]) + except errors.Error as e: + assert "Please try the certonly" in repr(e) + return + assert False, "Expected supplying --csr to fail with default verb" + + def test_csr_with_no_domains(self): + self.assertRaises( + errors.Error, self._call, + 'certonly --csr {0}'.format( + test_util.vector_path('csr-nonames.pem')).split()) + + def test_csr_with_inconsistent_domains(self): + self.assertRaises( + errors.Error, self._call, + 'certonly -d example.org --csr {0}'.format(CSR).split()) + + def _certonly_new_request_common(self, mock_client, args=None): + with mock.patch('certbot.main._find_lineage_for_domains_and_certname') as mock_renewal: + mock_renewal.return_value = ("newcert", None) + with mock.patch('certbot.main._init_le_client') as mock_init: + mock_init.return_value = mock_client + if args is None: + args = [] + args += '-d foo.bar -a standalone certonly'.split() + self._call(args) + + @mock.patch('certbot.main.zope.component.getUtility') + def test_certonly_dry_run_new_request_success(self, mock_get_utility): + mock_client = mock.MagicMock() + mock_client.obtain_and_enroll_certificate.return_value = None + self._certonly_new_request_common(mock_client, ['--dry-run']) + self.assertEqual( + mock_client.obtain_and_enroll_certificate.call_count, 1) + self.assertTrue( + 'dry run' in mock_get_utility().add_message.call_args[0][0]) + # Asserts we don't suggest donating after a successful dry run + self.assertEqual(mock_get_utility().add_message.call_count, 1) + + @mock.patch('certbot.crypto_util.notAfter') + @mock.patch('certbot.main.zope.component.getUtility') + def test_certonly_new_request_success(self, mock_get_utility, mock_notAfter): + cert_path = '/etc/letsencrypt/live/foo.bar' + date = '1970-01-01' + mock_notAfter().date.return_value = date + + mock_lineage = mock.MagicMock(cert=cert_path, fullchain=cert_path) + mock_client = mock.MagicMock() + mock_client.obtain_and_enroll_certificate.return_value = mock_lineage + self._certonly_new_request_common(mock_client) + self.assertEqual( + mock_client.obtain_and_enroll_certificate.call_count, 1) + cert_msg = mock_get_utility().add_message.call_args_list[0][0][0] + self.assertTrue(cert_path in cert_msg) + self.assertTrue(date in cert_msg) + self.assertTrue( + 'donate' in mock_get_utility().add_message.call_args[0][0]) + + def test_certonly_new_request_failure(self): + mock_client = mock.MagicMock() + mock_client.obtain_and_enroll_certificate.return_value = False + self.assertRaises(errors.Error, + self._certonly_new_request_common, mock_client) + + def _test_renewal_common(self, due_for_renewal, extra_args, log_out=None, + args=None, should_renew=True, error_expected=False): + # pylint: disable=too-many-locals,too-many-arguments + cert_path = test_util.vector_path('cert.pem') + chain_path = '/etc/letsencrypt/live/foo.bar/fullchain.pem' + mock_lineage = mock.MagicMock(cert=cert_path, fullchain=chain_path) + mock_lineage.should_autorenew.return_value = due_for_renewal + mock_lineage.has_pending_deployment.return_value = False + mock_lineage.names.return_value = ['isnot.org'] + mock_certr = mock.MagicMock() + mock_key = mock.MagicMock(pem='pem_key') + mock_client = mock.MagicMock() + stdout = None + mock_client.obtain_certificate.return_value = (mock_certr, 'chain', + mock_key, 'csr') + try: + with mock.patch('certbot.cert_manager.find_duplicative_certs') as mock_fdc: + mock_fdc.return_value = (mock_lineage, None) + with mock.patch('certbot.main._init_le_client') as mock_init: + mock_init.return_value = mock_client + get_utility_path = 'certbot.main.zope.component.getUtility' + with mock.patch(get_utility_path) as mock_get_utility: + with mock.patch('certbot.main.renewal.OpenSSL') as mock_ssl: + mock_latest = mock.MagicMock() + mock_latest.get_issuer.return_value = "Fake fake" + mock_ssl.crypto.load_certificate.return_value = mock_latest + with mock.patch('certbot.main.renewal.crypto_util'): + if not args: + args = ['-d', 'isnot.org', '-a', 'standalone', 'certonly'] + if extra_args: + args += extra_args + try: + ret, stdout, _, _ = self._call(args) + if ret: + print("Returned", ret) + raise AssertionError(ret) + assert not error_expected, "renewal should have errored" + except: # pylint: disable=bare-except + if not error_expected: + raise AssertionError( + "Unexpected renewal error:\n" + + traceback.format_exc()) + + if should_renew: + mock_client.obtain_certificate.assert_called_once_with(['isnot.org']) + else: + self.assertEqual(mock_client.obtain_certificate.call_count, 0) + except: + self._dump_log() + raise + finally: + if log_out: + with open(os.path.join(self.logs_dir, "letsencrypt.log")) as lf: + self.assertTrue(log_out in lf.read()) + + return mock_lineage, mock_get_utility, stdout + + def test_certonly_renewal(self): + lineage, get_utility, _ = self._test_renewal_common(True, []) + self.assertEqual(lineage.save_successor.call_count, 1) + lineage.update_all_links_to.assert_called_once_with( + lineage.latest_common_version()) + cert_msg = get_utility().add_message.call_args_list[0][0][0] + self.assertTrue('fullchain.pem' in cert_msg) + self.assertTrue('donate' in get_utility().add_message.call_args[0][0]) + + def test_certonly_renewal_triggers(self): + # --dry-run should force renewal + _, get_utility, _ = self._test_renewal_common(False, ['--dry-run', '--keep'], + log_out="simulating renewal") + self.assertEqual(get_utility().add_message.call_count, 1) + self.assertTrue('dry run' in get_utility().add_message.call_args[0][0]) + + self._test_renewal_common(False, ['--renew-by-default', '-tvv', '--debug'], + log_out="Auto-renewal forced") + self.assertEqual(get_utility().add_message.call_count, 1) + + self._test_renewal_common(False, ['-tvv', '--debug', '--keep'], + log_out="not yet due", should_renew=False) + + def _dump_log(self): + print("Logs:") + log_path = os.path.join(self.logs_dir, "letsencrypt.log") + if os.path.exists(log_path): + with open(log_path) as lf: + print(lf.read()) + + def test_renew_verb(self): + test_util.make_lineage(self, 'sample-renewal.conf') + args = ["renew", "--dry-run", "-tvv"] + self._test_renewal_common(True, [], args=args, should_renew=True) + + def test_quiet_renew(self): + test_util.make_lineage(self, 'sample-renewal.conf') + args = ["renew", "--dry-run"] + _, _, stdout = self._test_renewal_common(True, [], args=args, should_renew=True) + out = stdout.getvalue() + self.assertTrue("renew" in out) + + args = ["renew", "--dry-run", "-q"] + _, _, stdout = self._test_renewal_common(True, [], args=args, should_renew=True) + out = stdout.getvalue() + self.assertEqual("", out) + + def test_renew_hook_validation(self): + test_util.make_lineage(self, 'sample-renewal.conf') + args = ["renew", "--dry-run", "--post-hook=no-such-command"] + self._test_renewal_common(True, [], args=args, should_renew=False, + error_expected=True) + + def test_renew_no_hook_validation(self): + test_util.make_lineage(self, 'sample-renewal.conf') + args = ["renew", "--dry-run", "--post-hook=no-such-command", + "--disable-hook-validation"] + self._test_renewal_common(True, [], args=args, should_renew=True, + error_expected=False) + + @mock.patch("certbot.cli.set_by_cli") + def test_ancient_webroot_renewal_conf(self, mock_set_by_cli): + mock_set_by_cli.return_value = False + rc_path = test_util.make_lineage(self, 'sample-renewal-ancient.conf') + args = mock.MagicMock(account=None, email=None, webroot_path=None) + config = configuration.NamespaceConfig(args) + lineage = storage.RenewableCert(rc_path, config) + renewalparams = lineage.configuration["renewalparams"] + # pylint: disable=protected-access + renewal._restore_webroot_config(config, renewalparams) + self.assertEqual(config.webroot_path, ["/var/www/"]) + + def test_renew_verb_empty_config(self): + rd = os.path.join(self.config_dir, 'renewal') + if not os.path.exists(rd): + os.makedirs(rd) + with open(os.path.join(rd, 'empty.conf'), 'w'): + pass # leave the file empty + args = ["renew", "--dry-run", "-tvv"] + self._test_renewal_common(False, [], args=args, should_renew=False, error_expected=True) + + def test_renew_with_certname(self): + test_util.make_lineage(self, 'sample-renewal.conf') + self._test_renewal_common(True, [], should_renew=True, + args=['renew', '--dry-run', '--cert-name', 'sample-renewal']) + + def test_renew_with_bad_certname(self): + self._test_renewal_common(True, [], should_renew=False, + args=['renew', '--dry-run', '--cert-name', 'sample-renewal'], + error_expected=True) + + def _make_dummy_renewal_config(self): + renewer_configs_dir = os.path.join(self.config_dir, 'renewal') + os.makedirs(renewer_configs_dir) + with open(os.path.join(renewer_configs_dir, 'test.conf'), 'w') as f: + f.write("My contents don't matter") + + def _test_renew_common(self, renewalparams=None, names=None, + assert_oc_called=None, **kwargs): + self._make_dummy_renewal_config() + with mock.patch('certbot.storage.RenewableCert') as mock_rc: + mock_lineage = mock.MagicMock() + mock_lineage.fullchain = "somepath/fullchain.pem" + if renewalparams is not None: + mock_lineage.configuration = {'renewalparams': renewalparams} + if names is not None: + mock_lineage.names.return_value = names + mock_rc.return_value = mock_lineage + with mock.patch('certbot.main.obtain_cert') as mock_obtain_cert: + kwargs.setdefault('args', ['renew']) + self._test_renewal_common(True, None, should_renew=False, **kwargs) + + if assert_oc_called is not None: + if assert_oc_called: + self.assertTrue(mock_obtain_cert.called) + else: + self.assertFalse(mock_obtain_cert.called) + + def test_renew_no_renewalparams(self): + self._test_renew_common(assert_oc_called=False, error_expected=True) + + def test_renew_no_authenticator(self): + self._test_renew_common(renewalparams={}, assert_oc_called=False, + error_expected=True) + + def test_renew_with_bad_int(self): + renewalparams = {'authenticator': 'webroot', + 'rsa_key_size': 'over 9000'} + self._test_renew_common(renewalparams=renewalparams, error_expected=True, + assert_oc_called=False) + + def test_renew_with_nonetype_http01(self): + renewalparams = {'authenticator': 'webroot', + 'http01_port': 'None'} + self._test_renew_common(renewalparams=renewalparams, + assert_oc_called=True) + + def test_renew_with_bad_domain(self): + renewalparams = {'authenticator': 'webroot'} + names = ['*.example.com'] + self._test_renew_common(renewalparams=renewalparams, error_expected=True, + names=names, assert_oc_called=False) + + def test_renew_with_configurator(self): + renewalparams = {'authenticator': 'webroot'} + self._test_renew_common( + renewalparams=renewalparams, assert_oc_called=True, + args='renew --configurator apache'.split()) + + def test_renew_plugin_config_restoration(self): + renewalparams = {'authenticator': 'webroot', + 'webroot_path': 'None', + 'webroot_imaginary_flag': '42'} + self._test_renew_common(renewalparams=renewalparams, + assert_oc_called=True) + + def test_renew_with_webroot_map(self): + renewalparams = {'authenticator': 'webroot'} + self._test_renew_common( + renewalparams=renewalparams, assert_oc_called=True, + args=['renew', '--webroot-map', '{"example.com": "/tmp"}']) + + def test_renew_reconstitute_error(self): + # pylint: disable=protected-access + with mock.patch('certbot.main.renewal._reconstitute') as mock_reconstitute: + mock_reconstitute.side_effect = Exception + self._test_renew_common(assert_oc_called=False, error_expected=True) + + def test_renew_obtain_cert_error(self): + self._make_dummy_renewal_config() + with mock.patch('certbot.storage.RenewableCert') as mock_rc: + mock_lineage = mock.MagicMock() + mock_lineage.fullchain = "somewhere/fullchain.pem" + mock_rc.return_value = mock_lineage + mock_lineage.configuration = { + 'renewalparams': {'authenticator': 'webroot'}} + with mock.patch('certbot.main.obtain_cert') as mock_obtain_cert: + mock_obtain_cert.side_effect = Exception + self._test_renewal_common(True, None, error_expected=True, + args=['renew'], should_renew=False) + + def test_renew_with_bad_cli_args(self): + self._test_renewal_common(True, None, args='renew -d example.com'.split(), + should_renew=False, error_expected=True) + self._test_renewal_common(True, None, args='renew --csr {0}'.format(CSR).split(), + should_renew=False, error_expected=True) + + @mock.patch('certbot.main.zope.component.getUtility') + @mock.patch('certbot.main._find_lineage_for_domains_and_certname') + @mock.patch('certbot.main._init_le_client') + def test_certonly_reinstall(self, mock_init, mock_renewal, mock_get_utility): + mock_renewal.return_value = ('reinstall', mock.MagicMock()) + mock_init.return_value = mock_client = mock.MagicMock() + self._call(['-d', 'foo.bar', '-a', 'standalone', 'certonly']) + self.assertFalse(mock_client.obtain_certificate.called) + self.assertFalse(mock_client.obtain_and_enroll_certificate.called) + self.assertEqual(mock_get_utility().add_message.call_count, 0) + #self.assertTrue('donate' not in mock_get_utility().add_message.call_args[0][0]) + + def _test_certonly_csr_common(self, extra_args=None): + certr = 'certr' + chain = 'chain' + mock_client = mock.MagicMock() + mock_client.obtain_certificate_from_csr.return_value = (certr, chain) + cert_path = '/etc/letsencrypt/live/example.com/cert.pem' + mock_client.save_certificate.return_value = cert_path, None, None + with mock.patch('certbot.main._init_le_client') as mock_init: + mock_init.return_value = mock_client + get_utility_path = 'certbot.main.zope.component.getUtility' + with mock.patch(get_utility_path) as mock_get_utility: + chain_path = '/etc/letsencrypt/live/example.com/chain.pem' + full_path = '/etc/letsencrypt/live/example.com/fullchain.pem' + args = ('-a standalone certonly --csr {0} --cert-path {1} ' + '--chain-path {2} --fullchain-path {3}').format( + CSR, cert_path, chain_path, full_path).split() + if extra_args: + args += extra_args + with mock.patch('certbot.main.crypto_util'): + self._call(args) + + if '--dry-run' in args: + self.assertFalse(mock_client.save_certificate.called) + else: + mock_client.save_certificate.assert_called_once_with( + certr, chain, cert_path, chain_path, full_path) + + return mock_get_utility + + def test_certonly_csr(self): + mock_get_utility = self._test_certonly_csr_common() + cert_msg = mock_get_utility().add_message.call_args_list[0][0][0] + self.assertTrue('cert.pem' in cert_msg) + self.assertTrue( + 'donate' in mock_get_utility().add_message.call_args[0][0]) + + def test_certonly_csr_dry_run(self): + mock_get_utility = self._test_certonly_csr_common(['--dry-run']) + self.assertEqual(mock_get_utility().add_message.call_count, 1) + self.assertTrue( + 'dry run' in mock_get_utility().add_message.call_args[0][0]) + + @mock.patch('certbot.main.client.acme_client') + def test_revoke_with_key(self, mock_acme_client): + server = 'foo.bar' + self._call_no_clientmock(['--cert-path', CERT, '--key-path', KEY, + '--server', server, 'revoke']) + with open(KEY, 'rb') as f: + mock_acme_client.Client.assert_called_once_with( + server, key=jose.JWK.load(f.read()), net=mock.ANY) + with open(CERT, 'rb') as f: + cert = crypto_util.pyopenssl_load_certificate(f.read())[0] + mock_revoke = mock_acme_client.Client().revoke + mock_revoke.assert_called_once_with(jose.ComparableX509(cert)) + + @mock.patch('certbot.main._determine_account') + def test_revoke_without_key(self, mock_determine_account): + mock_determine_account.return_value = (mock.MagicMock(), None) + _, _, _, client = self._call(['--cert-path', CERT, 'revoke']) + with open(CERT) as f: + cert = crypto_util.pyopenssl_load_certificate(f.read())[0] + mock_revoke = client.acme_from_config_key().revoke + mock_revoke.assert_called_once_with(jose.ComparableX509(cert)) + + def test_agree_dev_preview_config(self): + with mock.patch('certbot.main.run') as mocked_run: + self._call(['-c', test_util.vector_path('cli.ini')]) + self.assertTrue(mocked_run.called) + + def test_register(self): + with mock.patch('certbot.main.client') as mocked_client: + acc = mock.MagicMock() + acc.id = "imaginary_account" + mocked_client.register.return_value = (acc, "worked") + self._call_no_clientmock(["register", "--email", "user@example.org"]) + # TODO: It would be more correct to explicitly check that + # _determine_account() gets called in the above case, + # but coverage statistics should also show that it did. + with mock.patch('certbot.main.account') as mocked_account: + mocked_storage = mock.MagicMock() + mocked_account.AccountFileStorage.return_value = mocked_storage + mocked_storage.find_all.return_value = ["an account"] + x = self._call_no_clientmock(["register", "--email", "user@example.org"]) + self.assertTrue("There is an existing account" in x[0]) + + def test_update_registration_no_existing_accounts(self): + # with mock.patch('certbot.main.client') as mocked_client: + with mock.patch('certbot.main.account') as mocked_account: + mocked_storage = mock.MagicMock() + mocked_account.AccountFileStorage.return_value = mocked_storage + mocked_storage.find_all.return_value = [] + x = self._call_no_clientmock( + ["register", "--update-registration", "--email", + "user@example.org"]) + self.assertTrue("Could not find an existing account" in x[0]) + + def test_update_registration_unsafely(self): + # This test will become obsolete when register --update-registration + # supports removing an e-mail address from the account + with mock.patch('certbot.main.account') as mocked_account: + mocked_storage = mock.MagicMock() + mocked_account.AccountFileStorage.return_value = mocked_storage + mocked_storage.find_all.return_value = ["an account"] + x = self._call_no_clientmock( + "register --update-registration " + "--register-unsafely-without-email".split()) + self.assertTrue("--register-unsafely-without-email" in x[0]) + + @mock.patch('certbot.main.display_ops.get_email') + @mock.patch('certbot.main.zope.component.getUtility') + def test_update_registration_with_email(self, mock_utility, mock_email): + email = "user@example.com" + mock_email.return_value = email + with mock.patch('certbot.main.client') as mocked_client: + with mock.patch('certbot.main.account') as mocked_account: + with mock.patch('certbot.main._determine_account') as mocked_det: + with mock.patch('certbot.main.client') as mocked_client: + mocked_storage = mock.MagicMock() + mocked_account.AccountFileStorage.return_value = mocked_storage + mocked_storage.find_all.return_value = ["an account"] + mocked_det.return_value = (mock.MagicMock(), "foo") + acme_client = mock.MagicMock() + mocked_client.Client.return_value = acme_client + x = self._call_no_clientmock( + ["register", "--update-registration"]) + # When registration change succeeds, the return value + # of register() is None + self.assertTrue(x[0] is None) + # and we got supposedly did update the registration from + # the server + self.assertTrue( + acme_client.acme.update_registration.called) + # and we saved the updated registration on disk + self.assertTrue(mocked_storage.save_regr.called) + self.assertTrue( + email in mock_utility().add_message.call_args[0][0]) + + +class TestHandleException(unittest.TestCase): + """Test main._handle_exception""" + @mock.patch('certbot.main.sys') + def test_handle_exception(self, mock_sys): + # pylint: disable=protected-access + from acme import messages + + config = mock.MagicMock() + mock_open = mock.mock_open() + + with mock.patch('certbot.main.open', mock_open, create=True): + exception = Exception('detail') + config.verbose_count = 1 + main._handle_exception( + Exception, exc_value=exception, trace=None, config=None) + mock_open().write.assert_any_call(''.join( + traceback.format_exception_only(Exception, exception))) + error_msg = mock_sys.exit.call_args_list[0][0][0] + self.assertTrue('unexpected error' in error_msg) + + with mock.patch('certbot.main.open', mock_open, create=True): + mock_open.side_effect = [KeyboardInterrupt] + error = errors.Error('detail') + main._handle_exception( + errors.Error, exc_value=error, trace=None, config=None) + # assert_any_call used because sys.exit doesn't exit in cli.py + mock_sys.exit.assert_any_call(''.join( + traceback.format_exception_only(errors.Error, error))) + + bad_typ = messages.ERROR_PREFIX + 'triffid' + exception = messages.Error(detail='alpha', typ=bad_typ, title='beta') + config = mock.MagicMock(debug=False, verbose_count=-3) + main._handle_exception( + messages.Error, exc_value=exception, trace=None, config=config) + error_msg = mock_sys.exit.call_args_list[-1][0][0] + self.assertTrue('unexpected error' in error_msg) + self.assertTrue('acme:error' not in error_msg) + self.assertTrue('alpha' in error_msg) + self.assertTrue('beta' in error_msg) + config = mock.MagicMock(debug=False, verbose_count=1) + main._handle_exception( + messages.Error, exc_value=exception, trace=None, config=config) + error_msg = mock_sys.exit.call_args_list[-1][0][0] + self.assertTrue('unexpected error' in error_msg) + self.assertTrue('acme:error' in error_msg) + self.assertTrue('alpha' in error_msg) + + interrupt = KeyboardInterrupt('detail') + main._handle_exception( + KeyboardInterrupt, exc_value=interrupt, trace=None, config=None) + mock_sys.exit.assert_called_with(''.join( + traceback.format_exception_only(KeyboardInterrupt, interrupt))) + + if __name__ == '__main__': unittest.main() # pragma: no cover diff --git a/certbot/tests/ocsp_test.py b/certbot/tests/ocsp_test.py new file mode 100644 index 000000000..ff79bb01e --- /dev/null +++ b/certbot/tests/ocsp_test.py @@ -0,0 +1,137 @@ +"""Tests for ocsp.py""" +# pylint: disable=protected-access + +import unittest + +import mock + +from certbot import errors + +out = """Missing = in header key=value +ocsp: Use -help for summary. +""" + +class OCSPTest(unittest.TestCase): + + _multiprocess_can_split_ = True + + def setUp(self): + from certbot import ocsp + with mock.patch('certbot.ocsp.Popen') as mock_popen: + with mock.patch('certbot.util.exe_exists') as mock_exists: + mock_communicate = mock.MagicMock() + mock_communicate.communicate.return_value = (None, out) + mock_popen.return_value = mock_communicate + mock_exists.return_value = True + self.checker = ocsp.RevocationChecker() + + def tearDown(self): + pass + + @mock.patch('certbot.ocsp.logging.info') + @mock.patch('certbot.ocsp.Popen') + @mock.patch('certbot.util.exe_exists') + def test_init(self, mock_exists, mock_popen, mock_log): + mock_communicate = mock.MagicMock() + mock_communicate.communicate.return_value = (None, out) + mock_popen.return_value = mock_communicate + mock_exists.return_value = True + + from certbot import ocsp + checker = ocsp.RevocationChecker() + self.assertEqual(mock_popen.call_count, 1) + self.assertEqual(checker.host_args("x"), ["Host=x"]) + + mock_communicate.communicate.return_value = (None, out.partition("\n")[2]) + checker = ocsp.RevocationChecker() + self.assertEqual(checker.host_args("x"), ["Host", "x"]) + self.assertEqual(checker.broken, False) + + mock_exists.return_value = False + mock_popen.call_count = 0 + checker = ocsp.RevocationChecker() + self.assertEqual(mock_popen.call_count, 0) + self.assertEqual(mock_log.call_count, 1) + self.assertEqual(checker.broken, True) + + @mock.patch('certbot.ocsp.RevocationChecker.determine_ocsp_server') + @mock.patch('certbot.util.run_script') + def test_ocsp_revoked(self, mock_run, mock_determine): + self.checker.broken = True + mock_determine.return_value = ("", "") + self.assertEqual(self.checker.ocsp_revoked("x", "y"), False) + + self.checker.broken = False + mock_run.return_value = tuple(openssl_happy[1:]) + self.assertEqual(self.checker.ocsp_revoked("x", "y"), False) + self.assertEqual(mock_run.call_count, 0) + + mock_determine.return_value = ("http://x.co", "x.co") + self.assertEqual(self.checker.ocsp_revoked("blah.pem", "chain.pem"), False) + mock_run.side_effect = errors.SubprocessError("Unable to load certificate launcher") + self.assertEqual(self.checker.ocsp_revoked("x", "y"), False) + self.assertEqual(mock_run.call_count, 2) + + + @mock.patch('certbot.ocsp.logger.debug') + @mock.patch('certbot.ocsp.logger.info') + @mock.patch('certbot.util.run_script') + def test_determine_ocsp_server(self, mock_run, mock_info, mock_debug): + uri = "http://ocsp.stg-int-x1.letsencrypt.org/" + host = "ocsp.stg-int-x1.letsencrypt.org" + mock_run.return_value = uri, "" + self.assertEqual(self.checker.determine_ocsp_server("beep"), (uri, host)) + mock_run.return_value = "ftp:/" + host + "/", "" + self.assertEqual(self.checker.determine_ocsp_server("beep"), (None, None)) + self.assertEqual(mock_info.call_count, 1) + + c = "confusion" + mock_run.side_effect = errors.SubprocessError(c) + self.assertEqual(self.checker.determine_ocsp_server("beep"), (None, None)) + self.assertTrue(c in repr(mock_debug.call_args[0][1])) + + @mock.patch('certbot.ocsp.logger') + @mock.patch('certbot.util.run_script') + def test_translate_ocsp(self, mock_run, mock_log): + # pylint: disable=protected-access,star-args + mock_run.return_value = openssl_confused + from certbot import ocsp + self.assertEqual(ocsp._translate_ocsp_query(*openssl_happy), False) + self.assertEqual(ocsp._translate_ocsp_query(*openssl_confused), False) + self.assertEqual(mock_log.debug.call_count, 1) + self.assertEqual(mock_log.warn.call_count, 0) + self.assertEqual(ocsp._translate_ocsp_query(*openssl_broken), False) + self.assertEqual(mock_log.warn.call_count, 1) + self.assertEqual(ocsp._translate_ocsp_query(*openssl_revoked), True) + + +# pylint: disable=line-too-long +openssl_confused = ("", """ +/etc/letsencrypt/live/example.org/cert.pem: good + This Update: Dec 17 00:00:00 2016 GMT + Next Update: Dec 24 00:00:00 2016 GMT +""", +""" +Response Verify Failure +139903674214048:error:27069065:OCSP routines:OCSP_basic_verify:certificate verify error:ocsp_vfy.c:138:Verify error:unable to get local issuer certificate +""") + +openssl_happy = ("blah.pem", """ +blah.pem: good + This Update: Dec 20 18:00:00 2016 GMT + Next Update: Dec 27 18:00:00 2016 GMT +""", +"Response verify OK") + +openssl_revoked = ("blah.pem", """ +blah.pem: revoked + This Update: Dec 20 01:00:00 2016 GMT + Next Update: Dec 27 01:00:00 2016 GMT + Revocation Time: Dec 20 01:46:34 2016 GMT +""", +"""Response verify OK""") + +openssl_broken = ("", "tentacles", "Response verify OK") + +if __name__ == '__main__': + unittest.main() # pragma: no cover diff --git a/certbot/tests/renewal_test.py b/certbot/tests/renewal_test.py new file mode 100644 index 000000000..8155595c2 --- /dev/null +++ b/certbot/tests/renewal_test.py @@ -0,0 +1,29 @@ +"""Tests for certbot.renewal""" +import os +import mock +import unittest +import tempfile + +from certbot import configuration +from certbot import storage + +from certbot.tests import util + + +class RenewalTest(unittest.TestCase): + def setUp(self): + self.tmp_dir = tempfile.mkdtemp() + self.config_dir = os.path.join(self.tmp_dir, 'config') + + @mock.patch("certbot.cli.set_by_cli") + def test_ancient_webroot_renewal_conf(self, mock_set_by_cli): + mock_set_by_cli.return_value = False + rc_path = util.make_lineage(self, 'sample-renewal-ancient.conf') + args = mock.MagicMock(account=None, email=None, webroot_path=None) + config = configuration.NamespaceConfig(args) + lineage = storage.RenewableCert(rc_path, config) + renewalparams = lineage.configuration["renewalparams"] + # pylint: disable=protected-access + from certbot import renewal + renewal._restore_webroot_config(config, renewalparams) + self.assertEqual(config.webroot_path, ["/var/www/"]) diff --git a/certbot/tests/reporter_test.py b/certbot/tests/reporter_test.py index 02c7981b7..0b06cccd7 100644 --- a/certbot/tests/reporter_test.py +++ b/certbot/tests/reporter_test.py @@ -8,7 +8,6 @@ import six class ReporterTest(unittest.TestCase): """Tests for certbot.reporter.Reporter.""" - def setUp(self): from certbot import reporter self.reporter = reporter.Reporter(mock.MagicMock(quiet=False)) @@ -21,7 +20,7 @@ class ReporterTest(unittest.TestCase): def test_multiline_message(self): self.reporter.add_message("Line 1\nLine 2", self.reporter.LOW_PRIORITY) - self.reporter.atexit_print_messages() + self.reporter.print_messages() output = sys.stdout.getvalue() self.assertTrue("Line 1\n" in output) self.assertTrue("Line 2" in output) @@ -39,9 +38,12 @@ class ReporterTest(unittest.TestCase): self.reporter.print_messages() self.assertEqual(sys.stdout.getvalue(), "") - def test_atexit_print_messages(self): + @mock.patch('certbot.reporter.os.getpid') + def test_atexit_print_messages(self, mock_getpid): self._add_messages() - self.reporter.atexit_print_messages() + mock_getpid.return_value = 42 + with mock.patch('certbot.reporter.INITIAL_PID', 42): + self.reporter.atexit_print_messages() output = sys.stdout.getvalue() self.assertTrue("IMPORTANT NOTES:" in output) self.assertTrue("High" in output) diff --git a/certbot/tests/reverter_test.py b/certbot/tests/reverter_test.py index 450cecacf..62a43f0fe 100644 --- a/certbot/tests/reverter_test.py +++ b/certbot/tests/reverter_test.py @@ -1,6 +1,5 @@ """Test certbot.reverter.""" import csv -import itertools import logging import os import shutil @@ -8,6 +7,7 @@ import tempfile import unittest import mock +import six from certbot import errors @@ -153,7 +153,7 @@ class ReverterCheckpointLocalTest(unittest.TestCase): act_coms = get_undo_commands(self.config.temp_checkpoint_dir) - for a_com, com in itertools.izip(act_coms, coms): + for a_com, com in six.moves.zip(act_coms, coms): self.assertEqual(a_com, com) def test_bad_register_undo_command(self): diff --git a/certbot/tests/storage_test.py b/certbot/tests/storage_test.py index 261500b98..a1fda6535 100644 --- a/certbot/tests/storage_test.py +++ b/certbot/tests/storage_test.py @@ -9,6 +9,7 @@ import unittest import configobj import mock import pytz +import six import certbot from certbot import cli @@ -16,10 +17,10 @@ from certbot import configuration from certbot import errors from certbot.storage import ALL_FOUR -from certbot.tests import test_util +from certbot.tests import util -CERT = test_util.load_cert('cert.pem') +CERT = util.load_cert('cert.pem') def unlink_all(rc_object): @@ -42,11 +43,13 @@ class BaseRenewableCertTest(unittest.TestCase): your test. Check :class:`.cli_test.DuplicateCertTest` for an example. """ + _multiprocess_can_split_ = True + def setUp(self): from certbot import storage self.tempdir = tempfile.mkdtemp() - self.cli_config = configuration.RenewerConfiguration( + self.cli_config = configuration.NamespaceConfig( namespace=mock.MagicMock( config_dir=self.tempdir, work_dir=self.tempdir, @@ -54,16 +57,22 @@ class BaseRenewableCertTest(unittest.TestCase): ) ) - # TODO: maybe provide RenewerConfiguration.make_dirs? + # TODO: maybe provide NamespaceConfig.make_dirs? # TODO: main() should create those dirs, c.f. #902 os.makedirs(os.path.join(self.tempdir, "live", "example.org")) - os.makedirs(os.path.join(self.tempdir, "archive", "example.org")) + archive_path = os.path.join(self.tempdir, "archive", "example.org") + os.makedirs(archive_path) os.makedirs(os.path.join(self.tempdir, "renewal")) config = configobj.ConfigObj() for kind in ALL_FOUR: - config[kind] = os.path.join(self.tempdir, "live", "example.org", + kind_path = os.path.join(self.tempdir, "live", "example.org", kind + ".pem") + config[kind] = kind_path + with open(os.path.join(self.tempdir, "live", "example.org", + "README"), 'a'): + pass + config["archive"] = archive_path config.filename = os.path.join(self.tempdir, "renewal", "example.org.conf") config.write() @@ -92,8 +101,8 @@ class BaseRenewableCertTest(unittest.TestCase): os.symlink(os.path.join(os.path.pardir, os.path.pardir, "archive", "example.org", "{0}{1}.pem".format(kind, ver)), link) - with open(link, "w") as f: - f.write(kind if value is None else value) + with open(link, "wb") as f: + f.write(kind.encode('ascii') if value is None else value) def _write_out_ex_kinds(self): for kind in ALL_FOUR: @@ -235,7 +244,7 @@ class RenewableCertTests(BaseRenewableCertTest): self.assertEqual(self.test_rc.current_version("cert"), None) def test_latest_and_next_versions(self): - for ver in xrange(1, 6): + for ver in six.moves.range(1, 6): for kind in ALL_FOUR: self._write_out_kind(kind, ver) self.assertEqual(self.test_rc.latest_common_version(), 5) @@ -257,8 +266,25 @@ class RenewableCertTests(BaseRenewableCertTest): self.assertEqual(self.test_rc.latest_common_version(), 17) self.assertEqual(self.test_rc.next_free_version(), 18) + @mock.patch("certbot.storage.logger") + def test_ensure_deployed(self, mock_logger): + mock_update = self.test_rc.update_all_links_to = mock.Mock() + mock_has_pending = self.test_rc.has_pending_deployment = mock.Mock() + self.test_rc.latest_common_version = mock.Mock() + + mock_has_pending.return_value = False + self.assertEqual(self.test_rc.ensure_deployed(), True) + self.assertEqual(mock_update.call_count, 0) + self.assertEqual(mock_logger.warn.call_count, 0) + + mock_has_pending.return_value = True + self.assertEqual(self.test_rc.ensure_deployed(), False) + self.assertEqual(mock_update.call_count, 1) + self.assertEqual(mock_logger.warn.call_count, 1) + + def test_update_link_to(self): - for ver in xrange(1, 6): + for ver in six.moves.range(1, 6): for kind in ALL_FOUR: self._write_out_kind(kind, ver) self.assertEqual(ver, self.test_rc.current_version(kind)) @@ -285,12 +311,12 @@ class RenewableCertTests(BaseRenewableCertTest): os.path.basename(self.test_rc.version("cert", 8))) def test_update_all_links_to_success(self): - for ver in xrange(1, 6): + for ver in six.moves.range(1, 6): for kind in ALL_FOUR: self._write_out_kind(kind, ver) self.assertEqual(ver, self.test_rc.current_version(kind)) self.assertEqual(self.test_rc.latest_common_version(), 5) - for ver in xrange(1, 6): + for ver in six.moves.range(1, 6): self.test_rc.update_all_links_to(ver) for kind in ALL_FOUR: self.assertEqual(ver, self.test_rc.current_version(kind)) @@ -330,11 +356,11 @@ class RenewableCertTests(BaseRenewableCertTest): self.assertEqual(self.test_rc.current_version(kind), 11) def test_has_pending_deployment(self): - for ver in xrange(1, 6): + for ver in six.moves.range(1, 6): for kind in ALL_FOUR: self._write_out_kind(kind, ver) self.assertEqual(ver, self.test_rc.current_version(kind)) - for ver in xrange(1, 6): + for ver in six.moves.range(1, 6): self.test_rc.update_all_links_to(ver) for kind in ALL_FOUR: self.assertEqual(ver, self.test_rc.current_version(kind)) @@ -345,18 +371,18 @@ class RenewableCertTests(BaseRenewableCertTest): def test_names(self): # Trying the current version - self._write_out_kind("cert", 12, test_util.load_vector("cert-san.pem")) + self._write_out_kind("cert", 12, util.load_vector("cert-san.pem")) self.assertEqual(self.test_rc.names(), ["example.com", "www.example.com"]) # Trying a non-current version - self._write_out_kind("cert", 15, test_util.load_vector("cert.pem")) + self._write_out_kind("cert", 15, util.load_vector("cert.pem")) self.assertEqual(self.test_rc.names(12), ["example.com", "www.example.com"]) # Testing common name is listed first self._write_out_kind( - "cert", 12, test_util.load_vector("cert-5sans.pem")) + "cert", 12, util.load_vector("cert-5sans.pem")) self.assertEqual( self.test_rc.names(12), ["example.com"] + ["{0}.example.com".format(c) for c in "abcd"]) @@ -369,14 +395,14 @@ class RenewableCertTests(BaseRenewableCertTest): def test_time_interval_judgments(self, mock_datetime): """Test should_autodeploy() and should_autorenew() on the basis of expiry time windows.""" - test_cert = test_util.load_vector("cert.pem") + test_cert = util.load_vector("cert.pem") self._write_out_ex_kinds() self.test_rc.update_all_links_to(12) - with open(self.test_rc.cert, "w") as f: + with open(self.test_rc.cert, "wb") as f: f.write(test_cert) self.test_rc.update_all_links_to(11) - with open(self.test_rc.cert, "w") as f: + with open(self.test_rc.cert, "wb") as f: f.write(test_cert) mock_datetime.timedelta = datetime.timedelta @@ -426,7 +452,7 @@ class RenewableCertTests(BaseRenewableCertTest): self.assertFalse(self.test_rc.should_autodeploy()) self.test_rc.configuration["autodeploy"] = "1" # No pending deployment - for ver in xrange(1, 6): + for ver in six.moves.range(1, 6): for kind in ALL_FOUR: self._write_out_kind(kind, ver) self.assertFalse(self.test_rc.should_autodeploy()) @@ -461,7 +487,7 @@ class RenewableCertTests(BaseRenewableCertTest): # (to avoid instantiating parser) mock_rv.side_effect = lambda x: x - for ver in xrange(1, 6): + for ver in six.moves.range(1, 6): for kind in ALL_FOUR: self._write_out_kind(kind, ver) self.test_rc.update_all_links_to(3) @@ -492,7 +518,7 @@ class RenewableCertTests(BaseRenewableCertTest): self.test_rc.version("privkey", i)))) for kind in ALL_FOUR: - self.assertEqual(self.test_rc.available_versions(kind), range(1, 9)) + self.assertEqual(self.test_rc.available_versions(kind), list(six.moves.range(1, 9))) self.assertEqual(self.test_rc.current_version(kind), 3) # Test updating from latest version rather than old version self.test_rc.update_all_links_to(8) @@ -501,7 +527,7 @@ class RenewableCertTests(BaseRenewableCertTest): "attempt", self.cli_config)) for kind in ALL_FOUR: self.assertEqual(self.test_rc.available_versions(kind), - range(1, 10)) + list(six.moves.range(1, 10))) self.assertEqual(self.test_rc.current_version(kind), 8) with open(self.test_rc.version("fullchain", 9)) as f: self.assertEqual(f.read(), "last" + "attempt") @@ -555,34 +581,38 @@ class RenewableCertTests(BaseRenewableCertTest): from certbot import storage result = storage.RenewableCert.new_lineage( - "the-lineage.com", "cert", "privkey", "chain", self.cli_config) + "the-lineage.com", b"cert", b"privkey", b"chain", self.cli_config) # This consistency check tests most relevant properties about the # newly created cert lineage. # pylint: disable=protected-access self.assertTrue(result._consistent()) self.assertTrue(os.path.exists(os.path.join( self.cli_config.renewal_configs_dir, "the-lineage.com.conf"))) - with open(result.fullchain) as f: - self.assertEqual(f.read(), "cert" + "chain") + self.assertTrue(os.path.exists(os.path.join( + self.cli_config.live_dir, "the-lineage.com", "README"))) + with open(result.fullchain, "rb") as f: + self.assertEqual(f.read(), b"cert" + b"chain") # Let's do it again and make sure it makes a different lineage result = storage.RenewableCert.new_lineage( - "the-lineage.com", "cert2", "privkey2", "chain2", self.cli_config) + "the-lineage.com", b"cert2", b"privkey2", b"chain2", self.cli_config) self.assertTrue(os.path.exists(os.path.join( self.cli_config.renewal_configs_dir, "the-lineage.com-0001.conf"))) + self.assertTrue(os.path.exists(os.path.join( + self.cli_config.live_dir, "the-lineage.com-0001", "README"))) # Now trigger the detection of already existing files os.mkdir(os.path.join( self.cli_config.live_dir, "the-lineage.com-0002")) self.assertRaises(errors.CertStorageError, storage.RenewableCert.new_lineage, "the-lineage.com", - "cert3", "privkey3", "chain3", self.cli_config) - os.mkdir(os.path.join(self.cli_config.archive_dir, "other-example.com")) + b"cert3", b"privkey3", b"chain3", self.cli_config) + os.mkdir(os.path.join(self.cli_config.default_archive_dir, "other-example.com")) self.assertRaises(errors.CertStorageError, storage.RenewableCert.new_lineage, - "other-example.com", "cert4", - "privkey4", "chain4", self.cli_config) + "other-example.com", b"cert4", + b"privkey4", b"chain4", self.cli_config) # Make sure it can accept renewal parameters result = storage.RenewableCert.new_lineage( - "the-lineage.com", "cert2", "privkey2", "chain2", self.cli_config) + "the-lineage.com", b"cert2", b"privkey2", b"chain2", self.cli_config) # TODO: Conceivably we could test that the renewal parameters actually # got saved @@ -595,18 +625,18 @@ class RenewableCertTests(BaseRenewableCertTest): from certbot import storage shutil.rmtree(self.cli_config.renewal_configs_dir) - shutil.rmtree(self.cli_config.archive_dir) + shutil.rmtree(self.cli_config.default_archive_dir) shutil.rmtree(self.cli_config.live_dir) storage.RenewableCert.new_lineage( - "the-lineage.com", "cert2", "privkey2", "chain2", self.cli_config) + "the-lineage.com", b"cert2", b"privkey2", b"chain2", self.cli_config) self.assertTrue(os.path.exists( os.path.join( self.cli_config.renewal_configs_dir, "the-lineage.com.conf"))) self.assertTrue(os.path.exists(os.path.join( self.cli_config.live_dir, "the-lineage.com", "privkey.pem"))) self.assertTrue(os.path.exists(os.path.join( - self.cli_config.archive_dir, "the-lineage.com", "privkey1.pem"))) + self.cli_config.default_archive_dir, "the-lineage.com", "privkey1.pem"))) @mock.patch("certbot.storage.util.unique_lineage_name") def test_invalid_config_filename(self, mock_uln): @@ -681,6 +711,19 @@ class RenewableCertTests(BaseRenewableCertTest): self.assertEqual(storage.add_time_interval(base_time, interval), excepted) + def test_is_test_cert(self): + self.test_rc.configuration["renewalparams"] = {} + rp = self.test_rc.configuration["renewalparams"] + self.assertEqual(self.test_rc.is_test_cert, False) + rp["server"] = "https://acme-staging.api.letsencrypt.org/directory" + self.assertEqual(self.test_rc.is_test_cert, True) + rp["server"] = "https://staging.someotherca.com/directory" + self.assertEqual(self.test_rc.is_test_cert, True) + rp["server"] = "https://acme-v01.api.letsencrypt.org/directory" + self.assertEqual(self.test_rc.is_test_cert, False) + rp["server"] = "https://acme-v02.api.letsencrypt.org/directory" + self.assertEqual(self.test_rc.is_test_cert, False) + def test_missing_cert(self): from certbot import storage self.assertRaises(errors.CertStorageError, @@ -703,9 +746,10 @@ class RenewableCertTests(BaseRenewableCertTest): target = {} for x in ALL_FOUR: target[x] = "somewhere" + archive_dir = "the_archive" relevant_data = {"useful": "new_value"} from certbot import storage - storage.write_renewal_config(temp, temp2, target, relevant_data) + storage.write_renewal_config(temp, temp2, archive_dir, target, relevant_data) with open(temp2, "r") as f: content = f.read() # useful value was updated @@ -717,6 +761,110 @@ class RenewableCertTests(BaseRenewableCertTest): # check version was stored self.assertTrue("version = {0}".format(certbot.__version__) in content) + def test_update_symlinks(self): + from certbot import storage + archive_dir_path = os.path.join(self.tempdir, "archive", "example.org") + for kind in ALL_FOUR: + live_path = self.config[kind] + basename = kind + "1.pem" + archive_path = os.path.join(archive_dir_path, basename) + open(archive_path, 'a').close() + os.symlink(os.path.join(self.tempdir, basename), live_path) + self.assertRaises(errors.CertStorageError, + storage.RenewableCert, self.config.filename, + self.cli_config) + storage.RenewableCert(self.config.filename, self.cli_config, + update_symlinks=True) + +class DeleteFilesTest(BaseRenewableCertTest): + """Tests for certbot.storage.delete_files""" + def setUp(self): + super(DeleteFilesTest, self).setUp() + for kind in ALL_FOUR: + kind_path = os.path.join(self.tempdir, "live", "example.org", + kind + ".pem") + with open(kind_path, 'a'): + pass + self.config.write() + self.assertTrue(os.path.exists(os.path.join( + self.cli_config.renewal_configs_dir, "example.org.conf"))) + self.assertTrue(os.path.exists(os.path.join( + self.cli_config.live_dir, "example.org"))) + self.assertTrue(os.path.exists(os.path.join( + self.tempdir, "archive", "example.org"))) + + def _call(self): + from certbot import storage + with mock.patch("certbot.storage.logger"): + storage.delete_files(self.cli_config, "example.org") + + def test_delete_all_files(self): + self._call() + + self.assertFalse(os.path.exists(os.path.join( + self.cli_config.renewal_configs_dir, "example.org.conf"))) + self.assertFalse(os.path.exists(os.path.join( + self.cli_config.live_dir, "example.org"))) + self.assertFalse(os.path.exists(os.path.join( + self.tempdir, "archive", "example.org"))) + + def test_bad_renewal_config(self): + with open(self.config.filename, 'a') as config_file: + config_file.write("asdfasfasdfasdf") + + self.assertRaises(errors.CertStorageError, self._call) + self.assertTrue(os.path.exists(os.path.join( + self.cli_config.live_dir, "example.org"))) + self.assertFalse(os.path.exists(os.path.join( + self.cli_config.renewal_configs_dir, "example.org.conf"))) + + def test_no_renewal_config(self): + os.remove(self.config.filename) + self.assertRaises(errors.CertStorageError, self._call) + self.assertTrue(os.path.exists(os.path.join( + self.cli_config.live_dir, "example.org"))) + self.assertFalse(os.path.exists(self.config.filename)) + + def test_no_cert_file(self): + os.remove(os.path.join( + self.cli_config.live_dir, "example.org", "cert.pem")) + self._call() + self.assertFalse(os.path.exists(self.config.filename)) + self.assertFalse(os.path.exists(os.path.join( + self.cli_config.live_dir, "example.org"))) + self.assertFalse(os.path.exists(os.path.join( + self.tempdir, "archive", "example.org"))) + + def test_no_readme_file(self): + os.remove(os.path.join( + self.cli_config.live_dir, "example.org", "README")) + self._call() + self.assertFalse(os.path.exists(self.config.filename)) + self.assertFalse(os.path.exists(os.path.join( + self.cli_config.live_dir, "example.org"))) + self.assertFalse(os.path.exists(os.path.join( + self.tempdir, "archive", "example.org"))) + + def test_livedir_not_empty(self): + with open(os.path.join( + self.cli_config.live_dir, "example.org", "other_file"), 'a'): + pass + self._call() + self.assertFalse(os.path.exists(self.config.filename)) + self.assertTrue(os.path.exists(os.path.join( + self.cli_config.live_dir, "example.org"))) + self.assertFalse(os.path.exists(os.path.join( + self.tempdir, "archive", "example.org"))) + + def test_no_archive(self): + archive_dir = os.path.join(self.tempdir, "archive", "example.org") + os.rmdir(archive_dir) + self._call() + self.assertFalse(os.path.exists(self.config.filename)) + self.assertFalse(os.path.exists(os.path.join( + self.cli_config.live_dir, "example.org"))) + self.assertFalse(os.path.exists(archive_dir)) + if __name__ == "__main__": unittest.main() # pragma: no cover diff --git a/certbot/tests/test_util.py b/certbot/tests/test_util.py deleted file mode 100644 index 24eceff5a..000000000 --- a/certbot/tests/test_util.py +++ /dev/null @@ -1,75 +0,0 @@ -"""Test utilities. - -.. warning:: This module is not part of the public API. - -""" -import os -import pkg_resources - -from cryptography.hazmat.backends import default_backend -from cryptography.hazmat.primitives import serialization -import OpenSSL - -from acme import jose - - -def vector_path(*names): - """Path to a test vector.""" - return pkg_resources.resource_filename( - __name__, os.path.join('testdata', *names)) - - -def load_vector(*names): - """Load contents of a test vector.""" - # luckily, resource_string opens file in binary mode - return pkg_resources.resource_string( - __name__, os.path.join('testdata', *names)) - - -def _guess_loader(filename, loader_pem, loader_der): - _, ext = os.path.splitext(filename) - if ext.lower() == '.pem': - return loader_pem - elif ext.lower() == '.der': - return loader_der - else: # pragma: no cover - raise ValueError("Loader could not be recognized based on extension") - - -def load_cert(*names): - """Load certificate.""" - loader = _guess_loader( - names[-1], OpenSSL.crypto.FILETYPE_PEM, OpenSSL.crypto.FILETYPE_ASN1) - return OpenSSL.crypto.load_certificate(loader, load_vector(*names)) - - -def load_comparable_cert(*names): - """Load ComparableX509 cert.""" - return jose.ComparableX509(load_cert(*names)) - - -def load_csr(*names): - """Load certificate request.""" - loader = _guess_loader( - names[-1], OpenSSL.crypto.FILETYPE_PEM, OpenSSL.crypto.FILETYPE_ASN1) - return OpenSSL.crypto.load_certificate_request(loader, load_vector(*names)) - - -def load_comparable_csr(*names): - """Load ComparableX509 certificate request.""" - return jose.ComparableX509(load_csr(*names)) - - -def load_rsa_private_key(*names): - """Load RSA private key.""" - loader = _guess_loader(names[-1], serialization.load_pem_private_key, - serialization.load_der_private_key) - return jose.ComparableRSAKey(loader( - load_vector(*names), password=None, backend=default_backend())) - - -def load_pyopenssl_private_key(*names): - """Load pyOpenSSL private key.""" - loader = _guess_loader( - names[-1], OpenSSL.crypto.FILETYPE_PEM, OpenSSL.crypto.FILETYPE_ASN1) - return OpenSSL.crypto.load_privatekey(loader, load_vector(*names)) diff --git a/certbot/tests/testdata/live/sample-renewal/cert.pem b/certbot/tests/testdata/live/sample-renewal/cert.pem deleted file mode 120000 index e06effe40..000000000 --- a/certbot/tests/testdata/live/sample-renewal/cert.pem +++ /dev/null @@ -1 +0,0 @@ -../../archive/sample-renewal/cert1.pem \ No newline at end of file diff --git a/certbot/tests/testdata/live/sample-renewal/chain.pem b/certbot/tests/testdata/live/sample-renewal/chain.pem deleted file mode 120000 index 71f665f29..000000000 --- a/certbot/tests/testdata/live/sample-renewal/chain.pem +++ /dev/null @@ -1 +0,0 @@ -../../archive/sample-renewal/chain1.pem \ No newline at end of file diff --git a/certbot/tests/testdata/live/sample-renewal/fullchain.pem b/certbot/tests/testdata/live/sample-renewal/fullchain.pem deleted file mode 120000 index 0f06f077d..000000000 --- a/certbot/tests/testdata/live/sample-renewal/fullchain.pem +++ /dev/null @@ -1 +0,0 @@ -../../archive/sample-renewal/fullchain1.pem \ No newline at end of file diff --git a/certbot/tests/testdata/live/sample-renewal/privkey.pem b/certbot/tests/testdata/live/sample-renewal/privkey.pem deleted file mode 120000 index 5187eda6b..000000000 --- a/certbot/tests/testdata/live/sample-renewal/privkey.pem +++ /dev/null @@ -1 +0,0 @@ -../../archive/sample-renewal/privkey1.pem \ No newline at end of file diff --git a/certbot/tests/testdata/archive/sample-renewal/cert1.pem b/certbot/tests/testdata/sample-archive/cert1.pem similarity index 100% rename from certbot/tests/testdata/archive/sample-renewal/cert1.pem rename to certbot/tests/testdata/sample-archive/cert1.pem diff --git a/certbot/tests/testdata/archive/sample-renewal/chain1.pem b/certbot/tests/testdata/sample-archive/chain1.pem similarity index 100% rename from certbot/tests/testdata/archive/sample-renewal/chain1.pem rename to certbot/tests/testdata/sample-archive/chain1.pem diff --git a/certbot/tests/testdata/archive/sample-renewal/fullchain1.pem b/certbot/tests/testdata/sample-archive/fullchain1.pem similarity index 100% rename from certbot/tests/testdata/archive/sample-renewal/fullchain1.pem rename to certbot/tests/testdata/sample-archive/fullchain1.pem diff --git a/certbot/tests/testdata/archive/sample-renewal/privkey1.pem b/certbot/tests/testdata/sample-archive/privkey1.pem similarity index 100% rename from certbot/tests/testdata/archive/sample-renewal/privkey1.pem rename to certbot/tests/testdata/sample-archive/privkey1.pem diff --git a/certbot/tests/testdata/sample-renewal-ancient.conf b/certbot/tests/testdata/sample-renewal-ancient.conf index dd3075b8e..333bcaa18 100644 --- a/certbot/tests/testdata/sample-renewal-ancient.conf +++ b/certbot/tests/testdata/sample-renewal-ancient.conf @@ -1,7 +1,7 @@ -cert = MAGICDIR/live/sample-renewal/cert.pem -privkey = MAGICDIR/live/sample-renewal/privkey.pem -chain = MAGICDIR/live/sample-renewal/chain.pem -fullchain = MAGICDIR/live/sample-renewal/fullchain.pem +cert = MAGICDIR/live/sample-renewal-ancient/cert.pem +privkey = MAGICDIR/live/sample-renewal-ancient/privkey.pem +chain = MAGICDIR/live/sample-renewal-ancient/chain.pem +fullchain = MAGICDIR/live/sample-renewal-ancient/fullchain.pem renew_before_expiry = 1 year # Options and defaults used in the renewal process diff --git a/certbot/tests/util.py b/certbot/tests/util.py new file mode 100644 index 000000000..2c5583c24 --- /dev/null +++ b/certbot/tests/util.py @@ -0,0 +1,160 @@ +"""Test utilities. + +.. warning:: This module is not part of the public API. + +""" +import os +import pkg_resources +import shutil +import unittest + +from cryptography.hazmat.backends import default_backend +from cryptography.hazmat.primitives import serialization +import OpenSSL + +from acme import errors +from acme import jose +from acme import util + +from certbot import constants +from certbot import storage + + +def vector_path(*names): + """Path to a test vector.""" + return pkg_resources.resource_filename( + __name__, os.path.join('testdata', *names)) + + +def load_vector(*names): + """Load contents of a test vector.""" + # luckily, resource_string opens file in binary mode + return pkg_resources.resource_string( + __name__, os.path.join('testdata', *names)) + + +def _guess_loader(filename, loader_pem, loader_der): + _, ext = os.path.splitext(filename) + if ext.lower() == '.pem': + return loader_pem + elif ext.lower() == '.der': + return loader_der + else: # pragma: no cover + raise ValueError("Loader could not be recognized based on extension") + + +def load_cert(*names): + """Load certificate.""" + loader = _guess_loader( + names[-1], OpenSSL.crypto.FILETYPE_PEM, OpenSSL.crypto.FILETYPE_ASN1) + return OpenSSL.crypto.load_certificate(loader, load_vector(*names)) + + +def load_comparable_cert(*names): + """Load ComparableX509 cert.""" + return jose.ComparableX509(load_cert(*names)) + + +def load_csr(*names): + """Load certificate request.""" + loader = _guess_loader( + names[-1], OpenSSL.crypto.FILETYPE_PEM, OpenSSL.crypto.FILETYPE_ASN1) + return OpenSSL.crypto.load_certificate_request(loader, load_vector(*names)) + + +def load_comparable_csr(*names): + """Load ComparableX509 certificate request.""" + return jose.ComparableX509(load_csr(*names)) + + +def load_rsa_private_key(*names): + """Load RSA private key.""" + loader = _guess_loader(names[-1], serialization.load_pem_private_key, + serialization.load_der_private_key) + return jose.ComparableRSAKey(loader( + load_vector(*names), password=None, backend=default_backend())) + + +def load_pyopenssl_private_key(*names): + """Load pyOpenSSL private key.""" + loader = _guess_loader( + names[-1], OpenSSL.crypto.FILETYPE_PEM, OpenSSL.crypto.FILETYPE_ASN1) + return OpenSSL.crypto.load_privatekey(loader, load_vector(*names)) + + +def requirement_available(requirement): + """Checks if requirement can be imported. + + :rtype: bool + :returns: ``True`` iff requirement can be imported + + """ + try: + util.activate(requirement) + except errors.DependencyError: # pragma: no cover + return False + return True # pragma: no cover + + +def skip_unless(condition, reason): # pragma: no cover + """Skip tests unless a condition holds. + + This implements the basic functionality of unittest.skipUnless + which is only available on Python 2.7+. + + :param bool condition: If ``False``, the test will be skipped + :param str reason: the reason for skipping the test + + :rtype: callable + :returns: decorator that hides tests unless condition is ``True`` + + """ + if hasattr(unittest, "skipUnless"): + return unittest.skipUnless(condition, reason) + elif condition: + return lambda cls: cls + else: + return lambda cls: None + + +def make_lineage(self, testfile): + """Creates a lineage defined by testfile. + + This creates the archive, live, and renewal directories if + necessary and creates a simple lineage. + + :param str testfile: configuration file to base the lineage on + + :returns: path to the renewal conf file for the created lineage + :rtype: str + + """ + lineage_name = testfile[:-len('.conf')] + + conf_dir = os.path.join( + self.config_dir, constants.RENEWAL_CONFIGS_DIR) + archive_dir = os.path.join( + self.config_dir, constants.ARCHIVE_DIR, lineage_name) + live_dir = os.path.join( + self.config_dir, constants.LIVE_DIR, lineage_name) + + for directory in (archive_dir, conf_dir, live_dir,): + if not os.path.exists(directory): + os.makedirs(directory) + + sample_archive = vector_path('sample-archive') + for kind in os.listdir(sample_archive): + shutil.copyfile(os.path.join(sample_archive, kind), + os.path.join(archive_dir, kind)) + + for kind in storage.ALL_FOUR: + os.symlink(os.path.join(archive_dir, '{0}1.pem'.format(kind)), + os.path.join(live_dir, '{0}.pem'.format(kind))) + + conf_path = os.path.join(self.config_dir, conf_dir, testfile) + with open(vector_path(testfile)) as src: + with open(conf_path, 'w') as dst: + dst.writelines( + line.replace('MAGICDIR', self.config_dir) for line in src) + + return conf_path diff --git a/certbot/tests/util_test.py b/certbot/tests/util_test.py index 36676443a..cd02d835d 100644 --- a/certbot/tests/util_test.py +++ b/certbot/tests/util_test.py @@ -11,7 +11,7 @@ import mock import six from certbot import errors -from certbot.tests import test_util +import certbot.tests.util as test_util class RunScriptTest(unittest.TestCase): @@ -189,6 +189,13 @@ class UniqueFileTest(unittest.TestCase): self.assertTrue(basename3.endswith("foo.txt")) +try: + file_type = file +except NameError: + import io + file_type = io.TextIOWrapper + + class UniqueLineageNameTest(unittest.TestCase): """Tests for certbot.util.unique_lineage_name.""" @@ -204,13 +211,13 @@ class UniqueLineageNameTest(unittest.TestCase): def test_basic(self): f, path = self._call("wow") - self.assertTrue(isinstance(f, file)) + self.assertTrue(isinstance(f, file_type)) self.assertEqual(os.path.join(self.root_path, "wow.conf"), path) def test_multiple(self): - for _ in xrange(10): + for _ in six.moves.range(10): f, name = self._call("wow") - self.assertTrue(isinstance(f, file)) + self.assertTrue(isinstance(f, file_type)) self.assertTrue(isinstance(name, str)) self.assertTrue("wow-0009.conf" in name) @@ -324,6 +331,34 @@ class AddDeprecatedArgumentTest(unittest.TestCase): self.assertTrue("--old-option" not in stdout.getvalue()) +class EnforceLeValidity(unittest.TestCase): + """Test enforce_le_validity.""" + def _call(self, domain): + from certbot.util import enforce_le_validity + return enforce_le_validity(domain) + + def test_sanity(self): + self.assertRaises(errors.ConfigurationError, self._call, u"..") + + def test_invalid_chars(self): + self.assertRaises( + errors.ConfigurationError, self._call, u"hello_world.example.com") + + def test_leading_hyphen(self): + self.assertRaises( + errors.ConfigurationError, self._call, u"-a.example.com") + + def test_trailing_hyphen(self): + self.assertRaises( + errors.ConfigurationError, self._call, u"a-.example.com") + + def test_one_label(self): + self.assertRaises(errors.ConfigurationError, self._call, u"com") + + def test_valid_domain(self): + self.assertEqual(self._call(u"example.com"), u"example.com") + + class EnforceDomainSanityTest(unittest.TestCase): """Test enforce_domain_sanity.""" @@ -339,6 +374,11 @@ class EnforceDomainSanityTest(unittest.TestCase): self.assertRaises(errors.ConfigurationError, self._call, u"eichh\u00f6rnchen.example.com") + def test_punycode_ok(self): + # Punycode is now legal, so no longer an error; instead check + # that it's _not_ an error (at the initial sanity check stage) + self._call('this.is.xn--ls8h.tld') + class OsInfoTest(unittest.TestCase): """Test OS / distribution detection""" diff --git a/certbot/util.py b/certbot/util.py index 998808be0..cc0a74bd2 100644 --- a/certbot/util.py +++ b/certbot/util.py @@ -17,6 +17,7 @@ import sys import configargparse +from certbot import constants from certbot import errors @@ -37,20 +38,22 @@ ANSI_SGR_RED = "\033[31m" ANSI_SGR_RESET = "\033[0m" -def run_script(params): +def run_script(params, log=logger.error): """Run the script with the given params. :param list params: List of parameters to pass to Popen + :param logging.Logger log: Logger to use for errors """ try: proc = subprocess.Popen(params, stdout=subprocess.PIPE, - stderr=subprocess.PIPE) + stderr=subprocess.PIPE, + universal_newlines=True) except (OSError, ValueError): msg = "Unable to run the command: %s" % " ".join(params) - logger.error(msg) + log(msg) raise errors.SubprocessError(msg) stdout, stderr = proc.communicate() @@ -59,7 +62,7 @@ def run_script(params): msg = "Error while running %s.\n%s\n%s" % ( " ".join(params), stdout, stderr) # Enter recovery routine... - logger.error(msg) + log(msg) raise errors.SubprocessError(msg) return stdout, stderr @@ -151,11 +154,11 @@ def safe_open(path, mode="w", chmod=None, buffering=None): mode, *fdopen_args) -def _unique_file(path, filename_pat, count, mode): +def _unique_file(path, filename_pat, count, chmod, mode): while True: current_path = os.path.join(path, filename_pat(count)) try: - return safe_open(current_path, chmod=mode),\ + return safe_open(current_path, chmod=chmod, mode=mode),\ os.path.abspath(current_path) except OSError as err: # "File exists," is okay, try a different name. @@ -164,11 +167,12 @@ def _unique_file(path, filename_pat, count, mode): count += 1 -def unique_file(path, mode=0o777): +def unique_file(path, chmod=0o777, mode="w"): """Safely finds a unique file. :param str path: path/filename.ext - :param int mode: File mode + :param int chmod: File mode + :param str mode: Open mode :returns: tuple of file object and file name @@ -176,15 +180,16 @@ def unique_file(path, mode=0o777): path, tail = os.path.split(path) return _unique_file( path, filename_pat=(lambda count: "%04d_%s" % (count, tail)), - count=0, mode=mode) + count=0, chmod=chmod, mode=mode) -def unique_lineage_name(path, filename, mode=0o777): +def unique_lineage_name(path, filename, chmod=0o644, mode="w"): """Safely finds a unique file using lineage convention. :param str path: directory path :param str filename: proposed filename - :param int mode: file mode + :param int chmod: file mode + :param str mode: open mode :returns: tuple of file object and file name (which may be modified from the requested one by appending digits to ensure uniqueness) @@ -196,13 +201,13 @@ def unique_lineage_name(path, filename, mode=0o777): """ preferred_path = os.path.join(path, "%s.conf" % (filename)) try: - return safe_open(preferred_path, chmod=mode), preferred_path + return safe_open(preferred_path, chmod=chmod), preferred_path except OSError as err: if err.errno != errno.EEXIST: raise return _unique_file( path, filename_pat=(lambda count: "%s-%04d.conf" % (filename, count)), - count=1, mode=mode) + count=1, chmod=chmod, mode=mode) def safely_remove(path): @@ -390,43 +395,73 @@ def add_deprecated_argument(add_argument, argument_name, nargs): help=argparse.SUPPRESS, nargs=nargs) +def enforce_le_validity(domain): + """Checks that Let's Encrypt will consider domain to be valid. + + :param str domain: FQDN to check + :type domain: `str` or `unicode` + :returns: The domain cast to `str`, with ASCII-only contents + :rtype: str + :raises ConfigurationError: for invalid domains and cases where Let's + Encrypt currently will not issue certificates + + """ + domain = enforce_domain_sanity(domain) + if not re.match("^[A-Za-z0-9.-]*$", domain): + raise errors.ConfigurationError( + "{0} contains an invalid character. " + "Valid characters are A-Z, a-z, 0-9, ., and -.".format(domain)) + + labels = domain.split(".") + if len(labels) < 2: + raise errors.ConfigurationError( + "{0} needs at least two labels".format(domain)) + for label in labels: + if label.startswith("-"): + raise errors.ConfigurationError( + 'label "{0}" in domain "{1}" cannot start with "-"'.format( + label, domain)) + if label.endswith("-"): + raise errors.ConfigurationError( + 'label "{0}" in domain "{1}" cannot end with "-"'.format( + label, domain)) + return domain + def enforce_domain_sanity(domain): """Method which validates domain value and errors out if the requirements are not met. :param domain: Domain to check - :type domains: `str` or `unicode` + :type domain: `str` or `unicode` :raises ConfigurationError: for invalid domains and cases where Let's Encrypt currently will not issue certificates :returns: The domain cast to `str`, with ASCII-only contents :rtype: str """ + if isinstance(domain, six.text_type): + wildcard_marker = u"*." + else: + wildcard_marker = b"*." + # Check if there's a wildcard domain - if domain.startswith("*."): + if domain.startswith(wildcard_marker): raise errors.ConfigurationError( "Wildcard domains are not supported: {0}".format(domain)) - # Punycode - if "xn--" in domain: - raise errors.ConfigurationError( - "Punycode domains are not presently supported: {0}".format(domain)) # Unicode try: - domain = domain.encode('ascii').lower() + if isinstance(domain, six.binary_type): + domain = domain.decode('utf-8') + domain.encode('ascii') except UnicodeError: - error_fmt = (u"Internationalized domain names " - "are not presently supported: {0}") - if isinstance(domain, six.text_type): - raise errors.ConfigurationError(error_fmt.format(domain)) - else: - raise errors.ConfigurationError(str(error_fmt).format(domain)) + raise errors.ConfigurationError("Non-ASCII domain names not supported. " + "To issue for an Internationalized Domain Name, use Punycode.") - if six.PY3: - domain = domain.decode('ascii') + domain = domain.lower() # Remove trailing dot - domain = domain[:-1] if domain.endswith('.') else domain + domain = domain[:-1] if domain.endswith(u'.') else domain # Explain separately that IP addresses aren't allowed (apart from not # being FQDNs) because hope springs eternal concerning this point @@ -466,3 +501,14 @@ def get_strict_version(normalized): # strict version ending with "a" and a number designates a pre-release # pylint: disable=no-member return distutils.version.StrictVersion(normalized.replace(".dev", "a")) + + +def is_staging(srv): + """ + Determine whether a given ACME server is a known test / staging server. + + :param str srv: the URI for the ACME server + :returns: True iff srv is a known test / staging server + :rtype bool: + """ + return srv == constants.STAGING_URI or "staging" in srv diff --git a/docs/api/log.rst b/docs/api/log.rst deleted file mode 100644 index 41311de90..000000000 --- a/docs/api/log.rst +++ /dev/null @@ -1,5 +0,0 @@ -:mod:`certbot.log` ----------------------- - -.. automodule:: certbot.log - :members: diff --git a/docs/cli-help.txt b/docs/cli-help.txt index 749983d0e..279b65219 100644 --- a/docs/cli-help.txt +++ b/docs/cli-help.txt @@ -1,4 +1,4 @@ -usage: +usage: certbot [SUBCOMMAND] [options] [-d domain] [-d domain] ... Certbot can obtain and install HTTPS/TLS/SSL certificates. By default, @@ -21,7 +21,7 @@ optional arguments: config file path (default: None) -v, --verbose This flag can be used multiple times to incrementally increase the verbosity of output, e.g. -vvv. (default: - -3) + -2) -t, --text Use the text output instead of the curses UI. (default: False) -n, --non-interactive, --noninteractive @@ -29,7 +29,11 @@ optional arguments: require additional command line flags; the client will try to explain which ones are required if it finds one missing (default: False) - --dialog Run using dialog (default: False) + --dialog Run using interactive dialog menus (default: False) + -d DOMAIN, --domains DOMAIN, --domain DOMAIN + Domain names to apply. For multiple domains you can + use multiple -d flags or enter a comma separated list + of domains as a parameter. (default: []) --dry-run Perform a test run of the client, obtaining test (invalid) certs but not saving them to disk. This can currently only be used with the 'certonly' and 'renew' @@ -62,10 +66,16 @@ optional arguments: -m EMAIL, --email EMAIL Email used for registration and recovery contact. (default: None) - -d DOMAIN, --domains DOMAIN, --domain DOMAIN - Domain names to apply. For multiple domains you can - use multiple -d flags or enter a comma separated list - of domains as a parameter. (default: []) + --preferred-challenges PREF_CHALLS + A sorted, comma delimited list of the preferred + challenge to use during authorization with the most + preferred challenge listed first (Eg, "dns" or "tls- + sni-01,http,dns"). Not all plugins support all + challenges. See + https://certbot.eff.org/docs/using.html#plugins for + details. ACME Challenges are versioned, but if you + pick "http" rather than "http-01", Certbot will select + the latest version automatically. (default: []) --user-agent USER_AGENT Set a custom user agent string for the client. User agent strings allow the CA to collect high level @@ -104,35 +114,15 @@ automation: --duplicate Allow making a certificate lineage that duplicates an existing one (both can be renewed in parallel) (default: False) - --os-packages-only (letsencrypt-auto only) install OS package - dependencies and then stop (default: False) - --no-self-upgrade (letsencrypt-auto only) prevent the letsencrypt-auto - script from upgrading itself to newer released - versions (default: False) + --os-packages-only (certbot-auto only) install OS package dependencies + and then stop (default: False) + --no-self-upgrade (certbot-auto only) prevent the certbot-auto script + from upgrading itself to newer released versions + (default: False) -q, --quiet Silence all output except errors. Useful for automation via cron. Implies --non-interactive. (default: False) -testing: - The following flags are meant for testing purposes only! Do NOT change - them, unless you really know what you're doing! - - --debug Show tracebacks in case of errors, and allow - letsencrypt-auto execution on experimental platforms - (default: False) - --no-verify-ssl Disable SSL certificate verification. (default: False) - --tls-sni-01-port TLS_SNI_01_PORT - Port number to perform tls-sni-01 challenge. Boulder - in testing mode defaults to 5001. (default: 443) - --http-01-port HTTP01_PORT - Port used in the SimpleHttp challenge. (default: 80) - --break-my-certs Be willing to replace or renew valid certs with - invalid (testing/staging) certs (default: False) - --test-cert, --staging - Use the staging server to obtain test (invalid) certs; - equivalent to --server https://acme- - staging.api.letsencrypt.org/directory (default: False) - security: Security parameters & server settings @@ -147,8 +137,8 @@ security: HTTPS for the newly authenticated vhost. (default: None) --hsts Add the Strict-Transport-Security header to every HTTP - response. Forcing browser to always use SSL for - the domain. Defends against SSL Stripping. (default: + response. Forcing browser to always use SSL for the + domain. Defends against SSL Stripping. (default: False) --no-hsts Do not automatically add the Strict-Transport-Security header to every HTTP response. (default: False) @@ -168,11 +158,27 @@ security: current user; only needed if your config is somewhere unsafe like /tmp/ (default: False) +testing: + The following flags are meant for testing purposes only! Do NOT change + them, unless you really know what you're doing! + + --test-cert, --staging + Use the staging server to obtain test (invalid) certs; + equivalent to --server https://acme- + staging.api.letsencrypt.org/directory (default: False) + --debug Show tracebacks in case of errors, and allow certbot- + auto execution on experimental platforms (default: + False) + --no-verify-ssl Disable verification of the ACME server's certificate. + (default: False) + --break-my-certs Be willing to replace or renew valid certs with + invalid (testing/staging) certs (default: False) + renew: The 'renew' subcommand will attempt to renew all certificates (or more precisely, certificate lineages) you have previously obtained if they are close to expiry, and print a summary of the results. By default, 'renew' - will reuse the options used to create obtain or most recently successfully + will reuse the options used to create, obtain or most recently successfully renew each certificate lineage. You can try it with `--dry-run` first. For more fine-grained control, you can renew individual lineages with the `certonly` subcommand. Hooks are available to run commands before and @@ -194,11 +200,11 @@ renew: (default: None) --renew-hook RENEW_HOOK Command to be run in a shell once for each - successfully renewed certificate.For this command, the - shell variable $RENEWED_LINEAGE will point to - theconfig live subdirectory containing the new certs - and keys; the shell variable $RENEWED_DOMAINS will - contain a space-delimited list of renewed cert domains + successfully renewed certificate. For this command, + the shell variable $RENEWED_LINEAGE will point to the + config live subdirectory containing the new certs and + keys; the shell variable $RENEWED_DOMAINS will contain + a space-delimited list of renewed cert domains (default: None) --disable-hook-validation Ordinarily the commands specified for --pre-hook @@ -213,11 +219,19 @@ renew: certonly: Options for modifying how a cert is obtained - --csr CSR Path to a Certificate Signing Request (CSR) in DER - format; note that the .csr file *must* contain a - Subject Alternative Name field for each domain you - want certified. Currently --csr only works with the - 'certonly' subcommand' (default: None) + --tls-sni-01-port TLS_SNI_01_PORT + Port used during tls-sni-01 challenge. This only + affects the port Certbot listens on. A conforming ACME + server will still attempt to connect on port 443. + (default: 443) + --http-01-port HTTP01_PORT + Port used in the http-01 challenge. This only affects + the port Certbot listens on. A conforming ACME server + will still attempt to connect on port 80. (default: + 80) + --csr CSR Path to a Certificate Signing Request (CSR) in DER or + PEM format. Currently --csr only works with the + 'certonly' subcommand. (default: None) install: Options for modifying how a cert is deployed @@ -232,7 +246,7 @@ rollback: (default: 1) plugins: - Plugin options + Options for the "plugins" subcommand --init Initialize plugins. (default: False) --prepare Initialize and prepare plugins. (default: False) @@ -267,10 +281,11 @@ paths: https://acme-v01.api.letsencrypt.org/directory) plugins: - Certbot client supports an extensible plugins architecture. See 'certbot - plugins' for a list of all installed plugins and their names. You can - force a particular plugin by setting options provided below. Running - --help will list flags specific to that plugin. + Plugin Selection: Certbot client supports an extensible plugins + architecture. See 'certbot plugins' for a list of all installed plugins + and their names. You can force a particular plugin by setting options + provided below. Running --help will list flags specific to + that plugin. -a AUTHENTICATOR, --authenticator AUTHENTICATOR Authenticator plugin name. (default: None) @@ -290,12 +305,17 @@ plugins: --webroot Obtain certs by placing files in a webroot directory. (default: False) -standalone: - Automatically use a temporary webserver +nginx: + Nginx Web Server plugin - Alpha - --standalone-supported-challenges STANDALONE_SUPPORTED_CHALLENGES - Supported challenges. Preferred in the order they are - listed. (default: tls-sni-01,http-01) + --nginx-server-root NGINX_SERVER_ROOT + Nginx server root directory. (default: /etc/nginx) + --nginx-ctl NGINX_CTL + Path to the 'nginx' binary, used for 'configtest' and + retrieving nginx version number. (default: nginx) + +standalone: + Spin up a temporary webserver manual: Manually configure an HTTP server @@ -306,15 +326,6 @@ manual: Automatically allows public IP logging. (default: False) -nginx: - Nginx Web Server - currently doesn't work - - --nginx-server-root NGINX_SERVER_ROOT - Nginx server root directory. (default: /etc/nginx) - --nginx-ctl NGINX_CTL - Path to the 'nginx' binary, used for 'configtest' and - retrieving nginx version number. (default: nginx) - webroot: Place files in webroot directory @@ -337,7 +348,7 @@ webroot: {}) apache: - Apache Web Server - Alpha + Apache Web Server plugin - Beta --apache-enmod APACHE_ENMOD Path to the Apache 'a2enmod' binary. (default: @@ -353,6 +364,9 @@ apache: --apache-vhost-root APACHE_VHOST_ROOT Apache server VirtualHost configuration root (default: /etc/apache2/sites-available) + --apache-logs-root APACHE_LOGS_ROOT + Apache server logs directory (default: + /var/log/apache2) --apache-challenge-location APACHE_CHALLENGE_LOCATION Directory path for challenge configuration. (default: /etc/apache2) diff --git a/docs/conf.py b/docs/conf.py index e387e1eae..7b3f2026c 100644 --- a/docs/conf.py +++ b/docs/conf.py @@ -45,7 +45,6 @@ extensions = [ 'sphinx.ext.coverage', 'sphinx.ext.viewcode', 'repoze.sphinx.autointerface', - 'sphinxcontrib.programoutput', ] autodoc_member_order = 'bysource' diff --git a/docs/install.rst b/docs/install.rst index e79a3b596..aa59e44ec 100644 --- a/docs/install.rst +++ b/docs/install.rst @@ -1,13 +1,57 @@ ===================== -Quick Installation +Get Certbot ===================== -If ``certbot`` (or ``letsencrypt``) is packaged for your Unix OS (visit -certbot.eff.org_ to find out), you can install it -from there, and run it by typing ``certbot`` (or ``letsencrypt``). Because -not all operating systems have packages yet, we provide a temporary solution -via the ``certbot-auto`` wrapper script, which obtains some dependencies from -your OS and puts others in a python virtual environment:: +.. contents:: Table of Contents + :local: + + +About Certbot +============= + +Certbot is packaged for many common operating systems and web servers. Check whether +``certbot`` (or ``letsencrypt``) is packaged for your web server's OS by visiting +certbot.eff.org_, where you will also find the correct installation instructions for +your system. + +.. Note:: Unless you have very specific requirements, we kindly suggest that you use the Certbot packages provided by your package manager (see certbot.eff.org_). If such packages are not available, we recommend using ``certbot-auto``, which automates the process of installing Certbot on your system. + +.. _certbot.eff.org: https://certbot.eff.org + + +System Requirements +=================== + +The Let's Encrypt Client presently only runs on Unix-ish OSes that include +Python 2.6 or 2.7; Python 3.x support will hopefully be added in the future. The +client requires root access in order to write to ``/etc/letsencrypt``, +``/var/log/letsencrypt``, ``/var/lib/letsencrypt``; to bind to ports 80 and 443 +(if you use the ``standalone`` plugin) and to read and modify webserver +configurations (if you use the ``apache`` or ``nginx`` plugins). If none of +these apply to you, it is theoretically possible to run without root privileges, +but for most users who want to avoid running an ACME client as root, either +`letsencrypt-nosudo `_ or +`simp_le `_ are more appropriate choices. + +The Apache plugin currently requires OS with augeas version 1.0; currently `it +supports +`_ +modern OSes based on Debian, Fedora, SUSE, Gentoo and Darwin. + +Alternate installation methods +================================ + +If you are offline or your operating system doesn't provide a package, you can use +an alternate method for installing ``certbot``. + +.. _certbot-auto: + +Certbot-Auto +------------ + +The ``certbot-auto`` wrapper script installs Certbot, obtaining some dependencies +from your web server OS and putting others in a python virtual environment. You can +download and run it as follows:: user@webserver:~$ wget https://dl.eff.org/certbot-auto user@webserver:~$ chmod a+x ./certbot-auto @@ -20,14 +64,172 @@ your OS and puts others in a python virtual environment:: user@server:~$ gpg2 --recv-key A2CFB51FA275A7286234E7B24D17C995CD9775F2 user@server:~$ gpg2 --trusted-key 4D17C995CD9775F2 --verify certbot-auto.asc certbot-auto -And for full command line help, you can type:: +The ``certbot-auto`` command updates to the latest client release automatically. +Since ``certbot-auto`` is a wrapper to ``certbot``, it accepts exactly +the same command line flags and arguments. For more information, see +`Certbot command-line options `_. + +For full command line help, you can type:: ./certbot-auto --help all -``certbot-auto`` updates to the latest client release automatically. And -since ``certbot-auto`` is a wrapper to ``certbot``, it accepts exactly -the same command line flags and arguments. More details about this script and -other installation methods can be found `in the User Guide -`_. +Problems with Python virtual environment +---------------------------------------- + +On a low memory system such as VPS with only 256MB of RAM, the required dependencies of Certbot will failed to build. +This can be identified if the pip outputs contains something like ``internal compiler error: Killed (program cc1)``. +You can workaround this restriction by creating a temporary swapfile:: + + user@webserver:~$ sudo fallocate -l 1G /tmp/swapfile + user@webserver:~$ sudo chmod 600 /tmp/swapfile + user@webserver:~$ sudo mkswap /tmp/swapfile + user@webserver:~$ sudo swapon /tmp/swapfile + +Disable and remove the swapfile once the virtual enviroment is constructed:: + + user@webserver:~$ sudo swapoff /tmp/swapfile + user@webserver:~$ sudo rm /tmp/swapfile + +Running with Docker +------------------- + +Docker_ is an amazingly simple and quick way to obtain a +certificate. However, this mode of operation is unable to install +certificates or configure your webserver, because our installer +plugins cannot reach your webserver from inside the Docker container. + +Most users should use the operating system packages (see instructions at +certbot.eff.org_) or, as a fallback, ``certbot-auto``. You should only +use Docker if you are sure you know what you are doing and have a +good reason to do so. + +You should definitely read the :ref:`where-certs` section, in order to +know how to manage the certs +manually. `Our ciphersuites page `__ +provides some information about recommended ciphersuites. If none of +these make much sense to you, you should definitely use the +certbot-auto_ method, which enables you to use installer plugins +that cover both of those hard topics. + +If you're still not convinced and have decided to use this method, +from the server that the domain you're requesting a cert for resolves +to, `install Docker`_, then issue the following command: + +.. code-block:: shell + + sudo docker run -it --rm -p 443:443 -p 80:80 --name certbot \ + -v "/etc/letsencrypt:/etc/letsencrypt" \ + -v "/var/lib/letsencrypt:/var/lib/letsencrypt" \ + quay.io/letsencrypt/letsencrypt:latest certonly + +Running Certbot with the ``certonly`` command will obtain a certificate and place it in the directory +``/etc/letsencrypt/live`` on your system. Because Certonly cannot install the certificate from +within Docker, you must install the certificate manually according to the procedure +recommended by the provider of your webserver. + +For more information about the layout +of the ``/etc/letsencrypt`` directory, see :ref:`where-certs`. + +.. _Docker: https://docker.com +.. _`install Docker`: https://docs.docker.com/engine/installation/ + +Operating System Packages +------------------------- + +**FreeBSD** + + * Port: ``cd /usr/ports/security/py-certbot && make install clean`` + * Package: ``pkg install py27-certbot`` + +**OpenBSD** + + * Port: ``cd /usr/ports/security/letsencrypt/client && make install clean`` + * Package: ``pkg_add letsencrypt`` + +**Arch Linux** + +.. code-block:: shell + + sudo pacman -S certbot + +**Debian** + +If you run Debian Stretch or Debian Sid, you can install certbot packages. + +.. code-block:: shell + + sudo apt-get update + sudo apt-get install certbot python-certbot-apache + +If you don't want to use the Apache plugin, you can omit the +``python-certbot-apache`` package. + +Packages exist for Debian Jessie via backports. First you'll have to follow the +instructions at http://backports.debian.org/Instructions/ to enable the Jessie backports +repo, if you have not already done so. Then run: + +.. code-block:: shell + + sudo apt-get install certbot python-certbot-apache -t jessie-backports + +**Fedora** + +.. code-block:: shell + + sudo dnf install certbot python2-certbot-apache + +**Gentoo** + +The official Certbot client is available in Gentoo Portage. If you +want to use the Apache plugin, it has to be installed separately: + +.. code-block:: shell + + emerge -av app-crypt/certbot + emerge -av app-crypt/certbot-apache + +When using the Apache plugin, you will run into a "cannot find a cert or key +directive" error if you're sporting the default Gentoo ``httpd.conf``. +You can fix this by commenting out two lines in ``/etc/apache2/httpd.conf`` +as follows: + +Change + +.. code-block:: shell + + + LoadModule ssl_module modules/mod_ssl.so + + +to + +.. code-block:: shell + + # + LoadModule ssl_module modules/mod_ssl.so + # + +For the time being, this is the only way for the Apache plugin to recognise +the appropriate directives when installing the certificate. +Note: this change is not required for the other plugins. + +**Other Operating Systems** + +OS packaging is an ongoing effort. If you'd like to package +Certbot for your distribution of choice please have a +look at the :doc:`packaging`. + +Installing from source +---------------------- + +Installation from source is only supported for developers and the +whole process is described in the :doc:`contributing`. + +.. warning:: Please do **not** use ``python setup.py install`` or + ``python pip install .``. Please do **not** attempt the + installation commands as superuser/root and/or without virtual + environment, e.g. ``sudo python setup.py install``, ``sudo pip + install``, ``sudo ./venv/bin/...``. These modes of operation might + corrupt your operating system and are **not supported** by the + Certbot team! -.. _certbot.eff.org: https://certbot.eff.org/ diff --git a/docs/resources.rst b/docs/resources.rst index a284f4a3d..459d8a829 100644 --- a/docs/resources.rst +++ b/docs/resources.rst @@ -2,53 +2,6 @@ Resources ===================== -Documentation: https://certbot.eff.org/docs - -Software project: https://github.com/certbot/certbot - -Notes for developers: https://certbot.eff.org/docs/contributing.html - -Main Website: https://letsencrypt.org/ - -Let's Encrypt FAQ: https://community.letsencrypt.org/t/frequently-asked-questions-faq/26#topic-title - -IRC Channel: #letsencrypt on `Freenode`_ or #certbot on `OFTC`_ - -Community: https://community.letsencrypt.org - -ACME spec: http://ietf-wg-acme.github.io/acme/ - -ACME working area in github: https://github.com/ietf-wg-acme/acme - - -Mailing list: `client-dev`_ (to subscribe without a Google account, send an -email to client-dev+subscribe@letsencrypt.org) - -|build-status| |coverage| |docs| |container| - - - -.. |build-status| image:: https://travis-ci.org/certbot/certbot.svg?branch=master - :target: https://travis-ci.org/certbot/certbot - :alt: Travis CI status - -.. |coverage| image:: https://coveralls.io/repos/certbot/certbot/badge.svg?branch=master - :target: https://coveralls.io/r/certbot/certbot - :alt: Coverage status - -.. |docs| image:: https://readthedocs.org/projects/letsencrypt/badge/ - :target: https://readthedocs.org/projects/letsencrypt/ - :alt: Documentation status - -.. |container| image:: https://quay.io/repository/letsencrypt/letsencrypt/status - :target: https://quay.io/repository/letsencrypt/letsencrypt - :alt: Docker Repository on Quay.io - -.. _`installation instructions`: - https://letsencrypt.readthedocs.org/en/latest/using.html - -.. _watch demo video: https://www.youtube.com/watch?v=Gas_sSB-5SU - -.. _Freenode: https://webchat.freenode.net?channels=%23letsencrypt -.. _OFTC: https://webchat.oftc.net?channels=%23certbot -.. _client-dev: https://groups.google.com/a/letsencrypt.org/forum/#!forum/client-dev +.. include:: ../README.rst + :start-after: tag:links-begin + :end-before: tag:links-end diff --git a/docs/using.rst b/docs/using.rst index f43fd15c5..0aeed58b9 100644 --- a/docs/using.rst +++ b/docs/using.rst @@ -5,84 +5,81 @@ User Guide .. contents:: Table of Contents :local: +Certbot Commands +================ -System Requirements -=================== +Certbot uses a number of different "commands" (also referred +to, equivalently, as "subcommands") to request specific actions such as +obtaining, renewing, or revoking certificates. Some of the most important +and most commonly-used commands will be discussed throughout this +document; an exhaustive list also appears near the end of the document. -The Let's Encrypt Client presently only runs on Unix-ish OSes that include -Python 2.6 or 2.7; Python 3.x support will hopefully be added in the future. The -client requires root access in order to write to ``/etc/letsencrypt``, -``/var/log/letsencrypt``, ``/var/lib/letsencrypt``; to bind to ports 80 and 443 -(if you use the ``standalone`` plugin) and to read and modify webserver -configurations (if you use the ``apache`` or ``nginx`` plugins). If none of -these apply to you, it is theoretically possible to run without root privileges, -but for most users who want to avoid running an ACME client as root, either -`letsencrypt-nosudo `_ or -`simp_le `_ are more appropriate choices. +The ``certbot`` script on your web server might be named ``letsencrypt`` if your system uses an older package, or ``certbot-auto`` if you used an alternate installation method. Throughout the docs, whenever you see ``certbot``, swap in the correct name as needed. -The Apache plugin currently requires a Debian-based OS with augeas version -1.0; this includes Ubuntu 12.04+ and Debian 7+. +.. _plugins: - -Getting Certbot -=============== - -To get specific instructions for installing Certbot on your OS, -visit certbot.eff.org_. This is the easiest way to learn how to get -Certbot up and running on your system. - -If you're offline, you can find some general -instructions under `Quick Installation `__. - -__ installation_ -.. _certbot.eff.org: https://certbot.eff.org - -.. _certbot-auto: https://certbot.eff.org/docs/using.html#certbot-auto - -The name of the certbot command -------------------------------- - -Many platforms now have native packages that give you a ``certbot`` or (for -older packages) ``letsencrypt`` command you can run. On others, the -``certbot-auto`` / ``letsencrypt-auto`` installer and wrapper script is a -stand-in. Throughout the documentation, whenever you see references to -``certbot`` script/binary, you should substitute in the name of the command -that certbot.eff.org_ told you to use on your system (``certbot``, -``letsencrypt``, or ``certbot-auto``). - - -Plugins -======= +Getting certificates (and choosing plugins) +=========================================== The Certbot client supports a number of different "plugins" that can be -used to obtain and/or install certificates. Plugins that can obtain a cert -are called "authenticators" and can be used with the "certonly" command. -Plugins that can install a cert are called "installers". Plugins that do both -can be used with the "certbot run" command, which is the default. +used to obtain and/or install certificates. -=========== ==== ==== =============================================================== -Plugin Auth Inst Notes -=========== ==== ==== =============================================================== -apache_ Y Y Automates obtaining and installing a cert with Apache 2.4 on - Debian-based distributions with ``libaugeas0`` 1.0+. -webroot_ Y N Obtains a cert by writing to the webroot directory of an - already running webserver. -standalone_ Y N Uses a "standalone" webserver to obtain a cert. Requires - port 80 or 443 to be available. This is useful on systems - with no webserver, or when direct integration with the local - webserver is not supported or not desired. -manual_ Y N Helps you obtain a cert by giving you instructions to perform - domain validation yourself. -nginx_ Y Y Very experimental and not included in certbot-auto_. -=========== ==== ==== =============================================================== +Plugins that can obtain a cert are called "authenticators" and can be used with +the "certonly" command. This will carry out the steps needed to validate that you +control the domain(s) you are requesting a cert for, obtain a cert for the specified +domain(s), and place it in the ``/etc/letsencrypt`` directory on your +machine - without editing any of your server's configuration files to serve the +obtained certificate. If you specify multiple domains to authenticate, they will +all be listed in a single certificate. To obtain multiple seperate certificates +you will need to run Certbot multiple times. -There are many third-party-plugins_ available. +Plugins that can install a cert are called "installers" and can be used with the +"install" command. These plugins can modify your webserver's configuration to +serve your website over HTTPS using certificates obtained by certbot. + +Plugins that do both can be used with the "certbot run" command, which is the default +when no command is specified. The "run" subcommand can also be used to specify +a combination of distinct authenticator and installer plugins. + +=========== ==== ==== =============================================================== ============================= +Plugin Auth Inst Notes Challenge types (and port) +=========== ==== ==== =============================================================== ============================= +apache_ Y Y | Automates obtaining and installing a cert with Apache 2.4 on tls-sni-01_ (443) + | Debian-based distributions with ``libaugeas0`` 1.0+. +webroot_ Y N | Obtains a cert by writing to the webroot directory of an http-01_ (80) + | already running webserver. +nginx_ Y Y | Automates obtaining and installing a cert with Nginx. Alpha tls-sni-01_ (443) + | release shipped with Certbot 0.9.0. +standalone_ Y N | Uses a "standalone" webserver to obtain a cert. Requires http-01_ (80) or + | port 80 or 443 to be available. This is useful on systems tls-sni-01_ (443) + | with no webserver, or when direct integration with the local + | webserver is not supported or not desired. +manual_ Y N | Helps you obtain a cert by giving you instructions to perform http-01_ (80) or + | domain validation yourself. dns-01_ (53) +=========== ==== ==== =============================================================== ============================= + +Under the hood, plugins use one of several ACME protocol "Challenges_" to +prove you control a domain. The options are http-01_ (which uses port 80), +tls-sni-01_ (port 443) and dns-01_ (requring configuration of a DNS server on +port 53, thought that's often not the same machine as your webserver). A few +plugins support more than one challenge type, in which case you can choose one +with ``--preferred-challenges``. + +There are also many third-party-plugins_ available. Below we describe in more detail +the circumstances in which each plugin can be used, and how to use it. + +.. _Challenges: https://tools.ietf.org/html/draft-ietf-acme-acme-03#section-7 +.. _tls-sni-01: https://tools.ietf.org/html/draft-ietf-acme-acme-03#section-7.3 +.. _http-01: https://tools.ietf.org/html/draft-ietf-acme-acme-03#section-7.2 +.. _dns-01: https://tools.ietf.org/html/draft-ietf-acme-acme-03#section-7.4 Apache ------ -If you're running Apache 2.4 on a Debian-based OS with version 1.0+ of -the ``libaugeas0`` package available, you can use the Apache plugin. +The Apache plugin currently requires OS with augeas version 1.0; currently `it +supports +`_ +modern OSes based on Debian, Fedora, SUSE, Gentoo and Darwin. This automates both obtaining *and* installing certs on an Apache webserver. To specify this plugin on the command line, simply include ``--apache``. @@ -129,6 +126,19 @@ your webserver configuration, you might need to modify the configuration to ensure that files inside ``/.well-known/acme-challenge`` are served by the webserver. +Nginx +----- + +The Nginx plugin has been distributed with Certbot since version 0.9.0 and should +work for most configurations. Because it is alpha code, we recommend backing up Nginx +configurations before using it (though you can also revert changes to +configurations with ``certbot --nginx rollback``). You can use it by providing +the ``--nginx`` flag on the commandline. + +:: + + certbot --nginx + Standalone ---------- @@ -158,15 +168,6 @@ the UI, you can use the plugin to obtain a cert by specifying to copy and paste commands into another terminal session, which may be on a different computer. -Nginx ------ - -In the future, if you're running Nginx you will hopefully be able to use this -plugin to automatically obtain and install your certificate. The Nginx plugin is -still experimental, however, and is not installed with certbot-auto_. If -installed, you can select this plugin on the command line by including -``--nginx``. - .. _third-party-plugins: Third-party plugins @@ -192,7 +193,7 @@ postfix_ N Y STARTTLS Everywhere is becoming a Certbot Postfix/Exim plu =========== ==== ==== =============================================================== .. _plesk: https://github.com/plesk/letsencrypt-plesk -.. _haproxy: https://code.greenhost.net/open/letsencrypt-haproxy +.. _haproxy: https://github.com/greenhost/certbot-haproxy .. _s3front: https://github.com/dlapiduz/letsencrypt-s3front .. _gandi: https://github.com/Gandi/letsencrypt-gandi .. _icecast: https://github.com/e00E/lets-encrypt-icecast @@ -205,10 +206,64 @@ postfix_ N Y STARTTLS Everywhere is becoming a Certbot Postfix/Exim plu If you're interested, you can also :ref:`write your own plugin `. +Re-running Certbot +================== +Running Certbot with the ``certonly`` or ``run`` commands always requests +the creation of a single new certificate, even if you already have an +existing certificate with some of the same domain names. The ``--force-renewal``, +``--duplicate``, and ``--expand`` options control Certbot's behavior in this case. +If you don't specify a requested behavior, Certbot may ask you what you intended. -Renewal -======= +``--force-renewal`` tells Certbot to request a new certificate +with the same domains as an existing certificate. (Each and every domain +must be explicitly specified via ``-d``.) If successful, this certificate +will be saved alongside the earlier one and symbolic links (the "``live``" +reference) will be updated to point to the new certificate. This is a +valid method of explicitly requesting the renewal of a specific individual +certificate. + +``--duplicate`` tells Certbot to create a separate, unrelated certificate +with the same domains as an existing certificate. This certificate will +be saved completely separately from the prior one. Most users probably +do not want this behavior. + +``--expand`` tells Certbot to update an existing certificate with a new +certificate that contains all of the old domains and one or more additional +new domains. + +``--allow-subset-of-names`` tells Certbot to continue with cert generation if +only some of the specified domain authorizations can be obtained. This may +be useful if some domains specified in a certificate no longer point at this +system. + +Whenever you obtain a new certificate in any of these ways, the new +certificate exists alongside any previously-obtained certificates, whether +or not the previous certificates have expired. The generation of a new +certificate counts against several rate limits that are intended to prevent +abuse of the ACME protocol, as described +`here `__. + +Certbot also provides a ``renew`` command. This command examines *all* existing +certificates to determine whether or not each is near expiry. For any existing +certificate that is near expiry, ``certbot renew`` will attempt to obtain a +new certificate for the same domains. Unlike ``certonly``, ``renew`` acts on +multiple certificates and always takes into account whether each one is near +expiry. Because of this, ``renew`` is suitable (and designed) for automated use, +to allow your system to automatically renew each certificate when appropriate. +Since ``renew`` will only renew certificates that are near expiry it can be +run as frequently as you want - since it will usually take no action. + +Typically, ``certbot renew`` runs a reduced risk of rate-limit problems +because it renews certificates only when necessary, and because some of +the Let's Encrypt CA's rate limit policies treat the issuance of a new +certificate under these circumstances more generously. More details about +the use of ``certbot renew`` are provided below. + +.. _renewal: + +Renewing certificates +===================== .. note:: Let's Encrypt CA issues short-lived certificates (90 days). Make sure you renew the certificates at least once in 3 @@ -226,10 +281,11 @@ at the time the certificate was originally issued will be used for the renewal attempt, unless you specify other plugins or options. You can also specify hooks to be run before or after a certificate is -renewed. For example, if you want to use the standalone_ plugin to renew -your certificates, you may want to use a command like +renewed. For example, if you have only a single cert and you obtained it using +the standalone_ plugin, it will be used by default when renewing. In that case +you may want to use a command like this to renew your certificate. -``certbot renew --standalone --pre-hook "service nginx stop" --post-hook "service nginx start"`` +``certbot renew --pre-hook "service nginx stop" --post-hook "service nginx start"`` This will stop Nginx so standalone can bind to the necessary ports and then restart Nginx after the plugin is finished. The hooks will only be @@ -245,12 +301,13 @@ can run on a regular basis, like every week or every day). In that case, you are likely to want to use the ``-q`` or ``--quiet`` quiet flag to silence all output except errors. -The ``--force-renew`` flag may be helpful for automating renewal; -it causes the expiration time of the certificate(s) to be ignored when -considering renewal, and attempts to renew each and every installed -certificate regardless of its age. (This form is not appropriate to run -daily because each certificate will be renewed every day, which will -quickly run into the certificate authority rate limit.) +If you are manually renewing all of your certificates, the +``--force-renewal`` flag may be helpful; it causes the expiration time of +the certificate(s) to be ignored when considering renewal, and attempts to +renew each and every installed certificate regardless of its age. (This +form is not appropriate to run daily because each certificate will be +renewed every day, which will quickly run into the certificate authority +rate limit.) Note that options provided to ``certbot renew`` will apply to *every* certificate for which renewal is attempted; for example, @@ -260,7 +317,6 @@ RSA public key. If a certificate is successfully renewed using specified options, those options will be saved and used for future renewals of that certificate. - An alternative form that provides for more fine-grained control over the renewal process (while renewing specified certificates one at a time), is ``certbot certonly`` with the complete set of subject domains of @@ -275,8 +331,8 @@ this case in order to renew and replace the old certificate rather than obtaining a new one; don't forget any `www.` domains! Specifying a subset of the domains creates a new, separate certificate containing only those domains, rather than replacing the original certificate.) -The ``certonly`` form attempts to renew one individual certificate. - +When run with a set of domains corresponding to an existing certificate, +the ``certonly`` command attempts to renew that one individual certificate. Please note that the CA will send notification emails to the address you provide if you do not renew certificates that are about to expire. @@ -287,8 +343,8 @@ commands into your individual environment. .. _command-line: -Command line options -==================== +Certbot command-line options +============================ Certbot supports a lot of command line options. Here's the full list, from ``certbot --help all``: @@ -322,43 +378,41 @@ The following files are available: This is what Apache needs for `SSLCertificateKeyFile `_, - and nginx for `ssl_certificate_key + and Nginx for `ssl_certificate_key `_. -``cert.pem`` - Server certificate only. - - This is what Apache < 2.4.8 needs for `SSLCertificateFile - `_. - -``chain.pem`` - All certificates that need to be served by the browser **excluding** - server certificate, i.e. root and intermediate certificates only. - - This is what Apache < 2.4.8 needs for `SSLCertificateChainFile - `_, - and what nginx >= 1.3.7 needs for `ssl_trusted_certificate - `_. - ``fullchain.pem`` - All certificates, **including** server certificate. This is - concatenation of ``cert.pem`` and ``chain.pem``. + All certificates, **including** server certificate (aka leaf certificate or + end-entity certificate). The server certificate is the first one in this file, + followed by any intermediates. This is what Apache >= 2.4.8 needs for `SSLCertificateFile `_, - and what nginx needs for `ssl_certificate + and what Nginx needs for `ssl_certificate `_. +``cert.pem`` and ``chain.pem`` (less common) + ``cert.pem`` contains the server certificate by itself, and + ``chain.pem`` contains the additional intermediate certificate or + certificates that web browsers will need in order to validate the + server certificate. If you provide one of these files to your web + server, you **must** provide both of them, or some browsers will show + "This Connection is Untrusted" errors for your site, `some of the time + `_. -For both chain files, all certificates are ordered from root (primary -certificate) towards leaf. + Apache < 2.4.8 needs these for `SSLCertificateFile + `_. + and `SSLCertificateChainFile + `_, + respectively. -Please note, that **you must use** either ``chain.pem`` or -``fullchain.pem``. In case of webservers, using only ``cert.pem``, -will cause nasty errors served through the browsers! + If you're using OCSP stapling with Nginx >= 1.3.7, ``chain.pem`` should be + provided as the `ssl_trusted_certificate + `_ + to validate OCSP responses. -.. note:: All files are PEM-encoded (as the filename suffix - suggests). If you need other format, such as DER or PFX, then you +.. note:: All files are PEM-encoded. + If you need other format, such as DER or PFX, then you could convert using ``openssl``. You can automate that with ``--renew-hook`` if you're using automatic renewal_. @@ -388,14 +442,15 @@ By default, the following locations are searched: Getting help ============ -If you're having problems you can chat with us on `IRC (#certbot @ -OFTC) `_ or at -`IRC (#letsencrypt @ freenode) `_ -or get support on the Let's Encrypt `forums `_. +If you're having problems, we recommend posting on the Let's Encrypt +`Community Forum `_. + +You can also chat with us on IRC: `(#certbot @ +OFTC) `_ or +`(#letsencrypt @ freenode) `_. If you find a bug in the software, please do report it in our `issue -tracker -`_. Remember to +tracker `_. Remember to give us as much information as possible: - copy and paste exact command line used and the output (though mind @@ -406,185 +461,3 @@ give us as much information as possible: - copy and paste ``certbot --version`` output - your operating system, including specific version - specify which installation method you've chosen - -Other methods of installation -============================= - -Running with Docker -------------------- - -Docker_ is an amazingly simple and quick way to obtain a -certificate. However, this mode of operation is unable to install -certificates or configure your webserver, because our installer -plugins cannot reach your webserver from inside the Docker container. - -Most users should use the operating system packages (see instructions at -certbot.eff.org_) or, as a fallback, ``certbot-auto``. You should only -use Docker if you are sure you know what you are doing and have a -good reason to do so. - -You should definitely read the :ref:`where-certs` section, in order to -know how to manage the certs -manually. `Our ciphersuites page `__ -provides some information about recommended ciphersuites. If none of -these make much sense to you, you should definitely use the -certbot-auto_ method, which enables you to use installer plugins -that cover both of those hard topics. - -If you're still not convinced and have decided to use this method, -from the server that the domain you're requesting a cert for resolves -to, `install Docker`_, then issue the following command: - -.. code-block:: shell - - sudo docker run -it --rm -p 443:443 -p 80:80 --name certbot \ - -v "/etc/letsencrypt:/etc/letsencrypt" \ - -v "/var/lib/letsencrypt:/var/lib/letsencrypt" \ - quay.io/letsencrypt/letsencrypt:latest certonly - -Running Certbot with the ``certonly`` command will obtain a certificate and place it in the directory -``/etc/letsencrypt/live`` on your system. Because Certonly cannot install the certificate from -within Docker, you must install the certificate manually according to the procedure -recommended by the provider of your webserver. - -For more information about the layout -of the ``/etc/letsencrypt`` directory, see :ref:`where-certs`. - -.. _Docker: https://docker.com -.. _`install Docker`: https://docs.docker.com/userguide/ - - -Operating System Packages --------------------------- - -**FreeBSD** - - * Port: ``cd /usr/ports/security/py-certbot && make install clean`` - * Package: ``pkg install py27-certbot`` - -**OpenBSD** - - * Port: ``cd /usr/ports/security/letsencrypt/client && make install clean`` - * Package: ``pkg_add letsencrypt`` - -**Arch Linux** - -.. code-block:: shell - - sudo pacman -S certbot - -**Debian** - -If you run Debian Stretch or Debian Sid, you can install certbot packages. - -.. code-block:: shell - - sudo apt-get update - sudo apt-get install certbot python-certbot-apache - -If you don't want to use the Apache plugin, you can omit the -``python-certbot-apache`` package. - -Packages exist for Debian Jessie via backports. First you'll have to follow the -instructions at http://backports.debian.org/Instructions/ to enable the Jessie backports -repo, if you have not already done so. Then run: - -.. code-block:: shell - - sudo apt-get install letsencrypt python-letsencrypt-apache -t jessie-backports - -**Fedora** - -.. code-block:: shell - - sudo dnf install letsencrypt - -**Gentoo** - -The official Certbot client is available in Gentoo Portage. If you -want to use the Apache plugin, it has to be installed separately: - -.. code-block:: shell - - emerge -av app-crypt/letsencrypt - emerge -av app-crypt/letsencrypt-apache - -Currently, only the Apache plugin is included in Portage. However, if you -Warning! -You can use Layman to add the mrueg overlay which does include a package for the -Certbot Nginx plugin, however, this plugin is known to be buggy and should only -be used with caution after creating a backup up your Nginx configuration. -We strongly recommend you use the app-crypt/letsencrypt package instead until -the Nginx plugin is ready. - -.. code-block:: shell - - emerge -av app-portage/layman - layman -S - layman -a mrueg - emerge -av app-crypt/letsencrypt-nginx - -When using the Apache plugin, you will run into a "cannot find a cert or key -directive" error if you're sporting the default Gentoo ``httpd.conf``. -You can fix this by commenting out two lines in ``/etc/apache2/httpd.conf`` -as follows: - -Change - -.. code-block:: shell - - - LoadModule ssl_module modules/mod_ssl.so - - -to - -.. code-block:: shell - - # - LoadModule ssl_module modules/mod_ssl.so - # - -For the time being, this is the only way for the Apache plugin to recognise -the appropriate directives when installing the certificate. -Note: this change is not required for the other plugins. - -**Other Operating Systems** - -OS packaging is an ongoing effort. If you'd like to package -Certbot for your distribution of choice please have a -look at the :doc:`packaging`. - - -From source ------------ - -Installation from source is only supported for developers and the -whole process is described in the :doc:`contributing`. - -.. warning:: Please do **not** use ``python setup.py install`` or - ``python pip install .``. Please do **not** attempt the - installation commands as superuser/root and/or without virtual - environment, e.g. ``sudo python setup.py install``, ``sudo pip - install``, ``sudo ./venv/bin/...``. These modes of operation might - corrupt your operating system and are **not supported** by the - Certbot team! - - -Comparison of different methods -------------------------------- - -Unless you have very specific requirements, we kindly suggest that you use -the Certbot packages provided by your package manager (see certbot.eff.org_). -If such packages are not available, we recommend using ``certbot-auto``, which -automates the process of installing Certbot on your system. - -Beyond the methods discussed here, other methods may be possible, such as -installing Certbot directly with pip from PyPI or downloading a ZIP -archive from GitHub may be technically possible but are not presently -recommended or supported. - -.. include:: ../README.rst - :start-after: tag:features-begin - :end-before: tag:features-end -.. include:: ../CHANGES.rst diff --git a/letsencrypt-apache/LICENSE.txt b/letsencrypt-apache/LICENSE.txt deleted file mode 100644 index 981c46c9f..000000000 --- a/letsencrypt-apache/LICENSE.txt +++ /dev/null @@ -1,190 +0,0 @@ - Copyright 2015 Electronic Frontier Foundation and others - - Licensed under the Apache License, Version 2.0 (the "License"); - you may not use this file except in compliance with the License. - You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - - Unless required by applicable law or agreed to in writing, software - distributed under the License is distributed on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - See the License for the specific language governing permissions and - limitations under the License. - - Apache License - Version 2.0, January 2004 - http://www.apache.org/licenses/ - - TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION - - 1. Definitions. - - "License" shall mean the terms and conditions for use, reproduction, - and distribution as defined by Sections 1 through 9 of this document. - - "Licensor" shall mean the copyright owner or entity authorized by - the copyright owner that is granting the License. - - "Legal Entity" shall mean the union of the acting entity and all - other entities that control, are controlled by, or are under common - control with that entity. For the purposes of this definition, - "control" means (i) the power, direct or indirect, to cause the - direction or management of such entity, whether by contract or - otherwise, or (ii) ownership of fifty percent (50%) or more of the - outstanding shares, or (iii) beneficial ownership of such entity. - - "You" (or "Your") shall mean an individual or Legal Entity - exercising permissions granted by this License. - - "Source" form shall mean the preferred form for making modifications, - including but not limited to software source code, documentation - source, and configuration files. - - "Object" form shall mean any form resulting from mechanical - transformation or translation of a Source form, including but - not limited to compiled object code, generated documentation, - and conversions to other media types. - - "Work" shall mean the work of authorship, whether in Source or - Object form, made available under the License, as indicated by a - copyright notice that is included in or attached to the work - (an example is provided in the Appendix below). - - "Derivative Works" shall mean any work, whether in Source or Object - form, that is based on (or derived from) the Work and for which the - editorial revisions, annotations, elaborations, or other modifications - represent, as a whole, an original work of authorship. For the purposes - of this License, Derivative Works shall not include works that remain - separable from, or merely link (or bind by name) to the interfaces of, - the Work and Derivative Works thereof. - - "Contribution" shall mean any work of authorship, including - the original version of the Work and any modifications or additions - to that Work or Derivative Works thereof, that is intentionally - submitted to Licensor for inclusion in the Work by the copyright owner - or by an individual or Legal Entity authorized to submit on behalf of - the copyright owner. For the purposes of this definition, "submitted" - means any form of electronic, verbal, or written communication sent - to the Licensor or its representatives, including but not limited to - communication on electronic mailing lists, source code control systems, - and issue tracking systems that are managed by, or on behalf of, the - Licensor for the purpose of discussing and improving the Work, but - excluding communication that is conspicuously marked or otherwise - designated in writing by the copyright owner as "Not a Contribution." - - "Contributor" shall mean Licensor and any individual or Legal Entity - on behalf of whom a Contribution has been received by Licensor and - subsequently incorporated within the Work. - - 2. Grant of Copyright License. Subject to the terms and conditions of - this License, each Contributor hereby grants to You a perpetual, - worldwide, non-exclusive, no-charge, royalty-free, irrevocable - copyright license to reproduce, prepare Derivative Works of, - publicly display, publicly perform, sublicense, and distribute the - Work and such Derivative Works in Source or Object form. - - 3. Grant of Patent License. Subject to the terms and conditions of - this License, each Contributor hereby grants to You a perpetual, - worldwide, non-exclusive, no-charge, royalty-free, irrevocable - (except as stated in this section) patent license to make, have made, - use, offer to sell, sell, import, and otherwise transfer the Work, - where such license applies only to those patent claims licensable - by such Contributor that are necessarily infringed by their - Contribution(s) alone or by combination of their Contribution(s) - with the Work to which such Contribution(s) was submitted. If You - institute patent litigation against any entity (including a - cross-claim or counterclaim in a lawsuit) alleging that the Work - or a Contribution incorporated within the Work constitutes direct - or contributory patent infringement, then any patent licenses - granted to You under this License for that Work shall terminate - as of the date such litigation is filed. - - 4. Redistribution. You may reproduce and distribute copies of the - Work or Derivative Works thereof in any medium, with or without - modifications, and in Source or Object form, provided that You - meet the following conditions: - - (a) You must give any other recipients of the Work or - Derivative Works a copy of this License; and - - (b) You must cause any modified files to carry prominent notices - stating that You changed the files; and - - (c) You must retain, in the Source form of any Derivative Works - that You distribute, all copyright, patent, trademark, and - attribution notices from the Source form of the Work, - excluding those notices that do not pertain to any part of - the Derivative Works; and - - (d) If the Work includes a "NOTICE" text file as part of its - distribution, then any Derivative Works that You distribute must - include a readable copy of the attribution notices contained - within such NOTICE file, excluding those notices that do not - pertain to any part of the Derivative Works, in at least one - of the following places: within a NOTICE text file distributed - as part of the Derivative Works; within the Source form or - documentation, if provided along with the Derivative Works; or, - within a display generated by the Derivative Works, if and - wherever such third-party notices normally appear. The contents - of the NOTICE file are for informational purposes only and - do not modify the License. You may add Your own attribution - notices within Derivative Works that You distribute, alongside - or as an addendum to the NOTICE text from the Work, provided - that such additional attribution notices cannot be construed - as modifying the License. - - You may add Your own copyright statement to Your modifications and - may provide additional or different license terms and conditions - for use, reproduction, or distribution of Your modifications, or - for any such Derivative Works as a whole, provided Your use, - reproduction, and distribution of the Work otherwise complies with - the conditions stated in this License. - - 5. Submission of Contributions. Unless You explicitly state otherwise, - any Contribution intentionally submitted for inclusion in the Work - by You to the Licensor shall be under the terms and conditions of - this License, without any additional terms or conditions. - Notwithstanding the above, nothing herein shall supersede or modify - the terms of any separate license agreement you may have executed - with Licensor regarding such Contributions. - - 6. Trademarks. This License does not grant permission to use the trade - names, trademarks, service marks, or product names of the Licensor, - except as required for reasonable and customary use in describing the - origin of the Work and reproducing the content of the NOTICE file. - - 7. Disclaimer of Warranty. Unless required by applicable law or - agreed to in writing, Licensor provides the Work (and each - Contributor provides its Contributions) on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or - implied, including, without limitation, any warranties or conditions - of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A - PARTICULAR PURPOSE. You are solely responsible for determining the - appropriateness of using or redistributing the Work and assume any - risks associated with Your exercise of permissions under this License. - - 8. Limitation of Liability. In no event and under no legal theory, - whether in tort (including negligence), contract, or otherwise, - unless required by applicable law (such as deliberate and grossly - negligent acts) or agreed to in writing, shall any Contributor be - liable to You for damages, including any direct, indirect, special, - incidental, or consequential damages of any character arising as a - result of this License or out of the use or inability to use the - Work (including but not limited to damages for loss of goodwill, - work stoppage, computer failure or malfunction, or any and all - other commercial damages or losses), even if such Contributor - has been advised of the possibility of such damages. - - 9. Accepting Warranty or Additional Liability. While redistributing - the Work or Derivative Works thereof, You may choose to offer, - and charge a fee for, acceptance of support, warranty, indemnity, - or other liability obligations and/or rights consistent with this - License. However, in accepting such obligations, You may act only - on Your own behalf and on Your sole responsibility, not on behalf - of any other Contributor, and only if You agree to indemnify, - defend, and hold each Contributor harmless for any liability - incurred by, or claims asserted against, such Contributor by reason - of your accepting any such warranty or additional liability. - - END OF TERMS AND CONDITIONS diff --git a/letsencrypt-apache/MANIFEST.in b/letsencrypt-apache/MANIFEST.in deleted file mode 100644 index 97e2ad3df..000000000 --- a/letsencrypt-apache/MANIFEST.in +++ /dev/null @@ -1,2 +0,0 @@ -include LICENSE.txt -include README.rst diff --git a/letsencrypt-apache/README.rst b/letsencrypt-apache/README.rst deleted file mode 100644 index c0c201f14..000000000 --- a/letsencrypt-apache/README.rst +++ /dev/null @@ -1,2 +0,0 @@ -This package is a simple shim for backwards compatibility around -``certbot-apache``, the Apache plugin for ``certbot``. diff --git a/letsencrypt-apache/letsencrypt_apache/__init__.py b/letsencrypt-apache/letsencrypt_apache/__init__.py deleted file mode 100644 index cc8faef21..000000000 --- a/letsencrypt-apache/letsencrypt_apache/__init__.py +++ /dev/null @@ -1,8 +0,0 @@ -"""Let's Encrypt Apache plugin.""" -import sys - - -import certbot_apache - - -sys.modules['letsencrypt_apache'] = certbot_apache diff --git a/letsencrypt-apache/setup.py b/letsencrypt-apache/setup.py deleted file mode 100644 index 09703841c..000000000 --- a/letsencrypt-apache/setup.py +++ /dev/null @@ -1,59 +0,0 @@ -import codecs -import os -import sys - -from setuptools import setup -from setuptools import find_packages - - -def read_file(filename, encoding='utf8'): - """Read unicode from given file.""" - with codecs.open(filename, encoding=encoding) as fd: - return fd.read() - - -here = os.path.abspath(os.path.dirname(__file__)) -readme = read_file(os.path.join(here, 'README.rst')) - - -version = '0.8.0.dev0' - - -# This package is a simple shim around certbot-apache -install_requires = [ - 'certbot-apache', - 'letsencrypt=={0}'.format(version), -] - - -setup( - name='letsencrypt-apache', - version=version, - description="Apache plugin for Let's Encrypt", - long_description=readme, - url='https://github.com/letsencrypt/letsencrypt', - author="Certbot Project", - author_email='client-dev@letsencrypt.org', - license='Apache License 2.0', - classifiers=[ - 'Development Status :: 3 - Alpha', - 'Environment :: Plugins', - 'Intended Audience :: System Administrators', - 'License :: OSI Approved :: Apache Software License', - 'Operating System :: POSIX :: Linux', - 'Programming Language :: Python', - 'Programming Language :: Python :: 2', - 'Programming Language :: Python :: 2.6', - 'Programming Language :: Python :: 2.7', - 'Topic :: Internet :: WWW/HTTP', - 'Topic :: Security', - 'Topic :: System :: Installation/Setup', - 'Topic :: System :: Networking', - 'Topic :: System :: Systems Administration', - 'Topic :: Utilities', - ], - - packages=find_packages(), - include_package_data=True, - install_requires=install_requires, -) diff --git a/letsencrypt-auto b/letsencrypt-auto index 80f39cf59..cba185eae 100755 --- a/letsencrypt-auto +++ b/letsencrypt-auto @@ -19,7 +19,7 @@ XDG_DATA_HOME=${XDG_DATA_HOME:-~/.local/share} VENV_NAME="letsencrypt" VENV_PATH=${VENV_PATH:-"$XDG_DATA_HOME/$VENV_NAME"} VENV_BIN="$VENV_PATH/bin" -LE_AUTO_VERSION="0.8.1" +LE_AUTO_VERSION="0.9.3" BASENAME=$(basename $0) USAGE="Usage: $BASENAME [OPTIONS] A self-updating wrapper script for the Certbot ACME client. When run, updates @@ -34,6 +34,7 @@ Help for certbot itself cannot be provided until it is installed. -n, --non-interactive, --noninteractive run without asking for user input --no-self-upgrade do not download updates --os-packages-only install OS dependencies and exit + -q, --quiet provide only update/error output -v, --verbose provide more output All arguments are accepted and forwarded to the Certbot client when run." @@ -52,15 +53,19 @@ for arg in "$@" ; do HELP=1;; --noninteractive|--non-interactive) ASSUME_YES=1;; + --quiet) + QUIET=1;; --verbose) VERBOSE=1;; -[!-]*) - while getopts ":hnv" short_arg $arg; do + while getopts ":hnvq" short_arg $arg; do case "$short_arg" in h) HELP=1;; n) ASSUME_YES=1;; + q) + QUIET=1;; v) VERBOSE=1;; esac @@ -121,7 +126,7 @@ ExperimentalBootstrap() { $2 fi else - echo "WARNING: $1 support is very experimental at present..." + echo "FATAL: $1 support is very experimental at present..." echo "if you would like to work on improving it, please ensure you have backups" echo "and then run this script again with the --debug flag!" exit 1 @@ -276,6 +281,30 @@ BootstrapRpmCommon() { exit 1 fi + if [ "$ASSUME_YES" = 1 ]; then + yes_flag="-y" + fi + + if ! $SUDO $tool list *virtualenv >/dev/null 2>&1; then + echo "To use Certbot, packages from the EPEL repository need to be installed." + if ! $SUDO $tool list epel-release >/dev/null 2>&1; then + echo "Please enable this repository and try running Certbot again." + exit 1 + fi + if [ "$ASSUME_YES" = 1 ]; then + /bin/echo -n "Enabling the EPEL repository in 3 seconds..." + sleep 1s + /bin/echo -ne "\e[0K\rEnabling the EPEL repository in 2 seconds..." + sleep 1s + /bin/echo -e "\e[0K\rEnabling the EPEL repository in 1 seconds..." + sleep 1s + fi + if ! $SUDO $tool install $yes_flag epel-release; then + echo "Could not enable EPEL. Aborting bootstrap!" + exit 1 + fi + fi + pkgs=" gcc dialog @@ -313,10 +342,6 @@ BootstrapRpmCommon() { " fi - if [ "$ASSUME_YES" = 1 ]; then - yes_flag="-y" - fi - if ! $SUDO $tool install $yes_flag $pkgs; then echo "Could not install OS dependencies. Aborting bootstrap!" exit 1 @@ -565,8 +590,9 @@ if [ "$1" = "--le-auto-phase2" ]; then # ------------------------------------------------------------------------- cat << "UNLIKELY_EOF" > "$TEMP_DIR/letsencrypt-auto-requirements.txt" # This is the flattened list of packages certbot-auto installs. To generate -# this, do `pip install --no-cache-dir -e acme -e . -e certbot-apache`, and -# then use `hashin` or a more secure method to gather the hashes. +# this, do +# `pip install --no-cache-dir -e acme -e . -e certbot-apache -e certbot-nginx`, +# and then use `hashin` or a more secure method to gather the hashes. argparse==1.4.0 \ --hash=sha256:c31647edb69fd3d465a847ea3157d37bed1f95f19760b11a47aa91c04b666314 \ @@ -598,28 +624,29 @@ ConfigArgParse==0.10.0 \ --hash=sha256:3b50a83dd58149dfcee98cb6565265d10b53e9c0a2bca7eeef7fb5f5524890a7 configobj==5.0.6 \ --hash=sha256:a2f5650770e1c87fb335af19a9b7eb73fc05ccf22144eb68db7d00cd2bcb0902 -cryptography==1.2.3 \ - --hash=sha256:031938f73a5c5eb3e809e18ff7caeb6865351871417be6050cb8c86a9a202b9a \ - --hash=sha256:a179a38d50f8d68b491d7a313db78f8cabe290842cecddddc7b34d408e59db0a \ - --hash=sha256:906c88b2aadcf99cfabb24098263d1bf65ab0c8688acde10dae1f09d865920f1 \ - --hash=sha256:6e706c5c6088770b1d1b634e959e21963e315b0255f5f4777125ad3d54082977 \ - --hash=sha256:f5ebf8e31c48f8707921dca0e994de77813a9c9b9bf03c119c5ddf97bdcffe73 \ - --hash=sha256:c7b89e42288cc7fbee3812e99ef5c744f22452e11d6822f6807afc6d6b3be83e \ - --hash=sha256:8408d29865947109d8b68f1837a7cde1aa4dc86e0f79ca3ba58c0c44e443d6a5 \ - --hash=sha256:c7e76cf3c3d925dd31fa238cfb806cffba718c0f08707d77a538768477969956 \ - --hash=sha256:7d8de35380f31702758b7753bb5c40723832c73006dedb2f9099bf61a37f7287 \ - --hash=sha256:5edbee71fae5469ee83fe0a37866b9398c8ce3a46325c24fcedfbf097bb48a19 \ - --hash=sha256:594edafe4801c13bdc1cc305e7704a90c19617e95936f6ab457ee4ffe000ba50 \ - --hash=sha256:b7fdb16a0a7f481be42da744bfe1ea2163025de21f90f2c688a316f3c354da9c \ - --hash=sha256:207b8bf0fe0907336df38b733b487521cf9e138189aba9234ad54fe545dd0db8 \ - --hash=sha256:509a2f05386270cf783993c90d49ffefb3dd62aee45bf1ea8ce3d2cde7271c21 \ - --hash=sha256:ac69b65dd1af0179ede40c9f15788c88f73e628ea6c0519de3838e279bb388c6 \ - --hash=sha256:8df6fad6c6ae12fd7004ea29357f0a2b4d3774eaeca7656530d08d2d90cd41aa \ - --hash=sha256:0b8b96dd81cc1533a04f30382c0fe21c1972e189f794d0c4261a18cec08fd9b5 \ - --hash=sha256:cae8fca1883f23c50ea78d89de6fe4fefdb4cea83177760f47177559414ded93 \ - --hash=sha256:1a471ca576a9cdce1b1cd9f3a22b1d09ee44d46862037557de17919c0db44425 \ - --hash=sha256:8ec4e8e3d453b3a1b63b5f57737a434dcf1ee4a2f26f6ff7c5a37c3f679104d2 \ - --hash=sha256:8eb11c77dd8e73f48df6b2f7a7e16173fe0fe8fdfe266232832e88477e08454e +cryptography==1.3.4 \ + --hash=sha256:bede00edd11a2a62c8c98c271cc103fa3a3d72acf64f6e5e4eaf251128897b17 \ + --hash=sha256:53b39e687b744bb548a98f40736cc529d9f60959b4e6cc551322cf9505d35eb3 \ + --hash=sha256:474b73ad1139b4e423e46bbd818efd0d5c0df1c65d9f7c957d64c9215d77afde \ + --hash=sha256:aaddf9592d5b99e32dd518bb4a25b147c124f9d6b4ad64b94f01b15d1666b8c8 \ + --hash=sha256:6dcad2f407db8c3cd6ecd78361439c449a4f94786b46c54507e7e68f51e1709d \ + --hash=sha256:475c153fc622e656f1f10a9c9941d0ac7ab18df7c38d35d563a437c1c0e34f24 \ + --hash=sha256:86dd61df581cba04e89e45081efbc531faff1c9d99c77b1ce97f87216c356353 \ + --hash=sha256:75cc697e4ef5fdd0102ca749114c6370dbd11db0c9132a18834858c2566247e3 \ + --hash=sha256:ea03ad5b9df6d79fc9fc1ab23729e01e1c920d2974c5e3c634ccf45a5c378452 \ + --hash=sha256:c8872b8fe4f3416d6338ab99612f49ab314f7856cb43bffab2a32d28a6267be8 \ + --hash=sha256:468fc6e16eaec6ceaa6bc341273e6e9912d01b42b740f8cf896ace7fcd6a321d \ + --hash=sha256:d6fea3c6502735011c5d61a62aef1c1d770fc6a2def45d9e6c0d94c9651e3317 \ + --hash=sha256:3cf95f179f4bead3d5649b91860ef4cf60ad4244209190fc405908272576d961 \ + --hash=sha256:141f77e60a5b9158309b2b60288c7f81d37faa15c22a69b94c190ceefaaa6236 \ + --hash=sha256:87b7a1fe703c6424451f3372d1879dae91c7fe5e13375441a72833db76fee30e \ + --hash=sha256:f5ee3cb0cf1a6550bf483ccffa6608db267a377b45f7e3a8201a86d1d8feb19f \ + --hash=sha256:4e097286651ea318300af3251375d48b71b8228481c56cd617ddd4459a1ff261 \ + --hash=sha256:1e3d3ae3f22f22d50d340f47f25227511326f3f1396c6d2446a5b45b516c4313 \ + --hash=sha256:6a057941cb64d79834ea3cf99093fcc4787c2a5d44f686c4f297361ddc419bcd \ + --hash=sha256:68b3d5390b92559ddd3353c73ab2dfcff758f9c4ec4f5d5226ccede0e5d779f4 \ + --hash=sha256:545dc003b4b6081f9c3e452da15d819b04b696f49484aff64c0a2aedf766bef8 \ + --hash=sha256:423ff890c01be7c70dbfeaa967eeef5146f1a43a5f810ffdc07b178e48a105a9 enum34==1.1.2 \ --hash=sha256:2475d7fcddf5951e92ff546972758802de5260bf409319a9f1934e6bbc8b1dc7 \ --hash=sha256:35907defb0f992b75ab7788f65fedc1cf20ffa22688e0e6f6f12afc06b3ea501 @@ -645,28 +672,6 @@ parsedatetime==2.1 \ pbr==1.8.1 \ --hash=sha256:46c8db75ae75a056bd1cc07fa21734fe2e603d11a07833ecc1eeb74c35c72e0c \ --hash=sha256:e2127626a91e6c885db89668976db31020f0af2da728924b56480fc7ccf09649 -psutil==3.3.0 \ - --hash=sha256:584f0b29fcc5d523b433cb8918b2fc74d67e30ee0b44a95baf031528f424619f \ - --hash=sha256:28ca0b6e9d99aa8dc286e8747a4471362b69812a25291de29b6a8d70a1545a0d \ - --hash=sha256:167ad5fff52a672c4ddc1c1a0b25146d6813ebb08a9aab0a3ac45f8a5b669c3b \ - --hash=sha256:e6dea6173a988727bb223d3497349ad5cdef5c0b282eff2d83e5f9065c53f85f \ - --hash=sha256:2af5e0a4aad66049955d0734aa4e3dc8caa17a9eaf8b4c1a27a5f1ee6e40f6fc \ - --hash=sha256:d9884dc0dc2e55e2448e495778dc9899c1c8bf37aeb2f434c1bea74af93c2683 \ - --hash=sha256:e27c2fe6dfcc8738be3d2c5a022f785eb72971057e1a9e1e34fba73bce8a71a6 \ - --hash=sha256:65afd6fecc8f3aed09ee4be63583bc8eb472f06ceaa4fe24c4d1d5a1a3c0e13f \ - --hash=sha256:ba1c558fbfcdf94515c2394b1155c1dc56e2bc2a9c17d30349827c9ed8a67e46 \ - --hash=sha256:ba95ea0022dcb64d36f0c1335c0605fae35bdf3e0fea8d92f5d0f6456a35e55b \ - --hash=sha256:421b6591d16b509aaa8d8c15821d66bb94cb4a8dc4385cad5c51b85d4a096d85 \ - --hash=sha256:326b305cbdb6f94dafbfe2c26b11da88b0ab07b8a07f8188ab9d75ff0c6e841a \ - --hash=sha256:9aede5b2b6fe46b3748ea8e5214443890d1634027bef3d33b7dad16556830278 \ - --hash=sha256:73bed1db894d1aa9c3c7e611d302cdeab7ae8a0dc0eeaf76727878db1ac5cd87 \ - --hash=sha256:935b5dd6d558af512f42501a7c08f41d7aff139af1bb3959daa3abb859234d6c \ - --hash=sha256:4ca0111cf157dcc0f2f69a323c5b5478718d68d45fc9435d84be0ec0f186215b \ - --hash=sha256:b6f13c95398a3fcf0226c4dcfa448560ba5865259cd96ec2810658651e932189 \ - --hash=sha256:ee6be30d1635bbdea4c4325d507dc8a0dbbde7e1c198bd62ddb9f43198b9e214 \ - --hash=sha256:dfa786858c268d7fbbe1b6175e001ec02738d7cfae0a7ce77bf9b651af676729 \ - --hash=sha256:aa77f9de72af9c16cc288cd4a24cf58824388f57d7a81e400c4616457629870e \ - --hash=sha256:f500093357d04da8140d87932cac2e54ef592a54ca8a743abb2850f60c2c22eb pyasn1==0.1.9 \ --hash=sha256:61f9d99e3cef65feb1bfe3a2eef7a93eb93819d345bf54bcd42f4e63d5204dae \ --hash=sha256:1802a6dd32045e472a419db1441aecab469d33e0d2749e192abdec52101724af \ @@ -679,9 +684,18 @@ pyasn1==0.1.9 \ --hash=sha256:5191ff6b9126d2c039dd87f8ff025bed274baf07fa78afa46f556b1ad7265d6e \ --hash=sha256:8323e03637b2d072cc7041300bac6ec448c3c28950ab40376036788e9a1af629 \ --hash=sha256:853cacd96d1f701ddd67aa03ecc05f51890135b7262e922710112f12a2ed2a7f -pyOpenSSL==0.15.1 \ - --hash=sha256:88e45e6bb25dfed272a1ef2e728461d44b634c2cd689e989b6e56a349c5a3ae5 \ - --hash=sha256:f0a26070d6db0881de8bcc7846934b7c3c930d8f9c79d45883ee48984bc0d672 +pyopenssl==16.0.0 \ + --hash=sha256:5add70cf00273bf957ca31fdb0df9b0ae4639e081897d5f86a0ae1f104901230 \ + --hash=sha256:363d10ee43d062285facf4e465f4f5163f9f702f9134f0a5896f134cbb92d17d +pyparsing==2.1.8 \ + --hash=sha256:2f0f5ceb14eccd5aef809d6382e87df22ca1da583c79f6db01675ce7d7f49c18 \ + --hash=sha256:03a4869b9f3493807ee1f1cb405e6d576a1a2ca4d81a982677c0c1ad6177c56b \ + --hash=sha256:ab09aee814c0241ff0c503cff30018219fe1fc14501d89f406f4664a0ec9fbcd \ + --hash=sha256:6e9a7f052f8e26bcf749e4033e3115b6dc7e3c85aafcb794b9a88c9d9ef13c97 \ + --hash=sha256:9f463a6bcc4eeb6c08f1ed84439b17818e2085937c0dee0d7674ac127c67c12b \ + --hash=sha256:3626b4d81cfb300dad57f52f2f791caaf7b06c09b368c0aa7b868e53a5775424 \ + --hash=sha256:367b90cc877b46af56d4580cd0ae278062903f02b8204ab631f5a2c0f50adfd0 \ + --hash=sha256:9f1ea360086cd68681e7f4ca8f1f38df47bf81942a0d76a9673c2d23eff35b13 pyRFC3339==1.0 \ --hash=sha256:eea31835c56e2096af4363a5745a784878a61d043e247d3a6d6a0a32a9741f56 \ --hash=sha256:8dfbc6c458b8daba1c0f3620a8c78008b323a268b27b7359e92a4ae41325f535 @@ -747,15 +761,18 @@ letsencrypt==0.7.0 \ # THE LINES BELOW ARE EDITED BY THE RELEASE SCRIPT; ADD ALL DEPENDENCIES ABOVE. -acme==0.8.1 \ - --hash=sha256:ccd7883772efbf933f91713b8241455993834f3620c8fbd459d9ed5e50bbaaca \ - --hash=sha256:d3ea4acf280bf6253ad7d641cb0970f230a19805acfed809e7a8ddcf62157d9f -certbot==0.8.1 \ - --hash=sha256:89805d9f70249ae859ec4d7a99c00b4bb7083ca90cd12d4d202b76dfc284f7c5 \ - --hash=sha256:6ca8df3d310ced6687d38aac17c0fb8c1b2ec7a3bea156a254e4cc2a1c132771 -certbot-apache==0.8.1 \ - --hash=sha256:c9e3fdc15e65589c2e39eb0e6b1f61f0c0a1db3c17b00bb337f0ff636cc61cb3 \ - --hash=sha256:0faf2879884d3b7a58b071902fba37d4b8b58a50e2c3b8ac262c0a74134045ed +acme==0.9.3 \ + --hash=sha256:d18ce17a75ad24d27981dfaef0524aa905eab757b267e027162b56a8967ab8fb \ + --hash=sha256:a6eff1f955eb2e4316abd9aa2fedb6d9345e6b5b8a2d64ea0ad35e05d6124099 +certbot==0.9.3 \ + --hash=sha256:a87ef4c53c018df4e52ee2f2e906ad16bbb37789f29e6f284c495a2eb4d9b243 \ + --hash=sha256:68149cb8392b29f5d5246e7226d25f913f2b10482bf3bc7368e8c8821d25f3b0 +certbot-apache==0.9.3 \ + --hash=sha256:f379b1053e10709692654d7a6fcea9eaed19b66c49a753b61e31bd06a04b0aac \ + --hash=sha256:a5d98cf972072de08f984db4e6a7f20269f3f023c43f6d4e781fe43be7c10086 +certbot-nginx==0.9.3 \ + --hash=sha256:3c26f18f0b57550f069263bd9b2984ef33eab6693e7796611c1b2cc16574069c \ + --hash=sha256:7337a2e90e0b28a1ab09e31d9fb81c6d78e6453500c824c0f18bab5d31b63058 UNLIKELY_EOF # ------------------------------------------------------------------------- @@ -912,13 +929,19 @@ UNLIKELY_EOF # Set PATH so pipstrap upgrades the right (v)env: PATH="$VENV_BIN:$PATH" "$VENV_BIN/python" "$TEMP_DIR/pipstrap.py" set +e - PIP_OUT=`"$VENV_BIN/pip" install --no-cache-dir --require-hashes -r "$TEMP_DIR/letsencrypt-auto-requirements.txt" 2>&1` + if [ "$VERBOSE" = 1 ]; then + "$VENV_BIN/pip" install --no-cache-dir --require-hashes -r "$TEMP_DIR/letsencrypt-auto-requirements.txt" + else + PIP_OUT=`"$VENV_BIN/pip" install --no-cache-dir --require-hashes -r "$TEMP_DIR/letsencrypt-auto-requirements.txt" 2>&1` + fi PIP_STATUS=$? set -e if [ "$PIP_STATUS" != 0 ]; then # Report error. (Otherwise, be quiet.) - echo "Had a problem while installing Python packages:" - echo "$PIP_OUT" + echo "Had a problem while installing Python packages." + if [ "$VERBOSE" != 1 ]; then + echo "$PIP_OUT" + fi rm -rf "$VENV_PATH" exit 1 fi @@ -926,8 +949,10 @@ UNLIKELY_EOF fi if [ -n "$SUDO" ]; then # SUDO is su wrapper or sudo - echo "Requesting root privileges to run certbot..." - echo " $VENV_BIN/letsencrypt" "$@" + if [ "$QUIET" != 1 ]; then + echo "Requesting root privileges to run certbot..." + echo " $VENV_BIN/letsencrypt" "$@" + fi fi if [ -z "$SUDO_ENV" ] ; then # SUDO is su wrapper / noop @@ -967,7 +992,7 @@ else # Print latest released version of LE to stdout: python fetch.py --latest-version - + # Download letsencrypt-auto script from git tag v1.2.3 into the folder I'm # in, and make sure its signature verifies: python fetch.py --le-auto-script v1.2.3 diff --git a/letsencrypt-auto-source/Dockerfile.centos6 b/letsencrypt-auto-source/Dockerfile.centos6 new file mode 100644 index 000000000..e1280109b --- /dev/null +++ b/letsencrypt-auto-source/Dockerfile.centos6 @@ -0,0 +1,32 @@ +# For running tests, build a docker image with a passwordless sudo and a trust +# store we can manipulate. + +FROM centos:6 + +RUN yum install -y epel-release + +# Install pip, sudo and nose: +RUN yum install -y python-pip sudo +RUN pip install nose + +# Add an unprivileged user: +RUN useradd --create-home --home-dir /home/lea --shell /bin/bash --groups wheel --uid 1000 lea + +# Let that user sudo: +RUN sed -i.bkp -e \ + 's/# %wheel\(NOPASSWD: ALL\)\?/%wheel/g' \ + /etc/sudoers + +RUN mkdir -p /home/lea/certbot + +# Install fake testing CA: +COPY ./tests/certs/ca/my-root-ca.crt.pem /usr/local/share/ca-certificates/ +RUN update-ca-trust + +# Copy code: +COPY . /home/lea/certbot/letsencrypt-auto-source + +USER lea +WORKDIR /home/lea + +CMD ["nosetests", "-v", "-s", "certbot/letsencrypt-auto-source/tests"] diff --git a/letsencrypt-auto-source/Dockerfile.precise b/letsencrypt-auto-source/Dockerfile.precise new file mode 100644 index 000000000..c8b593774 --- /dev/null +++ b/letsencrypt-auto-source/Dockerfile.precise @@ -0,0 +1,31 @@ +# For running tests, build a docker image with a passwordless sudo and a trust +# store we can manipulate. + +FROM ubuntu:precise + +# Add an unprivileged user: +RUN useradd --create-home --home-dir /home/lea --shell /bin/bash --groups sudo --uid 1000 lea + +# Install pip, sudo, openssl, and nose: +RUN apt-get update && \ + apt-get -q -y install python-pip sudo openssl && \ + apt-get clean +RUN pip install nose + +# Let that user sudo: +RUN sed -i.bkp -e \ + 's/%sudo\s\+ALL=(ALL\(:ALL\)\?)\s\+ALL/%sudo ALL=NOPASSWD:ALL/g' \ + /etc/sudoers + +RUN mkdir -p /home/lea/certbot + +# Install fake testing CA: +COPY ./tests/certs/ca/my-root-ca.crt.pem /usr/local/share/ca-certificates/ + +# Copy code: +COPY . /home/lea/certbot/letsencrypt-auto-source + +USER lea +WORKDIR /home/lea + +CMD ["nosetests", "-v", "-s", "certbot/letsencrypt-auto-source/tests"] diff --git a/letsencrypt-auto-source/Dockerfile b/letsencrypt-auto-source/Dockerfile.trusty similarity index 100% rename from letsencrypt-auto-source/Dockerfile rename to letsencrypt-auto-source/Dockerfile.trusty diff --git a/letsencrypt-auto-source/Dockerfile.wheezy b/letsencrypt-auto-source/Dockerfile.wheezy new file mode 100644 index 000000000..f86795e08 --- /dev/null +++ b/letsencrypt-auto-source/Dockerfile.wheezy @@ -0,0 +1,31 @@ +# For running tests, build a docker image with a passwordless sudo and a trust +# store we can manipulate. + +FROM debian:wheezy + +# Add an unprivileged user: +RUN useradd --create-home --home-dir /home/lea --shell /bin/bash --groups sudo --uid 1000 lea + +# Install pip, sudo, openssl, and nose: +RUN apt-get update && \ + apt-get -q -y install python-pip sudo openssl && \ + apt-get clean +RUN pip install nose + +# Let that user sudo: +RUN sed -i.bkp -e \ + 's/%sudo\s\+ALL=(ALL\(:ALL\)\?)\s\+ALL/%sudo ALL=NOPASSWD:ALL/g' \ + /etc/sudoers + +RUN mkdir -p /home/lea/certbot + +# Install fake testing CA: +COPY ./tests/certs/ca/my-root-ca.crt.pem /usr/local/share/ca-certificates/ + +# Copy code: +COPY . /home/lea/certbot/letsencrypt-auto-source + +USER lea +WORKDIR /home/lea + +CMD ["nosetests", "-v", "-s", "certbot/letsencrypt-auto-source/tests"] diff --git a/letsencrypt-auto-source/certbot-auto.asc b/letsencrypt-auto-source/certbot-auto.asc index 5bb725c96..db40cfb84 100644 --- a/letsencrypt-auto-source/certbot-auto.asc +++ b/letsencrypt-auto-source/certbot-auto.asc @@ -1,11 +1,11 @@ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 -iQEcBAABAgAGBQJXYJmBAAoJEE0XyZXNl3XyyIMH/jtYFb7rl5XXN8hjlKuK5frq -z7/jdK7fvI+mtYJ4i2Cy3yMz8T4wscXGkhxNtipbATWlpevPfjYzm4ZGC25coFZx -fDX44w0hBBgel7EISXGR1ABXb2rj24TZxIYXwaeClylsK9n5CxcWBocn8tDlfr8t -7VQUJEL3l1IlrnKnvpoL4Eq11sxlIPtitDPJ5c98ZM1293ZbWzIqyZKoXLIUkKHg -pkaa80j/QMmFumxzXFenU91JusLdeoblvjjg+kzjGonjslAYIuH4wEEjz2VJuUYe -P2+2ZyW4eLA6rRZhZ3CMtV79HzTPTWiELCYbXezb+yXJJEqzCYtIXkmbNQ3jUEY= -=86lB +iQEcBAABAgAGBQJYADL6AAoJEE0XyZXNl3XyZW8H/RgPxga4SZ8VoMGGOpzYGzaD +C/VW6IZeHjD7urkAjfSiMMStkYKlZMGcT/3Pw1L39wIX/37jqQTTh01JL+TcqRMJ +AUHmSgrErjUU42YV68u2c/wT9Dsid+OxpP/WSbJn5MomWtvGpFxffc/FK/W8ccFR +r6ZhAt2rgkBmYjrC6w8V9KTzhp4+n7ZpQPxuMFxpJhyTmMzgj9K+aI2OuKDKT7iO +nke74Lgx/xPatLDgygw5bRiFyZ+X65p/awalEXBcFW0zmlN2Fqp8om8UjtUtkVw9 +ixr9/kq9VhcHjho9cmKWl14IShbcxZZc60xL2y6gmkgoBpzVlHfvRNnxapodTsc= +=jULW -----END PGP SIGNATURE----- diff --git a/letsencrypt-auto-source/letsencrypt-auto b/letsencrypt-auto-source/letsencrypt-auto index 27b11c656..d62a642ea 100755 --- a/letsencrypt-auto-source/letsencrypt-auto +++ b/letsencrypt-auto-source/letsencrypt-auto @@ -15,11 +15,15 @@ set -e # Work even if somebody does "sh thisscript.sh". # Note: you can set XDG_DATA_HOME or VENV_PATH before running this script, # if you want to change where the virtual environment will be installed -XDG_DATA_HOME=${XDG_DATA_HOME:-~/.local/share} +if [ -z "$XDG_DATA_HOME" ]; then + XDG_DATA_HOME="~/.local/share" +fi VENV_NAME="letsencrypt" -VENV_PATH=${VENV_PATH:-"$XDG_DATA_HOME/$VENV_NAME"} +if [ -z "$VENV_PATH" ]; then + VENV_PATH="$XDG_DATA_HOME/$VENV_NAME" +fi VENV_BIN="$VENV_PATH/bin" -LE_AUTO_VERSION="0.9.0.dev0" +LE_AUTO_VERSION="0.10.0.dev0" BASENAME=$(basename $0) USAGE="Usage: $BASENAME [OPTIONS] A self-updating wrapper script for the Certbot ACME client. When run, updates @@ -58,6 +62,7 @@ for arg in "$@" ; do --verbose) VERBOSE=1;; -[!-]*) + OPTIND=1 while getopts ":hnvq" short_arg $arg; do case "$short_arg" in h) @@ -79,43 +84,74 @@ if [ $BASENAME = "letsencrypt-auto" ]; then HELP=0 fi +# Support for busybox and others where there is no "command", +# but "which" instead +if command -v command > /dev/null 2>&1 ; then + export EXISTS="command -v" +elif which which > /dev/null 2>&1 ; then + export EXISTS="which" +else + echo "Cannot find command nor which... please install one!" + exit 1 +fi + # certbot-auto needs root access to bootstrap OS dependencies, and # certbot itself needs root access for almost all modes of operation # The "normal" case is that sudo is used for the steps that need root, but # this script *can* be run as root (not recommended), or fall back to using -# `su` +# `su`. Auto-detection can be overrided by explicitly setting the +# environment variable LE_AUTO_SUDO to 'sudo', 'sudo_su' or '' as used below. + +# Because the parameters in `su -c` has to be a string, +# we need to properly escape it. +su_sudo() { + args="" + # This `while` loop iterates over all parameters given to this function. + # For each parameter, all `'` will be replace by `'"'"'`, and the escaped string + # will be wrapped in a pair of `'`, then appended to `$args` string + # For example, `echo "It's only 1\$\!"` will be escaped to: + # 'echo' 'It'"'"'s only 1$!' + # │ │└┼┘│ + # │ │ │ └── `'s only 1$!'` the literal string + # │ │ └── `\"'\"` is a single quote (as a string) + # │ └── `'It'`, to be concatenated with the strings following it + # └── `echo` wrapped in a pair of `'`, it's totally fine for the shell command itself + while [ $# -ne 0 ]; do + args="$args'$(printf "%s" "$1" | sed -e "s/'/'\"'\"'/g")' " + shift + done + su root -c "$args" +} + SUDO_ENV="" export CERTBOT_AUTO="$0" -if test "`id -u`" -ne "0" ; then - if command -v sudo 1>/dev/null 2>&1; then - SUDO=sudo - SUDO_ENV="CERTBOT_AUTO=$0" - else - echo \"sudo\" is not available, will use \"su\" for installation steps... - # Because the parameters in `su -c` has to be a string, - # we need properly escape it - su_sudo() { - args="" - # This `while` loop iterates over all parameters given to this function. - # For each parameter, all `'` will be replace by `'"'"'`, and the escaped string - # will be wrapped in a pair of `'`, then appended to `$args` string - # For example, `echo "It's only 1\$\!"` will be escaped to: - # 'echo' 'It'"'"'s only 1$!' - # │ │└┼┘│ - # │ │ │ └── `'s only 1$!'` the literal string - # │ │ └── `\"'\"` is a single quote (as a string) - # │ └── `'It'`, to be concatenated with the strings following it - # └── `echo` wrapped in a pair of `'`, it's totally fine for the shell command itself - while [ $# -ne 0 ]; do - args="$args'$(printf "%s" "$1" | sed -e "s/'/'\"'\"'/g")' " - shift - done - su root -c "$args" - } - SUDO=su_sudo - fi +if [ -n "${LE_AUTO_SUDO+x}" ]; then + case "$LE_AUTO_SUDO" in + su_sudo|su) + SUDO=su_sudo + ;; + sudo) + SUDO=sudo + SUDO_ENV="CERTBOT_AUTO=$0" + ;; + '') ;; # Nothing to do for plain root method. + *) + echo "Error: unknown root authorization mechanism '$LE_AUTO_SUDO'." + exit 1 + esac + echo "Using preset root authorization mechanism '$LE_AUTO_SUDO'." else - SUDO= + if test "`id -u`" -ne "0" ; then + if $EXISTS sudo 1>/dev/null 2>&1; then + SUDO=sudo + SUDO_ENV="CERTBOT_AUTO=$0" + else + echo \"sudo\" is not available, will use \"su\" for installation steps... + SUDO=su_sudo + fi + else + SUDO= + fi fi ExperimentalBootstrap() { @@ -136,7 +172,7 @@ ExperimentalBootstrap() { DeterminePythonVersion() { for LE_PYTHON in "$LE_PYTHON" python2.7 python27 python2 python; do # Break (while keeping the LE_PYTHON value) if found. - command -v "$LE_PYTHON" > /dev/null && break + $EXISTS "$LE_PYTHON" > /dev/null && break done if [ "$?" != "0" ]; then echo "Cannot find any Pythons; please install one!" @@ -177,19 +213,22 @@ BootstrapDebCommon() { # distro version (#346) virtualenv= - if apt-cache show virtualenv > /dev/null 2>&1 && ! apt-cache --quiet=0 show virtualenv 2>&1 | grep -q 'No packages found'; then - virtualenv="virtualenv" + # virtual env is known to apt and is installable + if apt-cache show virtualenv > /dev/null 2>&1 ; then + if ! LC_ALL=C apt-cache --quiet=0 show virtualenv 2>&1 | grep -q 'No packages found'; then + virtualenv="virtualenv" + fi fi if apt-cache show python-virtualenv > /dev/null 2>&1; then - virtualenv="$virtualenv python-virtualenv" + virtualenv="$virtualenv python-virtualenv" fi augeas_pkg="libaugeas0 augeas-lenses" - AUGVERSION=`apt-cache show --no-all-versions libaugeas0 | grep ^Version: | cut -d" " -f2` + AUGVERSION=`LC_ALL=C apt-cache show --no-all-versions libaugeas0 | grep ^Version: | cut -d" " -f2` if [ "$ASSUME_YES" = 1 ]; then - YES_FLAG="-y" + YES_FLAG="-y" fi AddBackportRepo() { @@ -248,7 +287,6 @@ BootstrapDebCommon() { python-dev \ $virtualenv \ gcc \ - dialog \ $augeas_pkg \ libssl-dev \ libffi-dev \ @@ -256,7 +294,7 @@ BootstrapDebCommon() { - if ! command -v virtualenv > /dev/null ; then + if ! $EXISTS virtualenv > /dev/null ; then echo Failed to install a working \"virtualenv\" command, exiting exit 1 fi @@ -281,9 +319,32 @@ BootstrapRpmCommon() { exit 1 fi + if [ "$ASSUME_YES" = 1 ]; then + yes_flag="-y" + fi + + if ! $SUDO $tool list *virtualenv >/dev/null 2>&1; then + echo "To use Certbot, packages from the EPEL repository need to be installed." + if ! $SUDO $tool list epel-release >/dev/null 2>&1; then + echo "Please enable this repository and try running Certbot again." + exit 1 + fi + if [ "$ASSUME_YES" = 1 ]; then + /bin/echo -n "Enabling the EPEL repository in 3 seconds..." + sleep 1s + /bin/echo -ne "\e[0K\rEnabling the EPEL repository in 2 seconds..." + sleep 1s + /bin/echo -e "\e[0K\rEnabling the EPEL repository in 1 seconds..." + sleep 1s + fi + if ! $SUDO $tool install $yes_flag epel-release; then + echo "Could not enable EPEL. Aborting bootstrap!" + exit 1 + fi + fi + pkgs=" gcc - dialog augeas-libs openssl openssl-devel @@ -318,10 +379,6 @@ BootstrapRpmCommon() { " fi - if [ "$ASSUME_YES" = 1 ]; then - yes_flag="-y" - fi - if ! $SUDO $tool install $yes_flag $pkgs; then echo "Could not install OS dependencies. Aborting bootstrap!" exit 1 @@ -341,7 +398,6 @@ BootstrapSuseCommon() { python-devel \ python-virtualenv \ gcc \ - dialog \ augeas-lenses \ libopenssl-devel \ libffi-devel \ @@ -360,7 +416,6 @@ BootstrapArchCommon() { python2 python-virtualenv gcc - dialog augeas openssl libffi @@ -384,22 +439,26 @@ BootstrapGentooCommon() { PACKAGES=" dev-lang/python:2.7 dev-python/virtualenv - dev-util/dialog app-admin/augeas dev-libs/openssl dev-libs/libffi app-misc/ca-certificates virtual/pkgconfig" + ASK_OPTION="--ask" + if [ "$ASSUME_YES" = 1 ]; then + ASK_OPTION="" + fi + case "$PACKAGE_MANAGER" in (paludis) $SUDO cave resolve --preserve-world --keep-targets if-possible $PACKAGES -x ;; (pkgcore) - $SUDO pmerge --noreplace --oneshot $PACKAGES + $SUDO pmerge --noreplace --oneshot $ASK_OPTION $PACKAGES ;; (portage|*) - $SUDO emerge --noreplace --oneshot $PACKAGES + $SUDO emerge --noreplace --oneshot $ASK_OPTION $PACKAGES ;; esac } @@ -429,7 +488,6 @@ BootstrapMac() { fi $pkgcmd augeas - $pkgcmd dialog if [ "$(which python)" = "/System/Library/Frameworks/Python.framework/Versions/2.7/bin/python" \ -o "$(which python)" = "/usr/bin/python" ]; then # We want to avoid using the system Python because it requires root to use pip. @@ -476,7 +534,6 @@ BootstrapMageiaCommon() { if ! $SUDO urpmi --force \ git \ gcc \ - cdialog \ python-augeas \ libopenssl-devel \ libffi-devel \ @@ -570,8 +627,14 @@ if [ "$1" = "--le-auto-phase2" ]; then # ------------------------------------------------------------------------- cat << "UNLIKELY_EOF" > "$TEMP_DIR/letsencrypt-auto-requirements.txt" # This is the flattened list of packages certbot-auto installs. To generate -# this, do `pip install --no-cache-dir -e acme -e . -e certbot-apache`, and -# then use `hashin` or a more secure method to gather the hashes. +# this, do +# `pip install --no-cache-dir -e acme -e . -e certbot-apache -e certbot-nginx`, +# and then use `hashin` or a more secure method to gather the hashes. + +# Hashin example: +# pip install hashin +# hashin -r letsencrypt-auto-requirements.txt cryptography==1.5.2 +# sets the new certbot-auto pinned version of cryptography to 1.5.2 argparse==1.4.0 \ --hash=sha256:c31647edb69fd3d465a847ea3157d37bed1f95f19760b11a47aa91c04b666314 \ @@ -580,7 +643,8 @@ argparse==1.4.0 \ # This comes before cffi because cffi will otherwise install an unchecked # version via setup_requires. pycparser==2.14 \ - --hash=sha256:7959b4a74abdc27b312fed1c21e6caf9309ce0b29ea86b591fd2e99ecdf27f73 + --hash=sha256:7959b4a74abdc27b312fed1c21e6caf9309ce0b29ea86b591fd2e99ecdf27f73 \ + --no-binary pycparser cffi==1.4.2 \ --hash=sha256:53c1c9ddb30431513eb7f3cdef0a3e06b0f1252188aaa7744af0f5a4cd45dbaf \ @@ -603,29 +667,29 @@ ConfigArgParse==0.10.0 \ --hash=sha256:3b50a83dd58149dfcee98cb6565265d10b53e9c0a2bca7eeef7fb5f5524890a7 configobj==5.0.6 \ --hash=sha256:a2f5650770e1c87fb335af19a9b7eb73fc05ccf22144eb68db7d00cd2bcb0902 -cryptography==1.3.4 \ - --hash=sha256:bede00edd11a2a62c8c98c271cc103fa3a3d72acf64f6e5e4eaf251128897b17 \ - --hash=sha256:53b39e687b744bb548a98f40736cc529d9f60959b4e6cc551322cf9505d35eb3 \ - --hash=sha256:474b73ad1139b4e423e46bbd818efd0d5c0df1c65d9f7c957d64c9215d77afde \ - --hash=sha256:aaddf9592d5b99e32dd518bb4a25b147c124f9d6b4ad64b94f01b15d1666b8c8 \ - --hash=sha256:6dcad2f407db8c3cd6ecd78361439c449a4f94786b46c54507e7e68f51e1709d \ - --hash=sha256:475c153fc622e656f1f10a9c9941d0ac7ab18df7c38d35d563a437c1c0e34f24 \ - --hash=sha256:86dd61df581cba04e89e45081efbc531faff1c9d99c77b1ce97f87216c356353 \ - --hash=sha256:75cc697e4ef5fdd0102ca749114c6370dbd11db0c9132a18834858c2566247e3 \ - --hash=sha256:ea03ad5b9df6d79fc9fc1ab23729e01e1c920d2974c5e3c634ccf45a5c378452 \ - --hash=sha256:c8872b8fe4f3416d6338ab99612f49ab314f7856cb43bffab2a32d28a6267be8 \ - --hash=sha256:468fc6e16eaec6ceaa6bc341273e6e9912d01b42b740f8cf896ace7fcd6a321d \ - --hash=sha256:d6fea3c6502735011c5d61a62aef1c1d770fc6a2def45d9e6c0d94c9651e3317 \ - --hash=sha256:3cf95f179f4bead3d5649b91860ef4cf60ad4244209190fc405908272576d961 \ - --hash=sha256:141f77e60a5b9158309b2b60288c7f81d37faa15c22a69b94c190ceefaaa6236 \ - --hash=sha256:87b7a1fe703c6424451f3372d1879dae91c7fe5e13375441a72833db76fee30e \ - --hash=sha256:f5ee3cb0cf1a6550bf483ccffa6608db267a377b45f7e3a8201a86d1d8feb19f \ - --hash=sha256:4e097286651ea318300af3251375d48b71b8228481c56cd617ddd4459a1ff261 \ - --hash=sha256:1e3d3ae3f22f22d50d340f47f25227511326f3f1396c6d2446a5b45b516c4313 \ - --hash=sha256:6a057941cb64d79834ea3cf99093fcc4787c2a5d44f686c4f297361ddc419bcd \ - --hash=sha256:68b3d5390b92559ddd3353c73ab2dfcff758f9c4ec4f5d5226ccede0e5d779f4 \ - --hash=sha256:545dc003b4b6081f9c3e452da15d819b04b696f49484aff64c0a2aedf766bef8 \ - --hash=sha256:423ff890c01be7c70dbfeaa967eeef5146f1a43a5f810ffdc07b178e48a105a9 +cryptography==1.5.3 \ + --hash=sha256:e514d92086246b53ae9b048df652cf3036b462e50a6ce9fac6b6253502679991 \ + --hash=sha256:10ee414f4b5af403a0d8f20dfa80f7dad1fc7ae5452ec5af03712d5b6e78c664 \ + --hash=sha256:7234456d1f4345a144ed07af2416c7c0659d4bb599dd1a963103dc8c183b370e \ + --hash=sha256:d3b9587406f94642bd70b3d666b813f446e95f84220c9e416ad94cbfb6be2eaa \ + --hash=sha256:b15fc6b59f1474eef62207c85888afada8acc47fae8198ba2b0197d54538961a \ + --hash=sha256:3b62d65d342704fc07ed171598db2a2775bdf587b1b6abd2cba2261bfe3ccde3 \ + --hash=sha256:059343022ec904c867a13bc55d2573e36c8cfb2c250e30d8a2e9825f253b07ba \ + --hash=sha256:c7897cf13bc8b4ee0215d83cbd51766d87c06b277fcca1f9108595508e5bcfb4 \ + --hash=sha256:9b69e983e5bf83039ddd52e52a28c7faedb2b22bdfb5876377b95aac7d3be63e \ + --hash=sha256:61e40905c426d02b3fae38088dc66ce4ef84830f7eb223dec6b3ac3ccdc676fb \ + --hash=sha256:00783a32bcd91a12177230d35bfcf70a2333ade4a6b607fac94a633a7971c671 \ + --hash=sha256:d11973f49b648cde1ea1a30e496d7557dbfeccd08b3cd9ba58d286a9c274ff8e \ + --hash=sha256:f24bedf28b81932ba6063aec9a826669f5237ea3b755efe04d98b072faa053a5 \ + --hash=sha256:3ab5725367239e3deb9b92e917aa965af3fef008f25b96a3000821869e208181 \ + --hash=sha256:8a53209de822e22b5f73bf4b99e68ac4ccc91051fd6751c8252982983e86a77d \ + --hash=sha256:5a07439d4b1e4197ac202b7eea45e26a6fd65757652dc50f1a63367f711df933 \ + --hash=sha256:26b1c4b40aec7b0074bceabe6e06565aa28176eca7323a31df66ebf89fe916d3 \ + --hash=sha256:eaa4a7b5a6682adcf8d6ebb2a08a008802657643655bb527c95c8a3860253d8e \ + --hash=sha256:8156927dcf8da274ff205ad0612f75c380df45385bacf98531a5b3348c88d135 \ + --hash=sha256:61ec0d792749d0e91e84b1d58b6dfd204806b10b5811f846c2ceca0de028c53a \ + --hash=sha256:26330c88041569ca621cc42274d0ea2667a48b6deab41467272c3aba0b6e8f07 \ + --hash=sha256:cf82ddac919b587f5e44247579b433224cc2e03332d2ea4d89aa70d7e6b64ae5 enum34==1.1.2 \ --hash=sha256:2475d7fcddf5951e92ff546972758802de5260bf409319a9f1934e6bbc8b1dc7 \ --hash=sha256:35907defb0f992b75ab7788f65fedc1cf20ffa22688e0e6f6f12afc06b3ea501 @@ -641,8 +705,6 @@ ipaddress==1.0.16 \ linecache2==1.0.0 \ --hash=sha256:e78be9c0a0dfcbac712fe04fbf92b96cddae80b1b842f24248214c8496f006ef \ --hash=sha256:4b26ff4e7110db76eeb6f5a7b64a82623839d595c2038eeda662f2a2db78e97c -ndg-httpsclient==0.4.0 \ - --hash=sha256:e8c155fdebd9c4bcb0810b4ed01ae1987554b1ee034dd7532d7b8fdae38a6274 ordereddict==1.1 \ --hash=sha256:1c35b4ac206cef2d24816c89f89cf289dd3d38cf7c449bb3fab7bf6d43f01b1f parsedatetime==2.1 \ @@ -651,28 +713,6 @@ parsedatetime==2.1 \ pbr==1.8.1 \ --hash=sha256:46c8db75ae75a056bd1cc07fa21734fe2e603d11a07833ecc1eeb74c35c72e0c \ --hash=sha256:e2127626a91e6c885db89668976db31020f0af2da728924b56480fc7ccf09649 -psutil==3.3.0 \ - --hash=sha256:584f0b29fcc5d523b433cb8918b2fc74d67e30ee0b44a95baf031528f424619f \ - --hash=sha256:28ca0b6e9d99aa8dc286e8747a4471362b69812a25291de29b6a8d70a1545a0d \ - --hash=sha256:167ad5fff52a672c4ddc1c1a0b25146d6813ebb08a9aab0a3ac45f8a5b669c3b \ - --hash=sha256:e6dea6173a988727bb223d3497349ad5cdef5c0b282eff2d83e5f9065c53f85f \ - --hash=sha256:2af5e0a4aad66049955d0734aa4e3dc8caa17a9eaf8b4c1a27a5f1ee6e40f6fc \ - --hash=sha256:d9884dc0dc2e55e2448e495778dc9899c1c8bf37aeb2f434c1bea74af93c2683 \ - --hash=sha256:e27c2fe6dfcc8738be3d2c5a022f785eb72971057e1a9e1e34fba73bce8a71a6 \ - --hash=sha256:65afd6fecc8f3aed09ee4be63583bc8eb472f06ceaa4fe24c4d1d5a1a3c0e13f \ - --hash=sha256:ba1c558fbfcdf94515c2394b1155c1dc56e2bc2a9c17d30349827c9ed8a67e46 \ - --hash=sha256:ba95ea0022dcb64d36f0c1335c0605fae35bdf3e0fea8d92f5d0f6456a35e55b \ - --hash=sha256:421b6591d16b509aaa8d8c15821d66bb94cb4a8dc4385cad5c51b85d4a096d85 \ - --hash=sha256:326b305cbdb6f94dafbfe2c26b11da88b0ab07b8a07f8188ab9d75ff0c6e841a \ - --hash=sha256:9aede5b2b6fe46b3748ea8e5214443890d1634027bef3d33b7dad16556830278 \ - --hash=sha256:73bed1db894d1aa9c3c7e611d302cdeab7ae8a0dc0eeaf76727878db1ac5cd87 \ - --hash=sha256:935b5dd6d558af512f42501a7c08f41d7aff139af1bb3959daa3abb859234d6c \ - --hash=sha256:4ca0111cf157dcc0f2f69a323c5b5478718d68d45fc9435d84be0ec0f186215b \ - --hash=sha256:b6f13c95398a3fcf0226c4dcfa448560ba5865259cd96ec2810658651e932189 \ - --hash=sha256:ee6be30d1635bbdea4c4325d507dc8a0dbbde7e1c198bd62ddb9f43198b9e214 \ - --hash=sha256:dfa786858c268d7fbbe1b6175e001ec02738d7cfae0a7ce77bf9b651af676729 \ - --hash=sha256:aa77f9de72af9c16cc288cd4a24cf58824388f57d7a81e400c4616457629870e \ - --hash=sha256:f500093357d04da8140d87932cac2e54ef592a54ca8a743abb2850f60c2c22eb pyasn1==0.1.9 \ --hash=sha256:61f9d99e3cef65feb1bfe3a2eef7a93eb93819d345bf54bcd42f4e63d5204dae \ --hash=sha256:1802a6dd32045e472a419db1441aecab469d33e0d2749e192abdec52101724af \ @@ -685,17 +725,23 @@ pyasn1==0.1.9 \ --hash=sha256:5191ff6b9126d2c039dd87f8ff025bed274baf07fa78afa46f556b1ad7265d6e \ --hash=sha256:8323e03637b2d072cc7041300bac6ec448c3c28950ab40376036788e9a1af629 \ --hash=sha256:853cacd96d1f701ddd67aa03ecc05f51890135b7262e922710112f12a2ed2a7f -pyopenssl==16.0.0 \ - --hash=sha256:5add70cf00273bf957ca31fdb0df9b0ae4639e081897d5f86a0ae1f104901230 \ - --hash=sha256:363d10ee43d062285facf4e465f4f5163f9f702f9134f0a5896f134cbb92d17d +pyOpenSSL==16.2.0 \ + --hash=sha256:26ca380ddf272f7556e48064bbcd5bd71f83dfc144f3583501c7ddbd9434ee17 \ + --hash=sha256:7779a3bbb74e79db234af6a08775568c6769b5821faecf6e2f4143edb227516e +pyparsing==2.1.8 \ + --hash=sha256:2f0f5ceb14eccd5aef809d6382e87df22ca1da583c79f6db01675ce7d7f49c18 \ + --hash=sha256:03a4869b9f3493807ee1f1cb405e6d576a1a2ca4d81a982677c0c1ad6177c56b \ + --hash=sha256:ab09aee814c0241ff0c503cff30018219fe1fc14501d89f406f4664a0ec9fbcd \ + --hash=sha256:6e9a7f052f8e26bcf749e4033e3115b6dc7e3c85aafcb794b9a88c9d9ef13c97 \ + --hash=sha256:9f463a6bcc4eeb6c08f1ed84439b17818e2085937c0dee0d7674ac127c67c12b \ + --hash=sha256:3626b4d81cfb300dad57f52f2f791caaf7b06c09b368c0aa7b868e53a5775424 \ + --hash=sha256:367b90cc877b46af56d4580cd0ae278062903f02b8204ab631f5a2c0f50adfd0 \ + --hash=sha256:9f1ea360086cd68681e7f4ca8f1f38df47bf81942a0d76a9673c2d23eff35b13 pyRFC3339==1.0 \ --hash=sha256:eea31835c56e2096af4363a5745a784878a61d043e247d3a6d6a0a32a9741f56 \ --hash=sha256:8dfbc6c458b8daba1c0f3620a8c78008b323a268b27b7359e92a4ae41325f535 python-augeas==0.5.0 \ --hash=sha256:67d59d66cdba8d624e0389b87b2a83a176f21f16a87553b50f5703b23f29bac2 -python2-pythondialog==3.3.0 \ - --hash=sha256:04e93f24995c43dd90f338d5d865ca72ce3fb5a5358d4daa4965571db35fc3ec \ - --hash=sha256:3e6f593fead98f8a526bc3e306933533236e33729f552f52896ea504f55313fa pytz==2015.7 \ --hash=sha256:3abe6a6d3fc2fbbe4c60144211f45da2edbe3182a6f6511af6bbba0598b1f992 \ --hash=sha256:939ef9c1e1224d980405689a97ffcf7828c56d1517b31d73464356c1f2b7769e \ @@ -710,9 +756,9 @@ pytz==2015.7 \ --hash=sha256:fbd26746772c24cb93c8b97cbdad5cb9e46c86bbdb1b9d8a743ee00e2fb1fc5d \ --hash=sha256:99266ef30a37e43932deec2b7ca73e83c8dbc3b9ff703ec73eca6b1dae6befea \ --hash=sha256:8b6ce1c993909783bc96e0b4f34ea223bff7a4df2c90bdb9c4e0f1ac928689e3 -requests==2.9.1 \ - --hash=sha256:113fbba5531a9e34945b7d36b33a084e8ba5d0664b703c81a7c572d91919a5b8 \ - --hash=sha256:c577815dd00f1394203fc44eb979724b098f88264a9ef898ee45b8e5e9cf587f +requests==2.12.1 \ + --hash=sha256:3f3f27a9d0f9092935efc78054ef324eb9f8166718270aefe036dfa1e4f68e1e \ + --hash=sha256:2109ecea94df90980be040490ff1d879971b024861539abb00054062388b612e six==1.10.0 \ --hash=sha256:0ff78c403d9bccf5a425a6d31a12aa6b47f1c21ca4dc2573a7e2f32a97335eb1 \ --hash=sha256:105f8d68616f8248e24bf0e9372ef04d3cc10104f1980f54d57b2ce73a5ad56a @@ -753,15 +799,18 @@ letsencrypt==0.7.0 \ # THE LINES BELOW ARE EDITED BY THE RELEASE SCRIPT; ADD ALL DEPENDENCIES ABOVE. -acme==0.8.1 \ - --hash=sha256:ccd7883772efbf933f91713b8241455993834f3620c8fbd459d9ed5e50bbaaca \ - --hash=sha256:d3ea4acf280bf6253ad7d641cb0970f230a19805acfed809e7a8ddcf62157d9f -certbot==0.8.1 \ - --hash=sha256:89805d9f70249ae859ec4d7a99c00b4bb7083ca90cd12d4d202b76dfc284f7c5 \ - --hash=sha256:6ca8df3d310ced6687d38aac17c0fb8c1b2ec7a3bea156a254e4cc2a1c132771 -certbot-apache==0.8.1 \ - --hash=sha256:c9e3fdc15e65589c2e39eb0e6b1f61f0c0a1db3c17b00bb337f0ff636cc61cb3 \ - --hash=sha256:0faf2879884d3b7a58b071902fba37d4b8b58a50e2c3b8ac262c0a74134045ed +acme==0.9.3 \ + --hash=sha256:d18ce17a75ad24d27981dfaef0524aa905eab757b267e027162b56a8967ab8fb \ + --hash=sha256:a6eff1f955eb2e4316abd9aa2fedb6d9345e6b5b8a2d64ea0ad35e05d6124099 +certbot==0.9.3 \ + --hash=sha256:a87ef4c53c018df4e52ee2f2e906ad16bbb37789f29e6f284c495a2eb4d9b243 \ + --hash=sha256:68149cb8392b29f5d5246e7226d25f913f2b10482bf3bc7368e8c8821d25f3b0 +certbot-apache==0.9.3 \ + --hash=sha256:f379b1053e10709692654d7a6fcea9eaed19b66c49a753b61e31bd06a04b0aac \ + --hash=sha256:a5d98cf972072de08f984db4e6a7f20269f3f023c43f6d4e781fe43be7c10086 +certbot-nginx==0.9.3 \ + --hash=sha256:3c26f18f0b57550f069263bd9b2984ef33eab6693e7796611c1b2cc16574069c \ + --hash=sha256:7337a2e90e0b28a1ab09e31d9fb81c6d78e6453500c824c0f18bab5d31b63058 UNLIKELY_EOF # ------------------------------------------------------------------------- @@ -929,7 +978,28 @@ UNLIKELY_EOF # Report error. (Otherwise, be quiet.) echo "Had a problem while installing Python packages." if [ "$VERBOSE" != 1 ]; then + echo + echo "pip prints the following errors: " + echo "=====================================================" echo "$PIP_OUT" + echo "=====================================================" + echo + echo "Certbot has problem setting up the virtual environment." + + if `echo $PIP_OUT | grep -q Killed` || `echo $PIP_OUT | grep -q "allocate memory"` ; then + echo + echo "Based on your pip output, the problem can likely be fixed by " + echo "increasing the available memory." + else + echo + echo "We were not be able to guess the right solution from your pip " + echo "output." + fi + + echo + echo "Consult https://certbot.eff.org/docs/install.html#problems-with-python-virtual-environment" + echo "for possible solutions." + echo "You may also find some support resources at https://certbot.eff.org/support/ ." fi rm -rf "$VENV_PATH" exit 1 @@ -981,7 +1051,7 @@ else # Print latest released version of LE to stdout: python fetch.py --latest-version - + # Download letsencrypt-auto script from git tag v1.2.3 into the folder I'm # in, and make sure its signature verifies: python fetch.py --le-auto-script v1.2.3 diff --git a/letsencrypt-auto-source/letsencrypt-auto.sig b/letsencrypt-auto-source/letsencrypt-auto.sig index e3da0e0a3..f3950b7d6 100644 Binary files a/letsencrypt-auto-source/letsencrypt-auto.sig and b/letsencrypt-auto-source/letsencrypt-auto.sig differ diff --git a/letsencrypt-auto-source/letsencrypt-auto.template b/letsencrypt-auto-source/letsencrypt-auto.template index 991d9dd76..d7c497260 100755 --- a/letsencrypt-auto-source/letsencrypt-auto.template +++ b/letsencrypt-auto-source/letsencrypt-auto.template @@ -15,9 +15,13 @@ set -e # Work even if somebody does "sh thisscript.sh". # Note: you can set XDG_DATA_HOME or VENV_PATH before running this script, # if you want to change where the virtual environment will be installed -XDG_DATA_HOME=${XDG_DATA_HOME:-~/.local/share} +if [ -z "$XDG_DATA_HOME" ]; then + XDG_DATA_HOME="~/.local/share" +fi VENV_NAME="letsencrypt" -VENV_PATH=${VENV_PATH:-"$XDG_DATA_HOME/$VENV_NAME"} +if [ -z "$VENV_PATH" ]; then + VENV_PATH="$XDG_DATA_HOME/$VENV_NAME" +fi VENV_BIN="$VENV_PATH/bin" LE_AUTO_VERSION="{{ LE_AUTO_VERSION }}" BASENAME=$(basename $0) @@ -58,6 +62,7 @@ for arg in "$@" ; do --verbose) VERBOSE=1;; -[!-]*) + OPTIND=1 while getopts ":hnvq" short_arg $arg; do case "$short_arg" in h) @@ -79,43 +84,74 @@ if [ $BASENAME = "letsencrypt-auto" ]; then HELP=0 fi +# Support for busybox and others where there is no "command", +# but "which" instead +if command -v command > /dev/null 2>&1 ; then + export EXISTS="command -v" +elif which which > /dev/null 2>&1 ; then + export EXISTS="which" +else + echo "Cannot find command nor which... please install one!" + exit 1 +fi + # certbot-auto needs root access to bootstrap OS dependencies, and # certbot itself needs root access for almost all modes of operation # The "normal" case is that sudo is used for the steps that need root, but # this script *can* be run as root (not recommended), or fall back to using -# `su` +# `su`. Auto-detection can be overrided by explicitly setting the +# environment variable LE_AUTO_SUDO to 'sudo', 'sudo_su' or '' as used below. + +# Because the parameters in `su -c` has to be a string, +# we need to properly escape it. +su_sudo() { + args="" + # This `while` loop iterates over all parameters given to this function. + # For each parameter, all `'` will be replace by `'"'"'`, and the escaped string + # will be wrapped in a pair of `'`, then appended to `$args` string + # For example, `echo "It's only 1\$\!"` will be escaped to: + # 'echo' 'It'"'"'s only 1$!' + # │ │└┼┘│ + # │ │ │ └── `'s only 1$!'` the literal string + # │ │ └── `\"'\"` is a single quote (as a string) + # │ └── `'It'`, to be concatenated with the strings following it + # └── `echo` wrapped in a pair of `'`, it's totally fine for the shell command itself + while [ $# -ne 0 ]; do + args="$args'$(printf "%s" "$1" | sed -e "s/'/'\"'\"'/g")' " + shift + done + su root -c "$args" +} + SUDO_ENV="" export CERTBOT_AUTO="$0" -if test "`id -u`" -ne "0" ; then - if command -v sudo 1>/dev/null 2>&1; then - SUDO=sudo - SUDO_ENV="CERTBOT_AUTO=$0" - else - echo \"sudo\" is not available, will use \"su\" for installation steps... - # Because the parameters in `su -c` has to be a string, - # we need properly escape it - su_sudo() { - args="" - # This `while` loop iterates over all parameters given to this function. - # For each parameter, all `'` will be replace by `'"'"'`, and the escaped string - # will be wrapped in a pair of `'`, then appended to `$args` string - # For example, `echo "It's only 1\$\!"` will be escaped to: - # 'echo' 'It'"'"'s only 1$!' - # │ │└┼┘│ - # │ │ │ └── `'s only 1$!'` the literal string - # │ │ └── `\"'\"` is a single quote (as a string) - # │ └── `'It'`, to be concatenated with the strings following it - # └── `echo` wrapped in a pair of `'`, it's totally fine for the shell command itself - while [ $# -ne 0 ]; do - args="$args'$(printf "%s" "$1" | sed -e "s/'/'\"'\"'/g")' " - shift - done - su root -c "$args" - } - SUDO=su_sudo - fi +if [ -n "${LE_AUTO_SUDO+x}" ]; then + case "$LE_AUTO_SUDO" in + su_sudo|su) + SUDO=su_sudo + ;; + sudo) + SUDO=sudo + SUDO_ENV="CERTBOT_AUTO=$0" + ;; + '') ;; # Nothing to do for plain root method. + *) + echo "Error: unknown root authorization mechanism '$LE_AUTO_SUDO'." + exit 1 + esac + echo "Using preset root authorization mechanism '$LE_AUTO_SUDO'." else - SUDO= + if test "`id -u`" -ne "0" ; then + if $EXISTS sudo 1>/dev/null 2>&1; then + SUDO=sudo + SUDO_ENV="CERTBOT_AUTO=$0" + else + echo \"sudo\" is not available, will use \"su\" for installation steps... + SUDO=su_sudo + fi + else + SUDO= + fi fi ExperimentalBootstrap() { @@ -136,7 +172,7 @@ ExperimentalBootstrap() { DeterminePythonVersion() { for LE_PYTHON in "$LE_PYTHON" python2.7 python27 python2 python; do # Break (while keeping the LE_PYTHON value) if found. - command -v "$LE_PYTHON" > /dev/null && break + $EXISTS "$LE_PYTHON" > /dev/null && break done if [ "$?" != "0" ]; then echo "Cannot find any Pythons; please install one!" @@ -264,7 +300,28 @@ UNLIKELY_EOF # Report error. (Otherwise, be quiet.) echo "Had a problem while installing Python packages." if [ "$VERBOSE" != 1 ]; then + echo + echo "pip prints the following errors: " + echo "=====================================================" echo "$PIP_OUT" + echo "=====================================================" + echo + echo "Certbot has problem setting up the virtual environment." + + if `echo $PIP_OUT | grep -q Killed` || `echo $PIP_OUT | grep -q "allocate memory"` ; then + echo + echo "Based on your pip output, the problem can likely be fixed by " + echo "increasing the available memory." + else + echo + echo "We were not be able to guess the right solution from your pip " + echo "output." + fi + + echo + echo "Consult https://certbot.eff.org/docs/install.html#problems-with-python-virtual-environment" + echo "for possible solutions." + echo "You may also find some support resources at https://certbot.eff.org/support/ ." fi rm -rf "$VENV_PATH" exit 1 diff --git a/letsencrypt-auto-source/pieces/bootstrappers/arch_common.sh b/letsencrypt-auto-source/pieces/bootstrappers/arch_common.sh index 39e2da5fe..333f56ff7 100755 --- a/letsencrypt-auto-source/pieces/bootstrappers/arch_common.sh +++ b/letsencrypt-auto-source/pieces/bootstrappers/arch_common.sh @@ -10,7 +10,6 @@ BootstrapArchCommon() { python2 python-virtualenv gcc - dialog augeas openssl libffi diff --git a/letsencrypt-auto-source/pieces/bootstrappers/deb_common.sh b/letsencrypt-auto-source/pieces/bootstrappers/deb_common.sh index 8eb7e16ee..27919b67b 100644 --- a/letsencrypt-auto-source/pieces/bootstrappers/deb_common.sh +++ b/letsencrypt-auto-source/pieces/bootstrappers/deb_common.sh @@ -23,19 +23,22 @@ BootstrapDebCommon() { # distro version (#346) virtualenv= - if apt-cache show virtualenv > /dev/null 2>&1 && ! apt-cache --quiet=0 show virtualenv 2>&1 | grep -q 'No packages found'; then - virtualenv="virtualenv" + # virtual env is known to apt and is installable + if apt-cache show virtualenv > /dev/null 2>&1 ; then + if ! LC_ALL=C apt-cache --quiet=0 show virtualenv 2>&1 | grep -q 'No packages found'; then + virtualenv="virtualenv" + fi fi if apt-cache show python-virtualenv > /dev/null 2>&1; then - virtualenv="$virtualenv python-virtualenv" + virtualenv="$virtualenv python-virtualenv" fi augeas_pkg="libaugeas0 augeas-lenses" - AUGVERSION=`apt-cache show --no-all-versions libaugeas0 | grep ^Version: | cut -d" " -f2` + AUGVERSION=`LC_ALL=C apt-cache show --no-all-versions libaugeas0 | grep ^Version: | cut -d" " -f2` if [ "$ASSUME_YES" = 1 ]; then - YES_FLAG="-y" + YES_FLAG="-y" fi AddBackportRepo() { @@ -94,7 +97,6 @@ BootstrapDebCommon() { python-dev \ $virtualenv \ gcc \ - dialog \ $augeas_pkg \ libssl-dev \ libffi-dev \ @@ -102,7 +104,7 @@ BootstrapDebCommon() { - if ! command -v virtualenv > /dev/null ; then + if ! $EXISTS virtualenv > /dev/null ; then echo Failed to install a working \"virtualenv\" command, exiting exit 1 fi diff --git a/letsencrypt-auto-source/pieces/bootstrappers/gentoo_common.sh b/letsencrypt-auto-source/pieces/bootstrappers/gentoo_common.sh index 580b69a0d..86a1ec7d6 100755 --- a/letsencrypt-auto-source/pieces/bootstrappers/gentoo_common.sh +++ b/letsencrypt-auto-source/pieces/bootstrappers/gentoo_common.sh @@ -2,22 +2,26 @@ BootstrapGentooCommon() { PACKAGES=" dev-lang/python:2.7 dev-python/virtualenv - dev-util/dialog app-admin/augeas dev-libs/openssl dev-libs/libffi app-misc/ca-certificates virtual/pkgconfig" + ASK_OPTION="--ask" + if [ "$ASSUME_YES" = 1 ]; then + ASK_OPTION="" + fi + case "$PACKAGE_MANAGER" in (paludis) $SUDO cave resolve --preserve-world --keep-targets if-possible $PACKAGES -x ;; (pkgcore) - $SUDO pmerge --noreplace --oneshot $PACKAGES + $SUDO pmerge --noreplace --oneshot $ASK_OPTION $PACKAGES ;; (portage|*) - $SUDO emerge --noreplace --oneshot $PACKAGES + $SUDO emerge --noreplace --oneshot $ASK_OPTION $PACKAGES ;; esac } diff --git a/letsencrypt-auto-source/pieces/bootstrappers/mac.sh b/letsencrypt-auto-source/pieces/bootstrappers/mac.sh index 2b04977c8..a28b410d2 100755 --- a/letsencrypt-auto-source/pieces/bootstrappers/mac.sh +++ b/letsencrypt-auto-source/pieces/bootstrappers/mac.sh @@ -15,7 +15,6 @@ BootstrapMac() { fi $pkgcmd augeas - $pkgcmd dialog if [ "$(which python)" = "/System/Library/Frameworks/Python.framework/Versions/2.7/bin/python" \ -o "$(which python)" = "/usr/bin/python" ]; then # We want to avoid using the system Python because it requires root to use pip. diff --git a/letsencrypt-auto-source/pieces/bootstrappers/mageia_common.sh b/letsencrypt-auto-source/pieces/bootstrappers/mageia_common.sh index d6651574a..63649a974 100644 --- a/letsencrypt-auto-source/pieces/bootstrappers/mageia_common.sh +++ b/letsencrypt-auto-source/pieces/bootstrappers/mageia_common.sh @@ -11,7 +11,6 @@ BootstrapMageiaCommon() { if ! $SUDO urpmi --force \ git \ gcc \ - cdialog \ python-augeas \ libopenssl-devel \ libffi-devel \ diff --git a/letsencrypt-auto-source/pieces/bootstrappers/rpm_common.sh b/letsencrypt-auto-source/pieces/bootstrappers/rpm_common.sh index 0f98b4bbc..26d717ea1 100755 --- a/letsencrypt-auto-source/pieces/bootstrappers/rpm_common.sh +++ b/letsencrypt-auto-source/pieces/bootstrappers/rpm_common.sh @@ -17,9 +17,32 @@ BootstrapRpmCommon() { exit 1 fi + if [ "$ASSUME_YES" = 1 ]; then + yes_flag="-y" + fi + + if ! $SUDO $tool list *virtualenv >/dev/null 2>&1; then + echo "To use Certbot, packages from the EPEL repository need to be installed." + if ! $SUDO $tool list epel-release >/dev/null 2>&1; then + echo "Please enable this repository and try running Certbot again." + exit 1 + fi + if [ "$ASSUME_YES" = 1 ]; then + /bin/echo -n "Enabling the EPEL repository in 3 seconds..." + sleep 1s + /bin/echo -ne "\e[0K\rEnabling the EPEL repository in 2 seconds..." + sleep 1s + /bin/echo -e "\e[0K\rEnabling the EPEL repository in 1 seconds..." + sleep 1s + fi + if ! $SUDO $tool install $yes_flag epel-release; then + echo "Could not enable EPEL. Aborting bootstrap!" + exit 1 + fi + fi + pkgs=" gcc - dialog augeas-libs openssl openssl-devel @@ -54,10 +77,6 @@ BootstrapRpmCommon() { " fi - if [ "$ASSUME_YES" = 1 ]; then - yes_flag="-y" - fi - if ! $SUDO $tool install $yes_flag $pkgs; then echo "Could not install OS dependencies. Aborting bootstrap!" exit 1 diff --git a/letsencrypt-auto-source/pieces/bootstrappers/suse_common.sh b/letsencrypt-auto-source/pieces/bootstrappers/suse_common.sh index 9ac295922..bd4d9c68d 100755 --- a/letsencrypt-auto-source/pieces/bootstrappers/suse_common.sh +++ b/letsencrypt-auto-source/pieces/bootstrappers/suse_common.sh @@ -11,7 +11,6 @@ BootstrapSuseCommon() { python-devel \ python-virtualenv \ gcc \ - dialog \ augeas-lenses \ libopenssl-devel \ libffi-devel \ diff --git a/letsencrypt-auto-source/pieces/fetch.py b/letsencrypt-auto-source/pieces/fetch.py index d11f8da61..365a5a36a 100644 --- a/letsencrypt-auto-source/pieces/fetch.py +++ b/letsencrypt-auto-source/pieces/fetch.py @@ -2,7 +2,7 @@ # Print latest released version of LE to stdout: python fetch.py --latest-version - + # Download letsencrypt-auto script from git tag v1.2.3 into the folder I'm # in, and make sure its signature verifies: python fetch.py --le-auto-script v1.2.3 diff --git a/letsencrypt-auto-source/pieces/letsencrypt-auto-requirements.txt b/letsencrypt-auto-source/pieces/letsencrypt-auto-requirements.txt index 0c642a33e..5af713056 100644 --- a/letsencrypt-auto-source/pieces/letsencrypt-auto-requirements.txt +++ b/letsencrypt-auto-source/pieces/letsencrypt-auto-requirements.txt @@ -1,6 +1,12 @@ # This is the flattened list of packages certbot-auto installs. To generate -# this, do `pip install --no-cache-dir -e acme -e . -e certbot-apache`, and -# then use `hashin` or a more secure method to gather the hashes. +# this, do +# `pip install --no-cache-dir -e acme -e . -e certbot-apache -e certbot-nginx`, +# and then use `hashin` or a more secure method to gather the hashes. + +# Hashin example: +# pip install hashin +# hashin -r letsencrypt-auto-requirements.txt cryptography==1.5.2 +# sets the new certbot-auto pinned version of cryptography to 1.5.2 argparse==1.4.0 \ --hash=sha256:c31647edb69fd3d465a847ea3157d37bed1f95f19760b11a47aa91c04b666314 \ @@ -9,7 +15,8 @@ argparse==1.4.0 \ # This comes before cffi because cffi will otherwise install an unchecked # version via setup_requires. pycparser==2.14 \ - --hash=sha256:7959b4a74abdc27b312fed1c21e6caf9309ce0b29ea86b591fd2e99ecdf27f73 + --hash=sha256:7959b4a74abdc27b312fed1c21e6caf9309ce0b29ea86b591fd2e99ecdf27f73 \ + --no-binary pycparser cffi==1.4.2 \ --hash=sha256:53c1c9ddb30431513eb7f3cdef0a3e06b0f1252188aaa7744af0f5a4cd45dbaf \ @@ -32,29 +39,29 @@ ConfigArgParse==0.10.0 \ --hash=sha256:3b50a83dd58149dfcee98cb6565265d10b53e9c0a2bca7eeef7fb5f5524890a7 configobj==5.0.6 \ --hash=sha256:a2f5650770e1c87fb335af19a9b7eb73fc05ccf22144eb68db7d00cd2bcb0902 -cryptography==1.3.4 \ - --hash=sha256:bede00edd11a2a62c8c98c271cc103fa3a3d72acf64f6e5e4eaf251128897b17 \ - --hash=sha256:53b39e687b744bb548a98f40736cc529d9f60959b4e6cc551322cf9505d35eb3 \ - --hash=sha256:474b73ad1139b4e423e46bbd818efd0d5c0df1c65d9f7c957d64c9215d77afde \ - --hash=sha256:aaddf9592d5b99e32dd518bb4a25b147c124f9d6b4ad64b94f01b15d1666b8c8 \ - --hash=sha256:6dcad2f407db8c3cd6ecd78361439c449a4f94786b46c54507e7e68f51e1709d \ - --hash=sha256:475c153fc622e656f1f10a9c9941d0ac7ab18df7c38d35d563a437c1c0e34f24 \ - --hash=sha256:86dd61df581cba04e89e45081efbc531faff1c9d99c77b1ce97f87216c356353 \ - --hash=sha256:75cc697e4ef5fdd0102ca749114c6370dbd11db0c9132a18834858c2566247e3 \ - --hash=sha256:ea03ad5b9df6d79fc9fc1ab23729e01e1c920d2974c5e3c634ccf45a5c378452 \ - --hash=sha256:c8872b8fe4f3416d6338ab99612f49ab314f7856cb43bffab2a32d28a6267be8 \ - --hash=sha256:468fc6e16eaec6ceaa6bc341273e6e9912d01b42b740f8cf896ace7fcd6a321d \ - --hash=sha256:d6fea3c6502735011c5d61a62aef1c1d770fc6a2def45d9e6c0d94c9651e3317 \ - --hash=sha256:3cf95f179f4bead3d5649b91860ef4cf60ad4244209190fc405908272576d961 \ - --hash=sha256:141f77e60a5b9158309b2b60288c7f81d37faa15c22a69b94c190ceefaaa6236 \ - --hash=sha256:87b7a1fe703c6424451f3372d1879dae91c7fe5e13375441a72833db76fee30e \ - --hash=sha256:f5ee3cb0cf1a6550bf483ccffa6608db267a377b45f7e3a8201a86d1d8feb19f \ - --hash=sha256:4e097286651ea318300af3251375d48b71b8228481c56cd617ddd4459a1ff261 \ - --hash=sha256:1e3d3ae3f22f22d50d340f47f25227511326f3f1396c6d2446a5b45b516c4313 \ - --hash=sha256:6a057941cb64d79834ea3cf99093fcc4787c2a5d44f686c4f297361ddc419bcd \ - --hash=sha256:68b3d5390b92559ddd3353c73ab2dfcff758f9c4ec4f5d5226ccede0e5d779f4 \ - --hash=sha256:545dc003b4b6081f9c3e452da15d819b04b696f49484aff64c0a2aedf766bef8 \ - --hash=sha256:423ff890c01be7c70dbfeaa967eeef5146f1a43a5f810ffdc07b178e48a105a9 +cryptography==1.5.3 \ + --hash=sha256:e514d92086246b53ae9b048df652cf3036b462e50a6ce9fac6b6253502679991 \ + --hash=sha256:10ee414f4b5af403a0d8f20dfa80f7dad1fc7ae5452ec5af03712d5b6e78c664 \ + --hash=sha256:7234456d1f4345a144ed07af2416c7c0659d4bb599dd1a963103dc8c183b370e \ + --hash=sha256:d3b9587406f94642bd70b3d666b813f446e95f84220c9e416ad94cbfb6be2eaa \ + --hash=sha256:b15fc6b59f1474eef62207c85888afada8acc47fae8198ba2b0197d54538961a \ + --hash=sha256:3b62d65d342704fc07ed171598db2a2775bdf587b1b6abd2cba2261bfe3ccde3 \ + --hash=sha256:059343022ec904c867a13bc55d2573e36c8cfb2c250e30d8a2e9825f253b07ba \ + --hash=sha256:c7897cf13bc8b4ee0215d83cbd51766d87c06b277fcca1f9108595508e5bcfb4 \ + --hash=sha256:9b69e983e5bf83039ddd52e52a28c7faedb2b22bdfb5876377b95aac7d3be63e \ + --hash=sha256:61e40905c426d02b3fae38088dc66ce4ef84830f7eb223dec6b3ac3ccdc676fb \ + --hash=sha256:00783a32bcd91a12177230d35bfcf70a2333ade4a6b607fac94a633a7971c671 \ + --hash=sha256:d11973f49b648cde1ea1a30e496d7557dbfeccd08b3cd9ba58d286a9c274ff8e \ + --hash=sha256:f24bedf28b81932ba6063aec9a826669f5237ea3b755efe04d98b072faa053a5 \ + --hash=sha256:3ab5725367239e3deb9b92e917aa965af3fef008f25b96a3000821869e208181 \ + --hash=sha256:8a53209de822e22b5f73bf4b99e68ac4ccc91051fd6751c8252982983e86a77d \ + --hash=sha256:5a07439d4b1e4197ac202b7eea45e26a6fd65757652dc50f1a63367f711df933 \ + --hash=sha256:26b1c4b40aec7b0074bceabe6e06565aa28176eca7323a31df66ebf89fe916d3 \ + --hash=sha256:eaa4a7b5a6682adcf8d6ebb2a08a008802657643655bb527c95c8a3860253d8e \ + --hash=sha256:8156927dcf8da274ff205ad0612f75c380df45385bacf98531a5b3348c88d135 \ + --hash=sha256:61ec0d792749d0e91e84b1d58b6dfd204806b10b5811f846c2ceca0de028c53a \ + --hash=sha256:26330c88041569ca621cc42274d0ea2667a48b6deab41467272c3aba0b6e8f07 \ + --hash=sha256:cf82ddac919b587f5e44247579b433224cc2e03332d2ea4d89aa70d7e6b64ae5 enum34==1.1.2 \ --hash=sha256:2475d7fcddf5951e92ff546972758802de5260bf409319a9f1934e6bbc8b1dc7 \ --hash=sha256:35907defb0f992b75ab7788f65fedc1cf20ffa22688e0e6f6f12afc06b3ea501 @@ -70,8 +77,6 @@ ipaddress==1.0.16 \ linecache2==1.0.0 \ --hash=sha256:e78be9c0a0dfcbac712fe04fbf92b96cddae80b1b842f24248214c8496f006ef \ --hash=sha256:4b26ff4e7110db76eeb6f5a7b64a82623839d595c2038eeda662f2a2db78e97c -ndg-httpsclient==0.4.0 \ - --hash=sha256:e8c155fdebd9c4bcb0810b4ed01ae1987554b1ee034dd7532d7b8fdae38a6274 ordereddict==1.1 \ --hash=sha256:1c35b4ac206cef2d24816c89f89cf289dd3d38cf7c449bb3fab7bf6d43f01b1f parsedatetime==2.1 \ @@ -80,28 +85,6 @@ parsedatetime==2.1 \ pbr==1.8.1 \ --hash=sha256:46c8db75ae75a056bd1cc07fa21734fe2e603d11a07833ecc1eeb74c35c72e0c \ --hash=sha256:e2127626a91e6c885db89668976db31020f0af2da728924b56480fc7ccf09649 -psutil==3.3.0 \ - --hash=sha256:584f0b29fcc5d523b433cb8918b2fc74d67e30ee0b44a95baf031528f424619f \ - --hash=sha256:28ca0b6e9d99aa8dc286e8747a4471362b69812a25291de29b6a8d70a1545a0d \ - --hash=sha256:167ad5fff52a672c4ddc1c1a0b25146d6813ebb08a9aab0a3ac45f8a5b669c3b \ - --hash=sha256:e6dea6173a988727bb223d3497349ad5cdef5c0b282eff2d83e5f9065c53f85f \ - --hash=sha256:2af5e0a4aad66049955d0734aa4e3dc8caa17a9eaf8b4c1a27a5f1ee6e40f6fc \ - --hash=sha256:d9884dc0dc2e55e2448e495778dc9899c1c8bf37aeb2f434c1bea74af93c2683 \ - --hash=sha256:e27c2fe6dfcc8738be3d2c5a022f785eb72971057e1a9e1e34fba73bce8a71a6 \ - --hash=sha256:65afd6fecc8f3aed09ee4be63583bc8eb472f06ceaa4fe24c4d1d5a1a3c0e13f \ - --hash=sha256:ba1c558fbfcdf94515c2394b1155c1dc56e2bc2a9c17d30349827c9ed8a67e46 \ - --hash=sha256:ba95ea0022dcb64d36f0c1335c0605fae35bdf3e0fea8d92f5d0f6456a35e55b \ - --hash=sha256:421b6591d16b509aaa8d8c15821d66bb94cb4a8dc4385cad5c51b85d4a096d85 \ - --hash=sha256:326b305cbdb6f94dafbfe2c26b11da88b0ab07b8a07f8188ab9d75ff0c6e841a \ - --hash=sha256:9aede5b2b6fe46b3748ea8e5214443890d1634027bef3d33b7dad16556830278 \ - --hash=sha256:73bed1db894d1aa9c3c7e611d302cdeab7ae8a0dc0eeaf76727878db1ac5cd87 \ - --hash=sha256:935b5dd6d558af512f42501a7c08f41d7aff139af1bb3959daa3abb859234d6c \ - --hash=sha256:4ca0111cf157dcc0f2f69a323c5b5478718d68d45fc9435d84be0ec0f186215b \ - --hash=sha256:b6f13c95398a3fcf0226c4dcfa448560ba5865259cd96ec2810658651e932189 \ - --hash=sha256:ee6be30d1635bbdea4c4325d507dc8a0dbbde7e1c198bd62ddb9f43198b9e214 \ - --hash=sha256:dfa786858c268d7fbbe1b6175e001ec02738d7cfae0a7ce77bf9b651af676729 \ - --hash=sha256:aa77f9de72af9c16cc288cd4a24cf58824388f57d7a81e400c4616457629870e \ - --hash=sha256:f500093357d04da8140d87932cac2e54ef592a54ca8a743abb2850f60c2c22eb pyasn1==0.1.9 \ --hash=sha256:61f9d99e3cef65feb1bfe3a2eef7a93eb93819d345bf54bcd42f4e63d5204dae \ --hash=sha256:1802a6dd32045e472a419db1441aecab469d33e0d2749e192abdec52101724af \ @@ -114,17 +97,23 @@ pyasn1==0.1.9 \ --hash=sha256:5191ff6b9126d2c039dd87f8ff025bed274baf07fa78afa46f556b1ad7265d6e \ --hash=sha256:8323e03637b2d072cc7041300bac6ec448c3c28950ab40376036788e9a1af629 \ --hash=sha256:853cacd96d1f701ddd67aa03ecc05f51890135b7262e922710112f12a2ed2a7f -pyopenssl==16.0.0 \ - --hash=sha256:5add70cf00273bf957ca31fdb0df9b0ae4639e081897d5f86a0ae1f104901230 \ - --hash=sha256:363d10ee43d062285facf4e465f4f5163f9f702f9134f0a5896f134cbb92d17d +pyOpenSSL==16.2.0 \ + --hash=sha256:26ca380ddf272f7556e48064bbcd5bd71f83dfc144f3583501c7ddbd9434ee17 \ + --hash=sha256:7779a3bbb74e79db234af6a08775568c6769b5821faecf6e2f4143edb227516e +pyparsing==2.1.8 \ + --hash=sha256:2f0f5ceb14eccd5aef809d6382e87df22ca1da583c79f6db01675ce7d7f49c18 \ + --hash=sha256:03a4869b9f3493807ee1f1cb405e6d576a1a2ca4d81a982677c0c1ad6177c56b \ + --hash=sha256:ab09aee814c0241ff0c503cff30018219fe1fc14501d89f406f4664a0ec9fbcd \ + --hash=sha256:6e9a7f052f8e26bcf749e4033e3115b6dc7e3c85aafcb794b9a88c9d9ef13c97 \ + --hash=sha256:9f463a6bcc4eeb6c08f1ed84439b17818e2085937c0dee0d7674ac127c67c12b \ + --hash=sha256:3626b4d81cfb300dad57f52f2f791caaf7b06c09b368c0aa7b868e53a5775424 \ + --hash=sha256:367b90cc877b46af56d4580cd0ae278062903f02b8204ab631f5a2c0f50adfd0 \ + --hash=sha256:9f1ea360086cd68681e7f4ca8f1f38df47bf81942a0d76a9673c2d23eff35b13 pyRFC3339==1.0 \ --hash=sha256:eea31835c56e2096af4363a5745a784878a61d043e247d3a6d6a0a32a9741f56 \ --hash=sha256:8dfbc6c458b8daba1c0f3620a8c78008b323a268b27b7359e92a4ae41325f535 python-augeas==0.5.0 \ --hash=sha256:67d59d66cdba8d624e0389b87b2a83a176f21f16a87553b50f5703b23f29bac2 -python2-pythondialog==3.3.0 \ - --hash=sha256:04e93f24995c43dd90f338d5d865ca72ce3fb5a5358d4daa4965571db35fc3ec \ - --hash=sha256:3e6f593fead98f8a526bc3e306933533236e33729f552f52896ea504f55313fa pytz==2015.7 \ --hash=sha256:3abe6a6d3fc2fbbe4c60144211f45da2edbe3182a6f6511af6bbba0598b1f992 \ --hash=sha256:939ef9c1e1224d980405689a97ffcf7828c56d1517b31d73464356c1f2b7769e \ @@ -139,9 +128,9 @@ pytz==2015.7 \ --hash=sha256:fbd26746772c24cb93c8b97cbdad5cb9e46c86bbdb1b9d8a743ee00e2fb1fc5d \ --hash=sha256:99266ef30a37e43932deec2b7ca73e83c8dbc3b9ff703ec73eca6b1dae6befea \ --hash=sha256:8b6ce1c993909783bc96e0b4f34ea223bff7a4df2c90bdb9c4e0f1ac928689e3 -requests==2.9.1 \ - --hash=sha256:113fbba5531a9e34945b7d36b33a084e8ba5d0664b703c81a7c572d91919a5b8 \ - --hash=sha256:c577815dd00f1394203fc44eb979724b098f88264a9ef898ee45b8e5e9cf587f +requests==2.12.1 \ + --hash=sha256:3f3f27a9d0f9092935efc78054ef324eb9f8166718270aefe036dfa1e4f68e1e \ + --hash=sha256:2109ecea94df90980be040490ff1d879971b024861539abb00054062388b612e six==1.10.0 \ --hash=sha256:0ff78c403d9bccf5a425a6d31a12aa6b47f1c21ca4dc2573a7e2f32a97335eb1 \ --hash=sha256:105f8d68616f8248e24bf0e9372ef04d3cc10104f1980f54d57b2ce73a5ad56a @@ -182,12 +171,15 @@ letsencrypt==0.7.0 \ # THE LINES BELOW ARE EDITED BY THE RELEASE SCRIPT; ADD ALL DEPENDENCIES ABOVE. -acme==0.8.1 \ - --hash=sha256:ccd7883772efbf933f91713b8241455993834f3620c8fbd459d9ed5e50bbaaca \ - --hash=sha256:d3ea4acf280bf6253ad7d641cb0970f230a19805acfed809e7a8ddcf62157d9f -certbot==0.8.1 \ - --hash=sha256:89805d9f70249ae859ec4d7a99c00b4bb7083ca90cd12d4d202b76dfc284f7c5 \ - --hash=sha256:6ca8df3d310ced6687d38aac17c0fb8c1b2ec7a3bea156a254e4cc2a1c132771 -certbot-apache==0.8.1 \ - --hash=sha256:c9e3fdc15e65589c2e39eb0e6b1f61f0c0a1db3c17b00bb337f0ff636cc61cb3 \ - --hash=sha256:0faf2879884d3b7a58b071902fba37d4b8b58a50e2c3b8ac262c0a74134045ed +acme==0.9.3 \ + --hash=sha256:d18ce17a75ad24d27981dfaef0524aa905eab757b267e027162b56a8967ab8fb \ + --hash=sha256:a6eff1f955eb2e4316abd9aa2fedb6d9345e6b5b8a2d64ea0ad35e05d6124099 +certbot==0.9.3 \ + --hash=sha256:a87ef4c53c018df4e52ee2f2e906ad16bbb37789f29e6f284c495a2eb4d9b243 \ + --hash=sha256:68149cb8392b29f5d5246e7226d25f913f2b10482bf3bc7368e8c8821d25f3b0 +certbot-apache==0.9.3 \ + --hash=sha256:f379b1053e10709692654d7a6fcea9eaed19b66c49a753b61e31bd06a04b0aac \ + --hash=sha256:a5d98cf972072de08f984db4e6a7f20269f3f023c43f6d4e781fe43be7c10086 +certbot-nginx==0.9.3 \ + --hash=sha256:3c26f18f0b57550f069263bd9b2984ef33eab6693e7796611c1b2cc16574069c \ + --hash=sha256:7337a2e90e0b28a1ab09e31d9fb81c6d78e6453500c824c0f18bab5d31b63058 diff --git a/letsencrypt-auto-source/tests/auto_test.py b/letsencrypt-auto-source/tests/auto_test.py index 56023bc6f..6f21c28d5 100644 --- a/letsencrypt-auto-source/tests/auto_test.py +++ b/letsencrypt-auto-source/tests/auto_test.py @@ -279,8 +279,8 @@ class AutoTests(TestCase): ok_(re.match(r'letsencrypt \d+\.\d+\.\d+', err.strip().splitlines()[-1])) # Make a few assertions to test the validity of the next tests: - self.assertIn('Upgrading certbot-auto ', out) - self.assertIn('Creating virtual environment...', out) + self.assertTrue('Upgrading certbot-auto ' in out) + self.assertTrue('Creating virtual environment...' in out) # Now we have le-auto 99.9.9 and LE 99.9.9 installed. This # conveniently sets us up to test the next 2 cases. @@ -288,15 +288,15 @@ class AutoTests(TestCase): # Test when neither phase-1 upgrade nor phase-2 upgrade is # needed (probably a common case): out, err = run_letsencrypt_auto() - self.assertNotIn('Upgrading certbot-auto ', out) - self.assertNotIn('Creating virtual environment...', out) + self.assertFalse('Upgrading certbot-auto ' in out) + self.assertFalse('Creating virtual environment...' in out) # Test when a phase-1 upgrade is not needed but a phase-2 # upgrade is: set_le_script_version(venv_dir, '0.0.1') out, err = run_letsencrypt_auto() - self.assertNotIn('Upgrading certbot-auto ', out) - self.assertIn('Creating virtual environment...', out) + self.assertFalse('Upgrading certbot-auto ' in out) + self.assertTrue('Creating virtual environment...' in out) def test_openssl_failure(self): """Make sure we stop if the openssl signature check fails.""" @@ -313,9 +313,8 @@ class AutoTests(TestCase): out, err = run_le_auto(venv_dir, base_url) except CalledProcessError as exc: eq_(exc.returncode, 1) - self.assertIn("Couldn't verify signature of downloaded " - "certbot-auto.", - exc.output) + self.assertTrue("Couldn't verify signature of downloaded " + "certbot-auto." in exc.output) else: self.fail('Signature check on certbot-auto erroneously passed.') @@ -335,9 +334,8 @@ class AutoTests(TestCase): out, err = run_le_auto(venv_dir, base_url) except CalledProcessError as exc: eq_(exc.returncode, 1) - self.assertIn("THESE PACKAGES DO NOT MATCH THE HASHES " - "FROM THE REQUIREMENTS FILE", - exc.output) + self.assertTrue("THESE PACKAGES DO NOT MATCH THE HASHES " + "FROM THE REQUIREMENTS FILE" in exc.output) ok_(not exists(join(venv_dir, 'letsencrypt')), msg="The virtualenv was left around, even though " "installation didn't succeed. We shouldn't do " diff --git a/letsencrypt-nginx/LICENSE.txt b/letsencrypt-nginx/LICENSE.txt deleted file mode 100644 index 02a1459be..000000000 --- a/letsencrypt-nginx/LICENSE.txt +++ /dev/null @@ -1,216 +0,0 @@ - Copyright 2015 Electronic Frontier Foundation and others - - Licensed under the Apache License, Version 2.0 (the "License"); - you may not use this file except in compliance with the License. - You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - - Unless required by applicable law or agreed to in writing, software - distributed under the License is distributed on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - See the License for the specific language governing permissions and - limitations under the License. - - Incorporating code from nginxparser - Copyright 2014 Fatih Erikli - Licensed MIT - - -Text of Apache License -====================== - Apache License - Version 2.0, January 2004 - http://www.apache.org/licenses/ - - TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION - - 1. Definitions. - - "License" shall mean the terms and conditions for use, reproduction, - and distribution as defined by Sections 1 through 9 of this document. - - "Licensor" shall mean the copyright owner or entity authorized by - the copyright owner that is granting the License. - - "Legal Entity" shall mean the union of the acting entity and all - other entities that control, are controlled by, or are under common - control with that entity. For the purposes of this definition, - "control" means (i) the power, direct or indirect, to cause the - direction or management of such entity, whether by contract or - otherwise, or (ii) ownership of fifty percent (50%) or more of the - outstanding shares, or (iii) beneficial ownership of such entity. - - "You" (or "Your") shall mean an individual or Legal Entity - exercising permissions granted by this License. - - "Source" form shall mean the preferred form for making modifications, - including but not limited to software source code, documentation - source, and configuration files. - - "Object" form shall mean any form resulting from mechanical - transformation or translation of a Source form, including but - not limited to compiled object code, generated documentation, - and conversions to other media types. - - "Work" shall mean the work of authorship, whether in Source or - Object form, made available under the License, as indicated by a - copyright notice that is included in or attached to the work - (an example is provided in the Appendix below). - - "Derivative Works" shall mean any work, whether in Source or Object - form, that is based on (or derived from) the Work and for which the - editorial revisions, annotations, elaborations, or other modifications - represent, as a whole, an original work of authorship. For the purposes - of this License, Derivative Works shall not include works that remain - separable from, or merely link (or bind by name) to the interfaces of, - the Work and Derivative Works thereof. - - "Contribution" shall mean any work of authorship, including - the original version of the Work and any modifications or additions - to that Work or Derivative Works thereof, that is intentionally - submitted to Licensor for inclusion in the Work by the copyright owner - or by an individual or Legal Entity authorized to submit on behalf of - the copyright owner. For the purposes of this definition, "submitted" - means any form of electronic, verbal, or written communication sent - to the Licensor or its representatives, including but not limited to - communication on electronic mailing lists, source code control systems, - and issue tracking systems that are managed by, or on behalf of, the - Licensor for the purpose of discussing and improving the Work, but - excluding communication that is conspicuously marked or otherwise - designated in writing by the copyright owner as "Not a Contribution." - - "Contributor" shall mean Licensor and any individual or Legal Entity - on behalf of whom a Contribution has been received by Licensor and - subsequently incorporated within the Work. - - 2. Grant of Copyright License. Subject to the terms and conditions of - this License, each Contributor hereby grants to You a perpetual, - worldwide, non-exclusive, no-charge, royalty-free, irrevocable - copyright license to reproduce, prepare Derivative Works of, - publicly display, publicly perform, sublicense, and distribute the - Work and such Derivative Works in Source or Object form. - - 3. Grant of Patent License. Subject to the terms and conditions of - this License, each Contributor hereby grants to You a perpetual, - worldwide, non-exclusive, no-charge, royalty-free, irrevocable - (except as stated in this section) patent license to make, have made, - use, offer to sell, sell, import, and otherwise transfer the Work, - where such license applies only to those patent claims licensable - by such Contributor that are necessarily infringed by their - Contribution(s) alone or by combination of their Contribution(s) - with the Work to which such Contribution(s) was submitted. If You - institute patent litigation against any entity (including a - cross-claim or counterclaim in a lawsuit) alleging that the Work - or a Contribution incorporated within the Work constitutes direct - or contributory patent infringement, then any patent licenses - granted to You under this License for that Work shall terminate - as of the date such litigation is filed. - - 4. Redistribution. You may reproduce and distribute copies of the - Work or Derivative Works thereof in any medium, with or without - modifications, and in Source or Object form, provided that You - meet the following conditions: - - (a) You must give any other recipients of the Work or - Derivative Works a copy of this License; and - - (b) You must cause any modified files to carry prominent notices - stating that You changed the files; and - - (c) You must retain, in the Source form of any Derivative Works - that You distribute, all copyright, patent, trademark, and - attribution notices from the Source form of the Work, - excluding those notices that do not pertain to any part of - the Derivative Works; and - - (d) If the Work includes a "NOTICE" text file as part of its - distribution, then any Derivative Works that You distribute must - include a readable copy of the attribution notices contained - within such NOTICE file, excluding those notices that do not - pertain to any part of the Derivative Works, in at least one - of the following places: within a NOTICE text file distributed - as part of the Derivative Works; within the Source form or - documentation, if provided along with the Derivative Works; or, - within a display generated by the Derivative Works, if and - wherever such third-party notices normally appear. The contents - of the NOTICE file are for informational purposes only and - do not modify the License. You may add Your own attribution - notices within Derivative Works that You distribute, alongside - or as an addendum to the NOTICE text from the Work, provided - that such additional attribution notices cannot be construed - as modifying the License. - - You may add Your own copyright statement to Your modifications and - may provide additional or different license terms and conditions - for use, reproduction, or distribution of Your modifications, or - for any such Derivative Works as a whole, provided Your use, - reproduction, and distribution of the Work otherwise complies with - the conditions stated in this License. - - 5. Submission of Contributions. Unless You explicitly state otherwise, - any Contribution intentionally submitted for inclusion in the Work - by You to the Licensor shall be under the terms and conditions of - this License, without any additional terms or conditions. - Notwithstanding the above, nothing herein shall supersede or modify - the terms of any separate license agreement you may have executed - with Licensor regarding such Contributions. - - 6. Trademarks. This License does not grant permission to use the trade - names, trademarks, service marks, or product names of the Licensor, - except as required for reasonable and customary use in describing the - origin of the Work and reproducing the content of the NOTICE file. - - 7. Disclaimer of Warranty. Unless required by applicable law or - agreed to in writing, Licensor provides the Work (and each - Contributor provides its Contributions) on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or - implied, including, without limitation, any warranties or conditions - of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A - PARTICULAR PURPOSE. You are solely responsible for determining the - appropriateness of using or redistributing the Work and assume any - risks associated with Your exercise of permissions under this License. - - 8. Limitation of Liability. In no event and under no legal theory, - whether in tort (including negligence), contract, or otherwise, - unless required by applicable law (such as deliberate and grossly - negligent acts) or agreed to in writing, shall any Contributor be - liable to You for damages, including any direct, indirect, special, - incidental, or consequential damages of any character arising as a - result of this License or out of the use or inability to use the - Work (including but not limited to damages for loss of goodwill, - work stoppage, computer failure or malfunction, or any and all - other commercial damages or losses), even if such Contributor - has been advised of the possibility of such damages. - - 9. Accepting Warranty or Additional Liability. While redistributing - the Work or Derivative Works thereof, You may choose to offer, - and charge a fee for, acceptance of support, warranty, indemnity, - or other liability obligations and/or rights consistent with this - License. However, in accepting such obligations, You may act only - on Your own behalf and on Your sole responsibility, not on behalf - of any other Contributor, and only if You agree to indemnify, - defend, and hold each Contributor harmless for any liability - incurred by, or claims asserted against, such Contributor by reason - of your accepting any such warranty or additional liability. - - END OF TERMS AND CONDITIONS - -Text of MIT License -=================== -Permission is hereby granted, free of charge, to any person obtaining a copy of -this software and associated documentation files (the "Software"), to deal in -the Software without restriction, including without limitation the rights to -use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of -the Software, and to permit persons to whom the Software is furnished to do so, -subject to the following conditions: - -The above copyright notice and this permission notice shall be included in all -copies or substantial portions of the Software. - -THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR -IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS -FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR -COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER -IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN -CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. diff --git a/letsencrypt-nginx/MANIFEST.in b/letsencrypt-nginx/MANIFEST.in deleted file mode 100644 index 97e2ad3df..000000000 --- a/letsencrypt-nginx/MANIFEST.in +++ /dev/null @@ -1,2 +0,0 @@ -include LICENSE.txt -include README.rst diff --git a/letsencrypt-nginx/README.rst b/letsencrypt-nginx/README.rst deleted file mode 100644 index cd1f32fb8..000000000 --- a/letsencrypt-nginx/README.rst +++ /dev/null @@ -1,2 +0,0 @@ -This package is a simple shim for backwards compatibility around -``certbot-nginx``, the Nginx plugin for ``certbot``. diff --git a/letsencrypt-nginx/letsencrypt_nginx/__init__.py b/letsencrypt-nginx/letsencrypt_nginx/__init__.py deleted file mode 100644 index aa14fe963..000000000 --- a/letsencrypt-nginx/letsencrypt_nginx/__init__.py +++ /dev/null @@ -1,8 +0,0 @@ -"""Let's Encrypt Nginx plugin.""" -import sys - - -import certbot_nginx - - -sys.modules['letsencrypt_nginx'] = certbot_nginx diff --git a/letsencrypt-nginx/setup.py b/letsencrypt-nginx/setup.py deleted file mode 100644 index 25db12a47..000000000 --- a/letsencrypt-nginx/setup.py +++ /dev/null @@ -1,59 +0,0 @@ -import codecs -import os -import sys - -from setuptools import setup -from setuptools import find_packages - - -def read_file(filename, encoding='utf8'): - """Read unicode from given file.""" - with codecs.open(filename, encoding=encoding) as fd: - return fd.read() - - -here = os.path.abspath(os.path.dirname(__file__)) -readme = read_file(os.path.join(here, 'README.rst')) - - -version = '0.8.0.dev0' - - -# This package is a simple shim around certbot-nginx -install_requires = [ - 'certbot-nginx', - 'letsencrypt=={0}'.format(version), -] - - -setup( - name='letsencrypt-nginx', - version=version, - description="Nginx plugin for Let's Encrypt", - long_description=readme, - url='https://github.com/letsencrypt/letsencrypt', - author="Certbot Project", - author_email='client-dev@letsencrypt.org', - license='Apache License 2.0', - classifiers=[ - 'Development Status :: 3 - Alpha', - 'Environment :: Plugins', - 'Intended Audience :: System Administrators', - 'License :: OSI Approved :: Apache Software License', - 'Operating System :: POSIX :: Linux', - 'Programming Language :: Python', - 'Programming Language :: Python :: 2', - 'Programming Language :: Python :: 2.6', - 'Programming Language :: Python :: 2.7', - 'Topic :: Internet :: WWW/HTTP', - 'Topic :: Security', - 'Topic :: System :: Installation/Setup', - 'Topic :: System :: Networking', - 'Topic :: System :: Systems Administration', - 'Topic :: Utilities', - ], - - packages=find_packages(), - include_package_data=True, - install_requires=install_requires, -) diff --git a/letsencrypt/LICENSE.txt b/letsencrypt/LICENSE.txt deleted file mode 100644 index 82d868261..000000000 --- a/letsencrypt/LICENSE.txt +++ /dev/null @@ -1,205 +0,0 @@ -Let's Encrypt ACME Client -Copyright (c) Electronic Frontier Foundation and others -Licensed Apache Version 2.0 - -The nginx plugin incorporates code from nginxparser -Copyright (c) 2014 Fatih Erikli -Licensed MIT - - -Text of Apache License -====================== - Apache License - Version 2.0, January 2004 - http://www.apache.org/licenses/ - - TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION - - 1. Definitions. - - "License" shall mean the terms and conditions for use, reproduction, - and distribution as defined by Sections 1 through 9 of this document. - - "Licensor" shall mean the copyright owner or entity authorized by - the copyright owner that is granting the License. - - "Legal Entity" shall mean the union of the acting entity and all - other entities that control, are controlled by, or are under common - control with that entity. For the purposes of this definition, - "control" means (i) the power, direct or indirect, to cause the - direction or management of such entity, whether by contract or - otherwise, or (ii) ownership of fifty percent (50%) or more of the - outstanding shares, or (iii) beneficial ownership of such entity. - - "You" (or "Your") shall mean an individual or Legal Entity - exercising permissions granted by this License. - - "Source" form shall mean the preferred form for making modifications, - including but not limited to software source code, documentation - source, and configuration files. - - "Object" form shall mean any form resulting from mechanical - transformation or translation of a Source form, including but - not limited to compiled object code, generated documentation, - and conversions to other media types. - - "Work" shall mean the work of authorship, whether in Source or - Object form, made available under the License, as indicated by a - copyright notice that is included in or attached to the work - (an example is provided in the Appendix below). - - "Derivative Works" shall mean any work, whether in Source or Object - form, that is based on (or derived from) the Work and for which the - editorial revisions, annotations, elaborations, or other modifications - represent, as a whole, an original work of authorship. For the purposes - of this License, Derivative Works shall not include works that remain - separable from, or merely link (or bind by name) to the interfaces of, - the Work and Derivative Works thereof. - - "Contribution" shall mean any work of authorship, including - the original version of the Work and any modifications or additions - to that Work or Derivative Works thereof, that is intentionally - submitted to Licensor for inclusion in the Work by the copyright owner - or by an individual or Legal Entity authorized to submit on behalf of - the copyright owner. For the purposes of this definition, "submitted" - means any form of electronic, verbal, or written communication sent - to the Licensor or its representatives, including but not limited to - communication on electronic mailing lists, source code control systems, - and issue tracking systems that are managed by, or on behalf of, the - Licensor for the purpose of discussing and improving the Work, but - excluding communication that is conspicuously marked or otherwise - designated in writing by the copyright owner as "Not a Contribution." - - "Contributor" shall mean Licensor and any individual or Legal Entity - on behalf of whom a Contribution has been received by Licensor and - subsequently incorporated within the Work. - - 2. Grant of Copyright License. Subject to the terms and conditions of - this License, each Contributor hereby grants to You a perpetual, - worldwide, non-exclusive, no-charge, royalty-free, irrevocable - copyright license to reproduce, prepare Derivative Works of, - publicly display, publicly perform, sublicense, and distribute the - Work and such Derivative Works in Source or Object form. - - 3. Grant of Patent License. Subject to the terms and conditions of - this License, each Contributor hereby grants to You a perpetual, - worldwide, non-exclusive, no-charge, royalty-free, irrevocable - (except as stated in this section) patent license to make, have made, - use, offer to sell, sell, import, and otherwise transfer the Work, - where such license applies only to those patent claims licensable - by such Contributor that are necessarily infringed by their - Contribution(s) alone or by combination of their Contribution(s) - with the Work to which such Contribution(s) was submitted. If You - institute patent litigation against any entity (including a - cross-claim or counterclaim in a lawsuit) alleging that the Work - or a Contribution incorporated within the Work constitutes direct - or contributory patent infringement, then any patent licenses - granted to You under this License for that Work shall terminate - as of the date such litigation is filed. - - 4. Redistribution. You may reproduce and distribute copies of the - Work or Derivative Works thereof in any medium, with or without - modifications, and in Source or Object form, provided that You - meet the following conditions: - - (a) You must give any other recipients of the Work or - Derivative Works a copy of this License; and - - (b) You must cause any modified files to carry prominent notices - stating that You changed the files; and - - (c) You must retain, in the Source form of any Derivative Works - that You distribute, all copyright, patent, trademark, and - attribution notices from the Source form of the Work, - excluding those notices that do not pertain to any part of - the Derivative Works; and - - (d) If the Work includes a "NOTICE" text file as part of its - distribution, then any Derivative Works that You distribute must - include a readable copy of the attribution notices contained - within such NOTICE file, excluding those notices that do not - pertain to any part of the Derivative Works, in at least one - of the following places: within a NOTICE text file distributed - as part of the Derivative Works; within the Source form or - documentation, if provided along with the Derivative Works; or, - within a display generated by the Derivative Works, if and - wherever such third-party notices normally appear. The contents - of the NOTICE file are for informational purposes only and - do not modify the License. You may add Your own attribution - notices within Derivative Works that You distribute, alongside - or as an addendum to the NOTICE text from the Work, provided - that such additional attribution notices cannot be construed - as modifying the License. - - You may add Your own copyright statement to Your modifications and - may provide additional or different license terms and conditions - for use, reproduction, or distribution of Your modifications, or - for any such Derivative Works as a whole, provided Your use, - reproduction, and distribution of the Work otherwise complies with - the conditions stated in this License. - - 5. Submission of Contributions. Unless You explicitly state otherwise, - any Contribution intentionally submitted for inclusion in the Work - by You to the Licensor shall be under the terms and conditions of - this License, without any additional terms or conditions. - Notwithstanding the above, nothing herein shall supersede or modify - the terms of any separate license agreement you may have executed - with Licensor regarding such Contributions. - - 6. Trademarks. This License does not grant permission to use the trade - names, trademarks, service marks, or product names of the Licensor, - except as required for reasonable and customary use in describing the - origin of the Work and reproducing the content of the NOTICE file. - - 7. Disclaimer of Warranty. Unless required by applicable law or - agreed to in writing, Licensor provides the Work (and each - Contributor provides its Contributions) on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or - implied, including, without limitation, any warranties or conditions - of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A - PARTICULAR PURPOSE. You are solely responsible for determining the - appropriateness of using or redistributing the Work and assume any - risks associated with Your exercise of permissions under this License. - - 8. Limitation of Liability. In no event and under no legal theory, - whether in tort (including negligence), contract, or otherwise, - unless required by applicable law (such as deliberate and grossly - negligent acts) or agreed to in writing, shall any Contributor be - liable to You for damages, including any direct, indirect, special, - incidental, or consequential damages of any character arising as a - result of this License or out of the use or inability to use the - Work (including but not limited to damages for loss of goodwill, - work stoppage, computer failure or malfunction, or any and all - other commercial damages or losses), even if such Contributor - has been advised of the possibility of such damages. - - 9. Accepting Warranty or Additional Liability. While redistributing - the Work or Derivative Works thereof, You may choose to offer, - and charge a fee for, acceptance of support, warranty, indemnity, - or other liability obligations and/or rights consistent with this - License. However, in accepting such obligations, You may act only - on Your own behalf and on Your sole responsibility, not on behalf - of any other Contributor, and only if You agree to indemnify, - defend, and hold each Contributor harmless for any liability - incurred by, or claims asserted against, such Contributor by reason - of your accepting any such warranty or additional liability. - - -Text of MIT License -=================== -Permission is hereby granted, free of charge, to any person obtaining a copy of -this software and associated documentation files (the "Software"), to deal in -the Software without restriction, including without limitation the rights to -use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of -the Software, and to permit persons to whom the Software is furnished to do so, -subject to the following conditions: - -The above copyright notice and this permission notice shall be included in all -copies or substantial portions of the Software. - -THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR -IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS -FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR -COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER -IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN -CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. diff --git a/letsencrypt/MANIFEST.in b/letsencrypt/MANIFEST.in deleted file mode 100644 index 97e2ad3df..000000000 --- a/letsencrypt/MANIFEST.in +++ /dev/null @@ -1,2 +0,0 @@ -include LICENSE.txt -include README.rst diff --git a/letsencrypt/README.rst b/letsencrypt/README.rst deleted file mode 100644 index b5fa0ec95..000000000 --- a/letsencrypt/README.rst +++ /dev/null @@ -1,2 +0,0 @@ -This package is a simple shim around the ``certbot`` ACME client for backwards -compatibility. diff --git a/letsencrypt/letsencrypt/__init__.py b/letsencrypt/letsencrypt/__init__.py deleted file mode 100644 index a67d641f5..000000000 --- a/letsencrypt/letsencrypt/__init__.py +++ /dev/null @@ -1,8 +0,0 @@ -"""Let's Encrypt ACME client.""" -import sys - - -import certbot - - -sys.modules['letsencrypt'] = certbot diff --git a/letsencrypt/setup.py b/letsencrypt/setup.py deleted file mode 100644 index 4541e85fe..000000000 --- a/letsencrypt/setup.py +++ /dev/null @@ -1,62 +0,0 @@ -import codecs -import os -import sys - -from setuptools import setup -from setuptools import find_packages - - -def read_file(filename, encoding='utf8'): - """Read unicode from given file.""" - with codecs.open(filename, encoding=encoding) as fd: - return fd.read() - - -here = os.path.abspath(os.path.dirname(__file__)) -readme = read_file(os.path.join(here, 'README.rst')) - - -# This package is a simple shim around certbot -install_requires = ['certbot'] - - -version = '0.8.0.dev0' - - -setup( - name='letsencrypt', - version=version, - description="ACME client", - long_description=readme, - url='https://github.com/letsencrypt/letsencrypt', - author="Certbot Project", - author_email='client-dev@letsencrypt.org', - license='Apache License 2.0', - classifiers=[ - 'Development Status :: 3 - Alpha', - 'Environment :: Console', - 'Environment :: Console :: Curses', - 'Intended Audience :: System Administrators', - 'License :: OSI Approved :: Apache Software License', - 'Operating System :: POSIX :: Linux', - 'Programming Language :: Python', - 'Programming Language :: Python :: 2', - 'Programming Language :: Python :: 2.6', - 'Programming Language :: Python :: 2.7', - 'Topic :: Internet :: WWW/HTTP', - 'Topic :: Security', - 'Topic :: System :: Installation/Setup', - 'Topic :: System :: Networking', - 'Topic :: System :: Systems Administration', - 'Topic :: Utilities', - ], - - packages=find_packages(), - include_package_data=True, - install_requires=install_requires, - entry_points={ - 'console_scripts': [ - 'letsencrypt = certbot.main:main', - ], - }, -) diff --git a/letsencrypt/tests/testdata/os-release b/letsencrypt/tests/testdata/os-release deleted file mode 100644 index b7c3ceb1b..000000000 --- a/letsencrypt/tests/testdata/os-release +++ /dev/null @@ -1,8 +0,0 @@ -NAME="SystemdOS" -VERSION="42.42.42 LTS, Unreal" -ID=systemdos -ID_LIKE=debian -PRETTY_NAME="SystemdOS 42.42.42 Unreal" -VERSION_ID="42" -HOME_URL="http://www.example.com/" -SUPPORT_URL="http://help.example.com/" diff --git a/letshelp-letsencrypt/LICENSE.txt b/letshelp-letsencrypt/LICENSE.txt deleted file mode 100644 index 981c46c9f..000000000 --- a/letshelp-letsencrypt/LICENSE.txt +++ /dev/null @@ -1,190 +0,0 @@ - Copyright 2015 Electronic Frontier Foundation and others - - Licensed under the Apache License, Version 2.0 (the "License"); - you may not use this file except in compliance with the License. - You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - - Unless required by applicable law or agreed to in writing, software - distributed under the License is distributed on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - See the License for the specific language governing permissions and - limitations under the License. - - Apache License - Version 2.0, January 2004 - http://www.apache.org/licenses/ - - TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION - - 1. Definitions. - - "License" shall mean the terms and conditions for use, reproduction, - and distribution as defined by Sections 1 through 9 of this document. - - "Licensor" shall mean the copyright owner or entity authorized by - the copyright owner that is granting the License. - - "Legal Entity" shall mean the union of the acting entity and all - other entities that control, are controlled by, or are under common - control with that entity. For the purposes of this definition, - "control" means (i) the power, direct or indirect, to cause the - direction or management of such entity, whether by contract or - otherwise, or (ii) ownership of fifty percent (50%) or more of the - outstanding shares, or (iii) beneficial ownership of such entity. - - "You" (or "Your") shall mean an individual or Legal Entity - exercising permissions granted by this License. - - "Source" form shall mean the preferred form for making modifications, - including but not limited to software source code, documentation - source, and configuration files. - - "Object" form shall mean any form resulting from mechanical - transformation or translation of a Source form, including but - not limited to compiled object code, generated documentation, - and conversions to other media types. - - "Work" shall mean the work of authorship, whether in Source or - Object form, made available under the License, as indicated by a - copyright notice that is included in or attached to the work - (an example is provided in the Appendix below). - - "Derivative Works" shall mean any work, whether in Source or Object - form, that is based on (or derived from) the Work and for which the - editorial revisions, annotations, elaborations, or other modifications - represent, as a whole, an original work of authorship. For the purposes - of this License, Derivative Works shall not include works that remain - separable from, or merely link (or bind by name) to the interfaces of, - the Work and Derivative Works thereof. - - "Contribution" shall mean any work of authorship, including - the original version of the Work and any modifications or additions - to that Work or Derivative Works thereof, that is intentionally - submitted to Licensor for inclusion in the Work by the copyright owner - or by an individual or Legal Entity authorized to submit on behalf of - the copyright owner. For the purposes of this definition, "submitted" - means any form of electronic, verbal, or written communication sent - to the Licensor or its representatives, including but not limited to - communication on electronic mailing lists, source code control systems, - and issue tracking systems that are managed by, or on behalf of, the - Licensor for the purpose of discussing and improving the Work, but - excluding communication that is conspicuously marked or otherwise - designated in writing by the copyright owner as "Not a Contribution." - - "Contributor" shall mean Licensor and any individual or Legal Entity - on behalf of whom a Contribution has been received by Licensor and - subsequently incorporated within the Work. - - 2. Grant of Copyright License. Subject to the terms and conditions of - this License, each Contributor hereby grants to You a perpetual, - worldwide, non-exclusive, no-charge, royalty-free, irrevocable - copyright license to reproduce, prepare Derivative Works of, - publicly display, publicly perform, sublicense, and distribute the - Work and such Derivative Works in Source or Object form. - - 3. Grant of Patent License. Subject to the terms and conditions of - this License, each Contributor hereby grants to You a perpetual, - worldwide, non-exclusive, no-charge, royalty-free, irrevocable - (except as stated in this section) patent license to make, have made, - use, offer to sell, sell, import, and otherwise transfer the Work, - where such license applies only to those patent claims licensable - by such Contributor that are necessarily infringed by their - Contribution(s) alone or by combination of their Contribution(s) - with the Work to which such Contribution(s) was submitted. If You - institute patent litigation against any entity (including a - cross-claim or counterclaim in a lawsuit) alleging that the Work - or a Contribution incorporated within the Work constitutes direct - or contributory patent infringement, then any patent licenses - granted to You under this License for that Work shall terminate - as of the date such litigation is filed. - - 4. Redistribution. You may reproduce and distribute copies of the - Work or Derivative Works thereof in any medium, with or without - modifications, and in Source or Object form, provided that You - meet the following conditions: - - (a) You must give any other recipients of the Work or - Derivative Works a copy of this License; and - - (b) You must cause any modified files to carry prominent notices - stating that You changed the files; and - - (c) You must retain, in the Source form of any Derivative Works - that You distribute, all copyright, patent, trademark, and - attribution notices from the Source form of the Work, - excluding those notices that do not pertain to any part of - the Derivative Works; and - - (d) If the Work includes a "NOTICE" text file as part of its - distribution, then any Derivative Works that You distribute must - include a readable copy of the attribution notices contained - within such NOTICE file, excluding those notices that do not - pertain to any part of the Derivative Works, in at least one - of the following places: within a NOTICE text file distributed - as part of the Derivative Works; within the Source form or - documentation, if provided along with the Derivative Works; or, - within a display generated by the Derivative Works, if and - wherever such third-party notices normally appear. The contents - of the NOTICE file are for informational purposes only and - do not modify the License. You may add Your own attribution - notices within Derivative Works that You distribute, alongside - or as an addendum to the NOTICE text from the Work, provided - that such additional attribution notices cannot be construed - as modifying the License. - - You may add Your own copyright statement to Your modifications and - may provide additional or different license terms and conditions - for use, reproduction, or distribution of Your modifications, or - for any such Derivative Works as a whole, provided Your use, - reproduction, and distribution of the Work otherwise complies with - the conditions stated in this License. - - 5. Submission of Contributions. Unless You explicitly state otherwise, - any Contribution intentionally submitted for inclusion in the Work - by You to the Licensor shall be under the terms and conditions of - this License, without any additional terms or conditions. - Notwithstanding the above, nothing herein shall supersede or modify - the terms of any separate license agreement you may have executed - with Licensor regarding such Contributions. - - 6. Trademarks. This License does not grant permission to use the trade - names, trademarks, service marks, or product names of the Licensor, - except as required for reasonable and customary use in describing the - origin of the Work and reproducing the content of the NOTICE file. - - 7. Disclaimer of Warranty. Unless required by applicable law or - agreed to in writing, Licensor provides the Work (and each - Contributor provides its Contributions) on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or - implied, including, without limitation, any warranties or conditions - of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A - PARTICULAR PURPOSE. You are solely responsible for determining the - appropriateness of using or redistributing the Work and assume any - risks associated with Your exercise of permissions under this License. - - 8. Limitation of Liability. In no event and under no legal theory, - whether in tort (including negligence), contract, or otherwise, - unless required by applicable law (such as deliberate and grossly - negligent acts) or agreed to in writing, shall any Contributor be - liable to You for damages, including any direct, indirect, special, - incidental, or consequential damages of any character arising as a - result of this License or out of the use or inability to use the - Work (including but not limited to damages for loss of goodwill, - work stoppage, computer failure or malfunction, or any and all - other commercial damages or losses), even if such Contributor - has been advised of the possibility of such damages. - - 9. Accepting Warranty or Additional Liability. While redistributing - the Work or Derivative Works thereof, You may choose to offer, - and charge a fee for, acceptance of support, warranty, indemnity, - or other liability obligations and/or rights consistent with this - License. However, in accepting such obligations, You may act only - on Your own behalf and on Your sole responsibility, not on behalf - of any other Contributor, and only if You agree to indemnify, - defend, and hold each Contributor harmless for any liability - incurred by, or claims asserted against, such Contributor by reason - of your accepting any such warranty or additional liability. - - END OF TERMS AND CONDITIONS diff --git a/letshelp-letsencrypt/MANIFEST.in b/letshelp-letsencrypt/MANIFEST.in deleted file mode 100644 index 97e2ad3df..000000000 --- a/letshelp-letsencrypt/MANIFEST.in +++ /dev/null @@ -1,2 +0,0 @@ -include LICENSE.txt -include README.rst diff --git a/letshelp-letsencrypt/README.rst b/letshelp-letsencrypt/README.rst deleted file mode 100644 index 57d0d8a3b..000000000 --- a/letshelp-letsencrypt/README.rst +++ /dev/null @@ -1,2 +0,0 @@ -This package is a simple shim around the ``letshelp-certbot`` for backwards -compatibility. diff --git a/letshelp-letsencrypt/letshelp_letsencrypt/__init__.py b/letshelp-letsencrypt/letshelp_letsencrypt/__init__.py deleted file mode 100644 index fe4e272f9..000000000 --- a/letshelp-letsencrypt/letshelp_letsencrypt/__init__.py +++ /dev/null @@ -1,8 +0,0 @@ -"""Tools for submitting server configurations.""" -import sys - - -import letshelp_certbot - - -sys.modules['letshelp_letsencrypt'] = letshelp_certbot diff --git a/letshelp-letsencrypt/setup.py b/letshelp-letsencrypt/setup.py deleted file mode 100644 index 10380c49b..000000000 --- a/letshelp-letsencrypt/setup.py +++ /dev/null @@ -1,61 +0,0 @@ -import codecs -import os -import sys - -from setuptools import setup -from setuptools import find_packages - - -def read_file(filename, encoding='utf8'): - """Read unicode from given file.""" - with codecs.open(filename, encoding=encoding) as fd: - return fd.read() - - -here = os.path.abspath(os.path.dirname(__file__)) -readme = read_file(os.path.join(here, 'README.rst')) - - -version = '0.7.0.dev0' - - -# This package is a simple shim around letshelp-certbot -install_requires = ['letshelp-certbot'] - - -setup( - name='letshelp-letsencrypt', - version=version, - description="Let's help Let's Encrypt client", - long_description=readme, - url='https://github.com/letsencrypt/letsencrypt', - author="Certbot Project", - author_email='client-dev@letsencrypt.org', - license='Apache License 2.0', - classifiers=[ - 'Development Status :: 3 - Alpha', - 'Environment :: Plugins', - 'Intended Audience :: System Administrators', - 'License :: OSI Approved :: Apache Software License', - 'Operating System :: POSIX :: Linux', - 'Programming Language :: Python', - 'Programming Language :: Python :: 2', - 'Programming Language :: Python :: 2.6', - 'Programming Language :: Python :: 2.7', - 'Topic :: Internet :: WWW/HTTP', - 'Topic :: Security', - 'Topic :: System :: Installation/Setup', - 'Topic :: System :: Networking', - 'Topic :: System :: Systems Administration', - 'Topic :: Utilities', - ], - - packages=find_packages(), - include_package_data=True, - install_requires=install_requires, - entry_points={ - 'console_scripts': [ - 'letshelp-letsencrypt-apache = letshelp_certbot.apache:main', - ], - }, -) diff --git a/setup.py b/setup.py index 6d0909ea8..4227d5d92 100644 --- a/setup.py +++ b/setup.py @@ -51,12 +51,6 @@ install_requires = [ 'zope.interface', ] -# Debian squeeze support, cf. #280 -if sys.version_info[0] == 2: - install_requires.append('python2-pythondialog>=3.2.2rc1') -else: - install_requires.append('pythondialog>=3.2.2rc1') - # env markers in extras_require cause problems with older pip: #517 # Keep in sync with conditional_requirements.py. if sys.version_info < (2, 7): @@ -85,7 +79,6 @@ docs_extras = [ 'repoze.sphinx.autointerface', 'Sphinx>=1.0', # autodoc_member_order = 'bysource', autodoc_default_flags 'sphinx_rtd_theme', - 'sphinxcontrib-programoutput', ] setup( diff --git a/tests/boulder-integration.sh b/tests/boulder-integration.sh index ab8fde5f6..e7975454b 100755 --- a/tests/boulder-integration.sh +++ b/tests/boulder-integration.sh @@ -33,9 +33,23 @@ common() { "$@" } -common --domains le1.wtf --standalone-supported-challenges tls-sni-01 auth -common --domains le2.wtf --standalone-supported-challenges http-01 run -common -a manual -d le.wtf auth --rsa-key-size 4096 +# We start a server listening on the port for the +# unrequested challenge to prevent regressions in #3601. +python -m SimpleHTTPServer $http_01_port & +python_server_pid=$! +common --domains le1.wtf --preferred-challenges tls-sni-01 auth +kill $python_server_pid +python -m SimpleHTTPServer $tls_sni_01_port & +python_server_pid=$! +common --domains le2.wtf --preferred-challenges http-01 run +kill $python_server_pid + +common certonly -a manual -d le.wtf --rsa-key-size 4096 \ + --manual-auth-hook ./tests/manual-http-auth.sh \ + --manual-cleanup-hook ./tests/manual-http-cleanup.sh + +common certonly -a manual -d dns.le.wtf --preferred-challenges dns-01 \ + --manual-auth-hook ./tests/manual-dns-auth.sh export CSR_PATH="${root}/csr.der" KEY_PATH="${root}/key.pem" \ OPENSSL_CNF=examples/openssl.cnf diff --git a/tests/display.py b/tests/display.py index ecb7c279b..1f548e33d 100644 --- a/tests/display.py +++ b/tests/display.py @@ -18,5 +18,5 @@ def test_visual(displayer, choices): if __name__ == "__main__": - for displayer in util.NcursesDisplay(), util.FileDisplay(sys.stdout): - test_visual(displayer, util_test.CHOICES) + displayer = util.FileDisplay(sys.stdout, False) + test_visual(displayer, util_test.CHOICES) diff --git a/tests/integration/_common.sh b/tests/integration/_common.sh index 8992a18c0..12924fe21 100755 --- a/tests/integration/_common.sh +++ b/tests/integration/_common.sh @@ -9,7 +9,9 @@ then fi store_flags="--config-dir $root/conf --work-dir $root/work" store_flags="$store_flags --logs-dir $root/logs" -export root store_flags +tls_sni_01_port=5001 +http_01_port=5002 +export root store_flags tls_sni_01_port http_01_port certbot_test () { certbot_test_no_force_renew \ @@ -21,15 +23,15 @@ certbot_test_no_force_renew () { certbot \ --server "${SERVER:-http://localhost:4000/directory}" \ --no-verify-ssl \ - --tls-sni-01-port 5001 \ - --http-01-port 5002 \ - --manual-test-mode \ + --tls-sni-01-port $tls_sni_01_port \ + --http-01-port $http_01_port \ + --manual-public-ip-logging-ok \ $store_flags \ --non-interactive \ --no-redirect \ --agree-tos \ --register-unsafely-without-email \ --debug \ - -vvvvvvv \ + -vv \ "$@" } diff --git a/tests/letstest/scripts/test_apache2.sh b/tests/letstest/scripts/test_apache2.sh index 3e0846216..7fa860302 100755 --- a/tests/letstest/scripts/test_apache2.sh +++ b/tests/letstest/scripts/test_apache2.sh @@ -17,6 +17,7 @@ then CONFFILE=/etc/httpd/conf/httpd.conf sudo setenforce 0 || true #disable selinux sudo yum -y install httpd + sudo yum -y install nghttp2 || echo this is probably ok but see https://bugzilla.redhat.com/show_bug.cgi?id=1358875 sudo service httpd start sudo mkdir -p /var/www/$PUBLIC_HOSTNAME/public_html sudo chmod -R oug+rwx /var/www diff --git a/tests/letstest/scripts/test_leauto_upgrades.sh b/tests/letstest/scripts/test_leauto_upgrades.sh index 0ad0d6081..08247fe8d 100755 --- a/tests/letstest/scripts/test_leauto_upgrades.sh +++ b/tests/letstest/scripts/test_leauto_upgrades.sh @@ -22,14 +22,14 @@ if ! command -v git ; then fi fi BRANCH=`git rev-parse --abbrev-ref HEAD` -git checkout v0.1.0 +git checkout -f v0.1.0 ./letsencrypt-auto -v --debug --version unset PIP_INDEX_URL export PIP_EXTRA_INDEX_URL="$SAVE" git checkout -f "$BRANCH" -if ! ./letsencrypt-auto -v --debug --version | grep 0.3.0 ; then +if ! ./letsencrypt-auto -v --debug --version | grep 0.9.0 ; then echo upgrade appeared to fail exit 1 fi diff --git a/tests/letstest/scripts/test_letsencrypt_auto_certonly_standalone.sh b/tests/letstest/scripts/test_letsencrypt_auto_certonly_standalone.sh index f4aef11fe..556f95e8c 100755 --- a/tests/letstest/scripts/test_letsencrypt_auto_certonly_standalone.sh +++ b/tests/letstest/scripts/test_letsencrypt_auto_certonly_standalone.sh @@ -7,7 +7,7 @@ #public_ip=$(curl -s http://169.254.169.254/2014-11-05/meta-data/public-ipv4) #private_ip=$(curl -s http://169.254.169.254/2014-11-05/meta-data/local-ipv4) -cd letsencrypt +cd letsencrypt/letsencrypt-auto-source ./letsencrypt-auto --os-packages-only --debug --version ./letsencrypt-auto certonly --no-self-upgrade -v --standalone --debug \ --text --agree-dev-preview --agree-tos \ diff --git a/tests/letstest/scripts/test_letsencrypt_auto_venv_only.sh b/tests/letstest/scripts/test_letsencrypt_auto_venv_only.sh index 234e70f68..c55e12e8b 100755 --- a/tests/letstest/scripts/test_letsencrypt_auto_venv_only.sh +++ b/tests/letstest/scripts/test_letsencrypt_auto_venv_only.sh @@ -4,4 +4,4 @@ cd letsencrypt # help installs virtualenv and does nothing else -./letsencrypt-auto -v --debug --help all +./letsencrypt-auto-source/letsencrypt-auto -v --debug --help all diff --git a/tests/letstest/scripts/test_tests.sh b/tests/letstest/scripts/test_tests.sh new file mode 100755 index 000000000..10cad2549 --- /dev/null +++ b/tests/letstest/scripts/test_tests.sh @@ -0,0 +1,17 @@ +#!/bin/sh -xe + +MODULES="acme certbot certbot_apache certbot_nginx" +VENV_NAME=venv + +# *-auto respects VENV_PATH +VENV_PATH=$VENV_NAME letsencrypt/certbot-auto --debug --non-interactive --version +. $VENV_NAME/bin/activate + +# change to an empty directory to ensure CWD doesn't affect tests +cd $(mktemp -d) +pip install nose + +for module in $MODULES ; do + echo testing $module + nosetests -v $module +done diff --git a/tests/manual-dns-auth.sh b/tests/manual-dns-auth.sh new file mode 100755 index 000000000..9b9a1a5eb --- /dev/null +++ b/tests/manual-dns-auth.sh @@ -0,0 +1,4 @@ +#!/bin/sh +curl -X POST 'http://localhost:8055/set-txt' -d \ + "{\"host\": \"_acme-challenge.$CERTBOT_DOMAIN.\", \ + \"value\": \"$CERTBOT_VALIDATION\"}" diff --git a/tests/manual-http-auth.sh b/tests/manual-http-auth.sh new file mode 100755 index 000000000..c4730392b --- /dev/null +++ b/tests/manual-http-auth.sh @@ -0,0 +1,12 @@ +#!/bin/sh +uri_path=".well-known/acme-challenge/$CERTBOT_TOKEN" + +cd $(mktemp -d) +mkdir -p $(dirname $uri_path) +echo $CERTBOT_VALIDATION > $uri_path +python -m SimpleHTTPServer $http_01_port >/dev/null 2>&1 & +server_pid=$! +while ! curl "http://localhost:$http_01_port/$uri_path" >/dev/null 2>&1; do + sleep 1s +done +echo $server_pid diff --git a/tests/manual-http-cleanup.sh b/tests/manual-http-cleanup.sh new file mode 100755 index 000000000..5e437bf08 --- /dev/null +++ b/tests/manual-http-cleanup.sh @@ -0,0 +1,2 @@ +#!/bin/sh +kill $CERTBOT_AUTH_OUTPUT diff --git a/tests/modification-check.sh b/tests/modification-check.sh new file mode 100755 index 000000000..73cdb0c09 --- /dev/null +++ b/tests/modification-check.sh @@ -0,0 +1,67 @@ +#!/bin/bash + +temp_dir=`mktemp -d` + +# Script should be run from Certbot's root directory + +SCRIPT_PATH=`dirname $0` +SCRIPT_PATH=`readlink -f $SCRIPT_PATH` +FLAG=false + +# Compare root letsencrypt-auto and certbot-auto with published versions + +cp letsencrypt-auto ${temp_dir}/letsencrypt-to-be-checked +cp certbot-auto ${temp_dir}/certbot-to-be-checked + +cp letsencrypt-auto-source/pieces/fetch.py ${temp_dir}/fetch.py +cd ${temp_dir} + +LATEST_VERSION=`python fetch.py --latest-version` +python fetch.py --le-auto-script v${LATEST_VERSION} + +cmp -s letsencrypt-auto letsencrypt-to-be-checked + +if [ $? != 0 ]; then + echo "Root letsencrypt-auto has changed." + FLAG=true +else + echo "Root letsencrypt-auto is unchanged." +fi + +cmp -s letsencrypt-auto certbot-to-be-checked + +if [ $? != 0 ]; then + echo "Root certbot-auto has changed." + FLAG=true +else + echo "Root certbot-auto is unchanged." +fi + +# Cleanup +rm ${temp_dir}/* +cd ${SCRIPT_PATH}/../ + +# Compare letsencrypt-auto-source/letsencrypt-auto with output of build.py + +cp letsencrypt-auto-source/letsencrypt-auto ${temp_dir}/original-lea +python letsencrypt-auto-source/build.py +cp letsencrypt-auto-source/letsencrypt-auto ${temp_dir}/build-lea + +cd $temp_dir + +cmp -s original-lea build-lea + +if [ $? != 0 ]; then + echo "letsencrypt-auto-source/letsencrypt-auto doesn't match output of \ +build.py." + FLAG=true +else + echo "letsencrypt-auto-source/letsencrypt-auto matches output of \ +build.py." +fi + +if $FLAG ; then + exit 1 +fi + +rm -rf temp_dir diff --git a/tools/release.sh b/tools/release.sh index c883e3d61..be306d8e0 100755 --- a/tools/release.sh +++ b/tools/release.sh @@ -147,36 +147,39 @@ cd ~- # get a snapshot of the CLI help for the docs certbot --help all > docs/cli-help.txt +jws --help > acme/docs/jws-help.txt +cd .. # freeze before installing anything else, so that we know end-user KGS # make sure "twine upload" doesn't catch "kgs" -if [ -d ../kgs ] ; then +if [ -d kgs ] ; then echo Deleting old kgs... - rm -rf ../kgs + rm -rf kgs fi -mkdir ../kgs -kgs="../kgs/$version" +mkdir kgs +kgs="kgs/$version" pip freeze | tee $kgs pip install nose for module in certbot $subpkgs_modules ; do echo testing $module nosetests $module done +cd ~- # pin pip hashes of the things we just built -for pkg in acme certbot certbot-apache ; do +for pkg in acme certbot certbot-apache certbot-nginx ; do echo $pkg==$version \\ pip hash dist."$version/$pkg"/*.{whl,gz} | grep "^--hash" | python2 -c 'from sys import stdin; input = stdin.read(); print " ", input.replace("\n--hash", " \\\n --hash"),' done > /tmp/hashes.$$ deactivate -if ! wc -l /tmp/hashes.$$ | grep -qE "^\s*9 " ; then +if ! wc -l /tmp/hashes.$$ | grep -qE "^\s*12 " ; then echo Unexpected pip hash output exit 1 fi # perform hideous surgery on requirements.txt... -head -n -9 letsencrypt-auto-source/pieces/letsencrypt-auto-requirements.txt > /tmp/req.$$ +head -n -12 letsencrypt-auto-source/pieces/letsencrypt-auto-requirements.txt > /tmp/req.$$ cat /tmp/hashes.$$ >> /tmp/req.$$ cp /tmp/req.$$ letsencrypt-auto-source/pieces/letsencrypt-auto-requirements.txt @@ -193,7 +196,7 @@ done # This signature is not quite as strong, but easier for people to verify out of band gpg -u "$RELEASE_GPG_KEY" --detach-sign --armor --sign letsencrypt-auto-source/letsencrypt-auto # We can't rename the openssl letsencrypt-auto.sig for compatibility reasons, -# but we can use the right name for cerbot-auto.asc from day one +# but we can use the right name for certbot-auto.asc from day one mv letsencrypt-auto-source/letsencrypt-auto.asc letsencrypt-auto-source/certbot-auto.asc # copy leauto to the root, overwriting the previous release version @@ -215,7 +218,6 @@ echo gpg -U $RELEASE_GPG_KEY --detach-sign --armor $name.$rev.tar.xz cd ~- echo "New root: $root" -echo "KGS is at $root/kgs" echo "Test commands (in the letstest repo):" echo 'python multitester.py targets.yaml $AWS_KEY $USERNAME scripts/test_leauto_upgrades.sh --alt_pip $YOUR_PIP_REPO --branch public-beta' echo 'python multitester.py targets.yaml $AWK_KEY $USERNAME scripts/test_letsencrypt_auto_certonly_standalone.sh --branch candidate-0.1.1' diff --git a/tox.ini b/tox.ini index 27979d9df..959f44a8d 100644 --- a/tox.ini +++ b/tox.ini @@ -4,7 +4,7 @@ [tox] skipsdist = true -envlist = py{26,33,34,35},cover,lint +envlist = modification,py{26,33,34,35},cover,lint # nosetest -v => more verbose output, allows to detect busy waiting # loops, especially on Travis @@ -14,42 +14,59 @@ envlist = py{26,33,34,35},cover,lint # are detected, c.f. #1002 commands = pip install -e acme[dns,dev] - nosetests -v acme + nosetests -v acme --processes=-1 pip install -e .[dev] - nosetests -v certbot + nosetests -v certbot --processes=-1 --process-timeout=100 pip install -e certbot-apache - nosetests -v certbot_apache + nosetests -v certbot_apache --processes=-1 --process-timeout=80 pip install -e certbot-nginx - nosetests -v certbot_nginx + nosetests -v certbot_nginx --processes=-1 pip install -e letshelp-certbot - nosetests -v letshelp_certbot + nosetests -v letshelp_certbot --processes=-1 setenv = PYTHONPATH = {toxinidir} PYTHONHASHSEED = 0 # https://testrun.org/tox/latest/example/basic.html#special-handling-of-pythonhas +# cffi<=1.7 is required for oldest tests due to +# https://bitbucket.org/cffi/cffi/commits/18cdf37d6b2691301a15b0e54f49757ebd4ed0f2?at=default +# requests<=2.11.1 required for oldest tests due to +# https://github.com/shazow/urllib3/pull/930 deps = + py{26,27}-oldest: cffi<=1.7 py{26,27}-oldest: cryptography==0.8 py{26,27}-oldest: configargparse==0.10.0 + py{26,27}-oldest: dnspython>=1.12 py{26,27}-oldest: psutil==2.1.0 py{26,27}-oldest: PyOpenSSL==0.13 - py{26,27}-oldest: python2-pythondialog==3.2.2rc1 + py{26,27}-oldest: requests<=2.11.1 [testenv:py33] commands = pip install -e acme[dns,dev] - nosetests -v acme + nosetests -v acme --processes=-1 + pip install -e .[dev] + nosetests -v certbot --processes=-1 --process-timeout=100 [testenv:py34] commands = pip install -e acme[dns,dev] - nosetests -v acme + nosetests -v acme --processes=-1 + pip install -e .[dev] + nosetests -v certbot --processes=-1 --process-timeout=100 [testenv:py35] commands = pip install -e acme[dns,dev] - nosetests -v acme + nosetests -v acme --processes=-1 + pip install -e .[dev] + nosetests -v certbot --processes=-1 --process-timeout=100 + +[testenv:py27_install] +basepython = python2.7 +commands = + pip install -e acme[dns,dev] -e .[dev] -e certbot-apache -e certbot-nginx -e letshelp-certbot [testenv:cover] basepython = python2.7 @@ -66,12 +83,8 @@ basepython = python2.7 commands = pip install -q -e acme[dns,dev] -e .[dev] -e certbot-apache -e certbot-nginx -e certbot-compatibility-test -e letshelp-certbot ./pep8.travis.sh - pylint --reports=n --rcfile=.pylintrc certbot pylint --reports=n --rcfile=acme/.pylintrc acme/acme - pylint --reports=n --rcfile=.pylintrc certbot-apache/certbot_apache - pylint --reports=n --rcfile=.pylintrc certbot-nginx/certbot_nginx - pylint --reports=n --rcfile=.pylintrc certbot-compatibility-test/certbot_compatibility_test - pylint --reports=n --rcfile=.pylintrc letshelp-certbot/letshelp_certbot + pylint -j 0 --reports=n --rcfile=.pylintrc certbot certbot-apache/certbot_apache certbot-nginx/certbot_nginx certbot-compatibility-test/certbot_compatibility_test letshelp-certbot/letshelp_certbot [testenv:apacheconftest] #basepython = python2.7 @@ -79,12 +92,71 @@ commands = pip install -e acme -e .[dev] -e certbot-apache -e certbot-nginx -e certbot-compatibility-test -e letshelp-certbot {toxinidir}/certbot-apache/certbot_apache/tests/apache-conf-files/apache-conf-test --debian-modules - -[testenv:le_auto] -# At the moment, this tests under Python 2.7 only, as only that version is -# readily available on the Trusty Docker image. +[testenv:nginxroundtrip] commands = - docker build -t lea letsencrypt-auto-source + pip install -e acme[dev] -e .[dev] -e certbot-nginx + python certbot-compatibility-test/nginx/roundtrip.py certbot-compatibility-test/nginx/nginx-roundtrip-testdata + +# This is a duplication of the command line in testenv:le_auto to +# allow users to run the modification check by running `tox` +[testenv:modification] +commands = + {toxinidir}/tests/modification-check.sh + +[testenv:apache_compat] +commands = + docker build -t certbot-compatibility-test -f certbot-compatibility-test/Dockerfile . + docker build -t apache-compat -f certbot-compatibility-test/Dockerfile-apache . + docker run --rm -it apache-compat -c apache.tar.gz -vvvv +whitelist_externals = + docker +passenv = DOCKER_* + +[testenv:nginx_compat] +commands = + docker build -t certbot-compatibility-test -f certbot-compatibility-test/Dockerfile . + docker build -t nginx-compat -f certbot-compatibility-test/Dockerfile-nginx . + docker run --rm -it nginx-compat -c nginx.tar.gz -vvvv +whitelist_externals = + docker +passenv = DOCKER_* + +[testenv:le_auto_precise] +# At the moment, this tests under Python 2.7 only, as only that version is +# readily available on the Precise Docker image. +commands = + docker build -f letsencrypt-auto-source/Dockerfile.precise -t lea letsencrypt-auto-source + docker run --rm -t -i lea +whitelist_externals = + docker +passenv = DOCKER_* + +[testenv:le_auto_trusty] +# At the moment, this tests under Python 2.7 only, as only that version is +# readily available on the Trusty Docker image. +commands = + {toxinidir}/tests/modification-check.sh + docker build -f letsencrypt-auto-source/Dockerfile.trusty -t lea letsencrypt-auto-source + docker run --rm -t -i lea +whitelist_externals = + docker +passenv = DOCKER_* + +[testenv:le_auto_wheezy] +# At the moment, this tests under Python 2.7 only, as only that version is +# readily available on the Wheezy Docker image. +commands = + docker build -f letsencrypt-auto-source/Dockerfile.wheezy -t lea letsencrypt-auto-source + docker run --rm -t -i lea +whitelist_externals = + docker +passenv = DOCKER_* + +[testenv:le_auto_centos6] +# At the moment, this tests under Python 2.6 only, as only that version is +# readily available on the CentOS 6 Docker image. +commands = + docker build -f letsencrypt-auto-source/Dockerfile.centos6 -t lea letsencrypt-auto-source docker run --rm -t -i lea whitelist_externals = docker