From 24a3b66b1ca7eff88fdf6ee40514898793eaab6a Mon Sep 17 00:00:00 2001 From: Brad Warren Date: Mon, 8 Feb 2016 17:52:12 -0800 Subject: [PATCH 01/12] Use server_close() in standalone --- letsencrypt/plugins/standalone.py | 3 +++ 1 file changed, 3 insertions(+) diff --git a/letsencrypt/plugins/standalone.py b/letsencrypt/plugins/standalone.py index cde7041d8..71a17a28e 100644 --- a/letsencrypt/plugins/standalone.py +++ b/letsencrypt/plugins/standalone.py @@ -90,6 +90,9 @@ class ServerManager(object): logger.debug("Stopping server at %s:%d...", *instance.server.socket.getsockname()[:2]) instance.server.shutdown() + # Not calling server_close causes problems when renewing multiple + # certs with `letsencrypt renew` using TLSSNI01 and PyOpenSSL 0.13 + instance.server.server_close() instance.thread.join() del self._instances[port] From bb2f054f1b9529c77f8f8d536dacd8a508667ec2 Mon Sep 17 00:00:00 2001 From: Brad Warren Date: Mon, 8 Feb 2016 17:54:02 -0800 Subject: [PATCH 02/12] Take boulder-integration.sh from #2398 --- tests/boulder-integration.sh | 39 ++++++++++++++++++++++++++++++++---- 1 file changed, 35 insertions(+), 4 deletions(-) diff --git a/tests/boulder-integration.sh b/tests/boulder-integration.sh index b6c76ee22..8b6dc5f1b 100755 --- a/tests/boulder-integration.sh +++ b/tests/boulder-integration.sh @@ -51,14 +51,45 @@ common --domains le3.wtf install \ --cert-path "${root}/csr/cert.pem" \ --key-path "${root}/csr/key.pem" +echo round 1 + +CheckCertCount() { + CERTCOUNT=`ls "${root}/conf/archive/le.wtf/"* | wc -l` + if [ "$CERTCOUNT" -ne "$1" ] ; then + echo Wrong cert count, not "$1" `ls "${root}/conf/archive/le.wtf/"*` + exit 1 + fi +} + +CheckCertCount 4 # This won't renew (because it's not time yet) -letsencrypt_test_no_force_renew --authenticator standalone --installer null renew +letsencrypt_test_no_force_renew --authenticator standalone --installer null renew -tvv +CheckCertCount 4 + +echo round 2 # This will renew because the expiry is less than 10 years from now -sed -i "4arenew_before_expiry = 10 years" "$root/conf/renewal/le1.wtf.conf" -letsencrypt_test_no_force_renew --authenticator standalone --installer null renew +sed -i "4arenew_before_expiry = 10 years" "$root/conf/renewal/le.wtf.conf" +letsencrypt_test_no_force_renew --authenticator standalone --installer null renew # --renew-by-default +CheckCertCount 8 + +echo round 3 + +# Check Param setting in renewal... +letsencrypt_test_no_force_renew --authenticator standalone --installer null renew --renew-by-default +CheckCertCount 12 +echo round 4 + +# The 4096 bit setting should persist to the first renewal, but be overriden in the second +size2=`wc -c ${root}/conf/archive/le.wtf/privkey2.pem | cut -d" " -f1` +size3=`wc -c ${root}/conf/archive/le.wtf/privkey3.pem | cut -d" " -f1` +#if ! [ "$size3" -lt "$size2" ] ; then +# echo "key size failure:" +# ls -l ${root}/conf/archive/le.wtf/ +# exit 1 +#fi + -ls "$root/conf/archive/le1.wtf" # dir="$root/conf/archive/le1.wtf" # for x in cert chain fullchain privkey; # do From 38a6d442796c6a4973365f67a96affeb11b612df Mon Sep 17 00:00:00 2001 From: Brad Warren Date: Mon, 8 Feb 2016 17:54:39 -0800 Subject: [PATCH 03/12] Remove round echos --- tests/boulder-integration.sh | 7 ------- 1 file changed, 7 deletions(-) diff --git a/tests/boulder-integration.sh b/tests/boulder-integration.sh index 8b6dc5f1b..53e9b3f15 100755 --- a/tests/boulder-integration.sh +++ b/tests/boulder-integration.sh @@ -51,8 +51,6 @@ common --domains le3.wtf install \ --cert-path "${root}/csr/cert.pem" \ --key-path "${root}/csr/key.pem" -echo round 1 - CheckCertCount() { CERTCOUNT=`ls "${root}/conf/archive/le.wtf/"* | wc -l` if [ "$CERTCOUNT" -ne "$1" ] ; then @@ -66,19 +64,14 @@ CheckCertCount 4 letsencrypt_test_no_force_renew --authenticator standalone --installer null renew -tvv CheckCertCount 4 -echo round 2 - # This will renew because the expiry is less than 10 years from now sed -i "4arenew_before_expiry = 10 years" "$root/conf/renewal/le.wtf.conf" letsencrypt_test_no_force_renew --authenticator standalone --installer null renew # --renew-by-default CheckCertCount 8 -echo round 3 - # Check Param setting in renewal... letsencrypt_test_no_force_renew --authenticator standalone --installer null renew --renew-by-default CheckCertCount 12 -echo round 4 # The 4096 bit setting should persist to the first renewal, but be overriden in the second size2=`wc -c ${root}/conf/archive/le.wtf/privkey2.pem | cut -d" " -f1` From 8eb889d94251d36189ea7f5f23e7e26f91fdd901 Mon Sep 17 00:00:00 2001 From: Brad Warren Date: Mon, 8 Feb 2016 17:55:28 -0800 Subject: [PATCH 04/12] Make CheckCertCount check cert counts --- tests/boulder-integration.sh | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/tests/boulder-integration.sh b/tests/boulder-integration.sh index 53e9b3f15..dd6c1835e 100755 --- a/tests/boulder-integration.sh +++ b/tests/boulder-integration.sh @@ -52,26 +52,26 @@ common --domains le3.wtf install \ --key-path "${root}/csr/key.pem" CheckCertCount() { - CERTCOUNT=`ls "${root}/conf/archive/le.wtf/"* | wc -l` + CERTCOUNT=`ls "${root}/conf/archive/le.wtf/cert*" | wc -l` if [ "$CERTCOUNT" -ne "$1" ] ; then echo Wrong cert count, not "$1" `ls "${root}/conf/archive/le.wtf/"*` exit 1 fi } -CheckCertCount 4 +CheckCertCount 1 # This won't renew (because it's not time yet) letsencrypt_test_no_force_renew --authenticator standalone --installer null renew -tvv -CheckCertCount 4 +CheckCertCount 1 # This will renew because the expiry is less than 10 years from now sed -i "4arenew_before_expiry = 10 years" "$root/conf/renewal/le.wtf.conf" letsencrypt_test_no_force_renew --authenticator standalone --installer null renew # --renew-by-default -CheckCertCount 8 +CheckCertCount 2 # Check Param setting in renewal... letsencrypt_test_no_force_renew --authenticator standalone --installer null renew --renew-by-default -CheckCertCount 12 +CheckCertCount 3 # The 4096 bit setting should persist to the first renewal, but be overriden in the second size2=`wc -c ${root}/conf/archive/le.wtf/privkey2.pem | cut -d" " -f1` From 77616a975bbea2b9166efe578314ca9ec5d773f2 Mon Sep 17 00:00:00 2001 From: Brad Warren Date: Mon, 8 Feb 2016 17:59:30 -0800 Subject: [PATCH 05/12] Allow non-interactive with test-mode --- letsencrypt/plugins/manual.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/letsencrypt/plugins/manual.py b/letsencrypt/plugins/manual.py index 54244db2a..0e516b5b0 100644 --- a/letsencrypt/plugins/manual.py +++ b/letsencrypt/plugins/manual.py @@ -91,7 +91,7 @@ s.serve_forever()" """ help="Automatically allows public IP logging.") def prepare(self): # pylint: disable=missing-docstring,no-self-use - if self.config.noninteractive_mode: + if self.config.noninteractive_mode and not self.conf("test-mode"): raise errors.PluginError("Running manual mode non-interactively is not supported") def more_info(self): # pylint: disable=missing-docstring,no-self-use From 4038be9816cbc4b942a6afad0377f84fc6944008 Mon Sep 17 00:00:00 2001 From: Brad Warren Date: Mon, 8 Feb 2016 18:06:56 -0800 Subject: [PATCH 06/12] Test manual prepare() --- letsencrypt/plugins/manual_test.py | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/letsencrypt/plugins/manual_test.py b/letsencrypt/plugins/manual_test.py index e16fadd13..e749eb1f9 100644 --- a/letsencrypt/plugins/manual_test.py +++ b/letsencrypt/plugins/manual_test.py @@ -23,16 +23,21 @@ class AuthenticatorTest(unittest.TestCase): def setUp(self): from letsencrypt.plugins.manual import Authenticator self.config = mock.MagicMock( - http01_port=8080, manual_test_mode=False, manual_public_ip_logging_ok=False) + http01_port=8080, manual_test_mode=False, + manual_public_ip_logging_ok=False, noninteractive_mode=True) self.auth = Authenticator(config=self.config, name="manual") self.achalls = [achallenges.KeyAuthorizationAnnotatedChallenge( challb=acme_util.HTTP01_P, domain="foo.com", account_key=KEY)] config_test_mode = mock.MagicMock( - http01_port=8080, manual_test_mode=True) + http01_port=8080, manual_test_mode=True, noninteractive_mode=True) self.auth_test_mode = Authenticator( config=config_test_mode, name="manual") + def test_prepare(self): + self.assertRaises(errors.PluginError, self.auth.prepare) + self.auth_test_mode.prepare() # error not raised + def test_more_info(self): self.assertTrue(isinstance(self.auth.more_info(), str)) From 70402790a3cb8324eee230f304e8db53ce3442f6 Mon Sep 17 00:00:00 2001 From: Brad Warren Date: Mon, 8 Feb 2016 18:07:56 -0800 Subject: [PATCH 07/12] Use --non-interactive instead of --text --- tests/integration/_common.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/integration/_common.sh b/tests/integration/_common.sh index 9230cc682..db6e2f0f1 100755 --- a/tests/integration/_common.sh +++ b/tests/integration/_common.sh @@ -19,7 +19,7 @@ letsencrypt_test () { --http-01-port 5002 \ --manual-test-mode \ $store_flags \ - --text \ + --non-interactive \ --no-redirect \ --agree-tos \ --register-unsafely-without-email \ @@ -37,7 +37,7 @@ letsencrypt_test_no_force_renew () { --http-01-port 5002 \ --manual-test-mode \ $store_flags \ - --text \ + --non-interactive \ --no-redirect \ --agree-tos \ --register-unsafely-without-email \ From 7a902daa9f8480b527e54f6b18d38be7cd36ce73 Mon Sep 17 00:00:00 2001 From: Brad Warren Date: Mon, 8 Feb 2016 18:14:29 -0800 Subject: [PATCH 08/12] duplication-- --- tests/boulder-integration.sh | 11 +++++------ tests/integration/_common.sh | 17 ++--------------- 2 files changed, 7 insertions(+), 21 deletions(-) diff --git a/tests/boulder-integration.sh b/tests/boulder-integration.sh index dd6c1835e..cfd0e5c16 100755 --- a/tests/boulder-integration.sh +++ b/tests/boulder-integration.sh @@ -20,17 +20,16 @@ else readlink="readlink" fi -common() { - letsencrypt_test \ +common_no_force_renew() { + letsencrypt_test_no_force_renew \ --authenticator standalone \ --installer null \ "$@" } -common_no_force_renew() { - letsencrypt_test_no_force_renew \ - --authenticator standalone \ - --installer null \ +common() { + common_no_force_renew \ + --renew-by-default \ "$@" } diff --git a/tests/integration/_common.sh b/tests/integration/_common.sh index db6e2f0f1..77a60112b 100755 --- a/tests/integration/_common.sh +++ b/tests/integration/_common.sh @@ -12,21 +12,8 @@ store_flags="$store_flags --logs-dir $root/logs" export root store_flags letsencrypt_test () { - letsencrypt \ - --server "${SERVER:-http://localhost:4000/directory}" \ - --no-verify-ssl \ - --tls-sni-01-port 5001 \ - --http-01-port 5002 \ - --manual-test-mode \ - $store_flags \ - --non-interactive \ - --no-redirect \ - --agree-tos \ - --register-unsafely-without-email \ - --renew-by-default \ - --debug \ - -vvvvvvv \ - "$@" + letsencrypt_test_no_force_renew \ + --renew-by-default } letsencrypt_test_no_force_renew () { From e798b62d2e47f8ce669da6dfaad813fadd1f442f Mon Sep 17 00:00:00 2001 From: Brad Warren Date: Mon, 8 Feb 2016 18:18:48 -0800 Subject: [PATCH 09/12] Testing cleanup --- tests/boulder-integration.sh | 30 ++++++------------------------ 1 file changed, 6 insertions(+), 24 deletions(-) diff --git a/tests/boulder-integration.sh b/tests/boulder-integration.sh index cfd0e5c16..7e0246085 100755 --- a/tests/boulder-integration.sh +++ b/tests/boulder-integration.sh @@ -60,36 +60,18 @@ CheckCertCount() { CheckCertCount 1 # This won't renew (because it's not time yet) -letsencrypt_test_no_force_renew --authenticator standalone --installer null renew -tvv +letsencrypt_test_no_force_renew renew CheckCertCount 1 +# --renew-by-default is used, so renewal should occur +letsencrypt_test renew +CheckCertCount 2 + # This will renew because the expiry is less than 10 years from now sed -i "4arenew_before_expiry = 10 years" "$root/conf/renewal/le.wtf.conf" -letsencrypt_test_no_force_renew --authenticator standalone --installer null renew # --renew-by-default -CheckCertCount 2 - -# Check Param setting in renewal... -letsencrypt_test_no_force_renew --authenticator standalone --installer null renew --renew-by-default +letsencrypt_test_no_force_renew CheckCertCount 3 -# The 4096 bit setting should persist to the first renewal, but be overriden in the second -size2=`wc -c ${root}/conf/archive/le.wtf/privkey2.pem | cut -d" " -f1` -size3=`wc -c ${root}/conf/archive/le.wtf/privkey3.pem | cut -d" " -f1` -#if ! [ "$size3" -lt "$size2" ] ; then -# echo "key size failure:" -# ls -l ${root}/conf/archive/le.wtf/ -# exit 1 -#fi - - -# dir="$root/conf/archive/le1.wtf" -# for x in cert chain fullchain privkey; -# do -# latest="$(ls -1t $dir/ | grep -e "^${x}" | head -n1)" -# live="$($readlink -f "$root/conf/live/le1.wtf/${x}.pem")" -# [ "${dir}/${latest}" = "$live" ] # renewer fails this test -# done - # revoke by account key common revoke --cert-path "$root/conf/live/le.wtf/cert.pem" # revoke renewed From 2170c8d7d2830b0d883d605f17f3831d38ade4a7 Mon Sep 17 00:00:00 2001 From: Brad Warren Date: Mon, 8 Feb 2016 18:35:44 -0800 Subject: [PATCH 10/12] Move * outside of " --- tests/boulder-integration.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/boulder-integration.sh b/tests/boulder-integration.sh index 7e0246085..5520a75f1 100755 --- a/tests/boulder-integration.sh +++ b/tests/boulder-integration.sh @@ -51,7 +51,7 @@ common --domains le3.wtf install \ --key-path "${root}/csr/key.pem" CheckCertCount() { - CERTCOUNT=`ls "${root}/conf/archive/le.wtf/cert*" | wc -l` + CERTCOUNT=`ls "${root}/conf/archive/le.wtf/cert"* | wc -l` if [ "$CERTCOUNT" -ne "$1" ] ; then echo Wrong cert count, not "$1" `ls "${root}/conf/archive/le.wtf/"*` exit 1 From 8b613eed8f3a9bb0313cafe887c9cc764355dd8e Mon Sep 17 00:00:00 2001 From: Brad Warren Date: Mon, 8 Feb 2016 18:39:59 -0800 Subject: [PATCH 11/12] Pass additional args to letsencrypt_test_no_force_renew --- tests/integration/_common.sh | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/tests/integration/_common.sh b/tests/integration/_common.sh index 77a60112b..e86d087cb 100755 --- a/tests/integration/_common.sh +++ b/tests/integration/_common.sh @@ -13,7 +13,8 @@ export root store_flags letsencrypt_test () { letsencrypt_test_no_force_renew \ - --renew-by-default + --renew-by-default \ + "$@" } letsencrypt_test_no_force_renew () { From 0fa61f4192131892a9e2949d6c77a6cd38e297a0 Mon Sep 17 00:00:00 2001 From: Brad Warren Date: Mon, 8 Feb 2016 18:46:24 -0800 Subject: [PATCH 12/12] Use common and add verb --- tests/boulder-integration.sh | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/tests/boulder-integration.sh b/tests/boulder-integration.sh index 5520a75f1..29618b97f 100755 --- a/tests/boulder-integration.sh +++ b/tests/boulder-integration.sh @@ -60,16 +60,16 @@ CheckCertCount() { CheckCertCount 1 # This won't renew (because it's not time yet) -letsencrypt_test_no_force_renew renew +common_no_force_renew renew CheckCertCount 1 # --renew-by-default is used, so renewal should occur -letsencrypt_test renew +common renew CheckCertCount 2 # This will renew because the expiry is less than 10 years from now sed -i "4arenew_before_expiry = 10 years" "$root/conf/renewal/le.wtf.conf" -letsencrypt_test_no_force_renew +common_no_force_renew renew CheckCertCount 3 # revoke by account key