From b1a3c488eb1751b037b3b4e65c915d725253c2e9 Mon Sep 17 00:00:00 2001 From: Will Greenberg Date: Fri, 1 May 2026 12:05:51 -0700 Subject: [PATCH] certbot: add tests for dns-persist-01 failures/warnings --- .../_internal/tests/plugins/manual_test.py | 27 ++++++++++++------- certbot/src/certbot/tests/acme_util.py | 12 ++++++--- 2 files changed, 26 insertions(+), 13 deletions(-) diff --git a/certbot/src/certbot/_internal/tests/plugins/manual_test.py b/certbot/src/certbot/_internal/tests/plugins/manual_test.py index 8af9cbf0c..e113f2d9e 100644 --- a/certbot/src/certbot/_internal/tests/plugins/manual_test.py +++ b/certbot/src/certbot/_internal/tests/plugins/manual_test.py @@ -26,13 +26,15 @@ class AuthenticatorTest(test_util.TempDirTestCase): self.dns_achall = acme_util.DNS01_A self.dns_achall_2 = acme_util.DNS01_A_2 self.dns_persist_achall = acme_util.DNS_PERSIST_01_A - self.dns_persist_achall_wildcard = acme_util.DNS_PERSIST_01_A_WILDCARD + self.dns_persist_achall_wildcard = acme_util.DNS_PERSIST_01_A_WILDCARD_A + self.dns_persist_achall_long = acme_util.DNS_PERSIST_01_LONG_A self.achalls = [ self.http_achall, self.dns_achall, self.dns_achall_2, self.dns_persist_achall, self.dns_persist_achall_wildcard, + self.dns_persist_achall_long, ] self.responses: list[challenges.ChallengeResponse] = [] for achall in self.achalls: @@ -147,6 +149,8 @@ class AuthenticatorTest(test_util.TempDirTestCase): assert achall.validation_domain_name(achall.identifier.value) in args[0] else: assert achall.validation(achall.account_key) in args[0] + if achall == self.dns_persist_achall_long: + assert "WARNING: Because the above DNS record's value is longer than 255 bytes" in args[0] assert kwargs['wrap'] is False def test_cleanup(self): @@ -169,23 +173,26 @@ class AuthenticatorTest(test_util.TempDirTestCase): else: assert 'CERTBOT_TOKEN' not in os.environ + def test_auth_hint_hook(self): self.config.manual_auth_hook = '/bin/true' - assert self.auth.auth_hint([acme_util.DNS01_A, acme_util.HTTP01_A]) == \ - 'The Certificate Authority failed to verify the DNS TXT records and challenge ' \ - 'files created by the --manual-auth-hook. Ensure that this hook is functioning ' \ - 'correctly and that it waits a sufficient duration of time for DNS propagation. ' \ - 'Refer to "certbot --help manual" and the Certbot User Guide.' + for dns_achall in [acme_util.DNS01_A, acme_util.DNS_PERSIST_01_A]: + assert self.auth.auth_hint([dns_achall, acme_util.HTTP01_A]) == \ + 'The Certificate Authority failed to verify the DNS TXT records and challenge ' \ + 'files created by the --manual-auth-hook. Ensure that this hook is functioning ' \ + 'correctly and that it waits a sufficient duration of time for DNS propagation. ' \ + 'Refer to "certbot --help manual" and the Certbot User Guide.' assert self.auth.auth_hint([acme_util.HTTP01_A]) == \ 'The Certificate Authority failed to verify the challenge files created by the ' \ '--manual-auth-hook. Ensure that this hook is functioning correctly. Refer to ' \ '"certbot --help manual" and the Certbot User Guide.' def test_auth_hint_no_hook(self): - assert self.auth.auth_hint([acme_util.DNS01_A, acme_util.HTTP01_A]) == \ - 'The Certificate Authority failed to verify the manually created DNS TXT records ' \ - 'and challenge files. Ensure that you created these in the correct location, or ' \ - 'try waiting longer for DNS propagation on the next attempt.' + for dns_achall in [acme_util.DNS01_A, acme_util.DNS_PERSIST_01_A]: + assert self.auth.auth_hint([dns_achall, acme_util.HTTP01_A]) == \ + 'The Certificate Authority failed to verify the manually created DNS TXT records ' \ + 'and challenge files. Ensure that you created these in the correct location, or ' \ + 'try waiting longer for DNS propagation on the next attempt.' assert self.auth.auth_hint([acme_util.HTTP01_A, acme_util.HTTP01_A, acme_util.HTTP01_A]) == \ 'The Certificate Authority failed to verify the manually created challenge files. ' \ 'Ensure that you created these in the correct location.' diff --git a/certbot/src/certbot/tests/acme_util.py b/certbot/src/certbot/tests/acme_util.py index aa320dd88..56a965cda 100644 --- a/certbot/src/certbot/tests/acme_util.py +++ b/certbot/src/certbot/tests/acme_util.py @@ -21,6 +21,9 @@ DNS01_2 = challenges.DNS01(token=b"cafecafecafecafecafecafe0feedbac") DNS_PERSIST_01 = challenges.DNSPersist01( issuer_domain_names=('ca.example',), account_uri='https://ca.example/acct/123') +DNS_PERSIST_01_LONG = challenges.DNSPersist01( + issuer_domain_names=('ca.example',), + account_uri=f"https://ca.example/acct/{'a' * 256}") CHALLENGES = [HTTP01, DNS01] @@ -44,6 +47,7 @@ HTTP01_P = chall_to_challb(HTTP01, messages.STATUS_PENDING) DNS01_P = chall_to_challb(DNS01, messages.STATUS_PENDING) DNS01_P_2 = chall_to_challb(DNS01_2, messages.STATUS_PENDING) DNS_PERSIST_01_P = chall_to_challb(DNS_PERSIST_01, messages.STATUS_PENDING) +DNS_PERSIST_01_LONG_P = chall_to_challb(DNS_PERSIST_01_LONG, messages.STATUS_PENDING) # AnnotatedChallenge objects @@ -53,9 +57,11 @@ DNS01_A = auth_handler.challb_to_achall(DNS01_P, JWK, messages.Identifier( typ=messages.IDENTIFIER_FQDN, value="example.org")) DNS01_A_2 = auth_handler.challb_to_achall(DNS01_P_2, JWK, messages.Identifier( typ=messages.IDENTIFIER_FQDN, value="esimerkki.example.org")) -DNS_PERSIST_01_A = auth_handler.challb_to_achall(DNS_PERSIST_01_P, JWK, messages.Identifier( - typ=messages.IDENTIFIER_FQDN, value="example.net")) -DNS_PERSIST_01_A_WILDCARD = auth_handler.challb_to_achall(DNS_PERSIST_01_P, JWK, +DNS_PERSIST_01_A = auth_handler.challb_to_achall(DNS_PERSIST_01_P, JWK, + messages.Identifier(typ=messages.IDENTIFIER_FQDN, value="example.net")) +DNS_PERSIST_01_LONG_A = auth_handler.challb_to_achall(DNS_PERSIST_01_LONG_P, JWK, + messages.Identifier(typ=messages.IDENTIFIER_FQDN, value="example.net")) +DNS_PERSIST_01_A_WILDCARD_A = auth_handler.challb_to_achall(DNS_PERSIST_01_P, JWK, messages.Identifier(typ=messages.IDENTIFIER_FQDN, value="*.example.net"))