Fix --allow-subset-of-names (#5690)

* Remove aauthzr instance variable

* If domain begins with fail, fail the challenge.

* test --allow-subset-of-names

* Fix renewal and add extra check

* test after hook checks

tests/boulder-integration.sh

@@ -327,6 +327,19 @@ CheckDirHooks 1
 common renew --cert-name le2.wtf
 CheckDirHooks 1
 
+# manual-dns-auth.sh will skip completing the challenge for domains that begin
+# with fail.
+common -a manual -d dns1.le.wtf,fail.dns1.le.wtf \
+    --allow-subset-of-names \
+    --preferred-challenges dns,tls-sni \
+    --manual-auth-hook ./tests/manual-dns-auth.sh \
+    --manual-cleanup-hook ./tests/manual-dns-cleanup.sh
+
+if common certificates | grep "fail\.dns1\.le\.wtf"; then
+    echo "certificate should not have been issued for domain!" >&2
+    exit 1
+fi
+
 # ECDSA
 openssl ecparam -genkey -name secp384r1 -out "${root}/privkey-p384.pem"
 SAN="DNS:ecdsa.le.wtf" openssl req -new -sha256 \

tests/manual-dns-auth.sh

@@ -1,4 +1,8 @@
-#!/bin/sh
-curl -X POST 'http://localhost:8055/set-txt' -d \
-    "{\"host\": \"_acme-challenge.$CERTBOT_DOMAIN.\", \
-     \"value\": \"$CERTBOT_VALIDATION\"}"
+#!/bin/bash
+
+# If domain begins with fail, fail the challenge by not completing it.
+if [[ "$CERTBOT_DOMAIN" != fail* ]]; then
+    curl -X POST 'http://localhost:8055/set-txt' -d \
+        "{\"host\": \"_acme-challenge.$CERTBOT_DOMAIN.\", \
+         \"value\": \"$CERTBOT_VALIDATION\"}"
+fi

tests/manual-dns-cleanup.sh

@@ -1,3 +1,8 @@
-#!/bin/sh
-curl -X POST 'http://localhost:8055/clear-txt' -d \
-    "{\"host\": \"_acme-challenge.$CERTBOT_DOMAIN.\"}"
+#!/bin/bash
+
+# If domain begins with fail, we didn't complete the challenge so there is
+# nothing to clean up.
+if [[ "$CERTBOT_DOMAIN" != fail* ]]; then
+    curl -X POST 'http://localhost:8055/clear-txt' -d \
+        "{\"host\": \"_acme-challenge.$CERTBOT_DOMAIN.\"}"
+fi