From 55d4365a46cef56228851ac9f7e6c47846eaff88 Mon Sep 17 00:00:00 2001 From: Joe Ranweiler Date: Wed, 2 Dec 2015 21:30:05 -0800 Subject: [PATCH 01/11] Expect a fixed standalone challenge preference --- letsencrypt/plugins/standalone_test.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/letsencrypt/plugins/standalone_test.py b/letsencrypt/plugins/standalone_test.py index 26a040c2e..91b7b56a0 100644 --- a/letsencrypt/plugins/standalone_test.py +++ b/letsencrypt/plugins/standalone_test.py @@ -104,8 +104,8 @@ class AuthenticatorTest(unittest.TestCase): self.assertTrue(isinstance(self.auth.more_info(), six.string_types)) def test_get_chall_pref(self): - self.assertEqual(set(self.auth.get_chall_pref(domain=None)), - set([challenges.TLSSNI01, challenges.HTTP01])) + self.assertEqual(self.auth.get_chall_pref(domain=None), + [challenges.TLSSNI01, challenges.HTTP01]) @mock.patch("letsencrypt.plugins.standalone.util") def test_perform_alredy_listening(self, mock_util): From 5054a3dd79b752b9839ba85f120dc43d452078d1 Mon Sep 17 00:00:00 2001 From: Joe Ranweiler Date: Wed, 2 Dec 2015 21:57:31 -0800 Subject: [PATCH 02/11] Fix typo in test name --- letsencrypt/plugins/standalone_test.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/letsencrypt/plugins/standalone_test.py b/letsencrypt/plugins/standalone_test.py index 91b7b56a0..b4aac76b2 100644 --- a/letsencrypt/plugins/standalone_test.py +++ b/letsencrypt/plugins/standalone_test.py @@ -108,7 +108,7 @@ class AuthenticatorTest(unittest.TestCase): [challenges.TLSSNI01, challenges.HTTP01]) @mock.patch("letsencrypt.plugins.standalone.util") - def test_perform_alredy_listening(self, mock_util): + def test_perform_already_listening(self, mock_util): for chall, port in ((challenges.TLSSNI01.typ, 1234), (challenges.HTTP01.typ, 4321)): mock_util.already_listening.return_value = True From 144a678473fd3d2634092adcb72b411c1a3274fb Mon Sep 17 00:00:00 2001 From: Joe Ranweiler Date: Wed, 2 Dec 2015 22:01:55 -0800 Subject: [PATCH 03/11] Encode challenge preference order in constant --- letsencrypt/plugins/standalone.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/letsencrypt/plugins/standalone.py b/letsencrypt/plugins/standalone.py index 8b8612fd1..9efb5d301 100644 --- a/letsencrypt/plugins/standalone.py +++ b/letsencrypt/plugins/standalone.py @@ -108,7 +108,7 @@ class ServerManager(object): in six.iteritems(self._instances)) -SUPPORTED_CHALLENGES = set([challenges.TLSSNI01, challenges.HTTP01]) +SUPPORTED_CHALLENGES = [challenges.TLSSNI01, challenges.HTTP01] def supported_challenges_validator(data): From a0142dbe44e2e8f1530fa35361b044232ec91b2c Mon Sep 17 00:00:00 2001 From: Joe Ranweiler Date: Wed, 2 Dec 2015 22:13:05 -0800 Subject: [PATCH 04/11] Don't randomize challenge preference --- letsencrypt/plugins/standalone.py | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/letsencrypt/plugins/standalone.py b/letsencrypt/plugins/standalone.py index 9efb5d301..496ea7ded 100644 --- a/letsencrypt/plugins/standalone.py +++ b/letsencrypt/plugins/standalone.py @@ -198,9 +198,7 @@ class Authenticator(common.Plugin): def get_chall_pref(self, domain): # pylint: disable=unused-argument,missing-docstring - chall_pref = list(self.supported_challenges) - random.shuffle(chall_pref) # 50% for each challenge - return chall_pref + return SUPPORTED_CHALLENGES def perform(self, achalls): # pylint: disable=missing-docstring if any(util.already_listening(port) for port in self._necessary_ports): From fa558715983956eefec8ed41fab3208a390afea4 Mon Sep 17 00:00:00 2001 From: Joe Ranweiler Date: Wed, 2 Dec 2015 22:14:32 -0800 Subject: [PATCH 05/11] Remove dead import --- letsencrypt/plugins/standalone.py | 1 - 1 file changed, 1 deletion(-) diff --git a/letsencrypt/plugins/standalone.py b/letsencrypt/plugins/standalone.py index 496ea7ded..dc52cf5e7 100644 --- a/letsencrypt/plugins/standalone.py +++ b/letsencrypt/plugins/standalone.py @@ -2,7 +2,6 @@ import argparse import collections import logging -import random import socket import threading From d5511971aa4ea64d67c7181aa16720fce51481c4 Mon Sep 17 00:00:00 2001 From: Joe Ranweiler Date: Wed, 2 Dec 2015 22:50:32 -0800 Subject: [PATCH 06/11] Update plugin help string --- letsencrypt/plugins/standalone.py | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/letsencrypt/plugins/standalone.py b/letsencrypt/plugins/standalone.py index dc52cf5e7..3cd8cd95f 100644 --- a/letsencrypt/plugins/standalone.py +++ b/letsencrypt/plugins/standalone.py @@ -165,10 +165,10 @@ class Authenticator(common.Plugin): @classmethod def add_parser_arguments(cls, add): - add("supported-challenges", help="Supported challenges, " - "order preferences are randomly chosen.", - type=supported_challenges_validator, default=",".join( - sorted(chall.typ for chall in SUPPORTED_CHALLENGES))) + add("supported-challenges", + help="Supported challenges. Prefers tls-sni-01.", + type=supported_challenges_validator, + default=",".join(chall.typ for chall in SUPPORTED_CHALLENGES)) @property def supported_challenges(self): From 8cf47e3aba7dba8090ef8c18c325ff5177dc42ed Mon Sep 17 00:00:00 2001 From: Joe Ranweiler Date: Thu, 3 Dec 2015 00:13:09 -0800 Subject: [PATCH 07/11] Add tests to check that configuration is used The existing tests use the case in which the (configured) supported challenges are equal to the defaults, and in the same (now-fixed) order. These additional tests check that, if we have configured a subset of the supported challenges, then we actually _use_ that configuration. --- letsencrypt/plugins/standalone_test.py | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/letsencrypt/plugins/standalone_test.py b/letsencrypt/plugins/standalone_test.py index b4aac76b2..1833a55fe 100644 --- a/letsencrypt/plugins/standalone_test.py +++ b/letsencrypt/plugins/standalone_test.py @@ -100,6 +100,11 @@ class AuthenticatorTest(unittest.TestCase): self.assertEqual(self.auth.supported_challenges, set([challenges.TLSSNI01, challenges.HTTP01])) + def test_supported_challenges_configured(self): + self.config.standalone_supported_challenges = "tls-sni-01" + self.assertEqual(self.auth.supported_challenges, + set([challenges.TLSSNI01])) + def test_more_info(self): self.assertTrue(isinstance(self.auth.more_info(), six.string_types)) @@ -107,6 +112,11 @@ class AuthenticatorTest(unittest.TestCase): self.assertEqual(self.auth.get_chall_pref(domain=None), [challenges.TLSSNI01, challenges.HTTP01]) + def test_get_chall_pref_configured(self): + self.config.standalone_supported_challenges = "tls-sni-01" + self.assertEqual(self.auth.get_chall_pref(domain=None), + [challenges.TLSSNI01]) + @mock.patch("letsencrypt.plugins.standalone.util") def test_perform_already_listening(self, mock_util): for chall, port in ((challenges.TLSSNI01.typ, 1234), From dbf181ebacd9edf00196dbcfc85fdf2794e2f3c9 Mon Sep 17 00:00:00 2001 From: Joe Ranweiler Date: Thu, 3 Dec 2015 00:28:12 -0800 Subject: [PATCH 08/11] Respect config when stating challenge preferences --- letsencrypt/plugins/standalone.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/letsencrypt/plugins/standalone.py b/letsencrypt/plugins/standalone.py index 3cd8cd95f..1bca3c036 100644 --- a/letsencrypt/plugins/standalone.py +++ b/letsencrypt/plugins/standalone.py @@ -197,7 +197,8 @@ class Authenticator(common.Plugin): def get_chall_pref(self, domain): # pylint: disable=unused-argument,missing-docstring - return SUPPORTED_CHALLENGES + return [chall for chall in SUPPORTED_CHALLENGES + if chall in self.supported_challenges] def perform(self, achalls): # pylint: disable=missing-docstring if any(util.already_listening(port) for port in self._necessary_ports): From c66c6bae1d5edcfbe0716b7e5b3f870e8595e0da Mon Sep 17 00:00:00 2001 From: Joe Ranweiler Date: Fri, 11 Dec 2015 18:00:33 -0800 Subject: [PATCH 09/11] Make `supported_challenges` return a list, not set --- letsencrypt/plugins/standalone.py | 4 ++-- letsencrypt/plugins/standalone_test.py | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/letsencrypt/plugins/standalone.py b/letsencrypt/plugins/standalone.py index 1bca3c036..139764601 100644 --- a/letsencrypt/plugins/standalone.py +++ b/letsencrypt/plugins/standalone.py @@ -173,8 +173,8 @@ class Authenticator(common.Plugin): @property def supported_challenges(self): """Challenges supported by this plugin.""" - return set(challenges.Challenge.TYPES[name] for name in - self.conf("supported-challenges").split(",")) + return [challenges.Challenge.TYPES[name] for name in + self.conf("supported-challenges").split(",")] @property def _necessary_ports(self): diff --git a/letsencrypt/plugins/standalone_test.py b/letsencrypt/plugins/standalone_test.py index 1833a55fe..1e39dee57 100644 --- a/letsencrypt/plugins/standalone_test.py +++ b/letsencrypt/plugins/standalone_test.py @@ -98,12 +98,12 @@ class AuthenticatorTest(unittest.TestCase): def test_supported_challenges(self): self.assertEqual(self.auth.supported_challenges, - set([challenges.TLSSNI01, challenges.HTTP01])) + [challenges.TLSSNI01, challenges.HTTP01]) def test_supported_challenges_configured(self): self.config.standalone_supported_challenges = "tls-sni-01" self.assertEqual(self.auth.supported_challenges, - set([challenges.TLSSNI01])) + [challenges.TLSSNI01]) def test_more_info(self): self.assertTrue(isinstance(self.auth.more_info(), six.string_types)) From 2f904a41e060e468891df53114b5df2ce735fba3 Mon Sep 17 00:00:00 2001 From: Joe Ranweiler Date: Fri, 11 Dec 2015 18:06:11 -0800 Subject: [PATCH 10/11] Derive preference order from `supported_challenges` order --- letsencrypt/plugins/standalone.py | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/letsencrypt/plugins/standalone.py b/letsencrypt/plugins/standalone.py index 139764601..70bf92dbb 100644 --- a/letsencrypt/plugins/standalone.py +++ b/letsencrypt/plugins/standalone.py @@ -197,8 +197,7 @@ class Authenticator(common.Plugin): def get_chall_pref(self, domain): # pylint: disable=unused-argument,missing-docstring - return [chall for chall in SUPPORTED_CHALLENGES - if chall in self.supported_challenges] + return self.supported_challenges def perform(self, achalls): # pylint: disable=missing-docstring if any(util.already_listening(port) for port in self._necessary_ports): From f4d499dbad41ea16759deffd95290a01836bd914 Mon Sep 17 00:00:00 2001 From: Joe Ranweiler Date: Fri, 11 Dec 2015 18:07:25 -0800 Subject: [PATCH 11/11] Make help message indicate derived challenge preference --- letsencrypt/plugins/standalone.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/letsencrypt/plugins/standalone.py b/letsencrypt/plugins/standalone.py index 70bf92dbb..4319e51f9 100644 --- a/letsencrypt/plugins/standalone.py +++ b/letsencrypt/plugins/standalone.py @@ -166,7 +166,7 @@ class Authenticator(common.Plugin): @classmethod def add_parser_arguments(cls, add): add("supported-challenges", - help="Supported challenges. Prefers tls-sni-01.", + help="Supported challenges. Preferred in the order they are listed.", type=supported_challenges_validator, default=",".join(chall.typ for chall in SUPPORTED_CHALLENGES))