Merge pull request #3393 from certbot/nginx-compatibility-test

Nginx compatibility test

.travis.yml

@@ -34,6 +34,8 @@ matrix:
     - python: "2.7"
       env: TOXENV=apacheconftest
       sudo: required
+    - python: "2.7"
+      env: TOXENV=nginxroundtrip
     - python: "2.7"
       env: TOXENV=py27 BOULDER_INTEGRATION=1
       sudo: true
@@ -53,6 +55,16 @@ matrix:
       services: docker
       before_install:
       addons:
+    - sudo: required
+      env: TOXENV=apache_compat
+      services: docker
+      before_install:
+      addons:
+    - sudo: required
+      env: TOXENV=nginx_compat
+      services: docker
+      before_install:
+      addons:
     - python: "2.7"
       env: TOXENV=cover
     - python: "3.3"

certbot-compatibility-test/Dockerfile

@@ -0,0 +1,51 @@
+FROM debian:jessie
+MAINTAINER Brad Warren <bmw@eff.org>
+
+# no need to mkdir anything:
+# https://docs.docker.com/reference/builder/#copy
+# If <dest> doesn't exist, it is created along with all missing
+# directories in its path.
+
+# TODO: Install non-default Python versions for tox.
+# TODO: Install Apache/Nginx for plugin development.
+COPY certbot-auto /opt/certbot/src/certbot-auto
+RUN /opt/certbot/src/certbot-auto -n --os-packages-only
+
+# the above is not likely to change, so by putting it further up the
+# Dockerfile we make sure we cache as much as possible
+
+COPY setup.py README.rst CHANGES.rst MANIFEST.in linter_plugin.py tox.cover.sh tox.ini pep8.travis.sh .pep8 .pylintrc /opt/certbot/src/
+
+# all above files are necessary for setup.py, however, package source
+# code directory has to be copied separately to a subdirectory...
+# https://docs.docker.com/reference/builder/#copy: "If <src> is a
+# directory, the entire contents of the directory are copied,
+# including filesystem metadata. Note: The directory itself is not
+# copied, just its contents." Order again matters, three files are far
+# more likely to be cached than the whole project directory
+
+COPY certbot /opt/certbot/src/certbot/
+COPY acme /opt/certbot/src/acme/
+COPY certbot-apache /opt/certbot/src/certbot-apache/
+COPY certbot-nginx /opt/certbot/src/certbot-nginx/
+COPY certbot-compatibility-test /opt/certbot/src/certbot-compatibility-test/
+
+RUN virtualenv --no-site-packages -p python2 /opt/certbot/venv && \
+    /opt/certbot/venv/bin/pip install -U setuptools && \
+    /opt/certbot/venv/bin/pip install -U pip && \
+    /opt/certbot/venv/bin/pip install \
+    -e /opt/certbot/src/acme \
+    -e /opt/certbot/src \
+    -e /opt/certbot/src/certbot-apache \
+    -e /opt/certbot/src/certbot-nginx \
+    -e /opt/certbot/src/certbot-compatibility-test \
+    -e /opt/certbot/src[dev,docs]
+
+# install in editable mode (-e) to save space: it's not possible to
+# "rm -rf /opt/certbot/src" (it's stays in the underlaying image);
+# this might also help in debugging: you can "docker run --entrypoint
+# bash" and investigate, apply patches, etc.
+
+WORKDIR /opt/certbot/src/certbot-compatibility-test/certbot_compatibility_test/testdata
+
+ENV PATH /opt/certbot/venv/bin:$PATH

certbot-compatibility-test/Dockerfile-apache

@@ -0,0 +1,6 @@
+FROM certbot-compatibility-test
+MAINTAINER Brad Warren <bmw@eff.org>
+
+RUN apt-get install apache2 -y
+
+ENTRYPOINT [ "certbot-compatibility-test", "-p", "apache" ]

certbot-compatibility-test/Dockerfile-nginx

@@ -0,0 +1,6 @@
+FROM certbot-compatibility-test
+MAINTAINER Brad Warren <bmw@eff.org>
+
+RUN apt-get install nginx -y
+
+ENTRYPOINT [ "certbot-compatibility-test", "-p", "nginx" ]

certbot-compatibility-test/certbot_compatibility_test/configurators/apache/Dockerfile

@@ -1,20 +0,0 @@
-FROM httpd
-MAINTAINER Brad Warren <bradmw@umich.edu>
-
-RUN mkdir /var/run/apache2
-
-ENV APACHE_RUN_USER=daemon \
-    APACHE_RUN_GROUP=daemon \
-    APACHE_PID_FILE=/usr/local/apache2/logs/httpd.pid \
-    APACHE_RUN_DIR=/var/run/apache2 \
-    APACHE_LOCK_DIR=/var/lock \
-    APACHE_LOG_DIR=/usr/local/apache2/logs 
-
-COPY certbot-compatibility-test/certbot_compatibility_test/configurators/apache/a2enmod.sh /usr/local/bin/
-COPY certbot-compatibility-test/certbot_compatibility_test/configurators/apache/a2dismod.sh /usr/local/bin/
-COPY certbot-compatibility-test/certbot_compatibility_test/testdata/rsa1024_key2.pem /usr/local/apache2/conf/
-COPY certbot-compatibility-test/certbot_compatibility_test/testdata/empty_cert.pem /usr/local/apache2/conf/
-
-# Note: this only exposes the port to other docker containers. You
-# still have to bind to 443@host at runtime.
-EXPOSE 443

certbot-compatibility-test/certbot_compatibility_test/configurators/apache/common.py

@@ -1,5 +1,4 @@
 """Provides a common base for Apache proxies"""
-import re
 import os
 import shutil
 import subprocess
@@ -17,10 +16,6 @@ from certbot_compatibility_test import util
 from certbot_compatibility_test.configurators import common as configurators_common
 
 
-APACHE_VERSION_REGEX = re.compile(r"Apache/([0-9\.]*)", re.IGNORECASE)
-APACHE_COMMANDS = ["apachectl", "a2enmod", "a2dismod"]
-
-
 @zope.interface.implementer(interfaces.IConfiguratorProxy)
 class Proxy(configurators_common.Proxy):
     # pylint: disable=too-many-instance-attributes
@@ -32,37 +27,25 @@ class Proxy(configurators_common.Proxy):
         self.le_config.apache_le_vhost_ext = "-le-ssl.conf"
 
         self.modules = self.server_root = self.test_conf = self.version = None
-        self._apache_configurator = self._all_names = self._test_names = None
         patch = mock.patch(
             "certbot_apache.configurator.display_ops.select_vhost")
         mock_display = patch.start()
         mock_display.side_effect = le_errors.PluginError(
             "Unable to determine vhost")
 
-    def __getattr__(self, name):
-        """Wraps the Apache Configurator methods"""
-        method = getattr(self._apache_configurator, name, None)
-        if callable(method):
-            return method
-        else:
-            raise AttributeError()
-
     def load_config(self):
         """Loads the next configuration for the plugin to test"""
-
         config = super(Proxy, self).load_config()
         self._all_names, self._test_names = _get_names(config)
 
         server_root = _get_server_root(config)
-        # with open(os.path.join(config, "config_file")) as f:
-        #    config_file = os.path.join(server_root, f.readline().rstrip())
         shutil.rmtree("/etc/apache2")
         shutil.copytree(server_root, "/etc/apache2", symlinks=True)
 
         self._prepare_configurator()
 
         try:
-            subprocess.check_call("apachectl -k start".split())
+            subprocess.check_call("apachectl -k restart".split())
         except errors.Error:
             raise errors.Error(
                 "Apache failed to load {0} before tests started".format(
@@ -78,38 +61,16 @@ class Proxy(configurators_common.Proxy):
         # An alias
         self.le_config.apache_handle_modules = self.le_config.apache_handle_mods
 
-        self._apache_configurator = configurator.ApacheConfigurator(
+        self._configurator = configurator.ApacheConfigurator(
             config=configuration.NamespaceConfig(self.le_config),
             name="apache")
-        self._apache_configurator.prepare()
+        self._configurator.prepare()
 
     def cleanup_from_tests(self):
         """Performs any necessary cleanup from running plugin tests"""
         super(Proxy, self).cleanup_from_tests()
         mock.patch.stopall()
 
-    def get_all_names_answer(self):
-        """Returns the set of domain names that the plugin should find"""
-        if self._all_names:
-            return self._all_names
-        else:
-            raise errors.Error("No configuration file loaded")
-
-    def get_testable_domain_names(self):
-        """Returns the set of domain names that can be tested against"""
-        if self._test_names:
-            return self._test_names
-        else:
-            return {"example.com"}
-
-    def deploy_cert(self, domain, cert_path, key_path, chain_path=None,
-                    fullchain_path=None):
-        """Installs cert"""
-        cert_path, key_path, chain_path = self.copy_certs_and_keys(
-            cert_path, key_path, chain_path)
-        self._apache_configurator.deploy_cert(
-            domain, cert_path, key_path, chain_path, fullchain_path)
-
 
 def _get_server_root(config):
     """Returns the server root directory in config"""

certbot-compatibility-test/certbot_compatibility_test/configurators/common.py

@@ -5,6 +5,7 @@ import shutil
 import tempfile
 
 from certbot import constants
+from certbot_compatibility_test import errors
 from certbot_compatibility_test import util
 
 
@@ -31,6 +32,18 @@ class Proxy(object):
         self.args = args
         self.http_port = 80
         self.https_port = 443
+        self._configurator = self._all_names = self._test_names = None
+
+    def __getattr__(self, name):
+        """Wraps the configurator methods"""
+        if self._configurator is None:
+            raise AttributeError()
+
+        method = getattr(self._configurator, name, None)
+        if callable(method):
+            return method
+        else:
+            raise AttributeError()
 
     def has_more_configs(self):
         """Returns true if there are more configs to test"""
@@ -63,3 +76,25 @@ class Proxy(object):
             chain = None
 
         return cert, key, chain
+
+    def get_all_names_answer(self):
+        """Returns the set of domain names that the plugin should find"""
+        if self._all_names:
+            return self._all_names
+        else:
+            raise errors.Error("No configuration file loaded")
+
+    def get_testable_domain_names(self):
+        """Returns the set of domain names that can be tested against"""
+        if self._test_names:
+            return self._test_names
+        else:
+            return {"example.com"}
+
+    def deploy_cert(self, domain, cert_path, key_path, chain_path=None,
+                    fullchain_path=None):
+        """Installs cert"""
+        cert_path, key_path, chain_path = self.copy_certs_and_keys(
+            cert_path, key_path, chain_path)
+        self._configurator.deploy_cert(
+            domain, cert_path, key_path, chain_path, fullchain_path)

certbot-compatibility-test/certbot_compatibility_test/configurators/nginx/__init__.py

@@ -0,0 +1 @@
+"""Certbot compatibility test Nginx configurators"""

certbot-compatibility-test/certbot_compatibility_test/configurators/nginx/common.py

@@ -0,0 +1,84 @@
+"""Provides a common base for Nginx proxies"""
+import os
+import shutil
+import subprocess
+
+import zope.interface
+
+from certbot import configuration
+from certbot_nginx import configurator
+from certbot_nginx import constants
+from certbot_compatibility_test import errors
+from certbot_compatibility_test import interfaces
+from certbot_compatibility_test import util
+from certbot_compatibility_test.configurators import common as configurators_common
+
+
+@zope.interface.implementer(interfaces.IConfiguratorProxy)
+class Proxy(configurators_common.Proxy):
+    # pylint: disable=too-many-instance-attributes
+    """A common base for Nginx test configurators"""
+
+    def __init__(self, args):
+        """Initializes the plugin with the given command line args"""
+        super(Proxy, self).__init__(args)
+
+    def load_config(self):
+        """Loads the next configuration for the plugin to test"""
+        config = super(Proxy, self).load_config()
+        self._all_names, self._test_names = _get_names(config)
+
+        server_root = _get_server_root(config)
+
+        # XXX: Deleting all of this is kind of scary unless the test
+        #      instances really each have a complete configuration!
+        shutil.rmtree("/etc/nginx")
+        shutil.copytree(server_root, "/etc/nginx", symlinks=True)
+
+        self._prepare_configurator()
+
+        try:
+            subprocess.check_call("service nginx reload".split())
+        except errors.Error:
+            raise errors.Error(
+                "Nginx failed to load {0} before tests started".format(
+                    config))
+
+        return config
+
+    def _prepare_configurator(self):
+        """Prepares the Nginx plugin for testing"""
+        for k in constants.CLI_DEFAULTS.keys():
+            setattr(self.le_config, "nginx_" + k, constants.os_constant(k))
+
+        conf = configuration.NamespaceConfig(self.le_config)
+        zope.component.provideUtility(conf)
+        self._configurator = configurator.NginxConfigurator(
+            config=conf, name="nginx")
+        self._configurator.prepare()
+
+
+def _get_server_root(config):
+    """Returns the server root directory in config"""
+    subdirs = [
+        name for name in os.listdir(config)
+        if os.path.isdir(os.path.join(config, name))]
+
+    if len(subdirs) != 1:
+        raise errors.Error("Malformed configuration directory {0}".format(config))
+
+    return os.path.join(config, subdirs[0].rstrip())
+
+
+def _get_names(config):
+    """Returns all and testable domain names in config"""
+    all_names = set()
+    for root, _dirs, files in os.walk(config):
+        for this_file in files:
+            for line in open(os.path.join(root, this_file)):
+                if line.strip().startswith("server_name"):
+                    names = line.partition("server_name")[2].rpartition(";")[0]
+                    for n in names.split():
+                        all_names.add(n)
+    non_ip_names = set(n for n in all_names if not util.IP_REGEX.match(n))
+    return all_names, non_ip_names

certbot-compatibility-test/certbot_compatibility_test/test_driver.py

@@ -22,7 +22,8 @@ from certbot_compatibility_test import errors
 from certbot_compatibility_test import util
 from certbot_compatibility_test import validator
 
-from certbot_compatibility_test.configurators.apache import common
+from certbot_compatibility_test.configurators.apache import common as a_common
+from certbot_compatibility_test.configurators.nginx import common as n_common
 
 
 DESCRIPTION = """
@@ -32,7 +33,7 @@ tests that the plugin supports are performed.
 
 """
 
-PLUGINS = {"apache": common.Proxy}
+PLUGINS = {"apache": a_common.Proxy, "nginx": n_common.Proxy}
 
 
 logger = logging.getLogger(__name__)
@@ -143,7 +144,7 @@ def test_deploy_cert(plugin, temp_dir, domains):
 
     for domain in domains:
         try:
-            plugin.deploy_cert(domain, cert_path, util.KEY_PATH, cert_path)
+            plugin.deploy_cert(domain, cert_path, util.KEY_PATH, cert_path, cert_path)
             plugin.save()  # Needed by the Apache plugin
         except le_errors.Error as error:
             logger.error("Plugin failed to deploy ceritificate for %s:", domain)

certbot-nginx/certbot_nginx/constants.py

@@ -16,3 +16,17 @@ MOD_SSL_CONF_SRC = pkg_resources.resource_filename(
     "certbot_nginx", "options-ssl-nginx.conf")
 """Path to the nginx mod_ssl config file found in the Certbot
 distribution."""
+
+def os_constant(key):
+    # XXX TODO: In the future, this could return different constants
+    #           based on what OS we are running under.  To see an
+    #           approach to how to handle different OSes, see the
+    #           apache version of this file.  Currently, we do not
+    #           actually have any OS-specific constants on Nginx.
+    """
+    Get a constant value for operating system
+
+    :param key: name of cli constant
+    :return: value of constant for active os
+    """
+    return CLI_DEFAULTS[key]

certbot-nginx/certbot_nginx/tls_sni_01.py

@@ -91,10 +91,10 @@ class NginxTlsSni01(common.TLSSNI01):
         # Add the 'include' statement for the challenges if it doesn't exist
         # already in the main config
         included = False
-        include_directive = ['include', ' ', self.challenge_conf]
+        include_directive = ['\n', 'include', ' ', self.challenge_conf]
         root = self.configurator.parser.loc["root"]
 
-        bucket_directive = ['server_names_hash_bucket_size', ' ', '128']
+        bucket_directive = ['\n', 'server_names_hash_bucket_size', ' ', '128']
 
         main = self.configurator.parser.parsed[root]
         for key, body in main:

tox.ini

@@ -80,6 +80,10 @@ commands =
     pip install -e acme -e .[dev] -e certbot-apache -e certbot-nginx -e certbot-compatibility-test -e letshelp-certbot
     {toxinidir}/certbot-apache/certbot_apache/tests/apache-conf-files/apache-conf-test --debian-modules
 
+[testenv:nginxroundtrip]
+commands =
+    pip install -e acme[dev] -e .[dev] -e certbot-nginx
+    python certbot-compatibility-test/nginx/roundtrip.py certbot-compatibility-test/nginx/nginx-roundtrip-testdata
 
 [testenv:le_auto]
 # At the moment, this tests under Python 2.7 only, as only that version is
@@ -90,3 +94,21 @@ commands =
 whitelist_externals =
     docker
 passenv = DOCKER_*
+
+[testenv:apache_compat]
+commands =
+    docker build -t certbot-compatibility-test -f certbot-compatibility-test/Dockerfile .
+    docker build -t apache-compat -f certbot-compatibility-test/Dockerfile-apache .
+    docker run --rm -it apache-compat -c apache.tar.gz -vvvv
+whitelist_externals =
+    docker
+passenv = DOCKER_*
+
+[testenv:nginx_compat]
+commands =
+    docker build -t certbot-compatibility-test -f certbot-compatibility-test/Dockerfile .
+    docker build -t nginx-compat -f certbot-compatibility-test/Dockerfile-nginx .
+    docker run --rm -it nginx-compat -c nginx.tar.gz -vvvv
+whitelist_externals =
+    docker
+passenv = DOCKER_*