Commit Graph
7326 Commits
Author SHA1 Message Date
Brad WarrenandPeter Eckersley 12edbb53db Fixes #3954 and adds a test to prevent regressions (#3957)
* fixes #3954 and adds test to prevent regressions

* assure pylint I know what I'm doing

* Test FileDisplay methods take force_interactive
2016-12-23 10:49:51 -08:00
Peter EckersleyandGitHub 839ff7a265 Merge pull request #3941 from certbot/ocsp
OCSP checking and other cool "certbot certificates" features
2016-12-22 16:21:29 -08:00
Peter Eckersley 9aa93c05c1 Simplify the ocsp_revoked() return type
- we weren't reacting to None, so call it False instead
2016-12-22 15:35:29 -08:00
Peter Eckersley 19143d8303 Increase test coverage 2016-12-22 13:07:00 -08:00
Brad WarrenandGitHub 39f5551305 Merge the manual and script plugins (#3890)
* Start of combined manual/script plugin

* Return str from hooks.execute, not bytes

* finish manual/script rewrite

* delete old manual and script plugins

* manually specify we want chall.token

* use consistent quotes

* specify chall for uri

* s/script/hook

* fix spacing on instructions

* remove unneeded response argument

* make achall more helpful

* simplify perform

* remove old test files

* add start of manual_tests

* fix ParseTest.test_help

* stop using manual_test_mode in cli tests

* Revert "make achall more helpful"

This reverts commit 54b01cea30.

* use bad response/validation methods on achalls

* simplify perform and cleanup environment

* finish manual tests

* Add HTTP manual hook integration test

* add manual http scripts

* Add manual DNS script integration test

* remove references to the script plugin

* they're hooks, not scripts

* add --manual-public-ip-logging-ok to integration tests

* use --pref-chall for dns integration

* does dns work?

* validate hooks

* test hook validation

* Revert "does dns work?"

This reverts commit 1224cc2961.

* busy wait in manual-http-auth

* remove DNS script test for now

* Fix challenge prefix and add trailing .

* Add comment about universal_newlines

* Fix typo from 0464ba2c4

* fix nits and typos

* Generalize HookCOmmandNotFound error

* Add verify_exe_exists

* Don't duplicate code in hooks.py

* Revert changes to hooks.py

* Use consistent hook error messages
2016-12-22 08:24:08 -08:00
Peter Eckersley 7014ab5fd0 lint 2016-12-21 23:20:19 -08:00
Peter Eckersley 61e822a897 Add a few more tests 2016-12-21 21:50:19 -08:00
Peter Eckersley e2d8630f5e py3fix 2016-12-21 14:42:35 -08:00
Peter Eckersley 0ed3213989 Remove --check-ocsp flag
- Might have been occasionally useful, but simplicity
 - Add some missing tests, remove some obsolete ones
2016-12-21 14:38:26 -08:00
Peter Eckersley 76b8c53566 Tests for ocsp.py, and associated fixes 2016-12-21 14:38:26 -08:00
Peter Eckersley f495863da9 Check --check-ocsp flags, and test those checks 2016-12-21 14:38:26 -08:00
Peter Eckersley 509f4029bb more py3 fixes 2016-12-21 14:38:26 -08:00
Peter Eckersley 7d02b8dbd5 py3fix 2016-12-21 14:38:26 -08:00
Peter Eckersley fcf7387c3d Don't crash if openssl is missing 2016-12-21 14:38:26 -08:00
Peter Eckersley 011f6055d4 Better message 2016-12-21 14:38:26 -08:00
Peter Eckersley bf6084db61 With mixed staging/prod lineages, it might not be correct to stop OCSPing
- One lineage might fail, and a later one succeed
2016-12-21 14:38:26 -08:00
Peter Eckersley 15ed372df6 Fix existing tests 2016-12-21 14:38:26 -08:00
Peter Eckersley 03f312e653 Allow filtering of "certbot certificates output" with --config-name or -d 2016-12-21 14:38:26 -08:00
Peter Eckersley e5e5db24d7 CLI flag for controlling ocsp checking now works 2016-12-21 14:38:26 -08:00
Peter Eckersley 840c584cbd Make the OCSP checker a class
(Since it contains a reasonable amount of system state)
2016-12-21 14:38:26 -08:00
Peter Eckersley 7a18a124ce Better error handling 2016-12-21 14:38:26 -08:00
Peter Eckersley fe36e336a8 Run with both old and new versions of openssl 2016-12-21 14:38:26 -08:00
Peter Eckersley 245b84ab78 Format CLI to keep modern openssls happy
- This is somewhat ominous
2016-12-21 14:38:26 -08:00
Peter Eckersley ac02cd9cb8 ocsp checking needs -verify_other
https://community.letsencrypt.org/t/unable-to-verify-ocsp-response/7264
2016-12-21 14:38:26 -08:00
Peter Eckersley 40e29bb95f begin implementing OCSP checking for "certificates" 2016-12-21 14:38:20 -08:00
James KastenandPeter Eckersley 15d2a0ffde Import OCSP code from the historical cert_manager branch
(This is pde committing jdkasten's code)
2016-12-21 14:36:51 -08:00
Tan Jay JunandPeter Eckersley 44d5886429 Add missing comma to documentation for 'renew' subcommand (#3945) 2016-12-21 14:21:52 -08:00
Erica PortnoyandGitHub 8ebca1c052 Return domains for _find_domains_or_certname (#3937)
* Return domains for _find_domains_or_certname

* Revamp find_domains_or_certname
2016-12-20 17:17:01 -08:00
Brad WarrenandPeter Eckersley 00e143d369 Serialize coverage tests (#3919)
* Serialize coverage tests

* add py27_install env

* Separate cover from integration tests

* Add docker to py27 integration tests
2016-12-20 16:24:33 -08:00
Brad WarrenandGitHub 28ce10fef5 Don't add ServerAlias directives when the domain is already covered by a wildcard (#3917)
* correctly match * and ? in ServerAlias directives

* update Apache wildcard test

* Consolidate wildcard matching and remove bad test

* Test Apache vhost selection with wildcards

* Added few more tests to proof vhost selection
2016-12-20 15:53:52 -08:00
Brad WarrenandPeter Eckersley f92254769b I promise checklists are OK (fixes #3934) (#3940)
* TIL checklist calls input

* full coverage on certbot/display/util.py

* improve no double warning test
2016-12-20 14:34:12 -08:00
Craig SmithandBrad Warren 6a933f1de3 Changed plugin interface return types (#3748). (#3780) 2016-12-19 18:02:05 -08:00
Lior SabagandPeter Eckersley acc501d3a1 Fix typo (#3932) 2016-12-19 12:49:27 -08:00
Brad WarrenandPeter Eckersley ae379568b1 Mitigate problems for people who run without -n (#3916)
* CLI flag for forcing interactivity

* add --force-interactive

* Add force_interactive error checking and tests

* Add force_interactive parameter to FileDisplay

* add _can_interact

* Add _return_default

* Add **unused_kwargs to NoninteractiveDisplay

* improve _return_default assertion

* Change IDisplay calls and write tests

* Document force_interactive in interfaces.py

* Don't force_interactive with a new prompt

* Warn when skipping an interaction for the first time

* add specific logger.debug message
2016-12-19 12:45:40 -08:00
Erica PortnoyandGitHub 81fd0cd32c Implement delete command (#3913)
* organize cert_manager.py

* add delete files to cert manager and storage

* add tests

* add to main and cli

* Clean up all related files we can find, even if some are missing.

* error messages, debug logs, and remove RenewerConfiguration

* add logs for failure to remove

* remove renewer_config_file
2016-12-15 20:23:02 -08:00
Erica PortnoyandPeter Eckersley 16361bfd06 test using os.path.sep not hardcoded / (#3920) 2016-12-15 19:41:42 -08:00
Erica PortnoyandBrad Warren 27525fb205 Use relative paths for livedir symlinks (#3914)
* Use relative paths for livedir symlinks

* switch directory back for the rest of the tests
2016-12-15 11:00:07 -08:00
Peter EckersleyandGitHub 107851ee9b Document defaults (#3863)
* Begin fixing incorrect defaults

* Fix more defaults

* Make more defaults correct

* Update cli-help.txt

(To show what this PR does)

* Lint

* Extend argparse rather than vendoring it

* lint

* Move sample User Agent generation into the same module as UA generation

* Revert cli-help.txt to previous release version

* Slightly more consistent linebreaks
2016-12-13 17:32:46 -08:00
Clif HouckandBrad Warren ad53c80c1e Fix certbox-nginx address equality check (#3886)
0.0.0.0, *, and '' are equivalent hosts to nginx. Changes Addr object's
equality testing to treat them as equal.

Fixes #3855
2016-12-13 14:38:57 -08:00
Peter EckersleyandGitHub 0464ba2c4b Implement our fancy new --help output (#3883)
* Start reorganising -h output

* Fix the --debug flag

  - Currently exceptions are often caught and burried in log files, even
    if this flag is provided!

* Explain the insanity

* Parallalelise nosetests from tox (#3836)

* Parallalelise nosetests from tox

* Parallelise even more things, break even more things

* Now unbreak all the tests that aren't ready for ||ism

* Try to pass tests!

 - Remove non-working hack in reporter_test
 - also be selective about ||ism in the cover environment

* Try again

* certbot-apache tests also work, given enough time

* Nginx may need more time in Travis's cloud

* Unbreak reporter_test under ||ism

* More timeout

* Working again?

* This goes way faster

* Another big win

* Split a couple more large test suites

* A last improvement

* More ||ism!

* ||ise lint too

* Allow nosetests to figure out how many cores to use

* simplify merge

* Mark the new CLI tests as ||izable

* Simplify reporter_test changes

* Rationalise ||ism flags

* Re-up coverage

* Clean up reporter tests

* Stop modifying testdata during tests

* remove unused os

* Improve the "certbot certificates" output (#3846)

* Begin making "certbot certificates" future safe

* Handle the case where a renewal conf file has no "server" entry

* Improvements, tweaks

* Capitalise on things

* Print the command summary for -h and -h all, but not otherwise

Also, update nginx not installed CLI hint

* Add a "certificates" help section

* Clean up usage string construction

* Greatly improve "certbot -h TOPIC"

  - subcommands now get their own usage headings if they want them
  - added "certbot -h commands"

* A few more cli formatting tests

* Auto-populate the verb subgroups from the docs

* Show the new help output

* Lint, tweak

* More lint, and cleanup

* Infinite lint

* Add rename to command summary; sort "-h commands" output

* Use fancy string formatting

* More space

* Implement --help manage

Also, implement a general mechanism for documenting subcommands within
topics

* Remove one comma

* Only create weird parser structures if -h is provided :)

* Update sample cli out

* Lint

* Revert cli-help.txt to previous release version

* Grammar & style
2016-12-13 14:19:47 -08:00
MaartenandPeter Eckersley dc81c291b4 Change link of haproxy plugin to new version (#3904)
Greenhost has rewritten their HAProxy plugin and it's hosted on a different location. The original URL also points to this new location: https://code.greenhost.net/open/letsencrypt-haproxy
2016-12-13 13:13:55 -08:00
Peter EckersleyandBrad Warren 2d7f6d7d92 Ensure apt-cache is always running in English if we're going to grep its output (#3900) 2016-12-12 17:20:52 -08:00
FrankandPeter Eckersley e6f24db624 Sort the names by domain (then subdomain) before showing them (#3892)
* Sort the names by domain (then subdomain) before showing them

* Sort the names in display + tests
2016-12-11 02:18:32 -08:00
Joona HoikkalaandPeter Eckersley e9f040e209 Make default renewal file permissions more strict (#3891) 2016-12-10 11:19:20 -08:00
Peter EckersleyandBrad Warren 22e0f5779a Fix --debug (#3877)
* Fix the --debug flag

  - Currently exceptions are often caught and burried in log files, even
    if this flag is provided!

* Explain the insanity

* Make things slightly nicer
2016-12-09 14:56:14 -08:00
Brad WarrenandPeter Eckersley 9bdb3d67bc make our linter happy (#3881) 2016-12-08 20:29:59 -08:00
Erica PortnoyandPeter Eckersley 4a4977a54d Make renew command respect the --cert-name flag (#3880)
* Renew command respects --cert-name flag

* Error out early if requested cert doesn't exist
2016-12-08 18:27:23 -08:00
Erica PortnoyandGitHub 0a7ca2f32e Implement the --cert-name flag to select a lineage by its name, and the rename verb. (#3785)
* Rename and simplify main functions

* pass certname to auth method

* find cert by certname flag

* Implement --cert-name command

* don't ask to confirm new cert when we have domains and no existing certs with the lineage name

* Refactor and add --new-cert-name flag

* add interactivity to rename verb

* allow noninteractive and more descriptive function names
2016-12-08 11:53:30 -08:00
Peter EckersleyandErica Portnoy cc86ff2a21 Improve the "certbot certificates" output (#3846)
* Begin making "certbot certificates" future safe

* Handle the case where a renewal conf file has no "server" entry
2016-12-07 16:02:13 -08:00
Peter EckersleyandGitHub 59c602d9ca Parallalelise nosetests from tox (#3836)
* Parallalelise nosetests from tox

* Parallelise even more things, break even more things

* Now unbreak all the tests that aren't ready for ||ism

* Try to pass tests!

 - Remove non-working hack in reporter_test
 - also be selective about ||ism in the cover environment

* Try again

* certbot-apache tests also work, given enough time

* Nginx may need more time in Travis's cloud

* Unbreak reporter_test under ||ism

* More timeout

* Working again?

* This goes way faster

* Another big win

* Split a couple more large test suites

* A last improvement

* More ||ism!

* ||ise lint too

* Allow nosetests to figure out how many cores to use

* simplify merge

* Mark the new CLI tests as ||izable

* Simplify reporter_test changes

* Rationalise ||ism flags

* Re-up coverage

* Clean up reporter tests

* Stop modifying testdata during tests

* remove unused os
2016-12-06 20:39:16 -08:00