Skip to content

Commit a3983b3

Browse files
timkimbertimkimber
authored
Merge pull request srvrco#684 from srvrco/fix-host-idn-bug
Fix host idn bug
2 parents 91d0f13 + 2f51861 commit a3983b3

File tree

6 files changed

+71
-25
lines changed

6 files changed

+71
-25
lines changed

‎getssl

Lines changed: 17 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -263,6 +263,7 @@
263263
# 2021-07-07 Request new certificate if SANs have changed (#669)(#673)
264264
# 2021-07-12 Do not redirect outputs on remote commands when the debug option is used (atisne)
265265
# 2021-07-20 Use +noidnout to enable certificates for IDN domains (#679)(2.37)
266+
# 2021-07-22 Only pass +noidnout param to dig/drill(#682)(2.38)
266267
# ----------------------------------------------------------------------------------------
267268

268269
case :$SHELLOPTS: in
@@ -271,7 +272,7 @@ esac
271272

272273
PROGNAME=${0##*/}
273274
PROGDIR="$(cd "$(dirname "$0")" || exit; pwd -P;)"
274-
VERSION="2.37"
275+
VERSION="2.38"
275276

276277
# defaults
277278
ACCOUNT_KEY_LENGTH=4096
@@ -693,36 +694,35 @@ check_config() { # check the config files for all obvious errors
693694

694695
# check domain exists using all DNS utilities. DNS_CHECK_OPTIONS may bind IP address or provide TSIG
695696

696-
# add +noidnout if idn-domain so search for domain in results works
697-
if [[ "${d}" == xn--* || "${d}" == *".xn--"* ]]; then
698-
if [[ "$HAS_DIG_OR_DRILL" != "dig" || "$DIG_SUPPORTS_NOIDNOUT" == "true" ]]; then
699-
DNS_CHECK_OPTIONS="$DNS_CHECK_OPTIONS +noidnout"
700-
fi
701-
fi
702-
703697
found_ip=false
704698
if [[ -n "$HAS_DIG_OR_DRILL" ]]; then
705-
debug "DNS lookup using $HAS_DIG_OR_DRILL $DNS_CHECK_OPTIONS ${d}"
699+
# add +noidnout if idn-domain so search for domain in results works
700+
DIG_CHECK_OPTIONS="$DNS_CHECK_OPTIONS"
701+
if [[ ("${d}" == xn--* || "${d}" == *".xn--"* ) && "$DIG_SUPPORTS_NOIDNOUT" == "true" ]]; then
702+
DIG_CHECK_OPTIONS="$DNS_CHECK_OPTIONS +noidnout"
703+
fi
704+
705+
debug "DNS lookup using $HAS_DIG_OR_DRILL $DIG_CHECK_OPTIONS ${d}"
706706
# shellcheck disable=SC2086
707-
if [[ "$($HAS_DIG_OR_DRILL $DNS_CHECK_OPTIONS -t SOA "${d}" |grep -c -i "^${d}")" -ge 1 ]]; then
707+
if [[ "$($HAS_DIG_OR_DRILL $DIG_CHECK_OPTIONS -t SOA "${d}" |grep -c -i "^${d}")" -ge 1 ]]; then
708708
found_ip=true
709-
elif [[ "$($HAS_DIG_OR_DRILL $DNS_CHECK_OPTIONS -t A "${d}"|grep -c -i "^${d}")" -ge 1 ]]; then
709+
elif [[ "$($HAS_DIG_OR_DRILL $DIG_CHECK_OPTIONS -t A "${d}"|grep -c -i "^${d}")" -ge 1 ]]; then
710710
found_ip=true
711-
elif [[ "$($HAS_DIG_OR_DRILL $DNS_CHECK_OPTIONS -t AAAA "${d}"|grep -c -i "^${d}")" -ge 1 ]]; then
711+
elif [[ "$($HAS_DIG_OR_DRILL $DIG_CHECK_OPTIONS -t AAAA "${d}"|grep -c -i "^${d}")" -ge 1 ]]; then
712712
found_ip=true
713713
fi
714714
fi
715715

716716
if [[ "$HAS_HOST" == "true" ]]; then
717-
debug "DNS lookup using host ${d}"
717+
debug "DNS lookup using host $DNS_CHECK_OPTIONS ${d}"
718718
# shellcheck disable=SC2086
719719
if [[ "$(host $DNS_CHECK_OPTIONS "${d}" |grep -c -i "^${d}")" -ge 1 ]]; then
720720
found_ip=true
721721
fi
722722
fi
723723

724724
if [[ "$HAS_NSLOOKUP" == "true" ]]; then
725-
debug "DNS lookup using nslookup -query AAAA ${d}"
725+
debug "DNS lookup using nslookup $DNS_CHECK_OPTIONS -query AAAA ${d}"
726726
# shellcheck disable=SC2086
727727
if [[ "$(nslookup $DNS_CHECK_OPTIONS -query=AAAA "${d}"|grep -c -i "^${d}.*has AAAA address")" -ge 1 ]]; then
728728
debug "found IPv6 record for ${d}"
@@ -1161,7 +1161,6 @@ find_dns_utils() {
11611161
fi
11621162

11631163
if [[ -n "$(command -v drill 2>/dev/null)" ]]; then
1164-
debug "HAS DIG_OR_DRILL=drill"
11651164
HAS_DIG_OR_DRILL="drill"
11661165
elif [[ -n "$(command -v dig 2>/dev/null)" ]] && dig >/dev/null 2>&1; then
11671166
if dig -r >/dev/null 2>&1; then
@@ -1170,8 +1169,10 @@ find_dns_utils() {
11701169
else
11711170
HAS_DIG_OR_DRILL="dig"
11721171
fi
1172+
fi
11731173

1174-
if dig +noidnout >/dev/null 2>&1; then
1174+
if [[ -n "$HAS_DIG_OR_DRILL" ]]; then
1175+
if $HAS_DIG_OR_DRILL +noidnout >/dev/null 2>&1; then
11751176
DIG_SUPPORTS_NOIDNOUT=true
11761177
fi
11771178

‎test/37-idn.bats

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -7,14 +7,13 @@ load '/getssl/test/test_helper.bash'
77
setup_file() {
88
if [ -z "$STAGING" ]; then
99
export CURL_CA_BUNDLE=/root/pebble-ca-bundle.crt
10-
GETSSL_CMD_HOST=${GETSSL_HOST/getssl/xn--t-r1a81lydm69gz81r}
11-
curl --silent -X POST -d '{"host":"'$GETSSL_CMD_HOST'", "addresses":["'$GETSSL_IP'"]}' http://10.30.50.3:8055/add-a
10+
curl --silent -X POST -d '{"host":"'$GETSSL_IDN_HOST'", "addresses":["'$GETSSL_IP'"]}' http://10.30.50.3:8055/add-a
1211
fi
1312
}
1413

1514
# This is run for every test
1615
setup() {
17-
GETSSL_CMD_HOST=${GETSSL_HOST/getssl/xn--t-r1a81lydm69gz81r}
16+
GETSSL_CMD_HOST=${GETSSL_IDN_HOST}
1817

1918
# use the test description to move tools we don't want to test out of the way
2019
DNS_TOOL=${BATS_TEST_DESCRIPTION##*:}
@@ -39,7 +38,7 @@ teardown() {
3938

4039
teardown_file() {
4140
if [ -z "$STAGING" ]; then
42-
curl --silent -X POST -d '{"host":"'$GETSSL_CMD_HOST'", "addresses":["'$GETSSL_IP'"]}' http://10.30.50.3:8055/clear-a
41+
curl --silent -X POST -d '{"host":"'$GETSSL_IDN_HOST'", "addresses":["'$GETSSL_IP'"]}' http://10.30.50.3:8055/clear-a
4342
fi
4443
}
4544

‎test/38-idn-http01-check-noidnout.bats

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
#! /usr/bin/env bats
2+
3+
load '/bats-support/load.bash'
4+
load '/bats-assert/load.bash'
5+
load '/getssl/test/test_helper.bash'
6+
7+
setup_file() {
8+
if [ -z "$STAGING" ]; then
9+
export CURL_CA_BUNDLE=/root/pebble-ca-bundle.crt
10+
curl --silent -X POST -d '{"host":"'$GETSSL_IDN_HOST'", "addresses":["'$GETSSL_IP'"]}' http://10.30.50.3:8055/add-a
11+
fi
12+
}
13+
14+
setup() {
15+
GETSSL_CMD_HOST=$GETSSL_IDN_HOST
16+
}
17+
18+
teardown_file() {
19+
if [ -z "$STAGING" ]; then
20+
curl --silent -X POST -d '{"host":"'$GETSSL_IDN_HOST'", "addresses":["'$GETSSL_IP'"]}' http://10.30.50.3:8055/clear-a
21+
22+
fi
23+
}
24+
25+
@test "Ensure noidnout in check_config isn't passed to host and nslookup (HTTP-01)" {
26+
if [ -n "$STAGING" ]; then
27+
skip "Using staging server, skipping internal test"
28+
fi
29+
CONFIG_FILE="getssl-http01.cfg"
30+
setup_environment
31+
init_getssl
32+
cat <<- EOF > ${INSTALL_DIR}/.getssl/${GETSSL_CMD_HOST}/getssl_test_specific.cfg
33+
SANS="${GETSSL_HOST}"
34+
USE_SINGLE_ACL="true"
35+
EOF
36+
37+
create_certificate -d --check-config
38+
39+
assert_success
40+
refute_output --partial "DNS lookup using host +noidnout"
41+
refute_output --partial "DNS lookup using nslookup +noidnout"
42+
refute_output --partial "+noidnout $GETSSL_HOST"
43+
check_output_for_errors
44+
}

‎test/run-test.cmd

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,11 +8,11 @@ SET COMMAND=%2 %3
88

99
:CheckAlias
1010
REM check if OS *contains* staging
11+
SET GETSSL_IDN_HOST=%OS%.xn--t-r1a81lydm69gz81r.test
1112
IF NOT x%OS:duck=%==x%OS% GOTO duckdns
1213
IF NOT x%OS:dynu=%==x%OS% GOTO dynu
1314
IF NOT x%OS:bash=%==x%OS% GOTO bash
1415
SET ALIAS=%OS%.getssl.test
15-
SET IDN=%OS%.xn--t-r1a81lydm69gz81r.test
1616
SET STAGING=
1717
SET GETSSL_OS=%OS%
1818
GOTO Run
@@ -51,12 +51,13 @@ IF %ErrorLevel% EQU 1 GOTO End
5151
@echo on
5252
docker run -it ^
5353
--env GETSSL_HOST=%ALIAS% %STAGING% ^
54+
--env GETSSL_IDN_HOST=%GETSSL_IDN_HOST% ^
5455
--env GETSSL_OS=%GETSSL_OS% ^
5556
-v %cd%:/getssl ^
5657
--rm ^
5758
--network %CurrDirName%_acmenet ^
5859
--network-alias %ALIAS% ^
59-
--network-alias %IDN% ^
60+
--network-alias %GETSSL_IDN_HOST% ^
6061
--network-alias a.%OS%.getssl.test ^
6162
--network-alias b.%OS%.getssl.test ^
6263
--network-alias c.%OS%.getssl.test ^

‎test/run-test.sh

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ else
1515
fi
1616

1717
ALIAS="$OS.getssl.test"
18-
IDN="$OS.xn--t-r1a81lydm69gz81r.test"
18+
GETSSL_IDN_HOST="$OS.xn--t-r1a81lydm69gz81r.test"
1919
STAGING=""
2020
GETSSL_OS=$OS
2121

@@ -35,12 +35,13 @@ docker build --rm -f "test/Dockerfile-$OS" -t "getssl-$OS" .
3535
# shellcheck disable=SC2086
3636
docker run \
3737
--env GETSSL_HOST=$ALIAS $STAGING \
38+
--env GETSSL_IDN_HOST=$GETSSL_IDN_HOST \
3839
--env GETSSL_OS=$GETSSL_OS \
3940
-v "$(pwd)":/getssl \
4041
--rm \
4142
--network ${PWD##*/}_acmenet \
4243
--network-alias $ALIAS \
43-
--network-alias $IDN \
44+
--network-alias $GETSSL_IDN_HOST \
4445
--network-alias "a.$OS.getssl.test" \
4546
--network-alias "b.$OS.getssl.test" \
4647
--network-alias "c.$OS.getssl.test" \

‎test/test_helper.bash

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@ create_certificate() {
4747
# Create certificate
4848
cp "${CODE_DIR}/test/test-config/${CONFIG_FILE}" "${INSTALL_DIR}/.getssl/${GETSSL_CMD_HOST}/getssl.cfg"
4949
# shellcheck disable=SC2086
50-
run ${CODE_DIR}/getssl $1 "$GETSSL_CMD_HOST"
50+
run ${CODE_DIR}/getssl "$@" "$GETSSL_CMD_HOST"
5151
}
5252

5353
init_getssl() {

0 commit comments

Comments
 (0)