Skip to content

Commit b7919d6

Browse files
timkimbertimkimber
authored
Merge pull request #863 from srvrco/fix-json_get-parse-error
Fix test failure when token contains the phrase "url"
2 parents 997a895 + 9f26be1 commit b7919d6

File tree

4 files changed

+210
-10
lines changed

4 files changed

+210
-10
lines changed

‎getssl

+4-6
Original file line numberDiff line numberDiff line change
@@ -1424,10 +1424,8 @@ for d in "${alldomains[@]}"; do
14241424
else # APIv2
14251425
debug "authlink response = ${response//[$'\t\r\n']}"
14261426
# get the token and uri from the dns-01 component
1427-
token=$(json_get "$response" "challenges" "type" "dns-01" "token")
1428-
uri=$(json_get "$response" "challenges" "type" "dns-01" "url")
1429-
# when using pebble this sometimes appears to have a newline which causes problems in send_signed_request
1430-
uri=$(echo "$uri" | tr -d '\r')
1427+
token=$(json_get "$response" "challenges" "type" "dns-01" '"token"')
1428+
uri=$(json_get "$response" "challenges" "type" "dns-01" '"url"')
14311429
debug uri "$uri"
14321430
fi
14331431

@@ -1488,9 +1486,9 @@ for d in "${alldomains[@]}"; do
14881486
else # APIv2
14891487
debug "authlink response = ${response//[$'\t\r\n']}"
14901488
# get the token from the http-01 component
1491-
token=$(json_get "$response" "challenges" "type" "http-01" "token")
1489+
token=$(json_get "$response" "challenges" "type" "http-01" '"token"')
14921490
# get the uri from the http component
1493-
uri=$(json_get "$response" "challenges" "type" "http-01" "url" | head -n1)
1491+
uri=$(json_get "$response" "challenges" "type" "http-01" '"url"' | head -n1)
14941492
debug uri "$uri"
14951493
fi
14961494

‎test/test_helper.bash

+22-4
Original file line numberDiff line numberDiff line change
@@ -61,9 +61,27 @@ check_nginx() {
6161
fi
6262
}
6363

64+
whitelist_array=(
65+
"DNS problem"
66+
"acme:error:badNonce"
67+
"acme:error:dns"
68+
)
69+
6470
check_output_for_errors() {
71+
# check if the output contains a whitelisted phrase, if it does, don't check for the phrase "Error"
72+
contains_whitelisted_phrase=0
73+
for phrase in "${whitelist_array[@]}"; do
74+
#echo "# DEBUG: checking output for whitelisted phrase: $phrase"
75+
status=1
76+
assert_output --regexp "$phrase" 2>/dev/null || status=0
77+
contains_whitelisted_phrase=$((status || contains_whitelisted_phrase))
78+
done
79+
80+
if [[ $contains_whitelisted_phrase -eq 0 ]]; then
81+
refute_output --regexp '[^_][Ee][Rr][Rr][Oo][Rr]'
82+
fi
83+
6584
refute_output --regexp '[Ff][Aa][Ii][Ll][Ee][Dd]'
66-
refute_output --regexp '[^_][Ee][Rr][Rr][Oo][Rr][^:badNonce]'
6785
refute_output --regexp '[^_][Ww][Aa][Rr][Nn][Ii][Nn][Gg]'
6886
refute_line --partial 'command not found'
6987
}
@@ -107,9 +125,9 @@ setup_environment() {
107125
# shellcheck disable=SC2153 # Ignore GETSSL_OS looks like typo of GETSSL_IP
108126
if [[ -f /usr/bin/supervisord && -f /etc/supervisord.conf ]]; then
109127
if [[ ! $(pgrep supervisord) ]]; then
110-
/usr/bin/supervisord -c /etc/supervisord.conf 3>&- 4>&-
111-
# Give supervisord time to start
112-
sleep 1
128+
/usr/bin/supervisord -c /etc/supervisord.conf 3>&- 4>&-
129+
# Give supervisord time to start
130+
sleep 1
113131
fi
114132
elif [[ "$GETSSL_OS" == "centos"[78] || "$GETSSL_OS" == "rockylinux"* ]]; then
115133
if [ -z "$(pgrep nginx)" ]; then

‎test/u10-test-json_get.bats

+96
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
#! /usr/bin/env bats
2+
3+
load '/bats-support/load.bash'
4+
load '/bats-assert/load.bash'
5+
load '/getssl/test/test_helper.bash'
6+
7+
8+
# This is run for every test
9+
setup() {
10+
[ ! -f $BATS_RUN_TMPDIR/failed.skip ] || skip "skipping tests after first failure"
11+
12+
. /getssl/getssl --source
13+
export API=2
14+
_USE_DEBUG=1
15+
}
16+
17+
18+
teardown() {
19+
[ -n "$BATS_TEST_COMPLETED" ] || touch $BATS_RUN_TMPDIR/failed.skip
20+
}
21+
22+
response='
23+
{
24+
"challenges": [
25+
{
26+
"status": "pending",
27+
"token": "kD1H4FVIEFvkWghLlKFoSPpR5u0FTGkRs4A_FnTfv3A",
28+
"type": "http-01",
29+
"url": "https://pebble:14000/chalZ/firw72KAYbsChpxMAzrTSLpCKepAdqcJn7NERZtAknY"
30+
},
31+
{
32+
"status": "pending",
33+
"token": "3FMfZoNNrjZzh_nnxanW5oEKvC6urlGS5wQWI5Bg9J4",
34+
"type": "dns-01",
35+
"url": "https://pebble:14000/chalZ/vkHAS1A9tQQ5A8QoAIRQJrSC_WJNm303iwC1r22dnCc"
36+
},
37+
{
38+
"status": "pending",
39+
"token": "UGkg34cDGoM9Su22iCH9yn383uLfTpr5Ys4Tms9QYAo",
40+
"type": "dns-account-01",
41+
"url": "https://pebble:14000/chalZ/ryNLsf-iOe22YYeYv6YIwBp7E2z492bdesvNQFzl9gI"
42+
},
43+
{
44+
"status": "pending",
45+
"token": "Sla6q_0Nl3JB3JMsWCXn_X3-KyH45mjKaStRDZU8I0g",
46+
"type": "tls-alpn-01",
47+
"url": "https://pebble:14000/chalZ/pzLqpT2qVf4DxK25GX0mONLE9Ii35FAXL9ioxONoSFQ"
48+
}
49+
],
50+
"expires": "2024-10-18T17:24:42Z",
51+
"identifier": {
52+
"type": "dns",
53+
"value": "c.debian.getssl.test"
54+
},
55+
"status": "pending"
56+
}'
57+
58+
59+
@test "Test that json_get fails if token contains the phrase 'url'" {
60+
# the token for te dns-01 entry contains the text "url" which breaks the json_get url parser!
61+
62+
type="dns-01"
63+
uri=$(json_get "$response" "challenges" "type" $type "url")
64+
token=$(json_get "$response" "challenges" "type" $type "token")
65+
# when using pebble this sometimes appears to have a newline which causes problems in send_signed_request
66+
uri=$(echo "$uri" | tr -d '\r')
67+
echo uri "$uri" >&3
68+
echo token "$token" >&3
69+
70+
# check the uri begins with https
71+
begins_with_https=0
72+
if [[ "$uri" == https* ]]; then
73+
begins_with_https=1
74+
fi
75+
76+
assert_not_equal $begins_with_https 1
77+
}
78+
79+
80+
@test "Test that json_get works if we quote 'url'" {
81+
# the token for te dns-01 entry contains the text "url" which breaks the json_get url parser!
82+
83+
type="dns-01"
84+
uri=$(json_get "$response" "challenges" "type" $type '"url"')
85+
token=$(json_get "$response" "challenges" "type" $type '"token"')
86+
echo uri "$uri" >&3
87+
echo token "$token" >&3
88+
89+
# check the uri begins with https
90+
begins_with_https=0
91+
if [[ "$uri" == https* ]]; then
92+
begins_with_https=1
93+
fi
94+
95+
assert_equal $begins_with_https 1
96+
}

‎test/u11-test-ignore-dns-error-in-output.bats

+88
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
#! /usr/bin/env bats
2+
3+
load '/bats-support/load.bash'
4+
load '/bats-assert/load.bash'
5+
load '/getssl/test/test_helper.bash'
6+
7+
8+
# This is run for every test
9+
setup() {
10+
[ ! -f $BATS_RUN_TMPDIR/failed.skip ] || skip "skipping tests after first failure"
11+
12+
. /getssl/getssl --source
13+
export API=2
14+
_USE_DEBUG=1
15+
}
16+
17+
18+
teardown() {
19+
[ -n "$BATS_TEST_COMPLETED" ] || touch $BATS_RUN_TMPDIR/failed.skip
20+
}
21+
22+
# First sample text where we don't want check_output_for_errors to find an error
23+
output1=(
24+
'send_signed_request:533 code 200'
25+
'send_signed_request:533 response status = invalid'
26+
'check_challenge_completion:1472 *.ubuntu-acmedns-getssl.freeddns.org:Verify error: "detail": "DNS problem: server failure at resolver looking up CAA for freeddns.org",'
27+
'del_dns_rr:1474 removing DNS RR via command: /getssl/dns_scripts/dns_del_acmedns ubuntu-acmedns-getssl.freeddns.org hEAib3ePU0s8-G3HPmPSa50ZjfdKt0A0qskHyTfBJr8'
28+
'send_signed_request:1215 url https://acme-staging-v02.api.letsencrypt.org/acme/new-order'
29+
'send_signed_request:1215 using KID=https://acme-staging-v02.api.letsencrypt.org/acme/acct/168360453'
30+
'send_signed_request:1215 payload = {"identifiers": [{"type":"dns","value":"*.ubuntu-acmedns-getssl.freeddns.org"}]}'
31+
)
32+
33+
# Second sample text where we don't want check_output_for_errors to find an error
34+
output2=(
35+
'send_signed_request:3553 response { "identifier": { "type": "dns", "value": "ubuntu-acmedns-getssl.freeddns.org" }, "status": "invalid", "expires": "2024-10-30T15:24:16Z", "challenges": [ { "type": "dns-01", "url": "https://acme-staging-v02.api.letsencrypt.org/acme/chall-v3/14558038743/zzz8VA", "status": "invalid", "validated": "2024-10-23T15:24:18Z", "error": { "type": "urn:ietf:params:acme:error:dns", "detail": "DNS problem: server failure at resolver looking up CAA for freeddns.org", "status": 400 }, "token": "PyBVfKevM4noXq3fdsFs_0G1BY_o7Nl7eGa6mQw7oJM", "validationRecord": [ { "hostname": "ubuntu-acmedns-getssl.freeddns.org" } ] } ], "wildcard": true}'
36+
'send_signed_request:3553 code 200'
37+
'send_signed_request:3553 response status = invalid'
38+
'main:0 deactivating domain'
39+
'main:0 deactivating https://acme-staging-v02.api.letsencrypt.org/acme/authz-v3/14558038743'
40+
'send_signed_request:3557 url https://acme-staging-v02.api.letsencrypt.org/acme/authz-v3/14558038743'
41+
'send_signed_request:3557 using KID=https://acme-staging-v02.api.letsencrypt.org/acme/acct/168360453'
42+
'send_signed_request:3557 payload = {"resource": "authz", "status": "deactivated"}'
43+
)
44+
45+
# Text that should cause check_output_for_errors to find an error
46+
output3=(
47+
'send_signed_request:3553 code 200'
48+
'send_signed_request:3553 response status = error'
49+
'main:0 deactivating domain'
50+
'main:0 deactivating https://acme-staging-v02.api.letsencrypt.org/acme/authz-v3/14558038743'
51+
'send_signed_request:3557 url https://acme-staging-v02.api.letsencrypt.org/acme/authz-v3/14558038743'
52+
'send_signed_request:3557 using KID=https://acme-staging-v02.api.letsencrypt.org/acme/acct/168360453'
53+
'send_signed_request:3557 payload = {"resource": "authz", "status": "deactivated"}'
54+
)
55+
56+
57+
output_test_text() {
58+
input_array=("$@")
59+
printf '%s\n' "${input_array[@]}"
60+
}
61+
62+
63+
@test "Test that 'Verify error...DNS problem' in first sample output is ignored" {
64+
# print the known output that used to break the check
65+
run output_test_text "${output1[@]}"
66+
67+
# run the check
68+
check_output_for_errors
69+
}
70+
71+
72+
@test "Test that 'acme:dns:error' in second sample output is ignored" {
73+
# print the known output that used to break the check
74+
run output_test_text "${output2[@]}"
75+
76+
# run the check
77+
check_output_for_errors
78+
}
79+
80+
81+
@test "Test that generic error in third sample output is NOT ignored" {
82+
# print sample output that should cause 'check_output_for_errors' to fail a test
83+
run output_test_text "${output3[@]}"
84+
85+
# run the function and check the output confirms that it would fail the test
86+
run check_output_for_errors
87+
assert_output --partial "-- regular expression should not match output --"
88+
}

0 commit comments

Comments
 (0)