Skip to content

Commit 2de47bc

Browse files
rolandshoemakerDaniel McCarney
rolandshoemaker
authored and
Daniel McCarney
committed
WFE/WFE2: Remove old authz/challenge support (letsencrypt#4486)
Does what it says on the tin. Also requires some mocks changes that will also be used by RA changes in the next part of this change series.
1 parent 2e7333d commit 2de47bc

File tree

5 files changed

+176
-613
lines changed

5 files changed

+176
-613
lines changed

‎mocks/mocks.go‎

Lines changed: 44 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -490,7 +490,7 @@ func (sa *StorageAuthority) GetOrder(_ context.Context, req *sapb.OrderRequest)
490490
Expires: &exp,
491491
Names: []string{"example.com"},
492492
Status: &status,
493-
Authorizations: []string{"hello"},
493+
V2Authorizations: []int64{1},
494494
CertificateSerial: &serial,
495495
Error: nil,
496496
}
@@ -577,7 +577,40 @@ func (sa *StorageAuthority) CountInvalidAuthorizations2(ctx context.Context, req
577577
}
578578

579579
func (sa *StorageAuthority) GetValidAuthorizations2(ctx context.Context, req *sapb.GetValidAuthorizationsRequest) (*sapb.Authorizations, error) {
580-
return nil, nil
580+
if *req.RegistrationID != 1 && *req.RegistrationID != 5 && *req.RegistrationID != 4 {
581+
return &sapb.Authorizations{}, nil
582+
}
583+
now := time.Unix(0, *req.Now)
584+
auths := &sapb.Authorizations{}
585+
for _, name := range req.Domains {
586+
if sa.authorizedDomains[name] || name == "not-an-example.com" || name == "bad.example.com" {
587+
exp := now.AddDate(100, 0, 0)
588+
authzPB, err := bgrpc.AuthzToPB(core.Authorization{
589+
Status: core.StatusValid,
590+
RegistrationID: *req.RegistrationID,
591+
Expires: &exp,
592+
Identifier: identifier.ACMEIdentifier{
593+
Type: "dns",
594+
Value: name,
595+
},
596+
Challenges: []core.Challenge{
597+
{
598+
Status: core.StatusValid,
599+
Type: core.ChallengeTypeDNS01,
600+
},
601+
},
602+
})
603+
if err != nil {
604+
return nil, err
605+
}
606+
n := name
607+
auths.Authz = append(auths.Authz, &sapb.Authorizations_MapElement{
608+
Domain: &n,
609+
Authz: authzPB,
610+
})
611+
}
612+
}
613+
return auths, nil
581614
}
582615

583616
func (sa *StorageAuthority) GetAuthorizations2(ctx context.Context, req *sapb.GetAuthorizationsRequest) (*sapb.Authorizations, error) {
@@ -602,10 +635,8 @@ func (sa *StorageAuthority) GetAuthorization2(ctx context.Context, id *sapb.Auth
602635
Status: core.StatusValid,
603636
RegistrationID: 1,
604637
Identifier: identifier.DNSIdentifier("not-an-example.com"),
605-
V2: true,
606638
Challenges: []core.Challenge{
607639
{
608-
ID: 23,
609640
Token: "token",
610641
Type: "dns",
611642
},
@@ -704,15 +735,14 @@ type SAWithFailedChallenges struct {
704735
Clk clock.FakeClock
705736
}
706737

707-
func (sa *SAWithFailedChallenges) GetAuthorization(_ context.Context, id string) (core.Authorization, error) {
738+
func (sa *SAWithFailedChallenges) GetAuthorization2(ctx context.Context, id *sapb.AuthorizationID2) (*corepb.Authorization, error) {
708739
authz := core.Authorization{
709-
ID: "valid",
740+
ID: "55",
710741
Status: core.StatusValid,
711742
RegistrationID: 1,
712743
Identifier: identifier.DNSIdentifier("not-an-example.com"),
713744
Challenges: []core.Challenge{
714745
{
715-
ID: 23,
716746
Type: "dns",
717747
},
718748
},
@@ -724,18 +754,18 @@ func (sa *SAWithFailedChallenges) GetAuthorization(_ context.Context, id string)
724754
}
725755
exp := sa.Clk.Now().AddDate(100, 0, 0)
726756
authz.Expires = &exp
727-
// "oldNS" returns an authz with a failed challenge that has the problem type
757+
// 55 returns an authz with a failed challenge that has the problem type
728758
// statically prefixed by the V1ErrorNS
729-
if id == "oldNS" {
759+
if *id.Id == 55 {
730760
prob.Type = probs.V1ErrorNS + prob.Type
731761
authz.Challenges[0].Error = prob
732-
return authz, nil
762+
return bgrpc.AuthzToPB(authz)
733763
}
734-
// "failed" returns an authz with a failed challenge that has no error
764+
// 56 returns an authz with a failed challenge that has no error
735765
// namespace on the problem type.
736-
if id == "failed" {
766+
if *id.Id == 56 {
737767
authz.Challenges[0].Error = prob
738-
return authz, nil
768+
return bgrpc.AuthzToPB(authz)
739769
}
740-
return core.Authorization{}, berrors.NotFoundError("no authorization found with id %q", id)
770+
return nil, berrors.NotFoundError("no authorization found with id %q", id)
741771
}

‎wfe/wfe.go‎

Lines changed: 14 additions & 119 deletions
Original file line numberDiff line numberDiff line change
@@ -49,12 +49,10 @@ const (
4949
newRegPath = "/acme/new-reg"
5050
regPath = "/acme/reg/"
5151
newAuthzPath = "/acme/new-authz"
52-
authzPath = "/acme/authz/"
5352
// For user-facing URLs we use a "v3" suffix to avoid potential confusiong
5453
// regarding ACMEv2.
5554
authzv2Path = "/acme/authz-v3/"
5655
challengev2Path = "/acme/chall-v3/"
57-
challengePath = "/acme/challenge/"
5856
newCertPath = "/acme/new-cert"
5957
certPath = "/acme/cert/"
6058
revokeCertPath = "/acme/revoke-cert"
@@ -308,9 +306,7 @@ func (wfe *WebFrontEndImpl) Handler() http.Handler {
308306
wfe.HandleFunc(m, newAuthzPath, wfe.NewAuthorization, "POST")
309307
wfe.HandleFunc(m, newCertPath, wfe.NewCertificate, "POST")
310308
wfe.HandleFunc(m, regPath, wfe.Registration, "POST")
311-
wfe.HandleFunc(m, authzPath, wfe.Authorization, "GET", "POST")
312309
wfe.HandleFunc(m, authzv2Path, wfe.AuthorizationV2, "GET", "POST")
313-
wfe.HandleFunc(m, challengePath, wfe.Challenge, "GET", "POST")
314310
wfe.HandleFunc(m, challengev2Path, wfe.ChallengeV2, "GET", "POST")
315311
wfe.HandleFunc(m, certPath, wfe.Certificate, "GET")
316312
wfe.HandleFunc(m, revokeCertPath, wfe.RevokeCertificate, "POST")
@@ -762,27 +758,18 @@ func (wfe *WebFrontEndImpl) NewAuthorization(ctx context.Context, logEvent *web.
762758
}
763759

764760
func (wfe *WebFrontEndImpl) regHoldsAuthorizations(ctx context.Context, regID int64, names []string) (bool, error) {
765-
var authzMap map[string]*core.Authorization
766-
if features.Enabled(features.NewAuthorizationSchema) {
767-
now := wfe.clk.Now().UnixNano()
768-
authzMapPB, err := wfe.SA.GetValidAuthorizations2(ctx, &sapb.GetValidAuthorizationsRequest{
769-
RegistrationID: &regID,
770-
Domains: names,
771-
Now: &now,
772-
})
773-
if err != nil {
774-
return false, err
775-
}
776-
authzMap, err = bgrpc.PBToAuthzMap(authzMapPB)
777-
if err != nil {
778-
return false, err
779-
}
780-
} else {
781-
var err error
782-
authzMap, err = wfe.SA.GetValidAuthorizations(ctx, regID, names, wfe.clk.Now())
783-
if err != nil {
784-
return false, err
785-
}
761+
now := wfe.clk.Now().UnixNano()
762+
authzMapPB, err := wfe.SA.GetValidAuthorizations2(ctx, &sapb.GetValidAuthorizationsRequest{
763+
RegistrationID: &regID,
764+
Domains: names,
765+
Now: &now,
766+
})
767+
if err != nil {
768+
return false, err
769+
}
770+
authzMap, err := bgrpc.PBToAuthzMap(authzMapPB)
771+
if err != nil {
772+
return false, err
786773
}
787774
if len(names) != len(authzMap) {
788775
return false, nil
@@ -1017,10 +1004,6 @@ func (wfe *WebFrontEndImpl) ChallengeV2(
10171004
notFound := func() {
10181005
wfe.sendError(response, logEvent, probs.NotFound("No such challenge"), nil)
10191006
}
1020-
if !features.Enabled(features.NewAuthorizationSchema) {
1021-
notFound()
1022-
return
1023-
}
10241007
slug := strings.Split(request.URL.Path, "/")
10251008
if len(slug) != 2 {
10261009
notFound()
@@ -1051,64 +1034,7 @@ func (wfe *WebFrontEndImpl) ChallengeV2(
10511034
notFound()
10521035
return
10531036
}
1054-
wfe.challengeCommon(ctx, logEvent, response, request, authz, challengeIndex)
1055-
}
1056-
1057-
// Challenge handles POST requests to challenge URLs. Such requests are clients'
1058-
// responses to the server's challenges.
1059-
func (wfe *WebFrontEndImpl) Challenge(
1060-
ctx context.Context,
1061-
logEvent *web.RequestEvent,
1062-
response http.ResponseWriter,
1063-
request *http.Request) {
1064-
1065-
notFound := func() {
1066-
wfe.sendError(response, logEvent, probs.NotFound("No such challenge"), nil)
1067-
}
1068-
1069-
// Here we parse out the authorization and challenge IDs and retrieve
1070-
// the authorization.
1071-
slug := strings.Split(request.URL.Path, "/")
1072-
if len(slug) != 2 {
1073-
notFound()
1074-
return
1075-
}
1076-
var authorizationID string = slug[0]
1077-
challengeID, err := strconv.ParseInt(slug[1], 10, 64)
1078-
if err != nil {
1079-
notFound()
1080-
return
1081-
}
1082-
1083-
authz, err := wfe.SA.GetAuthorization(ctx, authorizationID)
1084-
if err != nil {
1085-
if berrors.Is(err, berrors.NotFound) {
1086-
notFound()
1087-
} else {
1088-
wfe.sendError(response, logEvent, probs.ServerInternal("Problem getting authorization"), err)
1089-
}
1090-
return
1091-
}
1092-
1093-
// Check that the requested challenge exists within the authorization
1094-
challengeIndex := authz.FindChallenge(challengeID)
1095-
if challengeIndex == -1 {
1096-
notFound()
1097-
return
1098-
}
1099-
1100-
wfe.challengeCommon(ctx, logEvent, response, request, authz, challengeIndex)
1101-
}
11021037

1103-
// challengeCommon handles logic that is common to both Challenge and
1104-
// ChallengeV2.
1105-
func (wfe *WebFrontEndImpl) challengeCommon(
1106-
ctx context.Context,
1107-
logEvent *web.RequestEvent,
1108-
response http.ResponseWriter,
1109-
request *http.Request,
1110-
authz core.Authorization,
1111-
challengeIndex int) {
11121038
if authz.Expires == nil || authz.Expires.Before(wfe.clk.Now()) {
11131039
wfe.sendError(response, logEvent, probs.NotFound("Expired authorization"), nil)
11141040
return
@@ -1134,13 +1060,7 @@ func (wfe *WebFrontEndImpl) challengeCommon(
11341060
// the client by filling in its URI field and clearing its ID field.
11351061
func (wfe *WebFrontEndImpl) prepChallengeForDisplay(request *http.Request, authz core.Authorization, challenge *core.Challenge) {
11361062
// Update the challenge URI to be relative to the HTTP request Host
1137-
if authz.V2 {
1138-
challenge.URI = web.RelativeEndpoint(request, fmt.Sprintf("%s%s/%s", challengev2Path, authz.ID, challenge.StringID()))
1139-
} else {
1140-
challenge.URI = web.RelativeEndpoint(request, fmt.Sprintf("%s%s/%d", challengePath, authz.ID, challenge.ID))
1141-
}
1142-
// Ensure the challenge ID isn't written. 0 is considered "empty" for the purpose of the JSON omitempty tag.
1143-
challenge.ID = 0
1063+
challenge.URI = web.RelativeEndpoint(request, fmt.Sprintf("%s%s/%s", challengev2Path, authz.ID, challenge.StringID()))
11441064

11451065
// Historically the Type field of a problem was always prefixed with a static
11461066
// error namespace. To support the V2 API and migrating to the correct IETF
@@ -1420,10 +1340,6 @@ func (wfe *WebFrontEndImpl) AuthorizationV2(ctx context.Context, logEvent *web.R
14201340
notFound := func() {
14211341
wfe.sendError(response, logEvent, probs.NotFound("No such authorization"), nil)
14221342
}
1423-
if !features.Enabled(features.NewAuthorizationSchema) {
1424-
notFound()
1425-
return
1426-
}
14271343
authzID, err := strconv.ParseInt(id, 10, 64)
14281344
if err != nil {
14291345
wfe.sendError(response, logEvent, probs.Malformed("Invalid authorization ID"), nil)
@@ -1487,24 +1403,6 @@ func (wfe *WebFrontEndImpl) authorizationCommon(
14871403
}
14881404
}
14891405

1490-
// Authorization is used by clients to submit an update to one of their
1491-
// authorizations.
1492-
func (wfe *WebFrontEndImpl) Authorization(ctx context.Context, logEvent *web.RequestEvent, response http.ResponseWriter, request *http.Request) {
1493-
// Requests to this handler should have a path that leads to a known authz
1494-
id := request.URL.Path
1495-
authz, err := wfe.SA.GetAuthorization(ctx, id)
1496-
if err != nil {
1497-
if berrors.Is(err, berrors.NotFound) {
1498-
wfe.sendError(response, logEvent, probs.NotFound("No such authorization"), nil)
1499-
} else {
1500-
wfe.sendError(response, logEvent, probs.ServerInternal("Problem getting authorization"), err)
1501-
}
1502-
return
1503-
}
1504-
1505-
wfe.authorizationCommon(ctx, logEvent, response, request, authz)
1506-
}
1507-
15081406
var allHex = regexp.MustCompile("^[0-9a-f]+$")
15091407

15101408
// Certificate is used by clients to request a copy of their current certificate, or to
@@ -1717,8 +1615,5 @@ func (wfe *WebFrontEndImpl) addIssuingCertificateURLs(response http.ResponseWrit
17171615
}
17181616

17191617
func urlForAuthz(authz core.Authorization, request *http.Request) string {
1720-
if authz.V2 {
1721-
return web.RelativeEndpoint(request, authzv2Path+string(authz.ID))
1722-
}
1723-
return web.RelativeEndpoint(request, authzPath+string(authz.ID))
1618+
return web.RelativeEndpoint(request, authzv2Path+string(authz.ID))
17241619
}

0 commit comments

Comments
 (0)