Skip to content

Commit c560fa4

Browse files
Roland Bracewell Shoemakercpu
Roland Bracewell Shoemaker
authored and
cpu
committed
Remove features checks from wfe2 (letsencrypt#2982)
1 parent e670e6e commit c560fa4

File tree

3 files changed

+77
-230
lines changed

3 files changed

+77
-230
lines changed

‎core/util.go‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -95,10 +95,18 @@ func (e BadNonceError) Error() string { return string(e) }
9595

9696
// Random stuff
9797

98+
type randSource interface {
99+
Read(p []byte) (n int, err error)
100+
}
101+
102+
// RandReader is used so that it can be replaced in tests that require
103+
// deterministic output
104+
var RandReader randSource = rand.Reader
105+
98106
// RandomString returns a randomly generated string of the requested length.
99107
func RandomString(byteLength int) string {
100108
b := make([]byte, byteLength)
101-
_, err := io.ReadFull(rand.Reader, b)
109+
_, err := io.ReadFull(RandReader, b)
102110
if err != nil {
103111
panic(fmt.Sprintf("Error reading random bytes: %s", err))
104112
}

‎wfe2/wfe.go‎

Lines changed: 30 additions & 50 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,6 @@ import (
1919
"golang.org/x/net/context"
2020

2121
"github.com/letsencrypt/boulder/core"
22-
"github.com/letsencrypt/boulder/features"
2322
"github.com/letsencrypt/boulder/goodkey"
2423
blog "github.com/letsencrypt/boulder/log"
2524
"github.com/letsencrypt/boulder/metrics"
@@ -269,7 +268,7 @@ func (wfe *WebFrontEndImpl) relativeDirectory(request *http.Request, directory m
269268
// the `BaseURL`. Otherwise, prefix each endpoint using the request protocol
270269
// & host.
271270
for k, v := range directory {
272-
if features.Enabled(features.RandomDirectoryEntry) && v == randomDirKeyExplanationLink {
271+
if v == randomDirKeyExplanationLink {
273272
relativeDir[k] = v
274273
continue
275274
}
@@ -308,9 +307,7 @@ func (wfe *WebFrontEndImpl) Handler() http.Handler {
308307
wfe.HandleFunc(m, termsPath, wfe.Terms, "GET")
309308
wfe.HandleFunc(m, issuerPath, wfe.Issuer, "GET")
310309
wfe.HandleFunc(m, buildIDPath, wfe.BuildID, "GET")
311-
if features.Enabled(features.AllowKeyRollover) {
312-
wfe.HandleFunc(m, rolloverPath, wfe.KeyRollover, "POST")
313-
}
310+
wfe.HandleFunc(m, rolloverPath, wfe.KeyRollover, "POST")
314311
// We don't use our special HandleFunc for "/" because it matches everything,
315312
// meaning we can wind up returning 405 when we mean to return 404. See
316313
// https://github.com/letsencrypt/boulder/issues/717
@@ -376,26 +373,18 @@ func (wfe *WebFrontEndImpl) Directory(ctx context.Context, logEvent *requestEven
376373
"revoke-cert": revokeCertPath,
377374
}
378375

379-
// Versions of Certbot pre-0.6.0 (named LetsEncryptPythonClient at the time) break when they
380-
// encounter a directory containing elements they don't expect so we gate
381-
// adding new directory fields for clients matching this UA.
382-
clientDirChangeIntolerant := strings.HasPrefix(request.UserAgent(), "LetsEncryptPythonClient")
383-
if features.Enabled(features.AllowKeyRollover) && !clientDirChangeIntolerant {
384-
directoryEndpoints["key-change"] = rolloverPath
385-
}
386-
if features.Enabled(features.RandomDirectoryEntry) && !clientDirChangeIntolerant {
387-
// Add a random key to the directory in order to make sure that clients don't hardcode an
388-
// expected set of keys. This ensures that we can properly extend the directory when we
389-
// need to add a new endpoint or meta element.
390-
directoryEndpoints[core.RandomString(8)] = randomDirKeyExplanationLink
391-
}
392-
if features.Enabled(features.DirectoryMeta) && !clientDirChangeIntolerant {
393-
// ACME since draft-02 describes an optional "meta" directory entry. The
394-
// meta entry may optionally contain a "terms-of-service" URI for the
395-
// current ToS.
396-
directoryEndpoints["meta"] = map[string]string{
397-
"terms-of-service": wfe.SubscriberAgreementURL,
398-
}
376+
directoryEndpoints["key-change"] = rolloverPath
377+
378+
// Add a random key to the directory in order to make sure that clients don't hardcode an
379+
// expected set of keys. This ensures that we can properly extend the directory when we
380+
// need to add a new endpoint or meta element.
381+
directoryEndpoints[core.RandomString(8)] = randomDirKeyExplanationLink
382+
383+
// ACME since draft-02 describes an optional "meta" directory entry. The
384+
// meta entry may optionally contain a "terms-of-service" URI for the
385+
// current ToS.
386+
directoryEndpoints["meta"] = map[string]string{
387+
"terms-of-service": wfe.SubscriberAgreementURL,
399388
}
400389

401390
response.Header().Set("Content-Type", "application/json")
@@ -707,15 +696,10 @@ func (wfe *WebFrontEndImpl) NewCertificate(ctx context.Context, logEvent *reques
707696

708697
// TODO Content negotiation
709698
response.Header().Add("Location", certURL)
710-
if features.Enabled(features.UseAIAIssuerURL) {
711-
if err = wfe.addIssuingCertificateURLs(response, parsedCertificate.IssuingCertificateURL); err != nil {
712-
logEvent.AddError("unable to parse IssuingCertificateURL: %s", err)
713-
wfe.sendError(response, logEvent, probs.ServerInternal("unable to parse IssuingCertificateURL"), err)
714-
return
715-
}
716-
} else {
717-
relativeIssuerPath := wfe.relativeEndpoint(request, issuerPath)
718-
response.Header().Add("Link", link(relativeIssuerPath, "up"))
699+
if err = wfe.addIssuingCertificateURLs(response, parsedCertificate.IssuingCertificateURL); err != nil {
700+
logEvent.AddError("unable to parse IssuingCertificateURL: %s", err)
701+
wfe.sendError(response, logEvent, probs.ServerInternal("unable to parse IssuingCertificateURL"), err)
702+
return
719703
}
720704
response.Header().Set("Content-Type", "application/pkix-cert")
721705
response.WriteHeader(http.StatusCreated)
@@ -953,7 +937,7 @@ func (wfe *WebFrontEndImpl) Registration(
953937
// If a user tries to send both a deactivation request and an update to their
954938
// contacts or subscriber agreement URL the deactivation will take place and
955939
// return before an update would be performed.
956-
if features.Enabled(features.AllowAccountDeactivation) && (update.Status != "" && update.Status != currReg.Status) {
940+
if update.Status != "" && update.Status != currReg.Status {
957941
if update.Status != core.StatusDeactivated {
958942
wfe.sendError(response, logEvent, probs.Malformed("Invalid value provided for status field"), nil)
959943
return
@@ -1127,22 +1111,18 @@ func (wfe *WebFrontEndImpl) Certificate(ctx context.Context, logEvent *requestEv
11271111

11281112
// TODO Content negotiation
11291113
response.Header().Set("Content-Type", "application/pkix-cert")
1130-
if features.Enabled(features.UseAIAIssuerURL) {
1131-
parsedCertificate, err := x509.ParseCertificate([]byte(cert.DER))
1132-
if err != nil {
1133-
logEvent.AddError("unable to parse certificate: %s", err)
1134-
wfe.sendError(response, logEvent, probs.ServerInternal("Unable to parse certificate"), err)
1135-
return
1136-
}
1137-
if err = wfe.addIssuingCertificateURLs(response, parsedCertificate.IssuingCertificateURL); err != nil {
1138-
logEvent.AddError("unable to parse IssuingCertificateURL: %s", err)
1139-
wfe.sendError(response, logEvent, probs.ServerInternal("unable to parse IssuingCertificateURL"), err)
1140-
return
1141-
}
1142-
} else {
1143-
relativeIssuerPath := wfe.relativeEndpoint(request, issuerPath)
1144-
response.Header().Add("Link", link(relativeIssuerPath, "up"))
1114+
parsedCertificate, err := x509.ParseCertificate([]byte(cert.DER))
1115+
if err != nil {
1116+
logEvent.AddError("unable to parse certificate: %s", err)
1117+
wfe.sendError(response, logEvent, probs.ServerInternal("Unable to parse certificate"), err)
1118+
return
11451119
}
1120+
if err = wfe.addIssuingCertificateURLs(response, parsedCertificate.IssuingCertificateURL); err != nil {
1121+
logEvent.AddError("unable to parse IssuingCertificateURL: %s", err)
1122+
wfe.sendError(response, logEvent, probs.ServerInternal("unable to parse IssuingCertificateURL"), err)
1123+
return
1124+
}
1125+
11461126
response.WriteHeader(http.StatusOK)
11471127
if _, err = response.Write(cert.DER); err != nil {
11481128
logEvent.AddError(err.Error())

0 commit comments

Comments
 (0)