Skip to content

Commit dee757c

Browse files
authored
Remove multiva exception list code (letsencrypt#4933)
Fixes letsencrypt#4931
1 parent e940b63 commit dee757c

File tree

11 files changed

+21
-379
lines changed

11 files changed

+21
-379
lines changed

cmd/boulder-va/main.go

Lines changed: 1 addition & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -43,13 +43,6 @@ type config struct {
4343
Features map[string]bool
4444

4545
AccountURIPrefixes []string
46-
47-
// A filename pointing to a YAML file containing MultiVAPolicy contents.
48-
// This file will be set up to live-reload the contents of the policy file
49-
// such that the VA can use the specified disabledDomains and
50-
// disabledAccounts lists to determine whether or not to enforce multi-VA
51-
// consensus for an account/domain.
52-
MultiVAPolicyFile string
5346
}
5447

5548
Syslog cmd.SyslogConfig
@@ -164,8 +157,7 @@ func main() {
164157
scope,
165158
clk,
166159
logger,
167-
c.VA.AccountURIPrefixes,
168-
c.VA.MultiVAPolicyFile)
160+
c.VA.AccountURIPrefixes)
169161
cmd.FailOnError(err, "Unable to create VA server")
170162

171163
serverMetrics := bgrpc.NewServerMetrics(scope)

ratelimit/rate-limits_test.go

Lines changed: 9 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -147,16 +147,15 @@ func TestLoadPolicies(t *testing.T) {
147147
certsPerFQDN := policy.CertificatesPerFQDNSet()
148148
test.AssertEquals(t, certsPerFQDN.Threshold, 5)
149149
test.AssertDeepEquals(t, certsPerFQDN.Overrides, map[string]int{
150-
"le.wtf": 10000,
151-
"le1.wtf": 10000,
152-
"le2.wtf": 10000,
153-
"le3.wtf": 10000,
154-
"le.wtf,le1.wtf": 10000,
155-
"good-caa-reserved.com": 10000,
156-
"nginx.wtf": 10000,
157-
"ecdsa.le.wtf": 10000,
158-
"must-staple.le.wtf": 10000,
159-
"brokenmultiva.letsencrypt.org": 10000,
150+
"le.wtf": 10000,
151+
"le1.wtf": 10000,
152+
"le2.wtf": 10000,
153+
"le3.wtf": 10000,
154+
"le.wtf,le1.wtf": 10000,
155+
"good-caa-reserved.com": 10000,
156+
"nginx.wtf": 10000,
157+
"ecdsa.le.wtf": 10000,
158+
"must-staple.le.wtf": 10000,
160159
})
161160
test.AssertEquals(t, len(certsPerFQDN.RegistrationOverrides), 0)
162161

test/config-next/va.json

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,6 @@
4242
}
4343
],
4444
"maxRemoteValidationFailures": 1,
45-
"multiVAPolicyFile": "test/example-multiva-policy.yaml",
4645
"accountURIPrefixes": [
4746
"http://boulder:4000/acme/reg/",
4847
"http://boulder:4001/acme/acct/"

test/config/va.json

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,6 @@
4040
}
4141
],
4242
"maxRemoteValidationFailures": 1,
43-
"multiVAPolicyFile": "test/example-multiva-policy.yaml",
4443
"accountURIPrefixes": [
4544
"http://boulder:4000/acme/reg/",
4645
"http://boulder:4001/acme/acct/"

test/example-multiva-policy.yaml

Lines changed: 0 additions & 15 deletions
This file was deleted.

test/rate-limit-policies.yml

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -49,5 +49,3 @@ certificatesPerFQDNSet:
4949
nginx.wtf: 10000
5050
ecdsa.le.wtf: 10000
5151
must-staple.le.wtf: 10000
52-
# Used by integration tests for the multiVA policy file.
53-
brokenmultiva.letsencrypt.org: 10000

test/v2_integration.py

Lines changed: 7 additions & 114 deletions
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@
2222

2323
from acme import errors as acme_errors
2424

25-
from acme.messages import Status, CertificateRequest, Directory, RegistrationResource
25+
from acme.messages import Status, CertificateRequest, Directory
2626
from acme import crypto_util as acme_crypto_util
2727
from acme import client as acme_client
2828
from acme import messages
@@ -774,7 +774,7 @@ def test_only_return_existing_reg():
774774
email = "test@not-example.com"
775775
client.new_account(messages.NewRegistration.from_data(email=email,
776776
terms_of_service_agreed=True))
777-
777+
778778
client = chisel2.uninitialized_client(key=client.net.key)
779779
class extendedAcct(dict):
780780
def json_dumps(self, indent=None):
@@ -806,7 +806,7 @@ def BouncerHTTPRequestHandler(redirect, guestlist):
806806
spot for that UA it will be redirected to the real server and the
807807
guestlist will be decremented. Once the guestlist spots for a UA are
808808
expended requests will get a bogus result and have to stand outside in the
809-
cold
809+
cold
810810
"""
811811
class BouncerHandler(BaseHTTPRequestHandler):
812812
def __init__(self, *args, **kwargs):
@@ -851,19 +851,15 @@ def wait_for_server(addr):
851851
pass
852852
time.sleep(0.5)
853853

854-
def multiva_setup(client, guestlist, domain=None):
854+
def multiva_setup(client, guestlist):
855855
"""
856856
Setup a testing domain and backing multiva server setup. This will block
857857
until the server is ready. The returned cleanup function should be used to
858858
stop the server. The first bounceFirst requests to the server will be sent
859859
to the real challtestsrv for a good answer, the rest will get a bad
860-
answer. If no explicit testing domain is provided then one is randomly
861-
chosen with random_domain().
860+
answer. Domain name is randomly chosen with random_domain().
862861
"""
863-
if domain is None:
864-
hostname = random_domain()
865-
else:
866-
hostname = domain
862+
hostname = random_domain()
867863

868864
csr_pem = chisel2.make_csr([hostname])
869865
order = client.new_order(csr_pem)
@@ -1000,109 +996,6 @@ def test_http_multiva_threshold_fail():
1000996
if not httpChall.error.detail.startswith("During secondary validation: "):
1001997
raise(Exception("expected 'During secondary validation' problem detail, found {0}".format(httpChall.error.detail)))
1002998

1003-
def test_http_multiva_threshold_fail_domain_disabled():
1004-
client = chisel2.make_client()
1005-
1006-
# Configure a guestlist that will fail the multiVA threshold test by
1007-
# only allowing the primary VA.
1008-
guestlist = {"boulder": 1}
1009-
1010-
# Explicitly use a domain name that exists in
1011-
# `test/example-multiva-policy.yaml`'s disabledDomains list
1012-
domain = "brokenmultiva.letsencrypt.org"
1013-
1014-
_, cleanup = multiva_setup(client, guestlist, domain)
1015-
1016-
# We do not expect any errors, even though the guestlist ensured multi-va
1017-
# failures, because the domain was in the multi VA policy disabledDomains
1018-
# list.
1019-
try:
1020-
chisel2.auth_and_issue([domain], client=client, chall_type="http-01")
1021-
finally:
1022-
cleanup()
1023-
1024-
def test_http_multiva_threshold_fail_account_disabled():
1025-
# Create an ACME account
1026-
client = chisel2.make_client()
1027-
1028-
# Find the numeric ID it was assigned by the ACME server
1029-
acctURI = client.net.account.uri
1030-
if len(acctURI.split("/")) < 1:
1031-
raise(Exception("invalid account URI for newly registered account: {0}".format(acctURI)))
1032-
acctID = acctURI.split("/")[-1:][0]
1033-
1034-
def run_query(query):
1035-
command=["mysql",
1036-
"-h", "bmysql",
1037-
"-u", "root",
1038-
"--password=",
1039-
"-e", query,
1040-
"boulder_sa_integration",
1041-
]
1042-
subprocess.check_call(command, shell=False, stderr=subprocess.STDOUT)
1043-
1044-
def flip_ids(oldID, newID):
1045-
"""
1046-
flip_ids changes a registrations ID from one value to another. Note that
1047-
in order for this to succeed all other tables with foreign key
1048-
constraints on the registration.ID field must be adjusted or otherwise
1049-
dealt with.
1050-
"""
1051-
run_query("UPDATE registrations SET id={0} WHERE id={1}".format(newID, oldID))
1052-
1053-
def remove_certs(newID):
1054-
"""
1055-
remove_certs deletes rows created while the account registration ID was changed.
1056-
We need to delete these rows so that the original account registration
1057-
ID can be restored without violating the foreign key constraints on the
1058-
certs, precerts and serials tables. Updating the registrationID of these
1059-
rows first is difficult because the new value (the original ID) doesn't
1060-
exist in the registrations table yet. The best solution would be doing
1061-
all of this in one transaction but we're already deep in hacky
1062-
integration test yak shaving at this point...
1063-
"""
1064-
run_query("DELETE FROM certificates WHERE registrationID={0}".format(newID))
1065-
run_query("DELETE FROM precertificates WHERE registrationID={0}".format(newID))
1066-
run_query("DELETE FROM serials WHERE registrationID={0}".format(newID))
1067-
1068-
try:
1069-
# Update the account ID in the database to match an ID that exists in
1070-
# `test/example-multi-va-policy.yaml`'s disabledAccounts list. We do this
1071-
# with direct DB access because the alternative is hackish rewriting of the
1072-
# policy YAML file at runtime (especially since the reload event can't be
1073-
# easily detected). This approach is _also_ hackish, but marginally less so.
1074-
newID=99991337
1075-
flip_ids(acctID, newID)
1076-
1077-
# Update the in-memory account ID for the client instance to match
1078-
client.net.account = RegistrationResource(
1079-
body=client.net.account.body,
1080-
uri=acctURI.replace(acctID, str(newID)),
1081-
terms_of_service=client.net.account.terms_of_service)
1082-
1083-
# Configure a guestlist that will fail the multiVA threshold test by
1084-
# only allowing the primary VA.
1085-
guestlist = {"boulder": 1}
1086-
1087-
# Setup for a random domain name
1088-
domain, cleanup = multiva_setup(client, guestlist, domain=None)
1089-
1090-
# We do not expect any errors, even though the guestlist ensured multi-va
1091-
# failures, because the client was set up with an account key corresponding
1092-
# to a multi VA policy disabledAccount ID.
1093-
chisel2.auth_and_issue([domain], client=client, chall_type="http-01")
1094-
finally:
1095-
cleanup()
1096-
# Remove certificates and related resources issued by the
1097-
# fixed example-multi-va-policy.yaml account ID. This avoids foreign key
1098-
# constraints being broken when we flip_ids next.
1099-
remove_certs(newID)
1100-
# Change the account ID back to the old account ID. This will prevent
1101-
# duplicate key errors when the integration test is run again and tries
1102-
# to update a different newly created account to the fixed ID from the
1103-
# example-multi-va-policy.yaml file.
1104-
flip_ids(newID, acctID)
1105-
1106999
class FakeH2ServerHandler(socketserver.BaseRequestHandler):
11071000
"""
11081001
FakeH2ServerHandler is a TCP socket handler that writes data representing an
@@ -1184,7 +1077,7 @@ def test_new_order_policy_errs():
11841077
client = chisel2.make_client(None)
11851078

11861079
# 'in-addr.arpa' is present in `test/hostname-policy.yaml`'s
1187-
# HighRiskBlockedNames list.
1080+
# HighRiskBlockedNames list.
11881081
csr_pem = chisel2.make_csr(["out-addr.in-addr.arpa", "between-addr.in-addr.arpa"])
11891082

11901083
# With two policy blocked names in the order we expect to get back a top

va/policy.go

Lines changed: 0 additions & 95 deletions
This file was deleted.

0 commit comments

Comments
 (0)