Make RA check sanity and make tests pass

bifurcation · bifurcation · commit eb42a08258da · 2015-10-03T10:41:23.000-04:00
diff --git a/core/challenges.go b/core/challenges.go
@@ -6,26 +6,15 @@
 package core
 
 import (
-	"encoding/json"
 	"github.com/letsencrypt/boulder/Godeps/_workspace/src/github.com/letsencrypt/go-jose"
 )
 
 func newChallenge(challengeType string, accountKey *jose.JsonWebKey) (Challenge, error) {
-	ak := AuthorizedKey{
-		Token: NewToken(),
-		Key:   accountKey,
-	}
-
-	jsonAK, err := json.Marshal(ak)
-	if err != nil {
-		return Challenge{}, err
-	}
-
 	return Challenge{
-		Type:          challengeType,
-		Status:        StatusPending,
-		AccountKey:    accountKey,
-		AuthorizedKey: jsonAK,
+		Type:       challengeType,
+		Status:     StatusPending,
+		AccountKey: accountKey,
+		Token:      NewToken(),
 	}, nil
 }
 
@@ -53,16 +42,9 @@ func DvsniChallenge(accountKey *jose.JsonWebKey) (Challenge, error) {
 	}, nil
 }
 
-// HTTPChallenge constructs a random http-00 challenge
+// HTTPChallenge constructs a random http-01 challenge
 func HTTPChallenge01(accountKey *jose.JsonWebKey) (Challenge, error) {
-	chall, err := newChallenge(ChallengeTypeHTTP01, accountKey)
-	if err != nil {
-		return Challenge{}, err
-	}
-
-	tls := true
-	chall.TLS = &tls
-	return chall, nil
+	return newChallenge(ChallengeTypeHTTP01, accountKey)
 }
 
 // DvsniChallenge constructs a random tls-sni-00 challenge
diff --git a/ra/registration-authority.go b/ra/registration-authority.go
@@ -506,6 +506,12 @@ func (ra *RegistrationAuthorityImpl) UpdateAuthorization(base core.Authorization
 	}
 	authz.Challenges[challengeIndex] = authz.Challenges[challengeIndex].MergeResponse(response)
 
+	// At this point, the challenge should be sane as a complete challenge
+	if !authz.Challenges[challengeIndex].IsSane(true) {
+		err = core.MalformedRequestError("Response does not complete challenge")
+		return
+	}
+
 	// Store the updated version
 	if err = ra.SA.UpdatePendingAuthorization(authz); err != nil {
 		// This can pretty much only happen when the client corrupts the Challenge
diff --git a/ra/registration-authority_test.go b/ra/registration-authority_test.go
@@ -101,9 +101,6 @@ var (
 	}
 
 	ResponseIndex = 0
-	Response      = core.Challenge{
-		Type: "simpleHttp",
-	}
 
 	ExampleCSR = &x509.CertificateRequest{}
 
@@ -128,6 +125,19 @@ const (
 	saDBConnStr = "mysql+tcp://boulder@localhost:3306/boulder_sa_test"
 )
 
+func makeResponse(ch core.Challenge) (out core.Challenge, err error) {
+	jsonAuthorizedKey, err := json.Marshal(core.AuthorizedKey{
+		Token: ch.Token,
+		Key:   ch.AccountKey,
+	})
+	if err != nil {
+		return
+	}
+
+	out = core.Challenge{AuthorizedKey: jsonAuthorizedKey}
+	return
+}
+
 func initAuthorities(t *testing.T) (*DummyValidationAuthority, *sa.SQLStorageAuthority, *RegistrationAuthorityImpl, clock.FakeClock, func()) {
 	err := json.Unmarshal(AccountKeyJSONA, &AccountKeyA)
 	test.AssertNotError(t, err, "Failed to unmarshal public JWK")
@@ -406,7 +416,9 @@ func TestUpdateAuthorization(t *testing.T) {
 	authz, err := ra.NewAuthorization(AuthzRequest, Registration.ID)
 	test.AssertNotError(t, err, "NewAuthorization failed")
 
-	authz, err = ra.UpdateAuthorization(authz, ResponseIndex, Response)
+	response, err := makeResponse(authz.Challenges[ResponseIndex])
+	test.AssertNotError(t, err, "Unable to construct response to challenge")
+	authz, err = ra.UpdateAuthorization(authz, ResponseIndex, response)
 	test.AssertNotError(t, err, "UpdateAuthorization failed")
 
 	// Verify that returned authz same as DB
@@ -440,7 +452,9 @@ func TestUpdateAuthorizationReject(t *testing.T) {
 	test.AssertNotError(t, err, "UpdateRegistration failed")
 
 	// Verify that the RA rejected the authorization request
-	_, err = ra.UpdateAuthorization(authz, ResponseIndex, Response)
+	response, err := makeResponse(authz.Challenges[ResponseIndex])
+	test.AssertNotError(t, err, "Unable to construct response to challenge")
+	_, err = ra.UpdateAuthorization(authz, ResponseIndex, response)
 	test.AssertEquals(t, err, core.UnauthorizedError("Challenge cannot be updated with a different key"))
 
 	t.Log("DONE TestUpdateAuthorizationReject")
