Commit graph

10392 commits

Author SHA1 Message Date
Peter Eckersley
40e29bb95f begin implementing OCSP checking for "certificates" 2016-12-21 14:38:20 -08:00
James Kasten
15d2a0ffde Import OCSP code from the historical cert_manager branch
(This is pde committing jdkasten's code)
2016-12-21 14:36:51 -08:00
Tan Jay Jun
44d5886429 Add missing comma to documentation for 'renew' subcommand (#3945) 2016-12-21 14:21:52 -08:00
Erica Portnoy
8ebca1c052 Return domains for _find_domains_or_certname (#3937)
* Return domains for _find_domains_or_certname

* Revamp find_domains_or_certname
2016-12-20 17:17:01 -08:00
Brad Warren
00e143d369 Serialize coverage tests (#3919)
* Serialize coverage tests

* add py27_install env

* Separate cover from integration tests

* Add docker to py27 integration tests
2016-12-20 16:24:33 -08:00
Brad Warren
28ce10fef5 Don't add ServerAlias directives when the domain is already covered by a wildcard (#3917)
* correctly match * and ? in ServerAlias directives

* update Apache wildcard test

* Consolidate wildcard matching and remove bad test

* Test Apache vhost selection with wildcards

* Added few more tests to proof vhost selection
2016-12-20 15:53:52 -08:00
Brad Warren
f92254769b I promise checklists are OK (fixes #3934) (#3940)
* TIL checklist calls input

* full coverage on certbot/display/util.py

* improve no double warning test
2016-12-20 14:34:12 -08:00
Craig Smith
6a933f1de3 Changed plugin interface return types (#3748). (#3780) 2016-12-19 18:02:05 -08:00
Peter Eckersley
6a67ce5567 Ensure that path_surgery doesn't happen until we have a logger 2016-12-19 17:00:09 -08:00
Lior Sabag
acc501d3a1 Fix typo (#3932) 2016-12-19 12:49:27 -08:00
Brad Warren
ae379568b1 Mitigate problems for people who run without -n (#3916)
* CLI flag for forcing interactivity

* add --force-interactive

* Add force_interactive error checking and tests

* Add force_interactive parameter to FileDisplay

* add _can_interact

* Add _return_default

* Add **unused_kwargs to NoninteractiveDisplay

* improve _return_default assertion

* Change IDisplay calls and write tests

* Document force_interactive in interfaces.py

* Don't force_interactive with a new prompt

* Warn when skipping an interaction for the first time

* add specific logger.debug message
2016-12-19 12:45:40 -08:00
Peter Eckersley
186a8c888f Path surgery makes sense for hooks that may be called from cron 2016-12-17 15:02:13 -08:00
Peter Eckersley
64daefea6b util.exe_exists and hooks._which were almost identical; merge them 2016-12-17 15:02:10 -08:00
Erica Portnoy
81fd0cd32c Implement delete command (#3913)
* organize cert_manager.py

* add delete files to cert manager and storage

* add tests

* add to main and cli

* Clean up all related files we can find, even if some are missing.

* error messages, debug logs, and remove RenewerConfiguration

* add logs for failure to remove

* remove renewer_config_file
2016-12-15 20:23:02 -08:00
Erica Portnoy
16361bfd06 test using os.path.sep not hardcoded / (#3920) 2016-12-15 19:41:42 -08:00
Peter Eckersley
99482e8047 Document subtle new semantics 2016-12-15 17:41:34 -08:00
Peter Eckersley
de77dd74ad Unbreak repeated insertion logic 2016-12-15 17:31:32 -08:00
Peter Eckersley
33de782fba Make post hooks run in deterministic order 2016-12-15 17:28:16 -08:00
Peter Eckersley
0c2dc60484 Integration tests for hooks 2016-12-15 17:28:16 -08:00
Peter Eckersley
6f9abde894 Support intricate combinations of pre-hooks in different lineages 2016-12-15 17:28:16 -08:00
Peter Eckersley
0bea6c7350 Log when we run renew hooks (why weren't we doing this already?) 2016-12-15 17:28:16 -08:00
Peter Eckersley
876a760a91 Begin implementing pre / post-hook preservation 2016-12-15 17:28:16 -08:00
Erica Portnoy
27525fb205 Use relative paths for livedir symlinks (#3914)
* Use relative paths for livedir symlinks

* switch directory back for the rest of the tests
2016-12-15 11:00:07 -08:00
Peter Eckersley
107851ee9b Document defaults (#3863)
* Begin fixing incorrect defaults

* Fix more defaults

* Make more defaults correct

* Update cli-help.txt

(To show what this PR does)

* Lint

* Extend argparse rather than vendoring it

* lint

* Move sample User Agent generation into the same module as UA generation

* Revert cli-help.txt to previous release version

* Slightly more consistent linebreaks
2016-12-13 17:32:46 -08:00
Clif Houck
ad53c80c1e Fix certbox-nginx address equality check (#3886)
0.0.0.0, *, and '' are equivalent hosts to nginx. Changes Addr object's
equality testing to treat them as equal.

Fixes #3855
2016-12-13 14:38:57 -08:00
Peter Eckersley
0464ba2c4b Implement our fancy new --help output (#3883)
* Start reorganising -h output

* Fix the --debug flag

  - Currently exceptions are often caught and burried in log files, even
    if this flag is provided!

* Explain the insanity

* Parallalelise nosetests from tox (#3836)

* Parallalelise nosetests from tox

* Parallelise even more things, break even more things

* Now unbreak all the tests that aren't ready for ||ism

* Try to pass tests!

 - Remove non-working hack in reporter_test
 - also be selective about ||ism in the cover environment

* Try again

* certbot-apache tests also work, given enough time

* Nginx may need more time in Travis's cloud

* Unbreak reporter_test under ||ism

* More timeout

* Working again?

* This goes way faster

* Another big win

* Split a couple more large test suites

* A last improvement

* More ||ism!

* ||ise lint too

* Allow nosetests to figure out how many cores to use

* simplify merge

* Mark the new CLI tests as ||izable

* Simplify reporter_test changes

* Rationalise ||ism flags

* Re-up coverage

* Clean up reporter tests

* Stop modifying testdata during tests

* remove unused os

* Improve the "certbot certificates" output (#3846)

* Begin making "certbot certificates" future safe

* Handle the case where a renewal conf file has no "server" entry

* Improvements, tweaks

* Capitalise on things

* Print the command summary for -h and -h all, but not otherwise

Also, update nginx not installed CLI hint

* Add a "certificates" help section

* Clean up usage string construction

* Greatly improve "certbot -h TOPIC"

  - subcommands now get their own usage headings if they want them
  - added "certbot -h commands"

* A few more cli formatting tests

* Auto-populate the verb subgroups from the docs

* Show the new help output

* Lint, tweak

* More lint, and cleanup

* Infinite lint

* Add rename to command summary; sort "-h commands" output

* Use fancy string formatting

* More space

* Implement --help manage

Also, implement a general mechanism for documenting subcommands within
topics

* Remove one comma

* Only create weird parser structures if -h is provided :)

* Update sample cli out

* Lint

* Revert cli-help.txt to previous release version

* Grammar & style
2016-12-13 14:19:47 -08:00
Maarten
dc81c291b4 Change link of haproxy plugin to new version (#3904)
Greenhost has rewritten their HAProxy plugin and it's hosted on a different location. The original URL also points to this new location: https://code.greenhost.net/open/letsencrypt-haproxy
2016-12-13 13:13:55 -08:00
Peter Eckersley
2d7f6d7d92 Ensure apt-cache is always running in English if we're going to grep its output (#3900) 2016-12-12 17:20:52 -08:00
Frank
e6f24db624 Sort the names by domain (then subdomain) before showing them (#3892)
* Sort the names by domain (then subdomain) before showing them

* Sort the names in display + tests
2016-12-11 02:18:32 -08:00
Joona Hoikkala
e9f040e209 Make default renewal file permissions more strict (#3891) 2016-12-10 11:19:20 -08:00
Peter Eckersley
22e0f5779a Fix --debug (#3877)
* Fix the --debug flag

  - Currently exceptions are often caught and burried in log files, even
    if this flag is provided!

* Explain the insanity

* Make things slightly nicer
2016-12-09 14:56:14 -08:00
Brad Warren
9bdb3d67bc make our linter happy (#3881) 2016-12-08 20:29:59 -08:00
Erica Portnoy
4a4977a54d Make renew command respect the --cert-name flag (#3880)
* Renew command respects --cert-name flag

* Error out early if requested cert doesn't exist
2016-12-08 18:27:23 -08:00
Erica Portnoy
0a7ca2f32e Implement the --cert-name flag to select a lineage by its name, and the rename verb. (#3785)
* Rename and simplify main functions

* pass certname to auth method

* find cert by certname flag

* Implement --cert-name command

* don't ask to confirm new cert when we have domains and no existing certs with the lineage name

* Refactor and add --new-cert-name flag

* add interactivity to rename verb

* allow noninteractive and more descriptive function names
2016-12-08 11:53:30 -08:00
Peter Eckersley
cc86ff2a21 Improve the "certbot certificates" output (#3846)
* Begin making "certbot certificates" future safe

* Handle the case where a renewal conf file has no "server" entry
2016-12-07 16:02:13 -08:00
Thomas Mayer
823cba55e3 Avoid eval() (#3844) 2016-12-07 23:02:42 +01:00
Peter Eckersley
59c602d9ca Parallalelise nosetests from tox (#3836)
* Parallalelise nosetests from tox

* Parallelise even more things, break even more things

* Now unbreak all the tests that aren't ready for ||ism

* Try to pass tests!

 - Remove non-working hack in reporter_test
 - also be selective about ||ism in the cover environment

* Try again

* certbot-apache tests also work, given enough time

* Nginx may need more time in Travis's cloud

* Unbreak reporter_test under ||ism

* More timeout

* Working again?

* This goes way faster

* Another big win

* Split a couple more large test suites

* A last improvement

* More ||ism!

* ||ise lint too

* Allow nosetests to figure out how many cores to use

* simplify merge

* Mark the new CLI tests as ||izable

* Simplify reporter_test changes

* Rationalise ||ism flags

* Re-up coverage

* Clean up reporter tests

* Stop modifying testdata during tests

* remove unused os
2016-12-06 20:39:16 -08:00
Kenneth Skovhede
184d673378 Busybox support (#3797)
* Added support for shells without default variable support

* Added support for BusyBox installs that do not have `command` but has `which`

* Style fixes as suggested by reviewer

* Renamed `WHERE_IS` to `EXISTS` as suggested by review

* Removed expansion of `$LE_AUTO_SUDO` to `x` as the `-n` can check empty strings.

* Added `EXISTS` to debian bootstrap as suggested in review
2016-12-05 19:40:07 -08:00
Erica Portnoy
f0a7bb0e33 Mark Nginx vhosts as ssl when any vhost is on ssl at that address (#3856)
* Move parse_server to be a method of NginxParser

* add super equal method to more correctly check addr equality in nginx should we support ipv6 in nginx in the future

* add addr:normalized_tuple method

* mark addresses listening sslishly due to another server block listening sslishly on that address

* test turning on ssl globally

* add docstring

* lint and remove extra file
2016-12-05 19:17:04 -08:00
Timothy Guan-tin Chien
3dbf5c9fcb certbot-auto: Print link to doc on debugging pip install error [revision requested] (#3473)
* certbot-auto: Print link to doc on debugging pip install error

Also, update the doc to teach the user to workaround problem on a low
memory system.

* Correct formatting

* grep the PIP_OUT and print useful info if the problem is about memory allocation

* Fix logic on string to grep
2016-12-05 18:49:38 -08:00
Brad Warren
feef1b411b Add pyasn1 back to le-auto (#3858) 2016-12-05 17:00:04 -08:00
Blake Griffith
65d9e997e5 Refactor cli_test.py and main_test.py (#3828)
* Begin breaking out cli_test.py

* simplify main

* refactor porse tests

* move determine account tests to main_test.py

* move duplicate cert test to main_test.py

* move cli stuff out of the way

* add test_renewal.py

* move error test into error_handler_test.py

* move test_read_file

* move test_no_gui out of MainTest

* move test_install_abspath to parsetest

* Move main tests into main_test.py

* move cli tests back into cli_test.py

* clean up cli_test.py

* move punycode test to util_test.py

* Fix NameError from missing plugins_disco

* Fix linting errors

* test_renewal.py -> renewal_test.py

* rm not_cli_test.py

* Move main._handle_exception test to main_test.py

* Move renewal import in renewal_test.py

from @ohemorange comments

* certbot.tests.test_util -> certbot.tests.util

* Fix issues from rebasing.

* Fix testing issue with option_was_set

* fix linting issue
2016-12-05 15:22:14 -08:00
Peter Eckersley
93f0846fa4 Testfarm test new leauto (#3845)
Test farm tests should test the version of letsencrypt-auto that's in the git tree, not the one from the previous release.


* Test the new leauto, not the previously released one
2016-12-05 09:09:43 -08:00
Thomas Mayer
7767f62a2e Remove recently added test (#3844) 2016-12-03 07:22:55 +01:00
Thomas Mayer
0e237e1c0b Preserve --must-staple in configuration for renewal (#3844) 2016-12-03 06:59:32 +01:00
Brad Warren
da3332ccfa Security enhancement cleanup (#3837)
* Stop passing around config and refactor tests

* Refactor and warn during enhance_config

* Use mock.ANY to make new Pythons happy

* Remove verbose enhance_config from test names

* Fix spacing in warning
2016-12-02 16:03:55 -08:00
Peter Eckersley
8b67a58f3c Ensure tests pass with openssl 1.1 (#3827)
* Ensure tests pass with openssl 1.1

A bunch of the acme.standalone and acme.crypto_util tests were using
weak crypto that is now prohibited :/

* lint

* lintlint

* Fix symlink
2016-12-02 15:11:35 -08:00
Brad Warren
edbb3a73c6 Take advantage of urllib3 pyopenssl rewrite (#3805)
* pin requests version in py26-oldest

* Determine requests security deps dynamically

Starting with requests 2.12, pyasn1 and ndg-httpsclient are no longer
needed to inject pyopenssl into urllib3. This change allows us to
determine whether or not these dependencies are required at install
time. If an older version of requests is used, these packages are
still installed. If a new version of requests is used, they are not
reducing the number of dependencies we have.

* Bump requests version in certbot-auto

* Use pkg_resources in activate test

Due to pip's lack of dependency resolution, the change to use
requests[extras] causes errors in acme.util_test because pkg_resources
accurately detects the "missing" dependency.

There isn't a real problem here. The problem comes from a brand new
requests and ancient pyopenssl as well as a unit test for
functionality we plan to remove in our next release. I modified
the unit test to fix the problem for now.

* Use six instead of pkg_resources for test

* Require requests<=2.11.1 in py27-oldest test

If we don't do this, we get test failures for the certbot package
which is actually a good thing! pkg_resources is catching the
unlikely but possible problem I describe in #3803 and erroring out
saying it is missing the necessary dependencies to run certbot.
Good job package resources.

* Undo changes to acme.util_test
2016-12-01 10:47:08 -08:00
Brad Warren
0289457a93 Use ${foo+x} not ${foo:+x} (#3833) 2016-11-30 16:09:16 -08:00
Mario Villaplana
ec0cd4d538 Warn early if a selected enhancement is unsupported by the current plugin (#3688)
Certbot currently silently allows a user to specify enhancements that are
unsupported by the chosen plugin. This adds an early warning message
indicating when a selected enhancement isn't supported by a plugin.
2016-11-30 10:50:16 -08:00