Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Add support for testing ARI in Pebble#24

Merged
eggsampler merged 4 commits into
eggsampler:masterfrom
pgporada:ari-pebble
May 29, 2024
Merged

Add support for testing ARI in Pebble#24
eggsampler merged 4 commits into
eggsampler:masterfrom
pgporada:ari-pebble

Conversation

@pgporada
Copy link
Copy Markdown
Contributor

@pgporada pgporada commented May 17, 2024

This change is dependent upon a Pebble change I made here: letsencrypt/pebble#461

  • Added makeReplacementOrderFinalized which issues a replacement order and progresses through the entire issuance workflow. It does not create a new account each time it's called which is different from the existing makeOrder and makeOrderFinalised.
  • Refactored iterating over every authorization and validating its challenges into a separate helper function validateChallenges.

@pgporada
Copy link
Copy Markdown
Contributor Author

pgporada commented May 17, 2024 •
edited
Loading

Testing pebble and this change was performed as follows:

# Run challtestsrv, version doesn't particularly matter because we're not touching this code
$ docker rm challtestsrv 2>&1; docker run -p 5001:5001 -p 5002:5002 -p 5003:5003 -p 8053:8053 -p 8055:8055 -p 8443:8443 --name challtestsrv ghcr.io/letsencrypt/pebble-challtestsrv:latest

# Get the IP of that container
$ CHALLTESTSRV=$(docker inspect challtestsrv | jq -r '.[].NetworkSettings.Networks.bridge.IPAddress')

# Run pebble
$ go run cmd/pebble/main.go -config ./test/config/pebble-config.json -dnsserver ${CHALLTESTSRV}:8053

-----------------------------
# In the eggsampler repo
$ export PEBBLE_PATH=/path/to/pebble/on/your/computer
$ go test -test.run TestClient_IssueReplacementCert

which should result in

$ go test -run TestClient_IssueReplacementCert -v
2024/05/17 15:09:33 error reading: /home/phil/.gvm/pkgsets/go1.22.2/global/src/github.com/letsencrypt/boulder/.hierarchy/root-cert-ecdsa.pem - open /home/phil/.gvm/pkgsets/go1.22.2/global/src/github.com/letsencrypt/boulder/.hierarchy/root-cert-ecdsa.pem: no such file or directory
2024/05/17 15:09:33 error reading: /home/phil/.gvm/pkgsets/go1.22.2/global/src/github.com/letsencrypt/boulder/.hierarchy/root-cert-rsa.pem - open /home/phil/.gvm/pkgsets/go1.22.2/global/src/github.com/letsencrypt/boulder/.hierarchy/root-cert-rsa.pem: no such file or directory
2024/05/17 15:09:33 error creating client for http://localhost:4001/directory - acme: error fetching response: Get "http://localhost:4001/directory": dial tcp [::1]:4001: connect: connection refused
2024/05/17 15:09:33 using pebble directory at: https://localhost:14000/dir
=== RUN   TestClient_IssueReplacementCert
    ari_test.go:65: Issuing initial order
    ari_test.go:72: Issuing first replacement order
    ari_test.go:79: Issuing second replacement order
    ari_test.go:86: Should not be able to create a duplicate replacement
--- PASS: TestClient_IssueReplacementCert (18.59s)
PASS
ok      github.com/eggsampler/acme/v3   18.604s


$ go test -run TestClient_FailedReplacementOrderAllowsAnotherReplacement -v
2024/05/21 15:56:23 error reading: /home/phil/.gvm/pkgsets/go1.22.2/global/src/github.com/letsencrypt/boulder/.hierarchy/root-cert-ecdsa.pem - open /home/phil/.gvm/pkgsets/go1.22.2/global/src/github.com/letsencrypt/boulder/.hierarchy/root-cert-ecdsa.pem: no such file or directory
2024/05/21 15:56:23 error reading: /home/phil/.gvm/pkgsets/go1.22.2/global/src/github.com/letsencrypt/boulder/.hierarchy/root-cert-rsa.pem - open /home/phil/.gvm/pkgsets/go1.22.2/global/src/github.com/letsencrypt/boulder/.hierarchy/root-cert-rsa.pem: no such file or directory
2024/05/21 15:56:23 using pebble directory at: https://localhost:14000/dir
=== RUN   TestClient_FailedReplacementOrderAllowsAnotherReplacement
    ari_test.go:94: Issuing initial order
    ari_test.go:112: Issuing replacement order which will intentionally fail
    ari_test.go:119: Issuing replacement order for a parent order who previously had a failed replacement order
--- PASS: TestClient_FailedReplacementOrderAllowsAnotherReplacement (16.55s)
PASS
ok      github.com/eggsampler/acme/v3   16.571s

aarongable
aarongable approved these changes May 23, 2024
View reviewed changes
Copy link
Copy Markdown
Contributor

@aarongable aarongable left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is cool, I like these extended tests! LGTM, in case my opinion helps :D

@pgporada
Copy link
Copy Markdown
Contributor Author

pgporada commented May 24, 2024

@eggsampler ARI support has landed in Pebble as of a few moments ago. letsencrypt/pebble#461

Would you mind taking a look at this when you can, please?

@pgporada pgporada mentioned this pull request May 24, 2024
Closed
@eggsampler
Copy link
Copy Markdown
Owner

eggsampler commented May 24, 2024

Code looks good, thankyou!

My only query is, should there be some form of guard on the ari test code where the acme server in test does not support ari? ie,

acme/order_test.go

Lines 138 to 141 in 79b263f

if testClient.dir.RenewalInfo == "" {
t.Skip("acme server does not support ari renewals")
return
}

It's not super critical as this is primarily for boulder and pebble anyway, but when I first ran the make pebble test, I didn't realise the pebble ari code hadn't been tagged in a release and some of the tests failed.

@pgporada
Copy link
Copy Markdown
Contributor Author

pgporada commented May 25, 2024 via email

@eggsampler eggsampler merged commit 79ababe into eggsampler:master May 29, 2024
@pgporada pgporada deleted the ari-pebble branch May 30, 2024 13:56
@pgporada
Copy link
Copy Markdown
Contributor Author

pgporada commented May 31, 2024

@eggsampler I've just cut pebble v2.6.0 which has ARI support, rather than having to pull the main branch.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

1 more reviewer

@aarongable aarongable aarongable approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@pgporada @eggsampler @aarongable