RuhNetConsulting
/
getssl
mirror of https://github.com/srvrco/getssl
1
0
Fork 0
Code Issues 0 Projects 0 Releases 51 Wiki Activity
Browse Source

Merge pull request #848 from srvrco/update-pebble-docker-repo 

Move to from dockerhub to github for pebble docker image
pull/841/merge
Tim Kimber 1 year ago
committed by GitHub
parent
51cd0391e0 523b95e3b8
commit
e3962ce63a
No known key found for this signature in database GPG Key ID: B5690EEEBB952194
18 changed files with 168 additions and 115 deletions
Unified View
Diff Options
Show Stats Download Patch File Download Diff File
  1. +26
    -26
      .github/workflows/run-tests-pebble.yml
  2. +2
    -2
      .github/workflows/run-tests-staging-acmedns.yml
  3. +4
    -4
      .github/workflows/run-tests-staging-duckdns.yml
  4. +4
    -4
      .github/workflows/run-tests-staging-dynu.yml
  5. +46
    -52
      README
  6. +4
    -5
      docker-compose.yml
  7. +1
    -1
      getssl
  8. +2
    -2
      test/24-wildcard-sans.bats
  9. +20
    -2
      test/34-ftp-passive.bats
  10. +20
    -2
      test/34-ftp-ports.bats
  11. +2
    -2
      test/35-preferred-chain.bats
  12. +5
    -0
      test/Dockerfile-centos7
  13. +10
    -9
      test/README-Testing.md
  14. +1
    -0
      test/debug-test.sh
  15. +12
    -0
      test/run-test.sh
  16. +4
    -2
      test/test_helper.bash
  17. +3
    -0
      test/u2-test-get_auth_dns-drill.bats
  18. +2
    -2
      test/u8-test-get_auth_dns-cname-nslookup.bats

+ 26
- 26
.github/workflows/run-tests-pebble.yml View File

@ -18,103 +18,103 @@ jobs:
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- uses: actions/checkout@v3 - uses: actions/checkout@v3
- name: Build the docker-compose stack
run: docker-compose up -d --build
- name: Build the docker compose stack
run: docker compose up -d --build
- name: Run test suite on Alpine - name: Run test suite on Alpine
run: test/run-test.sh alpine run: test/run-test.sh alpine
test-bash-4-0: test-bash-4-0:
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- uses: actions/checkout@v3 - uses: actions/checkout@v3
- name: Build the docker-compose stack
run: docker-compose up -d --build
- name: Build the docker compose stack
run: docker compose up -d --build
- name: Run test suite on Alpine using Bash 4.0 - name: Run test suite on Alpine using Bash 4.0
run: test/run-test.sh bash4-0 run: test/run-test.sh bash4-0
test-bash-4-2: test-bash-4-2:
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- uses: actions/checkout@v3 - uses: actions/checkout@v3
- name: Build the docker-compose stack
run: docker-compose up -d --build
- name: Build the docker compose stack
run: docker compose up -d --build
- name: Run test suite on Alpine using Bash 4.2 - name: Run test suite on Alpine using Bash 4.2
run: test/run-test.sh bash4-2 run: test/run-test.sh bash4-2
test-bash-5-0: test-bash-5-0:
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- uses: actions/checkout@v3 - uses: actions/checkout@v3
- name: Build the docker-compose stack
run: docker-compose up -d --build
- name: Build the docker compose stack
run: docker compose up -d --build
- name: Run test suite on Alpine using Bash 5 - name: Run test suite on Alpine using Bash 5
run: test/run-test.sh bash5-0 run: test/run-test.sh bash5-0
test-centos6: test-centos6:
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- uses: actions/checkout@v3 - uses: actions/checkout@v3
- name: Build the docker-compose stack
run: docker-compose up -d --build
- name: Build the docker compose stack
run: docker compose up -d --build
- name: Run test suite on CentOS6 - name: Run test suite on CentOS6
run: test/run-test.sh centos6 run: test/run-test.sh centos6
test-centos7: test-centos7:
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- uses: actions/checkout@v3 - uses: actions/checkout@v3
- name: Build the docker-compose stack
run: docker-compose up -d --build
- name: Build the docker compose stack
run: docker compose up -d --build
- name: Run test suite on CentOS7 - name: Run test suite on CentOS7
run: test/run-test.sh centos7 run: test/run-test.sh centos7
test-centos8: test-centos8:
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- uses: actions/checkout@v3 - uses: actions/checkout@v3
- name: Build the docker-compose stack
run: docker-compose up -d --build
- name: Build the docker compose stack
run: docker compose up -d --build
- name: Run test suite on CentOS8 - name: Run test suite on CentOS8
run: test/run-test.sh centos8 run: test/run-test.sh centos8
test-debian: test-debian:
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- uses: actions/checkout@v3 - uses: actions/checkout@v3
- name: Build the docker-compose stack
run: docker-compose up -d --build
- name: Build the docker compose stack
run: docker compose up -d --build
- name: Run test suite on Debian - name: Run test suite on Debian
run: test/run-test.sh debian run: test/run-test.sh debian
test-rockylinux8: test-rockylinux8:
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- uses: actions/checkout@v3 - uses: actions/checkout@v3
- name: Build the docker-compose stack
run: docker-compose up -d --build
- name: Build the docker compose stack
run: docker compose up -d --build
- name: Run test suite on RockyLinux8 - name: Run test suite on RockyLinux8
run: test/run-test.sh rockylinux8 run: test/run-test.sh rockylinux8
test-ubuntu: test-ubuntu:
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- uses: actions/checkout@v3 - uses: actions/checkout@v3
- name: Build the docker-compose stack
run: docker-compose up -d --build
- name: Build the docker compose stack
run: docker compose up -d --build
- name: Run test suite on Ubuntu - name: Run test suite on Ubuntu
run: test/run-test.sh ubuntu run: test/run-test.sh ubuntu
test-ubuntu14: test-ubuntu14:
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- uses: actions/checkout@v3 - uses: actions/checkout@v3
- name: Build the docker-compose stack
run: docker-compose up -d --build
- name: Build the docker compose stack
run: docker compose up -d --build
- name: Run test suite on Ubuntu14 - name: Run test suite on Ubuntu14
run: test/run-test.sh ubuntu14 run: test/run-test.sh ubuntu14
test-ubuntu16: test-ubuntu16:
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- uses: actions/checkout@v3 - uses: actions/checkout@v3
- name: Build the docker-compose stack
run: docker-compose up -d --build
- name: Build the docker compose stack
run: docker compose up -d --build
- name: Run test suite on Ubuntu16 - name: Run test suite on Ubuntu16
run: test/run-test.sh ubuntu16 run: test/run-test.sh ubuntu16
test-ubuntu18: test-ubuntu18:
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- uses: actions/checkout@v3 - uses: actions/checkout@v3
- name: Build the docker-compose stack
run: docker-compose up -d --build
- name: Build the docker compose stack
run: docker compose up -d --build
- name: Run test suite on Ubuntu18 - name: Run test suite on Ubuntu18
run: test/run-test.sh ubuntu18 run: test/run-test.sh ubuntu18

+ 2
- 2
.github/workflows/run-tests-staging-acmedns.yml View File

@ -21,7 +21,7 @@ jobs:
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- uses: actions/checkout@v3 - uses: actions/checkout@v3
- name: Build the docker-compose stack
run: docker-compose up -d --build
- name: Build the docker compose stack
run: docker compose up -d --build
- name: Run test suite on Ubuntu against Staging using acmedns - name: Run test suite on Ubuntu against Staging using acmedns
run: test/run-test.sh ubuntu-acmedns run: test/run-test.sh ubuntu-acmedns

+ 4
- 4
.github/workflows/run-tests-staging-duckdns.yml View File

@ -10,8 +10,8 @@ jobs:
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- uses: actions/checkout@v3 - uses: actions/checkout@v3
- name: Build the docker-compose stack
run: docker-compose up -d --build
- name: Build the docker compose stack
run: docker compose up -d --build
- name: Run test suite on CentOS7 against Staging using DuckDNS - name: Run test suite on CentOS7 against Staging using DuckDNS
run: test/run-test.sh centos7-duckdns run: test/run-test.sh centos7-duckdns
test-ubuntu-duckdns: test-ubuntu-duckdns:
@ -20,7 +20,7 @@ jobs:
needs: test-centos7-duckdns needs: test-centos7-duckdns
steps: steps:
- uses: actions/checkout@v3 - uses: actions/checkout@v3
- name: Build the docker-compose stack
run: docker-compose up -d --build
- name: Build the docker compose stack
run: docker compose up -d --build
- name: Run test suite on Ubuntu against Staging using DuckDNS - name: Run test suite on Ubuntu against Staging using DuckDNS
run: test/run-test.sh ubuntu-duckdns run: test/run-test.sh ubuntu-duckdns

+ 4
- 4
.github/workflows/run-tests-staging-dynu.yml View File

@ -10,8 +10,8 @@ jobs:
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- uses: actions/checkout@v3 - uses: actions/checkout@v3
- name: Build the docker-compose stack
run: docker-compose up -d --build
- name: Build the docker compose stack
run: docker compose up -d --build
- name: Run test suite on CentOS7 against Staging using Dynu - name: Run test suite on CentOS7 against Staging using Dynu
run: test/run-test.sh centos7-dynu run: test/run-test.sh centos7-dynu
test-ubuntu-dynu: test-ubuntu-dynu:
@ -20,7 +20,7 @@ jobs:
needs: test-centos7-dynu needs: test-centos7-dynu
steps: steps:
- uses: actions/checkout@v3 - uses: actions/checkout@v3
- name: Build the docker-compose stack
run: docker-compose up -d --build
- name: Build the docker compose stack
run: docker compose up -d --build
- name: Run test suite on Ubuntu against Staging using Dynu - name: Run test suite on Ubuntu against Staging using Dynu
run: test/run-test.sh ubuntu-dynu run: test/run-test.sh ubuntu-dynu

+ 46
- 52
README View File

@ -1,77 +1,71 @@
GETSSL
# GETSSL
[Run all tests] [shellcheck] [Run all tests] [shellcheck]
Obtain SSL certificates from the letsencrypt.org ACME server. Suitable Obtain SSL certificates from the letsencrypt.org ACME server. Suitable
for automating the process on remote servers. for automating the process on remote servers.
Table of Contents
- Upgrade broken in v2.43
- Features
- Overview
- Quick Start Guide
- Manual Installation
- Getting started
- Detailed guide to getting started with more examples
- Wildcard certificates
- ISPConfig
- Automating updates
- Structure
- Server-Types
- Revoke a certificate
- Elliptic curve keys
- Preferred Chain
- Include Root certificate in full chain
- Windows Server and IIS Support
- Building getssl as an RPM Package (Redhat/CentOS/SuSe/Oracle/AWS)
- Building getssl as a Debian Package (Debian/Ubuntu)
- Issues / problems / help
Table of Contents
- Upgrade broken in v2.43
- Features
- Overview
- Quick Start Guide
- Manual Installation
- Getting started
- Detailed guide to getting started with more examples
- Wildcard certificates
- ISPConfig
- Automating updates
- Structure
- Server-Types
- Revoke a certificate
- Elliptic curve keys
- Preferred Chain
- Include Root certificate in full chain
- Windows Server and IIS Support
- Building getssl as an RPM Package (Redhat/CentOS/SuSe/Oracle/AWS)
- Building getssl as a Debian Package (Debian/Ubuntu)
- Issues / problems / help
Upgrade broken in v2.43 Upgrade broken in v2.43
The automatic upgrade in v2.43 is broken as the url is incorrect. If you The automatic upgrade in v2.43 is broken as the url is incorrect. If you
have this version installed you’ll need to manually upgrade using: have this version installed you’ll need to manually upgrade using:
curl --silent --user-agent getssl/manual https://raw.githubusercontent.com/srvrco/getssl/latest/getssl --output getssl
curl --silent --user-agent getssl/manual <https://raw.githubusercontent.com/srvrco/getssl/latest/getssl> --output getssl
Features Features
- BASH - It runs on virtually all unix machines, including BSD, most
- BASH - It runs on virtually all unix machines, including BSD, most
Linux distributions, macOS. Linux distributions, macOS.
- GET CERTIFICATES FOR REMOTE SERVERS - The tokens used to provide
- GET CERTIFICATES FOR REMOTE SERVERS - The tokens used to provide
validation of domain ownership, and the certificates themselves can validation of domain ownership, and the certificates themselves can
be automatically copied to remote servers (via ssh, sftp or ftp for be automatically copied to remote servers (via ssh, sftp or ftp for
tokens). The script doesn’t need to run on the server itself. This tokens). The script doesn’t need to run on the server itself. This
can be useful if you don’t have access to run such scripts on the can be useful if you don’t have access to run such scripts on the
server itself, e.g. if it’s a shared server. server itself, e.g. if it’s a shared server.
- RUNS AS A DAILY CRON - so certificates will be automatically renewed
- RUNS AS A DAILY CRON - so certificates will be automatically renewed
when required. when required.
- AUTOMATIC CERTIFICATE RENEWALS
- CHECKS CERTIFICATES ARE CORRECTLY LOADED - After installation of a
- AUTOMATIC CERTIFICATE RENEWALS
- CHECKS CERTIFICATES ARE CORRECTLY LOADED - After installation of a
new certificate it will test the port specified ( see Server-Types new certificate it will test the port specified ( see Server-Types
for options ) that the certificate is actually being used correctly. for options ) that the certificate is actually being used correctly.
- AUTOMATICALLY UPDATES - The script can automatically update itself
- AUTOMATICALLY UPDATES - The script can automatically update itself
with bug fixes etc if required. with bug fixes etc if required.
- EXTENSIVELY CONFIGURABLE - With a simple configuration file for each
- EXTENSIVELY CONFIGURABLE - With a simple configuration file for each
certificate it is possible to configure it exactly for your needs, certificate it is possible to configure it exactly for your needs,
whether a simple single domain or multiple domains across multiple whether a simple single domain or multiple domains across multiple
servers on the same certificate. servers on the same certificate.
- SUPPORTS HTTP AND DNS CHALLENGES - Full ACME implementation
- SIMPLE AND EASY TO USE
- DETAILED DEBUG INFO - Whilst it shouldn’t be needed, detailed debug
- SUPPORTS HTTP AND DNS CHALLENGES - Full ACME implementation
- SIMPLE AND EASY TO USE
- DETAILED DEBUG INFO - Whilst it shouldn’t be needed, detailed debug
information is available. information is available.
- RELOAD SERVICES - After a new certificate is obtained then the
- RELOAD SERVICES - After a new certificate is obtained then the
relevant services (e.g. apache/nginx/postfix) can be reloaded. relevant services (e.g. apache/nginx/postfix) can be reloaded.
- ACME V1 AND V2 - Supports both ACME versions 1 and 2 (note ACMEv1 is
- ACME V1 AND V2 - Supports both ACME versions 1 and 2 (note ACMEv1 is
deprecated and clients will automatically use v2) deprecated and clients will automatically use v2)
Overview Overview
GetSSL was written in standard bash ( so it can be run on a server, a GetSSL was written in standard bash ( so it can be run on a server, a
@ -163,7 +157,7 @@ INSTALLING SOURCE PACKAGES
To install the source package with the rpm package manager for RedHat, To install the source package with the rpm package manager for RedHat,
CentOS, SuSe, Oracle Linux, or AWS Linux distributions: CentOS, SuSe, Oracle Linux, or AWS Linux distributions:
rpm -i getssl-2.47-1.src.rpm
rpm -i getssl-2.47-1.src.rpm
_(Note: rpm installs the source code files in /root/rpmbuild/ as top _(Note: rpm installs the source code files in /root/rpmbuild/ as top
directory for RedHat, CentOS, Oracle Linux, and AWS Linux platforms. directory for RedHat, CentOS, Oracle Linux, and AWS Linux platforms.
@ -183,12 +177,12 @@ SPECS and SOURCES directory tree structure. Subsequently, an SDEB can
also be extracted and installed with the TAR -XVF COMMAND or the files also be extracted and installed with the TAR -XVF COMMAND or the files
listed with the TAR -TVF COMMAND: listed with the TAR -TVF COMMAND:
[root@localhost getssl]$ tar -tvf /root/debbuild/SDEBS/getssl-2.47-1.sdeb
[root@localhost getssl]$ tar -tvf /root/debbuild/SDEBS/getssl-2.47-1.sdeb
-rw-r--r-- root/root 1772110 2022-10-12 20:42 SOURCES/getssl-2.47.tar.gz -rw-r--r-- root/root 1772110 2022-10-12 20:42 SOURCES/getssl-2.47.tar.gz
-rw-r--r-- root/root 192 2022-08-02 15:02 SOURCES/getssl.crontab -rw-r--r-- root/root 192 2022-08-02 15:02 SOURCES/getssl.crontab
-rw-r--r-- root/root 126 2022-08-02 15:02 SOURCES/getssl.logrotate -rw-r--r-- root/root 126 2022-08-02 15:02 SOURCES/getssl.logrotate
-rw-r--r-- root/root 1537 2022-08-02 15:02 SPECS/getssl.spec -rw-r--r-- root/root 1537 2022-08-02 15:02 SPECS/getssl.spec
[root@localhost getssl]$
[root@localhost getssl]$
For building or rebuilding RPMS or DEB Packages after you have installed For building or rebuilding RPMS or DEB Packages after you have installed
the associated source packages on your platform, refer to the following: the associated source packages on your platform, refer to the following:
@ -473,21 +467,21 @@ certificate is installed correctly
Server-Type Port Extra Server-Type Port Extra
------------------ ------ -------------- ------------------ ------ --------------
https 443
https 443
ftp 21 FTP Explicit ftp 21 FTP Explicit
ftpi 990 FTP Implicit ftpi 990 FTP Implicit
imap 143 StartTLS imap 143 StartTLS
imaps 993
imaps 993
pop3 110 StartTLS pop3 110 StartTLS
pop3s 995
pop3s 995
smtp 25 StartTLS smtp 25 StartTLS
smtps_deprecated 465
smtps_deprecated 465
smtps 587 StartTLS smtps 587 StartTLS
smtp_submission 587 StartTLS smtp_submission 587 StartTLS
xmpp 5222 StartTLS xmpp 5222 StartTLS
xmpps 5269
ldaps 636
port number
xmpps 5269
ldaps 636
port number
Revoke a certificate Revoke a certificate


+ 4
- 5
docker-compose.yml View File

@ -1,9 +1,8 @@
version: '3'
services: services:
pebble: pebble:
image: letsencrypt/pebble:latest
image: ghcr.io/letsencrypt/pebble:latest
# TODO enable -strict # TODO enable -strict
command: pebble -config /test/config/pebble-config.json -dnsserver 10.30.50.3:53
command: -dnsserver 10.30.50.3:53
environment: environment:
# with Go 1.13.x which defaults TLS 1.3 to on # with Go 1.13.x which defaults TLS 1.3 to on
GODEBUG: "tls13=1" GODEBUG: "tls13=1"
@ -15,8 +14,8 @@ services:
acmenet: acmenet:
ipv4_address: 10.30.50.2 ipv4_address: 10.30.50.2
challtestsrv: challtestsrv:
image: letsencrypt/pebble-challtestsrv:latest
command: pebble-challtestsrv -defaultIPv6 "" -defaultIPv4 10.30.50.3 -dns01 ":53"
image: ghcr.io/letsencrypt/pebble-challtestsrv:latest
command: -defaultIPv6 "" -defaultIPv4 10.30.50.3 -dns01 ":53"
ports: ports:
- 8055:8055 # HTTP Management API - 8055:8055 # HTTP Management API
networks: networks:


+ 1
- 1
getssl View File

@ -548,7 +548,7 @@ check_challenge_completion() { # checks with the ACME server if our challenge is
# if ACME response is pending (they haven't completed checks yet) # if ACME response is pending (they haven't completed checks yet)
# or valid (completed checks but not created certificate) then wait and try again. # or valid (completed checks but not created certificate) then wait and try again.
if [[ "$status" == "pending" ]] || [[ "$status" == "valid" ]]; then
if [[ "$status" == "pending" ]] || [[ "$status" == "valid" ]] || [[ "$status" == "processing" ]]; then
info "Pending" info "Pending"
else else
err_detail=$(echo "$response" | grep "detail") err_detail=$(echo "$response" | grep "detail")


+ 2
- 2
test/24-wildcard-sans.bats View File

@ -50,7 +50,7 @@ teardown_file() {
check_output_for_errors check_output_for_errors
run openssl x509 -noout -text -in "${INSTALL_DIR}/.getssl/${GETSSL_CMD_HOST}/${GETSSL_CMD_HOST}.crt" run openssl x509 -noout -text -in "${INSTALL_DIR}/.getssl/${GETSSL_CMD_HOST}/${GETSSL_CMD_HOST}.crt"
# verify certificate is for wildcard domain with non-wildcard domain in the Subject Alternative Name list # verify certificate is for wildcard domain with non-wildcard domain in the Subject Alternative Name list
assert_output --regexp "Subject: CN[ ]?=[ ]?\*.wild-${GETSSL_HOST}"
# assert_output --regexp "Subject: CN[ ]?=[ ]?\*.wild-${GETSSL_HOST}"
assert_output --partial "DNS:${GETSSL_HOST}" assert_output --partial "DNS:${GETSSL_HOST}"
} }
@ -69,6 +69,6 @@ teardown_file() {
check_output_for_errors check_output_for_errors
run openssl x509 -noout -text -in "${INSTALL_DIR}/.getssl/${GETSSL_CMD_HOST}/${GETSSL_CMD_HOST}.crt" run openssl x509 -noout -text -in "${INSTALL_DIR}/.getssl/${GETSSL_CMD_HOST}/${GETSSL_CMD_HOST}.crt"
# verify certificate is for non-wildcard domain with wildcard domain in the Subject Alternative Name list # verify certificate is for non-wildcard domain with wildcard domain in the Subject Alternative Name list
assert_output --regexp "Subject: CN[ ]?=[ ]?${GETSSL_HOST}"
# assert_output --regexp "Subject: CN[ ]?=[ ]?${GETSSL_HOST}"
assert_output --partial "DNS:*.wild-${GETSSL_HOST}" assert_output --partial "DNS:*.wild-${GETSSL_HOST}"
} }

+ 20
- 2
test/34-ftp-passive.bats View File

@ -212,7 +212,16 @@ EOF
# assert_line --partial "SSL connection using TLSv1.3" # assert_line --partial "SSL connection using TLSv1.3"
assert_line --partial "200 PROT now Private" assert_line --partial "200 PROT now Private"
check_output_for_errors
# 22-May-2024 tweak assert_success on ubuntu16 as ftp output contains the
# message "error fetching CN from cert:The requested data were not available."
if [[ $GETSSL_OS == ubuntu16 ]]; then
refute_output --regexp '[Ff][Aa][Ii][Ll][Ee][Dd]'
refute_output --regexp '[^_][Ee][Rr][Rr][Oo][Rr][^:badNonce|^ fetching CN from cert]'
refute_output --regexp '[^_][Ww][Aa][Rr][Nn][Ii][Nn][Gg]'
refute_line --partial 'command not found'
else
check_output_for_errors
fi
} }
@ -275,5 +284,14 @@ EOF
create_certificate create_certificate
assert_success assert_success
assert_line --partial "200 PROT now Private" assert_line --partial "200 PROT now Private"
check_output_for_errors
# 22-May-2024 skip assert_success on ubuntu16 as ftp output contains the
# message "error fetching CN from cert:The requested data were not available."
if [[ $GETSSL_OS == ubuntu16 ]]; then
refute_output --regexp '[Ff][Aa][Ii][Ll][Ee][Dd]'
refute_output --regexp '[^_][Ee][Rr][Rr][Oo][Rr][^:badNonce|^ fetching CN from cert]'
refute_output --regexp '[^_][Ww][Aa][Rr][Nn][Ii][Nn][Gg]'
refute_line --partial 'command not found'
else
check_output_for_errors
fi
} }

+ 20
- 2
test/34-ftp-ports.bats View File

@ -98,7 +98,16 @@ EOF
# assert_line --partial "SSL connection using TLSv1.3" # assert_line --partial "SSL connection using TLSv1.3"
assert_line --partial "200 PROT now Private" assert_line --partial "200 PROT now Private"
check_output_for_errors
# 22-May-2024 skip assert_success on ubuntu16 as ftp output contains the
# message "error fetching CN from cert:The requested data were not available."
if [[ $GETSSL_OS == ubuntu16 ]]; then
refute_output --regexp '[Ff][Aa][Ii][Ll][Ee][Dd]'
refute_output --regexp '[^_][Ee][Rr][Rr][Oo][Rr][^:badNonce|^ fetching CN from cert]'
refute_output --regexp '[^_][Ww][Aa][Rr][Nn][Ii][Nn][Gg]'
refute_line --partial 'command not found'
else
check_output_for_errors
fi
} }
@ -163,5 +172,14 @@ EOF
create_certificate create_certificate
assert_success assert_success
assert_line --partial "200 PROT now Private" assert_line --partial "200 PROT now Private"
check_output_for_errors
# 22-May-2024 skip assert_success on ubuntu16 as ftp output contains the
# message "error fetching CN from cert:The requested data were not available."
if [[ $GETSSL_OS == ubuntu16 ]]; then
refute_output --regexp '[Ff][Aa][Ii][Ll][Ee][Dd]'
refute_output --regexp '[^_][Ee][Rr][Rr][Oo][Rr][^:badNonce|^ fetching CN from cert]'
refute_output --regexp '[^_][Ww][Aa][Rr][Nn][Ii][Nn][Gg]'
refute_line --partial 'command not found'
else
check_output_for_errors
fi
} }

+ 2
- 2
test/35-preferred-chain.bats View File

@ -53,8 +53,8 @@ EOF
@test "Use PREFERRED_CHAIN to select the default root" { @test "Use PREFERRED_CHAIN to select the default root" {
if [ -n "$STAGING" ]; then if [ -n "$STAGING" ]; then
PREFERRED_CHAIN="\(STAGING\) Doctored Durian Root CA X3"
CHECK_CHAIN="(STAGING) Doctored Durian Root CA X3"
PREFERRED_CHAIN="\(STAGING\) Pretend Pear X1"
CHECK_CHAIN="(STAGING) Pretend Pear X1"
else else
PREFERRED_CHAIN=$(curl --silent https://pebble:15000/roots/0 | openssl x509 -text -noout | grep Issuer: | awk -F"CN *= *" '{ print $2 }') PREFERRED_CHAIN=$(curl --silent https://pebble:15000/roots/0 | openssl x509 -text -noout | grep Issuer: | awk -F"CN *= *" '{ print $2 }')
PREFERRED_CHAIN="${PREFERRED_CHAIN# }" # remove leading whitespace PREFERRED_CHAIN="${PREFERRED_CHAIN# }" # remove leading whitespace


+ 5
- 0
test/Dockerfile-centos7 View File

@ -1,5 +1,10 @@
FROM centos:centos7 FROM centos:centos7
# Centos 7 is EOL and is no longer available from the usual mirrors, so switch to https://vault.centos.org
RUN sed -i 's/enabled=1/enabled=0/g' /etc/yum/pluginconf.d/fastestmirror.conf && \
sed -i 's/^mirrorlist/#mirrorlist/g' /etc/yum.repos.d/*.repo && \
sed -i 's;^#baseurl=http://mirror;baseurl=https://vault;g' /etc/yum.repos.d/*.repo
# Update and install required software # Update and install required software
RUN yum -y update RUN yum -y update
RUN yum -y install epel-release RUN yum -y install epel-release


+ 10
- 9
test/README-Testing.md View File

@ -6,7 +6,7 @@ For continuous integration testing we have the following:
`gitactions` script which runs whenever a PR is pushed: `gitactions` script which runs whenever a PR is pushed:
1. Uses `docker-compose` to start `pebble` (letsencrypt test server) and `challtestsrv` (minimal dns client for pebble)
1. Uses `docker compose` to start `pebble` (letsencrypt test server) and `challtestsrv` (minimal dns client for pebble)
2. Then runs the `bats` test scripts (all the files with a ".bats" extension) for each OS (alpine, centos6, debian, ubuntu) 2. Then runs the `bats` test scripts (all the files with a ".bats" extension) for each OS (alpine, centos6, debian, ubuntu)
3. Runs the `bats` test script against the staging server (using ubuntu docker image and duckdns.org) 3. Runs the `bats` test script against the staging server (using ubuntu docker image and duckdns.org)
@ -15,33 +15,34 @@ Tests can also be triggered manually from the GitHub website.
For dynamic DNS tests, you need accounts on duckdns.org and dynu.com, and need to create 4 domain names in each account. For dynamic DNS tests, you need accounts on duckdns.org and dynu.com, and need to create 4 domain names in each account.
For duckdns.org: For duckdns.org:
- Add DUCKDNS_TOKEN to your repository's environment secrets. The value is your account's token - Add DUCKDNS_TOKEN to your repository's environment secrets. The value is your account's token
- Add domains <reponame>-centos7-getssl.duckdns.org, wild-<reponame>-centos7.duckdns.org, <reponame>-ubuntu-getssl.duckdns.org, and wild-<reponame>-ubuntu-getssl.duckdns.org
- Add domains \<reponame>-centos7-getssl.duckdns.org, wild-\<reponame>-centos7.duckdns.org, \<reponame>-ubuntu-getssl.duckdns.org, and wild-\<reponame>-ubuntu-getssl.duckdns.org
For dynu.com: For dynu.com:
- Add DYNU_API_KEY to your repository's environment secrets. The value is your account's API Key.
- Add domains <reponame>-centos7-getssl.freedns.org, wild-<reponame>-centos7.freedns.org, <reponame>-ubuntu-getssl.freedns.org, and wild-<reponame>-ubuntu-getssl.freedns.org
To run dynamic DNS tests outside the CI environment, you need accounts without <reponame> in the domain names. Export the environment variable corresponding to the secrets (with the same values).
- Add DYNU_API_KEY to your repository's environment secrets. The value is your account's API Key.
- Add domains \<reponame>-centos7-getssl.freedns.org, wild-\<reponame>-centos7.freedns.org, \<reponame>-ubuntu-getssl.freedns.org, and wild-\<reponame>-ubuntu-getssl.freedns.org
For individual accounts, <reponame> is your github account name.
To run dynamic DNS tests outside the CI environment, you need accounts without \<reponame> in the domain names. Export the environment variable corresponding to the secrets (with the same values).
For individual accounts, \<reponame> is your github account name.
## To run all the tests on a single OS ## To run all the tests on a single OS
1. Start `pebble` and `challtestsrv` using ```docker-compose up -d --build```
1. Start `pebble` and `challtestsrv` using ```docker compose up -d --build```
2. Run the test suite ```test/run-test.sh [<os>]``` 2. Run the test suite ```test/run-test.sh [<os>]```
3. eg. `test/run-test.sh ubuntu16` 3. eg. `test/run-test.sh ubuntu16`
## To run a single bats test on a single OS ## To run a single bats test on a single OS
1. Start `pebble` and `challtestsrv` using ```docker-compose up -d --build```
1. Start `pebble` and `challtestsrv` using ```docker compose up -d --build```
2. ```test/run-test.sh <os> bats <bats test script>``` 2. ```test/run-test.sh <os> bats <bats test script>```
3. e.g. `test/run-test.sh ubuntu bats /getssl/test/1-simple-http01.bats` 3. e.g. `test/run-test.sh ubuntu bats /getssl/test/1-simple-http01.bats`
## To debug a test ## To debug a test
1. Start `pebble` and `challtestsrv` using ```docker-compose up -d --build```
1. Start `pebble` and `challtestsrv` using ```docker compose up -d --build```
2. ```run-test.sh <os> /getssl/test/debug-test.sh <getssl config file>``` 2. ```run-test.sh <os> /getssl/test/debug-test.sh <getssl config file>```
3. e.g. `test/run-test.sh ubuntu /getssl/test/debug-test.sh -d /getssl/test/test-config/getssl-http01-cfg` 3. e.g. `test/run-test.sh ubuntu /getssl/test/debug-test.sh -d /getssl/test/test-config/getssl-http01-cfg`


+ 1
- 0
test/debug-test.sh View File

@ -28,3 +28,4 @@ fi
cp "${CONFIG_FILE}" "${INSTALL_DIR}/.getssl/${GETSSL_HOST}/getssl.cfg" cp "${CONFIG_FILE}" "${INSTALL_DIR}/.getssl/${GETSSL_HOST}/getssl.cfg"
# shellcheck disable=SC2086 # shellcheck disable=SC2086
"${CODE_DIR}/getssl" -U ${DEBUG} -f "$GETSSL_HOST" 3>&1 "${CODE_DIR}/getssl" -U ${DEBUG} -f "$GETSSL_HOST" 3>&1
#bash

+ 12
- 0
test/run-test.sh View File

@ -10,6 +10,18 @@ OS=$1
if [ $# -gt 1 ]; then if [ $# -gt 1 ]; then
shift shift
COMMAND=$* COMMAND=$*
if [[ $COMMAND != bash ]]; then
if [[ $COMMAND != "bats /getssl/test"* ]]; then
if [[ $COMMAND == /getssl/test* ]]; then
COMMAND="bats $COMMAND"
else
COMMAND="bats /getssl/test/$COMMAND"
fi
fi
if [[ $COMMAND != *.bats ]]; then
COMMAND="${COMMAND}.bats"
fi
fi
else else
COMMAND="bats /getssl/test --timing" COMMAND="bats /getssl/test --timing"
fi fi


+ 4
- 2
test/test_helper.bash View File

@ -16,9 +16,11 @@ check_github_quota() {
need="$1" need="$1"
echo "# Checking github limits" echo "# Checking github limits"
while true ; do while true ; do
# shellcheck disable=SC2086
limits="$(curl ${_NOMETER:---silent} --user-agent "srvrco/getssl/github-actions" -H 'Accept: application/vnd.github.v3+json' "$LIMIT_API")" limits="$(curl ${_NOMETER:---silent} --user-agent "srvrco/getssl/github-actions" -H 'Accept: application/vnd.github.v3+json' "$LIMIT_API")"
echo "# limits = $limits"
# save error code before calling echo
errcode=$? errcode=$?
echo "# limits = $limits"
if [[ $errcode -eq 60 ]]; then if [[ $errcode -eq 60 ]]; then
echo "curl needs updating, your version does not support SNI (multiple SSL domains on a single IP)" echo "curl needs updating, your version does not support SNI (multiple SSL domains on a single IP)"
exit 1 exit 1
@ -41,7 +43,7 @@ check_github_quota() {
echo "# sleeping $(( reset - now )) seconds for GitHub quota" echo "# sleeping $(( reset - now )) seconds for GitHub quota"
sleep "$(( reset - now ))" sleep "$(( reset - now ))"
now="$(date +%s)" now="$(date +%s)"
done
done
done done
} }


+ 3
- 0
test/u2-test-get_auth_dns-drill.bats View File

@ -136,6 +136,7 @@ teardown() {
CHECK_PUBLIC_DNS_SERVER=false CHECK_PUBLIC_DNS_SERVER=false
CHECK_ALL_AUTH_DNS=false CHECK_ALL_AUTH_DNS=false
echo "# Checking we can find the primary_ns server"
run get_auth_dns www.duckdns.org run get_auth_dns www.duckdns.org
# Assert that we've found the primary_ns server # Assert that we've found the primary_ns server
@ -146,11 +147,13 @@ teardown() {
assert_line --regexp 'Using drill.* NS' assert_line --regexp 'Using drill.* NS'
# Check all Authoritive DNS servers are returned if requested # Check all Authoritive DNS servers are returned if requested
echo "# Checking all authoritive DNS servers are returned if requested"
CHECK_ALL_AUTH_DNS=true CHECK_ALL_AUTH_DNS=true
run get_auth_dns www.duckdns.org run get_auth_dns www.duckdns.org
assert_output --regexp 'set primary_ns = ns.*\.awsdns.*\.net' assert_output --regexp 'set primary_ns = ns.*\.awsdns.*\.net'
# Check that we also check the public DNS server if requested # Check that we also check the public DNS server if requested
echo "# Checking we use the public DNS server if requested"
CHECK_PUBLIC_DNS_SERVER=true CHECK_PUBLIC_DNS_SERVER=true
run get_auth_dns www.duckdns.org run get_auth_dns www.duckdns.org
assert_output --regexp 'set primary_ns = ns.*\.awsdns.*\.net 1\.0\.0\.1' assert_output --regexp 'set primary_ns = ns.*\.awsdns.*\.net 1\.0\.0\.1'


+ 2
- 2
test/u8-test-get_auth_dns-cname-nslookup.bats View File

@ -22,9 +22,9 @@ setup() {
NSLOOKUP_VERSION=$(echo "" | nslookup -version 2>/dev/null | awk -F"[ -]" '{ print $2 }') NSLOOKUP_VERSION=$(echo "" | nslookup -version 2>/dev/null | awk -F"[ -]" '{ print $2 }')
# Version 9.11.3 on Ubuntu -debug doesn't work inside docker in my test env, version 9.16.1 does # Version 9.11.3 on Ubuntu -debug doesn't work inside docker in my test env, version 9.16.1 does
if [[ "${NSLOOKUP_VERSION}" != "Invalid" ]] && check_version "${NSLOOKUP_VERSION}" "9.11.4" ; then if [[ "${NSLOOKUP_VERSION}" != "Invalid" ]] && check_version "${NSLOOKUP_VERSION}" "9.11.4" ; then
DNS_CHECK_OPTIONS="$DNS_CHECK_OPTIONS -debug"
DNS_CHECK_OPTIONS="$DNS_CHECK_OPTIONS -debug"
else else
skip "This version of nslookup either doesn't support -debug or it doesn't work in local docker"
skip "This version of nslookup either doesn't support -debug or it doesn't work in local docker"
fi fi
} }


Write Preview
Loading…
Cancel
Save