acme_nsupdate 0.2.1 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 32d57c19eaf5a6c23f23af08da0f6aa8f4089855
-  data.tar.gz: 8cacaab5401445f956efa5b001a339559f64b14d
+  metadata.gz: 7e22b3776fb2331b29ccdbded623176832232282
+  data.tar.gz: 395303634131286629fd3092f102651d4e4901da
 SHA512:
-  metadata.gz: c7ba48ba36dfd57d13726be92ff5a40028626118442dd57dc9e7659ab81207be33f9d8f2713c41e2f6d7ae0a250820dc9e3c87aed6312a9a2e391444ca83ee18
-  data.tar.gz: 6c0e2cc6bae8556affad2e617c9a2ea4ec9f0d463c2a5b3c11be1d24e1b56f9ad3d2e129c665e68ea036e8a3c798c42c2ac9644d2baa024b944c9e9beb330b06
+  metadata.gz: b227c653a1414547d8317d4ada1091cbdf36c71f79be39ac4de08a6406a2b06bd0ea89f73a52076b9a7eeabadb34286c46b609f953c2d2cc4a384a5c63c5cffc
+  data.tar.gz: 8df03352e20f02af82cc2ccf2ac8fe9b1997976e10ddc86160e7a14fbc9ed601c0d92431f15e08953f2d318ad8f8e86be246f718b3802bda2971ba824a209f13

data/lib/acme_nsupdate/strategies/dns01.rb

@@ -1,3 +1,5 @@
+require "resolv"
+
 require "acme_nsupdate/strategy"
 
 module AcmeNsupdate
@@ -12,23 +14,24 @@ module AcmeNsupdate
       end
 
       def publish_challenges
-        @client.logger.debug "Publishing challenges for #{@client.options[:domains].join(", ")}"
-
-        challenges = @client.options[:domains].map {|domain|
-          nsupdate = @client.build_nsupdate
-
-          authorization = @client.client.authorize domain: domain
+        challenges = map_authorizations {|domain, authorization|
           challenge = authorization.dns01
           abort "Challenge dns-01 not supported by the given ACME server" unless challenge
+
+          nsupdate = @client.build_nsupdate
           nsupdate.del(*record(domain, challenge, true)) unless @client.options[:keep]
           nsupdate.add(*record(domain, challenge), @client.options[:txt_ttl])
           nsupdate.send
 
-          [domain, challenge]
-        }.to_h
+          challenge
+        }
 
-        @client.logger.info "Waiting 120 seconds for the DNS updates to go live"
-        sleep 120 # We wait some time to give the slaves time to update
+        unless challenges.empty?
+          @client.logger.info "Waiting up to 120 seconds for the DNS updates to go live"
+          unless verify_live_challenges(@client.options[:master], challenges)
+            raise AcmeNsupdate::Client::Error, "DNS challenges didn't appear on all nameservers within 120 seconds"
+          end
+        end
 
         challenges
       end
@@ -44,6 +47,58 @@ module AcmeNsupdate
 
       private
 
+      def verify_live_challenges(primary, challenges, timeout=120)
+        waited = 0
+        public_nameservers(primary, challenges.first.first).all? {|nameserver|
+          @client.logger.debug "Verifying DNS challenges are present on #{nameserver}"
+          challenges.all? {|domain, challenge|
+            name, type, content = record(domain, challenge)
+            records = query(nameserver, name, type).map(&:strings).flatten.map {|content| %("#{content}") }
+            @client.logger.debug "Got #{records.size} TXT records for #{name}: #{records.map(&:inspect).join(", ")}"
+            if records.include? content
+              true
+            elsif waited == timeout
+              @client.logger.error "None matched, timeout reached, aborting"
+              return false
+            else
+              @client.logger.debug "None matched, pausing for 5 seconds, already waited #{waited} seconds"
+              sleep 5
+              waited += 5
+              redo
+            end
+          }
+        }
+      end
+
+      def public_nameservers(primary, name)
+        # We have to hack into this because it gives us no way to fetch the SOA on a NXDOMAIN
+        authority = nil
+        Resolv::DNS.open(nameserver: [primary], search: [], ndots: 1) do |dns|
+          dns.lazy_initialize
+          message = Resolv::DNS::Message.new
+          message.rd = 1
+          message.add_question(name, Resolv::DNS::Resource::IN::SOA)
+          requester = dns.make_udp_requester
+
+          begin
+            sender = requester.sender(message, name, primary, 53)
+            reply, _ = requester.request(sender, 10)
+            authority = reply.authority.first.first.to_s
+          ensure
+            requester.close
+          end
+        end
+
+        return [] unless authority
+        query(primary, authority, :NS).map {|record| record.name.to_s }.uniq
+      end
+
+      def query(nameserver, name, qtype)
+        Resolv::DNS.open(nameserver: [nameserver], search: [], ndots: 1) do |dns|
+          return dns.getresources(name, Resolv::DNS::Resource::IN.const_get(qtype))
+        end
+      end
+
       def record domain, challenge, nodata=false
         ["#{challenge.record_name}.#{domain}", challenge.record_type].tap do |record|
           record << %("#{challenge.record_content}") unless nodata

data/lib/acme_nsupdate/strategies/http01.rb

@@ -14,17 +14,17 @@ module AcmeNsupdate
       end
 
       def publish_challenges
-        @client.logger.debug "Publishing challenges for #{@client.options[:domains].join(", ")}"
-        @client.options[:domains].map {|domain|
-          authorization = @client.client.authorize domain: domain
+        map_authoriations {|domain, authorization|
           challenge = authorization.http01
           abort "Challenge http-01 not supported by this ACME server" unless challenge
+
           path = path challenge
           @client.logger.debug "Writing #{path} for #{domain}"
           FileUtils.mkdir_p File.dirname path
           File.write path, challenge.file_content
+
           [domain, challenge]
-        }.to_h
+        }.compact.to_h
       end
 
       def cleanup challenges

data/lib/acme_nsupdate/strategy.rb

@@ -21,8 +21,29 @@ module AcmeNsupdate
       end
     end
 
+
     private
 
+    def map_authorizations
+      @client.logger.debug "Publishing challenges for #{@client.options[:domains].join(", ")}"
+
+      challenges = @client.options[:domains].map {|domain|
+        authorization = @client.client.authorize domain: domain
+        if authorization.status == "valid"
+          @client.logger.debug("Skipping challenge for #{domain}, already valid.")
+          next
+        end
+
+        challenge = yield domain, authorization
+        unless challenge
+          @client.logger.debug("Skipping challenge for #{domain}, not solvable.")
+          next
+        end
+
+        [domain, challenge]
+      }.compact.to_h
+    end
+
     def wait_for_verification challenges
       @client.logger.debug("Requesting verification")
       challenges.each_value(&:request_verification)

data/lib/acme_nsupdate/version.rb

@@ -1,3 +1,3 @@
 module AcmeNsupdate
-  VERSION = "0.2.1"
+  VERSION = "0.3.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: acme_nsupdate
 version: !ruby/object:Gem::Version
-  version: 0.2.1
+  version: 0.3.0
 platform: ruby
 authors:
 - Jonne Haß
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-08-10 00:00:00.000000000 Z
+date: 2016-08-15 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: slop