devnomads 0.6.0__tar.gz → 0.6.1__tar.gz

{devnomads-0.6.0 → devnomads-0.6.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: devnomads
-Version: 0.6.0
+Version: 0.6.1
 Summary: Python client library for the DevNomads API (transport, DNS, ACME)
 Project-URL: Homepage, https://devnomads.nl
 Author-email: DevNomads <support@devnomads.nl>

{devnomads-0.6.0 → devnomads-0.6.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "devnomads"
-version = "0.6.0"
+version = "0.6.1"
 description = "Python client library for the DevNomads API (transport, DNS, ACME)"
 readme = "README.md"
 requires-python = ">=3.10"

{devnomads-0.6.0 → devnomads-0.6.1}/src/devnomads/acme/verify.py

@@ -15,6 +15,9 @@ import dns.resolver
 
 log = logging.getLogger("devnomads.acme")
 
+# Bounds a CNAME chain at _acme-challenge (and breaks loops).
+_MAX_CNAME_HOPS = 8
+
 
 def _make_resolver(nameservers: list[str] | None) -> dns.resolver.Resolver:
     resolver = dns.resolver.Resolver()
@@ -54,6 +57,27 @@ def authoritative_nameservers(
     return []
 
 
+def challenge_record_name(fqdn: str, nameservers: list[str] | None = None) -> str:
+    """Return the name that actually holds the TXT record for ``fqdn``.
+
+    Normally ``_acme-challenge.<fqdn>``. When that name is a CNAME (delegated
+    DNS-01: the domain owner points it at a zone the ACME client can write),
+    the CA follows the chain, so the record lives at the final target.
+    """
+
+    name = f"_acme-challenge.{fqdn}"
+    resolver = _make_resolver(nameservers)
+    for _ in range(_MAX_CNAME_HOPS):
+        try:
+            answers = resolver.resolve(name, "CNAME")
+        except dns.exception.DNSException:
+            break
+        target = str(answers[0].target).rstrip(".")
+        log.debug("challenge name %s is a CNAME to %s", name, target)
+        name = target
+    return name
+
+
 def verify_txt_record(
     fqdn: str,
     expected_value: str,
@@ -63,13 +87,18 @@ def verify_txt_record(
     nameservers: list[str] | None = None,
 ) -> bool:
     """Poll authoritative nameservers until ``_acme-challenge.<fqdn>`` carries
-    ``expected_value``. Returns False on timeout."""
+    ``expected_value``. Returns False on timeout.
+
+    A CNAME at ``_acme-challenge.<fqdn>`` is followed: the authoritative
+    nameservers of the domain only return the CNAME, so the record is polled
+    at the target's nameservers instead.
+    """
 
-    challenge = f"_acme-challenge.{fqdn}"
+    challenge = challenge_record_name(fqdn, nameservers)
     base_resolver = _make_resolver(nameservers)
-    auth_ns: list[str | None] = list(authoritative_nameservers(fqdn, nameservers))
+    auth_ns: list[str | None] = list(authoritative_nameservers(challenge, nameservers))
     if not auth_ns:
-        log.warning("no authoritative NS for %s, using default resolver", fqdn)
+        log.warning("no authoritative NS for %s, using default resolver", challenge)
         auth_ns = [None]
     else:
         log.info("polling authoritative nameservers for %s: %s", challenge, auth_ns)

devnomads-0.6.1/tests/test_acme_verify.py

@@ -0,0 +1,106 @@
+"""Tests for authoritative DNS-01 TXT verification."""
+
+from __future__ import annotations
+
+from types import SimpleNamespace
+
+import dns.resolver
+import pytest
+
+from devnomads.acme import verify
+
+
+class FakeResolver:
+    """Answers from a ``{(name, rdtype): [rdata, ...]}`` table; NXDOMAIN otherwise."""
+
+    def __init__(self, records):
+        self.records = records
+        self.nameservers: list[str] = []
+
+    def resolve(self, name, rdtype):
+        try:
+            return self.records[(name, rdtype)]
+        except KeyError:
+            raise dns.resolver.NXDOMAIN from None
+
+
+def _cname(target):
+    return [SimpleNamespace(target=f"{target}.")]
+
+
+def _ns(*hosts):
+    return [SimpleNamespace(target=f"{h}.") for h in hosts]
+
+
+class _Txt:
+    def __init__(self, value):
+        self.value = value
+
+    def __str__(self):
+        return f'"{self.value}"'
+
+
+@pytest.fixture
+def records(monkeypatch):
+    table: dict = {}
+    monkeypatch.setattr(dns.resolver, "Resolver", lambda: FakeResolver(table))
+    monkeypatch.setattr(verify, "_resolve_ns_hostname", lambda host, r: ["192.0.2.1"])
+    return table
+
+
+def test_challenge_record_name_without_cname(records):
+    assert verify.challenge_record_name("example.com") == "_acme-challenge.example.com"
+
+
+def test_challenge_record_name_follows_cname(records):
+    records[("_acme-challenge.example.com", "CNAME")] = _cname(
+        "example-com.acme.infrapod.nl"
+    )
+    assert verify.challenge_record_name("example.com") == "example-com.acme.infrapod.nl"
+
+
+def test_challenge_record_name_follows_chain(records):
+    records[("_acme-challenge.example.com", "CNAME")] = _cname("hop.example.net")
+    records[("hop.example.net", "CNAME")] = _cname("example-com.acme.infrapod.nl")
+    assert verify.challenge_record_name("example.com") == "example-com.acme.infrapod.nl"
+
+
+def test_challenge_record_name_stops_on_loop(records):
+    records[("_acme-challenge.example.com", "CNAME")] = _cname("a.example.net")
+    records[("a.example.net", "CNAME")] = _cname("b.example.net")
+    records[("b.example.net", "CNAME")] = _cname("a.example.net")
+    # Must terminate; the exact name it lands on is irrelevant.
+    assert verify.challenge_record_name("example.com") in {
+        "a.example.net",
+        "b.example.net",
+    }
+
+
+def test_verify_txt_record_polls_cname_target(records):
+    """The domain's own nameservers only hold the CNAME; the TXT is checked
+    at the target's zone."""
+
+    records[("_acme-challenge.example.com", "CNAME")] = _cname(
+        "example-com.acme.infrapod.nl"
+    )
+    records[("example.com", "NS")] = _ns("ns1.customer.example")
+    records[("acme.infrapod.nl", "NS")] = _ns("one.dns.infrapod.nl")
+    records[("example-com.acme.infrapod.nl", "TXT")] = [_Txt("token")]
+
+    assert verify.verify_txt_record("example.com", "token", timeout=1, interval=0)
+
+
+def test_verify_txt_record_without_cname(records):
+    records[("example.com", "NS")] = _ns("one.dns.infrapod.nl")
+    records[("_acme-challenge.example.com", "TXT")] = [_Txt("token")]
+
+    assert verify.verify_txt_record("example.com", "token", timeout=1, interval=0)
+
+
+def test_verify_txt_record_times_out_on_missing_value(records):
+    records[("example.com", "NS")] = _ns("one.dns.infrapod.nl")
+    records[("_acme-challenge.example.com", "TXT")] = [_Txt("other")]
+
+    assert not verify.verify_txt_record(
+        "example.com", "token", timeout=0.05, interval=0
+    )

{devnomads-0.6.0 → devnomads-0.6.1}/uv.lock

@@ -469,7 +469,7 @@ wheels = [
 
 [[package]]
 name = "devnomads"
-version = "0.6.0"
+version = "0.6.1"
 source = { editable = "." }
 dependencies = [
     { name = "httpx" },