forked from TrueCloudLab/lego
Gandi DNS: use acme.FindZoneByFqdn function
This commit is contained in:
Michael Cross
parent
8512faba3b
commit
3d7abd9093
2 changed files with 70 additions and 136 deletions
|
|
@ -20,10 +20,20 @@ import (
|
|||
// Gandi API reference: http://doc.rpc.gandi.net/index.html
|
||||
// Gandi API domain examples: http://doc.rpc.gandi.net/domain/faq.html
|
||||
|
||||
var (
|
||||
// endpoint is the Gandi XML-RPC endpoint used by Present and
|
||||
// CleanUp. It is overridden during tests.
|
||||
endpoint = "https://rpc.gandi.net/xmlrpc/"
|
||||
// findZoneByFqdn determines the DNS zone of an fqdn. It is overridden
|
||||
// during tests.
|
||||
findZoneByFqdn = acme.FindZoneByFqdn
|
||||
)
|
||||
|
||||
// inProgressInfo contains information about an in-progress challenge
|
||||
type inProgressInfo struct {
|
||||
zoneID int // zoneID of zone to restore in CleanUp
|
||||
newZoneID int // zoneID of temporary zone containing TXT record
|
||||
rootDN string // the registered (root) domain name being manipulated
|
||||
zoneID int // zoneID of gandi zone to restore in CleanUp
|
||||
newZoneID int // zoneID of temporary gandi zone containing TXT record
|
||||
authZone string // the domain name registered at gandi with trailing "."
|
||||
}
|
||||
|
||||
// DNSProvider is an implementation of the
|
||||
|
|
@ -32,7 +42,7 @@ type inProgressInfo struct {
|
|||
type DNSProvider struct {
|
||||
apiKey string
|
||||
inProgressFQDNs map[string]inProgressInfo
|
||||
inProgressRootDNs map[string]struct{}
|
||||
inProgressAuthZones map[string]struct{}
|
||||
inProgressMu sync.Mutex
|
||||
}
|
||||
|
||||
|
|
@ -52,67 +62,48 @@ func NewDNSProviderCredentials(apiKey string) (*DNSProvider, error) {
|
|||
return &DNSProvider{
|
||||
apiKey: apiKey,
|
||||
inProgressFQDNs: make(map[string]inProgressInfo),
|
||||
inProgressRootDNs: make(map[string]struct{}),
|
||||
inProgressAuthZones: make(map[string]struct{}),
|
||||
}, nil
|
||||
}
|
||||
|
||||
// Present creates a TXT record using the specified parameters. It
|
||||
// does this by creating and activating a new temporary DNS zone. This
|
||||
// new zone contains the TXT record.
|
||||
// does this by creating and activating a new temporary Gandi DNS
|
||||
// zone. This new zone contains the TXT record.
|
||||
func (d *DNSProvider) Present(domain, token, keyAuth string) error {
|
||||
fqdn, value, ttl := acme.DNS01Record(domain, keyAuth)
|
||||
if ttl < 300 {
|
||||
ttl = 300 // 300 is gandi minimum value for ttl
|
||||
}
|
||||
i := strings.Index(fqdn, ".")
|
||||
sub := fqdn[:i+1]
|
||||
root := fqdn[i+1:]
|
||||
var zoneID int
|
||||
var err error
|
||||
// find sub and root (sub + root == fqdn) where root is the domain
|
||||
// registered with gandi. Do this by successively increasing sub
|
||||
// and decreasing root until root matches a registered domain with
|
||||
// a zone_id
|
||||
for {
|
||||
zoneID, err = d.getZoneID(root)
|
||||
if err == nil {
|
||||
// domain found
|
||||
break
|
||||
// find authZone and Gandi zone_id for fqdn
|
||||
authZone, err := findZoneByFqdn(fqdn, acme.RecursiveNameserver)
|
||||
if err != nil {
|
||||
return fmt.Errorf("Gandi DNS: findZoneByFqdn failure: %v", err)
|
||||
}
|
||||
if faultErr, ok := err.(rpcError); ok {
|
||||
if faultErr.faultCode == 510042 {
|
||||
// 510042 error means root is not found - increase
|
||||
// sub, reduce root and retry.
|
||||
// [see http://doc.rpc.gandi.net/errors/fault_codes.html]
|
||||
i := strings.Index(root, ".")
|
||||
if i != -1 && i != len(root)-1 &&
|
||||
strings.Index(root[i+1:], ".") != -1 &&
|
||||
strings.Index(root[i+1:], ".") != len(root[i+1:])-1 {
|
||||
sub = sub + root[:i+1]
|
||||
root = root[i+1:]
|
||||
continue
|
||||
}
|
||||
}
|
||||
}
|
||||
// root is not found and cannot be reduced in size any further
|
||||
// or there is some other error from getZoneID
|
||||
zoneID, err := d.getZoneID(authZone)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
// remove trailing "." from sub
|
||||
sub = sub[:len(sub)-1]
|
||||
// determine name of TXT record
|
||||
if !strings.HasSuffix(
|
||||
strings.ToLower(fqdn), strings.ToLower("."+authZone)) {
|
||||
return fmt.Errorf(
|
||||
"Gandi DNS: unexpected authZone %s for fqdn %s", authZone, fqdn)
|
||||
}
|
||||
name := fqdn[:len(fqdn)-len("."+authZone)]
|
||||
// acquire lock and check there is not a challenge already in
|
||||
// progress for this value of root
|
||||
// progress for this value of authZone
|
||||
d.inProgressMu.Lock()
|
||||
defer d.inProgressMu.Unlock()
|
||||
if _, ok := d.inProgressRootDNs[root]; ok {
|
||||
if _, ok := d.inProgressAuthZones[authZone]; ok {
|
||||
return fmt.Errorf(
|
||||
"Gandi DNS: challenge already in progress on root domain")
|
||||
"Gandi DNS: challenge already in progress for authZone %s",
|
||||
authZone)
|
||||
}
|
||||
// perform API actions to create and activate new zone for root
|
||||
// perform API actions to create and activate new gandi zone
|
||||
// containing the required TXT record
|
||||
newZoneName := fmt.Sprintf(
|
||||
"%s [ACME Challenge %s]",
|
||||
root[:len(root)-1], time.Now().Format(time.RFC822Z))
|
||||
acme.UnFqdn(authZone), time.Now().Format(time.RFC822Z))
|
||||
newZoneID, err := d.cloneZone(zoneID, newZoneName)
|
||||
if err != nil {
|
||||
return err
|
||||
|
|
@ -121,7 +112,7 @@ func (d *DNSProvider) Present(domain, token, keyAuth string) error {
|
|||
if err != nil {
|
||||
return err
|
||||
}
|
||||
err = d.addTXTRecord(newZoneID, newZoneVersion, sub, value, ttl)
|
||||
err = d.addTXTRecord(newZoneID, newZoneVersion, name, value, ttl)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
|
@ -129,7 +120,7 @@ func (d *DNSProvider) Present(domain, token, keyAuth string) error {
|
|||
if err != nil {
|
||||
return err
|
||||
}
|
||||
err = d.setZone(root, newZoneID)
|
||||
err = d.setZone(authZone, newZoneID)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
|
@ -137,18 +128,18 @@ func (d *DNSProvider) Present(domain, token, keyAuth string) error {
|
|||
d.inProgressFQDNs[fqdn] = inProgressInfo{
|
||||
zoneID: zoneID,
|
||||
newZoneID: newZoneID,
|
||||
rootDN: root,
|
||||
authZone: authZone,
|
||||
}
|
||||
d.inProgressRootDNs[root] = struct{}{}
|
||||
d.inProgressAuthZones[authZone] = struct{}{}
|
||||
return nil
|
||||
}
|
||||
|
||||
// CleanUp removes the TXT record matching the specified
|
||||
// parameters. It does this by restoring the old DNS zone and removing
|
||||
// the temporary one created by Present.
|
||||
// parameters. It does this by restoring the old Gandi DNS zone and
|
||||
// removing the temporary one created by Present.
|
||||
func (d *DNSProvider) CleanUp(domain, token, keyAuth string) error {
|
||||
fqdn, _, _ := acme.DNS01Record(domain, keyAuth)
|
||||
// acquire lock and retrieve zoneID, newZoneID and root
|
||||
// acquire lock and retrieve zoneID, newZoneID and authZone
|
||||
d.inProgressMu.Lock()
|
||||
defer d.inProgressMu.Unlock()
|
||||
if _, ok := d.inProgressFQDNs[fqdn]; !ok {
|
||||
|
|
@ -157,11 +148,11 @@ func (d *DNSProvider) CleanUp(domain, token, keyAuth string) error {
|
|||
}
|
||||
zoneID := d.inProgressFQDNs[fqdn].zoneID
|
||||
newZoneID := d.inProgressFQDNs[fqdn].newZoneID
|
||||
root := d.inProgressFQDNs[fqdn].rootDN
|
||||
authZone := d.inProgressFQDNs[fqdn].authZone
|
||||
delete(d.inProgressFQDNs, fqdn)
|
||||
delete(d.inProgressRootDNs, root)
|
||||
// perform API actions to restore old zone for root
|
||||
err := d.setZone(root, zoneID)
|
||||
delete(d.inProgressAuthZones, authZone)
|
||||
// perform API actions to restore old gandi zone for authZone
|
||||
err := d.setZone(authZone, zoneID)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
|
@ -179,9 +170,6 @@ func (d *DNSProvider) Timeout() (timeout, interval time.Duration) {
|
|||
return 40 * time.Minute, 60 * time.Second
|
||||
}
|
||||
|
||||
// endpoint is the Gandi XML-RPC endpoint used by Present and CleanUp.
|
||||
var endpoint = "https://rpc.gandi.net/xmlrpc/"
|
||||
|
||||
// types for XML-RPC method calls and parameters
|
||||
|
||||
type param interface {
|
||||
|
|
@ -332,7 +320,8 @@ func (d *DNSProvider) getZoneID(domain string) (int, error) {
|
|||
}
|
||||
}
|
||||
if zoneID == 0 {
|
||||
return 0, fmt.Errorf("Gandi DNS: Could not determine zone_id")
|
||||
return 0, fmt.Errorf(
|
||||
"Gandi DNS: Could not determine zone_id for %s", domain)
|
||||
}
|
||||
return zoneID, nil
|
||||
}
|
||||
|
|
@ -458,7 +447,8 @@ func (d *DNSProvider) setZone(domain string, zoneID int) error {
|
|||
}
|
||||
}
|
||||
if respZoneID != zoneID {
|
||||
return fmt.Errorf("Gandi DNS: Could not set new zone_id")
|
||||
return fmt.Errorf(
|
||||
"Gandi DNS: Could not set new zone_id for %s", domain)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
|
|
|||
|
|
@ -44,12 +44,16 @@ func TestDNSProvider(t *testing.T) {
|
|||
}
|
||||
}))
|
||||
defer fakeServer.Close()
|
||||
// override gandi endpoint to point to fake server
|
||||
savedEndpoint := endpoint
|
||||
// define function to override findZoneByFqdn with
|
||||
fakeFindZoneByFqdn := func(fqdn, nameserver string) (string, error) {
|
||||
return "example.com.", nil
|
||||
}
|
||||
// override gandi endpoint and findZoneByFqdn function
|
||||
savedEndpoint, savedFindZoneByFqdn := endpoint, findZoneByFqdn
|
||||
defer func() {
|
||||
endpoint = savedEndpoint
|
||||
endpoint, findZoneByFqdn = savedEndpoint, savedFindZoneByFqdn
|
||||
}()
|
||||
endpoint = fakeServer.URL + "/"
|
||||
endpoint, findZoneByFqdn = fakeServer.URL+"/", fakeFindZoneByFqdn
|
||||
// run Present
|
||||
err = provider.Present("abc.def.example.com", "", fakeKeyAuth)
|
||||
if err != nil {
|
||||
|
|
@ -69,66 +73,6 @@ func TestDNSProvider(t *testing.T) {
|
|||
var serverResponses = map[string]string{
|
||||
// Present Request->Response 1 (getZoneID)
|
||||
`<?xml version="1.0"?>
|
||||
<methodCall>
|
||||
<methodName>domain.info</methodName>
|
||||
<param>
|
||||
<value>
|
||||
<string>123412341234123412341234</string>
|
||||
</value>
|
||||
</param>
|
||||
<param>
|
||||
<value>
|
||||
<string>abc.def.example.com.</string>
|
||||
</value>
|
||||
</param>
|
||||
</methodCall>`: `<?xml version='1.0'?>
|
||||
<methodResponse>
|
||||
<fault>
|
||||
<value><struct>
|
||||
<member>
|
||||
<name>faultCode</name>
|
||||
<value><int>510042</int></value>
|
||||
</member>
|
||||
<member>
|
||||
<name>faultString</name>
|
||||
<value><string>Error on object : OBJECT_DOMAIN (CAUSE_NOTFOUND) [Domain 'abc.def.example.com.' doesn't exist.]</string></value>
|
||||
</member>
|
||||
</struct></value>
|
||||
</fault>
|
||||
</methodResponse>
|
||||
`,
|
||||
// Present Request->Response 2 (getZoneID)
|
||||
`<?xml version="1.0"?>
|
||||
<methodCall>
|
||||
<methodName>domain.info</methodName>
|
||||
<param>
|
||||
<value>
|
||||
<string>123412341234123412341234</string>
|
||||
</value>
|
||||
</param>
|
||||
<param>
|
||||
<value>
|
||||
<string>def.example.com.</string>
|
||||
</value>
|
||||
</param>
|
||||
</methodCall>`: `<?xml version='1.0'?>
|
||||
<methodResponse>
|
||||
<fault>
|
||||
<value><struct>
|
||||
<member>
|
||||
<name>faultCode</name>
|
||||
<value><int>510042</int></value>
|
||||
</member>
|
||||
<member>
|
||||
<name>faultString</name>
|
||||
<value><string>Error on object : OBJECT_DOMAIN (CAUSE_NOTFOUND) [Domain 'def.example.com.' doesn't exist.]</string></value>
|
||||
</member>
|
||||
</struct></value>
|
||||
</fault>
|
||||
</methodResponse>
|
||||
`,
|
||||
// Present Request->Response 3 (getZoneID)
|
||||
`<?xml version="1.0"?>
|
||||
<methodCall>
|
||||
<methodName>domain.info</methodName>
|
||||
<param>
|
||||
|
|
@ -309,7 +253,7 @@ var serverResponses = map[string]string{
|
|||
</params>
|
||||
</methodResponse>
|
||||
`,
|
||||
// Present Request->Response 4 (cloneZone)
|
||||
// Present Request->Response 2 (cloneZone)
|
||||
`<?xml version="1.0"?>
|
||||
<methodCall>
|
||||
<methodName>domain.zone.clone</methodName>
|
||||
|
|
@ -384,7 +328,7 @@ var serverResponses = map[string]string{
|
|||
</params>
|
||||
</methodResponse>
|
||||
`,
|
||||
// Present Request->Response 5 (newZoneVersion)
|
||||
// Present Request->Response 3 (newZoneVersion)
|
||||
`<?xml version="1.0"?>
|
||||
<methodCall>
|
||||
<methodName>domain.zone.version.new</methodName>
|
||||
|
|
@ -407,7 +351,7 @@ var serverResponses = map[string]string{
|
|||
</params>
|
||||
</methodResponse>
|
||||
`,
|
||||
// Present Request->Response 6 (addTXTRecord)
|
||||
// Present Request->Response 4 (addTXTRecord)
|
||||
`<?xml version="1.0"?>
|
||||
<methodCall>
|
||||
<methodName>domain.zone.record.add</methodName>
|
||||
|
|
@ -486,7 +430,7 @@ var serverResponses = map[string]string{
|
|||
</params>
|
||||
</methodResponse>
|
||||
`,
|
||||
// Present Request->Response 7 (setZoneVersion)
|
||||
// Present Request->Response 5 (setZoneVersion)
|
||||
`<?xml version="1.0"?>
|
||||
<methodCall>
|
||||
<methodName>domain.zone.version.set</methodName>
|
||||
|
|
@ -514,7 +458,7 @@ var serverResponses = map[string]string{
|
|||
</params>
|
||||
</methodResponse>
|
||||
`,
|
||||
// Present Request->Response 8 (setZone)
|
||||
// Present Request->Response 6 (setZone)
|
||||
`<?xml version="1.0"?>
|
||||
<methodCall>
|
||||
<methodName>domain.zone.set</methodName>
|
||||
|
|
|
|||
Loading…
Reference in a new issue