From 4ac432ce8782db055cdd7ae57623645a4de1faf5 Mon Sep 17 00:00:00 2001 From: csine-nflx Date: Sun, 13 Dec 2020 00:03:21 -0800 Subject: [PATCH] Creating variable to store cname_delegation state and creating cname delegation metric --- lemur/plugins/lemur_acme/acme_handlers.py | 17 ++++++++++------- .../lemur_acme/tests/test_acme_handler.py | 2 +- 2 files changed, 11 insertions(+), 8 deletions(-) diff --git a/lemur/plugins/lemur_acme/acme_handlers.py b/lemur/plugins/lemur_acme/acme_handlers.py index 83dfb1ba..78c160b2 100644 --- a/lemur/plugins/lemur_acme/acme_handlers.py +++ b/lemur/plugins/lemur_acme/acme_handlers.py @@ -36,12 +36,13 @@ from retrying import retry class AuthorizationRecord(object): - def __init__(self, domain, target_domain, authz, dns_challenge, change_id): + def __init__(self, domain, target_domain, authz, dns_challenge, change_id, cname_delegation): self.domain = domain self.target_domain = target_domain self.authz = authz self.dns_challenge = dns_challenge self.change_id = change_id + self.cname_delegation = cname_delegation class AcmeHandler(object): @@ -305,6 +306,7 @@ class AcmeDnsHandler(AcmeHandler): current_app.logger.debug(f"Starting DNS challenge for {domain} using target domain {target_domain}.") change_ids = [] + cname_delegation = domain != target_domain dns_challenges = self.get_dns_challenges(domain, order.authorizations) host_to_validate, _ = self.strip_wildcard(target_domain) host_to_validate = self.maybe_add_extension(host_to_validate, dns_provider_options) @@ -315,9 +317,7 @@ class AcmeDnsHandler(AcmeHandler): raise Exception("Unable to determine DNS challenges from authorizations") for dns_challenge in dns_challenges: - - # Only prepend '_acme-challenge' if not using CNAME redirection - if domain == target_domain: + if not cname_delegation: host_to_validate = dns_challenge.validation_domain_name(host_to_validate) change_id = dns_provider.create_txt_record( @@ -328,7 +328,7 @@ class AcmeDnsHandler(AcmeHandler): change_ids.append(change_id) return AuthorizationRecord( - domain, target_domain, order.authorizations, dns_challenges, change_ids + domain, target_domain, order.authorizations, dns_challenges, change_ids, cname_delegation ) def complete_dns_challenge(self, acme_client, authz_record): @@ -395,6 +395,9 @@ class AcmeDnsHandler(AcmeHandler): if cname_result: target_domain = cname_result self.autodetect_dns_providers(target_domain) + metrics.send( + "get_authorizations_cname_delegation_for_domain", "counter", 1, metric_tags={"domain": domain} + ) if not self.dns_providers_for_domain.get(target_domain): metrics.send( @@ -455,7 +458,7 @@ class AcmeDnsHandler(AcmeHandler): account_number = dns_provider_options.get("account_id") host_to_validate, _ = self.strip_wildcard(authz_record.target_domain) host_to_validate = self.maybe_add_extension(host_to_validate, dns_provider_options) - if authz_record.domain == authz_record.target_domain: + if not authz_record.cname_delegation: host_to_validate = challenges.DNS01().validation_domain_name(host_to_validate) dns_provider_plugin.delete_txt_record( authz_record.change_id, @@ -492,7 +495,7 @@ class AcmeDnsHandler(AcmeHandler): dns_provider_plugin = self.get_dns_provider(dns_provider.provider_type) for dns_challenge in dns_challenges: - if authz_record.domain == authz_record.target_domain: + if not authz_record.cname_delegation: host_to_validate = dns_challenge.validation_domain_name(host_to_validate) try: dns_provider_plugin.delete_txt_record( diff --git a/lemur/plugins/lemur_acme/tests/test_acme_handler.py b/lemur/plugins/lemur_acme/tests/test_acme_handler.py index cfc18c83..324af5ac 100644 --- a/lemur/plugins/lemur_acme/tests/test_acme_handler.py +++ b/lemur/plugins/lemur_acme/tests/test_acme_handler.py @@ -30,7 +30,7 @@ class TestAcmeHandler(unittest.TestCase): self.assertEqual(expected, result) def test_authz_record(self): - a = acme_handlers.AuthorizationRecord("domain", "host", "authz", "challenge", "id") + a = acme_handlers.AuthorizationRecord("domain", "host", "authz", "challenge", "id", "cname_delegation") self.assertEqual(type(a), acme_handlers.AuthorizationRecord) def test_setup_acme_client_fail(self):