From 12777d9bf074dc15436e4c7257e52ad7c331b90b Mon Sep 17 00:00:00 2001 From: Michael Hobbs Date: Thu, 12 Feb 2015 12:33:13 -0800 Subject: [PATCH] simplify SSL hostname handling and avoid overwriting variables. refs #971 --- plugins/nginx-vhosts/commands | 14 +++++++++----- tests/unit/00_dokku-standard.bats | 7 +++---- tests/unit/nginx-vhosts.bats | 16 ++++++++++++++++ tests/unit/server_ssl_wildcard.tar | Bin 0 -> 10240 bytes tests/unit/test_helper.bash | 18 ++++++++++++++++++ 5 files changed, 46 insertions(+), 9 deletions(-) create mode 100644 tests/unit/server_ssl_wildcard.tar diff --git a/plugins/nginx-vhosts/commands b/plugins/nginx-vhosts/commands index 1d0a9db23..a75745871 100755 --- a/plugins/nginx-vhosts/commands +++ b/plugins/nginx-vhosts/commands @@ -52,14 +52,18 @@ EOF SCHEME="https" SSL_HOSTNAME=$(openssl x509 -in $SSL_INUSE/server.crt -noout -subject | tr '/' '\n' | grep CN= | cut -c4-) - SSL_HOSTNAME=$(echo "$SSL_HOSTNAME" | sed 's|\.|\\.|g' | sed 's/\*/\.\*/g') - [[ -z "$(egrep ^"$SSL_HOSTNAME"$ $VHOST_PATH)" ]] && echo "$SSL_HOSTNAME" | sed 's/\\./\./g' >> $VHOST_PATH + if [[ -n "$SSL_HOSTNAME" ]]; then + SSL_HOSTNAME_REGEX=$(echo "$SSL_HOSTNAME" | sed 's|\.|\\.|g' | sed 's/\*/\.\*/g') + [[ -z "$(egrep "^${SSL_HOSTNAME_REGEX}$" $VHOST_PATH)" ]] && echo "$SSL_HOSTNAME" >> $VHOST_PATH + fi SSL_HOSTNAME_ALT=$(openssl x509 -in $SSL_INUSE/server.crt -noout -text | grep --after-context=1 '509v3 Subject Alternative Name:' | tail -n 1 | sed -e "s/[[:space:]]*DNS://g" | tr ',' '\n' || true) - SSL_HOSTNAME_ALT=$(echo "$SSL_HOSTNAME_ALT" | sed 's|\.|\\.|g' | sed 's/\*/\.\*/g') - [[ -z "$(egrep ^"$SSL_HOSTNAME_ALT"$ $VHOST_PATH)" ]] && echo "$SSL_HOSTNAME_ALT" | sed 's/\\./\./g' >> $VHOST_PATH + if [[ -n "$SSL_HOSTNAME_ALT" ]]; then + SSL_HOSTNAME_ALT_REGEX=$(echo "$SSL_HOSTNAME_ALT" | sed 's|\.|\\.|g' | sed 's/\*/\.\*/g') + [[ -z "$(egrep "^${SSL_HOSTNAME_ALT_REGEX}$" $VHOST_PATH)" ]] && echo "$SSL_HOSTNAME_ALT" >> $VHOST_PATH + fi - SSL_VHOSTS=$(egrep "^${SSL_HOSTNAME}$|^${SSL_HOSTNAME_ALT}$" $VHOST_PATH || exit 0) + SSL_VHOSTS=$(egrep "^${SSL_HOSTNAME_REGEX}$|^${SSL_HOSTNAME_ALT_REGEX}$" $VHOST_PATH || exit 0) NONSSL_VHOSTS=$(egrep -v "^${SSL_HOSTNAME}$|^${SSL_HOSTNAME_ALT}$" $VHOST_PATH || exit 0) while read line; do diff --git a/tests/unit/00_dokku-standard.bats b/tests/unit/00_dokku-standard.bats index c8abfbfba..cb9857e39 100644 --- a/tests/unit/00_dokku-standard.bats +++ b/tests/unit/00_dokku-standard.bats @@ -9,6 +9,7 @@ setup() { teardown() { rm -rf /home/dokku/$TEST_APP/tls /home/dokku/tls destroy_app + disable_tls_wildcard } @test "run (with tty)" { @@ -35,8 +36,7 @@ teardown() { } @test "urls (app ssl)" { - mkdir -p /home/dokku/$TEST_APP/tls - touch /home/dokku/$TEST_APP/tls/server.crt /home/dokku/$TEST_APP/tls/server.key + setup_test_tls run bash -c "dokku urls $TEST_APP | grep dokku.me" echo "output: "$output echo "status: "$status @@ -44,8 +44,7 @@ teardown() { } @test "urls (wildcard ssl)" { - mkdir -p /home/dokku/tls - touch /home/dokku/tls/server.crt /home/dokku/tls/server.key + setup_test_tls_wildcard run bash -c "dokku urls $TEST_APP | grep dokku.me" echo "output: "$output echo "status: "$status diff --git a/tests/unit/nginx-vhosts.bats b/tests/unit/nginx-vhosts.bats index 0c6f09db1..8c9660a48 100644 --- a/tests/unit/nginx-vhosts.bats +++ b/tests/unit/nginx-vhosts.bats @@ -12,6 +12,7 @@ teardown() { destroy_app [[ -f "$DOKKU_ROOT/VHOST.bak" ]] && mv "$DOKKU_ROOT/VHOST.bak" "$DOKKU_ROOT/VHOST" [[ -f "$DOKKU_ROOT/HOSTNAME.bak" ]] && mv "$DOKKU_ROOT/HOSTNAME.bak" "$DOKKU_ROOT/HOSTNAME" + disable_tls_wildcard } @test "nginx (no server tokens)" { @@ -22,6 +23,21 @@ teardown() { assert_failure } +@test "nginx:build-config (wildcard SSL)" { + destroy_app + setup_test_tls_wildcard + create_app + run dokku domains:add $TEST_APP wildcard.dokku.me + echo "output: "$output + echo "status: "$status + assert_success + deploy_app + run bash -c "response=\"$(curl -LkSs wildcard.dokku.me)\"; echo \$response; test \"\$response\" == \"nodejs/express\"" + echo "output: "$output + echo "status: "$status + assert_success +} + @test "nginx:build-config (with SSL CN mismatch)" { setup_test_tls deploy_app diff --git a/tests/unit/server_ssl_wildcard.tar b/tests/unit/server_ssl_wildcard.tar new file mode 100644 index 0000000000000000000000000000000000000000..0fa52c4eefaf1ce1d71da62dd54834cb4d9b6530 GIT binary patch literal 10240 zcmeH~NziXFsZ4(vN(70ZoHfB>;C;@3A{=5$w2StZb~!6c->o z%+2HR2!Ea5z$qWseEcmP=Wl<}fX+c+*thcmlQ{J2^UH*wDE9VH zzI})OqImw`cA4gQ{Qmvh8W&^y`qvEpH~Sx){^xxB*VkZpQ8vD_yzR<@%+fCZV;0b5 znTrpWrJGwpZ!$v{vO>#@nKzi8iJ_*`kjOfN=*S7mSv-Gg!d6Jgjr_uDd*9xW)S>bYFAmk2&ri zb6a%q=ay=bhCQAsb@qPOcYr@=`)e=f=5@9<%0z711XY&U=Xc>rdp~Wd&fQO2#fWJu zEFsbyA#(j;2YxP?bk6%3mdwMA#xiFx`u@9fU1zIqi9~9QQEy3nZz~GE`T`96N|-(g z)0oU~8~wFFrMojL77M4moQ?91?>3^6{?Mqo7Tmkp2WTCV8H zuY31G*|N_PVeD}z=3%kcq`-d-cE9vi{r28CzTSpi&jAa^2mA4IlKu`&XQpp`BXQ2y zE@i+EHp->tn-uAiSt=e}dZlAmQ@&)Xb4w60>b(PyEO1F?ogbyE=nijlcxs@_hwm2d zwO)@nuu{A0pc3(NYg~`$rfF(#P-ww~jizv00sXi*M?K1%Jreyi9Hy2oxf9}OR|gwx zKZcUqo1@H@wwlJkGt+wuJ^Zm%HP^K&f&>i3^)4?dC^pj!uo+o4*2jyG&aBRs-ONp; zyL5YH$=+y8N;PG6Sg4Z~{h4)!ro|^9KI!m(4oAjs7OT_r#%|}awITCN0Y?`>@n`qp zD_gWhFMy!f-rCFT5S&(kNi1t2G8?XLn^|z@*tw(%F#(#Pc`ZjRWD8*O4-q- zGy(&tV9s(XuD@lqmRP}|0wITFk`cvc;P0)&+ynn|jf*Gy4l9tK_bgZE*v6|(o7dJ( z0m>PAnA~F}-m=giy{+w$$?0@ceifDr2CueK{GA{Bm)#l zRdXXYCez~<@XEVl`p)Oi>gk(a(??eu!oXXYwng66o44qh6LXiWKY9oV;YP+y zf6A8mNk&c8UoiO9A+V~A{8gV_iZn=`HG4aEIH|u~H_wkbk0Y){yM`rx)&q`1u99QU zl)ol1=7+kc0Y8crZ*c!y!2WZ}@c&z+zx`eR>-_y!1@R^F|3?2&1V(??f1LQK|L8~m z|Ehfa>i5Ux`KkZ5Lw`4I`F`sEca;zS(F5>Zan>+eWoe72=YV0Q_^s!umsJZq^vxj6hRW%(7qXRfrAZD>OpnLgd^z>ArOGxw z1sgKSmUJ0)2br3fo<#QsKxh~BevTc&6)g~}22-t;c6|08d>b@PQ=YTP8+o0fM$`>4 zSx>n7rlI&UBiV#)$@+B@}7NQ+bC+J(Pj%qeuPg*}w#56b30|K(A2!YK<(K`6202l;%(G znX_*W!;%=lRh#!H5ZY#h6OzW`<+IIr8=bbS#%tfL$&Z*gZwWtZ)f%#Q}GYZudeXg+g<0zoj z$|0b<6G}LtZn8beSiA7C3GL?1ulhWJeeIS(9szNS(C}tbfC1HGHqx*AUOLNyD;a+U zmM81N1phPyfzcXzyA{e+jR=H8XFljvujR=lZwyDAg=6q$ZJ}>oTcI8;2$07MAt0pP z^op!R4WHXP%b{KB{YKbE!pJAt#4y)e+oEN&*ZO!vFK<0S#j|(XjS|GE1YH3}&+7fn zV~dcdk(VfwTTM^(o?H#Nj5M6STv!ktW#dqdkh(Nb5lqxlU)BotW;M8r0K}6OUf+=I z{=)t7T}MfaAmWmqQG0WR9YE`5f|i^(h$&I$7g6`y;`1X z8HVG-#;vn4e?H#$`EOOPbHdMLoXEt+0T4GW#zJJ2fL$hUxAAm> zbZQvoUMAdv*fHWsLje>`7k#>WT?WSPae_M4s#=ljhTI8fSDrr=0R(xA+O zXU+w;8z$xETnleTyX{Ps)$aOUAe9+G-dTpk7RjPFm*f>6?4b>Y%f)2kV}<7V0OI=