letsencrypt
/
boulder
mirror of https://github.com/letsencrypt/boulder.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Improve error messages. (#2256) 

Quote rejected hostnames.
Include term "global" when rejecting based on global rate limit.

Fixes #2252
This commit is contained in:
Jacob Hoffman-Andrews 2016-10-18 10:15:21 -07:00 committed by Roland Bracewell Shoemaker
parent 27d531101f
commit 404e9682b1
3 changed files with 16 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
csr/csr.go
View File

@ -80,7 +80,7 @@ func VerifyCSR(csr *x509.CertificateRequest, maxNames int, keyPolicy *goodkey.Ke
Type: core.IdentifierDNS, Type: core.IdentifierDNS,
Value: name, Value: name,
}); err != nil { }); err != nil {
badNames = append(badNames, name) badNames = append(badNames, fmt.Sprintf("%q", name))
} }
} }
if len(badNames) > 0 { if len(badNames) > 0 {

28
csr/csr_test.go
View File

@ -28,7 +28,7 @@ func (pa *mockPA) ChallengesFor(identifier core.AcmeIdentifier) (challenges []co
} }
func (pa *mockPA) WillingToIssue(id core.AcmeIdentifier) error { func (pa *mockPA) WillingToIssue(id core.AcmeIdentifier) error {
if id.Value == "bad-name.com" { if id.Value == "bad-name.com" || id.Value == "other-bad-name.com" {
return errors.New("") return errors.New("")
} }
return nil return nil
@ -50,9 +50,9 @@ func TestVerifyCSR(t *testing.T) {
signedReqWithLongCN := new(x509.CertificateRequest) signedReqWithLongCN := new(x509.CertificateRequest)
*signedReqWithLongCN = *signedReq *signedReqWithLongCN = *signedReq
signedReqWithLongCN.Subject.CommonName = strings.Repeat("a", maxCNLength+1) signedReqWithLongCN.Subject.CommonName = strings.Repeat("a", maxCNLength+1)
signedReqWithBadName := new(x509.CertificateRequest) signedReqWithBadNames := new(x509.CertificateRequest)
*signedReqWithBadName = *signedReq *signedReqWithBadNames = *signedReq
signedReqWithBadName.DNSNames = []string{"bad-name.com"} signedReqWithBadNames.DNSNames = []string{"bad-name.com", "other-bad-name.com"}
signedReqWithEmailAddress := new(x509.CertificateRequest) signedReqWithEmailAddress := new(x509.CertificateRequest)
*signedReqWithEmailAddress = *signedReq *signedReqWithEmailAddress = *signedReq
signedReqWithEmailAddress.EmailAddresses = []string{"foo@bar.com"} signedReqWithEmailAddress.EmailAddresses = []string{"foo@bar.com"}
@ -70,7 +70,7 @@ func TestVerifyCSR(t *testing.T) {
}{ }{
{ {
&x509.CertificateRequest{}, &x509.CertificateRequest{},
0, 100,
testingPolicy, testingPolicy,
&mockPA{}, &mockPA{},
0, 0,
@ -78,7 +78,7 @@ func TestVerifyCSR(t *testing.T) {
}, },
{ {
&x509.CertificateRequest{PublicKey: private.PublicKey}, &x509.CertificateRequest{PublicKey: private.PublicKey},
1, 100,
testingPolicy, testingPolicy,
&mockPA{}, &mockPA{},
0, 0,
@ -86,7 +86,7 @@ func TestVerifyCSR(t *testing.T) {
}, },
{ {
brokenSignedReq, brokenSignedReq,
1, 100,
testingPolicy, testingPolicy,
&mockPA{}, &mockPA{},
0, 0,
@ -94,7 +94,7 @@ func TestVerifyCSR(t *testing.T) {
}, },
{ {
signedReq, signedReq,
1, 100,
testingPolicy, testingPolicy,
&mockPA{}, &mockPA{},
0, 0,
@ -102,7 +102,7 @@ func TestVerifyCSR(t *testing.T) {
}, },
{ {
signedReqWithLongCN, signedReqWithLongCN,
1, 100,
testingPolicy, testingPolicy,
&mockPA{}, &mockPA{},
0, 0,
@ -117,16 +117,16 @@ func TestVerifyCSR(t *testing.T) {
errors.New("CSR contains more than 1 DNS names"), errors.New("CSR contains more than 1 DNS names"),
}, },
{ {
signedReqWithBadName, signedReqWithBadNames,
1, 100,
testingPolicy, testingPolicy,
&mockPA{}, &mockPA{},
0, 0,
errors.New("policy forbids issuing for: bad-name.com"), errors.New("policy forbids issuing for: \"bad-name.com\", \"other-bad-name.com\""),
}, },
{ {
signedReqWithEmailAddress, signedReqWithEmailAddress,
1, 100,
testingPolicy, testingPolicy,
&mockPA{}, &mockPA{},
0, 0,
@ -134,7 +134,7 @@ func TestVerifyCSR(t *testing.T) {
}, },
{ {
signedReqWithIPAddress, signedReqWithIPAddress,
1, 100,
testingPolicy, testingPolicy,
&mockPA{}, &mockPA{},
0, 0,

2
ra/ra.go
View File

@ -749,7 +749,7 @@ func (ra *RegistrationAuthorityImpl) checkLimits(ctx context.Context, names []st
domains := strings.Join(names, ",") domains := strings.Join(names, ",")
ra.totalCertsStats.Inc("Exceeded", 1) ra.totalCertsStats.Inc("Exceeded", 1)
ra.log.Info(fmt.Sprintf("Rate limit exceeded, TotalCertificates, regID: %d, domains: %s, totalIssued: %d", regID, domains, totalIssued)) ra.log.Info(fmt.Sprintf("Rate limit exceeded, TotalCertificates, regID: %d, domains: %s, totalIssued: %d", regID, domains, totalIssued))
return core.RateLimitedError("Certificate issuance limit reached") return core.RateLimitedError("Global certificate issuance limit reached. Try again in an hour.")
} }
ra.totalCertsStats.Inc("Pass", 1) ra.totalCertsStats.Inc("Pass", 1)
} }