letsencrypt
/
boulder
mirror of https://github.com/letsencrypt/boulder.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Fix bug in how bad-key-revoker resolves contacts (#4833) 

admin-revoker uses a dummy registration ID (0) when adding rows to
the blockedKeys table. resolveContacts in bad-key-revoker fails if it
cannot lookup a registration. Don't bother adding the id to the list
of ids to resolve, and add a catch for non-existent registration IDs
to resolveContacts.
This commit is contained in:
Roland Bracewell Shoemaker 2020-06-01 14:32:02 -07:00 committed by GitHub
parent c5cb86ac48
commit c1fc30020e
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 8 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
cmd/bad-key-revoker/main.go
View File

@ -153,6 +153,9 @@ func (bkr *badKeyRevoker) resolveContacts(ids []int64) (map[int64][]string, erro
}
err := bkr.dbMap.SelectOne(&emails, "SELECT contact FROM registrations WHERE id = ?", id)
if err != nil {
if db.IsNoRows(err) {
continue
}
return nil, err
}
if len(emails.Contact) != 0 {
@ -278,8 +281,10 @@ func (bkr *badKeyRevoker) invoke() (bool, error) {
}
// if the account that revoked the original certificate isn't an owner of any
// extant certificates, still add them to ids so that we can resolve their
// email and avoid sending emails later.
if _, present := ownedBy[unchecked.RevokedBy]; !present {
// email and avoid sending emails later. If RevokedBy == 0 it was a row
// inserted by admin-revoker with a dummy ID, since there won't be a registration
// to look up, don't bother adding it to ids.
if _, present := ownedBy[unchecked.RevokedBy]; !present && unchecked.RevokedBy != 0 {
ids = append(ids, unchecked.RevokedBy)
}
// get contact addresses for the list of IDs

2
cmd/bad-key-revoker/main_test.go
View File

@ -182,7 +182,7 @@ func TestResolveContacts(t *testing.T) {
regIDC := insertRegistration(t, dbMap, "example.com")
regIDD := insertRegistration(t, dbMap, "example-2.com")
idToEmail, err := bkr.resolveContacts([]int64{regIDA, regIDB, regIDC, regIDD})
idToEmail, err := bkr.resolveContacts([]int64{0, regIDA, regIDB, regIDC, regIDD})
test.AssertNotError(t, err, "resolveContacts failed")
test.AssertDeepEquals(t, idToEmail, map[int64][]string{
regIDA: {""},