Validate TLD during ssl cert creation

Change-Id: Id77c9cff8075bbc3f421b832d2d71ea217ef952c

Mocked the underlying network calls that validate the domain

Change-Id: I07146c65518b120d114d62ae38066de08b210b2a

Fixing pep8 issue

Change-Id: Ibf5072288c1fbba086a021e07a56c33a4f7b3fbf
This commit is contained in:
Mohan Madhavan 2016-07-15 13:44:09 -05:00
parent 414261ac13
commit 7e0e0e69eb
6 changed files with 45 additions and 3 deletions

View File

@ -48,7 +48,8 @@ class DefaultSSLCertificateController(base.SSLCertificateController):
if (not validators.is_valid_domain_name(cert_obj.domain_name)) or \
(validators.is_root_domain(
domain.Domain(cert_obj.domain_name).to_dict())):
domain.Domain(cert_obj.domain_name).to_dict())) or \
(not validators.is_valid_tld(cert_obj.domain_name)):
# here created a http domain object but it does not matter http or
# https
raise ValueError('%s must be a valid non-root domain' %

View File

@ -14,9 +14,12 @@
# limitations under the License.
import datetime
import dns.resolver
import functools
import json
import re
import whois
try:
set
except NameError: # noqa pragma: no cover
@ -30,6 +33,7 @@ from poppy.common import util
from poppy.transport.validators import root_domain_regexes as regexes
from poppy.transport.validators.stoplight import decorators
from poppy.transport.validators.stoplight import exceptions
from tld import get_tld
def req_accepts_json_pecan(request, desired_content_type='application/json'):
@ -134,6 +138,23 @@ def is_valid_shared_ssl_domain_name(domain_name):
return re.match(shared_ssl_domain_regex, domain_name) is not None
def is_valid_tld(domain_name):
try:
status = whois.whois(domain_name)['status']
if status is not None or status != '':
url = 'https://{domain}'
tld_obj = get_tld(url.format(domain=domain_name),
as_object=True)
tld = tld_obj.suffix
try:
dns.resolver.query(tld + '.', 'SOA')
return True
except dns.resolver.NXDOMAIN:
return False
except Exception:
return False
def is_valid_domain_name(domain_name):
# only allow ascii
domain_regex = ('^((?=[a-z0-9-]{1,63}\.)[a-z0-9]+'

View File

@ -19,3 +19,7 @@ oslo.log>=1.12.1
oslo.serialization>=1.7.0
oslo.utils>=2.0.0
SecretStorage==2.1.4
python-whois>=0.6.2
tld>=0.7.6
dnspython>=1.14.0

View File

@ -17,7 +17,9 @@ import json
import uuid
import ddt
import mock
from poppy.transport.validators import helpers as validators
from tests.functional.transport.pecan import base
@ -56,6 +58,7 @@ class SSLCertificateControllerTest(base.FunctionalTest):
@ddt.file_data("data_create_ssl_certificate.json")
def test_create_ssl_certificate(self, ssl_certificate_json):
validators.is_valid_tld = mock.Mock(return_value=True)
# override the hardcoded flavor_id in the ddt file with
# a custom one defined in setUp()
@ -81,6 +84,7 @@ class SSLCertificateControllerTest(base.FunctionalTest):
self.assertEqual(404, response.status_code)
def test_get_ssl_certificate_existing_domain(self):
validators.is_valid_tld = mock.Mock(return_value=True)
domain = 'www.iexist.com'
ssl_certificate_json = {
"cert_type": "san",
@ -113,6 +117,7 @@ class SSLCertificateControllerTest(base.FunctionalTest):
response_list[0]["project_id"])
def test_get_ssl_certificate_existing_domain_different_project_id(self):
validators.is_valid_tld = mock.Mock(return_value=True)
domain = 'www.iexist.com'
ssl_certificate_json = {
"cert_type": "san",

View File

@ -1,6 +1,5 @@
coverage
ddt==1.0.0
dnspython
fixtures
hacking
mock
@ -11,4 +10,4 @@ requests-mock
testrepository
testtools
beautifulsoup4
hypothesis
hypothesis

View File

@ -22,6 +22,7 @@ import testtools
from poppy.manager.default import driver
from poppy.manager.default import ssl_certificate
from poppy.model import ssl_certificate as ssl_cert_model
from poppy.transport.validators import helpers as validators
from tests.unit import base
@ -88,6 +89,17 @@ class DefaultSSLCertificateControllerTests(base.TestCase):
with testtools.ExpectedException(ValueError):
self.scc.create_ssl_certificate('project_id', cert_obj=cert_obj)
def test_create_ssl_certificate_invalid_domain(self):
cert_obj = ssl_cert_model.SSLCertificate(
'premium',
'www.krusty.happyclowns',
'san',
project_id='000'
)
validators.is_valid_tld = mock.Mock(return_value=False)
with testtools.ExpectedException(ValueError):
self.scc.create_ssl_certificate('project_id', cert_obj=cert_obj)
def test_create_ssl_certificate_exception_storage_create_cert(self):
cert_obj = ssl_cert_model.SSLCertificate(
'flavor_id',