From 11d971bc07ceb4359565e6611ae03a0c0134d153 Mon Sep 17 00:00:00 2001
From: Guilhem Moulin <guilhem@fripost.org>
Date: Fri, 19 Feb 2021 23:22:15 +0100
Subject: Add test suite against Let's Encrypt's staging environment.

https://letsencrypt.org/docs/staging-environment/
---
 tests/accountd | 64 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 64 insertions(+)
 create mode 100644 tests/accountd

(limited to 'tests/accountd')

diff --git a/tests/accountd b/tests/accountd
new file mode 100644
index 0000000..2f3985f
--- /dev/null
+++ b/tests/accountd
@@ -0,0 +1,64 @@
+# Use a separate accountd server process
+
+adduser --disabled-password \
+       --home /home/lacme-account \
+       --gecos "lacme account user" \
+       --quiet lacme-account
+
+# non-existent parent directory
+! lacme --socket="/nonexistent/S.lacme" account 2>"$STDERR" || fail
+grepstderr -Fxq "stat(/nonexistent): No such file or directory"
+
+# word-writable parent directory
+! lacme --socket="/tmp/S.lacme" account 2>"$STDERR" || fail
+grepstderr -Fxq "Error: insecure permissions on /tmp"
+
+# missing socket
+SOCKET=~lacme-account/S.lacme
+! lacme --socket="$SOCKET" account 2>"$STDERR" || fail
+grepstderr -Fxq "Can't stat $SOCKET: No such file or directory (Is lacme-accountd running?)"
+
+#######################################################################
+
+install -olacme-account -glacme-account -Ddm0700 ~lacme-account/.config/lacme
+mv -t ~lacme-account/.config/lacme /etc/lacme/account.key
+chown lacme-account: ~lacme-account/.config/lacme/account.key
+
+cat >~lacme-account/.config/lacme/lacme-accountd.conf <<-EOF
+	privkey = file:/home/lacme-account/.config/lacme/account.key
+EOF
+
+# non-existent parent directory
+! runuser -u lacme-account -- lacme-accountd --socket="/nonexistent/S.lacme" 2>"$STDERR" || fail
+grepstderr -Fxq "stat(/nonexistent): No such file or directory"
+
+# word-writable parent directory
+! runuser -u lacme-account -- lacme-accountd --socket="/tmp/S.lacme" account 2>"$STDERR" || fail
+grepstderr -Fxq "Error: insecure permissions on /tmp"
+
+# non-existent $XDG_RUNTIME_DIR
+! runuser -u lacme-account -- env XDG_RUNTIME_DIR="/nonexistent" lacme-accountd 2>"$STDERR" || fail
+grepstderr -Fxq "stat(/nonexistent): No such file or directory"
+
+# test running accountd
+runuser -u lacme-account -- env XDG_RUNTIME_DIR=/home/lacme-account lacme-accountd --debug 2>"$STDERR" & PID=$!
+sleep 1
+kill $PID || fail
+wait || fail
+grepstderr -Fxq "Using configuration file: /home/lacme-account/.config/lacme/lacme-accountd.conf"
+grepstderr -Fxq "Starting lacme Account Key Manager at /home/lacme-account/S.lacme"
+
+# spawn accountd
+runuser -u lacme-account -- lacme-accountd --socket="$SOCKET" --quiet & PID=$!
+
+# run lacme(8) multiple times using that single lacme-accountd(1) instance
+lacme --socket="$SOCKET" account  2>"$STDERR" || fail
+lacme --socket="$SOCKET" newOrder 2>"$STDERR" || fail
+test /etc/lacme/simpletest.rsa.crt -nt /etc/lacme/simpletest.rsa.key
+
+# terminate accountd and check that it removes the socket
+kill $PID
+wait
+! test -e "$SOCKET"
+
+# vim: set filetype=sh :
-- 
cgit v1.2.3


From 0ef94d85e58497dcb2c4c954cadcac918032467a Mon Sep 17 00:00:00 2001
From: Guilhem Moulin <guilhem@fripost.org>
Date: Thu, 18 Feb 2021 21:07:01 +0100
Subject: Add %-specifiers support.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

lacme(8): for --config=, --socket=, --config-certs= (and ‘socket’/
‘config-certs’/‘challenge-directory’ configuration options *before*
privilege drop; and for the [accountd] section ‘command’/‘config’
configuration options *after* privilege drop).

lacme-accountd(1): for --config=, --socket= and --privkey= (and
‘socket’/‘privkey’ configuration options).

This also changes the default configuration file location.  lacme(8) and
lacme-accountd(1) now respectively use /etc/lacme/lacme.conf resp.
/etc/lacme/lacme-accountd.conf when running as root, and
$XDG_CONFIG_HOME/lacme/lacme.conf resp. $XDG_CONFIG_HOME/lacme/lacme-accountd.conf
when running as a normal user.  There is no fallback to /etc anymore.
---
 Changelog                  |  23 ++++++--
 INSTALL                    |   1 -
 Makefile                   |   1 +
 config/lacme-accountd.conf |   4 +-
 config/lacme.conf          |   4 +-
 lacme                      |  39 +++++++++++---
 lacme-accountd             |  35 +++++++++---
 lacme-accountd.1.md        |  67 ++++++++++++++++++-----
 lacme.8.md                 |  90 +++++++++++++++++++++++--------
 tests/accountd             |  13 ++++-
 tests/spec-expansion       | 130 +++++++++++++++++++++++++++++++++++++++++++++
 11 files changed, 341 insertions(+), 66 deletions(-)
 create mode 100644 tests/spec-expansion

(limited to 'tests/accountd')

diff --git a/Changelog b/Changelog
index 8952ba6..966b0b0 100644
--- a/Changelog
+++ b/Changelog
@@ -19,9 +19,16 @@ lacme (0.7.1) upstream;
    validate provided X.509 chains using that self-contained bundle,
    regardless of which CAs is marqued as trusted under /etc/ssl/certs.
    This change bumps the minimum OpenSSL version to 1.1.0.
- * Breaking change: lacme(8) resp. lacme-accountd(1) no longer consider
-   ./lacme.conf resp. ./lacme-accountd.conf as default location for the
-   configuration file.
+ * Breaking change: lacme(8) and lacme-accountd(1) respectively load
+   their configuration file from /etc/lacme/lacme.conf resp.
+   /etc/lacme/lacme-accountd.conf when running as root, and
+   $XDG_CONFIG_HOME/lacme/lacme.conf resp.
+   $XDG_CONFIG_HOME/lacme/lacme-accountd.conf when running as a normal
+   user.  There is no fallback to /etc anymore, and the lookup in the
+   current directory as prefered choice is removed too.  However
+   lacme-accountd(1) can be used without configuration file under
+   ~/.config/lacme as it treats a non-existent default location as an
+   empty file.
  * The client, webserver, and accountd commands are now split on
    whitespace.  This doesn't change the default behavior but allows
    using `ssh -T lacme@account.example.net lacme-accountd` to spawn a
@@ -30,11 +37,17 @@ lacme (0.7.1) upstream;
    https://letsencrypt.org/docs/staging-environment/ .
  * lacme(8)'s 'config' option in the [accountd] section no longer have a
    default value.  The previous default /etc/lacme/lacme-accountd.conf
-   is still honored when there is the user running lacme doesn't have a
-   ~/.config/lacme/lacme-account.conf configuration file.
+   is still honored when root privileges are preserved (the default).
  * Deprecate setting 'privkey' in [accountd] section of the lacme(8)
    configuration file.  One need to use the lacme-accountd(1)
    configuration file for that instead.
+ * lacme(8): add %-specifiers support for --config=, --socket=,
+   --config-certs= (and 'socket'/'config-certs'/'challenge-directory'
+   configuration options *before* privilege drop; and for the [accountd]
+   section 'command'/'config' configuration options *after* privilege
+   drop).
+ * lacme-accountd(1): add %-specifiers support for --config=, --socket=
+   and --privkey= (and 'socket'/'privkey' configuration options).
  + Improve nginx/apache2 snippets for direct serving of challenge files
    (with the new 'challenge-directory' logic symlinks can be disabled).
  + Split Nginx and Apapche2 static configuration snippets into seperate
diff --git a/INSTALL b/INSTALL
index 85bd0c2..092ef16 100644
--- a/INSTALL
+++ b/INSTALL
@@ -7,7 +7,6 @@ lacme-accountd depends on the following Perl modules:
   - File::Basename (core module)
   - Getopt::Long (core module)
   - JSON (optionally C/XS-accelerated with JSON::XS)
-  - List::Util (core module)
   - MIME::Base64 (core module)
   - Socket (core module)
 
diff --git a/Makefile b/Makefile
index 2ac524b..a4caff0 100644
--- a/Makefile
+++ b/Makefile
@@ -56,6 +56,7 @@ $(BUILDDIR)/%: %
 	        s#@@sbindir@@#$(sbindir)#g; \
 	        s#@@libexecdir@@#$(libexecdir)#g; \
 	        s#@@datadir@@#$(datadir)#g; \
+	        s#@@localstatedir@@#$(localstatedir)#g; \
 	        s#@@runstatedir@@#$(runstatedir)#g; \
 	        s#@@sysconfdir@@#$(sysconfdir)#g; \
 	        s#@@lacme_www_user@@#$(lacme_www_user)#g; \
diff --git a/config/lacme-accountd.conf b/config/lacme-accountd.conf
index 10f332e..f31cf67 100644
--- a/config/lacme-accountd.conf
+++ b/config/lacme-accountd.conf
@@ -17,10 +17,8 @@
 # for signature requests from the ACME client.  An error is raised if
 # the path exists or if its parent directory is writable by other
 # users.
-# Default: "$XDG_RUNTIME_DIR/S.lacme" if the XDG_RUNTIME_DIR
-# environment variable is set.
 #
-#socket = /run/user/1000/S.lacme
+#socket = %t/S.lacme
 
 # Be quiet.  Possible values: "Yes"/"No".
 #
diff --git a/config/lacme.conf b/config/lacme.conf
index 98ecacb..198729d 100644
--- a/config/lacme.conf
+++ b/config/lacme.conf
@@ -10,13 +10,11 @@
 # UNIX-domain socket to connect to for signature requests from the ACME
 # client.  lacme(8) aborts if the socket is readable or writable by
 # other users, or if its parent directory is writable by other users.
-# Default: "$XDG_RUNTIME_DIR/S.lacme" if the XDG_RUNTIME_DIR environment
-# variable is set.
 # This setting is ignored when lacme-accountd(1) is spawned by lacme(8),
 # since the two processes communicate through a socket pair.  See the
 # "accountd" section below for details.
 #
-#socket =
+#socket = %t/S.lacme
 
 # username to drop privileges to (setting both effective and real uid).
 # Skip privilege drop if the value is empty (not recommended).
diff --git a/lacme b/lacme
index 9a62cbb..ad7e1d8 100755
--- a/lacme
+++ b/lacme
@@ -75,13 +75,33 @@ $COMMAND = $COMMAND =~ /\A(account|newOrder|new-cert|revokeCert|revoke-cert)\z/
          : usage(1, "Invalid command: $COMMAND"); # validate and untaint $COMMAND
 @ARGV = map { /\A(\p{Print}*)\z/ ? $1 : die } @ARGV; # untaint @ARGV
 
+sub env_fallback($$) {
+    my $v = $ENV{ shift() };
+    return (defined $v and $v ne "") ? $v : shift;
+}
+sub spec_expand($) {
+    my $str = shift;
+    $str =~ s#%(.)# my $x =
+          $1 eq "C" ? ($< == 0 ? "@@localstatedir@@/cache" : env_fallback(XDG_CACHE_HOME => "$ENV{HOME}/.cache"))
+        : $1 eq "E" ? ($< == 0 ? "@@sysconfdir@@" : env_fallback(XDG_CONFIG_HOME => "$ENV{HOME}/.config"))
+        : $1 eq "g" ? (getgrgid((split /\s/,$()[0]))[0]
+        : $1 eq "G" ? $( =~ s/\s.*//r
+        : $1 eq "h" ? (getpwuid($<))[7]
+        : $1 eq "u" ? (getpwuid($<))[0]
+        : $1 eq "U" ? $<
+        : $1 eq "t" ? ($< == 0 ? "@@runstatedir@@" : $ENV{XDG_RUNTIME_DIR})
+        : $1 eq "T" ? env_fallback(TMPDIR => "/tmp")
+        : $1 eq "%" ? "%"
+        : die "Error: \"$str\" has unknown specifier %$1\n";
+        die "Error: undefined expansion %$1 in \"$str\"\n" unless defined $x;
+        $x;
+    #ge;
+    return $str;
+}
+
 sub set_FD_CLOEXEC($$);
-my $CONFFILENAME = $OPTS{config} // first { -f $_ }
-   ( ($ENV{XDG_CONFIG_HOME} // "$ENV{HOME}/.config") . "/lacme/$NAME.conf"
-   , "@@sysconfdir@@/lacme/$NAME.conf"
-   );
+my $CONFFILENAME = spec_expand($OPTS{config} // "%E/lacme/$NAME.conf");
 do {
-    die "Error: Can't find configuration file\n" unless defined $CONFFILENAME;
     print STDERR "Using configuration file: $CONFFILENAME\n" if $OPTS{debug};
     open $CONFFILE, '<', $CONFFILENAME or die "Can't open $CONFFILENAME: $!\n";
     my $conf = do { local $/ = undef; <$CONFFILE> };
@@ -93,7 +113,7 @@ do {
     my $accountd = defined $OPTS{socket} ? 0 : exists $h->{accountd} ? 1 : 0;
     my %valid = (
         client => {
-            socket  => (defined $ENV{XDG_RUNTIME_DIR} ? "$ENV{XDG_RUNTIME_DIR}/S.lacme" : undef),
+            socket  => '%t/S.lacme',
             user    => '@@lacme_client_user@@',
             group   => '@@lacme_client_group@@',
             command => '@@libexecdir@@/lacme/client',
@@ -285,6 +305,7 @@ sub spawn_webserver() {
     # Use existing HTTPd to serve challenge files using 'challenge-directory'
     # as document root
     if (defined (my $dir = $conf->{'challenge-directory'})) {
+        $dir = spec_expand($dir);
         print STDERR "[$$] Using existing webserver on $dir\n" if $OPTS{debug};
         # lacme(8) doesn't have the list of challenge files to delete on
         # cleanup -- instead, we unlink all files and fails at
@@ -513,8 +534,9 @@ sub acme_client($@) {
             set_FD_CLOEXEC($s, 1);
             $ENV{GPG_TTY} = $GPG_TTY if defined $GPG_TTY;
             my ($cmd, @args) = split(/\s+/, $accountd->{command}) or die "Empty accountd command\n";
+            $_ = spec_expand($_) foreach ($cmd, @args); # expand %-specifiers after privilege drop and whitespace split
             push @args, '--stdio';
-            push @args, '--config='.$accountd->{config}   if $accountd->{config} ne '';
+            push @args, '--config='.spec_expand($accountd->{config}) if $accountd->{config} ne '';
             push @args, '--privkey='.$accountd->{privkey} if $accountd->{privkey} ne ''; # XXX deprecated in 0.8.0
             push @args, '--quiet' unless lc $accountd->{quiet} eq 'no';
             push @args, '--debug' if $OPTS{debug};
@@ -531,7 +553,7 @@ sub acme_client($@) {
     }
     else {
         my @stat;
-        my $sockname = $OPTS{socket} // $conf->{socket} // die "Missing socket option\n";
+        my $sockname = spec_expand($OPTS{socket} // $conf->{socket});
         $sockname = $sockname =~ /\A(\p{Print}+)\z/ ? $1 : die "Invalid socket name\n"; # untaint $sockname
 
         # ensure we're the only user with write access to the parent dir
@@ -697,6 +719,7 @@ elsif ($COMMAND eq 'newOrder' or $COMMAND eq 'new-cert') {
     my $conffiles = defined $OPTS{'config-certs'} ? $OPTS{'config-certs'}
                   : defined $CONFIG->{_}->{'config-certs'} ? [ split(/\s+/, $CONFIG->{_}->{'config-certs'}) ]
                   : [ "$NAME-certs.conf", "$NAME-certs.conf.d/" ];
+    $_ = spec_expand($_) foreach @$conffiles;
     my ($conf, %defaults);
     foreach my $conffile (@$conffiles) {
         $conffile = dirname($CONFFILENAME) .'/'. $conffile unless $conffile =~ /\A\//;
diff --git a/lacme-accountd b/lacme-accountd
index b9a6e33..e170637 100755
--- a/lacme-accountd
+++ b/lacme-accountd
@@ -30,7 +30,6 @@ my $NAME = 'lacme-accountd';
 use Errno 'EINTR';
 use File::Basename 'dirname';
 use Getopt::Long qw/:config posix_default no_ignore_case gnu_getopt auto_version/;
-use List::Util 'first';
 use MIME::Base64 'encode_base64url';
 use Socket qw/PF_UNIX SOCK_STREAM SHUT_RDWR/;
 
@@ -64,11 +63,32 @@ sub usage(;$$) {
 usage(1) unless GetOptions(\%OPTS, qw/config=s privkey=s socket=s stdio quiet|q debug help|h/);
 usage(0) if $OPTS{help};
 
+sub env_fallback($$) {
+    my $v = $ENV{ shift() };
+    return (defined $v and $v ne "") ? $v : shift;
+}
+sub spec_expand($) {
+    my $str = shift;
+    $str =~ s#%(.)# my $x =
+          $1 eq "C" ? ($< == 0 ? "@@localstatedir@@/cache" : env_fallback(XDG_CACHE_HOME => "$ENV{HOME}/.cache"))
+        : $1 eq "E" ? ($< == 0 ? "@@sysconfdir@@" : env_fallback(XDG_CONFIG_HOME => "$ENV{HOME}/.config"))
+        : $1 eq "g" ? (getgrgid((split /\s/,$()[0]))[0]
+        : $1 eq "G" ? $( =~ s/\s.*//r
+        : $1 eq "h" ? (getpwuid($<))[7]
+        : $1 eq "u" ? (getpwuid($<))[0]
+        : $1 eq "U" ? $<
+        : $1 eq "t" ? ($< == 0 ? "@@runstatedir@@" : $ENV{XDG_RUNTIME_DIR})
+        : $1 eq "T" ? env_fallback(TMPDIR => "/tmp")
+        : $1 eq "%" ? "%"
+        : die "Error: \"$str\" has unknown specifier %$1\n";
+        die "Error: undefined expansion %$1 in \"$str\"\n" unless defined $x;
+        $x;
+    #ge;
+    return $str;
+}
+
 do {
-    my $conffile = $OPTS{config} // first { -f $_ }
-        ( ($ENV{XDG_CONFIG_HOME} // "$ENV{HOME}/.config") . "/lacme/$NAME.conf"
-        , "@@sysconfdir@@/lacme/$NAME.conf"
-        );
+    my $conffile = spec_expand($OPTS{config} // "%E/lacme/$NAME.conf");
 
     if (defined $OPTS{config} or -e $conffile) {
         print STDERR "Using configuration file: $conffile\n" if $OPTS{debug};
@@ -94,7 +114,7 @@ do {
 #
 my ($JWK, $SIGN);
 if ($OPTS{privkey} =~ /\A(file|gpg):(\p{Print}+)\z/) {
-    my ($method, $filename) = ($1,$2);
+    my ($method, $filename) = ($1, spec_expand($2));
     my ($fh, @command);
     if ($method eq 'file') {
         # generate with `openssl genpkey -algorithm RSA`
@@ -142,8 +162,7 @@ my $JWK_STR = JSON::->new->encode($JWK);
 # delete the file manually.
 #
 unless (defined $OPTS{stdio}) {
-    my $sockname = $OPTS{socket} // (defined $ENV{XDG_RUNTIME_DIR} ? "$ENV{XDG_RUNTIME_DIR}/S.lacme" : undef);
-    die "Missing socket option\n" unless defined $sockname;
+    my $sockname = spec_expand($OPTS{socket} // '%t/S.lacme');
     $sockname = $sockname =~ /\A(\p{Print}+)\z/ ? $1 : die "Invalid socket name\n"; # untaint $sockname
 
     # ensure we're the only user with write access to the parent dir
diff --git a/lacme-accountd.1.md b/lacme-accountd.1.md
index cd6352c..4c494f2 100644
--- a/lacme-accountd.1.md
+++ b/lacme-accountd.1.md
@@ -41,9 +41,12 @@ Options
 
 `--config=`*filename*
 
-:   Use *filename* as configuration file.  `lacme-accountd` fails when
-    `--config=` is used with a non-existent file, but a non-existent
-    default location is treated as if it were an empty file.
+:   Use *filename* as configuration file instead of
+    `%E/lacme/lacme-accountd.conf`.  The value is subject to
+    [%-specifier expansion](#percent-specifiers).  `lacme-accountd`
+    fails when `--config=` is used with a non-existent file, but a
+    non-existent default location is treated as if it were an empty
+    file.
 
     See the **[configuration file](#configuration-file)** section below
     for the configuration options.
@@ -57,6 +60,8 @@ Options
       symmetrically encrypted)
     * `gpg:`*FILE*, for a [`gpg`(1)]-encrypted private key
 
+    *FILE* is subject to [%-specifier expansion](#percent-specifiers).
+
     The [`genpkey`(1ssl)] command can be used to generate a new private
     (account) key:
 
@@ -67,9 +72,14 @@ Options
 
 `--socket=`*path*
 
-:   Use *path* as the UNIX-domain socket to bind against for signature
-    requests from the [ACME] client.  `lacme-accountd` aborts if *path*
-    exists or if its parent directory is writable by other users.
+:   Use *path* as the UNIX-domain socket to bind to for signature
+    requests from the [ACME] client.  The value is subject to
+    [%-specifier expansion](#percent-specifiers).  `lacme-accountd`
+    aborts if *path* exists or if its parent directory is writable by
+    other users.
+    Default: `%t/S.lacme` (omitting `--socket=` therefore yields an
+    error when `lacme-accountd` doesn't run as and the `XDG_RUNTIME_DIR`
+    environment variable is unset or empty).
 
 `-h`, `--help`
 
@@ -86,12 +96,6 @@ Options
 Configuration file
 ==================
 
-If `--config=` is not given, `lacme-accountd` uses the first existing
-configuration file among *$XDG_CONFIG_HOME/lacme/lacme-accountd.conf*
-(or *~/.config/lacme/lacme-accountd.conf* if the `XDG_CONFIG_HOME`
-environment variable is not set), and
-*@@sysconfdir@@/lacme/lacme-accountd.conf*.
-
 When given on the command line, the `--privkey=`, `--socket=` and
 `--quiet` options take precedence over their counterpart (without
 leading `--`) in the configuration file.  Valid settings are:
@@ -110,13 +114,48 @@ leading `--`) in the configuration file.  Valid settings are:
 *socket*
 
 :   See `--socket=`.
-    Default: *$XDG_RUNTIME_DIR/S.lacme* if the `XDG_RUNTIME_DIR`
-    environment variable is set.
 
 *quiet*
 
 :   Be quiet. Possible values: `Yes`/`No`.
 
+%-specifiers  {#percent-specifiers}
+============
+
+The value the `--config=`, `--privkey=` and `--socket=` CLI options (and
+*privkey* and *socket* configuration options) are subject to %-expansion
+for the following specifiers.
+
+----  ------------------------------------------------------------------
+`%C`  `@@localstatedir@@/cache` for the root user, and `$XDG_CACHE_HOME`
+      for other users (or `$HOME/.cache` if the `XDG_CACHE_HOME`
+      environment variable is unset or empty).
+
+`%E`  `@@sysconfdir@@` for the root user, and `$XDG_CONFIG_HOME` for
+      other users (or `$HOME/.config` if the `XDG_CONFIG_HOME`
+      environment variable is unset or empty).
+
+`%g`  Current group name.
+
+`%G`  Current group ID.
+
+`%h`  Home directory of the current user.
+
+`%t`  `@@runstatedir@@` for the root user, and `$XDG_RUNTIME_DIR` for
+      other users.  Non-root users may only use `%t` when the
+      `XDG_RUNTIME_DIR` environment variable is set to a non-empty
+      value.
+
+`%T`  `$TMPDIR`, or `/tmp` if the `TMPDIR` environment variable is unset
+      or empty.
+
+`%u`  Current user name.
+
+`%U`  Current user ID.
+
+`%%`  A literal `%`.
+----  ------------------------------------------------------------------
+
 Examples
 ========
 
diff --git a/lacme.8.md b/lacme.8.md
index 4dfc67e..aab448f 100644
--- a/lacme.8.md
+++ b/lacme.8.md
@@ -100,16 +100,22 @@ Generic settings
 
 `--config=`*filename*
 
-:    Use *filename* as configuration file.  See the **[configuration
-     file](#configuration-file)** section below for the configuration
-     options.
+:   Use *filename* as configuration file instead of
+    `%E/lacme/lacme.conf`.  The value is subject to [%-specifier
+    expansion](#percent-specifiers).
+
+    See the **[configuration file](#configuration-file)** section below
+    for the configuration options.
 
 `--socket=`*path*
 
 :   Use *path* as the [`lacme-accountd`(1)] UNIX-domain socket to
-    connect to for signature requests from the [ACME] client.  `lacme`
-    aborts if `path` is readable or writable by other users, or if its
-    parent directory is writable by other users.
+    connect to for signature requests from the [ACME] client.  The value
+    is subject to [%-specifier expansion](#percent-specifiers).
+    `lacme` aborts if *path* exists or if its parent directory is
+    writable by other users.
+    Default: `%t/S.lacme`.
+
     This command-line option overrides the *socket* setting of the
     [`[client]` section](#client-section) of the configuration file; it
     also causes the [`[accountd]` section](#accountd-section) to be
@@ -130,10 +136,6 @@ Generic settings
 Configuration file
 ==================
 
-If `--config=` is not given, `lacme` uses the first existing
-configuration file among *$XDG_CONFIG_HOME/lacme/lacme.conf* (or
-*~/.config/lacme/lacme.conf* if the `XDG_CONFIG_HOME` environment
-variable is not set), and *@@sysconfdir@@/lacme/lacme.conf*.
 Valid settings are:
 
 Default section
@@ -145,13 +147,15 @@ Default section
     space-separated list of certificate configuration files or
     directories to use (see the **[certificate configuration
     file](#certificate-configuration-file)** section below for the
-    configuration options).
+    configuration options).  Each item in that list is independently
+    subject to [%-specifier expansion](#percent-specifiers).
 
-    Paths not starting with `/` are relative to the directory name of
-    the **[configuration filename](#configuration-file)**.  The list of
-    files and directories is processed in order, with the later items
-    taking precedence.  Files in a directory are processed in
-    lexicographic order, only considering the ones with suffix `.conf`.
+    Paths not starting with `/` (after %-expansion) are relative to the
+    parent directory of the **[configuration filename](#configuration-file)**.
+    The list of files and directories is processed in the specified
+    order, with the later items taking precedence.  Files in a directory
+    are processed in lexicographic order, only considering the ones with
+    suffix `.conf`.
 
     Default: `lacme-certs.conf lacme-certs.conf.d/`.
 
@@ -164,8 +168,6 @@ of [ACME] commands and dialogues with the remote [ACME] server).
 *socket*
 
 :   See `--socket=`.
-    Default: *$XDG_RUNTIME_DIR/S.lacme* if the `XDG_RUNTIME_DIR`
-    environment variable is set.
 
 *user*
 
@@ -247,7 +249,9 @@ served during certificate issuance.
     lacme client user (by default `@@lacme_client_user@@`) needs to be
     able to create files under it.
 
-    This setting is required when *listen* is empty.
+    This setting is required when *listen* is empty.  Moreover its value
+    is subject to [%-specifier expansion](#percent-specifiers) _before_
+    privilege drop.
 
 *user*
 
@@ -308,13 +312,18 @@ UNIX-domain socket.
     the first item being the command to execute, the second its first
     argument etc.  (Note that `lacme` appends more arguments when
     executing the command internally.)
+    Each item in that list is independently subject to [%-specifier
+    expansion](#percent-specifiers) _after_ privilege drop.
+    Default: `@@bindir@@/lacme-accountd`.
+
     Use for instance `ssh -T lacme@account.example.net lacme-accountd`
-    in order to spawn a remote [`lacme-accountd`(1)] server.  Default:
-    `@@bindir@@/lacme-accountd`.
+    in order to spawn a remote [`lacme-accountd`(1)] server.
 
 *config*
 
-:   Path to the [`lacme-accountd`(1)] configuration file.
+:   Path to the [`lacme-accountd`(1)] configuration file.  The value is
+    subject to [%-specifier expansion](#percent-specifiers) _after_
+    privilege drop.
 
 *quiet*
 
@@ -428,6 +437,43 @@ Valid settings are:
     after successful installation of the *certificate* and/or
     *certificate-chain*.
 
+%-specifiers  {#percent-specifiers}
+============
+
+Some CLI options and configuration settings are subject to %-expansion
+for the following specifiers.  Check the documentation of each setting
+to see which ones are affected.
+
+----  ------------------------------------------------------------------
+`%C`  `@@localstatedir@@/cache` for the root user, and `$XDG_CACHE_HOME`
+      for other users (or `$HOME/.cache` if the `XDG_CACHE_HOME`
+      environment variable is unset or empty).
+
+`%E`  `@@sysconfdir@@` for the root user, and `$XDG_CONFIG_HOME` for
+      other users (or `$HOME/.config` if the `XDG_CONFIG_HOME`
+      environment variable is unset or empty).
+
+`%g`  Current group name.
+
+`%G`  Current group ID.
+
+`%h`  Home directory of the current user.
+
+`%t`  `@@runstatedir@@` for the root user, and `$XDG_RUNTIME_DIR` for
+      other users.  Non-root users may only use `%t` when the
+      `XDG_RUNTIME_DIR` environment variable is set to a non-empty
+      value.
+
+`%T`  `$TMPDIR`, or `/tmp` if the `TMPDIR` environment variable is unset
+      or empty.
+
+`%u`  Current user name.
+
+`%U`  Current user ID.
+
+`%%`  A literal `%`.
+----  ------------------------------------------------------------------
+
 Examples
 ========
 
diff --git a/tests/accountd b/tests/accountd
index 2f3985f..4626c78 100644
--- a/tests/accountd
+++ b/tests/accountd
@@ -20,12 +20,17 @@ grepstderr -Fxq "Can't stat $SOCKET: No such file or directory (Is lacme-account
 
 #######################################################################
 
+# missing configuration at default location
+! runuser -u lacme-account -- lacme-accountd --debug 2>"$STDERR" || fail
+grepstderr -Fxq "Ignoring missing configuration file at default location /home/lacme-account/.config/lacme/lacme-accountd.conf"
+grepstderr -Fxq "Error: 'privkey' is not specified"
+
 install -olacme-account -glacme-account -Ddm0700 ~lacme-account/.config/lacme
 mv -t ~lacme-account/.config/lacme /etc/lacme/account.key
 chown lacme-account: ~lacme-account/.config/lacme/account.key
 
 cat >~lacme-account/.config/lacme/lacme-accountd.conf <<-EOF
-	privkey = file:/home/lacme-account/.config/lacme/account.key
+	privkey = file:%E/lacme/account.key
 EOF
 
 # non-existent parent directory
@@ -33,9 +38,13 @@ EOF
 grepstderr -Fxq "stat(/nonexistent): No such file or directory"
 
 # word-writable parent directory
-! runuser -u lacme-account -- lacme-accountd --socket="/tmp/S.lacme" account 2>"$STDERR" || fail
+! runuser -u lacme-account -- lacme-accountd --socket="%T/S.lacme" account 2>"$STDERR" || fail
 grepstderr -Fxq "Error: insecure permissions on /tmp"
 
+# unset XDG_RUNTIME_DIR
+! runuser -u lacme-account -- lacme-accountd 2>"$STDERR" || fail
+grepstderr "Error: undefined expansion %t in \"%t/S.lacme\""
+
 # non-existent $XDG_RUNTIME_DIR
 ! runuser -u lacme-account -- env XDG_RUNTIME_DIR="/nonexistent" lacme-accountd 2>"$STDERR" || fail
 grepstderr -Fxq "stat(/nonexistent): No such file or directory"
diff --git a/tests/spec-expansion b/tests/spec-expansion
new file mode 100644
index 0000000..722bdfc
--- /dev/null
+++ b/tests/spec-expansion
@@ -0,0 +1,130 @@
+# %-specifiers expansion
+
+# lacme --config=, all specifiers, root privileges
+! lacme --config="%C %E %t %h %T %g %G %u %U %%.conf" account 2>"$STDERR" || fail
+grepstderr -Fxq "Can't open /var/cache /etc /run /root /tmp root 0 root 0 %.conf: No such file or directory"
+
+# lacme --config=, all specifiers, root privileges, defined XDG_*
+! env XDG_CACHE_HOME=/foo/cache XDG_CONFIG_HOME=/foo/config XDG_RUNTIME_DIR=/foo/run HOME=/foo/home USER=myuser TMPDIR=/foo/tmp \
+    lacme --config="%C %E %t %h %T %g %G %u %U %%.conf" account 2>"$STDERR" || fail
+grepstderr -Fxq "Can't open /var/cache /etc /run /root /foo/tmp root 0 root 0 %.conf: No such file or directory"
+
+# lacme --config=, all specifiers, non-root, unset XDG_RUNTIME_DIR
+! runuser -u nobody -- lacme --config="%C %E %t %h %T %g %G %u %U %%.conf" account 2>"$STDERR" || fail
+grepstderr -Fxq "Error: undefined expansion %t in \"%C %E %t %h %T %g %G %u %U %%.conf\""
+
+# lacme --config=, all specifiers, non-root, defined XDG_RUNTIME_DIR, no other XDG_*
+! runuser -u nobody -g www-data -- env XDG_RUNTIME_DIR=/foo/run \
+    lacme --config="%C %E %t %h %T %g %G %u %U %%.conf" account 2>"$STDERR" || fail
+grepstderr -Fxq "Can't open /nonexistent/.cache /nonexistent/.config /foo/run /nonexistent /tmp www-data 33 nobody 65534 %.conf: No such file or directory"
+
+# lacme --config=, all specifiers, non-root, defined XDG_*
+! runuser -u nobody -- env XDG_CACHE_HOME=/foo/cache XDG_CONFIG_HOME=/foo/config XDG_RUNTIME_DIR=/foo/run HOME=/foo/home USER=myuser TMPDIR=/foo/tmp \
+    lacme --config="%C %E %t %h %T %g %G %u %U %%.conf" account 2>"$STDERR" || fail
+grepstderr -Fxq "Can't open /foo/cache /foo/config /foo/run /nonexistent /foo/tmp nogroup 65534 nobody 65534 %.conf: No such file or directory"
+
+# lacme --socket=
+! lacme --config="%E/lacme/lacme.conf" --socket="%t/S.lacme2" account --debug 2>"$STDERR" || fail
+grepstderr -Fxq "Using configuration file: /etc/lacme/lacme.conf"
+grepstderr -Fxq "Can't stat /run/S.lacme2: No such file or directory (Is lacme-accountd running?)"
+
+# 'challenge-directory' setting (expands before privilege drop)
+sed -ri 's|^#?challenge-directory\s*=.*|challenge-directory = /nonexistent/%u:%g|' /etc/lacme/lacme.conf
+! lacme newOrder --debug 2>"$STDERR" || fail
+grepstderr -Fq "Using existing webserver on /nonexistent/root:root"
+
+# lacme --config-certs= and 'config-certs' settings (expands before privilege drop)
+! lacme newOrder --debug nonexistent 2>"$STDERR" || fail
+grepstderr -Fxq "Reading /etc/lacme/lacme-certs.conf"
+
+sed -ri 's|^#?config-certs\s*=.*|config-certs = /nonexistent/%u:%g.conf|' /etc/lacme/lacme.conf
+! lacme newOrder --debug nonexistent 2>"$STDERR" || fail
+grepstderr -Fxq "Reading /nonexistent/root:root.conf"
+
+! lacme newOrder --config-certs="%E/lacme/certs.conf.d" --debug nonexistent 2>"$STDERR" || fail
+grepstderr -vFxq "Reading /etc/lacme/lacme-certs.conf"
+grepstderr -Fxq "Reading /etc/lacme/certs.conf.d"
+
+# 'config' setting in [accountd] section (expands after privilege drop)
+sed -ri 's|^#?config\s*=\s*$|config = /nonexistent/%u:%g.conf|' /etc/lacme/lacme.conf
+! lacme account 2>"$STDERR" || fail
+grepstderr -Fxq "Failed to open file '/nonexistent/root:root.conf' for reading: No such file or directory"
+
+sed -ri 's|^#?user\s*=\s*$|user = nobody|' /etc/lacme/lacme.conf
+! lacme account 2>"$STDERR" || fail
+grepstderr -Fxq "Failed to open file '/nonexistent/nobody:root.conf' for reading: No such file or directory"
+
+# 'command' setting in [accountd] section (expands after privilege drop)
+sed -ri 's|^#?command\s*=.*/lacme-accountd$|command = /usr/bin/lacme-accountd --%u|' /etc/lacme/lacme.conf
+! lacme account 2>"$STDERR" || fail
+grepstderr -Fxq "Unknown option: nobody"
+
+sed -ri 's|^#?command\s*=.*/lacme-accountd .*|command = /nonexistent/%u/%g %u %g|' /etc/lacme/lacme.conf
+! lacme account 2>"$STDERR" || fail
+grepstderr -Eq "^Can't exec \"/nonexistent/nobody/root\": No such file or directory"
+
+
+#######################################################################
+
+# lacme-accountd --config=, all specifiers, root privileges
+! lacme-accountd --config="%C %E %t %h %T %g %G %u %U %%.conf" 2>"$STDERR" || fail
+grepstderr -Fxq "Failed to open file '/var/cache /etc /run /root /tmp root 0 root 0 %.conf' for reading: No such file or directory"
+
+# lacme-accountd --config=, all specifiers, root privileges, defined XDG_*
+! env XDG_CACHE_HOME=/foo/cache XDG_CONFIG_HOME=/foo/config XDG_RUNTIME_DIR=/foo/run HOME=/foo/home USER=myuser TMPDIR=/foo/tmp \
+    lacme-accountd --config="%C %E %t %h %T %g %G %u %U %%.conf" 2>"$STDERR" || fail
+grepstderr -Fxq "Failed to open file '/var/cache /etc /run /root /foo/tmp root 0 root 0 %.conf' for reading: No such file or directory"
+
+# lacme-accountd --config=, all specifiers, non-root, unset XDG_RUNTIME_DIR
+! runuser -u nobody -- lacme-accountd --config="%C %E %t %h %T %g %G %u %U %%.conf" account 2>"$STDERR" || fail
+grepstderr -Fxq "Error: undefined expansion %t in \"%C %E %t %h %T %g %G %u %U %%.conf\""
+
+# lacme-accountd --config=, all specifiers, non-root, defined XDG_RUNTIME_DIR, no other XDG_*
+! runuser -u nobody -g www-data -- env XDG_RUNTIME_DIR=/foo/run \
+    lacme-accountd --config="%C %E %t %h %T %g %G %u %U %%.conf" 2>"$STDERR" || fail
+grepstderr -Fxq "Failed to open file '/nonexistent/.cache /nonexistent/.config /foo/run /nonexistent /tmp www-data 33 nobody 65534 %.conf' for reading: No such file or directory"
+
+# lacme-accountd --config=, all specifiers, non-root, defined XDG_*
+! runuser -u nobody -- env XDG_CACHE_HOME=/foo/cache XDG_CONFIG_HOME=/foo/config XDG_RUNTIME_DIR=/foo/run HOME=/foo/home USER=myuser TMPDIR=/foo/tmp \
+    lacme-accountd --config="%C %E %t %h %T %g %G %u %U %%.conf" 2>"$STDERR" || fail
+grepstderr -Fxq "Failed to open file '/foo/cache /foo/config /foo/run /nonexistent /foo/tmp nogroup 65534 nobody 65534 %.conf' for reading: No such file or directory"
+
+# lacme-accountd --privkey=
+! lacme-accountd --privkey="file:%h/lacme-accountd.key" --debug 2>"$STDERR" || fail
+grepstderr -Fxq "Error: Can't open /root/lacme-accountd.key: No such file or directory"
+
+# lacme-accountd, default socket location
+lacme-accountd --debug 2>"$STDERR" & PID=$!
+sleep 1
+kill $PID || fail
+wait || fail
+grepstderr -Fxq "Using configuration file: /etc/lacme/lacme-accountd.conf"
+grepstderr -Fxq "Starting lacme Account Key Manager at /run/S.lacme"
+grepstderr -Fxq "Unlinking /run/S.lacme"
+
+# lacme-accountd --config= --socket= --privkey=
+ln -s lacme-accountd.conf /etc/lacme/accountd.conf
+lacme-accountd --config="%E/lacme/accountd.conf" --socket="%t/S.lacme2" --privkey="file:%E/lacme/account.key" --debug 2>"$STDERR" & PID=$!
+sleep 1
+kill $PID || fail
+wait || fail
+grepstderr -Fxq "Using configuration file: /etc/lacme/accountd.conf"
+grepstderr -Fxq "Starting lacme Account Key Manager at /run/S.lacme2"
+grepstderr -Fxq "Unlinking /run/S.lacme2"
+
+# lacme-accountd, custom 'socket' setting
+sed -ri 's|^#?socket\s*=.*|socket = %t/S.lacme3|' /etc/lacme/lacme-accountd.conf
+lacme-accountd --debug 2>"$STDERR" & PID=$!
+sleep 1
+kill $PID || fail
+wait || fail
+grepstderr -Fxq "Using configuration file: /etc/lacme/lacme-accountd.conf"
+grepstderr -Fxq "Starting lacme Account Key Manager at /run/S.lacme3"
+grepstderr -Fxq "Unlinking /run/S.lacme3"
+
+# lacme-accountd, custom 'privkey' setting
+sed -ri 's|^privkey\s*=.*|privkey = file:%h/lacme-accountd.key|' /etc/lacme/lacme-accountd.conf
+! lacme-accountd --debug 2>"$STDERR" || fail
+grepstderr -Fxq "Error: Can't open /root/lacme-accountd.key: No such file or directory"
+
+# vim: set filetype=sh :
-- 
cgit v1.2.3


From 74c0a11722cf1e01b9a9834e89a07b55eaf01080 Mon Sep 17 00:00:00 2001
From: Guilhem Moulin <guilhem@fripost.org>
Date: Sat, 20 Feb 2021 22:05:18 +0100
Subject: lacme-accountd: new setting 'logfile' to log signature requests.

Prefixed with a timestamp.
---
 Changelog             |   2 +
 lacme                 |   6 +--
 lacme-accountd        | 110 +++++++++++++++++++++++++++++++-------------------
 lacme-accountd.1.md   |   9 ++++-
 lacme.8.md            |   2 +-
 tests/accountd        |  27 +++++++++----
 tests/accountd-remote |  11 +++--
 tests/spec-expansion  |  12 +++---
 8 files changed, 116 insertions(+), 63 deletions(-)

(limited to 'tests/accountd')

diff --git a/Changelog b/Changelog
index c69d0d0..e6becda 100644
--- a/Changelog
+++ b/Changelog
@@ -50,6 +50,8 @@ lacme (0.7.1) upstream;
    and --privkey= (and 'socket'/'privkey' configuration options).
  * lacme-accountd(1): base64url-decode incoming signature requests shown
    in messages to the standard error.
+ * lacme-accountd(1): new setting 'logfile' to log (decoded) incoming
+   signature requests to a file.
  + Improve nginx/apache2 snippets for direct serving of challenge files
    (with the new 'challenge-directory' logic symlinks can be disabled).
  + Split Nginx and Apapche2 static configuration snippets into seperate
diff --git a/lacme b/lacme
index ad7e1d8..88ab78d 100755
--- a/lacme
+++ b/lacme
@@ -558,12 +558,12 @@ sub acme_client($@) {
 
         # ensure we're the only user with write access to the parent dir
         my $dirname = dirname($sockname);
-        @stat = stat($dirname) or die "stat($dirname): $!\n";
-        die "Error: insecure permissions on $dirname\n" if ($stat[2] & 0022) != 0;
+        @stat = stat($dirname) or die "Error: stat($dirname): $!\n";
+        die "Error: Insecure permissions on $dirname\n" if ($stat[2] & 0022) != 0;
 
         # ensure we're the only user with read/write access to the socket
         @stat = stat($sockname) or die "Can't stat $sockname: $! (Is lacme-accountd running?)\n";
-        die "Error: insecure permissions on $sockname\n" if ($stat[2] & 0066) != 0;
+        die "Error: Insecure permissions on $sockname\n" if ($stat[2] & 0066) != 0;
 
         # connect(2) to the socket
         socket($client, PF_UNIX, SOCK_STREAM, 0) or die "socket: $!";
diff --git a/lacme-accountd b/lacme-accountd
index 0adfe38..c8c6d5e 100755
--- a/lacme-accountd
+++ b/lacme-accountd
@@ -63,6 +63,30 @@ sub usage(;$$) {
 usage(1) unless GetOptions(\%OPTS, qw/config=s privkey=s socket=s stdio quiet|q debug help|h/);
 usage(0) if $OPTS{help};
 
+my $LOG;
+sub logmsg($@) {
+    my $lvl = shift // "all";
+    if (defined $LOG) {
+        my $now = localtime;
+        $LOG->printflush("[", $now, "] ", @_, "\n") or warn "print: $!";
+    }
+    unless (($lvl eq "debug" and !$OPTS{debug}) or ($lvl eq "noquiet" and $OPTS{quiet})) {
+        print STDERR @_, "\n" or warn "print: $!";
+    }
+}
+sub info(@) { logmsg(all => @_); }
+sub error(@) {
+    my @msg = ("Error: ", @_);
+    info(@msg);
+    die(@msg, "\n");
+}
+sub panic(@) {
+    my @loc = caller;
+    my @msg = (@_, " at line $loc[2] in $loc[1]");
+    info(@msg);
+    die(@msg, "\n");
+}
+
 sub env_fallback($$) {
     my $v = $ENV{ shift() };
     return (defined $v and $v ne "") ? $v : shift;
@@ -80,8 +104,8 @@ sub spec_expand($) {
         : $1 eq "t" ? ($< == 0 ? "@@runstatedir@@" : $ENV{XDG_RUNTIME_DIR})
         : $1 eq "T" ? env_fallback(TMPDIR => "/tmp")
         : $1 eq "%" ? "%"
-        : die "Error: \"$str\" has unknown specifier %$1\n";
-        die "Error: undefined expansion %$1 in \"$str\"\n" unless defined $x;
+        : error("\"$str\" has unknown specifier %$1");
+        error("undefined expansion %$1 in \"$str\"") unless defined $x;
         $x;
     #ge;
     return $str;
@@ -92,11 +116,16 @@ do {
 
     if (defined $OPTS{config} or -e $conffile) {
         print STDERR "Using configuration file: $conffile\n" if $OPTS{debug};
-        my $h = Config::Tiny::->read($conffile) or die Config::Tiny::->errstr()."\n";
+        my $h = Config::Tiny::->read($conffile) or error(Config::Tiny::->errstr());
         my $h2 = delete $h->{_} // {};
-        die "Invalid section(s): ".join(', ', keys %$h)."\n" if %$h;
-        my %h = map { $_ => delete $h2->{$_} } qw/privkey gpg socket quiet/;
-        die "Unknown option(s): ".join(', ', keys %$h2)."\n" if %$h2;
+        if (defined (my $logfile = $h2->{logfile})) {
+            $logfile = spec_expand($logfile);
+            die "Invalid log file name\n" unless $logfile =~ /\A(\p{Print}+)\z/; # untaint
+            open $LOG, ">>", $1 or die "Can't open $1: $!";
+        }
+        error("Invalid section(s): ".join(', ', keys %$h)) if %$h;
+        my %h = map { $_ => delete $h2->{$_} } qw/privkey gpg socket logfile quiet/;
+        error("Unknown option(s): ".join(', ', keys %$h2)) if %$h2;
         $h{quiet} = lc $h{quiet} eq 'yes' ? 1 : 0 if defined $h{quiet};
         $OPTS{$_} //= $h{$_} foreach grep {defined $h{$_}} keys %h;
     } else {
@@ -104,7 +133,7 @@ do {
     }
 
     $OPTS{quiet} = 0 if $OPTS{debug};
-    die "Error: 'privkey' is not specified\n" unless defined $OPTS{privkey};
+    error("'privkey' is not specified") unless defined $OPTS{privkey};
 };
 
 
@@ -118,27 +147,27 @@ if ($OPTS{privkey} =~ /\A(file|gpg):(\p{Print}+)\z/) {
     my ($fh, @command);
     if ($method eq 'file') {
         # generate with `openssl genpkey -algorithm RSA`
-        open $fh, '<', $filename or die "Error: Can't open $filename: $!\n";
+        open $fh, '<', $filename or error("Can't open $filename: $!");
     }
     elsif ($method eq 'gpg') {
         @command = split /\s+/, ($OPTS{gpg} // 'gpg --quiet');
-        open $fh, '-|', @command, qw/-o - --decrypt --/, $filename or die "fork: $!";
+        open $fh, '-|', @command, qw/-o - --decrypt --/, $filename or panic("fork: $!");
     }
     else {
-        die; # impossible
+        panic(); # impossible
     }
 
     my $str = do {local $/ = undef; <$fh>};
-    close $fh or die $! ?
-        "close: $!" :
-        "Error: $command[0] exited with value ".($? >> 8)."\n";
+    close $fh or ($! or !@command) ?
+        panic("close: $!") :
+        error("$command[0] exited with value ".($? >> 8));
 
     require 'Crypt/OpenSSL/RSA.pm';
     my $rsa = Crypt::OpenSSL::RSA->new_private_key($str);
     undef $str;
 
-    die "Error: $filename: Not a private key\n" unless $rsa->is_private();
-    die "Error: $filename: Invalid key\n"       unless $rsa->check_key();
+    error("$filename: Not a private key") unless $rsa->is_private();
+    error("$filename: Invalid key")       unless $rsa->check_key();
     $rsa->use_sha256_hash();
 
     require 'Crypt/OpenSSL/Bignum.pm';
@@ -149,7 +178,7 @@ if ($OPTS{privkey} =~ /\A(file|gpg):(\p{Print}+)\z/) {
     $SIGN = sub($) { $rsa->sign($_[0]) };
 }
 else {
-    die "Error: unsupported method: $OPTS{privkey}\n";
+    error("unsupported method: $OPTS{privkey}");
 }
 my $JWK_STR = JSON::->new->encode($JWK);
 
@@ -163,24 +192,24 @@ my $JWK_STR = JSON::->new->encode($JWK);
 #
 unless (defined $OPTS{stdio}) {
     my $sockname = spec_expand($OPTS{socket} // '%t/S.lacme');
-    $sockname = $sockname =~ /\A(\p{Print}+)\z/ ? $1 : die "Invalid socket name\n"; # untaint $sockname
+    $sockname = $sockname =~ /\A(\p{Print}+)\z/ ? $1 : error("Invalid socket name"); # untaint
 
     # ensure we're the only user with write access to the parent dir
     my $dirname = dirname($sockname);
-    my @stat = stat($dirname) or die "stat($dirname): $!\n";
-    die "Error: insecure permissions on $dirname\n" if ($stat[2] & 0022) != 0;
+    my @stat = stat($dirname) or error("stat($dirname): $!");
+    error("Insecure permissions on $dirname") if ($stat[2] & 0022) != 0;
 
-    my $umask = umask(0177) // die "umask: $!";
+    my $umask = umask(0177) // panic("umask: $!");
 
-    print STDERR "Starting lacme Account Key Manager at $sockname\n" unless $OPTS{quiet};
-    socket(my $sock, PF_UNIX, SOCK_STREAM, 0) or die "socket: $!";
-    my $sockaddr = Socket::sockaddr_un($sockname) // die;
-    bind($sock, $sockaddr) or die "bind: $!";
+    logmsg(noquiet => "Starting lacme Account Key Manager at $sockname");
+    socket(my $sock, PF_UNIX, SOCK_STREAM, 0) or panic("socket: $!");
+    my $sockaddr = Socket::sockaddr_un($sockname) // panic();
+    bind($sock, $sockaddr) or panic("bind: $!");
 
     ($SOCKNAME, $S) = ($sockname, $sock);
-    listen($S, 1) or die "listen: $!";
+    listen($S, 1) or panic("listen: $!");
 
-    umask($umask) // die "umask: $!";
+    umask($umask) // panic("umask: $!");
 };
 
 
@@ -194,23 +223,22 @@ sub conn($$;$) {
 
     # sign whatever comes in
     while (defined (my $data = $in->getline())) {
-        $data =~ s/\r\n\z// or die;
+        $data =~ s/\r\n\z// or panic();
 
         my ($protected, $payload) = split(/\./, $data, 2);
         unless (defined $protected and $protected =~ /\A[A-Za-z0-9\-_]+\z/) {
-            print STDERR "[$id] >>> Error: Malformed protected data, refusing to sign!\n";
+            info("[$id] >>> Error: Malformed protected data, refusing to sign!");
             last;
         }
         unless (defined $payload and $payload =~ /\A[A-Za-z0-9\-_]*\z/) {
             # payload can be empty, for instance for POST-as-GET
-            print STDERR "[$id] >>> Error: Malformed payload data, refusing to sign!\n";
+            info("[$id] >>> Error: Malformed payload data, refusing to sign!");
             last;
         }
 
-        print STDERR "[$id] >>> Incoming signature request for ",
-            "base64url(", decode_base64url($protected), ") . ",
-            "base64url(", decode_base64url($payload), ")"
-            unless $OPTS{quiet};
+        logmsg(noquiet => "[$id] >>> Incoming signature request for ",
+               "base64url(", decode_base64url($protected), ") . ",
+               "base64url(", decode_base64url($payload), ")");
 
         my $sig = $SIGN->($data);
         $out->printflush( encode_base64url($sig), "\r\n" ) or warn "print: $!";
@@ -224,11 +252,11 @@ if (defined $OPTS{stdio}) {
     for (my $count = 0;; $count++) {
         accept(my $conn, $S) or do {
             next if $! == EINTR; # try again if accept(2) was interrupted by a signal
-            die "accept: $!";
+            panic("accept: $!");
         };
-        print STDERR "[$count] >>> Accepted new connection\n" unless $OPTS{quiet};
+        logmsg(noquiet => "[$count] >>> Accepted new connection");
         conn($conn, $conn, $count);
-        print STDERR "[$count] >>> Connection terminated\n" unless $OPTS{quiet};
+        logmsg(noquiet => "[$count] >>> Connection terminated");
         $conn->close() or warn "close: $!";
     }
 }
@@ -238,12 +266,12 @@ if (defined $OPTS{stdio}) {
 #
 END {
     if (defined $SOCKNAME and -S $SOCKNAME) {
-        print STDERR "Unlinking $SOCKNAME\n" if $OPTS{debug};
-        unlink $SOCKNAME or print STDERR "Couldn't unlink $SOCKNAME: $!\n";
+        logmsg(debug => "Unlinking $SOCKNAME");
+        unlink $SOCKNAME or info("Error: unlink($SOCKNAME): $!");
     }
     if (defined $S) {
-        print STDERR "Shutting down and closing lacme Account Key Manager\n" unless $OPTS{quiet};
-        shutdown($S, SHUT_RDWR) or warn "shutdown: $!";
-        close $S or print STDERR "close: $!\n";
+        logmsg(noquiet => "Shutting down and closing lacme Account Key Manager");
+        shutdown($S, SHUT_RDWR) or info("Error: shutdown: $!");
+        close $S or info("Error: close: $!");
     }
 }
diff --git a/lacme-accountd.1.md b/lacme-accountd.1.md
index 476a150..66ef222 100644
--- a/lacme-accountd.1.md
+++ b/lacme-accountd.1.md
@@ -119,6 +119,11 @@ leading `--`) in the configuration file.  Valid settings are:
     [`gpg`(1)] to use, as well as some default options.
     Default: `gpg --quiet`.
 
+*logfile*
+
+:   An optional file where to log to.  The value is subject to
+    [%-specifier expansion](#percent-specifiers).
+
 *socket*
 
 :   See `--socket=`.
@@ -131,8 +136,8 @@ leading `--`) in the configuration file.  Valid settings are:
 ============
 
 The value the `--config=`, `--privkey=` and `--socket=` CLI options (and
-*privkey* and *socket* configuration options) are subject to %-expansion
-for the following specifiers.
+*privkey*, *socket* and *logfile* settings in the configuration file)
+are subject to %-expansion for the following specifiers.
 
 ----  ------------------------------------------------------------------
 `%C`  `@@localstatedir@@/cache` for the root user, and `$XDG_CACHE_HOME`
diff --git a/lacme.8.md b/lacme.8.md
index ca47470..7d66e79 100644
--- a/lacme.8.md
+++ b/lacme.8.md
@@ -497,7 +497,7 @@ remote [`lacme-accountd`(1)] and use it to sign [ACME] requests.
 Further hardening can be achieved by means of [`authorized_keys`(5)]
 restrictions:
 
-    restrict,from="…",command="/usr/bin/lacme-accountd --stdio" ssh-rsa …
+    restrict,from="…",command="/usr/bin/lacme-accountd --quiet --stdio" ssh-rsa …
 
 See also
 ========
diff --git a/tests/accountd b/tests/accountd
index 4626c78..2798465 100644
--- a/tests/accountd
+++ b/tests/accountd
@@ -7,11 +7,11 @@ adduser --disabled-password \
 
 # non-existent parent directory
 ! lacme --socket="/nonexistent/S.lacme" account 2>"$STDERR" || fail
-grepstderr -Fxq "stat(/nonexistent): No such file or directory"
+grepstderr -Fxq "Error: stat(/nonexistent): No such file or directory"
 
 # word-writable parent directory
 ! lacme --socket="/tmp/S.lacme" account 2>"$STDERR" || fail
-grepstderr -Fxq "Error: insecure permissions on /tmp"
+grepstderr -Fxq "Error: Insecure permissions on /tmp"
 
 # missing socket
 SOCKET=~lacme-account/S.lacme
@@ -25,21 +25,23 @@ grepstderr -Fxq "Can't stat $SOCKET: No such file or directory (Is lacme-account
 grepstderr -Fxq "Ignoring missing configuration file at default location /home/lacme-account/.config/lacme/lacme-accountd.conf"
 grepstderr -Fxq "Error: 'privkey' is not specified"
 
-install -olacme-account -glacme-account -Ddm0700 ~lacme-account/.config/lacme
+install -olacme-account -glacme-account -Ddm0700 -- \
+    ~lacme-account/.config/lacme ~lacme-account/.local/share/lacme
 mv -t ~lacme-account/.config/lacme /etc/lacme/account.key
 chown lacme-account: ~lacme-account/.config/lacme/account.key
 
 cat >~lacme-account/.config/lacme/lacme-accountd.conf <<-EOF
 	privkey = file:%E/lacme/account.key
+	logfile = %h/.local/share/lacme/accountd.log
 EOF
 
 # non-existent parent directory
 ! runuser -u lacme-account -- lacme-accountd --socket="/nonexistent/S.lacme" 2>"$STDERR" || fail
-grepstderr -Fxq "stat(/nonexistent): No such file or directory"
+grepstderr -Fxq "Error: stat(/nonexistent): No such file or directory"
 
 # word-writable parent directory
 ! runuser -u lacme-account -- lacme-accountd --socket="%T/S.lacme" account 2>"$STDERR" || fail
-grepstderr -Fxq "Error: insecure permissions on /tmp"
+grepstderr -Fxq "Error: Insecure permissions on /tmp"
 
 # unset XDG_RUNTIME_DIR
 ! runuser -u lacme-account -- lacme-accountd 2>"$STDERR" || fail
@@ -47,7 +49,7 @@ grepstderr "Error: undefined expansion %t in \"%t/S.lacme\""
 
 # non-existent $XDG_RUNTIME_DIR
 ! runuser -u lacme-account -- env XDG_RUNTIME_DIR="/nonexistent" lacme-accountd 2>"$STDERR" || fail
-grepstderr -Fxq "stat(/nonexistent): No such file or directory"
+grepstderr -Fxq "Error: stat(/nonexistent): No such file or directory"
 
 # test running accountd
 runuser -u lacme-account -- env XDG_RUNTIME_DIR=/home/lacme-account lacme-accountd --debug 2>"$STDERR" & PID=$!
@@ -57,7 +59,11 @@ wait || fail
 grepstderr -Fxq "Using configuration file: /home/lacme-account/.config/lacme/lacme-accountd.conf"
 grepstderr -Fxq "Starting lacme Account Key Manager at /home/lacme-account/S.lacme"
 
-# spawn accountd
+# make sure errors are logged too
+grep -F "Error: " ~lacme-account/.local/share/lacme/accountd.log
+
+# rotate the log and start accountd
+rm -f ~lacme-account/.local/share/lacme/accountd.log
 runuser -u lacme-account -- lacme-accountd --socket="$SOCKET" --quiet & PID=$!
 
 # run lacme(8) multiple times using that single lacme-accountd(1) instance
@@ -70,4 +76,11 @@ kill $PID
 wait
 ! test -e "$SOCKET"
 
+# ensure signature requests are logged
+grep -Fq "Starting lacme Account Key Manager at /home/lacme-account/S.lacme" ~lacme-account/.local/share/lacme/accountd.log
+grep -Fq "[0] >>> Accepted new connection" ~lacme-account/.local/share/lacme/accountd.log
+grep -Fq "[1] >>> Accepted new connection" ~lacme-account/.local/share/lacme/accountd.log
+grep -Fq "Shutting down and closing lacme Account Key Manager" ~lacme-account/.local/share/lacme/accountd.log
+grep -F ">>> Incoming signature request for " ~lacme-account/.local/share/lacme/accountd.log
+
 # vim: set filetype=sh :
diff --git a/tests/accountd-remote b/tests/accountd-remote
index bd5d99f..05850c2 100644
--- a/tests/accountd-remote
+++ b/tests/accountd-remote
@@ -31,20 +31,25 @@ lacme newOrder --debug 2>"$STDERR" || fail # intentionally use --debug, ssh shou
 test /etc/lacme/simpletest.rsa.crt -nt /etc/lacme/simpletest.rsa.key
 
 # and now with an authorized_keys(5) restriction
-sed -ri "s|^[^#]|restrict,from=\"127.0.0.1\",command=\"/usr/bin/lacme-accountd --stdio\" &|" ~lacme-account/.ssh/authorized_keys
+sed -ri "s|^[^#]|restrict,from=\"127.0.0.1\",command=\"/usr/bin/lacme-accountd --quiet --stdio\" &|" ~lacme-account/.ssh/authorized_keys
 rm -vf /etc/lacme/simpletest.rsa.crt
 
 ! lacme newOrder 2>"$STDERR" || fail # --config= (and --debug) should be ignored
 grepstderr -Fxq "Error: 'privkey' is not specified"
 grepstderr -Fxq "[simpletest-rsa] Error: Couldn't issue X.509 certificate!"
 
-install -olacme-account -glacme-account -Ddm0700 ~lacme-account/.config/lacme
+install -olacme-account -glacme-account -Ddm0700 -- \
+    ~lacme-account/.config/lacme ~lacme-account/.local/share/lacme
 mv -t ~lacme-account/.config/lacme /etc/lacme/account.key
 cat >~lacme-account/.config/lacme/lacme-accountd.conf <<-EOF
 	privkey = file:%E/lacme/account.key
+	logfile = %h/.local/share/lacme/accountd.log
 EOF
 
-lacme newOrder || fail
+lacme newOrder
 test /etc/lacme/simpletest.rsa.crt -nt /etc/lacme/simpletest.rsa.key
 
+# ensure signature requests are logged
+grep -F ">>> Incoming signature request for " ~lacme-account/.local/share/lacme/accountd.log
+
 # vim: set filetype=sh :
diff --git a/tests/spec-expansion b/tests/spec-expansion
index 722bdfc..273fa51 100644
--- a/tests/spec-expansion
+++ b/tests/spec-expansion
@@ -48,11 +48,11 @@ grepstderr -Fxq "Reading /etc/lacme/certs.conf.d"
 # 'config' setting in [accountd] section (expands after privilege drop)
 sed -ri 's|^#?config\s*=\s*$|config = /nonexistent/%u:%g.conf|' /etc/lacme/lacme.conf
 ! lacme account 2>"$STDERR" || fail
-grepstderr -Fxq "Failed to open file '/nonexistent/root:root.conf' for reading: No such file or directory"
+grepstderr -Fxq "Error: Failed to open file '/nonexistent/root:root.conf' for reading: No such file or directory"
 
 sed -ri 's|^#?user\s*=\s*$|user = nobody|' /etc/lacme/lacme.conf
 ! lacme account 2>"$STDERR" || fail
-grepstderr -Fxq "Failed to open file '/nonexistent/nobody:root.conf' for reading: No such file or directory"
+grepstderr -Fxq "Error: Failed to open file '/nonexistent/nobody:root.conf' for reading: No such file or directory"
 
 # 'command' setting in [accountd] section (expands after privilege drop)
 sed -ri 's|^#?command\s*=.*/lacme-accountd$|command = /usr/bin/lacme-accountd --%u|' /etc/lacme/lacme.conf
@@ -68,12 +68,12 @@ grepstderr -Eq "^Can't exec \"/nonexistent/nobody/root\": No such file or direct
 
 # lacme-accountd --config=, all specifiers, root privileges
 ! lacme-accountd --config="%C %E %t %h %T %g %G %u %U %%.conf" 2>"$STDERR" || fail
-grepstderr -Fxq "Failed to open file '/var/cache /etc /run /root /tmp root 0 root 0 %.conf' for reading: No such file or directory"
+grepstderr -Fxq "Error: Failed to open file '/var/cache /etc /run /root /tmp root 0 root 0 %.conf' for reading: No such file or directory"
 
 # lacme-accountd --config=, all specifiers, root privileges, defined XDG_*
 ! env XDG_CACHE_HOME=/foo/cache XDG_CONFIG_HOME=/foo/config XDG_RUNTIME_DIR=/foo/run HOME=/foo/home USER=myuser TMPDIR=/foo/tmp \
     lacme-accountd --config="%C %E %t %h %T %g %G %u %U %%.conf" 2>"$STDERR" || fail
-grepstderr -Fxq "Failed to open file '/var/cache /etc /run /root /foo/tmp root 0 root 0 %.conf' for reading: No such file or directory"
+grepstderr -Fxq "Error: Failed to open file '/var/cache /etc /run /root /foo/tmp root 0 root 0 %.conf' for reading: No such file or directory"
 
 # lacme-accountd --config=, all specifiers, non-root, unset XDG_RUNTIME_DIR
 ! runuser -u nobody -- lacme-accountd --config="%C %E %t %h %T %g %G %u %U %%.conf" account 2>"$STDERR" || fail
@@ -82,12 +82,12 @@ grepstderr -Fxq "Error: undefined expansion %t in \"%C %E %t %h %T %g %G %u %U %
 # lacme-accountd --config=, all specifiers, non-root, defined XDG_RUNTIME_DIR, no other XDG_*
 ! runuser -u nobody -g www-data -- env XDG_RUNTIME_DIR=/foo/run \
     lacme-accountd --config="%C %E %t %h %T %g %G %u %U %%.conf" 2>"$STDERR" || fail
-grepstderr -Fxq "Failed to open file '/nonexistent/.cache /nonexistent/.config /foo/run /nonexistent /tmp www-data 33 nobody 65534 %.conf' for reading: No such file or directory"
+grepstderr -Fxq "Error: Failed to open file '/nonexistent/.cache /nonexistent/.config /foo/run /nonexistent /tmp www-data 33 nobody 65534 %.conf' for reading: No such file or directory"
 
 # lacme-accountd --config=, all specifiers, non-root, defined XDG_*
 ! runuser -u nobody -- env XDG_CACHE_HOME=/foo/cache XDG_CONFIG_HOME=/foo/config XDG_RUNTIME_DIR=/foo/run HOME=/foo/home USER=myuser TMPDIR=/foo/tmp \
     lacme-accountd --config="%C %E %t %h %T %g %G %u %U %%.conf" 2>"$STDERR" || fail
-grepstderr -Fxq "Failed to open file '/foo/cache /foo/config /foo/run /nonexistent /foo/tmp nogroup 65534 nobody 65534 %.conf' for reading: No such file or directory"
+grepstderr -Fxq "Error: Failed to open file '/foo/cache /foo/config /foo/run /nonexistent /foo/tmp nogroup 65534 nobody 65534 %.conf' for reading: No such file or directory"
 
 # lacme-accountd --privkey=
 ! lacme-accountd --privkey="file:%h/lacme-accountd.key" --debug 2>"$STDERR" || fail
-- 
cgit v1.2.3


From d56b957dbae6c8214d50ce88d0ea04eb4654b843 Mon Sep 17 00:00:00 2001
From: Guilhem Moulin <guilhem@fripost.org>
Date: Sun, 21 Feb 2021 17:34:51 +0100
Subject: wording

---
 lacme                | 2 +-
 lacme-accountd       | 4 ++--
 lacme.8.md           | 2 +-
 tests/accountd       | 2 +-
 tests/spec-expansion | 4 ++--
 5 files changed, 7 insertions(+), 7 deletions(-)

(limited to 'tests/accountd')

diff --git a/lacme b/lacme
index 88ab78d..1e51c6c 100755
--- a/lacme
+++ b/lacme
@@ -93,7 +93,7 @@ sub spec_expand($) {
         : $1 eq "T" ? env_fallback(TMPDIR => "/tmp")
         : $1 eq "%" ? "%"
         : die "Error: \"$str\" has unknown specifier %$1\n";
-        die "Error: undefined expansion %$1 in \"$str\"\n" unless defined $x;
+        die "Error: Undefined expansion %$1 in \"$str\"\n" unless defined $x;
         $x;
     #ge;
     return $str;
diff --git a/lacme-accountd b/lacme-accountd
index 6a6e90d..0f0b0d9 100755
--- a/lacme-accountd
+++ b/lacme-accountd
@@ -105,7 +105,7 @@ sub spec_expand($) {
         : $1 eq "T" ? env_fallback(TMPDIR => "/tmp")
         : $1 eq "%" ? "%"
         : error("\"$str\" has unknown specifier %$1");
-        error("undefined expansion %$1 in \"$str\"") unless defined $x;
+        error("Undefined expansion %$1 in \"$str\"") unless defined $x;
         $x;
     #ge;
     return $str;
@@ -178,7 +178,7 @@ if ($OPTS{privkey} =~ /\A(file|gpg):(\p{Print}+)\z/) {
     $SIGN = sub($) { $rsa->sign($_[0]) };
 }
 else {
-    error("unsupported method: $OPTS{privkey}");
+    error("Unsupported method: $OPTS{privkey}");
 }
 my $JWK_STR = JSON::->new->encode($JWK);
 
diff --git a/lacme.8.md b/lacme.8.md
index 30de221..ad6dab6 100644
--- a/lacme.8.md
+++ b/lacme.8.md
@@ -92,7 +92,7 @@ Commands
 
 :   Request that the given certificate(s) *FILE*(s) be revoked.  For
     this command, [`lacme-accountd`(1)] can be pointed to either the
-    account key or the server's private key.
+    account key or the certificate key.
     Command alias: `revoke-cert`.
 
 Generic settings
diff --git a/tests/accountd b/tests/accountd
index 2798465..c82a05d 100644
--- a/tests/accountd
+++ b/tests/accountd
@@ -45,7 +45,7 @@ grepstderr -Fxq "Error: Insecure permissions on /tmp"
 
 # unset XDG_RUNTIME_DIR
 ! runuser -u lacme-account -- lacme-accountd 2>"$STDERR" || fail
-grepstderr "Error: undefined expansion %t in \"%t/S.lacme\""
+grepstderr "Error: Undefined expansion %t in \"%t/S.lacme\""
 
 # non-existent $XDG_RUNTIME_DIR
 ! runuser -u lacme-account -- env XDG_RUNTIME_DIR="/nonexistent" lacme-accountd 2>"$STDERR" || fail
diff --git a/tests/spec-expansion b/tests/spec-expansion
index 273fa51..a268637 100644
--- a/tests/spec-expansion
+++ b/tests/spec-expansion
@@ -11,7 +11,7 @@ grepstderr -Fxq "Can't open /var/cache /etc /run /root /foo/tmp root 0 root 0 %.
 
 # lacme --config=, all specifiers, non-root, unset XDG_RUNTIME_DIR
 ! runuser -u nobody -- lacme --config="%C %E %t %h %T %g %G %u %U %%.conf" account 2>"$STDERR" || fail
-grepstderr -Fxq "Error: undefined expansion %t in \"%C %E %t %h %T %g %G %u %U %%.conf\""
+grepstderr -Fxq "Error: Undefined expansion %t in \"%C %E %t %h %T %g %G %u %U %%.conf\""
 
 # lacme --config=, all specifiers, non-root, defined XDG_RUNTIME_DIR, no other XDG_*
 ! runuser -u nobody -g www-data -- env XDG_RUNTIME_DIR=/foo/run \
@@ -77,7 +77,7 @@ grepstderr -Fxq "Error: Failed to open file '/var/cache /etc /run /root /foo/tmp
 
 # lacme-accountd --config=, all specifiers, non-root, unset XDG_RUNTIME_DIR
 ! runuser -u nobody -- lacme-accountd --config="%C %E %t %h %T %g %G %u %U %%.conf" account 2>"$STDERR" || fail
-grepstderr -Fxq "Error: undefined expansion %t in \"%C %E %t %h %T %g %G %u %U %%.conf\""
+grepstderr -Fxq "Error: Undefined expansion %t in \"%C %E %t %h %T %g %G %u %U %%.conf\""
 
 # lacme-accountd --config=, all specifiers, non-root, defined XDG_RUNTIME_DIR, no other XDG_*
 ! runuser -u nobody -g www-data -- env XDG_RUNTIME_DIR=/foo/run \
-- 
cgit v1.2.3


From 1bdaeae835b5c9914f9c2107efda150d643cda12 Mon Sep 17 00:00:00 2001
From: Guilhem Moulin <guilhem@fripost.org>
Date: Sun, 21 Feb 2021 19:54:25 +0100
Subject: accountd: Improve log message for incoming requests.

---
 lacme-accountd        | 14 +++++++-------
 tests/accountd        |  2 +-
 tests/accountd-remote |  2 +-
 3 files changed, 9 insertions(+), 9 deletions(-)

(limited to 'tests/accountd')

diff --git a/lacme-accountd b/lacme-accountd
index d4521f9..d8c96b0 100755
--- a/lacme-accountd
+++ b/lacme-accountd
@@ -233,20 +233,20 @@ sub conn($$$) {
     while (defined (my $data = $in->getline())) {
         $data =~ s/\r\n\z// or panic();
 
-        my ($protected, $payload) = split(/\./, $data, 2);
-        unless (defined $protected and $protected =~ /\A[A-Za-z0-9\-_]+\z/) {
-            info("[$id] >>> Error: Malformed protected data, refusing to sign!");
+        my ($header, $payload) = split(/\./, $data, 2);
+        unless (defined $header and $header =~ /\A[A-Za-z0-9\-_]+\z/) {
+            info("[$id] >>> Error: Refusing to sign request: Malformed protected header");
             last;
         }
         unless (defined $payload and $payload =~ /\A[A-Za-z0-9\-_]*\z/) {
             # POST-as-GET yields an empty payload
-            info("[$id] >>> Error: Malformed payload data, refusing to sign!");
+            info("[$id] >>> Error: Refusing to sign request: Malformed payload");
             last;
         }
 
-        logmsg(noquiet => "[$id] >>> Incoming signature request for ",
-               "base64url(", decode_base64url($protected), ") . ",
-               "base64url(", decode_base64url($payload), ")");
+        logmsg(noquiet => "[$id] >>> OK signing request: ",
+               "header=base64url(", decode_base64url($header), "); ",
+               "playload=base64url(", decode_base64url($payload), ")");
 
         my $sig = $SIGN->($data);
         $out->printflush( encode_base64url($sig), "\r\n" ) or warn "print: $!";
diff --git a/tests/accountd b/tests/accountd
index c82a05d..9acb33f 100644
--- a/tests/accountd
+++ b/tests/accountd
@@ -81,6 +81,6 @@ grep -Fq "Starting lacme Account Key Manager at /home/lacme-account/S.lacme" ~la
 grep -Fq "[0] >>> Accepted new connection" ~lacme-account/.local/share/lacme/accountd.log
 grep -Fq "[1] >>> Accepted new connection" ~lacme-account/.local/share/lacme/accountd.log
 grep -Fq "Shutting down and closing lacme Account Key Manager" ~lacme-account/.local/share/lacme/accountd.log
-grep -F ">>> Incoming signature request for " ~lacme-account/.local/share/lacme/accountd.log
+grep -F ">>> OK signing request:" ~lacme-account/.local/share/lacme/accountd.log
 
 # vim: set filetype=sh :
diff --git a/tests/accountd-remote b/tests/accountd-remote
index 05850c2..9e7f812 100644
--- a/tests/accountd-remote
+++ b/tests/accountd-remote
@@ -50,6 +50,6 @@ lacme newOrder
 test /etc/lacme/simpletest.rsa.crt -nt /etc/lacme/simpletest.rsa.key
 
 # ensure signature requests are logged
-grep -F ">>> Incoming signature request for " ~lacme-account/.local/share/lacme/accountd.log
+grep -F ">>> OK signing request:" ~lacme-account/.local/share/lacme/accountd.log
 
 # vim: set filetype=sh :
-- 
cgit v1.2.3


From 903309cb8364047a2939fb6d3cb06da8ecc32726 Mon Sep 17 00:00:00 2001
From: Guilhem Moulin <guilhem@fripost.org>
Date: Mon, 22 Feb 2021 03:19:38 +0100
Subject: tests: Check presence of extra greeting data.

---
 tests/accountd | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

(limited to 'tests/accountd')

diff --git a/tests/accountd b/tests/accountd
index 9acb33f..a603c16 100644
--- a/tests/accountd
+++ b/tests/accountd
@@ -67,7 +67,8 @@ rm -f ~lacme-account/.local/share/lacme/accountd.log
 runuser -u lacme-account -- lacme-accountd --socket="$SOCKET" --quiet & PID=$!
 
 # run lacme(8) multiple times using that single lacme-accountd(1) instance
-lacme --socket="$SOCKET" account  2>"$STDERR" || fail
+lacme --socket="$SOCKET" --debug account 2>"$STDERR" || fail
+grepstderr -F "Received extra greeting data from accountd:"
 lacme --socket="$SOCKET" newOrder 2>"$STDERR" || fail
 test /etc/lacme/simpletest.rsa.crt -nt /etc/lacme/simpletest.rsa.key
 
-- 
cgit v1.2.3