BUG/MINOR: acme: exact domain match in acme_challenge_ready()

acme_challenge_ready() compares the domain passed on the CLI (or via the
Lua ACME.challenge_ready() function) with strncmp() limited to the
length of the authorization's domain. This is a prefix match: with a
certificate covering "example.com" and "example.com.au", signaling
"example.com.au" also marks the "example.com" challenge as ready.

Use isteq() so that only the exact domain matches.

This should be backported to 3.3. The code was moved into
acme_challenge_ready() in 3.5, so the fix has to be applied to
cli_acme_chall_ready_parse() in older versions.

diff --git a/src/acme.c b/src/acme.c
index dbf1d1f3adb6901a8e94ca13c73a0f0ce1e350e2..63f6959aec912b2dc39cc27feac86400bb6fc1ab 100644 (file)
--- a/src/acme.c
+++ b/src/acme.c
@@ -3604,7 +3604,7 @@ int acme_challenge_ready(const char *crt, const char *dns)
        if (ctx->cfg->cond_ready & ACME_RDY_CLI)
                auth = ctx->auths;
        while (auth) {
-               if (strncmp(dns, auth->dns.ptr, auth->dns.len) == 0) {
+               if (isteq(ist(dns), auth->dns)) {
                        if ((auth->ready & ACME_RDY_CLI) == 0) {
                                auth->ready |= ACME_RDY_CLI;
                                found++;