Add AIA functional tests and fix server lint warnings

Add functional tests for hashed TLSA and stapled AIA flows,

Fix lint warnings in server.go

Update CI to install xxd and use Google Chrome on Ubuntu instead of snap Chromium (snap introduces some annoying issues)

Author: robertmin1

.cirrus.yml

@@ -125,7 +125,8 @@ task:
   install_script:
     - apt-get update
     # bind9-dnsutils contains dig
-    - apt-get install -y dnssec-trigger bind9-dnsutils xxd
+    - apt-get install -y dnssec-trigger bind9-dnsutils libnss3-tools xxd
+    - if [ "$CI_DISTRO" = "ubuntu" ]; then curl -fsSL https://dl.google.com/linux/linux_signing_key.pub | gpg --dearmor -o /usr/share/keyrings/google-chrome.gpg && echo "deb [arch=amd64 signed-by=/usr/share/keyrings/google-chrome.gpg] http://dl.google.com/linux/chrome/deb/ stable main" > /etc/apt/sources.list.d/google-chrome.list && apt-get update && apt-get install -y google-chrome-stable; else apt-get install -y chromium; fi
     # Namecoin Core
     # Temporarily downgrade Namecoin Core until deterministic salts with descriptor wallets are fixed.
     #- BITCOIND_URL=$(curl https://www.namecoin.org/download/ | grep x86_64-linux-gnu.tar.gz | grep -v 0.13.99 | grep --only-matching https://.*.tar.gz)
@@ -162,7 +163,7 @@ task:
     - chown encaya:encaya testdata/*.pem
     # Curiously, relative paths don't work here, they cause the .pem files to
     # not be detected.  Maybe file a bug with Hugo?
-    - encaya -conf "$(pwd)/testdata/encaya.conf"
+    - encaya -conf "$(pwd)/testdata/encaya.conf" -encaya.namecoinrpcaddress 127.0.0.1:18554 -encaya.namecoinrpcusername doggman -encaya.namecoinrpcpassword donkey
   regtest_script:
     - sleep 15s
     - testdata/regtest.sh

server/server.go

@@ -460,20 +460,20 @@ func (s *Server) lookupDNS(req *http.Request, domain string) (tlsa *dns.TLSA, er
 	}
 
 	dnsResponse := result.ResponseMsg
-	if dnsResponse.MsgHdr.Rcode != dns.RcodeSuccess && dnsResponse.MsgHdr.Rcode != dns.RcodeNameError {
+	if dnsResponse.Rcode != dns.RcodeSuccess && dnsResponse.Rcode != dns.RcodeNameError {
 		// A DNS error occurred (return code wasn't Success or NXDOMAIN).
 		return nil, fmt.Errorf("qlib error: return code not Success or NXDOMAIN")
 	}
 
-	if dnsResponse.MsgHdr.Rcode == dns.RcodeNameError {
+	if dnsResponse.Rcode == dns.RcodeNameError {
 		// Wildcard subdomain doesn't exist.
 		// That means the domain doesn't use Namecoin-form DANE.
 		// Return no cert.
 		log.Debugf("wildcard subdomain doesn't exist: %s", domain)
 		return nil, nil
 	}
 
-	if !dnsResponse.MsgHdr.AuthenticatedData && !dnsResponse.MsgHdr.Authoritative {
+	if !dnsResponse.AuthenticatedData && !dnsResponse.Authoritative {
 		// For security reasons, we only trust records that are
 		// authenticated (e.g. server is Unbound and has verified
 		// DNSSEC sigs) or authoritative (e.g. server is ncdns and is
@@ -734,7 +734,7 @@ func (s *Server) aiaHandler(writer http.ResponseWriter, req *http.Request) {
 		writer.Header().Set("Cache-Control", "max-age="+maxAgeStr)
 	}
 
-	_, err = io.WriteString(writer, string(requestedCert))
+	_, err = writer.Write(requestedCert)
 	if err != nil {
 		log.Debuge(err, "write error")
 	}