bolt 0.24.0 → 0.25.0

data/vendored/puppet/lib/puppet/ssl/key.rb

@@ -1,59 +0,0 @@
-require 'puppet/ssl/base'
-require 'puppet/indirector'
-
-# Manage private and public keys as a pair.
-class Puppet::SSL::Key < Puppet::SSL::Base
-  wraps OpenSSL::PKey::RSA
-
-  extend Puppet::Indirector
-  indirects :key, :terminus_class => :file, :doc => <<DOC
-    This indirection wraps an `OpenSSL::PKey::RSA object, representing a private key.
-    The indirection key is the certificate CN (generally a hostname).
-DOC
-
-  # Because of how the format handler class is included, this
-  # can't be in the base class.
-  def self.supported_formats
-    [:s]
-  end
-
-  attr_accessor :password_file
-
-  # Knows how to create keys with our system defaults.
-  def generate
-    Puppet.info _("Creating a new SSL key for %{name}") % { name: name }
-    @content = OpenSSL::PKey::RSA.new(Puppet[:keylength].to_i)
-  end
-
-  def initialize(name)
-    super
-
-    @password_file = Puppet[:passfile]
-  end
-
-  def password
-    return nil unless password_file and Puppet::FileSystem.exist?(password_file)
-
-    # Puppet generates files at the default Puppet[:capass] using ASCII
-    # User configured :passfile could be in any encoding
-    # Use BINARY given the string is passed to an OpenSSL API accepting bytes
-    # note this is only called internally
-    Puppet::FileSystem.read(password_file, :encoding => Encoding::BINARY)
-  end
-
-  # Optionally support specifying a password file.
-  def read(path)
-    return super unless password_file
-
-    # RFC 1421 states PEM is 7-bit ASCII https://tools.ietf.org/html/rfc1421
-    @content = wrapped_class.new(Puppet::FileSystem.read(path, :encoding => Encoding::ASCII), password)
-  end
-
-  def to_s
-    if pass = password
-      @content.export(OpenSSL::Cipher::DES.new(:EDE3, :CBC), pass)
-    else
-      return super
-    end
-  end
-end

data/vendored/puppet/lib/puppet/ssl/oids.rb

@@ -1,193 +0,0 @@
-require 'puppet/ssl'
-
-# This module defines OIDs for use within Puppet.
-#
-# == ASN.1 Definition
-#
-# The following is the formal definition of OIDs specified in this file.
-#
-# puppetCertExtensions OBJECT IDENTIFIER ::= {iso(1) identified-organization(3)
-#    dod(6) internet(1) private(4) enterprise(1) 34380 1}
-#
-# -- the tree under registeredExtensions 'belongs' to puppetlabs
-# -- privateExtensions can be extended by enterprises to suit their own needs
-# registeredExtensions OBJECT IDENTIFIER ::= { puppetCertExtensions 1 }
-# privateExtensions OBJECT IDENTIFIER ::= { puppetCertExtensions 2 }
-# authorizationExtensions OBJECT IDENTIFIER ::= { puppetCertExtensions 3 }
-#
-# -- subtree of common registered extensions
-# -- The short names for these OIDs are intentionally lowercased and formatted
-# -- since they may be exposed inside the Puppet DSL as variables.
-# pp_uuid  OBJECT IDENTIFIER ::= { registeredExtensions 1 }
-# pp_instance_id OBJECT IDENTIFIER ::= { registeredExtensions 2 }
-# pp_image_name OBJECT IDENTIFIER ::= { registeredExtensions 3 }
-# pp_preshared_key OBJECT IDENTIFIER ::= { registeredExtensions 4 }
-#
-# @api private
-module Puppet::SSL::Oids
-
-  # Note: When updating the following OIDs make sure to also update the OID
-  # definitions here:
-  # https://github.com/puppetlabs/puppetserver/blob/master/src/clj/puppetlabs/puppetserver/certificate_authority.clj#L122-L159
-
-  PUPPET_OIDS = [
-    ["1.3.6.1.4.1.34380", 'puppetlabs', 'Puppet Labs'],
-    ["1.3.6.1.4.1.34380.1", 'ppCertExt', 'Puppet Certificate Extension'],
-
-    ["1.3.6.1.4.1.34380.1.1", 'ppRegCertExt', 'Puppet Registered Certificate Extension'],
-
-    ["1.3.6.1.4.1.34380.1.1.1", 'pp_uuid', 'Puppet Node UUID'],
-    ["1.3.6.1.4.1.34380.1.1.2", 'pp_instance_id', 'Puppet Node Instance ID'],
-    ["1.3.6.1.4.1.34380.1.1.3", 'pp_image_name', 'Puppet Node Image Name'],
-    ["1.3.6.1.4.1.34380.1.1.4", 'pp_preshared_key', 'Puppet Node Preshared Key'],
-    ["1.3.6.1.4.1.34380.1.1.5", 'pp_cost_center', 'Puppet Node Cost Center Name'],
-    ["1.3.6.1.4.1.34380.1.1.6", 'pp_product', 'Puppet Node Product Name'],
-    ["1.3.6.1.4.1.34380.1.1.7", 'pp_project', 'Puppet Node Project Name'],
-    ["1.3.6.1.4.1.34380.1.1.8", 'pp_application', 'Puppet Node Application Name'],
-    ["1.3.6.1.4.1.34380.1.1.9", 'pp_service', 'Puppet Node Service Name'],
-    ["1.3.6.1.4.1.34380.1.1.10", 'pp_employee', 'Puppet Node Employee Name'],
-    ["1.3.6.1.4.1.34380.1.1.11", 'pp_created_by', 'Puppet Node created_by Tag'],
-    ["1.3.6.1.4.1.34380.1.1.12", 'pp_environment', 'Puppet Node Environment Name'],
-    ["1.3.6.1.4.1.34380.1.1.13", 'pp_role', 'Puppet Node Role Name'],
-    ["1.3.6.1.4.1.34380.1.1.14", 'pp_software_version', 'Puppet Node Software Version'],
-    ["1.3.6.1.4.1.34380.1.1.15", 'pp_department', 'Puppet Node Department Name'],
-    ["1.3.6.1.4.1.34380.1.1.16", 'pp_cluster', 'Puppet Node Cluster Name'],
-    ["1.3.6.1.4.1.34380.1.1.17", 'pp_provisioner', 'Puppet Node Provisioner Name'],
-    ["1.3.6.1.4.1.34380.1.1.18", 'pp_region', 'Puppet Node Region Name'],
-    ["1.3.6.1.4.1.34380.1.1.19", 'pp_datacenter', 'Puppet Node Datacenter Name'],
-    ["1.3.6.1.4.1.34380.1.1.20", 'pp_zone', 'Puppet Node Zone Name'],
-    ["1.3.6.1.4.1.34380.1.1.21", 'pp_network', 'Puppet Node Network Name'],
-    ["1.3.6.1.4.1.34380.1.1.22", 'pp_securitypolicy', 'Puppet Node Security Policy Name'],
-    ["1.3.6.1.4.1.34380.1.1.23", 'pp_cloudplatform', 'Puppet Node Cloud Platform Name'],
-    ["1.3.6.1.4.1.34380.1.1.24", 'pp_apptier', 'Puppet Node Application Tier'],
-    ["1.3.6.1.4.1.34380.1.1.25", 'pp_hostname', 'Puppet Node Hostname'],
-
-    ["1.3.6.1.4.1.34380.1.2", 'ppPrivCertExt', 'Puppet Private Certificate Extension'],
-
-    ["1.3.6.1.4.1.34380.1.3", 'ppAuthCertExt', 'Puppet Certificate Authorization Extension'],
-
-    ["1.3.6.1.4.1.34380.1.3.1",  'pp_authorization', 'Certificate Extension Authorization'],
-    ["1.3.6.1.4.1.34380.1.3.13", 'pp_auth_role', 'Puppet Node Role Name for Authorization'],
-  ]
-
-  @did_register_puppet_oids = false
-
-  # Register our custom Puppet OIDs with OpenSSL so they can be used as CSR
-  # extensions. Without registering these OIDs, OpenSSL will fail when it
-  # encounters such an extension in a CSR.
-  def self.register_puppet_oids()
-    if !@did_register_puppet_oids
-      PUPPET_OIDS.each do |oid_defn|
-        OpenSSL::ASN1::ObjectId.register(*oid_defn)
-      end
-
-      @did_register_puppet_oids = true
-    end
-  end
-
-  # Parse custom OID mapping file that enables custom OIDs to be resolved
-  # into user-friendly names.
-  #
-  # @param custom_oid_file [String] File to obtain custom OIDs mapping from
-  # @param map_key [String] Hash key in which custom OIDs mapping is stored
-  #
-  # @example Custom OID mapping file
-  # ---
-  # oid_mapping:
-  #  '1.3.6.1.4.1.34380.1.2.1.1':
-  #    shortname : 'myshortname'
-  #    longname  : 'Long name'
-  #  '1.3.6.1.4.1.34380.1.2.1.2':
-  #    shortname: 'myothershortname'
-  #    longname: 'Other Long name'
-  def self.parse_custom_oid_file(custom_oid_file, map_key='oid_mapping')
-    if File.exists?(custom_oid_file) && File.readable?(custom_oid_file)
-      mapping = nil
-      begin
-        mapping = Puppet::Util::Yaml.safe_load_file(custom_oid_file, [Symbol])
-      rescue => err
-        raise Puppet::Error, _("Error loading ssl custom OIDs mapping file from '%{custom_oid_file}': %{err}") % { custom_oid_file: custom_oid_file, err: err }, err.backtrace
-      end
-
-      unless mapping.has_key?(map_key)
-        raise Puppet::Error, _("Error loading ssl custom OIDs mapping file from '%{custom_oid_file}': no such index '%{map_key}'") % { custom_oid_file: custom_oid_file, map_key: map_key }
-      end
-
-      unless mapping[map_key].is_a?(Hash)
-        raise Puppet::Error, _("Error loading ssl custom OIDs mapping file from '%{custom_oid_file}': data under index '%{map_key}' must be a Hash") % { custom_oid_file: custom_oid_file, map_key: map_key }
-      end
-
-      oid_defns = []
-      mapping[map_key].keys.each do |oid|
-        shortname, longname = mapping[map_key][oid].values_at("shortname","longname")
-        if shortname.nil? || longname.nil?
-          raise Puppet::Error, _("Error loading ssl custom OIDs mapping file from '%{custom_oid_file}': incomplete definition of oid '%{oid}'") % { custom_oid_file: custom_oid_file, oid: oid }
-        end
-        oid_defns << [oid, shortname, longname]
-      end
-
-      oid_defns
-    end
-  end
-
-  # Load custom OID mapping file that enables custom OIDs to be resolved
-  # into user-friendly names.
-  #
-  # @param custom_oid_file [String] File to obtain custom OIDs mapping from
-  # @param map_key [String] Hash key in which custom OIDs mapping is stored
-  #
-  # @example Custom OID mapping file
-  # ---
-  # oid_mapping:
-  #  '1.3.6.1.4.1.34380.1.2.1.1':
-  #    shortname : 'myshortname'
-  #    longname  : 'Long name'
-  #  '1.3.6.1.4.1.34380.1.2.1.2':
-  #    shortname: 'myothershortname'
-  #    longname: 'Other Long name'
-  def self.load_custom_oid_file(custom_oid_file, map_key='oid_mapping')
-    oid_defns = parse_custom_oid_file(custom_oid_file, map_key)
-    unless oid_defns.nil?
-      begin
-        oid_defns.each do |oid_defn|
-          OpenSSL::ASN1::ObjectId.register(*oid_defn)
-        end
-      rescue => err
-        raise ArgumentError, _("Error registering ssl custom OIDs mapping from file '%{custom_oid_file}': %{err}") % { custom_oid_file: custom_oid_file, err: err }, err.backtrace
-      end
-    end
-  end
-
-  # Determine if the first OID contains the second OID
-  #
-  # @param first [String] The containing OID, in dotted form or as the short name
-  # @param second [String] The contained OID, in dotted form or as the short name
-  # @param exclusive [true, false] If an OID should not be considered as a subtree of itself
-  #
-  # @example Comparing two dotted OIDs
-  #   Puppet::SSL::Oids.subtree_of?('1.3.6.1', '1.3.6.1.4.1') #=> true
-  #   Puppet::SSL::Oids.subtree_of?('1.3.6.1', '1.3.6') #=> false
-  #
-  # @example Comparing an OID short name with a dotted OID
-  #   Puppet::SSL::Oids.subtree_of?('IANA', '1.3.6.1.4.1') #=> true
-  #   Puppet::SSL::Oids.subtree_of?('1.3.6.1', 'enterprises') #=> true
-  #
-  # @example Comparing an OID against itself
-  #   Puppet::SSL::Oids.subtree_of?('IANA', 'IANA') #=> true
-  #   Puppet::SSL::Oids.subtree_of?('IANA', 'IANA', true) #=> false
-  #
-  # @return [true, false]
-  def self.subtree_of?(first, second, exclusive = false)
-    first_oid = OpenSSL::ASN1::ObjectId.new(first).oid
-    second_oid = OpenSSL::ASN1::ObjectId.new(second).oid
-
-
-    if exclusive and first_oid == second_oid
-      false
-    else
-      second_oid.index(first_oid) == 0
-    end
-  rescue OpenSSL::ASN1::ASN1Error, TypeError
-    false
-  end
-end

data/vendored/puppet/lib/puppet/ssl/validator.rb

@@ -1,60 +0,0 @@
-require 'openssl'
-
-# API for certificate verification
-#
-# @api public
-class Puppet::SSL::Validator
-
-  # Factory method for creating an instance of a null/no validator.
-  # This method does not have to be implemented by concrete implementations of this API.
-  #
-  # @return [Puppet::SSL::Validator] produces a validator that performs no validation
-  #
-  # @api public
-  #
-  def self.no_validator()
-    @@no_validator_cache ||= Puppet::SSL::Validator::NoValidator.new()
-  end
-
-  # Factory method for creating an instance of the default Puppet validator.
-  # This method does not have to be implemented by concrete implementations of this API.
-  #
-  # @return [Puppet::SSL::Validator] produces a validator that performs no validation
-  #
-  # @api public
-  #
-  def self.default_validator()
-    Puppet::SSL::Validator::DefaultValidator.new()
-  end
-
-  # Array of peer certificates
-  # @return [Array<Puppet::SSL::Certificate>] peer certificates
-  #
-  # @api public
-  #
-  def peer_certs
-    raise NotImplementedError, "Concrete class should have implemented this method"
-  end
-
-  # Contains the result of validation
-  # @return [Array<String>, nil] nil, empty Array, or Array with messages
-  #
-  # @api public
-  #
-  def verify_errors
-    raise NotImplementedError, "Concrete class should have implemented this method"
-  end
-
-  # Registers the connection to validate.
-  #
-  # @param [Net::HTTP] connection The connection to validate
-  #
-  # @return [void]
-  #
-  # @api public
-  #
-  def setup_connection(connection)
-    raise NotImplementedError, "Concrete class should have implemented this method"
-  end
-end
-

data/vendored/puppet/lib/puppet/ssl/validator/default_validator.rb

@@ -1,187 +0,0 @@
-require 'openssl'
-require 'puppet/ssl'
-
-# Perform peer certificate verification against the known CA.
-# If there is no CA information known, then no verification is performed
-#
-# @api private
-#
-class Puppet::SSL::Validator::DefaultValidator #< class Puppet::SSL::Validator
-  attr_reader :peer_certs
-  attr_reader :verify_errors
-
-  FIVE_MINUTES_AS_SECONDS = 5 * 60
-
-  # Creates a new DefaultValidator, optionally with an SSL Configuration and SSL Host.
-  #
-  # @param ca_path [String] Filepath for the cacert
-  #
-  # @api private
-  #
-  def initialize(
-    ca_path = Puppet[:ssl_client_ca_auth] || Puppet[:localcacert])
-
-    reset!
-    @ca_path = ca_path
-  end
-
-
-  # Resets this validator to its initial validation state. The ssl configuration is not changed.
-  #
-  # @api private
-  #
-  def reset!
-    @peer_certs = []
-    @verify_errors = []
-  end
-
-  # Performs verification of the SSL connection and collection of the
-  # certificates for use in constructing the error message if the verification
-  # failed.  This callback will be executed once for each certificate in a
-  # chain being verified.
-  #
-  # From the [OpenSSL
-  # documentation](https://www.openssl.org/docs/ssl/SSL_CTX_set_verify.html):
-  # The `verify_callback` function is used to control the behaviour when the
-  # SSL_VERIFY_PEER flag is set. It must be supplied by the application and
-  # receives two arguments: preverify_ok indicates, whether the verification of
-  # the certificate in question was passed (preverify_ok=1) or not
-  # (preverify_ok=0). x509_store_ctx is a pointer to the complete context used for
-  # the certificate chain verification.
-  #
-  # See {Puppet::Network::HTTP::Connection} for more information and where this
-  # class is intended to be used.
-  #
-  # @param [Boolean] preverify_ok indicates whether the verification of the
-  #   certificate in question was passed (preverify_ok=true)
-  # @param [OpenSSL::X509::StoreContext] store_context holds the X509 store context
-  #   for the chain being verified.
-  #
-  # @return [Boolean] false if the peer is invalid, true otherwise.
-  #
-  # @api private
-  #
-  def call(preverify_ok, store_context)
-    current_cert = store_context.current_cert
-    @peer_certs << current_cert
-
-    # We must make a copy since the scope of the store_context will be lost
-    # across invocations of this method.
-    if preverify_ok
-      # If we've copied all of the certs in the chain out of the SSL library
-      if @peer_certs.length == store_context.chain.length
-        # (#20027) The peer cert must be issued by a specific authority
-        preverify_ok = valid_peer?
-      end
-    else
-      error = store_context.error || 0
-      error_string = store_context.error_string || "OpenSSL error #{error}"
-
-      case error
-      when OpenSSL::X509::V_ERR_CRL_NOT_YET_VALID
-        # current_crl can be nil
-        # https://github.com/ruby/ruby/blob/ruby_1_9_3/ext/openssl/ossl_x509store.c#L501-L510
-        crl = store_context.current_crl
-        if crl
-          if crl.last_update && crl.last_update < Time.now + FIVE_MINUTES_AS_SECONDS
-            Puppet.debug("Ignoring CRL not yet valid, current time #{Time.now.utc}, CRL last updated #{crl.last_update.utc}")
-            preverify_ok = true
-          else
-            @verify_errors << "#{error_string} for #{crl.issuer}"
-          end
-        else
-          @verify_errors << error_string
-        end
-      else
-        @verify_errors << "#{error_string} for #{current_cert.subject}"
-      end
-    end
-    preverify_ok
-  rescue => ex
-    @verify_errors << ex.message
-    false
-  end
-
-  # Registers the instance's call method with the connection.
-  #
-  # @param [Net::HTTP] connection The connection to validate
-  #
-  # @param [Puppet::SSL::Host] host The host object containing SSL data
-  # @return [void]
-  #
-  # @api private
-  #
-  def setup_connection(connection, ssl_host = Puppet.lookup(:ssl_host))
-    if ssl_certificates_are_present?
-      connection.cert_store = ssl_host.ssl_store
-      connection.ca_file = @ca_path
-      connection.cert = ssl_host.certificate.content
-      connection.key = ssl_host.key.content
-      connection.verify_mode = OpenSSL::SSL::VERIFY_PEER
-      connection.verify_callback = self
-    else
-      connection.verify_mode = OpenSSL::SSL::VERIFY_NONE
-    end
-  end
-
-  ##
-  # Decode a string of concatenated certificates
-  #
-  # @return [Array<OpenSSL::X509::Certificate>]
-  def decode_cert_bundle(bundle_str)
-    re = /-----BEGIN CERTIFICATE-----.*?-----END CERTIFICATE-----/m
-    pem_ary = bundle_str.scan(re)
-    pem_ary.map do |pem_str|
-      OpenSSL::X509::Certificate.new(pem_str)
-    end
-  end
-
-  # read_file makes testing easier.
-  def read_file(path)
-    # https://www.ietf.org/rfc/rfc2459.txt defines the x509 V3 certificate format
-    # CA bundles are concatenated X509 certificates, but may also include
-    # comments, which could have UTF-8 characters
-    Puppet::FileSystem.read(path, :encoding => Encoding::UTF_8)
-  end
-
-  # Validates the peer certificates against the authorized certificates.
-  #
-  # @api private
-  #
-  def valid_peer?
-    descending_cert_chain = @peer_certs.reverse
-    authz_ca_certs = decode_cert_bundle(read_file(@ca_path))
-
-    if not has_authz_peer_cert(descending_cert_chain, authz_ca_certs)
-      msg = "The server presented a SSL certificate chain which does not include a " <<
-        "CA listed in the ssl_client_ca_auth file.  "
-      msg << "Authorized Issuers: #{authz_ca_certs.collect {|c| c.subject}.join(', ')}  " <<
-        "Peer Chain: #{descending_cert_chain.collect {|c| c.subject}.join(' => ')}"
-      @verify_errors << msg
-      false
-    else
-      true
-    end
-  end
-
-  # Checks if the set of peer_certs contains at least one certificate issued
-  # by a certificate listed in authz_certs
-  #
-  # @return [Boolean]
-  #
-  # @api private
-  #
-  def has_authz_peer_cert(peer_certs, authz_certs)
-    peer_certs.any? do |peer_cert|
-      authz_certs.any? do |authz_cert|
-        peer_cert.verify(authz_cert.public_key)
-      end
-    end
-  end
-
-  # @api private
-  #
-  def ssl_certificates_are_present?
-    Puppet::FileSystem.exist?(Puppet[:hostcert]) && Puppet::FileSystem.exist?(@ca_path)
-  end
-end