chef 12.0.0.alpha.2 → 12.0.0.rc.0

data/lib/chef/knife/data_bag_edit.rb

@@ -18,10 +18,12 @@
 #
 
 require 'chef/knife'
+require 'chef/knife/data_bag_secret_options'
 
 class Chef
   class Knife
     class DataBagEdit < Knife
+      include DataBagSecretOptions
 
       deps do
         require 'chef/data_bag_item'
@@ -31,48 +33,17 @@ class Chef
       banner "knife data bag edit BAG ITEM (options)"
       category "data bag"
 
-      option :secret,
-        :short => "-s SECRET",
-        :long  => "--secret ",
-        :description => "The secret key to use to encrypt data bag item values",
-        :proc => Proc.new { |s| Chef::Config[:knife][:secret] = s }
-
-      option :secret_file,
-        :long => "--secret-file SECRET_FILE",
-        :description => "A file containing the secret key to use to encrypt data bag item values",
-        :proc => Proc.new { |sf| Chef::Config[:knife][:secret_file] = sf }
-
-      def read_secret
-        if config[:secret]
-          config[:secret]
-        else
-          Chef::EncryptedDataBagItem.load_secret(config[:secret_file])
-        end
-      end
-
-      def use_encryption
-        if config[:secret] && config[:secret_file]
-          stdout.puts "please specify only one of --secret, --secret-file"
-          exit(1)
-        end
-        config[:secret] || config[:secret_file]
-      end
-
       def load_item(bag, item_name)
         item = Chef::DataBagItem.load(bag, item_name)
-        if use_encryption
-          Chef::EncryptedDataBagItem.new(item, read_secret).to_hash
+        if encrypted?(item.raw_data)
+          if encryption_secret_provided_ignore_encrypt_flag?
+            return Chef::EncryptedDataBagItem.new(item, read_secret).to_hash, true
+          else
+            ui.fatal("You cannot edit an encrypted data bag without providing the secret.")
+            exit(1)
+          end
         else
-          item
-        end
-      end
-
-      def edit_item(item)
-        output = edit_data(item)
-        if use_encryption
-          Chef::EncryptedDataBagItem.encrypt_data_bag_item(output, read_secret)
-        else
-          output
+          return item, false
         end
       end
 
@@ -82,11 +53,21 @@ class Chef
           stdout.puts opt_parser
           exit 1
         end
-        item = load_item(@name_args[0], @name_args[1])
-        output = edit_item(item)
-        rest.put_rest("data/#{@name_args[0]}/#{@name_args[1]}", output)
+
+        item, was_encrypted = load_item(@name_args[0], @name_args[1])
+        edited_item = edit_data(item)
+
+        if was_encrypted || encryption_secret_provided?
+          ui.info("Encrypting data bag using provided secret.")
+          item_to_save = Chef::EncryptedDataBagItem.encrypt_data_bag_item(edited_item, read_secret)
+        else
+          ui.info("Saving data bag unencrypted.  To encrypt it, provide an appropriate secret.")
+          item_to_save = edited_item
+        end
+
+        rest.put_rest("data/#{@name_args[0]}/#{@name_args[1]}", item_to_save)
         stdout.puts("Saved data_bag_item[#{@name_args[1]}]")
-        ui.output(output) if config[:print_after]
+        ui.output(edited_item) if config[:print_after]
       end
     end
   end

data/lib/chef/knife/data_bag_from_file.rb

@@ -18,10 +18,13 @@
 #
 
 require 'chef/knife'
+require 'chef/util/path_helper'
+require 'chef/knife/data_bag_secret_options'
 
 class Chef
   class Knife
     class DataBagFromFile < Knife
+      include DataBagSecretOptions
 
       deps do
         require 'chef/data_bag'
@@ -34,38 +37,11 @@ class Chef
       banner "knife data bag from file BAG FILE|FOLDER [FILE|FOLDER..] (options)"
       category "data bag"
 
-      option :secret,
-        :short => "-s SECRET",
-        :long  => "--secret ",
-        :description => "The secret key to use to encrypt data bag item values",
-        :proc => Proc.new { |s| Chef::Config[:knife][:secret] = s }
-
-      option :secret_file,
-        :long => "--secret-file SECRET_FILE",
-        :description => "A file containing the secret key to use to encrypt data bag item values",
-        :proc => Proc.new { |sf| Chef::Config[:knife][:secret_file] = sf }
-
       option :all,
         :short => "-a",
         :long  => "--all",
         :description => "Upload all data bags or all items for specified data bags"
 
-      def read_secret
-        if config[:secret]
-          config[:secret]
-        else
-          Chef::EncryptedDataBagItem.load_secret(config[:secret_file])
-        end
-      end
-
-      def use_encryption
-        if config[:secret] && config[:secret_file]
-          ui.fatal("please specify only one of --secret, --secret-file")
-          exit(1)
-        end
-        config[:secret] || config[:secret_file]
-      end
-
       def loader
         @loader ||= Knife::Core::ObjectLoader.new(DataBagItem, ui)
       end
@@ -108,9 +84,8 @@ class Chef
         item_paths = normalize_item_paths(items)
         item_paths.each do |item_path|
           item = loader.load_from("#{data_bags_path}", data_bag, item_path)
-          item = if use_encryption
-                   secret = read_secret
-                   Chef::EncryptedDataBagItem.encrypt_data_bag_item(item, secret)
+          item = if encryption_secret_provided?
+                   Chef::EncryptedDataBagItem.encrypt_data_bag_item(item, read_secret)
                  else
                    item
                  end
@@ -126,7 +101,7 @@ class Chef
         paths = Array.new
         args.each do |path|
           if File.directory?(path)
-            paths.concat(Dir.glob(File.join(path, "*.json")))
+            paths.concat(Dir.glob(File.join(Chef::Util::PathHelper.escape_glob(path), "*.json")))
           else
             paths << path
           end

data/lib/chef/knife/data_bag_secret_options.rb

@@ -0,0 +1,142 @@
+#
+# Author:: Tyler Ball (<tball@opscode.com>)
+# Copyright:: Copyright (c) 2014 Opscode, Inc.
+# License:: Apache License, Version 2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+require 'mixlib/cli'
+require 'chef/config'
+require 'chef/encrypted_data_bag_item/check_encrypted'
+
+class Chef
+  class Knife
+    module DataBagSecretOptions
+      include Mixlib::CLI
+      include Chef::EncryptedDataBagItem::CheckEncrypted
+
+      # The config object is populated by knife#merge_configs with knife.rb `knife[:*]` config values, but they do
+      # not overwrite the command line properties.  It does mean, however, that `knife[:secret]` and `--secret-file`
+      # passed at the same time populate both `config[:secret]` and `config[:secret_file]`.  We cannot differentiate
+      # the valid case (`knife[:secret]` in config file and `--secret-file` on CL) and the invalid case (`--secret`
+      # and `--secret-file` on the CL) - thats why I'm storing the CL options in a different config key if they
+      # are provided.
+
+      def self.included(base)
+        base.option :secret,
+               :short => "-s SECRET",
+               :long  => "--secret ",
+               :description => "The secret key to use to encrypt data bag item values.  Can also be defaulted in your config with the key 'secret'",
+               # Need to store value from command line in separate variable - knife#merge_configs populates same keys
+               # on config object from
+               :proc => Proc.new { |s| set_cl_secret(s) }
+
+        base.option :secret_file,
+               :long => "--secret-file SECRET_FILE",
+               :description => "A file containing the secret key to use to encrypt data bag item values.  Can also be defaulted in your config with the key 'secret_file'",
+               :proc => Proc.new { |sf| set_cl_secret_file(sf) }
+
+        base.option :encrypt,
+               :long => "--encrypt",
+               :description => "If 'secret' or 'secret_file' is present in your config, then encrypt data bags using it",
+               :boolean => true,
+               :default => false
+      end
+
+      def encryption_secret_provided?
+        base_encryption_secret_provided?
+      end
+
+      def encryption_secret_provided_ignore_encrypt_flag?
+        base_encryption_secret_provided?(false)
+      end
+
+      def read_secret
+        # Moving the non 'compile-time' requires into here to speed up knife command loading
+        # IE, if we are not running 'knife data bag *' we don't need to load 'chef/encrypted_data_bag_item'
+        require 'chef/encrypted_data_bag_item'
+
+        if has_cl_secret?
+          config[:secret]
+        elsif has_cl_secret_file?
+          Chef::EncryptedDataBagItem.load_secret(config[:secret_file])
+        elsif secret = knife_config[:secret]
+          secret
+        else
+          secret_file = knife_config[:secret_file]
+          Chef::EncryptedDataBagItem.load_secret(secret_file)
+        end
+      end
+
+      def validate_secrets
+        if has_cl_secret? && has_cl_secret_file?
+          ui.fatal("Please specify only one of --secret, --secret-file")
+          exit(1)
+        end
+
+        if knife_config[:secret] && knife_config[:secret_file]
+          ui.fatal("Please specify only one of 'secret' or 'secret_file' in your config file")
+          exit(1)
+        end
+      end
+
+      private
+
+      ##
+      # Determine if the user has specified an appropriate secret for encrypting data bag items.
+      # @returns boolean
+      def base_encryption_secret_provided?(need_encrypt_flag = true)
+        validate_secrets
+
+        return true if has_cl_secret? || has_cl_secret_file?
+
+        if need_encrypt_flag
+          if config[:encrypt]
+            unless knife_config[:secret] || knife_config[:secret_file]
+              ui.fatal("No secret or secret_file specified in config, unable to encrypt item.")
+              exit(1)
+            end
+            return true
+          end
+          return false
+        elsif knife_config[:secret] || knife_config[:secret_file]
+          # Certain situations (show and bootstrap) don't need a --encrypt flag to use the config file secret
+          return true
+        end
+        return false
+      end
+
+      def has_cl_secret?
+        Chef::Config[:knife].has_key?(:cl_secret)
+      end
+
+      def self.set_cl_secret(s)
+        Chef::Config[:knife][:cl_secret] = s
+      end
+
+      def has_cl_secret_file?
+        Chef::Config[:knife].has_key?(:cl_secret_file)
+      end
+
+      def self.set_cl_secret_file(sf)
+        Chef::Config[:knife][:cl_secret_file] = sf
+      end
+
+      def knife_config
+        Chef::Config.key?(:knife) ? Chef::Config[:knife] : {}
+      end
+
+    end
+  end
+end

data/lib/chef/knife/data_bag_show.rb

@@ -18,10 +18,12 @@
 #
 
 require 'chef/knife'
+require 'chef/knife/data_bag_secret_options'
 
 class Chef
   class Knife
     class DataBagShow < Knife
+      include DataBagSecretOptions
 
       deps do
         require 'chef/data_bag'
@@ -31,45 +33,29 @@ class Chef
       banner "knife data bag show BAG [ITEM] (options)"
       category "data bag"
 
-      option :secret,
-        :short => "-s SECRET",
-        :long  => "--secret ",
-        :description => "The secret key to use to decrypt data bag item values",
-        :proc => Proc.new { |s| Chef::Config[:knife][:secret] = s }
-
-      option :secret_file,
-        :long => "--secret-file SECRET_FILE",
-        :description => "A file containing the secret key to use to decrypt data bag item values",
-        :proc => Proc.new { |sf| Chef::Config[:knife][:secret_file] = sf }
-
-      def read_secret
-        if config[:secret]
-          config[:secret]
-        else
-          Chef::EncryptedDataBagItem.load_secret(config[:secret_file])
-        end
-      end
-
-      def use_encryption
-        if config[:secret] && config[:secret_file]
-          stdout.puts "please specify only one of --secret, --secret-file"
-          exit(1)
-        end
-        config[:secret] || config[:secret_file]
-      end
-
       def run
         display = case @name_args.length
-        when 2
-          if use_encryption
+        when 2 # Bag and Item names provided
+          secret = encryption_secret_provided_ignore_encrypt_flag? ? read_secret : nil
+          raw_data = Chef::DataBagItem.load(@name_args[0], @name_args[1]).raw_data
+          encrypted = encrypted?(raw_data)
+
+          if encrypted && secret
+            # Users do not need to pass --encrypt to read data, we simply try to use the provided secret
+            ui.info("Encrypted data bag detected, decrypting with provided secret.")
             raw = Chef::EncryptedDataBagItem.load(@name_args[0],
                                                   @name_args[1],
-                                                  read_secret)
+                                                  secret)
             format_for_display(raw.to_hash)
+          elsif encrypted && !secret
+            ui.warn("Encrypted data bag detected, but no secret provided for decoding.  Displaying encrypted data.")
+            format_for_display(raw_data)
           else
-            format_for_display(Chef::DataBagItem.load(@name_args[0], @name_args[1]).raw_data)
+            ui.info("Unencrypted data bag detected, ignoring any provided secret options.")
+            format_for_display(raw_data)
           end
-        when 1
+
+        when 1 # Only Bag name provided
           format_list_for_display(Chef::DataBag.load(@name_args[0]))
         else
           stdout.puts opt_parser
@@ -77,7 +63,7 @@ class Chef
         end
         output(display)
       end
+
     end
   end
 end
-

data/lib/chef/knife/node_from_file.rb

@@ -35,16 +35,17 @@ class Chef
       end
 
       def run
-        updated = loader.load_from('nodes', @name_args[0])
-
-        updated.save
-
-        output(format_for_display(updated)) if config[:print_after]
-
-        ui.info("Updated Node #{updated.name}!")
+        @name_args.each do |arg|
+          updated = loader.load_from('nodes', arg)
+  
+          updated.save
+  
+          output(format_for_display(updated)) if config[:print_after]
+  
+          ui.info("Updated Node #{updated.name}!")
+        end
       end
 
     end
   end
 end
-

data/lib/chef/knife/ssh.rb

@@ -106,13 +106,6 @@ class Chef
       def session
         config[:on_error] ||= :skip
         ssh_error_handler = Proc.new do |server|
-          if config[:manual]
-            node_name = server.host
-          else
-            @action_nodes.each do |n|
-              node_name = n if format_for_display(n)[config[:attribute]] == server.host
-            end
-          end
           case config[:on_error]
           when :skip
             ui.warn "Failed to connect to #{server.host} -- #{$!.class.name}: #{$!.message}"

data/lib/chef/knife/ssl_check.rb

@@ -106,6 +106,22 @@ class Chef
         end
       end
 
+      def verify_X509
+        cert_debug_msg = ""
+        trusted_certificates.each do |cert_name|
+          message = check_X509_certificate(cert_name)
+          unless message.nil?
+            cert_debug_msg << File.expand_path(cert_name) + ": " + message + "\n"
+          end
+        end
+
+        unless cert_debug_msg.empty?
+          debug_invalid_X509(cert_debug_msg)
+        end
+
+        true # Maybe the bad certs won't hurt...
+      end
+
       def verify_cert
         ui.msg("Connecting to host #{host}:#{port}")
         verify_peer_socket.connect
@@ -127,6 +143,35 @@ class Chef
         false
       end
 
+      def debug_invalid_X509(cert_debug_msg)
+        ui.msg("\n#{ui.color("Configuration Info:", :bold)}\n\n")
+        debug_ssl_settings
+        debug_chef_ssl_config
+
+        ui.warn(<<-BAD_CERTS)
+There are invalid certificates in your trusted_certs_dir.
+OpenSSL will not use the following certificates when verifying SSL connections:
+
+#{cert_debug_msg}
+
+#{ui.color("TO FIX THESE WARNINGS:", :bold)}
+
+We are working on documentation for resolving common issues uncovered here.
+
+* If the certificate is generated by the server, you may try redownloading the
+server's certificate. By default, the certificate is stored in the following
+location on the host where your chef-server runs:
+
+  /var/opt/chef-server/nginx/ca/SERVER_HOSTNAME.crt
+
+Copy that file to your trusted_certs_dir (currently: #{configuration.trusted_certs_dir})
+using SSH/SCP or some other secure method, then re-run this command to confirm
+that the server's certificate is now trusted.
+
+BAD_CERTS
+        # @TODO: ^ needs URL once documentation is posted.
+      end
+
       def debug_invalid_cert
         noverify_socket.connect
         issuer_info = noverify_socket.peer_cert.issuer
@@ -148,7 +193,7 @@ where your chef-server runs:
 
   /var/opt/chef-server/nginx/ca/SERVER_HOSTNAME.crt
 
-Copy that file to you trusted_certs_dir (currently: #{configuration.trusted_certs_dir})
+Copy that file to your trusted_certs_dir (currently: #{configuration.trusted_certs_dir})
 using SSH/SCP or some other secure method, then re-run this command to confirm
 that the server's certificate is now trusted.
 
@@ -197,17 +242,36 @@ ADVICE
 
       def run
         validate_uri
-        if verify_cert && verify_cert_host
+        if verify_X509 && verify_cert && verify_cert_host
           ui.msg "Successfully verified certificates from `#{host}'"
         else
           exit 1
         end
       end
 
+      private
+      def trusted_certificates
+        if configuration.trusted_certs_dir && Dir.exist?(configuration.trusted_certs_dir)
+          Dir.glob(File.join(configuration.trusted_certs_dir, "*.{crt,pem}"))
+        else
+          []
+        end
+      end
+
+      def check_X509_certificate(cert_file)
+        store = OpenSSL::X509::Store.new
+        cert = OpenSSL::X509::Certificate.new(IO.read(File.expand_path(cert_file)))
+        begin
+          store.add_cert(cert)
+          # test if the store can verify the cert we just added
+          unless store.verify(cert) # true if verified, false if not
+            return store.error_string
+          end
+        rescue OpenSSL::X509::StoreError => e
+          return e.message
+        end
+        return nil
+      end
     end
   end
 end
-
-
-
-