chef 16.16.13 → 17.0.242

data/lib/chef/knife/ssl_check.rb

@@ -1,284 +0,0 @@
-#
-# Author:: Daniel DeLeo (<dan@chef.io>)
-# Copyright:: Copyright (c) Chef Software Inc.
-# License:: Apache License, Version 2.0
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-
-require_relative "../knife"
-require "chef-utils/dist" unless defined?(ChefUtils::Dist)
-
-class Chef
-  class Knife
-    class SslCheck < Chef::Knife
-
-      deps do
-        require_relative "../config"
-        require "pp" unless defined?(PP)
-        require "socket" unless defined?(Socket)
-        require "uri" unless defined?(URI)
-        require_relative "../http/ssl_policies"
-        require "openssl" unless defined?(OpenSSL)
-        require_relative "../mixin/proxified_socket"
-        include Chef::Mixin::ProxifiedSocket
-      end
-
-      banner "knife ssl check [URL] (options)"
-
-      def initialize(*args)
-        @host = nil
-        @verify_peer_socket = nil
-        @ssl_policy = HTTP::DefaultSSLPolicy
-        super
-      end
-
-      def uri
-        @uri ||= begin
-          Chef::Log.trace("Checking SSL cert on #{given_uri}")
-          URI.parse(given_uri)
-        end
-      end
-
-      def given_uri
-        (name_args[0] || Chef::Config.chef_server_url)
-      end
-
-      def host
-        uri.host
-      end
-
-      def port
-        uri.port
-      end
-
-      def validate_uri
-        unless host && port
-          invalid_uri!
-        end
-      rescue URI::Error
-        invalid_uri!
-      end
-
-      def invalid_uri!
-        ui.error("Given URI: `#{given_uri}' is invalid")
-        show_usage
-        exit 1
-      end
-
-      def verify_peer_socket
-        @verify_peer_socket ||= begin
-          tcp_connection = proxified_socket(host, port)
-          ssl_client = OpenSSL::SSL::SSLSocket.new(tcp_connection, verify_peer_ssl_context)
-          ssl_client.hostname = host
-          ssl_client
-        end
-      end
-
-      def verify_peer_ssl_context
-        @verify_peer_ssl_context ||= begin
-          verify_peer_context = OpenSSL::SSL::SSLContext.new
-          @ssl_policy.apply_to(verify_peer_context)
-          verify_peer_context.verify_mode = OpenSSL::SSL::VERIFY_PEER
-          verify_peer_context
-        end
-      end
-
-      def noverify_socket
-        @noverify_socket ||= begin
-          tcp_connection = proxified_socket(host, port)
-          OpenSSL::SSL::SSLSocket.new(tcp_connection, noverify_peer_ssl_context)
-        end
-      end
-
-      def noverify_peer_ssl_context
-        @noverify_peer_ssl_context ||= begin
-          noverify_peer_context = OpenSSL::SSL::SSLContext.new
-          @ssl_policy.apply_to(noverify_peer_context)
-          noverify_peer_context.verify_mode = OpenSSL::SSL::VERIFY_NONE
-          noverify_peer_context
-        end
-      end
-
-      def verify_X509
-        cert_debug_msg = ""
-        trusted_certificates.each do |cert_name|
-          message = check_X509_certificate(cert_name)
-          unless message.nil?
-            cert_debug_msg << File.expand_path(cert_name) + ": " + message + "\n"
-          end
-        end
-
-        unless cert_debug_msg.empty?
-          debug_invalid_X509(cert_debug_msg)
-        end
-
-        true # Maybe the bad certs won't hurt...
-      end
-
-      def verify_cert
-        ui.msg("Connecting to host #{host}:#{port}")
-        verify_peer_socket.connect
-        true
-      rescue OpenSSL::SSL::SSLError => e
-        ui.error "The SSL certificate of #{host} could not be verified"
-        Chef::Log.trace e.message
-        debug_invalid_cert
-        false
-      end
-
-      def verify_cert_host
-        verify_peer_socket.post_connection_check(host)
-        true
-      rescue OpenSSL::SSL::SSLError => e
-        ui.error "The SSL cert is signed by a trusted authority but is not valid for the given hostname"
-        Chef::Log.trace(e)
-        debug_invalid_host
-        false
-      end
-
-      def debug_invalid_X509(cert_debug_msg)
-        ui.msg("\n#{ui.color("Configuration Info:", :bold)}\n\n")
-        debug_ssl_settings
-        debug_chef_ssl_config
-
-        ui.warn(<<~BAD_CERTS)
-          There are invalid certificates in your trusted_certs_dir.
-          OpenSSL will not use the following certificates when verifying SSL connections:
-
-          #{cert_debug_msg}
-
-          #{ui.color("TO FIX THESE WARNINGS:", :bold)}
-
-          We are working on documentation for resolving common issues uncovered here.
-
-          * If the certificate is generated by the server, you may try redownloading the
-          server's certificate. By default, the certificate is stored in the following
-          location on the host where your chef-server runs:
-
-            /var/opt/opscode/nginx/ca/SERVER_HOSTNAME.crt
-
-          Copy that file to your trusted_certs_dir (currently: #{configuration.trusted_certs_dir})
-          using SSH/SCP or some other secure method, then re-run this command to confirm
-          that the server's certificate is now trusted.
-
-        BAD_CERTS
-        # @TODO: ^ needs URL once documentation is posted.
-      end
-
-      def debug_invalid_cert
-        noverify_socket.connect
-        issuer_info = noverify_socket.peer_cert.issuer
-        ui.msg("Certificate issuer data: #{issuer_info}")
-
-        ui.msg("\n#{ui.color("Configuration Info:", :bold)}\n\n")
-        debug_ssl_settings
-        debug_chef_ssl_config
-
-        ui.err(<<~ADVICE)
-
-          #{ui.color("TO FIX THIS ERROR:", :bold)}
-
-          If the server you are connecting to uses a self-signed certificate, you must
-          configure #{ChefUtils::Dist::Infra::PRODUCT} to trust that server's certificate.
-
-          By default, the certificate is stored in the following location on the host
-          where your chef-server runs:
-
-            /var/opt/opscode/nginx/ca/SERVER_HOSTNAME.crt
-
-          Copy that file to your trusted_certs_dir (currently: #{configuration.trusted_certs_dir})
-          using SSH/SCP or some other secure method, then re-run this command to confirm
-          that the server's certificate is now trusted.
-
-        ADVICE
-      end
-
-      def debug_invalid_host
-        noverify_socket.connect
-        subject = noverify_socket.peer_cert.subject
-        cn_field_tuple = subject.to_a.find { |field| field[0] == "CN" }
-        cn = cn_field_tuple[1]
-
-        ui.error("You are attempting to connect to:   '#{host}'")
-        ui.error("The server's certificate belongs to '#{cn}'")
-        ui.err(<<~ADVICE)
-
-          #{ui.color("TO FIX THIS ERROR:", :bold)}
-
-          The solution for this issue depends on your networking configuration. If you
-          are able to connect to this server using the hostname #{cn}
-          instead of #{host}, then you can resolve this issue by updating chef_server_url
-          in your configuration file.
-
-          If you are not able to connect to the server using the hostname #{cn}
-          you will have to update the certificate on the server to use the correct hostname.
-        ADVICE
-      end
-
-      def debug_ssl_settings
-        ui.err "OpenSSL Configuration:"
-        ui.err "* Version: #{OpenSSL::OPENSSL_VERSION}"
-        ui.err "* Certificate file: #{OpenSSL::X509::DEFAULT_CERT_FILE}"
-        ui.err "* Certificate directory: #{OpenSSL::X509::DEFAULT_CERT_DIR}"
-      end
-
-      def debug_chef_ssl_config
-        ui.err "#{ChefUtils::Dist::Infra::PRODUCT} SSL Configuration:"
-        ui.err "* ssl_ca_path: #{configuration.ssl_ca_path.inspect}"
-        ui.err "* ssl_ca_file: #{configuration.ssl_ca_file.inspect}"
-        ui.err "* trusted_certs_dir: #{configuration.trusted_certs_dir.inspect}"
-      end
-
-      def configuration
-        Chef::Config
-      end
-
-      def run
-        validate_uri
-
-        if verify_X509 && verify_cert && verify_cert_host
-          ui.msg "Successfully verified certificates from `#{host}'"
-        else
-          exit 1
-        end
-      end
-
-      private
-
-      def trusted_certificates
-        if configuration.trusted_certs_dir && Dir.exist?(configuration.trusted_certs_dir)
-          glob_dir = ChefConfig::PathHelper.escape_glob_dir(configuration.trusted_certs_dir)
-          Dir.glob(File.join(glob_dir, "*.{crt,pem}"))
-        else
-          []
-        end
-      end
-
-      def check_X509_certificate(cert_file)
-        store = OpenSSL::X509::Store.new
-        cert = OpenSSL::X509::Certificate.new(IO.read(File.expand_path(cert_file)))
-        begin
-          store.add_cert(cert)
-          # test if the store can verify the cert we just added
-          unless store.verify(cert) # true if verified, false if not
-            return store.error_string
-          end
-        rescue OpenSSL::X509::StoreError => e
-          return e.message
-        end
-        nil
-      end
-    end
-  end
-end

data/lib/chef/knife/ssl_fetch.rb

@@ -1,161 +0,0 @@
-#
-# Author:: Daniel DeLeo (<dan@chef.io>)
-# Copyright:: Copyright (c) Chef Software Inc.
-# License:: Apache License, Version 2.0
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-
-require_relative "../knife"
-
-class Chef
-  class Knife
-    class SslFetch < Chef::Knife
-
-      deps do
-        require_relative "../config"
-        require "pp" unless defined?(PP)
-        require "socket" unless defined?(Socket)
-        require "uri" unless defined?(URI)
-        require "openssl" unless defined?(OpenSSL)
-        require_relative "../mixin/proxified_socket"
-        include Chef::Mixin::ProxifiedSocket
-      end
-
-      banner "knife ssl fetch [URL] (options)"
-
-      def initialize(*args)
-        super
-        @uri = nil
-      end
-
-      def uri
-        @uri ||= begin
-          Chef::Log.trace("Checking SSL cert on #{given_uri}")
-          URI.parse(given_uri)
-        end
-      end
-
-      def given_uri
-        (name_args[0] || Chef::Config.chef_server_url)
-      end
-
-      def host
-        uri.host
-      end
-
-      def port
-        uri.port
-      end
-
-      def validate_uri
-        unless host && port
-          invalid_uri!
-        end
-      rescue URI::Error
-        invalid_uri!
-      end
-
-      def invalid_uri!
-        ui.error("Given URI: `#{given_uri}' is invalid")
-        show_usage
-        exit 1
-      end
-
-      def remote_cert_chain
-        tcp_connection = proxified_socket(host, port)
-        shady_ssl_connection = OpenSSL::SSL::SSLSocket.new(tcp_connection, noverify_peer_ssl_context)
-        shady_ssl_connection.connect
-        shady_ssl_connection.peer_cert_chain
-      end
-
-      def noverify_peer_ssl_context
-        @noverify_peer_ssl_context ||= begin
-          noverify_peer_context = OpenSSL::SSL::SSLContext.new
-          noverify_peer_context.verify_mode = OpenSSL::SSL::VERIFY_NONE
-          noverify_peer_context
-        end
-      end
-
-      def cn_of(certificate)
-        subject = certificate.subject
-        if cn_field_tuple = subject.to_a.find { |field| field[0] == "CN" }
-          cn_field_tuple[1]
-        else
-          nil
-        end
-      end
-
-      # Convert the CN of a certificate into something that will work well as a
-      # filename. To do so, all `*` characters are converted to the string
-      # "wildcard" and then all characters other than alphanumeric and hyphen
-      # characters are converted to underscores.
-      # NOTE: There is some confusion about what the CN will contain when
-      # using internationalized domain names. RFC 6125 mandates that the ascii
-      # representation be used, but it is not clear whether this is followed in
-      # practice.
-      # https://tools.ietf.org/html/rfc6125#section-6.4.2
-      def normalize_cn(cn)
-        cn.gsub("*", "wildcard").gsub(/[^[:alnum:]\-]/, "_")
-      end
-
-      def configuration
-        Chef::Config
-      end
-
-      def trusted_certs_dir
-        configuration.trusted_certs_dir
-      end
-
-      def write_cert(cert)
-        FileUtils.mkdir_p(trusted_certs_dir)
-        cn = cn_of(cert)
-        filename = cn.nil? ? "#{host}_#{Time.new.to_i}" : normalize_cn(cn)
-        full_path = File.join(trusted_certs_dir, "#{filename}.crt")
-        ui.msg("Adding certificate for #{filename} in #{full_path}")
-        File.open(full_path, File::CREAT | File::TRUNC | File::RDWR, 0644) do |f|
-          f.print(cert.to_s)
-        end
-      end
-
-      def run
-        validate_uri
-        ui.warn(<<~TRUST_TRUST)
-          Certificates from #{host} will be fetched and placed in your trusted_cert
-          directory (#{trusted_certs_dir}).
-
-          Knife has no means to verify these are the correct certificates. You should
-          verify the authenticity of these certificates after downloading.
-
-        TRUST_TRUST
-        remote_cert_chain.each do |cert|
-          write_cert(cert)
-        end
-      rescue OpenSSL::SSL::SSLError => e
-        # 'unknown protocol' usually means you tried to connect to a non-ssl
-        # service. We handle that specially here, any other error we let bubble
-        # up (probably a bug of some sort).
-        raise unless e.message.include?("unknown protocol")
-
-        ui.error("The service at the given URI (#{uri}) does not accept SSL connections")
-
-        if uri.scheme == "http"
-          https_uri = uri.to_s.sub(/^http/, "https")
-          ui.error("Perhaps you meant to connect to '#{https_uri}'?")
-        end
-        exit 1
-      end
-
-    end
-  end
-end

data/lib/chef/knife/status.rb

@@ -1,95 +0,0 @@
-#
-# Author:: Ian Meyer (<ianmmeyer@gmail.com>)
-# Copyright:: Copyright 2010-2020, Ian Meyer
-# License:: Apache License, Version 2.0
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-
-require_relative "../knife"
-require_relative "core/status_presenter"
-require_relative "core/formatting_options"
-require "chef-utils/dist" unless defined?(ChefUtils::Dist)
-
-class Chef
-  class Knife
-    class Status < Knife
-      include Knife::Core::FormattingOptions
-
-      deps do
-        require_relative "../search/query"
-      end
-
-      banner "knife status QUERY (options)"
-
-      option :run_list,
-        short: "-r",
-        long: "--run-list",
-        description: "Show the run list"
-
-      option :sort_reverse,
-        short: "-s",
-        long: "--sort-reverse",
-        description: "Sort the status list by last run time descending"
-
-      option :hide_by_mins,
-        long: "--hide-by-mins MINS",
-        description: "Hide nodes that have run #{ChefUtils::Dist::Infra::CLIENT} in the last MINS minutes"
-
-      def append_to_query(term)
-        @query << " AND " unless @query.empty?
-        @query << term
-      end
-
-      def run
-        ui.use_presenter Knife::Core::StatusPresenter
-
-        if config[:long_output]
-          opts = {}
-        else
-          opts = { filter_result:
-                 { name: ["name"], ipaddress: ["ipaddress"], ohai_time: ["ohai_time"],
-                   cloud: ["cloud"], run_list: ["run_list"], platform: ["platform"],
-                   platform_version: ["platform_version"], chef_environment: ["chef_environment"] } }
-        end
-
-        @query ||= ""
-        append_to_query(@name_args[0]) if @name_args[0]
-        append_to_query("chef_environment:#{config[:environment]}") if config[:environment]
-
-        if config[:hide_by_mins]
-          hide_by_mins = config[:hide_by_mins].to_i
-          time = Time.now.to_i
-          # AND NOT is not valid lucene syntax, so don't use append_to_query
-          @query << " " unless @query.empty?
-          @query << "NOT ohai_time:[#{(time - hide_by_mins * 60)} TO #{time}]"
-        end
-
-        @query = @query.empty? ? "*:*" : @query
-
-        all_nodes = []
-        q = Chef::Search::Query.new
-        Chef::Log.info("Sending query: #{@query}")
-        q.search(:node, @query, opts) do |node|
-          all_nodes << node
-        end
-
-        all_nodes.sort_by! { |n| n["ohai_time"] || 0 }
-        all_nodes.reverse! if config[:sort_reverse] || config[:sort_status_reverse]
-
-        output(all_nodes)
-      end
-
-    end
-  end
-end

data/lib/chef/knife/supermarket_download.rb

@@ -1,121 +0,0 @@
-#
-# Author:: Christopher Webber (<cwebber@chef.io>)
-# Copyright:: Copyright (c) Chef Software Inc.
-# License:: Apache License, Version 2.0
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-
-require_relative "../knife"
-
-class Chef
-  class Knife
-    class SupermarketDownload < Knife
-
-      banner "knife supermarket download COOKBOOK [VERSION] (options)"
-      category "supermarket"
-
-      deps do
-        require "fileutils" unless defined?(FileUtils)
-      end
-
-      option :file,
-        short: "-f FILE",
-        long: "--file FILE",
-        description: "The filename to write to."
-
-      option :force,
-        long: "--force",
-        description: "Force download deprecated version."
-
-      option :supermarket_site,
-        short: "-m SUPERMARKET_SITE",
-        long: "--supermarket-site SUPERMARKET_SITE",
-        description: "The URL of the Supermarket site.",
-        default: "https://supermarket.chef.io"
-
-      def run
-        if current_cookbook_deprecated?
-          message = "DEPRECATION: This cookbook has been deprecated. "
-          replacement = replacement_cookbook
-          if !replacement.to_s.strip.empty?
-            message << "It has been replaced by #{replacement}."
-          else
-            message << "No replacement has been defined."
-          end
-          ui.warn message
-
-          unless config[:force]
-            ui.warn "Use --force to force download deprecated cookbook."
-            return
-          end
-        end
-
-        download_cookbook
-      end
-
-      def version
-        @version = desired_cookbook_data["version"]
-      end
-
-      private
-
-      def cookbooks_api_url
-        "#{config[:supermarket_site]}/api/v1/cookbooks"
-      end
-
-      def current_cookbook_data
-        @current_cookbook_data ||= begin
-                                     noauth_rest.get "#{cookbooks_api_url}/#{@name_args[0]}"
-                                   end
-      end
-
-      def current_cookbook_deprecated?
-        current_cookbook_data["deprecated"] == true
-      end
-
-      def desired_cookbook_data
-        @desired_cookbook_data ||= begin
-                                     uri = if @name_args.length == 1
-                                             current_cookbook_data["latest_version"]
-                                           else
-                                             specific_cookbook_version_url
-                                           end
-
-                                     noauth_rest.get uri
-                                   end
-      end
-
-      def download_cookbook
-        ui.info "Downloading #{@name_args[0]} from Supermarket at version #{version} to #{download_location}"
-        tf = noauth_rest.streaming_request(desired_cookbook_data["file"])
-
-        ::FileUtils.cp tf.path, download_location
-        ui.info "Cookbook saved: #{download_location}"
-      end
-
-      def download_location
-        config[:file] ||= File.join Dir.pwd, "#{@name_args[0]}-#{version}.tar.gz"
-        config[:file]
-      end
-
-      def replacement_cookbook
-        File.basename(current_cookbook_data["replacement"] || "")
-      end
-
-      def specific_cookbook_version_url
-        "#{cookbooks_api_url}/#{@name_args[0]}/versions/#{@name_args[1].tr(".", "_")}"
-      end
-    end
-  end
-end