chef 18.0.169-x64-mingw-ucrt

data/lib/chef/resource/openssl_x509_certificate.rb

@@ -0,0 +1,262 @@
+#
+# License:: Apache License, Version 2.0
+# Author:: Julien Huon
+# Copyright:: Copyright (c) Chef Software Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+require_relative "../resource"
+
+class Chef
+  class Resource
+    class OpensslX509Certificate < Chef::Resource
+      require_relative "../mixin/openssl_helper"
+      include Chef::Mixin::OpenSSLHelper
+
+      provides :openssl_x509_certificate
+      provides(:openssl_x509) { true } # legacy cookbook name.
+
+      description "Use the **openssl_x509_certificate** resource to generate signed or self-signed, PEM-formatted x509 certificates. If no existing key is specified, the resource will automatically generate a passwordless key with the certificate. If a CA private key and certificate are provided, the certificate will be signed with them. Note: This resource was renamed from openssl_x509 to openssl_x509_certificate. The legacy name will continue to function, but cookbook code should be updated for the new resource name."
+      introduced "14.4"
+      examples <<~DOC
+        Create a simple self-signed certificate file
+
+        ```ruby
+        openssl_x509_certificate '/etc/httpd/ssl/mycert.pem' do
+          common_name 'www.f00bar.com'
+          org 'Foo Bar'
+          org_unit 'Lab'
+          country 'US'
+        end
+        ```
+
+        Create a certificate using additional options
+
+        ```ruby
+        openssl_x509_certificate '/etc/ssl_files/my_signed_cert.crt' do
+          common_name 'www.f00bar.com'
+          ca_key_file '/etc/ssl_files/my_ca.key'
+          ca_cert_file '/etc/ssl_files/my_ca.crt'
+          expire 365
+          extensions(
+            'keyUsage' => {
+              'values' => %w(
+                keyEncipherment
+                digitalSignature),
+              'critical' => true,
+            },
+            'extendedKeyUsage' => {
+              'values' => %w(serverAuth),
+              'critical' => false,
+            }
+          )
+          subject_alt_name ['IP:127.0.0.1', 'DNS:localhost.localdomain']
+        end
+        ```
+      DOC
+
+      property :path, String,
+        description: "An optional property for specifying the path to write the file to if it differs from the resource block's name.",
+        name_property: true
+
+      property :owner, [String, Integer],
+        description: "The owner applied to all files created by the resource."
+
+      property :group, [String, Integer],
+        description: "The group ownership applied to all files created by the resource."
+
+      property :expire, Integer,
+        description: "Value representing the number of days from now through which the issued certificate cert will remain valid. The certificate will expire after this period.",
+        default: 365
+
+      property :mode, [Integer, String],
+        description: "The permission mode applied to all files created by the resource."
+
+      property :country, String,
+        description: "Value for the `C` certificate field."
+
+      property :state, String,
+        description: "Value for the `ST` certificate field."
+
+      property :city, String,
+        description: "Value for the `L` certificate field."
+
+      property :org, String,
+        description: "Value for the `O` certificate field."
+
+      property :org_unit, String,
+        description: "Value for the `OU` certificate field."
+
+      property :common_name, String,
+        description: "Value for the `CN` certificate field."
+
+      property :email, String,
+        description: "Value for the `email` certificate field."
+
+      property :extensions, Hash,
+        description: "Hash of X509 Extensions entries, in format `{ 'keyUsage' => { 'values' => %w( keyEncipherment digitalSignature), 'critical' => true } }`.",
+        default: {}
+
+      property :subject_alt_name, Array,
+        description: "Array of Subject Alternative Name entries, in format `DNS:example.com` or `IP:1.2.3.4`.",
+        default: []
+
+      property :key_file, String,
+        description: "The path to a certificate key file on the filesystem. If the key_file property is specified, the resource will attempt to source a key from this location. If no key file is found, the resource will generate a new key file at this location. If the key_file property is not specified, the resource will generate a key file in the same directory as the generated certificate, with the same name as the generated certificate."
+
+      property :key_pass, String,
+        description: "The passphrase for an existing key's passphrase."
+
+      property :key_type, String,
+        equal_to: %w{rsa ec},
+        description: "The desired type of the generated key.",
+        default: "rsa"
+
+      property :key_length, Integer,
+        equal_to: [1024, 2048, 4096, 8192],
+        description: "The desired bit length of the generated key (if key_type is equal to 'rsa').",
+        default: 2048
+
+      property :key_curve, String,
+        description: "The desired curve of the generated key (if key_type is equal to 'ec'). Run `openssl ecparam -list_curves` to see available options.",
+        equal_to: %w{secp384r1 secp521r1 prime256v1},
+        default: "prime256v1"
+
+      property :csr_file, String,
+        description: "The path to a X509 Certificate Request (CSR) on the filesystem. If the `csr_file` property is specified, the resource will attempt to source a CSR from this location. If no CSR file is found, the resource will generate a Self-Signed Certificate and the certificate fields must be specified (common_name at last)."
+
+      property :ca_cert_file, String,
+        description: "The path to the CA X509 Certificate on the filesystem. If the `ca_cert_file` property is specified, the `ca_key_file` property must also be specified, the certificate will be signed with them."
+
+      property :ca_key_file, String,
+        description: "The path to the CA private key on the filesystem. If the `ca_key_file` property is specified, the `ca_cert_file` property must also be specified, the certificate will be signed with them."
+
+      property :ca_key_pass, String,
+        description: "The passphrase for CA private key's passphrase."
+
+      property :renew_before_expiry, Integer,
+        description: "The number of days before the expiry. The certificate will be automatically renewed when the value is reached.",
+        introduced: "15.7"
+
+      action :create, description: "Generate a certificate file." do
+        file new_resource.path do
+          action :create_if_missing
+          owner new_resource.owner unless new_resource.owner.nil?
+          group new_resource.group unless new_resource.group.nil?
+          mode new_resource.mode unless new_resource.mode.nil?
+          content cert.to_pem
+        end
+
+        if !new_resource.renew_before_expiry.nil? && cert_need_renewal?(new_resource.path, new_resource.renew_before_expiry)
+          file new_resource.path do
+            action :create
+            owner new_resource.owner unless new_resource.owner.nil?
+            group new_resource.group unless new_resource.group.nil?
+            mode new_resource.mode unless new_resource.mode.nil?
+            sensitive true
+            content cert.to_pem
+          end
+        end
+
+        if new_resource.csr_file.nil?
+          file key_file do
+            action :create_if_missing
+            owner new_resource.owner unless new_resource.owner.nil?
+            group new_resource.group unless new_resource.group.nil?
+            mode new_resource.mode unless new_resource.mode.nil?
+            sensitive true
+            content key.to_pem
+          end
+        end
+      end
+
+      action_class do
+        def key_file
+          @key_file ||=
+            if new_resource.key_file
+              new_resource.key_file
+            else
+              path, file = ::File.split(new_resource.path)
+              filename = ::File.basename(file, ::File.extname(file))
+              path + "/" + filename + ".key"
+            end
+        end
+
+        def key
+          @key ||= if priv_key_file_valid?(key_file, new_resource.key_pass)
+                     OpenSSL::PKey.read ::File.read(key_file), new_resource.key_pass
+                   elsif new_resource.key_type == "rsa"
+                     gen_rsa_priv_key(new_resource.key_length)
+                   else
+                     gen_ec_priv_key(new_resource.key_curve)
+                   end
+        end
+
+        def request
+          if new_resource.csr_file.nil?
+            gen_x509_request(subject, key)
+          else
+            OpenSSL::X509::Request.new ::File.read(new_resource.csr_file)
+          end
+        end
+
+        def subject
+          OpenSSL::X509::Name.new.tap do |csr_subject|
+            csr_subject.add_entry("C", new_resource.country) unless new_resource.country.nil?
+            csr_subject.add_entry("ST", new_resource.state) unless new_resource.state.nil?
+            csr_subject.add_entry("L", new_resource.city) unless new_resource.city.nil?
+            csr_subject.add_entry("O", new_resource.org) unless new_resource.org.nil?
+            csr_subject.add_entry("OU", new_resource.org_unit) unless new_resource.org_unit.nil?
+            csr_subject.add_entry("CN", new_resource.common_name)
+            csr_subject.add_entry("emailAddress", new_resource.email) unless new_resource.email.nil?
+          end
+        end
+
+        def ca_private_key
+          if new_resource.ca_key_file.nil?
+            key
+          else
+            OpenSSL::PKey.read ::File.read(new_resource.ca_key_file), new_resource.ca_key_pass
+          end
+        end
+
+        def ca_info
+          # Will contain issuer (if any) & expiration
+          ca_info = {}
+
+          unless new_resource.ca_cert_file.nil?
+            ca_info["issuer"] = OpenSSL::X509::Certificate.new ::File.read(new_resource.ca_cert_file)
+          end
+          ca_info["validity"] = new_resource.expire
+
+          ca_info
+        end
+
+        def extensions
+          extensions = gen_x509_extensions(new_resource.extensions)
+
+          unless new_resource.subject_alt_name.empty?
+            extensions += gen_x509_extensions("subjectAltName" => { "values" => new_resource.subject_alt_name, "critical" => false })
+          end
+
+          extensions
+        end
+
+        def cert
+          gen_x509_cert(request, extensions, ca_info, ca_private_key)
+        end
+      end
+    end
+  end
+end

data/lib/chef/resource/openssl_x509_crl.rb

@@ -0,0 +1,148 @@
+#
+# License:: Apache License, Version 2.0
+# Author:: Julien Huon
+# Copyright:: Copyright (c) Chef Software Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+require_relative "../resource"
+
+class Chef
+  class Resource
+    class OpensslX509Crl < Chef::Resource
+      require_relative "../mixin/openssl_helper"
+      include Chef::Mixin::OpenSSLHelper
+
+      provides :openssl_x509_crl
+
+      description "Use the **openssl_x509_crl** resource to generate PEM-formatted x509 certificate revocation list (CRL) files."
+      introduced "14.4"
+      examples <<~DOC
+      **Create a certificate revocation file**
+
+      ```ruby
+      openssl_x509_crl '/etc/ssl_test/my_ca.crl' do
+        ca_cert_file '/etc/ssl_test/my_ca.crt'
+        ca_key_file '/etc/ssl_test/my_ca.key'
+      end
+      ```
+
+      **Create a certificate revocation file for a particular serial**
+
+      ```ruby
+      openssl_x509_crl '/etc/ssl_test/my_ca.crl' do
+        ca_cert_file '/etc/ssl_test/my_ca.crt'
+        ca_key_file '/etc/ssl_test/my_ca.key'
+        serial_to_revoke C7BCB6602A2E4251EF4E2827A228CB52BC0CEA2F
+      end
+      ```
+      DOC
+
+      property :path, String,
+        description: "An optional property for specifying the path to write the file to if it differs from the resource block's name.",
+        name_property: true
+
+      property :serial_to_revoke, [Integer, String],
+        description: "Serial of the X509 Certificate to revoke."
+
+      property :revocation_reason, Integer,
+        description: "Reason for the revocation.",
+        default: 0
+
+      property :expire, Integer,
+        description: "Value representing the number of days from now through which the issued CRL will remain valid. The CRL will expire after this period.",
+        default: 8
+
+      property :renewal_threshold, Integer,
+        description: "Number of days before the expiration. It this threshold is reached, the CRL will be renewed.",
+        default: 1
+
+      property :ca_cert_file, String,
+        description: "The path to the CA X509 Certificate on the filesystem. If the `ca_cert_file` property is specified, the `ca_key_file` property must also be specified, the CRL will be signed with them.",
+        required: true
+
+      property :ca_key_file, String,
+        description: "The path to the CA private key on the filesystem. If the `ca_key_file` property is specified, the `ca_cert_file` property must also be specified, the CRL will be signed with them.",
+        required: true
+
+      property :ca_key_pass, String,
+        description: "The passphrase for CA private key's passphrase."
+
+      property :owner, [String, Integer],
+        description: "The owner permission for the CRL file."
+
+      property :group, [String, Integer],
+        description: "The group permission for the CRL file."
+
+      property :mode, [Integer, String],
+        description: "The permission mode of the CRL file."
+
+      action :create, description: "Create the certificate revocation list (CRL) file." do
+        file new_resource.path do
+          owner new_resource.owner unless new_resource.owner.nil?
+          group new_resource.group unless new_resource.group.nil?
+          mode new_resource.mode unless new_resource.mode.nil?
+          content crl.to_pem
+          action :create
+        end
+      end
+
+      action_class do
+        def crl_info
+          # Will contain issuer & expiration
+          crl_info = {}
+
+          crl_info["issuer"] = ::OpenSSL::X509::Certificate.new ::File.read(new_resource.ca_cert_file)
+          crl_info["validity"] = new_resource.expire
+
+          crl_info
+        end
+
+        def revoke_info
+          # Will contain Serial to revoke & reason
+          revoke_info = {}
+
+          revoke_info["serial"] = new_resource.serial_to_revoke
+          revoke_info["reason"] = new_resource.revocation_reason
+
+          revoke_info
+        end
+
+        def ca_private_key
+          ::OpenSSL::PKey.read ::File.read(new_resource.ca_key_file), new_resource.ca_key_pass
+        end
+
+        def crl
+          if crl_file_valid?(new_resource.path)
+            crl = ::OpenSSL::X509::CRL.new ::File.read(new_resource.path)
+          else
+            log "Creating a CRL #{new_resource.path} for CA #{new_resource.ca_cert_file}"
+            crl = gen_x509_crl(ca_private_key, crl_info)
+          end
+
+          if !new_resource.serial_to_revoke.nil? && serial_revoked?(crl, new_resource.serial_to_revoke) == false
+            log "Revoking serial #{new_resource.serial_to_revoke} in CRL #{new_resource.path}"
+            crl = revoke_x509_crl(revoke_info, crl, ca_private_key, crl_info)
+          elsif crl.next_update <= Time.now + 3600 * 24 * new_resource.renewal_threshold
+            log "Renewing CRL for CA #{new_resource.ca_cert_file}"
+            crl = renew_x509_crl(crl, ca_private_key, crl_info)
+          end
+
+          crl
+        end
+      end
+
+    end
+  end
+end

data/lib/chef/resource/openssl_x509_request.rb

@@ -0,0 +1,183 @@
+#
+# License:: Apache License, Version 2.0
+# Author:: Julien Huon
+# Copyright:: Copyright (c) Chef Software Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+require_relative "../resource"
+
+class Chef
+  class Resource
+    class OpensslX509Request < Chef::Resource
+      require_relative "../mixin/openssl_helper"
+      include Chef::Mixin::OpenSSLHelper
+
+      provides :openssl_x509_request
+
+      description "Use the **openssl_x509_request** resource to generate PEM-formatted x509 certificates requests. If no existing key is specified, the resource will automatically generate a passwordless key with the certificate."
+      introduced "14.4"
+      examples <<~DOC
+        **Generate new EC key and CSR file**
+
+        ```ruby
+        openssl_x509_request '/etc/ssl_files/my_ec_request.csr' do
+          common_name 'myecrequest.example.com'
+          org 'Test Kitchen Example'
+          org_unit 'Kitchens'
+          country 'UK'
+        end
+        ```
+
+        **Generate a new CSR file from an existing EC key**
+
+        ```ruby
+        openssl_x509_request '/etc/ssl_files/my_ec_request2.csr' do
+          common_name 'myecrequest2.example.com'
+          org 'Test Kitchen Example'
+          org_unit 'Kitchens'
+          country 'UK'
+          key_file '/etc/ssl_files/my_ec_request.key'
+        end
+        ```
+
+        **Generate new RSA key and CSR file**
+
+        ```ruby
+        openssl_x509_request '/etc/ssl_files/my_rsa_request.csr' do
+          common_name 'myrsarequest.example.com'
+          org 'Test Kitchen Example'
+          org_unit 'Kitchens'
+          country 'UK'
+          key_type 'rsa'
+        end
+        ```
+      DOC
+
+      property :path, String, name_property: true,
+               description: "An optional property for specifying the path to write the file to if it differs from the resource block's name."
+
+      property :owner, [String, Integer],
+        description: "The owner applied to all files created by the resource."
+
+      property :group, [String, Integer],
+        description: "The group ownership applied to all files created by the resource."
+
+      property :mode, [Integer, String],
+        description: "The permission mode applied to all files created by the resource."
+
+      property :country, String,
+        description: "Value for the `C` certificate field."
+
+      property :state, String,
+        description: "Value for the `ST` certificate field."
+
+      property :city, String,
+        description: "Value for the `L` certificate field."
+
+      property :org, String,
+        description: "Value for the `O` certificate field."
+
+      property :org_unit, String,
+        description: "Value for the `OU` certificate field."
+
+      property :common_name, String,
+        required: true,
+        description: "Value for the `CN` certificate field."
+
+      property :email, String,
+        description: "Value for the `email` certificate field."
+
+      property :key_file, String,
+        description: "The path to a certificate key file on the filesystem. If the `key_file` property is specified, the resource will attempt to source a key from this location. If no key file is found, the resource will generate a new key file at this location. If the `key_file` property is not specified, the resource will generate a key file in the same directory as the generated certificate, with the same name as the generated certificate."
+
+      property :key_pass, String,
+        description: "The passphrase for an existing key's passphrase."
+
+      property :key_type, String,
+        equal_to: %w{rsa ec}, default: "ec",
+        description: "The desired type of the generated key."
+
+      property :key_length, Integer,
+        equal_to: [1024, 2048, 4096, 8192], default: 2048,
+        description: "The desired bit length of the generated key (if key_type is equal to `rsa`)."
+
+      property :key_curve, String,
+        equal_to: %w{secp384r1 secp521r1 prime256v1}, default: "prime256v1",
+        description: "The desired curve of the generated key (if key_type is equal to `ec`). Run `openssl ecparam -list_curves` to see available options."
+
+      action :create, description: "Generate a certificate request file." do
+        unless ::File.exist? new_resource.path
+          converge_by("Create CSR #{@new_resource}") do
+            file new_resource.path do
+              owner new_resource.owner unless new_resource.owner.nil?
+              group new_resource.group unless new_resource.group.nil?
+              mode new_resource.mode unless new_resource.mode.nil?
+              content csr.to_pem
+              action :create
+            end
+
+            file key_file do
+              owner new_resource.owner unless new_resource.owner.nil?
+              group new_resource.group unless new_resource.group.nil?
+              mode new_resource.mode unless new_resource.mode.nil?
+              content key.to_pem
+              sensitive true
+              action :create_if_missing
+            end
+          end
+        end
+      end
+
+      action_class do
+        def key_file
+          @key_file ||=
+            if new_resource.key_file
+              new_resource.key_file
+            else
+              path, file = ::File.split(new_resource.path)
+              filename = ::File.basename(file, ::File.extname(file))
+              path + "/" + filename + ".key"
+            end
+        end
+
+        def key
+          @key ||= if priv_key_file_valid?(key_file, new_resource.key_pass)
+                     OpenSSL::PKey.read ::File.read(key_file), new_resource.key_pass
+                   elsif new_resource.key_type == "rsa"
+                     gen_rsa_priv_key(new_resource.key_length)
+                   else
+                     gen_ec_priv_key(new_resource.key_curve)
+                   end
+        end
+
+        def subject
+          OpenSSL::X509::Name.new.tap do |csr_subject|
+            csr_subject.add_entry("C", new_resource.country) unless new_resource.country.nil?
+            csr_subject.add_entry("ST", new_resource.state) unless new_resource.state.nil?
+            csr_subject.add_entry("L", new_resource.city) unless new_resource.city.nil?
+            csr_subject.add_entry("O", new_resource.org) unless new_resource.org.nil?
+            csr_subject.add_entry("OU", new_resource.org_unit) unless new_resource.org_unit.nil?
+            csr_subject.add_entry("CN", new_resource.common_name)
+            csr_subject.add_entry("emailAddress", new_resource.email) unless new_resource.email.nil?
+          end
+        end
+
+        def csr
+          gen_x509_request(subject, key)
+        end
+      end
+    end
+  end
+end