hammer_cli 0.10.1 → 0.10.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: a51bb0421b077ec5f6b58516eb36bfb36593543a
-  data.tar.gz: e10795cc718d474a9b71e084472c2e9455bcc208
+  metadata.gz: 230906bc19a41759805ad05e51cee6244938cc5e
+  data.tar.gz: 7e4389026de508ce212c3af34823bc1606b6851e
 SHA512:
-  metadata.gz: 177b9fe7bcfc57623a87fe32890a44ffe8ce2ed9c25bdcde061c87670fb8a1a6e5cf5993046262eabbf993984621e119fda6ec72ce880531f998893da80c6a9d
-  data.tar.gz: 37f64d084f60e2e87fa99ac7f1b2ffe670a7577ec715e349439dce07432d9deee7e2193b16be8b35c896d75777a7dd0e55360b2c8e529b2ffbebb8adf2ac2df4
+  metadata.gz: 55c6841e58e1645e48eb83e147d662abc847cf99f18df1f5636b6fb9a09be79e133d99429fa626c3e6ca2456003091e7e74f2813ac43dc22ee163c0f2862b54d
+  data.tar.gz: ddeec7d17a560050722bddc473bbc2ff8bba5e967c3cf3f7772249fcf300ca38d03db2f5d8d75df0be5e1b10025eafeef257bf4b8ca5280d71720537ea0e6a0f

data/bin/hammer

@@ -125,7 +125,7 @@ require 'hammer_cli'
 
 if preparser.fetch_ca_cert
   require 'hammer_cli/ca_cert_fetcher'
-  ca_path = HammerCLI::SSLOptions.get_options[:ssl_ca_path]
+  ca_path = HammerCLI::SSLOptions.new.get_local_ca_store_path
   exit HammerCLI::CACertFetcher.new.fetch_ca_cert(preparser.fetch_ca_cert, ca_path)
 end
 

data/config/cli_config.template.yml

@@ -38,7 +38,7 @@
   #:ssl_ca_file: '/path/to/ca_certificate.pem'
 
   # Path to a direcotry with ca file
-  #:ssl_ca_path: '~/.hammer/certs'
+  #:ssl_ca_path: '/path/to/ca'
 
   # Turn SSL verification on/off
   #:verify_ssl: true
@@ -51,3 +51,6 @@
 
   # Enable standard authentication in addition to client certificate authentication
   #:ssl_with_basic_auth: true
+
+  # local CA cert store path
+  #:local_ca_store_path: '~/.hammer/certs'

data/doc/release_notes.md

@@ -1,6 +1,11 @@
 Release notes
 =============
 
+### 0.10.2 (2017-05-05)
+* Retry command on session expiry ([#19431](http://projects.theforeman.org/issues/19431))
+* Prevent fetching of non-CA certificates ([#19391](http://projects.theforeman.org/issues/19391))
+* Use local ca cert store instead of ssl_ca_path ([#19390](http://projects.theforeman.org/issues/19390))
+
 ### 0.10.1 (2017-04-24)
 * Require apipie-bindings >= 0.2.0 ([#19083](http://projects.theforeman.org/issues/19083))
 * Install server CA cert without root access ([#19083](http://projects.theforeman.org/issues/19083))

data/lib/hammer_cli/abstract.rb

@@ -24,11 +24,16 @@ module HammerCLI
     end
 
     def run(arguments)
-      exit_code = super
-      raise "exit code must be integer" unless exit_code.is_a? Integer
+      begin
+        begin
+          exit_code = super
+          raise "exit code must be integer" unless exit_code.is_a? Integer
+        rescue => e
+          exit_code = handle_exception(e)
+        end
+        logger.debug 'Retrying the command' if (exit_code == HammerCLI::EX_RETRY)
+      end while (exit_code == HammerCLI::EX_RETRY)
       return exit_code
-    rescue => e
-      handle_exception e
     end
 
     def parse(arguments)

data/lib/hammer_cli/apipie/api_connection.rb

@@ -7,7 +7,7 @@ module HammerCLI::Apipie
 
     def initialize(params, options = {})
       @logger = options[:logger]
-      @api = ApipieBindings::API.new(params, HammerCLI::SSLOptions.get_options)
+      @api = ApipieBindings::API.new(params, HammerCLI::SSLOptions.new.get_options(params[:uri]))
       if options[:reload_cache]
         @api.clean_cache
         @logger.debug 'Apipie cache was cleared' unless @logger.nil?

data/lib/hammer_cli/ca_cert_fetcher.rb

@@ -1,13 +1,13 @@
 require 'hammer_cli/ca_cert_manager'
 module HammerCLI
   class CACertFetcher
-    def fetch_ca_cert(service_uri, ca_path)
+    def fetch_ca_cert(service_uri, ca_store_path)
       begin
         uri = URI.parse(service_uri)
         raise URI::InvalidURIError.new(_("Unable to find hostname in #{service_uri}")) if uri.host.nil?
         raise URI::InvalidURIError.new(scheme_error(uri)) unless uri.scheme == 'https'
-        ca_cert_manager = HammerCLI::CACertManager.new(ca_path)
-        raw_cert = HammerCLI::CACertDownloader.new.download(uri)
+        ca_cert_manager = HammerCLI::CACertManager.new(ca_store_path)
+        raw_cert = HammerCLI::CertDownloader.new.download(uri)
         cert_file = ca_cert_manager.cert_file_name(uri)
         ca_cert_manager.store_ca_cert(raw_cert, cert_file)
 
@@ -17,8 +17,9 @@ module HammerCLI
         deb_update_cmd = "update-ca-certificates"
         cert_file = ca_cert_manager.cert_file_name(uri)
 
-        puts _("CA certificate for #{service_uri} was stored to #{cert_file}")
+        puts _("CA certificate for %{uri} was stored to %{file}") % {:uri => service_uri, :file => cert_file}
         puts _("Now hammer can use the downloaded certificate to verify SSL connection to the server.")
+        puts _("It will be used automatically when ssl_ca_path and ssl_ca_file options are not set.")
         puts
         puts _("Be aware that hammer cannot verify whether the certificate is correct and you should verify its authenticity.")
         puts
@@ -44,6 +45,16 @@ module HammerCLI
         $stderr.puts _("Couldn't parse URI '%s'.") % service_uri
         $stderr.puts e.message
         return HammerCLI::EX_SOFTWARE
+      rescue HammerCLI::NoCACertificate => e
+        $stderr.puts _("The CA certificate for %{uri} couldn't be downloaded. No CA cert was found.") % {:uri => service_uri}
+        $stderr.puts
+        $stderr.puts _("Make sure your server sends cert chain including the CA.")
+        $stderr.puts _("To see the actual chain you can use openssl command")
+        $stderr.puts "  $ openssl s_client -showcerts -connect #{uri.host}:#{uri.port} </dev/null"
+        $stderr.puts
+        $stderr.puts _("You can also download the certificate manually and store it as #{cert_file}")
+        $stderr.puts _("If you choose any other location set the ssl_ca_path or ssl_ca_file configuration options appropriately.")
+        return HammerCLI::EX_SOFTWARE
       rescue StandardError => e
         logger = Logging.logger['CACertFetcher']
         msg = [_('Fetching the CA certificate failed:')]

data/lib/hammer_cli/ca_cert_manager.rb

@@ -2,58 +2,43 @@ require 'fileutils'
 
 module HammerCLI
   class CACertManager
-    attr_reader :ca_path
+    attr_reader :ca_store_path
 
-    def initialize(ca_path)
-      @ca_path = ca_path
+    def initialize(ca_store_path)
+      @ca_store_path = File.expand_path(ca_store_path)
     end
 
     def store_ca_cert(raw_cert, cert_file)
-      ensure_ca_path_exist
+      raise HammerCLI::NoCACertificate.new unless is_ca_cert?(raw_cert)
+      ensure_ca_store_exist
       File.write(cert_file, raw_cert)
-      hash = cert_hash(raw_cert)
-      create_link(hash, cert_file)
       cert_file
     end
 
-    def cert_hash(raw_cert)
-      cert = OpenSSL::X509::Certificate.new(raw_cert)
-      subject = OpenSSL::X509::Name.new(cert.subject)
-      subject.hash
-    end
-
-    def create_link(hash, cert_file)
-      ensure_ca_path_exist
-      cert_link = File.join(ca_path, "#{hash.to_s(16)}.%s")
-      count = 0
-      # increase hash index if file or link to different target already exist
-      while plain_file?(cert_link % count) || link_to_different_target?(cert_link % count, cert_file) do
-        count += 1
-      end
-      File.symlink(cert_file, cert_link % count) unless File.symlink?(cert_link % count)
+    def cert_file_name(uri)
+      File.join(ca_store_path, "#{uri.host}_#{uri.port}.pem")
     end
 
-    def cert_file_name(uri)
-      File.join(ca_path, "#{uri.host}.pem")
+    def cert_exist?(uri)
+      File.exist?(cert_file_name(uri))
     end
 
     protected
 
-
-    def ensure_ca_path_exist
-      FileUtils.mkpath(ca_path) unless File.directory?(ca_path)
-    end
-
-    def plain_file?(path)
-      File.exist?(path) && !File.symlink?(path)
+    def ensure_ca_store_exist
+      FileUtils.mkpath(ca_store_path) unless File.directory?(ca_store_path)
     end
 
-    def link_to_different_target?(path, target)
-      File.symlink?(path) && File.expand_path(File.readlink(path)) != File.expand_path(target)
+    def is_ca_cert?(cert)
+      cert = OpenSSL::X509::Certificate.new(cert) if cert.is_a? String
+      cert.extensions.any? do |ex|
+        (ex.oid == 'basicConstraints' && ex.value.upcase == 'CA:TRUE') ||
+            (ex.oid == 'keyUsage' && ex.value =~ /Cert(ificate )?Sign/i)
+      end
     end
   end
 
-  class CACertDownloader
+  class CertDownloader
     def download(uri)
       noverify_ssl_connection = OpenSSL::SSL::SSLSocket.new(TCPSocket.new(uri.host, uri.port), noverify_ssl_context)
       noverify_ssl_connection.connect

data/lib/hammer_cli/exceptions.rb

@@ -4,5 +4,6 @@ module HammerCLI
   class OperationNotSupportedError < StandardError; end
   class ModuleLoadingError < StandardError; end
   class ModuleDisabledButRequired < StandardError; end
+  class NoCACertificate < StandardError; end
 
 end

data/lib/hammer_cli/exit_codes.rb

@@ -4,7 +4,7 @@ module HammerCLI
   EX_USAGE        = 64      # command line usage error
   EX_DATAERR      = 65      # data format error
   EX_NOINPUT      = 66      # cannot open input
-  EX_NOUSER       = 67      # addressee unknown 
+  EX_NOUSER       = 67      # addressee unknown
   EX_NOHOST       = 68      # host name unknown
   EX_UNAVAILABLE  = 69      # service unavailable
   EX_SOFTWARE     = 70      # internal software error
@@ -20,4 +20,5 @@ module HammerCLI
   # non POSIX codes
   EX_NOT_FOUND    = 128     # resource was not found
   EX_UNAUTHORIZED = 129     # authorization failed
+  EX_RETRY        = 666     # retry the command
 end

data/lib/hammer_cli/ssloptions.rb

@@ -1,17 +1,18 @@
 module HammerCLI
   class SSLOptions
-    DEFAULT_SSL_CA_PATH = "~/.hammer/certs"
+    DEFAULT_LOCAL_CA_STORE_PATH = "~/.hammer/certs"
 
-    def initialize(settings = HammerCLI::Settings, logger = Logging.logger['SSLoptions'])
-      @settings = settings
-      @logger = logger
+    def initialize(options={})
+      @settings = options.fetch(:settings, HammerCLI::Settings)
+      @logger = options.fetch(:logger, Logging.logger['SSLoptions'])
+      @ca_manager = options.fetch(:ca_manager, HammerCLI::CACertManager.new(DEFAULT_LOCAL_CA_STORE_PATH))
     end
 
-    def self.get_options(settings = HammerCLI::Settings, logger = Logging.logger['SSLoptions'])
-      self.new(settings, logger).get_options
+    def get_local_ca_store_path
+      @settings.get(:ssl, :local_ca_store_path) || DEFAULT_LOCAL_CA_STORE_PATH
     end
 
-    def get_options
+    def get_options(uri = nil)
       ssl_options = {}
       for sslopt in [:ssl_ca_file, :ssl_ca_path, :verify_ssl] do
         ssloptval = read_ssl_option(sslopt)
@@ -19,13 +20,21 @@ module HammerCLI
       end
       ssl_options.merge!(cert_key_options)
 
-      ssl_options[:ssl_ca_path] = DEFAULT_SSL_CA_PATH if ssl_options[:ssl_ca_path].nil?
+      # enable ssl verification
+      ssl_options[:verify_ssl] = true if ssl_options[:verify_ssl].nil?
+
+      if ssl_options[:verify_ssl] && uri && !ssl_options[:ssl_ca_file] && !ssl_options[:ssl_ca_path]
+        uri = URI.parse(uri) if uri.is_a?(String)
+        if @ca_manager.cert_exist?(uri)
+          ssl_options[:ssl_ca_file] = @ca_manager.cert_file_name(uri)
+          @logger.info("Matching CA cert was found in local CA store #{ssl_options[:ssl_ca_file]}")
+        end
+      end
+
       [:ssl_ca_file, :ssl_ca_path].each do |opt|
         ssl_options[opt] = File.expand_path(ssl_options[opt]) unless ssl_options[opt].nil?
       end
 
-      # enable ssl verification
-      ssl_options[:verify_ssl] = true if ssl_options[:verify_ssl].nil?
       @logger.debug("SSL options: #{ApipieBindings::Utils::inspect_data(ssl_options)}")
       ssl_options
     end

data/lib/hammer_cli/version.rb

@@ -1,5 +1,5 @@
 module HammerCLI
   def self.version
-    @version ||= Gem::Version.new '0.10.1'
+    @version ||= Gem::Version.new '0.10.2'
   end
 end

data/lib/hammer_cli.rb

@@ -5,6 +5,7 @@ require 'hammer_cli/version'
 require 'hammer_cli/modules'
 require 'hammer_cli/exit_codes'
 require 'hammer_cli/settings'
+require 'hammer_cli/ca_cert_manager'
 require 'hammer_cli/connection'
 require 'hammer_cli/validator'
 require 'hammer_cli/output'

data/test/unit/apipie/api_connection_test.rb

@@ -10,7 +10,6 @@ describe HammerCLI::Apipie::ApiConnection do
     def api_stub(params = {}, options = {})
       api_stub = stub()
       options[:verify_ssl] = true if options[:verify_ssl].nil?
-      options[:ssl_ca_path] = File.expand_path(HammerCLI::SSLOptions::DEFAULT_SSL_CA_PATH) if options[:ssl_ca_path].nil?
       ApipieBindings::API.expects(:new).with(params, options).returns(api_stub)
       api_stub
     end

data/test/unit/ca_cert_manager_test.rb

@@ -6,59 +6,49 @@ require 'hammer_cli/ca_cert_manager'
 describe HammerCLI::CACertManager do
 
   before(:all) do
-    @ca_path = Dir.mktmpdir('ca_cert_manager')
+    @ca_store_path = Dir.mktmpdir('ca_cert_manager')
   end
 
   after(:all) do
-    FileUtils.rm_rf(@ca_path) if File.exist?(@ca_path)
+    FileUtils.rm_rf(@ca_store_path) if File.exist?(@ca_store_path)
   end
 
   let(:service_uri) { URI.parse("https://test.host.com") }
-  let(:ca_cert_manager) { HammerCLI::CACertManager.new(@ca_path) }
+  let(:ca_cert_manager) { HammerCLI::CACertManager.new(@ca_store_path) }
   let(:cert_file) { ca_cert_manager.cert_file_name(service_uri) }
+  let(:ca_cert_fixture) { File.join(File.dirname(__FILE__), '/fixtures/certs/ca_cert.pem') }
+  let(:non_ca_cert_fixture) { File.join(File.dirname(__FILE__), '/fixtures/certs/non_ca_cert.pem') }
 
   describe '#store_ca_cert' do
-    let(:cert_fixture) { File.join(File.dirname(__FILE__), '/fixtures/certs/ca_cert.pem') }
-
     it 'stores ca cert' do
-      new_cert_file = ca_cert_manager.store_ca_cert(File.read(cert_fixture), cert_file)
-      assert File.exist?(File.join(@ca_path, "2c543cd1.0"))
+      new_cert_file = ca_cert_manager.store_ca_cert(File.read(ca_cert_fixture), cert_file)
       assert File.exist?(cert_file)
       assert_equal cert_file, new_cert_file
     end
-  end
-
-  describe '#create_link' do
-    let(:hash) { 123456789 }
-    let(:hash_file) { hash.to_s(16) }
 
-    it "creates link to cert" do
-      FileUtils.touch(cert_file)
-      ca_cert_manager.create_link(hash, cert_file)
-      assert File.exist?(File.join(@ca_path, "#{hash_file}.0"))
+    it 'refuses non-CA cert' do
+      assert_raises HammerCLI::NoCACertificate do
+        ca_cert_manager.store_ca_cert(File.read(non_ca_cert_fixture), cert_file)
+      end
     end
+  end
 
-    it "creates ca path if missing" do
-      FileUtils.rm_rf(@ca_path) if File.exist?(@ca_path)
-      ca_cert_manager.create_link(hash, cert_file)
-      FileUtils.touch(cert_file)
-      assert File.exist?(File.join(@ca_path, "#{hash_file}.0"))
+  describe '#cert_exist?' do
+    it 'return true if the cert exist' do
+      ca_cert_manager.store_ca_cert(File.read(ca_cert_fixture), cert_file)
+      assert ca_cert_manager.cert_exist?(service_uri)
     end
 
-    it "does not create new link if it already exist" do
-      FileUtils.touch(cert_file)
-      File.symlink(cert_file, File.join(@ca_path, "#{hash_file}.0"))
-      ca_cert_manager.create_link(hash, cert_file)
-      assert File.exist?(File.join(@ca_path, "#{hash_file}.0"))
-      refute File.exist?(File.join(@ca_path, "#{hash_file}.1"))
+    it 'return false if the cert does not exist' do
+      refute ca_cert_manager.cert_exist?(service_uri)
     end
+  end
 
-    it "does not override existing link if it has different target" do
-      FileUtils.touch(cert_file)
-      FileUtils.touch(File.join(@ca_path, "#{hash_file}.0"))
-      ca_cert_manager.create_link(hash, cert_file)
-      assert File.exist?(File.join(@ca_path, "#{hash_file}.0"))
-      assert File.exist?(File.join(@ca_path, "#{hash_file}.1"))
+  describe '#cert_file_name' do
+    it 'make file name from host uri' do
+      uri = URI.parse("https://test.example.com:1111")
+      filename = ca_cert_manager.cert_file_name(uri)
+      assert_equal File.join(ca_cert_manager.ca_store_path,'test.example.com_1111.pem'), filename
     end
   end
 end

data/test/unit/fixtures/certs/non_ca_cert.pem

@@ -0,0 +1,27 @@
+-----BEGIN CERTIFICATE-----
+MIIEgDCCA2igAwIBAgIIdKMhNG6e8c4wDQYJKoZIhvcNAQELBQAwSTELMAkGA1UE
+BhMCVVMxEzARBgNVBAoTCkdvb2dsZSBJbmMxJTAjBgNVBAMTHEdvb2dsZSBJbnRl
+cm5ldCBBdXRob3JpdHkgRzIwHhcNMTcwNDEyMTMyODAwWhcNMTcwNzA1MTMyODAw
+WjBoMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwN
+TW91bnRhaW4gVmlldzETMBEGA1UECgwKR29vZ2xlIEluYzEXMBUGA1UEAwwOd3d3
+Lmdvb2dsZS5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDI5ZXl
+lffcMQiwJGs2CxZToWbi16Q7LL6H8y3xuRwDn//gp8qX8Jcv4x7KG4aEipB8wOUm
+jrZs2Q1BT8VIqfQLLqhSrP61LZfuAzv/v1WAw7CmtvqCH91qKM/SkOXyCJK1Cf2/
++i5oLoY2NnxV7iM7+tidPSF4ZPMjtb13ABVcdr49lDlSZce8YXDoWtlr9hjfAPEF
+mzxlSsA5gPv/BNUhgW8Rna3UWwl4jgKAFOgLybKTharhnEl14cYUeDJ/HnGLc8L1
+6es05HjHsz6J3jpXi9x0X1b5lQfeEFYLBPQ3nPjGgOZvECLLl8esBkpAWy+BLGd0
+vPYRWZnnnOU3+i33AgMBAAGjggFLMIIBRzAdBgNVHSUEFjAUBggrBgEFBQcDAQYI
+KwYBBQUHAwIwGQYDVR0RBBIwEIIOd3d3Lmdvb2dsZS5jb20waAYIKwYBBQUHAQEE
+XDBaMCsGCCsGAQUFBzAChh9odHRwOi8vcGtpLmdvb2dsZS5jb20vR0lBRzIuY3J0
+MCsGCCsGAQUFBzABhh9odHRwOi8vY2xpZW50czEuZ29vZ2xlLmNvbS9vY3NwMB0G
+A1UdDgQWBBRfEHz1zg9lsVjVptJ9ncVQH7wzIzAMBgNVHRMBAf8EAjAAMB8GA1Ud
+IwQYMBaAFErdBhYbvPZotXb1gba7Yhq6WoEvMCEGA1UdIAQaMBgwDAYKKwYBBAHW
+eQIFATAIBgZngQwBAgIwMAYDVR0fBCkwJzAloCOgIYYfaHR0cDovL3BraS5nb29n
+bGUuY29tL0dJQUcyLmNybDANBgkqhkiG9w0BAQsFAAOCAQEAgo6rk/60YN5JYhPO
+oBm3nTawx+0FW/rFh6tEsxUl2x6d6eYN/W95Wx2ofJFTe0blC5W40GHyFjuGoEGb
+7soS+gUMsMNb1oiz8osD/OOce70afUcGMSB1qEXC2Q7plCqnJSTDIEsO1r7O0Y6n
+JUqvdrB/LqihaKYnYKsSM6ya+i3fX55KfamkqeRmDIVOspDNcy8zl+EbAX3sJk3j
+k2bitWNktp37t+suGhimvmOVaP/EVRMl8z5RUrNTi8q2M1BzDOZD5k/Hhxy1UFpr
+QwHC6MuyOpgKBIHQguLvzD2I3dyK1GzzsfiyYx3eCJVq4f5iAfSkaxf8spWIhIRo
+YgQaig==
+-----END CERTIFICATE-----