openvox 7.37.1

data/tasks/generate_cert_fixtures.rake

@@ -0,0 +1,194 @@
+# Run this rake task to generate cert fixtures used in unit tests. This should
+# be run whenever new fixtures are required that derive from the existing ones
+# such as to add an extension to client certs, change expiration, etc. All
+# regenerated fixtures should be committed together.
+desc "Generate cert test fixtures"
+task(:gen_cert_fixtures) do
+  $LOAD_PATH << File.expand_path(File.join(File.dirname(__FILE__), '../spec/lib'))
+  require 'puppet/test_ca'
+
+  def save(dir, name, x509)
+    path = File.join(dir, name)
+    puts "Generating #{path}"
+    File.open(path, 'w') do |f|
+      f.write(x509.to_text)
+      text = if block_given?
+               yield x509
+             else
+               x509.to_pem
+             end
+
+      f.write(text)
+    end
+  end
+
+  # This task generates a PKI consisting of a root CA, intermediate CA and
+  # several leaf certs. A CRL is generated for each CA. The root CA CRL is
+  # empty, while the intermediate CA CRL contains the revoked cert's serial
+  # number. A textual representation of each X509 object is included in the
+  # fixture as a comment.
+  #
+  # Certs
+  # =====
+  #
+  # ca.pem                           /CN=Test CA
+  #                                   |
+  # intermediate.pem                  +- /CN=Test CA Subauthority
+  #                                   |   |
+  # signed.pem                        |   +- /CN=signed
+  # revoked.pem                       |   +- /CN=revoked
+  # tampered-cert.pem                 |   +- /CN=signed (with different public key)
+  # ec.pem                            |   +- /CN=ec (with EC private key)
+  # oid.pem                           |   +- /CN=oid (with custom oid)
+  #                                   |
+  # 127.0.0.1.pem                     +- /CN=127.0.0.1 (with dns alt names)
+  #                                   |
+  # intermediate-agent.pem            +- /CN=Test CA Agent Subauthority
+  #                                   |   |
+  # pluto.pem                         |   +- /CN=pluto
+  #                                   |
+  # bad-int-basic-constraints.pem     +- /CN=Test CA Subauthority (bad isCA constraint)
+  #
+  # bad-basic-constraints.pem        /CN=Test CA (bad isCA constraint)
+  #
+  # unknown-ca.pem                   /CN=Unknown CA
+  #                                   |
+  # unknown-127.0.0.1.pem             +- /CN=127.0.0.1
+  #
+  # Keys
+  # ====
+  #
+  # The RSA private key for each leaf cert is also generated. In addition,
+  # `encrypted-key.pem` contains the private key for the `signed` cert.
+  #
+  # Requests
+  # ========
+  #
+  # `request.pem` contains a valid CSR for /CN=pending, while `tampered_csr.pem`
+  # is the same as `request.pem`, but it's public key has been replaced.
+  #
+  dir = File.join(RAKE_ROOT, 'spec/fixtures/ssl')
+
+  # Create self-signed CA & key
+  unknown_ca = Puppet::TestCa.new('Unknown CA')
+  save(dir, 'unknown-ca.pem', unknown_ca.ca_cert)
+  save(dir, 'unknown-ca-key.pem', unknown_ca.key)
+
+  # Create an SSL cert for 127.0.0.1
+  signed = unknown_ca.create_cert('127.0.0.1', unknown_ca.ca_cert, unknown_ca.key, subject_alt_names: 'DNS:127.0.0.1,DNS:127.0.0.2')
+  save(dir, 'unknown-127.0.0.1.pem', signed[:cert])
+  save(dir, 'unknown-127.0.0.1-key.pem', signed[:private_key])
+
+  # Create Test CA & CRL
+  ca = Puppet::TestCa.new
+  save(dir, 'ca.pem', ca.ca_cert)
+  save(dir, 'crl.pem', ca.ca_crl)
+
+  # Create Intermediate CA & CRL "Test CA Subauthority" issued by "Test CA"
+  inter = ca.create_intermediate_cert('Test CA Subauthority', ca.ca_cert, ca.key)
+  save(dir, 'intermediate.pem', inter[:cert])
+  inter_crl = ca.create_crl(inter[:cert], inter[:private_key])
+
+  # Create a leaf/entity key and cert for host "signed" and issued by "Test CA Subauthority"
+  signed = ca.create_cert('signed', inter[:cert], inter[:private_key])
+  save(dir, 'signed.pem', signed[:cert])
+  save(dir, 'signed-key.pem', signed[:private_key])
+
+  # Create an encrypted version of the above private key for host "signed"
+  save(dir, 'encrypted-key.pem', signed[:private_key]) do |x509|
+    # private key password was chosen at random
+    x509.to_pem(OpenSSL::Cipher::AES.new(128, :CBC), '74695716c8b6')
+  end
+
+  # Create an SSL cert for 127.0.0.1 with dns_alt_names
+  signed = ca.create_cert('127.0.0.1', ca.ca_cert, ca.key, subject_alt_names: 'DNS:127.0.0.1,DNS:127.0.0.2')
+  save(dir, '127.0.0.1.pem', signed[:cert])
+  save(dir, '127.0.0.1-key.pem', signed[:private_key])
+
+  # Create an SSL cert with extensions containing custom oids
+  extensions = [
+    ['1.3.6.1.4.1.34380.1.2.1.1', OpenSSL::ASN1::UTF8String.new('somevalue'), false],
+  ]
+  oid = ca.create_cert('oid', inter[:cert], inter[:private_key], extensions: extensions)
+  save(dir, 'oid.pem', oid[:cert])
+  save(dir, 'oid-key.pem', oid[:private_key])
+
+  # Create a leaf/entity key and cert for host "revoked", issued by "Test CA Subauthority"
+  # and revoke the cert
+  revoked = ca.create_cert('revoked', inter[:cert], inter[:private_key])
+  ca.revoke(revoked[:cert], inter_crl, inter[:private_key])
+  save(dir, 'revoked.pem', revoked[:cert])
+  save(dir, 'revoked-key.pem', revoked[:private_key])
+
+  # Create an EC key and cert, issued by "Test CA Subauthority"
+  ec = ca.create_cert('ec', inter[:cert], inter[:private_key], key_type: :ec)
+  save(dir, 'ec.pem', ec[:cert])
+  save(dir, 'ec-key.pem', ec[:private_key])
+
+  # Create an encrypted version of the above private key for host "ec"
+  save(dir, 'encrypted-ec-key.pem', ec[:private_key]) do |x509|
+    # private key password was chosen at random
+    x509.to_pem(OpenSSL::Cipher::AES.new(128, :CBC), '74695716c8b6')
+  end
+
+  # Update intermediate CRL now that we've revoked
+  save(dir, 'intermediate-crl.pem', inter_crl)
+
+  # Create a pending request (CSR) and private key for host "pending"
+  request = ca.create_request('pending')
+  save(dir, 'request.pem', request[:csr])
+  save(dir, 'request-key.pem', request[:private_key])
+
+  # Create an intermediate for agent certs
+  inter_agent = ca.create_intermediate_cert('Test CA Agent Subauthority', ca.ca_cert, ca.key)
+  save(dir, 'intermediate-agent.pem', inter_agent[:cert])
+  inter_agent_crl = ca.create_crl(inter_agent[:cert], inter_agent[:private_key])
+  save(dir, 'intermediate-agent-crl.pem', inter_agent_crl)
+
+  # Create a leaf/entity key and cert for host "pluto" and issued by "Test CA Agent Subauthority"
+  pluto = ca.create_cert('pluto', inter_agent[:cert], inter_agent[:private_key])
+  save(dir, 'pluto.pem', pluto[:cert])
+  save(dir, 'pluto-key.pem', pluto[:private_key])
+
+  # Create a new root CA cert, but change the "isCA" basic constraint.
+  # It should not be trusted to act as a CA.
+  badconstraints = ca.create_cacert('Test CA')[:cert]
+  badconstraints.public_key = ca.ca_cert.public_key
+  badconstraints.extensions = []
+  ca.ca_cert.extensions.each do |ext|
+    if ext.oid == 'basicConstraints'
+      ef = OpenSSL::X509::ExtensionFactory.new
+      badconstraints.add_extension(ef.create_extension("basicConstraints","CA:FALSE", true))
+    else
+      badconstraints.add_extension(ext)
+    end
+  end
+  badconstraints.sign(ca.key, OpenSSL::Digest::SHA256.new)
+  save(dir, 'bad-basic-constraints.pem', badconstraints)
+
+  # Same as above, but create a new intermediate CA
+  badintconstraints = inter[:cert].dup
+  badintconstraints.public_key = inter[:cert].public_key
+  badintconstraints.extensions = []
+  inter[:cert].extensions.each do |ext|
+    if ext.oid == 'basicConstraints'
+      ef = OpenSSL::X509::ExtensionFactory.new
+      badintconstraints.add_extension(ef.create_extension("basicConstraints","CA:FALSE", true))
+    else
+      badintconstraints.add_extension(ext)
+    end
+  end
+  badintconstraints.sign(ca.key, OpenSSL::Digest::SHA256.new)
+  save(dir, 'bad-int-basic-constraints.pem', badintconstraints)
+
+  # Create a request, but replace its public key after it's signed
+  tampered_csr = ca.create_request('signed')[:csr]
+  tampered_csr.public_key = OpenSSL::PKey::RSA.new(2048).public_key
+  save(dir, 'tampered-csr.pem', tampered_csr)
+
+  # Create a cert issued from the real intermediate CA, but replace its
+  # public key
+  tampered_cert = ca.create_cert('signed', inter[:cert], inter[:private_key])[:cert]
+  tampered_cert.public_key = OpenSSL::PKey::RSA.new(2048).public_key
+  save(dir, 'tampered-cert.pem', tampered_cert)
+end

data/tasks/manpages.rake

@@ -0,0 +1,67 @@
+desc "Build Puppet manpages"
+task :gen_manpages do
+  require 'puppet/face'
+  require 'fileutils'
+
+  Puppet.initialize_settings
+  helpface = Puppet::Face[:help, '0.0.1']
+
+  bins  = Dir.glob(%w{bin/*})
+  non_face_applications = helpface.legacy_applications
+  faces = Puppet::Face.faces.map(&:to_s)
+  apps = non_face_applications + faces
+
+  ronn_args = '--manual="Puppet manual" --organization="Puppet, Inc." --roff'
+
+  unless ENV['SOURCE_DATE_EPOCH'].nil?
+    source_date = Time.at(ENV['SOURCE_DATE_EPOCH'].to_i).strftime('%Y-%m-%d')
+    ronn_args += " --date=#{source_date}"
+  end
+
+  # Locate ronn
+  begin
+    require 'ronn'
+  rescue LoadError
+    abort("Run `bundle install --with documentation` to install the `ronn` gem.")
+  end
+
+  ronn = %x{which ronn}.chomp
+  unless File.executable?(ronn)
+    abort("Ronn does not appear to be installed")
+  end
+
+  %x{mkdir -p ./man/man5 ./man/man8}
+  %x{RUBYLIB=./lib:$RUBYLIB bin/puppet doc --reference configuration > ./man/man5/puppetconf.5.ronn}
+  %x{#{ronn} #{ronn_args} ./man/man5/puppetconf.5.ronn}
+  FileUtils.mv("./man/man5/puppetconf.5", "./man/man5/puppet.conf.5")
+  FileUtils.rm("./man/man5/puppetconf.5.ronn")
+
+  # Create LEGACY binary man pages (i.e. delete me for 2.8.0)
+  bins.each do |bin|
+    b = bin.gsub( /^s?bin\//, "")
+    %x{RUBYLIB=./lib:$RUBYLIB #{bin} --help > ./man/man8/#{b}.8.ronn}
+    %x{#{ronn} #{ronn_args} ./man/man8/#{b}.8.ronn}
+    FileUtils.rm("./man/man8/#{b}.8.ronn")
+  end
+
+  apps.each do |app|
+    %x{RUBYLIB=./lib:$RUBYLIB bin/puppet help #{app} --ronn > ./man/man8/puppet-#{app}.8.ronn}
+    %x{#{ronn} #{ronn_args} ./man/man8/puppet-#{app}.8.ronn}
+    FileUtils.rm("./man/man8/puppet-#{app}.8.ronn")
+  end
+
+  # Delete orphaned manpages if binary was deleted
+  Dir.glob(%w{./man/man8/puppet-*.8}) do |app|
+    appname = app.match(/puppet-(.*)\.8/)[1]
+    FileUtils.rm("./man/man8/puppet-#{appname}.8") unless apps.include?(appname)
+  end
+
+  # Vile hack: create puppet resource man page
+  # Currently, the useless resource face wins against puppet resource in puppet
+  # man. (And actually, it even gets removed from the list of legacy
+  # applications.) So we overwrite it with the correct man page at the end.
+  %x{RUBYLIB=./lib:$RUBYLIB bin/puppet resource --help > ./man/man8/puppet-resource.8.ronn}
+  %x{#{ronn} #{ronn_args} ./man/man8/puppet-resource.8.ronn}
+  FileUtils.rm("./man/man8/puppet-resource.8.ronn")
+
+end

data/tasks/memwalk.rake

@@ -0,0 +1,195 @@
+# Walks the memory dumped into heap.json, and produces a graph of the memory dumped in diff.json
+# If a single argument (a hex address to one object) is given, the graph is limited to this object and what references it
+# The heap dumps should be in the format produced by Ruby ObjectSpace in Ruby version 2.1.0 or later.
+#
+# The command produces a .dot file that can be rendered with graphwiz dot into SVG. If a memwalk is performed for all
+# objects in the diff.json, the output file name is memwalk.dot. If it is produced for a single address, the name of the
+# output file is memwalk-<address>.dot
+#
+# The dot file can be rendered with something like: dot -Tsvg -omemwalk.svg memwalk.dot
+#
+desc "Process a diff.json of object ids, and a heap.json of a Ruby 2.1.0 ObjectSpace dump and produce a graph"
+task :memwalk, [:id] do |t, args|
+  puts "Memwalk"
+  puts "Computing for #{args[:id] ? args[:id] : 'all'}"
+  @single_id = args[:id] ? args[:id].to_i(16) : nil
+
+  require 'json'
+  #require 'debug'
+
+  TYPE = "type".freeze
+  ROOT = "root".freeze
+  ROOT_UC = "ROOT".freeze
+  ADDR = "address".freeze
+  NODE = "NODE".freeze
+  STRING = "STRING".freeze
+  DATA = "DATA".freeze
+  HASH = "HASH".freeze
+  ARRAY = "ARRAY".freeze
+  OBJECT = "OBJECT".freeze
+  CLASS = "CLASS".freeze
+
+  allocations = {}
+  # An array of integer addresses of the objects to trace bindings for
+  diff_index = {}
+  puts "Reading data"
+  begin
+    puts "Reading diff"
+    lines = 0;
+    File.readlines("diff.json").each do | line |
+      lines += 1
+      diff = JSON.parse(line)
+      case diff[ TYPE ]
+      when STRING, DATA, HASH, ARRAY
+        # skip the strings
+      else
+        diff_index[ diff[ ADDR ].to_i(16) ] = diff
+      end
+    end
+    puts "Read #{lines} number of diffs"
+  rescue => e
+    raise "ERROR READING DIFF at line #{lines} #{e.message[0, 200]}"
+  end
+
+  begin
+    puts "Reading heap"
+    lines = 0
+    allocation = nil
+    File.readlines("heap.json").each do | line |
+      lines += 1
+      allocation = JSON.parse(line)
+      case allocation[ TYPE ]
+      when ROOT_UC
+        # Graph for single id must include roots, as it may be a root that holds on to the reference
+        # a global variable, thread, etc.
+        #
+        if @single_id
+          allocations[ allocation[ ROOT ] ] = allocation
+        end
+      when NODE
+        # skip the NODE objects - they represent the loaded ruby code
+      when STRING
+        # skip all strings - they are everywhere
+      else
+        allocations[ allocation[ ADDR ].to_i(16) ] = allocation
+      end
+    end
+    puts "Read #{lines} number of entries"
+  rescue => e
+    require 'debug'
+    puts "ERROR READING HEAP #{e.message[0, 200]}"
+    raise e
+  end
+  @heap = allocations
+
+  puts "Building reference index"
+  # References is an index from a referenced object to an array with addresses to the objects that references it
+  @references = Hash.new { |h, k| h[k] = [] }
+  REFERENCES = "references".freeze
+  allocations.each do |k,v|
+    refs = v[ REFERENCES ]
+    if refs.is_a?(Array)
+      refs.each {|addr| @references[ addr.to_i(16) ] << k }
+    end
+  end
+
+  @printed = Set.new()
+
+  def print_object(addr, entry)
+    # only print each node once
+    return unless @printed.add?(addr)
+    begin
+    if addr.is_a?(String)
+      @output.write( "x#{node_name(addr)} [label=\"#{node_label(addr, entry)}\\n#{addr}\"];\n")
+    else
+      @output.write( "x#{node_name(addr)} [label=\"#{node_label(addr, entry)}\\n#{addr.to_s(16)}\"];\n")
+    end
+    rescue => e
+      require 'debug'
+      raise e
+    end
+  end
+
+  def node_label(addr, entry)
+    if entry[ TYPE ] == OBJECT
+      class_ref = entry[ "class" ].to_i(16)
+      @heap[ class_ref ][ "name" ]
+    elsif entry[ TYPE ] == CLASS
+      "CLASS #{entry[ "name"]}"
+    else
+      entry[TYPE]
+    end
+  end
+
+  def node_name(addr)
+    return addr if addr.is_a? String
+    addr.to_s(16)
+  end
+
+  def print_edge(from_addr, to_addr)
+    @output.write("x#{node_name(from_addr)}->x#{node_name(to_addr)};\n")
+  end
+
+  def closure_and_edges(diff)
+    edges = Set.new()
+    walked = Set.new()
+    puts "Number of diffs referenced = #{diff.count {|k,_| @references[k].is_a?(Array) && @references[k].size() > 0 }}"
+    diff.each {|k,_| walk(k, edges, walked) }
+    edges.each {|e| print_edge(*e) }
+  end
+
+  def walk(addr, edges, walked)
+    if !@heap[ addr ].nil?
+      print_object(addr, @heap[addr])
+
+      @references [ addr ].each do |r|
+        walk_to_object(addr, r, edges, walked)
+      end
+    end
+  end
+
+  def walk_to_object(to_addr, cursor, edges, walked)
+    return unless walked
+    # if walked to an object, or everything if a single_id is the target
+    if @heap[ cursor ][ TYPE ] == OBJECT || (@single_id && @heap[ cursor ][ TYPE ] == ROOT_UC || @heap[ cursor ][ TYPE ] == CLASS )
+      # and the edge is unique
+      if edges.add?( [ cursor, to_addr ] )
+        # then we may not have visited objects this objects is being referred from
+        print_object(cursor, @heap[ cursor ])
+        # Do not follow what binds a class
+        if @heap[ cursor ][ TYPE ] != CLASS
+          @references[ cursor ].each do |r|
+            walk_to_object(cursor, r, edges, walked.add?(r))
+            walked.delete(r)
+          end
+        end
+      end
+    else
+      # continue search until Object
+      @references[cursor].each do |r|
+        walk_to_object(to_addr, r, edges, walked.add?(r))
+      end
+    end
+  end
+
+  def single_closure_and_edges(the_target)
+    edges = Set.new()
+    walked = Set.new()
+    walk(the_target, edges, walked)
+    edges.each {|e| print_edge(*e) }
+  end
+
+  puts "creating graph"
+  if @single_id
+    @output = File.open("memwalk-#{@single_id.to_s(16)}.dot", "w")
+    @output.write("digraph root {\n")
+    single_closure_and_edges(@single_id)
+  else
+    @output = File.open("memwalk.dot", "w")
+    @output.write("digraph root {\n")
+    closure_and_edges(diff_index)
+  end
+  @output.write("}\n")
+  @output.close
+  puts "done"
+end