puppet-retrospec 0.12.2 → 1.0.0

data/vendor/gems/puppet-4.5.2/lib/puppet/ssl/certificate_factory.rb

@@ -0,0 +1,219 @@
+require 'puppet/ssl'
+
+# This class encapsulates the logic of creating and adding extensions to X509
+# certificates.
+#
+# @api private
+module Puppet::SSL::CertificateFactory
+
+  # Create a new X509 certificate and add any needed extensions to the cert.
+  #
+  # @param cert_type [Symbol] The certificate type to create, which specifies
+  #   what extensions are added to the certificate.
+  #   One of (:ca, :terminalsubca, :server, :ocsp, :client)
+  # @param csr [Puppet::SSL::CertificateRequest] The signing request associated with
+  #   the certificate being created.
+  # @param issuer [OpenSSL::X509::Certificate, OpenSSL::X509::Request] An X509 CSR
+  #   if this is a self signed certificate, or the X509 certificate of the CA if
+  #   this is a CA signed certificate.
+  # @param serial [Integer] The serial number for the given certificate, which
+  #   MUST be unique for the given CA.
+  # @param ttl [String] The duration of the validity for the given certificate.
+  #   defaults to Puppet[:ca_ttl]
+  #
+  # @api public
+  #
+  # @return [OpenSSL::X509::Certificate]
+  def self.build(cert_type, csr, issuer, serial, ttl = nil)
+    # Work out if we can even build the requested type of certificate.
+    build_extensions = "build_#{cert_type.to_s}_extensions"
+    respond_to?(build_extensions) or
+      raise ArgumentError, "#{cert_type.to_s} is an invalid certificate type!"
+
+    raise ArgumentError, "Certificate TTL must be an integer" unless ttl.nil? || ttl.is_a?(Fixnum)
+
+    # set up the certificate, and start building the content.
+    cert = OpenSSL::X509::Certificate.new
+
+    cert.version    = 2 # X509v3
+    cert.subject    = csr.content.subject
+    cert.issuer     = issuer.subject
+    cert.public_key = csr.content.public_key
+    cert.serial     = serial
+
+    # Make the certificate valid as of yesterday, because so many people's
+    # clocks are out of sync.  This gives one more day of validity than people
+    # might expect, but is better than making every person who has a messed up
+    # clock fail, and better than having every cert we generate expire a day
+    # before the user expected it to when they asked for "one year".
+    cert.not_before = Time.now - (60*60*24)
+    cert.not_after  = Time.now + (ttl || Puppet[:ca_ttl])
+
+    add_extensions_to(cert, csr, issuer, send(build_extensions))
+
+    return cert
+  end
+
+  private
+
+  # Add X509v3 extensions to the given certificate.
+  #
+  # @param cert [OpenSSL::X509::Certificate] The certificate to add the
+  #   extensions to.
+  # @param csr [OpenSSL::X509::Request] The CSR associated with the given
+  #   certificate, which may specify requested extensions for the given cert.
+  #   See https://tools.ietf.org/html/rfc2985 Section 5.4.2 Extension request
+  # @param issuer [OpenSSL::X509::Certificate, OpenSSL::X509::Request] An X509 CSR
+  #   if this is a self signed certificate, or the X509 certificate of the CA if
+  #   this is a CA signed certificate.
+  # @param extensions [Hash<String, Array<String> | String>] The extensions to
+  #   add to the certificate, based on the certificate type being created (CA,
+  #   server, client, etc)
+  #
+  # @api private
+  #
+  # @return [void]
+  def self.add_extensions_to(cert, csr, issuer, extensions)
+    ef = OpenSSL::X509::ExtensionFactory.new
+    ef.subject_certificate = cert
+    ef.issuer_certificate  = issuer.is_a?(OpenSSL::X509::Request) ? cert : issuer
+
+    # Extract the requested extensions from the CSR.
+    requested_exts = csr.request_extensions.inject({}) do |hash, re|
+      hash[re["oid"]] = [re["value"], re["critical"]]
+      hash
+    end
+
+    # Produce our final set of extensions.  We deliberately order these to
+    # build the way we want:
+    # 1. "safe" default values, like the comment, that no one cares about.
+    # 2. request extensions, from the CSR
+    # 3. extensions based on the type we are generating
+    # 4. overrides, which we always want to have in their form
+    #
+    # This ordering *is* security-critical, but we want to allow the user
+    # enough rope to shoot themselves in the foot, if they want to ignore our
+    # advice and externally approve a CSR that sets the basicConstraints.
+    #
+    # Swapping the order of 2 and 3 would ensure that you couldn't slip a
+    # certificate through where the CA constraint was true, though, if
+    # something went wrong up there. --daniel 2011-10-11
+    defaults = { "nsComment" => "Puppet Ruby/OpenSSL Internal Certificate" }
+
+    # See https://www.openssl.org/docs/apps/x509v3_config.html
+    # for information about the special meanings of 'hash', 'keyid', 'issuer'
+    override = {
+      "subjectKeyIdentifier"   => "hash",
+      "authorityKeyIdentifier" => "keyid,issuer"
+    }
+
+    exts = [defaults, requested_exts, extensions, override].
+      inject({}) {|ret, val| ret.merge(val) }
+
+    cert.extensions = exts.map do |oid, val|
+      generate_extension(ef, oid, *val)
+    end
+  end
+
+  # Woot! We're a CA.
+  def self.build_ca_extensions
+    {
+      # This was accidentally omitted in the previous version of this code: an
+      # effort was made to add it last, but that actually managed to avoid
+      # adding it to the certificate at all.
+      #
+      # We have some sort of bug, which means that when we add it we get a
+      # complaint that the issuer keyid can't be fetched, which breaks all
+      # sorts of things in our test suite and, e.g., bootstrapping the CA.
+      #
+      # https://tools.ietf.org/html/rfc5280#section-4.2.1.1 says that, to be a
+      # conforming CA we MAY omit the field if we are self-signed, which I
+      # think gives us a pass in the specific case.
+      #
+      # It also notes that we MAY derive the ID from the subject and serial
+      # number of the issuer, or from the key ID, and we definitely have the
+      # former data, should we want to restore this...
+      #
+      # Anyway, preserving this bug means we don't risk breaking anything in
+      # the field, even though it would be nice to have. --daniel 2011-10-11
+      #
+      # "authorityKeyIdentifier" => "keyid:always,issuer:always",
+      "keyUsage"               => [%w{cRLSign keyCertSign}, true],
+      "basicConstraints"       => ["CA:TRUE", true],
+    }
+  end
+
+  # We're a terminal CA, probably not self-signed.
+  def self.build_terminalsubca_extensions
+    {
+      "keyUsage"         => [%w{cRLSign keyCertSign}, true],
+      "basicConstraints" => ["CA:TRUE,pathlen:0", true],
+    }
+  end
+
+  # We're a normal server.
+  def self.build_server_extensions
+    {
+      "keyUsage"         => [%w{digitalSignature keyEncipherment}, true],
+      "extendedKeyUsage" => [%w{serverAuth clientAuth}, true],
+      "basicConstraints" => ["CA:FALSE", true],
+    }
+  end
+
+  # Um, no idea.
+  def self.build_ocsp_extensions
+    {
+      "keyUsage"         => [%w{nonRepudiation digitalSignature}, true],
+      "extendedKeyUsage" => [%w{serverAuth OCSPSigning}, true],
+      "basicConstraints" => ["CA:FALSE", true],
+    }
+  end
+
+  # Normal client.
+  def self.build_client_extensions
+    {
+      "keyUsage"         => [%w{nonRepudiation digitalSignature keyEncipherment}, true],
+      # We don't seem to use this, but that seems much more reasonable here...
+      "extendedKeyUsage" => [%w{clientAuth emailProtection}, true],
+      "basicConstraints" => ["CA:FALSE", true],
+      "nsCertType"       => "client,email",
+    }
+  end
+
+  # Generate an extension with the given OID, value, and critical state
+  #
+  # @param oid [String] The numeric value or short name of a given OID. X509v3
+  #   extensions must be passed by short name or long name, while custom
+  #   extensions may be passed by short name, long name, oid numeric OID.
+  # @param ef [OpenSSL::X509::ExtensionFactory] The extension factory to use
+  #   when generating the extension.
+  # @param val [String, Array<String>] The extension value.
+  # @param crit [true, false] Whether the given extension is critical, defaults
+  #   to false.
+  #
+  # @return [OpenSSL::X509::Extension]
+  #
+  # @api private
+  def self.generate_extension(ef, oid, val, crit = false)
+
+    val = val.join(', ') unless val.is_a? String
+
+    # Enforce the X509v3 rules about subjectAltName being critical:
+    # specifically, it SHOULD NOT be critical if we have a subject, which we
+    # always do. --daniel 2011-10-18
+    crit = false if oid == "subjectAltName"
+
+    if Puppet::SSL::Oids.subtree_of?('id-ce', oid) or Puppet::SSL::Oids.subtree_of?('id-pkix', oid)
+      # Attempt to create a X509v3 certificate extension. Standard certificate
+      # extensions may need access to the associated subject certificate and
+      # issuing certificate, so must be created by the OpenSSL::X509::ExtensionFactory
+      # which provides that context.
+      ef.create_ext(oid, val, crit)
+    else
+      # This is not an X509v3 extension which means that the extension
+      # factory cannot generate it. We need to generate the extension
+      # manually.
+      OpenSSL::X509::Extension.new(oid, OpenSSL::ASN1::UTF8String.new(val).to_der, crit)
+    end
+  end
+end

data/vendor/gems/puppet-4.5.2/lib/puppet/ssl/certificate_request.rb

@@ -0,0 +1,327 @@
+require 'puppet/ssl/base'
+require 'puppet/ssl/certificate_signer'
+
+# This class creates and manages X509 certificate signing requests.
+#
+# ## CSR attributes
+#
+# CSRs may contain a set of attributes that includes supplementary information
+# about the CSR or information for the signed certificate.
+#
+# PKCS#9/RFC 2985 section 5.4 formally defines the "Challenge password",
+# "Extension request", and "Extended-certificate attributes", but this
+# implementation only handles the "Extension request" attribute. Other
+# attributes may be defined on a CSR, but the RFC doesn't define behavior for
+# any other attributes so we treat them as only informational.
+#
+# ## CSR Extension request attribute
+#
+# CSRs may contain an optional set of extension requests, which allow CSRs to
+# include additional information that may be included in the signed
+# certificate. Any additional information that should be copied from the CSR
+# to the signed certificate MUST be included in this attribute.
+#
+# This behavior is dictated by PKCS#9/RFC 2985 section 5.4.2.
+#
+# @see https://tools.ietf.org/html/rfc2985 "RFC 2985 Section 5.4.2 Extension request"
+#
+class Puppet::SSL::CertificateRequest < Puppet::SSL::Base
+  wraps OpenSSL::X509::Request
+
+  extend Puppet::Indirector
+
+  # If auto-signing is on, sign any certificate requests as they are saved.
+  module AutoSigner
+    def save(instance, key = nil)
+      super
+
+      # Try to autosign the CSR.
+      if ca = Puppet::SSL::CertificateAuthority.instance
+        ca.autosign(instance)
+      end
+    end
+  end
+
+  indirects :certificate_request, :terminus_class => :file, :extend => AutoSigner, :doc => <<DOC
+    This indirection wraps an `OpenSSL::X509::Request` object, representing a certificate signing request (CSR).
+    The indirection key is the certificate CN (generally a hostname).
+DOC
+
+  # Because of how the format handler class is included, this
+  # can't be in the base class.
+  def self.supported_formats
+    [:s]
+  end
+
+  def extension_factory
+    @ef ||= OpenSSL::X509::ExtensionFactory.new
+  end
+
+  # Create a certificate request with our system settings.
+  #
+  # @param key [OpenSSL::X509::Key, Puppet::SSL::Key] The key pair associated
+  #   with this CSR.
+  # @param options [Hash]
+  # @option options [String] :dns_alt_names A comma separated list of
+  #   Subject Alternative Names to include in the CSR extension request.
+  # @option options [Hash<String, String, Array<String>>] :csr_attributes A hash
+  #   of OIDs and values that are either a string or array of strings.
+  # @option options [Array<String, String>] :extension_requests A hash of
+  #   certificate extensions to add to the CSR extReq attribute, excluding
+  #   the Subject Alternative Names extension.
+  #
+  # @raise [Puppet::Error] If the generated CSR signature couldn't be verified
+  #
+  # @return [OpenSSL::X509::Request] The generated CSR
+  def generate(key, options = {})
+    Puppet.info "Creating a new SSL certificate request for #{name}"
+
+    # Support either an actual SSL key, or a Puppet key.
+    key = key.content if key.is_a?(Puppet::SSL::Key)
+
+    # If we're a CSR for the CA, then use the real ca_name, rather than the
+    # fake 'ca' name.  This is mostly for backward compatibility with 0.24.x,
+    # but it's also just a good idea.
+    common_name = name == Puppet::SSL::CA_NAME ? Puppet.settings[:ca_name] : name
+
+    csr = OpenSSL::X509::Request.new
+    csr.version = 0
+    csr.subject = OpenSSL::X509::Name.new([["CN", common_name]])
+    csr.public_key = key.public_key
+
+    if options[:csr_attributes]
+      add_csr_attributes(csr, options[:csr_attributes])
+    end
+
+    if (ext_req_attribute = extension_request_attribute(options))
+      csr.add_attribute(ext_req_attribute)
+    end
+
+    signer = Puppet::SSL::CertificateSigner.new
+    signer.sign(csr, key)
+
+    raise Puppet::Error, "CSR sign verification failed; you need to clean the certificate request for #{name} on the server" unless csr.verify(key.public_key)
+
+    @content = csr
+    Puppet.info "Certificate Request fingerprint (#{digest.name}): #{digest.to_hex}"
+    @content
+  end
+
+  def ext_value_to_ruby_value(asn1_arr)
+    # A list of ASN1 types than can't be directly converted to a Ruby type
+    @non_convertable ||= [OpenSSL::ASN1::EndOfContent,
+                          OpenSSL::ASN1::BitString,
+                          OpenSSL::ASN1::Null,
+                          OpenSSL::ASN1::Enumerated,
+                          OpenSSL::ASN1::UTCTime,
+                          OpenSSL::ASN1::GeneralizedTime,
+                          OpenSSL::ASN1::Sequence,
+                          OpenSSL::ASN1::Set]
+
+    begin
+      # Attempt to decode the extension's DER data located in the original OctetString
+      asn1_val = OpenSSL::ASN1.decode(asn1_arr.last.value)
+    rescue OpenSSL::ASN1::ASN1Error
+      # This is to allow supporting the old-style of not DER encoding trusted facts
+      return asn1_arr.last.value
+    end
+
+    # If the extension value can not be directly converted to an atomic Ruby
+    # type, use the original ASN1 value. This is needed to work around a bug
+    # in Ruby's OpenSSL library which doesn't convert the value of unknown
+    # extension OIDs properly. See PUP-3560
+    if @non_convertable.include?(asn1_val.class) then
+      # Allows OpenSSL to take the ASN1 value and turn it into something Ruby understands
+      OpenSSL::X509::Extension.new(asn1_arr.first.value, asn1_val.to_der).value
+    else
+      asn1_val.value
+    end
+  end
+
+  # Return the set of extensions requested on this CSR, in a form designed to
+  # be useful to Ruby: an array of hashes.  Which, not coincidentally, you can pass
+  # successfully to the OpenSSL constructor later, if you want.
+  #
+  # @return [Array<Hash{String => String}>] An array of two or three element
+  # hashes, with key/value pairs for the extension's oid, its value, and
+  # optionally its critical state.
+  def request_extensions
+    raise Puppet::Error, "CSR needs content to extract fields" unless @content
+
+    # Prefer the standard extReq, but accept the Microsoft specific version as
+    # a fallback, if the standard version isn't found.
+    attribute   = @content.attributes.find {|x| x.oid == "extReq" }
+    attribute ||= @content.attributes.find {|x| x.oid == "msExtReq" }
+    return [] unless attribute
+
+    extensions = unpack_extension_request(attribute)
+
+    index = -1
+    extensions.map do |ext_values|
+      index += 1
+
+      value = ext_value_to_ruby_value(ext_values)
+
+      # OK, turn that into an extension, to unpack the content.  Lovely that
+      # we have to swap the order of arguments to the underlying method, or
+      # perhaps that the ASN.1 representation chose to pack them in a
+      # strange order where the optional component comes *earlier* than the
+      # fixed component in the sequence.
+      case ext_values.length
+      when 2
+        {"oid" => ext_values[0].value, "value" => value}
+      when 3
+        {"oid" => ext_values[0].value, "value" => value, "critical" => ext_values[1].value}
+      else
+        raise Puppet::Error, "In #{attribute.oid}, expected extension record #{index} to have two or three items, but found #{ext_values.length}"
+      end
+    end
+  end
+
+  def subject_alt_names
+    @subject_alt_names ||= request_extensions.
+      select {|x| x["oid"] == "subjectAltName" }.
+      map {|x| x["value"].split(/\s*,\s*/) }.
+      flatten.
+      sort.
+      uniq
+  end
+
+  # Return all user specified attributes attached to this CSR as a hash. IF an
+  # OID has a single value it is returned as a string, otherwise all values are
+  # returned as an array.
+  #
+  # The format of CSR attributes is specified in PKCS#10/RFC 2986
+  #
+  # @see https://tools.ietf.org/html/rfc2986 "RFC 2986 Certification Request Syntax Specification"
+  #
+  # @api public
+  #
+  # @return [Hash<String, String>]
+  def custom_attributes
+    x509_attributes = @content.attributes.reject do |attr|
+      PRIVATE_CSR_ATTRIBUTES.include? attr.oid
+    end
+
+    x509_attributes.map do |attr|
+      {"oid" => attr.oid, "value" => attr.value.first.value}
+    end
+  end
+
+  private
+
+  # Exclude OIDs that may conflict with how Puppet creates CSRs.
+  #
+  # We only have nominal support for Microsoft extension requests, but since we
+  # ultimately respect that field when looking for extension requests in a CSR
+  # we need to prevent that field from being written to directly.
+  PRIVATE_CSR_ATTRIBUTES = [
+    'extReq',   '1.2.840.113549.1.9.14',
+    'msExtReq', '1.3.6.1.4.1.311.2.1.14',
+  ]
+
+  def add_csr_attributes(csr, csr_attributes)
+    csr_attributes.each do |oid, value|
+      begin
+        if PRIVATE_CSR_ATTRIBUTES.include? oid
+          raise ArgumentError, "Cannot specify CSR attribute #{oid}: conflicts with internally used CSR attribute"
+        end
+
+        encoded = OpenSSL::ASN1::PrintableString.new(value.to_s)
+
+        attr_set = OpenSSL::ASN1::Set.new([encoded])
+        csr.add_attribute(OpenSSL::X509::Attribute.new(oid, attr_set))
+        Puppet.debug("Added csr attribute: #{oid} => #{attr_set.inspect}")
+      rescue OpenSSL::X509::AttributeError => e
+        raise Puppet::Error, "Cannot create CSR with attribute #{oid}: #{e.message}", e.backtrace
+      end
+    end
+  end
+
+  private
+
+  PRIVATE_EXTENSIONS = [
+    'subjectAltName', '2.5.29.17',
+  ]
+
+  # @api private
+  def extension_request_attribute(options)
+    extensions = []
+
+    if options[:extension_requests]
+      options[:extension_requests].each_pair do |oid, value|
+        begin
+          if PRIVATE_EXTENSIONS.include? oid
+            raise Puppet::Error, "Cannot specify CSR extension request #{oid}: conflicts with internally used extension request"
+          end
+
+          ext = OpenSSL::X509::Extension.new(oid, OpenSSL::ASN1::UTF8String.new(value.to_s).to_der, false)
+          extensions << ext
+        rescue OpenSSL::X509::ExtensionError => e
+          raise Puppet::Error, "Cannot create CSR with extension request #{oid}: #{e.message}", e.backtrace
+        end
+      end
+    end
+
+    if options[:dns_alt_names]
+      names = options[:dns_alt_names].split(/\s*,\s*/).map(&:strip) + [name]
+      names = names.sort.uniq.map {|name| "DNS:#{name}" }.join(", ")
+      alt_names_ext = extension_factory.create_extension("subjectAltName", names, false)
+
+      extensions << alt_names_ext
+    end
+
+    unless extensions.empty?
+      seq = OpenSSL::ASN1::Sequence(extensions)
+      ext_req = OpenSSL::ASN1::Set([seq])
+      OpenSSL::X509::Attribute.new("extReq", ext_req)
+    end
+  end
+
+  # Unpack the extReq attribute into an array of Extensions.
+  #
+  # The extension request attribute is structured like
+  # `Set[Sequence[Extensions]]` where the outer Set only contains a single
+  # sequence.
+  #
+  # In addition the Ruby implementation of ASN1 requires that all ASN1 values
+  # contain a single value, so Sets and Sequence have to contain an array
+  # that in turn holds the elements. This is why we have to unpack an array
+  # every time we unpack a Set/Seq.
+  #
+  # @see https://tools.ietf.org/html/rfc2985#ref-10 5.4.2 CSR Extension Request structure
+  # @see https://tools.ietf.org/html/rfc5280 4.1 Certificate Extension structure
+  #
+  # @api private
+  #
+  # @param attribute [OpenSSL::X509::Attribute] The X509 extension request
+  #
+  # @return [Array<Array<Object>>] A array of arrays containing the extension
+  #   OID the critical state if present, and the extension value.
+  def unpack_extension_request(attribute)
+
+    unless attribute.value.is_a? OpenSSL::ASN1::Set
+      raise Puppet::Error, "In #{attribute.oid}, expected Set but found #{attribute.value.class}"
+    end
+
+    unless attribute.value.value.is_a? Array
+      raise Puppet::Error, "In #{attribute.oid}, expected Set[Array] but found #{attribute.value.value.class}"
+    end
+
+    unless attribute.value.value.size == 1
+      raise Puppet::Error, "In #{attribute.oid}, expected Set[Array] with one value but found #{attribute.value.value.size} elements"
+    end
+
+    unless attribute.value.value.first.is_a? OpenSSL::ASN1::Sequence
+      raise Puppet::Error, "In #{attribute.oid}, expected Set[Array[Sequence[...]]], but found #{extension.class}"
+    end
+
+    unless attribute.value.value.first.value.is_a? Array
+      raise Puppet::Error, "In #{attribute.oid}, expected Set[Array[Sequence[Array[...]]]], but found #{extension.value.class}"
+    end
+
+    extensions = attribute.value.value.first.value
+
+    extensions.map(&:value)
+  end
+end