puppet-retrospec 1.5.0 → 1.6.0

data/vendor/pup410/lib/puppet/ssl/inventory.rb

@@ -0,0 +1,55 @@
+require 'puppet/ssl'
+require 'puppet/ssl/certificate'
+
+# Keep track of all of our known certificates.
+class Puppet::SSL::Inventory
+  attr_reader :path
+
+  # Add a certificate to our inventory.
+  def add(cert)
+    cert = cert.content if cert.is_a?(Puppet::SSL::Certificate)
+    # RFC 5280 says the cert subject may contain UTF8 - https://www.ietf.org/rfc/rfc5280.txt
+    # Note however that Puppet generated SSL files must only contain ASCII characters
+    # based on the validate_certname method of Puppet::SSL::Base
+    Puppet.settings.setting(:cert_inventory).open('a:UTF-8') do |f|
+      f.print format(cert)
+    end
+  end
+
+  # Format our certificate for output.
+  def format(cert)
+    iso = '%Y-%m-%dT%H:%M:%S%Z'
+    "0x%04x %s %s %s\n" % [cert.serial,  cert.not_before.strftime(iso), cert.not_after.strftime(iso), cert.subject]
+  end
+
+  def initialize
+    @path = Puppet[:cert_inventory]
+  end
+
+  # Rebuild the inventory from scratch.  This should happen if
+  # the file is entirely missing or if it's somehow corrupted.
+  def rebuild
+    Puppet.notice "Rebuilding inventory file"
+
+    # RFC 5280 says the cert subject may contain UTF8 - https://www.ietf.org/rfc/rfc5280.txt
+    Puppet.settings.setting(:cert_inventory).open('w:UTF-8') do |f|
+      Puppet::SSL::Certificate.indirection.search("*").each do |cert|
+        f.print format(cert.content)
+      end
+    end
+  end
+
+  # Find all serial numbers for a given certificate. If none can be found, returns
+  # an empty array.
+  def serials(name)
+    return [] unless Puppet::FileSystem.exist?(@path)
+
+    # RFC 5280 says the cert subject may contain UTF8 - https://www.ietf.org/rfc/rfc5280.txt
+    # Note however that Puppet generated SSL files must only contain ASCII characters
+    # based on the validate_certname method of Puppet::SSL::Base
+    File.readlines(@path, :encoding => Encoding::UTF_8).collect do |line|
+      /^(\S+).+\/CN=#{name}$/.match(line)
+    end.compact.map { |m| Integer(m[1]) }
+  end
+
+end

data/vendor/pup410/lib/puppet/ssl/key.rb

@@ -0,0 +1,63 @@
+require 'puppet/ssl/base'
+require 'puppet/indirector'
+
+# Manage private and public keys as a pair.
+class Puppet::SSL::Key < Puppet::SSL::Base
+  wraps OpenSSL::PKey::RSA
+
+  extend Puppet::Indirector
+  indirects :key, :terminus_class => :file, :doc => <<DOC
+    This indirection wraps an `OpenSSL::PKey::RSA object, representing a private key.
+    The indirection key is the certificate CN (generally a hostname).
+DOC
+
+  # Because of how the format handler class is included, this
+  # can't be in the base class.
+  def self.supported_formats
+    [:s]
+  end
+
+  attr_accessor :password_file
+
+  # Knows how to create keys with our system defaults.
+  def generate
+    Puppet.info "Creating a new SSL key for #{name}"
+    @content = OpenSSL::PKey::RSA.new(Puppet[:keylength].to_i)
+  end
+
+  def initialize(name)
+    super
+
+    if ca?
+      @password_file = Puppet[:capass]
+    else
+      @password_file = Puppet[:passfile]
+    end
+  end
+
+  def password
+    return nil unless password_file and Puppet::FileSystem.exist?(password_file)
+
+    # Puppet generates files at the default Puppet[:capass] using ASCII
+    # User configured :passfile could be in any encoding
+    # Use BINARY given the string is passed to an OpenSSL API accepting bytes
+    # note this is only called internally
+    Puppet::FileSystem.read(password_file, :encoding => Encoding::BINARY)
+  end
+
+  # Optionally support specifying a password file.
+  def read(path)
+    return super unless password_file
+
+    # RFC 1421 states PEM is 7-bit ASCII https://tools.ietf.org/html/rfc1421
+    @content = wrapped_class.new(Puppet::FileSystem.read(path, :encoding => Encoding::ASCII), password)
+  end
+
+  def to_s
+    if pass = password
+      @content.export(OpenSSL::Cipher::DES.new(:EDE3, :CBC), pass)
+    else
+      return super
+    end
+  end
+end

data/vendor/pup410/lib/puppet/ssl/oids.rb

@@ -0,0 +1,187 @@
+require 'puppet/ssl'
+
+# This module defines OIDs for use within Puppet.
+#
+# == ASN.1 Definition
+#
+# The following is the formal definition of OIDs specified in this file.
+#
+# puppetCertExtensions OBJECT IDENTIFIER ::= {iso(1) identified-organization(3)
+#    dod(6) internet(1) private(4) enterprise(1) 34380 1}
+#
+# -- the tree under registeredExtensions 'belongs' to puppetlabs
+# -- privateExtensions can be extended by enterprises to suit their own needs
+# registeredExtensions OBJECT IDENTIFIER ::= { puppetCertExtensions 1 }
+# privateExtensions OBJECT IDENTIFIER ::= { puppetCertExtensions 2 }
+# authorizationExtensions OBJECT IDENTIFIER ::= { puppetCertExtensions 3 }
+#
+# -- subtree of common registered extensions
+# -- The short names for these OIDs are intentionally lowercased and formatted
+# -- since they may be exposed inside the Puppet DSL as variables.
+# pp_uuid  OBJECT IDENTIFIER ::= { registeredExtensions 1 }
+# pp_instance_id OBJECT IDENTIFIER ::= { registeredExtensions 2 }
+# pp_image_name OBJECT IDENTIFIER ::= { registeredExtensions 3 }
+# pp_preshared_key OBJECT IDENTIFIER ::= { registeredExtensions 4 }
+#
+# @api private
+module Puppet::SSL::Oids
+
+  # Note: When updating the following OIDs make sure to also update the OID
+  # definitions here:
+  # https://github.com/puppetlabs/puppetserver/blob/master/src/clj/puppetlabs/puppetserver/certificate_authority.clj#L122-L159
+
+  PUPPET_OIDS = [
+    ["1.3.6.1.4.1.34380", 'puppetlabs', 'Puppet Labs'],
+    ["1.3.6.1.4.1.34380.1", 'ppCertExt', 'Puppet Certificate Extension'],
+
+    ["1.3.6.1.4.1.34380.1.1", 'ppRegCertExt', 'Puppet Registered Certificate Extension'],
+
+    ["1.3.6.1.4.1.34380.1.1.1", 'pp_uuid', 'Puppet Node UUID'],
+    ["1.3.6.1.4.1.34380.1.1.2", 'pp_instance_id', 'Puppet Node Instance ID'],
+    ["1.3.6.1.4.1.34380.1.1.3", 'pp_image_name', 'Puppet Node Image Name'],
+    ["1.3.6.1.4.1.34380.1.1.4", 'pp_preshared_key', 'Puppet Node Preshared Key'],
+    ["1.3.6.1.4.1.34380.1.1.5", 'pp_cost_center', 'Puppet Node Cost Center Name'],
+    ["1.3.6.1.4.1.34380.1.1.6", 'pp_product', 'Puppet Node Product Name'],
+    ["1.3.6.1.4.1.34380.1.1.7", 'pp_project', 'Puppet Node Project Name'],
+    ["1.3.6.1.4.1.34380.1.1.8", 'pp_application', 'Puppet Node Application Name'],
+    ["1.3.6.1.4.1.34380.1.1.9", 'pp_service', 'Puppet Node Service Name'],
+    ["1.3.6.1.4.1.34380.1.1.10", 'pp_employee', 'Puppet Node Employee Name'],
+    ["1.3.6.1.4.1.34380.1.1.11", 'pp_created_by', 'Puppet Node created_by Tag'],
+    ["1.3.6.1.4.1.34380.1.1.12", 'pp_environment', 'Puppet Node Environment Name'],
+    ["1.3.6.1.4.1.34380.1.1.13", 'pp_role', 'Puppet Node Role Name'],
+    ["1.3.6.1.4.1.34380.1.1.14", 'pp_software_version', 'Puppet Node Software Version'],
+    ["1.3.6.1.4.1.34380.1.1.15", 'pp_department', 'Puppet Node Department Name'],
+    ["1.3.6.1.4.1.34380.1.1.16", 'pp_cluster', 'Puppet Node Cluster Name'],
+    ["1.3.6.1.4.1.34380.1.1.17", 'pp_provisioner', 'Puppet Node Provisioner Name'],
+    ["1.3.6.1.4.1.34380.1.1.18", 'pp_region', 'Puppet Node Region Name'],
+    ["1.3.6.1.4.1.34380.1.1.19", 'pp_datacenter', 'Puppet Node Datacenter Name'],
+    ["1.3.6.1.4.1.34380.1.1.20", 'pp_zone', 'Puppet Node Zone Name'],
+    ["1.3.6.1.4.1.34380.1.1.21", 'pp_network', 'Puppet Node Network Name'],
+    ["1.3.6.1.4.1.34380.1.1.22", 'pp_securitypolicy', 'Puppet Node Security Policy Name'],
+    ["1.3.6.1.4.1.34380.1.1.23", 'pp_cloudplatform', 'Puppet Node Cloud Platform Name'],
+    ["1.3.6.1.4.1.34380.1.1.24", 'pp_apptier', 'Puppet Node Application Tier'],
+    ["1.3.6.1.4.1.34380.1.1.25", 'pp_hostname', 'Puppet Node Hostname'],
+
+    ["1.3.6.1.4.1.34380.1.2", 'ppPrivCertExt', 'Puppet Private Certificate Extension'],
+
+    ["1.3.6.1.4.1.34380.1.3", 'ppAuthCertExt', 'Puppet Certificate Authorization Extension'],
+
+    ["1.3.6.1.4.1.34380.1.3.1",  'pp_authorization', 'Certificate Extension Authorization'],
+    ["1.3.6.1.4.1.34380.1.3.13", 'pp_auth_role', 'Puppet Node Role Name for Authorization'],
+  ]
+
+  # Register our custom Puppet OIDs with OpenSSL so they can be used as CSR
+  # extensions. Without registering these OIDs, OpenSSL will fail when it
+  # encounters such an extension in a CSR.
+  def self.register_puppet_oids()
+    PUPPET_OIDS.each do |oid_defn|
+      OpenSSL::ASN1::ObjectId.register(*oid_defn)
+    end
+  end
+
+  # Parse custom OID mapping file that enables custom OIDs to be resolved
+  # into user-friendly names.
+  #
+  # @param custom_oid_file [String] File to obtain custom OIDs mapping from
+  # @param map_key [String] Hash key in which custom OIDs mapping is stored
+  #
+  # @example Custom OID mapping file
+  # ---
+  # oid_mapping:
+  #  '1.3.6.1.4.1.34380.1.2.1.1':
+  #    shortname : 'myshortname'
+  #    longname  : 'Long name'
+  #  '1.3.6.1.4.1.34380.1.2.1.2':
+  #    shortname: 'myothershortname'
+  #    longname: 'Other Long name'
+  def self.parse_custom_oid_file(custom_oid_file, map_key='oid_mapping')
+    if File.exists?(custom_oid_file) && File.readable?(custom_oid_file)
+      mapping = nil
+      begin
+        mapping = YAML.load_file(custom_oid_file)
+      rescue => err
+        raise Puppet::Error, "Error loading ssl custom OIDs mapping file from '#{custom_oid_file}': #{err}", err.backtrace
+      end
+
+      unless mapping.has_key?(map_key)
+        raise Puppet::Error, "Error loading ssl custom OIDs mapping file from '#{custom_oid_file}': no such index '#{map_key}'"
+      end
+
+      unless mapping[map_key].is_a?(Hash)
+        raise Puppet::Error, "Error loading ssl custom OIDs mapping file from '#{custom_oid_file}': data under index '#{map_key}' must be a Hash"
+      end
+
+      oid_defns = []
+      mapping[map_key].keys.each do |oid|
+        shortname, longname = mapping[map_key][oid].values_at("shortname","longname")
+        if shortname.nil? || longname.nil?
+          raise Puppet::Error, "Error loading ssl custom OIDs mapping file from '#{custom_oid_file}': incomplete definition of oid '#{oid}'"
+        end
+        oid_defns << [oid, shortname, longname]
+      end
+
+      oid_defns
+    end
+  end
+
+  # Load custom OID mapping file that enables custom OIDs to be resolved
+  # into user-friendly names.
+  #
+  # @param custom_oid_file [String] File to obtain custom OIDs mapping from
+  # @param map_key [String] Hash key in which custom OIDs mapping is stored
+  #
+  # @example Custom OID mapping file
+  # ---
+  # oid_mapping:
+  #  '1.3.6.1.4.1.34380.1.2.1.1':
+  #    shortname : 'myshortname'
+  #    longname  : 'Long name'
+  #  '1.3.6.1.4.1.34380.1.2.1.2':
+  #    shortname: 'myothershortname'
+  #    longname: 'Other Long name'
+  def self.load_custom_oid_file(custom_oid_file, map_key='oid_mapping')
+    oid_defns = parse_custom_oid_file(custom_oid_file, map_key)
+    unless oid_defns.nil?
+      begin
+        oid_defns.each do |oid_defn|
+          OpenSSL::ASN1::ObjectId.register(*oid_defn)
+        end
+      rescue => err
+        raise ArgumentError, "Error registering ssl custom OIDs mapping from file '#{custom_oid_file}': #{err}", err.backtrace
+      end
+    end
+  end
+
+  # Determine if the first OID contains the second OID
+  #
+  # @param first [String] The containing OID, in dotted form or as the short name
+  # @param second [String] The contained OID, in dotted form or as the short name
+  # @param exclusive [true, false] If an OID should not be considered as a subtree of itself
+  #
+  # @example Comparing two dotted OIDs
+  #   Puppet::SSL::Oids.subtree_of?('1.3.6.1', '1.3.6.1.4.1') #=> true
+  #   Puppet::SSL::Oids.subtree_of?('1.3.6.1', '1.3.6') #=> false
+  #
+  # @example Comparing an OID short name with a dotted OID
+  #   Puppet::SSL::Oids.subtree_of?('IANA', '1.3.6.1.4.1') #=> true
+  #   Puppet::SSL::Oids.subtree_of?('1.3.6.1', 'enterprises') #=> true
+  #
+  # @example Comparing an OID against itself
+  #   Puppet::SSL::Oids.subtree_of?('IANA', 'IANA') #=> true
+  #   Puppet::SSL::Oids.subtree_of?('IANA', 'IANA', true) #=> false
+  #
+  # @return [true, false]
+  def self.subtree_of?(first, second, exclusive = false)
+    first_oid = OpenSSL::ASN1::ObjectId.new(first).oid
+    second_oid = OpenSSL::ASN1::ObjectId.new(second).oid
+
+
+    if exclusive and first_oid == second_oid
+      false
+    else
+      second_oid.index(first_oid) == 0
+    end
+  rescue OpenSSL::ASN1::ASN1Error
+    false
+  end
+end

data/vendor/pup410/lib/puppet/ssl/validator/default_validator.rb

@@ -0,0 +1,174 @@
+require 'openssl'
+require 'puppet/ssl'
+
+# Perform peer certificate verification against the known CA.
+# If there is no CA information known, then no verification is performed
+#
+# @api private
+#
+class Puppet::SSL::Validator::DefaultValidator #< class Puppet::SSL::Validator
+  attr_reader :peer_certs
+  attr_reader :verify_errors
+  attr_reader :ssl_configuration
+
+  FIVE_MINUTES_AS_SECONDS = 5 * 60
+
+  # Creates a new DefaultValidator, optionally with an SSL Configuration and SSL Host.
+  #
+  # @param ssl_configuration [Puppet::SSL::Configuration] (a default configuration) ssl_configuration the SSL configuration to use
+  # @param ssl_host [Puppet::SSL::Host] The SSL host to use
+  #
+  # @api private
+  #
+  def initialize(
+      ssl_configuration = Puppet::SSL::Configuration.new(
+                                        Puppet[:localcacert], {
+                                          :ca_auth_file  => Puppet[:ssl_client_ca_auth]
+                                        }),
+      ssl_host = Puppet.lookup(:ssl_host))
+
+    reset!
+    @ssl_configuration = ssl_configuration
+    @ssl_host = ssl_host
+  end
+
+
+  # Resets this validator to its initial validation state. The ssl configuration is not changed.
+  #
+  # @api private
+  #
+  def reset!
+    @peer_certs = []
+    @verify_errors = []
+  end
+
+  # Performs verification of the SSL connection and collection of the
+  # certificates for use in constructing the error message if the verification
+  # failed.  This callback will be executed once for each certificate in a
+  # chain being verified.
+  #
+  # From the [OpenSSL
+  # documentation](https://www.openssl.org/docs/ssl/SSL_CTX_set_verify.html):
+  # The `verify_callback` function is used to control the behaviour when the
+  # SSL_VERIFY_PEER flag is set. It must be supplied by the application and
+  # receives two arguments: preverify_ok indicates, whether the verification of
+  # the certificate in question was passed (preverify_ok=1) or not
+  # (preverify_ok=0). x509_store_ctx is a pointer to the complete context used for
+  # the certificate chain verification.
+  #
+  # See {Puppet::Network::HTTP::Connection} for more information and where this
+  # class is intended to be used.
+  #
+  # @param [Boolean] preverify_ok indicates whether the verification of the
+  #   certificate in question was passed (preverify_ok=true)
+  # @param [OpenSSL::X509::StoreContext] store_context holds the X509 store context
+  #   for the chain being verified.
+  #
+  # @return [Boolean] false if the peer is invalid, true otherwise.
+  #
+  # @api private
+  #
+  def call(preverify_ok, store_context)
+    # We must make a copy since the scope of the store_context will be lost
+    # across invocations of this method.
+    if preverify_ok
+      current_cert = store_context.current_cert
+      @peer_certs << Puppet::SSL::Certificate.from_instance(current_cert)
+
+      # If we've copied all of the certs in the chain out of the SSL library
+      if @peer_certs.length == store_context.chain.length
+        # (#20027) The peer cert must be issued by a specific authority
+        preverify_ok = valid_peer?
+      end
+    else
+      error = store_context.error || 0
+      error_string = store_context.error_string || "OpenSSL error #{error}"
+
+      case error
+      when OpenSSL::X509::V_ERR_CRL_NOT_YET_VALID
+        # current_crl can be nil
+        # https://github.com/ruby/ruby/blob/ruby_1_9_3/ext/openssl/ossl_x509store.c#L501-L510
+        crl = store_context.current_crl
+        if crl
+          if crl.last_update && crl.last_update < Time.now + FIVE_MINUTES_AS_SECONDS
+            Puppet.debug("Ignoring CRL not yet valid, current time #{Time.now.utc}, CRL last updated #{crl.last_update.utc}")
+            preverify_ok = true
+          else
+            @verify_errors << "#{error_string} for #{crl.issuer}"
+          end
+        else
+          @verify_errors << error_string
+        end
+      else
+        current_cert = store_context.current_cert
+        @verify_errors << "#{error_string} for #{current_cert.subject}"
+      end
+    end
+    preverify_ok
+  rescue => ex
+    @verify_errors << ex.message
+    false
+  end
+
+  # Registers the instance's call method with the connection.
+  #
+  # @param [Net::HTTP] connection The connection to validate
+  #
+  # @return [void]
+  #
+  # @api private
+  #
+  def setup_connection(connection)
+    if ssl_certificates_are_present?
+      connection.cert_store = @ssl_host.ssl_store
+      connection.ca_file = @ssl_configuration.ca_auth_file
+      connection.cert = @ssl_host.certificate.content
+      connection.key = @ssl_host.key.content
+      connection.verify_mode = OpenSSL::SSL::VERIFY_PEER
+      connection.verify_callback = self
+    else
+      connection.verify_mode = OpenSSL::SSL::VERIFY_NONE
+    end
+  end
+
+  # Validates the peer certificates against the authorized certificates.
+  #
+  # @api private
+  #
+  def valid_peer?
+    descending_cert_chain = @peer_certs.reverse.map {|c| c.content }
+    authz_ca_certs = ssl_configuration.ca_auth_certificates
+
+    if not has_authz_peer_cert(descending_cert_chain, authz_ca_certs)
+      msg = "The server presented a SSL certificate chain which does not include a " <<
+        "CA listed in the ssl_client_ca_auth file.  "
+      msg << "Authorized Issuers: #{authz_ca_certs.collect {|c| c.subject}.join(', ')}  " <<
+        "Peer Chain: #{descending_cert_chain.collect {|c| c.subject}.join(' => ')}"
+      @verify_errors << msg
+      false
+    else
+      true
+    end
+  end
+
+  # Checks if the set of peer_certs contains at least one certificate issued
+  # by a certificate listed in authz_certs
+  #
+  # @return [Boolean]
+  #
+  # @api private
+  #
+  def has_authz_peer_cert(peer_certs, authz_certs)
+    peer_certs.any? do |peer_cert|
+      authz_certs.any? do |authz_cert|
+        peer_cert.verify(authz_cert.public_key)
+      end
+    end
+  end
+
+  # @api private
+  #
+  def ssl_certificates_are_present?
+    Puppet::FileSystem.exist?(Puppet[:hostcert]) && Puppet::FileSystem.exist?(@ssl_configuration.ca_auth_file)
+  end
+end