puppet 0.18.4 → 0.22.4

data/lib/puppet/reports/store.rb

@@ -0,0 +1,64 @@
+require 'puppet'
+
+Puppet::Network::Handler.report.newreport(:store, :useyaml => true) do
+    Puppet.config.use(:reporting)
+
+    desc "Store the yaml report on disk.  Each host sends its report as a YAML dump
+        and this just stores the file on disk, in the ``reportdir`` directory.
+        
+        These files collect quickly -- one every half hour -- so it is a good idea
+        to perform some maintenance on them if you use this report (it's the only
+        default report)."
+
+    def mkclientdir(client, dir)
+        config = Puppet::Util::Config.new
+        config.setdefaults("reportclient-#{client}",
+            "clientdir-#{client}" => { :default => dir,
+                :mode => 0750,
+                :desc => "Client dir for %s" % client,
+                :owner => Puppet[:user],
+                :group => Puppet[:group]
+            }
+        )
+
+        config.use("reportclient-#{client}")
+    end
+
+    def process(yaml)
+        # We don't want any tracking back in the fs.  Unlikely, but there
+        # you go.
+        client = self.host.gsub("..",".")
+
+        dir = File.join(Puppet[:reportdir], client)
+
+        unless FileTest.exists?(dir)
+            mkclientdir(client, dir)
+        end
+
+        # Now store the report.
+        now = Time.now.gmtime
+        name = %w{year month day hour min}.collect do |method|
+            # Make sure we're at least two digits everywhere
+            "%02d" % now.send(method).to_s
+        end.join("") + ".yaml"
+
+        file = File.join(dir, name)
+
+        begin
+            File.open(file, "w", 0640) do |f|
+                f.print yaml
+            end
+        rescue => detail
+            if Puppet[:trace]
+                puts detail.backtrace
+            end
+            Puppet.warning "Could not write report for %s at %s: %s" %
+                [client, file, detail]
+        end
+
+        # Only testing cares about the return value
+        return file
+    end
+end
+
+# $Id: store.rb 2259 2007-03-06 19:03:05Z luke $

data/lib/puppet/reports/tagmail.rb

@@ -1,94 +1,167 @@
 require 'puppet'
-
-Puppet.config.setdefaults(:reporting,
-    :tagmap => ["$confdir/tagmail.conf",
-        "The mapping between reporting tags and email addresses."],
-    :sendmail => [%x{which sendmail 2>/dev/null}.chomp,
-        "Where to find the sendmail binary with which to send email."],
-    :reportfrom => ["report@" + [Facter["hostname"].value, Facter["domain"].value].join("."),
-        "The 'from' email address for the reports."],
-    :smtpserver => ["none",
-        "The server through which to send email reports."]
-)
+require 'pp'
 
 require 'net/smtp'
 
-Puppet::Server::Report.newreport(:tagmail) do |report|
-    unless FileTest.exists?(Puppet[:tagmap])
-        Puppet.notice "Cannot send tagmail report; no tagmap file %s" %
-            Puppet[:tagmap]
-        return
-    end
+Puppet::Network::Handler.report.newreport(:tagmail) do
+    desc "This report sends specific log messages to specific email addresses
+        based on the tags in the log messages.  See the
+        `UsingTags tag documentation`:trac: for more information
+        on tags.
+        
+        To use this report, you must create a ``tagmail.conf`` (in the location
+        specified by ``tagmap``).  This is a simple file that maps tags to
+        email addresses:  Any log messages in the report that match the specified
+        tags will be sent to the specified email addresses.
+        
+        Tags must be comma-separated, and they can be negated so that messages
+        only match when they do not have that tag.  The tags are separated from
+        the email addresses by a colon, and the email addresses should also
+        be comma-separated.
 
-    # Load the config file
-    tags = {}
-    File.readlines(Puppet[:tagmap]).each do |line|
-        taglist, emails = line.chomp.split(/\s*:\s*/)
+        Lastly, there is an ``all`` tag that will always match all log messages.
+
+        Here is an example tagmail.conf::
+
+            all: me@domain.com
+            webserver, !mailserver: httpadmins@domain.com
+
+        This will send all messages to ``me@domain.com``, and all messages from
+        webservers that are not also from mailservers to ``httpadmins@domain.com``.
+        "
+
+    # Find all matching messages.
+    def match(taglists)
+        reports = []
+        taglists.each do |emails, pos, neg|
+            # First find all of the messages matched by our positive tags
+            messages = nil
+            if pos.include?("all")
+                messages = self.logs
+            else
+                # Find all of the messages that are tagged with any of our
+                # tags.
+                messages = self.logs.find_all do |log|
+                    pos.detect { |tag| log.tagged?(tag) }
+                end
+            end
+
+            # Now go through and remove any messages that match our negative tags
+            messages = messages.reject do |log|
+                if neg.detect do |tag| log.tagged?(tag) end
+                    true
+                end
+            end
 
-        emails = emails.split(/\s*,\s*/)
-        taglist.split(/\s*,\s*/).each do |tag|
-            tags[tag] = emails
+            if messages.empty?
+                Puppet.info "No messages to report to %s" % emails.join(",")
+                next
+            else
+                reports << [emails, messages.collect { |m| m.to_report }.join("\n")]
+            end
         end
+        
+        return reports
     end
+    
+    # Load the config file
+    def parse(text)
+        taglists = []
+        text.split("\n").each do |line|
+            taglist = emails = nil
+            case line.chomp
+            when /^\s*#/: next
+            when /^\s*$/: next
+            when /^\s*(.+)\s*:\s*(.+)\s*$/:
+                taglist = $1
+                emails = $2.sub(/#.*$/,'')
+            else
+                raise ArgumentError, "Invalid tagmail config file"
+            end
 
-    # Now find any appropriately tagged messages.
-    reports = {}
-    tags.each do |tag, emails|
-        messages = nil
-        if tag == "all"
-            messages = report.logs
-        else
-            messages = report.logs.find_all do |log|
-                log.tagged?(tag)
+            pos = []
+            neg = []
+            taglist.sub(/\s+$/,'').split(/\s*,\s*/).each do |tag|
+                unless tag =~ /^!?[-\w]+$/
+                    raise ArgumentError, "Invalid tag %s" % tag.inspect
+                end
+                case tag
+                when /^\w+/: pos << tag
+                when /^!\w+/: neg << tag.sub("!", '')
+                else
+                    raise Puppet::Error, "Invalid tag '%s'" % tag
+                end
             end
-        end
 
-        if messages and ! messages.empty?
-            reports[emails] = messages.collect { |m| m.to_report }.join("\n")
-        else
-            Puppet.info "No messages to report"
+            # Now split the emails
+            emails = emails.sub(/\s+$/,'').split(/\s*,\s*/)
+            taglists << [emails, pos, neg]
         end
+        return taglists
     end
 
-    # Let's fork for the sending of the email, since you never know what might
-    # happen.
-    fork do
-        if Puppet[:smtpserver] != "none"
-            begin
-                Net::SMTP.start(Puppet[:smtpserver]) do |smtp|
+    # Process the report.  This just calls the other associated messages.
+    def process
+        unless FileTest.exists?(Puppet[:tagmap])
+            Puppet.notice "Cannot send tagmail report; no tagmap file %s" %
+                Puppet[:tagmap]
+            return
+        end
+
+        taglists = parse(File.read(Puppet[:tagmap]))
+        
+        # Now find any appropriately tagged messages.
+        reports = match(taglists)
+
+        send(reports)
+    end
+    
+    # Send the email reports.
+    def send(reports)
+        pid = fork do
+            if Puppet[:smtpserver] != "none"
+                begin
+                    Net::SMTP.start(Puppet[:smtpserver]) do |smtp|
+                        reports.each do |emails, messages|
+                            Puppet.info "Sending report to %s" % emails.join(", ")
+                            smtp.send_message(messages, Puppet[:reportfrom], *emails)
+                        end
+                    end
+                rescue => detail
+                    if Puppet[:debug]
+                        puts detail.backtrace
+                    end
+                    raise Puppet::Error,
+                        "Could not send report emails through smtp: %s" % detail
+                end
+            elsif Puppet[:sendmail] != ""
+                begin
                     reports.each do |emails, messages|
                         Puppet.info "Sending report to %s" % emails.join(", ")
-                        smtp.send_message(messages, Puppet[:reportfrom], *emails)
+                        # We need to open a separate process for every set of email addresses
+                        IO.popen(Puppet[:sendmail] + " " + emails.join(" "), "w") do |p|
+                            p.puts "From: #{Puppet[:reportfrom]}"
+                            p.puts "Subject: Puppet Report for %s" % self.host
+                            p.puts "To: " + emails.join(", ")
+
+                            p.puts messages
+                        end
                     end
-                end
-            rescue => detail
-                if Puppet[:debug]
-                    puts detail.backtrace
-                end
-                raise Puppet::Error,
-                    "Could not send report emails through smtp: %s" % detail
-            end
-        elsif Puppet[:sendmail] != ""
-            begin
-                reports.each do |emails, messages|
-                    Puppet.info "Sending report to %s" % emails.join(", ")
-                    # We need to open a separate process for every set of email addresses
-                    IO.popen(Puppet[:sendmail] + " " + emails.join(" "), "w") do |p|
-                        p.puts "From: #{Puppet[:reportfrom]}"
-                        p.puts "Subject: Puppet Report for %s" % report.host
-
-                        p.puts messages
+                rescue => detail
+                    if Puppet[:debug]
+                        puts detail.backtrace
                     end
+                    raise Puppet::Error,
+                        "Could not send report emails via sendmail: %s" % detail
                 end
-            rescue => detail
-                if Puppet[:debug]
-                    puts detail.backtrace
-                end
-                raise Puppet::Error,
-                    "Could not send report emails via sendmail: %s" % detail
+            else
+                raise Puppet::Error, "SMTP server is unset and could not find sendmail"
             end
-        else
-            raise Puppet::Error, "SMTP server is unset and could not find sendmail"
         end
+
+        # Don't bother waiting for the pid to return.
+        Process.detach(pid)
     end
 end
+
+# $Id: tagmail.rb 2406 2007-04-23 06:16:10Z luke $

data/lib/puppet/sslcertificates.rb

@@ -9,7 +9,17 @@ rescue LoadError
 end
 
 module Puppet::SSLCertificates
+    hostname = Facter["hostname"].value
+    domain = Facter["domain"].value
+    if domain and domain != ""
+        fqdn = [hostname, domain].join(".")
+    else
+        fqdn = hostname
+    end
+
     Puppet.setdefaults("certificates",
+        :certname => [fqdn, "The name to use when handling certificates.  Defaults
+            to the fully qualified domain name."],
         :certdir => ["$ssldir/certs", "The certificate directory."],
         :publickeydir => ["$ssldir/public_keys", "The public key directory."],
         :privatekeydir => { :default => "$ssldir/private_keys",
@@ -24,19 +34,41 @@ module Puppet::SSLCertificates
             :mode => 0640,
             :desc => "Where puppetd stores the password for its private key.
                 Generally unused."
+        },
+        :hostcsr => { :default => "$ssldir/csr_$certname.pem",
+            :mode => 0644,
+            :desc => "Where individual hosts store and look for their certificates."
+        },
+        :hostcert => { :default => "$certdir/$certname.pem",
+            :mode => 0644,
+            :desc => "Where individual hosts store and look for their certificates."
+        },
+        :hostprivkey => { :default => "$privatekeydir/$certname.pem",
+            :mode => 0600,
+            :desc => "Where individual hosts store and look for their private key."
+        },
+        :hostpubkey => { :default => "$publickeydir/$certname.pem",
+            :mode => 0644,
+            :desc => "Where individual hosts store and look for their public key."
+        },
+        :localcacert => { :default => "$certdir/ca.pem",
+            :mode => 0644,
+            :desc => "Where each client stores the CA certificate."
         }
     )
 
-    #def self.mkcert(type, name, days, issuercert, issuername, serial, publickey)
+    #def self.mkcert(type, name, ttl, issuercert, issuername, serial, publickey)
     def self.mkcert(hash)
-        [:type, :name, :days, :issuer, :serial, :publickey].each { |param|
+        [:type, :name, :ttl, :issuer, :serial, :publickey].each { |param|
             unless hash.include?(param)
                 raise ArgumentError, "mkcert called without %s" % param
             end
         }
 
         cert = OpenSSL::X509::Certificate.new
-        from = Time.now
+        # Make the certificate valid as of yesterday, because
+        # so many people's clocks are out of sync.
+        from = Time.now - (60*60*24)
 
         cert.subject = hash[:name]
         if hash[:issuer]
@@ -46,7 +78,7 @@ module Puppet::SSLCertificates
             cert.issuer = hash[:name]
         end
         cert.not_before = from
-        cert.not_after = from + (hash[:days] * 24 * 60 * 60)
+        cert.not_after = from + hash[:ttl]
         cert.version = 2 # X509v3
 
         cert.public_key = hash[:publickey]
@@ -154,7 +186,8 @@ module Puppet::SSLCertificates
         return hashpath
     end
     require 'puppet/sslcertificates/certificate'
+    require 'puppet/sslcertificates/inventory'
     require 'puppet/sslcertificates/ca'
 end
 
-# $Id: sslcertificates.rb 1117 2006-04-19 15:35:04Z luke $
+# $Id: sslcertificates.rb 2376 2007-03-30 23:45:48Z luke $

data/lib/puppet/sslcertificates/ca.rb

@@ -1,6 +1,8 @@
 class Puppet::SSLCertificates::CA
+    include Puppet::Util::Warnings
+
     Certificate = Puppet::SSLCertificates::Certificate
-    attr_accessor :keyfile, :file, :config, :dir, :cert
+    attr_accessor :keyfile, :file, :config, :dir, :cert, :crl
 
     Puppet.setdefaults(:ca,
         :cadir => {  :default => "$ssldir/ca",
@@ -26,6 +28,12 @@ class Puppet::SSLCertificates::CA
             :group => "$group",
             :desc => "The CA public key."
         },
+        :cacrl => { :default => "$cadir/ca_crl.pem",
+            :owner => "$user",
+            :group => "$group",
+            :mode => 0664,
+            :desc => "The certificate revocation list (CRL) for the CA. Set this to 'none' if you do not want to use a CRL."
+        },
         :caprivatedir => { :default => "$cadir/private",
             :owner => "$user",
             :group => "$group",
@@ -55,12 +63,19 @@ class Puppet::SSLCertificates::CA
             :desc => "Where the serial number for certificates is stored."
         },
         :autosign => { :default => "$confdir/autosign.conf",
-            :mode => 0640,
+            :mode => 0644,
             :desc => "Whether to enable autosign.  Valid values are true (which
                 autosigns any key request, and is a very bad idea), false (which
                 never autosigns any key request), and the path to a file, which
                 uses that configuration file to determine which keys to sign."},
-        :ca_days => [1825, "How long a certificate should be valid."],
+        :ca_days => ["", "How long a certificate should be valid. 
+                 This parameter is deprecated, use ca_ttl instead"],
+        :ca_ttl => ["5y", "The default TTL for new certificates; valid values 
+                must be an integer, optionally followed by one of the units 
+                'y' (years of 365 days), 'd' (days), 'h' (hours), or 
+                's' (seconds). The unit defaults to seconds. If this parameter
+                is set, ca_days is ignored. Examples are '3600' (one hour) 
+                and '1825d', which is the same as '5y' (5 years) "],
         :ca_md => ["md5", "The type of hash used in certificates."],
         :req_bits => [2048, "The bit length of the certificates."],
         :keylength => [1024, "The bit length of keys."]
@@ -72,6 +87,7 @@ class Puppet::SSLCertificates::CA
 
     # Remove all traces of a given host.  This is kind of hackish, but, eh.
     def clean(host)
+        host = host.downcase
         [:csrdir, :signeddir, :publickeydir, :privatekeydir, :certdir].each do |name|
             dir = Puppet[name]
 
@@ -79,7 +95,7 @@ class Puppet::SSLCertificates::CA
 
             if FileTest.exists?(file)
                 begin
-                    if Puppet.name == "puppetca"
+                    if Puppet[:name] == "puppetca"
                         puts "Removing %s" % file
                     else
                         Puppet.info "Removing %s" % file
@@ -95,13 +111,13 @@ class Puppet::SSLCertificates::CA
     end
 
     def host2csrfile(hostname)
-        File.join(Puppet[:csrdir], [hostname, "pem"].join("."))
+        File.join(Puppet[:csrdir], [hostname.downcase, "pem"].join("."))
     end
 
     # this stores signed certs in a directory unrelated to 
     # normal client certs
     def host2certfile(hostname)
-        File.join(Puppet[:signeddir], [hostname, "pem"].join("."))
+        File.join(Puppet[:signeddir], [hostname.downcase, "pem"].join("."))
     end
 
     # Turn our hostname into a Name object
@@ -130,6 +146,7 @@ class Puppet::SSLCertificates::CA
         end
 
         self.getcert
+        init_crl
         unless FileTest.exists?(@config[:serial])
             Puppet.config.write(:serial) do |f|
                 f << "%04X" % 1
@@ -190,7 +207,8 @@ class Puppet::SSLCertificates::CA
         return [OpenSSL::X509::Certificate.new(File.read(certfile)), @cert]
     end
 
-    # List certificates waiting to be signed.
+    # List certificates waiting to be signed.  This returns a list of hostnames, not actual
+    # files -- the names can be converted to full paths with host2csrfile.
     def list
         return Dir.entries(Puppet[:csrdir]).find_all { |file|
             file =~ /\.pem$/
@@ -212,18 +230,20 @@ class Puppet::SSLCertificates::CA
             :encrypt => @config[:capass],
             :key => @config[:cakey],
             :selfsign => true,
-            :length => 1825,
+            :ttl => ttl,
             :type => :ca
         )
 
         # This creates the cakey file
-        Puppet::Util.asuser(Puppet[:user], Puppet[:group]) do
+        Puppet::Util::SUIDManager.asuser(Puppet[:user], Puppet[:group]) do
             @cert = cert.mkselfsigned
         end
         Puppet.config.write(:cacert) do |f|
             f.puts @cert.to_pem
         end
-        @key = cert.key
+        Puppet.config.write(:capub) do |f|
+            f.puts @cert.public_key
+        end
         return cert
     end
 
@@ -236,6 +256,23 @@ class Puppet::SSLCertificates::CA
         File.unlink(csrfile)
     end
 
+    # Revoke the certificate with serial number SERIAL issued by this
+    # CA. The REASON must be one of the OpenSSL::OCSP::REVOKED_* reasons
+    def revoke(serial, reason = OpenSSL::OCSP::REVOKED_STATUS_KEYCOMPROMISE)
+        if @config[:cacrl] == 'none'
+            raise Puppet::Error, "Revocation requires a CRL, but ca_crl is set to 'none'"
+        end
+        time = Time.now
+        revoked = OpenSSL::X509::Revoked.new
+        revoked.serial = serial
+        revoked.time = time
+        enum = OpenSSL::ASN1::Enumerated(reason)
+        ext = OpenSSL::X509::Extension.new("CRLReason", enum)
+        revoked.add_extension(ext)
+        @crl.add_revoked(revoked)
+        store_crl
+    end
+    
     # Take the Puppet config and store it locally.
     def setconfig(hash)
         @config = {}
@@ -278,34 +315,12 @@ class Puppet::SSLCertificates::CA
             raise Puppet::Error, "CSR sign verification failed"
         end
 
-        # i should probably check key length...
-
-        # read the ca cert in
-        cacert = OpenSSL::X509::Certificate.new(
-            File.read(@config[:cacert])
-        )
-
-        cakey = nil
-        if @config[:password]
-            cakey = OpenSSL::PKey::RSA.new(
-                File.read(@config[:cakey]), @config[:password]
-            )
-        else
-            cakey = OpenSSL::PKey::RSA.new(
-                File.read(@config[:cakey])
-            )
-        end
-
-        unless cacert.check_private_key(cakey)
-            raise Puppet::Error, "CA Certificate is invalid"
-        end
-
         serial = File.read(@config[:serial]).chomp.hex
         newcert = Puppet::SSLCertificates.mkcert(
             :type => :server,
             :name => csr.subject,
-            :days => @config[:ca_days],
-            :issuer => cacert,
+            :ttl => ttl,
+            :issuer => @cert,
             :serial => serial,
             :publickey => csr.public_key
         )
@@ -315,11 +330,11 @@ class Puppet::SSLCertificates::CA
             f << "%04X" % (serial + 1)
         end
 
-        newcert.sign(cakey, OpenSSL::Digest::SHA1.new)
+        sign_with_key(newcert)
 
         self.storeclientcert(newcert)
 
-        return [newcert, cacert]
+        return [newcert, @cert]
     end
 
     # Store the client's CSR for later signing.  This is called from
@@ -348,10 +363,100 @@ class Puppet::SSLCertificates::CA
                 [certfile, host]
         end
 
+        Puppet::SSLCertificates::Inventory::add(cert)
         Puppet.config.writesub(:signeddir, certfile) do |f|
             f.print cert.to_pem
         end
     end
+
+    # TTL for new certificates in seconds. If config param :ca_ttl is set, 
+    # use that, otherwise use :ca_days for backwards compatibility
+    def ttl
+        days = @config[:ca_days]
+        if days && days.size > 0
+            warnonce "Parameter ca_ttl is not set. Using depecated ca_days instead."
+            return @config[:ca_days] * 24 * 60 * 60
+        else
+            ttl = @config[:ca_ttl]
+            if ttl.is_a?(String)
+                unless ttl =~ /^(\d+)(y|d|h|s)$/
+                    raise ArgumentError, "Invalid ca_ttl #{ttl}"
+                end
+                case $2
+                when 'y'
+                    unit = 365 * 24 * 60 * 60
+                when 'd'
+                    unit = 24 * 60 * 60
+                when 'h'
+                    unit = 60 * 60
+                when 's'
+                    unit = 1
+                else
+                    raise ArgumentError, "Invalid unit for ca_ttl #{ttl}"
+                end
+                return $1.to_i * unit
+            else
+                return ttl
+            end
+        end
+    end
+    
+    private
+    def init_crl
+        if FileTest.exists?(@config[:cacrl])
+            @crl = OpenSSL::X509::CRL.new(
+                File.read(@config[:cacrl])
+            )
+        elsif @config[:cacrl] == 'none'
+            @crl = nil
+        else
+            # Create new CRL
+            @crl = OpenSSL::X509::CRL.new
+            @crl.issuer = @cert.subject
+            @crl.version = 1
+            store_crl
+            @crl
+        end
+    end
+        
+    def store_crl
+        # Increment the crlNumber
+        e = @crl.extensions.find { |e| e.oid == 'crlNumber' }
+        ext = @crl.extensions.reject { |e| e.oid == 'crlNumber' }
+        crlNum = OpenSSL::ASN1::Integer(e ? e.value.to_i + 1 : 0)
+        ext << OpenSSL::X509::Extension.new("crlNumber", crlNum)
+        @crl.extensions = ext
+
+        # Set last/next update
+        now = Time.now
+        @crl.last_update = now
+        # Keep CRL valid for 5 years
+        @crl.next_update = now + 5 * 365*24*60*60
+
+        sign_with_key(@crl)
+        Puppet.config.write(:cacrl) do |f|
+            f.puts @crl.to_pem
+        end
+    end
+
+    def sign_with_key(signable, digest = OpenSSL::Digest::SHA1.new)
+        cakey = nil
+        if @config[:password]
+            cakey = OpenSSL::PKey::RSA.new(
+                File.read(@config[:cakey]), @config[:password]
+            )
+        else
+            cakey = OpenSSL::PKey::RSA.new(
+                File.read(@config[:cakey])
+            )
+        end
+
+        unless @cert.check_private_key(cakey)
+            raise Puppet::Error, "CA Certificate is invalid"
+        end
+
+        signable.sign(cakey, digest)
+    end
 end
 
-# $Id: ca.rb 1145 2006-04-28 04:08:38Z luke $
+# $Id: ca.rb 2259 2007-03-06 19:03:05Z luke $