puppet 0.24.9 → 0.25.0

data/lib/puppet/ssl/certificate_factory.rb

@@ -0,0 +1,145 @@
+require 'puppet/ssl'
+
+# The tedious class that does all the manipulations to the
+# certificate to correctly sign it.  Yay.
+class Puppet::SSL::CertificateFactory
+    # How we convert from various units to the required seconds.
+    UNITMAP = {
+        "y" => 365 * 24 * 60 * 60,
+        "d" => 24 * 60 * 60,
+        "h" => 60 * 60,
+        "s" => 1
+    }
+
+    attr_reader :name, :cert_type, :csr, :issuer, :serial
+
+    def initialize(cert_type, csr, issuer, serial)
+        @cert_type, @csr, @issuer, @serial = cert_type, csr, issuer, serial
+
+        @name = @csr.subject
+    end
+
+    # Actually generate our certificate.
+    def result
+        @cert = OpenSSL::X509::Certificate.new
+
+        @cert.version = 2 # X509v3
+        @cert.subject = @csr.subject
+        @cert.issuer = @issuer.subject
+        @cert.public_key = @csr.public_key
+        @cert.serial = @serial
+
+        build_extensions()
+
+        set_ttl
+
+        @cert
+    end
+
+    private
+
+    # This is pretty ugly, but I'm not really sure it's even possible to do
+    # it any other way.
+    def build_extensions
+        @ef = OpenSSL::X509::ExtensionFactory.new
+
+        @ef.subject_certificate = @cert
+
+        if @issuer.is_a?(OpenSSL::X509::Request) # It's a self-signed cert
+            @ef.issuer_certificate = @cert
+        else
+            @ef.issuer_certificate = @issuer
+        end
+
+        @subject_alt_name = []
+        @key_usage = nil
+        @ext_key_usage = nil
+        @extensions = []
+
+        method = "add_#{@cert_type.to_s}_extensions"
+
+        begin
+            send(method)
+        rescue NoMethodError
+            raise ArgumentError, "%s is an invalid certificate type" % @cert_type
+        end
+
+        @extensions << @ef.create_extension("nsComment", "Puppet Ruby/OpenSSL Generated Certificate")
+        @extensions << @ef.create_extension("basicConstraints", @basic_constraint, true)
+        @extensions << @ef.create_extension("subjectKeyIdentifier", "hash")
+        @extensions << @ef.create_extension("keyUsage", @key_usage.join(",")) if @key_usage
+        @extensions << @ef.create_extension("extendedKeyUsage", @ext_key_usage.join(",")) if @ext_key_usage
+        @extensions << @ef.create_extension("subjectAltName", @subject_alt_name.join(",")) if ! @subject_alt_name.empty?
+
+        @cert.extensions = @extensions
+
+        # for some reason this _must_ be the last extension added
+        @extensions << @ef.create_extension("authorityKeyIdentifier", "keyid:always,issuer:always") if @cert_type == :ca
+    end
+
+    # TTL for new certificates in seconds. If config param :ca_ttl is set,
+    # use that, otherwise use :ca_days for backwards compatibility
+    def ttl
+        ttl = Puppet.settings[:ca_ttl]
+
+        return ttl unless ttl.is_a?(String)
+
+        raise ArgumentError, "Invalid ca_ttl #{ttl}" unless ttl =~ /^(\d+)(y|d|h|s)$/
+
+        return $1.to_i * UNITMAP[$2]
+    end
+
+    def set_ttl
+        # Make the certificate valid as of yesterday, because
+        # so many people's clocks are out of sync.
+        from = Time.now - (60*60*24)
+        @cert.not_before = from
+        @cert.not_after = from + ttl
+    end
+
+    # Woot! We're a CA.
+    def add_ca_extensions
+        @basic_constraint = "CA:TRUE"
+        @key_usage = %w{cRLSign keyCertSign}
+    end
+
+    # We're a terminal CA, probably not self-signed.
+    def add_terminalsubca_extensions
+        @basic_constraint = "CA:TRUE,pathlen:0"
+        @key_usage = %w{cRLSign keyCertSign}
+    end
+
+    # We're a normal server.
+    def add_server_extensions
+        @basic_constraint = "CA:FALSE"
+        dnsnames = Puppet[:certdnsnames]
+        name = @name.to_s.sub(%r{/CN=},'')
+        if dnsnames != ""
+            dnsnames.split(':').each { |d| @subject_alt_name << 'DNS:' + d }
+            @subject_alt_name << 'DNS:' + name # Add the fqdn as an alias
+        elsif name == Facter.value(:fqdn) # we're a CA server, and thus probably the server
+            @subject_alt_name << 'DNS:' + "puppet" # Add 'puppet' as an alias
+            @subject_alt_name << 'DNS:' + name # Add the fqdn as an alias
+            @subject_alt_name << 'DNS:' + name.sub(/^[^.]+./, "puppet.") # add puppet.domain as an alias
+        end
+        @key_usage = %w{digitalSignature keyEncipherment}
+        @ext_key_usage = %w{serverAuth clientAuth emailProtection}
+    end
+
+    # Um, no idea.
+    def add_ocsp_extensions
+        @basic_constraint = "CA:FALSE"
+        @key_usage = %w{nonRepudiation digitalSignature}
+        @ext_key_usage = %w{serverAuth OCSPSigning}
+    end
+
+    # Normal client.
+    def add_client_extensions
+        @basic_constraint = "CA:FALSE"
+        @key_usage = %w{nonRepudiation digitalSignature keyEncipherment}
+        @ext_key_usage = %w{clientAuth emailProtection}
+
+        @extensions << @ef.create_extension("nsCertType", "client,email")
+    end
+end
+

data/lib/puppet/ssl/certificate_request.rb

@@ -0,0 +1,51 @@
+require 'puppet/ssl/base'
+
+# Manage certificate requests.
+class Puppet::SSL::CertificateRequest < Puppet::SSL::Base
+    wraps OpenSSL::X509::Request
+
+    extend Puppet::Indirector
+    indirects :certificate_request, :terminus_class => :file
+
+    # Convert a string into an instance.
+    def self.from_s(string)
+        instance = wrapped_class.new(string)
+        name = instance.subject.to_s.sub(/\/CN=/i, '').downcase
+        result = new(name)
+        result.content = instance
+        result
+    end
+
+    # Because of how the format handler class is included, this
+    # can't be in the base class.
+    def self.supported_formats
+        [:s]
+    end
+
+    # How to create a certificate request with our system defaults.
+    def generate(key)
+        Puppet.info "Creating a new SSL certificate request for %s" % name
+
+        # Support either an actual SSL key, or a Puppet key.
+        key = key.content if key.is_a?(Puppet::SSL::Key)
+
+        csr = OpenSSL::X509::Request.new
+        csr.version = 0
+        csr.subject = OpenSSL::X509::Name.new([["CN", name]])
+        csr.public_key = key.public_key
+        csr.sign(key, OpenSSL::Digest::MD5.new)
+
+        raise Puppet::Error, "CSR sign verification failed; you need to clean the certificate request for %s on the server" % name unless csr.verify(key.public_key)
+
+        @content = csr
+    end
+
+    def save(args = {})
+        super()
+
+        # Try to autosign the CSR.
+        if ca = Puppet::SSL::CertificateAuthority.instance
+            ca.autosign
+        end
+    end
+end

data/lib/puppet/ssl/certificate_revocation_list.rb

@@ -0,0 +1,86 @@
+require 'puppet/ssl/base'
+require 'puppet/indirector'
+
+# Manage the CRL.
+class Puppet::SSL::CertificateRevocationList < Puppet::SSL::Base
+    wraps OpenSSL::X509::CRL
+
+    extend Puppet::Indirector
+    indirects :certificate_revocation_list, :terminus_class => :file
+
+    # Convert a string into an instance.
+    def self.from_s(string)
+        instance = wrapped_class.new(string)
+        result = new('foo') # The name doesn't matter
+        result.content = instance
+        result
+    end
+
+    # Because of how the format handler class is included, this
+    # can't be in the base class.
+    def self.supported_formats
+        [:s]
+    end
+
+    # Knows how to create a CRL with our system defaults.
+    def generate(cert, cakey)
+        Puppet.info "Creating a new certificate revocation list"
+        @content = wrapped_class.new
+        @content.issuer = cert.subject
+        @content.version = 1
+
+        # Init the CRL number.
+        crlNum = OpenSSL::ASN1::Integer(0)
+        @content.extensions = [OpenSSL::X509::Extension.new("crlNumber", crlNum)]
+
+        # Set last/next update
+        @content.last_update = Time.now
+        # Keep CRL valid for 5 years
+        @content.next_update = Time.now + 5 * 365*24*60*60
+
+        @content.sign(cakey, OpenSSL::Digest::SHA1.new)
+
+        @content
+    end
+
+    # The name doesn't actually matter; there's only one CRL.
+    # We just need the name so our Indirector stuff all works more easily.
+    def initialize(fakename)
+        raise Puppet::Error, "Cannot manage the CRL when :cacrl is set to false" if [false, "false"].include?(Puppet[:cacrl])
+
+        @name = "crl"
+    end
+
+    # Revoke the certificate with serial number SERIAL issued by this
+    # CA, then write the CRL back to disk. The REASON must be one of the
+    # OpenSSL::OCSP::REVOKED_* reasons
+    def revoke(serial, cakey, reason = OpenSSL::OCSP::REVOKED_STATUS_KEYCOMPROMISE)
+        Puppet.notice "Revoked certificate with serial %s" % serial
+        time = Time.now
+
+        # Add our revocation to the CRL.
+        revoked = OpenSSL::X509::Revoked.new
+        revoked.serial = serial
+        revoked.time = time
+        enum = OpenSSL::ASN1::Enumerated(reason)
+        ext = OpenSSL::X509::Extension.new("CRLReason", enum)
+        revoked.add_extension(ext)
+        @content.add_revoked(revoked)
+
+        # Increment the crlNumber
+        e = @content.extensions.find { |e| e.oid == 'crlNumber' }
+        ext = @content.extensions.reject { |e| e.oid == 'crlNumber' }
+        crlNum = OpenSSL::ASN1::Integer(e ? e.value.to_i + 1 : 0)
+        ext << OpenSSL::X509::Extension.new("crlNumber", crlNum)
+        @content.extensions = ext
+
+        # Set last/next update
+        @content.last_update = time
+        # Keep CRL valid for 5 years
+        @content.next_update = time + 5 * 365*24*60*60
+
+        @content.sign(cakey, OpenSSL::Digest::SHA1.new)
+
+        save
+    end
+end

data/lib/puppet/ssl/host.rb

@@ -0,0 +1,271 @@
+require 'puppet/ssl'
+require 'puppet/ssl/key'
+require 'puppet/ssl/certificate'
+require 'puppet/ssl/certificate_request'
+require 'puppet/ssl/certificate_revocation_list'
+require 'puppet/util/cacher'
+
+# The class that manages all aspects of our SSL certificates --
+# private keys, public keys, requests, etc.
+class Puppet::SSL::Host
+    # Yay, ruby's strange constant lookups.
+    Key = Puppet::SSL::Key
+    Certificate = Puppet::SSL::Certificate
+    CertificateRequest = Puppet::SSL::CertificateRequest
+    CertificateRevocationList = Puppet::SSL::CertificateRevocationList
+
+    attr_reader :name
+    attr_accessor :ca
+
+    attr_writer :key, :certificate, :certificate_request
+
+    class << self
+        include Puppet::Util::Cacher
+
+        cached_attr(:localhost) do
+            result = new()
+            result.generate unless result.certificate
+            result.key # Make sure it's read in
+            result
+        end
+    end
+
+    CA_NAME = "ca"
+    # This is the constant that people will use to mark that a given host is
+    # a certificate authority.
+    def self.ca_name
+        CA_NAME
+    end
+
+    class << self
+        attr_reader :ca_location
+    end
+
+    # Configure how our various classes interact with their various terminuses.
+    def self.configure_indirection(terminus, cache = nil)
+        Certificate.terminus_class = terminus
+        CertificateRequest.terminus_class = terminus
+        CertificateRevocationList.terminus_class = terminus
+
+        if cache
+            # This is weird; we don't actually cache our keys, we
+            # use what would otherwise be the cache as our normal
+            # terminus.
+            Key.terminus_class = cache
+        else
+            Key.terminus_class = terminus
+        end
+
+        if cache
+            Certificate.cache_class = cache
+            CertificateRequest.cache_class = cache
+            CertificateRevocationList.cache_class = cache
+        else
+            # Make sure we have no cache configured.  puppetmasterd
+            # switches the configurations around a bit, so it's important
+            # that we specify the configs for absolutely everything, every
+            # time.
+            Certificate.cache_class = nil
+            CertificateRequest.cache_class = nil
+            CertificateRevocationList.cache_class = nil
+        end
+    end
+
+    CA_MODES = {
+        # Our ca is local, so we use it as the ultimate source of information
+        # And we cache files locally.
+        :local => [:ca, :file],
+        # We're a remote CA client.
+        :remote => [:rest, :file],
+        # We are the CA, so we don't have read/write access to the normal certificates.
+        :only => [:ca],
+        # We have no CA, so we just look in the local file store.
+        :none => [:file]
+    }
+
+    # Specify how we expect to interact with our certificate authority.
+    def self.ca_location=(mode)
+        raise ArgumentError, "CA Mode can only be %s" % CA_MODES.collect { |m| m.to_s }.join(", ") unless CA_MODES.include?(mode)
+
+        @ca_location = mode
+
+        configure_indirection(*CA_MODES[@ca_location])
+    end
+
+    # Remove all traces of a given host
+    def self.destroy(name)
+        [Key, Certificate, CertificateRequest].inject(false) do |result, klass|
+            if klass.destroy(name)
+                result = true
+            end
+            result
+        end
+    end
+
+    # Search for more than one host, optionally only specifying
+    # an interest in hosts with a given file type.
+    # This just allows our non-indirected class to have one of
+    # indirection methods.
+    def self.search(options = {})
+        classes = [Key, CertificateRequest, Certificate]
+        if klass = options[:for]
+            classlist = [klass].flatten
+        else
+            classlist = [Key, CertificateRequest, Certificate]
+        end
+
+        # Collect the results from each class, flatten them, collect all of the names, make the name list unique,
+        # then create a Host instance for each one.
+        classlist.collect { |klass| klass.search }.flatten.collect { |r| r.name }.uniq.collect do |name|
+            new(name)
+        end
+    end
+
+    # Is this a ca host, meaning that all of its files go in the CA location?
+    def ca?
+        ca
+    end
+
+    def key
+        return nil unless @key ||= Key.find(name)
+        @key
+    end
+
+    # This is the private key; we can create it from scratch
+    # with no inputs.
+    def generate_key
+        @key = Key.new(name)
+        @key.generate
+        begin
+            @key.save
+        rescue
+            @key = nil
+            raise
+        end
+        true
+    end
+
+    def certificate_request
+        return nil unless @certificate_request ||= CertificateRequest.find(name)
+        @certificate_request
+    end
+
+    # Our certificate request requires the key but that's all.
+    def generate_certificate_request
+        generate_key unless key
+        @certificate_request = CertificateRequest.new(name)
+        @certificate_request.generate(key.content)
+        begin
+            @certificate_request.save
+        rescue
+            @certificate_request = nil
+            raise
+        end
+
+        return true
+    end
+
+    def certificate
+        unless @certificate
+            generate_key unless key
+
+            # get the CA cert first, since it's required for the normal cert
+            # to be of any use.
+            return nil unless Certificate.find("ca") unless ca?
+            return nil unless @certificate = Certificate.find(name)
+
+            unless certificate_matches_key?
+                raise Puppet::Error, "Retrieved certificate does not match private key; please remove certificate from server and regenerate it with the current key"
+            end
+        end
+        @certificate
+    end
+
+    def certificate_matches_key?
+        return false unless key
+        return false unless certificate
+
+        return certificate.content.check_private_key(key.content)
+    end
+
+    # Generate all necessary parts of our ssl host.
+    def generate
+        generate_key unless key
+        generate_certificate_request unless certificate_request
+
+        # If we can get a CA instance, then we're a valid CA, and we
+        # should use it to sign our request; else, just try to read
+        # the cert.
+        if ! certificate() and ca = Puppet::SSL::CertificateAuthority.instance
+            ca.sign(self.name)
+        end
+    end
+
+    def initialize(name = nil)
+        @name = (name || Puppet[:certname]).downcase
+        @key = @certificate = @certificate_request = nil
+        @ca = (name == self.class.ca_name)
+    end
+
+    # Extract the public key from the private key.
+    def public_key
+        key.content.public_key
+    end
+
+    # Create/return a store that uses our SSL info to validate
+    # connections.
+    def ssl_store(purpose = OpenSSL::X509::PURPOSE_ANY)
+        unless defined?(@ssl_store) and @ssl_store
+            @ssl_store = OpenSSL::X509::Store.new
+            @ssl_store.purpose = purpose
+
+            # Use the file path here, because we don't want to cause
+            # a lookup in the middle of setting our ssl connection.
+            @ssl_store.add_file(Puppet[:localcacert])
+
+            # If there's a CRL, add it to our store.
+            if crl = Puppet::SSL::CertificateRevocationList.find("ca")
+                @ssl_store.flags = OpenSSL::X509::V_FLAG_CRL_CHECK_ALL|OpenSSL::X509::V_FLAG_CRL_CHECK
+                @ssl_store.add_crl(crl.content)
+            end
+            return @ssl_store
+        end
+        @ssl_store
+    end
+
+    # Attempt to retrieve a cert, if we don't already have one.
+    def wait_for_cert(time)
+        return if certificate
+        begin
+            generate
+
+            return if certificate
+        rescue StandardError => detail
+            Puppet.err "Could not request certificate: %s" % detail.to_s
+            if time < 1
+                puts "Exiting; failed to retrieve certificate and watiforcert is disabled"
+                exit(1)
+            else
+                sleep(time)
+            end
+            retry
+        end
+
+        if time < 1
+            puts "Exiting; no certificate found and waitforcert is disabled"
+            exit(1)
+        end
+
+        while true do
+            sleep time
+            begin
+                break if certificate
+                Puppet.notice "Did not receive certificate"
+            rescue StandardError => detail
+                Puppet.err "Could not request certificate: %s" % detail.to_s
+            end
+        end
+    end
+end
+
+require 'puppet/ssl/certificate_authority'