puppet 0.25.5 → 2.6.0

data/lib/puppet/ssl.rb

@@ -3,5 +3,6 @@ require 'puppet'
 require 'openssl'
 
 module Puppet::SSL # :nodoc:
-    require 'puppet/ssl/host'
+  CA_NAME = "ca"
+  require 'puppet/ssl/host'
 end

data/lib/puppet/ssl/base.rb

@@ -2,61 +2,78 @@ require 'puppet/ssl'
 
 # The base class for wrapping SSL instances.
 class Puppet::SSL::Base
-    # For now, use the YAML separator.
-    SEPARATOR = "\n---\n"
+  # For now, use the YAML separator.
+  SEPARATOR = "\n---\n"
 
-    def self.from_multiple_s(text)
-        text.split(SEPARATOR).collect { |inst| from_s(inst) }
-    end
+  def self.from_multiple_s(text)
+    text.split(SEPARATOR).collect { |inst| from_s(inst) }
+  end
 
-    def self.to_multiple_s(instances)
-        instances.collect { |inst| inst.to_s }.join(SEPARATOR)
-    end
+  def self.to_multiple_s(instances)
+    instances.collect { |inst| inst.to_s }.join(SEPARATOR)
+  end
 
-    def self.wraps(klass)
-        @wrapped_class = klass
-    end
+  def self.wraps(klass)
+    @wrapped_class = klass
+  end
 
-    def self.wrapped_class
-        raise(Puppet::DevError, "%s has not declared what class it wraps" % self) unless defined?(@wrapped_class)
-        @wrapped_class
-    end
+  def self.wrapped_class
+    raise(Puppet::DevError, "#{self} has not declared what class it wraps") unless defined?(@wrapped_class)
+    @wrapped_class
+  end
 
-    attr_accessor :name, :content
+  attr_accessor :name, :content
 
-    # Is this file for the CA?
-    def ca?
-        name == Puppet::SSL::Host.ca_name
-    end
+  # Is this file for the CA?
+  def ca?
+    name == Puppet::SSL::Host.ca_name
+  end
 
-    def generate
-        raise Puppet::DevError, "%s did not override 'generate'" % self.class
-    end
+  def generate
+    raise Puppet::DevError, "#{self.class} did not override 'generate'"
+  end
 
-    def initialize(name)
-        @name = name.to_s.downcase
-    end
+  def initialize(name)
+    @name = name.to_s.downcase
+  end
 
-    # Read content from disk appropriately.
-    def read(path)
-        @content = wrapped_class.new(File.read(path))
-    end
+  # Read content from disk appropriately.
+  def read(path)
+    @content = wrapped_class.new(File.read(path))
+  end
 
-    # Convert our thing to pem.
-    def to_s
-        return "" unless content
-        content.to_pem
-    end
+  # Convert our thing to pem.
+  def to_s
+    return "" unless content
+    content.to_pem
+  end
 
-    # Provide the full text of the thing we're dealing with.
-    def to_text
-        return "" unless content
-        content.to_text
-    end
+  # Provide the full text of the thing we're dealing with.
+  def to_text
+    return "" unless content
+    content.to_text
+  end
 
-    private
+  def fingerprint(md = :MD5)
+    require 'openssl/digest'
 
-    def wrapped_class
-        self.class.wrapped_class
+    # ruby 1.8.x openssl digest constants are string
+    # but in 1.9.x they are symbols
+    mds = md.to_s.upcase
+    if OpenSSL::Digest.constants.include?(mds)
+      md = mds
+    elsif OpenSSL::Digest.constants.include?(mds.to_sym)
+      md = mds.to_sym
+    else
+      raise ArgumentError, "#{md} is not a valid digest algorithm for fingerprinting certificate #{name}"
     end
+
+    OpenSSL::Digest.const_get(md).hexdigest(content.to_der).scan(/../).join(':').upcase
+  end
+
+  private
+
+  def wrapped_class
+    self.class.wrapped_class
+  end
 end

data/lib/puppet/ssl/certificate.rb

@@ -6,29 +6,29 @@ require 'puppet/ssl/base'
 # retrieve them from the CA (or not, as is often
 # the case).
 class Puppet::SSL::Certificate < Puppet::SSL::Base
-    # This is defined from the base class
-    wraps OpenSSL::X509::Certificate
+  # This is defined from the base class
+  wraps OpenSSL::X509::Certificate
 
-    extend Puppet::Indirector
-    indirects :certificate, :terminus_class => :file
+  extend Puppet::Indirector
+  indirects :certificate, :terminus_class => :file
 
-    # Convert a string into an instance.
-    def self.from_s(string)
-        instance = wrapped_class.new(string)
-        name = instance.subject.to_s.sub(/\/CN=/i, '').downcase
-        result = new(name)
-        result.content = instance
-        result
-    end
+  # Convert a string into an instance.
+  def self.from_s(string)
+    instance = wrapped_class.new(string)
+    name = instance.subject.to_s.sub(/\/CN=/i, '').downcase
+    result = new(name)
+    result.content = instance
+    result
+  end
 
-    # Because of how the format handler class is included, this
-    # can't be in the base class.
-    def self.supported_formats
-        [:s]
-    end
+  # Because of how the format handler class is included, this
+  # can't be in the base class.
+  def self.supported_formats
+    [:s]
+  end
 
-    def expiration
-        return nil unless content
-        return content.not_after
-    end
+  def expiration
+    return nil unless content
+    content.not_after
+  end
 end

data/lib/puppet/ssl/certificate_authority.rb

@@ -11,288 +11,274 @@ require 'puppet/util/cacher'
 # it can also be seen as a general interface into all of the
 # SSL stuff.
 class Puppet::SSL::CertificateAuthority
-    require 'puppet/ssl/certificate_factory'
-    require 'puppet/ssl/inventory'
-    require 'puppet/ssl/certificate_revocation_list'
+  require 'puppet/ssl/certificate_factory'
+  require 'puppet/ssl/inventory'
+  require 'puppet/ssl/certificate_revocation_list'
+  require 'puppet/ssl/certificate_authority/interface'
+  require 'puppet/network/authstore'
 
-    require 'puppet/ssl/certificate_authority/interface'
+  class CertificateVerificationError < RuntimeError
+    attr_accessor :error_code
 
-    class CertificateVerificationError < RuntimeError
-        attr_accessor :error_code
-
-        def initialize(code)
-            @error_code = code
-        end
+    def initialize(code)
+      @error_code = code
     end
+  end
 
-    class << self
-        include Puppet::Util::Cacher
+  class << self
+    include Puppet::Util::Cacher
 
-        cached_attr(:singleton_instance) { new }
-    end
+    cached_attr(:singleton_instance) { new }
+  end
 
-    def self.ca?
-        return false unless Puppet[:ca]
-        return false unless Puppet[:name] == "puppetmasterd"
-        return true
-    end
+  def self.ca?
+    return false unless Puppet[:ca]
+    return false unless Puppet.run_mode.master?
+    true
+  end
 
-    # If this process can function as a CA, then return a singleton
-    # instance.
-    def self.instance
-        return nil unless ca?
+  # If this process can function as a CA, then return a singleton
+  # instance.
+  def self.instance
+    return nil unless ca?
 
-        singleton_instance
-    end
+    singleton_instance
+  end
 
-    attr_reader :name, :host
+  attr_reader :name, :host
 
-    # Create and run an applicator.  I wanted to build an interface where you could do
-    # something like 'ca.apply(:generate).to(:all) but I don't think it's really possible.
-    def apply(method, options)
-        unless options[:to]
-            raise ArgumentError, "You must specify the hosts to apply to; valid values are an array or the symbol :all"
-        end
-        applier = Interface.new(method, options[:to])
+  # Create and run an applicator.  I wanted to build an interface where you could do
+  # something like 'ca.apply(:generate).to(:all) but I don't think it's really possible.
+  def apply(method, options)
+    raise ArgumentError, "You must specify the hosts to apply to; valid values are an array or the symbol :all" unless options[:to]
+    applier = Interface.new(method, options)
 
-        applier.apply(self)
-    end
+    applier.apply(self)
+  end
 
-    # If autosign is configured, then autosign all CSRs that match our configuration.
-    def autosign
-        return unless auto = autosign?
+  # If autosign is configured, then autosign all CSRs that match our configuration.
+  def autosign
+    return unless auto = autosign?
 
-        store = nil
-        if auto != true
-            store = autosign_store(auto)
-        end
+    store = nil
+    store = autosign_store(auto) if auto != true
 
-        Puppet::SSL::CertificateRequest.search("*").each do |csr|
-            sign(csr.name) if auto == true or store.allowed?(csr.name, "127.1.1.1")
-        end
+    Puppet::SSL::CertificateRequest.search("*").each do |csr|
+      sign(csr.name) if auto == true or store.allowed?(csr.name, "127.1.1.1")
+    end
+  end
+
+  # Do we autosign?  This returns true, false, or a filename.
+  def autosign?
+    auto = Puppet[:autosign]
+    return false if ['false', false].include?(auto)
+    return true if ['true', true].include?(auto)
+
+    raise ArgumentError, "The autosign configuration '#{auto}' must be a fully qualified file" unless auto =~ /^\//
+    FileTest.exist?(auto) && auto
+  end
+
+  # Create an AuthStore for autosigning.
+  def autosign_store(file)
+    auth = Puppet::Network::AuthStore.new
+    File.readlines(file).each do |line|
+      next if line =~ /^\s*#/
+      next if line =~ /^\s*$/
+      auth.allow(line.chomp)
     end
 
-    # Do we autosign?  This returns true, false, or a filename.
-    def autosign?
-        auto = Puppet[:autosign]
-        return false if ['false', false].include?(auto)
-        return true if ['true', true].include?(auto)
-
-        raise ArgumentError, "The autosign configuration '%s' must be a fully qualified file" % auto unless auto =~ /^\//
-        if FileTest.exist?(auto)
-            return auto
-        else
-            return false
-        end
+    auth
+  end
+
+  # Retrieve (or create, if necessary) the certificate revocation list.
+  def crl
+    unless defined?(@crl)
+      unless @crl = Puppet::SSL::CertificateRevocationList.find(Puppet::SSL::CA_NAME)
+        @crl = Puppet::SSL::CertificateRevocationList.new(Puppet::SSL::CA_NAME)
+        @crl.generate(host.certificate.content, host.key.content)
+        @crl.save
+      end
     end
+    @crl
+  end
 
-    # Create an AuthStore for autosigning.
-    def autosign_store(file)
-        auth = Puppet::Network::AuthStore.new
-        File.readlines(file).each do |line|
-            next if line =~ /^\s*#/
-            next if line =~ /^\s*$/
-            auth.allow(line.chomp)
-        end
+  # Delegate this to our Host class.
+  def destroy(name)
+    Puppet::SSL::Host.destroy(name)
+  end
 
-        auth
-    end
+  # Generate a new certificate.
+  def generate(name)
+    raise ArgumentError, "A Certificate already exists for #{name}" if Puppet::SSL::Certificate.find(name)
+    host = Puppet::SSL::Host.new(name)
 
-    # Retrieve (or create, if necessary) the certificate revocation list.
-    def crl
-        unless defined?(@crl)
-            unless @crl = Puppet::SSL::CertificateRevocationList.find("ca")
-                @crl = Puppet::SSL::CertificateRevocationList.new("ca")
-                @crl.generate(host.certificate.content, host.key.content)
-                @crl.save
-            end
-        end
-        @crl
-    end
+    host.generate_certificate_request
 
-    # Delegate this to our Host class.
-    def destroy(name)
-        Puppet::SSL::Host.destroy(name)
-    end
+    sign(name)
+  end
 
-    # Generate a new certificate.
-    def generate(name)
-        raise ArgumentError, "A Certificate already exists for %s" % name if Puppet::SSL::Certificate.find(name)
-        host = Puppet::SSL::Host.new(name)
+  # Generate our CA certificate.
+  def generate_ca_certificate
+    generate_password unless password?
 
-        host.generate_certificate_request
+    host.generate_key unless host.key
 
-        sign(name)
-    end
+    # Create a new cert request.  We do this
+    # specially, because we don't want to actually
+    # save the request anywhere.
+    request = Puppet::SSL::CertificateRequest.new(host.name)
+    request.generate(host.key)
 
-    # Generate our CA certificate.
-    def generate_ca_certificate
-        generate_password unless password?
+    # Create a self-signed certificate.
+    @certificate = sign(host.name, :ca, request)
 
-        host.generate_key unless host.key
+    # And make sure we initialize our CRL.
+    crl
+  end
 
-        # Create a new cert request.  We do this
-        # specially, because we don't want to actually
-        # save the request anywhere.
-        request = Puppet::SSL::CertificateRequest.new(host.name)
-        request.generate(host.key)
+  def initialize
+    Puppet.settings.use :main, :ssl, :ca
 
-        # Create a self-signed certificate.
-        @certificate = sign(host.name, :ca, request)
+    @name = Puppet[:certname]
 
-        # And make sure we initialize our CRL.
-        crl()
-    end
+    @host = Puppet::SSL::Host.new(Puppet::SSL::Host.ca_name)
 
-    def initialize
-        Puppet.settings.use :main, :ssl, :ca
+    setup
+  end
 
-        @name = Puppet[:certname]
+  # Retrieve (or create, if necessary) our inventory manager.
+  def inventory
+    @inventory ||= Puppet::SSL::Inventory.new
+  end
 
-        @host = Puppet::SSL::Host.new(Puppet::SSL::Host.ca_name)
+  # Generate a new password for the CA.
+  def generate_password
+    pass = ""
+    20.times { pass += (rand(74) + 48).chr }
 
-        setup()
+    begin
+      Puppet.settings.write(:capass) { |f| f.print pass }
+    rescue Errno::EACCES => detail
+      raise Puppet::Error, "Could not write CA password: #{detail}"
     end
 
-    # Retrieve (or create, if necessary) our inventory manager.
-    def inventory
-        unless defined?(@inventory)
-            @inventory = Puppet::SSL::Inventory.new
-        end
-        @inventory
-    end
+    @password = pass
 
-    # Generate a new password for the CA.
-    def generate_password
-        pass = ""
-        20.times { pass += (rand(74) + 48).chr }
+    pass
+  end
 
-        begin
-            Puppet.settings.write(:capass) { |f| f.print pass }
-        rescue Errno::EACCES => detail
-            raise Puppet::Error, "Could not write CA password: %s" % detail.to_s
-        end
+  # List all signed certificates.
+  def list
+    Puppet::SSL::Certificate.search("*").collect { |c| c.name }
+  end
 
-        @password = pass
+  # Read the next serial from the serial file, and increment the
+  # file so this one is considered used.
+  def next_serial
+    serial = nil
 
-        return pass
-    end
+    # This is slightly odd.  If the file doesn't exist, our readwritelock creates
+    # it, but with a mode we can't actually read in some cases.  So, use
+    # a default before the lock.
+    serial = 0x1 unless FileTest.exist?(Puppet[:serial])
 
-    # List all signed certificates.
-    def list
-        Puppet::SSL::Certificate.search("*").collect { |c| c.name }
-    end
+    Puppet.settings.readwritelock(:serial) { |f|
+      serial ||= File.read(Puppet.settings[:serial]).chomp.hex if FileTest.exist?(Puppet[:serial])
 
-    # Read the next serial from the serial file, and increment the
-    # file so this one is considered used.
-    def next_serial
-        serial = nil
+      # We store the next valid serial, not the one we just used.
+      f << "%04X" % (serial + 1)
+    }
 
-        # This is slightly odd.  If the file doesn't exist, our readwritelock creates
-        # it, but with a mode we can't actually read in some cases.  So, use
-        # a default before the lock.
-        unless FileTest.exist?(Puppet[:serial])
-            serial = 0x1
-        end
+    serial
+  end
 
-        Puppet.settings.readwritelock(:serial) { |f|
-            if FileTest.exist?(Puppet[:serial])
-                serial ||= File.read(Puppet.settings[:serial]).chomp.hex
-            end
+  # Does the password file exist?
+  def password?
+    FileTest.exist? Puppet[:capass]
+  end
 
-            # We store the next valid serial, not the one we just used.
-            f << "%04X" % (serial + 1)
-        }
+  # Print a given host's certificate as text.
+  def print(name)
+    (cert = Puppet::SSL::Certificate.find(name)) ? cert.to_text : nil
+  end
 
-        return serial
-    end
+  # Revoke a given certificate.
+  def revoke(name)
+    raise ArgumentError, "Cannot revoke certificates when the CRL is disabled" unless crl
 
-    # Does the password file exist?
-    def password?
-        FileTest.exist? Puppet[:capass]
+    if cert = Puppet::SSL::Certificate.find(name)
+      serial = cert.content.serial
+    elsif ! serial = inventory.serial(name)
+      raise ArgumentError, "Could not find a serial number for #{name}"
     end
-
-    # Print a given host's certificate as text.
-    def print(name)
-        if cert = Puppet::SSL::Certificate.find(name)
-            return cert.to_text
-        else
-            return nil
-        end
+    crl.revoke(serial, host.key.content)
+  end
+
+  # This initializes our CA so it actually works.  This should be a private
+  # method, except that you can't any-instance stub private methods, which is
+  # *awesome*.  This method only really exists to provide a stub-point during
+  # testing.
+  def setup
+    generate_ca_certificate unless @host.certificate
+  end
+
+  # Sign a given certificate request.
+  def sign(hostname, cert_type = :server, self_signing_csr = nil)
+    # This is a self-signed certificate
+    if self_signing_csr
+      csr = self_signing_csr
+      issuer = csr.content
+    else
+      unless csr = Puppet::SSL::CertificateRequest.find(hostname)
+        raise ArgumentError, "Could not find certificate request for #{hostname}"
+      end
+      issuer = host.certificate.content
     end
 
-    # Revoke a given certificate.
-    def revoke(name)
-        raise ArgumentError, "Cannot revoke certificates when the CRL is disabled" unless crl
+    cert = Puppet::SSL::Certificate.new(hostname)
+    cert.content = Puppet::SSL::CertificateFactory.new(cert_type, csr.content, issuer, next_serial).result
+    cert.content.sign(host.key.content, OpenSSL::Digest::SHA1.new)
 
-        if cert = Puppet::SSL::Certificate.find(name)
-            serial = cert.content.serial
-        elsif ! serial = inventory.serial(name)
-            raise ArgumentError, "Could not find a serial number for %s" % name
-        end
-        crl.revoke(serial, host.key.content)
-    end
+    Puppet.notice "Signed certificate request for #{hostname}"
 
-    # This initializes our CA so it actually works.  This should be a private
-    # method, except that you can't any-instance stub private methods, which is
-    # *awesome*.  This method only really exists to provide a stub-point during
-    # testing.
-    def setup
-        generate_ca_certificate unless @host.certificate
-    end
+    # Add the cert to the inventory before we save it, since
+    # otherwise we could end up with it being duplicated, if
+    # this is the first time we build the inventory file.
+    inventory.add(cert)
 
-    # Sign a given certificate request.
-    def sign(hostname, cert_type = :server, self_signing_csr = nil)
-        # This is a self-signed certificate
-        if self_signing_csr
-            csr = self_signing_csr
-            issuer = csr.content
-        else
-            unless csr = Puppet::SSL::CertificateRequest.find(hostname)
-                raise ArgumentError, "Could not find certificate request for %s" % hostname
-            end
-            issuer = host.certificate.content
-        end
-
-        cert = Puppet::SSL::Certificate.new(hostname)
-        cert.content = Puppet::SSL::CertificateFactory.new(cert_type, csr.content, issuer, next_serial).result
-        cert.content.sign(host.key.content, OpenSSL::Digest::SHA1.new)
-
-        Puppet.notice "Signed certificate request for %s" % hostname
-
-        # Add the cert to the inventory before we save it, since
-        # otherwise we could end up with it being duplicated, if
-        # this is the first time we build the inventory file.
-        inventory.add(cert)
-
-        # Save the now-signed cert.  This should get routed correctly depending
-        # on the certificate type.
-        cert.save
-
-        # And remove the CSR if this wasn't self signed.
-        Puppet::SSL::CertificateRequest.destroy(csr.name) unless self_signing_csr
-
-        return cert
-    end
+    # Save the now-signed cert.  This should get routed correctly depending
+    # on the certificate type.
+    cert.save
 
-    # Verify a given host's certificate.
-    def verify(name)
-        unless cert = Puppet::SSL::Certificate.find(name)
-            raise ArgumentError, "Could not find a certificate for %s" % name
-        end
-        store = OpenSSL::X509::Store.new
-        store.add_file Puppet[:cacert]
-        store.add_crl crl.content if self.crl
-        store.purpose = OpenSSL::X509::PURPOSE_SSL_CLIENT
-        store.flags = OpenSSL::X509::V_FLAG_CRL_CHECK_ALL|OpenSSL::X509::V_FLAG_CRL_CHECK if Puppet.settings[:certificate_revocation]
-
-        unless store.verify(cert.content)
-            raise CertificateVerificationError.new(store.error), store.error_string
-        end
-    end
+    # And remove the CSR if this wasn't self signed.
+    Puppet::SSL::CertificateRequest.destroy(csr.name) unless self_signing_csr
+
+    cert
+  end
 
-    # List the waiting certificate requests.
-    def waiting?
-        Puppet::SSL::CertificateRequest.search("*").collect { |r| r.name }
+  # Verify a given host's certificate.
+  def verify(name)
+    unless cert = Puppet::SSL::Certificate.find(name)
+      raise ArgumentError, "Could not find a certificate for #{name}"
     end
+    store = OpenSSL::X509::Store.new
+    store.add_file Puppet[:cacert]
+    store.add_crl crl.content if self.crl
+    store.purpose = OpenSSL::X509::PURPOSE_SSL_CLIENT
+    store.flags = OpenSSL::X509::V_FLAG_CRL_CHECK_ALL|OpenSSL::X509::V_FLAG_CRL_CHECK if Puppet.settings[:certificate_revocation]
+
+    raise CertificateVerificationError.new(store.error), store.error_string unless store.verify(cert.content)
+  end
+
+  def fingerprint(name, md = :MD5)
+    unless cert = Puppet::SSL::Certificate.find(name) || Puppet::SSL::CertificateRequest.find(name)
+      raise ArgumentError, "Could not find a certificate or csr for #{name}"
+    end
+    cert.fingerprint(md)
+  end
+
+  # List the waiting certificate requests.
+  def waiting?
+    Puppet::SSL::CertificateRequest.search("*").collect { |r| r.name }
+  end
 end