puppet 0.25.5 → 2.6.0

data/lib/puppet/ssl/certificate_authority/interface.rb

@@ -1,118 +1,134 @@
 # This class is basically a hidden class that knows how to act
 # on the CA.  It's only used by the 'puppetca' executable, and its
 # job is to provide a CLI-like interface to the CA class.
-class Puppet::SSL::CertificateAuthority::Interface
-    INTERFACE_METHODS = [:destroy, :list, :revoke, :generate, :sign, :print, :verify]
+module Puppet
+  module SSL
+    class CertificateAuthority
+      class Interface
+        INTERFACE_METHODS = [:destroy, :list, :revoke, :generate, :sign, :print, :verify, :fingerprint]
 
-    class InterfaceError < ArgumentError; end
+        class InterfaceError < ArgumentError; end
 
-    attr_reader :method, :subjects
+        attr_reader :method, :subjects, :digest
 
-    # Actually perform the work.
-    def apply(ca)
-        unless subjects or method == :list
-            raise ArgumentError, "You must provide hosts or :all when using %s" % method
-        end
+        # Actually perform the work.
+        def apply(ca)
+          unless subjects or method == :list
+            raise ArgumentError, "You must provide hosts or :all when using #{method}"
+          end
 
-        begin
-            if respond_to?(method)
-                return send(method, ca)
-            end
+          begin
+            return send(method, ca) if respond_to?(method)
 
             (subjects == :all ? ca.list : subjects).each do |host|
-                ca.send(method, host)
+              ca.send(method, host)
             end
-        rescue InterfaceError
+          rescue InterfaceError
             raise
-        rescue => detail
+          rescue => detail
             puts detail.backtrace if Puppet[:trace]
-            Puppet.err "Could not call %s: %s" % [method, detail]
+            Puppet.err "Could not call #{method}: #{detail}"
+          end
         end
-    end
 
-    def generate(ca)
-        raise InterfaceError, "It makes no sense to generate all hosts; you must specify a list" if subjects == :all
+        def generate(ca)
+          raise InterfaceError, "It makes no sense to generate all hosts; you must specify a list" if subjects == :all
 
-        subjects.each do |host|
+          subjects.each do |host|
             ca.generate(host)
+          end
         end
-    end
 
-    def initialize(method, subjects)
-        self.method = method
-        self.subjects = subjects
-    end
+        def initialize(method, options)
+          self.method = method
+          self.subjects = options[:to]
+          @digest = options[:digest] || :MD5
+        end
 
-    # List the hosts.
-    def list(ca)
-        unless subjects
+        # List the hosts.
+        def list(ca)
+          unless subjects
             puts ca.waiting?.join("\n")
             return nil
-        end
+          end
 
-        signed = ca.list
-        requests = ca.waiting?
+          signed = ca.list
+          requests = ca.waiting?
 
-        if subjects == :all
+          if subjects == :all
             hosts = [signed, requests].flatten
-        else
+          elsif subjects == :signed
+            hosts = signed.flatten
+          else
             hosts = subjects
-        end
+          end
 
-        hosts.uniq.sort.each do |host|
+          hosts.uniq.sort.each do |host|
             invalid = false
             begin
-                ca.verify(host) unless requests.include?(host)
+              ca.verify(host) unless requests.include?(host)
             rescue Puppet::SSL::CertificateAuthority::CertificateVerificationError => details
-                invalid = details.to_s
+              invalid = details.to_s
             end
             if not invalid and signed.include?(host)
-                puts "+ " + host
+              puts "+ #{host} (#{ca.fingerprint(host, @digest)})"
             elsif invalid
-                puts "- " + host + " (" + invalid + ")"
+              puts "- #{host} (#{ca.fingerprint(host, @digest)}) (#{invalid})"
             else
-                puts host
+              puts "#{host} (#{ca.fingerprint(host, @digest)})"
             end
+          end
         end
-    end
 
-    # Set the method to apply.
-    def method=(method)
-        raise ArgumentError, "Invalid method %s to apply" % method unless INTERFACE_METHODS.include?(method)
-        @method = method
-    end
+        # Set the method to apply.
+        def method=(method)
+          raise ArgumentError, "Invalid method #{method} to apply" unless INTERFACE_METHODS.include?(method)
+          @method = method
+        end
 
-    # Print certificate information.
-    def print(ca)
-        (subjects == :all ? ca.list : subjects).each do |host|
+        # Print certificate information.
+        def print(ca)
+          (subjects == :all ? ca.list  : subjects).each do |host|
             if value = ca.print(host)
-                puts value
+              puts value
             else
-                Puppet.err "Could not find certificate for %s" % host
+              Puppet.err "Could not find certificate for #{host}"
             end
+          end
         end
-    end
 
-    # Sign a given certificate.
-    def sign(ca)
-        list = subjects == :all ? ca.waiting? : subjects
-        raise InterfaceError, "No waiting certificate requests to sign" if list.empty?
-        list.each do |host|
-            ca.sign(host)
+        # Print certificate information.
+        def fingerprint(ca)
+          (subjects == :all ? ca.list + ca.waiting?: subjects).each do |host|
+            if value = ca.fingerprint(host, @digest)
+              puts "#{host} #{value}"
+            else
+              Puppet.err "Could not find certificate for #{host}"
+            end
+          end
         end
-    end
 
-    # Set the list of hosts we're operating on.  Also supports keywords.
-    def subjects=(value)
-        unless value == :all or value.is_a?(Array)
-            raise ArgumentError, "Subjects must be an array or :all; not %s" % value
+        # Sign a given certificate.
+        def sign(ca)
+          list = subjects == :all ? ca.waiting? : subjects
+          raise InterfaceError, "No waiting certificate requests to sign" if list.empty?
+          list.each do |host|
+            ca.sign(host)
+          end
         end
 
-        if value.is_a?(Array) and value.empty?
-            value = nil
-        end
+        # Set the list of hosts we're operating on.  Also supports keywords.
+        def subjects=(value)
+          unless value == :all or value == :signed or value.is_a?(Array)
+            raise ArgumentError, "Subjects must be an array or :all; not #{value}"
+          end
 
-        @subjects = value
+          value = nil if value.is_a?(Array) and value.empty?
+
+          @subjects = value
+        end
+      end
     end
+  end
 end
 

data/lib/puppet/ssl/certificate_factory.rb

@@ -3,143 +3,143 @@ require 'puppet/ssl'
 # The tedious class that does all the manipulations to the
 # certificate to correctly sign it.  Yay.
 class Puppet::SSL::CertificateFactory
-    # How we convert from various units to the required seconds.
-    UNITMAP = {
-        "y" => 365 * 24 * 60 * 60,
-        "d" => 24 * 60 * 60,
-        "h" => 60 * 60,
-        "s" => 1
-    }
+  # How we convert from various units to the required seconds.
+  UNITMAP = {
+    "y" => 365 * 24 * 60 * 60,
+    "d" => 24 * 60 * 60,
+    "h" => 60 * 60,
+    "s" => 1
+  }
 
-    attr_reader :name, :cert_type, :csr, :issuer, :serial
+  attr_reader :name, :cert_type, :csr, :issuer, :serial
 
-    def initialize(cert_type, csr, issuer, serial)
-        @cert_type, @csr, @issuer, @serial = cert_type, csr, issuer, serial
+  def initialize(cert_type, csr, issuer, serial)
+    @cert_type, @csr, @issuer, @serial = cert_type, csr, issuer, serial
 
-        @name = @csr.subject
-    end
-
-    # Actually generate our certificate.
-    def result
-        @cert = OpenSSL::X509::Certificate.new
-
-        @cert.version = 2 # X509v3
-        @cert.subject = @csr.subject
-        @cert.issuer = @issuer.subject
-        @cert.public_key = @csr.public_key
-        @cert.serial = @serial
-
-        build_extensions()
-
-        set_ttl
-
-        @cert
-    end
-
-    private
-
-    # This is pretty ugly, but I'm not really sure it's even possible to do
-    # it any other way.
-    def build_extensions
-        @ef = OpenSSL::X509::ExtensionFactory.new
-
-        @ef.subject_certificate = @cert
+    @name = @csr.subject
+  end
 
-        if @issuer.is_a?(OpenSSL::X509::Request) # It's a self-signed cert
-            @ef.issuer_certificate = @cert
-        else
-            @ef.issuer_certificate = @issuer
-        end
+  # Actually generate our certificate.
+  def result
+    @cert = OpenSSL::X509::Certificate.new
 
-        @subject_alt_name = []
-        @key_usage = nil
-        @ext_key_usage = nil
-        @extensions = []
+    @cert.version = 2 # X509v3
+    @cert.subject = @csr.subject
+    @cert.issuer = @issuer.subject
+    @cert.public_key = @csr.public_key
+    @cert.serial = @serial
 
-        method = "add_#{@cert_type.to_s}_extensions"
+    build_extensions
 
-        begin
-            send(method)
-        rescue NoMethodError
-            raise ArgumentError, "%s is an invalid certificate type" % @cert_type
-        end
+    set_ttl
 
-        @extensions << @ef.create_extension("nsComment", "Puppet Ruby/OpenSSL Generated Certificate")
-        @extensions << @ef.create_extension("basicConstraints", @basic_constraint, true)
-        @extensions << @ef.create_extension("subjectKeyIdentifier", "hash")
-        @extensions << @ef.create_extension("keyUsage", @key_usage.join(",")) if @key_usage
-        @extensions << @ef.create_extension("extendedKeyUsage", @ext_key_usage.join(",")) if @ext_key_usage
-        @extensions << @ef.create_extension("subjectAltName", @subject_alt_name.join(",")) if ! @subject_alt_name.empty?
+    @cert
+  end
 
-        @cert.extensions = @extensions
+  private
 
-        # for some reason this _must_ be the last extension added
-        @extensions << @ef.create_extension("authorityKeyIdentifier", "keyid:always,issuer:always") if @cert_type == :ca
-    end
-
-    # TTL for new certificates in seconds. If config param :ca_ttl is set,
-    # use that, otherwise use :ca_days for backwards compatibility
-    def ttl
-        ttl = Puppet.settings[:ca_ttl]
-
-        return ttl unless ttl.is_a?(String)
-
-        raise ArgumentError, "Invalid ca_ttl #{ttl}" unless ttl =~ /^(\d+)(y|d|h|s)$/
-
-        return $1.to_i * UNITMAP[$2]
-    end
+  # This is pretty ugly, but I'm not really sure it's even possible to do
+  # it any other way.
+  def build_extensions
+    @ef = OpenSSL::X509::ExtensionFactory.new
 
-    def set_ttl
-        # Make the certificate valid as of yesterday, because
-        # so many people's clocks are out of sync.
-        from = Time.now - (60*60*24)
-        @cert.not_before = from
-        @cert.not_after = from + ttl
-    end
+    @ef.subject_certificate = @cert
 
-    # Woot! We're a CA.
-    def add_ca_extensions
-        @basic_constraint = "CA:TRUE"
-        @key_usage = %w{cRLSign keyCertSign}
+    if @issuer.is_a?(OpenSSL::X509::Request) # It's a self-signed cert
+      @ef.issuer_certificate = @cert
+    else
+      @ef.issuer_certificate = @issuer
     end
 
-    # We're a terminal CA, probably not self-signed.
-    def add_terminalsubca_extensions
-        @basic_constraint = "CA:TRUE,pathlen:0"
-        @key_usage = %w{cRLSign keyCertSign}
-    end
+    @subject_alt_name = []
+    @key_usage = nil
+    @ext_key_usage = nil
+    @extensions = []
 
-    # We're a normal server.
-    def add_server_extensions
-        @basic_constraint = "CA:FALSE"
-        dnsnames = Puppet[:certdnsnames]
-        name = @name.to_s.sub(%r{/CN=},'')
-        if dnsnames != ""
-            dnsnames.split(':').each { |d| @subject_alt_name << 'DNS:' + d }
-            @subject_alt_name << 'DNS:' + name # Add the fqdn as an alias
-        elsif name == Facter.value(:fqdn) # we're a CA server, and thus probably the server
-            @subject_alt_name << 'DNS:' + "puppet" # Add 'puppet' as an alias
-            @subject_alt_name << 'DNS:' + name # Add the fqdn as an alias
-            @subject_alt_name << 'DNS:' + name.sub(/^[^.]+./, "puppet.") # add puppet.domain as an alias
-        end
-        @key_usage = %w{digitalSignature keyEncipherment}
-        @ext_key_usage = %w{serverAuth clientAuth emailProtection}
-    end
+    method = "add_#{@cert_type.to_s}_extensions"
 
-    # Um, no idea.
-    def add_ocsp_extensions
-        @basic_constraint = "CA:FALSE"
-        @key_usage = %w{nonRepudiation digitalSignature}
-        @ext_key_usage = %w{serverAuth OCSPSigning}
+    begin
+      send(method)
+    rescue NoMethodError
+      raise ArgumentError, "#{@cert_type} is an invalid certificate type"
     end
 
-    # Normal client.
-    def add_client_extensions
-        @basic_constraint = "CA:FALSE"
-        @key_usage = %w{nonRepudiation digitalSignature keyEncipherment}
-        @ext_key_usage = %w{clientAuth emailProtection}
-
-        @extensions << @ef.create_extension("nsCertType", "client,email")
+    @extensions << @ef.create_extension("nsComment", "Puppet Ruby/OpenSSL Generated Certificate")
+    @extensions << @ef.create_extension("basicConstraints", @basic_constraint, true)
+    @extensions << @ef.create_extension("subjectKeyIdentifier", "hash")
+    @extensions << @ef.create_extension("keyUsage", @key_usage.join(",")) if @key_usage
+    @extensions << @ef.create_extension("extendedKeyUsage", @ext_key_usage.join(",")) if @ext_key_usage
+    @extensions << @ef.create_extension("subjectAltName", @subject_alt_name.join(",")) if ! @subject_alt_name.empty?
+
+    @cert.extensions = @extensions
+
+    # for some reason this _must_ be the last extension added
+    @extensions << @ef.create_extension("authorityKeyIdentifier", "keyid:always,issuer:always") if @cert_type == :ca
+  end
+
+  # TTL for new certificates in seconds. If config param :ca_ttl is set,
+  # use that, otherwise use :ca_days for backwards compatibility
+  def ttl
+    ttl = Puppet.settings[:ca_ttl]
+
+    return ttl unless ttl.is_a?(String)
+
+    raise ArgumentError, "Invalid ca_ttl #{ttl}" unless ttl =~ /^(\d+)(y|d|h|s)$/
+
+    $1.to_i * UNITMAP[$2]
+  end
+
+  def set_ttl
+    # Make the certificate valid as of yesterday, because
+    # so many people's clocks are out of sync.
+    from = Time.now - (60*60*24)
+    @cert.not_before = from
+    @cert.not_after = from + ttl
+  end
+
+  # Woot! We're a CA.
+  def add_ca_extensions
+    @basic_constraint = "CA:TRUE"
+    @key_usage = %w{cRLSign keyCertSign}
+  end
+
+  # We're a terminal CA, probably not self-signed.
+  def add_terminalsubca_extensions
+    @basic_constraint = "CA:TRUE,pathlen:0"
+    @key_usage = %w{cRLSign keyCertSign}
+  end
+
+  # We're a normal server.
+  def add_server_extensions
+    @basic_constraint = "CA:FALSE"
+    dnsnames = Puppet[:certdnsnames]
+    name = @name.to_s.sub(%r{/CN=},'')
+    if dnsnames != ""
+      dnsnames.split(':').each { |d| @subject_alt_name << 'DNS:' + d }
+      @subject_alt_name << 'DNS:' + name # Add the fqdn as an alias
+    elsif name == Facter.value(:fqdn) # we're a CA server, and thus probably the server
+      @subject_alt_name << 'DNS:' + "puppet" # Add 'puppet' as an alias
+      @subject_alt_name << 'DNS:' + name # Add the fqdn as an alias
+      @subject_alt_name << 'DNS:' + name.sub(/^[^.]+./, "puppet.") # add puppet.domain as an alias
     end
+    @key_usage = %w{digitalSignature keyEncipherment}
+    @ext_key_usage = %w{serverAuth clientAuth emailProtection}
+  end
+
+  # Um, no idea.
+  def add_ocsp_extensions
+    @basic_constraint = "CA:FALSE"
+    @key_usage = %w{nonRepudiation digitalSignature}
+    @ext_key_usage = %w{serverAuth OCSPSigning}
+  end
+
+  # Normal client.
+  def add_client_extensions
+    @basic_constraint = "CA:FALSE"
+    @key_usage = %w{nonRepudiation digitalSignature keyEncipherment}
+    @ext_key_usage = %w{clientAuth emailProtection}
+
+    @extensions << @ef.create_extension("nsCertType", "client,email")
+  end
 end