puppet 2.6.18 → 2.7.1

data/lib/puppet/ssl/certificate_request.rb

@@ -5,7 +5,20 @@ class Puppet::SSL::CertificateRequest < Puppet::SSL::Base
   wraps OpenSSL::X509::Request
 
   extend Puppet::Indirector
-  indirects :certificate_request, :terminus_class => :file
+
+  # If auto-signing is on, sign any certificate requests as they are saved.
+  module AutoSigner
+    def save(instance, key = nil)
+      super
+
+      # Try to autosign the CSR.
+      if ca = Puppet::SSL::CertificateAuthority.instance
+        ca.autosign
+      end
+    end
+  end
+
+  indirects :certificate_request, :terminus_class => :file, :extend => AutoSigner
 
   # Convert a string into an instance.
   def self.from_s(string)
@@ -22,12 +35,8 @@ class Puppet::SSL::CertificateRequest < Puppet::SSL::Base
     [:s]
   end
 
-  def extension_factory
-    @ef ||= OpenSSL::X509::ExtensionFactory.new
-  end
-
   # How to create a certificate request with our system defaults.
-  def generate(key, options = {})
+  def generate(key)
     Puppet.info "Creating a new SSL certificate request for #{name}"
 
     # Support either an actual SSL key, or a Puppet key.
@@ -42,19 +51,6 @@ class Puppet::SSL::CertificateRequest < Puppet::SSL::Base
     csr.version = 0
     csr.subject = OpenSSL::X509::Name.new([["CN", common_name]])
     csr.public_key = key.public_key
-
-    if options[:dns_alt_names] then
-      names = options[:dns_alt_names].split(/\s*,\s*/).map(&:strip) + [name]
-      names = names.sort.uniq.map {|name| "DNS:#{name}" }.join(", ")
-      names = extension_factory.create_extension("subjectAltName", names, false)
-
-      extReq = OpenSSL::ASN1::Set([OpenSSL::ASN1::Sequence([names])])
-
-      # We only support the standard request extensions.  If you really need
-      # msExtReq support, let us know and we can restore them. --daniel 2011-10-10
-      csr.add_attribute(OpenSSL::X509::Attribute.new("extReq", extReq))
-    end
-
     csr.sign(key, OpenSSL::Digest::MD5.new)
 
     raise Puppet::Error, "CSR sign verification failed; you need to clean the certificate request for #{name} on the server" unless csr.verify(key.public_key)
@@ -63,83 +59,4 @@ class Puppet::SSL::CertificateRequest < Puppet::SSL::Base
     Puppet.info "Certificate Request fingerprint (md5): #{fingerprint}"
     @content
   end
-
-  def save(args = {})
-    super()
-
-    # Try to autosign the CSR.
-    if ca = Puppet::SSL::CertificateAuthority.instance
-      ca.autosign
-    end
-  end
-
-  # Return the set of extensions requested on this CSR, in a form designed to
-  # be useful to Ruby: a hash.  Which, not coincidentally, you can pass
-  # successfully to the OpenSSL constructor later, if you want.
-  def request_extensions
-    raise Puppet::Error, "CSR needs content to extract fields" unless @content
-
-    # Prefer the standard extReq, but accept the Microsoft specific version as
-    # a fallback, if the standard version isn't found.
-    ext = @content.attributes.find {|x| x.oid == "extReq" } or
-      @content.attributes.find {|x| x.oid == "msExtReq" }
-    return [] unless ext
-
-    # Assert the structure and extract the names into an array of arrays.
-    unless ext.value.is_a? OpenSSL::ASN1::Set
-      raise Puppet::Error, "In #{ext.oid}, expected Set but found #{ext.value.class}"
-    end
-
-    unless ext.value.value.is_a? Array
-      raise Puppet::Error, "In #{ext.oid}, expected Set[Array] but found #{ext.value.value.class}"
-    end
-
-    unless ext.value.value.length == 1
-      raise Puppet::Error, "In #{ext.oid}, expected Set[Array[...]], but found #{ext.value.value.length} items in the array"
-    end
-
-    san = ext.value.value.first
-    unless san.is_a? OpenSSL::ASN1::Sequence
-      raise Puppet::Error, "In #{ext.oid}, expected Set[Array[Sequence[...]]], but found #{san.class}"
-    end
-    san = san.value
-
-    # OK, now san should be the array of items, validate that...
-    index = -1
-    san.map do |name|
-      index += 1
-
-      unless name.is_a? OpenSSL::ASN1::Sequence
-        raise Puppet::Error, "In #{ext.oid}, expected request extension record #{index} to be a Sequence, but found #{name.class}"
-      end
-      name = name.value
-
-      # OK, turn that into an extension, to unpack the content.  Lovely that
-      # we have to swap the order of arguments to the underlying method, or
-      # perhaps that the ASN.1 representation chose to pack them in a
-      # strange order where the optional component comes *earlier* than the
-      # fixed component in the sequence.
-      case name.length
-      when 2
-        ev = OpenSSL::X509::Extension.new(name[0].value, name[1].value)
-        { "oid" => ev.oid, "value" => ev.value }
-
-      when 3
-        ev = OpenSSL::X509::Extension.new(name[0].value, name[2].value, name[1].value)
-        { "oid" => ev.oid, "value" => ev.value, "critical" => ev.critical? }
-
-      else
-        raise Puppet::Error, "In #{ext.oid}, expected extension record #{index} to have two or three items, but found #{name.length}"
-      end
-    end.flatten
-  end
-
-  def subject_alt_names
-    @subject_alt_names ||= request_extensions.
-      select {|x| x["oid"] = "subjectAltName" }.
-      map {|x| x["value"].split(/\s*,\s*/) }.
-      flatten.
-      sort.
-      uniq
-  end
 end

data/lib/puppet/ssl/certificate_revocation_list.rb

@@ -79,6 +79,6 @@ class Puppet::SSL::CertificateRevocationList < Puppet::SSL::Base
 
     @content.sign(cakey, OpenSSL::Digest::SHA1.new)
 
-    save
+    Puppet::SSL::CertificateRevocationList.indirection.save(self)
   end
 end

data/lib/puppet/ssl/host.rb

@@ -1,3 +1,4 @@
+require 'puppet/indirector'
 require 'puppet/ssl'
 require 'puppet/ssl/key'
 require 'puppet/ssl/certificate'
@@ -15,11 +16,17 @@ class Puppet::SSL::Host
   CertificateRequest = Puppet::SSL::CertificateRequest
   CertificateRevocationList = Puppet::SSL::CertificateRevocationList
 
+  extend Puppet::Indirector
+  indirects :certificate_status, :terminus_class => :file
+
   attr_reader :name
   attr_accessor :ca
 
   attr_writer :key, :certificate, :certificate_request
 
+  # This accessor is used in instances for indirector requests to hold desired state
+  attr_accessor :desired_state
+
   class << self
     include Puppet::Util::Cacher
 
@@ -43,31 +50,38 @@ class Puppet::SSL::Host
 
   # Configure how our various classes interact with their various terminuses.
   def self.configure_indirection(terminus, cache = nil)
-    Certificate.terminus_class = terminus
-    CertificateRequest.terminus_class = terminus
-    CertificateRevocationList.terminus_class = terminus
+    Certificate.indirection.terminus_class = terminus
+    CertificateRequest.indirection.terminus_class = terminus
+    CertificateRevocationList.indirection.terminus_class = terminus
+
+    host_map = {:ca => :file, :file => nil, :rest => :rest}
+    if term = host_map[terminus]
+      self.indirection.terminus_class = term
+    else
+      self.indirection.reset_terminus_class
+    end
 
     if cache
       # This is weird; we don't actually cache our keys, we
       # use what would otherwise be the cache as our normal
       # terminus.
-      Key.terminus_class = cache
+      Key.indirection.terminus_class = cache
     else
-      Key.terminus_class = terminus
+      Key.indirection.terminus_class = terminus
     end
 
     if cache
-      Certificate.cache_class = cache
-      CertificateRequest.cache_class = cache
-      CertificateRevocationList.cache_class = cache
+      Certificate.indirection.cache_class = cache
+      CertificateRequest.indirection.cache_class = cache
+      CertificateRevocationList.indirection.cache_class = cache
     else
       # Make sure we have no cache configured.  puppet master
       # switches the configurations around a bit, so it's important
       # that we specify the configs for absolutely everything, every
       # time.
-      Certificate.cache_class = nil
-      CertificateRequest.cache_class = nil
-      CertificateRevocationList.cache_class = nil
+      Certificate.indirection.cache_class = nil
+      CertificateRequest.indirection.cache_class = nil
+      CertificateRevocationList.indirection.cache_class = nil
     end
   end
 
@@ -85,30 +99,34 @@ class Puppet::SSL::Host
 
   # Specify how we expect to interact with our certificate authority.
   def self.ca_location=(mode)
-    raise ArgumentError, "CA Mode can only be #{CA_MODES.collect { |m| m.to_s }.join(", ")}" unless CA_MODES.include?(mode)
+    modes = CA_MODES.collect { |m, vals| m.to_s }.join(", ")
+    raise ArgumentError, "CA Mode can only be one of: #{modes}" unless CA_MODES.include?(mode)
 
     @ca_location = mode
 
     configure_indirection(*CA_MODES[@ca_location])
   end
 
-  # Remove all traces of a given host
+  # Puppet::SSL::Host is actually indirected now so the original implementation
+  # has been moved into the certificate_status indirector.  This method is in-use
+  # in `puppet cert -c <certname>`.
   def self.destroy(name)
-    [Key, Certificate, CertificateRequest].collect { |part| part.destroy(name) }.any? { |x| x }
+    indirection.destroy(name)
   end
 
-  # Search for more than one host, optionally only specifying
-  # an interest in hosts with a given file type.
-  # This just allows our non-indirected class to have one of
-  # indirection methods.
-  def self.search(options = {})
-    classlist = [options[:for] || [Key, CertificateRequest, Certificate]].flatten
-
-    # Collect the results from each class, flatten them, collect all of the names, make the name list unique,
-    # then create a Host instance for each one.
-    classlist.collect { |klass| klass.search }.flatten.collect { |r| r.name }.uniq.collect do |name|
-      new(name)
+  def self.from_pson(pson)
+    instance = new(pson["name"])
+    if pson["desired_state"]
+      instance.desired_state = pson["desired_state"]
     end
+    instance
+  end
+
+  # Puppet::SSL::Host is actually indirected now so the original implementation
+  # has been moved into the certificate_status indirector.  This method does not
+  # appear to be in use in `puppet cert -l`.
+  def self.search(options = {})
+    indirection.search("*", options)
   end
 
   # Is this a ca host, meaning that all of its files go in the CA location?
@@ -117,7 +135,7 @@ class Puppet::SSL::Host
   end
 
   def key
-    @key ||= Key.find(name)
+    @key ||= Key.indirection.find(name)
   end
 
   # This is the private key; we can create it from scratch
@@ -126,7 +144,7 @@ class Puppet::SSL::Host
     @key = Key.new(name)
     @key.generate
     begin
-      @key.save
+      Key.indirection.save(@key)
     rescue
       @key = nil
       raise
@@ -135,31 +153,16 @@ class Puppet::SSL::Host
   end
 
   def certificate_request
-    @certificate_request ||= CertificateRequest.find(name)
-  end
-
-  def this_csr_is_for_the_current_host
-    name == Puppet[:certname].downcase
+    @certificate_request ||= CertificateRequest.indirection.find(name)
   end
 
   # Our certificate request requires the key but that's all.
-  def generate_certificate_request(options = {})
+  def generate_certificate_request
     generate_key unless key
-
-    # If this is for the current machine...
-    if this_csr_is_for_the_current_host
-      # ...add our configured dns_alt_names
-      if Puppet[:dns_alt_names] and Puppet[:dns_alt_names] != ''
-        options[:dns_alt_names] ||= Puppet[:dns_alt_names]
-      elsif Puppet::SSL::CertificateAuthority.ca? and fqdn = Facter.value(:fqdn) and domain = Facter.value(:domain)
-        options[:dns_alt_names] = "puppet, #{fqdn}, puppet.#{domain}"
-      end
-    end
-
     @certificate_request = CertificateRequest.new(name)
-    @certificate_request.generate(key.content, options)
+    @certificate_request.generate(key.content)
     begin
-      @certificate_request.save
+      CertificateRequest.indirection.save(@certificate_request)
     rescue
       @certificate_request = nil
       raise
@@ -174,8 +177,8 @@ class Puppet::SSL::Host
 
       # get the CA cert first, since it's required for the normal cert
       # to be of any use.
-      return nil unless Certificate.find("ca") unless ca?
-      return nil unless @certificate = Certificate.find(name)
+      return nil unless Certificate.indirection.find("ca") unless ca?
+      return nil unless @certificate = Certificate.indirection.find(name)
 
       unless certificate_matches_key?
         raise Puppet::Error, "Retrieved certificate does not match private key; please remove certificate from server and regenerate it with the current key"
@@ -200,13 +203,12 @@ class Puppet::SSL::Host
     # should use it to sign our request; else, just try to read
     # the cert.
     if ! certificate and ca = Puppet::SSL::CertificateAuthority.instance
-      ca.sign(self.name, true)
+      ca.sign(self.name)
     end
   end
 
   def initialize(name = nil)
     @name = (name || Puppet[:certname]).downcase
-    Puppet::SSL::Base.validate_certname(@name)
     @key = @certificate = @certificate_request = nil
     @ca = (name == self.class.ca_name)
   end
@@ -228,7 +230,7 @@ class Puppet::SSL::Host
       @ssl_store.add_file(Puppet[:localcacert])
 
       # If there's a CRL, add it to our store.
-      if crl = Puppet::SSL::CertificateRevocationList.find(CA_NAME)
+      if crl = Puppet::SSL::CertificateRevocationList.indirection.find(CA_NAME)
         @ssl_store.flags = OpenSSL::X509::V_FLAG_CRL_CHECK_ALL|OpenSSL::X509::V_FLAG_CRL_CHECK if Puppet.settings[:certificate_revocation]
         @ssl_store.add_crl(crl.content)
       end
@@ -237,6 +239,24 @@ class Puppet::SSL::Host
     @ssl_store
   end
 
+  def to_pson(*args)
+    my_cert = Puppet::SSL::Certificate.indirection.find(name)
+    pson_hash = { :name  => name }
+
+    my_state = state
+
+    pson_hash[:state] = my_state
+    pson_hash[:desired_state] = desired_state if desired_state
+
+    if my_state == 'requested'
+      pson_hash[:fingerprint] = certificate_request.fingerprint
+    else
+      pson_hash[:fingerprint] = my_cert.fingerprint
+    end
+
+    pson_hash.to_pson(*args)
+  end
+
   # Attempt to retrieve a cert, if we don't already have one.
   def wait_for_cert(time)
     begin
@@ -273,6 +293,20 @@ class Puppet::SSL::Host
       end
     end
   end
+
+  def state
+    my_cert = Puppet::SSL::Certificate.indirection.find(name)
+    if certificate_request
+      return 'requested'
+    end
+
+    begin
+      Puppet::SSL::CertificateAuthority.new.verify(my_cert)
+      return 'signed'
+    rescue Puppet::SSL::CertificateAuthority::CertificateVerificationError
+      return 'revoked'
+    end
+  end
 end
 
 require 'puppet/ssl/certificate_authority'

data/lib/puppet/ssl/inventory.rb

@@ -36,7 +36,7 @@ class Puppet::SSL::Inventory
       f.print "# Inventory of signed certificates\n# SERIAL NOT_BEFORE NOT_AFTER SUBJECT\n"
     end
 
-    Puppet::SSL::Certificate.search("*").each { |cert| add(cert) }
+    Puppet::SSL::Certificate.indirection.search("*").each { |cert| add(cert) }
   end
 
   # Find the serial number for a given certificate.

data/lib/puppet/sslcertificates.rb

@@ -0,0 +1,146 @@
+# The library for manipulating SSL certs.
+
+require 'puppet'
+
+raise Puppet::Error, "You must have the Ruby openssl library installed" unless Puppet.features.openssl?
+
+module Puppet::SSLCertificates
+  #def self.mkcert(type, name, dnsnames, ttl, issuercert, issuername, serial, publickey)
+  def self.mkcert(hash)
+    [:type, :name, :ttl, :issuer, :serial, :publickey].each { |param|
+      raise ArgumentError, "mkcert called without #{param}" unless hash.include?(param)
+    }
+
+    cert = OpenSSL::X509::Certificate.new
+    # Make the certificate valid as of yesterday, because
+    # so many people's clocks are out of sync.
+    from = Time.now - (60*60*24)
+
+    cert.subject = hash[:name]
+    if hash[:issuer]
+      cert.issuer = hash[:issuer].subject
+    else
+      # we're a self-signed cert
+      cert.issuer = hash[:name]
+    end
+    cert.not_before = from
+    cert.not_after = from + hash[:ttl]
+    cert.version = 2 # X509v3
+
+    cert.public_key = hash[:publickey]
+    cert.serial = hash[:serial]
+
+    basic_constraint = nil
+    key_usage = nil
+    ext_key_usage = nil
+    subject_alt_name = []
+
+    ef = OpenSSL::X509::ExtensionFactory.new
+
+    ef.subject_certificate = cert
+
+    if hash[:issuer]
+      ef.issuer_certificate = hash[:issuer]
+    else
+      ef.issuer_certificate = cert
+    end
+
+    ex = []
+    case hash[:type]
+    when :ca
+      basic_constraint = "CA:TRUE"
+      key_usage = %w{cRLSign keyCertSign}
+    when :terminalsubca
+      basic_constraint = "CA:TRUE,pathlen:0"
+      key_usage = %w{cRLSign keyCertSign}
+    when :server
+      basic_constraint = "CA:FALSE"
+      dnsnames = Puppet[:certdnsnames]
+      name = hash[:name].to_s.sub(%r{/CN=},'')
+      if dnsnames != ""
+        dnsnames.split(':').each { |d| subject_alt_name << 'DNS:' + d }
+        subject_alt_name << 'DNS:' + name # Add the fqdn as an alias
+      elsif name == Facter.value(:fqdn) # we're a CA server, and thus probably the server
+        subject_alt_name << 'DNS:' + "puppet" # Add 'puppet' as an alias
+        subject_alt_name << 'DNS:' + name # Add the fqdn as an alias
+        subject_alt_name << 'DNS:' + name.sub(/^[^.]+./, "puppet.") # add puppet.domain as an alias
+      end
+      key_usage = %w{digitalSignature keyEncipherment}
+      ext_key_usage = %w{serverAuth clientAuth emailProtection}
+    when :ocsp
+      basic_constraint = "CA:FALSE"
+      key_usage = %w{nonRepudiation digitalSignature}
+      ext_key_usage = %w{serverAuth OCSPSigning}
+    when :client
+      basic_constraint = "CA:FALSE"
+      key_usage = %w{nonRepudiation digitalSignature keyEncipherment}
+      ext_key_usage = %w{clientAuth emailProtection}
+      ex << ef.create_extension("nsCertType", "client,email")
+    else
+      raise Puppet::Error, "unknown cert type '#{hash[:type]}'"
+    end
+
+
+      ex << ef.create_extension(
+        "nsComment",
+
+          "Puppet Ruby/OpenSSL Generated Certificate")
+    ex << ef.create_extension("basicConstraints", basic_constraint, true)
+    ex << ef.create_extension("subjectKeyIdentifier", "hash")
+
+    ex << ef.create_extension("keyUsage", key_usage.join(",")) if key_usage
+    ex << ef.create_extension("extendedKeyUsage", ext_key_usage.join(",")) if ext_key_usage
+    ex << ef.create_extension("subjectAltName", subject_alt_name.join(",")) if ! subject_alt_name.empty?
+
+    #if @ca_config[:cdp_location] then
+    #  ex << ef.create_extension("crlDistributionPoints",
+    #                            @ca_config[:cdp_location])
+    #end
+
+    #if @ca_config[:ocsp_location] then
+    #  ex << ef.create_extension("authorityInfoAccess",
+    #                            "OCSP;" << @ca_config[:ocsp_location])
+    #end
+    cert.extensions = ex
+
+    # for some reason this _must_ be the last extension added
+    ex << ef.create_extension("authorityKeyIdentifier", "keyid:always,issuer:always") if hash[:type] == :ca
+
+    cert
+  end
+
+  def self.mkhash(dir, cert, certfile)
+    # Make sure the hash is zero-padded to 8 chars
+    hash = "%08x" % cert.issuer.hash
+    hashpath = nil
+    10.times { |i|
+      path = File.join(dir, "#{hash}.#{i}")
+      if FileTest.exists?(path)
+        if FileTest.symlink?(path)
+          dest = File.readlink(path)
+          if dest == certfile
+            # the correct link already exists
+            hashpath = path
+            break
+          else
+            next
+          end
+        else
+          next
+        end
+      end
+
+      File.symlink(certfile, path)
+
+      hashpath = path
+      break
+    }
+
+
+    hashpath
+  end
+  require 'puppet/sslcertificates/certificate'
+  require 'puppet/sslcertificates/inventory'
+  require 'puppet/sslcertificates/ca'
+end
+