puppet 3.3.2 → 3.4.0.rc1

data/lib/puppet/ssl/certificate_factory.rb

@@ -66,17 +66,7 @@ module Puppet::SSL::CertificateFactory
       inject({}) {|ret, val| ret.merge(val) }
 
     cert.extensions = exts.map do |oid, val|
-      val, crit = *val
-      val       = val.join(', ') unless val.is_a? String
-
-      # Enforce the X509v3 rules about subjectAltName being critical:
-      # specifically, it SHOULD NOT be critical if we have a subject, which we
-      # always do. --daniel 2011-10-18
-      crit = false if oid == "subjectAltName"
-
-      # val can be either a string, or [string, critical], and this does the
-      # right thing regardless of what we get passed.
-      ef.create_ext(oid, val, crit)
+      generate_extension(ef, oid, *val)
     end
   end
 
@@ -144,5 +134,41 @@ module Puppet::SSL::CertificateFactory
       "nsCertType"       => "client,email",
     }
   end
-end
 
+  # Generate an extension with the given OID, value, and critical state
+  #
+  # @param oid [String] The numeric value or short name of a given OID. X509v3
+  #   extensions must be passed by short name or long name, while custom
+  #   extensions may be passed by short name, long name, oid numeric OID.
+  # @param ef [OpenSSL::X509::ExtensionFactory] The extension factory to use
+  #   when generating the extension.
+  # @param val [String, Array<String>] The extension value.
+  # @param crit [true, false] Whether the given extension is critical, defaults
+  #   to false.
+  #
+  # @return [OpenSSL::X509::Extension]
+  #
+  # @api private
+  def self.generate_extension(ef, oid, val, crit = false)
+
+    val = val.join(', ') unless val.is_a? String
+
+    # Enforce the X509v3 rules about subjectAltName being critical:
+    # specifically, it SHOULD NOT be critical if we have a subject, which we
+    # always do. --daniel 2011-10-18
+    crit = false if oid == "subjectAltName"
+
+    if Puppet::SSL::Oids.subtree_of?('id-ce', oid) or Puppet::SSL::Oids.subtree_of?('id-pkix', oid)
+      # Attempt to create a X509v3 certificate extension. Standard certificate
+      # extensions may need access to the associated subject certificate and
+      # issuing certificate, so must be created by the OpenSSL::X509::ExtensionFactory
+      # which provides that context.
+      ef.create_ext(oid, val, crit)
+    else
+      # This is not an X509v3 extension which means that the extension
+      # factory cannot generate it. We need to generate the extension
+      # manually.
+      OpenSSL::X509::Extension.new(oid, val, crit)
+    end
+  end
+end

data/lib/puppet/ssl/certificate_request.rb

@@ -1,7 +1,30 @@
 require 'puppet/ssl/base'
 require 'puppet/ssl/certificate_signer'
 
-# Manage certificate requests.
+# This class creates and manages X509 certificate signing requests.
+#
+# ## CSR attributes
+#
+# CSRs may contain a set of attributes that includes supplementary information
+# about the CSR or information for the signed certificate.
+#
+# PKCS#9/RFC 2985 section 5.4 formally defines the "Challenge password",
+# "Extension request", and "Extended-certificate attributes", but this
+# implementation only handles the "Extension request" attribute. Other
+# attributes may be defined on a CSR, but the RFC doesn't define behavior for
+# any other attributes so we treat them as only informational.
+#
+# ## CSR Extension request attribute
+#
+# CSRs may contain an optional set of extension requests, which allow CSRs to
+# include additional information that may be included in the signed
+# certificate. Any additional information that should be copied from the CSR
+# to the signed certificate MUST be included in this attribute.
+#
+# This behavior is dictated by PKCS#9/RFC 2985 section 5.4.2.
+#
+# @see http://tools.ietf.org/html/rfc2985 "RFC 2985 Section 5.4.2 Extension request"
+#
 class Puppet::SSL::CertificateRequest < Puppet::SSL::Base
   wraps OpenSSL::X509::Request
 
@@ -14,7 +37,7 @@ class Puppet::SSL::CertificateRequest < Puppet::SSL::Base
 
       # Try to autosign the CSR.
       if ca = Puppet::SSL::CertificateAuthority.instance
-        ca.autosign
+        ca.autosign(instance)
       end
     end
   end
@@ -34,7 +57,22 @@ DOC
     @ef ||= OpenSSL::X509::ExtensionFactory.new
   end
 
-  # How to create a certificate request with our system defaults.
+  # Create a certificate request with our system settings.
+  #
+  # @param key [OpenSSL::X509::Key, Puppet::SSL::Key] The key pair associated
+  #   with this CSR.
+  # @param opts [Hash]
+  # @options opts [String] :dns_alt_names A comma separated list of
+  #   Subject Alternative Names to include in the CSR extension request.
+  # @options opts [Hash<String, String, Array<String>>] :csr_attributes A hash
+  #   of OIDs and values that are either a string or array of strings.
+  # @options opts [Array<String, String>] :extension_requests A hash of
+  #   certificate extensions to add to the CSR extReq attribute, excluding
+  #   the Subject Alternative Names extension.
+  #
+  # @raise [Puppet::Error] If the generated CSR signature couldn't be verified
+  #
+  # @return [OpenSSL::X509::Request] The generated CSR
   def generate(key, options = {})
     Puppet.info "Creating a new SSL certificate request for #{name}"
 
@@ -51,16 +89,12 @@ DOC
     csr.subject = OpenSSL::X509::Name.new([["CN", common_name]])
     csr.public_key = key.public_key
 
-    if options[:dns_alt_names] then
-      names = options[:dns_alt_names].split(/\s*,\s*/).map(&:strip) + [name]
-      names = names.sort.uniq.map {|name| "DNS:#{name}" }.join(", ")
-      names = extension_factory.create_extension("subjectAltName", names, false)
-
-      extReq = OpenSSL::ASN1::Set([OpenSSL::ASN1::Sequence([names])])
+    if options[:csr_attributes]
+      add_csr_attributes(csr, options[:csr_attributes])
+    end
 
-      # We only support the standard request extensions.  If you really need
-      # msExtReq support, let us know and we can restore them. --daniel 2011-10-10
-      csr.add_attribute(OpenSSL::X509::Attribute.new("extReq", extReq))
+    if (ext_req_attribute = extension_request_attribute(options))
+      csr.add_attribute(ext_req_attribute)
     end
 
     signer = Puppet::SSL::CertificateSigner.new
@@ -74,72 +108,192 @@ DOC
   end
 
   # Return the set of extensions requested on this CSR, in a form designed to
-  # be useful to Ruby: a hash.  Which, not coincidentally, you can pass
+  # be useful to Ruby: an array of hashes.  Which, not coincidentally, you can pass
   # successfully to the OpenSSL constructor later, if you want.
+  #
+  # @return [Array<Hash{String => String}>] An array of two or three element
+  # hashes, with key/value pairs for the extension's oid, its value, and
+  # optionally its critical state.
   def request_extensions
     raise Puppet::Error, "CSR needs content to extract fields" unless @content
 
     # Prefer the standard extReq, but accept the Microsoft specific version as
     # a fallback, if the standard version isn't found.
-    ext = @content.attributes.find {|x| x.oid == "extReq" } or
-      @content.attributes.find {|x| x.oid == "msExtReq" }
-    return [] unless ext
-
-    # Assert the structure and extract the names into an array of arrays.
-    unless ext.value.is_a? OpenSSL::ASN1::Set
-      raise Puppet::Error, "In #{ext.oid}, expected Set but found #{ext.value.class}"
-    end
-
-    unless ext.value.value.is_a? Array
-      raise Puppet::Error, "In #{ext.oid}, expected Set[Array] but found #{ext.value.value.class}"
-    end
-
-    unless ext.value.value.length == 1
-      raise Puppet::Error, "In #{ext.oid}, expected Set[Array[...]], but found #{ext.value.value.length} items in the array"
-    end
+    attribute   = @content.attributes.find {|x| x.oid == "extReq" }
+    attribute ||= @content.attributes.find {|x| x.oid == "msExtReq" }
+    return [] unless attribute
 
-    san = ext.value.value.first
-    unless san.is_a? OpenSSL::ASN1::Sequence
-      raise Puppet::Error, "In #{ext.oid}, expected Set[Array[Sequence[...]]], but found #{san.class}"
-    end
-    san = san.value
+    extensions = unpack_extension_request(attribute)
 
-    # OK, now san should be the array of items, validate that...
     index = -1
-    san.map do |name|
+    extensions.map do |ext_values|
       index += 1
-
-      unless name.is_a? OpenSSL::ASN1::Sequence
-        raise Puppet::Error, "In #{ext.oid}, expected request extension record #{index} to be a Sequence, but found #{name.class}"
-      end
-      name = name.value
+      context = "#{attribute.oid} extension index #{index}"
 
       # OK, turn that into an extension, to unpack the content.  Lovely that
       # we have to swap the order of arguments to the underlying method, or
       # perhaps that the ASN.1 representation chose to pack them in a
       # strange order where the optional component comes *earlier* than the
       # fixed component in the sequence.
-      case name.length
+      case ext_values.length
       when 2
-        ev = OpenSSL::X509::Extension.new(name[0].value, name[1].value)
+        ev = OpenSSL::X509::Extension.new(ext_values[0].value, ext_values[1].value)
         { "oid" => ev.oid, "value" => ev.value }
 
       when 3
-        ev = OpenSSL::X509::Extension.new(name[0].value, name[2].value, name[1].value)
+        ev = OpenSSL::X509::Extension.new(ext_values[0].value, ext_values[2].value, ext_values[1].value)
         { "oid" => ev.oid, "value" => ev.value, "critical" => ev.critical? }
 
       else
-        raise Puppet::Error, "In #{ext.oid}, expected extension record #{index} to have two or three items, but found #{name.length}"
+        raise Puppet::Error, "In #{attribute.oid}, expected extension record #{index} to have two or three items, but found #{ext_values.length}"
       end
-    end.flatten
+    end
   end
 
   def subject_alt_names
     @subject_alt_names ||= request_extensions.
-      select {|x| x["oid"] = "subjectAltName" }.
+      select {|x| x["oid"] == "subjectAltName" }.
       map {|x| x["value"].split(/\s*,\s*/) }.
       flatten.
       sort.
       uniq
   end
+
+  # Return all user specified attributes attached to this CSR as a hash. IF an
+  # OID has a single value it is returned as a string, otherwise all values are
+  # returned as an array.
+  #
+  # The format of CSR attributes is specified in PKCS#10/RFC 2986
+  #
+  # @see http://tools.ietf.org/html/rfc2986 "RFC 2986 Certification Request Syntax Specification"
+  #
+  # @api public
+  #
+  # @return [Hash<String, String>]
+  def custom_attributes
+    x509_attributes = @content.attributes.reject do |attr|
+      PRIVATE_CSR_ATTRIBUTES.include? attr.oid
+    end
+
+    x509_attributes.map do |attr|
+      {"oid" => attr.oid, "value" => attr.value.first.value}
+    end
+  end
+
+  private
+
+  # Exclude OIDs that may conflict with how Puppet creates CSRs.
+  #
+  # We only have nominal support for Microsoft extension requests, but since we
+  # ultimately respect that field when looking for extension requests in a CSR
+  # we need to prevent that field from being written to directly.
+  PRIVATE_CSR_ATTRIBUTES = [
+    'extReq',   '1.2.840.113549.1.9.14',
+    'msExtReq', '1.3.6.1.4.1.311.2.1.14',
+  ]
+
+  def add_csr_attributes(csr, csr_attributes)
+    csr_attributes.each do |oid, value|
+      begin
+        if PRIVATE_CSR_ATTRIBUTES.include? oid
+          raise ArgumentError, "Cannot specify CSR attribute #{oid}: conflicts with internally used CSR attribute"
+        end
+
+        encoded = OpenSSL::ASN1::PrintableString.new(value.to_s)
+
+        attr_set = OpenSSL::ASN1::Set.new([encoded])
+        csr.add_attribute(OpenSSL::X509::Attribute.new(oid, attr_set))
+        Puppet.debug("Added csr attribute: #{oid} => #{attr_set.inspect}")
+      rescue OpenSSL::X509::AttributeError => e
+        raise Puppet::Error, "Cannot create CSR with attribute #{oid}: #{e.message}"
+      end
+    end
+  end
+
+  private
+
+  PRIVATE_EXTENSIONS = [
+    'subjectAltName', '2.5.29.17',
+  ]
+
+  # @api private
+  def extension_request_attribute(options)
+    extensions = []
+
+    if options[:extension_requests]
+      options[:extension_requests].each_pair do |oid, value|
+        begin
+          if PRIVATE_EXTENSIONS.include? oid
+            raise Puppet::Error, "Cannot specify CSR extension request #{oid}: conflicts with internally used extension request"
+          end
+
+          ext = OpenSSL::X509::Extension.new(oid, value.to_s, false)
+          extensions << ext
+        rescue OpenSSL::X509::ExtensionError => e
+          raise Puppet::Error, "Cannot create CSR with extension request #{oid}: #{e.message}"
+        end
+      end
+    end
+
+    if options[:dns_alt_names]
+      names = options[:dns_alt_names].split(/\s*,\s*/).map(&:strip) + [name]
+      names = names.sort.uniq.map {|name| "DNS:#{name}" }.join(", ")
+      alt_names_ext = extension_factory.create_extension("subjectAltName", names, false)
+
+      extensions << alt_names_ext
+    end
+
+    unless extensions.empty?
+      seq = OpenSSL::ASN1::Sequence(extensions)
+      ext_req = OpenSSL::ASN1::Set([seq])
+      OpenSSL::X509::Attribute.new("extReq", ext_req)
+    end
+  end
+
+  # Unpack the extReq attribute into an array of Extensions.
+  #
+  # The extension request attribute is structured like
+  # `Set[Sequence[Extensions]]` where the outer Set only contains a single
+  # sequence.
+  #
+  # In addition the Ruby implementation of ASN1 requires that all ASN1 values
+  # contain a single value, so Sets and Sequence have to contain an array
+  # that in turn holds the elements. This is why we have to unpack an array
+  # every time we unpack a Set/Seq.
+  #
+  # @see http://tools.ietf.org/html/rfc2985#ref-10 5.4.2 CSR Extension Request structure
+  # @see http://tools.ietf.org/html/rfc5280 4.1 Certificate Extension structure
+  #
+  # @api private
+  #
+  # @param attribute [OpenSSL::X509::Attribute] The X509 extension request
+  #
+  # @return [Array<Array<Object>>] A array of arrays containing the extension
+  #   OID the critical state if present, and the extension value.
+  def unpack_extension_request(attribute)
+
+    unless attribute.value.is_a? OpenSSL::ASN1::Set
+      raise Puppet::Error, "In #{attribute.oid}, expected Set but found #{attribute.value.class}"
+    end
+
+    unless attribute.value.value.is_a? Array
+      raise Puppet::Error, "In #{attribute.oid}, expected Set[Array] but found #{attribute.value.value.class}"
+    end
+
+    unless attribute.value.value.size == 1
+      raise Puppet::Error, "In #{attribute.oid}, expected Set[Array] with one value but found #{attribute.value.value.size} elements"
+    end
+
+    unless attribute.value.value.first.is_a? OpenSSL::ASN1::Sequence
+      raise Puppet::Error, "In #{attribute.oid}, expected Set[Array[Sequence[...]]], but found #{extension.class}"
+    end
+
+    unless attribute.value.value.first.value.is_a? Array
+      raise Puppet::Error, "In #{attribute.oid}, expected Set[Array[Sequence[Array[...]]]], but found #{extension.value.class}"
+    end
+
+    extensions = attribute.value.value.first.value
+
+    extensions.map(&:value)
+  end
 end

data/lib/puppet/ssl/certificate_request_attributes.rb

@@ -0,0 +1,34 @@
+require 'puppet/ssl'
+require 'puppet/util/yaml'
+
+# This class transforms simple key/value pairs into the equivalent ASN1
+# structures. Values may be strings or arrays of strings.
+#
+# @api private
+class Puppet::SSL::CertificateRequestAttributes
+
+  attr_reader :path, :custom_attributes, :extension_requests
+
+  def initialize(path)
+    @path = path
+    @custom_attributes = {}
+    @extension_requests = {}
+  end
+
+  # Attempt to load a yaml file at the given @path.
+  # @return true if we are able to load the file, false otherwise
+  # @raise [Puppet::Error] if there are unexpected attribute keys
+  def load
+    Puppet.info("csr_attributes file loading from #{path}")
+    if Puppet::FileSystem::File.exist?(path)
+      hash = Puppet::Util::Yaml.load_file(path)
+      @custom_attributes = hash.delete('custom_attributes') || {}
+      @extension_requests = hash.delete('extension_requests') || {}
+      if not hash.keys.empty?
+        raise Puppet::Error, "unexpected attributes #{hash.keys.inspect} in #{@path.inspect}"
+      end
+      return true
+    end
+    return false
+  end
+end

data/lib/puppet/ssl/certificate_revocation_list.rb

@@ -49,7 +49,7 @@ DOC
     Puppet.notice "Revoked certificate with serial #{serial}"
     time = Time.now
 
-    add_certitificate_revocation_for(serial, reason, time)
+    add_certificate_revocation_for(serial, reason, time)
     update_to_next_crl_number
     update_valid_time_range_to_start_at(time)
     sign_with(cakey)
@@ -69,7 +69,7 @@ private
     @content.extensions = [crl_number_of(0)]
   end
 
-  def add_certitificate_revocation_for(serial, reason, time)
+  def add_certificate_revocation_for(serial, reason, time)
     revoked = OpenSSL::X509::Revoked.new
     revoked.serial = serial
     revoked.time = time

data/lib/puppet/ssl/host.rb

@@ -4,6 +4,7 @@ require 'puppet/ssl/key'
 require 'puppet/ssl/certificate'
 require 'puppet/ssl/certificate_request'
 require 'puppet/ssl/certificate_revocation_list'
+require 'puppet/ssl/certificate_request_attributes'
 
 # The class that manages all aspects of our SSL certificates --
 # private keys, public keys, requests, etc.
@@ -173,6 +174,12 @@ DOC
       end
     end
 
+    csr_attributes = Puppet::SSL::CertificateRequestAttributes.new(Puppet[:csr_attributes])
+    if csr_attributes.load
+      options[:csr_attributes] = csr_attributes.custom_attributes
+      options[:extension_requests] = csr_attributes.extension_requests
+    end
+
     @certificate_request = CertificateRequest.new(name)
     @certificate_request.generate(key.content, options)
     begin
@@ -264,14 +271,14 @@ ERROR_STRING
     @ssl_store
   end
 
-  def to_pson(*args)
+  def to_data_hash
     my_cert = Puppet::SSL::Certificate.indirection.find(name)
-    pson_hash = { :name  => name }
+    result = { :name  => name }
 
     my_state = state
 
-    pson_hash[:state] = my_state
-    pson_hash[:desired_state] = desired_state if desired_state
+    result[:state] = my_state
+    result[:desired_state] = desired_state if desired_state
 
     thing_to_use = (my_state == 'requested') ? certificate_request : my_cert
 
@@ -280,7 +287,7 @@ ERROR_STRING
     # pson[:fingerprints][:default]
     # It appears that we have no internal consumers of this api
     # --jeffweiss 30 aug 2012
-    pson_hash[:fingerprint] = thing_to_use.fingerprint
+    result[:fingerprint] = thing_to_use.fingerprint
 
     # The above fingerprint doesn't tell us what message digest algorithm was used
     # No problem, except that the default is changing between 2.7 and 3.0. Also, as
@@ -289,15 +296,19 @@ ERROR_STRING
     # So, when we add the newer fingerprints, we're explicit about the hashing
     # algorithm used.
     # --jeffweiss 31 july 2012
-    pson_hash[:fingerprints] = {}
-    pson_hash[:fingerprints][:default] = thing_to_use.fingerprint
+    result[:fingerprints] = {}
+    result[:fingerprints][:default] = thing_to_use.fingerprint
 
     suitable_message_digest_algorithms.each do |md|
-      pson_hash[:fingerprints][md] = thing_to_use.fingerprint md
+      result[:fingerprints][md] = thing_to_use.fingerprint md
     end
-    pson_hash[:dns_alt_names] = thing_to_use.subject_alt_names
+    result[:dns_alt_names] = thing_to_use.subject_alt_names
 
-    pson_hash.to_pson(*args)
+    result
+  end
+
+  def to_pson(*args)
+    to_data_hash.to_pson(*args)
   end
 
   # eventually we'll probably want to move this somewhere else or make it