puppet 3.3.2 → 3.4.0.rc1

data/lib/puppet/ssl/inventory.rb

@@ -8,11 +8,7 @@ class Puppet::SSL::Inventory
   # Add a certificate to our inventory.
   def add(cert)
     cert = cert.content if cert.is_a?(Puppet::SSL::Certificate)
-
-    # Create our file, if one does not already exist.
-    rebuild unless FileTest.exist?(@path)
-
-    Puppet.settings.write(:cert_inventory, "a") do |f|
+    Puppet.settings.setting(:cert_inventory).open("a") do |f|
       f.print format(cert)
     end
   end
@@ -32,16 +28,16 @@ class Puppet::SSL::Inventory
   def rebuild
     Puppet.notice "Rebuilding inventory file"
 
-    Puppet.settings.write(:cert_inventory) do |f|
-      f.print "# Inventory of signed certificates\n# SERIAL NOT_BEFORE NOT_AFTER SUBJECT\n"
+    Puppet.settings.setting(:cert_inventory).open('w') do |f|
+      Puppet::SSL::Certificate.indirection.search("*").each do |cert|
+        f.print format(cert.content)
+      end
     end
-
-    Puppet::SSL::Certificate.indirection.search("*").each { |cert| add(cert) }
   end
 
   # Find the serial number for a given certificate.
   def serial(name)
-    return nil unless FileTest.exist?(@path)
+    return nil unless Puppet::FileSystem::File.exist?(@path)
 
     File.readlines(@path).each do |line|
       next unless line =~ /^(\S+).+\/CN=#{name}$/

data/lib/puppet/ssl/key.rb

@@ -36,7 +36,7 @@ DOC
   end
 
   def password
-    return nil unless password_file and FileTest.exist?(password_file)
+    return nil unless password_file and Puppet::FileSystem::File.exist?(password_file)
 
     ::File.read(password_file)
   end

data/lib/puppet/ssl/oids.rb

@@ -0,0 +1,78 @@
+require 'puppet/ssl'
+
+# This module defines OIDs for use within Puppet.
+#
+# == ASN.1 Definition
+#
+# The following is the formal definition of OIDs specified in this file.
+#
+# puppetCertExtensions OBJECT IDENTIFIER ::= {iso(1) identified-organization(3)
+#    dod(6) internet(1) private(4) enterprise(1) 34380 1}
+#
+# -- the tree under registeredExtensions 'belongs' to puppetlabs
+# -- privateExtensions can be extended by enterprises to suit their own needs
+# registeredExtensions OBJECT IDENTIFIER ::= { puppetCertExtensions 1 }
+# privateExtensions OBJECT IDENTIFIER ::= { puppetCertExtensions 2 }
+#
+# -- subtree of common registered extensions
+# -- The short names for these OIDs are intentionally lowercased and formatted
+# -- since they may be exposed inside the Puppet DSL as variables.
+# pp_uuid  OBJECT IDENTIFIER ::= { registeredExtensions 1 }
+# pp_instance_id OBJECT IDENTIFIER ::= { registeredExtensions 2 }
+# pp_image_name OBJECT IDENTIFIER ::= { registeredExtensions 3 }
+# pp_preshared_key OBJECT IDENTIFIER ::= { registeredExtensions 4 }
+#
+# @api private
+module Puppet::SSL::Oids
+
+  PUPPET_OIDS = [
+    ["1.3.6.1.4.1.34380", 'puppetlabs', 'Puppet Labs'],
+    ["1.3.6.1.4.1.34380.1", 'ppCertExt', 'Puppet Certificate Extension'],
+
+    ["1.3.6.1.4.1.34380.1.1", 'ppRegCertExt', 'Puppet Registered Certificate Extension'],
+
+    ["1.3.6.1.4.1.34380.1.1.1", 'pp_uuid', 'Puppet Node UUID'],
+    ["1.3.6.1.4.1.34380.1.1.2", 'pp_instance_id', 'Puppet Node Instance ID'],
+    ["1.3.6.1.4.1.34380.1.1.3", 'pp_image_name', 'Puppet Node Image Name'],
+    ["1.3.6.1.4.1.34380.1.1.4", 'pp_preshared_key', 'Puppet Node Preshared Key'],
+
+    ["1.3.6.1.4.1.34380.1.2", 'ppPrivCertExt', 'Puppet Private Certificate Extension'],
+  ]
+
+  PUPPET_OIDS.each do |oid_defn|
+    OpenSSL::ASN1::ObjectId.register(*oid_defn)
+  end
+
+  # Determine if the first OID contains the second OID
+  #
+  # @param first [String] The containing OID, in dotted form or as the short name
+  # @param second [String] The contained OID, in dotted form or as the short name
+  # @param exclusive [true, false] If an OID should not be considered as a subtree of itself
+  #
+  # @example Comparing two dotted OIDs
+  #   Puppet::SSL::Oids.subtree_of?('1.3.6.1', '1.3.6.1.4.1') #=> true
+  #   Puppet::SSL::Oids.subtree_of?('1.3.6.1', '1.3.6') #=> false
+  #
+  # @example Comparing an OID short name with a dotted OID
+  #   Puppet::SSL::Oids.subtree_of?('IANA', '1.3.6.1.4.1') #=> true
+  #   Puppet::SSL::Oids.subtree_of?('1.3.6.1', 'enterprises') #=> true
+  #
+  # @example Comparing an OID against itself
+  #   Puppet::SSL::Oids.subtree_of?('IANA', 'IANA') #=> true
+  #   Puppet::SSL::Oids.subtree_of?('IANA', 'IANA', true) #=> false
+  #
+  # @return [true, false]
+  def self.subtree_of?(first, second, exclusive = false)
+    first_oid = OpenSSL::ASN1::ObjectId.new(first).oid
+    second_oid = OpenSSL::ASN1::ObjectId.new(second).oid
+
+
+    if exclusive and first_oid == second_oid
+      false
+    else
+      second_oid.index(first_oid) == 0
+    end
+  rescue OpenSSL::ASN1::ASN1Error
+    false
+  end
+end

data/lib/puppet/ssl/validator.rb

@@ -1,116 +1,60 @@
-require 'puppet/ssl'
 require 'openssl'
-module Puppet
-module SSL
-class Validator
-  attr_reader :peer_certs
-  attr_reader :verify_errors
-  attr_reader :ssl_configuration
 
-  ##
-  # @param [Hash] opts the options to initialze the instance with.
-  #
-  # @option opts [Puppet::SSL::Configuration] :ssl_configuration to use for
-  #   authorizing the peer certificate chain.
-  def initialize(opts = {})
-    reset!
-    @ssl_configuration = opts[:ssl_configuration] or raise ArgumentError, ":ssl_configuration is required"
-  end
+# API for certificate verification
+#
+# @api public
+class Puppet::SSL::Validator
 
-  ##
-  # reset to the initial state.
-  def reset!
-    @peer_certs = []
-    @verify_errors = []
+  # Factory method for creating an instance of a null/no validator.
+  # This method does not have to be implemented by concrete implementations of this API.
+  #
+  # @return [Puppet::SSL::Validator] produces a validator that performs no validation
+  #
+  # @api public
+  #
+  def self.no_validator()
+    @@no_validator_cache ||= Puppet::SSL::Validator::NoValidator.new()
   end
 
-  ##
-  # call performs verification of the SSL connection and collection of the
-  # certificates for use in constructing the error message if the verification
-  # failed.  This callback will be executed once for each certificate in a
-  # chain being verified.
+  # Factory method for creating an instance of the default Puppet validator.
+  # This method does not have to be implemented by concrete implementations of this API.
   #
-  # From the [OpenSSL
-  # documentation](http://www.openssl.org/docs/ssl/SSL_CTX_set_verify.html):
-  # The `verify_callback` function is used to control the behaviour when the
-  # SSL_VERIFY_PEER flag is set. It must be supplied by the application and
-  # receives two arguments: preverify_ok indicates, whether the verification of
-  # the certificate in question was passed (preverify_ok=1) or not
-  # (preverify_ok=0). x509_ctx is a pointer to the complete context used for
-  # the certificate chain verification.
+  # @return [Puppet::SSL::Validator] produces a validator that performs no validation
   #
-  # See {Puppet::Network::HTTP::Connection} for more information and where this
-  # class is intended to be used.
+  # @api public
   #
-  # @param [Boolean] preverify_ok indicates whether the verification of the
-  #   certificate in question was passed (preverify_ok=true)
-  # @param [OpenSSL::SSL::SSLContext] ssl_context holds the SSLContext for the
-  #   chain being verified.
-  #
-  # @return [Boolean] false if the peer is invalid, true otherwise.
-  def call(preverify_ok, ssl_context)
-    # We must make a copy since the scope of the ssl_context will be lost
-    # across invocations of this method.
-    current_cert = ssl_context.current_cert
-    @peer_certs << Puppet::SSL::Certificate.from_instance(current_cert)
-
-    if preverify_ok
-      # If we've copied all of the certs in the chain out of the SSL library
-      if @peer_certs.length == ssl_context.chain.length
-        # (#20027) The peer cert must be issued by a specific authority
-        preverify_ok = valid_peer?
-      end
-    else
-      if ssl_context.error_string
-        @verify_errors << "#{ssl_context.error_string} for #{current_cert.subject}"
-      end
-    end
-    preverify_ok
-  rescue => ex
-    @verify_errors << ex.message
-    false
+  def self.default_validator()
+    Puppet::SSL::Validator::DefaultValidator.new()
   end
 
-  ##
-  # Register the instance's call method with the connection.
+  # Array of peer certificates
+  # @return [Array<Puppet::SSL::Certificate>] peer certificates
   #
-  # @param [Net::HTTP] connection The connection to velidate
+  # @api public
   #
-  # @return [void]
-  def register_verify_callback(connection)
-    connection.verify_callback = self
+  def peer_certs
+    raise NotImplementedError, "Concrete class should have implemented this method"
   end
 
-  ##
-  # Validate the peer certificates against the authorized certificates.
-  def valid_peer?
-    descending_cert_chain = @peer_certs.reverse.map {|c| c.content }
-    authz_ca_certs = ssl_configuration.ca_auth_certificates
-
-    if not has_authz_peer_cert(descending_cert_chain, authz_ca_certs)
-      msg = "The server presented a SSL certificate chain which does not include a " <<
-        "CA listed in the ssl_client_ca_auth file.  "
-      msg << "Authorized Issuers: #{authz_ca_certs.collect {|c| c.subject}.join(', ')}  " <<
-        "Peer Chain: #{descending_cert_chain.collect {|c| c.subject}.join(' => ')}"
-      @verify_errors << msg
-      false
-    else
-      true
-    end
+  # Contains the result of validation
+  # @return [Array<String>, nil] nil, empty Array, or Array with messages
+  #
+  # @api public
+  #
+  def verify_errors
+    raise NotImplementedError, "Concrete class should have implemented this method"
   end
 
-  ##
-  # checks if the set of peer_certs contains at least one certificate issued
-  # by a certificate listed in authz_certs
+  # Registers the connection to validate.
+  #
+  # @param [Net::HTTP] connection The connection to validate
+  #
+  # @return [void]
   #
-  # @return [Boolean]
-  def has_authz_peer_cert(peer_certs, authz_certs)
-    peer_certs.any? do |peer_cert|
-      authz_certs.any? do |authz_cert|
-        peer_cert.verify(authz_cert.public_key)
-      end
-    end
+  # @api public
+  #
+  def setup_connection(connection)
+    raise NotImplementedError, "Concrete class should have implemented this method"
   end
 end
-end
-end
+

data/lib/puppet/ssl/validator/default_validator.rb

@@ -0,0 +1,153 @@
+require 'openssl'
+
+# Perform peer certificate verification against the known CA.
+# If there is no CA information known, then no verification is performed
+#
+# @api private
+#
+class Puppet::SSL::Validator::DefaultValidator #< class Puppet::SSL::Validator
+  attr_reader :peer_certs
+  attr_reader :verify_errors
+  attr_reader :ssl_configuration
+
+  # Creates a new DefaultValidator, optionally with an SSL Configuration and SSL Host.
+  #
+  # @param [Puppet::SSL::Configuration] (a default configuration) ssl_configuration the SSL configuration to use
+  # @param [Puppet::SSL::Host] (Puppet::SSL::Host.localhost) the SSL host to use
+  #
+  # @api private
+  #
+  def initialize(
+      ssl_configuration = Puppet::SSL::Configuration.new(
+                                        Puppet[:localcacert], {
+                                          :ca_chain_file => Puppet[:ssl_client_ca_chain],
+                                          :ca_auth_file  => Puppet[:ssl_client_ca_auth]
+                                        }),
+      ssl_host = Puppet::SSL::Host.localhost)
+
+    reset!
+    @ssl_configuration = ssl_configuration
+    @ssl_host = ssl_host
+  end
+
+
+  # Resets this validator to its initial validation state. The ssl configuration is not changed.
+  #
+  # @api private
+  #
+  def reset!
+    @peer_certs = []
+    @verify_errors = []
+  end
+
+  # Performs verification of the SSL connection and collection of the
+  # certificates for use in constructing the error message if the verification
+  # failed.  This callback will be executed once for each certificate in a
+  # chain being verified.
+  #
+  # From the [OpenSSL
+  # documentation](http://www.openssl.org/docs/ssl/SSL_CTX_set_verify.html):
+  # The `verify_callback` function is used to control the behaviour when the
+  # SSL_VERIFY_PEER flag is set. It must be supplied by the application and
+  # receives two arguments: preverify_ok indicates, whether the verification of
+  # the certificate in question was passed (preverify_ok=1) or not
+  # (preverify_ok=0). x509_ctx is a pointer to the complete context used for
+  # the certificate chain verification.
+  #
+  # See {Puppet::Network::HTTP::Connection} for more information and where this
+  # class is intended to be used.
+  #
+  # @param [Boolean] preverify_ok indicates whether the verification of the
+  #   certificate in question was passed (preverify_ok=true)
+  # @param [OpenSSL::SSL::SSLContext] ssl_context holds the SSLContext for the
+  #   chain being verified.
+  #
+  # @return [Boolean] false if the peer is invalid, true otherwise.
+  #
+  # @api private
+  #
+  def call(preverify_ok, ssl_context)
+    # We must make a copy since the scope of the ssl_context will be lost
+    # across invocations of this method.
+    current_cert = ssl_context.current_cert
+    @peer_certs << Puppet::SSL::Certificate.from_instance(current_cert)
+
+    if preverify_ok
+      # If we've copied all of the certs in the chain out of the SSL library
+      if @peer_certs.length == ssl_context.chain.length
+        # (#20027) The peer cert must be issued by a specific authority
+        preverify_ok = valid_peer?
+      end
+    else
+      if ssl_context.error_string
+        @verify_errors << "#{ssl_context.error_string} for #{current_cert.subject}"
+      end
+    end
+    preverify_ok
+  rescue => ex
+    @verify_errors << ex.message
+    false
+  end
+
+  # Registers the instance's call method with the connection.
+  #
+  # @param [Net::HTTP] connection The connection to validate
+  #
+  # @return [void]
+  #
+  # @api private
+  #
+  def setup_connection(connection)
+    if ssl_certificates_are_present?
+      connection.cert_store = @ssl_host.ssl_store
+      connection.ca_file = @ssl_configuration.ca_auth_file
+      connection.cert = @ssl_host.certificate.content
+      connection.key = @ssl_host.key.content
+      connection.verify_mode = OpenSSL::SSL::VERIFY_PEER
+      connection.verify_callback = self
+    else
+      connection.verify_mode = OpenSSL::SSL::VERIFY_NONE
+    end
+  end
+
+  # Validates the peer certificates against the authorized certificates.
+  #
+  # @api private
+  #
+  def valid_peer?
+    descending_cert_chain = @peer_certs.reverse.map {|c| c.content }
+    authz_ca_certs = ssl_configuration.ca_auth_certificates
+
+    if not has_authz_peer_cert(descending_cert_chain, authz_ca_certs)
+      msg = "The server presented a SSL certificate chain which does not include a " <<
+        "CA listed in the ssl_client_ca_auth file.  "
+      msg << "Authorized Issuers: #{authz_ca_certs.collect {|c| c.subject}.join(', ')}  " <<
+        "Peer Chain: #{descending_cert_chain.collect {|c| c.subject}.join(' => ')}"
+      @verify_errors << msg
+      false
+    else
+      true
+    end
+  end
+
+  # Checks if the set of peer_certs contains at least one certificate issued
+  # by a certificate listed in authz_certs
+  #
+  # @return [Boolean]
+  #
+  # @api private
+  #
+  def has_authz_peer_cert(peer_certs, authz_certs)
+    peer_certs.any? do |peer_cert|
+      authz_certs.any? do |authz_cert|
+        peer_cert.verify(authz_cert.public_key)
+      end
+    end
+  end
+
+  # @api private
+  #
+  def ssl_certificates_are_present?
+    Puppet::FileSystem::File.exist?(Puppet[:hostcert]) && Puppet::FileSystem::File.exist?(@ssl_configuration.ca_auth_file)
+  end
+end

data/lib/puppet/ssl/validator/no_validator.rb

@@ -0,0 +1,17 @@
+# Performs no SSL verification
+# @api private
+#
+class Puppet::SSL::Validator::NoValidator < Puppet::SSL::Validator
+
+  def setup_connection(connection)
+    connection.verify_mode = OpenSSL::SSL::VERIFY_NONE
+  end
+
+  def peer_certs
+    []
+  end
+
+  def verify_errors
+    []
+  end
+end