puppet 3.5.0.rc1-x86-mingw32

data/lib/puppet/ssl/certificate_request_attributes.rb

@@ -0,0 +1,37 @@
+require 'puppet/ssl'
+require 'puppet/util/yaml'
+
+# This class transforms simple key/value pairs into the equivalent ASN1
+# structures. Values may be strings or arrays of strings.
+#
+# @api private
+class Puppet::SSL::CertificateRequestAttributes
+
+  attr_reader :path, :custom_attributes, :extension_requests
+
+  def initialize(path)
+    @path = path
+    @custom_attributes = {}
+    @extension_requests = {}
+  end
+
+  # Attempt to load a yaml file at the given @path.
+  # @return true if we are able to load the file, false otherwise
+  # @raise [Puppet::Error] if there are unexpected attribute keys
+  def load
+    Puppet.info("csr_attributes file loading from #{path}")
+    if Puppet::FileSystem.exist?(path)
+      hash = Puppet::Util::Yaml.load_file(path, {})
+      if ! hash.is_a?(Hash)
+        raise Puppet::Error, "invalid CSR attributes, expected instance of Hash, received instance of #{hash.class}"
+      end
+      @custom_attributes = hash.delete('custom_attributes') || {}
+      @extension_requests = hash.delete('extension_requests') || {}
+      if not hash.keys.empty?
+        raise Puppet::Error, "unexpected attributes #{hash.keys.inspect} in #{@path.inspect}"
+      end
+      return true
+    end
+    return false
+  end
+end

data/lib/puppet/ssl/certificate_revocation_list.rb

@@ -0,0 +1,110 @@
+require 'puppet/ssl/base'
+require 'puppet/indirector'
+
+# Manage the CRL.
+class Puppet::SSL::CertificateRevocationList < Puppet::SSL::Base
+  FIVE_YEARS = 5 * 365*24*60*60
+
+  wraps OpenSSL::X509::CRL
+
+  extend Puppet::Indirector
+  indirects :certificate_revocation_list, :terminus_class => :file, :doc => <<DOC
+    This indirection wraps an `OpenSSL::X509::CRL` object, representing a certificate revocation list (CRL).
+    The indirection key is the CA name (usually literally `ca`).
+DOC
+
+  # Convert a string into an instance.
+  def self.from_s(string)
+    super(string, 'foo') # The name doesn't matter
+  end
+
+  # Because of how the format handler class is included, this
+  # can't be in the base class.
+  def self.supported_formats
+    [:s]
+  end
+
+  # Knows how to create a CRL with our system defaults.
+  def generate(cert, cakey)
+    Puppet.info "Creating a new certificate revocation list"
+
+    create_crl_issued_by(cert)
+    start_at_initial_crl_number
+    update_valid_time_range_to_start_at(Time.now)
+    sign_with(cakey)
+
+    @content
+  end
+
+  # The name doesn't actually matter; there's only one CRL.
+  # We just need the name so our Indirector stuff all works more easily.
+  def initialize(fakename)
+    @name = "crl"
+  end
+
+  # Revoke the certificate with serial number SERIAL issued by this
+  # CA, then write the CRL back to disk. The REASON must be one of the
+  # OpenSSL::OCSP::REVOKED_* reasons
+  def revoke(serial, cakey, reason = OpenSSL::OCSP::REVOKED_STATUS_KEYCOMPROMISE)
+    Puppet.notice "Revoked certificate with serial #{serial}"
+    time = Time.now
+
+    add_certificate_revocation_for(serial, reason, time)
+    update_to_next_crl_number
+    update_valid_time_range_to_start_at(time)
+    sign_with(cakey)
+
+    Puppet::SSL::CertificateRevocationList.indirection.save(self)
+  end
+
+private
+
+  def create_crl_issued_by(cert)
+    ef = OpenSSL::X509::ExtensionFactory.new(cert)
+    @content = wrapped_class.new
+    @content.issuer = cert.subject
+    @content.add_extension(ef.create_ext("authorityKeyIdentifier", "keyid:always"))
+    @content.version = 1
+  end
+
+  def start_at_initial_crl_number
+    @content.add_extension(crl_number_of(0))
+  end
+
+  def add_certificate_revocation_for(serial, reason, time)
+    revoked = OpenSSL::X509::Revoked.new
+    revoked.serial = serial
+    revoked.time = time
+    enum = OpenSSL::ASN1::Enumerated(reason)
+    ext = OpenSSL::X509::Extension.new("CRLReason", enum)
+    revoked.add_extension(ext)
+    @content.add_revoked(revoked)
+  end
+
+  def update_valid_time_range_to_start_at(time)
+    # The CRL is not valid if the time of checking == the time of last_update.
+    # So to have it valid right now we need to say that it was updated one second ago.
+    @content.last_update = time - 1
+    @content.next_update = time + FIVE_YEARS
+  end
+
+  def update_to_next_crl_number
+    @content.extensions = with_next_crl_number_from(@content.extensions)
+  end
+
+  def with_next_crl_number_from(existing_extensions)
+    existing_crl_num = existing_extensions.find { |e| e.oid == 'crlNumber' }
+    new_crl_num = existing_crl_num ? existing_crl_num.value.to_i + 1 : 0
+
+    extensions_without_crl_num = existing_extensions.reject { |e| e.oid == 'crlNumber' }
+    extensions_without_crl_num + [crl_number_of(new_crl_num)]
+  end
+
+  def crl_number_of(number)
+    OpenSSL::X509::Extension.new('crlNumber', OpenSSL::ASN1::Integer(number))
+  end
+
+  def sign_with(cakey)
+    @content.sign(cakey, OpenSSL::Digest::SHA1.new)
+  end
+end

data/lib/puppet/ssl/certificate_signer.rb

@@ -0,0 +1,22 @@
+# Take care of signing a certificate in a FIPS 140-2 compliant manner.
+#
+# @see http://projects.puppetlabs.com/issues/17295
+#
+# @api private
+class Puppet::SSL::CertificateSigner
+  def initialize
+    if OpenSSL::Digest.const_defined?('SHA256')
+      @digest = OpenSSL::Digest::SHA256
+    elsif OpenSSL::Digest.const_defined?('SHA1')
+      @digest = OpenSSL::Digest::SHA1
+    else
+      raise Puppet::Error,
+        "No FIPS 140-2 compliant digest algorithm in OpenSSL::Digest"
+    end
+    @digest
+  end
+
+  def sign(content, key)
+    content.sign(key, @digest.new)
+  end
+end

data/lib/puppet/ssl/configuration.rb

@@ -0,0 +1,64 @@
+require 'puppet/ssl'
+require 'openssl'
+module Puppet
+module SSL
+  # Puppet::SSL::Configuration is intended to separate out the following concerns:
+  # * CA certificates that authenticate peers (ca_auth_file)
+  # * CA certificates that build trust but do not authenticate (ca_chain_file)
+  # * Who clients trust as distinct from who servers trust.  We should not
+  #   assume one single self signed CA cert for everyone.
+class Configuration
+  def initialize(localcacert, options={})
+    if (options[:ca_chain_file] and not options[:ca_auth_file])
+      raise ArgumentError, "The CA auth chain is required if the chain file is provided"
+    end
+    @localcacert = localcacert
+    @ca_chain_file = options[:ca_chain_file]
+    @ca_auth_file = options[:ca_auth_file]
+  end
+
+  # The ca_chain_file method is intended to return the PEM bundle of CA certs
+  # establishing trust but not used for peer authentication.
+  def ca_chain_file
+    @ca_chain_file || ca_auth_file
+  end
+
+  # The ca_auth_file method is intended to return the PEM bundle of CA certs
+  # used to authenticate peer connections.
+  def ca_auth_file
+    @ca_auth_file || @localcacert
+  end
+
+  ##
+  # ca_auth_certificates returns an Array of OpenSSL::X509::Certificate
+  # instances intended to be used in the connection verify_callback.  This
+  # method loads and parses the {#ca_auth_file} from the filesystem.
+  #
+  # @api private
+  #
+  # @return [Array<OpenSSL::X509::Certificate>]
+  def ca_auth_certificates
+    @ca_auth_certificates ||= decode_cert_bundle(read_file(ca_auth_file))
+  end
+
+  ##
+  # Decode a string of concatenated certificates
+  #
+  # @return [Array<OpenSSL::X509::Certificate>]
+  def decode_cert_bundle(bundle_str)
+    re = /-----BEGIN CERTIFICATE-----.*?-----END CERTIFICATE-----/m
+    pem_ary = bundle_str.scan(re)
+    pem_ary.map do |pem_str|
+      OpenSSL::X509::Certificate.new(pem_str)
+    end
+  end
+  private :decode_cert_bundle
+
+  # read_file makes testing easier.
+  def read_file(path)
+    File.read(path)
+  end
+  private :read_file
+end
+end
+end

data/lib/puppet/ssl/digest.rb

@@ -0,0 +1,20 @@
+class Puppet::SSL::Digest
+  attr_reader :digest
+
+  def initialize(algorithm, content)
+    algorithm ||= 'SHA256'
+    @digest = OpenSSL::Digest.new(algorithm, content)
+  end
+
+  def to_s
+    "(#{name}) #{to_hex}"
+  end
+
+  def to_hex
+    @digest.hexdigest.scan(/../).join(':').upcase
+  end
+
+  def name
+    @digest.name.upcase
+  end
+end

data/lib/puppet/ssl/host.rb

@@ -0,0 +1,371 @@
+require 'puppet/indirector'
+require 'puppet/ssl'
+require 'puppet/ssl/key'
+require 'puppet/ssl/certificate'
+require 'puppet/ssl/certificate_request'
+require 'puppet/ssl/certificate_revocation_list'
+require 'puppet/ssl/certificate_request_attributes'
+
+# The class that manages all aspects of our SSL certificates --
+# private keys, public keys, requests, etc.
+class Puppet::SSL::Host
+  # Yay, ruby's strange constant lookups.
+  Key = Puppet::SSL::Key
+  CA_NAME = Puppet::SSL::CA_NAME
+  Certificate = Puppet::SSL::Certificate
+  CertificateRequest = Puppet::SSL::CertificateRequest
+  CertificateRevocationList = Puppet::SSL::CertificateRevocationList
+
+  extend Puppet::Indirector
+  indirects :certificate_status, :terminus_class => :file, :doc => <<DOC
+    This indirection represents the host that ties a key, certificate, and certificate request together.
+    The indirection key is the certificate CN (generally a hostname).
+DOC
+
+  attr_reader :name
+  attr_accessor :ca
+
+  attr_writer :key, :certificate, :certificate_request
+
+  # This accessor is used in instances for indirector requests to hold desired state
+  attr_accessor :desired_state
+
+  def self.localhost
+    return @localhost if @localhost
+    @localhost = new
+    @localhost.generate unless @localhost.certificate
+    @localhost.key
+    @localhost
+  end
+
+  def self.reset
+    @localhost = nil
+  end
+
+  # This is the constant that people will use to mark that a given host is
+  # a certificate authority.
+  def self.ca_name
+    CA_NAME
+  end
+
+  class << self
+    attr_reader :ca_location
+  end
+
+  # Configure how our various classes interact with their various terminuses.
+  def self.configure_indirection(terminus, cache = nil)
+    Certificate.indirection.terminus_class = terminus
+    CertificateRequest.indirection.terminus_class = terminus
+    CertificateRevocationList.indirection.terminus_class = terminus
+
+    host_map = {:ca => :file, :disabled_ca => nil, :file => nil, :rest => :rest}
+    if term = host_map[terminus]
+      self.indirection.terminus_class = term
+    else
+      self.indirection.reset_terminus_class
+    end
+
+    if cache
+      # This is weird; we don't actually cache our keys, we
+      # use what would otherwise be the cache as our normal
+      # terminus.
+      Key.indirection.terminus_class = cache
+    else
+      Key.indirection.terminus_class = terminus
+    end
+
+    if cache
+      Certificate.indirection.cache_class = cache
+      CertificateRequest.indirection.cache_class = cache
+      CertificateRevocationList.indirection.cache_class = cache
+    else
+      # Make sure we have no cache configured.  puppet master
+      # switches the configurations around a bit, so it's important
+      # that we specify the configs for absolutely everything, every
+      # time.
+      Certificate.indirection.cache_class = nil
+      CertificateRequest.indirection.cache_class = nil
+      CertificateRevocationList.indirection.cache_class = nil
+    end
+  end
+
+  CA_MODES = {
+    # Our ca is local, so we use it as the ultimate source of information
+    # And we cache files locally.
+    :local => [:ca, :file],
+    # We're a remote CA client.
+    :remote => [:rest, :file],
+    # We are the CA, so we don't have read/write access to the normal certificates.
+    :only => [:ca],
+    # We have no CA, so we just look in the local file store.
+    :none => [:disabled_ca]
+  }
+
+  # Specify how we expect to interact with our certificate authority.
+  def self.ca_location=(mode)
+    modes = CA_MODES.collect { |m, vals| m.to_s }.join(", ")
+    raise ArgumentError, "CA Mode can only be one of: #{modes}" unless CA_MODES.include?(mode)
+
+    @ca_location = mode
+
+    configure_indirection(*CA_MODES[@ca_location])
+  end
+
+  # Puppet::SSL::Host is actually indirected now so the original implementation
+  # has been moved into the certificate_status indirector.  This method is in-use
+  # in `puppet cert -c <certname>`.
+  def self.destroy(name)
+    indirection.destroy(name)
+  end
+
+  def self.from_data_hash(data)
+    instance = new(data["name"])
+    if data["desired_state"]
+      instance.desired_state = data["desired_state"]
+    end
+    instance
+  end
+
+  def self.from_pson(pson)
+    Puppet.deprecation_warning("from_pson is being removed in favour of from_data_hash.")
+    self.from_data_hash(pson)
+  end
+
+  # Puppet::SSL::Host is actually indirected now so the original implementation
+  # has been moved into the certificate_status indirector.  This method does not
+  # appear to be in use in `puppet cert -l`.
+  def self.search(options = {})
+    indirection.search("*", options)
+  end
+
+  # Is this a ca host, meaning that all of its files go in the CA location?
+  def ca?
+    ca
+  end
+
+  def key
+    @key ||= Key.indirection.find(name)
+  end
+
+  # This is the private key; we can create it from scratch
+  # with no inputs.
+  def generate_key
+    @key = Key.new(name)
+    @key.generate
+    begin
+      Key.indirection.save(@key)
+    rescue
+      @key = nil
+      raise
+    end
+    true
+  end
+
+  def certificate_request
+    @certificate_request ||= CertificateRequest.indirection.find(name)
+  end
+
+  # Our certificate request requires the key but that's all.
+  def generate_certificate_request(options = {})
+    generate_key unless key
+
+    # If this CSR is for the current machine...
+    if name == Puppet[:certname].downcase
+      # ...add our configured dns_alt_names
+      if Puppet[:dns_alt_names] and Puppet[:dns_alt_names] != ''
+        options[:dns_alt_names] ||= Puppet[:dns_alt_names]
+      elsif Puppet::SSL::CertificateAuthority.ca? and fqdn = Facter.value(:fqdn) and domain = Facter.value(:domain)
+        options[:dns_alt_names] = "puppet, #{fqdn}, puppet.#{domain}"
+      end
+    end
+
+    csr_attributes = Puppet::SSL::CertificateRequestAttributes.new(Puppet[:csr_attributes])
+    if csr_attributes.load
+      options[:csr_attributes] = csr_attributes.custom_attributes
+      options[:extension_requests] = csr_attributes.extension_requests
+    end
+
+    @certificate_request = CertificateRequest.new(name)
+    @certificate_request.generate(key.content, options)
+    begin
+      CertificateRequest.indirection.save(@certificate_request)
+    rescue
+      @certificate_request = nil
+      raise
+    end
+
+    true
+  end
+
+  def certificate
+    unless @certificate
+      generate_key unless key
+
+      # get the CA cert first, since it's required for the normal cert
+      # to be of any use.
+      return nil unless Certificate.indirection.find("ca") unless ca?
+      return nil unless @certificate = Certificate.indirection.find(name)
+
+      validate_certificate_with_key
+    end
+    @certificate
+  end
+
+  def validate_certificate_with_key
+    raise Puppet::Error, "No certificate to validate." unless certificate
+    raise Puppet::Error, "No private key with which to validate certificate with fingerprint: #{certificate.fingerprint}" unless key
+    unless certificate.content.check_private_key(key.content)
+      raise Puppet::Error, <<ERROR_STRING
+The certificate retrieved from the master does not match the agent's private key.
+Certificate fingerprint: #{certificate.fingerprint}
+To fix this, remove the certificate from both the master and the agent and then start a puppet run, which will automatically regenerate a certficate.
+On the master:
+  puppet cert clean #{Puppet[:certname]}
+On the agent:
+  rm -f #{Puppet[:hostcert]}
+  puppet agent -t
+ERROR_STRING
+    end
+  end
+
+  # Generate all necessary parts of our ssl host.
+  def generate
+    generate_key unless key
+    generate_certificate_request unless certificate_request
+
+    # If we can get a CA instance, then we're a valid CA, and we
+    # should use it to sign our request; else, just try to read
+    # the cert.
+    if ! certificate and ca = Puppet::SSL::CertificateAuthority.instance
+      ca.sign(self.name, true)
+    end
+  end
+
+  def initialize(name = nil)
+    @name = (name || Puppet[:certname]).downcase
+    Puppet::SSL::Base.validate_certname(@name)
+    @key = @certificate = @certificate_request = nil
+    @ca = (name == self.class.ca_name)
+  end
+
+  # Extract the public key from the private key.
+  def public_key
+    key.content.public_key
+  end
+
+  # Create/return a store that uses our SSL info to validate
+  # connections.
+  def ssl_store(purpose = OpenSSL::X509::PURPOSE_ANY)
+    unless @ssl_store
+      @ssl_store = OpenSSL::X509::Store.new
+      @ssl_store.purpose = purpose
+
+      # Use the file path here, because we don't want to cause
+      # a lookup in the middle of setting our ssl connection.
+      @ssl_store.add_file(Puppet[:localcacert])
+
+      # If we're doing revocation and there's a CRL, add it to our store.
+      if Puppet.settings[:certificate_revocation]
+        if crl = Puppet::SSL::CertificateRevocationList.indirection.find(CA_NAME)
+          @ssl_store.flags = OpenSSL::X509::V_FLAG_CRL_CHECK_ALL|OpenSSL::X509::V_FLAG_CRL_CHECK
+          @ssl_store.add_crl(crl.content)
+        end
+      end
+      return @ssl_store
+    end
+    @ssl_store
+  end
+
+  def to_data_hash
+    my_cert = Puppet::SSL::Certificate.indirection.find(name)
+    result = { :name  => name }
+
+    my_state = state
+
+    result[:state] = my_state
+    result[:desired_state] = desired_state if desired_state
+
+    thing_to_use = (my_state == 'requested') ? certificate_request : my_cert
+
+    # this is for backwards-compatibility
+    # we should deprecate it and transition people to using
+    # pson[:fingerprints][:default]
+    # It appears that we have no internal consumers of this api
+    # --jeffweiss 30 aug 2012
+    result[:fingerprint] = thing_to_use.fingerprint
+
+    # The above fingerprint doesn't tell us what message digest algorithm was used
+    # No problem, except that the default is changing between 2.7 and 3.0. Also, as
+    # we move to FIPS 140-2 compliance, MD5 is no longer allowed (and, gasp, will
+    # segfault in rubies older than 1.9.3)
+    # So, when we add the newer fingerprints, we're explicit about the hashing
+    # algorithm used.
+    # --jeffweiss 31 july 2012
+    result[:fingerprints] = {}
+    result[:fingerprints][:default] = thing_to_use.fingerprint
+
+    suitable_message_digest_algorithms.each do |md|
+      result[:fingerprints][md] = thing_to_use.fingerprint md
+    end
+    result[:dns_alt_names] = thing_to_use.subject_alt_names
+
+    result
+  end
+
+  # eventually we'll probably want to move this somewhere else or make it
+  # configurable
+  # --jeffweiss 29 aug 2012
+  def suitable_message_digest_algorithms
+    [:SHA1, :SHA256, :SHA512]
+  end
+
+  # Attempt to retrieve a cert, if we don't already have one.
+  def wait_for_cert(time)
+    begin
+      return if certificate
+      generate
+      return if certificate
+    rescue SystemExit,NoMemoryError
+      raise
+    rescue Exception => detail
+      Puppet.log_exception(detail, "Could not request certificate: #{detail.message}")
+      if time < 1
+        puts "Exiting; failed to retrieve certificate and waitforcert is disabled"
+        exit(1)
+      else
+        sleep(time)
+      end
+      retry
+    end
+
+    if time < 1
+      puts "Exiting; no certificate found and waitforcert is disabled"
+      exit(1)
+    end
+
+    while true
+      sleep time
+      begin
+        break if certificate
+        Puppet.notice "Did not receive certificate"
+      rescue StandardError => detail
+        Puppet.log_exception(detail, "Could not request certificate: #{detail.message}")
+      end
+    end
+  end
+
+  def state
+    if certificate_request
+      return 'requested'
+    end
+
+    begin
+      Puppet::SSL::CertificateAuthority.new.verify(name)
+      return 'signed'
+    rescue Puppet::SSL::CertificateAuthority::CertificateVerificationError
+      return 'revoked'
+    end
+  end
+end
+
+require 'puppet/ssl/certificate_authority'