puppetserver-ca 0.2.0 → 0.3.0

data/lib/puppetserver/ca/puppet_config.rb

@@ -1,4 +1,7 @@
 require 'puppetserver/ca/config_utils'
+require 'puppetserver/settings/ttl_setting'
+require 'securerandom'
+require 'facter'
 
 module Puppetserver
   module Ca
@@ -49,6 +52,8 @@ module Puppetserver
           results = parse_text(File.read(@config_path))
         end
 
+        @certname = default_certname
+
         results ||= {}
         results[:main] ||= {}
         results[:master] ||= {}
@@ -58,9 +63,19 @@ module Puppetserver
         @settings = resolve_settings(overrides).freeze
       end
 
-      # Resolve the cacert, cakey, and cacrl settings from default values,
-      # with any overrides for the specific settings or their dependent
-      # settings (ssldir, cadir) taken into account.
+      def default_certname
+        hostname = Facter.value(:hostname)
+        domain = Facter.value(:domain)
+        if domain and domain != ''
+          fqdn = [hostname, domain].join('.')
+        else
+          fqdn = hostname
+        end
+        fqdn.chomp('.')
+      end
+
+      # Resolve settings from default values, with any overrides for the
+      # specific settings or their dependent settings (ssldir, cadir) taken into account.
       def resolve_settings(overrides = {})
         unresolved_setting = /\$[a-z_]+/
 
@@ -75,22 +90,54 @@ module Puppetserver
         ssldir = overrides.fetch(:ssldir, '$confdir/ssl')
         settings[:ssldir] = substitutions['$ssldir'] = ssldir.sub('$confdir', confdir)
 
+        certdir = overrides.fetch(:certdir, '$ssldir/certs')
+        settings[:certdir] = substitutions['$certdir'] = certdir.sub(unresolved_setting, substitutions)
+
         cadir = overrides.fetch(:cadir, '$ssldir/ca')
         settings[:cadir] = substitutions['$cadir'] = cadir.sub(unresolved_setting, substitutions)
 
-        settings[:cacert] = overrides.fetch(:cacert, '$cadir/ca_crt.pem')
-        settings[:cakey] = overrides.fetch(:cakey, '$cadir/ca_key.pem')
-        settings[:cacrl] = overrides.fetch(:cacrl, '$cadir/ca_crl.pem')
-        settings[:serial] = overrides.fetch(:serial, '$cadir/serial')
+        settings[:certname] = substitutions['$certname'] = overrides.fetch(:certname, @certname)
+
+        server = overrides.fetch(:server, '$certname')
+        settings[:server] = substitutions['$server'] = server.sub(unresolved_setting, substitutions)
+
+        settings[:masterport] = substitutions['$masterport'] = overrides.fetch(:masterport, '8140')
+
+        settings[:ca_name] =  overrides.fetch(:ca_name, 'Puppet CA: $certname')
+        settings[:root_ca_name] = overrides.fetch(:root_ca_name, "Puppet Root CA: #{SecureRandom.hex(7)}")
+
+        unmunged_ca_ttl =  overrides.fetch(:ca_ttl, '15y')
+        ttl_setting = Puppetserver::Settings::TTLSetting.new(:ca_ttl, unmunged_ca_ttl)
+        if ttl_setting.errors
+          ttl_setting.errors.each { |error| @errors << error }
+        end
+
+        settings[:ca_ttl] =         ttl_setting.munged_value
+        settings[:keylength] =      overrides.fetch(:keylength, 4096)
+        settings[:cacert] =         overrides.fetch(:cacert, '$cadir/ca_crt.pem')
+        settings[:cakey] =          overrides.fetch(:cakey, '$cadir/ca_key.pem')
+        settings[:rootkey] =        overrides.fetch(:rootkey, '$cadir/root_key.pem')
+        settings[:cacrl] =          overrides.fetch(:cacrl, '$cadir/ca_crl.pem')
+        settings[:serial] =         overrides.fetch(:serial, '$cadir/serial')
         settings[:cert_inventory] = overrides.fetch(:cert_inventory, '$cadir/inventory.txt')
+        settings[:ca_server] =      overrides.fetch(:ca_server, '$server')
+        settings[:ca_port] =        overrides.fetch(:ca_port, '$masterport')
+        settings[:localcacert] =    overrides.fetch(:localcacert, '$certdir/ca.pem')
+        settings[:hostcert] =       overrides.fetch(:hostcert, '$certdir/$certname.pem')
+        settings[:hostcrl] =        overrides.fetch(:hostcrl, '$ssldir/crl.pem')
+        settings[:privatekeydir] =  overrides.fetch(:privatekeydir, '$ssldir/private_keys')
+        settings[:publickeydir] =   overrides.fetch(:publickeydir, '$ssldir/public_keys')
+        settings[:certificate_revocation] = parse_crl_usage(overrides.fetch(:certificate_revocation, 'true'))
 
         settings.each_pair do |key, value|
-          settings[key] = value.sub(unresolved_setting, substitutions)
+          next unless value.is_a? String
+
+          settings[key] = value.gsub(unresolved_setting, substitutions)
 
           if match = settings[key].match(unresolved_setting)
             @errors << "Could not parse #{match[0]} in #{value}, " +
                        'valid settings to be interpolated are ' +
-                       '$ssldir or $cadir'
+                       '$ssldir, $cadir, or $certname'
           end
         end
 
@@ -127,6 +174,21 @@ module Puppetserver
       def explicitly_given_config_file_or_default_config_exists?
         !@using_default_location || File.exist?(@config_path)
       end
+
+      def run(command)
+        %x( #{command} )
+      end
+
+      def parse_crl_usage(setting)
+        case setting.to_s
+        when 'true', 'chain'
+          :chain
+        when 'leaf'
+          :leaf
+        when 'false'
+          :ignore
+        end
+      end
     end
   end
 end

data/lib/puppetserver/ca/revoke_action.rb

@@ -0,0 +1,138 @@
+require 'puppetserver/ca/utils'
+require 'puppetserver/utils/http_client'
+require 'puppetserver/utils/file_utilities'
+require 'puppetserver/ca/puppet_config'
+
+require 'optparse'
+require 'json'
+
+module Puppetserver
+  module Ca
+    class RevokeAction
+
+      include Puppetserver::Utils
+
+      REQUEST_BODY = JSON.dump({ desired_state: 'revoked' })
+      CERTNAME_BLACKLIST = %w{--all --config}
+
+      SUMMARY = 'Revoke a given certificate'
+      BANNER = <<-BANNER
+Usage:
+  puppetserver ca revoke [--help|--version]
+  puppetserver ca revoke [--config] --certname CERTNAME[,ADDLCERTNAME]
+
+Description:
+Given one or more valid certnames, instructs the CA to revoke them over
+HTTPS using the local agent's PKI
+
+Options:
+BANNER
+
+      def self.parser(parsed = {})
+        parsed['certnames'] = []
+        OptionParser.new do |o|
+          o.banner = BANNER
+          o.on('--certname foo,bar', Array,
+               'One or more comma separated certnames') do |certs|
+            parsed['certnames'] += certs
+          end
+          o.on('--config PUPPET.CONF', 'Custom path to puppet.conf') do |conf|
+            parsed['config'] = conf
+          end
+          o.on('--help', 'Displays this revoke specific help output') do |help|
+            parsed['help'] = help
+          end
+        end
+      end
+
+      def initialize(logger)
+        @logger = logger
+      end
+
+      def parse(args)
+        results = {}
+        parser = self.class.parser(results)
+
+        errors = Utils.parse_with_errors(parser, args)
+
+        results['certnames'].each do |certname|
+          if CERTNAME_BLACKLIST.include?(certname)
+            errors << "    Cannot manage cert named `#{certname}` from " +
+                      "the CLI, if needed use the HTTP API directly"
+          end
+        end
+
+        if results['certnames'].empty?
+          errors << '  At least one certname is required to revoke'
+        end
+
+        errors_were_handled = Utils.handle_errors(@logger, errors, parser.help)
+
+        # if there is an exit_code then Cli will return it early, so we only
+        # return an exit_code if there's an error
+        exit_code = errors_were_handled ? 1 : nil
+
+        return results, exit_code
+      end
+
+      def run(args)
+        certnames = args['certnames']
+        config = args['config']
+
+        if config
+          errors = FileUtilities.validate_file_paths(config)
+          return 1 if Utils.handle_errors(@logger, errors)
+        end
+
+        puppet = PuppetConfig.parse(config)
+        return 1 if Utils.handle_errors(@logger, puppet.errors)
+
+        passed = revoke_certs(certnames, puppet.settings)
+
+        return passed ? 0 : 1
+      end
+
+      def revoke_certs(certnames, settings)
+        client = HttpClient.new(settings[:localcacert],
+                                settings[:certificate_revocation],
+                                settings[:hostcrl])
+
+        url = client.make_ca_url(settings[:ca_server],
+                                 settings[:ca_port],
+                                 'certificate_status')
+
+        # results will be a list of trues & falses based on the success
+        # of revocations
+        results = client.with_connection(url) do |connection|
+          certnames.map do |certname|
+            url.resource_name = certname
+            result = connection.put(REQUEST_BODY, url)
+
+            check_result(result, certname)
+          end
+        end
+
+        return results.all?
+      end
+
+      # logs the action and returns a boolean for success/failure
+      def check_result(result, certname)
+        case result.code
+        when '200', '204'
+          @logger.inform "Revoked certificate for #{certname}"
+          return true
+        when '404'
+          @logger.err 'Error:'
+          @logger.err "    Could not find certificate for #{certname}"
+          return false
+        else
+          @logger.err 'Error:'
+          @logger.err "    When revoking #{certname} received:"
+          @logger.err "      code: #{result.code}"
+          @logger.err "      body: #{result.body.to_s}" if result.body
+          return false
+        end
+      end
+    end
+  end
+end

data/lib/puppetserver/ca/sign_action.rb

@@ -0,0 +1,192 @@
+require 'puppetserver/ca/utils'
+require 'puppetserver/utils/http_client'
+require 'puppetserver/utils/file_utilities'
+require 'puppetserver/ca/puppet_config'
+require 'optparse'
+require 'openssl'
+require 'net/https'
+require 'json'
+
+module Puppetserver
+  module Ca
+    class SignAction
+
+      include Puppetserver::Utils
+
+      SUMMARY = 'Sign a given certificate'
+      BANNER = <<-BANNER
+Usage:
+  puppetserver ca sign [--help|--version]
+  puppetserver ca sign [--config] --certname CERTNAME[,CERTNAME]
+  puppetserver ca sign  --all
+
+Description:
+Given a comma-separated list of valid certnames, instructs the CA to sign each cert.
+
+Options:
+      BANNER
+      BODY = JSON.dump({desired_state: 'signed'})
+
+      def self.parser(parsed = {})
+        OptionParser.new do |opts|
+          opts.banner = BANNER
+          opts.on('--certname x,y,z', Array, 'the name(s) of the cert(s) to be signed') do |cert|
+            parsed['certname'] = cert
+          end
+          opts.on('--config PUPPET.CONF', 'Custom path to Puppet\'s config file') do |conf|
+            parsed['config'] = conf
+          end
+          opts.on('--help', 'Display this command specific help output') do |help|
+            parsed['help'] = true
+          end
+          opts.on('--version', 'Output the version') do |v|
+            parsed['version'] = true
+          end
+          opts.on('--all', 'Operate on all certnames') do |a|
+            parsed['all'] = true
+          end
+        end
+      end
+
+      def initialize(logger)
+        @logger = logger
+      end
+
+      def run(input)
+        config = input['config']
+
+        if config
+          errors = FileUtilities.validate_file_paths(config)
+          return 1 if Utils.handle_errors(@logger, errors)
+        end
+
+        puppet = PuppetConfig.parse(config)
+        return 1 if Utils.handle_errors(@logger, puppet.errors)
+
+        if input['all']
+          requested_certnames = get_all_pending_certs(puppet.settings)
+          if requested_certnames.nil?
+            return 1
+          end
+        else
+          requested_certnames = input['certname']
+        end
+
+        success = sign_requested_certs(requested_certnames, puppet.settings)
+        return success ? 0 : 1
+      end
+
+      def http_client(settings)
+        @client ||= HttpClient.new(settings[:localcacert],
+                                   settings[:certificate_revocation],
+                                   settings[:hostcrl])
+      end
+
+      def get_certificate_statuses(settings)
+        client = http_client(settings)
+        url = client.make_ca_url(settings[:ca_server],
+                                 settings[:ca_port],
+                                 'certificate_statuses',
+                                 'any_key')
+        client.with_connection(url) do |connection|
+          connection.get(url)
+        end
+      end
+
+      def sign_certs(certnames,settings)
+        results = {}
+        client = http_client(settings)
+        url = client.make_ca_url(settings[:ca_server],
+                                 settings[:ca_port],
+                                 'certificate_status')
+        client.with_connection(url) do |connection|
+          certnames.each do |certname|
+            url.resource_name = certname
+            results[certname] = connection.put(BODY, url)
+          end
+        end
+        return results
+      end
+
+      def get_all_certs(settings)
+        result = get_certificate_statuses(settings)
+
+        unless result.code == 200
+            @logger.err 'Error:'
+            @logger.err "    #{result.inspect}"
+            return nil
+        end
+        return result
+      end
+
+      def select_pending_certs(get_result)
+        requested_certnames = JSON.parse(get_result).select{|e| e["state"] == "requested"}.map{|e| e["name"]}
+
+        if requested_certnames.empty?
+          @logger.err 'Error:'
+          @logger.err "    No waiting certificate requests to sign"
+          return nil
+        end
+
+        return requested_certnames
+      end
+
+      def get_all_pending_certs(settings)
+        result = get_all_certs(settings)
+        if result
+          select_pending_certs(result.body)
+        end
+      end
+
+      def sign_requested_certs(certnames,settings)
+        success = true
+        results = sign_certs(certnames, settings)
+        results.each do |certname, result|
+          case result.code
+          when '204'
+            @logger.inform "Signed certificate for #{certname}"
+          when '404'
+            @logger.err 'Error:'
+            @logger.err "    Could not find certificate for #{certname}"
+            success = false
+          else
+            @logger.err 'Error:'
+            @logger.err "    When download requested for #{result.inspect}"
+            @logger.err "    code: #{result.code}"
+            @logger.err "    body: #{result.body.to_s}" if result.body
+            success = false
+          end
+        end
+        return success
+      end
+
+      def check_flag_usage(results)
+        if results['certname'] && results['all']
+          '--all and --certname cannot be used together'
+        elsif !results['certname'] && !results['all']
+          'No arguments given'
+        elsif results['certname'] && results['certname'].include?('--all')
+          'Cannot use --all with --certname. If you actually have a certificate request ' +
+                          'for a certifcate named --all, you need to use the HTTP API.'
+        end
+      end
+
+      def parse(args)
+        results = {}
+        parser = self.class.parser(results)
+
+        errors = Utils.parse_with_errors(parser, args)
+
+        if check_flag_usage(results)
+          errors << check_flag_usage(results)
+        end
+
+        errors_were_handled = Utils.handle_errors(@logger, errors, parser.help)
+
+        exit_code = errors_were_handled ? 1 : nil
+
+        return results, exit_code
+      end
+    end
+  end
+end