puppetserver-ca 2.3.1 → 2.3.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9443656cd200fac958b84f3b7444a402146344105b25022eef46dbe1d24201a1
-  data.tar.gz: aa4c2fbcae1976a25346c6cfe16d792099b6ccc722f24770535e58367bc4128d
+  metadata.gz: 37981ba97c1f259e077b807b2903ea73d4726c56c4fb28b1e7e506fa456c2002
+  data.tar.gz: 15fab6a94a112e748d6605cb7d1b9a511fb17f663e6c25b59a2552d254f5c155
 SHA512:
-  metadata.gz: 34e5662cbb5d7f92bf9f1b3f91f69d37149986c4ba998e42655cf5440349a242116f04c3abfc50244140f4de681fdffed77fa9c56128286bfe3e96d49ebc2939
-  data.tar.gz: 24740e26cceae352f4def897433bc4971b78c8d51c94e0692b19868a10a73dec29c266c1f9f09281b46299dfd9f795cba00c57b00726556529faf0ef820bd664
+  metadata.gz: 993aa454173c018b817f5028bd0726679fd71c9588cf96aa75e4534e3726919b0b851b83c7bd04628c2cf9e58146739678d9b856e0b64fea8ca0fea98b78f567
+  data.tar.gz: ea9b4e92cf2a607274bee95d882f8e69c34fa5ae4dcf338aee4fae7697ed82d39f0cb1ffa16ba8466a88d2040e75d3d96b01f6b2c528adaf8170779966b2e366

data/lib/puppetserver/ca/action/generate.rb

@@ -26,7 +26,7 @@ Usage:
   puppetserver ca generate [--help]
   puppetserver ca generate --certname NAME[,NAME] [--config PATH]
                            [--subject-alt-names NAME[,NAME]]
-                           [--ca-client]
+                           [--ca-client [--force]]
 
 Description:
   Generates a new certificate signed by the intermediate CA
@@ -75,6 +75,10 @@ BANNER
                     'Causes the cert to be generated offline.') do |ca_client|
               parsed['ca-client'] = true
             end
+            opts.on('--force', 'Suppress errors when signing cert offline.',
+                    "To be used with '--ca-client'") do |force|
+              parsed['force'] = true
+            end
             opts.on('--ttl TTL', 'The time-to-live for each cert generated and signed') do |ttl|
               parsed['ttl'] = ttl
             end
@@ -139,8 +143,21 @@ BANNER
 
           # Generate and save certs and associated keys
           if input['ca-client']
-            # Refused to generate certs offfline if the CA service is running
-            return 1 if HttpClient.check_server_online(puppet.settings, @logger)
+            # Refuse to generate certs offline if the CA service is running
+            begin
+              return 1 if HttpClient.check_server_online(puppet.settings, @logger)
+            rescue Puppetserver::Ca::ConnectionFailed => e
+              base_message = "Could not determine whether Puppet Server is online."
+              if input['force']
+                @logger.inform("#{base_message} Connection check failed with " \
+                  "error: #{e.wrapped}\nContinuing with certificate signing.")
+              else
+                @logger.inform("#{base_message} If you are certain that the " \
+                  "Puppetserver service is stopped, run this command again " \
+                  "with the '--force' flag.")
+                raise e
+              end
+            end
             all_passed = generate_authorized_certs(certnames, alt_names, puppet.settings, signer.digest)
           else
             all_passed = generate_certs(certnames, alt_names, puppet.settings, signer.digest, input['ttl'])

data/lib/puppetserver/ca/action/list.rb

@@ -62,6 +62,7 @@ Options:
           certnames = input['certname'] || []
           all = input['all']
           output_format = input['format'] || "text"
+          missing = []
 
           unless VALID_FORMAT.include?(output_format)
             Errors.handle_with_usage(@logger, ["Unknown format flag '#{output_format}'. Valid formats are '#{VALID_FORMAT.join("', '")}'."])
@@ -87,14 +88,14 @@ Options:
             filter_names = lambda { |x| true }
           end
 
-          all_certs = get_all_certs(puppet.settings).select { |cert| filter_names.call(cert) }
-          requested, signed, revoked = separate_certs(all_certs)
-          missing = certnames - all_certs.map { |cert| cert['name'] }
-
           if (all || certnames.any?)
+            all_certs = get_certs_or_csrs(puppet.settings).select { |cert| filter_names.call(cert) }
+            requested, signed, revoked = separate_certs(all_certs)
+            missing = certnames - all_certs.map { |cert| cert['name'] }
             output_certs_by_state(all, output_format, requested, signed, revoked, missing)
           else
-            output_certs_by_state(all, output_format, requested)
+            all_csrs = get_certs_or_csrs(puppet.settings, "requested")
+            output_certs_by_state(all, output_format, all_csrs)
           end
 
           return missing.any? ? 1 : 0
@@ -209,8 +210,9 @@ Options:
           return requested, signed, revoked
         end
 
-        def get_all_certs(settings)
-          result = Puppetserver::Ca::CertificateAuthority.new(@logger, settings).get_certificate_statuses
+        def get_certs_or_csrs(settings, queried_state = nil)
+          query = queried_state ? { :state => queried_state } : {}
+          result = Puppetserver::Ca::CertificateAuthority.new(@logger, settings).get_certificate_statuses(query)
 
           if result
             return JSON.parse(result.body)

data/lib/puppetserver/ca/action/prune.rb

@@ -1,5 +1,6 @@
 require 'optparse'
 require 'openssl'
+require 'set'
 require 'puppetserver/ca/errors'
 require 'puppetserver/ca/utils/cli_parsing'
 require 'puppetserver/ca/utils/file_system'
@@ -31,6 +32,7 @@ BANNER
 
         def run(inputs)
           config_path = inputs['config']
+          exit_code = 0
 
           # Validate the config path.
           if config_path
@@ -49,55 +51,59 @@ BANNER
           # Getting the CRL(s)
           loader = X509Loader.new(puppet.settings[:cacert], puppet.settings[:cakey], puppet.settings[:cacrl])
 
-          puppet_crl = loader.crls.select { |crl| crl.verify(loader.key) }
-          number_of_removed_duplicates = prune_CRLs(puppet_crl)
+          verified_crls = loader.crls.select { |crl| crl.verify(loader.key) }
 
-          if number_of_removed_duplicates > 0
-            update_pruned_CRL(puppet_crl, loader.key)
-            FileSystem.write_file(puppet.settings[:cacrl], loader.crls, 0644)
-            @logger.inform("Removed #{number_of_removed_duplicates} duplicated certs from Puppet's CRL.")
+          if verified_crls.length == 1
+            puppet_crl = verified_crls.first
+            @logger.inform("Total number of certificates found in Puppet's CRL is: #{puppet_crl.revoked.length}.")
+            number_of_removed_duplicates = prune_CRL(puppet_crl)
+
+            if number_of_removed_duplicates > 0
+              update_pruned_CRL(puppet_crl, loader.key)
+              FileSystem.write_file(puppet.settings[:cacrl], loader.crls, 0644)
+              @logger.inform("Removed #{number_of_removed_duplicates} duplicated certs from Puppet's CRL.")
+            else
+              @logger.inform("No duplicate revocations found in the CRL.")
+            end
           else
-            @logger.inform("No duplicate revocations found in the CRL.")
+            @logger.err("Could not identify Puppet's CRL. Aborting prune action.")
+            exit_code = 1
           end
 
-          return 0
+          return exit_code
         end
 
-        def prune_CRLs(crl_list)
+        def prune_CRL(crl)
           number_of_removed_duplicates = 0
 
-          crl_list.each do |crl|
-            existed_serial_number = Set.new()
-            revoked_list = crl.revoked
-            @logger.debug("Pruning duplicate entries in CRL for issuer " \
-              "#{crl.issuer.to_s(OpenSSL::X509::Name::RFC2253)}") if @logger.debug?
-
-            revoked_list.delete_if do |revoked|
-              if existed_serial_number.add?(revoked.serial)
-                false
-              else
-                number_of_removed_duplicates += 1
-                @logger.debug("Removing duplicate of #{revoked.serial}, " \
-                  "revoked on #{revoked.time}\n") if @logger.debug?
-                true
-              end
+          existed_serial_number = Set.new()
+          revoked_list = crl.revoked
+          @logger.debug("Pruning duplicate entries in CRL for issuer " \
+            "#{crl.issuer.to_s(OpenSSL::X509::Name::RFC2253)}") if @logger.debug?
+
+          revoked_list.delete_if do |revoked|
+            if existed_serial_number.add?(revoked.serial)
+              false
+            else
+              number_of_removed_duplicates += 1
+              @logger.debug("Removing duplicate of #{revoked.serial}, " \
+                "revoked on #{revoked.time}\n") if @logger.debug?
+              true
             end
-            crl.revoked=(revoked_list)
           end
+          crl.revoked=(revoked_list)
 
           return number_of_removed_duplicates
         end
 
-        def update_pruned_CRL(crl_list, pkey)
-          crl_list.each do |crl|
-            number_ext, other_ext = crl.extensions.partition{ |ext| ext.oid == "crlNumber" }
-            number_ext.each do |crl_number|
-              updated_crl_number = OpenSSL::BN.new(crl_number.value) + OpenSSL::BN.new(1)
-              crl_number.value=(OpenSSL::ASN1::Integer(updated_crl_number))
-            end
-            crl.extensions=(number_ext + other_ext)
-            crl.sign(pkey, OpenSSL::Digest::SHA256.new)
+        def update_pruned_CRL(crl, pkey)
+          number_ext, other_ext = crl.extensions.partition{ |ext| ext.oid == "crlNumber" }
+          number_ext.each do |crl_number|
+            updated_crl_number = OpenSSL::BN.new(crl_number.value) + OpenSSL::BN.new(1)
+            crl_number.value=(OpenSSL::ASN1::Integer(updated_crl_number))
           end
+          crl.extensions=(number_ext + other_ext)
+          crl.sign(pkey, OpenSSL::Digest::SHA256.new)
         end
 
         def self.parser(parsed = {})

data/lib/puppetserver/ca/certificate_authority.rb

@@ -41,8 +41,8 @@ module Puppetserver
       end
 
       # Returns a URI-like wrapper around CA specific urls
-      def make_ca_url(resource_type = nil, certname = nil)
-        HttpClient::URL.new('https', @ca_server, @ca_port, 'puppet-ca', 'v1', resource_type, certname)
+      def make_ca_url(resource_type = nil, certname = nil, query = {})
+        HttpClient::URL.new('https', @ca_server, @ca_port, 'puppet-ca', 'v1', resource_type, certname, query)
       end
 
       def process_ttl_input(ttl)
@@ -141,7 +141,7 @@ module Puppetserver
         when :revoke
           case result.code
           when '200', '204'
-            @logger.inform "Revoked certificate for #{certname}"
+            @logger.inform "Certificate for #{certname} has been revoked"
             return :success
           when '404'
             @logger.err 'Error:'
@@ -215,7 +215,7 @@ module Puppetserver
       def check_revocation(certname, result)
         case result.code
         when '200', '204'
-          @logger.inform "Revoked certificate for #{certname}"
+          @logger.inform "Certificate for #{certname} has been revoked"
           return :success
         when '409'
           return :invalid
@@ -250,8 +250,8 @@ module Puppetserver
       end
 
       # Returns nil for errors, else the result of the GET request
-      def get_certificate_statuses
-        result = get('certificate_statuses', 'any_key')
+      def get_certificate_statuses(query = {})
+        result = get('certificate_statuses', 'any_key', query)
 
         unless result.code == '200'
           @logger.err 'Error:'
@@ -287,8 +287,8 @@ module Puppetserver
       # @param resource_type [String] the resource type of url
       # @param resource_name [String] the resource name of url
       # @return [Struct] an instance of the Result struct with :code, :body
-      def get(resource_type, resource_name)
-        url = make_ca_url(resource_type, resource_name)
+      def get(resource_type, resource_name, query = {})
+        url = make_ca_url(resource_type, resource_name, query)
         @client.with_connection(url) do |connection|
           connection.get(url)
         end

data/lib/puppetserver/ca/utils/http_client.rb

@@ -1,5 +1,6 @@
 require 'net/https'
 require 'openssl'
+require 'uri'
 
 require 'puppetserver/ca/errors'
 
@@ -114,7 +115,6 @@ module Puppetserver
             request.body = body
             result = @conn.request(request)
 
-
             Result.new(result.code, result.body)
           end
 
@@ -136,10 +136,13 @@ module Puppetserver
         # Like URI, but not... maybe of suspicious value
         URL = Struct.new(:protocol, :host, :port,
                          :endpoint, :version,
-                         :resource_type, :resource_name) do
+                         :resource_type, :resource_name, :query) do
                 def full_url
-                  protocol + '://' + host + ':' + port + '/' +
-                  [endpoint, version, resource_type, resource_name].join('/')
+                  url = protocol + '://' + host + ':' + port + '/' +
+                        [endpoint, version, resource_type, resource_name].join('/')
+
+                  url = url + "?" + URI.encode_www_form(query) unless query.nil? || query.empty?
+                  return url
                 end
 
                 def to_uri

data/lib/puppetserver/ca/version.rb

@@ -1,5 +1,5 @@
 module Puppetserver
   module Ca
-    VERSION = "2.3.1"
+    VERSION = "2.3.5"
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: puppetserver-ca
 version: !ruby/object:Gem::Version
-  version: 2.3.1
+  version: 2.3.5
 platform: ruby
 authors:
 - Puppet, Inc.
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2021-07-28 00:00:00.000000000 Z
+date: 2021-09-07 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: facter