puppetserver-ca 1.3.1 → 1.3.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 620bfa6c11518623fbd5070910a6c119d7597f3d
-  data.tar.gz: e68bb09956a5248ee1644a719a04f46c23bfaabe
+  metadata.gz: 7d21f7cdfd7425e4c88f7393fdd78534437eee25
+  data.tar.gz: 80a876597aa720abd453663da272579f95361248
 SHA512:
-  metadata.gz: 4b4b9ac60fccc7b4229f8763602cdef31dd0fc031caadc822901ef15980a167e54cd7c1b434d2b6766be38bf191220e6e835a321124a5277fe79c3799e47df63
-  data.tar.gz: 05c098c24279c5418a5a84f62b81084694167be9d1313eec2314b5410a2f0a36914af84cfc164146c643fa86131f561e6845fceec58c20e81b9204c225a544d9
+  metadata.gz: 778cdc29b03bf61bde662da6c5f8796616c1aead0bb72e136a0e688d7dd7fec552dce878eb043f51252de650d86f8c10c76811125988302d67125dce67ce9fc0
+  data.tar.gz: 96602ab1cf6da30af50fd1b50aaac4a96a936f35c60e7e2d6acec10a4e63fbb8888f586b28b517e291b524a1dea070b84425ff7d8e08fec2cecf5ce4b0dd2b54

data/lib/puppetserver/ca/action/enable.rb

@@ -97,9 +97,10 @@ MSG
           return signer.errors if signer.errors.any?
 
           ca = LocalCertificateAuthority.new(signer.digest, settings)
-          infra_crl = ca.create_crl_for(ca.cert, ca.key)
           return ca.errors if ca.errors.any?
 
+          infra_crl = ca.create_crl_for(ca.cert, ca.key)
+
           # Drop the full leaf CRL from the chain
           crl_chain = ca.crl_chain.drop(1)
           # Add the new clean CRL, that will be populated with infra nodes only

data/lib/puppetserver/ca/action/list.rb

@@ -20,6 +20,7 @@ Usage:
   puppetserver ca list [--help]
   puppetserver ca list [--config]
   puppetserver ca list [--all]
+  puppetserver ca list --certname NAME[,NAME]
 
 Description:
   List outstanding certificate requests. If --all is specified, signed and
@@ -46,11 +47,21 @@ Options:
             opts.on('--all', 'List all certificates') do |a|
               parsed['all'] = true
             end
+            opts.on('--certname NAME[,NAME]', Array, 'List the specified cert(s)') do |cert|
+              parsed['certname'] = cert
+            end
           end
         end
 
         def run(input)
           config = input['config']
+          certnames = input['certname'] || []
+          all = input['all']
+
+          if all && certnames.any?
+            Errors.handle_with_usage(@logger, ['Cannot combine use of --all and --certname'])
+            return 1
+          end
 
           if config
             errors = FileSystem.validate_file_paths(config)
@@ -60,17 +71,25 @@ Options:
           puppet = Config::Puppet.parse(config)
           return 1 if Errors.handle_with_usage(@logger, puppet.errors)
 
-          all_certs = get_all_certs(puppet.settings)
-          return 1 if all_certs.nil?
+          filter_names = certnames.any? \
+            ? lambda { |x| certnames.include?(x['name']) }
+            : lambda { |x| true }
 
+          all_certs = get_all_certs(puppet.settings).select { |cert| filter_names.call(cert) }
           requested, signed, revoked = separate_certs(all_certs)
-          input['all'] ? output_certs_by_state(requested, signed, revoked) : output_certs_by_state(requested)
+          missing = certnames - all_certs.map { |cert| cert['name'] }
+
+          (all || certnames.any?) \
+            ? output_certs_by_state(requested, signed, revoked, missing)
+            : output_certs_by_state(requested)
 
-          return 0
+          return missing.any? \
+            ? 1
+            : 0
         end
 
-        def output_certs_by_state(requested, signed = [], revoked = [])
-          if revoked.empty? && signed.empty? && requested.empty?
+        def output_certs_by_state(requested, signed = [], revoked = [], missing = [])
+          if revoked.empty? && signed.empty? && requested.empty? && missing.empty?
             @logger.inform "No certificates to list"
             return
           end
@@ -89,6 +108,13 @@ Options:
             @logger.inform "Revoked Certificates:"
             output_certs(revoked)
           end
+
+          unless missing.empty?
+            @logger.inform "Missing Certificates:"
+            missing.each do |name|
+              @logger.inform "    #{name}"
+            end
+          end
         end
 
         def output_certs(certs)
@@ -118,7 +144,7 @@ Options:
 
         def get_all_certs(settings)
           result = Puppetserver::Ca::CertificateAuthority.new(@logger, settings).get_certificate_statuses
-          JSON.parse(result.body) if result
+          result ? JSON.parse(result.body) : []
         end
 
         def parse(args)

data/lib/puppetserver/ca/local_certificate_authority.rb

@@ -64,10 +64,10 @@ module Puppetserver
 
       def load_ssl_components(loader)
         @cert_bundle = loader.certs
-        @cert = loader.certs.first
         @key = loader.key
+        @cert = loader.cert
         @crl_chain = loader.crls
-        @crl = loader.crls.first
+        @crl = loader.crl
       end
 
       def errors

data/lib/puppetserver/ca/version.rb

@@ -1,5 +1,5 @@
 module Puppetserver
   module Ca
-    VERSION = "1.3.1"
+    VERSION = "1.3.2"
   end
 end

data/lib/puppetserver/ca/x509_loader.rb

@@ -5,7 +5,7 @@ module Puppetserver
     # Load, validate, and store x509 objects needed by the Puppet Server CA.
     class X509Loader
 
-      attr_reader :errors, :certs, :key, :crls
+      attr_reader :errors, :certs, :cert, :key, :crls, :crl
 
       def initialize(bundle_path, key_path, chain_path)
         @errors = []
@@ -13,23 +13,53 @@ module Puppetserver
         @certs = load_certs(bundle_path)
         @key = load_key(key_path)
         @crls = load_crls(chain_path)
+        @cert = find_signing_cert
+        @crl = find_leaf_crl
 
         validate(@certs, @key, @crls)
       end
 
+      def find_signing_cert
+        return if @key.nil? || @certs.empty?
+
+        signing_cert = @certs.find do |cert|
+          cert.check_private_key(@key)
+        end
+
+        if signing_cert.nil?
+          @errors << "Could not find certificate matching private key"
+        end
+
+        signing_cert
+      end
+
+      def find_leaf_crl
+        return if @crls.empty? || @cert.nil?
+
+        leaf_crl = @crls.find do |crl|
+          crl.issuer == @cert.subject
+        end
+
+        if leaf_crl.nil?
+          @errors << 'Could not find CRL issued by CA certificate'
+        end
+
+        leaf_crl
+      end
+
       # Only do as much validation as is possible, assume whoever tried to
       # load the objects wrote errors about any invalid ones, but that bundle
       # and chain may be empty arrays and pkey may be nil.
       def validate(bundle, pkey, chain)
-        if !chain.empty? && !bundle.empty?
-          validate_crl_and_cert(chain.first, bundle.first)
+        if !@crl.nil? && !@cert.nil?
+          validate_crl_and_cert(@crl, @cert)
         end
 
-        if pkey && !bundle.empty?
-          validate_cert_and_key(pkey, bundle.first)
+        if pkey && !@cert.nil?
+          validate_cert_and_key(pkey, @cert)
         end
 
-        unless bundle.empty?
+        unless bundle.empty? || @cert.nil?
           validate_full_chain(bundle, chain)
         end
       end
@@ -112,7 +142,7 @@ module Puppetserver
       #   - If provided, no CAs within the chain of trust have been revoked
       # However this does allow for:
       #   - Additional, ignored, certs and CRLs in the bundle/chain
-      #   - certs and CRLs in any order (as long as the leaf cert is first)
+      #   - certs and CRLs in any order
       def validate_full_chain(certs, crls)
         store = OpenSSL::X509::Store.new
         certs.each {|cert| store.add_cert(cert) }
@@ -121,7 +151,7 @@ module Puppetserver
           crls.each {|crl| store.add_crl(crl) }
         end
 
-        unless store.verify(certs.first)
+        unless store.verify(@cert)
           @errors << 'Leaf certificate could not be validated'
           @errors << "Validating cert store returned: #{store.error} - #{store.error_string}"
         end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: puppetserver-ca
 version: !ruby/object:Gem::Version
-  version: 1.3.1
+  version: 1.3.2
 platform: ruby
 authors:
 - Puppet, Inc.
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-03-08 00:00:00.000000000 Z
+date: 2019-07-16 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: facter