simp-beaker-helpers 1.8.10 → 1.9.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 19a1973e3ecb4485608ca6f085c003ffa8ed9bcd65f77fefd0c4ecff01dd903a
-  data.tar.gz: d0d52e31f82650bf6a42a81fcb3af81b70e59ae01ea345ab3a8080fd37c207ae
+  metadata.gz: f0593bcb8d63201d20046c6799d7a18c1f6ca7f79302f424dc4d976fd7862c5f
+  data.tar.gz: eeb45a788d488c0a12c6b172f9c41bb3e15f592916db72dec843c135f4593470
 SHA512:
-  metadata.gz: 56df1ba666079778b9a66f25b9afb16b436455368ec86c4c2f781ea2620f5fb841ebdbb10847a00befbde8862a4cdc0f4b4d80264e7d2d4267c961641d65d03b
-  data.tar.gz: ac6c5ed1b1e2950df314ee2e3a111246c4fe70ca306f9c009595d4019ef19008a37a9b140be4d62915a49c768aa87af22482559ce700bacef309cc0a98425fd6
+  metadata.gz: 3616faeb4838f048f575ed0e6764c26f947be7c7e51fa3925080b464bbe363872075427d528f1025ce148f4965abb08aa67211421aaa61063db06ad993e5b0df
+  data.tar.gz: 7611ae390dab78771280651c0101e721a8c2b3abf018d22c59805f146fcbf3db80b1647e00377f4320a0a862a1fc6a21f7a71d77893168393ec232a2aa35d2d0

data/CHANGELOG.md

@@ -1,3 +1,8 @@
+### 1.9.0 / 2018-01-01
+* Ensure that all host IP addresses get added to the internally generated PKI
+  keys as subjectAltNames. Kubernetes needs this and it does not hurt to have
+  in place for testing.
+
 ### 1.8.10 / 2017-11-02
 * Fix bug in which dracut was not run on CentOS6, when dracut-fips was
   installed for a FIPS-enabled test.

data/files/pki/make.sh

@@ -1,6 +1,9 @@
+# For ruby
+export PATH=/opt/puppetlabs/puppet/bin:$PATH
+
 DAYS="-days 365"
 REQ="openssl req $SSLEAY_CONFIG"
-CA="openssl ca $SSLEAY_CONFIG -config ca.cnf"
+CA="openssl ca $SSLEAY_CONFIG"
 VERIFY="openssl verify"
 X509="openssl x509"
 
@@ -31,17 +34,58 @@ touch ${CATOP}/index.txt
 echo "== Making CA certificate ..."
 sed "s/^\([[:space:]]*commonName_default\).*/\1 \t\t= Fake Org Fake CA - ${CASERIAL}/" template_ca.cnf > ca.cnf
 
+export OPENSSL_CONF=ca.cnf
+
 $REQ -verbose -batch -passout file:cacertkey -new -x509 -keyout ${CATOP}/private/$CAKEY -out ${CATOP}/$CACERT $DAYS
 
 echo "== Making Client certificates ..."
-for hname in $*; do
+for hosts in $*; do
+  hosts=`echo $hosts | sed -e 's/[ \t]//g'`
+  hname=`echo $hosts | cut -d',' -f1`
+
   echo "-- $hname"
   mkdir -p "${keydist}/${hname}/cacerts"
-  sed -e "s/#HOSTNAME#/$hname/" template_host.cnf > "working/${hname}.cnf"
+
+  sed -e "s/#HOSTNAME#/${hname}/" template_host.cnf > "working/${hname}.cnf"
+
+  if [ "$hname" != "$hosts" ];
+  then
+    alts=`echo $hosts | cut -d',' -f1-`
+    altnames=''
+    for i in `echo $alts | tr ',' '\n'`
+    do
+      ruby -r ipaddr -e "begin IPAddr.new('$i') rescue exit 1 end"
+      if [ $? -eq 0 ]; then
+        # This is required due to some applications not properly supporting the
+        # IP version of subjectAltName.
+        prefixes='IP DNS'
+      else
+        prefixes='DNS'
+      fi
+
+      for prefix in $prefixes; do
+        if [ "$altnames" != ''  ]
+        then
+          altnames+=",$prefix:$i"
+        else
+          altnames+="$prefix:$i"
+        fi
+      done
+    done
+
+    sed -i "s/# subjectAltName = #ALTNAMES#/subjectAltName = ${altnames}/" "working/${hname}.cnf"
+  fi
+
   echo "-- running openssl req"
-  $REQ -config "working/${hname}.cnf" -new -nodes -keyout ${keydist}/${hname}/${hname}.pem -out working/"${hname}"req.pem -days 360 -batch;
+
+  export OPENSSL_CONF="working/${hname}.cnf"
+
+  $REQ -new -nodes -keyout ${keydist}/${hname}/${hname}.pem -out working/"${hname}"req.pem -days 360 -batch;
+
   echo "-- running openssl ca"
+
   $CA -passin file:cacertkey -batch -out ${keydist}/${hname}/${hname}.pub -infiles working/"${hname}"req.pem
+
   cat ${keydist}/${hname}/${hname}.pub >> ${keydist}/${hname}/${hname}.pem
 done
 

data/files/pki/template_host.cnf

@@ -198,6 +198,7 @@ authorityKeyIdentifier=keyid,issuer:always
 # An alternative to produce certificates that aren't
 # deprecated according to PKIX.
 # subjectAltName=email:move
+# subjectAltName = #ALTNAMES#
 
 # Copy subject details
 # issuerAltName=issuer:copy

data/lib/simp/beaker_helpers.rb

@@ -401,15 +401,61 @@ DEFAULT_KERNEL_TITLE=`/sbin/grubby --info=\\\${DEFAULT_KERNEL_INFO} | grep -m1 t
     puts "== Fake PKI CA"
     pki_dir  = File.expand_path( "../../files/pki", File.dirname(__FILE__))
     host_dir = '/root/pki'
-    fqdns    = fact_on(hosts, 'fqdn')
 
     ca_sut.mkdir_p(host_dir)
     Dir[ File.join(pki_dir, '*') ].each{|f| copy_to( ca_sut, f, host_dir)}
 
+    # Collect network information from all SUTs
+    #
+    # We need this so that we don't insert any common IP addresses into certs
+    suts_network_info = {}
+
+    hosts.each do |host|
+      fqdn = fact_on(host, 'fqdn').strip
+
+      host_entry = { fqdn => [] }
+
+      # Ensure that all interfaces are active prior to collecting data
+      activate_interfaces(host)
+
+      # Gather the IP Addresses for the host to embed in the cert
+      interfaces = fact_on(host, 'interfaces').strip.split(',')
+      interfaces.each do |interface|
+        ipaddress = fact_on(host, "ipaddress_#{interface}")
+
+        next if ipaddress.nil? || ipaddress.empty? || ipaddress.start_with?('127.')
+
+        host_entry[fqdn] << ipaddress.strip
+
+        unless host_entry[fqdn].empty?
+          suts_network_info[fqdn] = host_entry[fqdn]
+        end
+      end
+    end
+
+    # Get all of the repeated SUT IP addresses:
+    #   1. Create a hash of elements that have a key that is the value and
+    #      elements that are the same value
+    #   2. Grab all elements that have more than one value (therefore, were
+    #      repeated)
+    #   3. Pull out an Array of all of the common element keys for future
+    #      comparison
+    common_ip_addresses = suts_network_info
+      .values.flatten
+      .group_by{ |x| x }
+      .select{|k,v| v.size > 1}
+      .keys
+
     # generate PKI certs for each SUT
     Dir.mktmpdir do |dir|
       pki_hosts_file = File.join(dir, 'pki.hosts')
-      File.open(pki_hosts_file, 'w'){|fh| fqdns.each{|fqdn| fh.puts fqdn}}
+
+      File.open(pki_hosts_file, 'w') do |fh|
+        suts_network_info.each do |fqdn, ipaddresses|
+          fh.puts ([fqdn] + (ipaddresses - common_ip_addresses)) .join(',')
+        end
+      end
+
       copy_to(ca_sut, pki_hosts_file, host_dir)
       # generate certs
       on(ca_sut, "cd #{host_dir}; cat #{host_dir}/pki.hosts | xargs bash make.sh")
@@ -489,6 +535,26 @@ done
   end
 
 
+  # Activate all network interfaces on the target system
+  #
+  # This is generally needed if the upstream vendor does not activate all
+  # interfaces by default (EL7 for example)
+  #
+  # Can be passed any number of hosts either singly or as an Array
+  def activate_interfaces(hosts)
+    Array(hosts).each do |host|
+      interfaces = fact_on(host, 'interfaces').strip.split(',')
+      interfaces.delete_if { |x| x =~ /^lo/ }
+
+      interfaces.each do |iface|
+        if fact_on(host, "ipaddress_#{iface}").strip.empty?
+          on(host, "ifup #{iface}", :accept_all_exit_codes => true)
+        end
+      end
+    end
+  end
+
+
   ## Inline Hiera Helpers ##
   ## These will be integrated into core Beaker at some point ##
 
@@ -505,16 +571,7 @@ done
     # We can't guarantee that the upstream vendor isn't disabling interfaces so
     # we need to turn them on at each context run
     c.before(:context) do
-      hosts.each do |host|
-        interfaces = fact_on(host, 'interfaces').strip.split(',')
-        interfaces.delete_if { |x| x =~ /^lo/ }
-
-        interfaces.each do |iface|
-          if fact_on(host, "ipaddress_#{iface}").strip.empty?
-            on(host, "ifup #{iface}", :accept_all_exit_codes => true)
-          end
-        end
-      end
+      activate_interfaces(hosts)
     end
 
     c.after(:all) do

data/lib/simp/beaker_helpers/version.rb

@@ -1,5 +1,5 @@
 module Simp; end
 
 module Simp::BeakerHelpers
-  VERSION = '1.8.10'
+  VERSION = '1.9.0'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: simp-beaker-helpers
 version: !ruby/object:Gem::Version
-  version: 1.8.10
+  version: 1.9.0
 platform: ruby
 authors:
 - Chris Tessmer
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2017-11-02 00:00:00.000000000 Z
+date: 2018-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: beaker
@@ -94,7 +94,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.7.0
+rubygems_version: 2.7.4
 signing_key: 
 specification_version: 4
 summary: beaker helper methods for SIMP