ufo 4.5.7 → 4.5.8
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/CHANGELOG.md +5 -0
- data/docs/_docs/ssl_errors.md +41 -0
- data/docs/_includes/subnav.html +1 -1
- data/docs/utils/ssl-doctor.rb +89 -0
- data/docs/utils/test-aws-api-access.rb +11 -0
- data/docs/utils/update-cert-chains.sh +11 -0
- data/lib/template/.ufo/settings/cfn/default.yml.tt +1 -1
- data/lib/ufo/cancel.rb +1 -1
- data/lib/ufo/version.rb +1 -1
- metadata +6 -2
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA256:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: 77c464a6ac76c7f5178cac5a8e7f03b55567fdc0878958a55d4855c3b04e956b
|
4
|
+
data.tar.gz: 7ff44130767630f6f6cd889cb1ba878585e1913dde1ecca1b61cbf4b4899d100
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: b445b6971da33ee4f7cf4e25eb099bdd314fcaa0616fd7acce582e19ddf6cc08656d861d6b5b7d08541444a3273fbdd54ce51a4397bc4656ddee9b99ecd2ccbd
|
7
|
+
data.tar.gz: 9e9beaf6fd336e4d6e457f2641985bfe011f38fae8ff51715e36e56b7bc1e45a0a6e3f0af380034d2f23a235fbf4090e7cdb028dba92477c7d91dd196537328b
|
data/CHANGELOG.md
CHANGED
@@ -3,6 +3,11 @@
|
|
3
3
|
All notable changes to this project will be documented in this file.
|
4
4
|
This project *tries* to adhere to [Semantic Versioning](http://semver.org/), even before v1.0.
|
5
5
|
|
6
|
+
## [4.5.8]
|
7
|
+
- #91 added helper scripts to dianose and resolve the SSL issues - added docs to help explain and save the user time and research
|
8
|
+
- improve cancel command
|
9
|
+
- update /up check starter example
|
10
|
+
|
6
11
|
## [4.5.7]
|
7
12
|
- #88 update starter variables template with += example
|
8
13
|
|
@@ -0,0 +1,41 @@
|
|
1
|
+
---
|
2
|
+
Title: SSL Errors
|
3
|
+
# nav_order:
|
4
|
+
---
|
5
|
+
|
6
|
+
UFO uses the AWS Ruby SDK and the underlying default SSL certificate chain configured in your active Ruby and
|
7
|
+
OpenSSL to communicate to your AWS environment. This means that you _must correctly configure_ your Ruby and OpenSSL to have all the needed ROOT certificates for UFO to be able to communicate to AWS - _especially_ if you are behind a proxy or a corporate SSL-Proxy.
|
8
|
+
|
9
|
+
If you are behind a corporate SSL proxy and you have not updated system, OpenSSL and Ruby certificate chains to include the needed corporate root certificates, you will see errors, such as:
|
10
|
+
|
11
|
+
```
|
12
|
+
Seahorse::Client::NetworkingError: SSL_connect returned=1 errno=0 state=error: certificate verify failed (self signed certificate in certificate chain)
|
13
|
+
~/.rbenv/versions/2.6.0/lib/ruby/2.6.0/net/protocol.rb:44:in `connect_nonblock'
|
14
|
+
~/.rbenv/versions/2.6.0/lib/ruby/2.6.0/net/protocol.rb:44:in `ssl_socket_connect'
|
15
|
+
~/.rbenv/versions/2.6.0/lib/ruby/2.6.0/net/http.rb:996:in `connect'
|
16
|
+
~/.rbenv/versions/2.6.0/lib/ruby/2.6.0/net/http.rb:930:in `do_start'
|
17
|
+
~/.rbenv/versions/2.6.0/lib/ruby/2.6.0/net/http.rb:925:in `start'
|
18
|
+
```
|
19
|
+
|
20
|
+
## Helper Scripts
|
21
|
+
|
22
|
+
The `docs/utils` directory has a few scripts that should be able to help you resolve these issues and track down which certs are giving you problems.
|
23
|
+
|
24
|
+
- `ssl-doctor.rb` is from the very useful examples at <https://github.com/mislav/ssl-tools>, and it can help you find the missing ROOT cert in your certificate chain and give suggestion on getting OpenSSL working correctly.
|
25
|
+
- `update-cert-chains.sh` will help you update your Ruby and OpenSSL chains by adding in the missing ROOT cert and also pulling in the OSX System Root to your rbenv environment.
|
26
|
+
- `test-aws-api-access.rb` should now return a list of the S3 buckets for the current AWS profile that is active.
|
27
|
+
|
28
|
+
## Trouble-shooting
|
29
|
+
|
30
|
+
### Update Brew and OpenSSL
|
31
|
+
|
32
|
+
- `brew update`
|
33
|
+
- `brew upgrade openssl`
|
34
|
+
|
35
|
+
### Use the Helper Scripts to find the trouble spot
|
36
|
+
|
37
|
+
Once you have updated OpenSSL and your `brew` packages, use the helper scripts above to see if you can track down the missing certificate in your certificate chain.
|
38
|
+
|
39
|
+
The `update-cert-chain.sh` file was created using the suggestions from <https://gemfury.com/help/could-not-verify-ssl-certificate/>. Please review the information at <https://gemfury.com/help/could-not-verify-ssl-certificate/> if the `Helper Scripts` above do not fully resolve your issue.
|
40
|
+
|
41
|
+
The `test-aws-api-access.rb` uses examples from the <https://docs.aws.amazon.com/sdk-for-ruby/v3/developer-guide/quick-start-guide.html> for using and configuring the Ruby AWS SDK on your system.
|
data/docs/_includes/subnav.html
CHANGED
@@ -58,7 +58,7 @@
|
|
58
58
|
<li><a href="{% link _docs/more/why-cloudformation.md %}">Why CloudFormation</a></li>
|
59
59
|
<li><a href="{% link _docs/more/customize-cloudformation.md %}">Customize CloudFormation</a></li>
|
60
60
|
<li><a href="{% link _docs/more/stuck-cloudformation.md %}">Stuck CloudFormation</a></li>
|
61
|
-
<li><a href="{% link _docs/more/run-in-pieces.md %}">Run In
|
61
|
+
<li><a href="{% link _docs/more/run-in-pieces.md %}">Run In Steps</a></li>
|
62
62
|
<li><a href="{% link _docs/more/single-task.md %}">Run Single Task</a></li>
|
63
63
|
<li><a href="{% link _docs/more/migrations.md %}">Database Migrations</a></li>
|
64
64
|
<li><a href="{% link _docs/more/automated-cleanup.md %}">Automated Cleanup</a></li>
|
@@ -0,0 +1,89 @@
|
|
1
|
+
# Usage: ruby doctor.rb [HOST=status.github.com[:PORT=443]]
|
2
|
+
# see: https://github.com/mislav/ssl-tools
|
3
|
+
require 'rbconfig'
|
4
|
+
require 'net/https'
|
5
|
+
|
6
|
+
if ARGV[0] =~ /^[^-]/
|
7
|
+
host, port = ARGV[0].split(':', 2)
|
8
|
+
else
|
9
|
+
host = 'status.github.com'
|
10
|
+
end
|
11
|
+
port ||= 443
|
12
|
+
|
13
|
+
ruby = File.join(RbConfig::CONFIG['bindir'], RbConfig::CONFIG['ruby_install_name'])
|
14
|
+
ruby_version = RUBY_VERSION
|
15
|
+
if patch = RbConfig::CONFIG['PATCHLEVEL']
|
16
|
+
ruby_version += "-p#{patch}"
|
17
|
+
end
|
18
|
+
puts "%s (%s)" % [ruby, ruby_version]
|
19
|
+
|
20
|
+
openssl_dir = OpenSSL::X509::DEFAULT_CERT_AREA
|
21
|
+
mac_openssl = '/System/Library/OpenSSL' == openssl_dir
|
22
|
+
puts "%s: %s" % [OpenSSL::OPENSSL_VERSION, openssl_dir]
|
23
|
+
[OpenSSL::X509::DEFAULT_CERT_DIR_ENV, OpenSSL::X509::DEFAULT_CERT_FILE_ENV].each do |key|
|
24
|
+
puts "%s=%s" % [key, ENV[key].to_s.inspect]
|
25
|
+
end
|
26
|
+
|
27
|
+
ca_file = ENV[OpenSSL::X509::DEFAULT_CERT_FILE_ENV] || OpenSSL::X509::DEFAULT_CERT_FILE
|
28
|
+
ca_path = (ENV[OpenSSL::X509::DEFAULT_CERT_DIR_ENV] || OpenSSL::X509::DEFAULT_CERT_DIR).chomp('/')
|
29
|
+
|
30
|
+
puts "\nHEAD https://#{host}:#{port}"
|
31
|
+
http = Net::HTTP.new(host, port)
|
32
|
+
http.use_ssl = true
|
33
|
+
|
34
|
+
# Explicitly setting cert_store like this is not needed in most cases but it
|
35
|
+
# seems necessary in edge cases such as when using `verify_callback` in some
|
36
|
+
# combination of Ruby + OpenSSL versions.
|
37
|
+
http.cert_store = OpenSSL::X509::Store.new
|
38
|
+
http.cert_store.set_default_paths
|
39
|
+
|
40
|
+
http.verify_mode = OpenSSL::SSL::VERIFY_PEER
|
41
|
+
failed_cert = failed_cert_reason = nil
|
42
|
+
|
43
|
+
if mac_openssl
|
44
|
+
warn "warning: will not be able show failed certificate info on OS X's OpenSSL"
|
45
|
+
# This drives me absolutely nuts. It seems that on Rubies compiled against OS X's
|
46
|
+
# system OpenSSL, the mere fact of defining a `verify_callback` makes the
|
47
|
+
# cert verification fail for requests that would otherwise be successful.
|
48
|
+
else
|
49
|
+
http.verify_callback = lambda { |verify_ok, store_context|
|
50
|
+
if !verify_ok
|
51
|
+
failed_cert = store_context.current_cert
|
52
|
+
failed_cert_reason = "%d: %s" % [ store_context.error, store_context.error_string ]
|
53
|
+
end
|
54
|
+
verify_ok
|
55
|
+
}
|
56
|
+
end
|
57
|
+
|
58
|
+
user_agent = "net/http #{ruby_version}"
|
59
|
+
req = Net::HTTP::Head.new('/', 'user-agent' => user_agent)
|
60
|
+
|
61
|
+
begin
|
62
|
+
res = http.start { http.request(req) }
|
63
|
+
abort res.inspect if res.code.to_i >= 500
|
64
|
+
puts "OK"
|
65
|
+
rescue Errno::ECONNREFUSED
|
66
|
+
puts "Error: connection refused"
|
67
|
+
exit 1
|
68
|
+
rescue OpenSSL::SSL::SSLError => e
|
69
|
+
puts "#{e.class}: #{e.message}"
|
70
|
+
|
71
|
+
if failed_cert
|
72
|
+
puts "\nThe server presented a certificate that could not be verified:"
|
73
|
+
puts " subject: #{failed_cert.subject}"
|
74
|
+
puts " issuer: #{failed_cert.issuer}"
|
75
|
+
puts " error code %s" % failed_cert_reason
|
76
|
+
end
|
77
|
+
|
78
|
+
ca_file_missing = !File.exist?(ca_file) && !mac_openssl
|
79
|
+
ca_path_empty = Dir["#{ca_path}/*"].empty?
|
80
|
+
|
81
|
+
if ca_file_missing || ca_path_empty
|
82
|
+
puts "\nPossible causes:"
|
83
|
+
puts " `%s' does not exist" % ca_file if ca_file_missing
|
84
|
+
puts " `%s/' is empty" % ca_path if ca_path_empty
|
85
|
+
end
|
86
|
+
|
87
|
+
exit 1
|
88
|
+
end
|
89
|
+
|
@@ -0,0 +1,11 @@
|
|
1
|
+
# usage 'ruby s3-cert-chain-test.rb'
|
2
|
+
# see: https://docs.aws.amazon.com/sdk-for-ruby/v3/developer-guide/quick-start-guide.html
|
3
|
+
|
4
|
+
require 'aws-sdk-s3' # v2: require 'aws-sdk'
|
5
|
+
#Aws.use_bundled_cert!
|
6
|
+
|
7
|
+
s3 = Aws::S3::Resource.new(region: 'us-east-1')
|
8
|
+
|
9
|
+
s3.buckets.limit(50).each do |b|
|
10
|
+
puts "#{b.name}"
|
11
|
+
end
|
@@ -0,0 +1,11 @@
|
|
1
|
+
#!/bin/bash
|
2
|
+
|
3
|
+
cert_file=$(ruby -ropenssl -e 'puts OpenSSL::X509::DEFAULT_CERT_FILE' 2>/dev/null)
|
4
|
+
echo 'What is the uri to your organizations root certificate chain?'
|
5
|
+
read -p 'org_root_chain: ' org_root_chain
|
6
|
+
echo "$org_root_chain"
|
7
|
+
curl "$org_root_chain" -o org_chain.txt
|
8
|
+
cat org_chain.txt >> "$cert_file"
|
9
|
+
mkdir -p "${cert_file%/*}"
|
10
|
+
security find-certificate -a -p /Library/Keychains/System.keychain > "$cert_file"
|
11
|
+
security find-certificate -a -p /System/Library/Keychains/SystemRootCertificates.keychain >> "$cert_file"
|
@@ -18,7 +18,7 @@ target_group:
|
|
18
18
|
# network elb: TCP
|
19
19
|
# so we can keep this commented out, unless we need HTTPS at the app level
|
20
20
|
# Health check settings are supported by application load balancer only:
|
21
|
-
# health_check_path: /
|
21
|
+
# health_check_path: /up # health check
|
22
22
|
health_check_interval_seconds: 10 # default: 30. Network ELB can only take 10 or 30
|
23
23
|
healthy_threshold_count: 2
|
24
24
|
unhealthy_threshold_count: 2 # default: 10
|
data/lib/ufo/cancel.rb
CHANGED
@@ -12,7 +12,7 @@ module Ufo
|
|
12
12
|
if stack.stack_status == "CREATE_IN_PROGRESS"
|
13
13
|
cloudformation.delete_stack(stack_name: @stack_name)
|
14
14
|
puts "Canceling stack creation."
|
15
|
-
elsif stack.stack_status
|
15
|
+
elsif stack.stack_status == "UPDATE_IN_PROGRESS"
|
16
16
|
cloudformation.cancel_update_stack(stack_name: @stack_name)
|
17
17
|
puts "Canceling stack update."
|
18
18
|
else
|
data/lib/ufo/version.rb
CHANGED
metadata
CHANGED
@@ -1,14 +1,14 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: ufo
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 4.5.
|
4
|
+
version: 4.5.8
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- Tung Nguyen
|
8
8
|
autorequire:
|
9
9
|
bindir: exe
|
10
10
|
cert_chain: []
|
11
|
-
date: 2019-
|
11
|
+
date: 2019-10-18 00:00:00.000000000 Z
|
12
12
|
dependencies:
|
13
13
|
- !ruby/object:Gem::Dependency
|
14
14
|
name: aws-sdk-cloudformation
|
@@ -333,6 +333,7 @@ files:
|
|
333
333
|
- docs/_docs/settings/cfn.md
|
334
334
|
- docs/_docs/settings/cluster.md
|
335
335
|
- docs/_docs/settings/network.md
|
336
|
+
- docs/_docs/ssl_errors.md
|
336
337
|
- docs/_docs/structure.md
|
337
338
|
- docs/_docs/tutorial-ufo-docker-build.md
|
338
339
|
- docs/_docs/tutorial-ufo-init.md
|
@@ -459,6 +460,9 @@ files:
|
|
459
460
|
- docs/quick-start.md
|
460
461
|
- docs/reference.md
|
461
462
|
- docs/style.css
|
463
|
+
- docs/utils/ssl-doctor.rb
|
464
|
+
- docs/utils/test-aws-api-access.rb
|
465
|
+
- docs/utils/update-cert-chains.sh
|
462
466
|
- exe/ufo
|
463
467
|
- lib/cfn/stack.yml
|
464
468
|
- lib/template/.env
|