summaryrefslogtreecommitdiffstats
path: root/lib/puppet/ssl/host.rb
Commit message (Collapse)AuthorAgeFilesLines
* Merge branch '0.25.x'Markus Roberts2010-02-091-0/+2
|\ | | | | | | | | | | | | | | | | | | Conflicts: lib/puppet/agent.rb lib/puppet/application/puppet.rb lib/puppet/configurer.rb man/man5/puppet.conf.5 spec/integration/defaults.rb spec/unit/configurer.rb
| * Partial reversion of patch for #3088 to fix #3104 (Exception misreported)Markus Roberts2010-01-241-1/+1
| | | | | | | | | | | | | | In my patch for #3088 I made a erroneous assumption about the ruby exception hierarchy and thus missed the fact that Timeout::error descends from both SignalError and Interrupt. This is a partial reversion of the patch for #3088 to let these through so that more useful error messages can be produced.
| * Fix for #3088 (catching Exception also traps SystemExit)Markus Roberts2010-01-241-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | Changing rescues from the default to Exception (to catch errors that don't descend from StandardError) had the unintended consequence of catching (and suppressing) SystemExit. This patch restores the behavior of by reraising the exception. Of the other exceptions that fall through the same crack (NoMemoryError, SignalException, LoadError, Interrupt, NotImplementedError, and ScriptError) this patch also reraises NoMemoryError, SignalException, and Interrupt in the same way and leaves the rest captured.
* | Merge branch '0.25.x'James Turnbull2010-01-131-33/+14
|\| | | | | | | | | | | Conflicts: lib/puppet/ssl/host.rb spec/spec_helper.rb
| * Fix for #2890 (the cached certificates that would not die)Markus Roberts2009-12-191-33/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch implements the two-part suggestion from the ticket; 1) a client that receives a certificate that doesn't match its current private key does not accept, store or use the certificate--instead it removes any locally cached copies and acts as if the certificate had never been found. 2) a puppetmaster that receives a csr from a client for whom it already has a signed certificate now honors the request and considers it to supercede any previously signed certificates. In order to make the cache expiration work as expected, I changed a few assumptions in the caching system: * The expiration of a cached certificate is the earlier of the envelope expiration and the certificate's expiration, as opposed to just overriding the cache value * Telling the cache to expire an item now removes it from the cache if possible, rather than just setting an expiration date in the past and hoping that somebody notices. Signed-off-by: Markus Roberts <Markus@reality.com>
* | Merge branch '0.25.x'Luke Kanies2009-12-211-3/+2
|\| | | | | | | | | | | | | | | Conflicts: lib/puppet/agent.rb lib/puppet/application/puppetd.rb lib/puppet/parser/ast/leaf.rb lib/puppet/util/rdoc/parser.rb
| * Revised partial fix for #2661 and related issuesMarkus Roberts2009-10-271-3/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If setup code for a process depends on network connectivity it needs to be protected with a rescue clause as much as the main body of the process. Further, Timeout exceptions aren't under StandardError and thus aren't caught by an un-typed rescue clause. This doesn't matter if we've morphed the exception, but will cause the program to fail if we haven't. There are many places where these concerns _might_ cause a problem but in most cases they never will in practice; this patch addesses the two cases where I have been able to confirm that it actually can cause the client daemon to exit and two more where I suspect (but can not prove) that it could. I'd be willing to push this patch as it stands, as it at least fixes demonstrable problems. A more general solution would be nice.
* | Always using the CA_name constant instead of "ca"Luke Kanies2009-11-201-3/+3
|/ | | | Signed-off-by: Luke Kanies <luke@madstop.com>
* Removed extra whitespace from end of linesIan Taylor2009-06-061-1/+1
|
* Fixing #2028 - Better failures when a cert is found with no keyLuke Kanies2009-02-281-1/+14
| | | | | | | | | | | | | | | | | | The problem was that the server had a certificate for the client. Initially the client just didn't have a key, because it assumed that if it had a certificate then it had a key. Upon fixing it to create the key, the key then did not match the found certificate. This commit fixes both of those: The key is always found before the certificate, and when the certificate is found it's verified against the private key and an exception is thrown if they don't match. It's always a failure, so this just makes the failure more informative. Signed-off-by: Luke Kanies <luke@madstop.com>
* Resetting SSL cache terminii to nil when only using the caLuke Kanies2009-02-061-0/+8
| | | | | | | | This is important because puppetmasterd changes its configurations a couple of times, and we need to disable any previously-created caches. Signed-off-by: Luke Kanies <luke@madstop.com>
* Cleaning up SSL instances that can't be savedLuke Kanies2009-02-061-2/+13
| | | | | | | | | | | If the SSL Host couldn't save a CSR or key, it would still keep them in memory; this meant that, for instance, a CSR that couldn't be saved to the server was never resent. This commit removes in-memory instances that couldn't be saved, thus forcing regeneration. Signed-off-by: Luke Kanies <luke@madstop.com>
* Fixing #1729 - puppetmasterd can now read certs at startupLuke Kanies2008-12-181-20/+30
| | | | | | | | | | The main aspect of this solution is to create a site-wide Puppet::SSL::Host instance to cache ssl key and certificate, so that by the time we've switched UIDs, we've got the key and cert in memory. Then webrick just uses that, rather than creating a new Host instance. Signed-off-by: Luke Kanies <luke@madstop.com>
* Retrieving the CA certificate before the client certificate.Luke Kanies2008-11-031-4/+10
| | | | | | | | | | | We have to have a CA cert first, because the host will start using the client cert as soon as it's available, but it's not functional without a CA cert. Also removing extra stupid stuff from wait_for_cert -- the connection is now always recycled, which is much simpler. Signed-off-by: Luke Kanies <luke@madstop.com>
* Fixing the SSL::Host#waitforcert method.Luke Kanies2008-08-071-10/+26
| | | | | | | It now works the way puppetd needs it to, rather than the way I thought it would need to work. Signed-off-by: Luke Kanies <luke@madstop.com>
* Caching the SSL store for the SSL Host.Luke Kanies2008-08-071-8/+11
| | | | | | | | | We were creating a new SSL store every time, which caused problems during testing -- it created an infinite loop when trying to create the store while looking up the CRL. Signed-off-by: Luke Kanies <luke@madstop.com>
* Adding wait_for_cert functionality to the ssl host class.Luke Kanies2008-08-041-0/+19
| | | | | | This essentially deprecates the CertHandler module. Signed-off-by: Luke Kanies <luke@madstop.com>
* Fixing #1168 for REST -- all ssl classes downcase their names.Luke Kanies2008-06-151-1/+1
| | | | This is a much cleaner fix than the xmlrpc version, thankfully. :)
* The CRL is now automatically used or ignored.Luke Kanies2008-05-071-4/+2
| | | | | | | | | Previously, you had to configure whether you wanted the CRL or not, which resulted in errors all the time when it was configured but unavailable. Now, Puppet will always create and try to use it, but you won't get failures if it's unavailable.
* Fixing a critical problem in how CRLs were saved and moving SSL Store ↵Luke Kanies2008-05-051-0/+18
| | | | | | | | | | | | | | responsibilities to the SSL::Host class. I was previously saving invalid CRLs unless they'd had a revocation done in them; this commit fixes them so that they're always valid. Also, I've added to SSL::Host the ability to generate a valid SSL Store, suitable for validation. This is now used by Webrick and can be used by the http clients, too. This should have been two commits, but I'm kind of down the rabbit hole ATM.
* The SSL::Host class now uses the CA to generate its certificate when ↵Luke Kanies2008-05-051-3/+8
| | | | | | | | appropriate. It uses the CA singleton method to determine whether it's on valid CA host, and if so, uses the CA instance to sign its generated CSR.
* Interim commit, since I want to work but have no network available.Luke Kanies2008-04-281-2/+12
|
* Renaming the 'ca_file' ssl terminus type to 'ca'.Luke Kanies2008-04-211-1/+1
|
* Making the SSL::Host's destroy method a class method,Luke Kanies2008-04-191-7/+10
| | | | rather than an instance method.
* Finishing the interface between the CA and the CRL.Luke Kanies2008-04-191-16/+7
| | | | | | Certificate revocation now works, the CA knows how to generate the CRL, and the SSL::Host class knows how to configure the CRL class for indirection.
* Switching the SSL::Host class to return Puppet instances.Luke Kanies2008-04-171-11/+9
| | | | | | | | | Previously, the class was returning OpenSSL instances (e.g, OpenSSL::X509::Certificate) instead of Puppet instances (e.g., Puppet::SSL::Certificate). This made some things easier, but it made them asymmetric (e.g., you assigned the key as a Puppet instance but got back an OpenSSL instance), and it also reduced your flexibility and introspectiveness.
* Adding integration tests for a lot of the SSL code.Luke Kanies2008-04-171-1/+3
| | | | | This flushed out some problems, and things mostly look good now, but I don't think we're quite there yet.
* Moving the password file handling into the SSL::Key class.Luke Kanies2008-04-171-5/+1
| | | | | | | | | | | | | | This was necessary because when the Indirector is used, there isn't necessarily enough context available to know when a password file should be used (e.g., when reading a Key from disk, you don't know if that key was encrypted). Now, the Key class automatically uses the right password file, and only tries to use those files that actually exist. This isn't very flexible, in that it only allows one CA file and one non-CA file, but no one really uses anything but the CA file anyway.
* Adding SSL::Host-level support for managing the terminus andLuke Kanies2008-04-171-0/+56
| | | | | cache classes. Also, defaulting to the :file terminus for all of the SSL classes.
* Changing all of the SSL terminus classes to treat CA files specially.Luke Kanies2008-04-171-8/+20
| | | | | | | | | | | | | | | | | | | | | | This is a kind of weird design situation. For instance, we've got a collection of certificates in the :certdir, but then there's a special CA certificate off by itself. Rather than build a whole separate infrastructure for managing those separate files (cert and key, at least), I decided to add special support for specifying where to find the CA-specific bits, and then code for handling them when necessary. This requires that we have a standard way of knowing whether we should be managing the CA bits or normal host files. The Puppet::SSL::Host class now has a 'ca_name' method that returns the string we're using for the CA name; this name is currently 'ca'. We have to use a name, because the name is the only thing that all methods have access to (e.g., when trying to 'find' the right cert, we only have the name available). What this means is that if you want access to the CA key or cert, then create a Puppet::SSL::Host instance with the name 'ca'. You'll still get the CA cert created with the host's :certname; it will just be stored in a different location.
* Removing all the cases where the ssl host specifiesLuke Kanies2008-04-161-70/+18
| | | | | a terminus. Also, getting rid of some metaprogramming that wasn't really helping.
* Adding a :search method to the ssl_file terminus typeLuke Kanies2008-04-151-0/+19
| | | | and the SSL::Host class.
* We have a basically functional CA -- it can signLuke Kanies2008-04-151-3/+22
| | | | | | requests and return certificates. There's still plenty more work to do, but I'm probably not much more than a day away from redoing puppetca to use this code.
* This is a first pass at the certificate authority.Luke Kanies2008-04-151-45/+59
| | | | | The tests are basically entirely absent still, but the structure is all there.
* It looks like all of the new ssl classes for managingLuke Kanies2008-04-151-11/+45
| | | | | | | keys, certificates, and requests now work, including talking to the certificate authority. Now we just need the authority itself, along with the necessary REST terminii.
* The new SSL classes basically work, but they're notLuke Kanies2008-04-151-0/+62
functionally connected to any kind of indirection.
generated by cgit (git 2.34.1) at 2025-09-26 03:16:55 +0000