summaryrefslogtreecommitdiffstats
path: root/lib/puppet/ssl
Commit message (Collapse)AuthorAgeFilesLines
* Merge branch '0.25.x'Markus Roberts2010-02-091-0/+2
|\ | | | | | | | | | | | | | | | | | | Conflicts: lib/puppet/agent.rb lib/puppet/application/puppet.rb lib/puppet/configurer.rb man/man5/puppet.conf.5 spec/integration/defaults.rb spec/unit/configurer.rb
| * Partial reversion of patch for #3088 to fix #3104 (Exception misreported)Markus Roberts2010-01-241-1/+1
| | | | | | | | | | | | | | In my patch for #3088 I made a erroneous assumption about the ruby exception hierarchy and thus missed the fact that Timeout::error descends from both SignalError and Interrupt. This is a partial reversion of the patch for #3088 to let these through so that more useful error messages can be produced.
| * Fix for #3088 (catching Exception also traps SystemExit)Markus Roberts2010-01-241-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | Changing rescues from the default to Exception (to catch errors that don't descend from StandardError) had the unintended consequence of catching (and suppressing) SystemExit. This patch restores the behavior of by reraising the exception. Of the other exceptions that fall through the same crack (NoMemoryError, SignalException, LoadError, Interrupt, NotImplementedError, and ScriptError) this patch also reraises NoMemoryError, SignalException, and Interrupt in the same way and leaves the rest captured.
* | Fix #3117 - cert fingerprinting uses a method not available in ruby <= 1.8.6Brice Figureau2010-01-281-1/+1
| | | | | | | | | | | | | | | | OpenSSL::Digest.hexdigest is not available on older ruby versions. This patch accesses directly to the digest instead (which hopefully support hexdigest). Signed-off-by: Brice Figureau <brice-puppet@daysofwonder.com>
* | Feature #2839 - fingerprint certificateBrice Figureau2010-01-194-9/+47
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds several things: * certificate fingerprinting in --list mode * a puppetca action called "--fingerprint" to display fingerprints of given certificates (or all including CSR) * a --fingerprint puppetd option to display client certificates * each time a CSR is generated, its fingerprint is displayed in the log It is also possible to use --digest in puppetca and puppetd to specify a specific digest algorithm. Signed-off-by: Brice Figureau <brice-puppet@daysofwonder.com>
* | Revert "Feature #2839 - fingerprint certificate"James Turnbull2010-01-192-40/+7
| | | | | | | | | | | | This reverts commit a9fb82b0026e75a670fec553b17de3b0f091c2a5. An older branch was pulled
* | Feature #2839 - fingerprint certificateBrice Figureau2010-01-182-7/+40
| | | | | | | | | | | | | | | | | | | | | | | | This patch adds two things: * certificate fingerprinting in --list mode * a puppetca action called "--fingerprint" to display fingerprints of given certificates It is also possible to use --digest to specify a specific digest algorithm. Signed-off-by: Brice Figureau <brice-puppet@daysofwonder.com>
* | Merge branch '0.25.x'James Turnbull2010-01-132-35/+17
|\| | | | | | | | | | | Conflicts: lib/puppet/ssl/host.rb spec/spec_helper.rb
| * Fix for #2890 (the cached certificates that would not die)Markus Roberts2009-12-192-35/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch implements the two-part suggestion from the ticket; 1) a client that receives a certificate that doesn't match its current private key does not accept, store or use the certificate--instead it removes any locally cached copies and acts as if the certificate had never been found. 2) a puppetmaster that receives a csr from a client for whom it already has a signed certificate now honors the request and considers it to supercede any previously signed certificates. In order to make the cache expiration work as expected, I changed a few assumptions in the caching system: * The expiration of a cached certificate is the earlier of the envelope expiration and the certificate's expiration, as opposed to just overriding the cache value * Telling the cache to expire an item now removes it from the cache if possible, rather than just setting an expiration date in the past and hoping that somebody notices. Signed-off-by: Markus Roberts <Markus@reality.com>
* | Merge branch '0.25.x'Luke Kanies2009-12-212-5/+2
|\| | | | | | | | | | | | | | | Conflicts: lib/puppet/agent.rb lib/puppet/application/puppetd.rb lib/puppet/parser/ast/leaf.rb lib/puppet/util/rdoc/parser.rb
| * Re-fixed #2750 - Stop disabling the CRL or checking for a disabled CRLJohn A. Barbuto2009-10-271-2/+0
| | | | | | | | | | | | This was deprecated in commit 1cfb0215 and was keeping puppetd from starting in listen mode. Signed-off-by: John A. Barbuto <jbarbuto@corp.sourceforge.com>
| * Revised partial fix for #2661 and related issuesMarkus Roberts2009-10-271-3/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If setup code for a process depends on network connectivity it needs to be protected with a rescue clause as much as the main body of the process. Further, Timeout exceptions aren't under StandardError and thus aren't caught by an un-typed rescue clause. This doesn't matter if we've morphed the exception, but will cause the program to fail if we haven't. There are many places where these concerns _might_ cause a problem but in most cases they never will in practice; this patch addesses the two cases where I have been able to confirm that it actually can cause the client daemon to exit and two more where I suspect (but can not prove) that it could. I'd be willing to push this patch as it stands, as it at least fixes demonstrable problems. A more general solution would be nice.
* | Fixing #1507 - Adding a :ca_name settingLuke Kanies2009-11-201-1/+6
| | | | | | | | | | | | | | | | This allows one to specify the name to use in the CA certificate. It defaults to the :certname, but for those stuck using mod_ssl it can be changed. Signed-off-by: Luke Kanies <luke@madstop.com>
* | Always using the CA_name constant instead of "ca"Luke Kanies2009-11-202-5/+5
|/ | | | Signed-off-by: Luke Kanies <luke@madstop.com>
* Fix #2082 - puppetca shouldn't list revoked certificatesBrice Figureau2009-07-072-2/+19
| | | | | | | | This patch does two things: * it enhance puppetca to list revoked certificates (prefixed by -) * it fixes the ca crl verification which was broken Signed-off-by: Brice Figureau <brice-puppet@daysofwonder.com>
* Removed extra whitespace from end of linesIan Taylor2009-06-063-4/+4
|
* JRuby OpenSSL implementation is more strict than real ruby one andJames Turnbull2009-05-301-1/+1
| | | | requires certificate serial number to be strictly positive.
* Fixing #2028 - Better failures when a cert is found with no keyLuke Kanies2009-02-281-1/+14
| | | | | | | | | | | | | | | | | | The problem was that the server had a certificate for the client. Initially the client just didn't have a key, because it assumed that if it had a certificate then it had a key. Upon fixing it to create the key, the key then did not match the found certificate. This commit fixes both of those: The key is always found before the certificate, and when the certificate is found it's verified against the private key and an exception is thrown if they don't match. It's always a failure, so this just makes the failure more informative. Signed-off-by: Luke Kanies <luke@madstop.com>
* Resetting SSL cache terminii to nil when only using the caLuke Kanies2009-02-061-0/+8
| | | | | | | | This is important because puppetmasterd changes its configurations a couple of times, and we need to disable any previously-created caches. Signed-off-by: Luke Kanies <luke@madstop.com>
* Cleaning up SSL instances that can't be savedLuke Kanies2009-02-061-2/+13
| | | | | | | | | | | If the SSL Host couldn't save a CSR or key, it would still keep them in memory; this meant that, for instance, a CSR that couldn't be saved to the server was never resent. This commit removes in-memory instances that couldn't be saved, thus forcing regeneration. Signed-off-by: Luke Kanies <luke@madstop.com>
* Fixing #1729 - puppetmasterd can now read certs at startupLuke Kanies2008-12-181-20/+30
| | | | | | | | | | The main aspect of this solution is to create a site-wide Puppet::SSL::Host instance to cache ssl key and certificate, so that by the time we've switched UIDs, we've got the key and cert in memory. Then webrick just uses that, rather than creating a new Host instance. Signed-off-by: Luke Kanies <luke@madstop.com>
* Refactoring the Cacher interface to always require attribute declaration.Luke Kanies2008-11-111-2/+6
| | | | | | | | | | | | | | | Previously you could dynamically use cached values, but the new interface requires a single static declaration of the attribute: cached_attr(:myattr) { my_init_code() } This is cleaner, because it makes it easy to turn the code into an init method and generally makes the whole thing easier to think about. Most of this commit is going through the different classes that already using the Caching engine. Signed-off-by: Luke Kanies <luke@madstop.com>
* Retrieving the CA certificate before the client certificate.Luke Kanies2008-11-031-4/+10
| | | | | | | | | | | We have to have a CA cert first, because the host will start using the client cert as soon as it's available, but it's not functional without a CA cert. Also removing extra stupid stuff from wait_for_cert -- the connection is now always recycled, which is much simpler. Signed-off-by: Luke Kanies <luke@madstop.com>
* Handling the case where a symbol (e.g., :ca) is used for a certificate name.Luke Kanies2008-11-031-1/+1
| | | | Signed-off-by: Luke Kanies <luke@madstop.com>
* Fixing CertificateRequest#save to accept arguments.Luke Kanies2008-11-031-1/+1
| | | | | | This happens when called over REST. Signed-off-by: Luke Kanies <luke@madstop.com>
* Fixing the String format (fixes #1522).Luke Kanies2008-08-201-0/+11
| | | | | | | | | The string format no longer provides any support methods, which means that I had to create to_multiple_s and from_multiple_s methods on the SSL classes. I created them in the base class and tested them just in the cert class. Signed-off-by: Luke Kanies <luke@madstop.com>
* Fixing the SSL::Host#waitforcert method.Luke Kanies2008-08-071-10/+26
| | | | | | | It now works the way puppetd needs it to, rather than the way I thought it would need to work. Signed-off-by: Luke Kanies <luke@madstop.com>
* Certificates now work over REST.Luke Kanies2008-08-074-4/+30
| | | | | | | | | All of the format work is done, they all support plaintext successfully, and I've got integration tests that demonstrate that it actually works. Signed-off-by: Luke Kanies <luke@madstop.com>
* Caching the SSL store for the SSL Host.Luke Kanies2008-08-071-8/+11
| | | | | | | | | We were creating a new SSL store every time, which caused problems during testing -- it created an infinite loop when trying to create the store while looking up the CRL. Signed-off-by: Luke Kanies <luke@madstop.com>
* Making all certificates only support the plaintext format.Luke Kanies2008-08-044-0/+24
| | | | | | | None of them actually support yaml or marshal by default, and plaintext is easiest anyway. Signed-off-by: Luke Kanies <luke@madstop.com>
* Adding wait_for_cert functionality to the ssl host class.Luke Kanies2008-08-041-0/+19
| | | | | | This essentially deprecates the CertHandler module. Signed-off-by: Luke Kanies <luke@madstop.com>
* Fixing #1168 for REST -- all ssl classes downcase their names.Luke Kanies2008-06-152-2/+2
| | | | This is a much cleaner fix than the xmlrpc version, thankfully. :)
* Using the new Cacher class for handling cached data.Luke Kanies2008-05-131-5/+4
| | | | | This provides a single, global bit for determining whether a given piece of cached data is still valid.
* The CRL is now automatically used or ignored.Luke Kanies2008-05-072-10/+2
| | | | | | | | | Previously, you had to configure whether you wanted the CRL or not, which resulted in errors all the time when it was configured but unavailable. Now, Puppet will always create and try to use it, but you won't get failures if it's unavailable.
* The master and client now successfully speak xmlrpc using the new system.Luke Kanies2008-05-072-6/+17
| | | | | | The server is actually serving REST, but the client can't use it until we resolve the format and security issues that REST hasn't yet tackled.
* Adding autosigning to the new CA.Luke Kanies2008-05-062-23/+39
| | | | | Now the CSR class triggers autosigning when any CSR is saved, if it's running on a CA host.
* Moving the CA Interface class to a separate file.Luke Kanies2008-05-062-109/+144
|
* The Certificate Authority now automatically creates a CRL when appropriate.Luke Kanies2008-05-051-3/+6
| | | | This requires less setup and configuration on the part of the user.
* Fixing a critical problem in how CRLs were saved and moving SSL Store ↵Luke Kanies2008-05-052-1/+30
| | | | | | | | | | | | | | responsibilities to the SSL::Host class. I was previously saving invalid CRLs unless they'd had a revocation done in them; this commit fixes them so that they're always valid. Also, I've added to SSL::Host the ability to generate a valid SSL Store, suitable for validation. This is now used by Webrick and can be used by the http clients, too. This should have been two commits, but I'm kind of down the rabbit hole ATM.
* The SSL::Host class now uses the CA to generate its certificate when ↵Luke Kanies2008-05-051-3/+8
| | | | | | | | appropriate. It uses the CA singleton method to determine whether it's on valid CA host, and if so, uses the CA instance to sign its generated CSR.
* The CA now initializes itself.Luke Kanies2008-05-051-2/+23
| | | | | | | I realized that it never made sense to have a CA that didn't know how to initialize itself, so we now have a singleton method for the CA, and it also automatically initializes itself.
* I think I've now got the Webrick SSL support working.Luke Kanies2008-04-281-1/+2
| | | | | Now I just need to get xmlrpc working alongside REST in both mongrel and webrick.
* Interim commit, since I want to work but have no network available.Luke Kanies2008-04-281-2/+12
|
* Renaming the 'ca_file' ssl terminus type to 'ca'.Luke Kanies2008-04-211-1/+1
|
* Fixing how the CRL is used for certificate verification.Luke Kanies2008-04-191-1/+1
| | | | | | | | The CRL was not correctly being added to the Store used for verification. It does not appear to be working, though, since revoked certificates still pass verification.
* Added an Interface class to the CA to model puppetca's usage.Luke Kanies2008-04-192-0/+122
| | | | | | | | | | This class provides all of the semantics from puppetca, and appears to entirely duplicate the behaviour of the existing executable, with basically all of the code in a library file, instead of the executable. As such, I've deleted the test for the executable. We should have one, but it's not nearly as important.
* Making the SSL::Host's destroy method a class method,Luke Kanies2008-04-191-7/+10
| | | | rather than an instance method.
* Adding the last functionality needed for puppetca to use the Indirector.Luke Kanies2008-04-191-0/+14
| | | | | | | This commit adds 'list' and 'print' support to the CA. They're mostly delegator methods, but now the CA should be the sole interface for puppetca.
* Finishing the interface between the CA and the CRL.Luke Kanies2008-04-194-50/+128
| | | | | | Certificate revocation now works, the CA knows how to generate the CRL, and the SSL::Host class knows how to configure the CRL class for indirection.
* Adding inventory support to the new certificate authority.Luke Kanies2008-04-182-2/+10
| | | | | The new-style CA now keeps track of all of its signed certificates in its inventory file.
generated by cgit (git 2.34.1) at 2025-09-25 18:28:16 +0000