summaryrefslogtreecommitdiffstats
path: root/lib
Commit message (Collapse)AuthorAgeFilesLines
...
* | Adding pidfile management and daemonization to the ServerLuke Kanies2008-05-071-0/+56
| | | | | | | | class.
* | Fixing the HttpPool module to get rid of an infinite loop.Luke Kanies2008-05-063-3/+4
| | | | | | | | | | | | | | | | | | We can't have the HttpPool class use the Indirector to see if it has a cert available, because it might be being used to try to download one, which would cause it to make an http instance, which would cause it to... Well, you get the idea. Adding and fixing a few other tests I ran into on the way.
* | Adding REST terminuses for the SSL-related indirections.Luke Kanies2008-05-063-0/+18
| |
* | Adding autosigning to the new CA.Luke Kanies2008-05-062-23/+39
| | | | | | | | | | Now the CSR class triggers autosigning when any CSR is saved, if it's running on a CA host.
* | Moving the CA Interface class to a separate file.Luke Kanies2008-05-062-109/+144
| |
* | The master is now functionally serving REST and xmlrpc.Luke Kanies2008-05-051-1/+1
| | | | | | | | | | | | | | | | | | | | ...as far as I can tell. The client, however, is broken, since it used the old http_pool/ssl_support stuff, which no longer works. I have to port puppetd over to using the new ssl stuff, then I'll at least be able to verify that the master can still speak xmlrpc.
* | The REST infrastructure now correctly the SSL certificates.Luke Kanies2008-05-053-13/+10
| | | | | | | | | | | | | | I don't think the whole thing is done, but at least the basic flows are in place. Now it's just a question of doing real-world tests and fleshing out the unit tests as necessary.
* | The Certificate Authority now automatically creates a CRL when appropriate.Luke Kanies2008-05-051-3/+6
| | | | | | | | This requires less setup and configuration on the part of the user.
* | The Settings class now clears the 'used' sections when a value is changed.Luke Kanies2008-05-051-1/+3
| | | | | | | | | | | | | | | | | | This makes is so that if you, for instance, reset the vardir, then the next time an initialization call is made, we reuse any previously used sections, thus (hopefully) correctly creating any newly needed directories. This is mostly helpful during testing.
* | Moving some http configuration values to the mainLuke Kanies2008-05-051-14/+14
| | | | | | | | defaults section, rather than the puppetd section.
* | The http pool manager now uses new-style certificate management.Luke Kanies2008-05-051-11/+15
| | | | | | | | | | It uses an instance of SSL::Host for getting its certificate and ssl store.
* | Fixing a critical problem in how CRLs were saved and moving SSL Store ↵Luke Kanies2008-05-053-17/+32
| | | | | | | | | | | | | | | | | | | | | | | | | | | | responsibilities to the SSL::Host class. I was previously saving invalid CRLs unless they'd had a revocation done in them; this commit fixes them so that they're always valid. Also, I've added to SSL::Host the ability to generate a valid SSL Store, suitable for validation. This is now used by Webrick and can be used by the http clients, too. This should have been two commits, but I'm kind of down the rabbit hole ATM.
* | The SSL::Host class now uses the CA to generate its certificate when ↵Luke Kanies2008-05-051-3/+8
| | | | | | | | | | | | | | | | appropriate. It uses the CA singleton method to determine whether it's on valid CA host, and if so, uses the CA instance to sign its generated CSR.
* | The CA now initializes itself.Luke Kanies2008-05-051-2/+23
| | | | | | | | | | | | | | I realized that it never made sense to have a CA that didn't know how to initialize itself, so we now have a singleton method for the CA, and it also automatically initializes itself.
* | Switched puppetmasterd to use the new-style server plumbing.Luke Kanies2008-05-022-2/+11
| | | | | | | | | | | | | | | | The code is much cleaner, and it seems to be mostly functional, but we have to pick a strategy for signing the host's certificate on first startup. Also, I haven't actually done end-to-end testing yet, which needs the certs working first.
* | Adding xmlrpc backward compatibility to the new Mongrel code.Luke Kanies2008-05-021-0/+10
| |
* | Adding xmlrpc support to webrick.Luke Kanies2008-05-022-3/+20
| | | | | | | | | | This provides the backward compatibility for webrick, and only Mongrel is left.
* | Fixing some whitespaceLuke Kanies2008-05-021-4/+3
| |
* | Adding configuration support for XMLRPC handlers.Luke Kanies2008-05-021-7/+37
| | | | | | | | | | | | | | | | | | This provides the interface for configuring backward compatibility in the new-style server code. It requires a completely different configuration step, in that REST and xmlrpc handlers are configured separately, rather than using the same handler names, but this was considered less evil than having a large abstraction layer for specifying how the handlers are related.
* | I think I've now got the Webrick SSL support working.Luke Kanies2008-04-284-5/+20
| | | | | | | | | | Now I just need to get xmlrpc working alongside REST in both mongrel and webrick.
* | Interim commit, since I want to work but have no network available.Luke Kanies2008-04-282-18/+35
| |
* | Merge branch '0.24.x'Luke Kanies2008-04-216-8/+35
|\| | | | | | | | | | | Conflicts: bin/puppetca
| * Pushed patch for #1176 - configtimeout fixJames Turnbull2008-04-192-3/+4
| |
| * Pushed patch for ticket #1191 - adding globbing support to ports providerJames Turnbull2008-04-191-1/+6
| |
| * Pushed patch for ticket #1187 - freebsd pkg_add supportJames Turnbull2008-04-191-4/+15
| |
| * Pushed schema patch for #1193James Turnbull2008-04-172-0/+10
| |
* | Changing the File certificate terminus so that itLuke Kanies2008-04-211-1/+1
| | | | | | | | | | | | | | saves to the :localcacert instead of :cacert. This way the :ca terminus saves to :cacert and the :file terminus saves to :localcacert.
* | Renaming the 'ca_file' ssl terminus type to 'ca'.Luke Kanies2008-04-215-6/+6
| |
* | Fixing how the CRL is used for certificate verification.Luke Kanies2008-04-191-1/+1
| | | | | | | | | | | | | | | | The CRL was not correctly being added to the Store used for verification. It does not appear to be working, though, since revoked certificates still pass verification.
* | Added an Interface class to the CA to model puppetca's usage.Luke Kanies2008-04-192-0/+122
| | | | | | | | | | | | | | | | | | | | This class provides all of the semantics from puppetca, and appears to entirely duplicate the behaviour of the existing executable, with basically all of the code in a library file, instead of the executable. As such, I've deleted the test for the executable. We should have one, but it's not nearly as important.
* | Making the SSL::Host's destroy method a class method,Luke Kanies2008-04-191-7/+10
| | | | | | | | rather than an instance method.
* | Adding the last functionality needed for puppetca to use the Indirector.Luke Kanies2008-04-191-0/+14
| | | | | | | | | | | | | | This commit adds 'list' and 'print' support to the CA. They're mostly delegator methods, but now the CA should be the sole interface for puppetca.
* | Finishing the interface between the CA and the CRL.Luke Kanies2008-04-194-50/+128
| | | | | | | | | | | | Certificate revocation now works, the CA knows how to generate the CRL, and the SSL::Host class knows how to configure the CRL class for indirection.
* | Adding inventory support to the new certificate authority.Luke Kanies2008-04-182-2/+10
| | | | | | | | | | The new-style CA now keeps track of all of its signed certificates in its inventory file.
* | Adding support within the inventory for real certs or Puppet cert wrappers.Luke Kanies2008-04-181-0/+2
| |
* | Changing the Inventory class to rebuild when theLuke Kanies2008-04-181-2/+3
| | | | | | | | first cert is added, so it's easier to test.
* | Adding a comment to the inventory class.Luke Kanies2008-04-181-1/+1
| |
* | Adding an SSl::Inventory class for managing the ssl inventory.Luke Kanies2008-04-181-0/+38
| | | | | | | | | | This models the existing Inventory module in the sslcertificates/ directory, but does so as an instance, rather than a module.
* | All SSL terminus classes now force the CA information into the right place.Luke Kanies2008-04-182-0/+2
| | | | | | | | | | | | | | | | | | Without this, then you could end up duplicating your CA key into the normal directory depending on how caching was set up. Again, this design aspect isn't the most straightforward, but at least it's functional now.
* | Switching the SSL::Host class to return Puppet instances.Luke Kanies2008-04-173-13/+14
| | | | | | | | | | | | | | | | | | Previously, the class was returning OpenSSL instances (e.g, OpenSSL::X509::Certificate) instead of Puppet instances (e.g., Puppet::SSL::Certificate). This made some things easier, but it made them asymmetric (e.g., you assigned the key as a Puppet instance but got back an OpenSSL instance), and it also reduced your flexibility and introspectiveness.
* | Setting the expiration date of certificate objects to the expiry of the actualLuke Kanies2008-04-171-0/+5
| | | | | | | | cert.
* | Adding integration tests for a lot of the SSL code.Luke Kanies2008-04-174-5/+6
| | | | | | | | | | This flushed out some problems, and things mostly look good now, but I don't think we're quite there yet.
* | Moving the password file handling into the SSL::Key class.Luke Kanies2008-04-174-15/+21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This was necessary because when the Indirector is used, there isn't necessarily enough context available to know when a password file should be used (e.g., when reading a Key from disk, you don't know if that key was encrypted). Now, the Key class automatically uses the right password file, and only tries to use those files that actually exist. This isn't very flexible, in that it only allows one CA file and one non-CA file, but no one really uses anything but the CA file anyway.
* | Moving all of the ca-specific settings to the ca_fileLuke Kanies2008-04-174-2/+21
| | | | | | | | | | | | | | | | terminus classes, rather than the normal :file classes. This is unfortunately complicated, and it means that the Key :ca_file is only ever actually used for retrieving the CA key itself.
* | Adding SSL::Host-level support for managing the terminus andLuke Kanies2008-04-176-21/+66
| | | | | | | | | | cache classes. Also, defaulting to the :file terminus for all of the SSL classes.
* | Fixing the CA so it actually automatically generates its certificate.Luke Kanies2008-04-171-7/+8
| |
* | The certificate authority now uses a Host instance named 'ca'.Luke Kanies2008-04-171-65/+26
| | | | | | | | | | | | It previously was a subclass of Host, but this should make it easier to separate between the thing doing the signing and the thing managing the necessary files.
* | Changing all of the SSL terminus classes to treat CA files specially.Luke Kanies2008-04-178-53/+139
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is a kind of weird design situation. For instance, we've got a collection of certificates in the :certdir, but then there's a special CA certificate off by itself. Rather than build a whole separate infrastructure for managing those separate files (cert and key, at least), I decided to add special support for specifying where to find the CA-specific bits, and then code for handling them when necessary. This requires that we have a standard way of knowing whether we should be managing the CA bits or normal host files. The Puppet::SSL::Host class now has a 'ca_name' method that returns the string we're using for the CA name; this name is currently 'ca'. We have to use a name, because the name is the only thing that all methods have access to (e.g., when trying to 'find' the right cert, we only have the name available). What this means is that if you want access to the CA key or cert, then create a Puppet::SSL::Host instance with the name 'ca'. You'll still get the CA cert created with the host's :certname; it will just be stored in a different location.
* | The 'destroy' method for the ssl_file terminus base classLuke Kanies2008-04-161-1/+1
| | | | | | | | now returns false on missing files, rather than failing.
* | Removing all the cases where the ssl host specifiesLuke Kanies2008-04-161-70/+18
| | | | | | | | | | a terminus. Also, getting rid of some metaprogramming that wasn't really helping.
generated by cgit (git 2.34.1) at 2025-09-29 15:27:17 +0000