summaryrefslogtreecommitdiffstats
path: root/spec/unit/ssl
Commit message (Collapse)AuthorAgeFilesLines
...
* Fixing #1557 - Environments are now in REST URIsLuke Kanies2009-03-202-8/+0
| | | | | | | | | | | | | | | | | | This commit includes multiple, related changes, all in one commit because the whole thing was necessary to reach a functional tree again: * The URI starts with the environment, so: /production/certificate/foo /development/file_content/path/to/your/file * All REST handling is done by a single instance mounted at / for webrick and Mongrel, rather than having individual instances mounted at, say, /certificate. * All REST URI translation is done by an API module. Currently only the 'v1' module exists with no support for additional modules, but it's well-separated and will be easy to expand as we need it. Signed-off-by: Luke Kanies <luke@madstop.com>
* Fixing #2028 - Better failures when a cert is found with no keyLuke Kanies2009-02-281-1/+77
| | | | | | | | | | | | | | | | | | The problem was that the server had a certificate for the client. Initially the client just didn't have a key, because it assumed that if it had a certificate then it had a key. Upon fixing it to create the key, the key then did not match the found certificate. This commit fixes both of those: The key is always found before the certificate, and when the certificate is found it's verified against the private key and an exception is thrown if they don't match. It's always a failure, so this just makes the failure more informative. Signed-off-by: Luke Kanies <luke@madstop.com>
* Removing a test that was too dependant on order.Luke Kanies2009-02-141-4/+0
| | | | | | | It wasn't a terribly useful test anyway, since no one depends on that individual configuration. Signed-off-by: Luke Kanies <luke@madstop.com>
* Resetting SSL cache terminii to nil when only using the caLuke Kanies2009-02-061-0/+8
| | | | | | | | This is important because puppetmasterd changes its configurations a couple of times, and we need to disable any previously-created caches. Signed-off-by: Luke Kanies <luke@madstop.com>
* Cleaning up SSL instances that can't be savedLuke Kanies2009-02-061-0/+23
| | | | | | | | | | | If the SSL Host couldn't save a CSR or key, it would still keep them in memory; this meant that, for instance, a CSR that couldn't be saved to the server was never resent. This commit removes in-memory instances that couldn't be saved, thus forcing regeneration. Signed-off-by: Luke Kanies <luke@madstop.com>
* Fixing #1729 - puppetmasterd can now read certs at startupLuke Kanies2008-12-181-0/+64
| | | | | | | | | | The main aspect of this solution is to create a site-wide Puppet::SSL::Host instance to cache ssl key and certificate, so that by the time we've switched UIDs, we've got the key and cert in memory. Then webrick just uses that, rather than creating a new Host instance. Signed-off-by: Luke Kanies <luke@madstop.com>
* Merge branch '0.24.x'Luke Kanies2008-12-021-1/+2
| | | | | | | | | | | | | | | | | | | | Conflicts: bin/puppetca lib/puppet/type/group.rb lib/puppet/type/tidy.rb lib/puppet/util/settings.rb Also edited the following files so tests will pass: lib/puppet/type/component.rb spec/unit/ssl/certificate_request.rb spec/unit/type/computer.rb spec/unit/type/mcx.rb spec/unit/type/resources.rb spec/unit/util/settings.rb spec/unit/util/storage.rb test/ral/type/zone.rb
* Changing the Cacher.invalidate method to Cacher.expire.Luke Kanies2008-11-111-1/+1
| | | | Signed-off-by: Luke Kanies <luke@madstop.com>
* Retrieving the CA certificate before the client certificate.Luke Kanies2008-11-031-8/+27
| | | | | | | | | | | We have to have a CA cert first, because the host will start using the client cert as soon as it's available, but it's not functional without a CA cert. Also removing extra stupid stuff from wait_for_cert -- the connection is now always recycled, which is much simpler. Signed-off-by: Luke Kanies <luke@madstop.com>
* Handling the case where a symbol (e.g., :ca) is used for a certificate name.Luke Kanies2008-11-031-2/+2
| | | | Signed-off-by: Luke Kanies <luke@madstop.com>
* Fixing CertificateRequest#save to accept arguments.Luke Kanies2008-11-031-0/+7
| | | | | | This happens when called over REST. Signed-off-by: Luke Kanies <luke@madstop.com>
* Fixing the String format (fixes #1522).Luke Kanies2008-08-201-10/+34
| | | | | | | | | The string format no longer provides any support methods, which means that I had to create to_multiple_s and from_multiple_s methods on the SSL classes. I created them in the base class and tested them just in the cert class. Signed-off-by: Luke Kanies <luke@madstop.com>
* Fixing the SSL::Host#waitforcert method.Luke Kanies2008-08-071-13/+37
| | | | | | | It now works the way puppetd needs it to, rather than the way I thought it would need to work. Signed-off-by: Luke Kanies <luke@madstop.com>
* Certificates now work over REST.Luke Kanies2008-08-074-3/+53
| | | | | | | | | All of the format work is done, they all support plaintext successfully, and I've got integration tests that demonstrate that it actually works. Signed-off-by: Luke Kanies <luke@madstop.com>
* Caching the SSL store for the SSL Host.Luke Kanies2008-08-071-1/+1
| | | | | | | | | We were creating a new SSL store every time, which caused problems during testing -- it created an infinite loop when trying to create the store while looking up the CRL. Signed-off-by: Luke Kanies <luke@madstop.com>
* Making all certificates only support the plaintext format.Luke Kanies2008-08-044-0/+16
| | | | | | | None of them actually support yaml or marshal by default, and plaintext is easiest anyway. Signed-off-by: Luke Kanies <luke@madstop.com>
* Adding wait_for_cert functionality to the ssl host class.Luke Kanies2008-08-041-0/+42
| | | | | | This essentially deprecates the CertHandler module. Signed-off-by: Luke Kanies <luke@madstop.com>
* Fixing #1168 for REST -- all ssl classes downcase their names.Luke Kanies2008-06-154-0/+21
| | | | This is a much cleaner fix than the xmlrpc version, thankfully. :)
* Fixing #1256 -- CA tests now work with no ~/.puppet.Luke Kanies2008-05-251-21/+18
| | | | | I've set the default cadir and vardir to /dev/null, to hopefully catch this kind of test sooner next time.
* Fixing another failing test -- the new CA tests correctly clear the cache.Luke Kanies2008-05-251-1/+2
| | | | | I was previously not clearing the cache using the Cacher.invalidate method, which caused a test to fail.
* The CRL is now automatically used or ignored.Luke Kanies2008-05-072-49/+19
| | | | | | | | | Previously, you had to configure whether you wanted the CRL or not, which resulted in errors all the time when it was configured but unavailable. Now, Puppet will always create and try to use it, but you won't get failures if it's unavailable.
* The master and client now successfully speak xmlrpc using the new system.Luke Kanies2008-05-071-1/+1
| | | | | | The server is actually serving REST, but the client can't use it until we resolve the format and security issues that REST hasn't yet tackled.
* Adding autosigning to the new CA.Luke Kanies2008-05-062-10/+103
| | | | | Now the CSR class triggers autosigning when any CSR is saved, if it's running on a CA host.
* Moving the CA Interface class to a separate file.Luke Kanies2008-05-062-255/+270
|
* The Certificate Authority now automatically creates a CRL when appropriate.Luke Kanies2008-05-051-15/+40
| | | | This requires less setup and configuration on the part of the user.
* Fixing a critical problem in how CRLs were saved and moving SSL Store ↵Luke Kanies2008-05-052-6/+85
| | | | | | | | | | | | | | responsibilities to the SSL::Host class. I was previously saving invalid CRLs unless they'd had a revocation done in them; this commit fixes them so that they're always valid. Also, I've added to SSL::Host the ability to generate a valid SSL Store, suitable for validation. This is now used by Webrick and can be used by the http clients, too. This should have been two commits, but I'm kind of down the rabbit hole ATM.
* The SSL::Host class now uses the CA to generate its certificate when ↵Luke Kanies2008-05-051-3/+24
| | | | | | | | appropriate. It uses the CA singleton method to determine whether it's on valid CA host, and if so, uses the CA instance to sign its generated CSR.
* The CA now initializes itself.Luke Kanies2008-05-051-11/+78
| | | | | | | I realized that it never made sense to have a CA that didn't know how to initialize itself, so we now have a singleton method for the CA, and it also automatically initializes itself.
* I think I've now got the Webrick SSL support working.Luke Kanies2008-04-281-5/+6
| | | | | Now I just need to get xmlrpc working alongside REST in both mongrel and webrick.
* Interim commit, since I want to work but have no network available.Luke Kanies2008-04-281-0/+45
|
* Renaming the 'ca_file' ssl terminus type to 'ca'.Luke Kanies2008-04-211-4/+4
|
* Fixing how the CRL is used for certificate verification.Luke Kanies2008-04-191-2/+2
| | | | | | | | The CRL was not correctly being added to the Store used for verification. It does not appear to be working, though, since revoked certificates still pass verification.
* Added an Interface class to the CA to model puppetca's usage.Luke Kanies2008-04-192-3/+285
| | | | | | | | | | This class provides all of the semantics from puppetca, and appears to entirely duplicate the behaviour of the existing executable, with basically all of the code in a library file, instead of the executable. As such, I've deleted the test for the executable. We should have one, but it's not nearly as important.
* Making the SSL::Host's destroy method a class method,Luke Kanies2008-04-191-16/+30
| | | | rather than an instance method.
* Adding the last functionality needed for puppetca to use the Indirector.Luke Kanies2008-04-191-0/+20
| | | | | | | This commit adds 'list' and 'print' support to the CA. They're mostly delegator methods, but now the CA should be the sole interface for puppetca.
* Finishing the interface between the CA and the CRL.Luke Kanies2008-04-194-27/+262
| | | | | | Certificate revocation now works, the CA knows how to generate the CRL, and the SSL::Host class knows how to configure the CRL class for indirection.
* Adding inventory support to the new certificate authority.Luke Kanies2008-04-182-3/+22
| | | | | The new-style CA now keeps track of all of its signed certificates in its inventory file.
* Adding support within the inventory for real certs or Puppet cert wrappers.Luke Kanies2008-04-181-0/+12
|
* Changing the Inventory class to rebuild when theLuke Kanies2008-04-181-40/+45
| | | | first cert is added, so it's easier to test.
* Adding an SSl::Inventory class for managing the ssl inventory.Luke Kanies2008-04-181-0/+136
| | | | | This models the existing Inventory module in the sslcertificates/ directory, but does so as an instance, rather than a module.
* Switching the SSL::Host class to return Puppet instances.Luke Kanies2008-04-173-27/+37
| | | | | | | | | Previously, the class was returning OpenSSL instances (e.g, OpenSSL::X509::Certificate) instead of Puppet instances (e.g., Puppet::SSL::Certificate). This made some things easier, but it made them asymmetric (e.g., you assigned the key as a Puppet instance but got back an OpenSSL instance), and it also reduced your flexibility and introspectiveness.
* Setting the expiration date of certificate objects to the expiry of the actualLuke Kanies2008-04-171-0/+15
| | | | cert.
* Adding integration tests for a lot of the SSL code.Luke Kanies2008-04-172-5/+5
| | | | | This flushed out some problems, and things mostly look good now, but I don't think we're quite there yet.
* Moving the password file handling into the SSL::Key class.Luke Kanies2008-04-173-32/+57
| | | | | | | | | | | | | | This was necessary because when the Indirector is used, there isn't necessarily enough context available to know when a password file should be used (e.g., when reading a Key from disk, you don't know if that key was encrypted). Now, the Key class automatically uses the right password file, and only tries to use those files that actually exist. This isn't very flexible, in that it only allows one CA file and one non-CA file, but no one really uses anything but the CA file anyway.
* Adding SSL::Host-level support for managing the terminus andLuke Kanies2008-04-175-7/+111
| | | | | cache classes. Also, defaulting to the :file terminus for all of the SSL classes.
* Fixing the CA so it actually automatically generates its certificate.Luke Kanies2008-04-171-12/+11
|
* The certificate authority now uses a Host instance named 'ca'.Luke Kanies2008-04-171-90/+57
| | | | | | It previously was a subclass of Host, but this should make it easier to separate between the thing doing the signing and the thing managing the necessary files.
* Changing all of the SSL terminus classes to treat CA files specially.Luke Kanies2008-04-172-88/+74
| | | | | | | | | | | | | | | | | | | | | | This is a kind of weird design situation. For instance, we've got a collection of certificates in the :certdir, but then there's a special CA certificate off by itself. Rather than build a whole separate infrastructure for managing those separate files (cert and key, at least), I decided to add special support for specifying where to find the CA-specific bits, and then code for handling them when necessary. This requires that we have a standard way of knowing whether we should be managing the CA bits or normal host files. The Puppet::SSL::Host class now has a 'ca_name' method that returns the string we're using for the CA name; this name is currently 'ca'. We have to use a name, because the name is the only thing that all methods have access to (e.g., when trying to 'find' the right cert, we only have the name available). What this means is that if you want access to the CA key or cert, then create a Puppet::SSL::Host instance with the name 'ca'. You'll still get the CA cert created with the host's :certname; it will just be stored in a different location.
* Marking a test as pending, because it's not ready yet.Luke Kanies2008-04-161-7/+7
|
* Removing all the cases where the ssl host specifiesLuke Kanies2008-04-161-128/+6
| | | | | a terminus. Also, getting rid of some metaprogramming that wasn't really helping.
generated by cgit (git 2.34.1) at 2025-09-02 08:28:52 +0000