Class: Puppet::SSL::Base

Inherits:
Object show all
Defined in:
lib/puppet/ssl/base.rb

Overview

The base class for wrapping SSL instances.

Constant Summary collapse

SEPARATOR =

For now, use the YAML separator.

"\n---\n"
VALID_CERTNAME =

Only allow printing ascii characters, excluding /

/\A[ -.0-~]+\Z/

Instance Attribute Summary collapse

Class Method Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(name) ⇒ Base

Returns a new instance of Base.



46
47
48
49
 
# File 'lib/puppet/ssl/base.rb', line 46

def initialize(name)
  @name = name.to_s.downcase
  self.class.validate_certname(@name)
end

Instance Attribute Details

#content ⇒ Object

Returns the value of attribute content.



35
36
37
 
# File 'lib/puppet/ssl/base.rb', line 35

def content
  @content
end

#name ⇒ Object

Returns the value of attribute name.



35
36
37
 
# File 'lib/puppet/ssl/base.rb', line 35

def name
  @name
end

Class Method Details

.from_instance(instance, name = nil) ⇒ Object

Create an instance of our Puppet::SSL::* class using a given instance of the wrapped class

Raises:

  • (ArgumentError) 


66
67
68
69
70
71
72
73
74
 
# File 'lib/puppet/ssl/base.rb', line 66

def self.from_instance(instance, name = nil)
  raise ArgumentError, "Object must be an instance of #{wrapped_class}, #{instance.class} given" unless instance.is_a? wrapped_class
  raise ArgumentError, "Name must be supplied if it cannot be determined from the instance" if name.nil? and !instance.respond_to?(:subject)

  name ||= name_from_subject(instance.subject)
  result = new(name)
  result.content = instance
  result
end

.from_multiple_s(text) ⇒ Object 



14
15
16
 
# File 'lib/puppet/ssl/base.rb', line 14

def self.from_multiple_s(text)
  text.split(SEPARATOR).collect { |inst| from_s(inst) }
end

.from_s(string, name = nil) ⇒ Object

Convert a string into an instance



77
78
79
80
 
# File 'lib/puppet/ssl/base.rb', line 77

def self.from_s(string, name = nil)
  instance = wrapped_class.new(string)
  from_instance(instance, name)
end

.name_from_subject(subject) ⇒ String

This method is part of a private API. You should avoid using this method if possible, as it may be removed or be changed in the future.

name_from_subject extracts the common name attribute from the subject of an x.509 certificate certificate

Parameters:

  • subject (OpenSSL::X509::Name) —

    The full subject (distinguished name) of the x.509 certificate.

Returns:

  • (String) —

    the name (CN) extracted from the subject.



61
62
63
 
# File 'lib/puppet/ssl/base.rb', line 61

def self.name_from_subject(subject)
  Puppet::Util::SSL.cn_from_subject(subject)
end

.to_multiple_s(instances) ⇒ Object 



18
19
20
 
# File 'lib/puppet/ssl/base.rb', line 18

def self.to_multiple_s(instances)
  instances.collect { |inst| inst.to_s }.join(SEPARATOR)
end

.validate_certname(name) ⇒ Object 



31
32
33
 
# File 'lib/puppet/ssl/base.rb', line 31

def self.validate_certname(name)
  raise _("Certname %{name} must not contain unprintable or non-ASCII characters") % { name: name.inspect } unless name =~ VALID_CERTNAME
end

.wrapped_class ⇒ Object

Raises:



26
27
28
29
 
# File 'lib/puppet/ssl/base.rb', line 26

def self.wrapped_class
  raise(Puppet::DevError, "#{self} has not declared what class it wraps") unless defined?(@wrapped_class)
  @wrapped_class
end

.wraps(klass) ⇒ Object 



22
23
24
 
# File 'lib/puppet/ssl/base.rb', line 22

def self.wraps(klass)
  @wrapped_class = klass
end

Instance Method Details

#ca? ⇒ Boolean

Is this file for the CA?

Returns:

  • (Boolean) 


38
39
40
 
# File 'lib/puppet/ssl/base.rb', line 38

def ca?
  name == Puppet::SSL::Host.ca_name
end

#digest(algorithm = nil) ⇒ Object 



121
122
123
124
125
126
127
 
# File 'lib/puppet/ssl/base.rb', line 121

def digest(algorithm=nil)
  unless algorithm
    algorithm = digest_algorithm
  end

  Puppet::SSL::Digest.new(algorithm, content.to_der)
end

#digest_algorithm ⇒ Object 



129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
 
# File 'lib/puppet/ssl/base.rb', line 129

def digest_algorithm
  # The signature_algorithm on the X509 cert is a combination of the digest
  # algorithm and the encryption algorithm
  # e.g. md5WithRSAEncryption, sha256WithRSAEncryption
  # Unfortunately there isn't a consistent pattern
  # See RFCs 3279, 5758
  digest_re = Regexp.union(
    /ripemd160/i,
    /md[245]/i,
    /sha\d*/i
  )
  ln = content.signature_algorithm
  if match = digest_re.match(ln)
    match[0].downcase
  else
    raise Puppet::Error, _("Unknown signature algorithm '%{ln}'") % { ln: ln }
  end
end

#fingerprint(md = :SHA256) ⇒ Object 



116
117
118
119
 
# File 'lib/puppet/ssl/base.rb', line 116

def fingerprint(md = :SHA256)
  mds = md.to_s.upcase
  digest(mds).to_hex
end

#generate ⇒ Object

Raises:



42
43
44
 
# File 'lib/puppet/ssl/base.rb', line 42

def generate
  raise Puppet::DevError, "#{self.class} did not override 'generate'"
end

#read(path) ⇒ Object

Read content from disk appropriately.



83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
 
# File 'lib/puppet/ssl/base.rb', line 83

def read(path)
  # applies to Puppet::SSL::Certificate, Puppet::SSL::CertificateRequest, Puppet::SSL::CertificateRevocationList
  # Puppet::SSL::Key uses this, but also provides its own override
  # nothing derives from Puppet::SSL::Certificate, but it is called by a number of other SSL Indirectors:
  # Puppet::SSL::Certificate::DisabledCa (:find, :save, :destroy)
  # Puppet::Indirector::CertificateStatus::File (.indirection.find)
  # Puppet::Network::HTTP::WEBrick (.indirection.find)
  # Puppet::Network::HTTP::RackREST (.from_instance)
  # Puppet::Network::HTTP::WEBrickREST (.from_instance)
  # Puppet::SSL::CertificateAuthority (.new, .indirection.find, .indirection.save)
  # Puppet::SSL::Host (.indirection.find)
  # Puppet::SSL::Inventory (.indirection.search, implements its own add / rebuild / serials with encoding UTF8)
  # Puppet::SSL::CertificateAuthority::Interface (.indirection.find)
  # Puppet::SSL::Validator::DefaultValidator (.from_instance) / Puppet::SSL::Validator::NoValidator does nothing
  @content = wrapped_class.new(Puppet::FileSystem.read(path, :encoding => Encoding::ASCII))
end

#to_data_hash ⇒ Object 



106
107
108
 
# File 'lib/puppet/ssl/base.rb', line 106

def to_data_hash
  to_s
end

#to_s ⇒ Object

Convert our thing to pem.



101
102
103
104
 
# File 'lib/puppet/ssl/base.rb', line 101

def to_s
  return "" unless content
  content.to_pem
end

#to_text ⇒ Object

Provide the full text of the thing we’re dealing with.



111
112
113
114
 
# File 'lib/puppet/ssl/base.rb', line 111

def to_text
  return "" unless content
  content.to_text
end