Class: Puppet::SSL::StateMachine::NeedCRLs Private

Inherits:
SSLState show all
Defined in:
lib/puppet/ssl/state_machine.rb

Overview

This class is part of a private API. You should avoid using this class if possible, as it may be removed or be changed in the future.

If revocation is enabled, load CRLs or download them, using the CA bundle from the previous state. Transition to NeedKey. Even if Puppet is leaf or chain, disable revocation when downloading the CRL, since 1) we may not have one yet or 2) the connection will fail if NeedCACerts downloaded a new CA for which we don’t have a CRL

Instance Attribute Summary collapse

Attributes inherited from SSLState

#ssl_context

Instance Method Summary collapse

Methods inherited from SSLState

#log_error, #to_error

Constructor Details

#initialize(machine, ssl_context, force_crl_refresh = false) ⇒ NeedCRLs

This method is part of a private API. You should avoid using this method if possible, as it may be removed or be changed in the future.

Returns a new instance of NeedCRLs.



160
161
162
163
 
# File 'lib/puppet/ssl/state_machine.rb', line 160

def initialize(machine, ssl_context, force_crl_refresh = false)
  super(machine, ssl_context)
  @force_crl_refresh = force_crl_refresh
end

Instance Attribute Details

#force_crl_refresh ⇒ Object (readonly)

This method is part of a private API. You should avoid using this method if possible, as it may be removed or be changed in the future. 



158
159
160
 
# File 'lib/puppet/ssl/state_machine.rb', line 158

def force_crl_refresh
  @force_crl_refresh
end

Instance Method Details

#next_state ⇒ Object

This method is part of a private API. You should avoid using this method if possible, as it may be removed or be changed in the future. 



165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
 
# File 'lib/puppet/ssl/state_machine.rb', line 165

def next_state
  Puppet.debug("Loading CRLs")

  case Puppet[:certificate_revocation]
  when :chain, :leaf
    crls = @cert_provider.load_crls
    if crls
      next_ctx = @ssl_provider.create_root_context(cacerts: ssl_context[:cacerts], crls: crls)

      now = Time.now
      last_update = @cert_provider.crl_last_update
      if needs_refresh?(now, last_update)
        next_ctx = refresh_crl(next_ctx, last_update)
      end
    else
      next_ctx = download_crl(@ssl_context, nil)
    end
  else
    Puppet.info("Certificate revocation is disabled, skipping CRL download")
    next_ctx = @ssl_provider.create_root_context(cacerts: ssl_context[:cacerts], crls: [])
  end

  NeedKey.new(@machine, next_ctx)
rescue OpenSSL::X509::CRLError => e
  Error.new(@machine, e.message, e)
rescue Puppet::HTTP::ResponseError => e
  if e.response.code == 404
    to_error(_('CRL is missing from the server'), e)
  else
    to_error(_('Could not download CRLs: %{message}') % { message: e.message }, e)
  end
end