Skip to content

Commit 5349728

Browse files
jcpunkjcpunk
committed
Permit client CA and infra CA to use UUID serial numbers
Fixes: #284 Signed-off-by: Pat Riehecky <riehecky@fnal.gov> Assisted-by: Claude <noreply@anthropic.com> Assisted-by: Qwen <noreply@litellm.ai> Signed-off-by: Pat Riehecky <riehecky@fnal.gov>
1 parent f129569 commit 5349728

8 files changed

Lines changed: 991 additions & 121 deletions

File tree

‎src/clj/puppetlabs/puppetserver/certificate_authority.clj‎

Lines changed: 222 additions & 84 deletions
Large diffs are not rendered by default.

‎test/integration/puppetlabs/puppetserver/bootstrap_testutils.clj‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -181,8 +181,8 @@
181181
:- (schema/pred ssl-simple/ssl-cert?)
182182
[ca-cert :- ca/Certificate
183183
certname :- schema/Str]
184-
(let [ca-private-key (ssl-utils/pem->private-key
185-
(str "./target/server-conf/ca/ca_key.pem"))
184+
(let [ca-private-key (ssl-utils/pem->private-key
185+
"./target/server-conf/ca/ca_key.pem")
186186
ca-dn (-> ca-cert
187187
(.getSubjectX500Principal)
188188
(.getName))

‎test/integration/puppetlabs/services/certificate_authority/certificate_authority_int_test.clj‎

Lines changed: 93 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1793,8 +1793,8 @@
17931793
ca-key (str bootstrap/server-conf-dir "/ca/ca_key.pem")
17941794
ca-crl (str bootstrap/server-conf-dir "/ca/ca_crl.pem")
17951795
ca-cert' (ssl-utils/pem->ca-cert ca-cert ca-key)
1796-
revoke-response (http-client/put
1797-
(str "https://localhost:8140/puppet-ca/v1/clean")
1796+
revoke-response (http-client/put
1797+
"https://localhost:8140/puppet-ca/v1/clean"
17981798
{:body (json/encode {:certnames [random-certname]})
17991799
:ssl-cert (str bootstrap/server-conf-dir "/ssl/certs/localhost.pem")
18001800
:ssl-key (str bootstrap/server-conf-dir "/ssl/private_keys/localhost.pem")
@@ -1939,8 +1939,94 @@
19391939
(merge request-opts
19401940
{:headers {"content-type" "application/json" "X-Authentication" "test"}}))]
19411941
(is (= 204 (:status response))))))
1942-
(testing "getting the cert returns a 404"
1943-
(let [response (http-client/get status-url
1944-
(merge request-opts
1945-
{:headers {"content-type" "application/json" "X-Authentication" "test"}}))]
1946-
(is (= 404 (:status response)))))))))))
1942+
(testing "getting the cert returns a 404"
1943+
(let [response (http-client/get status-url
1944+
(merge request-opts
1945+
{:headers {"content-type" "application/json" "X-Authentication" "test"}}))]
1946+
(is (= 404 (:status response)))))))))))
1947+
1948+
(deftest uuid-serial-certificate-signing-int-test
1949+
(testutils/with-stub-puppet-conf
1950+
(bootstrap/with-puppetserver-running-with-config
1951+
app
1952+
(bootstrap/load-dev-config-with-overrides
1953+
{:certificate-authority {:serial-type "uuid"}
1954+
:jruby-puppet
1955+
{:gem-path [(ks/absolute-path jruby-testutils/gem-path)]}
1956+
:webserver
1957+
{:ssl-cert (str bootstrap/server-conf-dir "/ssl/certs/localhost.pem")
1958+
:ssl-key (str bootstrap/server-conf-dir "/ssl/private_keys/localhost.pem")
1959+
:ssl-ca-cert (str bootstrap/server-conf-dir "/ca/ca_crt.pem")
1960+
:ssl-crl-path (str bootstrap/server-conf-dir "/ssl/crl.pem")}})
1961+
(let [request-dir (str bootstrap/server-conf-dir "/ca/requests")
1962+
key-pair (ssl-utils/generate-key-pair)
1963+
subjectDN (ssl-utils/cn "test-uuid-node")
1964+
csr (ssl-utils/generate-certificate-request key-pair subjectDN)
1965+
csr-file (ks/temp-file "test_uuid_csr.pem")
1966+
saved-csr (str request-dir "/test-uuid-node.pem")
1967+
url "https://localhost:8140/puppet-ca/v1/certificate_request/test-uuid-node"
1968+
request-opts {:ssl-cert (str bootstrap/server-conf-dir "/ca/ca_crt.pem")
1969+
:ssl-key (str bootstrap/server-conf-dir "/ca/ca_key.pem")
1970+
:ssl-ca-cert (str bootstrap/server-conf-dir "/ca/ca_crt.pem")
1971+
:as :text
1972+
:headers {"content-type" "text/plain"}}]
1973+
(ssl-utils/obj->pem! csr csr-file)
1974+
(http-client/put url (merge request-opts {:body (slurp csr-file)}))
1975+
(is (fs/exists? saved-csr))
1976+
(let [cert-pem (slurp saved-csr)
1977+
cert (ssl-utils/pem->cert cert-pem)
1978+
serial (.getSerialNumber cert)]
1979+
(is (instance? java.math.BigInteger serial)
1980+
"Serial should be BigInteger")
1981+
(is (> (.bitLength serial) 100)
1982+
"UUID serial should be at least 100+ bits"))
1983+
(fs/delete csr-file)))))
1984+
1985+
(deftest mixed-serial-modes-int-test
1986+
(testutils/with-stub-puppet-conf
1987+
(bootstrap/with-puppetserver-running-with-config
1988+
app
1989+
(bootstrap/load-dev-config-with-overrides
1990+
{:certificate-authority {:serial-type "incrementing"
1991+
:infra-serial-type "uuid"}
1992+
:jruby-puppet
1993+
{:gem-path [(ks/absolute-path jruby-testutils/gem-path)]}
1994+
:webserver
1995+
{:ssl-cert (str bootstrap/server-conf-dir "/ssl/certs/localhost.pem")
1996+
:ssl-key (str bootstrap/server-conf-dir "/ssl/private_keys/localhost.pem")
1997+
:ssl-ca-cert (str bootstrap/server-conf-dir "/ca/ca_crt.pem")
1998+
:ssl-crl-path (str bootstrap/server-conf-dir "/ssl/crl.pem")}})
1999+
(let [infra-nodes-path (str bootstrap/server-conf-dir "/ca/infra_inventory.txt")
2000+
regular-key (ssl-utils/generate-key-pair)
2001+
infra-key (ssl-utils/generate-key-pair)
2002+
regular-subject (ssl-utils/cn "regular-node")
2003+
infra-subject (ssl-utils/cn "infra-mom")
2004+
regular-csr (ssl-utils/generate-certificate-request regular-key regular-subject)
2005+
infra-csr (ssl-utils/generate-certificate-request infra-key infra-subject)
2006+
regular-csr-file (ks/temp-file "regular_csr.pem")
2007+
infra-csr-file (ks/temp-file "infra_csr.pem")
2008+
regular-url "https://localhost:8140/puppet-ca/v1/certificate_request/regular-node"
2009+
infra-url "https://localhost:8140/puppet-ca/v1/certificate_request/infra-mom"
2010+
request-opts {:ssl-cert (str bootstrap/server-conf-dir "/ca/ca_crt.pem")
2011+
:ssl-key (str bootstrap/server-conf-dir "/ca/ca_key.pem")
2012+
:ssl-ca-cert (str bootstrap/server-conf-dir "/ca/ca_crt.pem")
2013+
:as :text
2014+
:headers {"content-type" "text/plain"}}]
2015+
(ks-file/atomic-write-string infra-nodes-path (str infra-subject "\n") "rw-r--r--")
2016+
(ssl-utils/obj->pem! regular-csr regular-csr-file)
2017+
(ssl-utils/obj->pem! infra-csr infra-csr-file)
2018+
(http-client/put regular-url (merge request-opts {:body (slurp regular-csr-file)}))
2019+
(http-client/put infra-url (merge request-opts {:body (slurp infra-csr-file)}))
2020+
(let [regular-cert (ssl-utils/pem->cert (slurp regular-csr-file))
2021+
infra-cert (ssl-utils/pem->cert (slurp infra-csr-file))
2022+
regular-serial (.getSerialNumber regular-cert)
2023+
infra-serial (.getSerialNumber infra-cert)]
2024+
(is (= 1N regular-serial)
2025+
"Regular node should have incrementing serial (1)")
2026+
(is (instance? java.math.BigInteger infra-serial))
2027+
(is (> (.bitLength infra-serial) 100)
2028+
"Infra node should have UUID serial"))
2029+
(fs/delete regular-csr-file)
2030+
(fs/delete infra-csr-file)))))
2031+
2032+

0 commit comments

Comments
 (0)