Commit d85cd70f authored by Russ Allbery's avatar Russ Allbery
Browse files

Also fix coding style for apache::cert::* classes

parent abad185a

manifests/cert/comodo.pp

+83 −97
Original line number Diff line number Diff line
@@ -34,73 +34,61 @@ 
# handle that below.

define apache::cert::comodo(

  $ensure,

    $keyname     = 'NONE',

  $keyname     = undef,

  $owner       = 'root',

    $group       = 'NONE',

    $mode        = 640,

    $identity    = 'NONE',

  $group       = undef,

  $mode        = '0640',

  $identity    = undef,

  $comodoroot  = '',

  $symlink     = true,

  $installroot = true

) {

    case $ensure {

        'present', 'absent': { }

        default: { crit "Invalid ensure value: $ensure" }

    }



    # We can't use $name when setting a default value inside the parameter

    # list, so we have to do this lame nonsense.  We also can't reset the

    # variable, so we have to use a different variable.

    case $keyname {

        'NONE':  { $key = "unix-${name}-ssl-key" }

        default: { $key = $keyname }

    }

    case $identity {

        'NONE':  { $id = "${name}.stanford.edu" }

        default: { $id = $identity }

    }

    case $group {

        'NONE': {

            $grp = $operatingsystem ? {

                'debian' => 'ssl-cert',

                'ubuntu' => 'ssl-cert',

                'redhat' => 'root',

            }

        }

        default: { $grp = $group }

  if !($ensure in [ 'present', 'absent' ]) {

    fail("ensure must be present or absent, not $ensure")

  }



  # Include required packages.

    case $ensure {

        'present': { include apache::cert::packages }

        default:   { }

  if ($ensure == 'present') {

    include apache::cert::packages

  }



  # Install the private key.

    base::wallet { "$key":

  case $keyname {

    undef:   { $key = "unix-${name}-ssl-key" }

    default: { $key = $keyname }

  }

  base::wallet { $key:

    ensure  => $ensure,

    type    => 'file',

    path    => "/etc/ssl/private/${name}.key",

    owner   => $owner,

        group   => $grp,

    group   => $group ? {

      undef   => $::operatingsystem ? {

        'debian' => 'ssl-cert',

        'ubuntu' => 'ssl-cert',

        'redhat' => 'root',

      },

      default => $group,

    }

    mode    => $mode,

        require => $operatingsystem ? {

    require => $::operatingsystem ? {

      'debian' => Package['ca-certificates'],

      'ubuntu' => Package['ca-certificates'],

            'redhat' => [ Package['openssl'],

                          File['/etc/ssl/private'] ],

      'redhat' => [ Package['openssl'], File['/etc/ssl/private'] ],

    },

  }



  # Install the public certificate.

  file { "/etc/ssl/certs/${name}.pem":

    ensure  => $ensure,

        source  => "puppet:///modules/cert-files/${id}",

        require => $operatingsystem ? {

    source  => $identity ? {

      undef   => "puppet:///modules/cert-files/${name}.stanford.edu",

      default => $identity,

    }

    require => $::operatingsystem ? {

      'debian' => Package['ca-certificates'],

      'ubuntu' => Package['ca-certificates'],

            'redhat' => [ Package['openssl'],

                          File['/etc/ssl/certs'] ],

      'redhat' => [ Package['openssl'], File['/etc/ssl/certs'] ],

    },

  }
@@ -108,22 +96,21 @@ define apache::cert::comodo( 
  apache::cert::hash { "${name}.pem": ensure => $ensure }



  # Install the server symlinks unless symlink is set to false.

    if $symlink == true {

        file {

            "/etc/ssl/certs/server.pem":

  if ($symlink == true) {

    file { '/etc/ssl/certs/server.pem':

      ensure  => $ensure ? {

        present => link,

        absent  => absent,

        default => $ensure,

      },

      target  => "${name}.pem",

                require => $operatingsystem ? {

      require => $::operatingsystem ? {

        'debian' => Package['ca-certificates'],

        'ubuntu' => Package['ca-certificates'],

                    'redhat' => [ Package['openssl'],

                                  File['/etc/ssl/certs'] ],

                };

            '/etc/ssl/private/server.key':

        'redhat' => [ Package['openssl'], File['/etc/ssl/certs'] ],

      },

    }

    file { '/etc/ssl/private/server.key':

      ensure => $ensure ? {

        present => link,

        absent  => absent,
@@ -133,9 +120,8 @@ define apache::cert::comodo( 
      require => $operatingsystem ? {

        'debian' => Package['ca-certificates'],

        'ubuntu' => Package['ca-certificates'],

                    'redhat' => [ Package['openssl'],

                                  File['/etc/ssl/private'] ],

                };

        'redhat' => [ Package['openssl'], File['/etc/ssl/private'] ],

      },

    }

  }

}

manifests/cert/hash.pp

+22 −30
Original line number Diff line number Diff line 
#

# Creates the OpenSSL hash symlinks for certificates.  Factored out for ensure

# handling and since it's used for both the main certificate and for the

# Comodo root certificate.
@@ -7,32 +6,25 @@ define apache::cert::hash( 
  $ensure    = 'present',

  $directory = '/etc/ssl/certs'

) {

    case $ensure {

        present: {

            $hashcommand = "`openssl x509 -noout -hash -in $directory/$name`"

  if !($ensure in [ 'present', 'absent' ]) {

    fail("ensure must be present or absent, not $ensure")

  }

  $hashcommand = "`openssl x509 -noout -hash -in ${directory}/${name}`"



            exec { "openssl hash link $directory/$name":

                command => "ln -s $directory/$name $directory/$hashcommand.0",

                unless  => "[ -f \"$directory/$hashcommand.0\" ]",

                require => $operatingsystem ? {

                    'debian' => [

                                 File["$directory/$name"],

  # Create the link if ensure is present.

  if ($ensure == 'present') {

    exec { "openssl hash link ${directory}/${name}":

      command => "ln -s ${directory}/${name} ${directory}/${hashcommand}.0",

      unless  => "[ -f \"${directory}/${hashcommand}.0\" ]",

      require => $::operatingsystem ? {

        'debian' => [ File["${directory}/${name}"],

                      Package['ca-certificates'],

                                 Package['openssl']

                                ],

                    'ubuntu' => [

                                 File["$directory/$name"],

                      Package['openssl'] ],

        'ubuntu' => [ File["${directory}/${name}"],

                      Package['ca-certificates'],

                                 Package['openssl']

                                ],

                    'redhat' => [

                                 File["$directory/$name"],

                                 Package['openssl']

                                ],

                      Package['openssl'] ],

        'redhat' => [ File["${directory}/${name}"], Package['openssl'] ],

      },

    }

  }

        absent: { }

        default: { crit "Invalid ensure value: $ensure" }

    }

}

manifests/cert/packages.pp

+44 −45
Original line number Diff line number Diff line
@@ -2,54 +2,53 @@ 
# apache::cert::* defines from one class so that we don't have multiple

# definition problems.



# Helper define to install a Comodo root certificate.

define apache::cert::packages::root($ensure) {

  file { "/etc/ssl/certs/${name}.pem":

    ensure  => $ensure,

    source  => "puppet:///modules/apache/${name}.pem",

    require => $::operatingsystem ? {

      'debian' => Package['ca-certificates'],

      'ubuntu' => Package['ca-certificates'],

      'redhat' => [ Package['openssl'], File['/etc/ssl/certs'] ],

    },

  }

  apache::cert::hash { "${name}.pem": ensure => $ensure }

}



class apache::cert::packages {

  package { 'openssl': ensure => present }



    case $operatingsystem {

  # Install the basic certificate handling infrastructure.

  case $::operatingsystem {

    'debian', 'ubuntu': {

      package { 'ca-certificates': ensure => present }

    }



        # The ca-certificates package on Debian provides this, but no package

        # on Red Hat does.

    # The ca-certificates package on Debian provides this, but no package on

    # Red Hat does.

    'redhat': {

      file {

        '/etc/ssl':

          ensure  => directory,

                    mode    => 0755;

          mode    => '0755';

        '/etc/ssl/certs':

          ensure  => directory,

                    mode    => 0755;

          mode    => '0755';

        '/etc/ssl/private':

          ensure  => directory,

                    mode    => 0710;

          mode    => '0710';

      }

    }

  }



    # Install the Comodo root certificates we know about.

    define apache::cert::packages::root($ensure) {

        file { "/etc/ssl/certs/${name}.pem":

            ensure  => $ensure,

            source  => "puppet:///modules/apache/${name}.pem",

            require => $operatingsystem ? {

                'debian' => Package['ca-certificates'],

                'ubuntu' => Package['ca-certificates'],

                'redhat' => [ Package['openssl'],

                              File['/etc/ssl/certs'] ],

            },

        }

        apache::cert::hash { "$name.pem": ensure => $ensure }

    }

    apache::cert::packages::root {

        [

         'comodo-addtrust-2020',

  # Install all the known Comodo intermediate certificates.

  apache::cert::packages::root { [ 'comodo-addtrust-2020',

                                   'comodo-addtrust-2020-new',

                                   'comodo-entrust-2015',

                                   'comodo-entrust-2019',

                                   'incommon-addtrust-2020',

         'comodo-incommon-addtrust-bundle-2020',

         ]:

                                   'comodo-incommon-addtrust-bundle-2020' ]:

    ensure => present;

  }

}

manifests/cert/self-signed.pp

+37 −35
Original line number Diff line number Diff line
@@ -41,7 +41,7 @@ 
define apache::cert::self-signed(

  $ensure,

  $identity   = $fqdn,

    $pool       = 'false',

  $pool       = false,

  $serverlink = true,

  $certdir    = '/etc/ssl/certs',

  $keydir     = '/etc/ssl/private'
@@ -49,20 +49,22 @@ define apache::cert::self-signed( 
  if ($ensure != 'present') and ($ensure != 'absent') {

    fail("Invalid ensure value: $ensure")

  }



  # Currently, do nothing if ensure is absent.

  if $ensure == 'present' {

    include apache::cert::packages



        $pflag = $pool       ? { true  => "-p", default => "" }

        $mflag = $serverlink ? { false => "-m", default => "" }

    $pflag = $pool       ? { true  => '-p', default => '' }

    $mflag = $serverlink ? { false => '-m', default => '' }

    if ($certdir != '/etc/ssl/certs') or ($keydir != '/etc/ssl/private') {

            $flags = "-c '$certdir' -k '$keydir' $pflag $mflag"

      $flags = "-c '${certdir}' -k '${keydir}' ${pflag} ${mflag}"

    } else {

            $flags = "$pflag $mflag"

      $flags = "${pflag} ${mflag}"

    }

    $filename = regsubst($identity, '^([^.]+)\..*', '\1.pem')

        exec { "make-local-cert $identity":

            command => "/usr/sbin/make-local-cert $flags $identity",

            creates => "$certdir/$filename",

    exec { "make-local-cert ${identity}":

      command => "/usr/sbin/make-local-cert ${flags} ${identity}",

      creates => "${certdir}/${filename}",

      require => $operatingsystem ? {

        'debian' => [ Package["ca-certificates"],

                      Package["openssl"],