6e0d6ddf5ef1cd6b23a672020bb657744b5a2c59 Luke Kanies luke@madstop.com http://github.com/duritong/puppet/commit/38e2dcf35a1d9b19970d1fb253f6c09b0529e083 38e2dcf35a1d9b19970d1fb253f6c09b0529e083

2008-05-05T20:36:59-07:00

The master is now functionally serving REST and xmlrpc. ...as far as I can tell. The client, however, is broken, since it used the old http_pool/ssl_support stuff, which no longer works. I have to port puppetd over to using the new ssl stuff, then I'll at least be able to verify that the master can still speak xmlrpc. d4e28bf2ebc43b73bfd36bfb72bf5b5da53e6ee7 Luke Kanies luke@madstop.com 51ce6746bc4c865b307af77b0967b345bf095aa8 Luke Kanies luke@madstop.com http://github.com/duritong/puppet/commit/6e0d6ddf5ef1cd6b23a672020bb657744b5a2c59 6e0d6ddf5ef1cd6b23a672020bb657744b5a2c59

2008-05-05T20:25:42-07:00

The REST infrastructure now correctly the SSL certificates. I don't think the whole thing is done, but at least the basic flows are in place. Now it's just a question of doing real-world tests and fleshing out the unit tests as necessary. 472d2c2b9880e214ad0057954bb499446769827a Luke Kanies luke@madstop.com 62f1f5e1514b4283750558f0019331de8e9460a4 Luke Kanies luke@madstop.com http://github.com/duritong/puppet/commit/51ce6746bc4c865b307af77b0967b345bf095aa8 51ce6746bc4c865b307af77b0967b345bf095aa8

2008-05-05T19:16:25-07:00

Fixing the webrick integration tests to use the newly-functional SSL code. b4c9f2ddf36d025ddb2ff728c9f6f9d3899b029c Luke Kanies luke@madstop.com e57436f1056cceb8ecdfadfa618911c5595c72e2 Luke Kanies luke@madstop.com http://github.com/duritong/puppet/commit/62f1f5e1514b4283750558f0019331de8e9460a4 62f1f5e1514b4283750558f0019331de8e9460a4

2008-05-05T19:15:39-07:00

The Certificate Authority now automatically creates a CRL when appropriate. This requires less setup and configuration on the part of the user. edeef80e4099cc8bbb9dc726a9c010202d2ce385 Luke Kanies luke@madstop.com 137e29ff0e33ff5cbb4032d452abc5a5aef2c941 Luke Kanies luke@madstop.com http://github.com/duritong/puppet/commit/e57436f1056cceb8ecdfadfa618911c5595c72e2 e57436f1056cceb8ecdfadfa618911c5595c72e2

2008-05-05T19:14:46-07:00

The Settings class now clears the 'used' sections when a value is changed. This makes is so that if you, for instance, reset the vardir, then the next time an initialization call is made, we reuse any previously used sections, thus (hopefully) correctly creating any newly needed directories. This is mostly helpful during testing. 8e4314dbc7a754ba19c07971686ee03c8c5ed68e Luke Kanies luke@madstop.com a3b88041570a35827c82993d7559d3583b31232c Luke Kanies luke@madstop.com http://github.com/duritong/puppet/commit/137e29ff0e33ff5cbb4032d452abc5a5aef2c941 137e29ff0e33ff5cbb4032d452abc5a5aef2c941

2008-05-05T19:13:07-07:00

Moving some http configuration values to the main defaults section, rather than the puppetd section. 9910c985db5acbb715560d103e84b3dcfd191148 Luke Kanies luke@madstop.com e596bc5267bdbbe2e4ea0e7722047d1354f10826 Luke Kanies luke@madstop.com http://github.com/duritong/puppet/commit/a3b88041570a35827c82993d7559d3583b31232c a3b88041570a35827c82993d7559d3583b31232c

2008-05-05T19:12:39-07:00

The http pool manager now uses new-style certificate management. It uses an instance of SSL::Host for getting its certificate and ssl store. 5c725319a4a5f0d2e95f616769a72ebcb1c1b043 Luke Kanies luke@madstop.com 160f9d99e33b051d40f00971683cf54a0ff00c32 Luke Kanies luke@madstop.com http://github.com/duritong/puppet/commit/e596bc5267bdbbe2e4ea0e7722047d1354f10826 e596bc5267bdbbe2e4ea0e7722047d1354f10826

2008-05-05T19:01:33-07:00

Fixing some tests that were insufficiently mocking their configurations. These were still writing to ~. 05b099636251e8cfd6d4eb9c89baa6cf071d58e1 Luke Kanies luke@madstop.com ce6d5787aaefc4c980e51c394328c2ddc2f7cb9c Luke Kanies luke@madstop.com http://github.com/duritong/puppet/commit/160f9d99e33b051d40f00971683cf54a0ff00c32 160f9d99e33b051d40f00971683cf54a0ff00c32

2008-05-05T19:00:29-07:00

Fixing a critical problem in how CRLs were saved and moving SSL Store responsibilities to the SSL::Host class. I was previously saving invalid CRLs unless they'd had a revocation done in them; this commit fixes them so that they're always valid. Also, I've added to SSL::Host the ability to generate a valid SSL Store, suitable for validation. This is now used by Webrick and can be used by the http clients, too. This should have been two commits, but I'm kind of down the rabbit hole ATM. 50f5a7e2e40482289f84175036a42874fad26dac Luke Kanies luke@madstop.com 67dc268fae0489de93f247b08fdaf7b1eec0e15d Luke Kanies luke@madstop.com http://github.com/duritong/puppet/commit/ce6d5787aaefc4c980e51c394328c2ddc2f7cb9c ce6d5787aaefc4c980e51c394328c2ddc2f7cb9c

2008-05-05T15:16:03-07:00

The SSL::Host class now uses the CA to generate its certificate when appropriate. It uses the CA singleton method to determine whether it's on valid CA host, and if so, uses the CA instance to sign its generated CSR. 5bc654caf5c6da1127fb93e081b1dcf99929695a Luke Kanies luke@madstop.com 6356c043a44c771d707750f96f7660a1093be9ac Luke Kanies luke@madstop.com http://github.com/duritong/puppet/commit/67dc268fae0489de93f247b08fdaf7b1eec0e15d 67dc268fae0489de93f247b08fdaf7b1eec0e15d

2008-05-05T15:10:07-07:00

The CA now initializes itself. I realized that it never made sense to have a CA that didn't know how to initialize itself, so we now have a singleton method for the CA, and it also automatically initializes itself. 727206889dcccab3d9d3292726e87a663ae539f9 Luke Kanies luke@madstop.com 4c590df607f3d2cb6921b8d8269862a4f8f2456c Luke Kanies luke@madstop.com http://github.com/duritong/puppet/commit/6356c043a44c771d707750f96f7660a1093be9ac 6356c043a44c771d707750f96f7660a1093be9ac

2008-05-02T11:47:44-07:00

Switched puppetmasterd to use the new-style server plumbing. The code is much cleaner, and it seems to be mostly functional, but we have to pick a strategy for signing the host's certificate on first startup. Also, I haven't actually done end-to-end testing yet, which needs the certs working first. 509a3b2cdce0ff91ff62b960ac9c4c66de55ff2e Luke Kanies luke@madstop.com 31b79fa7760f95059a4e2afb35e734de283cf4a0 Luke Kanies luke@madstop.com http://github.com/duritong/puppet/commit/4c590df607f3d2cb6921b8d8269862a4f8f2456c 4c590df607f3d2cb6921b8d8269862a4f8f2456c

2008-05-02T11:20:00-07:00

Adding xmlrpc backward compatibility to the new Mongrel code. faa9497988f4c108344472e8a41347294cf004dc Luke Kanies luke@madstop.com 7a876ed6a06bc5decb257126eb57368aeb178a81 Luke Kanies luke@madstop.com http://github.com/duritong/puppet/commit/31b79fa7760f95059a4e2afb35e734de283cf4a0 31b79fa7760f95059a4e2afb35e734de283cf4a0

2008-05-02T10:58:35-07:00

Adding xmlrpc support to webrick. This provides the backward compatibility for webrick, and only Mongrel is left. 5e8cf6732758e3548103d2523fccecb056c39c1d Luke Kanies luke@madstop.com 72673413c8ead5adcb321fe1ce9cfe0410e0eb54 Luke Kanies luke@madstop.com http://github.com/duritong/puppet/commit/7a876ed6a06bc5decb257126eb57368aeb178a81 7a876ed6a06bc5decb257126eb57368aeb178a81

2008-05-02T10:28:23-07:00

Fixing some whitespace 316594daa96b6828082d8427385930d2efed9225 Luke Kanies luke@madstop.com 8c9b04d807b34ade704da3584b72d39bb129aa75 Luke Kanies luke@madstop.com http://github.com/duritong/puppet/commit/72673413c8ead5adcb321fe1ce9cfe0410e0eb54 72673413c8ead5adcb321fe1ce9cfe0410e0eb54

2008-05-02T10:27:15-07:00

Adding configuration support for XMLRPC handlers. This provides the interface for configuring backward compatibility in the new-style server code. It requires a completely different configuration step, in that REST and xmlrpc handlers are configured separately, rather than using the same handler names, but this was considered less evil than having a large abstraction layer for specifying how the handlers are related. 046e8d8e07284368527359606ca2956a53d2a47d Luke Kanies luke@madstop.com 83519f4e59f68f867f8ddbe141ac8bd9a6238ae1 Luke Kanies luke@madstop.com http://github.com/duritong/puppet/commit/8c9b04d807b34ade704da3584b72d39bb129aa75 8c9b04d807b34ade704da3584b72d39bb129aa75

2008-04-28T15:52:02-07:00

I think I've now got the Webrick SSL support working. Now I just need to get xmlrpc working alongside REST in both mongrel and webrick. c76828f38c7c8d28f4b533d556e809d0bf3c1437 Luke Kanies luke@madstop.com 0e8a1c9f6ac45e9e6f6dcf6464ad4d2780201ce1 Luke Kanies luke@madstop.com http://github.com/duritong/puppet/commit/83519f4e59f68f867f8ddbe141ac8bd9a6238ae1 83519f4e59f68f867f8ddbe141ac8bd9a6238ae1

2008-04-28T10:16:16-07:00

Interim commit, since I want to work but have no network available. a8fbd0e17b70abde2646659bef25b3aff91c7d63 Luke Kanies luke@madstop.com 58fb416e9f52a9dc834b735ffa7e5c425495c982 62ca72608c8fcded624c46c6951b9381a7284a80 Luke Kanies luke@madstop.com http://github.com/duritong/puppet/commit/0e8a1c9f6ac45e9e6f6dcf6464ad4d2780201ce1 0e8a1c9f6ac45e9e6f6dcf6464ad4d2780201ce1

2008-04-21T21:45:53-07:00

Merge branch '0.24.x' Conflicts: bin/puppetca 0bcf46830c65667ebf85e44f8699243f8da5a5f3 Luke Kanies luke@madstop.com 79ca44404af29b2bae621f9a6cb80467d95468aa Luke Kanies luke@madstop.com http://github.com/duritong/puppet/commit/58fb416e9f52a9dc834b735ffa7e5c425495c982 58fb416e9f52a9dc834b735ffa7e5c425495c982

2008-04-21T20:30:01-07:00

Changing the File certificate terminus so that it saves to the :localcacert instead of :cacert. This way the :ca terminus saves to :cacert and the :file terminus saves to :localcacert. 7cd0338ef9934a3ac567f6a1eda952da5d746960 Luke Kanies luke@madstop.com a116d10b5e4412c362a246f12b77fc2e979aedbe Luke Kanies luke@madstop.com http://github.com/duritong/puppet/commit/79ca44404af29b2bae621f9a6cb80467d95468aa 79ca44404af29b2bae621f9a6cb80467d95468aa

2008-04-21T15:33:58-07:00

Renaming the 'ca_file' ssl terminus type to 'ca'. 176d472b4b4067cd5038c5e629e246d8f2d73627 Luke Kanies luke@madstop.com d87e018ab84646de94aea70c2bd0270e1721940d Luke Kanies luke@madstop.com http://github.com/duritong/puppet/commit/a116d10b5e4412c362a246f12b77fc2e979aedbe a116d10b5e4412c362a246f12b77fc2e979aedbe

2008-04-19T17:37:22-07:00

Temporarily disabling the revoke/verify test in the CA. It looks like it's not taking the CRL into account, so I can't seem to actually get a cert to fail verification. 474fcf7511c910e8ef3f4807e5f2e2a5758ee405 Luke Kanies luke@madstop.com 6c539c001e26b5a344d1f6e582f2f25cf16542bc Luke Kanies luke@madstop.com http://github.com/duritong/puppet/commit/d87e018ab84646de94aea70c2bd0270e1721940d d87e018ab84646de94aea70c2bd0270e1721940d

2008-04-19T17:20:25-07:00

Fixing how the CRL is used for certificate verification. The CRL was not correctly being added to the Store used for verification. It does not appear to be working, though, since revoked certificates still pass verification. 4aaeb8061e18856a1343fffe4a8ba4ab330a2e52 Luke Kanies luke@madstop.com ebdbe4880d8c20965ac21a473b2bfc1ab953b6d4 Luke Kanies luke@madstop.com http://github.com/duritong/puppet/commit/6c539c001e26b5a344d1f6e582f2f25cf16542bc 6c539c001e26b5a344d1f6e582f2f25cf16542bc

2008-04-19T17:13:14-07:00

Fixing puppetca so it uses the :local ca setting. This causes it to use both the :ca_file and :file terminus types. f5e13b2b0659c24713a79a63fbe9dfb8b90f207b Luke Kanies luke@madstop.com 934fbba81cb18f05e07675d79a2e830c4e95c918 Luke Kanies luke@madstop.com http://github.com/duritong/puppet/commit/ebdbe4880d8c20965ac21a473b2bfc1ab953b6d4 ebdbe4880d8c20965ac21a473b2bfc1ab953b6d4

2008-04-19T17:08:36-07:00

Added an Interface class to the CA to model puppetca's usage. This class provides all of the semantics from puppetca, and appears to entirely duplicate the behaviour of the existing executable, with basically all of the code in a library file, instead of the executable. As such, I've deleted the test for the executable. We should have one, but it's not nearly as important. 3ad90a8ef93313f95db4f2976bd043c4f8fe7640 Luke Kanies luke@madstop.com d4813f1e03d96551e91b104e48b028fb4074d398 Luke Kanies luke@madstop.com http://github.com/duritong/puppet/commit/934fbba81cb18f05e07675d79a2e830c4e95c918 934fbba81cb18f05e07675d79a2e830c4e95c918

2008-04-19T13:30:11-07:00

Making the SSL::Host's destroy method a class method, rather than an instance method. 271bc1b8f94904e24be6b4823b304ef8787f4e9e Luke Kanies luke@madstop.com 809fc77bc767fb3acabc83d55183686200b1e384 Luke Kanies luke@madstop.com http://github.com/duritong/puppet/commit/d4813f1e03d96551e91b104e48b028fb4074d398 d4813f1e03d96551e91b104e48b028fb4074d398

2008-04-19T12:59:11-07:00

Adding the last functionality needed for puppetca to use the Indirector. This commit adds 'list' and 'print' support to the CA. They're mostly delegator methods, but now the CA should be the sole interface for puppetca. 535b8ebeadc42be7e3d1bcc8679c1790a341ec19 Luke Kanies luke@madstop.com 16056a24c65a7c6485b65f15700ff3971781031b Luke Kanies luke@madstop.com http://github.com/duritong/puppet/commit/809fc77bc767fb3acabc83d55183686200b1e384 809fc77bc767fb3acabc83d55183686200b1e384

2008-04-19T12:50:18-07:00

Finishing the interface between the CA and the CRL. Certificate revocation now works, the CA knows how to generate the CRL, and the SSL::Host class knows how to configure the CRL class for indirection. 26f0fa4954f693168f7f366c5ea8653531de3ac6 Luke Kanies luke@madstop.com 82b9f61bdc0f3141b8744b83978e2fe9cd2a710b James Turnbull james@lovedthanlost.net http://github.com/duritong/puppet/commit/62ca72608c8fcded624c46c6951b9381a7284a80 62ca72608c8fcded624c46c6951b9381a7284a80

2008-04-19T05:35:02-07:00

Fixed some tests broken by #1176 b72d405280767141130b3e96603a6a8f49fc3a4f James Turnbull james@lovedthanlost.net a35450b147c8594d5bcae4facc938fe8143218f7 James Turnbull james@lovedthanlost.net http://github.com/duritong/puppet/commit/82b9f61bdc0f3141b8744b83978e2fe9cd2a710b 82b9f61bdc0f3141b8744b83978e2fe9cd2a710b

2008-04-19T04:56:17-07:00

Added puppetlast script to ext directory c6bf370bbb60081f8156ea773ce1364febd20af3 James Turnbull james@lovedthanlost.net