Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add support for REQUIRE SSL|X509 option #888

Merged
merged 1 commit into from
Sep 29, 2016
Merged

Conversation

edestecd
Copy link
Contributor

@edestecd edestecd commented Sep 13, 2016

Basic support for REQUIRE SSL or REQUIRE X509 only through the options param on the mysql_grant type. This seems like an option we should support.

It would be nice to support any option in the options array, but I'm not sure about the code to check if the options are set in the instances method. Seems like you need to look for something explicitly in the rest, the way it is set up currently.

Copy link
Contributor

@JAORMX JAORMX left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this needs test in the same manner that there are tests already for 'GRANT'. Look at
spec/acceptance/types/mysql_grant_spec.rb

@@ -107,6 +107,8 @@ def self.cmd_options(options)
options.each do |opt|
if opt == 'GRANT'
option_string << ' WITH GRANT OPTION'
elsif op = opt.match(/^REQUIRE\s(SSL|X509)$/)
Copy link
Contributor

@JAORMX JAORMX Sep 28, 2016

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

well, we already know that if SSL or X509 is given, it's a REQUIRE. Why not take a similar approach than 'GRANT' and just use 'SSL' or 'X509'; Those will be looked for here and subsequently the option_string will fill in the REQUIRE. So something like:

elsif opt == 'SSL' or opt == 'X509'
  option_string << "REQUIRE #{opt}"

options = []
options << 'GRANT' if rest.match(/WITH\sGRANT\sOPTION/)
req_opt = rest.match(/REQUIRE\s(SSL|X509)/)
options << req_opt[0] if req_opt
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If the above recommendation is taken, this also needs to be changed,

@edestecd edestecd force-pushed the master branch 5 times, most recently from f03a744 to f4961e9 Compare September 29, 2016 14:06
Copy link
Contributor

@JAORMX JAORMX left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

it's a bit verbose to have to write REQUIRE SSL, buuuut I'm fine with this. It's way better to have support for this

@edestecd
Copy link
Contributor Author

Added spec tests and Doc to the README.

@edestecd
Copy link
Contributor Author

I prefer the verbosity of REQUIRE, b/c its more clear what you are doing when glancing the code.
Also there is a third argument with the following options...
| CIPHER 'cipher'
| ISSUER 'issuer'
| SUBJECT 'subject'

http://dev.mysql.com/doc/refman/5.7/en/grant.html

So there is no chance for a single word there. I have not added support for these as of yet, but hope to in the future...

I'm not entirely married to the REQUIRE, however. If others feel the same way, I will change it.

@JAORMX
Copy link
Contributor

JAORMX commented Sep 29, 2016

@edestecd using REQUIRE is fine for me. and SSL and X509 support is exactly what I need for the stuff I'm doing. Thanks!

@EmilienM
Copy link
Contributor

Code looks good to me, also nice testing coverage. Let's go!

@EmilienM EmilienM merged commit 1c763bb into puppetlabs:master Sep 29, 2016
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants