Skip to content

Commit 736c8d9

Browse files
dimonzozodimonzozo
authored
Add optional variables to support SSL CRL check configuration (voxpupuli#869)
* Add optional variables to support SSL CRL check configuration * Fix specs and lots of typos * Remove defaults from common.yaml (definition in init.pp is prefered) * Use Stdlib::Absolutepath instead of String for setting with path Co-authored-by: Dmitriy Myaskovskiy <[email protected]>
1 parent 70958be commit 736c8d9

File tree

4 files changed

+144
-0
lines changed

4 files changed

+144
-0
lines changed

‎manifests/config.pp‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,9 @@
6060
$ssl_dhfile = $rabbitmq::ssl_dhfile
6161
$ssl_versions = $rabbitmq::ssl_versions
6262
$ssl_ciphers = $rabbitmq::ssl_ciphers
63+
$ssl_crl_check = $rabbitmq::ssl_crl_check
64+
$ssl_crl_cache_hash_dir = $rabbitmq::ssl_crl_cache_hash_dir
65+
$ssl_crl_cache_http_timeout = $rabbitmq::ssl_crl_cache_http_timeout
6366
$stomp_port = $rabbitmq::stomp_port
6467
$stomp_ssl_only = $rabbitmq::stomp_ssl_only
6568
$ldap_auth = $rabbitmq::ldap_auth

‎manifests/init.pp‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -269,6 +269,15 @@
269269
# Functionality can be tested with cipherscan or similar tool: https://github.com/mozilla/cipherscan
270270
# * Erlang style: `['ecdhe_rsa,aes_256_cbc,sha', 'dhe_rsa,aes_256_cbc,sha']`
271271
# * OpenSSL style: `['ECDHE-RSA-AES256-SHA', 'DHE-RSA-AES256-SHA']`
272+
# @param ssl_crl_check
273+
# Perform CRL (Certificate Revocation List) verification
274+
# Please see the [Erlang SSL](https://erlang.org/doc/man/ssl.html#type-crl_check) module documentation for more information.
275+
# @param ssl_crl_cache_hash_dir
276+
# This setting makes use of a directory where CRLs are stored in files named by the hash of the issuer name.
277+
# Please see the [Erlang SSL](https://erlang.org/doc/man/ssl.html#type-crl_cache_opts) module documentation for more information.
278+
# @param ssl_crl_cache_http_timeout
279+
# This setting enables use of internal CRLs cache and sets HTTP timeout interval on fetching CRLs from distributino URLs defined inside certificate.
280+
# Please see the [Erlang SSL](https://erlang.org/doc/man/ssl.html#type-crl_cache_opts) module documentation for more information.
272281
# @param stomp_port
273282
# The port to use for Stomp.
274283
# @param stomp_ssl_only
@@ -368,6 +377,9 @@
368377
Boolean $ssl_honor_cipher_order = true,
369378
Optional[Stdlib::Absolutepath] $ssl_dhfile = undef,
370379
Array $ssl_ciphers = [],
380+
Enum['true','false','peer','best_effort'] $ssl_crl_check = 'false',
381+
Optional[Stdlib::Absolutepath] $ssl_crl_cache_hash_dir = undef,
382+
Optional[Integer] $ssl_crl_cache_http_timeout = undef,
371383
Boolean $stomp_ensure = false,
372384
Boolean $ldap_auth = false,
373385
Variant[String[1],Array[String[1]]] $ldap_server = 'ldap',
@@ -413,6 +425,30 @@
413425
}
414426
}
415427

428+
if $ssl_crl_check != 'false' {
429+
unless $ssl {
430+
fail('$ssl_crl_check requires that $ssl => true')
431+
}
432+
}
433+
434+
if $ssl_crl_cache_hash_dir {
435+
unless $ssl {
436+
fail('$ssl_crl_cache_hash_dir requires that $ssl => true')
437+
}
438+
if $ssl_crl_check == 'false' {
439+
fail('$ssl_crl_cache_http_timeout requires that $ssl_crl_check => true|peer|best_effort')
440+
}
441+
}
442+
443+
if $ssl_crl_cache_http_timeout {
444+
unless $ssl {
445+
fail('$ssl_crl_cache_http_timeout requires that $ssl => true')
446+
}
447+
if $ssl_crl_check == 'false' {
448+
fail('$ssl_crl_cache_http_timeout requires that $ssl_crl_check => true|peer|best_effort')
449+
}
450+
}
451+
416452
if $repos_ensure {
417453
case $facts['os']['family'] {
418454
'RedHat': {

‎spec/classes/rabbitmq_spec.rb‎

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1161,6 +1161,102 @@
11611161
end
11621162
end
11631163

1164+
describe 'ssl options with ssl_crl_check enabled' do
1165+
let(:params) do
1166+
{ ssl: true,
1167+
ssl_port: 3141,
1168+
ssl_cacert: '/path/to/cacert',
1169+
ssl_cert: '/path/to/cert',
1170+
ssl_key: '/path/to/key',
1171+
ssl_crl_check: 'true' }
1172+
end
1173+
1174+
it 'sets ssl crl check setting to specified value' do
1175+
is_expected.to contain_file('rabbitmq.config').with_content(%r{crl_check,true})
1176+
end
1177+
end
1178+
1179+
describe 'ssl options with ssl_crl_check and ssl_crl_hash_cache enabled' do
1180+
let(:params) do
1181+
{ ssl: true,
1182+
ssl_port: 3141,
1183+
ssl_cacert: '/path/to/cacert',
1184+
ssl_cert: '/path/to/cert',
1185+
ssl_key: '/path/to/key',
1186+
ssl_crl_check: 'true',
1187+
ssl_crl_cache_hash_dir: '/path/to/crl_cache/dir' }
1188+
end
1189+
1190+
it 'sets ssl crl check setting to specified value' do
1191+
is_expected.to contain_file('rabbitmq.config').with_content(%r{crl_check,true})
1192+
is_expected.to contain_file('rabbitmq.config').with_content(%r{crl_cache,\s+{ssl_crl_hash_dir,\s+{internal,\s+\[{dir, "/path/to/crl_cache/dir"}\]}}})
1193+
end
1194+
end
1195+
1196+
describe 'ssl options with ssl_crl_check and http cache enabled' do
1197+
let(:params) do
1198+
{ ssl: true,
1199+
ssl_port: 3141,
1200+
ssl_cacert: '/path/to/cacert',
1201+
ssl_cert: '/path/to/cert',
1202+
ssl_key: '/path/to/key',
1203+
ssl_crl_check: 'true',
1204+
ssl_crl_cache_http_timeout: 5000 }
1205+
end
1206+
1207+
it 'sets ssl crl check setting to specified value' do
1208+
is_expected.to contain_file('rabbitmq.config').with_content(%r{crl_check,true})
1209+
is_expected.to contain_file('rabbitmq.config').with_content(%r{crl_cache,\s+{ssl_crl_cache,\s+{internal,\s+\[{http, 5000}\]}}})
1210+
end
1211+
end
1212+
1213+
describe 'ssl options with ssl_crl_check enabled and not ssl' do
1214+
let(:params) do
1215+
{ ssl: false,
1216+
ssl_port: 3141,
1217+
ssl_cacert: '/path/to/cacert',
1218+
ssl_cert: '/path/to/cert',
1219+
ssl_key: '/path/to/key',
1220+
ssl_crl_check: 'true' }
1221+
end
1222+
1223+
it 'fails' do
1224+
expect { catalogue }.to raise_error(Puppet::Error, %r{\$ssl_crl_check requires that \$ssl => true})
1225+
end
1226+
end
1227+
1228+
describe 'ssl options with ssl_crl_cache_hash_dir set and not ssl_crl_check' do
1229+
let(:params) do
1230+
{ ssl: true,
1231+
ssl_port: 3141,
1232+
ssl_cacert: '/path/to/cacert',
1233+
ssl_cert: '/path/to/cert',
1234+
ssl_key: '/path/to/key',
1235+
ssl_crl_check: 'false',
1236+
ssl_crl_cache_hash_dir: '/path/to/crl_cache/dir' }
1237+
end
1238+
1239+
it 'fails' do
1240+
expect { catalogue }.to raise_error(Puppet::Error, %r{\$ssl_crl_cache_hash_dir requires that \$ssl_crl_check => true|peer|best_effort})
1241+
end
1242+
end
1243+
1244+
describe 'ssl options with ssl_crl_cache_http_timeout set and not ssl_crl_check' do
1245+
let(:params) do
1246+
{ ssl: true,
1247+
ssl_port: 3141,
1248+
ssl_cacert: '/path/to/cacert',
1249+
ssl_cert: '/path/to/cert',
1250+
ssl_key: '/path/to/key',
1251+
ssl_crl_check: 'false',
1252+
ssl_crl_cache_http_timeout: 5000 }
1253+
end
1254+
1255+
it 'fails' do
1256+
expect { catalogue }.to raise_error(Puppet::Error, %r{\$ssl_crl_cache_http_timeout requires that \$ssl_crl_check => true|peer|best_effort})
1257+
end
1258+
end
1259+
11641260
describe 'ssl admin options with specific ssl versions' do
11651261
let(:params) do
11661262
{ ssl: true,

‎templates/rabbitmq.config.erb‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -95,6 +95,15 @@ end
9595
<%= ssl_ciphers %>
9696
]}
9797
<%- end -%>
98+
<%- if @ssl_crl_check != 'false' -%>
99+
,{crl_check,<%= @ssl_crl_check %>}
100+
<%- end -%>
101+
<%- if @ssl_crl_cache_hash_dir -%>
102+
,{crl_cache, {ssl_crl_hash_dir, {internal, [{dir, "<%= @ssl_crl_cache_hash_dir %>"}]}}}
103+
<%- end -%>
104+
<%- if @ssl_crl_cache_http_timeout -%>
105+
,{crl_cache, {ssl_crl_cache, {internal, [{http, <%= @ssl_crl_cache_http_timeout %>}]}}}
106+
<%- end -%>
98107
]},
99108
<%- end -%>
100109
<% if scope['rabbitmq::config_variables'] -%>

0 commit comments

Comments
 (0)