Skip to content

Commit a940564

Browse files
kperronne-godaddywyardley
authored andcommitted
Add ssl options for client renegotiation to rabbitmq-server
1 parent c5afc5f commit a940564

File tree

6 files changed

+276
-1
lines changed

6 files changed

+276
-1
lines changed

REFERENCE.md

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -278,6 +278,7 @@ The following parameters are available in the `rabbitmq` class:
278278
* [`ssl_management_fail_if_no_peer_cert`](#-rabbitmq--ssl_management_fail_if_no_peer_cert)
279279
* [`ssl_port`](#-rabbitmq--ssl_port)
280280
* [`ssl_reuse_sessions`](#-rabbitmq--ssl_reuse_sessions)
281+
* [`ssl_client_renegotiation`](#-rabbitmq--ssl_client_renegotiation)
281282
* [`ssl_secure_renegotiate`](#-rabbitmq--ssl_secure_renegotiate)
282283
* [`ssl_stomp_port`](#-rabbitmq--ssl_stomp_port)
283284
* [`ssl_verify`](#-rabbitmq--ssl_verify)
@@ -995,6 +996,14 @@ Reuse ssl sessions
995996

996997
Default value: `true`
997998

999+
##### <a name="-rabbitmq--ssl_client_renegotiation"></a>`ssl_client_renegotiation`
1000+
1001+
Data type: `Optional[Boolean]`
1002+
1003+
Allow ssl client renegotiation
1004+
1005+
Default value: `undef`
1006+
9981007
##### <a name="-rabbitmq--ssl_secure_renegotiate"></a>`ssl_secure_renegotiate`
9991008

10001009
Data type: `Boolean`

data/common.yaml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,7 @@ rabbitmq::ssl_fail_if_no_peer_cert: false
6262
rabbitmq::ssl_management_verify: 'verify_none'
6363
rabbitmq::ssl_management_fail_if_no_peer_cert: false
6464
rabbitmq::ssl_versions: ~
65+
rabbitmq::ssl_client_renegotiation: ~
6566
rabbitmq::ssl_secure_renegotiate: true
6667
rabbitmq::ssl_reuse_sessions: true
6768
rabbitmq::ssl_honor_cipher_order: true

manifests/config.pp

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,7 @@
5656
$ssl_stomp_port = $rabbitmq::ssl_stomp_port
5757
$ssl_verify = $rabbitmq::ssl_verify
5858
$ssl_fail_if_no_peer_cert = $rabbitmq::ssl_fail_if_no_peer_cert
59+
$ssl_client_renegotiation = $rabbitmq::ssl_client_renegotiation
5960
$ssl_secure_renegotiate = $rabbitmq::ssl_secure_renegotiate
6061
$ssl_reuse_sessions = $rabbitmq::ssl_reuse_sessions
6162
$ssl_honor_cipher_order = $rabbitmq::ssl_honor_cipher_order

manifests/init.pp

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -291,6 +291,8 @@
291291
# SSL port for RabbitMQ
292292
# @param ssl_reuse_sessions
293293
# Reuse ssl sessions
294+
# @param ssl_client_renegotiation
295+
# Allow ssl client renegotiation
294296
# @param ssl_secure_renegotiate
295297
# Use ssl secure renegotiate
296298
# @param ssl_stomp_port
@@ -419,13 +421,14 @@
419421
Enum['verify_none','verify_peer'] $ssl_management_verify = 'verify_none',
420422
Boolean $ssl_management_fail_if_no_peer_cert = false,
421423
Optional[Array] $ssl_versions = undef,
424+
Optional[Boolean] $ssl_client_renegotiation = undef,
422425
Boolean $ssl_secure_renegotiate = true,
423426
Boolean $ssl_reuse_sessions = true,
424427
Boolean $ssl_honor_cipher_order = true,
425428
Optional[Stdlib::Absolutepath] $ssl_dhfile = undef,
426429
Array $ssl_ciphers = [],
427430
Enum['true','false','peer','best_effort'] $ssl_crl_check = 'false',
428-
Optional[Stdlib::Absolutepath] $ssl_crl_cache_hash_dir = undef,
431+
Optional[Stdlib::Absolutepath] $ssl_crl_cache_hash_dir = undef,
429432
Optional[Integer] $ssl_crl_cache_http_timeout = undef,
430433
Boolean $stomp_ensure = false,
431434
Boolean $ldap_auth = false,

spec/classes/rabbitmq_spec.rb

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1194,6 +1194,34 @@
11941194
end
11951195
end
11961196

1197+
# tlsv1.3 not supported on older RMQ/Erlang with this distro
1198+
describe 'ssl options with ssl version tlsv1.3', unless: facts[:osfamily] == 'RedHat' do
1199+
let(:params) do
1200+
{ ssl: true,
1201+
ssl_port: 3141,
1202+
ssl_cacert: '/path/to/cacert',
1203+
ssl_cert: '/path/to/cert',
1204+
ssl_key: '/path/to/key',
1205+
ssl_versions: ['tlsv1.3'] }
1206+
end
1207+
1208+
it 'sets ssl options to specified values' do
1209+
is_expected.to contain_file('rabbitmq.config').with_content(%r{ssl_listeners, \[3141\]})
1210+
is_expected.to contain_file('rabbitmq.config').with_content(%r{ssl_options, \[})
1211+
is_expected.to contain_file('rabbitmq.config').with_content(%r{cacertfile,"/path/to/cacert"})
1212+
is_expected.to contain_file('rabbitmq.config').with_content(%r{certfile,"/path/to/cert"})
1213+
is_expected.to contain_file('rabbitmq.config').with_content(%r{keyfile,"/path/to/key})
1214+
is_expected.to contain_file('rabbitmq.config').with_content(%r{ssl, \[\{versions, \['tlsv1.3'\]\}\]})
1215+
is_expected.to contain_file('rabbitmq.config').with_content(%r{versions, \['tlsv1.3'\]})
1216+
end
1217+
1218+
it 'does not set ssl negotiation options with tlsv1.3' do
1219+
is_expected.to contain_file('rabbitmq.config'). \
1220+
without_content(%r{client_renegotiation}). \
1221+
without_content(%r{secure_renegotiate})
1222+
end
1223+
end
1224+
11971225
describe 'ssl options with ssl_versions and not ssl' do
11981226
let(:params) do
11991227
{ ssl: false,
@@ -1379,6 +1407,16 @@
13791407
it { is_expected.to contain_file('rabbitmq.config').without_content(%r{dhfile,}) }
13801408
end
13811409

1410+
describe 'ssl with ssl_client_renegotiation false' do
1411+
let(:params) do
1412+
{ ssl: true,
1413+
ssl_interface: '0.0.0.0',
1414+
ssl_client_renegotiation: false }
1415+
end
1416+
1417+
it { is_expected.to contain_file('rabbitmq.config').with_content(%r{client_renegotiation,false}) }
1418+
end
1419+
13821420
describe 'ssl with ssl_secure_renegotiate false' do
13831421
let(:params) do
13841422
{ ssl: true,

templates/rabbitmq.config.erb

Lines changed: 223 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,223 @@
1+
% This file managed by Puppet
2+
% Template Path: <%= @module_name %>/templates/rabbitmq.config
3+
[
4+
<%-
5+
if @ssl_ciphers && @ssl_ciphers.size > 0
6+
ssl_ciphers = @ssl_ciphers.map do |cipher|
7+
if cipher.split(',').size > 1
8+
"{#{cipher}}"
9+
else
10+
"\"#{cipher}\""
11+
end
12+
end.join(",\n ")
13+
else
14+
ssl_ciphers = nil
15+
end
16+
-%>
17+
<%- if @ssl and @ssl_versions -%>
18+
{ssl, [{versions, [<%= @ssl_versions.sort.map { |v| "'#{v}'" }.join(', ') %>]}]},
19+
<%- end -%>
20+
{rabbit, [
21+
<%- if @heartbeat -%>
22+
{heartbeat, <%=@heartbeat%>},
23+
<% end -%>
24+
{loopback_users, [<%= @loopback_users.map { |u| "<<\"#{u}\">>" }.join(', ') %>]},
25+
<% if @auth_backends -%>
26+
{auth_backends, [<%= @auth_backends.map { |v| "#{v}" }.join(', ') %>]},
27+
<% elsif @ldap_auth -%>
28+
{auth_backends, [rabbit_auth_backend_internal, rabbit_auth_backend_ldap]},
29+
<% end -%>
30+
<% if @config_cluster -%>
31+
{cluster_nodes, {[<%= @cluster_nodes.map { |n| "\'rabbit@#{n}\'" }.join(', ') %>], <%= @cluster_node_type %>}},
32+
{cluster_partition_handling, <%= @cluster_partition_handling %>},
33+
<% end -%>
34+
{tcp_listen_options, [
35+
<%- unless @config_ranch -%>
36+
binary,
37+
{packet, raw},
38+
{reuseaddr, true},
39+
<%- end -%>
40+
<%- if @tcp_keepalive -%>
41+
{keepalive, true},
42+
<%- end -%>
43+
<%- if @tcp_backlog -%>
44+
{backlog, <%= @tcp_backlog %>},
45+
<%- end -%>
46+
<%- if @tcp_sndbuf -%>
47+
{sndbuf, <%= @tcp_sndbuf %>},
48+
<%- end -%>
49+
<%- if @tcp_recbuf -%>
50+
{recbuf, <%= @tcp_recbuf %>},
51+
<%- end -%>
52+
{nodelay, true},
53+
{linger, {true, 0}},
54+
{exit_on_close, false}
55+
]},
56+
<%- if @collect_statistics_interval -%>
57+
{collect_statistics_interval, <%= @collect_statistics_interval %>},
58+
<%- end -%>
59+
<%- if @ssl_only -%>
60+
{tcp_listeners, []},
61+
<%- elsif @interface -%>
62+
{tcp_listeners, [{"<%= @interface%>", <%= @port %>}]},
63+
<%- end -%>
64+
<%- if @ssl -%>
65+
<%- if @ssl_interface -%>
66+
{ssl_listeners, [{"<%= @ssl_interface%>", <%= @ssl_port %>}]},
67+
<%- else -%>
68+
{ssl_listeners, [<%= @ssl_port %>]},
69+
<%- end -%>
70+
{ssl_options, [
71+
<%- if @ssl_cacert -%>
72+
{cacertfile,"<%= @ssl_cacert %>"},
73+
<%- end -%>
74+
{certfile,"<%= @ssl_cert %>"},
75+
{keyfile,"<%= @ssl_key %>"},
76+
<%- if @ssl_cert_password -%>
77+
{password, "<%= @ssl_cert_password %>"},
78+
<%- end -%>
79+
<%- if @ssl_depth -%>
80+
{depth,<%= @ssl_depth %>},
81+
<%- end -%>
82+
<%- if @ssl_dhfile -%>
83+
{dhfile, "<%= @ssl_dhfile %>"},
84+
<%- end -%>
85+
<%- if !@ssl_versions || !@ssl_versions.include?('tlsv1.3') -%>
86+
<%- if defined?(@ssl_client_renegotiation) -%>
87+
{client_renegotiation,<%= @ssl_client_renegotiation %>},
88+
<%- end -%>
89+
{secure_renegotiate,<%= @ssl_secure_renegotiate %>},
90+
<%- end -%>
91+
{reuse_sessions,<%= @ssl_reuse_sessions %>},
92+
{honor_cipher_order,<%= @ssl_honor_cipher_order %>},
93+
{verify,<%= @ssl_verify %>},
94+
{fail_if_no_peer_cert,<%= @ssl_fail_if_no_peer_cert %>}
95+
<%- if @ssl_versions -%>
96+
,{versions, [<%= @ssl_versions.sort.map { |v| "'#{v}'" }.join(', ') %>]}
97+
<%- end -%>
98+
<%- if @ssl_ciphers and @ssl_ciphers.size > 0 -%>
99+
,{ciphers,[
100+
<%= ssl_ciphers %>
101+
]}
102+
<%- end -%>
103+
<%- if @ssl_crl_check != 'false' -%>
104+
,{crl_check,<%= @ssl_crl_check %>}
105+
<%- end -%>
106+
<%- if @ssl_crl_cache_hash_dir -%>
107+
,{crl_cache, {ssl_crl_hash_dir, {internal, [{dir, "<%= @ssl_crl_cache_hash_dir %>"}]}}}
108+
<%- end -%>
109+
<%- if @ssl_crl_cache_http_timeout -%>
110+
,{crl_cache, {ssl_crl_cache, {internal, [{http, <%= @ssl_crl_cache_http_timeout %>}]}}}
111+
<%- end -%>
112+
]},
113+
<%- end -%>
114+
<% if scope['rabbitmq::config_variables'] -%>
115+
<%- scope['rabbitmq::config_variables'].keys.sort.each do |key| -%>
116+
{<%= key %>, <%= scope['rabbitmq::config_variables'][key] %>},
117+
<%- end -%>
118+
<%- end -%>
119+
{default_user, <<"<%= @default_user %>">>},
120+
{default_pass, <<"<%= @default_pass %>">>}
121+
]}<% if @config_kernel_variables -%>,
122+
{kernel, [
123+
<%= @config_kernel_variables.sort.map{|k,v| "{#{k}, #{v}}"}.join(",\n ") %>
124+
]}
125+
<%- end -%>
126+
<%- if @admin_enable or @management_enable or !@config_management_variables.empty? -%>,
127+
{rabbitmq_management, [
128+
<%- if !@config_management_variables.empty? -%>
129+
<%= @config_management_variables.sort.map{|k,v| "{#{k}, #{v}}"}.join(",\n ") %>
130+
<%- end -%>
131+
<%- if @admin_enable or @management_enable -%>
132+
<%- if !@config_management_variables.empty? -%>,<%-end-%>
133+
{listener, [
134+
<%- if @ssl && @management_ssl -%>
135+
<%- if @management_ip_address -%>
136+
{ip, "<%= @management_ip_address %>"},
137+
<%- end -%>
138+
{port, <%= @ssl_management_port %>},
139+
{ssl, true},
140+
{ssl_opts, [<%- if @ssl_management_cacert %>
141+
{cacertfile, "<%= @ssl_management_cacert %>"},
142+
<%- end -%>
143+
{certfile, "<%= @ssl_management_cert %>"},
144+
{keyfile, "<%= @ssl_management_key %>"},
145+
<%- if !@ssl_versions || !@ssl_versions.include?('tlsv1.3') -%>
146+
<%- if defined?(@ssl_client_renegotiation) -%>
147+
{client_renegotiation,<%= @ssl_client_renegotiation %>},
148+
<%- end -%>
149+
{secure_renegotiate,<%= @ssl_secure_renegotiate %>},
150+
<%- end -%>
151+
{reuse_sessions,<%= @ssl_reuse_sessions %>},
152+
{honor_cipher_order,<%= @ssl_honor_cipher_order %>},
153+
{verify,<%= @ssl_management_verify %>},
154+
{fail_if_no_peer_cert,<%= @ssl_management_fail_if_no_peer_cert %>}
155+
<%- if @ssl_versions -%>
156+
,{versions, [<%= @ssl_versions.sort.map { |v| "'#{v}'" }.join(', ') %>]}
157+
<%- end -%>
158+
<%- if @ssl_ciphers and @ssl_ciphers.size > 0 -%>
159+
,{ciphers,[
160+
<%= ssl_ciphers %>
161+
]}
162+
<%- end -%>
163+
]}
164+
<%- else -%>
165+
<%- if @management_ip_address -%>
166+
{ip, "<%= @management_ip_address %>"},
167+
<%- end -%>
168+
{port, <%= @management_port %>}
169+
<%- end -%>
170+
]}
171+
<%- end -%>
172+
]}
173+
<%- end -%>
174+
<% if @config_stomp -%>,
175+
% Configure the Stomp Plugin listening port
176+
{rabbitmq_stomp, [
177+
<%- if @stomp_ssl_only -%>
178+
{tcp_listeners, []}
179+
<%- else -%>
180+
{tcp_listeners, [<%= @stomp_port %>]}
181+
<%- end -%>
182+
<%- if @ssl && @ssl_stomp_port -%>
183+
,
184+
{ssl_listeners, [<%= @ssl_stomp_port %>]}
185+
<%- end -%>
186+
]}
187+
<% end -%>
188+
<%- if @ldap_auth -%>,
189+
% Configure the LDAP authentication plugin
190+
{rabbitmq_auth_backend_ldap, [
191+
{other_bind, <%= @ldap_other_bind %>},
192+
<% if @ldap_server.class == Array -%>
193+
{servers, <%= @ldap_server %>},
194+
<% else -%>
195+
{servers, ["<%= @ldap_server %>"]},
196+
<% end -%>
197+
<% if @ldap_user_dn_pattern -%>
198+
{user_dn_pattern, "<%= @ldap_user_dn_pattern %>"},
199+
<%- end -%>
200+
{use_ssl, <%= @ldap_use_ssl %>},
201+
{port, <%= @ldap_port %>},
202+
<% if @ldap_config_variables -%>
203+
<%- @ldap_config_variables.keys.sort.each do |key| -%>
204+
{<%= key %>, <%= @ldap_config_variables[key] %>},
205+
<%- end -%>
206+
<%- end -%>
207+
{log, <%= @ldap_log %>}
208+
]}
209+
<%- end -%>
210+
<%- if @config_shovel and not @config_shovel_statics.empty? -%>,
211+
{rabbitmq_shovel,
212+
[{shovels,[
213+
<%= @config_shovel_statics.sort.map{|k,v| "{#{k},[#{v}]}"}.join(",\n ") %>
214+
]}]}
215+
<%- end -%>
216+
<%- if @config_additional_variables and not @config_additional_variables.empty? -%>,
217+
% Additional config
218+
<%- @config_additional_variables.keys.sort.each do |key| -%>
219+
{<%= key %>, <%= @config_additional_variables[key] %>}<%- if key != @config_additional_variables.keys.sort.last %>,<% end %>
220+
<%- end -%>
221+
<%- end -%>
222+
].
223+
% EOF

0 commit comments

Comments
 (0)