Changeset 9096 for lang/perl/Punc/branches

Timestamp:

04/08/08 00:07:10 (8 months ago)

Author:

mizzy

Message:

lang/perl/Punc: SSL まわり実装（まだ途中だけど一度commit）

Location:

lang/perl/Punc/branches/ssl

Files:

• . (modified) (1 prop)
• bin (modified) (1 prop)
• bin/puncd (modified) (1 diff)
• bin/puncmasterd (modified) (2 diffs)
• etc (modified) (1 prop)
• etc/puncd.yaml (added)
• lib/Punc.pm (modified) (1 diff)
• lib/Punc/ConfigLoader.pm (added)
• lib/Punc/Master/CA.pm (added)
• lib/Punc/Master/CSR.pm (added)
• lib/Punc/Master/Daemon.pm (modified) (5 diffs)
• lib/Punc/Slave/Daemon.pm (modified) (1 diff)
• lib/Punc/Util.pm (deleted)
• t/97_podspell.t (modified) (1 diff)

lang/perl/Punc/branches/ssl/bin/puncd

@@ -6 +6 @@
 use File::Spec;
 use lib File::Spec->catdir("$FindBin::Bin/..", 'lib');
+use Punc;
 use Punc::Slave::Daemon;
 use Getopt::Long;
-
-my $port = 7080;
+use Punc::ConfigLoader;
+use File::Path;
 
 GetOptions(
-    '--port=s' => $port,
+    '--port=i'    => \my $port,
+    '--confdir=s' => \my $confdir,
 );
 
-my $daemon = Punc::Slave::Daemon->new({ port => $port });
+$port    ||= 7080;
+$confdir ||= "$FindBin::Bin/../etc";
+
+mkpath($confdir) unless -d $confdir;
+
+my $yaml = File::Spec->catfile($confdir, 'puncd.yaml');
+
+my $conf = -f $yaml ? Punc::ConfigLoader->new->load($yaml) : {};
+
+my $daemon = Punc::Slave::Daemon->new({
+    port    => $port,
+    confdir => $confdir,
+    conf    => $conf,
+    context => Punc->new->context,
+});
+
 $daemon->run;
-
-
-

lang/perl/Punc/branches/ssl/bin/puncmasterd

@@ -6 +6 @@
 use File::Spec;
 use lib File::Spec->catdir("$FindBin::Bin/..", 'lib');
+use Punc;
 use Punc::Master::Daemon;
 use Getopt::Long;
@@ -20 +21 @@
     port    => $port,
     confdir => $confdir,
+    context => Punc->new->context,
 });
 

lang/perl/Punc/branches/ssl/lib/Punc.pm

@@ -4 +4 @@
 use warnings;
 our $VERSION = '0.01';
+
+use Pfacter;
+use UNIVERSAL::require;
+
+my $context;
+sub context {
+    $context = $_[1] if $_[1];
+    return $context;
+}
+
+sub new {
+    my $class = shift;
+    my $self = bless {}, $class;
+    $self->context($self);
+}
+
+sub fact {
+    my ( $self, $fact ) = @_;
+
+    foreach ( qw( kernel operatingsystem hostname domain ) ) {
+        $self->{'pfact'}->{$_} = $self->_pfact( $_ );
+    }
+
+    return $self->_pfact($fact);
+}
+
+sub _pfact {
+    my $self   = shift;
+    my $module = shift;
+
+    return $self->{'pfact'}->{lc( $module )}
+        if $self->{'pfact'}->{lc( $module )};
+
+    $module = 'Pfacter::' . lc $module;
+    $module->require or die $@;
+
+    my $pfact = $module->pfact($self);
+    chomp $pfact;
+    return $pfact;
+}
 
 1;

lang/perl/Punc/branches/ssl/lib/Punc/Master/Daemon.pm

@@ -4 +4 @@
 use warnings;
 use base qw( Punc::Daemon );
-use Punc::Util;
 use File::Spec;
+use File::Path;
+use Punc::Master::CA;
 use Crypt::OpenSSL::CA;
 use Crypt::OpenSSL::RSA;
@@ -13 +14 @@
     my $self = $class->SUPER::new(@_);
 
-    $self->_find_or_create_ca_cert;
+    $self->{ca} = Punc::Master::CA->new;
+
+    $self->_find_or_create_ca_cert($self->{context});
 
     return $self;
@@ -19 +22 @@
 
 sub _find_or_create_ca_cert {
-    my $self = shift;
-    my $cert = File::Spec->catfile($self->{confdir}, 'ca.cert');
+    my ( $self, $c ) = @_;
+
+    $self->{ssldir} = File::Spec->catdir($self->{confdir}, 'ssl');
+    $self->{cadir}  = File::Spec->catdir($self->{ssldir}, 'ca');
+    unless ( -d $self->{cadir} ) {
+        mkpath($self->{cadir});
+        chmod 0700, $self->{cadir};
+    }
+
+    my $cert = File::Spec->catfile($self->{cadir}, 'ca.cert');
     unless ( -f $cert ) {
-        $self->_create_self_signed_cert;
+        $self->_create_self_signed_cert($c);
     }
 }
 
 sub _create_self_signed_cert {
-    my $self = shift;
+    my ( $self, $c ) = @_;
 
+    # 鍵作成
     my $rsa = Crypt::OpenSSL::RSA->generate_key(1024);
-
-    open my $out, '>', File::Spec->catfile($self->{confdir}, 'ca.key') or die $!;
+    open my $out, '>', File::Spec->catfile($self->{cadir}, 'ca.key') or die $!;
     print $out $rsa->get_private_key_string;
     close $out;
 
-    my $dn      = Crypt::OpenSSL::CA::X509_NAME->new( CN => Punc::Util->fact('fqdn') );
     my $privkey = Crypt::OpenSSL::CA::PrivateKey->parse($rsa->get_private_key_string);
     my $pubkey  = $privkey->get_public_key;
 
+    # 自己署名証明書作成
+    my $dn   = Crypt::OpenSSL::CA::X509_NAME->new( CN => $c->fact('fqdn') );
     my $x509 = Crypt::OpenSSL::CA::X509->new($pubkey);
 
@@ -45 +57 @@
     $x509->set_issuer_DN($dn);
 
+    ### TODO: 有効期限の設定
+
     my $pem = $x509->sign($privkey, 'sha1');
-    open my $cert, '>', File::Spec->catfile($self->{confdir}, 'ca.cert') or die $!;
+    open my $cert, '>', File::Spec->catfile($self->{cadir}, 'ca.cert') or die $!;
     print $cert $pem;
     close $cert;
@@ -55 +69 @@
     my ( $self, $module, $method, $args ) = @_;
 
-    my $res;
-    if ( $method eq 'description' ) {
-        $res = $module->description;
-    }
-    else {
-        my $obj = $module->new;
-        $res = $obj->exec($method, $args);
-    }
+    # CSR 取得
+    my $csr = $args->{csr};
 
-    return $res;
+    my $csrdir = File::Spec->catdir($self->{ssldir}, 'csrs');
+    mkpath($csrdir) unless -d $csrdir;
+
+    Punc::Master::CA->save_csr({
+        csr => $csr,
+        dir => $csrdir,
+    });
+
+
+    ### TODO: 一度自己署名証明書をつくってもらって、sign しなおした方が早い？
+    ### TODO: 署名は puncmaster-ca コマンドでやるので、ここではやらない
+    ### TODO: 自動署名
+
 }
 
+
 1;

lang/perl/Punc/branches/ssl/lib/Punc/Slave/Daemon.pm

@@ -3 +3 @@
 use strict;
 use warnings;
+use File::Spec;
+use Crypt::OpenSSL::PKCS10 qw( :const );
+use JSON::RPC::Client;
+use JSON;
+use File::Path;
 
 use base qw( Punc::Daemon );
+
+sub new {
+    my $class = shift;
+    my $self = $class->SUPER::new(@_);
+
+    $self->_find_or_request_cert($self->{context});
+
+    return $self;
+}
+
+sub _find_or_request_cert {
+    my ( $self, $c ) = @_;
+
+    $self->{ssldir}  = File::Spec->catdir($self->{confdir}, 'ssl');
+    $self->{certdir} = File::Spec->catdir($self->{ssldir}, 'certs');
+    $self->{keydir} = File::Spec->catdir($self->{ssldir}, 'keys');
+    $self->{csrdir} = File::Spec->catdir($self->{ssldir}, 'csrs');
+
+    mkpath($self->{certdir}) unless -d $self->{certdir};
+    mkpath($self->{csrdir}) unless -d $self->{csrdir};
+    unless ( -d $self->{keydir} ) {
+        mkpath($self->{keydir});
+        chmod 0700, $self->{keydir};
+    }
+
+    my $cert = File::Spec->catfile($self->{certdir}, $c->fact('fqdn') . '.cert');
+    unless ( -f $cert ) {
+        $self->_request_cert($c);
+    }
+}
+
+sub _request_cert {
+    my ( $self, $c ) = @_;
+
+    my $req  = Crypt::OpenSSL::PKCS10->new;
+    my $fqdn = $c->fact('fqdn');
+    $req->set_subject("/CN=$fqdn");
+    $req->sign();
+
+    $req->write_pem_req( File::Spec->catfile( $self->{csrdir}, "${fqdn}.csr" ) );
+    $req->write_pem_pk( File::Spec->catfile( $self->{keydir}, "${fqdn}.key" ) );
+
+    my $client = JSON::RPC::Client->new;
+    my $host = $self->{conf}->{puncmaster_host} || 'localhost';
+    my $port = $self->{conf}->{puncmaster_port} || 7081;
+    my $url    = "http://$host:$port/cert";
+
+    my $callobj = {
+        method  => 'request',
+        params  => { csr => $req->get_pem_req() },
+    };
+
+    my $res = $client->call($url, $callobj);
+
+    if( $res ) {
+        warn $res->content
+    }
+    else {
+        warn 'error';
+    }
+}
 
 sub handle_request {

lang/perl/Punc/branches/ssl/t/97_podspell.t

@@ -8 +8 @@
 Gosuke Miyashita
 Punc
+TODO
+Facter
+punc
+