Browse Source

Add ssl_verify_client

This adds the ssl_verify_client parameter that
is passed down to the apache::vhost resource.

Without this being set, as of puppetlabs-apache 2.1.0,
the horizon_ca parameter will be ignored and you won't
get the CA/intermediate set in the vhost configuration. [1]

This was introduced a long long time ago which means we should
backport this or SSL is semi-broken when using this module.

[1] https://github.com/puppetlabs/puppetlabs-apache/blob/2.1.0/CHANGELOG.md#changed

Change-Id: I9f60f266400a6d0ccfad757aa33009929c02cde7
(cherry picked from commit 841d4d734e)
changes/27/758127/1
Tobias Urdin 3 months ago
parent
commit
2ae5f46740
5 changed files with 41 additions and 15 deletions
  1. +6
    -0
      manifests/init.pp
  2. +6
    -0
      manifests/wsgi/apache.pp
  3. +10
    -0
      releasenotes/notes/add-ssl_verify_client-3e2bc9a7f1d4291a.yaml
  4. +12
    -10
      spec/classes/horizon_init_spec.rb
  5. +7
    -5
      spec/classes/horizon_wsgi_apache_spec.rb

+ 6
- 0
manifests/init.pp View File

@@ -217,6 +217,10 @@
# [*horizon_ca*]
# (required with listen_ssl) CA certificate to use for SSL support.
#
# [*ssl_verify_client*]
# Set the Certificate verification level for Client Authentication.
# Defaults to undef
#
# [*wsgi_processes*]
# (optional) Number of Horizon processes to spawn
# Defaults to $::os_workers
@@ -498,6 +502,7 @@ class horizon(
$horizon_cert = undef,
$horizon_key = undef,
$horizon_ca = undef,
$ssl_verify_client = undef,
$wsgi_processes = $::os_workers,
$wsgi_threads = '1',
$compress_offline = true,
@@ -677,6 +682,7 @@ class horizon(
horizon_cert => $horizon_cert,
horizon_key => $horizon_key,
horizon_ca => $horizon_ca,
ssl_verify_client => $ssl_verify_client,
wsgi_processes => $wsgi_processes,
wsgi_threads => $wsgi_threads,
extra_params => $vhost_extra_params,


+ 6
- 0
manifests/wsgi/apache.pp View File

@@ -38,6 +38,10 @@
# [*horizon_ca*]
# (required with listen_ssl) CA certificate to use for SSL support.
#
# [*ssl_verify_client*]
# Set the Certificate verification level for Client Authentication.
# Defaults to undef
#
# [*wsgi_processes*]
# (optional) Number of Horizon processes to spawn
# Defaults to $::os_workers
@@ -102,6 +106,7 @@ class horizon::wsgi::apache (
$horizon_cert = undef,
$horizon_key = undef,
$horizon_ca = undef,
$ssl_verify_client = undef,
$wsgi_processes = $::os_workers,
$wsgi_threads = '1',
$custom_wsgi_process_options = {},
@@ -236,6 +241,7 @@ class horizon::wsgi::apache (
ssl_cert => $horizon_cert,
ssl_key => $horizon_key,
ssl_ca => $horizon_ca,
ssl_verify_client => $ssl_verify_client,
wsgi_script_aliases => hash([$script_url, $::horizon::params::django_wsgi]),
wsgi_daemon_process => $::horizon::params::wsgi_group,
wsgi_daemon_process_options => $wsgi_daemon_process_options,


+ 10
- 0
releasenotes/notes/add-ssl_verify_client-3e2bc9a7f1d4291a.yaml View File

@@ -0,0 +1,10 @@
---
features:
- |
Added the ssl_verify_client parameter to init class and horizon::wsgi::apache
that is passed down to the created apache::vhost resource.
upgrade:
- |
The puppetlabs-apache module 2.1.0 introduced a change where ssl_verify_client
is required otherwise the SSL CA certificate passed to the horizon module using
the horizon_ca parameter is ignored.

+ 12
- 10
spec/classes/horizon_init_spec.rb View File

@@ -343,21 +343,23 @@ describe 'horizon' do
context 'with ssl enabled' do
before do
params.merge!({
:listen_ssl => true,
:servername => 'some.host.tld',
:horizon_cert => '/etc/pki/tls/certs/httpd.crt',
:horizon_key => '/etc/pki/tls/private/httpd.key',
:horizon_ca => '/etc/pki/tls/certs/ca.crt',
:listen_ssl => true,
:servername => 'some.host.tld',
:horizon_cert => '/etc/pki/tls/certs/httpd.crt',
:horizon_key => '/etc/pki/tls/private/httpd.key',
:horizon_ca => '/etc/pki/tls/certs/ca.crt',
:ssl_verify_client => 'optional',
})
end

it 'configures apache' do
is_expected.to contain_class('horizon::wsgi::apache').with({
:bind_address => nil,
:listen_ssl => true,
:horizon_cert => '/etc/pki/tls/certs/httpd.crt',
:horizon_key => '/etc/pki/tls/private/httpd.key',
:horizon_ca => '/etc/pki/tls/certs/ca.crt',
:bind_address => nil,
:listen_ssl => true,
:horizon_cert => '/etc/pki/tls/certs/httpd.crt',
:horizon_key => '/etc/pki/tls/private/httpd.key',
:horizon_ca => '/etc/pki/tls/certs/ca.crt',
:ssl_verify_client => 'optional',
})
end
end


+ 7
- 5
spec/classes/horizon_wsgi_apache_spec.rb View File

@@ -125,11 +125,12 @@ describe 'horizon::wsgi::apache' do
context 'with ssl enabled' do
before do
params.merge!({
:listen_ssl => true,
:ssl_redirect => true,
:horizon_cert => '/etc/pki/tls/certs/httpd.crt',
:horizon_key => '/etc/pki/tls/private/httpd.key',
:horizon_ca => '/etc/pki/tls/certs/ca.crt',
:listen_ssl => true,
:ssl_redirect => true,
:horizon_cert => '/etc/pki/tls/certs/httpd.crt',
:horizon_key => '/etc/pki/tls/private/httpd.key',
:horizon_ca => '/etc/pki/tls/certs/ca.crt',
:ssl_verify_client => 'optional',
})
end

@@ -148,6 +149,7 @@ describe 'horizon::wsgi::apache' do
:ssl_cert => '/etc/pki/tls/certs/httpd.crt',
:ssl_key => '/etc/pki/tls/private/httpd.key',
:ssl_ca => '/etc/pki/tls/certs/ca.crt',
:ssl_verify_client => 'optional',
:redirectmatch_status => 'permanent',
:redirectmatch_regexp => '^/$',
:redirectmatch_dest => platforms_params[:root_url],


Loading…
Cancel
Save