# class Chef::Knife::SslFetch

### Public Class Methods

new(*args) click to toggle source
Calls superclass method

    # File lib/chef/knife/ssl_fetch.rb, line 35
    def initialize(*args)
      super
      @uri = nil
    end

### Public Instance Methods

cn_of(certificate) click to toggle source

    # File lib/chef/knife/ssl_fetch.rb, line 89
    def cn_of(certificate)
      subject = certificate.subject
      cn_field_tuple = subject.to_a.find {|field| field[0] == "CN" }
      cn_field_tuple[1]
    end

configuration() click to toggle source

    # File lib/chef/knife/ssl_fetch.rb, line 108
    def configuration
      Chef::Config
    end

given_uri() click to toggle source

    # File lib/chef/knife/ssl_fetch.rb, line 47
    def given_uri
      (name_args[0] or Chef::Config.chef_server_url)
    end

host() click to toggle source

    # File lib/chef/knife/ssl_fetch.rb, line 51
    def host
      uri.host
    end

invalid_uri!() click to toggle source

    # File lib/chef/knife/ssl_fetch.rb, line 67
    def invalid_uri!
      ui.error("Given URI: `#{given_uri}' is invalid")
      show_usage
      exit 1
    end

normalize_cn(cn) click to toggle source

Convert the CN of a certificate into something that will work well as a filename. To do so, all `*` characters are converted to the string “wildcard” and then all characters other than alphanumeric and hypen characters are converted to underscores. NOTE: There is some confustion about what the CN will contain when using internationalized domain names. RFC 6125 mandates that the ascii representation be used, but it is not clear whether this is followed in practice. tools.ietf.org/html/rfc6125#section-6.4.2

    # File lib/chef/knife/ssl_fetch.rb, line 104
    def normalize_cn(cn)
      cn.gsub("*", "wildcard").gsub(/[^[:alnum:]\-]/, '_')
    end

noverify_peer_ssl_context() click to toggle source

    # File lib/chef/knife/ssl_fetch.rb, line 80
    def noverify_peer_ssl_context
      @noverify_peer_ssl_context ||= begin
        noverify_peer_context = OpenSSL::SSL::SSLContext.new
        noverify_peer_context.verify_mode = OpenSSL::SSL::VERIFY_NONE
        noverify_peer_context
      end
    end

port() click to toggle source

    # File lib/chef/knife/ssl_fetch.rb, line 55
    def port
      uri.port
    end

remote_cert_chain() click to toggle source

    # File lib/chef/knife/ssl_fetch.rb, line 73
    def remote_cert_chain
      tcp_connection = TCPSocket.new(host, port)
      shady_ssl_connection = OpenSSL::SSL::SSLSocket.new(tcp_connection, noverify_peer_ssl_context)
      shady_ssl_connection.connect
      shady_ssl_connection.peer_cert_chain
    end

run() click to toggle source

    # File lib/chef/knife/ssl_fetch.rb, line 126
          def run
            validate_uri
            ui.warn("Certificates from #{host} will be fetched and placed in your trusted_cert
    directory (#{trusted_certs_dir}).

    Knife has no means to verify these are the correct certificates. You should
    verify the authenticity of these certificates after downloading.

    ")
            remote_cert_chain.each do |cert|
              write_cert(cert)
            end
          end

trusted_certs_dir() click to toggle source

    # File lib/chef/knife/ssl_fetch.rb, line 112
    def trusted_certs_dir
      configuration.trusted_certs_dir
    end

uri() click to toggle source

    # File lib/chef/knife/ssl_fetch.rb, line 40
    def uri
      @uri ||= begin
        Chef::Log.debug("Checking SSL cert on #{given_uri}")
        URI.parse(given_uri)
      end
    end

validate_uri() click to toggle source

    # File lib/chef/knife/ssl_fetch.rb, line 59
    def validate_uri
      unless host && port
        invalid_uri!
      end
    rescue URI::Error
      invalid_uri!
    end

write_cert(cert) click to toggle source

    # File lib/chef/knife/ssl_fetch.rb, line 116
    def write_cert(cert)
      FileUtils.mkdir_p(trusted_certs_dir)
      cn = cn_of(cert)
      filename = File.join(trusted_certs_dir, "#{normalize_cn(cn)}.crt")
      ui.msg("Adding certificate for #{cn} in #{filename}")
      File.open(filename, File::CREAT|File::TRUNC|File::RDWR, 0644) do |f|
        f.print(cert.to_s)
      end
    end