Skip to content

Commit

Permalink
Remove feature that exports client certs and keys to facts
Browse files Browse the repository at this point in the history
Exporting private keys via facts is unsafe as facts should not contain
sensitive information, as they might be accessible from undesired
systems (eg. dashboards)

This feature has been added in commit voxpupuli/puppet-openvpn@d0fd9f3 as a result of
voxpupuli#231

This commit reverts the changes and removes the added feature for
security reasons.
  • Loading branch information
TheBigLee committed Feb 12, 2020
1 parent 7845149 commit 3fe8b02
Show file tree
Hide file tree
Showing 9 changed files with 0 additions and 365 deletions.
62 changes: 0 additions & 62 deletions lib/facter/openvpn.rb

This file was deleted.

42 changes: 0 additions & 42 deletions manifests/deploy/client.pp

This file was deleted.

76 changes: 0 additions & 76 deletions manifests/deploy/export.pp

This file was deleted.

8 changes: 0 additions & 8 deletions manifests/deploy/install.pp

This file was deleted.

15 changes: 0 additions & 15 deletions manifests/deploy/prepare.pp

This file was deleted.

13 changes: 0 additions & 13 deletions manifests/deploy/service.pp

This file was deleted.

45 changes: 0 additions & 45 deletions spec/defines/openvpn_deploy_client_spec.rb

This file was deleted.

46 changes: 0 additions & 46 deletions spec/defines/openvpn_deploy_export_spec.rb

This file was deleted.

58 changes: 0 additions & 58 deletions spec/unit/openvpn_module_spec.rb
Original file line number Diff line number Diff line change
Expand Up @@ -42,62 +42,4 @@
it { is_expected.to eq('') }
end
end

describe '.client_certs' do
subject(:path) { described_class.client_certs }

before do
allow(Facter.fact(:osfamily)).to receive(:value) { osfamily }
end

after { Facter.clear }

context 'with Openvpn installed' do
let(:osfamily) { 'Linux' }

before do
allow(Dir).to receive(:entries).and_call_original
allow(Dir).to receive(:entries).with('/etc/openvpn').and_return(%w[. .. test-server])
allow(Dir).to receive(:entries).with('/etc/openvpn/test-server').and_return(%w[. .. download-configs])
allow(Dir).to receive(:entries).with('/etc/openvpn/test-server/download-configs').and_return(%w[. .. test2 client3 other4])
allow(File).to receive(:directory?).and_call_original
allow(File).to receive(:directory?).with('/etc/openvpn').and_return(true)
allow(File).to receive(:directory?).with('/etc/openvpn/test-server').and_return(true)
allow(File).to receive(:directory?).with('/etc/openvpn/test-server/download-configs').and_return(true)
allow(File).to receive(:directory?).with('/etc/openvpn/test-server/download-configs/test2').and_return(true)
allow(File).to receive(:open).with('/etc/openvpn/test-server/download-configs/test2/test2.conf', 'r').and_return(StringIO.new('conf'))
allow(File).to receive(:open).with('/etc/openvpn/test-server/download-configs/test2/keys/test2/ca.crt', 'r').and_return(StringIO.new('ca'))
allow(File).to receive(:open).with('/etc/openvpn/test-server/download-configs/test2/keys/test2/test2.crt', 'r').and_return(StringIO.new('crt'))
allow(File).to receive(:open).with('/etc/openvpn/test-server/download-configs/test2/keys/test2/test2.key', 'r').and_return(StringIO.new('key'))
end
it { is_expected.to eq('test-server' => { 'test2' => { 'conf' => 'conf', 'ca' => 'ca', 'crt' => 'crt', 'key' => 'key' } }) }

context 'with tsl_auth enabled' do
before do
allow(File).to receive(:exist?).with('/etc/openvpn/test-server/download-configs/test2/keys/test2/ta.key').and_return(true)
allow(File).to receive(:open).with('/etc/openvpn/test-server/download-configs/test2/keys/test2/ta.key', 'r').and_return(StringIO.new('ta'))
end

it { is_expected.to eq('test-server' => { 'test2' => { 'conf' => 'conf', 'ca' => 'ca', 'crt' => 'crt', 'key' => 'key', 'ta' => 'ta' } }) }
end
end
end

describe 'openvpn fact' do
subject(:fact) { Facter.fact('openvpn').value }

before do
# Ensure we're populating Facter's internal collection with our Fact
described_class.add_facts
end

# A regular ol' RSpec example
it { is_expected.to eq({}) }

after do
# Make sure we're clearing out Facter every time
Facter.clear
Facter.clear_messages
end
end
end

0 comments on commit 3fe8b02

Please sign in to comment.