Add ssl_verify_client

This adds the ssl_verify_client parameter that
is passed down to the apache::vhost resource.

Without this being set, as of puppetlabs-apache 2.1.0,
the horizon_ca parameter will be ignored and you won't
get the CA/intermediate set in the vhost configuration. [1]

This was introduced a long long time ago which means we should
backport this or SSL is semi-broken when using this module.

[1] https://github.com/puppetlabs/puppetlabs-apache/blob/2.1.0/CHANGELOG.md#changed

Change-Id: I9f60f266400a6d0ccfad757aa33009929c02cde7
(cherry picked from commit 841d4d734e)
This commit is contained in:
Tobias Urdin 2020-10-14 10:24:07 +02:00
parent 6eb4f5fc12
commit d0efac2714
5 changed files with 41 additions and 15 deletions

View File

@ -217,6 +217,10 @@
# [*horizon_ca*]
# (required with listen_ssl) CA certificate to use for SSL support.
#
# [*ssl_verify_client*]
# Set the Certificate verification level for Client Authentication.
# Defaults to undef
#
# [*wsgi_processes*]
# (optional) Number of Horizon processes to spawn
# Defaults to $::os_workers
@ -498,6 +502,7 @@ class horizon(
$horizon_cert = undef,
$horizon_key = undef,
$horizon_ca = undef,
$ssl_verify_client = undef,
$wsgi_processes = $::os_workers,
$wsgi_threads = '1',
$compress_offline = true,
@ -677,6 +682,7 @@ class horizon(
horizon_cert => $horizon_cert,
horizon_key => $horizon_key,
horizon_ca => $horizon_ca,
ssl_verify_client => $ssl_verify_client,
wsgi_processes => $wsgi_processes,
wsgi_threads => $wsgi_threads,
extra_params => $vhost_extra_params,

View File

@ -38,6 +38,10 @@
# [*horizon_ca*]
# (required with listen_ssl) CA certificate to use for SSL support.
#
# [*ssl_verify_client*]
# Set the Certificate verification level for Client Authentication.
# Defaults to undef
#
# [*wsgi_processes*]
# (optional) Number of Horizon processes to spawn
# Defaults to $::os_workers
@ -102,6 +106,7 @@ class horizon::wsgi::apache (
$horizon_cert = undef,
$horizon_key = undef,
$horizon_ca = undef,
$ssl_verify_client = undef,
$wsgi_processes = $::os_workers,
$wsgi_threads = '1',
$custom_wsgi_process_options = {},
@ -236,6 +241,7 @@ class horizon::wsgi::apache (
ssl_cert => $horizon_cert,
ssl_key => $horizon_key,
ssl_ca => $horizon_ca,
ssl_verify_client => $ssl_verify_client,
wsgi_script_aliases => hash([$script_url, $::horizon::params::django_wsgi]),
wsgi_daemon_process => $::horizon::params::wsgi_group,
wsgi_daemon_process_options => $wsgi_daemon_process_options,

View File

@ -0,0 +1,10 @@
---
features:
- |
Added the ssl_verify_client parameter to init class and horizon::wsgi::apache
that is passed down to the created apache::vhost resource.
upgrade:
- |
The puppetlabs-apache module 2.1.0 introduced a change where ssl_verify_client
is required otherwise the SSL CA certificate passed to the horizon module using
the horizon_ca parameter is ignored.

View File

@ -344,21 +344,23 @@ describe 'horizon' do
context 'with ssl enabled' do
before do
params.merge!({
:listen_ssl => true,
:servername => 'some.host.tld',
:horizon_cert => '/etc/pki/tls/certs/httpd.crt',
:horizon_key => '/etc/pki/tls/private/httpd.key',
:horizon_ca => '/etc/pki/tls/certs/ca.crt',
:listen_ssl => true,
:servername => 'some.host.tld',
:horizon_cert => '/etc/pki/tls/certs/httpd.crt',
:horizon_key => '/etc/pki/tls/private/httpd.key',
:horizon_ca => '/etc/pki/tls/certs/ca.crt',
:ssl_verify_client => 'optional',
})
end
it 'configures apache' do
is_expected.to contain_class('horizon::wsgi::apache').with({
:bind_address => nil,
:listen_ssl => true,
:horizon_cert => '/etc/pki/tls/certs/httpd.crt',
:horizon_key => '/etc/pki/tls/private/httpd.key',
:horizon_ca => '/etc/pki/tls/certs/ca.crt',
:bind_address => nil,
:listen_ssl => true,
:horizon_cert => '/etc/pki/tls/certs/httpd.crt',
:horizon_key => '/etc/pki/tls/private/httpd.key',
:horizon_ca => '/etc/pki/tls/certs/ca.crt',
:ssl_verify_client => 'optional',
})
end
end

View File

@ -125,11 +125,12 @@ describe 'horizon::wsgi::apache' do
context 'with ssl enabled' do
before do
params.merge!({
:listen_ssl => true,
:ssl_redirect => true,
:horizon_cert => '/etc/pki/tls/certs/httpd.crt',
:horizon_key => '/etc/pki/tls/private/httpd.key',
:horizon_ca => '/etc/pki/tls/certs/ca.crt',
:listen_ssl => true,
:ssl_redirect => true,
:horizon_cert => '/etc/pki/tls/certs/httpd.crt',
:horizon_key => '/etc/pki/tls/private/httpd.key',
:horizon_ca => '/etc/pki/tls/certs/ca.crt',
:ssl_verify_client => 'optional',
})
end
@ -148,6 +149,7 @@ describe 'horizon::wsgi::apache' do
:ssl_cert => '/etc/pki/tls/certs/httpd.crt',
:ssl_key => '/etc/pki/tls/private/httpd.key',
:ssl_ca => '/etc/pki/tls/certs/ca.crt',
:ssl_verify_client => 'optional',
:redirectmatch_status => 'permanent',
:redirectmatch_regexp => '^/$',
:redirectmatch_dest => platforms_params[:root_url],