Rewrote SSLCA as Cfg handler.

This adds encryption support to SSL key creation (much like SSH
private keys), and the ability to generate keys and certs that are
specific to groups, instead of just to hosts.  It also moves the SSLCA
data (the XML files describing keys and certs as well as the keys and
certs themselves) into the Cfg tree, rather than off in their own
separate place.

tools/upgrade/1.4/migrate_sslca.py can be used to migrate to the new
format.

This also adds XMLCfgCreator, a CfgCreator that makes it easier to
create data based on XML descriptions of it (which is exactly what the
SSH key and SSL CA creators do), including built-in support for host-
and group-specific data, encryption, and so on.

3 files changed, 131 insertions, 129 deletions

diff --git a/testsuite/Testsrc/Testlib/TestServer/TestPlugin/Testhelpers.py b/testsuite/Testsrc/Testlib/TestServer/TestPlugin/Testhelpers.py
index 7006e29e3..7515b5e97 100644
--- a/testsuite/Testsrc/Testlib/TestServer/TestPlugin/Testhelpers.py
+++ b/testsuite/Testsrc/Testlib/TestServer/TestPlugin/Testhelpers.py
@@ -1375,10 +1375,10 @@ class TestSpecificData(TestDebuggable):
         sd = self.get_obj()
         sd.handle_event(event)
         self.assertFalse(mock_open.called)
-        if hasattr(sd, 'data'):
-            self.assertIsNone(sd.data)
-        else:
+        try:
             self.assertFalse(hasattr(sd, 'data'))
+        except AssertionError:
+            self.assertIsNone(sd.data)
 
         event = Mock()
         mock_open.return_value.read.return_value = "test"
diff --git a/testsuite/Testsrc/Testlib/TestServer/TestPlugins/TestCfg/TestCfgPrivateKeyCreator.py b/testsuite/Testsrc/Testlib/TestServer/TestPlugins/TestCfg/TestCfgPrivateKeyCreator.py
index c4961db1c..ea0853a8d 100644
--- a/testsuite/Testsrc/Testlib/TestServer/TestPlugins/TestCfg/TestCfgPrivateKeyCreator.py
+++ b/testsuite/Testsrc/Testlib/TestServer/TestPlugins/TestCfg/TestCfgPrivateKeyCreator.py
@@ -33,15 +33,6 @@ class TestCfgPrivateKeyCreator(TestCfgCreator, TestStructFile):
     def get_obj(self, name=None, fam=None):
         return TestCfgCreator.get_obj(self, name=name)
 
-    @patch("Bcfg2.Server.Plugins.Cfg.CfgCreator.handle_event")
-    @patch("Bcfg2.Server.Plugin.helpers.StructFile.HandleEvent")
-    def test_handle_event(self, mock_HandleEvent, mock_handle_event):
-        pkc = self.get_obj()
-        evt = Mock()
-        pkc.handle_event(evt)
-        mock_HandleEvent.assert_called_with(pkc, evt)
-        mock_handle_event.assert_called_with(pkc, evt)
-
     @patch("shutil.rmtree")
     @patch("tempfile.mkdtemp")
     def test__gen_keypair(self, mock_mkdtemp, mock_rmtree):
@@ -90,57 +81,6 @@ class TestCfgPrivateKeyCreator(TestCfgCreator, TestStructFile):
         self.assertRaises(CfgCreationError, pkc._gen_keypair, metadata)
         mock_rmtree.assert_called_with(datastore)
 
-    def test_get_specificity(self):
-        pkc = self.get_obj()
-        pkc.XMLMatch = Mock()
-
-        metadata = Mock()
-
-        def reset():
-            pkc.XMLMatch.reset_mock()
-            metadata.group_in_category.reset_mock()
-
-        Bcfg2.Options.setup.sshkeys_category = None
-        pkc.XMLMatch.return_value = lxml.etree.Element("PrivateKey")
-        self.assertItemsEqual(pkc.get_specificity(metadata),
-                              dict(host=metadata.hostname))
-
-        Bcfg2.Options.setup.sshkeys_category = "foo"
-        pkc.XMLMatch.return_value = lxml.etree.Element("PrivateKey")
-        self.assertItemsEqual(pkc.get_specificity(metadata),
-                              dict(group=metadata.group_in_category.return_value,
-                                   prio=50))
-        metadata.group_in_category.assert_called_with("foo")
-
-        reset()
-        pkc.XMLMatch.return_value = lxml.etree.Element("PrivateKey",
-                                                       perhost="true")
-        self.assertItemsEqual(pkc.get_specificity(metadata),
-                              dict(host=metadata.hostname))
-
-        reset()
-        pkc.XMLMatch.return_value = lxml.etree.Element("PrivateKey",
-                                                       category="bar")
-        self.assertItemsEqual(pkc.get_specificity(metadata),
-                              dict(group=metadata.group_in_category.return_value,
-                                   prio=50))
-        metadata.group_in_category.assert_called_with("bar")
-
-        reset()
-        pkc.XMLMatch.return_value = lxml.etree.Element("PrivateKey",
-                                                       prio="10")
-        self.assertItemsEqual(pkc.get_specificity(metadata),
-                              dict(group=metadata.group_in_category.return_value,
-                                   prio=10))
-        metadata.group_in_category.assert_called_with("foo")
-
-        reset()
-        pkc.XMLMatch.return_value = lxml.etree.Element("PrivateKey")
-        metadata.group_in_category.return_value = ''
-        self.assertItemsEqual(pkc.get_specificity(metadata),
-                              dict(host=metadata.hostname))
-        metadata.group_in_category.assert_called_with("foo")
-
     @patch("shutil.rmtree")
     @patch("%s.open" % builtins)
     def test_create_data(self, mock_open, mock_rmtree):
@@ -179,67 +119,33 @@ class TestCfgPrivateKeyCreator(TestCfgCreator, TestStructFile):
             mock_open.return_value.read.side_effect = open_read_rv
 
         reset()
-        passphrase = "Bcfg2.Server.Plugins.Cfg.CfgPrivateKeyCreator.CfgPrivateKeyCreator.passphrase"
-
-        @patch(passphrase, None)
-        def inner():
-            self.assertEqual(pkc.create_data(entry, metadata), "privatekey")
-            pkc.XMLMatch.assert_called_with(metadata)
-            pkc.get_specificity.assert_called_with(metadata,
-                                                   pkc.XMLMatch.return_value)
-            pkc._gen_keypair.assert_called_with(metadata,
-                                                pkc.XMLMatch.return_value)
-            self.assertItemsEqual(mock_open.call_args_list,
-                                  [call(privkey + ".pub"), call(privkey)])
-            pkc.pubkey_creator.get_filename.assert_called_with(group="foo")
-            pkc.pubkey_creator.write_data.assert_called_with(
-                "ssh-rsa publickey pubkey.filename\n", group="foo")
-            pkc.write_data.assert_called_with("privatekey", group="foo")
-            mock_rmtree.assert_called_with(datastore)
-
-            reset()
-            self.assertEqual(pkc.create_data(entry, metadata, return_pair=True),
-                             ("ssh-rsa publickey pubkey.filename\n",
-                              "privatekey"))
-            pkc.XMLMatch.assert_called_with(metadata)
-            pkc.get_specificity.assert_called_with(metadata,
-                                                   pkc.XMLMatch.return_value)
-            pkc._gen_keypair.assert_called_with(metadata,
-                                                pkc.XMLMatch.return_value)
-            self.assertItemsEqual(mock_open.call_args_list,
-                                  [call(privkey + ".pub"), call(privkey)])
-            pkc.pubkey_creator.get_filename.assert_called_with(group="foo")
-            pkc.pubkey_creator.write_data.assert_called_with(
-                "ssh-rsa publickey pubkey.filename\n",
-                group="foo")
-            pkc.write_data.assert_called_with("privatekey", group="foo")
-            mock_rmtree.assert_called_with(datastore)
-
-        inner()
-
-        if HAS_CRYPTO:
-            @patch(passphrase, "foo")
-            @patch("Bcfg2.Server.Encryption.ssl_encrypt")
-            def inner2(mock_ssl_encrypt):
-                reset()
-                mock_ssl_encrypt.return_value = "encryptedprivatekey"
-                Bcfg2.Server.Plugins.Cfg.CfgPrivateKeyCreator.HAS_CRYPTO = True
-                self.assertEqual(pkc.create_data(entry, metadata),
-                                 "encryptedprivatekey")
-                pkc.XMLMatch.assert_called_with(metadata)
-                pkc.get_specificity.assert_called_with(
-                    metadata,
-                    pkc.XMLMatch.return_value)
-                pkc._gen_keypair.assert_called_with(metadata,
-                                                    pkc.XMLMatch.return_value)
-                self.assertItemsEqual(mock_open.call_args_list,
-                                      [call(privkey + ".pub"), call(privkey)])
-                pkc.pubkey_creator.get_filename.assert_called_with(group="foo")
-                pkc.pubkey_creator.write_data.assert_called_with(
-                    "ssh-rsa publickey pubkey.filename\n", group="foo")
-                pkc.write_data.assert_called_with("encryptedprivatekey",
-                                                  group="foo", ext=".crypt")
-                mock_ssl_encrypt.assert_called_with("privatekey", "foo")
-                mock_rmtree.assert_called_with(datastore)
-
-            inner2()
+        self.assertEqual(pkc.create_data(entry, metadata), "privatekey")
+        pkc.XMLMatch.assert_called_with(metadata)
+        pkc.get_specificity.assert_called_with(metadata)
+        pkc._gen_keypair.assert_called_with(metadata,
+ pkc.XMLMatch.return_value)
+        self.assertItemsEqual(mock_open.call_args_list,
+                              [call(privkey + ".pub"), call(privkey)])
+        pkc.pubkey_creator.get_filename.assert_called_with(group="foo")
+        pkc.pubkey_creator.write_data.assert_called_with(
+            "ssh-rsa publickey pubkey.filename\n", group="foo")
+        pkc.write_data.assert_called_with("privatekey", group="foo")
+        mock_rmtree.assert_called_with(datastore)
+
+        reset()
+        self.assertEqual(pkc.create_data(entry, metadata, return_pair=True),
+                         ("ssh-rsa publickey pubkey.filename\n",
+                          "privatekey"))
+        pkc.XMLMatch.assert_called_with(metadata)
+        pkc.get_specificity.assert_called_with(metadata,
+                                               pkc.XMLMatch.return_value)
+        pkc._gen_keypair.assert_called_with(metadata,
+                                            pkc.XMLMatch.return_value)
+        self.assertItemsEqual(mock_open.call_args_list,
+                              [call(privkey + ".pub"), call(privkey)])
+        pkc.pubkey_creator.get_filename.assert_called_with(group="foo")
+        pkc.pubkey_creator.write_data.assert_called_with(
+            "ssh-rsa publickey pubkey.filename\n",
+            group="foo")
+        pkc.write_data.assert_called_with("privatekey", group="foo")
+        mock_rmtree.assert_called_with(datastore)
diff --git a/testsuite/Testsrc/Testlib/TestServer/TestPlugins/TestCfg/Test_init.py b/testsuite/Testsrc/Testlib/TestServer/TestPlugins/TestCfg/Test_init.py
index 72be50299..170a31c3f 100644
--- a/testsuite/Testsrc/Testlib/TestServer/TestPlugins/TestCfg/Test_init.py
+++ b/testsuite/Testsrc/Testlib/TestServer/TestPlugins/TestCfg/Test_init.py
@@ -3,7 +3,7 @@ import sys
 import errno
 import lxml.etree
 import Bcfg2.Options
-from Bcfg2.Compat import walk_packages
+from Bcfg2.Compat import walk_packages, ConfigParser
 from mock import Mock, MagicMock, patch
 from Bcfg2.Server.Plugins.Cfg import *
 from Bcfg2.Server.Plugin import PluginExecutionError, Specificity
@@ -19,7 +19,7 @@ while path != "/":
     path = os.path.dirname(path)
 from common import *
 from TestPlugin import TestSpecificData, TestEntrySet, TestGroupSpool, \
-    TestPullTarget
+    TestPullTarget, TestStructFile
 
 
 class TestCfgBaseFileMatcher(TestSpecificData):
@@ -172,6 +172,7 @@ class TestCfgVerifier(TestCfgBaseFileMatcher):
 class TestCfgCreator(TestCfgBaseFileMatcher):
     test_obj = CfgCreator
     path = "/foo/bar/test.txt"
+    should_monitor = False
 
     def setUp(self):
         TestCfgBaseFileMatcher.setUp(self)
@@ -245,6 +246,101 @@ class TestCfgCreator(TestCfgBaseFileMatcher):
         self.assertRaises(CfgCreationError, cc.write_data, data)
 
 
+class TestXMLCfgCreator(TestCfgCreator, TestStructFile):
+    test_obj = XMLCfgCreator
+
+    @patch("Bcfg2.Server.Plugins.Cfg.CfgCreator.handle_event")
+    @patch("Bcfg2.Server.Plugin.helpers.StructFile.HandleEvent")
+    def test_handle_event(self, mock_HandleEvent, mock_handle_event):
+        cc = self.get_obj()
+        evt = Mock()
+        cc.handle_event(evt)
+        mock_HandleEvent.assert_called_with(cc, evt)
+        mock_handle_event.assert_called_with(cc, evt)
+
+    def test_get_specificity(self):
+        cc = self.get_obj()
+        metadata = Mock()
+
+        def reset():
+            metadata.group_in_category.reset_mock()
+
+        category = "%s.%s.category" % (self.test_obj.__module__,
+                                       self.test_obj.__name__)
+        @patch(category, None)
+        def inner():
+            cc.xdata = lxml.etree.Element("PrivateKey")
+            self.assertItemsEqual(cc.get_specificity(metadata),
+                                  dict(host=metadata.hostname))
+        inner()
+
+        @patch(category, "foo")
+        def inner2():
+            cc.xdata = lxml.etree.Element("PrivateKey")
+            self.assertItemsEqual(cc.get_specificity(metadata),
+                                  dict(group=metadata.group_in_category.return_value,
+                                       prio=50))
+            metadata.group_in_category.assert_called_with("foo")
+
+            reset()
+            cc.xdata = lxml.etree.Element("PrivateKey", perhost="true")
+            self.assertItemsEqual(cc.get_specificity(metadata),
+                                  dict(host=metadata.hostname))
+
+            reset()
+            cc.xdata = lxml.etree.Element("PrivateKey", category="bar")
+            self.assertItemsEqual(cc.get_specificity(metadata),
+                                  dict(group=metadata.group_in_category.return_value,
+                                       prio=50))
+            metadata.group_in_category.assert_called_with("bar")
+
+            reset()
+            cc.xdata = lxml.etree.Element("PrivateKey", prio="10")
+            self.assertItemsEqual(cc.get_specificity(metadata),
+                                  dict(group=metadata.group_in_category.return_value,
+                                       prio=10))
+            metadata.group_in_category.assert_called_with("foo")
+
+            reset()
+            cc.xdata = lxml.etree.Element("PrivateKey")
+            metadata.group_in_category.return_value = ''
+            self.assertItemsEqual(cc.get_specificity(metadata),
+                                  dict(host=metadata.hostname))
+            metadata.group_in_category.assert_called_with("foo")
+
+        inner2()
+
+    def _test_cfg_property(self, name):
+        """ generic test function to test both category and passphrase
+        properties """
+        cc = self.get_obj()
+        cc.setup = Mock()
+        cc.setup.cfp = ConfigParser.ConfigParser()
+        self.assertIsNone(getattr(cc, name))
+
+        cc.setup.reset_mock()
+        cc.setup.cfp.add_section("cfg")
+        cc.setup.cfp.set("cfg", name, "foo")
+        self.assertEqual(getattr(cc, name), "foo")
+
+        if cc.cfg_section:
+            cc.setup.cfp.add_section(cc.cfg_section)
+            cc.setup.cfp.set(cc.cfg_section, name, "bar")
+            self.assertEqual(getattr(cc, name), "bar")
+
+    def test_category(self):
+        self._test_cfg_property("category")
+
+    @patchIf(HAS_CRYPTO, "Bcfg2.Server.Encryption.get_passphrases")
+    def test_passphrase(self, mock_get_passphrases):
+        cc = self.get_obj()
+        if HAS_CRYPTO and cc.encryptable:
+            mock_get_passphrases.return_value = dict(foo="foo", bar="bar")
+            self._test_cfg_property("passphrase")
+        else:
+            self.assertIsNone(getattr(cc, name))
+
+
 class TestCfgDefaultInfo(TestCfgInfo):
     test_obj = CfgDefaultInfo