Skip to content

Commit 835072b

Browse files
committed
Make resolver changeable on Nginx (closes #29)
1 parent 9b0b7da commit 835072b

File tree

8 files changed

+134
-10
lines changed

8 files changed

+134
-10
lines changed

README.md

+10-9
Original file line numberDiff line numberDiff line change
@@ -696,15 +696,16 @@ Attributes
696696

697697
The following attributes are used to integrate SSL specific configurations with different services (Apache, nginx, ...). They are used internally by [the apache and nginx templates](#templates).
698698

699-
| Attribute | Default | Description |
700-
|:------------------------------------------------------|:-------------|:-----------------------------------|
701-
| `node['ssl_certificate']['service']['cipher_suite']` | `nil` | Service default SSL cipher suite.
702-
| `node['ssl_certificate']['service']['protocols']` | `nil` | Service default SSL protocols.
703-
| `node['ssl_certificate']['service']['apache']` | *calculated* | Apache web service httpd specific SSL attributes.
704-
| `node['ssl_certificate']['service']['nginx']` | *calculated* | nginx web service specific SSL attributes.
705-
| `node['ssl_certificate']['service']['compatibility']` | `nil` | Service SSL compatibility level (See [below](#securing-server-side-tls)).
706-
| `node['ssl_certificate']['service']['use_hsts']` | `true` | Whether to enable [HSTS](http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security) in the service.
707-
| `node['ssl_certificate']['service']['use_stapling']` | *calculated* | Whether to enable [OCSP stapling](http://en.wikipedia.org/wiki/OCSP_stapling) in the service (nginx only, use `node['apache']['mod_ssl']['use_stapling']` for apache).
699+
| Attribute | Default | Description |
700+
|:-----------------------------------------------------------|:-------------|:-----------------------------------|
701+
| `node['ssl_certificate']['service']['cipher_suite']` | `nil` | Service default SSL cipher suite.
702+
| `node['ssl_certificate']['service']['protocols']` | `nil` | Service default SSL protocols.
703+
| `node['ssl_certificate']['service']['apache']` | *calculated* | Apache web service httpd specific SSL attributes.
704+
| `node['ssl_certificate']['service']['nginx']` | *calculated* | nginx web service specific SSL attributes.
705+
| `node['ssl_certificate']['service']['compatibility']` | `nil` | Service SSL compatibility level (See [below](#securing-server-side-tls)).
706+
| `node['ssl_certificate']['service']['use_hsts']` | `true` | Whether to enable [HSTS](http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security) in the service.
707+
| `node['ssl_certificate']['service']['use_stapling']` | *calculated* | Whether to enable [OCSP stapling](http://en.wikipedia.org/wiki/OCSP_stapling) in the service (nginx only, use `node['apache']['mod_ssl']['use_stapling']` for apache).
708+
| `node['ssl_certificate']['service']['stapling_resolver']` | *calculated* | DNS resolver to use for OCSP. Only with Nginx.
708709

709710
See the [`ServiceHelpers` class documentation](http://www.rubydoc.info/github/zuazo/ssl_certificate-cookbook/master/Chef/SslCertificateCookbook/ServiceHelpers) to learn how to integrate them with new services.
710711

attributes/service.rb

+2
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,8 @@
2424
default['ssl_certificate']['service']['compatibility'] = nil
2525
default['ssl_certificate']['service']['use_hsts'] = true
2626
default['ssl_certificate']['service']['use_stapling'] = true
27+
default['ssl_certificate']['service']['stapling_resolver'] =
28+
Chef::SslCertificateCookbook::AttributeHelpers.resolvers || '8.8.8.8'
2729

2830
# SSL Recommended configurations from
2931
# https://wiki.mozilla.org/Security/Server_Side_TLS#Recommended_configurations

libraries/attribute_helpers.rb

+50
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
# encoding: UTF-8
2+
#
3+
# Cookbook Name:: ssl_certificate
4+
# Library:: attribute_helpers
5+
# Author:: Xabier de Zuazo (<[email protected]>)
6+
# Copyright:: Copyright (c) 2016 Xabier de Zuazo
7+
# License:: Apache License, Version 2.0
8+
#
9+
# Licensed under the Apache License, Version 2.0 (the "License");
10+
# you may not use this file except in compliance with the License.
11+
# You may obtain a copy of the License at
12+
#
13+
# http://www.apache.org/licenses/LICENSE-2.0
14+
#
15+
# Unless required by applicable law or agreed to in writing, software
16+
# distributed under the License is distributed on an "AS IS" BASIS,
17+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
18+
# See the License for the specific language governing permissions and
19+
# limitations under the License.
20+
#
21+
22+
require 'resolv'
23+
24+
class Chef
25+
module SslCertificateCookbook
26+
# Helper methods to use from attribute files.
27+
#
28+
# Usage example:
29+
#
30+
# ```ruby
31+
# # attributes/whatever.rb
32+
# Chef::SslCertificateCookbook::AttributeHelpers.resolvers
33+
# #=> "8.8.8.8:53"
34+
# ```
35+
class AttributeHelpers
36+
# Returns the system DNS resolvers separated by spaces.
37+
#
38+
# @return [String, nil] The DNS resolver address.
39+
# @example
40+
# resolvers #=> "8.8.8.8:53 4.4.4.2:53"
41+
# @api public
42+
def self.resolvers
43+
empty_ary = [nil, [], [[]], [['0.0.0.0', 53]]]
44+
resolvers = Resolv::DNS::Config.new.lazy_initialize.nameserver_port
45+
return nil if empty_ary.include?(resolvers)
46+
resolvers.map { |x| x.join(':') }.join(' ')
47+
end
48+
end
49+
end
50+
end

metadata.rb

+7
Original file line numberDiff line numberDiff line change
@@ -119,6 +119,13 @@
119119
required: 'optional',
120120
calculated: true
121121

122+
attribute 'ssl_certificate/service/stapling_resolver',
123+
display_name: 'ssl_certificate stapling resolver',
124+
description: 'DNS resolver to use for OCSP. Only with Nginx.',
125+
type: 'string',
126+
required: 'optional',
127+
calculated: true
128+
122129
attribute 'chef-vault/databag_fallback',
123130
display_name: 'fallback to unencrypted data bags',
124131
description: 'Whether to fallback to unencrypted data bag if'\

templates/default/nginx.erb

+1-1
Original file line numberDiff line numberDiff line change
@@ -29,5 +29,5 @@ self.class.send(:include, Chef::SslCertificateCookbook::ServiceHelpers)
2929
<% if @ssl_config[:use_stapling] && nginx_version_satisfies?('>= 1.3.7') -%>
3030
ssl_stapling on;
3131
ssl_stapling_verify on;
32-
resolver 8.8.8.8;
32+
resolver <%= @ssl_config[:stapling_resolver] %>;
3333
<% end -%>
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
# encoding: UTF-8
2+
#
3+
# Author:: Xabier de Zuazo (<[email protected]>)
4+
# Copyright:: Copyright (c) 2016 Xabier de Zuazo
5+
# License:: Apache License, Version 2.0
6+
#
7+
# Licensed under the Apache License, Version 2.0 (the "License");
8+
# you may not use this file except in compliance with the License.
9+
# You may obtain a copy of the License at
10+
#
11+
# http://www.apache.org/licenses/LICENSE-2.0
12+
#
13+
# Unless required by applicable law or agreed to in writing, software
14+
# distributed under the License is distributed on an "AS IS" BASIS,
15+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16+
# See the License for the specific language governing permissions and
17+
# limitations under the License.
18+
#
19+
20+
require_relative '../spec_helper'
21+
require 'attribute_helpers'
22+
23+
describe Chef::SslCertificateCookbook::AttributeHelpers, order: :random do
24+
let(:helpers) { described_class }
25+
let(:resolv_dns_config) { instance_double('Resolv::DNS::Config') }
26+
let(:nameserver_port) { [%w(1.2.3.4 53)] }
27+
28+
context '.resolvers' do
29+
before do
30+
expect(Resolv::DNS::Config).to receive(:new)
31+
.and_return(resolv_dns_config)
32+
allow(resolv_dns_config).to receive(:lazy_initialize)
33+
.and_return(resolv_dns_config)
34+
allow(resolv_dns_config).to receive(:nameserver_port)
35+
.and_return(nameserver_port)
36+
end
37+
38+
it 'returns the DNS resolver as a string' do
39+
expect(helpers.resolvers).to eq('1.2.3.4:53')
40+
end
41+
42+
context 'with multiple DNS resolvers' do
43+
let(:nameserver_port) { [%w(1.2.3.4 53), %w(5.6.7.8 5353)] }
44+
45+
it 'returns all DNS resolvers' do
46+
expect(helpers.resolvers).to eq('1.2.3.4:53 5.6.7.8:5353')
47+
end
48+
end
49+
50+
context 'without DNS resolvers' do
51+
let(:nameserver_port) { [['0.0.0.0', 53]] } # tested on GNU/Linux
52+
53+
it 'returns nil' do
54+
expect(helpers.resolvers).to eq(nil)
55+
end
56+
end
57+
end
58+
end

test/unit/spec_helper.rb

+1
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@
2424
require 'should_not/rspec'
2525

2626
# require_relative 'support/coverage'
27+
require 'attribute_helpers'
2728

2829
RSpec.configure do |config|
2930
# Prohibit using the should syntax

test/unit/templates/nginx_partial_spec.rb

+5
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,11 @@
5757
expect(template.render(variables))
5858
.to match(/^\s*ssl_stapling on;/)
5959
end
60+
61+
it 'sets DNS resolver' do
62+
expect(template.render(variables))
63+
.to match(/^\s*resolver( [a-zA-Z0-9.:-]+)+;/)
64+
end
6065
end
6166

6267
context 'with nginx < 1.3.7' do

0 commit comments

Comments
 (0)