Skip to content

Conversation

@jspaleta
Copy link
Contributor

Pull Request Checklist

Pull request to address failing errors found in the effort in #67

General

Two failing tests

  1. openssl client connection certificate chain formatting has changed betwen openssl 1.0 and openssl 1.1
    This causes the anchor test to fail and on examination would cause all anchor checks to fail on hosts using openssel 1.1

  2. the check-ssl-hsts-preloadable.rb warning test no longer works because the online lookup at hstspreload.org has no reliable warning example.

Fix includes.
  • updating plugin logic to use a matching regexp that can handle both openssl 1.0 and 1.1 formatting
  • add new option to treat anchor argument as a regexp,
  • update spec test to use regexp argument
  • disable preload warning test, as the domain used in the test no longer
Misc other changes:
  • update gemspec deps to make travis happy

the check-ssl-anchor.rb command

  • RuboCop passes

  • Existing tests pass

Copy link
Contributor

@phumpal phumpal left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is pretty rad. Thanks @jspaleta!

Copy link
Member

@majormoses majormoses left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

if config[:regexp]
ra = Regexp.new(config[:anchor].to_s)
if data[-1] =~ ra
anchor_regexp = Regexp.new(config[:anchor].to_s)
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

much clearer as to its intent, thank you I know its a bit nit picky...

@majormoses majormoses merged commit d497555 into master Jun 26, 2020
majormoses pushed a commit that referenced this pull request Jun 28, 2020
#71)

* Add option to treat anchor as a regexp. Fix parsing of openssl client output to work with both openssl 1.0 and openssl 1.1 formatting

* updates to make travis and rubocop happy

* Add pure ruby implementation of check-ssl-root-issuer.rb as alternative to check-ssl-anchor.rb

* make rubocop happy

* add test for check-ssl-root-issuer

* update changelog and README with new plugin information

* remove files changed in PR #70, unrelated to this new feature

* Update logic for validating issuer name format options. Using mixin libraries internal validation for allowed values.
phumpal pushed a commit to phumpal/sensu-plugins-ssl that referenced this pull request Dec 2, 2022
sensu-plugins#71)

* Add option to treat anchor as a regexp. Fix parsing of openssl client output to work with both openssl 1.0 and openssl 1.1 formatting

* updates to make travis and rubocop happy

* Add pure ruby implementation of check-ssl-root-issuer.rb as alternative to check-ssl-anchor.rb

* make rubocop happy

* add test for check-ssl-root-issuer

* update changelog and README with new plugin information

* remove files changed in PR sensu-plugins#70, unrelated to this new feature

* Update logic for validating issuer name format options. Using mixin libraries internal validation for allowed values.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants