Skip to content

Commit 8413dbe

Browse files
author
Cocker Koch
committed
Use Puppet-Datatype Sensitive
- fix some Puppetlint-Complaints, f.e. use Hash $::facts['blubb'] instead of specific global Variables - let Function mysql::password accept Datatype Sensitive for Password - let Function mysql_password accept Datatype Sensitive for Password - add Parameter "sensitive" to Function mysql::password to decide if its Returnvalue should be of Datatype Sensitive - add Parameter "sensitive" to Function mysql_password to decide if its Returnvalue should be of Datatype Sensitive - let mysql_user accept Datatype Sensitive for Parameter password_hash - let mysql::backup::mysqlbackup accept Datatype Sensitive for Parameter $backuppassword - let mysql::backup::mysqldump accept Datatype Sensitive for Parameter $backuppassword - let mysql::backup::xtrabackup accept Datatype Sensitive for Parameter $backuppassword - let mysql::db accept Datatype Sensitive for Parameter $password - let mysql::server accept Datatype Sensitive for Parameter $root_password - let mysql::server::backup accept Datatype Sensitive for Parameter $backuppassword - let mysql::server::monitor accept Datatype Sensitive for Parameter $mysql_monitor_password - let mysql::server::root_password accept Datatype Sensitive for $root_password - refactor Logic for unset Password for mysql::server::root_password
1 parent c3128e8 commit 8413dbe

21 files changed

+121
-36
lines changed

‎.puppet-lint.rc

+1
Original file line numberDiff line numberDiff line change
@@ -1 +1,2 @@
11
--relative
2+
--no-140chars-check

‎lib/puppet/functions/mysql/password.rb

+23-6
Original file line numberDiff line numberDiff line change
@@ -7,18 +7,35 @@
77
Puppet::Functions.create_function(:'mysql::password') do
88
# @param password
99
# Plain text password.
10+
# @param sensitive
11+
# If the Postgresql-Passwordhash should be of Datatype Sensitive[String]
1012
#
1113
# @return hash
1214
# The mysql password hash from the clear text password.
1315
#
1416
dispatch :password do
15-
required_param 'String', :password
16-
return_type 'String'
17+
required_param 'Variant[String, Sensitive[String]]', :password
18+
optional_param 'Boolean', :sensitive
19+
return_type 'Variant[String, Sensitive[String]]'
1720
end
1821

19-
def password(password)
20-
return '' if password.empty?
21-
return password if %r{\*[A-F0-9]{40}$}.match?(password)
22-
'*' + Digest::SHA1.hexdigest(Digest::SHA1.digest(password)).upcase
22+
def password(password, sensitive = false)
23+
if password.is_a?(Puppet::Pops::Types::PSensitiveType::Sensitive)
24+
password = password.unwrap
25+
end
26+
27+
result_string = if %r{\*[A-F0-9]{40}$}.match?(password)
28+
password
29+
elsif password.empty?
30+
''
31+
else
32+
'*' + Digest::SHA1.hexdigest(Digest::SHA1.digest(password)).upcase
33+
end
34+
35+
if sensitive
36+
Puppet::Pops::Types::PSensitiveType::Sensitive.new(result_string)
37+
else
38+
result_string
39+
end
2340
end
2441
end

‎lib/puppet/functions/mysql_password.rb

+5-4
Original file line numberDiff line numberDiff line change
@@ -8,12 +8,13 @@
88
# @return
99
# The mysql password hash from the 4.x function mysql::password.
1010
dispatch :mysql_password do
11-
required_param 'String', :password
12-
return_type 'String'
11+
required_param 'Variant[String, Sensitive[String]]', :password
12+
optional_param 'Boolean', :sensitive
13+
return_type 'Variant[String, Sensitive[String]]'
1314
end
1415

15-
def mysql_password(password)
16+
def mysql_password(password, sensitive = false)
1617
call_function('deprecation', 'mysql_password', "This method has been deprecated, please use the namespaced version 'mysql::password' instead.")
17-
call_function('mysql::password', password)
18+
call_function('mysql::password', password, sensitive)
1819
end
1920
end

‎lib/puppet/provider/mysql_user/mysql.rb

+2
Original file line numberDiff line numberDiff line change
@@ -74,6 +74,8 @@ def create
7474
max_updates_per_hour = @resource.value(:max_updates_per_hour) || 0
7575
tls_options = @resource.value(:tls_options) || ['NONE']
7676

77+
password_hash = password_hash.unwrap if password_hash.is_a?(Puppet::Pops::Types::PSensitiveType::Sensitive)
78+
7779
# Use CREATE USER to be compatible with NO_AUTO_CREATE_USER sql_mode
7880
# This is also required if you want to specify a authentication plugin
7981
if !plugin.nil?

‎manifests/backup/mysqlbackup.pp

+7-2
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
#
66
class mysql::backup::mysqlbackup (
77
$backupuser = '',
8-
$backuppassword = '',
8+
Variant[String, Sensitive[String]] $backuppassword = '',
99
$maxallowedpacket = '1M',
1010
$backupdir = '',
1111
$backupdirmode = '0700',
@@ -32,6 +32,11 @@
3232
$compression_command = undef,
3333
$compression_extension = undef,
3434
) inherits mysql::params {
35+
$backuppassword_unsensitive = if $backuppassword =~ Sensitive {
36+
$backuppassword.unwrap
37+
} else {
38+
$backuppassword
39+
}
3540
mysql_user { "${backupuser}@localhost":
3641
ensure => $ensure,
3742
password_hash => mysql::password($backuppassword),
@@ -104,7 +109,7 @@
104109
'incremental_base' => 'history:last_backup',
105110
'incremental_backup_dir' => $backupdir,
106111
'user' => $backupuser,
107-
'password' => $backuppassword,
112+
'password' => $backuppassword_unsensitive
108113
},
109114
}
110115
$options = mysql::normalise_and_deepmerge($default_options, $mysql::server::override_options)

‎manifests/backup/mysqldump.pp

+8-1
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
#
55
class mysql::backup::mysqldump (
66
$backupuser = '',
7-
$backuppassword = '',
7+
Variant[String, Sensitive[String]] $backuppassword = '',
88
$backupdir = '',
99
$maxallowedpacket = '1M',
1010
$backupdirmode = '0700',
@@ -33,6 +33,12 @@
3333
$compression_command = 'bzcat -zc',
3434
$compression_extension = '.bz2'
3535
) inherits mysql::params {
36+
$backuppassword_unsensitive = if $backuppassword =~ Sensitive {
37+
$backuppassword.unwrap
38+
} else {
39+
$backuppassword
40+
}
41+
3642
unless $::osfamily == 'FreeBSD' {
3743
if $backupcompress and $compression_command == 'bzcat -zc' {
3844
ensure_packages(['bzip2'])
@@ -82,6 +88,7 @@
8288
require => File['mysqlbackup.sh'],
8389
}
8490

91+
# TODO: use EPP instead of ERB, as EPP can handle Data of Type Sensitive without further ado
8592
file { 'mysqlbackup.sh':
8693
ensure => $ensure,
8794
path => '/usr/local/sbin/mysqlbackup.sh',

‎manifests/backup/xtrabackup.pp

+8-1
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
class mysql::backup::xtrabackup (
66
$xtrabackup_package_name = $mysql::params::xtrabackup_package_name,
77
$backupuser = undef,
8-
$backuppassword = undef,
8+
Optional[Variant[String, Sensitive[String]]] $backuppassword = undef,
99
$backupdir = '',
1010
$maxallowedpacket = '1M',
1111
$backupmethod = 'xtrabackup',
@@ -36,6 +36,12 @@
3636
) inherits mysql::params {
3737
ensure_packages($xtrabackup_package_name)
3838

39+
$backuppassword_unsensitive = if $backuppassword =~ Sensitive {
40+
$backuppassword.unwrap
41+
} else {
42+
$backuppassword
43+
}
44+
3945
if $backupuser and $backuppassword {
4046
mysql_user { "${backupuser}@localhost":
4147
ensure => $ensure,
@@ -121,6 +127,7 @@
121127
group => $backupdirgroup,
122128
}
123129

130+
# TODO: use EPP instead of ERB, as EPP can handle Data of Type Sensitive without further ado
124131
file { 'xtrabackup.sh':
125132
ensure => $ensure,
126133
path => '/usr/local/sbin/xtrabackup.sh',

‎manifests/bindings.pp

+3-3
Original file line numberDiff line numberDiff line change
@@ -102,13 +102,13 @@
102102
) inherits mysql::params {
103103
case $::osfamily {
104104
'Archlinux': {
105-
if $java_enable { fail("::mysql::bindings::java cannot be managed by puppet on ${osfamily}
105+
if $java_enable { fail("::mysql::bindings::java cannot be managed by puppet on ${::facts['os']['family']}
106106
as it is not in official repositories. Please disable java mysql binding.") }
107107
if $perl_enable { include 'mysql::bindings::perl' }
108-
if $php_enable { warning("::mysql::bindings::php does not need to be managed by puppet on ${osfamily}
108+
if $php_enable { warning("::mysql::bindings::php does not need to be managed by puppet on ${::facts['os']['family']}
109109
as it is included in mysql package by default.") }
110110
if $python_enable { include 'mysql::bindings::python' }
111-
if $ruby_enable { fail("::mysql::bindings::ruby cannot be managed by puppet on %{osfamily}
111+
if $ruby_enable { fail("::mysql::bindings::ruby cannot be managed by puppet on %{::facts['os']['family']}
112112
as it is not in official repositories. Please disable ruby mysql binding.") }
113113
}
114114

‎manifests/bindings/client_dev.pp

+1-1
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,6 @@
1212
provider => $mysql::bindings::client_dev_package_provider,
1313
}
1414
} else {
15-
warning("No MySQL client development package configured for ${os}.")
15+
warning("No MySQL client development package configured for ${::facts['os']['family']}.")
1616
}
1717
}

‎manifests/bindings/daemon_dev.pp

+1-1
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,6 @@
1212
provider => $mysql::bindings::daemon_dev_package_provider,
1313
}
1414
} else {
15-
warning("No MySQL daemon development package configured for ${os}.")
15+
warning("No MySQL daemon development package configured for ${::facts['os']['family']}.")
1616
}
1717
}

‎manifests/db.pp

+1-1
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@
4040
#
4141
define mysql::db (
4242
$user,
43-
$password,
43+
Variant[String, Sensitive[String]] $password,
4444
$tls_options = undef,
4545
$dbname = $name,
4646
$charset = 'utf8',

‎manifests/params.pp

+1-1
Original file line numberDiff line numberDiff line change
@@ -259,7 +259,7 @@
259259
$python_package_name = 'python-mysqldb'
260260
}
261261

262-
$ruby_package_name = $facts['operatingsystemmajrelease'] ? {
262+
$ruby_package_name = $facts['os']['release']['major'] ? {
263263
'8' => 'ruby-mysql', # jessie
264264
'9' => 'ruby-mysql2', # stretch
265265
'10' => 'ruby-mysql2', # buster

‎manifests/server.pp

+1-1
Original file line numberDiff line numberDiff line change
@@ -98,7 +98,7 @@
9898
$mysql_group = $mysql::params::mysql_group,
9999
$mycnf_owner = $mysql::params::mycnf_owner,
100100
$mycnf_group = $mysql::params::mycnf_group,
101-
$root_password = $mysql::params::root_password,
101+
Variant[String, Sensitive[String]] $root_password = $mysql::params::root_password,
102102
$service_enabled = $mysql::params::server_service_enabled,
103103
$service_manage = $mysql::params::server_service_manage,
104104
$service_name = $mysql::params::server_service_name,

‎manifests/server/backup.pp

+1-1
Original file line numberDiff line numberDiff line change
@@ -74,7 +74,7 @@
7474
# Configure the file extension for the compressed backup (when using the mysqldump provider)
7575
class mysql::server::backup (
7676
$backupuser = undef,
77-
$backuppassword = undef,
77+
Optional[Variant[String, Sensitive[String]]] $backuppassword = undef,
7878
$backupdir = undef,
7979
$backupdirmode = '0700',
8080
$backupdirowner = 'root',

‎manifests/server/monitor.pp

+1-1
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010
#
1111
class mysql::server::monitor (
1212
$mysql_monitor_username = '',
13-
$mysql_monitor_password = '',
13+
Optional[Variant[String, Sensitive[String]]] $mysql_monitor_password = '',
1414
$mysql_monitor_hostname = ''
1515
) {
1616
Anchor['mysql::server::end'] -> Class['mysql::server::monitor']

‎manifests/server/root_password.pp

+17-5
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,20 @@
1-
# @summary
1+
# @summary
22
# Private class for managing the root password
33
#
44
# @api private
55
#
66
class mysql::server::root_password {
7+
if $mysql::server::root_password =~ Sensitive {
8+
$root_password = $mysql::server::root_password.unwrap
9+
} else {
10+
$root_password = $mysql::server::root_password
11+
}
12+
if $root_password == 'UNSET' {
13+
$root_password_set = false
14+
} else {
15+
$root_password_set = true
16+
}
17+
718
$options = $mysql::server::_options
819
$secret_file = $mysql::server::install_secret_file
920
$login_file = $mysql::server::login_file
@@ -23,15 +34,16 @@
2334
}
2435

2536
# manage root password if it is set
26-
if $mysql::server::create_root_user == true and $mysql::server::root_password != 'UNSET' {
37+
if $mysql::server::create_root_user and $root_password_set {
2738
mysql_user { 'root@localhost':
2839
ensure => present,
2940
password_hash => mysql::password($mysql::server::root_password),
3041
require => Exec['remove install pass'],
3142
}
3243
}
3344

34-
if $mysql::server::create_root_my_cnf == true and $mysql::server::root_password != 'UNSET' {
45+
if $mysql::server::create_root_my_cnf and $root_password_set {
46+
# TODO: use EPP instead of ERB, as EPP can handle Data of Type Sensitive without further ado
3547
file { "${::root_home}/.my.cnf":
3648
content => template('mysql/my.cnf.pass.erb'),
3749
owner => 'root',
@@ -42,12 +54,12 @@
4254
if versioncmp($::puppetversion, '3.0') >= 0 {
4355
File["${::root_home}/.my.cnf"] { show_diff => false }
4456
}
45-
if $mysql::server::create_root_user == true {
57+
if $mysql::server::create_root_user {
4658
Mysql_user['root@localhost'] -> File["${::root_home}/.my.cnf"]
4759
}
4860
}
4961

50-
if $mysql::server::create_root_login_file == true and $mysql::server::root_password != 'UNSET' {
62+
if $mysql::server::create_root_login_file and $root_password_set {
5163
file { "${::root_home}/.mylogin.cnf":
5264
source => $login_file,
5365
owner => 'root',

‎spec/classes/mysql_server_spec.rb

+23
Original file line numberDiff line numberDiff line change
@@ -241,6 +241,29 @@
241241
}
242242
end
243243

244+
describe 'with users and Sensitive password_hash' do
245+
let(:params) do
246+
{ users: {
247+
'foo@localhost' => {
248+
'max_connections_per_hour' => '1',
249+
'max_queries_per_hour' => '2',
250+
'max_updates_per_hour' => '3',
251+
'max_user_connections' => '4',
252+
'password_hash' => sensitive('*F3A2A51A9B0F2BE2468926B4132313728C250DBF'),
253+
},
254+
'foo2@localhost' => {},
255+
} }
256+
end
257+
258+
it {
259+
is_expected.to contain_mysql_user('foo@localhost').with(
260+
max_connections_per_hour: '1', max_queries_per_hour: '2',
261+
max_updates_per_hour: '3', max_user_connections: '4',
262+
password_hash: 'Sensitive [value redacted]'
263+
)
264+
}
265+
end
266+
244267
describe 'with grants' do
245268
let(:params) do
246269
{ grants: {

‎spec/functions/mysql_password_spec.rb

+12-2
Original file line numberDiff line numberDiff line change
@@ -11,14 +11,24 @@
1111
is_expected.to run.with_params.and_raise_error(ArgumentError)
1212
end
1313

14-
it 'raises a ArgumentError if there is more than 1 arguments' do
15-
is_expected.to run.with_params('foo', 'bar').and_raise_error(ArgumentError)
14+
it 'raises a ArgumentError if there is more than 2 arguments' do
15+
is_expected.to run.with_params('foo', false, 'bar').and_raise_error(ArgumentError)
1616
end
1717

1818
it 'converts password into a hash' do
1919
is_expected.to run.with_params('password').and_return('*2470C0C06DEE42FD1618BB99005ADCA2EC9D1E19')
2020
end
2121

22+
it 'accept password as Sensitive' do
23+
is_expected.to run.with_params(sensitive('password')).and_return('*2470C0C06DEE42FD1618BB99005ADCA2EC9D1E19')
24+
end
25+
26+
# Test of a Returnvalue of Datatype Sensitive does not work
27+
it 'returns Sensitive with sensitive=true' do
28+
pending 'should have a Returnvalue of Datatype Sensitive'
29+
is_expected.to run.with_params('password', true).and_return(sensitive('*2470C0C06DEE42FD1618BB99005ADCA2EC9D1E19'))
30+
end
31+
2232
it 'password should be String' do
2333
is_expected.to run.with_params(123).and_raise_error(ArgumentError)
2434
end

‎templates/my.cnf.pass.erb

+2-2
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,8 @@
44
[<%= section -%>]
55
user=root
66
host=localhost
7-
<% unless scope.lookupvar('mysql::server::root_password') == 'UNSET' -%>
8-
password='<%= scope.lookupvar('mysql::server::root_password') %>'
7+
<% if @root_password_set -%>
8+
password='<%= @root_password %>'
99
<% end -%>
1010
socket=<%= @options['client']['socket'] %>
1111
<% end %>

‎templates/mysqlbackup.sh.erb

+1-1
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@
1515
##### START CONFIG ###################################################
1616

1717
USER=<%= @backupuser %>
18-
PASS='<%= @backuppassword %>'
18+
PASS='<%= @backuppassword_unsensitive %>'
1919
MAX_ALLOWED_PACKET=<%= @maxallowedpacket %>
2020
DIR=<%= @backupdir %>
2121
ROTATE=<%= [ Integer(@backuprotate) - 1, 0 ].max %>

‎templates/xtrabackup.sh.erb

+2-2
Original file line numberDiff line numberDiff line change
@@ -39,8 +39,8 @@ cleanup
3939

4040
<%- _innobackupex_args = '' -%>
4141

42-
<%- if @backupuser and @backuppassword -%>
43-
<%- _innobackupex_args = '--user="' + @backupuser + '" --password="' + @backuppassword + '"' -%>
42+
<%- if @backupuser and @backuppassword_unsensitive -%>
43+
<%- _innobackupex_args = '--user="' + @backupuser + '" --password="' + @backuppassword_unsensitive + '"' -%>
4444
<%- end -%>
4545

4646
<%- if @backupcompress -%>

0 commit comments

Comments
 (0)