Remove deprecated Ruby. Upgrade bundler. Fix failing tests

[phumpal]

Pull Request Checklist

Is this in reference to an existing issue?

General

• Update Changelog following the conventions laid out here

• Update README with any necessary configuration snippets

• Binstubs are created if needed

• RuboCop passes

• Existing tests pass

New Plugins

• Tests

• Add the plugin to the README

• Does it have a complete header as outlined here

Purpose

Known Compatibility Issues

[phumpal]

The HSTS Preload check is failing because the cert expired for https://oskuro.net/

Loos like an oversight (missing cron renewal?) https://www.sslshopper.com/ssl-checker.html#hostname=oskuro.net

[phumpal]

I kinda cheated here and removed a test as the cert for the domain expired.

Tests are passing again. I opened an issue on chromium/hstspreload#115

[phumpal]

@majormoses sorry to bug you again.

This fixes some of the test issues but not the failing HSTS test which I've removed in ac7196a. I suspect that's a happy medium as the parent issue has been in limbo for some time.

Also, having passing tests would be nice so we can add this #66

[phumpal]

Anyone available to take a look at this?

Perhaps adding a note saying the test is disabled (and adding an ignore) is the better approach.

Would love to see this merged and #66 review with passing tests.

[phumpal]

Gentle ping @rwky ^^ re: failing HSTS preload test (w/warnings)

[demonfoo]

Also the check-ssl-anchor.rb tests fail locally for me, because OpenSSL 1.1.1's output changed from 1.0.1 and before, thus preventing it from working at all.

[majormoses]

Hey so I think we should rather than remove the test update it to something we can trust. While I can't guarantee my cert wont ever expire since software by its nature we can use https://benabrams.it which is not currently expired and has the appropriate headers and preloading: https://hstspreload.org/?domain=benabrams.it.

I see we specifically need something with warnings...if someone can give me instructions on what I need to setup to make it "sorta wrong" I can try setting something up over the weekend.

I have some existing DNS entries we can also try testing if it helps: https://github.com/sensu-plugins/sensu-plugins-dns/blob/master/test/integration/helpers/serverspec/check-dns-shared_spec.rb

[phumpal]

if someone can give me instructions on what I need to setup to make it "sorta wrong"

If I'm not mistaken here are some of the warning conditions

https://github.com/chromium/hstspreload/blob/master/header_test.go#L148-L201

[phumpal]

I can try setting something up over the weekend

@majormoses any luck or should I dig in more to provide guidance?

[majormoses]

I can try setting something up over the weekend

@majormoses any luck or should I dig in more to provide guidance?

Sorry I didn't get around to this. Hopefully I have the time and will take a look this weekend. I am also gonna see if there is any interest on the sensu inc side to host some testing infra for this.

[jspaleta]

Okay so I have 2 local failing tests in master branch right now.

1. failure for the anchor test is entirely due to a change in how the openssl client reports the certificate information. We just need to adjust the regexp match used for data[0] leading to a NOTOK string replacement to work for both newer and older openssl.
   I think I can prototype a less strict regexp that will work on both..but see my note below.

2. failure of the preloading test warning condition. Since this check depends on how the hstspreload.org database works, i'd recommend just disabling the warning test. For this to work reliably the hstspreload.org would need to provide a guaranteed warning example.

Note:

I have to say... the fact that the anchor and cert checks requires a shell out to openssl commandline is a bit unnerving to me.
We should be able to accomplish the equivalent functionality with the ruby openssl module which makes use of the opensssl library directly, which may clean up changes in the text representation of the certificate chain.

[majormoses]

@phumpal sorry been busy, I have not had time to look into setting this up. I have reached out to some folks at Sensu Inc to see if they are willing to help out here as I can see the value that it would provide the community to have some test infra available for ci and development.

[majormoses]

I have to say... the fact that the anchor and cert checks requires a shell out to openssl commandline is a bit unnerving to me.
We should be able to accomplish the equivalent functionality with the ruby openssl module which makes use of the opensssl library directly, which may clean up changes in the text representation of the certificate chain.

No doubt, I am 👍 on it. It's one of the older checks while we have written many plugins to not rely on shell outs they do exist and in some cases are the only viable option as there is no native solution in the language. Take for example raid checks for a proprietary system where they provide a binary you can use but are not going to write client/language sdks.

[jspaleta]

One other thing... right now the cert used in the anchor test would need to also need to account for the openssel 1.0 or 1.1 variant being used.
We'd need to have rspec test the openssl client version by running openssl version capture the version number, parse it, and then use the correct anchor string variant appropriate for that version.

For openssl 1.1 -> 'i:O = Digital Signature Trust Co., CN = DST Root CA X3'
For openssl 1.0 -> 'i:/O=Digital Signature Trust Co./CN=DST Root CA X3'

There's probably some way to do that conditional switch out in the spec_helper.rb and then reference whatever variable the spec helper tests.

We could force the travis environment to be something newer that has openssl 1.1 and just live with it, or vice versa.

The important thing is to fix the regexp in the 'bin/check-ssl-anchor.rb' as that will cause the check to fail on the final host.

[jspaleta]

One last thought, We could let the anchor cmdline option encode a regexp.. that way the test could use it.

Yeah I think I like that.. I'm gonna prototype that change as well.

[jspaleta]

I'm gonna prep another pull request that will fix the anchor check and anchor check test by making use of the regexp.

I'm going to make it so its backwards compatible, by introducing a new cmdline option to treat the anchor as a regexp instead of as a normal string.

[jspaleta]

Okay I have a new branch up with a PR #70 that addresses the failing tests as I found them.

I was able to test the new anchor regexp logic on Fedora with openssl 1.1 and Centos7 with openssl 1.0 So that looks good.

The preload warning test I just disabled as it can't be made reliable.. until someone can identify a domain guaranteed to produce a warning from the online lookup.

[jspaleta]

Take a look at this:
https://github.com/jarthod/ssl-test

this has everything we need to do in check-ssl-anchor.rb and more

[jspaleta]

Okay New PR #71 is now up with a pure Ruby alternative implementation for the check-ssl-anchor.rb plugin.

[jspaleta]

Hey @phumpal

Can you rebase this PR against master now that we've gotten my related PRs merged.

[phumpal]

@jspaleta rebased against master. PTAL

[majormoses]

LGTM

[majormoses]

This should be under the Breaking Changes section but we will fix that up for you when we release (hoping to devote some time to sensu projects tomorrow).