{"ref":"refs/heads/master","commits":[{"author":{"name":"Daniel Pittman","email":"3d0f3b9ddcacec30c4008c5e030e6c13a478cb4f@puppetlabs.com"},"url":"https://api.github.com/repos/jhelwig/puppet/commits/78a01a253e44122dcf0343b016dbb77e1ad09575","message":"(#6928) Don't blow up when the method is undefined...\n\nUse the same model for testing instance methods as the rest of the code.\n\nReviewed-By: Max Martin <max@puppetlabs.com>","sha":"78a01a253e44122dcf0343b016dbb77e1ad09575"},{"author":{"name":"Daniel Pittman","email":"3d0f3b9ddcacec30c4008c5e030e6c13a478cb4f@puppetlabs.com"},"url":"https://api.github.com/repos/jhelwig/puppet/commits/d64b01b1a2dd8b8669348b6adb99ae157beb9eec","message":"(#2848) Set `certdnsnames` values into the CSR.\n\nWe were incorrectly applying the `certdnsnames` setting when a certificate was\nsigned, not when a CSR was generated.  This would misapply the server setting\nto all nodes in the infrastructure, rather than applying the client-supplied\nversion.\n\nThis commit adds `certdnsnames` to the CSR, allowing the client to pass their\ndesired set of names to the CA to be propagated into the final certificate.\n\nIt does not alter the behaviour when the certificate is generated.\n\nSigned-off-by: Daniel Pittman <daniel@puppetlabs.com>","sha":"d64b01b1a2dd8b8669348b6adb99ae157beb9eec"},{"author":{"name":"Daniel Pittman","email":"3d0f3b9ddcacec30c4008c5e030e6c13a478cb4f@puppetlabs.com"},"url":"https://api.github.com/repos/jhelwig/puppet/commits/f4fc11d4e6c8d70de5f8ddd31505e2899c970ae8","message":"(#2848) extract the subjectAltName value from the CSR.\n\nWhen a CSR is submitted, we need to inspect it and determine if there are any\nsubjectAltNames present in the request, and if those are legal.\n\nThe logic to validate the content of an extension is complex, and decomposing\nthe content requires digging into various X509 and ASN.1 related classes.\n\nThis commit adds a `subject_alt_names` method that will extract the extensions\ncontaining subjectAltName values from the CSR, and reformat them into a useful\nset of content suitable for use in Ruby.\n\nSigned-off-by: Daniel Pittman <daniel@puppetlabs.com>","sha":"f4fc11d4e6c8d70de5f8ddd31505e2899c970ae8"},{"author":{"name":"Daniel Pittman","email":"3d0f3b9ddcacec30c4008c5e030e6c13a478cb4f@puppetlabs.com"},"url":"https://api.github.com/repos/jhelwig/puppet/commits/a729d906482d4456a7c09c227831dbfe8374f4a6","message":"(#2848) Reject unknown (== all) extensions on the CSR.\n\nIf we get a CSR with a request extension that we don't recognize, we used to\njust ignore those.  This can lead to dangerous situations, or at least\nsurprising behaviour, since we wouldn't copy those extensions into the final\ncertificate.\n\nThis changes that, by establishing an internal policy that we will whitelist\nacceptable request extensions, and will hard-reject anything that isn't on\nthat.\n\nOnce something passes the whitelist we will have further policy, which will\nenforce sanity in the request => certificate path.\n\nSigned-off-by: Daniel Pittman <daniel@puppetlabs.com>","sha":"a729d906482d4456a7c09c227831dbfe8374f4a6"},{"author":{"name":"Daniel Pittman","email":"3d0f3b9ddcacec30c4008c5e030e6c13a478cb4f@puppetlabs.com"},"url":"https://api.github.com/repos/jhelwig/puppet/commits/94345ebac6d79a890efc5f49e136c4f76ddda3ef","message":"(#2848) Rewrite SSL Certificate Factory, fixing `subjectAltName` leak.\n\nThis is a major rewrite of the SSL CertificateFactory, which transforms the\nway that we build the certificate we are about to sign in response to a CSR.\n\nThe main body of rework is to clean up the code and make it easier to manage\nand validate, but there are two essential changes:\n\n1. We no longer inject `subjectAltName` from local `certdnsnames`\n   configuration option into every certificate we generate.  This fixes\n   CVE-2011-3872, and prevents issuing client certificates that can\n   impersonate the master.\n\n2. *All* request extensions from the CSR are transported into the final\n   certificate.  This includes `basicConstraints`; we rely on other layers of\n   the Puppet stack having validated the code to this point.\n\nSigned-off-by: Daniel Pittman <daniel@puppetlabs.com>","sha":"94345ebac6d79a890efc5f49e136c4f76ddda3ef"},{"author":{"name":"Nick Lewis","email":"75ef9faee755c70589550b513ad881e5a603182c@puppetlabs.com"},"url":"https://api.github.com/repos/jhelwig/puppet/commits/7460a5e5229bf9275af5e75d121dec32a19b0839","message":"(#7224) Add a helper to Puppet::SSL::Certificate to retrieve alternate names\n\nAlternate names, if present, are specified in the subjectAltName extension of\nthe certificate. The values are in the form:\n\n\"DNS:alternate_name1, DNS:alternate_name2\"\n\nThis helper will retrieve the value of the subjectAltName extension and extract\nthe alternate names, returning and empty list if the extension is absent. This\nwill make it easier to access the entire list of possible names for a\ncertificate, rather than just the common name; this is helpful for generating\nmore detailed SSL error messages.\n\nPaired-With: Jacob Helwig <jacob@puppetlabs.com>","sha":"7460a5e5229bf9275af5e75d121dec32a19b0839"},{"author":{"name":"Nick Lewis","email":"75ef9faee755c70589550b513ad881e5a603182c@puppetlabs.com"},"url":"https://api.github.com/repos/jhelwig/puppet/commits/978b65c122a60ce4eb232f1c1c7677e8ace8176d","message":"(#2848) List subject alt names in output of puppet cert --list\n\nGiven that it's potentially risky to sign a certificate which has alt\nnames, we now surface that information so the user can make an informed\ndecision when signing. This also includes some changes to the format of\nthe output, grouping certs by status to make it more easily scannable.","sha":"978b65c122a60ce4eb232f1c1c7677e8ace8176d"},{"author":{"name":"Nick Lewis","email":"75ef9faee755c70589550b513ad881e5a603182c@puppetlabs.com"},"url":"https://api.github.com/repos/jhelwig/puppet/commits/6e3f529c8997105f00234def27b60888ac54b8bb","message":"(#2848) CSR subjectAltNames handling while signing.\n\nThe puppet cert application now supports the --allow-subject-alt-names command\nline flag to specify that the certificate to sign should contain a\nsubjectAltName extension request.\n\nIf the option is not specified, an attempt to sign a certificate with alt\nnames will fail. Similarly, if the option is specified, an attempt to sign a\ncertificate without alt names will fail.\n\nThe latter behavior is deliberate, and is intended to help stop users from\ndeveloping a habit of always supplying the option, and thus accidentally\nsigning a dangerous certificate without realizing it when one comes along.\n\nIt also adds the `--subject-alt-name` option that will add a `subjectAltName`\nextension request to a CSR when it is generated.  This allows an additional\nservice to be bootstrapped with those names.\n\nGenerally only one of the two options should be required, as the CSR and the\nsigning process are distinct.\n\nMostly by Nick Lewis, additional code by Daniel Pittman\n\nSigned-off-by: Daniel Pittman <daniel@puppetlabs.com>","sha":"6e3f529c8997105f00234def27b60888ac54b8bb"},{"author":{"name":"Daniel Pittman","email":"3d0f3b9ddcacec30c4008c5e030e6c13a478cb4f@puppetlabs.com"},"url":"https://api.github.com/repos/jhelwig/puppet/commits/a72049914b76a63104b21090eedca22ff2a15699","message":"(#2848) Use `certdnsnames` when bootstrapping a local master.\n\nWe don't have any formal way to determine if a node is a master or not, which\nmakes it hard to authoritatively answer the question of \"should `certdnsnames`\napply to this node\".\n\nHowever, we can assume that if you are the CA then you are also a master node.\nYou can't be one without the other.\n\nWe can also assume that if you are running as master, but are not a CA, you\nintend to continue in that fashion.  This is a weaker heuristic, but should be\neffective enough for folks that start a master at the right time...\n\nThis means that the basic bootstrapping case uses that setting as it is\ndesigned, and since we just generated the CA certificate we can fairly\nconfidently trust that we are doing the right thing with the request.\n\nSigned-off-by: Daniel Pittman <daniel@puppetlabs.com>","sha":"a72049914b76a63104b21090eedca22ff2a15699"},{"author":{"name":"Daniel Pittman","email":"3d0f3b9ddcacec30c4008c5e030e6c13a478cb4f@puppetlabs.com"},"url":"https://api.github.com/repos/jhelwig/puppet/commits/bc2267ad8d90a8a86be04cbea6087c40e37478b0","message":"(#2848) Rename `certdnsnames` to match new behaviour.\n\nAs part of the update to SSL the behaviour of the `certdnsnames` options\nchanged sufficiently that it would be terribly confusing to retain it.\n\nInstead, modify the setting to warn that it is ignored, and add a new setting\nto set the default subjectAltName value for bootstrapping a master\ncertificate.\n\nThis retains the one really useful part of the feature, without the risk that\nsomeone will accidentally use the old name and receive a nasty surprise.\n\nIt should also draw more attention to formerly insecure configurations.\n\nSigned-off-by: Daniel Pittman <daniel@puppetlabs.com>","sha":"bc2267ad8d90a8a86be04cbea6087c40e37478b0"},{"author":{"name":"Daniel Pittman","email":"3d0f3b9ddcacec30c4008c5e030e6c13a478cb4f@puppetlabs.com"},"url":"https://api.github.com/repos/jhelwig/puppet/commits/a53f2f2b81f613fc0fc33c180ab028e97ca0c232","message":"(#2848) rename subject-alt-name option to dns-alt-names\n\nThe name of the option for adding subjectAltName fields to the request didn't\nreally indicate what it actually did: we forced the names into the DNS label\nspace, and generally imposed a bunch of additional behaviours.\n\nThis renames the option to better match the intended use.\n\nSigned-off-by: Daniel Pittman <daniel@puppetlabs.com>","sha":"a53f2f2b81f613fc0fc33c180ab028e97ca0c232"},{"author":{"name":"Daniel Pittman","email":"3d0f3b9ddcacec30c4008c5e030e6c13a478cb4f@puppetlabs.com"},"url":"https://api.github.com/repos/jhelwig/puppet/commits/b876c39b8e492126fd2e35ae11c5c78c379571ef","message":"Wire up the `setbycli` slot in Puppet settings.\n\nThere was an existing slot on the setting object that tracked if the value had\nbeen set on the command line or not, but it was not wired up to the rest of\nthe system.\n\nThis wires that up, allowing us to use that to determine if the\n`dns-alt-names` setting should apply just to the local node, or to all nodes,\nsafely from the `puppet cert` application.\n\nSigned-off-by: Daniel Pittman <daniel@puppetlabs.com>","sha":"b876c39b8e492126fd2e35ae11c5c78c379571ef"},{"author":{"name":"Daniel Pittman","email":"3d0f3b9ddcacec30c4008c5e030e6c13a478cb4f@puppetlabs.com"},"url":"https://api.github.com/repos/jhelwig/puppet/commits/e65a88eadc93275358d7518102f22f99b2e76524","message":"(#2848) Migrate `dns-alt-names` back to settings.\n\nNow that all the other changes have been made, the `dns-alt-names` can migrate\nback to the settings where they apply only for generating the CSR for the\nlocal machine.\n\nThe one exception to that rule is the `puppet cert generate` application, in\nwhich we want to pass any *command line* value of `dns-alt-names` into the CSR\nfor a foreign node, but not the value from anywhere but the command line.\n\nSince the settings now track the CLI origin of a setting, we can use that to\nderive the data and pass it around appropriately to make that so.\n\nSigned-off-by: Daniel Pittman <daniel@puppetlabs.com>","sha":"e65a88eadc93275358d7518102f22f99b2e76524"},{"author":{"name":"Daniel Pittman","email":"3d0f3b9ddcacec30c4008c5e030e6c13a478cb4f@puppetlabs.com"},"url":"https://api.github.com/repos/jhelwig/puppet/commits/f1285a46eed2cabf2cd1de53c05e2ac2503c9c07","message":"(#2848) Only mark `subjectAltName` critical if `subject` is empty.\n\nFrom X509v3, the subjectAltName extension should only be marked critical if\nthe subject DN is empty:\n\n\"If the subject field contains an empty sequence, then the issuing CA MUST\n include a subjectAltName extension that is marked as critical. When including\n the subjectAltName extension in a certificate that has a non-empty subject\n distinguished name, conforming CAs SHOULD mark the subjectAltName extension\n as non-critical.\"\n\nThis applies that rule, by always marking the `subjectAltName` as\nnon-critical, because we never have an empty name in our system.\n\nSigned-off-by: Daniel Pittman <daniel@puppetlabs.com>","sha":"f1285a46eed2cabf2cd1de53c05e2ac2503c9c07"},{"author":{"name":"Daniel Pittman","email":"3d0f3b9ddcacec30c4008c5e030e6c13a478cb4f@puppetlabs.com"},"url":"https://api.github.com/repos/jhelwig/puppet/commits/99488f363a3c53d4b6498d13ee5ca0c69b5e0127","message":"(#2848) Don't enable `emailProtection` for server keys.\n\nPreviously, Puppet enabled the `emailProtection` bit in the extended key usage\nfield.  This is unnecessary, and while probably not harmful we are taking the\nview that what is not required should not be allowed, so ... removed.\n\nSigned-off-by: Daniel Pittman <daniel@puppetlabs.com>","sha":"99488f363a3c53d4b6498d13ee5ca0c69b5e0127"},{"author":{"name":"Daniel Pittman","email":"3d0f3b9ddcacec30c4008c5e030e6c13a478cb4f@puppetlabs.com"},"url":"https://api.github.com/repos/jhelwig/puppet/commits/0b45f4ceb015d3d058221364d4a662bb2c7d28fa","message":"(#2848) Don't strip the subjectAltName label when listing.\n\nThe X.509 `subjectAltName` field contains a set of labeled values; each label\ndefines a namespace that the rest of the content fits within.  DNS is one of\nthose, and is the only one that Puppet actually uses, but there are plenty of\nothers including email addresses, IP, a DN, or a URI.\n\nWhen we displayed the values we used to strip that label off, which hid\npotentially critical information from the user.  Instead we should preserve,\nand display, that data.\n\nSigned-off-by: Daniel Pittman <daniel@puppetlabs.com>","sha":"0b45f4ceb015d3d058221364d4a662bb2c7d28fa"},{"author":{"name":"Daniel Pittman","email":"3d0f3b9ddcacec30c4008c5e030e6c13a478cb4f@puppetlabs.com"},"url":"https://api.github.com/repos/jhelwig/puppet/commits/d8516d947c4fae19e5a478e9401fdeff2ff4725f","message":"(#2848) Consistently use `subject_alt_names` as accessor name.\n\nWe had several different names for the same operation on different SSL\nobjects; this made little sense.  Now they are unified to use the same,\nstandard-based, name for the accessor.\n\nSigned-off-by: Daniel Pittman <daniel@puppetlabs.com>","sha":"d8516d947c4fae19e5a478e9401fdeff2ff4725f"},{"author":{"name":"Daniel Pittman","email":"3d0f3b9ddcacec30c4008c5e030e6c13a478cb4f@puppetlabs.com"},"url":"https://api.github.com/repos/jhelwig/puppet/commits/2b1ad43a99249c9e0bef753cb18c6cab45a4f750","message":"(#2848) Consistent return values from `subject_alt_names` accessors.\n\nThe various implementations of the `subject_alt_names` accessor on SSL objects\nhad different return types when the records were not present: nil, or an empty\narray.\n\nThis unifies them to consistently return an empty array, which makes it easier\nto iterate across the code.  It also cleans up some logic around handling\npolicy on those, to make it cleaner and quicker by not duplicating the same\n\"are there any subjectAltName values?\" test across every policy check.\n\nSigned-off-by: Daniel Pittman <daniel@puppetlabs.com>","sha":"2b1ad43a99249c9e0bef753cb18c6cab45a4f750"},{"author":{"name":"Nick Lewis","email":"75ef9faee755c70589550b513ad881e5a603182c@puppetlabs.com"},"url":"https://api.github.com/repos/jhelwig/puppet/commits/a644514f115d273be3235d97d11771206a093b95","message":"(#2848) Remove unused xmlrpc code\n\nWe no longer use the xmlrpc client in 2.6, so this is dead code. Because\nit depends on the legacy SSLCertificates code, which is also going away,\nthis code needs to be removed. We leave the server code for backward\ncompatibility with older clients.\n\nSigned-off-by: Daniel Pittman <daniel@puppetlabs.com>","sha":"a644514f115d273be3235d97d11771206a093b95"},{"author":{"name":"Nick Lewis","email":"75ef9faee755c70589550b513ad881e5a603182c@puppetlabs.com"},"url":"https://api.github.com/repos/jhelwig/puppet/commits/28dead0c05f4b01f6c273abfca0891ff0ee63da4","message":"(#2848) Rework the xmlrpc CA handler to use the modern SSL code\n\nIn order to remove the legacy SSLCertificates code, we first need to\nrework the one place it's still being used, which is the CA handler.\nNow, this handler essentially just defers to the Puppet::SSL classes.\n\nSigned-off-by: Daniel Pittman <daniel@puppetlabs.com>","sha":"28dead0c05f4b01f6c273abfca0891ff0ee63da4"}],"head":"d3791a4f3a92e77c5d293b3cfcb1cfb6e46e62f8","size":101,"push_id":48651445}