[no description] https://git.osdyson.ru/pkg-puppet/puppet/atom?h=master 2014-10-24T11:27:50Z 2014-10-24T11:27:50Z Stig Sandbeck Mathisen ssm@debian.org 2014-10-24T11:27:50Z urn:sha1:deaf3b4969d6518166fd08a10a387c45a4fc58ec 2014-10-21T21:43:14Z Rob Reynolds ferventcoder@gmail.com 2014-10-21T21:43:14Z urn:sha1:652bc05e123a78ffe7b34f9b9f674e6e04be6ee5 2014-10-21T00:01:48Z Josh Cooper josh@puppetlabs.com 2014-10-20T22:00:22Z urn:sha1:885838a0c1705ad0dee2fa168a992188f79faf99 Previously, when puppet initiated SSL connections, e.g. puppet agent, puppet module, etc, it could downgrade to SSLv3. This commit ensures puppet will not downgrade to SSLv3 by setting the `OpenSSL::SSL::OP_NO_SSLv3` bit. However, unlike SSLv2, we cannot remove SSLv3 ciphersuites, since they are the same ones used in TLSv1. From the openssl ciphers man page, "The TLSv1.0 ciphers are flagged with SSLv3". [1] https://www.openssl.org/docs/ssl/SSL_CIPHER_get_name.html 2014-10-21T00:01:47Z Josh Cooper josh@puppetlabs.com 2014-10-20T21:45:37Z urn:sha1:67b89bdda95149cc2df7abac2da8d906ccd551ce Previously, puppet's webrick server did not specify which ciphersuites it would accept. Depending on the ruby and openssl, the default set of ciphersuites is: $ ruby -ropenssl -e 'puts OpenSSL::SSL::SSLContext::DEFAULT_PARAMS[:ciphers]' ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW Note that "ALL:!ADH" does not exclude AECDH, and the default param string includes "LOW", e.g. DES-CBC-SHA. This commit updates the webrick ciphersuites to match the value used in passenger in commit 204b2974b. The resulting ciphersuites are: [["DHE-RSA-AES256-GCM-SHA384", "TLSv1/SSLv3", 256, 256], ["DHE-RSA-AES256-SHA256", "TLSv1/SSLv3", 256, 256], ["ECDHE-RSA-AES256-GCM-SHA384", "TLSv1/SSLv3", 256, 256], ["ECDHE-RSA-AES256-SHA384", "TLSv1/SSLv3", 256, 256], ["DHE-RSA-AES128-GCM-SHA256", "TLSv1/SSLv3", 128, 128], ["DHE-RSA-AES128-SHA256", "TLSv1/SSLv3", 128, 128], ["ECDHE-RSA-AES128-GCM-SHA256", "TLSv1/SSLv3", 128, 128], ["ECDHE-RSA-AES128-SHA256", "TLSv1/SSLv3", 128, 128], ["DHE-RSA-CAMELLIA256-SHA", "TLSv1/SSLv3", 256, 256], ["DHE-RSA-AES256-SHA", "TLSv1/SSLv3", 256, 256], ["ECDHE-RSA-AES256-SHA", "TLSv1/SSLv3", 256, 256], ["DHE-RSA-CAMELLIA128-SHA", "TLSv1/SSLv3", 128, 128], ["DHE-RSA-AES128-SHA", "TLSv1/SSLv3", 128, 128], ["ECDHE-RSA-AES128-SHA", "TLSv1/SSLv3", 128, 128], ["CAMELLIA256-SHA", "TLSv1/SSLv3", 256, 256], ["AES256-SHA", "TLSv1/SSLv3", 256, 256], ["CAMELLIA128-SHA", "TLSv1/SSLv3", 128, 128], ["AES128-SHA", "TLSv1/SSLv3", 128, 128]] 2014-10-20T22:28:43Z Josh Cooper josh@puppetlabs.com 2014-10-20T21:21:34Z urn:sha1:cb6bc786db52c604f112141e29b8d7b1427bfafa Webrick will now reject SSLv3 connections. If an SSL client tries to connection with SSLv3, webrick+openssl will issue an sslv3 alert handshake failure. 2014-10-16T23:37:46Z Andrew Parker andy@puppetlabs.com 2014-10-16T23:37:46Z urn:sha1:d4b882760269060287bd8325548eea2a29f64506 The :undef symbol was still leaking all over the place internally. This caused type inference to sometimes end up with Runtime[ruby, Symbol]. By using nil instead of :undef, everything can be much more straightforward. Once the code removal for puppet 4 comes into play even more oddities around how resource parameters are handled can be performed. 2014-10-16T18:17:56Z Andrew Parker andy@puppetlabs.com 2014-10-16T18:17:56Z urn:sha1:873a93ed5b5f0bdbded4bc739a601ef77cd19555 (PUP-3401) Fix type calculations of "all Patterns" 2014-10-15T22:55:27Z Hailee Kenney hailee@puppetlabs.com 2014-10-14T17:48:27Z urn:sha1:04b47bebf80c14b0e40a6bde7888e58fcfcbad72 In order to ensure that we don't encounter this issue again, add a test case to environments_spec to ensure that the cache is being properly cleared. Additionally, fix a small bug in environment's list method where a string should been converted to a symbol. 2014-10-15T18:35:56Z Hailee Kenney hailee@puppetlabs.com 2014-10-13T22:16:24Z urn:sha1:920b127cb93d88c787f081fa6c56bc04ccb87bbf Prior to this commit, environment settings were not being updated when environment.conf was changed, even if environment timeout had expired. This was because they were being cached in places in Puppet.settings that were not being cleared. Now, all the cached data for a particular environment is cleared when the environment timeout expires. 2014-10-15T18:03:11Z Kylo Ginsberg kylo@puppetlabs.com 2014-10-15T18:03:11Z urn:sha1:a8060647f705ee2b2db766bd2b87963ee6f5adbd (PUP-3357) purge unnamed ssh keys