[no description] https://git.osdyson.ru/pkg-puppet/puppet/atom?h=master 2014-10-21T00:01:48Z 2014-10-21T00:01:48Z Josh Cooper josh@puppetlabs.com 2014-10-20T22:00:22Z urn:sha1:885838a0c1705ad0dee2fa168a992188f79faf99 Previously, when puppet initiated SSL connections, e.g. puppet agent, puppet module, etc, it could downgrade to SSLv3. This commit ensures puppet will not downgrade to SSLv3 by setting the `OpenSSL::SSL::OP_NO_SSLv3` bit. However, unlike SSLv2, we cannot remove SSLv3 ciphersuites, since they are the same ones used in TLSv1. From the openssl ciphers man page, "The TLSv1.0 ciphers are flagged with SSLv3". [1] https://www.openssl.org/docs/ssl/SSL_CIPHER_get_name.html 2014-10-21T00:01:47Z Josh Cooper josh@puppetlabs.com 2014-10-20T21:45:37Z urn:sha1:67b89bdda95149cc2df7abac2da8d906ccd551ce Previously, puppet's webrick server did not specify which ciphersuites it would accept. Depending on the ruby and openssl, the default set of ciphersuites is: $ ruby -ropenssl -e 'puts OpenSSL::SSL::SSLContext::DEFAULT_PARAMS[:ciphers]' ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW Note that "ALL:!ADH" does not exclude AECDH, and the default param string includes "LOW", e.g. DES-CBC-SHA. This commit updates the webrick ciphersuites to match the value used in passenger in commit 204b2974b. The resulting ciphersuites are: [["DHE-RSA-AES256-GCM-SHA384", "TLSv1/SSLv3", 256, 256], ["DHE-RSA-AES256-SHA256", "TLSv1/SSLv3", 256, 256], ["ECDHE-RSA-AES256-GCM-SHA384", "TLSv1/SSLv3", 256, 256], ["ECDHE-RSA-AES256-SHA384", "TLSv1/SSLv3", 256, 256], ["DHE-RSA-AES128-GCM-SHA256", "TLSv1/SSLv3", 128, 128], ["DHE-RSA-AES128-SHA256", "TLSv1/SSLv3", 128, 128], ["ECDHE-RSA-AES128-GCM-SHA256", "TLSv1/SSLv3", 128, 128], ["ECDHE-RSA-AES128-SHA256", "TLSv1/SSLv3", 128, 128], ["DHE-RSA-CAMELLIA256-SHA", "TLSv1/SSLv3", 256, 256], ["DHE-RSA-AES256-SHA", "TLSv1/SSLv3", 256, 256], ["ECDHE-RSA-AES256-SHA", "TLSv1/SSLv3", 256, 256], ["DHE-RSA-CAMELLIA128-SHA", "TLSv1/SSLv3", 128, 128], ["DHE-RSA-AES128-SHA", "TLSv1/SSLv3", 128, 128], ["ECDHE-RSA-AES128-SHA", "TLSv1/SSLv3", 128, 128], ["CAMELLIA256-SHA", "TLSv1/SSLv3", 256, 256], ["AES256-SHA", "TLSv1/SSLv3", 256, 256], ["CAMELLIA128-SHA", "TLSv1/SSLv3", 128, 128], ["AES128-SHA", "TLSv1/SSLv3", 128, 128]] 2014-10-20T22:28:43Z Josh Cooper josh@puppetlabs.com 2014-10-20T21:21:34Z urn:sha1:cb6bc786db52c604f112141e29b8d7b1427bfafa Webrick will now reject SSLv3 connections. If an SSL client tries to connection with SSLv3, webrick+openssl will issue an sslv3 alert handshake failure. 2014-10-16T23:37:46Z Andrew Parker andy@puppetlabs.com 2014-10-16T23:37:46Z urn:sha1:d4b882760269060287bd8325548eea2a29f64506 The :undef symbol was still leaking all over the place internally. This caused type inference to sometimes end up with Runtime[ruby, Symbol]. By using nil instead of :undef, everything can be much more straightforward. Once the code removal for puppet 4 comes into play even more oddities around how resource parameters are handled can be performed. 2014-10-16T21:20:00Z Andrew Parker andy@puppetlabs.com 2014-10-16T21:20:00Z urn:sha1:a40cfd624fbc7380690d76a6cb691225e0e9eeba The lookup function only works when the future parser is in effect. This changes the spec tests to turn on the future parser. 2014-10-16T18:17:56Z Andrew Parker andy@puppetlabs.com 2014-10-16T18:17:56Z urn:sha1:873a93ed5b5f0bdbded4bc739a601ef77cd19555 (PUP-3401) Fix type calculations of "all Patterns" 2014-10-15T22:55:27Z Hailee Kenney hailee@puppetlabs.com 2014-10-14T17:48:27Z urn:sha1:04b47bebf80c14b0e40a6bde7888e58fcfcbad72 In order to ensure that we don't encounter this issue again, add a test case to environments_spec to ensure that the cache is being properly cleared. Additionally, fix a small bug in environment's list method where a string should been converted to a symbol. 2014-10-15T18:03:11Z Kylo Ginsberg kylo@puppetlabs.com 2014-10-15T18:03:11Z urn:sha1:a8060647f705ee2b2db766bd2b87963ee6f5adbd (PUP-3357) purge unnamed ssh keys 2014-10-15T17:52:45Z Felix Frank Felix.Frank@Alumni.TU-Berlin.de 2014-10-13T22:25:53Z urn:sha1:2a0eaac7321f199e023fd9500cfab64cfd6544ce Add an integration test with an ssh keyfile in which two keys have no name and make sure that both are successfully purged. 2014-10-15T17:52:45Z Felix Frank Felix.Frank@Alumni.TU-Berlin.de 2014-10-06T22:47:09Z urn:sha1:c9fd8dcb8c1860e80215a3d9fa1ee7fedec0ec2e Just makes sure that the user type and ssh_authorized_keys provider generate pseudo-names for keys following the same pattern.