openvox 7.37.1 → 8.19.0

data/lib/puppet/ssl/base.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative '../../puppet/ssl/openssl_loader'
 require_relative '../../puppet/ssl'
 require_relative '../../puppet/ssl/digest'
@@ -15,7 +17,7 @@ class Puppet::SSL::Base
   end
 
   def self.to_multiple_s(instances)
-    instances.collect { |inst| inst.to_s }.join(SEPARATOR)
+    instances.collect(&:to_s).join(SEPARATOR)
   end
 
   def self.wraps(klass)
@@ -24,6 +26,7 @@ class Puppet::SSL::Base
 
   def self.wrapped_class
     raise(Puppet::DevError, _("%{name} has not declared what class it wraps") % { name: self }) unless defined?(@wrapped_class)
+
     @wrapped_class
   end
 
@@ -62,7 +65,7 @@ class Puppet::SSL::Base
   def self.from_instance(instance, name = nil)
     unless instance.is_a?(wrapped_class)
       raise ArgumentError, _("Object must be an instance of %{class_name}, %{actual_class} given") %
-          { class_name: wrapped_class, actual_class: instance.class }
+                           { class_name: wrapped_class, actual_class: instance.class }
     end
     if name.nil? and !instance.respond_to?(:subject)
       raise ArgumentError, _("Name must be supplied if it cannot be determined from the instance")
@@ -95,6 +98,7 @@ class Puppet::SSL::Base
   # Convert our thing to pem.
   def to_s
     return "" unless content
+
     content.to_pem
   end
 
@@ -105,6 +109,7 @@ class Puppet::SSL::Base
   # Provide the full text of the thing we're dealing with.
   def to_text
     return "" unless content
+
     content.to_text
   end
 
@@ -113,10 +118,8 @@ class Puppet::SSL::Base
     digest(mds).to_hex
   end
 
-  def digest(algorithm=nil)
-    unless algorithm
-      algorithm = digest_algorithm
-    end
+  def digest(algorithm = nil)
+    algorithm ||= digest_algorithm
 
     Puppet::SSL::Digest.new(algorithm, content.to_der)
   end

data/lib/puppet/ssl/certificate.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative '../../puppet/ssl/base'
 
 # Manage certificates themselves.  This class has no
@@ -18,8 +20,9 @@ class Puppet::SSL::Certificate < Puppet::SSL::Base
   end
 
   def self.subject_alt_names_for(cert)
-    alts = cert.extensions.find{|ext| ext.oid == "subjectAltName"}
+    alts = cert.extensions.find { |ext| ext.oid == "subjectAltName" }
     return [] unless alts
+
     alts.value.split(/\s*,\s*/)
   end
 
@@ -29,6 +32,7 @@ class Puppet::SSL::Certificate < Puppet::SSL::Base
 
   def expiration
     return nil unless content
+
     content.not_after
   end
 
@@ -55,13 +59,12 @@ class Puppet::SSL::Certificate < Puppet::SSL::Base
     end
 
     custom_exts.map do |ext|
-      {'oid' => ext.oid, 'value' => get_ext_val(ext.oid)}
+      { 'oid' => ext.oid, 'value' => get_ext_val(ext.oid) }
     end
   end
 
   private
 
-
   # Extract the extensions sequence from the wrapped certificate's raw ASN.1 form
   def exts_seq
     # See RFC-2459 section 4.1 (https://tools.ietf.org/html/rfc2459#section-4.1)
@@ -92,5 +95,4 @@ class Puppet::SSL::Certificate < Puppet::SSL::Base
       raw_val
     end
   end
-
 end

data/lib/puppet/ssl/certificate_request.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative '../../puppet/ssl/base'
 require_relative '../../puppet/ssl/certificate_signer'
 
@@ -35,7 +37,9 @@ class Puppet::SSL::CertificateRequest < Puppet::SSL::Base
   end
 
   def extension_factory
+    # rubocop:disable Naming/MemoizedInstanceVariableName
     @ef ||= OpenSSL::X509::ExtensionFactory.new
+    # rubocop:enable Naming/MemoizedInstanceVariableName
   end
 
   # Create a certificate request with our system settings.
@@ -68,10 +72,7 @@ class Puppet::SSL::CertificateRequest < Puppet::SSL::Base
     csr.public_key = if key.is_a?(OpenSSL::PKey::EC)
                        # EC#public_key doesn't follow the PKey API,
                        # see https://github.com/ruby/openssl/issues/29
-                       point = key.public_key
-                       pubkey = OpenSSL::PKey::EC.new(point.group)
-                       pubkey.public_key = point
-                       pubkey
+                       key
                      else
                        key.public_key
                      end
@@ -141,8 +142,8 @@ class Puppet::SSL::CertificateRequest < Puppet::SSL::Base
 
     # Prefer the standard extReq, but accept the Microsoft specific version as
     # a fallback, if the standard version isn't found.
-    attribute   = @content.attributes.find {|x| x.oid == "extReq" }
-    attribute ||= @content.attributes.find {|x| x.oid == "msExtReq" }
+    attribute   = @content.attributes.find { |x| x.oid == "extReq" }
+    attribute ||= @content.attributes.find { |x| x.oid == "msExtReq" }
     return [] unless attribute
 
     extensions = unpack_extension_request(attribute)
@@ -160,9 +161,9 @@ class Puppet::SSL::CertificateRequest < Puppet::SSL::Base
       # fixed component in the sequence.
       case ext_values.length
       when 2
-        {"oid" => ext_values[0].value, "value" => value}
+        { "oid" => ext_values[0].value, "value" => value }
       when 3
-        {"oid" => ext_values[0].value, "value" => value, "critical" => ext_values[1].value}
+        { "oid" => ext_values[0].value, "value" => value, "critical" => ext_values[1].value }
       else
         raise Puppet::Error, _("In %{attr}, expected extension record %{index} to have two or three items, but found %{count}") % { attr: attribute.oid, index: index, count: ext_values.length }
       end
@@ -170,12 +171,12 @@ class Puppet::SSL::CertificateRequest < Puppet::SSL::Base
   end
 
   def subject_alt_names
-    @subject_alt_names ||= request_extensions.
-      select {|x| x["oid"] == "subjectAltName" }.
-      map {|x| x["value"].split(/\s*,\s*/) }.
-      flatten.
-      sort.
-      uniq
+    @subject_alt_names ||= request_extensions
+                           .select { |x| x["oid"] == "subjectAltName" }
+                           .map { |x| x["value"].split(/\s*,\s*/) }
+                           .flatten
+                           .sort
+                           .uniq
   end
 
   # Return all user specified attributes attached to this CSR as a hash. IF an
@@ -195,7 +196,7 @@ class Puppet::SSL::CertificateRequest < Puppet::SSL::Base
     end
 
     x509_attributes.map do |attr|
-      {"oid" => attr.oid, "value" => attr.value.value.first.value}
+      { "oid" => attr.oid, "value" => attr.value.value.first.value }
     end
   end
 
@@ -208,29 +209,27 @@ class Puppet::SSL::CertificateRequest < Puppet::SSL::Base
   # we need to prevent that field from being written to directly.
   PRIVATE_CSR_ATTRIBUTES = [
     'extReq',   '1.2.840.113549.1.9.14',
-    'msExtReq', '1.3.6.1.4.1.311.2.1.14',
+    'msExtReq', '1.3.6.1.4.1.311.2.1.14'
   ]
 
   def add_csr_attributes(csr, csr_attributes)
     csr_attributes.each do |oid, value|
-      begin
-        if PRIVATE_CSR_ATTRIBUTES.include? oid
-          raise ArgumentError, _("Cannot specify CSR attribute %{oid}: conflicts with internally used CSR attribute") % { oid: oid }
-        end
+      if PRIVATE_CSR_ATTRIBUTES.include? oid
+        raise ArgumentError, _("Cannot specify CSR attribute %{oid}: conflicts with internally used CSR attribute") % { oid: oid }
+      end
 
-        encoded = OpenSSL::ASN1::PrintableString.new(value.to_s)
+      encoded = OpenSSL::ASN1::PrintableString.new(value.to_s)
 
-        attr_set = OpenSSL::ASN1::Set.new([encoded])
-        csr.add_attribute(OpenSSL::X509::Attribute.new(oid, attr_set))
-        Puppet.debug("Added csr attribute: #{oid} => #{attr_set.inspect}")
-      rescue OpenSSL::X509::AttributeError => e
-        raise Puppet::Error, _("Cannot create CSR with attribute %{oid}: %{message}") % { oid: oid, message: e.message }, e.backtrace
-      end
+      attr_set = OpenSSL::ASN1::Set.new([encoded])
+      csr.add_attribute(OpenSSL::X509::Attribute.new(oid, attr_set))
+      Puppet.debug("Added csr attribute: #{oid} => #{attr_set.inspect}")
+    rescue OpenSSL::X509::AttributeError => e
+      raise Puppet::Error, _("Cannot create CSR with attribute %{oid}: %{message}") % { oid: oid, message: e.message }, e.backtrace
     end
   end
 
   PRIVATE_EXTENSIONS = [
-    'subjectAltName', '2.5.29.17',
+    'subjectAltName', '2.5.29.17'
   ]
 
   # @api private
@@ -239,16 +238,14 @@ class Puppet::SSL::CertificateRequest < Puppet::SSL::Base
 
     if options[:extension_requests]
       options[:extension_requests].each_pair do |oid, value|
-        begin
-          if PRIVATE_EXTENSIONS.include? oid
-            raise Puppet::Error, _("Cannot specify CSR extension request %{oid}: conflicts with internally used extension request") % { oid: oid }
-          end
-
-          ext = OpenSSL::X509::Extension.new(oid, OpenSSL::ASN1::UTF8String.new(value.to_s).to_der, false)
-          extensions << ext
-        rescue OpenSSL::X509::ExtensionError => e
-          raise Puppet::Error, _("Cannot create CSR with extension request %{oid}: %{message}") % { oid: oid, message: e.message }, e.backtrace
+        if PRIVATE_EXTENSIONS.include? oid
+          raise Puppet::Error, _("Cannot specify CSR extension request %{oid}: conflicts with internally used extension request") % { oid: oid }
         end
+
+        ext = OpenSSL::X509::Extension.new(oid, OpenSSL::ASN1::UTF8String.new(value.to_s).to_der, false)
+        extensions << ext
+      rescue OpenSSL::X509::ExtensionError => e
+        raise Puppet::Error, _("Cannot create CSR with extension request %{oid}: %{message}") % { oid: oid, message: e.message }, e.backtrace
       end
     end
 
@@ -296,7 +293,6 @@ class Puppet::SSL::CertificateRequest < Puppet::SSL::Base
   # @return [Array<Array<Object>>] A array of arrays containing the extension
   #   OID the critical state if present, and the extension value.
   def unpack_extension_request(attribute)
-
     unless attribute.value.is_a? OpenSSL::ASN1::Set
       raise Puppet::Error, _("In %{attr}, expected Set but found %{klass}") % { attr: attribute.oid, klass: attribute.value.class }
     end

data/lib/puppet/ssl/certificate_request_attributes.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative '../../puppet/ssl'
 require_relative '../../puppet/util/yaml'
 
@@ -6,7 +8,6 @@ require_relative '../../puppet/util/yaml'
 #
 # @api private
 class Puppet::SSL::CertificateRequestAttributes
-
   attr_reader :path, :custom_attributes, :extension_requests
 
   def initialize(path)
@@ -22,16 +23,18 @@ class Puppet::SSL::CertificateRequestAttributes
     Puppet.info(_("csr_attributes file loading from %{path}") % { path: path })
     if Puppet::FileSystem.exist?(path)
       hash = Puppet::Util::Yaml.safe_load_file(path, [Symbol]) || {}
-      if ! hash.is_a?(Hash)
+      unless hash.is_a?(Hash)
         raise Puppet::Error, _("invalid CSR attributes, expected instance of Hash, received instance of %{klass}") % { klass: hash.class }
       end
+
       @custom_attributes = hash.delete('custom_attributes') || {}
       @extension_requests = hash.delete('extension_requests') || {}
-      if not hash.keys.empty?
+      unless hash.keys.empty?
         raise Puppet::Error, _("unexpected attributes %{keys} in %{path}") % { keys: hash.keys.inspect, path: @path.inspect }
       end
+
       return true
     end
-    return false
+    false
   end
 end

data/lib/puppet/ssl/certificate_signer.rb

@@ -1,10 +1,11 @@
+# frozen_string_literal: true
+
 # Take care of signing a certificate in a FIPS 140-2 compliant manner.
 #
 # @see https://projects.puppetlabs.com/issues/17295
 #
 # @api private
 class Puppet::SSL::CertificateSigner
-
   # @!attribute [r] digest
   #   @return [OpenSSL::Digest]
   attr_reader :digest
@@ -22,9 +23,8 @@ class Puppet::SSL::CertificateSigner
       @digest = OpenSSL::Digest::SHA224
     else
       raise Puppet::Error,
-        "No FIPS 140-2 compliant digest algorithm in OpenSSL::Digest"
+            "No FIPS 140-2 compliant digest algorithm in OpenSSL::Digest"
     end
-    @digest
   end
 
   # Sign a certificate signing request (CSR) with a private key.

data/lib/puppet/ssl/digest.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 class Puppet::SSL::Digest
   attr_reader :digest
 

data/lib/puppet/ssl/error.rb

@@ -1,8 +1,11 @@
+# frozen_string_literal: true
+
 module Puppet::SSL
   class SSLError < Puppet::Error; end
 
   class CertVerifyError < Puppet::SSL::SSLError
     attr_reader :code, :cert
+
     def initialize(message, code, cert)
       super(message)
       @code = code

data/lib/puppet/ssl/oids.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative '../../puppet/ssl'
 
 # This module defines OIDs for use within Puppet.
@@ -27,7 +29,6 @@ require_relative '../../puppet/ssl'
 #
 # @api private
 module Puppet::SSL::Oids
-
   # Note: When updating the following OIDs make sure to also update the OID
   # definitions here:
   # https://github.com/puppetlabs/puppetserver/blob/master/src/clj/puppetlabs/puppetserver/certificate_authority.clj#L122-L159
@@ -69,9 +70,10 @@ module Puppet::SSL::Oids
 
     ["1.3.6.1.4.1.34380.1.3", 'ppAuthCertExt', 'Puppet Certificate Authorization Extension'],
 
-    ["1.3.6.1.4.1.34380.1.3.1",  'pp_authorization', 'Certificate Extension Authorization'],
+    ["1.3.6.1.4.1.34380.1.3.1", 'pp_authorization', 'Certificate Extension Authorization'],
+    ["1.3.6.1.4.1.34380.1.3.2", 'pp_auth_auto_renew', 'Auto-Renew Certificate Attribute'],
     ["1.3.6.1.4.1.34380.1.3.13", 'pp_auth_role', 'Puppet Node Role Name for Authorization'],
-    ["1.3.6.1.4.1.34380.1.3.39", 'pp_cli_auth', 'Puppetserver CA CLI Authorization'],
+    ["1.3.6.1.4.1.34380.1.3.39", 'pp_cli_auth', 'Puppetserver CA CLI Authorization']
   ]
 
   @did_register_puppet_oids = false
@@ -79,8 +81,8 @@ module Puppet::SSL::Oids
   # Register our custom Puppet OIDs with OpenSSL so they can be used as CSR
   # extensions. Without registering these OIDs, OpenSSL will fail when it
   # encounters such an extension in a CSR.
-  def self.register_puppet_oids()
-    if !@did_register_puppet_oids
+  def self.register_puppet_oids
+    unless @did_register_puppet_oids
       PUPPET_OIDS.each do |oid_defn|
         OpenSSL::ASN1::ObjectId.register(*oid_defn)
       end
@@ -104,7 +106,7 @@ module Puppet::SSL::Oids
   #  '1.3.6.1.4.1.34380.1.2.1.2':
   #    shortname: 'myothershortname'
   #    longname: 'Other Long name'
-  def self.parse_custom_oid_file(custom_oid_file, map_key='oid_mapping')
+  def self.parse_custom_oid_file(custom_oid_file, map_key = 'oid_mapping')
     if File.exist?(custom_oid_file) && File.readable?(custom_oid_file)
       mapping = nil
       begin
@@ -123,10 +125,11 @@ module Puppet::SSL::Oids
 
       oid_defns = []
       mapping[map_key].keys.each do |oid|
-        shortname, longname = mapping[map_key][oid].values_at("shortname","longname")
+        shortname, longname = mapping[map_key][oid].values_at("shortname", "longname")
         if shortname.nil? || longname.nil?
           raise Puppet::Error, _("Error loading ssl custom OIDs mapping file from '%{custom_oid_file}': incomplete definition of oid '%{oid}'") % { custom_oid_file: custom_oid_file, oid: oid }
         end
+
         oid_defns << [oid, shortname, longname]
       end
 
@@ -149,7 +152,7 @@ module Puppet::SSL::Oids
   #  '1.3.6.1.4.1.34380.1.2.1.2':
   #    shortname: 'myothershortname'
   #    longname: 'Other Long name'
-  def self.load_custom_oid_file(custom_oid_file, map_key='oid_mapping')
+  def self.load_custom_oid_file(custom_oid_file, map_key = 'oid_mapping')
     oid_defns = parse_custom_oid_file(custom_oid_file, map_key)
     unless oid_defns.nil?
       begin
@@ -185,7 +188,6 @@ module Puppet::SSL::Oids
     first_oid = OpenSSL::ASN1::ObjectId.new(first).oid
     second_oid = OpenSSL::ASN1::ObjectId.new(second).oid
 
-
     if exclusive and first_oid == second_oid
       false
     else

data/lib/puppet/ssl/openssl_loader.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative '../../puppet/util/platform'
 
 # This file should be required instead of writing `require 'openssl'`
@@ -5,10 +7,7 @@ require_relative '../../puppet/util/platform'
 # core Puppet code to load correctly in JRuby environments that do not
 # have a functioning openssl (eg a FIPS enabled one).
 
-unless Puppet::Util::Platform.jruby_fips?
-  require 'openssl'
-  require 'net/https'
-else
+if Puppet::Util::Platform.jruby_fips?
   # Even in JRuby we need to define the constants that are wrapped in
   # Indirections: Puppet::SSL::{Key, Certificate, CertificateRequest}
   module OpenSSL
@@ -21,4 +20,7 @@ else
       class Certificate; end
     end
   end
+else
+  require 'openssl'
+  require 'net/https'
 end

data/lib/puppet/ssl/ssl_context.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative '../../puppet/ssl'
 
 module Puppet::SSL

data/lib/puppet/ssl/ssl_provider.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative '../../puppet/ssl'
 
 # SSL Provider creates `SSLContext` objects that can be used to create
@@ -216,16 +218,16 @@ class Puppet::SSL::SSLProvider
       chain.reverse.each_with_index do |cert, i|
         digest = Puppet::SSL::Digest.new(alg, cert.to_der)
         if i == chain.length - 1
-          Puppet.debug(_("Verified client certificate '%{subject}' fingerprint %{digest}") % {subject: cert.subject.to_utf8, digest: digest})
+          Puppet.debug(_("Verified client certificate '%{subject}' fingerprint %{digest}") % { subject: cert.subject.to_utf8, digest: digest })
         else
-          Puppet.debug(_("Verified CA certificate '%{subject}' fingerprint %{digest}") % {subject: cert.subject.to_utf8, digest: digest})
+          Puppet.debug(_("Verified CA certificate '%{subject}' fingerprint %{digest}") % { subject: cert.subject.to_utf8, digest: digest })
         end
       end
       ssl_context.crls.each do |crl|
-        oid_values = Hash[crl.extensions.map { |ext| [ext.oid, ext.value] }]
+        oid_values = crl.extensions.to_h { |ext| [ext.oid, ext.value] }
         crlNumber = oid_values['crlNumber'] || 'unknown'
-        authKeyId = (oid_values['authorityKeyIdentifier'] || 'unknown').chomp!
-        Puppet.debug("Using CRL '#{crl.issuer.to_utf8}' authorityKeyIdentifier '#{authKeyId}' crlNumber '#{crlNumber }'")
+        authKeyId = (oid_values['authorityKeyIdentifier'] || 'unknown').chomp
+        Puppet.debug("Using CRL '#{crl.issuer.to_utf8}' authorityKeyIdentifier '#{authKeyId}' crlNumber '#{crlNumber}'")
       end
     end
   end
@@ -235,7 +237,7 @@ class Puppet::SSL::SSLProvider
   def default_flags
     # checking the signature of the self-signed cert doesn't add any security,
     # but it's a sanity check to make sure the cert isn't corrupt. This option
-    # is only available in openssl 1.1+
+    # is not available in JRuby's OpenSSL library.
     if defined?(OpenSSL::X509::V_FLAG_CHECK_SS_SIGNATURE)
       OpenSSL::X509::V_FLAG_CHECK_SS_SIGNATURE
     else
@@ -322,7 +324,7 @@ class Puppet::SSL::SSLProvider
       when OpenSSL::X509::V_ERR_CERT_NOT_YET_VALID
         _("The certificate '%{subject}' is not yet valid, verify time is synchronized") % { subject: subject(current_cert) }
       when OpenSSL::X509::V_ERR_CERT_HAS_EXPIRED
-        _("The certificate '%{subject}' has expired, verify time is synchronized") %  { subject: subject(current_cert) }
+        _("The certificate '%{subject}' has expired, verify time is synchronized") % { subject: subject(current_cert) }
       when OpenSSL::X509::V_ERR_CRL_NOT_YET_VALID
         _("The CRL issued by '%{issuer}' is not yet valid, verify time is synchronized") % { issuer: issuer(current_cert) }
       when OpenSSL::X509::V_ERR_CRL_HAS_EXPIRED
@@ -333,7 +335,8 @@ class Puppet::SSL::SSLProvider
         _("Invalid signature for CRL issued by '%{issuer}'") % { issuer: issuer(current_cert) }
       when OpenSSL::X509::V_ERR_UNABLE_TO_GET_ISSUER_CERT
         _("The issuer '%{issuer}' of certificate '%{subject}' is missing") % {
-          issuer: issuer(current_cert), subject: subject(current_cert) }
+          issuer: issuer(current_cert), subject: subject(current_cert)
+        }
       when OpenSSL::X509::V_ERR_UNABLE_TO_GET_CRL
         _("The CRL issued by '%{issuer}' is missing") % { issuer: issuer(current_cert) }
       when OpenSSL::X509::V_ERR_CERT_REVOKED
@@ -342,7 +345,8 @@ class Puppet::SSL::SSLProvider
         # error_string is labeled ASCII-8BIT, but is encoded based on Encoding.default_external
         err_utf8 = Puppet::Util::CharacterEncoding.convert_to_utf_8(store_context.error_string)
         _("Certificate '%{subject}' failed verification (%{err}): %{err_utf8}") % {
-          subject: subject(current_cert), err: store_context.error, err_utf8: err_utf8 }
+          subject: subject(current_cert), err: store_context.error, err_utf8: err_utf8
+        }
       end
 
     raise Puppet::SSL::CertVerifyError.new(message, store_context.error, current_cert)