openvox 7.37.1

data/lib/puppet/ssl/state_machine.rb

@@ -0,0 +1,474 @@
+require_relative '../../puppet/ssl'
+require_relative '../../puppet/util/pidlock'
+
+# This class implements a state machine for bootstrapping a host's CA and CRL
+# bundles, private key and signed client certificate. Each state has a frozen
+# SSLContext that it uses to make network connections. If a state makes progress
+# bootstrapping the host, then the state will generate a new frozen SSLContext
+# and pass that to the next state. For example, the NeedCACerts state will load
+# or download a CA bundle, and generate a new SSLContext containing those CA
+# certs. This way we're sure about which SSLContext is being used during any
+# phase of the bootstrapping process.
+#
+# @api private
+class Puppet::SSL::StateMachine
+  class SSLState
+    attr_reader :ssl_context
+
+    def initialize(machine, ssl_context)
+      @machine = machine
+      @ssl_context = ssl_context
+      @cert_provider = machine.cert_provider
+      @ssl_provider = machine.ssl_provider
+    end
+
+    def to_error(message, cause)
+      detail = Puppet::Error.new(message)
+      detail.set_backtrace(cause.backtrace)
+      Error.new(@machine, message, detail)
+    end
+
+    def log_error(message)
+      # When running daemonized we set stdout to /dev/null, so write to the log instead
+      if Puppet[:daemonize]
+        Puppet.err(message)
+      else
+        $stdout.puts(message)
+      end
+    end
+  end
+
+  # Load existing CA certs or download them. Transition to NeedCRLs.
+  #
+  class NeedCACerts < SSLState
+    def initialize(machine)
+      super(machine, nil)
+      @ssl_context = @ssl_provider.create_insecure_context
+    end
+
+    def next_state
+      Puppet.debug("Loading CA certs")
+
+      cacerts = @cert_provider.load_cacerts
+      if cacerts
+        next_ctx = @ssl_provider.create_root_context(cacerts: cacerts, revocation: false)
+      else
+        route = @machine.session.route_to(:ca, ssl_context: @ssl_context)
+        _, pem = route.get_certificate(Puppet::SSL::CA_NAME, ssl_context: @ssl_context)
+        if @machine.ca_fingerprint
+          actual_digest = Puppet::SSL::Digest.new(@machine.digest, pem).to_hex
+          expected_digest = @machine.ca_fingerprint.scan(/../).join(':').upcase
+          if actual_digest == expected_digest
+            Puppet.info(_("Verified CA bundle with digest (%{digest_type}) %{actual_digest}") %
+                        { digest_type: @machine.digest, actual_digest: actual_digest })
+          else
+            e = Puppet::Error.new(_("CA bundle with digest (%{digest_type}) %{actual_digest} did not match expected digest %{expected_digest}") % { digest_type: @machine.digest, actual_digest: actual_digest, expected_digest: expected_digest })
+            return Error.new(@machine, e.message, e)
+          end
+        end
+
+        cacerts = @cert_provider.load_cacerts_from_pem(pem)
+        # verify cacerts before saving
+        next_ctx = @ssl_provider.create_root_context(cacerts: cacerts, revocation: false)
+        @cert_provider.save_cacerts(cacerts)
+      end
+
+      NeedCRLs.new(@machine, next_ctx)
+    rescue OpenSSL::X509::CertificateError => e
+      Error.new(@machine, e.message, e)
+    rescue Puppet::HTTP::ResponseError => e
+      if e.response.code == 404
+        to_error(_('CA certificate is missing from the server'), e)
+      else
+        to_error(_('Could not download CA certificate: %{message}') % { message: e.message }, e)
+      end
+    end
+  end
+
+  # If revocation is enabled, load CRLs or download them, using the CA bundle
+  # from the previous state. Transition to NeedKey. Even if Puppet[:certificate_revocation]
+  # is leaf or chain, disable revocation when downloading the CRL, since 1) we may
+  # not have one yet or 2) the connection will fail if NeedCACerts downloaded a new CA
+  # for which we don't have a CRL
+  #
+  class NeedCRLs < SSLState
+    def next_state
+      Puppet.debug("Loading CRLs")
+
+      case Puppet[:certificate_revocation]
+      when :chain, :leaf
+        crls = @cert_provider.load_crls
+        if crls
+          next_ctx = @ssl_provider.create_root_context(cacerts: ssl_context[:cacerts], crls: crls)
+
+          crl_ttl = Puppet[:crl_refresh_interval]
+          if crl_ttl
+            last_update = @cert_provider.crl_last_update
+            now = Time.now
+            if last_update.nil? || now.to_i > last_update.to_i + crl_ttl
+              # set last updated time first, then make a best effort to refresh
+              @cert_provider.crl_last_update = now
+              next_ctx = refresh_crl(next_ctx, last_update)
+            end
+          end
+        else
+          next_ctx = download_crl(@ssl_context, nil)
+        end
+      else
+        Puppet.info("Certificate revocation is disabled, skipping CRL download")
+        next_ctx = @ssl_provider.create_root_context(cacerts: ssl_context[:cacerts], crls: [])
+      end
+
+      NeedKey.new(@machine, next_ctx)
+    rescue OpenSSL::X509::CRLError => e
+      Error.new(@machine, e.message, e)
+    rescue Puppet::HTTP::ResponseError => e
+      if e.response.code == 404
+        to_error(_('CRL is missing from the server'), e)
+      else
+        to_error(_('Could not download CRLs: %{message}') % { message: e.message }, e)
+      end
+    end
+
+    private
+
+    def refresh_crl(ssl_ctx, last_update)
+      Puppet.info(_("Refreshing CRL"))
+
+      # return the next_ctx containing the updated crl
+      download_crl(ssl_ctx, last_update)
+    rescue Puppet::HTTP::ResponseError => e
+      if e.response.code == 304
+        Puppet.info(_("CRL is unmodified, using existing CRL"))
+      else
+        Puppet.info(_("Failed to refresh CRL, using existing CRL: %{message}") % {message: e.message})
+      end
+
+      # return the original ssl_ctx
+      ssl_ctx
+    rescue Puppet::HTTP::HTTPError => e
+      Puppet.warning(_("Failed to refresh CRL, using existing CRL: %{message}") % {message: e.message})
+
+      # return the original ssl_ctx
+      ssl_ctx
+    end
+
+    def download_crl(ssl_ctx, last_update)
+      route = @machine.session.route_to(:ca, ssl_context: ssl_ctx)
+      _, pem = route.get_certificate_revocation_list(if_modified_since: last_update, ssl_context: ssl_ctx)
+      crls = @cert_provider.load_crls_from_pem(pem)
+      # verify crls before saving
+      next_ctx = @ssl_provider.create_root_context(cacerts: ssl_ctx[:cacerts], crls: crls)
+      @cert_provider.save_crls(crls)
+
+      next_ctx
+    end
+  end
+
+  # Load or generate a private key. If the key exists, try to load the client cert
+  # and transition to Done. If the cert is mismatched or otherwise fails valiation,
+  # raise an error. If the key doesn't exist yet, generate one, and save it. If the
+  # cert doesn't exist yet, transition to NeedSubmitCSR.
+  #
+  class NeedKey < SSLState
+    def next_state
+      Puppet.debug(_("Loading/generating private key"))
+
+      password = @cert_provider.load_private_key_password
+      key = @cert_provider.load_private_key(Puppet[:certname], password: password)
+      if key
+        cert = @cert_provider.load_client_cert(Puppet[:certname])
+        if cert
+          next_ctx = @ssl_provider.create_context(
+            cacerts: @ssl_context.cacerts, crls: @ssl_context.crls, private_key: key, client_cert: cert
+          )
+          return Done.new(@machine, next_ctx)
+        end
+      else
+        if Puppet[:key_type] == 'ec'
+          Puppet.info _("Creating a new EC SSL key for %{name} using curve %{curve}") % { name: Puppet[:certname], curve: Puppet[:named_curve] }
+          key = OpenSSL::PKey::EC.generate(Puppet[:named_curve])
+        else
+          Puppet.info _("Creating a new RSA SSL key for %{name}") % { name: Puppet[:certname] }
+          key = OpenSSL::PKey::RSA.new(Puppet[:keylength].to_i)
+        end
+
+        @cert_provider.save_private_key(Puppet[:certname], key, password: password)
+      end
+
+      NeedSubmitCSR.new(@machine, @ssl_context, key)
+    end
+  end
+
+  # Base class for states with a private key.
+  #
+  class KeySSLState < SSLState
+    attr_reader :private_key
+
+    def initialize(machine, ssl_context, private_key)
+      super(machine, ssl_context)
+      @private_key = private_key
+    end
+  end
+
+  # Generate and submit a CSR using the CA cert bundle and optional CRL bundle
+  # from earlier states. If the request is submitted, proceed to NeedCert,
+  # otherwise Wait. This could be due to the server already having a CSR
+  # for this host (either the same or different CSR content), having a
+  # signed certificate, or a revoked certificate.
+  #
+  class NeedSubmitCSR < KeySSLState
+    def next_state
+      Puppet.debug(_("Generating and submitting a CSR"))
+
+      csr = @cert_provider.create_request(Puppet[:certname], @private_key)
+      route = @machine.session.route_to(:ca, ssl_context: @ssl_context)
+      route.put_certificate_request(Puppet[:certname], csr, ssl_context: @ssl_context)
+      @cert_provider.save_request(Puppet[:certname], csr)
+      NeedCert.new(@machine, @ssl_context, @private_key)
+    rescue Puppet::HTTP::ResponseError => e
+      if e.response.code == 400
+        NeedCert.new(@machine, @ssl_context, @private_key)
+      else
+        to_error(_("Failed to submit the CSR, HTTP response was %{code}") % { code: e.response.code }, e)
+      end
+    end
+  end
+
+  # Attempt to load or retrieve our signed cert.
+  #
+  class NeedCert < KeySSLState
+    def next_state
+      Puppet.debug(_("Downloading client certificate"))
+
+      route = @machine.session.route_to(:ca, ssl_context: @ssl_context)
+      cert = OpenSSL::X509::Certificate.new(
+        route.get_certificate(Puppet[:certname], ssl_context: @ssl_context)[1]
+      )
+      Puppet.info _("Downloaded certificate for %{name} from %{url}") % { name: Puppet[:certname], url: route.url }
+      # verify client cert before saving
+      next_ctx = @ssl_provider.create_context(
+        cacerts: @ssl_context.cacerts, crls: @ssl_context.crls, private_key: @private_key, client_cert: cert
+      )
+      @cert_provider.save_client_cert(Puppet[:certname], cert)
+      @cert_provider.delete_request(Puppet[:certname])
+      Done.new(@machine, next_ctx)
+    rescue Puppet::SSL::SSLError => e
+      Error.new(@machine, e.message, e)
+    rescue OpenSSL::X509::CertificateError => e
+      Error.new(@machine, _("Failed to parse certificate: %{message}") % {message: e.message}, e)
+    rescue Puppet::HTTP::ResponseError => e
+      if e.response.code == 404
+        Puppet.info(_("Certificate for %{certname} has not been signed yet") % {certname: Puppet[:certname]})
+        $stdout.puts _("Couldn't fetch certificate from CA server; you might still need to sign this agent's certificate (%{name}).") % { name: Puppet[:certname] }
+        Wait.new(@machine)
+      else
+        to_error(_("Failed to retrieve certificate for %{certname}: %{message}") %
+                 {certname: Puppet[:certname], message: e.response.message}, e)
+      end
+    end
+  end
+
+  # We cannot make progress, so wait if allowed to do so, or exit.
+  #
+  class Wait < SSLState
+    def initialize(machine)
+      super(machine, nil)
+    end
+
+    def next_state
+      time = @machine.waitforcert
+      if time < 1
+        log_error(_("Exiting now because the waitforcert setting is set to 0."))
+        exit(1)
+      elsif Time.now.to_i > @machine.wait_deadline
+        log_error(_("Couldn't fetch certificate from CA server; you might still need to sign this agent's certificate (%{name}). Exiting now because the maxwaitforcert timeout has been exceeded.") % {name: Puppet[:certname] })
+        exit(1)
+      else
+        Puppet.info(_("Will try again in %{time} seconds.") % {time: time})
+
+        # close http/tls and session state before sleeping
+        Puppet.runtime[:http].close
+        @machine.session = Puppet.runtime[:http].create_session
+
+        @machine.unlock
+        Kernel.sleep(time)
+        NeedLock.new(@machine)
+      end
+    end
+  end
+
+  # Acquire the ssl lock or return LockFailure causing us to exit.
+  #
+  class NeedLock < SSLState
+    def initialize(machine)
+      super(machine, nil)
+    end
+
+    def next_state
+      if @machine.lock
+        # our ssl directory may have been cleaned while we were
+        # sleeping, start over from the top
+        NeedCACerts.new(@machine)
+      elsif @machine.waitforlock < 1
+        LockFailure.new(@machine, _("Another puppet instance is already running and the waitforlock setting is set to 0; exiting"))
+      elsif Time.now.to_i >= @machine.waitlock_deadline
+        LockFailure.new(@machine, _("Another puppet instance is already running and the maxwaitforlock timeout has been exceeded; exiting"))
+      else
+        Puppet.info _("Another puppet instance is already running; waiting for it to finish")
+        Puppet.info _("Will try again in %{time} seconds.") % {time: @machine.waitforlock}
+        Kernel.sleep @machine.waitforlock
+
+        # try again
+        self
+      end
+    end
+  end
+
+  # We failed to acquire the lock, so exit
+  #
+  class LockFailure < SSLState
+    attr_reader :message
+
+    def initialize(machine, message)
+      super(machine, nil)
+      @message = message
+    end
+  end
+
+  # We cannot make progress due to an error.
+  #
+  class Error < SSLState
+    attr_reader :message, :error
+
+    def initialize(machine, message, error)
+      super(machine, nil)
+      @message = message
+      @error = error
+    end
+
+    def next_state
+      Puppet.log_exception(@error, @message)
+      Wait.new(@machine)
+    end
+  end
+
+  # We have a CA bundle, optional CRL bundle, a private key and matching cert
+  # that chains to one of the root certs in our bundle.
+  #
+  class Done < SSLState; end
+
+  attr_reader :waitforcert, :wait_deadline, :waitforlock, :waitlock_deadline, :cert_provider, :ssl_provider, :ca_fingerprint, :digest
+  attr_accessor :session
+
+  # Construct a state machine to manage the SSL initialization process. By
+  # default, if the state machine encounters an exception, it will log the
+  # exception and wait for `waitforcert` seconds and retry, restarting from the
+  # beginning of the state machine.
+  #
+  # However, if `onetime` is true, then the state machine will raise the first
+  # error it encounters, instead of waiting. Otherwise, if `waitforcert` is 0,
+  # then then state machine will exit instead of wait.
+  #
+  # @param waitforcert [Integer] how many seconds to wait between attempts
+  # @param maxwaitforcert [Integer] maximum amount of seconds to wait for the
+  #   server to sign the certificate request
+  # @param waitforlock [Integer] how many seconds to wait between attempts for
+  #   acquiring the ssl lock
+  # @param maxwaitforlock [Integer] maximum amount of seconds to wait for an
+  #   already running process to release the ssl lock
+  # @param onetime [Boolean] whether to run onetime
+  # @param lockfile [Puppet::Util::Pidlock] lockfile to protect against
+  #   concurrent modification by multiple processes
+  # @param cert_provider [Puppet::X509::CertProvider] cert provider to use
+  #   to load and save X509 objects.
+  # @param ssl_provider [Puppet::SSL::SSLProvider] ssl provider to use
+  #   to construct ssl contexts.
+  # @param digest [String] digest algorithm to use for certificate fingerprinting
+  # @param ca_fingerprint [String] optional fingerprint to verify the
+  #   downloaded CA bundle
+  def initialize(waitforcert: Puppet[:waitforcert],
+                 maxwaitforcert: Puppet[:maxwaitforcert],
+                 waitforlock: Puppet[:waitforlock],
+                 maxwaitforlock: Puppet[:maxwaitforlock],
+                 onetime: Puppet[:onetime],
+                 cert_provider: Puppet::X509::CertProvider.new,
+                 ssl_provider: Puppet::SSL::SSLProvider.new,
+                 lockfile: Puppet::Util::Pidlock.new(Puppet[:ssl_lockfile]),
+                 digest: 'SHA256',
+                 ca_fingerprint: Puppet[:ca_fingerprint])
+    @waitforcert = waitforcert
+    @wait_deadline = Time.now.to_i + maxwaitforcert
+    @waitforlock = waitforlock
+    @waitlock_deadline = Time.now.to_i + maxwaitforlock
+    @onetime = onetime
+    @cert_provider = cert_provider
+    @ssl_provider = ssl_provider
+    @lockfile = lockfile
+    @digest = digest
+    @ca_fingerprint = ca_fingerprint
+    @session = Puppet.runtime[:http].create_session
+  end
+
+  # Run the state machine for CA certs and CRLs.
+  #
+  # @return [Puppet::SSL::SSLContext] initialized SSLContext
+  # @raise [Puppet::Error] If we fail to generate an SSLContext
+  # @api private
+  def ensure_ca_certificates
+    final_state = run_machine(NeedLock.new(self), NeedKey)
+    final_state.ssl_context
+  end
+
+  # Run the state machine for CA certs and CRLs.
+  #
+  # @return [Puppet::SSL::SSLContext] initialized SSLContext
+  # @raise [Puppet::Error] If we fail to generate an SSLContext
+  # @api private
+  def ensure_client_certificate
+    final_state = run_machine(NeedLock.new(self), Done)
+    ssl_context = final_state.ssl_context
+    @ssl_provider.print(ssl_context, @digest)
+    ssl_context
+  end
+
+  def lock
+    @lockfile.lock
+  end
+
+  def unlock
+    @lockfile.unlock
+  end
+
+  private
+
+  def run_machine(state, stop)
+    loop do
+      state = run_step(state)
+
+      case state
+      when stop
+        break
+      when LockFailure
+        raise Puppet::Error, state.message
+      when Error
+        if @onetime
+          Puppet.log_exception(state.error)
+          raise state.error
+        end
+      else
+        # fall through
+      end
+    end
+
+    state
+  ensure
+    @lockfile.unlock if @lockfile.locked?
+  end
+
+  def run_step(state)
+    state.next_state
+  rescue => e
+    state.to_error(e.message, e)
+  end
+end

data/lib/puppet/ssl/verifier.rb

@@ -0,0 +1,142 @@
+require_relative '../../puppet/ssl'
+
+# Verify an SSL connection.
+#
+# @api private
+class Puppet::SSL::Verifier
+
+  FIVE_MINUTES_AS_SECONDS = 5 * 60
+
+  attr_reader :ssl_context
+
+  # Create a verifier using an `ssl_context`.
+  #
+  # @param hostname [String] FQDN of the server we're attempting to connect to
+  # @param ssl_context [Puppet::SSL::SSLContext] ssl_context containing CA certs,
+  #   CRLs, etc needed to verify the server's certificate chain
+  # @api private
+  def initialize(hostname, ssl_context)
+    @hostname = hostname
+    @ssl_context = ssl_context
+  end
+
+  # Return true if `self` is reusable with `verifier` meaning they
+  # are using the same `ssl_context`, so there's no loss of security
+  # when using a cached connection.
+  #
+  # @param verifier [Puppet::SSL::Verifier] the verifier to compare against
+  # @return [Boolean] return true if a cached connection can be used, false otherwise
+  # @api private
+  def reusable?(verifier)
+    verifier.instance_of?(self.class) &&
+      verifier.ssl_context.object_id == @ssl_context.object_id
+  end
+
+  # Configure the `http` connection based on the current `ssl_context`.
+  #
+  # @param http [Net::HTTP] connection
+  # @api private
+  def setup_connection(http)
+    http.cert_store = @ssl_context[:store]
+    http.cert = @ssl_context[:client_cert]
+    http.key = @ssl_context[:private_key]
+    # default to VERIFY_PEER
+    http.verify_mode = if !@ssl_context[:verify_peer]
+                         OpenSSL::SSL::VERIFY_NONE
+                       else
+                         OpenSSL::SSL::VERIFY_PEER
+                       end
+    http.verify_callback = self
+  end
+
+  # This method is called if `Net::HTTP#start` raises an exception, which
+  # could be a result of an openssl error during cert verification, due
+  # to ruby's `Socket#post_connection_check`, or general SSL connection
+  # error.
+  #
+  # @param http [Net::HTTP] connection
+  # @param error [OpenSSL::SSL::SSLError] connection error
+  # @raise [Puppet::SSL::CertVerifyError] SSL connection failed due to a
+  #   verification error with the server's certificate or chain
+  # @raise [Puppet::Error] server hostname does not match certificate
+  # @raise [OpenSSL::SSL::SSLError] low-level SSL connection failure
+  # @api private
+  def handle_connection_error(http, error)
+    raise @last_error if @last_error
+
+    # ruby can pass SSL validation but fail post_connection_check
+    peer_cert = http.peer_cert
+    if peer_cert && !OpenSSL::SSL.verify_certificate_identity(peer_cert, @hostname)
+      raise Puppet::SSL::CertMismatchError.new(peer_cert, @hostname)
+    else
+      raise error
+    end
+  end
+
+  # OpenSSL will call this method with the verification result for each cert in
+  # the server's chain, working from the root CA to the server's cert. If
+  # preverify_ok is `true`, then that cert passed verification. If it's `false`
+  # then the current verification error is contained in `store_context.error`.
+  # and the current cert is in `store_context.current_cert`.
+  #
+  # If this method returns `false`, then verification stops and ruby will raise
+  # an `OpenSSL::SSL::Error` with "certificate verification failed". If this
+  # method returns `true`, then verification continues.
+  #
+  # If this method ignores a verification error, such as the cert's CRL will be
+  # valid within the next 5 minutes, then this method may be called with a
+  # different verification error for the same cert.
+  #
+  # WARNING: If `store_context.error` returns `OpenSSL::X509::V_OK`, don't
+  # assume verification passed. Ruby 2.4+ implements certificate hostname
+  # checking by default, and if the cert doesn't match the hostname, then the
+  # error will be V_OK. Always use `preverify_ok` to determine if verification
+  # succeeded or not.
+  #
+  # @param preverify_ok [Boolean] if `true` the current certificate in `store_context`
+  #   was verified. Otherwise, check for the current error in `store_context.error`
+  # @param store_context [OpenSSL::X509::StoreContext] The context holding the
+  #   verification result for one certificate
+  # @return [Boolean] If `true`, continue verifying the chain, even if that means
+  #   ignoring the current verification error. If `false`, abort the connection.
+  #
+  # @api private
+  def call(preverify_ok, store_context)
+    return true if preverify_ok
+
+    peer_cert = store_context.current_cert
+
+    case store_context.error
+    when OpenSSL::X509::V_OK
+      # chain is from leaf to root, opposite of the order that `call` is invoked
+      chain_cert = store_context.chain.first
+
+      # ruby 2.4 doesn't compare certs based on value, so force to DER byte array
+      if peer_cert && chain_cert && peer_cert.to_der == chain_cert.to_der && !OpenSSL::SSL.verify_certificate_identity(peer_cert, @hostname)
+        @last_error = Puppet::SSL::CertMismatchError.new(peer_cert, @hostname)
+        return false
+      end
+
+    # ruby-openssl#74ef8c0cc56b840b772240f2ee2b0fc0aafa2743 now sets the
+    # store_context error when the cert is mismatched
+    when OpenSSL::X509::V_ERR_HOSTNAME_MISMATCH
+      @last_error = Puppet::SSL::CertMismatchError.new(peer_cert, @hostname)
+      return false
+
+    when OpenSSL::X509::V_ERR_CRL_NOT_YET_VALID
+      crl = store_context.current_crl
+      if crl && crl.last_update && crl.last_update < Time.now + FIVE_MINUTES_AS_SECONDS
+        Puppet.debug("Ignoring CRL not yet valid, current time #{Time.now.utc}, CRL last updated #{crl.last_update.utc}")
+        return true
+      end
+    end
+
+    # TRANSLATORS: `error` is an untranslated message from openssl describing why a certificate in the server's chain is invalid, and `subject` is the identity/name of the failed certificate
+    @last_error = Puppet::SSL::CertVerifyError.new(
+      _("certificate verify failed [%{error} for %{subject}]") %
+      { error: store_context.error_string, subject: peer_cert.subject.to_utf8 },
+      store_context.error, peer_cert
+    )
+    false
+  end
+end

data/lib/puppet/ssl.rb

@@ -0,0 +1,23 @@
+# Just to make the constants work out.
+require_relative '../puppet'
+require_relative 'ssl/openssl_loader'
+
+# Responsible for bootstrapping an agent's certificate and private key, generating
+# SSLContexts for use in making HTTPS connections, and handling CSR attributes and
+# certificate extensions.
+#
+# @see Puppet::SSL::SSLProvider
+# @api private
+module Puppet::SSL
+  CA_NAME = "ca".freeze
+
+  require_relative 'ssl/oids'
+  require_relative 'ssl/error'
+  require_relative 'ssl/ssl_context'
+  require_relative 'ssl/verifier'
+  require_relative 'ssl/ssl_provider'
+  require_relative 'ssl/state_machine'
+  require_relative 'ssl/certificate'
+  require_relative 'ssl/certificate_request'
+  require_relative 'ssl/certificate_request_attributes'
+end

data/lib/puppet/syntax_checkers/base64.rb

@@ -0,0 +1,40 @@
+# A syntax checker for Base64.
+# @api public
+require_relative '../../puppet/syntax_checkers'
+require 'base64'
+class Puppet::SyntaxCheckers::Base64 < Puppet::Plugins::SyntaxCheckers::SyntaxChecker
+
+  # Checks the text for BASE64 syntax issues and reports them to the given acceptor.
+  # This checker allows the most relaxed form of Base64, including newlines and missing padding.
+  # It also accept URLsafe input.
+  #
+  # @param text [String] The text to check
+  # @param syntax [String] The syntax identifier in mime style (e.g. 'base64', 'text/xxx+base64')
+  # @param acceptor [#accept] A Diagnostic acceptor
+  # @param source_pos [Puppet::Pops::Adapters::SourcePosAdapter] A source pos adapter with location information
+  # @api public
+  #
+  def check(text, syntax, acceptor, source_pos)
+    raise ArgumentError.new(_("Base64 syntax checker: the text to check must be a String.")) unless text.is_a?(String)
+    raise ArgumentError.new(_("Base64 syntax checker: the syntax identifier must be a String, e.g. json, data+json")) unless syntax.is_a?(String)
+    raise ArgumentError.new(_("Base64 syntax checker: invalid Acceptor, got: '%{klass}'.") % { klass: acceptor.class.name }) unless acceptor.is_a?(Puppet::Pops::Validation::Acceptor)
+    cleaned_text = text.gsub(/[\r?\n[:blank:]]/, '')
+    begin
+      # Do a strict decode64 on text with all whitespace stripped since the non strict version
+      # simply skips all non base64 characters
+      Base64.strict_decode64(cleaned_text)
+    rescue
+      msg = if (cleaned_text.bytes.to_a.size * 8) % 6 != 0
+              _("Base64 syntax checker: Cannot parse invalid Base64 string - padding is not correct")
+            else
+              _("Base64 syntax checker: Cannot parse invalid Base64 string - contains letters outside strict base 64 range (or whitespace)")
+            end
+
+      # TODO: improve the pops API to allow simpler diagnostic creation while still maintaining capabilities
+      # and the issue code. (In this case especially, where there is only a single error message being issued).
+      #
+      issue = Puppet::Pops::Issues::issue(:ILLEGAL_BASE64) { msg }
+      acceptor.accept(Puppet::Pops::Validation::Diagnostic.new(:error, issue, source_pos.file, source_pos, {}))
+    end
+  end
+end