puppet 4.1.0 → 5.0.0

data/lib/puppet/ssl/certificate_request.rb

@@ -23,7 +23,7 @@ require 'puppet/ssl/certificate_signer'
 #
 # This behavior is dictated by PKCS#9/RFC 2985 section 5.4.2.
 #
-# @see http://tools.ietf.org/html/rfc2985 "RFC 2985 Section 5.4.2 Extension request"
+# @see https://tools.ietf.org/html/rfc2985 "RFC 2985 Section 5.4.2 Extension request"
 #
 class Puppet::SSL::CertificateRequest < Puppet::SSL::Base
   wraps OpenSSL::X509::Request
@@ -74,7 +74,7 @@ DOC
   #
   # @return [OpenSSL::X509::Request] The generated CSR
   def generate(key, options = {})
-    Puppet.info "Creating a new SSL certificate request for #{name}"
+    Puppet.info _("Creating a new SSL certificate request for %{name}") % { name: name }
 
     # Support either an actual SSL key, or a Puppet key.
     key = key.content if key.is_a?(Puppet::SSL::Key)
@@ -100,10 +100,10 @@ DOC
     signer = Puppet::SSL::CertificateSigner.new
     signer.sign(csr, key)
 
-    raise Puppet::Error, "CSR sign verification failed; you need to clean the certificate request for #{name} on the server" unless csr.verify(key.public_key)
+    raise Puppet::Error, _("CSR sign verification failed; you need to clean the certificate request for %{name} on the server") % { name: name } unless csr.verify(key.public_key)
 
     @content = csr
-    Puppet.info "Certificate Request fingerprint (#{digest.name}): #{digest.to_hex}"
+    Puppet.info _("Certificate Request fingerprint (%{digest}): %{hex_digest}") % { digest: digest.name, hex_digest: digest.to_hex }
     @content
   end
 
@@ -146,7 +146,7 @@ DOC
   # hashes, with key/value pairs for the extension's oid, its value, and
   # optionally its critical state.
   def request_extensions
-    raise Puppet::Error, "CSR needs content to extract fields" unless @content
+    raise Puppet::Error, _("CSR needs content to extract fields") unless @content
 
     # Prefer the standard extReq, but accept the Microsoft specific version as
     # a fallback, if the standard version isn't found.
@@ -173,7 +173,7 @@ DOC
       when 3
         {"oid" => ext_values[0].value, "value" => value, "critical" => ext_values[1].value}
       else
-        raise Puppet::Error, "In #{attribute.oid}, expected extension record #{index} to have two or three items, but found #{ext_values.length}"
+        raise Puppet::Error, _("In %{attr}, expected extension record %{index} to have two or three items, but found %{count}") % { attr: attribute.oid, index: index, count: ext_values.length }
       end
     end
   end
@@ -193,7 +193,7 @@ DOC
   #
   # The format of CSR attributes is specified in PKCS#10/RFC 2986
   #
-  # @see http://tools.ietf.org/html/rfc2986 "RFC 2986 Certification Request Syntax Specification"
+  # @see https://tools.ietf.org/html/rfc2986 "RFC 2986 Certification Request Syntax Specification"
   #
   # @api public
   #
@@ -204,7 +204,7 @@ DOC
     end
 
     x509_attributes.map do |attr|
-      {"oid" => attr.oid, "value" => attr.value.first.value}
+      {"oid" => attr.oid, "value" => attr.value.value.first.value}
     end
   end
 
@@ -224,7 +224,7 @@ DOC
     csr_attributes.each do |oid, value|
       begin
         if PRIVATE_CSR_ATTRIBUTES.include? oid
-          raise ArgumentError, "Cannot specify CSR attribute #{oid}: conflicts with internally used CSR attribute"
+          raise ArgumentError, _("Cannot specify CSR attribute %{oid}: conflicts with internally used CSR attribute") % { oid: oid }
         end
 
         encoded = OpenSSL::ASN1::PrintableString.new(value.to_s)
@@ -233,7 +233,7 @@ DOC
         csr.add_attribute(OpenSSL::X509::Attribute.new(oid, attr_set))
         Puppet.debug("Added csr attribute: #{oid} => #{attr_set.inspect}")
       rescue OpenSSL::X509::AttributeError => e
-        raise Puppet::Error, "Cannot create CSR with attribute #{oid}: #{e.message}", e.backtrace
+        raise Puppet::Error, _("Cannot create CSR with attribute %{oid}: %{message}") % { oid: oid, message: e.message }, e.backtrace
       end
     end
   end
@@ -252,13 +252,13 @@ DOC
       options[:extension_requests].each_pair do |oid, value|
         begin
           if PRIVATE_EXTENSIONS.include? oid
-            raise Puppet::Error, "Cannot specify CSR extension request #{oid}: conflicts with internally used extension request"
+            raise Puppet::Error, _("Cannot specify CSR extension request %{oid}: conflicts with internally used extension request") % { oid: oid }
           end
 
           ext = OpenSSL::X509::Extension.new(oid, OpenSSL::ASN1::UTF8String.new(value.to_s).to_der, false)
           extensions << ext
         rescue OpenSSL::X509::ExtensionError => e
-          raise Puppet::Error, "Cannot create CSR with extension request #{oid}: #{e.message}", e.backtrace
+          raise Puppet::Error, _("Cannot create CSR with extension request %{oid}: %{message}") % { oid: oid, message: e.message }, e.backtrace
         end
       end
     end
@@ -289,8 +289,8 @@ DOC
   # that in turn holds the elements. This is why we have to unpack an array
   # every time we unpack a Set/Seq.
   #
-  # @see http://tools.ietf.org/html/rfc2985#ref-10 5.4.2 CSR Extension Request structure
-  # @see http://tools.ietf.org/html/rfc5280 4.1 Certificate Extension structure
+  # @see https://tools.ietf.org/html/rfc2985#ref-10 5.4.2 CSR Extension Request structure
+  # @see https://tools.ietf.org/html/rfc5280 4.1 Certificate Extension structure
   #
   # @api private
   #
@@ -301,23 +301,23 @@ DOC
   def unpack_extension_request(attribute)
 
     unless attribute.value.is_a? OpenSSL::ASN1::Set
-      raise Puppet::Error, "In #{attribute.oid}, expected Set but found #{attribute.value.class}"
+      raise Puppet::Error, _("In %{attr}, expected Set but found %{klass}") % { attr: attribute.oid, klass: attribute.value.class }
     end
 
     unless attribute.value.value.is_a? Array
-      raise Puppet::Error, "In #{attribute.oid}, expected Set[Array] but found #{attribute.value.value.class}"
+      raise Puppet::Error, _("In %{attr}, expected Set[Array] but found %{klass}") % { attr: attribute.oid, klass: attribute.value.value.class }
     end
 
     unless attribute.value.value.size == 1
-      raise Puppet::Error, "In #{attribute.oid}, expected Set[Array] with one value but found #{attribute.value.value.size} elements"
+      raise Puppet::Error, _("In %{attr}, expected Set[Array] with one value but found %{count} elements") % { attr: attribute.oid, count: attribute.value.value.size }
     end
 
     unless attribute.value.value.first.is_a? OpenSSL::ASN1::Sequence
-      raise Puppet::Error, "In #{attribute.oid}, expected Set[Array[Sequence[...]]], but found #{extension.class}"
+      raise Puppet::Error, _("In %{attr}, expected Set[Array[Sequence[...]]], but found %{klass}") % { attr: attribute.oid, klass: extension.class }
     end
 
     unless attribute.value.value.first.value.is_a? Array
-      raise Puppet::Error, "In #{attribute.oid}, expected Set[Array[Sequence[Array[...]]]], but found #{extension.value.class}"
+      raise Puppet::Error, _("In %{attr}, expected Set[Array[Sequence[Array[...]]]], but found %{klass}") % { attr: attribute.oid, klass: extension.value.class }
     end
 
     extensions = attribute.value.value.first.value

data/lib/puppet/ssl/certificate_request_attributes.rb

@@ -19,16 +19,16 @@ class Puppet::SSL::CertificateRequestAttributes
   # @return true if we are able to load the file, false otherwise
   # @raise [Puppet::Error] if there are unexpected attribute keys
   def load
-    Puppet.info("csr_attributes file loading from #{path}")
+    Puppet.info(_("csr_attributes file loading from %{path}") % { path: path })
     if Puppet::FileSystem.exist?(path)
       hash = Puppet::Util::Yaml.load_file(path, {})
       if ! hash.is_a?(Hash)
-        raise Puppet::Error, "invalid CSR attributes, expected instance of Hash, received instance of #{hash.class}"
+        raise Puppet::Error, _("invalid CSR attributes, expected instance of Hash, received instance of %{klass}") % { klass: hash.class }
       end
       @custom_attributes = hash.delete('custom_attributes') || {}
       @extension_requests = hash.delete('extension_requests') || {}
       if not hash.keys.empty?
-        raise Puppet::Error, "unexpected attributes #{hash.keys.inspect} in #{@path.inspect}"
+        raise Puppet::Error, _("unexpected attributes %{keys} in %{path}") % { keys: hash.keys.inspect, path: @path.inspect }
       end
       return true
     end

data/lib/puppet/ssl/certificate_revocation_list.rb

@@ -26,7 +26,7 @@ DOC
 
   # Knows how to create a CRL with our system defaults.
   def generate(cert, cakey)
-    Puppet.info "Creating a new certificate revocation list"
+    Puppet.info _("Creating a new certificate revocation list")
 
     create_crl_issued_by(cert)
     start_at_initial_crl_number
@@ -39,14 +39,14 @@ DOC
   # The name doesn't actually matter; there's only one CRL.
   # We just need the name so our Indirector stuff all works more easily.
   def initialize(fakename)
-    @name = "crl"
+    @name = _("crl")
   end
 
   # Revoke the certificate with serial number SERIAL issued by this
   # CA, then write the CRL back to disk. The REASON must be one of the
   # OpenSSL::OCSP::REVOKED_* reasons
   def revoke(serial, cakey, reason = OpenSSL::OCSP::REVOKED_STATUS_KEYCOMPROMISE)
-    Puppet.notice "Revoked certificate with serial #{serial}"
+    Puppet.notice _("Revoked certificate with serial %{serial}") % { serial: serial }
     time = Time.now
 
     add_certificate_revocation_for(serial, reason, time)

data/lib/puppet/ssl/certificate_signer.rb

@@ -1,6 +1,6 @@
 # Take care of signing a certificate in a FIPS 140-2 compliant manner.
 #
-# @see http://projects.puppetlabs.com/issues/17295
+# @see https://projects.puppetlabs.com/issues/17295
 #
 # @api private
 class Puppet::SSL::CertificateSigner

data/lib/puppet/ssl/configuration.rb

@@ -50,7 +50,10 @@ class Configuration
 
   # read_file makes testing easier.
   def read_file(path)
-    File.read(path)
+    # https://www.ietf.org/rfc/rfc2459.txt defines the x509 V3 certificate format
+    # CA bundles are concatenated X509 certificates, but may also include
+    # comments, which could have UTF-8 characters
+    Puppet::FileSystem.read(path, :encoding => Encoding::UTF_8)
   end
   private :read_file
 end

data/lib/puppet/ssl/host.rb

@@ -104,7 +104,7 @@ DOC
   # Specify how we expect to interact with our certificate authority.
   def self.ca_location=(mode)
     modes = CA_MODES.collect { |m, vals| m.to_s }.join(", ")
-    raise ArgumentError, "CA Mode can only be one of: #{modes}" unless CA_MODES.include?(mode)
+    raise ArgumentError, _("CA Mode can only be one of: %{modes}") % { modes: modes } unless CA_MODES.include?(mode)
 
     @ca_location = mode
 
@@ -207,18 +207,18 @@ DOC
   end
 
   def validate_certificate_with_key
-    raise Puppet::Error, "No certificate to validate." unless certificate
-    raise Puppet::Error, "No private key with which to validate certificate with fingerprint: #{certificate.fingerprint}" unless key
+    raise Puppet::Error, _("No certificate to validate.") unless certificate
+    raise Puppet::Error, _("No private key with which to validate certificate with fingerprint: %{fingerprint}") % { fingerprint: certificate.fingerprint } unless key
     unless certificate.content.check_private_key(key.content)
-      raise Puppet::Error, <<ERROR_STRING
+      raise Puppet::Error, _(<<ERROR_STRING) % { fingerprint: certificate.fingerprint, cert_name: Puppet[:certname], ssl_dir: Puppet[:ssldir], cert_dir: Puppet[:certdir].gsub('/', '\\') }
 The certificate retrieved from the master does not match the agent's private key.
-Certificate fingerprint: #{certificate.fingerprint}
-To fix this, remove the certificate from both the master and the agent and then start a puppet run, which will automatically regenerate a certficate.
+Certificate fingerprint: %{fingerprint}
+To fix this, remove the certificate from both the master and the agent and then start a puppet run, which will automatically regenerate a certificate.
 On the master:
-  puppet cert clean #{Puppet[:certname]}
+  puppet cert clean %{cert_name}
 On the agent:
-  1a. On most platforms: find #{Puppet[:ssldir]} -name #{Puppet[:certname]}.pem -delete
-  1b. On Windows: del "#{Puppet[:ssldir]}/#{Puppet[:certname]}.pem" /f
+  1a. On most platforms: find %{ssl_dir} -name %{cert_name}.pem -delete
+  1b. On Windows: del "%{cert_dir}\\%{cert_name}.pem" /f
   2. puppet agent -t
 ERROR_STRING
     end
@@ -227,13 +227,35 @@ ERROR_STRING
   # Generate all necessary parts of our ssl host.
   def generate
     generate_key unless key
-    generate_certificate_request unless certificate_request
+    # ask indirector to find any existing requests and download them
+    existing_request = certificate_request
+
+    # if CSR downloaded from master, but the local keypair was just generated and
+    # does not match the public key in the CSR, fail hard
+    if !existing_request.nil? &&
+      (key.content.public_key.to_s != existing_request.content.public_key.to_s)
+
+      raise Puppet::Error, _(<<ERROR_STRING) % { fingerprint: existing_request.fingerprint, csr_public_key: existing_request.content.public_key.to_text, agent_public_key: key.content.public_key.to_text, cert_name: Puppet[:certname], ssl_dir: Puppet[:ssldir], cert_dir: Puppet[:certdir].gsub('/', '\\') }
+The CSR retrieved from the master does not match the agent's public key.
+CSR fingerprint: %{fingerprint}
+CSR public key: %{csr_public_key}
+Agent public key: %{agent_public_key}
+To fix this, remove the CSR from both the master and the agent and then start a puppet run, which will automatically regenerate a CSR.
+On the master:
+  puppet cert clean %{cert_name}
+On the agent:
+  1a. On most platforms: find %{ssl_dir} -name %{cert_name}.pem -delete
+  1b. On Windows: del "%{cert_dir}\\%{cert_name}.pem" /f
+  2. puppet agent -t
+ERROR_STRING
+    end
+    generate_certificate_request unless existing_request
 
     # If we can get a CA instance, then we're a valid CA, and we
     # should use it to sign our request; else, just try to read
     # the cert.
     if ! certificate and ca = Puppet::SSL::CertificateAuthority.instance
-      ca.sign(self.name, true)
+      ca.sign(self.name, {allow_dns_alt_names: true})
     end
   end
 
@@ -274,21 +296,21 @@ ERROR_STRING
 
   def to_data_hash
     my_cert = Puppet::SSL::Certificate.indirection.find(name)
-    result = { :name  => name }
+    result = { 'name'  => name }
 
     my_state = state
 
-    result[:state] = my_state
-    result[:desired_state] = desired_state if desired_state
+    result['state'] = my_state
+    result['desired_state'] = desired_state if desired_state
 
     thing_to_use = (my_state == 'requested') ? certificate_request : my_cert
 
     # this is for backwards-compatibility
     # we should deprecate it and transition people to using
-    # pson[:fingerprints][:default]
+    # json[:fingerprints][:default]
     # It appears that we have no internal consumers of this api
     # --jeffweiss 30 aug 2012
-    result[:fingerprint] = thing_to_use.fingerprint
+    result['fingerprint'] = thing_to_use.fingerprint
 
     # The above fingerprint doesn't tell us what message digest algorithm was used
     # No problem, except that the default is changing between 2.7 and 3.0. Also, as
@@ -297,13 +319,13 @@ ERROR_STRING
     # So, when we add the newer fingerprints, we're explicit about the hashing
     # algorithm used.
     # --jeffweiss 31 july 2012
-    result[:fingerprints] = {}
-    result[:fingerprints][:default] = thing_to_use.fingerprint
+    result['fingerprints'] = {}
+    result['fingerprints']['default'] = thing_to_use.fingerprint
 
     suitable_message_digest_algorithms.each do |md|
-      result[:fingerprints][md] = thing_to_use.fingerprint md
+      result['fingerprints'][md.to_s] = thing_to_use.fingerprint md
     end
-    result[:dns_alt_names] = thing_to_use.subject_alt_names
+    result['dns_alt_names'] = thing_to_use.subject_alt_names
 
     result
   end
@@ -322,9 +344,9 @@ ERROR_STRING
       generate
       return if certificate
     rescue StandardError => detail
-      Puppet.log_exception(detail, "Could not request certificate: #{detail.message}")
+      Puppet.log_exception(detail, _("Could not request certificate: %{message}") % { message: detail.message })
       if time < 1
-        puts "Exiting; failed to retrieve certificate and waitforcert is disabled"
+        puts _("Exiting; failed to retrieve certificate and waitforcert is disabled")
         exit(1)
       else
         sleep(time)
@@ -333,7 +355,7 @@ ERROR_STRING
     end
 
     if time < 1
-      puts "Exiting; no certificate found and waitforcert is disabled"
+      puts _("Exiting; no certificate found and waitforcert is disabled")
       exit(1)
     end
 
@@ -341,9 +363,9 @@ ERROR_STRING
       sleep time
       begin
         break if certificate
-        Puppet.notice "Did not receive certificate"
+        Puppet.notice _("Did not receive certificate")
       rescue StandardError => detail
-        Puppet.log_exception(detail, "Could not request certificate: #{detail.message}")
+        Puppet.log_exception(detail, _("Could not request certificate: %{message}") % { message: detail.message })
       end
     end
   end

data/lib/puppet/ssl/inventory.rb

@@ -8,7 +8,10 @@ class Puppet::SSL::Inventory
   # Add a certificate to our inventory.
   def add(cert)
     cert = cert.content if cert.is_a?(Puppet::SSL::Certificate)
-    Puppet.settings.setting(:cert_inventory).open("a") do |f|
+    # RFC 5280 says the cert subject may contain UTF8 - https://www.ietf.org/rfc/rfc5280.txt
+    # Note however that Puppet generated SSL files must only contain ASCII characters
+    # based on the validate_certname method of Puppet::SSL::Base
+    Puppet.settings.setting(:cert_inventory).open('a:UTF-8') do |f|
       f.print format(cert)
     end
   end
@@ -26,9 +29,10 @@ class Puppet::SSL::Inventory
   # Rebuild the inventory from scratch.  This should happen if
   # the file is entirely missing or if it's somehow corrupted.
   def rebuild
-    Puppet.notice "Rebuilding inventory file"
+    Puppet.notice _("Rebuilding inventory file")
 
-    Puppet.settings.setting(:cert_inventory).open('w') do |f|
+    # RFC 5280 says the cert subject may contain UTF8 - https://www.ietf.org/rfc/rfc5280.txt
+    Puppet.settings.setting(:cert_inventory).open('w:UTF-8') do |f|
       Puppet::SSL::Certificate.indirection.search("*").each do |cert|
         f.print format(cert.content)
       end
@@ -40,7 +44,10 @@ class Puppet::SSL::Inventory
   def serials(name)
     return [] unless Puppet::FileSystem.exist?(@path)
 
-    File.readlines(@path).collect do |line|
+    # RFC 5280 says the cert subject may contain UTF8 - https://www.ietf.org/rfc/rfc5280.txt
+    # Note however that Puppet generated SSL files must only contain ASCII characters
+    # based on the validate_certname method of Puppet::SSL::Base
+    File.readlines(@path, :encoding => Encoding::UTF_8).collect do |line|
       /^(\S+).+\/CN=#{name}$/.match(line)
     end.compact.map { |m| Integer(m[1]) }
   end

data/lib/puppet/ssl/key.rb

@@ -21,7 +21,7 @@ DOC
 
   # Knows how to create keys with our system defaults.
   def generate
-    Puppet.info "Creating a new SSL key for #{name}"
+    Puppet.info _("Creating a new SSL key for %{name}") % { name: name }
     @content = OpenSSL::PKey::RSA.new(Puppet[:keylength].to_i)
   end
 
@@ -38,15 +38,19 @@ DOC
   def password
     return nil unless password_file and Puppet::FileSystem.exist?(password_file)
 
-    ::File.read(password_file)
+    # Puppet generates files at the default Puppet[:capass] using ASCII
+    # User configured :passfile could be in any encoding
+    # Use BINARY given the string is passed to an OpenSSL API accepting bytes
+    # note this is only called internally
+    Puppet::FileSystem.read(password_file, :encoding => Encoding::BINARY)
   end
 
   # Optionally support specifying a password file.
   def read(path)
     return super unless password_file
 
-    #@content = wrapped_class.new(::File.read(path), password)
-    @content = wrapped_class.new(::File.read(path), password)
+    # RFC 1421 states PEM is 7-bit ASCII https://tools.ietf.org/html/rfc1421
+    @content = wrapped_class.new(Puppet::FileSystem.read(path, :encoding => Encoding::ASCII), password)
   end
 
   def to_s

data/lib/puppet/ssl/oids.rb

@@ -13,6 +13,7 @@ require 'puppet/ssl'
 # -- privateExtensions can be extended by enterprises to suit their own needs
 # registeredExtensions OBJECT IDENTIFIER ::= { puppetCertExtensions 1 }
 # privateExtensions OBJECT IDENTIFIER ::= { puppetCertExtensions 2 }
+# authorizationExtensions OBJECT IDENTIFIER ::= { puppetCertExtensions 3 }
 #
 # -- subtree of common registered extensions
 # -- The short names for these OIDs are intentionally lowercased and formatted
@@ -25,6 +26,10 @@ require 'puppet/ssl'
 # @api private
 module Puppet::SSL::Oids
 
+  # Note: When updating the following OIDs make sure to also update the OID
+  # definitions here:
+  # https://github.com/puppetlabs/puppetserver/blob/master/src/clj/puppetlabs/puppetserver/certificate_authority.clj#L122-L159
+
   PUPPET_OIDS = [
     ["1.3.6.1.4.1.34380", 'puppetlabs', 'Puppet Labs'],
     ["1.3.6.1.4.1.34380.1", 'ppCertExt', 'Puppet Certificate Extension'],
@@ -48,8 +53,21 @@ module Puppet::SSL::Oids
     ["1.3.6.1.4.1.34380.1.1.15", 'pp_department', 'Puppet Node Department Name'],
     ["1.3.6.1.4.1.34380.1.1.16", 'pp_cluster', 'Puppet Node Cluster Name'],
     ["1.3.6.1.4.1.34380.1.1.17", 'pp_provisioner', 'Puppet Node Provisioner Name'],
-    
+    ["1.3.6.1.4.1.34380.1.1.18", 'pp_region', 'Puppet Node Region Name'],
+    ["1.3.6.1.4.1.34380.1.1.19", 'pp_datacenter', 'Puppet Node Datacenter Name'],
+    ["1.3.6.1.4.1.34380.1.1.20", 'pp_zone', 'Puppet Node Zone Name'],
+    ["1.3.6.1.4.1.34380.1.1.21", 'pp_network', 'Puppet Node Network Name'],
+    ["1.3.6.1.4.1.34380.1.1.22", 'pp_securitypolicy', 'Puppet Node Security Policy Name'],
+    ["1.3.6.1.4.1.34380.1.1.23", 'pp_cloudplatform', 'Puppet Node Cloud Platform Name'],
+    ["1.3.6.1.4.1.34380.1.1.24", 'pp_apptier', 'Puppet Node Application Tier'],
+    ["1.3.6.1.4.1.34380.1.1.25", 'pp_hostname', 'Puppet Node Hostname'],
+
     ["1.3.6.1.4.1.34380.1.2", 'ppPrivCertExt', 'Puppet Private Certificate Extension'],
+
+    ["1.3.6.1.4.1.34380.1.3", 'ppAuthCertExt', 'Puppet Certificate Authorization Extension'],
+
+    ["1.3.6.1.4.1.34380.1.3.1",  'pp_authorization', 'Certificate Extension Authorization'],
+    ["1.3.6.1.4.1.34380.1.3.13", 'pp_auth_role', 'Puppet Node Role Name for Authorization'],
   ]
 
   # Register our custom Puppet OIDs with OpenSSL so they can be used as CSR
@@ -61,7 +79,7 @@ module Puppet::SSL::Oids
     end
   end
 
-  # Parse and load custom OID mapping file that enables custom OIDs to be resolved
+  # Parse custom OID mapping file that enables custom OIDs to be resolved
   # into user-friendly names.
   #
   # @param custom_oid_file [String] File to obtain custom OIDs mapping from
@@ -76,38 +94,60 @@ module Puppet::SSL::Oids
   #  '1.3.6.1.4.1.34380.1.2.1.2':
   #    shortname: 'myothershortname'
   #    longname: 'Other Long name'
-  def self.load_custom_oid_file(custom_oid_file, map_key='oid_mapping')
+  def self.parse_custom_oid_file(custom_oid_file, map_key='oid_mapping')
     if File.exists?(custom_oid_file) && File.readable?(custom_oid_file)
       mapping = nil
       begin
         mapping = YAML.load_file(custom_oid_file)
       rescue => err
-        raise Puppet::Error, "Error loading ssl custom OIDs mapping file from '#{custom_oid_file}': #{err}", err.backtrace
+        raise Puppet::Error, _("Error loading ssl custom OIDs mapping file from '%{custom_oid_file}': %{err}") % { custom_oid_file: custom_oid_file, err: err }, err.backtrace
       end
 
       unless mapping.has_key?(map_key)
-        raise Puppet::Error, "Error loading ssl custom OIDs mapping file from '#{custom_oid_file}': no such index '#{map_key}'"
+        raise Puppet::Error, _("Error loading ssl custom OIDs mapping file from '%{custom_oid_file}': no such index '%{map_key}'") % { custom_oid_file: custom_oid_file, map_key: map_key }
       end
 
       unless mapping[map_key].is_a?(Hash)
-        raise Puppet::Error, "Error loading ssl custom OIDs mapping file from '#{custom_oid_file}': data under index '#{map_key}' must be a Hash"
+        raise Puppet::Error, _("Error loading ssl custom OIDs mapping file from '%{custom_oid_file}': data under index '%{map_key}' must be a Hash") % { custom_oid_file: custom_oid_file, map_key: map_key }
       end
 
       oid_defns = []
       mapping[map_key].keys.each do |oid|
         shortname, longname = mapping[map_key][oid].values_at("shortname","longname")
         if shortname.nil? || longname.nil?
-          raise Puppet::Error, "Error loading ssl custom OIDs mapping file from '#{custom_oid_file}': incomplete definition of oid '#{oid}'"
+          raise Puppet::Error, _("Error loading ssl custom OIDs mapping file from '%{custom_oid_file}': incomplete definition of oid '%{oid}'") % { custom_oid_file: custom_oid_file, oid: oid }
         end
         oid_defns << [oid, shortname, longname]
       end
 
+      oid_defns
+    end
+  end
+
+  # Load custom OID mapping file that enables custom OIDs to be resolved
+  # into user-friendly names.
+  #
+  # @param custom_oid_file [String] File to obtain custom OIDs mapping from
+  # @param map_key [String] Hash key in which custom OIDs mapping is stored
+  #
+  # @example Custom OID mapping file
+  # ---
+  # oid_mapping:
+  #  '1.3.6.1.4.1.34380.1.2.1.1':
+  #    shortname : 'myshortname'
+  #    longname  : 'Long name'
+  #  '1.3.6.1.4.1.34380.1.2.1.2':
+  #    shortname: 'myothershortname'
+  #    longname: 'Other Long name'
+  def self.load_custom_oid_file(custom_oid_file, map_key='oid_mapping')
+    oid_defns = parse_custom_oid_file(custom_oid_file, map_key)
+    unless oid_defns.nil?
       begin
         oid_defns.each do |oid_defn|
           OpenSSL::ASN1::ObjectId.register(*oid_defn)
         end
       rescue => err
-        raise ArgumentError, "Error registering ssl custom OIDs mapping from file '#{custom_oid_file}': #{err}", err.backtrace
+        raise ArgumentError, _("Error registering ssl custom OIDs mapping from file '%{custom_oid_file}': %{err}") % { custom_oid_file: custom_oid_file, err: err }, err.backtrace
       end
     end
   end

data/lib/puppet/ssl/validator/default_validator.rb

@@ -16,7 +16,7 @@ class Puppet::SSL::Validator::DefaultValidator #< class Puppet::SSL::Validator
   # Creates a new DefaultValidator, optionally with an SSL Configuration and SSL Host.
   #
   # @param ssl_configuration [Puppet::SSL::Configuration] (a default configuration) ssl_configuration the SSL configuration to use
-  # @param ssl_host [Puppet::SSL::Host] (Puppet::SSL::Host.localhost) the SSL host to use
+  # @param ssl_host [Puppet::SSL::Host] The SSL host to use
   #
   # @api private
   #
@@ -25,7 +25,7 @@ class Puppet::SSL::Validator::DefaultValidator #< class Puppet::SSL::Validator
                                         Puppet[:localcacert], {
                                           :ca_auth_file  => Puppet[:ssl_client_ca_auth]
                                         }),
-      ssl_host = Puppet::SSL::Host.localhost)
+      ssl_host = Puppet.lookup(:ssl_host))
 
     reset!
     @ssl_configuration = ssl_configuration
@@ -48,7 +48,7 @@ class Puppet::SSL::Validator::DefaultValidator #< class Puppet::SSL::Validator
   # chain being verified.
   #
   # From the [OpenSSL
-  # documentation](http://www.openssl.org/docs/ssl/SSL_CTX_set_verify.html):
+  # documentation](https://www.openssl.org/docs/ssl/SSL_CTX_set_verify.html):
   # The `verify_callback` function is used to control the behaviour when the
   # SSL_VERIFY_PEER flag is set. It must be supplied by the application and
   # receives two arguments: preverify_ok indicates, whether the verification of
@@ -69,12 +69,12 @@ class Puppet::SSL::Validator::DefaultValidator #< class Puppet::SSL::Validator
   # @api private
   #
   def call(preverify_ok, store_context)
+    current_cert = store_context.current_cert
+    @peer_certs << Puppet::SSL::Certificate.from_instance(current_cert)
+
     # We must make a copy since the scope of the store_context will be lost
     # across invocations of this method.
     if preverify_ok
-      current_cert = store_context.current_cert
-      @peer_certs << Puppet::SSL::Certificate.from_instance(current_cert)
-
       # If we've copied all of the certs in the chain out of the SSL library
       if @peer_certs.length == store_context.chain.length
         # (#20027) The peer cert must be issued by a specific authority
@@ -100,7 +100,6 @@ class Puppet::SSL::Validator::DefaultValidator #< class Puppet::SSL::Validator
           @verify_errors << error_string
         end
       else
-        current_cert = store_context.current_cert
         @verify_errors << "#{error_string} for #{current_cert.subject}"
       end
     end

data/lib/puppet/syntax_checkers/base64.rb

@@ -0,0 +1,41 @@
+# A syntax checker for Base64.
+# @api public
+require 'puppet/syntax_checkers'
+require 'base64'
+class Puppet::SyntaxCheckers::Base64 < Puppet::Plugins::SyntaxCheckers::SyntaxChecker
+
+  # Checks the text for BASE64 syntax issues and reports them to the given acceptor.
+  # This checker allows the most relaxed form of Base64, including newlines and missing padding.
+  # It also accept URLsafe input.
+  #
+  # @param text [String] The text to check
+  # @param syntax [String] The syntax identifier in mime style (e.g. 'base64', 'text/xxx+base64')
+  # @param acceptor [#accept] A Diagnostic acceptor
+  # @param source_pos [Puppet::Pops::Adapters::SourcePosAdapter] A source pos adapter with location information
+  # @api public
+  #
+  def check(text, syntax, acceptor, source_pos)
+    raise ArgumentError.new(_("Base64 syntax checker: the text to check must be a String.")) unless text.is_a?(String)
+    raise ArgumentError.new(_("Base64 syntax checker: the syntax identifier must be a String, e.g. json, data+json")) unless syntax.is_a?(String)
+    raise ArgumentError.new(_("Base64 syntax checker: invalid Acceptor, got: '%{klass}'.") % { klass: acceptor.class.name }) unless acceptor.is_a?(Puppet::Pops::Validation::Acceptor)
+    cleaned_text = text.gsub(/[\r?\n[:blank:]]/, '')
+    begin
+      # Do a strict decode64 on text with all whitespace stripped since the non strict version
+      # simply skips all non base64 characters
+      Base64.strict_decode64(cleaned_text)
+    rescue => e
+      if (cleaned_text.bytes.to_a.size * 8) % 6 != 0
+        msg2 = _("padding is not correct")
+      else
+        msg2 = _("contains letters outside strict base 64 range (or whitespace)")
+      end
+      msg = _("Base64 syntax checker: Cannot parse invalid Base64 string - %{msg2}") % { msg2: msg2 }
+
+      # TODO: improve the pops API to allow simpler diagnostic creation while still maintaining capabilities
+      # and the issue code. (In this case especially, where there is only a single error message being issued).
+      #
+      issue = Puppet::Pops::Issues::issue(:ILLEGAL_BASE64) { msg }
+      acceptor.accept(Puppet::Pops::Validation::Diagnostic.new(:error, issue, source_pos.file, source_pos, {}))
+    end
+  end
+end