Jira (PUP-3788) Puppet Agent does not support Chained CRLs

[Adrien Thebo (JIRA)]

Title: Message Title

Adrien Thebo commented on PUP-3788   Re: Puppet Agent does not support Chained CRLs The assumption that Puppet will have a single CRL is wired deeply into the code and unwinding this assumption may require a number of nontrivial and potentially dangerous changes. First off, Puppet::SSL::CertificateRevocationList itself is hardcoded for a single CRL, and it hardcodes a number of things like the CRL name. For example: # Convert a string into an instance. def self.from_s(string) super(string, 'foo') # The name doesn't matter end   # ...   # The name doesn't actually matter; there's only one CRL. # We just need the name so our Indirector stuff all works more easily. def initialize(fakename) @name = _("crl") end This by itself isn't a difficult fix but it's a demonstration that the singleton CRL assumption is deeply wired. Further complicating things is that the logic for fetching and caching the CRL is tightly interwoven with the indirector. The indirector is used both for making the HTTP request to fetch the CRL, which assumes a singleton instance, and caching the CRL, which has the singleton logic even more deeply wired. The Puppet::Indirector::SslFile terminus is built such that if we have a resource that relies on a single file or bundle, the #search method won't work at all. Even if #search could work on bundle files, the indirector itself doesn't support caching the results of #search which means that we can't properly cache and retrieve fetched CRLs. In effect in order to support multiple CRLs we'll need to re-plumb every location that touches CRLs; if that's the case then there might be a compelling case to just write something new and bypass the current, indirector entangled code. In the short run we can sidestep this by supporting checking for the end entity certificate, like what Apache does with SslCARevocationCheck leaf. Enabling leaf checking means dropping the OpenSSL::X509::V_FLAG_CRL_CHECK_ALL flag when creating an SSL store, and then we're done. Since we've never supported multiple CRLs this doesn't decrease security, and by allowing people to perform any CRL checking at all we've provided a bit more security while we look at properly supporting CRL bundles. For the sake of compatibility we can change the certificate_revocation setting to accept chain and leaf settings, alias true to chain to support the current behavior, and allow people to use leaf checking when intermediate CAs are in place. Add Comment   This message was sent by Atlassian JIRA (v6.4.14#64029-sha1:ae256fe) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at https://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.