Skip to content

Commit b1b351a

Browse files
nmburgannmburgan
authored
Merge pull request #2668 from nmburgan/mergeup/main/from_7.x_2022_10_03
Mergeup 7.x -> main
2 parents 427ab09 + 7e8360f commit b1b351a

File tree

6 files changed

+108
-24
lines changed

6 files changed

+108
-24
lines changed

‎locales/eo.po‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -76,7 +76,7 @@ msgid "Certificate names must be lower case."
7676
msgstr ""
7777

7878
#: src/clj/puppetlabs/puppetserver/certificate_authority.clj
79-
msgid "Subject contains unprintable or non-ASCII characters"
79+
msgid "Subject hostname format is invalid"
8080
msgstr ""
8181

8282
#: src/clj/puppetlabs/puppetserver/certificate_authority.clj

‎locales/puppetserver.pot‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -77,7 +77,7 @@ msgid "Certificate names must be lower case."
7777
msgstr ""
7878

7979
#: src/clj/puppetlabs/puppetserver/certificate_authority.clj
80-
msgid "Subject contains unprintable or non-ASCII characters"
80+
msgid "Subject hostname format is invalid"
8181
msgstr ""
8282

8383
#: src/clj/puppetlabs/puppetserver/certificate_authority.clj

‎project.clj‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -27,14 +27,14 @@
2727

2828
:min-lein-version "2.9.1"
2929

30-
:parent-project {:coords [puppetlabs/clj-parent "5.2.3"]
30+
:parent-project {:coords [puppetlabs/clj-parent "5.2.11"]
3131
:inherit [:managed-dependencies]}
3232

3333
:dependencies [[org.clojure/clojure]
3434

3535
[slingshot]
3636
[clj-commons/clj-yaml]
37-
[org.yaml/snakeyaml "1.31"]
37+
[org.yaml/snakeyaml]
3838
[commons-lang]
3939
[commons-io]
4040

@@ -123,7 +123,7 @@
123123
[beckon]
124124
[lambdaisland/uri "1.4.70"]]}
125125
:dev [:defaults
126-
{:dependencies [[org.bouncycastle/bcpkix-jdk15on]]}]
126+
{:dependencies [[org.bouncycastle/bcpkix-jdk18on]]}]
127127
:fips [:defaults
128128
{:dependencies [[org.bouncycastle/bcpkix-fips]
129129
[org.bouncycastle/bc-fips]
@@ -154,7 +154,7 @@
154154
;; when a test fails.
155155
:dependencies [[pjstadig/humane-test-output "0.8.3"]]
156156
:injections [(require 'pjstadig.humane-test-output)
157-
(pjstadig.humane-test-output/activate!)]}
157+
(pjstadig.humane-test-output/activate!)]}
158158

159159

160160
:ezbake {:dependencies ^:replace [;; we need to explicitly pull in our parent project's
@@ -164,13 +164,13 @@
164164
;; in the list above, so any version overrides need to be
165165
;; specified in both places. TODO: fix this.
166166
[org.clojure/clojure]
167-
[org.bouncycastle/bcpkix-jdk15on]
167+
[org.bouncycastle/bcpkix-jdk18on]
168168
[puppetlabs/jruby-utils]
169169
[puppetlabs/puppetserver ~ps-version]
170170
[puppetlabs/trapperkeeper-webserver-jetty9]]
171171
:plugins [[puppetlabs/lein-ezbake "2.3.2"]]
172172
:name "puppetserver"}
173-
:uberjar {:dependencies [[org.bouncycastle/bcpkix-jdk15on]
173+
:uberjar {:dependencies [[org.bouncycastle/bcpkix-jdk18on]
174174
[puppetlabs/trapperkeeper-webserver-jetty9]]
175175
:aot [puppetlabs.trapperkeeper.main
176176
puppetlabs.trapperkeeper.services.status.status-service

‎src/clj/puppetlabs/puppetserver/certificate_authority.clj‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -806,15 +806,15 @@
806806
{:kind :invalid-subject-name
807807
:msg (i18n/tru "Certificate names must be lower case.")}))
808808

809-
(when-not (re-matches #"\A[ -.0-~]+\Z" subject)
809+
(when (.contains subject "*")
810810
(sling/throw+
811811
{:kind :invalid-subject-name
812-
:msg (i18n/tru "Subject contains unprintable or non-ASCII characters")}))
813-
814-
(when (.contains subject "*")
812+
:msg (i18n/tru "Subject contains a wildcard, which is not allowed: {0}" subject)}))
813+
814+
(when-not (re-matches #"^([a-z0-9](?:(?:[a-z0-9\-_]*|(?<!-)\.(?![\-.]))*[a-z0-9]+)?)$" subject)
815815
(sling/throw+
816816
{:kind :invalid-subject-name
817-
:msg (i18n/tru "Subject contains a wildcard, which is not allowed: {0}" subject)})))
817+
:msg (i18n/tru "Subject hostname format is invalid")})))
818818

819819
(schema/defn allowed-extension?
820820
"A predicate that answers if an extension is allowed or not.

‎test/unit/puppetlabs/puppetserver/certificate_authority_test.clj‎

Lines changed: 94 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1153,7 +1153,7 @@
11531153
(select-keys % [:kind :msg]))]
11541154
["invalid characters in name" "super/bad" "bad-subject-name-1.pem"
11551155
#(= {:kind :invalid-subject-name
1156-
:msg "Subject contains unprintable or non-ASCII characters"}
1156+
:msg "Subject hostname format is invalid"}
11571157
(select-keys % [:kind :msg]))]
11581158
["wildcard in name" "foo*bar" "bad-subject-name-wildcard.pem"
11591159
#(= {:kind :invalid-subject-name
@@ -1189,7 +1189,7 @@
11891189
(select-keys % [:kind :msg]))]
11901190
["subject contains invalid characters" "super/bad" "bad-subject-name-1.pem"
11911191
#(= {:kind :invalid-subject-name
1192-
:msg "Subject contains unprintable or non-ASCII characters"}
1192+
:msg "Subject hostname format is invalid"}
11931193
(select-keys % [:kind :msg]))]
11941194
["subject contains wildcard character" "foo*bar" "bad-subject-name-wildcard.pem"
11951195
#(= {:kind :invalid-subject-name
@@ -1609,17 +1609,101 @@
16091609
(deftest validate-subject!-test
16101610
(testing "an exception is thrown when the hostnames don't match"
16111611
(is (thrown+?
1612-
[:kind :hostname-mismatch
1613-
:msg "Instance name \"test-agent\" does not match requested key \"not-test-agent\""]
1614-
(validate-subject!
1615-
"not-test-agent" "test-agent"))))
1612+
[:kind :hostname-mismatch
1613+
:msg "Instance name \"test-agent\" does not match requested key \"not-test-agent\""]
1614+
(validate-subject!
1615+
"not-test-agent" "test-agent"))))
16161616

16171617
(testing "an exception is thrown if the subject name contains a capital letter"
16181618
(is (thrown+?
1619-
[:kind :invalid-subject-name
1620-
:msg "Certificate names must be lower case."]
1621-
(validate-subject! "Host-With-Capital-Letters"
1622-
"Host-With-Capital-Letters")))))
1619+
[:kind :invalid-subject-name
1620+
:msg "Certificate names must be lower case."]
1621+
(validate-subject! "Host-With-Capital-Letters"
1622+
"Host-With-Capital-Letters"))))
1623+
1624+
(testing "an exception is thrown when the hostnames ends in hyphen"
1625+
(is (thrown+?
1626+
[:kind :invalid-subject-name
1627+
:msg "Subject hostname format is invalid"]
1628+
(validate-subject!
1629+
"rootca-.example.org" "rootca-.example.org"))))
1630+
1631+
(testing "an exception is thrown when the hostnames starts with hyphen"
1632+
(is (thrown+?
1633+
[:kind :invalid-subject-name
1634+
:msg "Subject hostname format is invalid"]
1635+
(validate-subject!
1636+
"-rootca.example.org" "-rootca.example.org"))))
1637+
1638+
(testing "an exception is thrown when the hostnames contains a space"
1639+
(is (thrown+?
1640+
[:kind :invalid-subject-name
1641+
:msg "Subject hostname format is invalid"]
1642+
(validate-subject!
1643+
"root ca.example.org" "root ca.example.org"))))
1644+
1645+
(testing "an exception is thrown when the hostnames contain an ampersand"
1646+
(is (thrown+?
1647+
[:kind :invalid-subject-name
1648+
:msg "Subject hostname format is invalid"]
1649+
(validate-subject!
1650+
"root&ca.example.org" "root&ca.example.org"))))
1651+
1652+
(testing "an exception is thrown when the hostname is empty"
1653+
(is (thrown+?
1654+
[:kind :invalid-subject-name
1655+
:msg "Subject hostname format is invalid"]
1656+
(validate-subject!
1657+
"" ""))))
1658+
1659+
(testing "an exception is thrown when the hostnames contain multiple dots in a row"
1660+
(is (thrown+?
1661+
[:kind :invalid-subject-name
1662+
:msg "Subject hostname format is invalid"]
1663+
(validate-subject!
1664+
"rootca..example.org" "rootca..example.org"))))
1665+
1666+
(testing "an exception is thrown when the hostnames end in dot"
1667+
(is (thrown+?
1668+
[:kind :invalid-subject-name
1669+
:msg "Subject hostname format is invalid"]
1670+
(validate-subject!
1671+
"rootca." "rootca."))))
1672+
1673+
(testing "Single word hostnames are allowed"
1674+
(is (nil?
1675+
(validate-subject!
1676+
"rootca" "rootca"))))
1677+
1678+
(testing "Domain names are allowed"
1679+
(is (nil?
1680+
(validate-subject!
1681+
"puppet.com" "puppet.com"))))
1682+
1683+
(testing "Subdomains are allowed"
1684+
(is (nil?
1685+
(validate-subject!
1686+
"ca.puppet.com" "ca.puppet.com"))))
1687+
1688+
(testing "Hostnames containing underscores are allowed"
1689+
(is (nil?
1690+
(validate-subject!
1691+
"root_ca" "root_ca"))))
1692+
1693+
(testing "Hostnames containing dashes are allowed"
1694+
(is (nil?
1695+
(validate-subject!
1696+
"root-ca" "root-ca"))))
1697+
1698+
(testing "Hostnames containing numbers are allowed"
1699+
(is (nil?
1700+
(validate-subject!
1701+
"root123" "root123"))))
1702+
1703+
(testing "Domains containing numbers are allowed"
1704+
(is (nil?
1705+
(validate-subject!
1706+
"root123.com" "root123.com")))))
16231707

16241708
(deftest validate-subject-alt-names!-test
16251709
(testing "Both DNS and IP alt names are allowed"

‎test/unit/puppetlabs/services/ca/certificate_authority_core_test.clj‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -450,7 +450,7 @@
450450
response (handle-put-certificate-request!
451451
subject csr-stream settings)]
452452
(is (= 400 (:status response)))
453-
(is (= "Subject contains unprintable or non-ASCII characters"
453+
(is (= "Subject hostname format is invalid"
454454
(:body response)))))))
455455

456456
(testing "no wildcards allowed"

0 commit comments

Comments
 (0)