Merge remote-tracking branch 'stschulte/ticket/2.7.x/9796' into 2.7.x

* stschulte/ticket/2.7.x/9796:
  (#9796) ssh_authorized_key supports whitespace again
(#9997) Add mysql2 gem support

Besides the mysql gem there is a mysql2 gem that is a "modern, simple
and very fast Mysql library for Ruby" [1]. It can either be installed as a
seperate gem (v0.2.x) for ActiveRecord < 3.1 or can be used as part of
ActiveRecord 3.1

To use mysql2 the dbadapter setting must be set to "mysql2" and this patch
adds support for this setting.

[1] https://github.com/brianmario/mysql2#readme
(#9831) Standardize Windows provider confining

The newly created providers for Windows were using a combination of
':operatingsystem => :windows' and ':feature => :microsoft_windows'
for their confine and defaultfor calls.  This brings them in line to
all use the ':operatingsystem => :windows' form.

The general reasoning being that :operatingsystem is used for things
that are platform specific, where :feature is used for things that are
supported across multiple platforms, but require that external (to
Puppet or the base platform) support exist on the host.
(#9996) Restore functionality for multi-line commands in exec resources

Originally we were relying on the behavior that Array.new would call
 #to_a on its argument, which is a no-op if the object is already an
array.  When #to_a is called on a string, it does not always return
[original_string].  Because string.to_a is effectively equivalent to
string.each_line.to_a (at least in Ruby 1.8.7) we were breaking
commands with embedded newlines.

Manually wrapping the passed in command in an array, and calling
 #flatten is much safer since it will not "helpfully" split up the
command string for us.
(#9636) Fix PATHEXT resolution for paths other than system32

Previously, Puppet::Util.which could only resolve executables that
were located in the first PATH directory entry, typically
c:\windows\system32.

This was introduced in 0258096c4 due to the inner loop overwriting the
'bin' variable that was used in the outer loop. And it wasn't noticed
during testing, because I was always using executables from
c:\windows\system32, e.g. cmd.exe.

This commit changes that the inner loop to use a different variable so
as to not clobber the 'bin' variable. It also updates the spec test.
(#9636) Always set $CHILD_STATUS when executing on Windows

Previously, Puppet::Util.execute did not set $CHILD_STATUS on Windows,
including the Windows exec provider. This caused problems for the
'onlyif' and 'unless' exec parameters, among others.

When executing processes, the general approach on Unix, is to map
stdin, stdout, stderr of the child process to /dev/null or a file
descriptor, depending on the options specified, e.g. 'squelch',
'combine'. The use of a file, as opposed to creating a pipe, avoids
having to create reader threads, and the potential for deadlock that
can occur.

On Windows, we take the same approach. But this is complicated by the
lack of 'fork' and that $CHILD_STATUS is read-only. Ideally, we could
just use Process.spawn (as this allows redirection of stdin, etc), but
the method is only available in ruby 1.9.

So instead we use the win32/process gem, which uses the native Win32
API CreateProcess method. And the fix is to create a subprocess that
simply exits with the desired exit status, thereby setting
$CHILD_STATUS for us.

Also as part of this commit, the child_status variable was renamed to
exit_status, since that is what it is really, and to avoid confusion
with $CHILD_STATUS, which is something else entirely.
Maint: Remove duplicate path extension code

Previously, the Windows exec provider had incorrect logic for
resolving an executable using a hard-coded list of extensions,
e.g. '.cmd' wasn't in the list.

Recently, Puppet::Util.which was modified to perform path resolution
taking into account the PATHEXT environment variable on Windows. See
0258096c474d1b2cbf7e403fc990a853ac277231. As a result, the duplicate
logic in the Windows exec provider has been removed.
Merge pull request #167 from jhelwig/tickets/2.7.x/9996-exec-resources-with-multiline-commands

Tickets/2.7.x/9996 exec resources with multiline commands
Merge pull request #164 from jhelwig/tickets/2.7.x/9831-standardize-windows-provider-confines

Tickets/2.7.x/9831 standardize windows provider confines
Merge remote-tracking branch 'josh/ticket/2.7.x/9636-onlyif-unless-windows-exec' into 2.7.x

* josh/ticket/2.7.x/9636-onlyif-unless-windows-exec:
  Maint: Remove duplicate path extension code
  (#9636) Always set $CHILD_STATUS when executing on Windows
  (#9636) Fix PATHEXT resolution for paths other than system32
(#9996) Restore functionality for multi-line commands in exec resources

Originally we were relying on the behavior that Array.new would call
 #to_a on its argument, which is a no-op if the object is already an
array.  When #to_a is called on a string, it does not always return
[original_string].  Because string.to_a is effectively equivalent to
string.each_line.to_a (at least in Ruby 1.8.7) we were breaking
commands with embedded newlines.

Manually wrapping the passed in command in an array, and calling
 #flatten is much safer since it will not "helpfully" split up the
command string for us.
Updating for 2.7.6rc3
Merge branch '2.7rc' into 2.7.x
(#8547) Update storeconfigclean script to read puppet.conf

The existing storeconfig script is parsing and reading puppet.conf
specifically from the master section. This change allows the script to
read from the settings from puppet.conf in the order of master, main,
and loads the rails default. This should match the puppet application
behaviour.
(#10161) Parenthesize method arguments

Ruby 1.8.6 issues warnings when arguments to nested methods are not
parenthesized, e.g.

  f.puts(YAML.dump metadata)

results in:

  warning: parenthsize arguments(s) for future versions

These warnings were introduced during Windows development, but not
noticed on that platform due to using ruby 1.8.7, which doesn't issue
a warning. This commit just wraps the arguments in parenthesis.
(#6928) Don't blow up when the method is undefined...

Use the same model for testing instance methods as the rest of the code.

Reviewed-By: Max Martin <max@puppetlabs.com>
(#2848) Set `certdnsnames` values into the CSR.

We were incorrectly applying the `certdnsnames` setting when a certificate was
signed, not when a CSR was generated.  This would misapply the server setting
to all nodes in the infrastructure, rather than applying the client-supplied
version.

This commit adds `certdnsnames` to the CSR, allowing the client to pass their
desired set of names to the CA to be propagated into the final certificate.

It does not alter the behaviour when the certificate is generated.

Signed-off-by: Daniel Pittman <daniel@puppetlabs.com>
(#2848) extract the subjectAltName value from the CSR.

When a CSR is submitted, we need to inspect it and determine if there are any
subjectAltNames present in the request, and if those are legal.

The logic to validate the content of an extension is complex, and decomposing
the content requires digging into various X509 and ASN.1 related classes.

This commit adds a `subject_alt_names` method that will extract the extensions
containing subjectAltName values from the CSR, and reformat them into a useful
set of content suitable for use in Ruby.

Signed-off-by: Daniel Pittman <daniel@puppetlabs.com>
(#2848) Reject unknown (== all) extensions on the CSR.

If we get a CSR with a request extension that we don't recognize, we used to
just ignore those.  This can lead to dangerous situations, or at least
surprising behaviour, since we wouldn't copy those extensions into the final
certificate.

This changes that, by establishing an internal policy that we will whitelist
acceptable request extensions, and will hard-reject anything that isn't on
that.

Once something passes the whitelist we will have further policy, which will
enforce sanity in the request => certificate path.

Signed-off-by: Daniel Pittman <daniel@puppetlabs.com>
(#2848) Rewrite SSL Certificate Factory, fixing `subjectAltName` leak.

This is a major rewrite of the SSL CertificateFactory, which transforms the
way that we build the certificate we are about to sign in response to a CSR.

The main body of rework is to clean up the code and make it easier to manage
and validate, but there are two essential changes:

1. We no longer inject `subjectAltName` from local `certdnsnames`
   configuration option into every certificate we generate.  This fixes
   CVE-2011-3872, and prevents issuing client certificates that can
   impersonate the master.

2. *All* request extensions from the CSR are transported into the final
   certificate.  This includes `basicConstraints`; we rely on other layers of
   the Puppet stack having validated the code to this point.

Signed-off-by: Daniel Pittman <daniel@puppetlabs.com>