puppetlabs/puppet — pull request #236 by joshcooper (2011-11-29 19:00:26+00:00)
Title: (#10739) Provide default subjectAltNames while bootstrapping master

Prior to #2848 (CVE-2011-3872), if Puppet[:certdnsnames] was not set,
puppet would add default subjectAltNames to any non-CA cert it
signed. The subjectAltNames were of the form:

DNS:puppet, DNS:, DNS:puppet.

The fix for #2848, prevented implicit subjectAltNames from ever being
added. However, this is desirable behavior when bootstrapping the
initial puppet master.

This commit re-enables this behavior but restricts it to the case
where all of the following are true:

1. We are a CA and master
2. We're signing the master's cert, not self-signing the CA
3. The CSR is for the current host

These should only ever be true when bootstrapping the initial
master. In particular, it should never be true for the CA's
self-signed cert, for remote agents, or for servers that are either
masters or CAs, but not both.

This commit also restores the previous behavior of only adding default
subject alt names if the fqdn of the host can be resolved.

Since the CSR for the initial master may contain subjectAltNames,
e.g. by setting Puppet[:dns_alt_names] prior to starting the master
for the first time, then the default subjectAltNames will not be
merged -- it's either one or the other, but not both.