puppetlabs/puppet — pull request #1653 by zaphod42 (2013-05-16 22:15:05+00:00)
Title: (#20742) Handle DNs that cannot be parsed

When no DN is sent in a RACK setup (passenger behind apache), the DN that
the master sees for unauthenticated requests ends up being the string
"(null)". The openssl name parsing functions do not handle data that
doesn't look like a DN in a useful manner. If the string to be parsed as a
DN does not contain an equals sign ("="), then it will fail with an error
like:

TypeError: can't convert nil into String
# ./lib/puppet/util/ssl.rb:26:in `call'
# ./lib/puppet/util/ssl.rb:26:in `block in subject_from_dn'
# ./lib/puppet/util/ssl.rb:24:in `each'
# ./lib/puppet/util/ssl.rb:24:in `subject_from_dn'

This same code also would fail with a OpenSSL::X509::NameError if the
parsed DN contained an unknown part (RDN), e.g. "no=yes".

This commit fixes the malformed DN by checking that the DN contains at
least an equals sign before trying to parse. It also then handles all
OpenSSL::X509::NameError problems.

In addition, this fix uncovered a problem that the use of the SSL headers was
determined based on a DN being present, but not on the validity of that DN.
This would have allowed a DN without a CN to still use the verify header, but
leave the node unknown. That has also been fixed.