puppetlabs/puppet — pull request #3316 by camlow325 (2014-11-17 16:40:35+00:00)
Title: (PUP-3676) Move OpenSSL::X509::Name calls in util/ssl.rb

This commit moves the initialization of a couple of constants in
`Puppet::Util::SSL` down into the body of the `subject_from_dn` method.

The purpose of the change is to avoid having this initialization, which
involves creating `OpenSSL::X509::Name` objects, be done when Puppet is
running under Puppet Server. We've been trying to avoid calls into
JRuby OpenSSL as doing so has caused many problems for Puppet Server.

The `subject_for_dn` method is the only code which referenced these
constants and `subject_for_dn` is only called by the Rack HTTP handler,
which is not used by Puppet Server.

To test these changes, I ran all of the puppet spec tests and observed that
they passed. I also setup Puppet under Apache/Passenger and instrumented
the Puppet code to see that the `subject_for_dn` method still returned the right
DN for the client certificate provided by the agent making a request to the master.