Jira (PUP-3395) Puppet doesn't check if certificate CN match the requested catalog

Title: Message Title

Vincent Bernat created an issue

PUP-3395

Puppet is behind an nginx server with the following configuration:

proxy_set_header X-Client-Verify $ssl_client_verify;

proxy_set_header X-Client-DN $ssl_client_s_dn;

In puppet.conf:

[master]

ssl_client_header = HTTP_X_CLIENT_DN

ssl_client_verify_header = HTTP_X_CLIENT_VERIFY

Here is an example of request sent to the puppet server (caught with tcpdump):

GET /production/node/node.example.com?transaction_uuid=b9b942bd-b35e-4aa0-a5c2-abf9a66f8913&fail_on_404=true HTTP/1.0

Host: puppet.example.com

X-Real-IP: 10.16.36.49

X-Forwarded-For: 10.16.36.49

X-Client-Verify: SUCCESS

X-Client-DN: /CN=anothernode.example.com

X-SSL-Issuer: /CN=Puppet CA: puppet.example.com

Connection: close

Accept: pson, yaml, b64_zlib_yaml, raw

HTTP/1.1 200 OK

Date: Tue, 07 Oct 2014 08:31:15 GMT

Status: 200 OK

Connection: close

X-Puppet-Version: 3.6.1

Content-Type: text/pson

Content-Length: 10103

{"document_type":"Node","data":{"name":"node.example.com","environment":"production","classes":{"example::hypervisor":null,"example::base":null},

So, I am anothernode.example.com and I am able to request the catalog for node.example.com. I would expect Puppet to disallow that.

Add Comment

This message was sent by Atlassian JIRA

--
You received this message because you are subscribed to the Google Groups "Puppet Bugs" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To post to this group, send email to [email protected].
Visit this group at http://groups.google.com/group/puppet-bugs.
For more options, visit https://groups.google.com/d/optout.

Reply via email to