(PUP-10238) Change default value of strict_hostname_checking to true #7982
+31
−9
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
mwaggett
reviewed
Feb 11, 2020
mwaggett
reviewed
Feb 11, 2020
justinstoller
force-pushed
the
PUP-10238
branch
from
7e47c2c to
8386dd3
Compare
mwaggett
reviewed
Feb 11, 2020
spec/unit/node_spec.rb
Outdated
| Puppet[:node_name] = "cert" | ||
| @node = Puppet::Node.new("foo.domain.com", |
There was a problem hiding this comment.
Why is this needed now? Looks like the same as the @node above?
mwaggett
reviewed
Feb 11, 2020
spec/unit/node_spec.rb
Outdated
| Puppet[:strict_hostname_checking] = true | ||
| @node = Puppet::Node.new("foo.domain.com", |
There was a problem hiding this comment.
Good catch. I re-wrote the setup and teardown of these specs in an intermediate step and forgot they weren't needed when I cleaned them up.
There was a problem hiding this comment.
pushed an update addressing your comments
justinstoller
force-pushed
the
PUP-10238
branch
from
8386dd3 to
f00a4b2
Compare
|
I reverted the whitespace change in 5.5.x, so now there's a conflict. @justinstoller can you resolve? |
Previously our default value of strict_hostname_checking was false which allowed matching dotted segments of a nodes certname (its CN in its certificate) as well as the segments of its fqdn fact, or hostname + domain fact. This was for compatibility when fact based classification within a site.pp was a more common pattern and node declarations were much less powerful than they are now. With the ability to use regular expressions in a node declaration the auto segmenting is no longer needed and with the ability to use facts directly, to use fact interpetation in hiera lookups, or create a custom external node classifier the injecting of facts into the nodes "name" is unneeded. The desire is to remove the setting completely in Puppet 7, while leaving it in 6 so those that depend on this behavior have time to re-write their site.pps to the newer styles. strict_hostname_checking setting is not marked deprecated completely because it will cause deprecation notices on setting access, which happens as part of normal compilation for now. However it does mark "node_name" setting as deprecated completely because it is now only referenced in code that by default will not run (and will only run if users change strict_hostname_checking back to false).
justinstoller
force-pushed
the
PUP-10238
branch
from
f00a4b2 to
df826ba
Compare
|
Wow, I sure screwed up that rebase. I think it's sorted now. |
Magisus
approved these changes
Feb 12, 2020
|
I'll merge this up to 6.4.x before tonight's run |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Previously our default value of strict_hostname_checking was false which
allowed matching dotted segments of a nodes certname (its CN in its
certificate) as well as the segments of its fqdn fact, or hostname +
domain fact.
This was for compatibility when fact based classification within a
site.pp was a more common pattern and node declarations were much less
powerful than they are now.
With the ability to use regular expressions in a node declaration the
auto segmenting is no longer needed and with the ability to use facts
directly, to use fact interpetation in hiera lookups, or create a custom
external node classifier the injecting of facts into the nodes "name" is
unneeded.
The desire is to remove the setting completely in Puppet 7, while
leaving it in 6 so those that depend on this behavior have time to
re-write their site.pps to the newer styles.
strict_hostname_checking setting is not marked deprecated completely
because it will cause deprecation notices on setting access, which
happens as part of normal compilation for now. However it does mark
"node_name" setting as deprecated completely because it is now only
referenced in code that by default will not run (and will only run if
users change strict_hostname_checking back to false).