diff --git a/lib/puppet/network/handler/fileserver.rb b/lib/puppet/network/handler/fileserver.rb
index 20cf4338d..8fe3da29a 100755
--- a/lib/puppet/network/handler/fileserver.rb
+++ b/lib/puppet/network/handler/fileserver.rb
@@ -1,731 +1,732 @@
 require 'puppet'
 require 'puppet/network/authstore'
 require 'webrick/httpstatus'
 require 'cgi'
 require 'delegate'
 require 'sync'
+require 'puppet/network/handler'
 
 require 'puppet/network/handler'
 require 'puppet/network/xmlrpc/server'
 require 'puppet/file_serving'
 require 'puppet/file_serving/metadata'
 require 'puppet/network/handler'
 
 class Puppet::Network::Handler
   AuthStoreError = Puppet::AuthStoreError
   class FileServerError < Puppet::Error; end
   class FileServer < Handler
     desc "The interface to Puppet's fileserving abilities."
 
     attr_accessor :local
 
     CHECKPARAMS = [:mode, :type, :owner, :group, :checksum]
 
     # Special filserver module for puppet's module system
     MODULES = "modules"
     PLUGINS = "plugins"
 
     @interface = XMLRPC::Service::Interface.new("fileserver") { |iface|
       iface.add_method("string describe(string, string)")
       iface.add_method("string list(string, string, boolean, array)")
       iface.add_method("string retrieve(string, string)")
     }
 
     def self.params
       CHECKPARAMS.dup
     end
 
     # If the configuration file exists, then create (if necessary) a LoadedFile
     # object to manage it; else, return nil.
     def configuration
       # Short-circuit the default case.
       return @configuration if defined?(@configuration)
 
       config_path = @passed_configuration_path || Puppet[:fileserverconfig]
       return nil unless FileTest.exist?(config_path)
 
       # The file exists but we don't have a LoadedFile instance for it.
       @configuration = Puppet::Util::LoadedFile.new(config_path)
     end
 
     # Create our default mounts for modules and plugins.  This is duplicated code,
     # but I'm not really worried about that.
     def create_default_mounts
       @mounts = {}
       Puppet.debug "No file server configuration file; autocreating #{MODULES} mount with default permissions"
       mount = Mount.new(MODULES)
       mount.allow("*")
       @mounts[MODULES] = mount
 
       Puppet.debug "No file server configuration file; autocreating #{PLUGINS} mount with default permissions"
       mount = PluginMount.new(PLUGINS)
       mount.allow("*")
       @mounts[PLUGINS] = mount
     end
 
     # Describe a given file.  This returns all of the manageable aspects
     # of that file.
     def describe(url, links = :follow, client = nil, clientip = nil)
       links = links.intern if links.is_a? String
 
       mount, path = convert(url, client, clientip)
 
       mount.debug("Describing #{url} for #{client}") if client
 
       # use the mount to resolve the path for us.
       return "" unless full_path = mount.file_path(path, client)
 
       metadata = Puppet::FileServing::Metadata.new(url, :path => full_path, :links => links)
 
       return "" unless metadata.exist?
 
       begin
         metadata.collect
       rescue => detail
         puts detail.backtrace if Puppet[:trace]
         Puppet.err detail
         return ""
       end
 
       metadata.attributes_with_tabs
     end
 
     # Create a new fileserving module.
     def initialize(hash = {})
       @mounts = {}
       @files = {}
 
       @local = hash[:Local]
 
       @noreadconfig = true if hash[:Config] == false
 
       @passed_configuration_path = hash[:Config]
 
       if hash.include?(:Mount)
         @passedconfig = true
         raise Puppet::DevError, "Invalid mount hash #{hash[:Mount].inspect}" unless hash[:Mount].is_a?(Hash)
 
         hash[:Mount].each { |dir, name|
           self.mount(dir, name) if FileTest.exists?(dir)
         }
         self.mount(nil, MODULES)
         self.mount(nil, PLUGINS)
       else
         @passedconfig = false
         if configuration
           readconfig(false) # don't check the file the first time.
         else
           create_default_mounts
         end
       end
     end
 
     # List a specific directory's contents.
     def list(url, links = :ignore, recurse = false, ignore = false, client = nil, clientip = nil)
       mount, path = convert(url, client, clientip)
 
       mount.debug "Listing #{url} for #{client}" if client
 
       return "" unless mount.path_exists?(path, client)
 
       desc = mount.list(path, recurse, ignore, client)
 
       if desc.length == 0
         mount.notice "Got no information on //#{mount}/#{path}"
         return ""
       end
 
       desc.collect { |sub| sub.join("\t") }.join("\n")
     end
 
     def local?
       self.local
     end
 
     # Is a given mount available?
     def mounted?(name)
       @mounts.include?(name)
     end
 
     # Mount a new directory with a name.
     def mount(path, name)
       if @mounts.include?(name)
         if @mounts[name] != path
           raise FileServerError, "#{@mounts[name].path} is already mounted at #{name}"
         else
           # it's already mounted; no problem
           return
         end
       end
 
       # Let the mounts do their own error-checking.
       @mounts[name] = Mount.new(name, path)
       @mounts[name].info "Mounted #{path}"
 
       @mounts[name]
     end
 
     # Retrieve a file from the local disk and pass it to the remote
     # client.
     def retrieve(url, links = :ignore, client = nil, clientip = nil)
       links = links.intern if links.is_a? String
 
       mount, path = convert(url, client, clientip)
 
       mount.info "Sending #{url} to #{client}" if client
 
       unless mount.path_exists?(path, client)
         mount.debug "#{mount} reported that #{path} does not exist"
         return ""
       end
 
       links = links.intern if links.is_a? String
 
       if links == :ignore and FileTest.symlink?(path)
         mount.debug "I think that #{path} is a symlink and we're ignoring them"
         return ""
       end
 
       str = mount.read_file(path, client)
 
       if @local
         return str
       else
         return CGI.escape(str)
       end
     end
 
     def umount(name)
       @mounts.delete(name) if @mounts.include? name
     end
 
     private
 
     def authcheck(file, mount, client, clientip)
       # If we're local, don't bother passing in information.
       if local?
         client = nil
         clientip = nil
       end
       unless mount.allowed?(client, clientip)
         mount.warning "#{client} cannot access #{file}"
         raise Puppet::AuthorizationError, "Cannot access #{mount}"
       end
     end
 
     # Take a URL and some client info and return a mount and relative
     # path pair.
     #
     def convert(url, client, clientip)
       readconfig
 
       url = URI.unescape(url)
 
       mount, stub = splitpath(url, client)
 
       authcheck(url, mount, client, clientip)
 
       return mount, stub
     end
 
     # Return the mount for the Puppet modules; allows file copying from
     # the modules.
     def modules_mount(module_name, client)
       # Find our environment, if we have one.
       unless hostname = (client || Facter.value("hostname"))
         raise ArgumentError, "Could not find hostname"
       end
       env = (node = Puppet::Node.indirection.find(hostname)) ? node.environment : nil
 
       # And use the environment to look up the module.
       (mod = Puppet::Node::Environment.new(env).module(module_name) and mod.files?) ? @mounts[MODULES].copy(mod.name, mod.file_directory) : nil
     end
 
     # Read the configuration file.
     def readconfig(check = true)
       return if @noreadconfig
 
       return unless configuration
 
       return if check and ! @configuration.changed?
 
       newmounts = {}
       begin
         File.open(@configuration.file) { |f|
           mount = nil
           count = 1
           f.each { |line|
             case line
             when /^\s*#/; next # skip comments
             when /^\s*$/; next # skip blank lines
             when /\[([-\w]+)\]/
               name = $1
               raise FileServerError, "#{newmounts[name]} is already mounted as #{name} in #{@configuration.file}" if newmounts.include?(name)
               mount = Mount.new(name)
               newmounts[name] = mount
             when /^\s*(\w+)\s+(.+)$/
               var = $1
               value = $2
               case var
               when "path"
                 raise FileServerError.new("No mount specified for argument #{var} #{value}") unless mount
                 if mount.name == MODULES
                   Puppet.warning "The '#{mount.name}' module can not have a path. Ignoring attempt to set it"
                 else
                   begin
                     mount.path = value
                   rescue FileServerError => detail
                     Puppet.err "Removing mount #{mount.name}: #{detail}"
                     newmounts.delete(mount.name)
                   end
                 end
               when "allow"
                 raise FileServerError.new("No mount specified for argument #{var} #{value}") unless mount
                 value.split(/\s*,\s*/).each { |val|
                   begin
                     mount.info "allowing #{val} access"
                     mount.allow(val)
                   rescue AuthStoreError => detail
                     puts detail.backtrace if Puppet[:trace]
 
                       raise FileServerError.new(
                         detail.to_s,
 
                       count, @configuration.file)
                   end
                 }
               when "deny"
                 raise FileServerError.new("No mount specified for argument #{var} #{value}") unless mount
                 value.split(/\s*,\s*/).each { |val|
                   begin
                     mount.info "denying #{val} access"
                     mount.deny(val)
                   rescue AuthStoreError => detail
 
                     raise FileServerError.new(
                       detail.to_s,
 
                       count, @configuration.file)
                   end
                 }
               else
                 raise FileServerError.new("Invalid argument '#{var}'", count, @configuration.file)
               end
             else
               raise FileServerError.new("Invalid line '#{line.chomp}'", count, @configuration.file)
             end
             count += 1
           }
         }
       rescue Errno::EACCES => detail
         Puppet.err "FileServer error: Cannot read #{@configuration}; cannot serve"
         #raise Puppet::Error, "Cannot read #{@configuration}"
       rescue Errno::ENOENT => detail
         Puppet.err "FileServer error: '#{@configuration}' does not exist; cannot serve"
       end
 
       unless newmounts[MODULES]
         Puppet.debug "No #{MODULES} mount given; autocreating with default permissions"
         mount = Mount.new(MODULES)
         mount.allow("*")
         newmounts[MODULES] = mount
       end
 
       unless newmounts[PLUGINS]
         Puppet.debug "No #{PLUGINS} mount given; autocreating with default permissions"
         mount = PluginMount.new(PLUGINS)
         mount.allow("*")
         newmounts[PLUGINS] = mount
       end
 
       unless newmounts[PLUGINS].valid?
         Puppet.debug "No path given for #{PLUGINS} mount; creating a special PluginMount"
         # We end up here if the user has specified access rules for
         # the plugins mount, without specifying a path (which means
         # they want to have the default behaviour for the mount, but
         # special access control).  So we need to move all the
         # user-specified access controls into the new PluginMount
         # object...
         mount = PluginMount.new(PLUGINS)
         # Yes, you're allowed to hate me for this.
 
           mount.instance_variable_set(
             :@declarations,
 
               newmounts[PLUGINS].instance_variable_get(:@declarations)
               )
         newmounts[PLUGINS] = mount
       end
 
       # Verify each of the mounts are valid.
       # We let the check raise an error, so that it can raise an error
       # pointing to the specific problem.
       newmounts.each { |name, mount|
         raise FileServerError, "Invalid mount #{name}" unless mount.valid?
       }
       @mounts = newmounts
     end
 
     # Split the path into the separate mount point and path.
     def splitpath(dir, client)
       # the dir is based on one of the mounts
       # so first retrieve the mount path
       mount = nil
       path = nil
       if dir =~ %r{/([-\w]+)}
         # Strip off the mount name.
         mount_name, path = dir.sub(%r{^/}, '').split(File::Separator, 2)
 
         unless mount = modules_mount(mount_name, client)
           unless mount = @mounts[mount_name]
             raise FileServerError, "Fileserver module '#{mount_name}' not mounted"
           end
         end
       else
         raise FileServerError, "Fileserver error: Invalid path '#{dir}'"
       end
 
       if path.nil? or path == ''
         path = '/'
       elsif path
         # Remove any double slashes that might have occurred
         path = URI.unescape(path.gsub(/\/\//, "/"))
       end
 
       return mount, path
     end
 
     def to_s
       "fileserver"
     end
 
     # A simple class for wrapping mount points.  Instances of this class
     # don't know about the enclosing object; they're mainly just used for
     # authorization.
     class Mount < Puppet::Network::AuthStore
       attr_reader :name
 
       @@syncs = {}
 
       @@files = {}
 
       Puppet::Util.logmethods(self, true)
 
       # Create a map for a specific client.
       def clientmap(client)
         {
           "h" => client.sub(/\..*$/, ""),
           "H" => client,
           "d" => client.sub(/[^.]+\./, "") # domain name
         }
       end
 
       # Replace % patterns as appropriate.
       def expand(path, client = nil)
         # This map should probably be moved into a method.
         map = nil
 
         if client
           map = clientmap(client)
         else
           Puppet.notice "No client; expanding '#{path}' with local host"
           # Else, use the local information
           map = localmap
         end
         path.gsub(/%(.)/) do |v|
           key = $1
           if key == "%"
             "%"
           else
             map[key] || v
           end
         end
       end
 
       # Do we have any patterns in our path, yo?
       def expandable?
         if defined?(@expandable)
           @expandable
         else
           false
         end
       end
 
       # Return a fully qualified path, given a short path and
       # possibly a client name.
       def file_path(relative_path, node = nil)
         full_path = path(node)
 
         unless full_path
           p self
           raise ArgumentError.new("Mounts without paths are not usable") unless full_path
         end
 
         # If there's no relative path name, then we're serving the mount itself.
         return full_path unless relative_path and relative_path != "/"
 
         File.join(full_path, relative_path)
       end
 
       # Create out object.  It must have a name.
       def initialize(name, path = nil)
         unless name =~ %r{^[-\w]+$}
           raise FileServerError, "Invalid name format '#{name}'"
         end
         @name = name
 
         if path
           self.path = path
         else
           @path = nil
         end
 
         @files = {}
 
         super()
       end
 
       def fileobj(path, links, client)
         obj = nil
         if obj = @files[file_path(path, client)]
           # This can only happen in local fileserving, but it's an
           # important one.  It'd be nice if we didn't just set
           # the check params every time, but I'm not sure it's worth
           # the effort.
           obj[:audit] = CHECKPARAMS
         else
 
           obj = Puppet::Type.type(:file).new(
 
             :name => file_path(path, client),
 
             :audit => CHECKPARAMS
           )
           @files[file_path(path, client)] = obj
         end
 
         if links == :manage
           links = :follow
         end
 
         # This, ah, might be completely redundant
         obj[:links] = links unless obj[:links] == links
 
         obj
       end
 
       # Read the contents of the file at the relative path given.
       def read_file(relpath, client)
         File.read(file_path(relpath, client))
       end
 
       # Cache this manufactured map, since if it's used it's likely
       # to get used a lot.
       def localmap
         unless defined?(@@localmap)
           @@localmap = {
             "h" =>  Facter.value("hostname"),
             "H" => [Facter.value("hostname"),
               Facter.value("domain")].join("."),
             "d" =>  Facter.value("domain")
           }
         end
         @@localmap
       end
 
       # Return the path as appropriate, expanding as necessary.
       def path(client = nil)
         if expandable?
           return expand(@path, client)
         else
           return @path
         end
       end
 
       # Set the path.
       def path=(path)
         # FIXME: For now, just don't validate paths with replacement
         # patterns in them.
         if path =~ /%./
           # Mark that we're expandable.
           @expandable = true
         else
           raise FileServerError, "#{path} does not exist" unless FileTest.exists?(path)
           raise FileServerError, "#{path} is not a directory" unless FileTest.directory?(path)
           raise FileServerError, "#{path} is not readable" unless FileTest.readable?(path)
           @expandable = false
         end
         @path = path
       end
 
       # Verify that the path given exists within this mount's subtree.
       #
       def path_exists?(relpath, client = nil)
         File.exists?(file_path(relpath, client))
       end
 
       # Return the current values for the object.
       def properties(obj)
         obj.retrieve.inject({}) { |props, ary| props[ary[0].name] = ary[1]; props }
       end
 
       # Retrieve a specific directory relative to a mount point.
       # If they pass in a client, then expand as necessary.
       def subdir(dir = nil, client = nil)
         basedir = self.path(client)
 
         dirname = if dir
           File.join(basedir, *dir.split("/"))
         else
           basedir
         end
 
         dirname
       end
 
       def sync(path)
         @@syncs[path] ||= Sync.new
         @@syncs[path]
       end
 
       def to_s
         "mount[#{@name}]"
       end
 
       # Verify our configuration is valid.  This should really check to
       # make sure at least someone will be allowed, but, eh.
       def valid?
         if name == MODULES
           return @path.nil?
         else
           return ! @path.nil?
         end
       end
 
       # Return a new mount with the same properties as +self+, except
       # with a different name and path.
       def copy(name, path)
         result = self.clone
         result.path = path
         result.instance_variable_set(:@name, name)
         result
       end
 
       # List the contents of the relative path +relpath+ of this mount.
       #
       # +recurse+ is the number of levels to recurse into the tree,
       # or false to provide no recursion or true if you just want to
       # go for broke.
       #
       # +ignore+ is an array of filenames to ignore when traversing
       # the list.
       #
       # The return value of this method is a complex nest of arrays,
       # which describes a directory tree.  Each file or directory is
       # represented by an array, where the first element is the path
       # of the file (relative to the root of the mount), and the
       # second element is the type.  A directory is represented by an
       # array as well, where the first element is a "directory" array,
       # while the remaining elements are other file or directory
       # arrays.  Confusing?  Hell yes.  As an added bonus, all names
       # must start with a slash, because... well, I'm fairly certain
       # a complete explanation would involve the words "crack pipe"
       # and "bad batch".
       #
       def list(relpath, recurse, ignore, client = nil)
         abspath = file_path(relpath, client)
         if FileTest.exists?(abspath)
           if FileTest.directory?(abspath) and recurse
             return reclist(abspath, recurse, ignore)
           else
             return [["/", File.stat(abspath).ftype]]
           end
         end
         nil
       end
 
       def reclist(abspath, recurse, ignore)
         require 'puppet/file_serving'
         require 'puppet/file_serving/fileset'
         if recurse.is_a?(Fixnum)
           args = { :recurse => true, :recurselimit => recurse, :links => :follow }
         else
           args = { :recurse => recurse, :links => :follow }
         end
         args[:ignore] = ignore if ignore
         fs = Puppet::FileServing::Fileset.new(abspath, args)
         ary = fs.files.collect do |file|
           if file == "."
             file = "/"
           else
             file = File.join("/", file )
           end
           stat = fs.stat(File.join(abspath, file))
           next if stat.nil?
           [ file, stat.ftype ]
         end
 
         ary.compact
       end
 
     end
 
     # A special mount class specifically for the plugins mount -- just
     # has some magic to effectively do a union mount of the 'plugins'
     # directory of all modules.
     #
     class PluginMount < Mount
       def path(client)
         ''
       end
 
       def mod_path_exists?(mod, relpath, client = nil)
         ! mod.plugin(relpath).nil?
       end
 
       def path_exists?(relpath, client = nil)
         !valid_modules(client).find { |mod| mod.plugin(relpath) }.nil?
       end
 
       def valid?
         true
       end
 
       def mod_file_path(mod, relpath, client = nil)
         File.join(mod, PLUGINS, relpath)
       end
 
       def file_path(relpath, client = nil)
         return nil unless mod = valid_modules(client).find { |m| m.plugin(relpath) }
         mod.plugin(relpath)
       end
 
       # create a list of files by merging all modules
       def list(relpath, recurse, ignore, client = nil)
         result = []
         valid_modules(client).each do |mod|
           if modpath = mod.plugin(relpath)
             if FileTest.directory?(modpath) and recurse
               ary = reclist(modpath, recurse, ignore)
               ary ||= []
               result += ary
             else
               result += [["/", File.stat(modpath).ftype]]
             end
           end
         end
         result
       end
 
       private
       def valid_modules(client)
         Puppet::Node::Environment.new.modules.find_all { |mod| mod.exist? }
       end
 
       def add_to_filetree(f, filetree)
         first, rest = f.split(File::SEPARATOR, 2)
       end
     end
   end
 end
 
diff --git a/lib/puppet/network/http_server/mongrel.rb b/lib/puppet/network/http_server/mongrel.rb
index ce0401ad2..fb9516461 100644
--- a/lib/puppet/network/http_server/mongrel.rb
+++ b/lib/puppet/network/http_server/mongrel.rb
@@ -1,130 +1,129 @@
 #!/usr/bin/env ruby
 # File:       06-11-14-mongrel_xmlrpc.rb
 # Author:     Manuel Holtgrewe <purestorm at ggnore.net>
 #
 # Copyright (c) 2006 Manuel Holtgrewe, 2007 Luke Kanies
 #
 # This file is based heavily on a file retrieved from
 # http://ttt.ggnore.net/2006/11/15/xmlrpc-with-mongrel-and-ruby-off-rails/
 
 require 'rubygems'
 require 'mongrel'
 require 'xmlrpc/server'
 require 'puppet/network/xmlrpc/server'
 require 'puppet/network/http_server'
 require 'puppet/network/client_request'
 require 'puppet/network/handler'
 
 require 'resolv'
 
 # This handler can be hooked into Mongrel to accept HTTP requests. After
 # checking whether the request itself is sane, the handler forwards it
 # to an internal instance of XMLRPC::BasicServer to process it.
 #
 # You can access the server by calling the Handler's "xmlrpc_server"
 # attribute accessor method and add XMLRPC handlers there. For example:
 #
 # <pre>
 # handler = XmlRpcHandler.new
 # handler.xmlrpc_server.add_handler("my.add") { |a, b| a.to_i + b.to_i }
 # </pre>
 module Puppet::Network
   class HTTPServer::Mongrel < ::Mongrel::HttpHandler
     attr_reader :xmlrpc_server
 
     def initialize(handlers)
       if Puppet[:debug]
         $mongrel_debug_client = true
         Puppet.debug 'Mongrel client debugging enabled. [$mongrel_debug_client = true].'
       end
       # Create a new instance of BasicServer. We are supposed to subclass it
       # but that does not make sense since we would not introduce any new
       # behaviour and we have to subclass Mongrel::HttpHandler so our handler
       # works for Mongrel.
       @xmlrpc_server = Puppet::Network::XMLRPCServer.new
       handlers.each do |name|
         unless handler = Puppet::Network::Handler.handler(name)
           raise ArgumentError, "Invalid handler #{name}"
         end
         @xmlrpc_server.add_handler(handler.interface, handler.new({}))
       end
     end
 
     # This method produces the same results as XMLRPC::CGIServer.serve
     # from Ruby's stdlib XMLRPC implementation.
     def process(request, response)
       # Make sure this has been a POST as required for XMLRPC.
       request_method = request.params[Mongrel::Const::REQUEST_METHOD] || Mongrel::Const::GET
       if request_method != "POST"
         response.start(405) { |head, out| out.write("Method Not Allowed") }
         return
       end
 
       # Make sure the user has sent text/xml data.
       request_mime = request.params["CONTENT_TYPE"] || "text/plain"
       if parse_content_type(request_mime).first != "text/xml"
         response.start(400) { |head, out| out.write("Bad Request") }
         return
       end
 
       # Make sure there is data in the body at all.
       length = request.params[Mongrel::Const::CONTENT_LENGTH].to_i
       if length <= 0
         response.start(411) { |head, out| out.write("Length Required") }
         return
       end
 
       # Check the body to be valid.
       if request.body.nil? or request.body.size != length
         response.start(400) { |head, out| out.write("Bad Request") }
         return
       end
 
       info = client_info(request)
 
       # All checks above passed through
       response.start(200) do |head, out|
         head["Content-Type"] = "text/xml; charset=utf-8"
         begin
           out.write(@xmlrpc_server.process(request.body, info))
         rescue => detail
           puts detail.backtrace
           raise
         end
       end
     end
 
     private
 
     def client_info(request)
       params = request.params
       ip = params["HTTP_X_FORWARDED_FOR"] ? params["HTTP_X_FORWARDED_FOR"].split(',').last.strip : params["REMOTE_ADDR"]
       # JJM #906 The following dn.match regular expression is forgiving
       # enough to match the two Distinguished Name string contents
       # coming from Apache, Pound or other reverse SSL proxies.
       if dn = params[Puppet[:ssl_client_header]] and dn_matchdata = dn.match(/^.*?CN\s*=\s*(.*)/)
         client = dn_matchdata[1].to_str
         valid = (params[Puppet[:ssl_client_verify_header]] == 'SUCCESS')
       else
         begin
           client = Resolv.getname(ip)
         rescue => detail
           Puppet.err "Could not resolve #{ip}: #{detail}"
           client = "unknown"
         end
         valid = false
       end
 
       info = Puppet::Network::ClientRequest.new(client, ip, valid)
 
       info
     end
 
     # Taken from XMLRPC::ParseContentType
     def parse_content_type(str)
       a, *b = str.split(";")
       return a.strip, *b
     end
   end
 end
-
diff --git a/lib/puppet/ssl/certificate_request.rb b/lib/puppet/ssl/certificate_request.rb
index 461dc5721..b5ba86113 100644
--- a/lib/puppet/ssl/certificate_request.rb
+++ b/lib/puppet/ssl/certificate_request.rb
@@ -1,149 +1,219 @@
 require 'puppet/ssl/base'
 
 # Manage certificate requests.
 class Puppet::SSL::CertificateRequest < Puppet::SSL::Base
   wraps OpenSSL::X509::Request
 
   extend Puppet::Indirector
 
   # If auto-signing is on, sign any certificate requests as they are saved.
   module AutoSigner
     def save(instance, key = nil)
       super
 
       # Try to autosign the CSR.
       if ca = Puppet::SSL::CertificateAuthority.instance
         ca.autosign
       end
     end
   end
 
   indirects :certificate_request, :terminus_class => :file, :extend => AutoSigner
 
   # Convert a string into an instance.
   def self.from_s(string)
     instance = wrapped_class.new(string)
     name = instance.subject.to_s.sub(/\/CN=/i, '').downcase
     result = new(name)
     result.content = instance
     result
   end
 
   # Because of how the format handler class is included, this
   # can't be in the base class.
   def self.supported_formats
     [:s]
   end
 
   def extension_factory
     @ef ||= OpenSSL::X509::ExtensionFactory.new
   end
 
   # How to create a certificate request with our system defaults.
   def generate(key, options = {})
     Puppet.info "Creating a new SSL certificate request for #{name}"
 
     # Support either an actual SSL key, or a Puppet key.
     key = key.content if key.is_a?(Puppet::SSL::Key)
 
     # If we're a CSR for the CA, then use the real ca_name, rather than the
     # fake 'ca' name.  This is mostly for backward compatibility with 0.24.x,
     # but it's also just a good idea.
     common_name = name == Puppet::SSL::CA_NAME ? Puppet.settings[:ca_name] : name
 
     csr = OpenSSL::X509::Request.new
     csr.version = 0
     csr.subject = OpenSSL::X509::Name.new([["CN", common_name]])
     csr.public_key = key.public_key
 
     if options[:dns_alt_names] then
       names = options[:dns_alt_names].split(/\s*,\s*/).map(&:strip) + [name]
       names = names.sort.uniq.map {|name| "DNS:#{name}" }.join(", ")
       names = extension_factory.create_extension("subjectAltName", names, false)
 
       extReq = OpenSSL::ASN1::Set([OpenSSL::ASN1::Sequence([names])])
 
       # We only support the standard request extensions.  If you really need
       # msExtReq support, let us know and we can restore them. --daniel 2011-10-10
       csr.add_attribute(OpenSSL::X509::Attribute.new("extReq", extReq))
     end
 
     csr.sign(key, OpenSSL::Digest::MD5.new)
 
     raise Puppet::Error, "CSR sign verification failed; you need to clean the certificate request for #{name} on the server" unless csr.verify(key.public_key)
 
     @content = csr
     Puppet.info "Certificate Request fingerprint (md5): #{fingerprint}"
     @content
   end
 
   # Return the set of extensions requested on this CSR, in a form designed to
   # be useful to Ruby: a hash.  Which, not coincidentally, you can pass
   # successfully to the OpenSSL constructor later, if you want.
   def request_extensions
     raise Puppet::Error, "CSR needs content to extract fields" unless @content
 
     # Prefer the standard extReq, but accept the Microsoft specific version as
     # a fallback, if the standard version isn't found.
     ext = @content.attributes.find {|x| x.oid == "extReq" } or
       @content.attributes.find {|x| x.oid == "msExtReq" }
     return [] unless ext
 
     # Assert the structure and extract the names into an array of arrays.
     unless ext.value.is_a? OpenSSL::ASN1::Set
       raise Puppet::Error, "In #{ext.oid}, expected Set but found #{ext.value.class}"
     end
 
     unless ext.value.value.is_a? Array
       raise Puppet::Error, "In #{ext.oid}, expected Set[Array] but found #{ext.value.value.class}"
     end
 
     unless ext.value.value.length == 1
       raise Puppet::Error, "In #{ext.oid}, expected Set[Array[...]], but found #{ext.value.value.length} items in the array"
     end
 
     san = ext.value.value.first
     unless san.is_a? OpenSSL::ASN1::Sequence
       raise Puppet::Error, "In #{ext.oid}, expected Set[Array[Sequence[...]]], but found #{san.class}"
     end
     san = san.value
 
     # OK, now san should be the array of items, validate that...
     index = -1
     san.map do |name|
       index += 1
 
       unless name.is_a? OpenSSL::ASN1::Sequence
         raise Puppet::Error, "In #{ext.oid}, expected request extension record #{index} to be a Sequence, but found #{name.class}"
       end
       name = name.value
 
       # OK, turn that into an extension, to unpack the content.  Lovely that
       # we have to swap the order of arguments to the underlying method, or
       # perhaps that the ASN.1 representation chose to pack them in a
       # strange order where the optional component comes *earlier* than the
       # fixed component in the sequence.
       case name.length
       when 2
         ev = OpenSSL::X509::Extension.new(name[0].value, name[1].value)
         { "oid" => ev.oid, "value" => ev.value }
 
       when 3
         ev = OpenSSL::X509::Extension.new(name[0].value, name[2].value, name[1].value)
         { "oid" => ev.oid, "value" => ev.value, "critical" => ev.critical? }
 
       else
         raise Puppet::Error, "In #{ext.oid}, expected extension record #{index} to have two or three items, but found #{name.length}"
       end
     end.flatten
   end
 
   def subject_alt_names
     @subject_alt_names ||= request_extensions.
       select {|x| x["oid"] = "subjectAltName" }.
       map {|x| x["value"].split(/\s*,\s*/) }.
       flatten.
       sort.
       uniq
   end
+
+  # Return the set of extensions requested on this CSR, in a form designed to
+  # be useful to Ruby: a hash.  Which, not coincidentally, you can pass
+  # successfully to the OpenSSL constructor later, if you want.
+  def request_extensions
+    raise Puppet::Error, "CSR needs content to extract fields" unless @content
+
+    # Prefer the standard extReq, but accept the Microsoft specific version as
+    # a fallback, if the standard version isn't found.
+    ext = @content.attributes.find {|x| x.oid == "extReq" } or
+      @content.attributes.find {|x| x.oid == "msExtReq" }
+    return [] unless ext
+
+    # Assert the structure and extract the names into an array of arrays.
+    unless ext.value.is_a? OpenSSL::ASN1::Set
+      raise Puppet::Error, "In #{ext.oid}, expected Set but found #{ext.value.class}"
+    end
+
+    unless ext.value.value.is_a? Array
+      raise Puppet::Error, "In #{ext.oid}, expected Set[Array] but found #{ext.value.value.class}"
+    end
+
+    unless ext.value.value.length == 1
+      raise Puppet::Error, "In #{ext.oid}, expected Set[Array[...]], but found #{ext.value.value.length} items in the array"
+    end
+
+    san = ext.value.value.first
+    unless san.is_a? OpenSSL::ASN1::Sequence
+      raise Puppet::Error, "In #{ext.oid}, expected Set[Array[Sequence[...]]], but found #{san.class}"
+    end
+    san = san.value
+
+    # OK, now san should be the array of items, validate that...
+    index = -1
+    san.map do |name|
+      index += 1
+
+      unless name.is_a? OpenSSL::ASN1::Sequence
+        raise Puppet::Error, "In #{ext.oid}, expected request extension record #{index} to be a Sequence, but found #{name.class}"
+      end
+      name = name.value
+
+      # OK, turn that into an extension, to unpack the content.  Lovely that
+      # we have to swap the order of arguments to the underlying method, or
+      # perhaps that the ASN.1 representation chose to pack them in a
+      # strange order where the optional component comes *earlier* than the
+      # fixed component in the sequence.
+      case name.length
+      when 2
+        ev = OpenSSL::X509::Extension.new(name[0].value, name[1].value)
+        { "oid" => ev.oid, "value" => ev.value }
+
+      when 3
+        ev = OpenSSL::X509::Extension.new(name[0].value, name[2].value, name[1].value)
+        { "oid" => ev.oid, "value" => ev.value, "critical" => ev.critical? }
+
+      else
+        raise Puppet::Error, "In #{ext.oid}, expected extension record #{index} to have two or three items, but found #{name.length}"
+      end
+    end.flatten
+  end
+
+  def subject_alt_names
+    @subject_alt_names ||= request_extensions.
+      select {|x| x["oid"] = "subjectAltName" }.
+      map {|x| x["value"].split(/\s*,\s*/) }.
+      flatten.
+      sort.
+      uniq
+  end
 end
diff --git a/lib/puppet/ssl/host.rb b/lib/puppet/ssl/host.rb
index 36b759c65..468779870 100644
--- a/lib/puppet/ssl/host.rb
+++ b/lib/puppet/ssl/host.rb
@@ -1,325 +1,329 @@
 require 'puppet/indirector'
 require 'puppet/ssl'
 require 'puppet/ssl/key'
 require 'puppet/ssl/certificate'
 require 'puppet/ssl/certificate_request'
 require 'puppet/ssl/certificate_revocation_list'
 
 # The class that manages all aspects of our SSL certificates --
 # private keys, public keys, requests, etc.
 class Puppet::SSL::Host
   # Yay, ruby's strange constant lookups.
   Key = Puppet::SSL::Key
   CA_NAME = Puppet::SSL::CA_NAME
   Certificate = Puppet::SSL::Certificate
   CertificateRequest = Puppet::SSL::CertificateRequest
   CertificateRevocationList = Puppet::SSL::CertificateRevocationList
 
   extend Puppet::Indirector
   indirects :certificate_status, :terminus_class => :file
 
   attr_reader :name
   attr_accessor :ca
 
   attr_writer :key, :certificate, :certificate_request
 
   # This accessor is used in instances for indirector requests to hold desired state
   attr_accessor :desired_state
 
   def self.localhost
     return @localhost if @localhost
     @localhost = new
     @localhost.generate unless @localhost.certificate
     @localhost.key
     @localhost
   end
 
   def self.reset
     @localhost = nil
   end
 
   # This is the constant that people will use to mark that a given host is
   # a certificate authority.
   def self.ca_name
     CA_NAME
   end
 
   class << self
     attr_reader :ca_location
   end
 
   # Configure how our various classes interact with their various terminuses.
   def self.configure_indirection(terminus, cache = nil)
     Certificate.indirection.terminus_class = terminus
     CertificateRequest.indirection.terminus_class = terminus
     CertificateRevocationList.indirection.terminus_class = terminus
 
     host_map = {:ca => :file, :file => nil, :rest => :rest}
     if term = host_map[terminus]
       self.indirection.terminus_class = term
     else
       self.indirection.reset_terminus_class
     end
 
     if cache
       # This is weird; we don't actually cache our keys, we
       # use what would otherwise be the cache as our normal
       # terminus.
       Key.indirection.terminus_class = cache
     else
       Key.indirection.terminus_class = terminus
     end
 
     if cache
       Certificate.indirection.cache_class = cache
       CertificateRequest.indirection.cache_class = cache
       CertificateRevocationList.indirection.cache_class = cache
     else
       # Make sure we have no cache configured.  puppet master
       # switches the configurations around a bit, so it's important
       # that we specify the configs for absolutely everything, every
       # time.
       Certificate.indirection.cache_class = nil
       CertificateRequest.indirection.cache_class = nil
       CertificateRevocationList.indirection.cache_class = nil
     end
   end
 
   CA_MODES = {
     # Our ca is local, so we use it as the ultimate source of information
     # And we cache files locally.
     :local => [:ca, :file],
     # We're a remote CA client.
     :remote => [:rest, :file],
     # We are the CA, so we don't have read/write access to the normal certificates.
     :only => [:ca],
     # We have no CA, so we just look in the local file store.
     :none => [:file]
   }
 
   # Specify how we expect to interact with our certificate authority.
   def self.ca_location=(mode)
     modes = CA_MODES.collect { |m, vals| m.to_s }.join(", ")
     raise ArgumentError, "CA Mode can only be one of: #{modes}" unless CA_MODES.include?(mode)
 
     @ca_location = mode
 
     configure_indirection(*CA_MODES[@ca_location])
   end
 
   # Puppet::SSL::Host is actually indirected now so the original implementation
   # has been moved into the certificate_status indirector.  This method is in-use
   # in `puppet cert -c <certname>`.
   def self.destroy(name)
     indirection.destroy(name)
   end
 
   def self.from_pson(pson)
     instance = new(pson["name"])
     if pson["desired_state"]
       instance.desired_state = pson["desired_state"]
     end
     instance
   end
 
   # Puppet::SSL::Host is actually indirected now so the original implementation
   # has been moved into the certificate_status indirector.  This method does not
   # appear to be in use in `puppet cert -l`.
   def self.search(options = {})
     indirection.search("*", options)
   end
 
   # Is this a ca host, meaning that all of its files go in the CA location?
   def ca?
     ca
   end
 
   def key
     @key ||= Key.indirection.find(name)
   end
 
   # This is the private key; we can create it from scratch
   # with no inputs.
   def generate_key
     @key = Key.new(name)
     @key.generate
     begin
       Key.indirection.save(@key)
     rescue
       @key = nil
       raise
     end
     true
   end
 
   def certificate_request
     @certificate_request ||= CertificateRequest.indirection.find(name)
   end
 
   def this_csr_is_for_the_current_host
     name == Puppet[:certname].downcase
   end
 
+  def this_csr_is_for_the_current_host
+    name == Puppet[:certname].downcase
+  end
+
   # Our certificate request requires the key but that's all.
   def generate_certificate_request(options = {})
     generate_key unless key
 
     # If this is for the current machine...
     if this_csr_is_for_the_current_host
       # ...add our configured dns_alt_names
       if Puppet[:dns_alt_names] and Puppet[:dns_alt_names] != ''
         options[:dns_alt_names] ||= Puppet[:dns_alt_names]
       end
     end
 
     @certificate_request = CertificateRequest.new(name)
     @certificate_request.generate(key.content, options)
     begin
       CertificateRequest.indirection.save(@certificate_request)
     rescue
       @certificate_request = nil
       raise
     end
 
     true
   end
 
   def certificate
     unless @certificate
       generate_key unless key
 
       # get the CA cert first, since it's required for the normal cert
       # to be of any use.
       return nil unless Certificate.indirection.find("ca") unless ca?
       return nil unless @certificate = Certificate.indirection.find(name)
 
       unless certificate_matches_key?
         raise Puppet::Error, "Retrieved certificate does not match private key; please remove certificate from server and regenerate it with the current key"
       end
     end
     @certificate
   end
 
   def certificate_matches_key?
     return false unless key
     return false unless certificate
 
     certificate.content.check_private_key(key.content)
   end
 
   # Generate all necessary parts of our ssl host.
   def generate
     generate_key unless key
     generate_certificate_request unless certificate_request
 
     # If we can get a CA instance, then we're a valid CA, and we
     # should use it to sign our request; else, just try to read
     # the cert.
     if ! certificate and ca = Puppet::SSL::CertificateAuthority.instance
       ca.sign(self.name, true)
     end
   end
 
   def initialize(name = nil)
     @name = (name || Puppet[:certname]).downcase
     @key = @certificate = @certificate_request = nil
     @ca = (name == self.class.ca_name)
   end
 
   # Extract the public key from the private key.
   def public_key
     key.content.public_key
   end
 
   # Create/return a store that uses our SSL info to validate
   # connections.
   def ssl_store(purpose = OpenSSL::X509::PURPOSE_ANY)
     unless @ssl_store
       @ssl_store = OpenSSL::X509::Store.new
       @ssl_store.purpose = purpose
 
       # Use the file path here, because we don't want to cause
       # a lookup in the middle of setting our ssl connection.
       @ssl_store.add_file(Puppet[:localcacert])
 
       # If there's a CRL, add it to our store.
       if crl = Puppet::SSL::CertificateRevocationList.indirection.find(CA_NAME)
         @ssl_store.flags = OpenSSL::X509::V_FLAG_CRL_CHECK_ALL|OpenSSL::X509::V_FLAG_CRL_CHECK if Puppet.settings[:certificate_revocation]
         @ssl_store.add_crl(crl.content)
       end
       return @ssl_store
     end
     @ssl_store
   end
 
   def to_pson(*args)
     my_cert = Puppet::SSL::Certificate.indirection.find(name)
     pson_hash = { :name  => name }
 
     my_state = state
 
     pson_hash[:state] = my_state
     pson_hash[:desired_state] = desired_state if desired_state
 
     if my_state == 'requested'
       pson_hash[:fingerprint] = certificate_request.fingerprint
     else
       pson_hash[:fingerprint] = my_cert.fingerprint
     end
 
     pson_hash.to_pson(*args)
   end
 
   # Attempt to retrieve a cert, if we don't already have one.
   def wait_for_cert(time)
     begin
       return if certificate
       generate
       return if certificate
     rescue SystemExit,NoMemoryError
       raise
     rescue Exception => detail
       puts detail.backtrace if Puppet[:trace]
       Puppet.err "Could not request certificate: #{detail}"
       if time < 1
         puts "Exiting; failed to retrieve certificate and waitforcert is disabled"
         exit(1)
       else
         sleep(time)
       end
       retry
     end
 
     if time < 1
       puts "Exiting; no certificate found and waitforcert is disabled"
       exit(1)
     end
 
     while true
       sleep time
       begin
         break if certificate
         Puppet.notice "Did not receive certificate"
       rescue StandardError => detail
         puts detail.backtrace if Puppet[:trace]
         Puppet.err "Could not request certificate: #{detail}"
       end
     end
   end
 
   def state
     my_cert = Puppet::SSL::Certificate.indirection.find(name)
     if certificate_request
       return 'requested'
     end
 
     begin
       Puppet::SSL::CertificateAuthority.new.verify(my_cert)
       return 'signed'
     rescue Puppet::SSL::CertificateAuthority::CertificateVerificationError
       return 'revoked'
     end
   end
 end
 
 require 'puppet/ssl/certificate_authority'