bolt 0.0.1 → 0.5.0

data/vendored/puppet/lib/puppet/module_tool/skeleton/templates/generator/metadata.json.erb

@@ -0,0 +1 @@
+<%= metadata.to_json %>

data/vendored/puppet/lib/puppet/module_tool/skeleton/templates/generator/spec/classes/init_spec.rb.erb

@@ -0,0 +1,6 @@
+require 'spec_helper'
+describe '<%= metadata.name %>' do
+  context 'with default values for all parameters' do
+    it { should contain_class('<%= metadata.name %>') }
+  end
+end

data/vendored/puppet/lib/puppet/module_tool/skeleton/templates/generator/spec/spec_helper.rb

@@ -0,0 +1 @@
+require 'puppetlabs_spec_helper/module_spec_helper'

data/vendored/puppet/lib/puppet/module_tool/tar.rb

@@ -0,0 +1,18 @@
+require 'puppet/module_tool'
+require 'puppet/util'
+
+module Puppet::ModuleTool::Tar
+  require 'puppet/module_tool/tar/gnu'
+  require 'puppet/module_tool/tar/mini'
+
+  def self.instance
+    if Puppet.features.minitar? && Puppet.features.zlib?
+      Mini.new
+    elsif Puppet::Util.which('tar') && ! Puppet::Util::Platform.windows?
+      Gnu.new
+    else
+      #TRANSLATORS "tar" is a program name and should not be translated
+      raise RuntimeError, _('No suitable tar implementation found')
+    end
+  end
+end

data/vendored/puppet/lib/puppet/module_tool/tar/gnu.rb

@@ -0,0 +1,19 @@
+require 'shellwords'
+
+class Puppet::ModuleTool::Tar::Gnu
+  def unpack(sourcefile, destdir, owner)
+    sourcefile = File.expand_path(sourcefile)
+    destdir = File.expand_path(destdir)
+
+    Dir.chdir(destdir) do
+      Puppet::Util::Execution.execute("gzip -dc #{Shellwords.shellescape(sourcefile)} | tar xof -")
+      Puppet::Util::Execution.execute("find . -type d -exec chmod 755 {} +")
+      Puppet::Util::Execution.execute("find . -type f -exec chmod u+rw,g+r,a-st {} +")
+      Puppet::Util::Execution.execute("chown -R #{owner} .")
+    end
+  end
+
+  def pack(sourcedir, destfile)
+    Puppet::Util::Execution.execute("tar cf - #{sourcedir} | gzip -c > #{File.basename(destfile)}")
+  end
+end

data/vendored/puppet/lib/puppet/module_tool/tar/mini.rb

@@ -0,0 +1,53 @@
+class Puppet::ModuleTool::Tar::Mini
+  def unpack(sourcefile, destdir, _)
+    Zlib::GzipReader.open(sourcefile) do |reader|
+      Archive::Tar::Minitar.unpack(reader, destdir, find_valid_files(reader)) do |action, name, stats|
+        case action
+        when :file_done
+          File.chmod(0644, "#{destdir}/#{name}")
+        when :dir, :file_start
+          validate_entry(destdir, name)
+          Puppet.debug("Extracting: #{destdir}/#{name}")
+        end
+      end
+    end
+  end
+
+  def pack(sourcedir, destfile)
+    Zlib::GzipWriter.open(destfile) do |writer|
+      Archive::Tar::Minitar.pack(sourcedir, writer)
+    end
+  end
+
+  private
+
+  # Find all the valid files in tarfile.
+  #
+  # This check was mainly added to ignore 'x' and 'g' flags from the PAX
+  # standard but will also ignore any other non-standard tar flags.
+  # tar format info: https://pic.dhe.ibm.com/infocenter/zos/v1r13/index.jsp?topic=%2Fcom.ibm.zos.r13.bpxa500%2Ftaf.htm
+  # pax format info: https://pic.dhe.ibm.com/infocenter/zos/v1r13/index.jsp?topic=%2Fcom.ibm.zos.r13.bpxa500%2Fpxarchfm.htm
+  def find_valid_files(tarfile)
+    Archive::Tar::Minitar.open(tarfile).collect do |entry|
+      flag = entry.typeflag
+      if flag.nil? || flag =~ /[[:digit:]]/ && (0..7).include?(flag.to_i)
+        entry.full_name
+      else
+        Puppet.debug "Invalid tar flag '#{flag}' will not be extracted: #{entry.name}"
+        next
+      end
+    end
+  end
+
+  def validate_entry(destdir, path)
+    if Pathname.new(path).absolute?
+      raise Puppet::ModuleTool::Errors::InvalidPathInPackageError, :entry_path => path, :directory => destdir
+    end
+
+    path = File.expand_path File.join(destdir, path)
+
+    if path !~ /\A#{Regexp.escape destdir}/
+      raise Puppet::ModuleTool::Errors::InvalidPathInPackageError, :entry_path => path, :directory => destdir
+    end
+  end
+end

data/vendored/puppet/lib/puppet/network.rb

@@ -0,0 +1,3 @@
+# Just a stub, so we can correctly scope other classes.
+module Puppet::Network # :nodoc:
+end

data/vendored/puppet/lib/puppet/network/auth_config_parser.rb

@@ -0,0 +1,85 @@
+require 'puppet/network/rights'
+
+module Puppet::Network
+class AuthConfigParser
+
+  def self.new_from_file(file)
+    self.new(Puppet::FileSystem.read(file, :encoding => 'utf-8'))
+  end
+
+  def initialize(string)
+    @string = string
+  end
+
+  def parse
+    Puppet::Network::AuthConfig.new(parse_rights)
+  end
+
+  def parse_rights
+    rights = Puppet::Network::Rights.new
+    right = nil
+    count = 1
+    @string.each_line { |line|
+      case line.chomp
+      when /^\s*#/, /^\s*$/
+        # skip comments and blank lines
+      when /^path\s+((?:~\s+)?[^ ]+)\s*$/ # "path /path" or "path ~ regex"
+        name = $1.chomp
+        right = rights.newright(name, count, @file)
+      when /^\s*(allow(?:_ip)?|deny(?:_ip)?|method|environment|auth(?:enticated)?)\s+(.+?)(\s*#.*)?$/
+        if right.nil?
+          #TRANSLATORS "path" is a configuration file entry and should not be translated
+          raise Puppet::ConfigurationError, _("Missing or invalid 'path' before right directive at line %{count} of %{file}") % { count: count, file: @file }
+        end
+        parse_right_directive(right, $1, $2, count)
+      else
+        raise Puppet::ConfigurationError, _("Invalid line %{count}: %{line}") % { count: count, line: line }
+      end
+      count += 1
+    }
+
+    # Verify each of the rights are valid.
+    # We let the check raise an error, so that it can raise an error
+    # pointing to the specific problem.
+    rights.each { |name, r|
+      r.valid?
+    }
+    rights
+  end
+
+  def parse_right_directive(right, var, value, count)
+    value.strip!
+    case var
+    when "allow"
+      modify_right(right, :allow, value, _("allowing %s access"), count)
+    when "deny"
+      modify_right(right, :deny, value, _("denying %s access"), count)
+    when "allow_ip"
+      modify_right(right, :allow_ip, value, _("allowing IP %s access"), count)
+    when "deny_ip"
+      modify_right(right, :deny_ip, value, _("denying IP %s access"), count)
+    when "method"
+      modify_right(right, :restrict_method, value, _("allowing 'method' %s"), count)
+    when "environment"
+      modify_right(right, :restrict_environment, value, _("adding environment %s"), count)
+    when /auth(?:enticated)?/
+      modify_right(right, :restrict_authenticated, value, _("adding authentication %s"), count)
+    else
+      raise Puppet::ConfigurationError,
+        _("Invalid argument '%{var}' at line %{count}") % { var: var, count: count }
+    end
+  end
+
+  def modify_right(right, method, value, msg, count)
+    value.split(/\s*,\s*/).each do |val|
+      begin
+        val.strip!
+        right.info msg % val
+        right.send(method, val)
+      rescue Puppet::AuthStoreError => detail
+        raise Puppet::ConfigurationError, _("%{detail} at line %{count} of %{file}") % { detail: detail, count: count, file: @file }, detail.backtrace
+      end
+    end
+  end
+end
+end

data/vendored/puppet/lib/puppet/network/authconfig.rb

@@ -0,0 +1,112 @@
+require 'puppet/network/rights'
+require 'puppet/network/http'
+
+module Puppet
+  class ConfigurationError < Puppet::Error; end
+  class Network::DefaultAuthProvider
+    attr_accessor :rights
+
+    def self.master_url_prefix
+      Puppet::Network::HTTP::MASTER_URL_PREFIX
+    end
+
+    def self.ca_url_prefix
+      Puppet::Network::HTTP::CA_URL_PREFIX
+    end
+
+    def self.default_acl
+      [
+      # Master API V3
+      { :acl => "#{master_url_prefix}/v3/environments", :method => :find, :allow => '*', :authenticated => true },
+
+      { :acl => "~ ^#{master_url_prefix}\/v3\/catalog\/([^\/]+)$", :method => :find, :allow => '$1', :authenticated => true },
+      { :acl => "~ ^#{master_url_prefix}\/v3\/node\/([^\/]+)$", :method => :find, :allow => '$1', :authenticated => true },
+      { :acl => "~ ^#{master_url_prefix}\/v3\/report\/([^\/]+)$", :method => :save, :allow => '$1', :authenticated => true },
+
+      # this one will allow all file access, and thus delegate
+      # to fileserver.conf
+      { :acl => "#{master_url_prefix}/v3/file" },
+
+      { :acl => "#{master_url_prefix}/v3/status", :method => [:find], :authenticated => true },
+
+      # CA API V1
+      { :acl => "#{ca_url_prefix}/v1/certificate_revocation_list/ca", :method => :find, :authenticated => true },
+
+      # These allow `auth any`, because if you can do them anonymously you
+      # should probably also be able to do them when trusted.
+      { :acl => "#{ca_url_prefix}/v1/certificate/ca", :method => :find, :authenticated => :any },
+      { :acl => "#{ca_url_prefix}/v1/certificate/", :method => :find, :authenticated => :any },
+      { :acl => "#{ca_url_prefix}/v1/certificate_request", :method => [:find, :save], :authenticated => :any },
+      ]
+      end
+
+    # Just proxy the setting methods to our rights stuff
+    [:allow, :deny].each do |method|
+      define_method(method) do |*args|
+        @rights.send(method, *args)
+      end
+    end
+
+    # force regular ACLs to be present
+    def insert_default_acl
+      self.class.default_acl.each do |acl|
+        unless rights[acl[:acl]]
+          Puppet.info _("Inserting default '%{acl}' (auth %{auth}) ACL") % { acl: acl[:acl], auth: acl[:authenticated] }
+          mk_acl(acl)
+        end
+      end
+      # queue an empty (ie deny all) right for every other path
+      # actually this is not strictly necessary as the rights system
+      # denies not explicitly allowed paths
+      unless rights["/"]
+        rights.newright("/").restrict_authenticated(:any)
+      end
+    end
+
+    def mk_acl(acl)
+      right = @rights.newright(acl[:acl])
+      right.allow(acl[:allow] || "*")
+
+      if method = acl[:method]
+        method = [method] unless method.is_a?(Array)
+        method.each { |m| right.restrict_method(m) }
+      end
+      right.restrict_authenticated(acl[:authenticated]) unless acl[:authenticated].nil?
+    end
+
+    # check whether this request is allowed in our ACL
+    # raise an Puppet::Network::AuthorizedError if the request
+    # is denied.
+    def check_authorization(method, path, params)
+      if authorization_failure_exception = @rights.is_request_forbidden_and_why?(method, path, params)
+        Puppet.warning(_("Denying access: %{authorization_failure_exception}") % { authorization_failure_exception: authorization_failure_exception })
+        raise authorization_failure_exception
+      end
+    end
+
+    def initialize(rights=nil)
+      @rights = rights || Puppet::Network::Rights.new
+      insert_default_acl
+    end
+  end
+
+  class Network::AuthConfig
+    @@authprovider_class = nil
+
+    def self.authprovider_class=(klass)
+      @@authprovider_class = klass
+    end
+
+    def self.authprovider_class
+      @@authprovider_class || Puppet::Network::DefaultAuthProvider
+    end
+
+    def initialize(rights=nil)
+      @authprovider = self.class.authprovider_class.new(rights)
+    end
+
+    def check_authorization(method, path, params)
+      @authprovider.check_authorization(method, path, params)
+    end
+  end
+end

data/vendored/puppet/lib/puppet/network/authorization.rb

@@ -0,0 +1,41 @@
+require 'puppet/network/client_request'
+require 'puppet/network/authconfig'
+require 'puppet/network/auth_config_parser'
+
+module Puppet::Network
+  class AuthConfigLoader
+    # Create our config object if necessary. If there's no configuration file
+    # we install our defaults
+    def self.authconfig
+      @auth_config_file ||= Puppet::Util::WatchedFile.new(Puppet[:rest_authconfig])
+      if (not @auth_config) or @auth_config_file.changed?
+        begin
+          @auth_config = Puppet::Network::AuthConfigParser.new_from_file(Puppet[:rest_authconfig]).parse
+        rescue Errno::ENOENT, Errno::ENOTDIR
+          @auth_config = Puppet::Network::AuthConfig.new
+        end
+      end
+
+      @auth_config
+    end
+  end
+
+  module Authorization
+    @@authconfigloader_class = nil
+
+    def self.authconfigloader_class=(klass)
+      @@authconfigloader_class = klass
+    end
+
+    def authconfig
+      authconfigloader = @@authconfigloader_class || AuthConfigLoader
+      authconfigloader.authconfig
+    end
+
+    # Verify that our client has access.
+    def check_authorization(method, path, params)
+      authconfig.check_authorization(method, path, params)
+    end
+  end
+end
+

data/vendored/puppet/lib/puppet/network/authstore.rb

@@ -0,0 +1,282 @@
+# standard module for determining whether a given hostname or IP has access to
+# the requested resource
+
+require 'ipaddr'
+require 'puppet/util/logging'
+
+module Puppet
+  class AuthStoreError < Puppet::Error; end
+  class AuthorizationError < Puppet::Error; end
+
+  class Network::AuthStore
+    include Puppet::Util::Logging
+
+    # Is a given combination of name and ip address allowed?  If either input
+    # is non-nil, then both inputs must be provided.  If neither input
+    # is provided, then the authstore is considered local and defaults to "true".
+    def allowed?(name, ip)
+      if name or ip
+        # This is probably unnecessary, and can cause some weirdnesses in
+        # cases where we're operating over localhost but don't have a real
+        # IP defined.
+        raise Puppet::DevError, "Name and IP must be passed to 'allowed?'" unless name and ip
+        # else, we're networked and such
+      else
+        # we're local
+        return true
+      end
+
+      # yay insecure overrides
+      return true if globalallow?
+
+      if decl = declarations.find { |d| d.match?(name, ip) }
+        return decl.result
+      end
+
+      info _("defaulting to no access for %{name}") % { name: name }
+      false
+    end
+
+    # Mark a given pattern as allowed.
+    def allow(pattern)
+      # a simple way to allow anyone at all to connect
+      if pattern == "*"
+        @globalallow = true
+      else
+        store(:allow, pattern)
+      end
+
+      nil
+    end
+
+    def allow_ip(pattern)
+      store(:allow_ip, pattern)
+    end
+
+    # Deny a given pattern.
+    def deny(pattern)
+      store(:deny, pattern)
+    end
+
+    def deny_ip(pattern)
+      store(:deny_ip, pattern)
+    end
+
+    # Is global allow enabled?
+    def globalallow?
+      @globalallow
+    end
+
+    # does this auth store has any rules?
+    def empty?
+      @globalallow.nil? && @declarations.size == 0
+    end
+
+    def initialize
+      @globalallow = nil
+      @declarations = []
+    end
+
+    def to_s
+      "authstore"
+    end
+
+    def interpolate(match)
+      @modified_declarations = @declarations.collect { |ace| ace.interpolate(match) }.sort
+    end
+
+    def reset_interpolation
+      @modified_declarations = nil
+    end
+
+    private
+
+    # Returns our ACEs list, but if we have a modification of it, let's return
+    # it. This is used if we want to override the this purely immutable list
+    # by a modified version.
+    def declarations
+      @modified_declarations || @declarations
+    end
+
+    # Store the results of a pattern into our hash.  Basically just
+    # converts the pattern and sticks it into the hash.
+    def store(type, pattern)
+      @declarations << Declaration.new(type, pattern)
+      @declarations.sort!
+
+      nil
+    end
+
+    # A single declaration.  Stores the info for a given declaration,
+    # provides the methods for determining whether a declaration matches,
+    # and handles sorting the declarations appropriately.
+    class Declaration
+      include Puppet::Util
+      include Comparable
+
+      # The type of declaration: either :allow or :deny
+      attr_reader :type
+      VALID_TYPES = [ :allow, :deny, :allow_ip, :deny_ip ]
+
+      attr_accessor :name
+
+      # The pattern we're matching against.  Can be an IPAddr instance,
+      # or an array of strings, resulting from reversing a hostname
+      # or domain name.
+      attr_reader :pattern
+
+      # The length.  Only used for iprange and domain.
+      attr_accessor :length
+
+      # Sort the declarations most specific first.
+      def <=>(other)
+        compare(exact?, other.exact?) ||
+        compare(ip?, other.ip?)  ||
+        ((length != other.length) &&  (other.length <=> length)) ||
+        compare(deny?, other.deny?) ||
+        ( ip? ? pattern.to_s <=> other.pattern.to_s : pattern <=> other.pattern)
+      end
+
+      def deny?
+        type == :deny
+      end
+
+      def exact?
+        @exact == :exact
+      end
+
+      def initialize(type, pattern)
+        self.type = type
+        self.pattern = pattern
+      end
+
+      # Are we an IP type?
+      def ip?
+        name == :ip
+      end
+
+      # Does this declaration match the name/ip combo?
+      def match?(name, ip)
+        if ip?
+          pattern.include?(IPAddr.new(ip))
+        else
+          matchname?(name)
+        end
+      end
+
+      # Set the pattern appropriately.  Also sets the name and length.
+      def pattern=(pattern)
+        if [:allow_ip, :deny_ip].include?(self.type)
+          parse_ip(pattern)
+        else
+          parse(pattern)
+        end
+        @orig = pattern
+      end
+
+      # Mapping a type of statement into a return value.
+      def result
+        [:allow, :allow_ip].include?(type)
+      end
+
+      def to_s
+        "#{type}: #{pattern}"
+      end
+
+      # Set the declaration type.  Either :allow or :deny.
+      def type=(type)
+        type = type.intern
+        raise ArgumentError, "Invalid declaration type #{type}" unless VALID_TYPES.include?(type)
+        @type = type
+      end
+
+      # interpolate a pattern to replace any
+      # backreferences by the given match
+      # for instance if our pattern is $1.reductivelabs.com
+      # and we're called with a MatchData whose capture 1 is puppet
+      # we'll return a pattern of puppet.reductivelabs.com
+      def interpolate(match)
+        clone = dup
+        if @name == :dynamic
+          clone.pattern = clone.pattern.reverse.collect do |p|
+            p.gsub(/\$(\d)/) { |m| match[$1.to_i] }
+          end.join(".")
+        end
+        clone
+      end
+
+      private
+
+      # Returns nil if both values are true or both are false, returns
+      # -1 if the first is true, and 1 if the second is true.  Used
+      # in the <=> operator.
+      def compare(me, them)
+        (me and them) ? nil : me ? -1 : them ? 1 : nil
+      end
+
+      # Does the name match our pattern?
+      def matchname?(name)
+        case @name
+          when :domain, :dynamic, :opaque
+            name = munge_name(name)
+            (pattern == name) or (not exact? and pattern.zip(name).all? { |p,n| p == n })
+          when :regex
+            Regexp.new(pattern.slice(1..-2)).match(name)
+        end
+      end
+
+      # Convert the name to a common pattern.
+      def munge_name(name)
+        # Change to name.downcase.split(".",-1).reverse for FQDN support
+        name.downcase.split(".").reverse
+      end
+
+      # Parse our input pattern and figure out what kind of allowable
+      # statement it is.  The output of this is used for later matching.
+      Octet = '(\d|[1-9]\d|1\d\d|2[0-4]\d|25[0-5])'
+      IPv4 = "#{Octet}\.#{Octet}\.#{Octet}\.#{Octet}"
+      IPv6_full    = "_:_:_:_:_:_:_:_|_:_:_:_:_:_::_?|_:_:_:_:_::((_:)?_)?|_:_:_:_::((_:){0,2}_)?|_:_:_::((_:){0,3}_)?|_:_::((_:){0,4}_)?|_::((_:){0,5}_)?|::((_:){0,6}_)?"
+      IPv6_partial = "_:_:_:_:_:_:|_:_:_:_::(_:)?|_:_::(_:){0,2}|_::(_:){0,3}"
+      # It should be:
+      #     IP = "#{IPv4}|#{IPv6_full}|(#{IPv6_partial}#{IPv4})".gsub(/_/,'([0-9a-fA-F]{1,4})').gsub(/\(/,'(?:')
+      # but ruby's ipaddr lib doesn't support the hybrid format
+      IP = "#{IPv4}|#{IPv6_full}".gsub(/_/,'([0-9a-fA-F]{1,4})').gsub(/\(/,'(?:')
+
+      def parse_ip(value)
+        @name = :ip
+        @exact, @length, @pattern = *case value
+        when /^(?:#{IP})\/(\d+)$/                                 # 12.34.56.78/24, a001:b002::efff/120, c444:1000:2000::9:192.168.0.1/112
+          [:inexact, $1.to_i, IPAddr.new(value)]
+        when /^(#{IP})$/                                          # 10.20.30.40,
+          [:exact, nil, IPAddr.new(value)]
+        when /^(#{Octet}\.){1,3}\*$/                              # an ip address with a '*' at the end
+          segments = value.split(".")[0..-2]
+          bits = 8*segments.length
+          [:inexact, bits, IPAddr.new((segments+[0,0,0])[0,4].join(".") + "/#{bits}")]
+        else
+          raise AuthStoreError, _("Invalid IP pattern %{value}") % { value: value }
+        end
+      end
+
+      def parse(value)
+        @name,@exact,@length,@pattern = *case value
+        when /^(\w[-\w]*\.)+[-\w]+$/                              # a full hostname
+          # Change to /^(\w[-\w]*\.)+[-\w]+\.?$/ for FQDN support
+          [:domain,:exact,nil,munge_name(value)]
+        when /^\*(\.(\w[-\w]*)){1,}$/                             # *.domain.com
+          host_sans_star = munge_name(value)[0..-2]
+          [:domain,:inexact,host_sans_star.length,host_sans_star]
+        when /\$\d+/                                              # a backreference pattern ala $1.reductivelabs.com or 192.168.0.$1 or $1.$2
+          [:dynamic,:exact,nil,munge_name(value)]
+        when /^\w[-.@\w]*$/                                       # ? Just like a host name but allow '@'s and ending '.'s
+          [:opaque,:exact,nil,[value]]
+        when /^\/.*\/$/                                           # a regular expression
+          [:regex,:inexact,nil,value]
+        else
+          raise AuthStoreError, "Invalid pattern #{value}"
+        end
+      end
+    end
+  end
+end
+