bolt 0.0.1 → 0.5.0

data/vendored/puppet/lib/puppet/network/http/webrick.rb

@@ -0,0 +1,125 @@
+require 'webrick'
+require 'webrick/https'
+require 'puppet/network/http/webrick/rest'
+require 'thread'
+
+require 'puppet/ssl/certificate'
+require 'puppet/ssl/certificate_revocation_list'
+require 'puppet/ssl/configuration'
+
+class Puppet::Network::HTTP::WEBrick
+  CIPHERS = "EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH:+CAMELLIA256:+AES256:+CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!IDEA:!ECDSA:kEDH:CAMELLIA256-SHA:AES256-SHA:CAMELLIA128-SHA:AES128-SHA"
+
+  def initialize
+    @listening = false
+  end
+
+  def listen(address, port)
+    @server = create_server(address, port)
+
+    @server.listeners.each { |l| l.start_immediately = false }
+
+    @server.mount('/', Puppet::Network::HTTP::WEBrickREST)
+
+    raise _("WEBrick server is already listening") if @listening
+    @listening = true
+    @thread = Thread.new do
+      @server.start do |sock|
+        timeout = 10.0
+        if ! IO.select([sock],nil,nil,timeout)
+          raise _("Client did not send data within %.1f seconds of connecting") % timeout
+        end
+        sock.accept
+        @server.run(sock)
+      end
+    end
+    sleep 0.1 until @server.status == :Running
+  end
+
+  def unlisten
+    raise _("WEBrick server is not listening") unless @listening
+    @server.shutdown
+    wait_for_shutdown
+    @server = nil
+    @listening = false
+  end
+
+  def listening?
+    @listening
+  end
+
+  def wait_for_shutdown
+    @thread.join
+  end
+
+  # @api private
+  def create_server(address, port)
+    arguments = {:BindAddress => address, :Port => port, :DoNotReverseLookup => true}
+    arguments.merge!(setup_logger)
+    arguments.merge!(setup_ssl)
+
+    BasicSocket.do_not_reverse_lookup = true
+
+    server = WEBrick::HTTPServer.new(arguments)
+    server.ssl_context.ciphers = CIPHERS
+    server
+  end
+
+  # Configure our http log file.
+  def setup_logger
+    # Make sure the settings are all ready for us.
+    Puppet.settings.use(:main, :ssl, :application)
+
+    file = Puppet[:masterhttplog]
+
+    # open the log manually to prevent file descriptor leak
+    # webrick logged strings may contain UTF-8
+    file_io = ::File.open(file, "a+:UTF-8")
+    file_io.sync = true
+    if defined?(Fcntl::FD_CLOEXEC)
+      file_io.fcntl(Fcntl::F_SETFD, Fcntl::FD_CLOEXEC)
+    end
+
+    args = [file_io]
+    args << WEBrick::Log::DEBUG if Puppet::Util::Log.level == :debug
+
+    logger = WEBrick::Log.new(*args)
+    return :Logger => logger, :AccessLog => [
+      [logger, WEBrick::AccessLog::COMMON_LOG_FORMAT ],
+      [logger, WEBrick::AccessLog::REFERER_LOG_FORMAT ]
+    ]
+  end
+
+  # Add all of the ssl cert information.
+  def setup_ssl
+    results = {}
+
+    # Get the cached copy.  We know it's been generated, too.
+    host = Puppet::SSL::Host.localhost
+
+    raise Puppet::Error, _("Could not retrieve certificate for %{host} and not running on a valid certificate authority") % { value0: host.name } unless host.certificate
+
+    results[:SSLPrivateKey] = host.key.content
+    results[:SSLCertificate] = host.certificate.content
+    results[:SSLStartImmediately] = true
+    results[:SSLEnable] = true
+    results[:SSLOptions] = OpenSSL::SSL::OP_NO_SSLv2 | OpenSSL::SSL::OP_NO_SSLv3
+
+    raise Puppet::Error, _("Could not find CA certificate") unless Puppet::SSL::Certificate.indirection.find(Puppet::SSL::CA_NAME)
+
+    results[:SSLCACertificateFile] = ssl_configuration.ca_auth_file
+    results[:SSLVerifyClient] = OpenSSL::SSL::VERIFY_PEER
+
+    results[:SSLCertificateStore] = host.ssl_store
+
+    results
+  end
+
+  private
+
+  def ssl_configuration
+    @ssl_configuration ||= Puppet::SSL::Configuration.new(
+      Puppet[:localcacert],
+      :ca_auth_file  => Puppet[:ssl_server_ca_auth])
+  end
+end

data/vendored/puppet/lib/puppet/network/http/webrick/rest.rb

@@ -0,0 +1,114 @@
+require 'puppet/network/http/handler'
+require 'resolv'
+require 'webrick'
+require 'webrick/httputils'
+require 'puppet/util/ssl'
+
+class Puppet::Network::HTTP::WEBrickREST < WEBrick::HTTPServlet::AbstractServlet
+
+  include Puppet::Network::HTTP::Handler
+
+  def self.mutex
+    @mutex ||= Mutex.new
+  end
+
+  def initialize(server)
+    raise ArgumentError, _("server is required") unless server
+    register([Puppet::Network::HTTP::API.master_routes,
+              Puppet::Network::HTTP::API.ca_routes,
+              Puppet::Network::HTTP::API.not_found_upgrade])
+    super(server)
+  end
+
+  # Retrieve the request parameters, including authentication information.
+  def params(request)
+    query = request.query || {}
+    params =
+        if request.request_method == "PUT"
+          # webrick doesn't look at the query string for PUT requests, it only
+          # looks at the body, and then only if the body has a content type that
+          # looks like url-encoded form data.  We need the query string data as well.
+          WEBrick::HTTPUtils.parse_query(request.query_string).merge(query)
+        else
+          query
+        end
+
+    params = Hash[params.collect do |key, value|
+      all_values = value.list
+      [key, all_values.length == 1 ? value : all_values]
+    end]
+
+    params = decode_params(params)
+    params.merge(client_information(request))
+  end
+
+  # WEBrick uses a service method to respond to requests.  Simply delegate to
+  # the handler response method.
+  def service(request, response)
+    self.class.mutex.synchronize do
+      process(request, response)
+    end
+  end
+
+  def headers(request)
+    result = {}
+    request.each do |k, v|
+      result[k.downcase] = v
+    end
+    result
+  end
+
+  def http_method(request)
+    request.request_method
+  end
+
+  def path(request)
+    request.path
+  end
+
+  def body(request)
+    request.body
+  end
+
+  def client_cert(request)
+    if cert = request.client_cert
+      Puppet::SSL::Certificate.from_instance(cert)
+    else
+      nil
+    end
+  end
+
+  # Set the specified format as the content type of the response.
+  def set_content_type(response, format)
+    response["content-type"] = format
+  end
+
+  def set_response(response, result, status = 200)
+    response.status = status
+    if status >= 200 and status != 304
+      response.body = result
+      response["content-length"] = result.stat.size if result.is_a?(File)
+    end
+  end
+
+  # Retrieve node/cert/ip information from the request object.
+  def client_information(request)
+    result = {}
+    if peer = request.peeraddr and ip = peer[3]
+      result[:ip] = ip
+    end
+
+    # If they have a certificate (which will almost always be true)
+    # then we get the hostname from the cert, instead of via IP
+    # info
+    result[:authenticated] = false
+    if cert = request.client_cert and cn = Puppet::Util::SSL.cn_from_subject(cert.subject)
+      result[:node] = cn
+      result[:authenticated] = true
+    else
+      result[:node] = resolve_node(result)
+    end
+
+    result
+  end
+end

data/vendored/puppet/lib/puppet/network/http_pool.rb

@@ -0,0 +1,61 @@
+require 'puppet/network/http/connection'
+
+module Puppet::Network; end
+
+# This module contains the factory methods that should be used for getting a
+# {Puppet::Network::HTTP::Connection} instance. The pool may return a new
+# connection or a persistent cached connection, depending on the underlying
+# pool implementation in use.
+#
+# @api public
+#
+module Puppet::Network::HttpPool
+
+  @http_client_class = Puppet::Network::HTTP::Connection
+
+  def self.http_client_class
+    @http_client_class
+  end
+  def self.http_client_class=(klass)
+    @http_client_class = klass
+  end
+
+  # Retrieve a connection for the given host and port.
+  #
+  # @param host [String] The hostname to connect to
+  # @param port [Integer] The port on the host to connect to
+  # @param use_ssl [Boolean] Whether to use an SSL connection
+  # @param verify_peer [Boolean] Whether to verify the peer credentials, if possible. Verification will not take place if the CA certificate is missing.
+  # @return [Puppet::Network::HTTP::Connection]
+  #
+  # @api public
+  #
+  def self.http_instance(host, port, use_ssl = true, verify_peer = true)
+    verifier = if verify_peer
+                 Puppet::SSL::Validator.default_validator()
+               else
+                 Puppet::SSL::Validator.no_validator()
+               end
+
+    http_client_class.new(host, port,
+                            :use_ssl => use_ssl,
+                            :verify => verifier)
+  end
+
+  # Get an http connection that will be secured with SSL and have the
+  # connection verified with the given verifier
+  #
+  # @param host [String] the DNS name to connect to
+  # @param port [Integer] the port to connect to
+  # @param verifier [#setup_connection, #peer_certs, #verify_errors] An object that will setup the appropriate
+  #   verification on a Net::HTTP instance and report any errors and the certificates used.
+  # @return [Puppet::Network::HTTP::Connection]
+  #
+  # @api public
+  #
+  def self.http_ssl_instance(host, port, verifier = Puppet::SSL::Validator.default_validator())
+    http_client_class.new(host, port,
+                            :use_ssl => true,
+                            :verify => verifier)
+  end
+end

data/vendored/puppet/lib/puppet/network/resolver.rb

@@ -0,0 +1,86 @@
+require 'resolv'
+module Puppet::Network; end
+
+module Puppet::Network::Resolver
+  # Iterate through the list of servers that service this hostname
+  # and yield each server/port since SRV records have ports in them
+  # It will override whatever masterport setting is already set.
+  def self.each_srv_record(domain, service_name = :puppet, &block)
+    if (domain.nil? or domain.empty?)
+      Puppet.debug "Domain not known; skipping SRV lookup"
+      return
+    end
+
+    Puppet.debug "Searching for SRV records for domain: #{domain}"
+
+    case service_name
+      when :puppet then service = '_x-puppet'
+      when :ca     then service = '_x-puppet-ca'
+      when :report then service = '_x-puppet-report'
+      when :file   then service = '_x-puppet-fileserver'
+      else              service = "_x-puppet-#{service_name.to_s}"
+    end
+    srv_record = "#{service}._tcp.#{domain}"
+
+    resolver = Resolv::DNS.new
+    records = resolver.getresources(srv_record, Resolv::DNS::Resource::IN::SRV)
+    Puppet.debug "Found #{records.size} SRV records for: #{srv_record}"
+
+    if records.size == 0 && service_name != :puppet
+      # Try the generic :puppet service if no SRV records were found
+      # for the specific service.
+      each_srv_record(domain, :puppet, &block)
+    else
+      each_priority(records) do |priority, recs|
+        while next_rr = recs.delete(find_weighted_server(recs))
+          Puppet.debug "Yielding next server of #{next_rr.target.to_s}:#{next_rr.port}"
+          yield next_rr.target.to_s, next_rr.port
+        end
+      end
+    end
+  end
+
+  private
+
+  def self.each_priority(records)
+    pri_hash = records.inject({}) do |groups, element|
+      groups[element.priority] ||= []
+      groups[element.priority] << element
+      groups
+    end
+
+    pri_hash.keys.sort.each do |key|
+      yield key, pri_hash[key]
+    end
+  end
+
+  def self.find_weighted_server(records)
+    return nil if records.nil? || records.empty?
+    return records.first if records.size == 1
+
+    # Calculate the sum of all weights in the list of resource records,
+    # This is used to then select hosts until the weight exceeds what
+    # random number we selected.  For example, if we have weights of 1 8 and 3:
+    #
+    # |-|---|--------|
+    #        ^
+    # We generate a random number 5, and iterate through the records, adding
+    # the current record's weight to the accumulator until the weight of the
+    # current record plus previous records is greater than the random number.
+
+    total_weight = records.inject(0) { |sum,record|
+      sum + weight(record)
+    }
+    current_weight = 0
+    chosen_weight  = 1 + Kernel.rand(total_weight)
+
+    records.each do |record|
+      current_weight += weight(record)
+      return record if current_weight >= chosen_weight
+    end
+  end
+
+  def self.weight(record)
+    record.weight == 0 ? 1 : record.weight * 10
+  end
+end

data/vendored/puppet/lib/puppet/network/rest_controller.rb

@@ -0,0 +1,2 @@
+class Puppet::Network::RESTController # :nodoc:
+end

data/vendored/puppet/lib/puppet/network/rights.rb

@@ -0,0 +1,209 @@
+require 'puppet/network/authstore'
+require 'puppet/error'
+
+module Puppet::Network
+
+# this exception is thrown when a request is not authenticated
+class AuthorizationError < Puppet::Error; end
+
+# Rights class manages a list of ACLs for paths.
+class Rights
+  # Check that name is allowed or not
+  def allowed?(name, *args)
+    !is_forbidden_and_why?(name, :node => args[0], :ip => args[1])
+  end
+
+  def is_request_forbidden_and_why?(method, path, params)
+    methods_to_check = if method == :head
+                         # :head is ok if either :find or :save is ok.
+                         [:find, :save]
+                       else
+                         [method]
+                       end
+    authorization_failure_exceptions = methods_to_check.map do |m|
+      is_forbidden_and_why?(path, params.merge({:method => m}))
+    end
+    if authorization_failure_exceptions.include? nil
+      # One of the methods we checked is ok, therefore this request is ok.
+      nil
+    else
+      # Just need to return any of the failure exceptions.
+      authorization_failure_exceptions.first
+    end
+  end
+
+  def is_forbidden_and_why?(name, args = {})
+    res = :nomatch
+    right = @rights.find do |acl|
+      found = false
+      # an acl can return :dunno, which means "I'm not qualified to answer your question,
+      # please ask someone else". This is used when for instance an acl matches, but not for the
+      # current rest method, where we might think some other acl might be more specific.
+      if match = acl.match?(name)
+        args[:match] = match
+        if (res = acl.allowed?(args[:node], args[:ip], args)) != :dunno
+          # return early if we're allowed
+          return nil if res
+          # we matched, select this acl
+          found = true
+        end
+      end
+      found
+    end
+
+    # if we end up here, then that means we either didn't match or failed, in any
+    # case will return an error to the outside world
+    msg = "#{name} [#{args[:method]}]"
+
+    AuthorizationError.new(_("Forbidden request: %{msg}") % { msg: msg })
+  end
+
+  def initialize
+    @rights = []
+  end
+
+  def [](name)
+    @rights.find { |acl| acl == name }
+  end
+
+  def empty?
+    @rights.empty?
+  end
+
+  def include?(name)
+    @rights.include?(name)
+  end
+
+  def each
+    @rights.each { |r| yield r.name,r }
+  end
+
+  # Define a new right to which access can be provided.
+  def newright(name, line=nil, file=nil)
+    add_right( Right.new(name, line, file) )
+  end
+
+  private
+
+  def add_right(right)
+    @rights << right
+    right
+  end
+
+  # Retrieve a right by name.
+  def right(name)
+    self[name]
+  end
+
+  # A right.
+  class Right < Puppet::Network::AuthStore
+    attr_accessor :name, :key
+    # Overriding Object#methods sucks for debugging. If we're in here in the
+    # future, it would be nice to rename Right#methods
+    attr_accessor :methods, :environment, :authentication
+    attr_accessor :line, :file
+
+    ALL = [:save, :destroy, :find, :search]
+
+    Puppet::Util.logmethods(self, true)
+
+    def initialize(name, line, file)
+      @methods = []
+      @environment = []
+      @authentication = true # defaults to authenticated
+      @name = name
+      @line = line || 0
+      @file = file
+      @methods = ALL
+
+      case name
+      when /^\//
+        @key = Regexp.new("^" + Regexp.escape(name))
+      when /^~/ # this is a regex
+        @name = name.gsub(/^~\s+/,'')
+        @key = Regexp.new(@name)
+      else
+        raise ArgumentError, _("Unknown right type '%{name}'") % { name: name }
+      end
+
+      super()
+    end
+
+    def to_s
+      "access[#{@name}]"
+    end
+
+    # There's no real check to do at this point
+    def valid?
+      true
+    end
+
+    # does this right is allowed for this triplet?
+    # if this right is too restrictive (ie we don't match this access method)
+    # then return :dunno so that upper layers have a chance to try another right
+    # tailored to the given method
+    def allowed?(name, ip, args = {})
+      if not @methods.include?(args[:method])
+        return :dunno
+      elsif @environment.size > 0 and not @environment.include?(args[:environment])
+        return :dunno
+      elsif (@authentication and not args[:authenticated])
+        return :dunno
+      end
+
+      begin
+        # make sure any capture are replaced if needed
+        interpolate(args[:match]) if args[:match]
+        res = super(name,ip)
+      ensure
+        reset_interpolation
+      end
+      res
+    end
+
+    # restrict this right to some method only
+    def restrict_method(m)
+      m = m.intern if m.is_a?(String)
+
+      raise ArgumentError, _("'%{m}' is not an allowed value for method directive") % { m: m } unless ALL.include?(m)
+
+      # if we were allowing all methods, then starts from scratch
+      if @methods === ALL
+        @methods = []
+      end
+
+      raise ArgumentError, _("'%{m}' is already in the '%{name}' ACL") % { m: m, name: name } if @methods.include?(m)
+
+      @methods << m
+    end
+
+    def restrict_environment(environment)
+      env = Puppet.lookup(:environments).get(environment)
+      raise ArgumentError, _("'%{env}' is already in the '%{name}' ACL") % { env: env, name: name } if @environment.include?(env)
+
+      @environment << env
+    end
+
+    def restrict_authenticated(authentication)
+      case authentication
+      when "yes", "on", "true", true
+        authentication = true
+      when "no", "off", "false", false, "all" ,"any", :all, :any
+        authentication = false
+      else
+        raise ArgumentError, _("'%{name}' incorrect authenticated value: %{authentication}") % { name: name, authentication: authentication }
+      end
+      @authentication = authentication
+    end
+
+    def match?(key)
+      # otherwise match with the regex
+      self.key.match(key)
+    end
+
+    def ==(name)
+      self.name == name.gsub(/^~\s+/,'')
+    end
+  end
+end
+end