bolt 0.19.1 → 0.20.0

data/vendored/puppet/lib/puppet/network/http/webrick.rb

@@ -1,124 +0,0 @@
-require 'webrick'
-require 'webrick/https'
-require 'puppet/network/http/webrick/rest'
-require 'thread'
-
-require 'puppet/ssl/certificate'
-require 'puppet/ssl/certificate_revocation_list'
-require 'puppet/ssl/configuration'
-
-class Puppet::Network::HTTP::WEBrick
-  CIPHERS = "EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH:+CAMELLIA256:+AES256:+CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!IDEA:!ECDSA:kEDH:CAMELLIA256-SHA:AES256-SHA:CAMELLIA128-SHA:AES128-SHA"
-
-  def initialize
-    @listening = false
-  end
-
-  def listen(address, port)
-    @server = create_server(address, port)
-
-    @server.mount('/', Puppet::Network::HTTP::WEBrickREST)
-
-    raise _("WEBrick server is already listening") if @listening
-    @listening = true
-    @thread = Thread.new do
-      @server.start do |sock|
-        timeout = 10.0
-        if ! IO.select([sock],nil,nil,timeout)
-          raise _("Client did not send data within %{timeout} seconds of connecting") % { timeout: ("%.1f") % timeout }
-        end
-        sock.accept
-        @server.run(sock)
-      end
-    end
-    sleep 0.1 until @server.status == :Running
-  end
-
-  def unlisten
-    raise _("WEBrick server is not listening") unless @listening
-    @server.shutdown
-    wait_for_shutdown
-    @server = nil
-    @listening = false
-  end
-
-  def listening?
-    @listening
-  end
-
-  def wait_for_shutdown
-    @thread.join
-  end
-
-  # @api private
-  def create_server(address, port)
-    address = nil if address == '*'
-    arguments = {:BindAddress => address, :Port => port, :DoNotReverseLookup => true}
-    arguments.merge!(setup_logger)
-    arguments.merge!(setup_ssl)
-
-    BasicSocket.do_not_reverse_lookup = true
-
-    server = WEBrick::HTTPServer.new(arguments)
-    server.ssl_context.ciphers = CIPHERS
-    server
-  end
-
-  # Configure our http log file.
-  def setup_logger
-    # Make sure the settings are all ready for us.
-    Puppet.settings.use(:main, :ssl, :application)
-
-    file = Puppet[:masterhttplog]
-
-    # open the log manually to prevent file descriptor leak
-    # webrick logged strings may contain UTF-8
-    file_io = ::File.open(file, "a+:UTF-8")
-    file_io.sync = true
-    if defined?(Fcntl::FD_CLOEXEC)
-      file_io.fcntl(Fcntl::F_SETFD, Fcntl::FD_CLOEXEC)
-    end
-
-    args = [file_io]
-    args << WEBrick::Log::DEBUG if Puppet::Util::Log.level == :debug
-
-    logger = WEBrick::Log.new(*args)
-    return :Logger => logger, :AccessLog => [
-      [logger, WEBrick::AccessLog::COMMON_LOG_FORMAT ],
-      [logger, WEBrick::AccessLog::REFERER_LOG_FORMAT ]
-    ]
-  end
-
-  # Add all of the ssl cert information.
-  def setup_ssl
-    results = {}
-
-    # Get the cached copy.  We know it's been generated, too.
-    host = Puppet::SSL::Host.localhost
-
-    raise Puppet::Error, _("Could not retrieve certificate for %{host} and not running on a valid certificate authority") % { value0: host.name } unless host.certificate
-
-    results[:SSLPrivateKey] = host.key.content
-    results[:SSLCertificate] = host.certificate.content
-    results[:SSLStartImmediately] = false
-    results[:SSLEnable] = true
-    results[:SSLOptions] = OpenSSL::SSL::OP_NO_SSLv2 | OpenSSL::SSL::OP_NO_SSLv3
-
-    raise Puppet::Error, _("Could not find CA certificate") unless Puppet::SSL::Certificate.indirection.find(Puppet::SSL::CA_NAME)
-
-    results[:SSLCACertificateFile] = ssl_configuration.ca_auth_file
-    results[:SSLVerifyClient] = OpenSSL::SSL::VERIFY_PEER
-
-    results[:SSLCertificateStore] = host.ssl_store
-
-    results
-  end
-
-  private
-
-  def ssl_configuration
-    @ssl_configuration ||= Puppet::SSL::Configuration.new(
-      Puppet[:localcacert],
-      :ca_auth_file  => Puppet[:ssl_server_ca_auth])
-  end
-end

data/vendored/puppet/lib/puppet/network/http/webrick/rest.rb

@@ -1,114 +0,0 @@
-require 'puppet/network/http/handler'
-require 'resolv'
-require 'webrick'
-require 'webrick/httputils'
-require 'puppet/util/ssl'
-
-class Puppet::Network::HTTP::WEBrickREST < WEBrick::HTTPServlet::AbstractServlet
-
-  include Puppet::Network::HTTP::Handler
-
-  def self.mutex
-    @mutex ||= Mutex.new
-  end
-
-  def initialize(server)
-    raise ArgumentError, _("server is required") unless server
-    register([Puppet::Network::HTTP::API.master_routes,
-              Puppet::Network::HTTP::API.ca_routes,
-              Puppet::Network::HTTP::API.not_found_upgrade])
-    super(server)
-  end
-
-  # Retrieve the request parameters, including authentication information.
-  def params(request)
-    query = request.query || {}
-    params =
-        if request.request_method == "PUT"
-          # webrick doesn't look at the query string for PUT requests, it only
-          # looks at the body, and then only if the body has a content type that
-          # looks like url-encoded form data.  We need the query string data as well.
-          WEBrick::HTTPUtils.parse_query(request.query_string).merge(query)
-        else
-          query
-        end
-
-    params = Hash[params.collect do |key, value|
-      all_values = value.list
-      [key, all_values.length == 1 ? value : all_values]
-    end]
-
-    params = decode_params(params)
-    params.merge(client_information(request))
-  end
-
-  # WEBrick uses a service method to respond to requests.  Simply delegate to
-  # the handler response method.
-  def service(request, response)
-    self.class.mutex.synchronize do
-      process(request, response)
-    end
-  end
-
-  def headers(request)
-    result = {}
-    request.each do |k, v|
-      result[k.downcase] = v
-    end
-    result
-  end
-
-  def http_method(request)
-    request.request_method
-  end
-
-  def path(request)
-    request.path
-  end
-
-  def body(request)
-    request.body
-  end
-
-  def client_cert(request)
-    if cert = request.client_cert
-      Puppet::SSL::Certificate.from_instance(cert)
-    else
-      nil
-    end
-  end
-
-  # Set the specified format as the content type of the response.
-  def set_content_type(response, format)
-    response["content-type"] = format
-  end
-
-  def set_response(response, result, status = 200)
-    response.status = status
-    if status >= 200 and status != 304
-      response.body = result
-      response["content-length"] = result.stat.size if result.is_a?(File)
-    end
-  end
-
-  # Retrieve node/cert/ip information from the request object.
-  def client_information(request)
-    result = {}
-    if peer = request.peeraddr and ip = peer[3]
-      result[:ip] = ip
-    end
-
-    # If they have a certificate (which will almost always be true)
-    # then we get the hostname from the cert, instead of via IP
-    # info
-    result[:authenticated] = false
-    if cert = request.client_cert and cn = Puppet::Util::SSL.cn_from_subject(cert.subject)
-      result[:node] = cn
-      result[:authenticated] = true
-    else
-      result[:node] = resolve_node(result)
-    end
-
-    result
-  end
-end

data/vendored/puppet/lib/puppet/network/http_pool.rb

@@ -1,61 +0,0 @@
-require 'puppet/network/http/connection'
-
-module Puppet::Network; end
-
-# This module contains the factory methods that should be used for getting a
-# {Puppet::Network::HTTP::Connection} instance. The pool may return a new
-# connection or a persistent cached connection, depending on the underlying
-# pool implementation in use.
-#
-# @api public
-#
-module Puppet::Network::HttpPool
-
-  @http_client_class = Puppet::Network::HTTP::Connection
-
-  def self.http_client_class
-    @http_client_class
-  end
-  def self.http_client_class=(klass)
-    @http_client_class = klass
-  end
-
-  # Retrieve a connection for the given host and port.
-  #
-  # @param host [String] The hostname to connect to
-  # @param port [Integer] The port on the host to connect to
-  # @param use_ssl [Boolean] Whether to use an SSL connection
-  # @param verify_peer [Boolean] Whether to verify the peer credentials, if possible. Verification will not take place if the CA certificate is missing.
-  # @return [Puppet::Network::HTTP::Connection]
-  #
-  # @api public
-  #
-  def self.http_instance(host, port, use_ssl = true, verify_peer = true)
-    verifier = if verify_peer
-                 Puppet::SSL::Validator.default_validator()
-               else
-                 Puppet::SSL::Validator.no_validator()
-               end
-
-    http_client_class.new(host, port,
-                            :use_ssl => use_ssl,
-                            :verify => verifier)
-  end
-
-  # Get an http connection that will be secured with SSL and have the
-  # connection verified with the given verifier
-  #
-  # @param host [String] the DNS name to connect to
-  # @param port [Integer] the port to connect to
-  # @param verifier [#setup_connection, #peer_certs, #verify_errors] An object that will setup the appropriate
-  #   verification on a Net::HTTP instance and report any errors and the certificates used.
-  # @return [Puppet::Network::HTTP::Connection]
-  #
-  # @api public
-  #
-  def self.http_ssl_instance(host, port, verifier = Puppet::SSL::Validator.default_validator())
-    http_client_class.new(host, port,
-                            :use_ssl => true,
-                            :verify => verifier)
-  end
-end

data/vendored/puppet/lib/puppet/network/resolver.rb

@@ -1,85 +0,0 @@
-require 'resolv'
-module Puppet::Network; end
-
-module Puppet::Network::Resolver
-  # Iterate through the list of servers that service this hostname
-  # and yield each server/port since SRV records have ports in them
-  # It will override whatever masterport setting is already set.
-  def self.each_srv_record(domain, service_name = :puppet, &block)
-    if (domain.nil? or domain.empty?)
-      Puppet.debug "Domain not known; skipping SRV lookup"
-      return
-    end
-
-    Puppet.debug "Searching for SRV records for domain: #{domain}"
-
-    case service_name
-      when :puppet then service = '_x-puppet'
-      when :ca     then service = '_x-puppet-ca'
-      when :report then service = '_x-puppet-report'
-      when :file   then service = '_x-puppet-fileserver'
-      else              service = "_x-puppet-#{service_name.to_s}"
-    end
-    srv_record = "#{service}._tcp.#{domain}"
-
-    resolver = Resolv::DNS.new
-    records = resolver.getresources(srv_record, Resolv::DNS::Resource::IN::SRV)
-    Puppet.debug "Found #{records.size} SRV records for: #{srv_record}"
-
-    if records.size == 0 && service_name != :puppet
-      # Try the generic :puppet service if no SRV records were found
-      # for the specific service.
-      each_srv_record(domain, :puppet, &block)
-    else
-      each_priority(records) do |priority, recs|
-        while next_rr = recs.delete(find_weighted_server(recs))
-          Puppet.debug "Yielding next server of #{next_rr.target.to_s}:#{next_rr.port}"
-          yield next_rr.target.to_s, next_rr.port
-        end
-      end
-    end
-  end
-
-  def self.each_priority(records)
-    pri_hash = records.inject({}) do |groups, element|
-      groups[element.priority] ||= []
-      groups[element.priority] << element
-      groups
-    end
-
-    pri_hash.keys.sort.each do |key|
-      yield key, pri_hash[key]
-    end
-  end
-  private_class_method :each_priority
-
-  def self.find_weighted_server(records)
-    return nil if records.nil? || records.empty?
-    return records.first if records.size == 1
-
-    # Calculate the sum of all weights in the list of resource records,
-    # This is used to then select hosts until the weight exceeds what
-    # random number we selected.  For example, if we have weights of 1 8 and 3:
-    #
-    # |-|---|--------|
-    #        ^
-    # We generate a random number 5, and iterate through the records, adding
-    # the current record's weight to the accumulator until the weight of the
-    # current record plus previous records is greater than the random number.
-
-    total_weight = records.inject(0) { |sum,record|
-      sum + weight(record)
-    }
-    current_weight = 0
-    chosen_weight  = 1 + Kernel.rand(total_weight)
-
-    records.each do |record|
-      current_weight += weight(record)
-      return record if current_weight >= chosen_weight
-    end
-  end
-
-  def self.weight(record)
-    record.weight == 0 ? 1 : record.weight * 10
-  end
-end

data/vendored/puppet/lib/puppet/network/rest_controller.rb

@@ -1,2 +0,0 @@
-class Puppet::Network::RESTController # :nodoc:
-end

data/vendored/puppet/lib/puppet/network/rights.rb

@@ -1,209 +0,0 @@
-require 'puppet/network/authstore'
-require 'puppet/error'
-
-module Puppet::Network
-
-# this exception is thrown when a request is not authenticated
-class AuthorizationError < Puppet::Error; end
-
-# Rights class manages a list of ACLs for paths.
-class Rights
-  # Check that name is allowed or not
-  def allowed?(name, *args)
-    !is_forbidden_and_why?(name, :node => args[0], :ip => args[1])
-  end
-
-  def is_request_forbidden_and_why?(method, path, params)
-    methods_to_check = if method == :head
-                         # :head is ok if either :find or :save is ok.
-                         [:find, :save]
-                       else
-                         [method]
-                       end
-    authorization_failure_exceptions = methods_to_check.map do |m|
-      is_forbidden_and_why?(path, params.merge({:method => m}))
-    end
-    if authorization_failure_exceptions.include? nil
-      # One of the methods we checked is ok, therefore this request is ok.
-      nil
-    else
-      # Just need to return any of the failure exceptions.
-      authorization_failure_exceptions.first
-    end
-  end
-
-  def is_forbidden_and_why?(name, args = {})
-    res = :nomatch
-    @rights.find do |acl|
-      found = false
-      # an acl can return :dunno, which means "I'm not qualified to answer your question,
-      # please ask someone else". This is used when for instance an acl matches, but not for the
-      # current rest method, where we might think some other acl might be more specific.
-      if match = acl.match?(name)
-        args[:match] = match
-        if (res = acl.allowed?(args[:node], args[:ip], args)) != :dunno
-          # return early if we're allowed
-          return nil if res
-          # we matched, select this acl
-          found = true
-        end
-      end
-      found
-    end
-
-    # if we end up here, then that means we either didn't match or failed, in any
-    # case will return an error to the outside world
-    msg = "#{name} [#{args[:method]}]"
-
-    AuthorizationError.new(_("Forbidden request: %{msg}") % { msg: msg })
-  end
-
-  def initialize
-    @rights = []
-  end
-
-  def [](name)
-    @rights.find { |acl| acl == name }
-  end
-
-  def empty?
-    @rights.empty?
-  end
-
-  def include?(name)
-    @rights.include?(name)
-  end
-
-  def each
-    @rights.each { |r| yield r.name,r }
-  end
-
-  # Define a new right to which access can be provided.
-  def newright(name, line=nil, file=nil)
-    add_right( Right.new(name, line, file) )
-  end
-
-  private
-
-  def add_right(right)
-    @rights << right
-    right
-  end
-
-  # Retrieve a right by name.
-  def right(name)
-    self[name]
-  end
-
-  # A right.
-  class Right < Puppet::Network::AuthStore
-    attr_accessor :name, :key
-    # Overriding Object#methods sucks for debugging. If we're in here in the
-    # future, it would be nice to rename Right#methods
-    attr_accessor :methods, :environment, :authentication
-    attr_accessor :line, :file
-
-    ALL = [:save, :destroy, :find, :search]
-
-    Puppet::Util.logmethods(self, true)
-
-    def initialize(name, line, file)
-      @methods = []
-      @environment = []
-      @authentication = true # defaults to authenticated
-      @name = name
-      @line = line || 0
-      @file = file
-      @methods = ALL
-
-      case name
-      when /^\//
-        @key = Regexp.new("^" + Regexp.escape(name))
-      when /^~/ # this is a regex
-        @name = name.gsub(/^~\s+/,'')
-        @key = Regexp.new(@name)
-      else
-        raise ArgumentError, _("Unknown right type '%{name}'") % { name: name }
-      end
-
-      super()
-    end
-
-    def to_s
-      "access[#{@name}]"
-    end
-
-    # There's no real check to do at this point
-    def valid?
-      true
-    end
-
-    # does this right is allowed for this triplet?
-    # if this right is too restrictive (ie we don't match this access method)
-    # then return :dunno so that upper layers have a chance to try another right
-    # tailored to the given method
-    def allowed?(name, ip, args = {})
-      if not @methods.include?(args[:method])
-        return :dunno
-      elsif @environment.size > 0 and not @environment.include?(args[:environment])
-        return :dunno
-      elsif (@authentication and not args[:authenticated])
-        return :dunno
-      end
-
-      begin
-        # make sure any capture are replaced if needed
-        interpolate(args[:match]) if args[:match]
-        res = super(name,ip)
-      ensure
-        reset_interpolation
-      end
-      res
-    end
-
-    # restrict this right to some method only
-    def restrict_method(m)
-      m = m.intern if m.is_a?(String)
-
-      raise ArgumentError, _("'%{m}' is not an allowed value for method directive") % { m: m } unless ALL.include?(m)
-
-      # if we were allowing all methods, then starts from scratch
-      if @methods === ALL
-        @methods = []
-      end
-
-      raise ArgumentError, _("'%{m}' is already in the '%{name}' ACL") % { m: m, name: name } if @methods.include?(m)
-
-      @methods << m
-    end
-
-    def restrict_environment(environment)
-      env = Puppet.lookup(:environments).get(environment)
-      raise ArgumentError, _("'%{env}' is already in the '%{name}' ACL") % { env: env, name: name } if @environment.include?(env)
-
-      @environment << env
-    end
-
-    def restrict_authenticated(authentication)
-      case authentication
-      when "yes", "on", "true", true
-        authentication = true
-      when "no", "off", "false", false, "all" ,"any", :all, :any
-        authentication = false
-      else
-        raise ArgumentError, _("'%{name}' incorrect authenticated value: %{authentication}") % { name: name, authentication: authentication }
-      end
-      @authentication = authentication
-    end
-
-    def match?(key)
-      # otherwise match with the regex
-      self.key.match(key)
-    end
-
-    def ==(name)
-      self.name == name.gsub(/^~\s+/,'')
-    end
-  end
-end
-end