hiera-http-eyaml 0.9.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA1:
+  metadata.gz: 7a59eab7214ebf3882c2cfad48b54e3369053f05
+  data.tar.gz: 56535a0f8f1e1d223519c63902b2148d3e8b9450
+SHA512:
+  metadata.gz: da31505c73f8802e65b2789deaea72f5bc6e404fda129df4cb58dab27c971f84897893d4fa32bc8705d75fe6b0bb33182cc279416d39fbac9fdd331de746dced
+  data.tar.gz: c265b5415a6e799f4cd24af064abdbe49b4ab750521866e093535f4f63b24988a6fb6568d8282be251a48b626d9d949351cce3f4e978b92146d8374428cecd7c

data/.gitignore

@@ -0,0 +1,9 @@
+/.bundle/
+/.yardoc
+/Gemfile.lock
+/_yardoc/
+/coverage/
+/doc/
+/pkg/
+/spec/reports/
+/tmp/

data/Gemfile

@@ -0,0 +1,3 @@
+source 'https://rubygems.org'
+
+gemspec

data/LICENSE.txt

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2017 Ben P
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

data/README.md

@@ -0,0 +1,51 @@
+# Hiera HTTP+eYAML Backend
+
+This is a fork of the hiera-http backend that decrypts hiera-eyaml blobs.
+
+- https://github.com/crayfishx/hiera-http/
+- https://github.com/voxpupuli/hiera-eyaml/
+
+## Configuration
+
+The configuration is the same as hiera-http's configuration, plus any
+hiera-eyaml encryption options; at minimum you will need to set
+`pkcs7_private_key` and `pkcs7_public_key`.
+
+An example configuration for Hiera 3:
+
+```
+---
+:backends:
+  - http_eyaml
+
+:http_eyaml:
+  :host: 127.0.0.1
+  :port: 5984
+  :output: json
+  :cache_timeout: 10
+  :pkcs7_private_key: /path/to/private_key.pkcs7.pem
+  :pkcs7_public_key:  /path/to/public_key.pkcs7.pem
+  :headers:
+    :X-Token: my-token
+  :paths:
+    - /configuration/%{fqdn}
+    - /configuration/%{env}
+    - /configuration/common
+```
+
+## Installation
+
+Add this line to your puppet repo's Gemfile:
+
+```ruby
+gem 'hiera-http-eyaml'
+```
+
+Or install it with gem:
+
+    $ gem install hiera-http-eyaml
+
+## License
+
+The gem is available as open source under the terms of the [MIT License](http://opensource.org/licenses/MIT).
+

data/Rakefile

@@ -0,0 +1,2 @@
+require "bundler/gem_tasks"
+task :default => :spec

data/hiera-http-eyaml.gemspec

@@ -0,0 +1,25 @@
+# coding: utf-8
+lib = File.expand_path('../lib', __FILE__)
+$LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
+require 'hiera/backend/http_eyaml.rb'
+
+Gem::Specification.new do |spec|
+  spec.name          = "hiera-http-eyaml"
+  spec.version       = Hiera::Backend::Http_eyaml::VERSION
+  spec.authors       = ["benwtr"]
+  spec.email         = ["ben@g.megatron.org"]
+
+  spec.summary       = 'hiera-http-eyaml'
+  spec.description   = %q{Fork of the Hiera HTTP backend with eYAML support}
+  spec.homepage      = "https://github.com/benwtr/hiera-http-eyaml"
+  spec.license       = "MIT"
+
+  spec.files         = `git ls-files -z`.split("\x0").reject do |f|
+    f.match(%r{^(test|spec|features)/})
+  end
+  spec.executables   = spec.files.grep(%r{^bin/}) { |f| File.basename(f) }
+  spec.require_paths = ["lib"]
+
+  spec.add_dependency('hiera-eyaml', '~>2.1.0')
+  spec.add_dependency('lookup_http', '>=1.0.0')
+end

data/lib/hiera/backend/http_eyaml.rb

@@ -0,0 +1,9 @@
+class Hiera
+  module Backend
+    module Http_eyaml
+
+      VERSION = "0.9.0"
+
+    end
+  end
+end

data/lib/hiera/backend/http_eyaml_backend.rb

@@ -0,0 +1,201 @@
+require 'hiera/backend/eyaml/encryptor'
+require 'hiera/backend/eyaml/utils'
+require 'hiera/backend/eyaml/options'
+require 'hiera/backend/eyaml/parser/parser'
+
+class Hiera
+  module Backend
+    class Http_eyaml_backend
+
+      def initialize
+        debug("Hiera HTTP-eYAML backend starting")
+
+        require 'lookup_http'
+        @config = Config[:http_eyaml]
+
+        lookup_supported_params = [
+          :host,
+          :port,
+          :output,
+          :failure,
+          :ignore_404,
+          :headers,
+          :http_connect_timeout,
+          :http_read_timeout,
+          :use_ssl,
+          :ssl_ca_cert,
+          :ssl_cert,
+          :ssl_key,
+          :ssl_verify,
+          :use_auth,
+          :auth_user,
+          :auth_pass,
+        ]
+        lookup_params = @config.select { |p| lookup_supported_params.include?(p) }
+
+        @lookup = LookupHttp.new(lookup_params.merge( { :debug_log => "Hiera.debug" } ))
+
+
+        @cache = {}
+        @cache_timeout = @config[:cache_timeout] || 10
+        @cache_clean_interval = @config[:cache_clean_interval] || 3600
+
+        @regex_key_match = nil
+
+        if confine_keys = @config[:confine_to_keys]
+          confine_keys.map! { |r| Regexp.new(r) }
+          @regex_key_match = Regexp.union(confine_keys)
+        end
+
+      end
+
+      def lookup(key, scope, order_override, resolution_type)
+
+        parse_eyaml_options(scope)
+
+        debug("Looking up #{key} in HTTP-eYAML backend")
+
+        require 'uri'
+
+        # if confine_to_keys is configured, then only proceed if one of the
+        # regexes matches the lookup key
+        #
+        if @regex_key_match
+          return nil unless key[@regex_key_match] == key
+        end
+
+
+        answer = nil
+
+        paths = @config[:paths].map { |p| Backend.parse_string(p, scope, { 'key' => key }) }
+        paths.insert(0, order_override) if order_override
+
+
+        paths.each do |path|
+
+          debug("Lookup #{key} from #{@config[:host]}:#{@config[:port]}#{path}")
+
+          result = http_get_and_parse_with_cache(URI.escape(path))
+          result = result[key] if result.is_a?(Hash)
+          next if result.nil?
+
+          parsed_result = parse_answer(result, scope)
+
+          case resolution_type
+          when :array
+            answer ||= []
+            answer << parsed_result
+          when :hash
+            answer ||= {}
+            answer = Backend.merge_answer(parsed_result, answer)
+          else
+            answer = parsed_result
+            break
+          end
+        end
+        answer
+      end
+
+
+      private
+
+
+      def debug(message)
+        Hiera.debug("[hiera-http_eyaml_backend]: #{message}")
+      end
+
+
+      def http_get_and_parse_with_cache(path)
+        return @lookup.get_parsed(path) if @cache_timeout <= 0
+
+        now = Time.now.to_i
+        expired_at = now + @cache_timeout
+
+        # Deleting all stale cache entries can be expensive. Do not do it every time
+        periodically_clean_cache(now) unless @cache_clean_interval == 0
+
+        # Just refresh the entry being requested for performance
+        if !@cache[path] || @cache[path][:expired_at] < now
+          @cache[path] = {
+            :expired_at => expired_at,
+            :result => @lookup.get_parsed(path)
+          }
+        end
+        @cache[path][:result]
+      end
+
+
+      def periodically_clean_cache(now)
+        return if now < @clean_cache_at.to_i
+
+        @clean_cache_at = now + @cache_clean_interval
+        @cache.delete_if do |_, entry|
+          entry[:expired_at] < now
+        end
+      end
+
+
+      def decrypt(data)
+        if encrypted?(data)
+          debug("Attempting to decrypt")
+
+          parser = Eyaml::Parser::ParserFactory.hiera_backend_parser
+          tokens = parser.parse(data)
+          decrypted = tokens.map{ |token| token.to_plain_text }
+          plaintext = decrypted.join
+
+          plaintext.chomp
+        else
+          data
+        end
+      end
+
+
+      def encrypted?(data)
+        /.*ENC\[.*?\]/ =~ data ? true : false
+      end
+
+
+      def parse_answer(data, scope, extra_data={})
+        if data.is_a?(Numeric) or data.is_a?(TrueClass) or data.is_a?(FalseClass)
+          return data
+        elsif data.is_a?(String)
+          return parse_string(data, scope, extra_data)
+        elsif data.is_a?(Hash)
+          answer = {}
+          data.each_pair do |key, val|
+            interpolated_key = Backend.parse_string(key, scope, extra_data)
+            answer[interpolated_key] = parse_answer(val, scope, extra_data)
+          end
+
+          return answer
+        elsif data.is_a?(Array)
+          answer = []
+          data.each do |item|
+            answer << parse_answer(item, scope, extra_data)
+          end
+
+          return answer
+        end
+      end
+
+
+      def parse_eyaml_options(scope)
+        Config[:http_eyaml].each do |key, value|
+          parsed_value = Backend.parse_string(value, scope)
+          Eyaml::Options[key] = parsed_value
+          debug("Set option: #{key} = #{parsed_value}")
+        end
+
+        Eyaml::Options[:source] = "hiera"
+      end
+
+
+      def parse_string(data, scope, extra_data={})
+        decrypted_data = decrypt(data)
+        Backend.parse_string(decrypted_data, scope, extra_data)
+      end
+
+    end
+  end
+end

metadata

@@ -0,0 +1,80 @@
+--- !ruby/object:Gem::Specification
+name: hiera-http-eyaml
+version: !ruby/object:Gem::Version
+  version: 0.9.0
+platform: ruby
+authors:
+- benwtr
+autorequire: 
+bindir: bin
+cert_chain: []
+date: 2017-03-09 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: hiera-eyaml
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 2.1.0
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 2.1.0
+- !ruby/object:Gem::Dependency
+  name: lookup_http
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 1.0.0
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 1.0.0
+description: Fork of the Hiera HTTP backend with eYAML support
+email:
+- ben@g.megatron.org
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- ".gitignore"
+- Gemfile
+- LICENSE.txt
+- README.md
+- Rakefile
+- hiera-http-eyaml.gemspec
+- lib/hiera/backend/http_eyaml.rb
+- lib/hiera/backend/http_eyaml_backend.rb
+homepage: https://github.com/benwtr/hiera-http-eyaml
+licenses:
+- MIT
+metadata: {}
+post_install_message: 
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubyforge_project: 
+rubygems_version: 2.2.5
+signing_key: 
+specification_version: 4
+summary: hiera-http-eyaml
+test_files: []