openvox 7.37.1

data/lib/puppet/network/http/api/server/v3.rb

@@ -0,0 +1,39 @@
+require_relative 'v3/environments'
+require_relative '../../../../../puppet/network/http/api/indirected_routes'
+
+module Puppet
+  module Network
+    module HTTP
+      class API
+        module Server
+          class V3
+
+            def self.wrap(&block)
+              lambda do |request, response|
+                Puppet::Network::Authorization.
+                  check_external_authorization(request.method,
+                                               request.path)
+
+                block.call.call(request, response)
+              end
+            end
+
+            INDIRECTED = Puppet::Network::HTTP::Route.
+                path(/.*/).
+                any(wrap { Puppet::Network::HTTP::API::IndirectedRoutes.new } )
+
+            ENVIRONMENTS = Puppet::Network::HTTP::Route.
+                path(%r{^/environments$}).
+                get(wrap { Environments.new(Puppet.lookup(:environments)) } )
+
+            def self.routes
+              Puppet::Network::HTTP::Route.path(%r{v3}).
+                  any.
+                  chain(ENVIRONMENTS, INDIRECTED)
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/puppet/network/http/api/server.rb

@@ -0,0 +1,10 @@
+module Puppet
+  module Network
+    module HTTP
+      class API
+        module Server
+        end
+      end
+    end
+  end
+end

data/lib/puppet/network/http/api.rb

@@ -0,0 +1,39 @@
+class Puppet::Network::HTTP::API
+  require_relative '../../../puppet/version'
+
+  def self.not_found
+    Puppet::Network::HTTP::Route.
+      path(/.*/).
+      any(lambda do |req, res|
+        raise Puppet::Network::HTTP::Error::HTTPNotFoundError.new("No route for #{req.method} #{req.path}", Puppet::Network::HTTP::Issues::HANDLER_NOT_FOUND)
+      end)
+  end
+
+  def self.not_found_upgrade
+    Puppet::Network::HTTP::Route.
+      path(/.*/).
+      any(lambda do |req, res|
+        raise Puppet::Network::HTTP::Error::HTTPNotFoundError.new("Error: Invalid URL - Puppet expects requests that conform to the " +
+                                                                      "/puppet and /puppet-ca APIs.\n\n" +
+                                                                      "Note that Puppet 3 agents aren't compatible with this version; if you're " +
+                                                                      "running Puppet 3, you must either upgrade your agents to match the server " +
+                                                                      "or point them to a server running Puppet 3.\n\n" +
+                                                                      "Server Info:\n" +
+                                                                      "  Puppet version: #{Puppet.version}\n" +
+                                                                      "  Supported /puppet API versions: #{Puppet::Network::HTTP::SERVER_URL_VERSIONS}\n",
+                                                                  Puppet::Network::HTTP::Issues::HANDLER_NOT_FOUND)
+      end)
+  end
+
+  def self.server_routes
+    server_prefix = Regexp.new("^#{Puppet::Network::HTTP::SERVER_URL_PREFIX}/")
+    Puppet::Network::HTTP::Route.path(server_prefix).
+      any.
+      chain(Puppet::Network::HTTP::API::Server::V3.routes,
+            Puppet::Network::HTTP::API.not_found)
+  end
+
+  def self.master_routes
+    server_routes
+  end
+end

data/lib/puppet/network/http/connection.rb

@@ -0,0 +1,286 @@
+require_relative '../../../puppet/http'
+
+# This will be raised if too many redirects happen for a given HTTP request
+class Puppet::Network::HTTP::RedirectionLimitExceededException < Puppet::Error ; end
+
+# This class provides simple methods for issuing various types of HTTP
+# requests.  It's interface is intended to mirror Ruby's Net::HTTP
+# object, but it provides a few important bits of additional
+# functionality.  Notably:
+#
+# * Any HTTPS requests made using this class will use Puppet's SSL
+#   certificate configuration for their authentication, and
+# * Provides some useful error handling for any SSL errors that occur
+#   during a request.
+#
+# @deprecated Use {Puppet.runtime[:http]}
+# @api public
+class Puppet::Network::HTTP::Connection
+  include Puppet::HTTP::ResponseConverter
+
+  OPTION_DEFAULTS = {
+    :use_ssl => true,
+    :verifier => nil,
+    :redirect_limit => 10,
+  }
+
+  # Creates a new HTTP client connection to `host`:`port`.
+  # @param host [String] the host to which this client will connect to
+  # @param port [Integer] the port to which this client will connect to
+  # @param options [Hash] options influencing the properties of the created
+  #   connection,
+  # @option options [Boolean] :use_ssl true to connect with SSL, false
+  #   otherwise, defaults to true
+  # @option options [Puppet::SSL::Verifier] :verifier An object that will configure
+  #   any verification to do on the connection
+  # @option options [Integer] :redirect_limit the number of allowed
+  #   redirections, defaults to 10 passing any other option in the options
+  #   hash results in a Puppet::Error exception
+  #
+  # @note the HTTP connection itself happens lazily only when {#request}, or
+  #   one of the {#get}, {#post}, {#delete}, {#head} or {#put} is called
+  # @note The correct way to obtain a connection is to use one of the factory
+  #   methods on {Puppet::Network::HttpPool}
+  # @api private
+  def initialize(host, port, options = {})
+    unknown_options = options.keys - OPTION_DEFAULTS.keys
+    raise Puppet::Error, _("Unrecognized option(s): %{opts}") % { opts: unknown_options.map(&:inspect).sort.join(', ') } unless unknown_options.empty?
+
+    options = OPTION_DEFAULTS.merge(options)
+    @use_ssl = options[:use_ssl]
+    if @use_ssl
+      unless options[:verifier].is_a?(Puppet::SSL::Verifier)
+        raise ArgumentError, _("Expected an instance of Puppet::SSL::Verifier but was passed a %{klass}") % { klass: options[:verifier].class }
+      end
+
+      @verifier = options[:verifier]
+    end
+    @redirect_limit = options[:redirect_limit]
+    @site = Puppet::HTTP::Site.new(@use_ssl ? 'https' : 'http', host, port)
+    @client = Puppet.runtime[:http]
+  end
+
+  # The address to connect to.
+  def address
+    @site.host
+  end
+
+  # The port to connect to.
+  def port
+    @site.port
+  end
+
+  # Whether to use ssl
+  def use_ssl?
+    @site.use_ssl?
+  end
+
+  # @api private
+  def verifier
+    @verifier
+  end
+
+  # @!macro [new] common_options
+  #   @param options [Hash] options influencing the request made. Any
+  #   options not recognized by this class will be ignored - no error will
+  #   be thrown.
+  #   @option options [Hash{Symbol => String}] :basic_auth The basic auth
+  #     :username and :password to use for the request, :metric_id Ignored
+  #     by this class - used by Puppet Server only. The metric id by which
+  #     to track metrics on requests.
+
+  # @param path [String]
+  # @param headers [Hash{String => String}]
+  # @!macro common_options
+  # @api public
+  def get(path, headers = {}, options = {})
+    headers ||= {}
+    options[:ssl_context] ||= resolve_ssl_context
+    options[:redirect_limit] ||= @redirect_limit
+
+    with_error_handling do
+      to_ruby_response(@client.get(to_url(path), headers: headers, options: options))
+    end
+  end
+
+  # @param path [String]
+  # @param data [String]
+  # @param headers [Hash{String => String}]
+  # @!macro common_options
+  # @api public
+  def post(path, data, headers = nil, options = {})
+    headers ||= {}
+    headers['Content-Type'] ||= "application/x-www-form-urlencoded"
+    data ||= ''
+    options[:ssl_context] ||= resolve_ssl_context
+    options[:redirect_limit] ||= @redirect_limit
+
+    with_error_handling do
+      to_ruby_response(@client.post(to_url(path), data, headers: headers, options: options))
+    end
+  end
+
+  # @param path [String]
+  # @param headers [Hash{String => String}]
+  # @!macro common_options
+  # @api public
+  def head(path, headers = {}, options = {})
+    headers ||= {}
+    options[:ssl_context] ||= resolve_ssl_context
+    options[:redirect_limit] ||= @redirect_limit
+
+    with_error_handling do
+      to_ruby_response(@client.head(to_url(path), headers: headers, options: options))
+    end
+  end
+
+  # @param path [String]
+  # @param headers [Hash{String => String}]
+  # @!macro common_options
+  # @api public
+  def delete(path, headers = {'Depth' => 'Infinity'}, options = {})
+    headers ||= {}
+    options[:ssl_context] ||= resolve_ssl_context
+    options[:redirect_limit] ||= @redirect_limit
+
+    with_error_handling do
+      to_ruby_response(@client.delete(to_url(path), headers: headers, options: options))
+    end
+  end
+
+  # @param path [String]
+  # @param data [String]
+  # @param headers [Hash{String => String}]
+  # @!macro common_options
+  # @api public
+  def put(path, data, headers = nil, options = {})
+    headers ||= {}
+    headers['Content-Type'] ||= "application/x-www-form-urlencoded"
+    data ||= ''
+    options[:ssl_context] ||= resolve_ssl_context
+    options[:redirect_limit] ||= @redirect_limit
+
+    with_error_handling do
+      to_ruby_response(@client.put(to_url(path), data, headers: headers, options: options))
+    end
+  end
+
+  def request_get(*args, &block)
+    path, headers = *args
+    headers ||= {}
+    options = {
+      ssl_context: resolve_ssl_context,
+      redirect_limit: @redirect_limit
+    }
+
+    ruby_response = nil
+    @client.get(to_url(path), headers: headers, options: options) do |response|
+      ruby_response = to_ruby_response(response)
+      yield ruby_response if block_given?
+    end
+    ruby_response
+  end
+
+  def request_head(*args, &block)
+    path, headers = *args
+    headers ||= {}
+    options = {
+      ssl_context: resolve_ssl_context,
+      redirect_limit: @redirect_limit
+    }
+
+    response = @client.head(to_url(path), headers: headers, options: options)
+    ruby_response = to_ruby_response(response)
+    yield ruby_response if block_given?
+    ruby_response
+  end
+
+  def request_post(*args, &block)
+    path, data, headers = *args
+    headers ||= {}
+    headers['Content-Type'] ||= "application/x-www-form-urlencoded"
+    options = {
+      ssl_context: resolve_ssl_context,
+      redirect_limit: @redirect_limit
+    }
+
+    ruby_response = nil
+    @client.post(to_url(path), data, headers: headers, options: options) do |response|
+      ruby_response = to_ruby_response(response)
+      yield ruby_response if block_given?
+    end
+    ruby_response
+  end
+
+  private
+
+  # Resolve the ssl_context based on the verifier associated with this
+  # connection or load the available set of certs and key on disk.
+  # Don't try to bootstrap the agent, as we only want that to be triggered
+  # when running `puppet ssl` or `puppet agent`.
+  def resolve_ssl_context
+    # don't need an ssl context for http connections
+    return nil unless @site.use_ssl?
+
+    # if our verifier has an ssl_context, use that
+    ctx = @verifier.ssl_context
+    return ctx if ctx
+
+    # load available certs
+    cert = Puppet::X509::CertProvider.new
+    ssl = Puppet::SSL::SSLProvider.new
+    begin
+      password = cert.load_private_key_password
+      ssl.load_context(certname: Puppet[:certname], password: password)
+    rescue Puppet::SSL::SSLError => e
+      Puppet.log_exception(e)
+
+      # if we don't have cacerts, then create a root context that doesn't
+      # trust anything. The old code used to fallback to VERIFY_NONE,
+      # which we don't want to emulate.
+      ssl.create_root_context(cacerts: [])
+    end
+  end
+
+  def to_url(path)
+    if path =~ /^https?:\/\//
+      # The old Connection class accepts a URL as the request path, and sends
+      # it in "absolute-form" in the request line, e.g. GET https://puppet:8140/.
+      # See https://httpwg.org/specs/rfc7230.html#absolute-form. It just so happens
+      # to work because HTTP 1.1 servers are required to accept absolute-form even
+      # though clients are only supposed to send them to proxies, so the proxy knows
+      # what upstream server to CONNECT to. This method creates a URL using the
+      # scheme/host/port that the connection was created with, and appends the path
+      # and query portions of the absolute-form. The resulting request will use "origin-form"
+      # as it should have done all along.
+      abs_form = URI(path)
+      url = URI("#{@site.addr}/#{normalize_path(abs_form.path)}")
+      url.query = abs_form.query if abs_form.query
+      url
+    else
+      URI("#{@site.addr}/#{normalize_path(path)}")
+    end
+  end
+
+  def normalize_path(path)
+    if path[0] == '/'
+      path[1..-1]
+    else
+      path
+    end
+  end
+
+  def with_error_handling(&block)
+    yield
+  rescue Puppet::HTTP::TooManyRedirects => e
+    raise Puppet::Network::HTTP::RedirectionLimitExceededException.new(_("Too many HTTP redirections for %{host}:%{port}") % { host: @host, port: @port }, e)
+  rescue Puppet::HTTP::HTTPError => e
+    Puppet.log_exception(e, e.message)
+    case e.cause
+    when Net::OpenTimeout, Net::ReadTimeout, Net::HTTPError, EOFError
+      raise e.cause
+    else
+      raise e
+    end
+  end
+end

data/lib/puppet/network/http/error.rb

@@ -0,0 +1,73 @@
+require_relative '../../../puppet/util/json'
+
+module Puppet::Network::HTTP::Error
+  Issues = Puppet::Network::HTTP::Issues
+
+  class HTTPError < Exception
+    attr_reader :status, :issue_kind
+
+    def initialize(message, status, issue_kind)
+      super(message)
+      @status = status
+      @issue_kind = issue_kind
+    end
+
+    def to_json
+      Puppet::Util::Json.dump({:message => message, :issue_kind => @issue_kind})
+    end
+  end
+
+  class HTTPNotAcceptableError < HTTPError
+    CODE = 406
+    def initialize(message, issue_kind = Issues::RUNTIME_ERROR)
+      super(_("Not Acceptable: %{message}") % { message: message }, CODE, issue_kind)
+    end
+  end
+
+  class HTTPNotFoundError < HTTPError
+    CODE = 404
+    def initialize(message, issue_kind = Issues::RUNTIME_ERROR)
+      super(_("Not Found: %{message}") % { message: message }, CODE, issue_kind)
+    end
+  end
+
+  class HTTPNotAuthorizedError < HTTPError
+    CODE = 403
+    def initialize(message, issue_kind = Issues::RUNTIME_ERROR)
+      super(_("Not Authorized: %{message}") % { message: message }, CODE, issue_kind)
+    end
+  end
+
+  class HTTPBadRequestError < HTTPError
+    CODE = 400
+    def initialize(message, issue_kind = Issues::RUNTIME_ERROR)
+      super(_("Bad Request: %{message}") % { message: message }, CODE, issue_kind)
+    end
+  end
+
+  class HTTPMethodNotAllowedError < HTTPError
+    CODE = 405
+    def initialize(message, issue_kind = Issues::RUNTIME_ERROR)
+      super(_("Method Not Allowed: %{message}") % { message: message }, CODE, issue_kind)
+    end
+  end
+
+  class HTTPUnsupportedMediaTypeError < HTTPError
+    CODE = 415
+    def initialize(message, issue_kind = Issues::RUNTIME_ERROR)
+      super(_("Unsupported Media Type: %{message}") % { message: message }, CODE, issue_kind)
+    end
+  end
+
+  class HTTPServerError < HTTPError
+    CODE = 500
+
+    def initialize(original_error, issue_kind = Issues::RUNTIME_ERROR)
+      super(_("Server Error: %{message}") % { message: original_error.message }, CODE, issue_kind)
+    end
+
+    def to_json
+      Puppet::Util::Json.dump({:message => message, :issue_kind => @issue_kind})
+    end
+  end
+end

data/lib/puppet/network/http/handler.rb

@@ -0,0 +1,215 @@
+module Puppet::Network::HTTP
+end
+
+require_relative '../../../puppet/network/http'
+require_relative '../../../puppet/util/profiler'
+require_relative '../../../puppet/util/profiler/aggregate'
+require 'resolv'
+
+module Puppet::Network::HTTP::Handler
+  include Puppet::Network::HTTP::Issues
+
+  # These shouldn't be allowed to be set by clients
+  # in the query string, for security reasons.
+  DISALLOWED_KEYS = ["node", "ip"]
+
+  def register(routes)
+    # There's got to be a simpler way to do this, right?
+    dupes = {}
+    routes.each { |r| dupes[r.path_matcher] = (dupes[r.path_matcher] || 0) + 1 }
+    dupes = dupes.collect { |pm, count| pm if count > 1 }.compact
+    if dupes.count > 0
+      raise ArgumentError, _("Given multiple routes with identical path regexes: %{regexes}") % { regexes: dupes.map{ |rgx| rgx.inspect }.join(', ') }
+    end
+
+    @routes = routes
+    Puppet.debug("Routes Registered:")
+    @routes.each do |route|
+      Puppet.debug(route.inspect)
+    end
+  end
+
+  # Retrieve all headers from the http request, as a hash with the header names
+  # (lower-cased) as the keys
+  def headers(request)
+    raise NotImplementedError
+  end
+
+  # The mime type is always passed to the `set_content_type` method, so
+  # it is no longer necessary to retrieve the Format's mime type.
+  #
+  # @deprecated
+  def format_to_mime(format)
+    format.is_a?(Puppet::Network::Format) ? format.mime : format
+  end
+
+  # Create a generic puppet request from the implementation-specific request
+  # created by the web server
+  def make_generic_request(request)
+    request_path = path(request)
+
+    Puppet::Network::HTTP::Request.new(
+      headers(request),
+      params(request),
+      http_method(request),
+      request_path, # path
+      request_path, # routing_path
+      client_cert(request),
+      body(request)
+    )
+  end
+
+  def with_request_profiling(request)
+    profiler = configure_profiler(request.headers, request.params)
+
+    Puppet::Util::Profiler.profile(
+      _("Processed request %{request_method} %{request_path}") % { request_method: request.method, request_path: request.path },
+      [:http, request.method, request.path]
+    ) do
+      yield
+    end
+  ensure
+    remove_profiler(profiler) if profiler
+  end
+
+  # handle an HTTP request
+  def process(external_request, response)
+    # The response_wrapper stores the response and modifies it as a side effect.
+    # The caller will use the original response
+    response_wrapper = Puppet::Network::HTTP::Response.new(self, response)
+    request = make_generic_request(external_request)
+
+    set_puppet_version_header(response)
+
+    respond_to_errors(response_wrapper) do
+      with_request_profiling(request) do
+        find_route_or_raise(request).process(request, response_wrapper)
+      end
+    end
+  end
+
+  def respond_to_errors(response)
+    yield
+  rescue Puppet::Network::HTTP::Error::HTTPError => e
+    Puppet.info(e.message)
+    respond_with_http_error(response, e)
+  rescue StandardError => e
+    http_e = Puppet::Network::HTTP::Error::HTTPServerError.new(e)
+    Puppet.err([http_e.message, *e.backtrace].join("\n"))
+    respond_with_http_error(response, http_e)
+  end
+
+  def respond_with_http_error(response, exception)
+    response.respond_with(exception.status, "application/json", exception.to_json)
+  end
+
+  def find_route_or_raise(request)
+    route = @routes.find { |r| r.matches?(request) }
+    if route
+      return route
+    else
+      raise Puppet::Network::HTTP::Error::HTTPNotFoundError.new(
+              _("No route for %{request} %{path}") % { request: request.method, path: request.path },
+              HANDLER_NOT_FOUND)
+    end
+  end
+
+  def set_puppet_version_header(response)
+    response[Puppet::Network::HTTP::HEADER_PUPPET_VERSION] = Puppet.version
+  end
+
+  # Set the response up, with the body and status.
+  def set_response(response, body, status = 200)
+    raise NotImplementedError
+  end
+
+  # Set the specified format as the content type of the response.
+  def set_content_type(response, format)
+    raise NotImplementedError
+  end
+
+  # resolve node name from peer's ip address
+  # this is used when the request is unauthenticated
+  def resolve_node(result)
+    begin
+      return Resolv.getname(result[:ip])
+    rescue => detail
+      Puppet.err _("Could not resolve %{ip}: %{detail}") % { ip: result[:ip], detail: detail }
+    end
+    result[:ip]
+  end
+
+  private
+
+  # methods to be overridden by the including web server class
+
+  def http_method(request)
+    raise NotImplementedError
+  end
+
+  def path(request)
+    raise NotImplementedError
+  end
+
+  def request_key(request)
+    raise NotImplementedError
+  end
+
+  def body(request)
+    raise NotImplementedError
+  end
+
+  def params(request)
+    raise NotImplementedError
+  end
+
+  def client_cert(request)
+    raise NotImplementedError
+  end
+
+  def decode_params(params)
+    params.select { |key, _| allowed_parameter?(key) }.inject({}) do |result, ary|
+      param, value = ary
+      result[param.to_sym] = parse_parameter_value(param, value)
+      result
+    end
+  end
+
+  def allowed_parameter?(name)
+    not (name.nil? || name.empty? || DISALLOWED_KEYS.include?(name))
+  end
+
+  def parse_parameter_value(param, value)
+    if value.is_a?(Array)
+      value.collect { |v| parse_primitive_parameter_value(v) }
+    else
+      parse_primitive_parameter_value(value)
+    end
+  end
+
+  def parse_primitive_parameter_value(value)
+    case value
+    when "true"
+      true
+    when "false"
+      false
+    when /^\d+$/
+      Integer(value)
+    when /^\d+\.\d+$/
+      value.to_f
+    else
+      value
+    end
+  end
+
+  def configure_profiler(request_headers, request_params)
+    if (request_headers.has_key?(Puppet::Network::HTTP::HEADER_ENABLE_PROFILING.downcase) or Puppet[:profile])
+      Puppet::Util::Profiler.add_profiler(Puppet::Util::Profiler::Aggregate.new(Puppet.method(:info), request_params.object_id))
+    end
+  end
+
+  def remove_profiler(profiler)
+    profiler.shutdown
+    Puppet::Util::Profiler.remove_profiler(profiler)
+  end
+end

data/lib/puppet/network/http/issues.rb

@@ -0,0 +1,12 @@
+module Puppet::Network::HTTP::Issues
+  NO_INDIRECTION_REMOTE_REQUESTS = :NO_INDIRECTION_REMOTE_REQUESTS
+  HANDLER_NOT_FOUND = :HANDLER_NOT_FOUND
+  RESOURCE_NOT_FOUND = :RESOURCE_NOT_FOUND
+  ENVIRONMENT_NOT_FOUND = :ENVIRONMENT_NOT_FOUND
+  RUNTIME_ERROR = :RUNTIME_ERROR
+  MISSING_HEADER_FIELD = :MISSING_HEADER_FIELD
+  UNSUPPORTED_FORMAT = :UNSUPPORTED_FORMAT
+  UNSUPPORTED_METHOD = :UNSUPPORTED_METHOD
+  FAILED_AUTHORIZATION = :FAILED_AUTHORIZATION
+  UNSUPPORTED_MEDIA_TYPE = :UNSUPPORTED_MEDIA_TYPE
+end

data/lib/puppet/network/http/memory_response.rb

@@ -0,0 +1,13 @@
+class Puppet::Network::HTTP::MemoryResponse
+  attr_reader :code, :type, :body
+
+  def initialize
+    @body = ""
+  end
+
+  def respond_with(code, type, body)
+    @code = code
+    @type = type
+    @body += body
+  end
+end