openvox 8.19.0

data/lib/puppet/file_serving/base.rb

@@ -0,0 +1,94 @@
+# frozen_string_literal: true
+
+require_relative '../../puppet/file_serving'
+require_relative '../../puppet/util'
+
+# The base class for Content and Metadata; provides common
+# functionality like the behaviour around links.
+class Puppet::FileServing::Base
+  # This is for external consumers to store the source that was used
+  # to retrieve the metadata.
+  attr_accessor :source
+
+  # Does our file exist?
+  def exist?
+    stat
+    true
+  rescue
+    false
+  end
+
+  # Return the full path to our file.  Fails if there's no path set.
+  def full_path
+    if relative_path.nil? or relative_path == "" or relative_path == "."
+      full_path = path
+    else
+      full_path = File.join(path, relative_path)
+    end
+
+    if Puppet::Util::Platform.windows?
+      # Replace multiple slashes as long as they aren't at the beginning of a filename
+      full_path.gsub(%r{(./)/+}, '\1')
+    else
+      full_path.gsub(%r{//+}, '/')
+    end
+  end
+
+  def initialize(path, links: nil, relative_path: nil, source: nil)
+    self.path = path
+    @links = :manage
+
+    self.links = links if links
+    self.relative_path = relative_path if relative_path
+    self.source = source if source
+  end
+
+  # Determine how we deal with links.
+  attr_reader :links
+
+  def links=(value)
+    value = value.to_sym
+    value = :manage if value == :ignore
+    # TRANSLATORS ':link', ':manage', ':follow' should not be translated
+    raise(ArgumentError, _(":links can only be set to :manage or :follow")) unless [:manage, :follow].include?(value)
+
+    @links = value
+  end
+
+  # Set our base path.
+  attr_reader :path
+
+  def path=(path)
+    raise ArgumentError, _("Paths must be fully qualified") unless Puppet::FileServing::Base.absolute?(path)
+
+    @path = path
+  end
+
+  # Set a relative path; this is used for recursion, and sets
+  # the file's path relative to the initial recursion point.
+  attr_reader :relative_path
+
+  def relative_path=(path)
+    raise ArgumentError, _("Relative paths must not be fully qualified") if Puppet::FileServing::Base.absolute?(path)
+
+    @relative_path = path
+  end
+
+  # Stat our file, using the appropriate link-sensitive method.
+  def stat
+    @stat_method ||= links == :manage ? :lstat : :stat
+    Puppet::FileSystem.send(@stat_method, full_path)
+  end
+
+  def to_data_hash
+    {
+      'path' => @path,
+      'relative_path' => @relative_path,
+      'links' => @links.to_s
+    }
+  end
+
+  def self.absolute?(path)
+    Puppet::Util.absolute_path?(path, :posix) || (Puppet::Util::Platform.windows? && Puppet::Util.absolute_path?(path, :windows))
+  end
+end

data/lib/puppet/file_serving/configuration/parser.rb

@@ -0,0 +1,116 @@
+# frozen_string_literal: true
+
+require_relative '../../../puppet/file_serving/configuration'
+require_relative '../../../puppet/util/watched_file'
+
+class Puppet::FileServing::Configuration::Parser
+  Mount = Puppet::FileServing::Mount
+  MODULES = 'modules'
+
+  # Parse our configuration file.
+  def parse
+    raise(_("File server configuration %{config_file} does not exist") % { config_file: @file }) unless Puppet::FileSystem.exist?(@file)
+    raise(_("Cannot read file server configuration %{config_file}") % { config_file: @file }) unless FileTest.readable?(@file)
+
+    @mounts = {}
+    @count = 0
+
+    File.open(@file) do |f|
+      mount = nil
+      f.each_line do |line|
+        # Have the count increment at the top, in case we throw exceptions.
+        @count += 1
+
+        case line
+        when /^\s*#/; next # skip comments
+        when /^\s*$/; next # skip blank lines
+        when /\[([-\w]+)\]/
+          mount = newmount(::Regexp.last_match(1))
+        when /^\s*(\w+)\s+(.+?)(\s*#.*)?$/
+          var = ::Regexp.last_match(1)
+          value = ::Regexp.last_match(2)
+          value.strip!
+          raise(ArgumentError, _("Fileserver configuration file does not use '=' as a separator")) if value =~ /^=/
+
+          case var
+          when "path"
+            path(mount, value)
+          when "allow", "deny"
+            # ignore `allow *`, otherwise report error
+            if var != 'allow' || value != '*'
+              error_location_str = Puppet::Util::Errors.error_location(@file.filename, @count)
+              Puppet.err("Entry '#{line.chomp}' is unsupported and will be ignored at #{error_location_str}")
+            end
+          else
+            error_location_str = Puppet::Util::Errors.error_location(@file.filename, @count)
+            raise ArgumentError, _("Invalid argument '%{var}' at %{error_location}") %
+                                 { var: var, error_location: error_location_str }
+          end
+        else
+          error_location_str = Puppet::Util::Errors.error_location(@file.filename, @count)
+          raise ArgumentError, _("Invalid entry at %{error_location}: '%{file_text}'") %
+                               { file_text: line.chomp, error_location: error_location_str }
+        end
+      end
+    end
+
+    validate
+
+    @mounts
+  end
+
+  def initialize(filename)
+    @file = Puppet::Util::WatchedFile.new(filename)
+  end
+
+  def changed?
+    @file.changed?
+  end
+
+  private
+
+  # Create a new mount.
+  def newmount(name)
+    if @mounts.include?(name)
+      error_location_str = Puppet::Util::Errors.error_location(@file, @count)
+      raise ArgumentError, _("%{mount} is already mounted at %{name} at %{error_location}") %
+                           { mount: @mounts[name], name: name, error_location: error_location_str }
+    end
+    case name
+    when "modules"
+      mount = Mount::Modules.new(name)
+    when "plugins"
+      mount = Mount::Plugins.new(name)
+    when "scripts"
+      mount = Mount::Scripts.new(name)
+    when "tasks"
+      mount = Mount::Tasks.new(name)
+    when "locales"
+      mount = Mount::Locales.new(name)
+    else
+      mount = Mount::File.new(name)
+    end
+    @mounts[name] = mount
+    mount
+  end
+
+  # Set the path for a mount.
+  def path(mount, value)
+    if mount.respond_to?(:path=)
+      begin
+        mount.path = value
+      rescue ArgumentError => detail
+        Puppet.log_exception(detail, _("Removing mount \"%{mount}\": %{detail}") % { mount: mount.name, detail: detail })
+        @mounts.delete(mount.name)
+      end
+    else
+      Puppet.warning _("The '%{mount}' module can not have a path. Ignoring attempt to set it") % { mount: mount.name }
+    end
+  end
+
+  # Make sure all of our mounts are valid.  We have to do this after the fact
+  # because details are added over time as the file is parsed.
+  def validate
+    @mounts.each { |_name, mount| mount.validate }
+  end
+end

data/lib/puppet/file_serving/configuration.rb

@@ -0,0 +1,116 @@
+# frozen_string_literal: true
+
+require_relative '../../puppet'
+require_relative '../../puppet/file_serving'
+require_relative '../../puppet/file_serving/mount'
+require_relative '../../puppet/file_serving/mount/file'
+require_relative '../../puppet/file_serving/mount/modules'
+require_relative '../../puppet/file_serving/mount/plugins'
+require_relative '../../puppet/file_serving/mount/locales'
+require_relative '../../puppet/file_serving/mount/pluginfacts'
+require_relative '../../puppet/file_serving/mount/scripts'
+require_relative '../../puppet/file_serving/mount/tasks'
+
+class Puppet::FileServing::Configuration
+  require_relative 'configuration/parser'
+
+  def self.configuration
+    @configuration ||= new
+  end
+
+  Mount = Puppet::FileServing::Mount
+
+  private_class_method :new
+
+  attr_reader :mounts
+
+  # private :mounts
+
+  # Find the right mount.  Does some shenanigans to support old-style module
+  # mounts.
+  def find_mount(mount_name, environment)
+    # Reparse the configuration if necessary.
+    readconfig
+    # This can be nil.
+    mounts[mount_name]
+  end
+
+  def initialize
+    @mounts = {}
+    @config_file = nil
+
+    # We don't check to see if the file is modified the first time,
+    # because we always want to parse at first.
+    readconfig(false)
+  end
+
+  # Is a given mount available?
+  def mounted?(name)
+    @mounts.include?(name)
+  end
+
+  # Split the path into the separate mount point and path.
+  def split_path(request)
+    # Reparse the configuration if necessary.
+    readconfig
+
+    mount_name, path = request.key.split(File::Separator, 2)
+
+    raise(ArgumentError, _("Cannot find file: Invalid mount '%{mount_name}'") % { mount_name: mount_name }) unless mount_name =~ /^[-\w]+$/
+    raise(ArgumentError, _("Cannot find file: Invalid relative path '%{path}'") % { path: path }) if path and path.split('/').include?('..')
+
+    mount = find_mount(mount_name, request.environment)
+    return nil unless mount
+
+    if mount.name == "modules" and mount_name != "modules"
+      # yay backward-compatibility
+      path = "#{mount_name}/#{path}"
+    end
+
+    if path == ""
+      path = nil
+    elsif path
+      # Remove any double slashes that might have occurred
+      path = path.gsub(%r{/+}, "/")
+    end
+
+    [mount, path]
+  end
+
+  def umount(name)
+    @mounts.delete(name) if @mounts.include? name
+  end
+
+  private
+
+  def mk_default_mounts
+    @mounts["modules"] ||= Mount::Modules.new("modules")
+    @mounts["plugins"] ||= Mount::Plugins.new("plugins")
+    @mounts["locales"] ||= Mount::Locales.new("locales")
+    @mounts["pluginfacts"] ||= Mount::PluginFacts.new("pluginfacts")
+    @mounts["scripts"] ||= Mount::Scripts.new("scripts")
+    @mounts["tasks"] ||= Mount::Tasks.new("tasks")
+  end
+
+  # Read the configuration file.
+  def readconfig(check = true)
+    config = Puppet[:fileserverconfig]
+
+    return unless Puppet::FileSystem.exist?(config)
+
+    @parser ||= Puppet::FileServing::Configuration::Parser.new(config)
+
+    return if check and !@parser.changed?
+
+    # Don't assign the mounts hash until we're sure the parsing succeeded.
+    begin
+      newmounts = @parser.parse
+      @mounts = newmounts
+    rescue => detail
+      Puppet.log_exception(detail, _("Error parsing fileserver configuration: %{detail}; using old configuration") % { detail: detail })
+    end
+  ensure
+    # Make sure we've got our plugins and modules.
+    mk_default_mounts
+  end
+end

data/lib/puppet/file_serving/content.rb

@@ -0,0 +1,45 @@
+# frozen_string_literal: true
+
+require_relative '../../puppet/indirector'
+require_relative '../../puppet/file_serving'
+require_relative '../../puppet/file_serving/base'
+
+# A class that handles retrieving file contents.
+# It only reads the file when its content is specifically
+# asked for.
+class Puppet::FileServing::Content < Puppet::FileServing::Base
+  extend Puppet::Indirector
+  indirects :file_content, :terminus_class => :selector
+
+  attr_writer :content
+
+  def self.supported_formats
+    [:binary]
+  end
+
+  def self.from_binary(content)
+    instance = new("/this/is/a/fake/path")
+    instance.content = content
+    instance
+  end
+
+  # This is no longer used, but is still called by the file server implementations when interacting
+  # with their model abstraction.
+  def collect(source_permissions = nil)
+  end
+
+  # Read the content of our file in.
+  def content
+    unless @content
+      # This stat can raise an exception, too.
+      raise(ArgumentError, _("Cannot read the contents of links unless following links")) if stat.ftype == "symlink"
+
+      @content = Puppet::FileSystem.binread(full_path)
+    end
+    @content
+  end
+
+  def to_binary
+    File.new(full_path, "rb")
+  end
+end

data/lib/puppet/file_serving/fileset.rb

@@ -0,0 +1,190 @@
+# frozen_string_literal: true
+
+require 'find'
+require_relative '../../puppet/file_serving'
+require_relative '../../puppet/file_serving/metadata'
+
+# Operate recursively on a path, returning a set of file paths.
+class Puppet::FileServing::Fileset
+  attr_reader :path, :ignore, :links
+  attr_accessor :recurse, :recurselimit, :max_files, :checksum_type
+
+  # Produce a hash of files, with merged so that earlier files
+  # with the same postfix win.  E.g., /dir1/subfile beats /dir2/subfile.
+  # It's a hash because we need to know the relative path of each file,
+  # and the base directory.
+  #   This will probably only ever be used for searching for plugins.
+  def self.merge(*filesets)
+    result = {}
+
+    filesets.each do |fileset|
+      fileset.files.each do |file|
+        result[file] ||= fileset.path
+      end
+    end
+
+    result
+  end
+
+  def initialize(path, options = {})
+    if Puppet::Util::Platform.windows?
+      # REMIND: UNC path
+      path = path.chomp(File::SEPARATOR) unless path =~ %r{^[A-Za-z]:/$}
+    else
+      path = path.chomp(File::SEPARATOR) unless path == File::SEPARATOR
+    end
+    raise ArgumentError, _("Fileset paths must be fully qualified: %{path}") % { path: path } unless Puppet::Util.absolute_path?(path)
+
+    @path = path
+
+    # Set our defaults.
+    self.ignore = []
+    self.links = :manage
+    @recurse = false
+    @recurselimit = :infinite
+    @max_files = 0
+
+    if options.is_a?(Puppet::Indirector::Request)
+      initialize_from_request(options)
+    else
+      initialize_from_hash(options)
+    end
+
+    raise ArgumentError, _("Fileset paths must exist") unless valid?(path)
+    # TRANSLATORS "recurse" and "recurselimit" are parameter names and should not be translated
+    raise ArgumentError, _("Fileset recurse parameter must not be a number anymore, please use recurselimit") if @recurse.is_a?(Integer)
+  end
+
+  # Return a list of all files in our fileset.  This is different from the
+  # normal definition of find in that we support specific levels
+  # of recursion, which means we need to know when we're going another
+  # level deep, which Find doesn't do.
+  def files
+    files = perform_recursion
+    soft_max_files = 1000
+
+    # munged_max_files is needed since puppet http handler is keeping negative numbers as strings
+    # https://github.com/puppetlabs/puppet/blob/main/lib/puppet/network/http/handler.rb#L196-L197
+    munged_max_files = max_files == '-1' ? -1 : max_files
+
+    if munged_max_files > 0 && files.size > munged_max_files
+      raise Puppet::Error, _("The directory '%{path}' contains %{entries} entries, which exceeds the limit of %{munged_max_files} specified by the max_files parameter for this resource. The limit may be increased, but be aware that large number of file resources can result in excessive resource consumption and degraded performance. Consider using an alternate method to manage large directory trees") % { path: path, entries: files.size, munged_max_files: munged_max_files }
+    elsif munged_max_files == 0 && files.size > soft_max_files
+      Puppet.warning _("The directory '%{path}' contains %{entries} entries, which exceeds the default soft limit %{soft_max_files} and may cause excessive resource consumption and degraded performance. To remove this warning set a value for `max_files` parameter or consider using an alternate method to manage large directory trees") % { path: path, entries: files.size, soft_max_files: soft_max_files }
+    end
+
+    # Now strip off the leading path, so each file becomes relative, and remove
+    # any slashes that might end up at the beginning of the path.
+    result = files.collect { |file| file.sub(%r{^#{Regexp.escape(@path)}/*}, '') }
+
+    # And add the path itself.
+    result.unshift(".")
+
+    result
+  end
+
+  def ignore=(values)
+    values = [values] unless values.is_a?(Array)
+    @ignore = values.collect(&:to_s)
+  end
+
+  def links=(links)
+    links = links.to_sym
+    # TRANSLATORS ":links" is a parameter name and should not be translated
+    raise(ArgumentError, _("Invalid :links value '%{links}'") % { links: links }) unless [:manage, :follow].include?(links)
+
+    @links = links
+    @stat_method = @links == :manage ? :lstat : :stat
+  end
+
+  private
+
+  def initialize_from_hash(options)
+    options.each do |option, value|
+      method = option.to_s + "="
+      begin
+        send(method, value)
+      rescue NoMethodError => e
+        raise ArgumentError, _("Invalid option '%{option}'") % { option: option }, e.backtrace
+      end
+    end
+  end
+
+  def initialize_from_request(request)
+    [:links, :ignore, :recurse, :recurselimit, :max_files, :checksum_type].each do |param|
+      if request.options.include?(param) # use 'include?' so the values can be false
+        value = request.options[param]
+      elsif request.options.include?(param.to_s)
+        value = request.options[param.to_s]
+      end
+      next if value.nil?
+
+      value = true if value == "true"
+      value = false if value == "false"
+      value = Integer(value) if value.is_a?(String) and value =~ /^\d+$/
+      send(param.to_s + "=", value)
+    end
+  end
+
+  FileSetEntry = Struct.new(:depth, :path, :ignored, :stat_method) do
+    def down_level(to)
+      FileSetEntry.new(depth + 1, File.join(path, to), ignored, stat_method)
+    end
+
+    def basename
+      File.basename(path)
+    end
+
+    def children
+      return [] unless directory?
+
+      Dir.entries(path, encoding: Encoding::UTF_8)
+         .reject { |child| ignore?(child) }
+         .collect { |child| down_level(child) }
+    end
+
+    def ignore?(child)
+      return true if child == "." || child == ".."
+      return false if ignored == [nil]
+
+      ignored.any? { |pattern| File.fnmatch?(pattern, child) }
+    end
+
+    def directory?
+      Puppet::FileSystem.send(stat_method, path).directory?
+    rescue Errno::ENOENT, Errno::EACCES
+      false
+    end
+  end
+
+  # Pull the recursion logic into one place.  It's moderately hairy, and this
+  # allows us to keep the hairiness apart from what we do with the files.
+  def perform_recursion
+    current_dirs = [FileSetEntry.new(0, @path, @ignore, @stat_method)]
+
+    result = []
+
+    while entry = current_dirs.shift # rubocop:disable Lint/AssignmentInCondition
+      next unless continue_recursion_at?(entry.depth + 1)
+
+      entry.children.each do |child|
+        result << child.path
+        current_dirs << child
+      end
+    end
+
+    result
+  end
+
+  def valid?(path)
+    Puppet::FileSystem.send(@stat_method, path)
+    true
+  rescue Errno::ENOENT, Errno::EACCES
+    false
+  end
+
+  def continue_recursion_at?(depth)
+    # recurse if told to, and infinite recursion or current depth not at the limit
+    recurse && (recurselimit == :infinite || depth <= recurselimit)
+  end
+end

data/lib/puppet/file_serving/http_metadata.rb

@@ -0,0 +1,61 @@
+# frozen_string_literal: true
+
+require_relative '../../puppet/file_serving/metadata'
+
+# Simplified metadata representation, suitable for the information
+# that is available from HTTP headers.
+class Puppet::FileServing::HttpMetadata < Puppet::FileServing::Metadata
+  def initialize(http_response, path = '/dev/null')
+    super(path)
+
+    # ignore options that do not apply to HTTP metadata
+    @owner = @group = @mode = nil
+
+    # hash available checksums for eventual collection
+    @checksums = {}
+    # use a default mtime in case there is no usable HTTP header
+    @checksums[:mtime] = "{mtime}#{Time.now}"
+
+    # RFC-1864, deprecated in HTTP/1.1 due to partial responses
+    checksum = http_response['content-md5']
+    if checksum
+      # convert base64 digest to hex
+      checksum = checksum.unpack1("m").unpack1("H*")
+      @checksums[:md5] = "{md5}#{checksum}"
+    end
+
+    {
+      md5: 'X-Checksum-Md5',
+      sha1: 'X-Checksum-Sha1',
+      sha256: 'X-Checksum-Sha256'
+    }.each_pair do |checksum_type, header|
+      checksum = http_response[header]
+      if checksum
+        @checksums[checksum_type] = "{#{checksum_type}}#{checksum}"
+      end
+    end
+
+    last_modified = http_response['last-modified']
+    if last_modified
+      mtime = DateTime.httpdate(last_modified).to_time
+      @checksums[:mtime] = "{mtime}#{mtime.utc}"
+    end
+
+    @ftype = 'file'
+  end
+
+  # Override of the parent class method. Does not call super!
+  # We can only return metadata that was extracted from the
+  # HTTP headers during #initialize.
+  def collect
+    # Prefer the checksum_type from the indirector request options
+    # but fall back to the alternative otherwise
+    [@checksum_type, :sha256, :sha1, :md5, :mtime].each do |type|
+      next if type == :md5 && Puppet::Util::Platform.fips_enabled?
+
+      @checksum_type = type
+      @checksum = @checksums[type]
+      break if @checksum
+    end
+  end
+end