openvox 8.19.0

data/lib/puppet/http/errors.rb

@@ -0,0 +1,50 @@
+# frozen_string_literal: true
+
+module Puppet::HTTP
+  # A base class for puppet http errors
+  # @api public
+  class HTTPError < Puppet::Error; end
+
+  # A connection error such as if the server refuses the connection.
+  # @api public
+  class ConnectionError < HTTPError; end
+
+  # A failure to route to the server such as if the `server_list` is exhausted.
+  # @api public
+  class RouteError < HTTPError; end
+
+  # An HTTP protocol error, such as the server's response missing a required header.
+  # @api public
+  class ProtocolError < HTTPError; end
+
+  # An error serializing or deserializing an object via REST.
+  # @api public
+  class SerializationError < HTTPError; end
+
+  # An error due to an unsuccessful HTTP response, such as HTTP 500.
+  # @api public
+  class ResponseError < HTTPError
+    attr_reader :response
+
+    def initialize(response)
+      super(response.reason)
+      @response = response
+    end
+  end
+
+  # An error if asked to follow too many redirects (such as HTTP 301).
+  # @api public
+  class TooManyRedirects < HTTPError
+    def initialize(addr)
+      super(_("Too many HTTP redirections for %{addr}") % { addr: addr })
+    end
+  end
+
+  # An error if asked to retry (such as HTTP 503) too many times.
+  # @api public
+  class TooManyRetryAfters < HTTPError
+    def initialize(addr)
+      super(_("Too many HTTP retries for %{addr}") % { addr: addr })
+    end
+  end
+end

data/lib/puppet/http/external_client.rb

@@ -0,0 +1,89 @@
+# frozen_string_literal: true
+
+# Adapts an external http_client_class to the HTTP client API. The former
+# is typically registered by puppetserver and only implements a subset of
+# the Puppet::Network::HTTP::Connection methods. As a result, only the
+# `get` and `post` methods are supported. Calling `delete`, etc will
+# raise a NotImplementedError.
+#
+# @api private
+class Puppet::HTTP::ExternalClient < Puppet::HTTP::Client
+  # Create an external http client.
+  #
+  # @param [Class] http_client_class The class to create to handle the request
+  def initialize(http_client_class)
+    @http_client_class = http_client_class
+  end
+
+  # (see Puppet::HTTP::Client#get)
+  # @api private
+  def get(url, headers: {}, params: {}, options: {}, &block)
+    url = encode_query(url, params)
+
+    options[:use_ssl] = url.scheme == 'https'
+
+    client = @http_client_class.new(url.host, url.port, options)
+    response = Puppet::HTTP::ResponseNetHTTP.new(url, client.get(url.request_uri, headers, options))
+
+    if block_given?
+      yield response
+    else
+      response
+    end
+  rescue Puppet::HTTP::HTTPError
+    raise
+  rescue => e
+    raise Puppet::HTTP::HTTPError.new(e.message, e)
+  end
+
+  # (see Puppet::HTTP::Client#post)
+  # @api private
+  def post(url, body, headers: {}, params: {}, options: {}, &block)
+    raise ArgumentError, "'post' requires a string 'body' argument" unless body.is_a?(String)
+
+    url = encode_query(url, params)
+
+    options[:use_ssl] = url.scheme == 'https'
+
+    client = @http_client_class.new(url.host, url.port, options)
+    response = Puppet::HTTP::ResponseNetHTTP.new(url, client.post(url.request_uri, body, headers, options))
+
+    if block_given?
+      yield response
+    else
+      response
+    end
+  rescue Puppet::HTTP::HTTPError, ArgumentError
+    raise
+  rescue => e
+    raise Puppet::HTTP::HTTPError.new(e.message, e)
+  end
+
+  # (see Puppet::HTTP::Client#close)
+  # @api private
+  def close
+    # This is a noop as puppetserver doesn't provide a way to close its http client.
+  end
+
+  # The following are intentionally not documented
+
+  def create_session
+    raise NotImplementedError
+  end
+
+  def connect(uri, options: {}, &block)
+    raise NotImplementedError
+  end
+
+  def head(url, headers: {}, params: {}, options: {})
+    raise NotImplementedError
+  end
+
+  def put(url, headers: {}, params: {}, options: {})
+    raise NotImplementedError
+  end
+
+  def delete(url, headers: {}, params: {}, options: {})
+    raise NotImplementedError
+  end
+end

data/lib/puppet/http/factory.rb

@@ -0,0 +1,53 @@
+# frozen_string_literal: true
+
+require_relative '../../puppet/ssl/openssl_loader'
+require 'net/http'
+require_relative '../../puppet/http'
+
+# Factory for `Net::HTTP` objects.
+#
+# Encapsulates the logic for creating a `Net::HTTP` object based on the
+# specified {Site} and puppet settings.
+#
+# @api private
+class Puppet::HTTP::Factory
+  @@openssl_initialized = false
+
+  KEEP_ALIVE_TIMEOUT = 2**31 - 1
+
+  def initialize
+    # PUP-1411, make sure that openssl is initialized before we try to connect
+    unless @@openssl_initialized
+      OpenSSL::SSL::SSLContext.new
+      @@openssl_initialized = true
+    end
+  end
+
+  def create_connection(site)
+    Puppet.debug("Creating new connection for #{site}")
+
+    http = Puppet::HTTP::Proxy.proxy(URI(site.addr))
+    http.use_ssl = site.use_ssl?
+    if site.use_ssl?
+      http.min_version = OpenSSL::SSL::TLS1_VERSION if http.respond_to?(:min_version)
+      http.ciphers = Puppet[:ciphers]
+    end
+    http.read_timeout = Puppet[:http_read_timeout]
+    http.open_timeout = Puppet[:http_connect_timeout]
+    http.keep_alive_timeout = KEEP_ALIVE_TIMEOUT if http.respond_to?(:keep_alive_timeout=)
+
+    # 0 means make one request and never retry
+    http.max_retries = 0
+
+    if Puppet[:sourceaddress]
+      Puppet.debug("Using source IP #{Puppet[:sourceaddress]}")
+      http.local_host = Puppet[:sourceaddress]
+    end
+
+    if Puppet[:http_debug]
+      http.set_debug_output($stderr)
+    end
+
+    http
+  end
+end

data/lib/puppet/http/pool.rb

@@ -0,0 +1,174 @@
+# frozen_string_literal: true
+
+# A pool for persistent `Net::HTTP` connections. Connections are
+# stored in the pool indexed by their {Site}.
+# Connections are borrowed from the pool, yielded to the caller, and
+# released back into the pool. If a connection is expired, it will be
+# closed either when a connection to that site is requested, or when
+# the pool is closed. The pool can store multiple connections to the
+# same site, and will be reused in MRU order.
+#
+# @api private
+class Puppet::HTTP::Pool
+  attr_reader :factory, :keepalive_timeout
+
+  def initialize(keepalive_timeout)
+    @pool = {}
+    @factory = Puppet::HTTP::Factory.new
+    @keepalive_timeout = keepalive_timeout
+  end
+
+  def with_connection(site, verifier, &block)
+    reuse = true
+
+    http = borrow(site, verifier)
+    begin
+      if http.use_ssl? && http.verify_mode != OpenSSL::SSL::VERIFY_PEER
+        reuse = false
+      end
+
+      yield http
+    rescue => detail
+      reuse = false
+      raise detail
+    ensure
+      if reuse && http.started?
+        release(site, verifier, http)
+      else
+        close_connection(site, http)
+      end
+    end
+  end
+
+  def close
+    @pool.each_pair do |site, entries|
+      entries.each do |entry|
+        close_connection(site, entry.connection)
+      end
+    end
+    @pool.clear
+  end
+
+  # @api private
+  def pool
+    @pool
+  end
+
+  # Start a persistent connection
+  #
+  # @api private
+  def start(site, verifier, http)
+    Puppet.debug("Starting connection for #{site}")
+    if site.use_ssl?
+      verifier.setup_connection(http)
+      begin
+        http.start
+        print_ssl_info(http) if Puppet::Util::Log.sendlevel?(:debug)
+      rescue OpenSSL::SSL::SSLError => error
+        verifier.handle_connection_error(http, error)
+      end
+    else
+      http.start
+    end
+  end
+
+  # Safely close a persistent connection.
+  # Don't try to close a connection that's already closed.
+  #
+  # @api private
+  def close_connection(site, http)
+    return false unless http.started?
+
+    Puppet.debug("Closing connection for #{site}")
+    http.finish
+    true
+  rescue => detail
+    Puppet.log_exception(detail, _("Failed to close connection for %{site}: %{detail}") % { site: site, detail: detail })
+    nil
+  end
+
+  # Borrow and take ownership of a persistent connection. If a new
+  # connection is created, it will be started prior to being returned.
+  #
+  # @api private
+  def borrow(site, verifier)
+    @pool[site] = active_entries(site)
+    index = @pool[site].index do |entry|
+      (verifier.nil? && entry.verifier.nil?) ||
+        (!verifier.nil? && verifier.reusable?(entry.verifier))
+    end
+    entry = index ? @pool[site].delete_at(index) : nil
+    if entry
+      @pool.delete(site) if @pool[site].empty?
+
+      Puppet.debug("Using cached connection for #{site}")
+      entry.connection
+    else
+      http = @factory.create_connection(site)
+
+      start(site, verifier, http)
+      setsockopts(http.instance_variable_get(:@socket))
+      http
+    end
+  end
+
+  # Set useful socket option(s) which lack from default settings in Net:HTTP
+  #
+  # @api private
+  def setsockopts(netio)
+    return unless netio
+
+    socket = netio.io
+    socket.setsockopt(Socket::SOL_SOCKET, Socket::SO_KEEPALIVE, true)
+  end
+
+  # Release a connection back into the pool.
+  #
+  # @api private
+  def release(site, verifier, http)
+    expiration = Time.now + @keepalive_timeout
+    entry = Puppet::HTTP::PoolEntry.new(http, verifier, expiration)
+    Puppet.debug("Caching connection for #{site}")
+
+    entries = @pool[site]
+    if entries
+      entries.unshift(entry)
+    else
+      @pool[site] = [entry]
+    end
+  end
+
+  # Returns an Array of entries whose connections are not expired.
+  #
+  # @api private
+  def active_entries(site)
+    now = Time.now
+
+    entries = @pool[site] || []
+    entries.select do |entry|
+      if entry.expired?(now)
+        close_connection(site, entry.connection)
+        false
+      else
+        true
+      end
+    end
+  end
+
+  private
+
+  def print_ssl_info(http)
+    buffered_io = http.instance_variable_get(:@socket)
+    return unless buffered_io
+
+    socket = buffered_io.io
+    return unless socket
+
+    cipher = if Puppet::Util::Platform.jruby?
+               socket.cipher
+             else
+               socket.cipher.first
+             end
+    Puppet.debug("Using #{socket.ssl_version} with cipher #{cipher}")
+  end
+end

data/lib/puppet/http/pool_entry.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+# An entry in the peristent HTTP pool that references the connection and
+# an expiration time for the connection.
+#
+# @api private
+class Puppet::HTTP::PoolEntry
+  attr_reader :connection, :verifier
+
+  def initialize(connection, verifier, expiration_time)
+    @connection = connection
+    @verifier = verifier
+    @expiration_time = expiration_time
+  end
+
+  def expired?(now)
+    @expiration_time <= now
+  end
+end

data/lib/puppet/http/proxy.rb

@@ -0,0 +1,139 @@
+# frozen_string_literal: true
+
+require 'uri'
+require_relative '../../puppet/ssl/openssl_loader'
+
+module Puppet::HTTP::Proxy
+  def self.proxy(uri)
+    if http_proxy_host && !no_proxy?(uri)
+      Net::HTTP.new(uri.host, uri.port, http_proxy_host, http_proxy_port, http_proxy_user, http_proxy_password)
+    else
+      http = Net::HTTP.new(uri.host, uri.port, nil, nil, nil, nil)
+      # Net::HTTP defaults the proxy port even though we said not to
+      # use one. Set it to nil so caller is not surprised
+      http.proxy_port = nil
+      http
+    end
+  end
+
+  def self.http_proxy_env
+    # Returns a URI object if proxy is set, or nil
+    proxy_env = ENV.fetch("http_proxy", nil) || ENV.fetch("HTTP_PROXY", nil)
+    begin
+      return URI.parse(proxy_env) if proxy_env
+    rescue URI::InvalidURIError
+      return nil
+    end
+    nil
+  end
+
+  # The documentation around the format of the no_proxy variable seems
+  # inconsistent.  Some suggests the use of the * as a way of matching any
+  # hosts under a domain, e.g.:
+  #   *.example.com
+  # Other documentation suggests that just a leading '.' indicates a domain
+  # level exclusion, e.g.:
+  #   .example.com
+  # We'll accommodate both here.
+  def self.no_proxy?(dest)
+    no_proxy = self.no_proxy
+    unless no_proxy
+      return false
+    end
+
+    unless dest.is_a? URI
+      begin
+        dest = URI.parse(dest)
+      rescue URI::InvalidURIError
+        return false
+      end
+    end
+
+    no_proxy.split(/\s*,\s*/).each do |d|
+      host, port = d.split(':')
+      host = Regexp.escape(host).gsub('\*', '.*')
+
+      # If this no_proxy entry specifies a port, we want to match it against
+      # the destination port.  Otherwise just match hosts.
+      if port
+        no_proxy_regex  = /#{host}:#{port}$/
+        dest_string     = "#{dest.host}:#{dest.port}"
+      else
+        no_proxy_regex  = /#{host}$/
+        dest_string     = dest.host.to_s
+      end
+
+      if no_proxy_regex.match(dest_string)
+        return true
+      end
+    end
+
+    false
+  end
+
+  def self.http_proxy_host
+    env = http_proxy_env
+
+    if env and env.host
+      return env.host
+    end
+
+    if Puppet.settings[:http_proxy_host] == 'none'
+      return nil
+    end
+
+    Puppet.settings[:http_proxy_host]
+  end
+
+  def self.http_proxy_port
+    env = http_proxy_env
+
+    if env and env.port
+      return env.port
+    end
+
+    Puppet.settings[:http_proxy_port]
+  end
+
+  def self.http_proxy_user
+    env = http_proxy_env
+
+    if env and env.user
+      return env.user
+    end
+
+    if Puppet.settings[:http_proxy_user] == 'none'
+      return nil
+    end
+
+    Puppet.settings[:http_proxy_user]
+  end
+
+  def self.http_proxy_password
+    env = http_proxy_env
+
+    if env and env.password
+      return env.password
+    end
+
+    if Puppet.settings[:http_proxy_user] == 'none' or Puppet.settings[:http_proxy_password] == 'none'
+      return nil
+    end
+
+    Puppet.settings[:http_proxy_password]
+  end
+
+  def self.no_proxy
+    no_proxy_env = ENV.fetch("no_proxy", nil) || ENV.fetch("NO_PROXY", nil)
+
+    if no_proxy_env
+      return no_proxy_env
+    end
+
+    if Puppet.settings[:no_proxy] == 'none'
+      return nil
+    end
+
+    Puppet.settings[:no_proxy]
+  end
+end

data/lib/puppet/http/redirector.rb

@@ -0,0 +1,87 @@
+# frozen_string_literal: true
+
+# Handle HTTP redirects
+#
+# @api private
+class Puppet::HTTP::Redirector
+  # Create a new redirect handler
+  #
+  # @param [Integer] redirect_limit maximum number of redirects allowed
+  #
+  # @api private
+  def initialize(redirect_limit)
+    @redirect_limit = redirect_limit
+  end
+
+  # Determine of the HTTP response code indicates a redirect
+  #
+  # @param [Net::HTTP] request request that received the response
+  # @param [Puppet::HTTP::Response] response
+  #
+  # @return [Boolean] true if the response code is 301, 302, or 307.
+  #
+  # @api private
+  def redirect?(request, response)
+    # Net::HTTPRedirection is not used because historically puppet
+    # has only handled these, and we're not a browser
+    case response.code
+    when 301, 302, 307
+      true
+    else
+      false
+    end
+  end
+
+  # Implement the HTTP request redirection
+  #
+  # @param [Net::HTTP] request request that has been redirected
+  # @param [Puppet::HTTP::Response] response
+  # @param [Integer] redirects the current number of redirects
+  #
+  # @return [Net::HTTP] A new request based on the original request, but with
+  #   the redirected location
+  #
+  # @api private
+  def redirect_to(request, response, redirects)
+    raise Puppet::HTTP::TooManyRedirects, request.uri if redirects >= @redirect_limit
+
+    location = parse_location(response)
+    url = request.uri.merge(location)
+
+    new_request = request.class.new(url)
+    new_request.body = request.body
+    request.each do |header, value|
+      unless Puppet[:location_trusted]
+        # skip adding potentially sensitive header to other hosts
+        next if header.casecmp('Authorization').zero? && request.uri.host.casecmp(location.host) != 0
+        next if header.casecmp('Cookie').zero? && request.uri.host.casecmp(location.host) != 0
+      end
+      # Allow Net::HTTP to set its own Accept-Encoding header to avoid errors with HTTP compression.
+      # See https://github.com/puppetlabs/puppet/issues/9143
+      next if header.casecmp('Accept-Encoding').zero?
+
+      new_request[header] = value
+    end
+
+    # mimic private Net::HTTP#addr_port
+    new_request['Host'] = if (location.scheme == 'https' && location.port == 443) ||
+                             (location.scheme == 'http' && location.port == 80)
+                            location.host
+                          else
+                            "#{location.host}:#{location.port}"
+                          end
+
+    new_request
+  end
+
+  private
+
+  def parse_location(response)
+    location = response['location']
+    raise Puppet::HTTP::ProtocolError, _("Location response header is missing") unless location
+
+    URI.parse(location)
+  rescue URI::InvalidURIError => e
+    raise Puppet::HTTP::ProtocolError.new(_("Location URI is invalid: %{detail}") % { detail: e.message }, e)
+  end
+end

data/lib/puppet/http/resolver/server_list.rb

@@ -0,0 +1,88 @@
+# frozen_string_literal: true
+
+# Use the server_list setting to resolve a service. This resolver is only used
+# if server_list is set either on the command line or in the configuration file.
+#
+# @api public
+class Puppet::HTTP::Resolver::ServerList < Puppet::HTTP::Resolver
+  # Create a server list resolver.
+  #
+  # @param [Puppet::HTTP::Client] client
+  # @param [Array<String>] server_list_setting array of servers set via the
+  #   configuration or the command line
+  # @param [Integer] default_port if a port is not set for a server in
+  #   server_list, use this port
+  # @param [Array<Symbol>] services array of services that server_list can be
+  #   used to resolve. If a service is not included in this array, this resolver
+  #   will return nil.
+  #
+  def initialize(client, server_list_setting:, default_port:, services:)
+    @client = client
+    @server_list_setting = server_list_setting
+    @default_port = default_port
+    @services = services
+  end
+
+  # Walk the server_list to find a server and port that will connect successfully.
+  #
+  # @param [Puppet::HTTP::Session] session
+  # @param [Symbol] name the name of the service being resolved
+  # @param [Puppet::SSL::SSLContext] ssl_context
+  # @param [Proc] canceled_handler optional callback allowing a resolver
+  #   to cancel resolution.
+  #
+  # @return [nil] return nil if the service to be resolved does not support
+  #   server_list
+  # @return [Puppet::HTTP::Service] a validated service to use for future HTTP
+  #   requests
+  #
+  # @raise [Puppet::Error] raise if none of the servers defined in server_list
+  #   are available
+  #
+  # @api public
+  def resolve(session, name, ssl_context: nil, canceled_handler: nil)
+    # If we're configured to use an explicit service host, e.g. report_server
+    # then don't use server_list to resolve the `:report` service.
+    return nil unless @services.include?(name)
+
+    # If we resolved the URL already, use its host & port for the service
+    if @resolved_url
+      return Puppet::HTTP::Service.create_service(@client, session, name, @resolved_url.host, @resolved_url.port)
+    end
+
+    # Return the first simple service status endpoint we can connect to
+    @server_list_setting.value.each_with_index do |server, index|
+      host = server[0]
+      port = server[1] || @default_port
+
+      service = Puppet::HTTP::Service.create_service(@client, session, :puppetserver, host, port)
+      begin
+        service.get_simple_status(ssl_context: ssl_context)
+        @resolved_url = service.url
+        return Puppet::HTTP::Service.create_service(@client, session, name, @resolved_url.host, @resolved_url.port)
+      rescue Puppet::HTTP::ResponseError => detail
+        if index < @server_list_setting.value.length - 1
+          Puppet.warning(_("Puppet server %{host}:%{port} is unavailable: %{code} %{reason}") %
+                              { host: service.url.host, port: service.url.port, code: detail.response.code, reason: detail.response.reason } +
+                              ' ' + _("Trying with next server from server_list."))
+        else
+          Puppet.log_exception(detail, _("Puppet server %{host}:%{port} is unavailable: %{code} %{reason}") %
+                               { host: service.url.host, port: service.url.port, code: detail.response.code, reason: detail.response.reason })
+        end
+      rescue Puppet::HTTP::HTTPError => detail
+        if index < @server_list_setting.value.length - 1
+          Puppet.warning(_("Unable to connect to server from server_list setting: %{detail}") % { detail: detail } +
+                             ' ' + _("Trying with next server from server_list."))
+        else
+          Puppet.log_exception(detail, _("Unable to connect to server from server_list setting: %{detail}") % { detail: detail })
+        end
+      end
+    end
+
+    # don't fallback to other resolvers
+    canceled_handler.call(true) if canceled_handler
+
+    # not found
+    nil
+  end
+end