openvox 8.19.0

data/lib/puppet/http/resolver/settings.rb

@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+# Resolve a service using settings. This is the default resolver if none of the
+# other resolvers find a functional connection.
+#
+# @api public
+class Puppet::HTTP::Resolver::Settings < Puppet::HTTP::Resolver
+  # Resolve a service using the default server and port settings for this service.
+  #
+  # @param [Puppet::HTTP::Session] session
+  # @param [Symbol] name the name of the service to be resolved
+  # @param [Puppet::SSL::SSLContext] ssl_context
+  # @param [Proc] canceled_handler optional callback allowing a resolver
+  #   to cancel resolution.
+  #
+  # @return [Puppet::HTTP::Service] if the service successfully connects,
+  #   return it. Otherwise, return nil.
+  #
+  # @api public
+  def resolve(session, name, ssl_context: nil, canceled_handler: nil)
+    service = Puppet::HTTP::Service.create_service(@client, session, name)
+    check_connection?(session, service, ssl_context: ssl_context) ? service : nil
+  end
+end

data/lib/puppet/http/resolver/srv.rb

@@ -0,0 +1,42 @@
+# frozen_string_literal: true
+
+# Resolve a service using DNS SRV records.
+#
+# @api public
+class Puppet::HTTP::Resolver::SRV < Puppet::HTTP::Resolver
+  # Create an DNS SRV resolver.
+  #
+  # @param [Puppet::HTTP::Client] client
+  # @param [String] domain srv domain
+  # @param [Resolv::DNS] dns
+  #
+  def initialize(client, domain:, dns: Resolv::DNS.new)
+    @client = client
+    @srv_domain = domain
+    @delegate = Puppet::HTTP::DNS.new(dns)
+  end
+
+  # Walk the available srv records and return the first that successfully connects
+  #
+  # @param [Puppet::HTTP::Session] session
+  # @param [Symbol] name the service being resolved
+  # @param [Puppet::SSL::SSLContext] ssl_context
+  # @param [Proc] canceled_handler optional callback allowing a resolver
+  #   to cancel resolution.
+  #
+  # @return [Puppet::HTTP::Service] if an available service is found, return
+  #   it. Return nil otherwise.
+  #
+  # @api public
+  def resolve(session, name, ssl_context: nil, canceled_handler: nil)
+    # Here we pass our HTTP service name as the DNS SRV service name
+    # This is fine for :ca, but note that :puppet and :file are handled
+    # specially in `each_srv_record`.
+    @delegate.each_srv_record(@srv_domain, name) do |server, port|
+      service = Puppet::HTTP::Service.create_service(@client, session, name, server, port)
+      return service if check_connection?(session, service, ssl_context: ssl_context)
+    end
+
+    nil
+  end
+end

data/lib/puppet/http/resolver.rb

@@ -0,0 +1,50 @@
+# frozen_string_literal: true
+
+# Resolver base class. Each resolver represents a different strategy for
+# resolving a service name into a list of candidate servers and ports.
+#
+# @abstract Subclass and override {#resolve} to create a new resolver.
+# @api public
+class Puppet::HTTP::Resolver
+  #
+  # Create a new resolver.
+  #
+  # @param [Puppet::HTTP::Client] client
+  def initialize(client)
+    @client = client
+  end
+
+  # Return a working server/port for the resolver. This is the base
+  # implementation and is meant to be a placeholder.
+  #
+  # @param [Puppet::HTTP::Session] session
+  # @param [Symbol] name the service to resolve
+  # @param [Puppet::SSL::SSLContext] ssl_context (nil) optional ssl context to
+  #   use when creating a connection
+  # @param [Proc] canceled_handler (nil) optional callback allowing a resolver
+  #   to cancel resolution.
+  #
+  # @raise [NotImplementedError] this base class is not implemented
+  #
+  # @api public
+  def resolve(session, name, ssl_context: nil, canceled_handler: nil)
+    raise NotImplementedError
+  end
+
+  # Check a given connection to establish if it can be relied on for future use.
+  #
+  # @param [Puppet::HTTP::Session] session
+  # @param [Puppet::HTTP::Service] service
+  # @param [Puppet::SSL::SSLContext] ssl_context
+  #
+  # @return [Boolean] Returns true if a connection is successful, false otherwise
+  #
+  # @api public
+  def check_connection?(session, service, ssl_context: nil)
+    service.connect(ssl_context: ssl_context)
+    true
+  rescue Puppet::HTTP::ConnectionError => e
+    Puppet.log_exception(e, "Connection to #{service.url} failed, trying next route: #{e.message}")
+    false
+  end
+end

data/lib/puppet/http/response.rb

@@ -0,0 +1,104 @@
+# frozen_string_literal: true
+
+# Represents the response returned from the server from an HTTP request.
+#
+# @api abstract
+# @api public
+class Puppet::HTTP::Response
+  # @return [URI] the response url
+  attr_reader :url
+
+  # Create a response associated with the URL.
+  #
+  # @param [URI] url
+  # @param [Integer] HTTP status
+  # @param [String] HTTP reason
+  def initialize(url, code, reason)
+    @url = url
+    @code = code
+    @reason = reason
+  end
+
+  # Return the response code.
+  #
+  # @return [Integer] Response code for the request
+  #
+  # @api public
+  def code
+    @code
+  end
+
+  # Return the response message.
+  #
+  # @return [String] Response message for the request
+  #
+  # @api public
+  def reason
+    @reason
+  end
+
+  # Returns the entire response body. Can be used instead of
+  #   `Puppet::HTTP::Response.read_body`, but both methods cannot be used for the
+  #   same response.
+  #
+  # @return [String] Response body for the request
+  #
+  # @api public
+  def body
+    raise NotImplementedError
+  end
+
+  # Streams the response body to the caller in chunks. Can be used instead of
+  #   `Puppet::HTTP::Response.body`, but both methods cannot be used for the same
+  #   response.
+  #
+  # @yield [String] Streams the response body in chunks
+  #
+  # @raise [ArgumentError] raise if a block is not given
+  #
+  # @api public
+  def read_body(&block)
+    raise NotImplementedError
+  end
+
+  # Check if the request received a response of success (HTTP 2xx).
+  #
+  # @return [Boolean] Returns true if the response indicates success
+  #
+  # @api public
+  def success?
+    200 <= @code && @code < 300
+  end
+
+  # Get a header case-insensitively.
+  #
+  # @param [String] name The header name
+  # @return [String] The header value
+  #
+  # @api public
+  def [](name)
+    raise NotImplementedError
+  end
+
+  # Yield each header name and value. Returns an enumerator if no block is given.
+  #
+  # @yieldparam [String] header name
+  # @yieldparam [String] header value
+  #
+  # @api public
+  def each_header(&block)
+    raise NotImplementedError
+  end
+
+  # Ensure the response body is fully read so that the server is not blocked
+  # waiting for us to read data from the socket. Also if the caller streamed
+  # the response, but didn't read the data, we need a way to drain the socket
+  # before adding the connection back to the connection pool, otherwise the
+  # unread response data would "leak" into the next HTTP request/response.
+  #
+  # @api public
+  def drain
+    body
+    true
+  end
+end

data/lib/puppet/http/response_converter.rb

@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+module Puppet::HTTP::ResponseConverter
+  module_function
+
+  # Borrowed from puppetserver, see https://github.com/puppetlabs/puppetserver/commit/a1ebeaaa5af590003ccd23c89f808ba4f0c89609
+  def to_ruby_response(response)
+    str_code = response.code.to_s
+
+    # Copied from Net::HTTPResponse because it is private there.
+    clazz = Net::HTTPResponse::CODE_TO_OBJ[str_code] or
+      Net::HTTPResponse::CODE_CLASS_TO_OBJ[str_code[0, 1]] or
+      Net::HTTPUnknownResponse
+    result = clazz.new(nil, str_code, nil)
+    result.body = response.body
+    # This is nasty, nasty.  But apparently there is no way to create
+    # an instance of Net::HttpResponse from outside of the library and have
+    # the body be readable, unless you do stupid things like this.
+    result.instance_variable_set(:@read, true)
+    response.each_header do |k, v|
+      result[k] = v
+    end
+    result
+  end
+end

data/lib/puppet/http/response_net_http.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+# Adapts Net::HTTPResponse to Puppet::HTTP::Response
+#
+# @api public
+class Puppet::HTTP::ResponseNetHTTP < Puppet::HTTP::Response
+  # Create a response associated with the URL.
+  #
+  # @param [URI] url
+  # @param [Net::HTTPResponse] nethttp The response
+  def initialize(url, nethttp)
+    super(url, nethttp.code.to_i, nethttp.message)
+
+    @nethttp = nethttp
+  end
+
+  # (see Puppet::HTTP::Response#body)
+  def body
+    @nethttp.body
+  end
+
+  # (see Puppet::HTTP::Response#read_body)
+  def read_body(&block)
+    raise ArgumentError, "A block is required" unless block_given?
+
+    @nethttp.read_body(&block)
+  end
+
+  # (see Puppet::HTTP::Response#success?)
+  def success?
+    @nethttp.is_a?(Net::HTTPSuccess)
+  end
+
+  # (see Puppet::HTTP::Response#[])
+  def [](name)
+    @nethttp[name]
+  end
+
+  # (see Puppet::HTTP::Response#each_header)
+  def each_header(&block)
+    @nethttp.each_header(&block)
+  end
+end

data/lib/puppet/http/retry_after_handler.rb

@@ -0,0 +1,78 @@
+# frozen_string_literal: true
+
+require 'date'
+require 'time'
+
+# Parse information relating to responses containing a Retry-After headers
+#
+# @api private
+class Puppet::HTTP::RetryAfterHandler
+  # Create a handler to allow the system to sleep between HTTP requests
+  #
+  # @param [Integer] retry_limit number of retries allowed
+  # @param [Integer] max_sleep maximum sleep time allowed
+  def initialize(retry_limit, max_sleep)
+    @retry_limit = retry_limit
+    @max_sleep = max_sleep
+  end
+
+  # Does the response from the server tell us to wait until we attempt the next
+  # retry?
+  #
+  # @param [Net::HTTP] request
+  # @param [Puppet::HTTP::Response] response
+  #
+  # @return [Boolean] Return true if the response code is 429 or 503, return
+  #   false otherwise
+  #
+  # @api private
+  def retry_after?(request, response)
+    case response.code
+    when 429, 503
+      true
+    else
+      false
+    end
+  end
+
+  # The amount of time to wait before attempting a retry
+  #
+  # @param [Net::HTTP] request
+  # @param [Puppet::HTTP::Response] response
+  # @param [Integer] retries number of retries attempted so far
+  #
+  # @return [Integer] the amount of time to wait
+  #
+  # @raise [Puppet::HTTP::TooManyRetryAfters] raise if we have hit our retry
+  #   limit
+  #
+  # @api private
+  def retry_after_interval(request, response, retries)
+    raise Puppet::HTTP::TooManyRetryAfters, request.uri if retries >= @retry_limit
+
+    retry_after = response['Retry-After']
+    return nil unless retry_after
+
+    seconds = parse_retry_after(retry_after)
+
+    # if retry-after is far in the future, we could end up sleeping repeatedly
+    # for 30 minutes, effectively waiting indefinitely, seems like we should wait
+    # in total for 30 minutes, in which case this upper limit needs to be enforced
+    # by the client.
+    [seconds, @max_sleep].min
+  end
+
+  private
+
+  def parse_retry_after(retry_after)
+    Integer(retry_after)
+  rescue TypeError, ArgumentError
+    begin
+      tm = DateTime.rfc2822(retry_after)
+      seconds = (tm.to_time - DateTime.now.to_time).to_i
+      [seconds, 0].max
+    rescue ArgumentError
+      raise Puppet::HTTP::ProtocolError, _("Failed to parse Retry-After header '%{retry_after}' as an integer or RFC 2822 date") % { retry_after: retry_after }
+    end
+  end
+end

data/lib/puppet/http/service/ca.rb

@@ -0,0 +1,133 @@
+# frozen_string_literal: true
+
+# The CA service is used to handle certificate related REST requests.
+#
+# @api public
+class Puppet::HTTP::Service::Ca < Puppet::HTTP::Service
+  # @return [Hash] default headers for the ca service
+  HEADERS = { 'Accept' => 'text/plain' }.freeze
+
+  # @return [String] default API for the ca service
+  API = '/puppet-ca/v1'
+
+  # Use `Puppet::HTTP::Session.route_to(:ca)` to create or get an instance of this class.
+  #
+  # @param [Puppet::HTTP::Client] client
+  # @param [Puppet::HTTP::Session] session
+  # @param [String] server (`Puppet[:ca_server]`) If an explicit server is given,
+  #   create a service using that server. If server is nil, the default value
+  #   is used to create the service.
+  # @param [Integer] port (`Puppet[:ca_port]`) If an explicit port is given, create
+  #   a service using that port. If port is nil, the default value is used to
+  #   create the service.
+  #
+  def initialize(client, session, server, port)
+    url = build_url(API, server || Puppet[:ca_server], port || Puppet[:ca_port])
+    super(client, session, url)
+  end
+
+  # Submit a GET request to retrieve the named certificate from the server.
+  #
+  # @param [String] name name of the certificate to request
+  # @param [Time] if_modified_since If not nil, only download the cert if it has
+  #   been modified since the specified time.
+  # @param [Puppet::SSL::SSLContext] ssl_context
+  #
+  # @return [Array<Puppet::HTTP::Response, String>] An array containing the
+  #   request response and the stringified body of the request response
+  #
+  # @api public
+  def get_certificate(name, if_modified_since: nil, ssl_context: nil)
+    headers = add_puppet_headers(HEADERS)
+    headers['If-Modified-Since'] = if_modified_since.httpdate if if_modified_since
+
+    response = @client.get(
+      with_base_url("/certificate/#{name}"),
+      headers: headers,
+      options: { ssl_context: ssl_context }
+    )
+
+    process_response(response)
+
+    [response, response.body.to_s]
+  end
+
+  # Submit a GET request to retrieve the certificate revocation list from the
+  #   server.
+  #
+  # @param [Time] if_modified_since If not nil, only download the CRL if it has
+  #   been modified since the specified time.
+  # @param [Puppet::SSL::SSLContext] ssl_context
+  #
+  # @return [Array<Puppet::HTTP::Response, String>] An array containing the
+  #   request response and the stringified body of the request response
+  #
+  # @api public
+  def get_certificate_revocation_list(if_modified_since: nil, ssl_context: nil)
+    headers = add_puppet_headers(HEADERS)
+    headers['If-Modified-Since'] = if_modified_since.httpdate if if_modified_since
+
+    response = @client.get(
+      with_base_url("/certificate_revocation_list/ca"),
+      headers: headers,
+      options: { ssl_context: ssl_context }
+    )
+
+    process_response(response)
+
+    [response, response.body.to_s]
+  end
+
+  # Submit a PUT request to send a certificate request to the server.
+  #
+  # @param [String] name The name of the certificate request being sent
+  # @param [OpenSSL::X509::Request] csr Certificate request to send to the
+  #   server
+  # @param [Puppet::SSL::SSLContext] ssl_context
+  #
+  # @return [Puppet::HTTP::Response] The request response
+  #
+  # @api public
+  def put_certificate_request(name, csr, ssl_context: nil)
+    headers = add_puppet_headers(HEADERS)
+    headers['Content-Type'] = 'text/plain'
+
+    response = @client.put(
+      with_base_url("/certificate_request/#{name}"),
+      csr.to_pem,
+      headers: headers,
+      options: {
+        ssl_context: ssl_context
+      }
+    )
+
+    process_response(response)
+
+    response
+  end
+
+  # Submit a POST request to send a certificate renewal request to the server
+  #
+  # @param [Puppet::SSL::SSLContext] ssl_context
+  #
+  # @return [Array<Puppet::HTTP::Response, String>] The request response
+  #
+  # @api public
+  def post_certificate_renewal(ssl_context)
+    headers = add_puppet_headers(HEADERS)
+    headers['Content-Type'] = 'text/plain'
+
+    response = @client.post(
+      with_base_url('/certificate_renewal'),
+      '', # Puppet::HTTP::Client.post requires a body, the API endpoint does not
+      headers: headers,
+      options: { ssl_context: ssl_context }
+    )
+
+    raise ArgumentError, _('SSL context must contain a client certificate.') unless ssl_context.client_cert
+
+    process_response(response)
+
+    [response, response.body.to_s]
+  end
+end