openvox 8.19.0

data/lib/puppet/indirector/file_server.rb

@@ -0,0 +1,57 @@
+# frozen_string_literal: true
+
+require_relative '../../puppet/file_serving/configuration'
+require_relative '../../puppet/file_serving/fileset'
+require_relative '../../puppet/file_serving/terminus_helper'
+require_relative '../../puppet/indirector/terminus'
+
+# Look files up using the file server.
+class Puppet::Indirector::FileServer < Puppet::Indirector::Terminus
+  include Puppet::FileServing::TerminusHelper
+
+  # Is the client authorized to perform this action?
+  def authorized?(request)
+    return false unless [:find, :search].include?(request.method)
+
+    mount, _ = configuration.split_path(request)
+
+    # If we're not serving this mount, then access is denied.
+    return false unless mount
+
+    true
+  end
+
+  # Find our key using the fileserver.
+  def find(request)
+    mount, relative_path = configuration.split_path(request)
+
+    return nil unless mount
+
+    # The mount checks to see if the file exists, and returns nil
+    # if not.
+    path = mount.find(relative_path, request)
+    return nil unless path
+
+    path2instance(request, path)
+  end
+
+  # Search for files.  This returns an array rather than a single
+  # file.
+  def search(request)
+    mount, relative_path = configuration.split_path(request)
+
+    paths = mount.search(relative_path, request) if mount
+    unless paths
+      Puppet.info _("Could not find filesystem info for file '%{request}' in environment %{env}") % { request: request.key, env: request.environment }
+      return nil
+    end
+    path2instances(request, *paths)
+  end
+
+  private
+
+  # Our fileserver configuration, if needed.
+  def configuration
+    Puppet::FileServing::Configuration.configuration
+  end
+end

data/lib/puppet/indirector/generic_http.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+require_relative '../../puppet/file_serving/terminus_helper'
+
+class Puppet::Indirector::GenericHttp < Puppet::Indirector::Terminus
+  desc "Retrieve data from a remote HTTP server."
+end

data/lib/puppet/indirector/hiera.rb

@@ -0,0 +1,101 @@
+# frozen_string_literal: true
+
+require_relative '../../puppet/indirector/terminus'
+require 'hiera/scope'
+
+# This class can't be collapsed into Puppet::Indirector::DataBindings::Hiera
+# because some community plugins rely on this class directly, see PUP-1843.
+# This class is deprecated and will be deleted in a future release.
+# Use `Puppet::DataBinding.indirection.terminus(:hiera)` instead.
+class Puppet::Indirector::Hiera < Puppet::Indirector::Terminus
+  def initialize(*args)
+    unless Puppet.features.hiera?
+      # TRANSLATORS "Hiera" is the name of a code library and should not be translated
+      raise _("Hiera terminus not supported without hiera library")
+    end
+
+    super
+  end
+
+  if defined?(::Psych::SyntaxError)
+    DataBindingExceptions = [::StandardError, ::Psych::SyntaxError]
+  else
+    DataBindingExceptions = [::StandardError]
+  end
+
+  def find(request)
+    not_found = Object.new
+    options = request.options
+    Puppet.debug { "Performing a hiera indirector lookup of #{request.key} with options #{options.inspect}" }
+    value = hiera.lookup(request.key, not_found, Hiera::Scope.new(options[:variables]), nil, convert_merge(options[:merge]))
+    throw :no_such_key if value.equal?(not_found)
+    value
+  rescue *DataBindingExceptions => detail
+    error = Puppet::DataBinding::LookupError.new("DataBinding 'hiera': #{detail.message}")
+    error.set_backtrace(detail.backtrace)
+    raise error
+  end
+
+  private
+
+  # Converts a lookup 'merge' parameter argument into a Hiera 'resolution_type' argument.
+  #
+  # @param merge [String,Hash,nil] The lookup 'merge' argument
+  # @return [Symbol,Hash,nil] The Hiera 'resolution_type'
+  def convert_merge(merge)
+    case merge
+    when nil, 'first'
+      # Nil is OK. Defaults to Hiera :priority
+      nil
+    when Puppet::Pops::MergeStrategy
+      convert_merge(merge.configuration)
+    when 'unique'
+      # Equivalent to Hiera :array
+      :array
+    when 'hash'
+      # Equivalent to Hiera :hash with default :native merge behavior. A Hash must be passed here
+      # to override possible Hiera deep merge config settings.
+      { :behavior => :native }
+    when 'deep'
+      # Equivalent to Hiera :hash with :deeper merge behavior.
+      { :behavior => :deeper }
+    when Hash
+      strategy = merge['strategy']
+      if strategy == 'deep'
+        result = { :behavior => :deeper }
+        # Remaining entries must have symbolic keys
+        merge.each_pair { |k, v| result[k.to_sym] = v unless k == 'strategy' }
+        result
+      else
+        convert_merge(strategy)
+      end
+    else
+      # TRANSLATORS "merge" is a parameter name and should not be translated
+      raise Puppet::DataBinding::LookupError, _("Unrecognized value for request 'merge' parameter: '%{merge}'") % { merge: merge }
+    end
+  end
+
+  public
+
+  def self.hiera_config
+    hiera_config = Puppet.settings[:hiera_config]
+    config = {}
+
+    if Puppet::FileSystem.exist?(hiera_config)
+      config = Hiera::Config.load(hiera_config)
+    else
+      Puppet.warning _("Config file %{hiera_config} not found, using Hiera defaults") % { hiera_config: hiera_config }
+    end
+
+    config[:logger] = 'puppet'
+    config
+  end
+
+  def self.hiera
+    @hiera ||= Hiera.new(:config => hiera_config)
+  end
+
+  def hiera
+    self.class.hiera
+  end
+end

data/lib/puppet/indirector/indirection.rb

@@ -0,0 +1,381 @@
+# frozen_string_literal: true
+
+require_relative '../../puppet/util/docs'
+require_relative '../../puppet/util/profiler'
+require_relative '../../puppet/indirector/envelope'
+require_relative '../../puppet/indirector/request'
+require_relative '../../puppet/thread_local'
+
+# The class that connects functional classes with their different collection
+# back-ends.  Each indirection has a set of associated terminus classes,
+# each of which is a subclass of Puppet::Indirector::Terminus.
+class Puppet::Indirector::Indirection
+  include Puppet::Util::Docs
+
+  attr_accessor :name, :model
+  attr_reader :termini
+
+  @@indirections = []
+
+  # Find an indirection by name.  This is provided so that Terminus classes
+  # can specifically hook up with the indirections they are associated with.
+  def self.instance(name)
+    @@indirections.find { |i| i.name == name }
+  end
+
+  # Return a list of all known indirections.  Used to generate the
+  # reference.
+  def self.instances
+    @@indirections.collect(&:name)
+  end
+
+  # Find an indirected model by name.  This is provided so that Terminus classes
+  # can specifically hook up with the indirections they are associated with.
+  def self.model(name)
+    match = @@indirections.find { |i| i.name == name }
+    return nil unless match
+
+    match.model
+  end
+
+  # Create and return our cache terminus.
+  def cache
+    raise Puppet::DevError, _("Tried to cache when no cache class was set") unless cache_class
+
+    terminus(cache_class)
+  end
+
+  # Should we use a cache?
+  def cache?
+    cache_class ? true : false
+  end
+
+  def cache_class
+    @cache_class.value
+  end
+
+  # Define a terminus class to be used for caching.
+  def cache_class=(class_name)
+    validate_terminus_class(class_name) if class_name
+    @cache_class.value = class_name
+  end
+
+  # This is only used for testing.
+  def delete
+    @@indirections.delete(self) if @@indirections.include?(self)
+  end
+
+  # Set the time-to-live for instances created through this indirection.
+  def ttl=(value)
+    # TRANSLATORS "TTL" stands for "time to live" and refers to a duration of time
+    raise ArgumentError, _("Indirection TTL must be an integer") unless value.is_a?(Integer)
+
+    @ttl = value
+  end
+
+  # Default to the runinterval for the ttl.
+  def ttl
+    @ttl ||= Puppet[:runinterval]
+  end
+
+  # Calculate the expiration date for a returned instance.
+  def expiration
+    Time.now + ttl
+  end
+
+  # Generate the full doc string.
+  def doc
+    text = ''.dup
+
+    text << scrub(@doc) << "\n\n" if @doc
+
+    text << "* **Indirected Class**: `#{@indirected_class}`\n";
+    if terminus_setting
+      text << "* **Terminus Setting**: #{terminus_setting}\n"
+    end
+
+    text
+  end
+
+  def initialize(model, name, doc: nil, indirected_class: nil, cache_class: nil, terminus_class: nil, terminus_setting: nil, extend: nil)
+    @model = model
+    @name = name
+    @termini = {}
+
+    @doc = doc
+
+    raise(ArgumentError, _("Indirection %{name} is already defined") % { name: @name }) if @@indirections.find { |i| i.name == @name }
+
+    @@indirections << self
+
+    @indirected_class = indirected_class
+    self.extend(extend) if extend
+
+    # Setting these depend on the indirection already being installed so they have to be at the end
+    set_global_setting(:cache_class, cache_class)
+    set_global_setting(:terminus_class, terminus_class)
+    set_global_setting(:terminus_setting, terminus_setting)
+  end
+
+  # Use this to set indirector settings globally across threads.
+  def set_global_setting(setting, value)
+    case setting
+    when :cache_class
+      validate_terminus_class(value) unless value.nil?
+      @cache_class = Puppet::ThreadLocal.new(value)
+    when :terminus_class
+      validate_terminus_class(value) unless value.nil?
+      @terminus_class = Puppet::ThreadLocal.new(value)
+    when :terminus_setting
+      @terminus_setting = Puppet::ThreadLocal.new(value)
+    else
+      raise(ArgumentError, _("The setting %{setting} is not a valid indirection setting.") % { setting: setting })
+    end
+  end
+
+  # Set up our request object.
+  def request(*args)
+    Puppet::Indirector::Request.new(name, *args)
+  end
+
+  # Return the singleton terminus for this indirection.
+  def terminus(terminus_name = nil)
+    # Get the name of the terminus.
+    raise Puppet::DevError, _("No terminus specified for %{name}; cannot redirect") % { name: name } unless terminus_name ||= terminus_class
+
+    termini[terminus_name] ||= make_terminus(terminus_name)
+  end
+
+  # These can be used to select the terminus class.
+  def terminus_setting
+    @terminus_setting.value
+  end
+
+  def terminus_setting=(setting)
+    @terminus_setting.value = setting
+  end
+
+  # Determine the terminus class.
+  def terminus_class
+    unless @terminus_class.value
+      setting = terminus_setting
+      if setting
+        self.terminus_class = Puppet.settings[setting]
+      else
+        raise Puppet::DevError, _("No terminus class nor terminus setting was provided for indirection %{name}") % { name: name }
+      end
+    end
+    @terminus_class.value
+  end
+
+  def reset_terminus_class
+    @terminus_class.value = nil
+  end
+
+  # Specify the terminus class to use.
+  def terminus_class=(klass)
+    validate_terminus_class(klass)
+    @terminus_class.value = klass
+  end
+
+  # This is used by terminus_class= and cache=.
+  def validate_terminus_class(terminus_class)
+    unless terminus_class and terminus_class.to_s != ""
+      raise ArgumentError, _("Invalid terminus name %{terminus_class}") % { terminus_class: terminus_class.inspect }
+    end
+
+    unless Puppet::Indirector::Terminus.terminus_class(name, terminus_class)
+      raise ArgumentError, _("Could not find terminus %{terminus_class} for indirection %{name}") %
+                           { terminus_class: terminus_class, name: name }
+    end
+  end
+
+  # Expire a cached object, if one is cached.  Note that we don't actually
+  # remove it, we expire it and write it back out to disk.  This way people
+  # can still use the expired object if they want.
+  def expire(key, options = {})
+    request = request(:expire, key, nil, options)
+
+    return nil unless cache? && !request.ignore_cache_save?
+
+    instance = cache.find(request(:find, key, nil, options))
+    return nil unless instance
+
+    Puppet.info _("Expiring the %{cache} cache of %{instance}") % { cache: name, instance: instance.name }
+
+    # Set an expiration date in the past
+    instance.expiration = Time.now - 60
+
+    cache.save(request(:save, nil, instance, options))
+  end
+
+  def allow_remote_requests?
+    terminus.allow_remote_requests?
+  end
+
+  # Search for an instance in the appropriate terminus, caching the
+  # results if caching is configured..
+  def find(key, options = {})
+    request = request(:find, key, nil, options)
+    terminus = prepare(request)
+
+    result = find_in_cache(request)
+    if !result.nil?
+      result
+    elsif request.ignore_terminus?
+      nil
+    else
+      # Otherwise, return the result from the terminus, caching if
+      # appropriate.
+      result = terminus.find(request)
+      unless result.nil?
+        result.expiration ||= expiration if result.respond_to?(:expiration)
+        if cache? && !request.ignore_cache_save?
+          Puppet.info _("Caching %{indirection} for %{request}") % { indirection: name, request: request.key }
+          begin
+            cache.save request(:save, key, result, options)
+          rescue => detail
+            Puppet.log_exception(detail)
+            raise detail
+          end
+        end
+
+        filtered = result
+        if terminus.respond_to?(:filter)
+          Puppet::Util::Profiler.profile(_("Filtered result for %{indirection} %{request}") % { indirection: name, request: request.key }, [:indirector, :filter, name, request.key]) do
+            filtered = terminus.filter(result)
+          rescue Puppet::Error => detail
+            Puppet.log_exception(detail)
+            raise detail
+          end
+        end
+        filtered
+      end
+    end
+  end
+
+  # Search for an instance in the appropriate terminus, and return a
+  # boolean indicating whether the instance was found.
+  def head(key, options = {})
+    request = request(:head, key, nil, options)
+    terminus = prepare(request)
+
+    # Look in the cache first, then in the terminus.  Force the result
+    # to be a boolean.
+    !!(find_in_cache(request) || terminus.head(request))
+  end
+
+  def find_in_cache(request)
+    # See if our instance is in the cache and up to date.
+    cached = cache.find(request) if cache? && !request.ignore_cache?
+    return nil unless cached
+
+    if cached.expired?
+      Puppet.info _("Not using expired %{indirection} for %{request} from cache; expired at %{expiration}") % { indirection: name, request: request.key, expiration: cached.expiration }
+      return nil
+    end
+
+    Puppet.debug { "Using cached #{name} for #{request.key}" }
+    cached
+  rescue => detail
+    Puppet.log_exception(detail, _("Cached %{indirection} for %{request} failed: %{detail}") % { indirection: name, request: request.key, detail: detail })
+    nil
+  end
+
+  # Remove something via the terminus.
+  def destroy(key, options = {})
+    request = request(:destroy, key, nil, options)
+    terminus = prepare(request)
+
+    result = terminus.destroy(request)
+
+    if cache? and cache.find(request(:find, key, nil, options))
+      # Reuse the existing request, since it's equivalent.
+      cache.destroy(request)
+    end
+
+    result
+  end
+
+  # Search for more than one instance.  Should always return an array.
+  def search(key, options = {})
+    request = request(:search, key, nil, options)
+    terminus = prepare(request)
+
+    result = terminus.search(request)
+    if result
+      raise Puppet::DevError, _("Search results from terminus %{terminus_name} are not an array") % { terminus_name: terminus.name } unless result.is_a?(Array)
+
+      result.each do |instance|
+        next unless instance.respond_to? :expiration
+
+        instance.expiration ||= expiration
+      end
+      result
+    end
+  end
+
+  # Save the instance in the appropriate terminus.  This method is
+  # normally an instance method on the indirected class.
+  def save(instance, key = nil, options = {})
+    request = request(:save, key, instance, options)
+    terminus = prepare(request)
+
+    result = terminus.save(request) unless request.ignore_terminus?
+
+    # If caching is enabled, save our document there
+    cache.save(request) if cache? && !request.ignore_cache_save?
+
+    result
+  end
+
+  private
+
+  # Check authorization if there's a hook available; fail if there is one
+  # and it returns false.
+  def check_authorization(request, terminus)
+    # At this point, we're assuming authorization makes no sense without
+    # client information.
+    return unless request.node
+
+    # This is only to authorize via a terminus-specific authorization hook.
+    return unless terminus.respond_to?(:authorized?)
+
+    unless terminus.authorized?(request)
+      msg = if request.options.empty?
+              _("Not authorized to call %{method} on %{description}") %
+                { method: request.method, description: request.description }
+            else
+              _("Not authorized to call %{method} on %{description} with %{option}") %
+                { method: request.method, description: request.description, option: request.options.inspect }
+            end
+      raise ArgumentError, msg
+    end
+  end
+
+  # Pick the appropriate terminus, check the request's authorization, and return it.
+  # @param [Puppet::Indirector::Request] request instance
+  # @return [Puppet::Indirector::Terminus] terminus instance (usually a subclass
+  #   of Puppet::Indirector::Terminus) for this request
+  def prepare(request)
+    # Pick our terminus.
+    terminus_name = terminus_class
+
+    dest_terminus = terminus(terminus_name)
+    check_authorization(request, dest_terminus)
+    dest_terminus.validate(request)
+
+    dest_terminus
+  end
+
+  # Create a new terminus instance.
+  def make_terminus(terminus_class)
+    # Load our terminus class.
+    klass = Puppet::Indirector::Terminus.terminus_class(name, terminus_class)
+    unless klass
+      raise ArgumentError, _("Could not find terminus %{terminus_class} for indirection %{indirection}") % { terminus_class: terminus_class, indirection: name }
+    end
+
+    klass.new
+  end
+end

data/lib/puppet/indirector/json.rb

@@ -0,0 +1,82 @@
+# frozen_string_literal: true
+
+require_relative '../../puppet/indirector/terminus'
+require_relative '../../puppet/util'
+
+# The base class for JSON indirection terminus implementations.
+#
+# This should generally be preferred to the YAML base for any future
+# implementations, since it is faster and can load untrusted data safely.
+class Puppet::Indirector::JSON < Puppet::Indirector::Terminus
+  def find(request)
+    load_json_from_file(path(request.key), request.key)
+  end
+
+  def save(request)
+    filename = path(request.key)
+    FileUtils.mkdir_p(File.dirname(filename))
+
+    Puppet::FileSystem.replace_file(filename, 0o660) { |f| f.print to_json(request.instance).force_encoding(Encoding::BINARY) }
+  rescue TypeError => detail
+    Puppet.log_exception(detail, _("Could not save %{json} %{request}: %{detail}") % { json: name, request: request.key, detail: detail })
+  end
+
+  def destroy(request)
+    Puppet::FileSystem.unlink(path(request.key))
+  rescue => detail
+    unless detail.is_a? Errno::ENOENT
+      raise Puppet::Error, _("Could not destroy %{json} %{request}: %{detail}") % { json: name, request: request.key, detail: detail }, detail.backtrace
+    end
+
+    1 # emulate success...
+  end
+
+  def search(request)
+    Dir.glob(path(request.key)).collect do |file|
+      load_json_from_file(file, request.key)
+    end
+  end
+
+  # Return the path to a given node's file.
+  def path(name, ext = '.json')
+    if name =~ Puppet::Indirector::BadNameRegexp then
+      Puppet.crit(_("directory traversal detected in %{json}: %{name}") % { json: self.class, name: name.inspect })
+      raise ArgumentError, _("invalid key")
+    end
+
+    base = data_dir
+    File.join(base, self.class.indirection_name.to_s, name.to_s + ext)
+  end
+
+  private
+
+  def data_dir
+    Puppet.run_mode.server? ? Puppet[:server_datadir] : Puppet[:client_datadir]
+  end
+
+  def load_json_from_file(file, key)
+    json = nil
+
+    begin
+      json = Puppet::FileSystem.read(file, :encoding => Encoding::BINARY)
+    rescue Errno::ENOENT
+      return nil
+    rescue => detail
+      raise Puppet::Error, _("Could not read JSON data for %{name} %{key}: %{detail}") % { name: indirection.name, key: key, detail: detail }, detail.backtrace
+    end
+
+    begin
+      from_json(json)
+    rescue => detail
+      raise Puppet::Error, _("Could not parse JSON data for %{name} %{key}: %{detail}") % { name: indirection.name, key: key, detail: detail }, detail.backtrace
+    end
+  end
+
+  def from_json(text)
+    model.convert_from('json', text.force_encoding(Encoding::UTF_8))
+  end
+
+  def to_json(object)
+    object.render('json')
+  end
+end

data/lib/puppet/indirector/memory.rb

@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+require_relative '../../puppet/indirector/terminus'
+
+# Manage a memory-cached list of instances.
+class Puppet::Indirector::Memory < Puppet::Indirector::Terminus
+  def initialize
+    clear
+  end
+
+  def clear
+    @instances = {}
+  end
+
+  def destroy(request)
+    raise ArgumentError, _("Could not find %{request} to destroy") % { request: request.key } unless @instances.include?(request.key)
+
+    @instances.delete(request.key)
+  end
+
+  def find(request)
+    @instances[request.key]
+  end
+
+  def search(request)
+    found_keys = @instances.keys.find_all { |key| key.include?(request.key) }
+    found_keys.collect { |key| @instances[key] }
+  end
+
+  def head(request)
+    !find(request).nil?
+  end
+
+  def save(request)
+    @instances[request.key] = request.instance
+  end
+end