puppet-parse 0.0.1 → 0.0.2

data/lib/vendor/puppet/network/authstore.rb

@@ -0,0 +1,267 @@
+# standard module for determining whether a given hostname or IP has access to
+# the requested resource
+
+require 'ipaddr'
+require 'puppet/util/logging'
+
+module Puppet
+  class AuthStoreError < Puppet::Error; end
+  class AuthorizationError < Puppet::Error; end
+
+  class Network::AuthStore
+    include Puppet::Util::Logging
+
+    # Mark a given pattern as allowed.
+    def allow(pattern)
+      # a simple way to allow anyone at all to connect
+      if pattern == "*"
+        @globalallow = true
+      else
+        store(:allow, pattern)
+      end
+
+      nil
+    end
+
+    # Is a given combination of name and ip address allowed?  If either input
+    # is non-nil, then both inputs must be provided.  If neither input
+    # is provided, then the authstore is considered local and defaults to "true".
+    def allowed?(name, ip)
+      if name or ip
+        # This is probably unnecessary, and can cause some weirdnesses in
+        # cases where we're operating over localhost but don't have a real
+        # IP defined.
+        raise Puppet::DevError, "Name and IP must be passed to 'allowed?'" unless name and ip
+        # else, we're networked and such
+      else
+        # we're local
+        return true
+      end
+
+      # yay insecure overrides
+      return true if globalallow?
+
+      if decl = declarations.find { |d| d.match?(name, ip) }
+        return decl.result
+      end
+
+      info "defaulting to no access for #{name}"
+      false
+    end
+
+    # Deny a given pattern.
+    def deny(pattern)
+      store(:deny, pattern)
+    end
+
+    # Is global allow enabled?
+    def globalallow?
+      @globalallow
+    end
+
+    # does this auth store has any rules?
+    def empty?
+      @globalallow.nil? && @declarations.size == 0
+    end
+
+    def initialize
+      @globalallow = nil
+      @declarations = []
+    end
+
+    def to_s
+      "authstore"
+    end
+
+    def interpolate(match)
+      Thread.current[:declarations] = @declarations.collect { |ace| ace.interpolate(match) }.sort
+    end
+
+    def reset_interpolation
+      Thread.current[:declarations] = nil
+    end
+
+    private
+
+    # returns our ACEs list, but if we have a modification of it
+    # in our current thread, let's return it
+    # this is used if we want to override the this purely immutable list
+    # by a modified version in a multithread safe way.
+    def declarations
+      Thread.current[:declarations] || @declarations
+    end
+
+    # Store the results of a pattern into our hash.  Basically just
+    # converts the pattern and sticks it into the hash.
+    def store(type, pattern)
+      @declarations << Declaration.new(type, pattern)
+      @declarations.sort!
+
+      nil
+    end
+
+    # A single declaration.  Stores the info for a given declaration,
+    # provides the methods for determining whether a declaration matches,
+    # and handles sorting the declarations appropriately.
+    class Declaration
+      include Puppet::Util
+      include Comparable
+
+      # The type of declaration: either :allow or :deny
+      attr_reader :type
+
+      # The name: :ip or :domain
+      attr_accessor :name
+
+      # The pattern we're matching against.  Can be an IPAddr instance,
+      # or an array of strings, resulting from reversing a hostname
+      # or domain name.
+      attr_reader :pattern
+
+      # The length.  Only used for iprange and domain.
+      attr_accessor :length
+
+      # Sort the declarations most specific first.
+      def <=>(other)
+        compare(exact?, other.exact?) ||
+        compare(ip?, other.ip?)  ||
+        ((length != other.length) &&  (other.length <=> length)) ||
+        compare(deny?, other.deny?) ||
+        ( ip? ? pattern.to_s <=> other.pattern.to_s : pattern <=> other.pattern)
+      end
+
+      def deny?
+        type == :deny
+      end
+
+      def exact?
+        @exact == :exact
+      end
+
+      def initialize(type, pattern)
+        self.type = type
+        self.pattern = pattern
+      end
+
+      # Are we an IP type?
+      def ip?
+        name == :ip
+      end
+
+      # Does this declaration match the name/ip combo?
+      def match?(name, ip)
+        if ip?
+          if pattern.include?(IPAddr.new(ip))
+            Puppet.deprecation_warning "Authentication based on IP address is deprecated; please use certname-based rules instead"
+            true
+          else
+            false
+          end
+        else
+          matchname?(name)
+        end
+      end
+
+      # Set the pattern appropriately.  Also sets the name and length.
+      def pattern=(pattern)
+        parse(pattern)
+        @orig = pattern
+      end
+
+      # Mapping a type of statement into a return value.
+      def result
+        type == :allow
+      end
+
+      def to_s
+        "#{type}: #{pattern}"
+      end
+
+      # Set the declaration type.  Either :allow or :deny.
+      def type=(type)
+        type = type.intern
+        raise ArgumentError, "Invalid declaration type #{type}" unless [:allow, :deny].include?(type)
+        @type = type
+      end
+
+      # interpolate a pattern to replace any
+      # backreferences by the given match
+      # for instance if our pattern is $1.reductivelabs.com
+      # and we're called with a MatchData whose capture 1 is puppet
+      # we'll return a pattern of puppet.reductivelabs.com
+      def interpolate(match)
+        clone = dup
+        if @name == :dynamic
+          clone.pattern = clone.pattern.reverse.collect do |p|
+            p.gsub(/\$(\d)/) { |m| match[$1.to_i] }
+          end.join(".")
+        end
+        clone
+      end
+
+      private
+
+      # Returns nil if both values are true or both are false, returns
+      # -1 if the first is true, and 1 if the second is true.  Used
+      # in the <=> operator.
+      def compare(me, them)
+        (me and them) ? nil : me ? -1 : them ? 1 : nil
+      end
+
+      # Does the name match our pattern?
+      def matchname?(name)
+        case @name
+          when :domain, :dynamic, :opaque
+            name = munge_name(name)
+            (pattern == name) or (not exact? and pattern.zip(name).all? { |p,n| p == n })
+          when :regex
+            Regexp.new(pattern.slice(1..-2)).match(name)
+        end
+      end
+
+      # Convert the name to a common pattern.
+      def munge_name(name)
+        # Change to name.downcase.split(".",-1).reverse for FQDN support
+        name.downcase.split(".").reverse
+      end
+
+      # Parse our input pattern and figure out what kind of allowal
+      # statement it is.  The output of this is used for later matching.
+      Octet = '(\d|[1-9]\d|1\d\d|2[0-4]\d|25[0-5])'
+      IPv4 = "#{Octet}\.#{Octet}\.#{Octet}\.#{Octet}"
+      IPv6_full    = "_:_:_:_:_:_:_:_|_:_:_:_:_:_::_?|_:_:_:_:_::((_:)?_)?|_:_:_:_::((_:){0,2}_)?|_:_:_::((_:){0,3}_)?|_:_::((_:){0,4}_)?|_::((_:){0,5}_)?|::((_:){0,6}_)?"
+      IPv6_partial = "_:_:_:_:_:_:|_:_:_:_::(_:)?|_:_::(_:){0,2}|_::(_:){0,3}"
+      # It should be:
+      #     IP = "#{IPv4}|#{IPv6_full}|(#{IPv6_partial}#{IPv4})".gsub(/_/,'([0-9a-fA-F]{1,4})').gsub(/\(/,'(?:')
+      # but ruby's ipaddr lib doesn't support the hybrid format
+      IP = "#{IPv4}|#{IPv6_full}".gsub(/_/,'([0-9a-fA-F]{1,4})').gsub(/\(/,'(?:')
+      def parse(value)
+        @name,@exact,@length,@pattern = *case value
+        when /^(?:#{IP})\/(\d+)$/                                   # 12.34.56.78/24, a001:b002::efff/120, c444:1000:2000::9:192.168.0.1/112
+          [:ip,:inexact,$1.to_i,IPAddr.new(value)]
+        when /^(#{IP})$/                                          # 10.20.30.40,
+          [:ip,:exact,nil,IPAddr.new(value)]
+        when /^(#{Octet}\.){1,3}\*$/                              # an ip address with a '*' at the end
+          segments = value.split(".")[0..-2]
+          bits = 8*segments.length
+          [:ip,:inexact,bits,IPAddr.new((segments+[0,0,0])[0,4].join(".") + "/#{bits}")]
+        when /^(\w[-\w]*\.)+[-\w]+$/                              # a full hostname
+          # Change to /^(\w[-\w]*\.)+[-\w]+\.?$/ for FQDN support
+          [:domain,:exact,nil,munge_name(value)]
+        when /^\*(\.(\w[-\w]*)){1,}$/                             # *.domain.com
+          host_sans_star = munge_name(value)[0..-2]
+          [:domain,:inexact,host_sans_star.length,host_sans_star]
+        when /\$\d+/                                              # a backreference pattern ala $1.reductivelabs.com or 192.168.0.$1 or $1.$2
+          [:dynamic,:exact,nil,munge_name(value)]
+        when /^\w[-.@\w]*$/                                       # ? Just like a host name but allow '@'s and ending '.'s
+          [:opaque,:exact,nil,[value]]
+        when /^\/.*\/$/                                           # a regular expression
+          [:regex,:inexact,nil,value]
+        else
+          raise AuthStoreError, "Invalid pattern #{value}"
+        end
+      end
+    end
+  end
+end
+

data/lib/vendor/puppet/network/client_request.rb

@@ -0,0 +1,29 @@
+module Puppet::Network # :nodoc:
+  # A struct-like class for passing around a client request.  It's mostly
+  # just used for validation and authorization.
+  class ClientRequest
+    attr_accessor :name, :ip, :authenticated, :handler, :method
+
+    def authenticated?
+      self.authenticated
+    end
+
+    # A common way of talking about the full call.  Individual servers
+    # are responsible for setting the values correctly, but this common
+    # format makes it possible to check rights.
+    def call
+      raise ArgumentError, "Request is not set up; cannot build call" unless handler and method
+
+      [handler, method].join(".")
+    end
+
+    def initialize(name, ip, authenticated)
+      @name, @ip, @authenticated = name, ip, authenticated
+    end
+
+    def to_s
+      "#{self.name}(#{self.ip})"
+    end
+  end
+end
+

data/lib/vendor/puppet/network/format.rb

@@ -0,0 +1,111 @@
+require 'puppet/provider'
+require 'puppet/provider/confiner'
+
+# A simple class for modeling encoding formats for moving
+# instances around the network.
+class Puppet::Network::Format
+  include Puppet::Provider::Confiner
+
+  attr_reader :name, :mime
+  attr_accessor :intern_method, :render_method, :intern_multiple_method, :render_multiple_method, :weight, :required_methods, :extension
+
+  def init_attribute(name, default)
+    if value = @options[name]
+      @options.delete(name)
+    else
+      value = default
+    end
+    self.send(name.to_s + "=", value)
+  end
+
+  def initialize(name, options = {}, &block)
+    @name = name.to_s.downcase.intern
+
+    @options = options
+
+    # This must be done early the values can be used to set required_methods
+    define_method_names
+
+    method_list = {
+      :intern_method => "from_#{name}",
+      :intern_multiple_method => "from_multiple_#{name}",
+      :render_multiple_method => "to_multiple_#{name}",
+      :render_method => "to_#{name}"
+    }
+
+    init_attribute(:mime, "text/#{name}")
+    init_attribute(:weight, 5)
+    init_attribute(:required_methods, method_list.keys)
+    init_attribute(:extension, name.to_s)
+
+    method_list.each do |method, value|
+      init_attribute(method, value)
+    end
+
+    raise ArgumentError, "Unsupported option(s) #{@options.keys}" unless @options.empty?
+
+    @options = nil
+
+    instance_eval(&block) if block_given?
+  end
+
+  def intern(klass, text)
+    return klass.send(intern_method, text) if klass.respond_to?(intern_method)
+    raise NotImplementedError, "#{klass} does not respond to #{intern_method}; can not intern instances from #{mime}"
+  end
+
+  def intern_multiple(klass, text)
+    return klass.send(intern_multiple_method, text) if klass.respond_to?(intern_multiple_method)
+    raise NotImplementedError, "#{klass} does not respond to #{intern_multiple_method}; can not intern multiple instances from #{mime}"
+  end
+
+  def mime=(mime)
+    @mime = mime.to_s.downcase
+  end
+
+  def render(instance)
+    return instance.send(render_method) if instance.respond_to?(render_method)
+    raise NotImplementedError, "#{instance.class} does not respond to #{render_method}; can not render instances to #{mime}"
+  end
+
+  def render_multiple(instances)
+    # This method implicitly assumes that all instances are of the same type.
+    return instances[0].class.send(render_multiple_method, instances) if instances[0].class.respond_to?(render_multiple_method)
+    raise NotImplementedError, "#{instances[0].class} does not respond to #{render_multiple_method}; can not intern multiple instances to #{mime}"
+  end
+
+  def required_methods_present?(klass)
+    [:intern_method, :intern_multiple_method, :render_multiple_method].each do |name|
+      return false unless required_method_present?(name, klass, :class)
+    end
+
+    return false unless required_method_present?(:render_method, klass, :instance)
+
+    true
+  end
+
+  def supported?(klass)
+    suitable? and required_methods_present?(klass)
+  end
+
+  def to_s
+    "Puppet::Network::Format[#{name}]"
+  end
+
+  private
+
+  def define_method_names
+    @intern_method = "from_#{name}"
+    @render_method = "to_#{name}"
+    @intern_multiple_method = "from_multiple_#{name}"
+    @render_multiple_method = "to_multiple_#{name}"
+  end
+
+  def required_method_present?(name, klass, type)
+    return true unless required_methods.include?(name)
+
+    method = send(name)
+
+    return(type == :class ? klass.respond_to?(method) : klass.method_defined?(method))
+  end
+end

data/lib/vendor/puppet/network/format_handler.rb

@@ -0,0 +1,181 @@
+require 'yaml'
+require 'puppet/network'
+require 'puppet/network/format'
+
+module Puppet::Network::FormatHandler
+  class FormatError < Puppet::Error; end
+
+  class FormatProtector
+    attr_reader :format
+
+    def protect(method, args)
+        Puppet::Network::FormatHandler.format(format).send(method, *args)
+    rescue => details
+        direction = method.to_s.include?("intern") ? "from" : "to"
+        error = FormatError.new("Could not #{method} #{direction} #{format}: #{details}")
+        error.set_backtrace(details.backtrace)
+        raise error
+    end
+
+    def initialize(format)
+      @format = format
+    end
+
+    [:intern, :intern_multiple, :render, :render_multiple, :mime].each do |method|
+      define_method(method) do |*args|
+        protect(method, args)
+      end
+    end
+  end
+
+  @formats = {}
+  def self.create(*args, &block)
+    instance = Puppet::Network::Format.new(*args)
+    instance.instance_eval(&block) if block_given?
+
+    @formats[instance.name] = instance
+    instance
+  end
+
+  def self.create_serialized_formats(name,options = {},&block)
+    ["application/x-#{name}", "application/#{name}", "text/x-#{name}", "text/#{name}"].each { |mime_type|
+      create name, {:mime => mime_type}.update(options), &block
+    }
+  end
+
+  def self.extended(klass)
+    klass.extend(ClassMethods)
+
+    # LAK:NOTE This won't work in 1.9 ('send' won't be able to send
+    # private methods, but I don't know how else to do it.
+    klass.send(:include, InstanceMethods)
+  end
+
+  def self.format(name)
+    @formats[name.to_s.downcase.intern]
+  end
+
+  def self.format_by_extension(ext)
+    @formats.each do |name, format|
+      return format if format.extension == ext
+    end
+    nil
+  end
+
+  # Provide a list of all formats.
+  def self.formats
+    @formats.keys
+  end
+
+  # Return a format capable of handling the provided mime type.
+  def self.mime(mimetype)
+    mimetype = mimetype.to_s.downcase
+    @formats.values.find { |format| format.mime == mimetype }
+  end
+
+  # Use a delegator to make sure any exceptions generated by our formats are
+  # handled intelligently.
+  def self.protected_format(name)
+    name = format_to_canonical_name(name)
+    @format_protectors ||= {}
+    @format_protectors[name] ||= FormatProtector.new(name)
+    @format_protectors[name]
+  end
+
+  # Return a format name given:
+  #  * a format name
+  #  * a mime-type
+  #  * a format instance
+  def self.format_to_canonical_name(format)
+    case format
+    when Puppet::Network::Format
+      out = format
+    when %r{\w+/\w+}
+      out = mime(format)
+    else
+      out = format(format)
+    end
+    raise ArgumentError, "No format match the given format name or mime-type (#{format})" if out.nil?
+    out.name
+  end
+
+  module ClassMethods
+    def format_handler
+      Puppet::Network::FormatHandler
+    end
+
+    def convert_from(format, data)
+      format_handler.protected_format(format).intern(self, data)
+    end
+
+    def convert_from_multiple(format, data)
+      format_handler.protected_format(format).intern_multiple(self, data)
+    end
+
+    def render_multiple(format, instances)
+      format_handler.protected_format(format).render_multiple(instances)
+    end
+
+    def default_format
+      supported_formats[0]
+    end
+
+    def support_format?(name)
+      Puppet::Network::FormatHandler.format(name).supported?(self)
+    end
+
+    def supported_formats
+      result = format_handler.formats.collect { |f| format_handler.format(f) }.find_all { |f| f.supported?(self) }.collect { |f| f.name }.sort do |a, b|
+        # It's an inverse sort -- higher weight formats go first.
+        format_handler.format(b).weight <=> format_handler.format(a).weight
+      end
+
+      result = put_preferred_format_first(result)
+
+      Puppet.debug "#{friendly_name} supports formats: #{result.map{ |f| f.to_s }.sort.join(' ')}; using #{result.first}"
+
+      result
+    end
+
+    private
+
+    def friendly_name
+      if self.respond_to? :indirection
+        indirection.name
+      else
+        self
+      end
+    end
+
+    def put_preferred_format_first(list)
+      preferred_format = Puppet.settings[:preferred_serialization_format].to_sym
+      if list.include?(preferred_format)
+        list.delete(preferred_format)
+        list.unshift(preferred_format)
+      else
+        Puppet.debug "Value of 'preferred_serialization_format' (#{preferred_format}) is invalid for #{friendly_name}, using default (#{list.first})"
+      end
+      list
+    end
+  end
+
+  module InstanceMethods
+    def render(format = nil)
+      format ||= self.class.default_format
+
+      Puppet::Network::FormatHandler.protected_format(format).render(self)
+    end
+
+    def mime(format = nil)
+      format ||= self.class.default_format
+
+      Puppet::Network::FormatHandler.protected_format(format).mime
+    end
+
+    def support_format?(name)
+      self.class.support_format?(name)
+    end
+  end
+end
+
+require 'puppet/network/formats'