puppet-parse 0.0.1 → 0.0.2

data/lib/vendor/puppet/network/http/webrick/rest.rb

@@ -0,0 +1,81 @@
+require 'puppet/network/http/handler'
+require 'resolv'
+require 'webrick'
+
+class Puppet::Network::HTTP::WEBrickREST < WEBrick::HTTPServlet::AbstractServlet
+
+  include Puppet::Network::HTTP::Handler
+
+  def initialize(server, handler)
+    raise ArgumentError, "server is required" unless server
+    super(server)
+    initialize_for_puppet(:server => server, :handler => handler)
+  end
+
+  # Retrieve the request parameters, including authentication information.
+  def params(request)
+    result = request.query
+    result = decode_params(result)
+    result.merge(client_information(request))
+  end
+
+  # WEBrick uses a service method to respond to requests.  Simply delegate to the handler response method.
+  def service(request, response)
+    process(request, response)
+  end
+
+  def accept_header(request)
+    request["accept"]
+  end
+
+  def content_type_header(request)
+    request["content-type"]
+  end
+
+  def http_method(request)
+    request.request_method
+  end
+
+  def path(request)
+    request.path
+  end
+
+  def body(request)
+    request.body
+  end
+
+  # Set the specified format as the content type of the response.
+  def set_content_type(response, format)
+    response["content-type"] = format_to_mime(format)
+  end
+
+  def set_response(response, result, status = 200)
+    response.status = status
+    if status >= 200 and status != 304
+      response.body = result
+      response["content-length"] = result.stat.size if result.is_a?(File)
+    end
+    response.reason_phrase = result if status < 200 or status >= 300
+  end
+
+  # Retrieve node/cert/ip information from the request object.
+  def client_information(request)
+    result = {}
+    if peer = request.peeraddr and ip = peer[3]
+      result[:ip] = ip
+    end
+
+    # If they have a certificate (which will almost always be true)
+    # then we get the hostname from the cert, instead of via IP
+    # info
+    result[:authenticated] = false
+    if cert = request.client_cert and nameary = cert.subject.to_a.find { |ary| ary[0] == "CN" }
+      result[:node] = nameary[1]
+      result[:authenticated] = true
+    else
+      result[:node] = resolve_node(result)
+    end
+
+    result
+  end
+end

data/lib/vendor/puppet/network/http/webrick.rb

@@ -0,0 +1,141 @@
+require 'webrick'
+require 'webrick/https'
+require 'puppet/network/http/webrick/rest'
+require 'puppet/network/xmlrpc/webrick_servlet'
+require 'thread'
+
+require 'puppet/ssl/certificate'
+require 'puppet/ssl/certificate_revocation_list'
+
+class Puppet::Network::HTTP::WEBrick
+  def initialize(args = {})
+    @listening = false
+    @mutex = Mutex.new
+  end
+
+  def self.class_for_protocol(protocol)
+    return Puppet::Network::HTTP::WEBrickREST if protocol.to_sym == :rest
+    raise "Unknown protocol [#{protocol}]."
+  end
+
+  def listen(args = {})
+    raise ArgumentError, ":protocols must be specified." if !args[:protocols] or args[:protocols].empty?
+    raise ArgumentError, ":address must be specified." unless args[:address]
+    raise ArgumentError, ":port must be specified." unless args[:port]
+
+    @protocols = args[:protocols]
+    @xmlrpc_handlers = args[:xmlrpc_handlers]
+
+    arguments = {:BindAddress => args[:address], :Port => args[:port]}
+    arguments.merge!(setup_logger)
+    arguments.merge!(setup_ssl)
+
+    @server = WEBrick::HTTPServer.new(arguments)
+    @server.listeners.each { |l| l.start_immediately = false }
+
+    setup_handlers
+
+    @mutex.synchronize do
+      raise "WEBrick server is already listening" if @listening
+      @listening = true
+      @thread = Thread.new {
+        @server.start { |sock|
+          raise "Client disconnected before connection could be established" unless IO.select([sock],nil,nil,6.2)
+          sock.accept
+          @server.run(sock)
+        }
+      }
+      sleep 0.1 until @server.status == :Running
+    end
+  end
+
+  def unlisten
+    @mutex.synchronize do
+      raise "WEBrick server is not listening" unless @listening
+      @server.shutdown
+      @thread.join
+      @server = nil
+      @listening = false
+    end
+  end
+
+  def listening?
+    @mutex.synchronize do
+      @listening
+    end
+  end
+
+  # Configure our http log file.
+  def setup_logger
+    # Make sure the settings are all ready for us.
+    Puppet.settings.use(:main, :ssl, Puppet[:name])
+
+    if Puppet.run_mode.master?
+      file = Puppet[:masterhttplog]
+    else
+      file = Puppet[:httplog]
+    end
+
+    # open the log manually to prevent file descriptor leak
+    file_io = ::File.open(file, "a+")
+    file_io.sync = true
+    if defined?(Fcntl::FD_CLOEXEC)
+      file_io.fcntl(Fcntl::F_SETFD, Fcntl::FD_CLOEXEC)
+    end
+
+    args = [file_io]
+    args << WEBrick::Log::DEBUG if Puppet::Util::Log.level == :debug
+
+    logger = WEBrick::Log.new(*args)
+    return :Logger => logger, :AccessLog => [
+      [logger, WEBrick::AccessLog::COMMON_LOG_FORMAT ],
+      [logger, WEBrick::AccessLog::REFERER_LOG_FORMAT ]
+    ]
+  end
+
+  # Add all of the ssl cert information.
+  def setup_ssl
+    results = {}
+
+    # Get the cached copy.  We know it's been generated, too.
+    host = Puppet::SSL::Host.localhost
+
+    raise Puppet::Error, "Could not retrieve certificate for #{host.name} and not running on a valid certificate authority" unless host.certificate
+
+    results[:SSLPrivateKey] = host.key.content
+    results[:SSLCertificate] = host.certificate.content
+    results[:SSLStartImmediately] = true
+    results[:SSLEnable] = true
+
+    raise Puppet::Error, "Could not find CA certificate" unless Puppet::SSL::Certificate.indirection.find(Puppet::SSL::CA_NAME)
+
+    results[:SSLCACertificateFile] = Puppet[:localcacert]
+    results[:SSLVerifyClient] = OpenSSL::SSL::VERIFY_PEER
+
+    results[:SSLCertificateStore] = host.ssl_store
+
+    results
+  end
+
+  private
+
+  def setup_handlers
+    # Set up the new-style protocols.
+    klass = self.class.class_for_protocol(:rest)
+    @server.mount('/', klass, :this_value_is_apparently_necessary_but_unused)
+
+    # And then set up xmlrpc, if configured.
+    @server.mount("/RPC2", xmlrpc_servlet) if @protocols.include?(:xmlrpc) and ! @xmlrpc_handlers.empty?
+  end
+
+  # Create our xmlrpc servlet, which provides backward compatibility.
+  def xmlrpc_servlet
+    handlers = @xmlrpc_handlers.collect { |handler|
+      unless hclass = Puppet::Network::Handler.handler(handler)
+        raise "Invalid xmlrpc handler #{handler}"
+      end
+      hclass.new({})
+    }
+    Puppet::Network::XMLRPC::WEBrickServlet.new handlers
+  end
+end

data/lib/vendor/puppet/network/http.rb

@@ -0,0 +1,15 @@
+module Puppet::Network::HTTP
+  def self.server_class_by_type(kind)
+    case kind.to_sym
+    when :webrick
+      require 'puppet/network/http/webrick'
+      return Puppet::Network::HTTP::WEBrick
+    when :mongrel
+      raise ArgumentError, "Mongrel is not installed on this platform" unless Puppet.features.mongrel?
+      require 'puppet/network/http/mongrel'
+      return Puppet::Network::HTTP::Mongrel
+    else
+      raise ArgumentError, "Unknown HTTP server name [#{kind}]"
+    end
+  end
+end

data/lib/vendor/puppet/network/http_pool.rb

@@ -0,0 +1,57 @@
+require 'puppet/ssl/host'
+require 'net/https'
+
+module Puppet::Network; end
+
+module Puppet::Network::HttpPool
+  # Use the global localhost instance.
+  def self.ssl_host
+    Puppet::SSL::Host.localhost
+  end
+
+  # Use cert information from a Puppet client to set up the http object.
+  def self.cert_setup(http)
+    if FileTest.exist?(Puppet[:hostcert]) and FileTest.exist?(Puppet[:localcacert])
+      http.cert_store  = ssl_host.ssl_store
+      http.ca_file     = Puppet[:localcacert]
+      http.cert        = ssl_host.certificate.content
+      http.verify_mode = OpenSSL::SSL::VERIFY_PEER
+      http.key         = ssl_host.key.content
+    else
+      # We don't have the local certificates, so we don't do any verification
+      # or setup at this early stage.  REVISIT: Shouldn't we supply the local
+      # certificate details if we have them?  The original code didn't.
+      # --daniel 2012-06-03
+
+      # Ruby 1.8 defaulted to this, but 1.9 defaults to peer verify, and we
+      # almost always talk to a dedicated, not-standard CA that isn't trusted
+      # out of the box.  This forces the expected state.
+      http.verify_mode = OpenSSL::SSL::VERIFY_NONE
+    end
+  end
+
+  # Retrieve a cached http instance if caching is enabled, else return
+  # a new one.
+  def self.http_instance(host, port, reset = false)
+    args = [host, port]
+    if Puppet[:http_proxy_host] == "none"
+      args << nil << nil
+    else
+      args << Puppet[:http_proxy_host] << Puppet[:http_proxy_port]
+    end
+    http = Net::HTTP.new(*args)
+
+    # Pop open the http client a little; older versions of Net::HTTP(s) didn't
+    # give us a reader for ca_file... Grr...
+    class << http; attr_accessor :ca_file; end
+
+    http.use_ssl = true
+    # Use configured timeout (#1176)
+    http.read_timeout = Puppet[:configtimeout]
+    http.open_timeout = Puppet[:configtimeout]
+
+    cert_setup(http)
+
+    http
+  end
+end

data/lib/vendor/puppet/network/http_server/mongrel.rb

@@ -0,0 +1,129 @@
+#!/usr/bin/env ruby
+# File:       06-11-14-mongrel_xmlrpc.rb
+# Author:     Manuel Holtgrewe <purestorm at ggnore.net>
+#
+# Copyright (c) 2006 Manuel Holtgrewe, 2007 Luke Kanies
+#
+# This file is based heavily on a file retrieved from
+# http://ttt.ggnore.net/2006/11/15/xmlrpc-with-mongrel-and-ruby-off-rails/
+
+require 'rubygems'
+require 'mongrel'
+require 'xmlrpc/server'
+require 'puppet/network/xmlrpc/server'
+require 'puppet/network/http_server'
+require 'puppet/network/client_request'
+require 'puppet/network/handler'
+
+require 'resolv'
+
+# This handler can be hooked into Mongrel to accept HTTP requests. After
+# checking whether the request itself is sane, the handler forwards it
+# to an internal instance of XMLRPC::BasicServer to process it.
+#
+# You can access the server by calling the Handler's "xmlrpc_server"
+# attribute accessor method and add XMLRPC handlers there. For example:
+#
+# <pre>
+# handler = XmlRpcHandler.new
+# handler.xmlrpc_server.add_handler("my.add") { |a, b| a.to_i + b.to_i }
+# </pre>
+module Puppet::Network
+  class HTTPServer::Mongrel < ::Mongrel::HttpHandler
+    attr_reader :xmlrpc_server
+
+    def initialize(handlers)
+      if Puppet[:debug]
+        $mongrel_debug_client = true
+        Puppet.debug 'Mongrel client debugging enabled. [$mongrel_debug_client = true].'
+      end
+      # Create a new instance of BasicServer. We are supposed to subclass it
+      # but that does not make sense since we would not introduce any new
+      # behaviour and we have to subclass Mongrel::HttpHandler so our handler
+      # works for Mongrel.
+      @xmlrpc_server = Puppet::Network::XMLRPCServer.new
+      handlers.each do |name|
+        unless handler = Puppet::Network::Handler.handler(name)
+          raise ArgumentError, "Invalid handler #{name}"
+        end
+        @xmlrpc_server.add_handler(handler.interface, handler.new({}))
+      end
+    end
+
+    # This method produces the same results as XMLRPC::CGIServer.serve
+    # from Ruby's stdlib XMLRPC implementation.
+    def process(request, response)
+      # Make sure this has been a POST as required for XMLRPC.
+      request_method = request.params[Mongrel::Const::REQUEST_METHOD] || Mongrel::Const::GET
+      if request_method != "POST"
+        response.start(405) { |head, out| out.write("Method Not Allowed") }
+        return
+      end
+
+      # Make sure the user has sent text/xml data.
+      request_mime = request.params["CONTENT_TYPE"] || "text/plain"
+      if parse_content_type(request_mime).first != "text/xml"
+        response.start(400) { |head, out| out.write("Bad Request") }
+        return
+      end
+
+      # Make sure there is data in the body at all.
+      length = request.params[Mongrel::Const::CONTENT_LENGTH].to_i
+      if length <= 0
+        response.start(411) { |head, out| out.write("Length Required") }
+        return
+      end
+
+      # Check the body to be valid.
+      if request.body.nil? or request.body.size != length
+        response.start(400) { |head, out| out.write("Bad Request") }
+        return
+      end
+
+      info = client_info(request)
+
+      # All checks above passed through
+      response.start(200) do |head, out|
+        head["Content-Type"] = "text/xml; charset=utf-8"
+        begin
+          out.write(@xmlrpc_server.process(request.body, info))
+        rescue => detail
+          puts detail.backtrace
+          raise
+        end
+      end
+    end
+
+    private
+
+    def client_info(request)
+      params = request.params
+      ip = params["HTTP_X_FORWARDED_FOR"] ? params["HTTP_X_FORWARDED_FOR"].split(',').last.strip : params["REMOTE_ADDR"]
+      # JJM #906 The following dn.match regular expression is forgiving
+      # enough to match the two Distinguished Name string contents
+      # coming from Apache, Pound or other reverse SSL proxies.
+      if dn = params[Puppet[:ssl_client_header]] and dn_matchdata = dn.match(/^.*?CN\s*=\s*(.*)/)
+        client = dn_matchdata[1].to_str
+        valid = (params[Puppet[:ssl_client_verify_header]] == 'SUCCESS')
+      else
+        begin
+          client = Resolv.getname(ip)
+        rescue => detail
+          Puppet.err "Could not resolve #{ip}: #{detail}"
+          client = "unknown"
+        end
+        valid = false
+      end
+
+      info = Puppet::Network::ClientRequest.new(client, ip, valid)
+
+      info
+    end
+
+    # Taken from XMLRPC::ParseContentType
+    def parse_content_type(str)
+      a, *b = str.split(";")
+      return a.strip, *b
+    end
+  end
+end

data/lib/vendor/puppet/network/http_server.rb

@@ -0,0 +1,3 @@
+# Just a stub, so we can correctly scope other classes.
+module Puppet::Network::HTTPServer # :nodoc:
+end

data/lib/vendor/puppet/network/rest_authconfig.rb

@@ -0,0 +1,102 @@
+require 'puppet/network/authconfig'
+
+module Puppet
+  class Network::RestAuthConfig < Network::AuthConfig
+
+    extend MonitorMixin
+    attr_accessor :rights
+
+    DEFAULT_ACL = [
+      { :acl => "~ ^\/catalog\/([^\/]+)$", :method => :find, :allow => '$1', :authenticated => true },
+      { :acl => "~ ^\/node\/([^\/]+)$", :method => :find, :allow => '$1', :authenticated => true },
+      # this one will allow all file access, and thus delegate
+      # to fileserver.conf
+      { :acl => "/file" },
+      { :acl => "/certificate_revocation_list/ca", :method => :find, :authenticated => true },
+      { :acl => "/report", :method => :save, :authenticated => true },
+      # These allow `auth any`, because if you can do them anonymously you
+      # should probably also be able to do them when trusted.
+      { :acl => "/certificate/ca", :method => :find, :authenticated => :any },
+      { :acl => "/certificate/", :method => :find, :authenticated => :any },
+      { :acl => "/certificate_request", :method => [:find, :save], :authenticated => :any },
+      { :acl => "/status", :method => [:find], :authenticated => true },
+    ]
+
+    def self.main
+      synchronize do
+        add_acl = @main.nil?
+        super
+        @main.insert_default_acl if add_acl and !@main.exists?
+      end
+      @main
+    end
+
+    def allowed?(request)
+      Puppet.deprecation_warning "allowed? should not be called for REST authorization - use check_authorization instead"
+      check_authorization(request)
+    end
+
+    # check wether this request is allowed in our ACL
+    # raise an Puppet::Network::AuthorizedError if the request
+    # is denied.
+    def check_authorization(indirection, method, key, params)
+      read
+
+      # we're splitting the request in part because
+      # fail_on_deny could as well be called in the XMLRPC context
+      # with a ClientRequest.
+
+      if authorization_failure_exception = @rights.is_request_forbidden_and_why?(indirection, method, key, params)
+        Puppet.warning("Denying access: #{authorization_failure_exception}")
+        raise authorization_failure_exception
+      end
+    end
+
+    def initialize(file = nil, parsenow = true)
+      super(file || Puppet[:rest_authconfig], parsenow)
+
+      # if we didn't read a file (ie it doesn't exist)
+      # make sure we can create some default rights
+      @rights ||= Puppet::Network::Rights.new
+    end
+
+    def parse
+      super()
+      insert_default_acl
+    end
+
+    # force regular ACLs to be present
+    def insert_default_acl
+      if exists? then
+        reason = "none were found in '#{@file}'"
+      else
+        reason = "#{Puppet[:rest_authconfig]} doesn't exist"
+      end
+
+      DEFAULT_ACL.each do |acl|
+        unless rights[acl[:acl]]
+          Puppet.info "Inserting default '#{acl[:acl]}' (auth #{acl[:authenticated]}) ACL because #{reason}"
+          mk_acl(acl)
+        end
+      end
+      # queue an empty (ie deny all) right for every other path
+      # actually this is not strictly necessary as the rights system
+      # denies not explicitely allowed paths
+      unless rights["/"]
+        rights.newright("/")
+        rights.restrict_authenticated("/", :any)
+      end
+    end
+
+    def mk_acl(acl)
+      @rights.newright(acl[:acl])
+      @rights.allow(acl[:acl], acl[:allow] || "*")
+
+      if method = acl[:method]
+        method = [method] unless method.is_a?(Array)
+        method.each { |m| @rights.restrict_method(acl[:acl], m) }
+      end
+      @rights.restrict_authenticated(acl[:acl], acl[:authenticated]) unless acl[:authenticated].nil?
+    end
+  end
+end

data/lib/vendor/puppet/network/rest_authorization.rb

@@ -0,0 +1,23 @@
+require 'puppet/network/client_request'
+require 'puppet/network/rest_authconfig'
+
+module Puppet::Network
+
+  module RestAuthorization
+
+
+    # Create our config object if necessary. If there's no configuration file
+    # we install our defaults
+    def authconfig
+      @authconfig ||= Puppet::Network::RestAuthConfig.main
+
+      @authconfig
+    end
+
+    # Verify that our client has access.
+    def check_authorization(indirection, method, key, params)
+      authconfig.check_authorization(indirection, method, key, params)
+    end
+  end
+end
+

data/lib/vendor/puppet/network/rest_controller.rb

@@ -0,0 +1,2 @@
+class Puppet::Network::RESTController # :nodoc:
+end