puppet-parse 0.0.1 → 0.0.2

data/lib/vendor/puppet/network/rights.rb

@@ -0,0 +1,275 @@
+require 'puppet/network/authstore'
+require 'puppet/error'
+
+module Puppet::Network
+
+# this exception is thrown when a request is not authenticated
+class AuthorizationError < Puppet::Error; end
+
+# Define a set of rights and who has access to them.
+# There are two types of rights:
+#  * named rights (ie a common string)
+#  * path based rights (which are matched on a longest prefix basis)
+class Rights
+
+  # We basically just proxy directly to our rights.  Each Right stores
+  # its own auth abilities.
+  [:allow, :deny, :restrict_method, :restrict_environment, :restrict_authenticated].each do |method|
+    define_method(method) do |name, *args|
+      if obj = self[name]
+        obj.send(method, *args)
+      else
+        raise ArgumentError, "Unknown right '#{name}'"
+      end
+    end
+  end
+
+  # Check that name is allowed or not
+  def allowed?(name, *args)
+    !is_forbidden_and_why?(name, :node => args[0], :ip => args[1])
+  end
+
+  def is_request_forbidden_and_why?(indirection, method, key, params)
+    methods_to_check = if method == :head
+                         # :head is ok if either :find or :save is ok.
+                         [:find, :save]
+                       else
+                         [method]
+                       end
+    authorization_failure_exceptions = methods_to_check.map do |method|
+      is_forbidden_and_why?("/#{indirection}/#{key}", params.merge({:method => method}))
+    end
+    if authorization_failure_exceptions.include? nil
+      # One of the methods we checked is ok, therefore this request is ok.
+      nil
+    else
+      # Just need to return any of the failure exceptions.
+      authorization_failure_exceptions.first
+    end
+  end
+
+  def is_forbidden_and_why?(name, args = {})
+    res = :nomatch
+    right = @rights.find do |acl|
+      found = false
+      # an acl can return :dunno, which means "I'm not qualified to answer your question,
+      # please ask someone else". This is used when for instance an acl matches, but not for the
+      # current rest method, where we might think some other acl might be more specific.
+      if match = acl.match?(name)
+        args[:match] = match
+        if (res = acl.allowed?(args[:node], args[:ip], args)) != :dunno
+          # return early if we're allowed
+          return nil if res
+          # we matched, select this acl
+          found = true
+        end
+      end
+      found
+    end
+
+    # if we end here, then that means we either didn't match
+    # or failed, in any case will throw an error to the outside world
+    if name =~ /^\// or right
+      # we're a patch ACL, let's fail
+      msg = "#{(args[:node].nil? ? args[:ip] : "#{args[:node]}(#{args[:ip]})")} access to #{name} [#{args[:method]}]"
+
+      msg += " authenticated " if args[:authenticated]
+
+      error = AuthorizationError.new("Forbidden request: #{msg}")
+      if right
+        error.file = right.file
+        error.line = right.line
+      end
+    else
+      # there were no rights allowing/denying name
+      # if name is not a path, let's throw
+      raise ArgumentError, "Unknown namespace right '#{name}'"
+    end
+    error
+  end
+
+  def initialize
+    @rights = []
+  end
+
+  def [](name)
+    @rights.find { |acl| acl == name }
+  end
+
+  def include?(name)
+    @rights.include?(name)
+  end
+
+  def each
+    @rights.each { |r| yield r.name,r }
+  end
+
+  # Define a new right to which access can be provided.
+  def newright(name, line=nil, file=nil)
+    add_right( Right.new(name, line, file) )
+  end
+
+  private
+
+  def add_right(right)
+    if right.acl_type == :name and include?(right.key)
+      raise ArgumentError, "Right '%s' already exists"
+    end
+    @rights << right
+    sort_rights
+    right
+  end
+
+  def sort_rights
+    @rights.sort!
+  end
+
+  # Retrieve a right by name.
+  def right(name)
+    self[name]
+  end
+
+  # A right.
+  class Right < Puppet::Network::AuthStore
+    attr_accessor :name, :key, :acl_type
+    attr_accessor :methods, :environment, :authentication
+    attr_accessor :line, :file
+
+    ALL = [:save, :destroy, :find, :search]
+
+    Puppet::Util.logmethods(self, true)
+
+    def initialize(name, line, file)
+      @methods = []
+      @environment = []
+      @authentication = true # defaults to authenticated
+      @name = name
+      @line = line || 0
+      @file = file
+
+      case name
+      when Symbol
+        @acl_type = :name
+        @key = name
+      when /^\[(.+)\]$/
+        @acl_type = :name
+        @key = $1.intern if name.is_a?(String)
+      when /^\//
+        @acl_type = :regex
+        @key = Regexp.new("^" + Regexp.escape(name))
+        @methods = ALL
+      when /^~/ # this is a regex
+        @acl_type = :regex
+        @name = name.gsub(/^~\s+/,'')
+        @key = Regexp.new(@name)
+        @methods = ALL
+      else
+        raise ArgumentError, "Unknown right type '#{name}'"
+      end
+      super()
+    end
+
+    def to_s
+      "access[#{@name}]"
+    end
+
+    # There's no real check to do at this point
+    def valid?
+      true
+    end
+
+    def regex?
+      acl_type == :regex
+    end
+
+    # does this right is allowed for this triplet?
+    # if this right is too restrictive (ie we don't match this access method)
+    # then return :dunno so that upper layers have a chance to try another right
+    # tailored to the given method
+    def allowed?(name, ip, args = {})
+      return :dunno if acl_type == :regex and not @methods.include?(args[:method])
+      return :dunno if acl_type == :regex and @environment.size > 0 and not @environment.include?(args[:environment])
+      return :dunno if acl_type == :regex and not @authentication.nil? and args[:authenticated] != @authentication
+
+      begin
+        # make sure any capture are replaced if needed
+        interpolate(args[:match]) if acl_type == :regex and args[:match]
+        res = super(name,ip)
+      ensure
+        reset_interpolation if acl_type == :regex
+      end
+      res
+    end
+
+    # restrict this right to some method only
+    def restrict_method(m)
+      m = m.intern if m.is_a?(String)
+
+      raise ArgumentError, "'#{m}' is not an allowed value for method directive" unless ALL.include?(m)
+
+      # if we were allowing all methods, then starts from scratch
+      if @methods === ALL
+        @methods = []
+      end
+
+      raise ArgumentError, "'#{m}' is already in the '#{name}' ACL" if @methods.include?(m)
+
+      @methods << m
+    end
+
+    def restrict_environment(env)
+      env = Puppet::Node::Environment.new(env)
+      raise ArgumentError, "'#{env}' is already in the '#{name}' ACL" if @environment.include?(env)
+
+      @environment << env
+    end
+
+    def restrict_authenticated(authentication)
+      case authentication
+      when "yes", "on", "true", true
+        authentication = true
+      when "no", "off", "false", false
+        authentication = false
+      when "all","any", :all, :any
+        authentication = nil
+      else
+        raise ArgumentError, "'#{name}' incorrect authenticated value: #{authentication}"
+      end
+      @authentication = authentication
+    end
+
+    def match?(key)
+      # if we are a namespace compare directly
+      return self.key == namespace_to_key(key) if acl_type == :name
+
+      # otherwise match with the regex
+      self.key.match(key)
+    end
+
+    def namespace_to_key(key)
+      key = key.intern if key.is_a?(String)
+      key
+    end
+
+    # this is where all the magic happens.
+    # we're sorting the rights array with this scheme:
+    #  * namespace rights are all in front
+    #  * regex path rights are then all queued in file order
+    def <=>(rhs)
+      # move namespace rights at front
+      return self.acl_type == :name ? -1 : 1 if self.acl_type != rhs.acl_type
+
+      # sort by creation order (ie first match appearing in the file will win)
+      # that is don't sort, in which case the sort algorithm will order in the
+      # natural array order (ie the creation order)
+      0
+    end
+
+    def ==(name)
+      return(acl_type == :name ? self.key == namespace_to_key(name) : self.name == name.gsub(/^~\s+/,''))
+    end
+
+  end
+
+end
+end

data/lib/vendor/puppet/network/server.rb

@@ -0,0 +1,164 @@
+require 'puppet/network/http'
+require 'puppet/util/pidlock'
+
+class Puppet::Network::Server
+  attr_reader :server_type, :protocols, :address, :port
+
+  # Put the daemon into the background.
+  def daemonize
+    if pid = fork
+      Process.detach(pid)
+      exit(0)
+    end
+
+    # Get rid of console logging
+    Puppet::Util::Log.close(:console)
+
+    Process.setsid
+    Dir.chdir("/")
+    begin
+      $stdin.reopen "/dev/null"
+      $stdout.reopen "/dev/null", "a"
+      $stderr.reopen $stdout
+      Puppet::Util::Log.reopen
+    rescue => detail
+      Puppet::Util.replace_file("/tmp/daemonout", 0644) { |f|
+        f.puts "Could not start #{Puppet[:name]}: #{detail}"
+      }
+      raise "Could not start #{Puppet[:name]}: #{detail}"
+    end
+  end
+
+  # Create a pidfile for our daemon, so we can be stopped and others
+  # don't try to start.
+  def create_pidfile
+    Puppet::Util.synchronize_on(Puppet[:name],Sync::EX) do
+      raise "Could not create PID file: #{pidfile}" unless Puppet::Util::Pidlock.new(pidfile).lock
+    end
+  end
+
+  # Remove the pid file for our daemon.
+  def remove_pidfile
+    Puppet::Util.synchronize_on(Puppet[:name],Sync::EX) do
+      Puppet::Util::Pidlock.new(pidfile).unlock
+    end
+  end
+
+  # Provide the path to our pidfile.
+  def pidfile
+    Puppet[:pidfile]
+  end
+
+  def initialize(args = {})
+    valid_args = [:handlers, :xmlrpc_handlers, :port]
+    bad_args = args.keys.find_all { |p| ! valid_args.include?(p) }.collect { |p| p.to_s }.join(",")
+    raise ArgumentError, "Invalid argument(s) #{bad_args}" unless bad_args == ""
+    @server_type = Puppet[:servertype] or raise "No servertype configuration found."  # e.g.,  WEBrick, Mongrel, etc.
+    http_server_class || raise(ArgumentError, "Could not determine HTTP Server class for server type [#{@server_type}]")
+
+    @port = args[:port] || Puppet[:masterport] || raise(ArgumentError, "Must specify :port or configure Puppet :masterport")
+    @address = determine_bind_address
+
+    @protocols = [ :rest, :xmlrpc ]
+    @listening = false
+    @routes = {}
+    @xmlrpc_routes = {}
+    self.register(args[:handlers]) if args[:handlers]
+    self.register_xmlrpc(args[:xmlrpc_handlers]) if args[:xmlrpc_handlers]
+
+    # Make sure we have all of the directories we need to function.
+    Puppet.settings.use(:main, :ssl, Puppet[:name])
+  end
+
+  # Register handlers for REST networking, based on the Indirector.
+  def register(*indirections)
+    raise ArgumentError, "Indirection names are required." if indirections.empty?
+    indirections.flatten.each do |name|
+      Puppet::Indirector::Indirection.model(name) || raise(ArgumentError, "Cannot locate indirection '#{name}'.")
+      @routes[name.to_sym] = true
+    end
+  end
+
+  # Unregister Indirector handlers.
+  def unregister(*indirections)
+    raise "Cannot unregister indirections while server is listening." if listening?
+    indirections = @routes.keys if indirections.empty?
+
+    indirections.flatten.each do |i|
+      raise(ArgumentError, "Indirection [#{i}] is unknown.") unless @routes[i.to_sym]
+    end
+
+    indirections.flatten.each do |i|
+      @routes.delete(i.to_sym)
+    end
+  end
+
+  # Register xmlrpc handlers for backward compatibility.
+  def register_xmlrpc(*namespaces)
+    raise ArgumentError, "XMLRPC namespaces are required." if namespaces.empty?
+    namespaces.flatten.each do |name|
+      Puppet::Network::Handler.handler(name) || raise(ArgumentError, "Cannot locate XMLRPC handler for namespace '#{name}'.")
+      @xmlrpc_routes[name.to_sym] = true
+    end
+  end
+
+  # Unregister xmlrpc handlers.
+  def unregister_xmlrpc(*namespaces)
+    raise "Cannot unregister xmlrpc handlers while server is listening." if listening?
+    namespaces = @xmlrpc_routes.keys if namespaces.empty?
+
+    namespaces.flatten.each do |i|
+      raise(ArgumentError, "XMLRPC handler '#{i}' is unknown.") unless @xmlrpc_routes[i.to_sym]
+    end
+
+    namespaces.flatten.each do |i|
+      @xmlrpc_routes.delete(i.to_sym)
+    end
+  end
+
+  def listening?
+    @listening
+  end
+
+  def listen
+    raise "Cannot listen -- already listening." if listening?
+    @listening = true
+    http_server.listen(:address => address, :port => port, :handlers => @routes.keys, :xmlrpc_handlers => @xmlrpc_routes.keys, :protocols => protocols)
+  end
+
+  def unlisten
+    raise "Cannot unlisten -- not currently listening." unless listening?
+    http_server.unlisten
+    @listening = false
+  end
+
+  def http_server_class
+    http_server_class_by_type(@server_type)
+  end
+
+  def start
+    create_pidfile
+    listen
+  end
+
+  def stop
+    unlisten
+    remove_pidfile
+  end
+
+  private
+
+  def http_server
+    @http_server ||= http_server_class.new
+  end
+
+  def http_server_class_by_type(kind)
+    Puppet::Network::HTTP.server_class_by_type(kind)
+  end
+
+  def determine_bind_address
+    tmp = Puppet[:bindaddress]
+    return tmp if tmp != ""
+    server_type.to_s == "webrick" ? "0.0.0.0" : "127.0.0.1"
+  end
+end

data/lib/vendor/puppet/network/xmlrpc/processor.rb

@@ -0,0 +1,86 @@
+require 'puppet/network/authorization'
+require 'xmlrpc/server'
+
+# Just silly.
+class ::XMLRPC::FaultException
+  def to_s
+    self.message
+  end
+end
+
+module Puppet::Network
+  # Most of our subclassing is just so that we can get
+  # access to information from the request object, like
+  # the client name and IP address.
+  module XMLRPCProcessor
+    include Puppet::Network::Authorization
+
+    ERR_UNAUTHORIZED = 30
+
+    def add_handler(interface, handler)
+      @loadedhandlers << interface.prefix
+      super(interface, handler)
+    end
+
+    def handler_loaded?(handler)
+      @loadedhandlers.include?(handler.to_s)
+    end
+
+    # Convert our data and client request into xmlrpc calls, and verify
+    # they're authorized and such-like.  This method differs from the
+    # default in that it expects a ClientRequest object in addition to the
+    # data.
+    def process(data, request)
+      call, params = parser.parseMethodCall(data)
+      params << request.name << request.ip
+      handler, method = call.split(".")
+      request.handler = handler
+      request.method = method
+      begin
+        verify(request)
+      rescue InvalidClientRequest => detail
+        raise ::XMLRPC::FaultException.new(ERR_UNAUTHORIZED, detail.to_s)
+      end
+      handle(request.call, *params)
+    end
+
+    private
+
+    # Provide error handling for method calls.
+    def protect_service(obj, *args)
+      begin
+        obj.call(*args)
+      rescue ::XMLRPC::FaultException
+        raise
+      rescue Puppet::AuthorizationError => detail
+        Puppet.err "Permission denied: #{detail}"
+        raise ::XMLRPC::FaultException.new(
+          1, detail.to_s
+        )
+      rescue Puppet::Error => detail
+        puts detail.backtrace if Puppet[:trace]
+        Puppet.err detail.to_s
+        error = ::XMLRPC::FaultException.new(
+          1, detail.to_s
+        )
+        error.set_backtrace detail.backtrace
+        raise error
+      rescue => detail
+        puts detail.backtrace if Puppet[:trace]
+        Puppet.err "Could not call: #{detail}"
+        error = ::XMLRPC::FaultException.new(1, detail.to_s)
+        error.set_backtrace detail.backtrace
+        raise error
+      end
+    end
+
+    # Set up our service hook and init our handler list.
+    def setup_processor
+      @loadedhandlers = []
+      self.set_service_hook do |obj, *args|
+        protect_service(obj, *args)
+      end
+    end
+  end
+end
+

data/lib/vendor/puppet/network/xmlrpc/server.rb

@@ -0,0 +1,19 @@
+require 'xmlrpc/server'
+require 'puppet/network/authorization'
+require 'puppet/network/xmlrpc/processor'
+
+module Puppet::Network
+  # Most of our subclassing is just so that we can get
+  # access to information from the request object, like
+  # the client name and IP address.
+  class XMLRPCServer < ::XMLRPC::BasicServer
+    include Puppet::Util
+    include Puppet::Network::XMLRPCProcessor
+
+    def initialize
+      super()
+      setup_processor
+    end
+  end
+end
+

data/lib/vendor/puppet/network/xmlrpc/webrick_servlet.rb

@@ -0,0 +1,114 @@
+require 'xmlrpc/server'
+require 'puppet/network/authorization'
+require 'puppet/network/xmlrpc/processor'
+
+module Puppet::Network::XMLRPC
+  class ServletError < RuntimeError; end
+  class WEBrickServlet < ::XMLRPC::WEBrickServlet
+    include Puppet::Network::XMLRPCProcessor
+
+    # This is a hackish way to avoid an auth message every time we have a
+    # normal operation
+    def self.log(msg)
+      @logs ||= {}
+      if @logs.include?(msg)
+        @logs[msg] += 1
+      else
+        Puppet.info msg
+        @logs[msg] = 1
+      end
+    end
+
+    # Accept a list of handlers and register them all.
+    def initialize(handlers)
+      # the servlet base class does not consume any arguments
+      # and its BasicServer base class only accepts a 'class_delim'
+      # option which won't change in Puppet at all
+      # thus, we don't need to pass any args to our base class,
+      # and we can consume them all ourselves
+      super()
+
+      setup_processor
+
+      # Set up each of the passed handlers.
+      handlers.each do |handler|
+        add_handler(handler.class.interface, handler)
+      end
+    end
+
+    # Handle the actual request.  We can't use the super() method, because
+    # we need to pass a ClientRequest object to process so we can do
+    # authorization.  It's the only way to stay thread-safe.
+    def service(request, response)
+      if @valid_ip
+        raise WEBrick::HTTPStatus::Forbidden unless @valid_ip.any? { |ip| request.peeraddr[3] =~ ip }
+      end
+
+      if request.request_method != "POST"
+        raise WEBrick::HTTPStatus::MethodNotAllowed,
+          "unsupported method `#{request.request_method}'."
+      end
+
+      raise WEBrick::HTTPStatus::BadRequest if parse_content_type(request['Content-type']).first != "text/xml"
+
+      length = (request['Content-length'] || 0).to_i
+
+      raise WEBrick::HTTPStatus::LengthRequired unless length > 0
+
+      data = request.body
+
+      raise WEBrick::HTTPStatus::BadRequest if data.nil? or data.size != length
+
+      resp = process(data, client_request(request))
+      raise WEBrick::HTTPStatus::InternalServerError if resp.nil? or resp.size <= 0
+
+      response.status = 200
+      response['Content-Length'] = resp.size
+      response['Content-Type']   = "text/xml; charset=utf-8"
+      response.body = resp
+    end
+
+    private
+
+    # Generate a ClientRequest object for later validation.
+    def client_request(request)
+      if peer = request.peeraddr
+        client = peer[2]
+        clientip = peer[3]
+      else
+
+              raise ::XMLRPC::FaultException.new(
+                
+          ERR_UNCAUGHT_EXCEPTION,
+        
+          "Could not retrieve client information"
+        )
+      end
+
+      # If they have a certificate (which will almost always be true)
+      # then we get the hostname from the cert, instead of via IP
+      # info
+      valid = false
+      if cert = request.client_cert
+        nameary = cert.subject.to_a.find { |ary|
+          ary[0] == "CN"
+        }
+
+        if nameary.nil?
+          Puppet.warning "Could not retrieve server name from cert"
+        else
+          unless client == nameary[1]
+            Puppet.debug "Overriding #{client} with cert name #{nameary[1]}"
+            client = nameary[1]
+          end
+          valid = true
+        end
+      end
+
+      info = Puppet::Network::ClientRequest.new(client, clientip, valid)
+
+      info
+    end
+  end
+end
+

data/lib/vendor/puppet/network.rb

@@ -0,0 +1,3 @@
+# Just a stub, so we can correctly scope other classes.
+module Puppet::Network # :nodoc:
+end