puppet-parse 0.0.1 → 0.0.2

data/lib/vendor/puppet/ssl/host.rb

@@ -0,0 +1,365 @@
+require 'puppet/indirector'
+require 'puppet/ssl'
+require 'puppet/ssl/key'
+require 'puppet/ssl/certificate'
+require 'puppet/ssl/certificate_request'
+require 'puppet/ssl/certificate_revocation_list'
+
+# The class that manages all aspects of our SSL certificates --
+# private keys, public keys, requests, etc.
+class Puppet::SSL::Host
+  # Yay, ruby's strange constant lookups.
+  Key = Puppet::SSL::Key
+  CA_NAME = Puppet::SSL::CA_NAME
+  Certificate = Puppet::SSL::Certificate
+  CertificateRequest = Puppet::SSL::CertificateRequest
+  CertificateRevocationList = Puppet::SSL::CertificateRevocationList
+
+  extend Puppet::Indirector
+  indirects :certificate_status, :terminus_class => :file
+
+  attr_reader :name
+  attr_accessor :ca
+
+  attr_writer :key, :certificate, :certificate_request
+
+  # This accessor is used in instances for indirector requests to hold desired state
+  attr_accessor :desired_state
+
+  def self.localhost
+    return @localhost if @localhost
+    @localhost = new
+    @localhost.generate unless @localhost.certificate
+    @localhost.key
+    @localhost
+  end
+
+  def self.reset
+    @localhost = nil
+  end
+
+  # This is the constant that people will use to mark that a given host is
+  # a certificate authority.
+  def self.ca_name
+    CA_NAME
+  end
+
+  class << self
+    attr_reader :ca_location
+  end
+
+  # Configure how our various classes interact with their various terminuses.
+  def self.configure_indirection(terminus, cache = nil)
+    Certificate.indirection.terminus_class = terminus
+    CertificateRequest.indirection.terminus_class = terminus
+    CertificateRevocationList.indirection.terminus_class = terminus
+
+    host_map = {:ca => :file, :disabled_ca => nil, :file => nil, :rest => :rest}
+    if term = host_map[terminus]
+      self.indirection.terminus_class = term
+    else
+      self.indirection.reset_terminus_class
+    end
+
+    if cache
+      # This is weird; we don't actually cache our keys, we
+      # use what would otherwise be the cache as our normal
+      # terminus.
+      Key.indirection.terminus_class = cache
+    else
+      Key.indirection.terminus_class = terminus
+    end
+
+    if cache
+      Certificate.indirection.cache_class = cache
+      CertificateRequest.indirection.cache_class = cache
+      CertificateRevocationList.indirection.cache_class = cache
+    else
+      # Make sure we have no cache configured.  puppet master
+      # switches the configurations around a bit, so it's important
+      # that we specify the configs for absolutely everything, every
+      # time.
+      Certificate.indirection.cache_class = nil
+      CertificateRequest.indirection.cache_class = nil
+      CertificateRevocationList.indirection.cache_class = nil
+    end
+  end
+
+  CA_MODES = {
+    # Our ca is local, so we use it as the ultimate source of information
+    # And we cache files locally.
+    :local => [:ca, :file],
+    # We're a remote CA client.
+    :remote => [:rest, :file],
+    # We are the CA, so we don't have read/write access to the normal certificates.
+    :only => [:ca],
+    # We have no CA, so we just look in the local file store.
+    :none => [:disabled_ca]
+  }
+
+  # Specify how we expect to interact with our certificate authority.
+  def self.ca_location=(mode)
+    modes = CA_MODES.collect { |m, vals| m.to_s }.join(", ")
+    raise ArgumentError, "CA Mode can only be one of: #{modes}" unless CA_MODES.include?(mode)
+
+    @ca_location = mode
+
+    configure_indirection(*CA_MODES[@ca_location])
+  end
+
+  # Puppet::SSL::Host is actually indirected now so the original implementation
+  # has been moved into the certificate_status indirector.  This method is in-use
+  # in `puppet cert -c <certname>`.
+  def self.destroy(name)
+    indirection.destroy(name)
+  end
+
+  def self.from_pson(pson)
+    instance = new(pson["name"])
+    if pson["desired_state"]
+      instance.desired_state = pson["desired_state"]
+    end
+    instance
+  end
+
+  # Puppet::SSL::Host is actually indirected now so the original implementation
+  # has been moved into the certificate_status indirector.  This method does not
+  # appear to be in use in `puppet cert -l`.
+  def self.search(options = {})
+    indirection.search("*", options)
+  end
+
+  # Is this a ca host, meaning that all of its files go in the CA location?
+  def ca?
+    ca
+  end
+
+  def key
+    @key ||= Key.indirection.find(name)
+  end
+
+  # This is the private key; we can create it from scratch
+  # with no inputs.
+  def generate_key
+    @key = Key.new(name)
+    @key.generate
+    begin
+      Key.indirection.save(@key)
+    rescue
+      @key = nil
+      raise
+    end
+    true
+  end
+
+  def certificate_request
+    @certificate_request ||= CertificateRequest.indirection.find(name)
+  end
+
+  def this_csr_is_for_the_current_host
+    name == Puppet[:certname].downcase
+  end
+
+  def this_csr_is_for_the_current_host
+    name == Puppet[:certname].downcase
+  end
+
+  # Our certificate request requires the key but that's all.
+  def generate_certificate_request(options = {})
+    generate_key unless key
+
+    # If this is for the current machine...
+    if this_csr_is_for_the_current_host
+      # ...add our configured dns_alt_names
+      if Puppet[:dns_alt_names] and Puppet[:dns_alt_names] != ''
+        options[:dns_alt_names] ||= Puppet[:dns_alt_names]
+      elsif Puppet::SSL::CertificateAuthority.ca? and fqdn = Facter.value(:fqdn) and domain = Facter.value(:domain)
+        options[:dns_alt_names] = "puppet, #{fqdn}, puppet.#{domain}"
+      end
+    end
+
+    @certificate_request = CertificateRequest.new(name)
+    @certificate_request.generate(key.content, options)
+    begin
+      CertificateRequest.indirection.save(@certificate_request)
+    rescue
+      @certificate_request = nil
+      raise
+    end
+
+    true
+  end
+
+  def certificate
+    unless @certificate
+      generate_key unless key
+
+      # get the CA cert first, since it's required for the normal cert
+      # to be of any use.
+      return nil unless Certificate.indirection.find("ca") unless ca?
+      return nil unless @certificate = Certificate.indirection.find(name)
+
+      validate_certificate_with_key
+    end
+    @certificate
+  end
+
+  def validate_certificate_with_key
+    raise Puppet::Error, "No certificate to validate." unless certificate
+    raise Puppet::Error, "No private key with which to validate certificate with fingerprint: #{certificate.fingerprint}" unless key
+    unless certificate.content.check_private_key(key.content)
+      raise Puppet::Error, <<ERROR_STRING
+The certificate retrieved from the master does not match the agent's private key.
+Certificate fingerprint: #{certificate.fingerprint}
+To fix this, remove the certificate from both the master and the agent and then start a puppet run, which will automatically regenerate a certficate.
+On the master:
+  puppet cert clean #{Puppet[:certname]}
+On the agent:
+  rm -f #{Puppet[:hostcert]}
+  puppet agent -t
+ERROR_STRING
+    end
+  end
+
+  # Generate all necessary parts of our ssl host.
+  def generate
+    generate_key unless key
+    generate_certificate_request unless certificate_request
+
+    # If we can get a CA instance, then we're a valid CA, and we
+    # should use it to sign our request; else, just try to read
+    # the cert.
+    if ! certificate and ca = Puppet::SSL::CertificateAuthority.instance
+      ca.sign(self.name, true)
+    end
+  end
+
+  def initialize(name = nil)
+    @name = (name || Puppet[:certname]).downcase
+    Puppet::SSL::Base.validate_certname(@name)
+    @key = @certificate = @certificate_request = nil
+    @ca = (name == self.class.ca_name)
+  end
+
+  # Extract the public key from the private key.
+  def public_key
+    key.content.public_key
+  end
+
+  # Create/return a store that uses our SSL info to validate
+  # connections.
+  def ssl_store(purpose = OpenSSL::X509::PURPOSE_ANY)
+    unless @ssl_store
+      @ssl_store = OpenSSL::X509::Store.new
+      @ssl_store.purpose = purpose
+
+      # Use the file path here, because we don't want to cause
+      # a lookup in the middle of setting our ssl connection.
+      @ssl_store.add_file(Puppet[:localcacert])
+
+      # If there's a CRL, add it to our store.
+      if crl = Puppet::SSL::CertificateRevocationList.indirection.find(CA_NAME)
+        @ssl_store.flags = OpenSSL::X509::V_FLAG_CRL_CHECK_ALL|OpenSSL::X509::V_FLAG_CRL_CHECK if Puppet.settings[:certificate_revocation]
+        @ssl_store.add_crl(crl.content)
+      end
+      return @ssl_store
+    end
+    @ssl_store
+  end
+
+  def to_pson(*args)
+    my_cert = Puppet::SSL::Certificate.indirection.find(name)
+    pson_hash = { :name  => name }
+
+    my_state = state
+
+    pson_hash[:state] = my_state
+    pson_hash[:desired_state] = desired_state if desired_state
+
+    thing_to_use = (my_state == 'requested') ? certificate_request : my_cert
+
+    # this is for backwards-compatibility
+    # we should deprecate it and transition people to using
+    # pson[:fingerprints][:default]
+    # It appears that we have no internal consumers of this api
+    # --jeffweiss 30 aug 2012
+    pson_hash[:fingerprint] = thing_to_use.fingerprint
+    
+    # The above fingerprint doesn't tell us what message digest algorithm was used
+    # No problem, except that the default is changing between 2.7 and 3.0. Also, as
+    # we move to FIPS 140-2 compliance, MD5 is no longer allowed (and, gasp, will
+    # segfault in rubies older than 1.9.3)
+    # So, when we add the newer fingerprints, we're explicit about the hashing
+    # algorithm used.
+    # --jeffweiss 31 july 2012
+    pson_hash[:fingerprints] = {}
+    pson_hash[:fingerprints][:default] = thing_to_use.fingerprint
+    
+    suitable_message_digest_algorithms.each do |md| 
+      pson_hash[:fingerprints][md] = thing_to_use.fingerprint md
+    end
+    pson_hash[:dns_alt_names] = thing_to_use.subject_alt_names
+
+    pson_hash.to_pson(*args)
+  end
+  
+  # eventually we'll probably want to move this somewhere else or make it
+  # configurable
+  # --jeffweiss 29 aug 2012
+  def suitable_message_digest_algorithms
+    [:SHA1, :SHA256, :SHA512]
+  end
+
+  # Attempt to retrieve a cert, if we don't already have one.
+  def wait_for_cert(time)
+    begin
+      return if certificate
+      generate
+      return if certificate
+    rescue SystemExit,NoMemoryError
+      raise
+    rescue Exception => detail
+      puts detail.backtrace if Puppet[:trace]
+      Puppet.err "Could not request certificate: #{detail}"
+      if time < 1
+        puts "Exiting; failed to retrieve certificate and waitforcert is disabled"
+        exit(1)
+      else
+        sleep(time)
+      end
+      retry
+    end
+
+    if time < 1
+      puts "Exiting; no certificate found and waitforcert is disabled"
+      exit(1)
+    end
+
+    while true
+      sleep time
+      begin
+        break if certificate
+        Puppet.notice "Did not receive certificate"
+      rescue StandardError => detail
+        puts detail.backtrace if Puppet[:trace]
+        Puppet.err "Could not request certificate: #{detail}"
+      end
+    end
+  end
+
+  def state
+    my_cert = Puppet::SSL::Certificate.indirection.find(name)
+    if certificate_request
+      return 'requested'
+    end
+
+    begin
+      Puppet::SSL::CertificateAuthority.new.verify(my_cert)
+      return 'signed'
+    rescue Puppet::SSL::CertificateAuthority::CertificateVerificationError
+      return 'revoked'
+    end
+  end
+end
+
+require 'puppet/ssl/certificate_authority'

data/lib/vendor/puppet/ssl/inventory.rb

@@ -0,0 +1,54 @@
+require 'puppet/ssl'
+require 'puppet/ssl/certificate'
+
+# Keep track of all of our known certificates.
+class Puppet::SSL::Inventory
+  attr_reader :path
+
+  # Add a certificate to our inventory.
+  def add(cert)
+    cert = cert.content if cert.is_a?(Puppet::SSL::Certificate)
+
+    # Create our file, if one does not already exist.
+    rebuild unless FileTest.exist?(@path)
+
+    Puppet.settings.write(:cert_inventory, "a") do |f|
+      f.print format(cert)
+    end
+  end
+
+  # Format our certificate for output.
+  def format(cert)
+    iso = '%Y-%m-%dT%H:%M:%S%Z'
+    "0x%04x %s %s %s\n" % [cert.serial,  cert.not_before.strftime(iso), cert.not_after.strftime(iso), cert.subject]
+  end
+
+  def initialize
+    @path = Puppet[:cert_inventory]
+  end
+
+  # Rebuild the inventory from scratch.  This should happen if
+  # the file is entirely missing or if it's somehow corrupted.
+  def rebuild
+    Puppet.notice "Rebuilding inventory file"
+
+    Puppet.settings.write(:cert_inventory) do |f|
+      f.print "# Inventory of signed certificates\n# SERIAL NOT_BEFORE NOT_AFTER SUBJECT\n"
+    end
+
+    Puppet::SSL::Certificate.indirection.search("*").each { |cert| add(cert) }
+  end
+
+  # Find the serial number for a given certificate.
+  def serial(name)
+    return nil unless FileTest.exist?(@path)
+
+    File.readlines(@path).each do |line|
+      next unless line =~ /^(\S+).+\/CN=#{name}$/
+
+      return Integer($1)
+    end
+
+    return nil
+  end
+end

data/lib/vendor/puppet/ssl/key.rb

@@ -0,0 +1,56 @@
+require 'puppet/ssl/base'
+require 'puppet/indirector'
+
+# Manage private and public keys as a pair.
+class Puppet::SSL::Key < Puppet::SSL::Base
+  wraps OpenSSL::PKey::RSA
+
+  extend Puppet::Indirector
+  indirects :key, :terminus_class => :file
+
+  # Because of how the format handler class is included, this
+  # can't be in the base class.
+  def self.supported_formats
+    [:s]
+  end
+
+  attr_accessor :password_file
+
+  # Knows how to create keys with our system defaults.
+  def generate
+    Puppet.info "Creating a new SSL key for #{name}"
+    @content = OpenSSL::PKey::RSA.new(Puppet[:keylength].to_i)
+  end
+
+  def initialize(name)
+    super
+
+    if ca?
+      @password_file = Puppet[:capass]
+    else
+      @password_file = Puppet[:passfile]
+    end
+  end
+
+  def password
+    return nil unless password_file and FileTest.exist?(password_file)
+
+    ::File.read(password_file)
+  end
+
+  # Optionally support specifying a password file.
+  def read(path)
+    return super unless password_file
+
+    #@content = wrapped_class.new(::File.read(path), password)
+    @content = wrapped_class.new(::File.read(path), password)
+  end
+
+  def to_s
+    if pass = password
+      @content.export(OpenSSL::Cipher::DES.new(:EDE3, :CBC), pass)
+    else
+      return super
+    end
+  end
+end

data/lib/vendor/puppet/ssl.rb

@@ -0,0 +1,8 @@
+# Just to make the constants work out.
+require 'puppet'
+require 'openssl'
+
+module Puppet::SSL # :nodoc:
+  CA_NAME = "ca"
+  require 'puppet/ssl/host'
+end

data/lib/vendor/puppet/status.rb

@@ -0,0 +1,28 @@
+require 'puppet/indirector'
+
+class Puppet::Status
+  extend Puppet::Indirector
+  indirects :status, :terminus_class => :local
+
+  attr :status, true
+
+  def initialize( status = nil )
+    @status = status || {"is_alive" => true}
+  end
+
+  def to_pson(*args)
+    @status.to_pson
+  end
+
+  def self.from_pson( pson )
+    self.new( pson )
+  end
+
+  def name
+    "status"
+  end
+
+  def name=(name)
+    # NOOP
+  end
+end

data/lib/vendor/puppet/test/test_helper.rb

@@ -0,0 +1,141 @@
+module Puppet::Test
+  # This class is intended to provide an API to be used by external projects
+  #  when they are running tests that depend on puppet core.  This should
+  #  allow us to vary the implementation details of managing puppet's state
+  #  for testing, from one version of puppet to the next--without forcing
+  #  the external projects to do any of that state management or be aware of
+  #  the implementation details.
+  #
+  # For now, this consists of a few very simple signatures.  The plan is
+  #  that it should be the responsibility of the puppetlabs_spec_helper
+  #  to broker between external projects and this API; thus, if any
+  #  hacks are required (e.g. to determine whether or not a particular)
+  #  version of puppet supports this API, those hacks will be consolidated in
+  #  one place and won't need to be duplicated in every external project.
+  #
+  # This should also alleviate the anti-pattern that we've been following,
+  #  wherein each external project starts off with a copy of puppet core's
+  #  test_helper.rb and is exposed to risk of that code getting out of
+  #  sync with core.
+  #
+  # Since this class will be "library code" that ships with puppet, it does
+  #  not use API from any existing test framework such as rspec.  This should
+  #  theoretically allow it to be used with other unit test frameworks in the
+  #  future, if desired.
+  #
+  # Note that in the future this API could potentially be expanded to handle
+  #  other features such as "around_test", but we didn't see a compelling
+  #  reason to deal with that right now.
+  class TestHelper
+    # Call this method once, when beginning a test run--prior to running
+    #  any individual tests.
+    # @return nil
+    def self.before_all_tests()
+
+    end
+
+    # Call this method once, at the end of a test run, when no more tests
+    #  will be run.
+    # @return nil
+    def self.after_all_tests()
+
+    end
+
+    # Call this method once per test, prior to execution of each invididual test.
+    # @return nil
+    def self.before_each_test()
+      # We need to preserve the current state of all our indirection cache and
+      # terminus classes.  This is pretty important, because changes to these
+      # are global and lead to order dependencies in our testing.
+      #
+      # We go direct to the implementation because there is no safe, sane public
+      # API to manage restoration of these to their default values.  This
+      # should, once the value is proved, be moved to a standard API on the
+      # indirector.
+      #
+      # To make things worse, a number of the tests stub parts of the
+      # indirector.  These stubs have very specific expectations that what
+      # little of the public API we could use is, well, likely to explode
+      # randomly in some tests.  So, direct access.  --daniel 2011-08-30
+      $saved_indirection_state = {}
+      indirections = Puppet::Indirector::Indirection.send(:class_variable_get, :@@indirections)
+      indirections.each do |indirector|
+        $saved_indirection_state[indirector.name] = {
+            :@terminus_class => indirector.instance_variable_get(:@terminus_class),
+            :@cache_class    => indirector.instance_variable_get(:@cache_class)
+        }
+      end
+
+      initialize_settings_before_each()
+
+      # Longer keys are secure, but they sure make for some slow testing - both
+      # in terms of generating keys, and in terms of anything the next step down
+      # the line doing validation or whatever.  Most tests don't care how long
+      # or secure it is, just that it exists, so these are better and faster
+      # defaults, in testing only.
+      #
+      # I would make these even shorter, but OpenSSL doesn't support anything
+      # below 512 bits.  Sad, really, because a 0 bit key would be just fine.
+      Puppet[:req_bits]  = 512
+      Puppet[:keylength] = 512
+
+      Puppet::Node::Environment.clear
+      Puppet::Parser::Functions.reset
+
+      Puppet.clear_deprecation_warnings
+    end
+
+    # Call this method once per test, after execution of each individual test.
+    # @return nil
+    def self.after_each_test()
+      clear_settings_after_each()
+
+      Puppet::Util::Storage.clear
+      Puppet::Util::ExecutionStub.reset
+
+      # Restore the indirector configuration.  See before hook.
+      indirections = Puppet::Indirector::Indirection.send(:class_variable_get, :@@indirections)
+      indirections.each do |indirector|
+        $saved_indirection_state.fetch(indirector.name, {}).each do |variable, value|
+          indirector.instance_variable_set(variable, value)
+        end
+      end
+      $saved_indirection_state = nil
+
+
+      # Some tests can cause us to connect, in which case the lingering
+      # connection is a resource that can cause unexpected failure in later
+      # tests, as well as sharing state accidentally.
+      # We're testing if ActiveRecord::Base is defined because some test cases
+      # may stub Puppet.features.rails? which is how we should normally
+      # introspect for this functionality.
+      ActiveRecord::Base.remove_connection if defined?(ActiveRecord::Base)
+
+    end
+
+
+    #########################################################################################
+    # PRIVATE METHODS (not part of the public TestHelper API--do not call these from outside
+    #  of this class!)
+    #########################################################################################
+
+    def self.initialize_settings_before_each()
+      # these globals are set by Application
+      $puppet_application_mode = nil
+      $puppet_application_name = nil
+      # Set the confdir and vardir to gibberish so that tests
+      # have to be correctly mocked.
+      Puppet[:confdir] = "/dev/null"
+      Puppet[:vardir] = "/dev/null"
+
+      # Avoid opening ports to the outside world
+      Puppet[:bindaddress] = "127.0.0.1"
+    end
+    private_class_method :initialize_settings_before_each
+
+    def self.clear_settings_after_each()
+      Puppet.settings.clear
+    end
+    private_class_method :clear_settings_after_each
+  end
+end