puppet 0.18.4 → 0.22.4

data/lib/puppet/modules.rb

@@ -0,0 +1,113 @@
+# Support for modules
+class Puppet::Module
+
+    TEMPLATES = "templates"
+    FILES = "files"
+    MANIFESTS = "manifests"
+
+    # Return an array of paths by splitting the +modulepath+ config
+    # parameter. Only consider paths that are absolute and existing
+    # directories
+    def self.modulepath
+        dirs = Puppet[:modulepath].split(":")
+        if ENV["PUPPETLIB"]
+            dirs = ENV["PUPPETLIB"].split(":") + dirs
+        end
+        dirs.select do |p|
+            p =~ /^#{File::SEPARATOR}/ && File::directory?(p)
+        end
+    end
+
+    # Find and return the +module+ that +path+ belongs to. If +path+ is
+    # absolute, or if there is no module whose name is the first component
+    # of +path+, return +nil+
+    def self.find(path)
+        if path =~ %r/^#{File::SEPARATOR}/
+            return nil
+        end
+
+        modname, rest = path.split(File::SEPARATOR, 2)
+        return nil if modname.nil? || modname.empty?
+
+        modpath = modulepath.collect { |p|
+            File::join(p, modname)
+        }.find { |f| File::directory?(f) }
+        return nil unless modpath
+
+        return self.new(modname, modpath)
+    end
+
+    # Instance methods
+
+    # Find the concrete file denoted by +file+. If +file+ is absolute,
+    # return it directly. Otherwise try to find it as a template in a
+    # module. If that fails, return it relative to the +templatedir+ config
+    # param.
+    # In all cases, an absolute path is returned, which does not
+    # necessarily refer to an existing file
+    def self.find_template(file)
+        if file =~ /^#{File::SEPARATOR}/
+            return file
+        end
+
+        mod = find(file)
+        if mod
+            return mod.template(file)
+        else
+            return File.join(Puppet[:templatedir], file)
+        end
+    end
+
+    # Return a list of manifests (as absolute filenames) that match +pat+
+    # with the current directory set to +cwd+. If the first component of
+    # +pat+ does not contain any wildcards and is an existing module, return
+    # a list of manifests in that module matching the rest of +pat+
+    # Otherwise, try to find manifests matching +pat+ relative to +cwd+
+    def self.find_manifests(pat, cwd = nil)
+        cwd ||= Dir.getwd
+        mod = find(pat)
+        if mod
+            return mod.manifests(pat)
+        else
+            abspat = File::expand_path(pat, cwd)
+            files = Dir.glob(abspat).reject { |f| FileTest.directory?(f) }
+            if files.size == 0
+                files = Dir.glob(abspat + ".pp").reject { |f| FileTest.directory?(f) }
+            end
+            return files
+        end
+    end
+
+    attr_reader :name, :path
+    def initialize(name, path)
+        @name = name
+        @path = path
+    end
+
+    def strip(file)
+        n, rest = file.split(File::SEPARATOR, 2)
+        rest = nil if rest && rest.empty?
+        return rest
+    end
+
+    def template(file)
+        return File::join(path, TEMPLATES, strip(file))
+    end
+
+    def files
+        return File::join(path, FILES)
+    end
+
+    def manifests(pat)
+        rest = strip(pat)
+        rest ||= "init.pp"
+        p = File::join(path, MANIFESTS, rest)
+        files = Dir.glob(p)
+        if files.size == 0
+            files = Dir.glob(p + ".pp")
+        end
+        return files
+    end
+
+    private :initialize
+end

data/lib/puppet/network/authconfig.rb

@@ -0,0 +1,168 @@
+require 'puppet/util/loadedfile'
+require 'puppet/network/rights'
+
+module Puppet
+    class ConfigurationError < Puppet::Error; end
+    class Network::AuthConfig < Puppet::Util::LoadedFile
+
+        def self.main
+            unless defined? @main
+                @main = self.new()
+            end
+            @main
+        end
+
+        # Just proxy the setting methods to our rights stuff
+        [:allow, :deny].each do |method|
+            define_method(method) do |*args|
+                @rights.send(method, *args)
+            end         
+        end
+
+        # Here we add a little bit of semantics.  They can set auth on a whole
+        # namespace or on just a single method in the namespace.
+        def allowed?(request)
+            name        = request.call.intern
+            namespace   = request.handler.intern
+            method      = request.method.intern
+
+            read()
+
+            if @rights.include?(name)
+                return @rights[name].allowed?(request.name, request.ip)
+            elsif @rights.include?(namespace)
+                return @rights[namespace].allowed?(request.name, request.ip)
+            else
+                return false
+            end
+        end
+
+        # Does the file exist?  Puppetmasterd does not require it, but
+        # puppetd does.
+        def exists?
+            FileTest.exists?(@file)
+        end
+
+        def initialize(file = nil, parsenow = true)
+            @file ||= Puppet[:authconfig]
+
+            unless @file
+                raise Puppet::DevError, "No authconfig file defined"
+            end
+            return unless self.exists?
+            super(@file)
+            @rights = Puppet::Network::Rights.new
+            @configstamp = @configstatted = nil
+            @configtimeout = 60
+
+            if parsenow
+                read()
+            end
+        end
+
+        # Read the configuration file.
+        def read
+            return unless FileTest.exists?(@file)
+
+            if @configstamp
+                if @configtimeout and @configstatted
+                    if Time.now - @configstatted > @configtimeout
+                        @configstatted = Time.now
+                        tmp = File.stat(@file).ctime
+
+                        if tmp == @configstamp
+                            return
+                        else
+                            Puppet.notice "%s vs %s" % [tmp, @configstamp]
+                        end
+                    else
+                        return
+                    end
+                else    
+                    Puppet.notice "%s and %s" % [@configtimeout, @configstatted]
+                end
+            end
+
+            parse()
+
+            @configstamp = File.stat(@file).ctime
+            @configstatted = Time.now
+        end
+
+        private
+
+        def parse
+            newrights = Puppet::Network::Rights.new
+            begin
+                File.open(@file) { |f|
+                    right = nil
+                    count = 1
+                    f.each { |line|
+                        case line
+                        when /^\s*#/: next # skip comments
+                        when /^\s*$/: next # skip blank lines
+                        when /\[([\w.]+)\]/: # "namespace" or "namespace.method"
+                            name = $1
+                            if newrights.include?(name)
+                                raise FileServerError, "%s is already set at %s" %
+                                    [newrights[name], name]
+                            end
+                            newrights.newright(name)
+                            right = newrights[name]
+                        when /^\s*(\w+)\s+(.+)$/:
+                            var = $1
+                            value = $2
+                            case var
+                            when "allow":
+                                value.split(/\s*,\s*/).each { |val|
+                                    begin
+                                        right.info "allowing %s access" % val
+                                        right.allow(val)
+                                    rescue AuthStoreError => detail
+                                        raise ConfigurationError, "%s at line %s of %s" %
+                                            [detail.to_s, count, @config]
+                                    end
+                                }
+                            when "deny":
+                                value.split(/\s*,\s*/).each { |val|
+                                    begin
+                                        right.info "denying %s access" % val
+                                        right.deny(val)
+                                    rescue AuthStoreError => detail
+                                        raise ConfigurationError, "%s at line %s of %s" %
+                                            [detail.to_s, count, @config]
+                                    end
+                                }
+                            else
+                                raise ConfigurationError,
+                                    "Invalid argument '%s' at line %s" % [var, count]
+                            end
+                        else
+                            raise ConfigurationError, "Invalid line %s: %s" % [count, line]
+                        end
+                        count += 1
+                    }
+                }
+            rescue Errno::EACCES => detail
+                Puppet.err "Configuration error: Cannot read %s; cannot serve" % @file
+                #raise Puppet::Error, "Cannot read %s" % @config
+            rescue Errno::ENOENT => detail
+                Puppet.err "Configuration error: '%s' does not exit; cannot serve" %
+                    @file
+                #raise Puppet::Error, "%s does not exit" % @config
+            #rescue FileServerError => detail
+            #    Puppet.err "FileServer error: %s" % detail
+            end
+
+            # Verify each of the rights are valid.
+            # We let the check raise an error, so that it can raise an error
+            # pointing to the specific problem.
+            newrights.each { |name, right|
+                right.valid?
+            }
+            @rights = newrights
+        end
+    end
+end
+
+# $Id: authconfig.rb 2345 2007-03-22 15:40:28Z luke $

data/lib/puppet/network/authorization.rb

@@ -0,0 +1,84 @@
+require 'puppet/network/client_request'
+require 'puppet/network/authconfig'
+
+module Puppet::Network
+    # Most of our subclassing is just so that we can get
+    # access to information from the request object, like
+    # the client name and IP address.
+    class InvalidClientRequest < Puppet::Error; end
+    module Authorization
+        # Create our config object if necessary.  This works even if
+        # there's no configuration file.
+        def authconfig
+            unless defined? @authconfig
+                @authconfig = Puppet::Network::AuthConfig.main()
+            end
+
+            @authconfig
+        end
+
+        # Verify that our client has access.  We allow untrusted access to
+        # puppetca methods but no others.
+        def authorized?(request)
+            msg = "%s client %s access to %s" %
+                [request.authenticated? ? "authenticated" : "unauthenticated",
+                    request, request.call]
+
+            if request.authenticated?
+                if authconfig.exists?
+                    if authconfig.allowed?(request)
+                        Puppet.debug "Allowing " + msg
+                        return true
+                    else
+                        Puppet.notice "Denying " + msg
+                        return false
+                    end
+                else
+                    # This is a hack way of seeing if we're a config master.
+                    if Puppet[:name] == "puppetmasterd"
+                        Puppet.debug "Allowing " + msg
+                        return true
+                    else
+                        Puppet.notice "Denying " + msg
+                        return false
+                    end
+                end
+            else
+                if request.handler == "puppetca"
+                    Puppet.notice "Allowing " + msg
+                else
+                    Puppet.notice "Denying " + msg
+                    return false
+                end
+            end
+        end
+
+        # Is this functionality available?
+        def available?(request)
+            if handler_loaded?(request.handler)
+                return true
+            else
+                Puppet.warning "Client %s requested unavailable functionality %s" %
+                    [request, request.handler]
+                return false
+            end
+        end
+
+        # Make sure that this method is available and authorized.
+        def verify(request)
+            unless available?(request)
+                raise InvalidClientRequest.new(
+                    "Functionality %s not available" % request.handler
+                )
+            end
+            unless authorized?(request)
+                raise InvalidClientRequest.new(
+                    "Host %s not authorized to call %s" %
+                        [request, request.call]
+                )
+            end
+        end
+    end
+end
+
+# $Id: authorization.rb 2259 2007-03-06 19:03:05Z luke $

data/lib/puppet/network/authstore.rb

@@ -0,0 +1,293 @@
+# standard module for determining whether a given hostname or IP has access to
+# the requested resource
+
+require 'ipaddr'
+require 'puppet/util/logging'
+
+module Puppet
+    class AuthStoreError < Puppet::Error; end
+    class AuthorizationError < Puppet::Error; end
+
+    class Network::AuthStore
+        include Puppet::Util::Logging
+
+        # Mark a given pattern as allowed.
+        def allow(pattern)
+            # a simple way to allow anyone at all to connect
+            if pattern == "*"
+                @globalallow = true
+            else
+                store(:allow, pattern)
+            end
+
+            return nil
+        end
+
+        # Is a given combination of name and ip address allowed?  If either input
+        # is non-nil, then both inputs must be provided.  If neither input
+        # is provided, then the authstore is considered local and defaults to "true".
+        def allowed?(name, ip)
+            if name or ip
+                # This is probably unnecessary, and can cause some weirdnesses in
+                # cases where we're operating over localhost but don't have a real
+                # IP defined.
+                unless name and ip
+                    raise Puppet::DevError, "Name and IP must be passed to 'allowed?'"
+                end
+                # else, we're networked and such
+            else
+                # we're local
+                return true
+            end
+
+            # yay insecure overrides
+            if globalallow?
+                return true
+            end
+
+            if decl = @declarations.find { |d| d.match?(name, ip) }
+                return decl.result
+            end
+
+            self.info "defaulting to no access for %s" % name
+            return false
+        end
+
+        # Deny a given pattern.
+        def deny(pattern)
+            store(:deny, pattern)
+        end
+
+        # Is global allow enabled?
+        def globalallow?
+            @globalallow
+        end
+
+        def initialize
+            @globalallow = nil
+            @declarations = []
+        end
+
+        private
+
+        # Store the results of a pattern into our hash.  Basically just
+        # converts the pattern and sticks it into the hash.
+        def store(type, pattern)
+            @declarations << Declaration.new(type, pattern)
+            @declarations.sort!
+
+            return nil
+        end
+
+        # A single declaration.  Stores the info for a given declaration,
+        # provides the methods for determining whether a declaration matches,
+        # and handles sorting the declarations appropriately.
+        class Declaration
+            include Puppet::Util
+            include Comparable
+
+            # The type of declaration: either :allow or :deny
+            attr_reader :type
+
+            # The name: :ip or :domain
+            attr_accessor :name
+
+            # The pattern we're matching against.  Can be an IPAddr instance,
+            # or an array of strings, resulting from reversing a hostname
+            # or domain name.
+            attr_reader :pattern
+
+            # The length.  Only used for iprange and domain.
+            attr_accessor :length
+
+            # Sort the declarations specially.
+            def <=>(other)
+                # Sort first based on whether the matches are exact.
+                if r = compare(exact?, other.exact?)
+                    return r
+                end
+
+                # Then by type
+                if r = compare(self.ip?, other.ip?)
+                    return r
+                end
+
+                # Next sort based on length
+                unless self.length == other.length
+                    # Longer names/ips should go first, because they're more
+                    # specific.
+                    return other.length <=> self.length
+                end
+
+                # Then sort deny before allow
+                if r = compare(self.deny?, other.deny?)
+                    return r
+                end
+
+                # We've already sorted by name and length, so all that's left
+                # is the pattern
+                if ip?
+                    return self.pattern.to_s <=> other.pattern.to_s
+                else
+                    return self.pattern <=> other.pattern
+                end
+            end
+
+            def deny?
+                self.type == :deny
+            end
+
+            # Are we an exact match?
+            def exact?
+                self.length.nil?
+            end
+
+            def initialize(type, pattern)
+                self.type = type
+                self.pattern = pattern
+            end
+
+            # Are we an IP type?
+            def ip?
+                self.name == :ip
+            end
+
+            # Does this declaration match the name/ip combo?
+            def match?(name, ip)
+                if self.ip?
+                    return pattern.include?(IPAddr.new(ip))
+                else
+                    return matchname?(name)
+                end
+            end
+
+            # Set the pattern appropriately.  Also sets the name and length.
+            def pattern=(pattern)
+                parse(pattern)
+                @orig = pattern
+            end
+
+            # Mapping a type of statement into a return value.
+            def result
+                case @type
+                when :allow: true
+                else
+                    false
+                end
+            end
+
+            def to_s
+                "%s: %s" % [self.type, self.pattern]
+            end
+
+            # Set the declaration type.  Either :allow or :deny.
+            def type=(type)
+                type = symbolize(type)
+                unless [:allow, :deny].include?(type)
+                    raise ArgumentError, "Invalid declaration type %s" % type
+                end
+                @type = type
+            end
+
+            private
+
+            # Returns nil if both values are true or both are false, returns
+            # -1 if the first is true, and 1 if the second is true.  Used
+            # in the <=> operator.
+            def compare(me, them)
+                unless me and them
+                    if me
+                        return -1
+                    elsif them
+                        return 1
+                    else
+                        return false
+                    end
+                end
+                return nil
+            end
+
+            # Does the name match our pattern?
+            def matchname?(name)
+                name = munge_name(name)
+                return true if self.pattern == name
+
+                # If it's an exact match, then just return false, since the
+                # exact didn't match.
+                if exact?
+                    return false
+                end
+
+                # If every field in the pattern matches, then we consider it
+                # a match.
+                pattern.zip(name) do |p,n|
+                    unless p == n
+                        return false
+                    end
+                end
+
+                return true
+            end
+
+            # Convert the name to a common pattern.
+            def munge_name(name)
+                name.downcase.split(".").reverse
+            end
+
+            # Parse our input pattern and figure out what kind of allowal
+            # statement it is.  The output of this is used for later matching.
+            def parse(value)
+                case value
+                when /^(\d+\.){1,3}\*$/: # an ip address with a '*' at the end
+                    @name = :ip
+                    match = $1
+                    match.sub!(".", '')
+                    ary = value.split(".")
+
+                    mask = case ary.index(match)
+                    when 0: 8
+                    when 1: 16
+                    when 2: 24
+                    else
+                        raise AuthStoreError, "Invalid IP pattern %s" % value
+                    end
+
+                    @length = mask
+
+                    ary.pop
+                    while ary.length < 4
+                        ary.push("0")
+                    end
+
+                    begin
+                        @pattern = IPAddr.new(ary.join(".") + "/" + mask.to_s)
+                    rescue ArgumentError => detail
+                        raise AuthStoreError, "Invalid IP address pattern %s" % value
+                    end
+                when /^([a-zA-Z][-\w]*\.)+[-\w]+$/: # a full hostname
+                    @name = :domain
+                    @pattern = munge_name(value)
+                when /^\*(\.([a-zA-Z][-\w]*)){1,}$/: # *.domain.com
+                    @name = :domain
+                    @pattern = munge_name(value)
+                    @pattern.pop # take off the '*'
+                    @length = @pattern.length
+                else
+                    # Else, use the IPAddr class to determine if we've got a
+                    # valid IP address.
+                    if value =~ /\/(\d+)$/
+                        @length = Integer($1)
+                    end
+                    begin
+                        @pattern = IPAddr.new(value)
+                    rescue ArgumentError => detail
+                        raise AuthStoreError, "Invalid pattern %s" % value
+                    end
+                    @name = :ip
+                end
+            end
+        end
+    end
+end
+
+# $Id: authstore.rb 2262 2007-03-08 00:16:53Z luke $