puppet 0.18.4 → 0.22.4

data/bin/puppetca

@@ -9,7 +9,7 @@
 # = Usage
 #
 #   puppetca [-h|--help] [-V|--version] [-d|--debug] [-v|--verbose]
-#               [-g|--generate] [-l|--list] [-s|--sign]
+#               [-g|--generate] [-l|--list] [-s|--sign] [-r|--revoke]
 #               [-c|--clean] [host]
 #
 # = Description
@@ -25,13 +25,20 @@
 # is also a valid long argument.  For example, 'ssldir' is a valid configuration
 # parameter, so you can specify '--ssldir <directory>' as an argument.
 #
-# See the configuration file for the full list of acceptable parameters.
+# See the configuration file documentation at
+# http://reductivelabs.com/projects/puppet/reference/configref.html for
+# the full list of acceptable parameters. A commented list of all
+# configuration options can also be generated by running puppetca with
+# '--genconfig'.
 #
 # all::
 #   Operate on all outstanding requests.  Only makes sense with '--sign'.
 #
 # clean::
-#    Remove all traces of a host.  This is useful when rebuilding hosts.
+#    Remove all files related to a host from puppetca's storage. This is 
+#    useful when rebuilding hosts, since new certificate signing requests
+#    will only be honored if puppetca does not have a copy of a signed
+#    certificate for that host. The certificate of the host remains valid.
 #
 # debug::
 #   Enable full debugging.
@@ -46,6 +53,14 @@
 # list::
 #   List outstanding certificate requests.
 #
+# revoke::
+#   Revoke the certificate of a client. The certificate can be specified
+#   either by its serial number, given as a decimal number or a hexadecimal
+#   number prefixed by '0x', or by its hostname. The certificate is revoked
+#   by adding it to the Certificate Revocation List given by the 'cacrl'
+#   config parameter. Note that the puppetmasterd needs to be restarted
+#   after revoking certificates.
+#
 # sign::
 #   Sign an outstanding certificate request.  Unless '--all' is specified,
 #   hosts must be listed after all flags.
@@ -53,6 +68,9 @@
 # verbose::
 #   Enable verbosity.
 #
+# version::
+#   Print the puppet version number and exit.
+#
 # = Example
 #
 #   $ puppetca -l
@@ -72,23 +90,17 @@ require 'puppet'
 require 'puppet/sslcertificates'
 require 'getoptlong'
 
-$haveusage = true
-
-begin
-    require 'rdoc/usage'
-rescue LoadError
-    $haveusage = false
-end
-
 options = [
-	[ "--all",	    "-a",			GetoptLong::NO_ARGUMENT ],
-	[ "--clean",    "-c",			GetoptLong::NO_ARGUMENT ],
-	[ "--debug",    "-d",			GetoptLong::NO_ARGUMENT ],
-	[ "--generate", "-g",  			GetoptLong::NO_ARGUMENT ],
-	[ "--help",		"-h",			GetoptLong::NO_ARGUMENT ],
-	[ "--list",	    "-l",			GetoptLong::NO_ARGUMENT ],
-	[ "--sign",	    "-s",			GetoptLong::NO_ARGUMENT ],
-	[ "--verbose",  "-v",			GetoptLong::NO_ARGUMENT ]
+    [ "--all",      "-a",  GetoptLong::NO_ARGUMENT ],
+    [ "--clean",    "-c",  GetoptLong::NO_ARGUMENT ],
+    [ "--debug",    "-d",  GetoptLong::NO_ARGUMENT ],
+    [ "--generate", "-g",  GetoptLong::NO_ARGUMENT ],
+    [ "--help",     "-h",  GetoptLong::NO_ARGUMENT ],
+    [ "--list",     "-l",  GetoptLong::NO_ARGUMENT ],
+    [ "--revoke",   "-r",  GetoptLong::NO_ARGUMENT ],
+    [ "--sign",     "-s",  GetoptLong::NO_ARGUMENT ],
+	[ "--version",	"-V",  GetoptLong::NO_ARGUMENT ],
+    [ "--verbose",  "-v",  GetoptLong::NO_ARGUMENT ]
 ]
 
 # Add all of the config parameters as valid options.
@@ -108,12 +120,12 @@ begin
             when "--clean"
                 mode = :clean
             when "--debug"
-                Puppet::Log.level = :debug
+                Puppet::Util::Log.level = :debug
             when "--generate"
                 generate = arg
                 mode = :generate
             when "--help"
-                if $haveusage
+                if Puppet.features.usage?
                     RDoc::usage && exit
                 else
                     puts "No help available unless you have RDoc::usage installed"
@@ -121,19 +133,21 @@ begin
                 end
             when "--list"
                 mode = :list
+            when "--revoke"
+                mode = :revoke
             when "--sign"
                 mode = :sign
+            when "--version"
+                puts "%s" % Puppet.version
+                exit
             when "--verbose"
-                Puppet::Log.level = :info
+                Puppet::Util::Log.level = :info
             else
                 Puppet.config.handlearg(opt, arg)
         end
     }
 rescue GetoptLong::InvalidOption => detail
     $stderr.puts "Try '#{$0} --help'"
-    #if $haveusage
-    #    RDoc::usage_no_exit('usage')
-    #end
     exit(1)
 end
 
@@ -160,25 +174,34 @@ unless mode
     exit(12)
 end
 
-if mode == :generate or mode == :clean
-    hosts = ARGV
+if [:generate, :clean, :revoke].include?(mode)
+    hosts = ARGV.collect { |h| h.downcase }
 else
-    hosts = ca.list
-    unless hosts.length > 0
+    waiting = ca.list
+    unless waiting.length > 0
         puts "No certificates to sign"
-        exit(0)
+        if ARGV.length > 0
+            exit(17)
+        else
+            exit(0)
+        end
     end
+    to_sign = ARGV.collect { |h| h.downcase }
 end
 
 case mode
 when :list
-    puts hosts.join("\n")
+    puts waiting.join("\n")
 when :clean
+    if hosts.empty?
+        $stderr.puts "You must specify one or more hosts to clean"
+        exit(24)
+    end
     hosts.each do |host|
         ca.clean(host)
     end
 when :sign
-    unless ARGV.length > 0 or all
+    unless to_sign.length > 0 or all
         $stderr.puts(
             "You must specify to sign all certificates or you must specify hostnames"
         )
@@ -186,17 +209,17 @@ when :sign
     end
 
     unless all
-        ARGV.each { |host|
-            unless hosts.include?(host)
+        to_sign.each { |host|
+            unless waiting.include?(host)
                 $stderr.puts "No waiting request for %s" % host
             end
         }
-        hosts = hosts.find_all { |host|
-            ARGV.include?(host)
+        waiting = waiting.find_all { |host|
+            to_sign.include?(host)
         }
     end
 
-    hosts.each { |host|
+    waiting.each { |host|
         begin
             csr = ca.getclientcsr(host)
         rescue => detail
@@ -230,9 +253,29 @@ when :generate
         cert.cacert = cacert
         cert.write
     }
+when :revoke
+    hosts.each { |h|
+        serial = nil
+        if h =~ /^0x[0-9a-f]+$/
+            serial = h.to_i(16)
+        elsif h =~ /^[0-9]+$/
+            serial = h.to_i
+        else
+            cert = ca.getclientcert(h)[0]
+            if cert.nil?
+                $stderr.puts "Could not find client certificate for %s" % h
+            else
+                serial = cert.serial
+            end
+        end
+        unless serial.nil?
+            ca.revoke(serial)
+            puts "Revoked certificate with serial #{serial}"
+        end
+    }
 else
     $stderr.puts "Invalid mode %s" % mode
     exit(42)
 end
 
-# $Id: puppetca 1338 2006-06-29 19:29:05Z luke $
+# $Id: puppetca 2391 2007-04-17 18:54:52Z luke $

data/bin/puppetd

@@ -34,19 +34,19 @@
 # configuration every 30 minutes.
 #
 # Some flags are meant specifically for interactive use -- in particular,
-# +test+ and +tag+ are useful.  +test+ enables verobse logging, causes
+# +test+ and +tags+ are useful.  +test+ enables verobse logging, causes
 # the daemon to stay in the foreground, exits if the server's configuration is
 # invalid (this happens if, for instance, you've left a syntax error on the
 # server), and exits after running the configuration once (rather than hanging
 # around as a long-running process).
 #
-# +tag+ allows you to specify what portions of a configuration you want to apply.
+# +tags+ allows you to specify what portions of a configuration you want to apply.
 # Puppet elements are tagged with all of the class or definition names that
-# contain them, and you can use the +tag+ flag to specify one of these names,
+# contain them, and you can use the +tags+ flag to specify one of these names,
 # causing only configuration elements contained within that class or definition
 # to be applied.  This is very useful when you are testing new configurations --
 # for instance, if you are just starting to manage +ntpd+, you would put all of
-# the new elements into an +ntpd+ class, and call puppet with +--tag ntpd+,
+# the new elements into an +ntpd+ class, and call puppet with +--tags ntpd+,
 # which would only apply that small portion of the configuration during your
 # testing, rather than applying the whole thing.
 #
@@ -57,8 +57,10 @@
 # parameter, so you can specify '--server <servername>' as an argument.
 #
 # See the configuration file documentation at
-# http://reductivelabs.com/projects/puppet/documentation/puppet-executable-reference
-# for the full list of acceptable parameters.
+# http://reductivelabs.com/projects/puppet/reference/configref.html for
+# the full list of acceptable parameters. A commented list of all
+# configuration options can also be generated by running puppetd with
+# '--genconfig'.
 #
 # daemonize::
 #   Send the process into the background.  This is the default unless
@@ -99,6 +101,11 @@
 #   Defaults to sending messages to syslog, or the console if debugging or
 #   verbosity is enabled.
 #
+# no-client::
+#   Do not create a config client.  This will cause the daemon to run
+#   without ever checking for its configuration automatically, and only
+#   makes sense when used in conjunction with --listen.
+#
 # onetime::
 #   Run the configuration once, rather than as a long-running daemon.  This is
 #   useful for interactively running puppetd.
@@ -112,7 +119,7 @@
 #
 # test::
 #   Enable the most common options used for testing.  These are +onetime+,
-#   +verbose+, and +no-usecacheonfailure+.
+#   +verbose+, +ignorecache, and +no-usecacheonfailure+.
 #
 # verbose::
 #   Turn on verbose reporting.
@@ -148,17 +155,9 @@ trap(:INT) do
 end
 
 require 'puppet'
-require 'puppet/server'
-require 'puppet/client'
+require 'puppet/network/client'
 require 'getoptlong'
 
-$haveusage = true
-begin
-    require 'rdoc/usage'
-rescue LoadError
-    $haveusage = false
-end
-
 options = [
 	[ "--centrallogging",			GetoptLong::NO_ARGUMENT ],
 	[ "--daemonize", "-D",			GetoptLong::NO_ARGUMENT ],
@@ -196,6 +195,7 @@ options = {
 }
 
 begin
+    explicit_waitforcert = false
     result.each { |opt,arg|
         case opt
             # First check to see if the argument is a valid configuration parameter;
@@ -205,23 +205,25 @@ begin
             when "--disable"
                 options[:disable] = true
             when "--serve"
-                if klass = Puppet::Server::Handler.handler(arg)
+                if klass = Puppet::Network::Server::Handler.handler(arg)
                     options[:serve][klass.name] = klass
                 end
             when "--enable"
                 options[:enable] = true
             when "--test"
                 # Enable all of the most common test options.
+                Puppet.config.handlearg("--ignorecache")
                 Puppet.config.handlearg("--no-usecacheonfailure")
                 options[:onetime] = true
-                unless Puppet::Log.level == :debug
-                    Puppet::Log.level = :info
+                options[:waitforcert] = 0
+                unless Puppet::Util::Log.level == :debug
+                    Puppet::Util::Log.level = :info
                 end
-                Puppet::Log.newdestination(:console)
+                Puppet::Util::Log.newdestination(:console)
             when "--centrallogging"
                 options[:centrallogs] = true
             when "--help"
-                if $haveusage
+                if Puppet.features.usage?
                     RDoc::usage && exit
                 else
                     puts "No help available unless you have RDoc::usage installed"
@@ -231,28 +233,30 @@ begin
                 puts "%s" % Puppet.version
                 exit
             when "--verbose"
-                Puppet::Log.level = :info
-                Puppet::Log.newdestination(:console)
+                Puppet::Util::Log.level = :info
+                Puppet::Util::Log.newdestination(:console)
             when "--debug"
-                Puppet::Log.level = :debug
-                Puppet::Log.newdestination(:console)
+                Puppet::Util::Log.level = :debug
+                Puppet::Util::Log.newdestination(:console)
             when "--fqdn"
                 options[:fqdn] = arg
             when "--no-client"
                 options[:client] = false
             when "--onetime"
                 options[:onetime] = true
+                options[:waitforcert] = 0 unless explicit_waitforcert
             when "--port"
                 args[:Port] = arg
             when "--logdest"
                 begin
-                    Puppet::Log.newdestination(arg)
+                    Puppet::Util::Log.newdestination(arg)
                     options[:setdest] = true
                 rescue => detail
                     $stderr.puts detail.to_s
                 end
             when "--waitforcert"
                 options[:waitforcert] = arg.to_i
+                explicit_waitforcert = true
             else
                 Puppet.config.handlearg(opt, arg)
         end
@@ -260,25 +264,21 @@ begin
 rescue GetoptLong::InvalidOption => detail
     $stderr.puts detail
     $stderr.puts "Try '#{$0} --help'"
-    # FIXME RDoc::usage doesn't seem to work
-    #if $haveusage
-    #    RDoc::usage(1,'usage')
-    #end
     exit(1)
 end
 
-Puppet.genconfig
-Puppet.genmanifest
-
 # Now parse the config
 if Puppet[:config] and File.exists? Puppet[:config]
     Puppet.config.parse(Puppet[:config])
 end
 
+Puppet.genconfig
+Puppet.genmanifest
+
 # Default to daemonizing, but if verbose or debug is specified,
 # default to staying in the foreground.
 unless options.include?(:daemonize)
-    if Puppet::Log.level == :debug or Puppet::Log.level == :info
+    if Puppet::Util::Log.level == :debug or Puppet::Util::Log.level == :info
         options[:daemonize] = false
     else
         options[:daemonize] = true
@@ -286,12 +286,12 @@ unless options.include?(:daemonize)
 end
 
 unless options[:setdest]
-    Puppet::Log.newdestination(:syslog)
+    Puppet::Util::Log.newdestination(:syslog)
 end
 
 args[:Server] = Puppet[:server]
 if options[:fqdn]
-    args[:FQDN] = fqdn
+    args[:FQDN] = options[:fqdn]
 end
 
 if options[:centrallogs]
@@ -300,16 +300,12 @@ if options[:centrallogs]
     if args.include?(:Port)
         logdest += ":" + args[:Port]
     end
-    Puppet::Log.newdestination(logdest)
-end
-
-if options[:onetime]
-    Puppet[:setpidfile] = false
+    Puppet::Util::Log.newdestination(logdest)
 end
 
 # We need tomake the client either way, we just don't start it
 # if --no-client is set.
-client = Puppet::Client::MasterClient.new(args)
+client = Puppet::Network::Client.master.new(args)
 if options[:enable]
     client.enable
 elsif options[:disable]
@@ -328,13 +324,13 @@ if options[:daemonize]
     client.daemonize
 end
 
-unless client.readcert
+unless client.read_cert
     # If we don't already have the certificate, then create a client to
-    # request one.
-    caclient = Puppet::Client::CA.new(args)
+    # request one.  Use the special ca stuff, don't use the normal server and port.
+    caclient = Puppet::Network::Client.ca.new()
     if options[:waitforcert] > 0
         begin
-            while ! caclient.requestcert do
+            while ! caclient.request_cert do
                 Puppet.notice "Did not receive certificate"
                 sleep options[:waitforcert]
             end
@@ -343,14 +339,16 @@ unless client.readcert
             exit(23)
         end
     else
-        unless caclient.requestcert
+        unless caclient.request_cert
             Puppet.notice "No certificates; exiting"
             exit(1)
         end
     end
 
     # Now read the new cert in.
-    unless client.readcert
+    if client.read_cert
+        Puppet.notice "Got signed certificate"
+    else
         Puppet.err "Could not read certificates after retrieving them"
         exit(34)
     end
@@ -359,13 +357,20 @@ end
 objects = []
 
 # This has to go after the certs are dealt with.
-if Puppet[:listen]
+if Puppet[:listen] and ! options[:onetime]
     unless FileTest.exists?(Puppet[:authconfig])
-        $stderr.puts "Will not start without authorization file %s" %
+        Puppet.err "Will not start without authorization file %s" %
             Puppet[:authconfig]
         exit(14)
     end
 
+    # FIXME: we should really figure out how to distribute the CRL
+    # to clients. In the meantime, we just disable CRL checking if
+    # the CRL file doesn't exist
+    unless File::exist?(Puppet[:cacrl])
+        Puppet[:cacrl] = 'none'
+    end
+
     handlers = nil
 
     if options[:serve].empty?
@@ -383,8 +388,10 @@ if Puppet[:listen]
     args[:Handlers] = handlers
     args[:Port] = Puppet[:puppetport]
 
+    require 'puppet/network/server/webrick'
+
     begin
-        server = Puppet::Server.new(args)
+        server = Puppet::Network::Server::WEBrick.new(args)
     rescue => detail
         $stderr.puts detail
         puts detail.backtrace
@@ -392,11 +399,10 @@ if Puppet[:listen]
     end
 
     objects << server
+elsif options[:onetime] and Puppet[:listen]
+    Puppet.notice "Ignoring --listen on onetime run"
 end
 
-# now set up the network client with the certs, now that we have them
-client.setcerts
-
 if options[:client]
     objects << client
 end
@@ -404,26 +410,24 @@ end
 # Set traps for INT and TERM
 Puppet.settraps
 
+# If --onetime is specified, we don't run 'start', which means we don't
+# create a pidfile.
 if options[:onetime]
     unless options[:client]
         $stderr.puts "onetime is specified but there is no client"
         exit(43)
     end
 
-    if server
-        Puppet.notice "Ignoring --listen on onetime run"
-    end
-
     # Add the service, so the traps work correctly.
     Puppet.newservice(client)
 
     begin
         client.run
     rescue => detail
-        Puppet.err detail.to_s
-        if Puppet[:debug]
+        if Puppet[:trace]
             puts detail.backtrace
         end
+        Puppet.err detail.to_s
     end
     exit(0)
 else
@@ -441,5 +445,4 @@ else
     Puppet.start
 end
 
-
-# $Id: puppetd 1415 2006-07-21 15:37:15Z luke $
+# $Id: puppetd 2375 2007-03-30 23:17:40Z luke $