puppet 0.23.2 → 0.24.0

data/lib/puppet/sslcertificates.rb

@@ -9,7 +9,7 @@ rescue LoadError
 end
 
 module Puppet::SSLCertificates
-    #def self.mkcert(type, name, ttl, issuercert, issuername, serial, publickey)
+    #def self.mkcert(type, name, dnsnames, ttl, issuercert, issuername, serial, publickey)
     def self.mkcert(hash)
         [:type, :name, :ttl, :issuer, :serial, :publickey].each { |param|
             unless hash.include?(param)
@@ -39,6 +39,7 @@ module Puppet::SSLCertificates
         basic_constraint = nil
         key_usage = nil
         ext_key_usage = nil
+        subject_alt_name = []
 
         ef = OpenSSL::X509::ExtensionFactory.new
 
@@ -60,16 +61,26 @@ module Puppet::SSLCertificates
             key_usage = %w{cRLSign keyCertSign}
         when :server:
             basic_constraint = "CA:FALSE"
+            dnsnames = Puppet[:certdnsnames]
+            name = hash[:name].to_s.sub(%r{/CN=},'')
+            if dnsnames != ""
+                dnsnames.split(':').each { |d| subject_alt_name << 'DNS:' + d }
+                subject_alt_name << 'DNS:' + name # Add the fqdn as an alias
+            elsif name == Facter.value(:fqdn) # we're a CA server, and thus probably the server
+                subject_alt_name << 'DNS:' + "puppet" # Add 'puppet' as an alias
+                subject_alt_name << 'DNS:' + name # Add the fqdn as an alias
+                subject_alt_name << 'DNS:' + name.sub(/^[^.]+./, "puppet.") # add puppet.domain as an alias
+            end
             key_usage = %w{digitalSignature keyEncipherment}
-        ext_key_usage = %w{serverAuth clientAuth}
+            ext_key_usage = %w{serverAuth clientAuth}
         when :ocsp:
             basic_constraint = "CA:FALSE"
             key_usage = %w{nonRepudiation digitalSignature}
-        ext_key_usage = %w{serverAuth OCSPSigning}
+            ext_key_usage = %w{serverAuth OCSPSigning}
         when :client:
             basic_constraint = "CA:FALSE"
             key_usage = %w{nonRepudiation digitalSignature keyEncipherment}
-        ext_key_usage = %w{clientAuth emailProtection}
+            ext_key_usage = %w{clientAuth emailProtection}
             ex << ef.create_extension("nsCertType", "client,email")
         else
             raise Puppet::Error, "unknown cert type '%s'" % hash[:type]
@@ -80,12 +91,9 @@ module Puppet::SSLCertificates
         ex << ef.create_extension("basicConstraints", basic_constraint, true)
         ex << ef.create_extension("subjectKeyIdentifier", "hash")
 
-        if key_usage
-          ex << ef.create_extension("keyUsage", key_usage.join(","))
-        end
-        if ext_key_usage
-          ex << ef.create_extension("extendedKeyUsage", ext_key_usage.join(","))
-        end
+        ex << ef.create_extension("keyUsage", key_usage.join(",")) if key_usage
+        ex << ef.create_extension("extendedKeyUsage", ext_key_usage.join(",")) if ext_key_usage
+	    ex << ef.create_extension("subjectAltName", subject_alt_name.join(",")) if ! subject_alt_name.empty?
 
         #if @ca_config[:cdp_location] then
         #  ex << ef.create_extension("crlDistributionPoints",
@@ -99,10 +107,7 @@ module Puppet::SSLCertificates
         cert.extensions = ex
 
         # for some reason this _must_ be the last extension added
-        if hash[:type] == :ca
-            ex << ef.create_extension("authorityKeyIdentifier",
-                                      "keyid:always,issuer:always")
-        end
+        ex << ef.create_extension("authorityKeyIdentifier", "keyid:always,issuer:always") if hash[:type] == :ca
 
         return cert
     end
@@ -142,4 +147,3 @@ module Puppet::SSLCertificates
     require 'puppet/sslcertificates/ca'
 end
 
-# $Id: sslcertificates.rb 2463 2007-05-04 23:09:34Z luke $

data/lib/puppet/sslcertificates/ca.rb

@@ -1,3 +1,5 @@
+require 'sync'
+
 class Puppet::SSLCertificates::CA
     include Puppet::Util::Warnings
 
@@ -51,7 +53,7 @@ class Puppet::SSLCertificates::CA
     end
 
     def initialize(hash = {})
-        Puppet.config.use(:main, :ca, :ssl)
+        Puppet.settings.use(:main, :ca, :ssl)
         self.setconfig(hash)
 
         if Puppet[:capass]
@@ -71,7 +73,7 @@ class Puppet::SSLCertificates::CA
         self.getcert
         init_crl
         unless FileTest.exists?(@config[:serial])
-            Puppet.config.write(:serial) do |f|
+            Puppet.settings.write(:serial) do |f|
                 f << "%04X" % 1
             end
         end
@@ -83,7 +85,7 @@ class Puppet::SSLCertificates::CA
         20.times { pass += (rand(74) + 48).chr }
 
         begin
-            Puppet.config.write(:capass) { |f| f.print pass }
+            Puppet.settings.write(:capass) { |f| f.print pass }
         rescue Errno::EACCES => detail
             raise Puppet::Error, detail.to_s
         end
@@ -140,6 +142,16 @@ class Puppet::SSLCertificates::CA
         }
     end
 
+    # List signed certificates.  This returns a list of hostnames, not actual 
+    # files -- the names can be converted to full paths with host2csrfile. 
+    def list_signed 
+        return Dir.entries(Puppet[:signeddir]).find_all { |file| 
+            file =~ /\.pem$/ 
+        }.collect { |file| 
+            file.sub(/\.pem$/, '') 
+        } 
+    end 
+
     # Create the root certificate.
     def mkrootcert
         # Make the root cert's name the FQDN of the host running the CA.
@@ -161,10 +173,10 @@ class Puppet::SSLCertificates::CA
         Puppet::Util::SUIDManager.asuser(Puppet[:user], Puppet[:group]) do
             @cert = cert.mkselfsigned
         end
-        Puppet.config.write(:cacert) do |f|
+        Puppet.settings.write(:cacert) do |f|
             f.puts @cert.to_pem
         end
-        Puppet.config.write(:capub) do |f|
+        Puppet.settings.write(:capub) do |f|
             f.puts @cert.public_key
         end
         return cert
@@ -199,7 +211,7 @@ class Puppet::SSLCertificates::CA
     # Take the Puppet config and store it locally.
     def setconfig(hash)
         @config = {}
-        Puppet.config.params("ca").each { |param|
+        Puppet.settings.params("ca").each { |param|
             param = param.intern if param.is_a? String
             if hash.include?(param)
                 @config[param] = hash[param]
@@ -226,6 +238,33 @@ class Puppet::SSLCertificates::CA
         }
     end
 
+    # Create an exclusive lock for reading and writing, and do the
+    # writing in a tmp file.
+    def readwritelock(file, mode = 0600)
+        tmpfile = file + ".tmp"
+        sync = Sync.new
+        unless FileTest.directory?(File.dirname(tmpfile))
+            raise Puppet::DevError, "Cannot create %s; directory %s does not exist" %
+                [file, File.dirname(file)]
+        end
+        sync.synchronize(Sync::EX) do
+            File.open(file, "r+", mode) do |rf|
+                rf.lock_exclusive do
+                    File.open(tmpfile, "w", mode) do |tf|
+                        yield tf
+                    end
+                    begin
+                        File.rename(tmpfile, file)
+                    rescue => detail
+                        Puppet.err "Could not rename %s to %s: %s" %
+                            [file, tmpfile, detail]
+                    end
+                end
+            end
+        end
+    end
+
+
     # Sign a given certificate request.
     def sign(csr)
         unless csr.is_a?(OpenSSL::X509::Request)
@@ -238,7 +277,14 @@ class Puppet::SSLCertificates::CA
             raise Puppet::Error, "CSR sign verification failed"
         end
 
-        serial = File.read(@config[:serial]).chomp.hex
+        serial = nil
+        readwritelock(@config[:serial]) { |f|
+            serial = File.read(@config[:serial]).chomp.hex
+
+            # increment the serial
+            f << "%04X" % (serial + 1)
+        }
+
         newcert = Puppet::SSLCertificates.mkcert(
             :type => :server,
             :name => csr.subject,
@@ -248,10 +294,6 @@ class Puppet::SSLCertificates::CA
             :publickey => csr.public_key
         )
 
-        # increment the serial
-        Puppet.config.write(:serial) do |f|
-            f << "%04X" % (serial + 1)
-        end
 
         sign_with_key(newcert)
 
@@ -271,7 +313,7 @@ class Puppet::SSLCertificates::CA
             raise Puppet::Error, "Certificate request for %s already exists" % host
         end
 
-        Puppet.config.writesub(:csrdir, csrfile) do |f|
+        Puppet.settings.writesub(:csrdir, csrfile) do |f|
             f.print csr.to_pem
         end
     end
@@ -287,7 +329,7 @@ class Puppet::SSLCertificates::CA
         end
 
         Puppet::SSLCertificates::Inventory::add(cert)
-        Puppet.config.writesub(:signeddir, certfile) do |f|
+        Puppet.settings.writesub(:signeddir, certfile) do |f|
             f.print cert.to_pem
         end
     end
@@ -357,7 +399,7 @@ class Puppet::SSLCertificates::CA
         @crl.next_update = now + 5 * 365*24*60*60
 
         sign_with_key(@crl)
-        Puppet.config.write(:cacrl) do |f|
+        Puppet.settings.write(:cacrl) do |f|
             f.puts @crl.to_pem
         end
     end
@@ -382,4 +424,3 @@ class Puppet::SSLCertificates::CA
     end
 end
 
-# $Id: ca.rb 2463 2007-05-04 23:09:34Z luke $

data/lib/puppet/sslcertificates/certificate.rb

@@ -280,4 +280,3 @@ class Puppet::SSLCertificates::Certificate
     end
 end
 
-# $Id: certificate.rb 1581 2006-09-13 16:50:43Z lutter $

data/lib/puppet/sslcertificates/inventory.rb

@@ -11,11 +11,8 @@ module Puppet::SSLCertificates
                 inited = false
             end
 
-            Puppet.config.write(:cert_inventory, "a") do |f|
-                unless inited
-                    f.puts self.init
-                end
-                f.puts format(cert)
+            Puppet.settings.write(:cert_inventory, "a") do |f|
+                f.puts((inited ? nil : self.init).to_s + format(cert))
             end
         end
 
@@ -40,4 +37,3 @@ module Puppet::SSLCertificates
     end
 end
 
-# $Id$

data/lib/puppet/sslcertificates/monkey_patch.rb

@@ -0,0 +1,6 @@
+# This is the file that we use to add indirection to all the SSL Certificate classes.
+
+require 'puppet/indirector'
+
+OpenSSL::PKey::RSA.extend Puppet::Indirector
+OpenSSL::PKey::RSA.indirects :ssl_rsa, :terminus_class => :file

data/lib/puppet/sslcertificates/support.rb

@@ -44,7 +44,7 @@ module Puppet::SSLCertificates::Support
             unless instance_variable_get(var)
                 unless cert = send(reader)
                     cert = send(maker)
-                    Puppet.config.write(param) { |f| f.puts cert.to_pem }
+                    Puppet.settings.write(param) { |f| f.puts cert.to_pem }
                 end
                 instance_variable_set(var, cert)
             end
@@ -59,7 +59,7 @@ module Puppet::SSLCertificates::Support
 
         # Our key meta programming can only handle one file, so we have
         # to separately write out the public key.
-        Puppet.config.write(:hostpubkey) do |f|
+        Puppet.settings.write(:hostpubkey) do |f|
             f.print key.public_key.to_pem
         end
         return key
@@ -104,8 +104,8 @@ module Puppet::SSLCertificates::Support
         if cert.nil? or cert == ""
             return nil
         end
-        Puppet.config.write(:hostcert) do |f| f.print cert end
-        Puppet.config.write(:localcacert) do |f| f.print cacert end
+        Puppet.settings.write(:hostcert) do |f| f.print cert end
+        Puppet.settings.write(:localcacert) do |f| f.print cacert end
         #File.open(@certfile, "w", 0644) { |f| f.print cert }
         #File.open(@cacertfile, "w", 0644) { |f| f.print cacert }
         begin
@@ -125,4 +125,3 @@ module Puppet::SSLCertificates::Support
     end
 end
 
-# $Id: support.rb 2259 2007-03-06 19:03:05Z luke $

data/lib/puppet/transaction.rb

@@ -6,10 +6,14 @@ require 'puppet/propertychange'
 
 module Puppet
 class Transaction
-    attr_accessor :component, :resources, :ignoreschedules, :ignoretags
-    attr_accessor :relgraph, :sorted_resources, :configurator
+    attr_accessor :component, :catalog, :ignoreschedules
+    attr_accessor :sorted_resources, :configurator
 
+    # The report, once generated.
     attr_reader :report
+
+    # The list of events generated in this transaction.
+    attr_reader :events
     
     attr_writer :tags
 
@@ -22,13 +26,14 @@ class Transaction
         end
     end
 
-    # Check to see if we should actually allow deleition.
+    # Check to see if we should actually allow processing, but this really only
+    # matters when a resource is getting deleted.
     def allow_processing?(resource, changes)
         # If a resource is going to be deleted but it still has
         # dependencies, then don't delete it unless it's implicit or the
         # dependency is itself being deleted.
         if resource.purging? and resource.deleting?
-            if deps = @relgraph.dependents(resource) and ! deps.empty? and deps.detect { |d| ! d.deleting? }
+            if deps = relationship_graph.dependents(resource) and ! deps.empty? and deps.detect { |d| ! d.deleting? }
                 resource.warning "%s still depend%s on me -- not purging" %
                     [deps.collect { |r| r.ref }.join(","), deps.length > 1 ? "":"s"] 
                 return false
@@ -38,6 +43,16 @@ class Transaction
         return true
     end
 
+    # Are there any failed resources in this transaction?
+    def any_failed?
+        failures = @failures.inject(0) { |failures, array| failures += array[1]; failures }
+        if failures > 0
+            failures
+        else
+            false
+        end
+    end
+
     # Apply all changes for a resource, returning a list of the events
     # generated.
     def apply(resource)
@@ -129,6 +144,9 @@ class Transaction
     # Find all of the changed resources.
     def changed?
         @changes.find_all { |change| change.changed }.collect { |change|
+            unless change.property.resource
+                raise "No resource for %s" % change.inspect
+            end
             change.property.resource
         }.uniq
     end
@@ -137,14 +155,8 @@ class Transaction
     # contained resources might never get cleaned up.
     def cleanup
         if defined? @generated
-            @generated.each do |resource|
-                resource.remove
-            end
-        end
-        if defined? @relgraph
-            @relgraph.clear
+            relationship_graph.remove_resource(*@generated)
         end
-        @resources.clear
     end
 
     # Copy an important relationships from the parent to the newly-generated
@@ -158,10 +170,11 @@ class Transaction
             else
                 edge = [resource, gen_child]
             end
-            unless @relgraph.edge?(edge[1], edge[0])
-                @relgraph.add_edge!(*edge)
+            relationship_graph.add_resource(gen_child) unless relationship_graph.resource(gen_child.ref)
+
+            unless relationship_graph.edge?(edge[1], edge[0])
+                relationship_graph.add_edge!(*edge)
             else
-                @relgraph.add_vertex!(gen_child)
                 resource.debug "Skipping automatic relationship to %s" % gen_child
             end
         end
@@ -189,11 +202,7 @@ class Transaction
             end
             
             if children
-                children.each do |child|
-                    child.finish
-                    # Make sure that the vertex is in the relationship graph.
-                    @relgraph.add_vertex!(child)
-                end
+                children.each { |child| child.finish }
                 @generated += children
                 return children
             end
@@ -265,9 +274,12 @@ class Transaction
         # Collect the targets of any subscriptions to those events.  We pass
         # the parent resource in so it will override the source in the events,
         # since eval_generated children can't have direct relationships.
-        @relgraph.matching_edges(events, resource).each do |edge|
-            edge = edge.dup
-            label = edge.label
+        relationship_graph.matching_edges(events, resource).each do |orig_edge|
+            # We have to dup the label here, else we modify the original edge label,
+            # which affects whether a given event will match on the next run, which is,
+            # of course, bad.
+            edge = orig_edge.class.new(orig_edge.source, orig_edge.target)
+            label = orig_edge.label.dup
             label[:event] = events.collect { |e| e.event }
             edge.label = label
             set_trigger(edge)
@@ -282,9 +294,7 @@ class Transaction
     # necessary events.
     def evaluate
         @count = 0
-        
-        graph(@resources, :resources)
-        
+
         # Start logging.
         Puppet::Util::Log.newdestination(@report)
         
@@ -301,7 +311,7 @@ class Transaction
                     ret = eval_resource(resource)
                 end
 
-                if Puppet[:evaltrace]
+                if Puppet[:evaltrace] and @catalog.host_config?
                     resource.info "Evaluated in %0.2f seconds" % seconds
                 end
                 ret
@@ -314,6 +324,7 @@ class Transaction
         Puppet.debug "Finishing transaction %s with %s changes" %
             [self.object_id, @count]
 
+        @events = allevents
         allevents
     end
 
@@ -333,7 +344,7 @@ class Transaction
         # enough to check the immediate dependencies, which is why we use
         # a tree from the reversed graph.
         skip = false
-        deps = @relgraph.dependencies(resource)
+        deps = relationship_graph.dependencies(resource)
         deps.each do |dep|
             if fails = failed?(dep)
                 resource.notice "Dependency %s[%s] has %s failures" %
@@ -347,7 +358,7 @@ class Transaction
     
     # Collect any dynamically generated resources.
     def generate
-        list = @resources.vertices
+        list = @catalog.vertices
         
         # Store a list of all generated resources, so that we can clean them up
         # after the transaction closes.
@@ -369,7 +380,8 @@ class Transaction
                     end
                     made.uniq!
                     made.each do |res|
-                        @resources.add_vertex!(res)
+                        @catalog.add_resource(res)
+                        res.catalog = catalog
                         newlist << res
                         @generated << res
                         res.finish
@@ -410,32 +422,24 @@ class Transaction
         return @report
     end
 
-    # Produce the graph files if requested.
-    def graph(gr, name)
-        # We don't want to graph the configuration process.
-        return if self.configurator
-        
-        return unless Puppet[:graph]
-
-        Puppet.config.use(:graphing)
-
-        file = File.join(Puppet[:graphdir], "%s.dot" % name.to_s)
-        File.open(file, "w") { |f|
-            f.puts gr.to_dot("name" => name.to_s.capitalize)
-        }
+    # Should we ignore tags?
+    def ignore_tags?
+        ! @catalog.host_config?
     end
 
     # this should only be called by a Puppet::Type::Component resource now
     # and it should only receive an array
     def initialize(resources)
-        if resources.is_a?(Puppet::PGraph)
-            @resources = resources
+        if resources.is_a?(Puppet::Node::Catalog)
+            @catalog = resources
+        elsif resources.is_a?(Puppet::PGraph)
+            raise "Transactions should get catalogs now, not PGraph"
         else
-            @resources = resources.to_graph
+            raise "Transactions require catalogs"
         end
 
         @resourcemetrics = {
-            :total => @resources.vertices.length,
+            :total => @catalog.vertices.length,
             :out_of_sync => 0,    # The number of resources that had changes
             :applied => 0,        # The number of resources fixed
             :skipped => 0,      # The number of resources skipped
@@ -474,7 +478,7 @@ class Transaction
     # types, just providers.
     def prefetch
         prefetchers = {}
-        @resources.each do |resource|
+        @catalog.vertices.each do |resource|
             if provider = resource.provider and provider.class.respond_to?(:prefetch)
                 prefetchers[provider.class] ||= {}
                 prefetchers[provider.class][resource.title] = resource
@@ -501,48 +505,49 @@ class Transaction
     
         # Now add any dynamically generated resources
         generate()
-    
-        # Create a relationship graph from our resource graph
-        @relgraph = relationship_graph
         
         # This will throw an error if there are cycles in the graph.
-        @sorted_resources = @relgraph.topsort
+        @sorted_resources = relationship_graph.topsort
     end
-    
-    # Create a graph of all of the relationships in our resource graph.
+
     def relationship_graph
-        graph = Puppet::PGraph.new
-        
-        # First create the dependency graph
-        @resources.vertices.each do |vertex|
-            graph.add_vertex!(vertex)
-            vertex.builddepends.each do |edge|
-                graph.add_edge!(edge)
-            end
+        catalog.relationship_graph
+    end
+    
+    # Send off the transaction report.
+    def send_report
+        begin
+            report = generate_report()
+        rescue => detail
+            Puppet.err "Could not generate report: %s" % detail
+            return
+        end
+
+        if Puppet[:rrdgraph] == true
+            report.graph()
+        end
+
+        if Puppet[:summarize]
+            puts report.summary
         end
         
-        # Lastly, add in any autorequires
-        graph.vertices.each do |vertex|
-            vertex.autorequire.each do |edge|
-                unless graph.edge?(edge)
-                    unless graph.edge?(edge.target, edge.source)
-                        vertex.debug "Autorequiring %s" % [edge.source]
-                        graph.add_edge!(edge)
-                    else
-                        vertex.debug "Skipping automatic relationship with %s" % (edge.source == vertex ? edge.target : edge.source)
-                    end
-                end
+        if Puppet[:report]
+            begin
+                reportclient().report(report)
+            rescue => detail
+                Puppet.err "Reporting failed: %s" % detail
             end
         end
-        
-        graph(graph, :relationships)
-        
-        # Then splice in the container information
-        graph.splice!(@resources, Puppet::Type::Component)
+    end
 
-        graph(graph, :expanded_relationships)
-        
-        return graph
+    def reportclient
+        unless defined? @reportclient
+            @reportclient = Puppet::Network::Client.report.new(
+                :Server => Puppet[:reportserver]
+            )
+        end
+
+        @reportclient
     end
 
     # Roll all completed changes back.
@@ -572,7 +577,7 @@ class Transaction
             end
             
             # FIXME This won't work right now.
-            @relgraph.matching_edges(events).each do |edge|
+            relationship_graph.matching_edges(events).each do |edge|
                 @targets[edge.target] << edge
             end
 
@@ -606,7 +611,7 @@ class Transaction
     # Should this resource be skipped?
     def skip?(resource)
         skip = false
-        if ! tagged?(resource)
+        if missing_tags?(resource)
             resource.debug "Not tagged with %s" % tags.join(", ")
         elsif ! scheduled?(resource)
             resource.debug "Not scheduled"
@@ -620,29 +625,22 @@ class Transaction
     
     # The tags we should be checking.
     def tags
-        # Allow the tags to be overridden
         unless defined? @tags
-            @tags = Puppet[:tags]
-        end
-        
-        unless defined? @processed_tags
-            if @tags.nil? or @tags == ""
+            tags = Puppet[:tags]
+            if tags.nil? or tags == ""
                 @tags = []
             else
-                @tags = [@tags] unless @tags.is_a? Array
-                @tags = @tags.collect do |tag|
-                    tag.split(/\s*,\s*/)
-                end.flatten
+                @tags = tags.split(/\s*,\s*/)
             end
-            @processed_tags = true
         end
         
         @tags
     end
     
     # Is this resource tagged appropriately?
-    def tagged?(resource)
-        self.ignoretags or tags.empty? or resource.tagged?(tags)
+    def missing_tags?(resource)
+        return false if self.ignore_tags? or tags.empty?
+        return true unless resource.tagged?(tags)
     end
     
     # Are there any edges that target this resource?
@@ -737,4 +735,3 @@ end
 
 require 'puppet/transaction/report'
 
-# $Id: transaction.rb 2678 2007-07-11 19:30:42Z luke $