puppet 0.24.9 → 0.25.0

data/lib/puppet/network/authconfig.rb

@@ -16,7 +16,7 @@ module Puppet
         [:allow, :deny].each do |method|
             define_method(method) do |*args|
                 @rights.send(method, *args)
-            end         
+            end
         end
 
         # Here we add a little bit of semantics.  They can set auth on a whole
@@ -32,9 +32,8 @@ module Puppet
                 return @rights[name].allowed?(request.name, request.ip)
             elsif @rights.include?(namespace)
                 return @rights[namespace].allowed?(request.name, request.ip)
-            else
-                return false
             end
+            false
         end
 
         # Does the file exist?  Puppetmasterd does not require it, but
@@ -44,7 +43,7 @@ module Puppet
         end
 
         def initialize(file = nil, parsenow = true)
-            @file ||= Puppet[:authconfig]
+            @file = file || Puppet[:authconfig]
 
             unless @file
                 raise Puppet::DevError, "No authconfig file defined"
@@ -78,7 +77,7 @@ module Puppet
                     else
                         return
                     end
-                else    
+                else
                     Puppet.notice "%s and %s" % [@configtimeout, @configstatted]
                 end
             end
@@ -99,44 +98,21 @@ module Puppet
                     count = 1
                     f.each { |line|
                         case line
-                        when /^\s*#/: next # skip comments
-                        when /^\s*$/: next # skip blank lines
-                        when /\[([\w.]+)\]/: # "namespace" or "namespace.method"
-                            name = $1
-                            if newrights.include?(name)
-                                raise FileServerError, "%s is already set at %s" %
-                                    [newrights[name], name]
-                            end
-                            newrights.newright(name)
-                            right = newrights[name]
-                        when /^\s*(\w+)\s+(.+)$/:
-                            var = $1
-                            value = $2
-                            case var
-                            when "allow":
-                                value.split(/\s*,\s*/).each { |val|
-                                    begin
-                                        right.info "allowing %s access" % val
-                                        right.allow(val)
-                                    rescue AuthStoreError => detail
-                                        raise ConfigurationError, "%s at line %s of %s" %
-                                            [detail.to_s, count, @config]
-                                    end
-                                }
-                            when "deny":
-                                value.split(/\s*,\s*/).each { |val|
-                                    begin
-                                        right.info "denying %s access" % val
-                                        right.deny(val)
-                                    rescue AuthStoreError => detail
-                                        raise ConfigurationError, "%s at line %s of %s" %
-                                            [detail.to_s, count, @config]
-                                    end
-                                }
-                            else
-                                raise ConfigurationError,
-                                    "Invalid argument '%s' at line %s" % [var, count]
+                        when /^\s*#/ # skip comments
+                            count += 1
+                            next
+                        when /^\s*$/  # skip blank lines
+                            count += 1
+                            next
+                        when /^(?:(\[[\w.]+\])|(path)\s+((?:~\s+)?[^ ]+))\s*$/ # "namespace" or "namespace.method" or "path /path" or "path ~ regex"
+                             name = $1
+                            if $2 == "path"
+                                name = $3
                             end
+                            name.chomp!
+                            right = newrights.newright(name, count, @file)
+                        when /^\s*(allow|deny|method|environment|auth(?:enticated)?)\s+(.+)$/
+                            parse_right_directive(right, $1, $2, count)
                         else
                             raise ConfigurationError, "Invalid line %s: %s" % [count, line]
                         end
@@ -162,6 +138,45 @@ module Puppet
             }
             @rights = newrights
         end
+
+        def parse_right_directive(right, var, value, count)
+            case var
+            when "allow"
+                modify_right(right, :allow, value, "allowing %s access", count)
+            when "deny"
+                modify_right(right, :deny, value, "denying %s access", count)
+            when "method"
+                unless right.acl_type == :regex
+                    raise ConfigurationError, "'method' directive not allowed in namespace ACL at line %s of %s" % [count, @config]
+                end
+                modify_right(right, :restrict_method, value, "allowing 'method' %s", count)
+            when "environment"
+                unless right.acl_type == :regex
+                    raise ConfigurationError, "'environment' directive not allowed in namespace ACL at line %s of %s" % [count, @config]
+                end
+                modify_right(right, :restrict_environment, value, "adding environment %s", count)
+            when /auth(?:enticated)?/
+                unless right.acl_type == :regex
+                    raise ConfigurationError, "'authenticated' directive not allowed in namespace ACL at line %s of %s" % [count, @config]
+                end
+                modify_right(right, :restrict_authenticated, value, "adding authentication %s", count)
+            else
+                raise ConfigurationError,
+                    "Invalid argument '%s' at line %s" % [var, count]
+            end
+        end
+
+        def modify_right(right, method, value, msg, count)
+            value.split(/\s*,\s*/).each do |val|
+                begin
+                    right.info msg % val
+                    right.send(method, val)
+                rescue AuthStoreError => detail
+                    raise ConfigurationError, "%s at line %s of %s" % [detail.to_s, count, @file]
+                end
+            end
+        end
+
     end
 end
 

data/lib/puppet/network/authstore.rb

@@ -45,7 +45,7 @@ module Puppet
                 return true
             end
 
-            if decl = @declarations.find { |d| d.match?(name, ip) }
+            if decl = declarations.find { |d| d.match?(name, ip) }
                 return decl.result
             end
 
@@ -72,8 +72,29 @@ module Puppet
             "authstore"
         end
 
+        def interpolate(match)
+            declarations = @declarations.collect do |ace|
+                ace.interpolate(match)
+            end
+            declarations.sort!
+            Thread.current[:declarations] = declarations
+        end
+
+        def reset_interpolation
+            Thread.current[:declarations] = nil
+        end
+
         private
 
+        # returns our ACEs list, but if we have a modification of it
+        # in our current thread, let's return it
+        # this is used if we want to override the this purely immutable list
+        # by a modified version in a multithread safe way.
+        def declarations
+            return Thread.current[:declarations] if Thread.current[:declarations]
+            @declarations
+        end
+
         # Store the results of a pattern into our hash.  Basically just
         # converts the pattern and sticks it into the hash.
         def store(type, pattern)
@@ -174,7 +195,7 @@ module Puppet
             # Mapping a type of statement into a return value.
             def result
                 case @type
-                when :allow: true
+                when :allow; true
                 else
                     false
                 end
@@ -193,6 +214,21 @@ module Puppet
                 @type = type
             end
 
+            # interpolate a pattern to replace any
+            # backreferences by the given match
+            # for instance if our pattern is $1.reductivelabs.com
+            # and we're called with a MatchData whose capture 1 is puppet
+            # we'll return a pattern of puppet.reductivelabs.com
+            def interpolate(match)
+                return self if @name == :ip
+
+                clone = dup
+                clone.pattern = clone.pattern.reverse.collect do |p|
+                    p.gsub(/\$(\d)/) { |m| match[$1.to_i] }
+                end.join(".")
+                clone
+            end
+
             private
 
             # Returns nil if both values are true or both are false, returns
@@ -236,6 +272,7 @@ module Puppet
             # Convert the name to a common pattern.
             def munge_name(name)
                 # LAK:NOTE http://snurl.com/21zf8  [groups_google_com]
+                # Change to x = name.downcase.split(".",-1).reverse for FQDN support
                 x = name.downcase.split(".").reverse
             end
 
@@ -243,16 +280,16 @@ module Puppet
             # statement it is.  The output of this is used for later matching.
             def parse(value)
                 case value
-                when /^(\d+\.){1,3}\*$/: # an ip address with a '*' at the end
+                when /^(\d+\.){1,3}\*$/ # an ip address with a '*' at the end
                     @name = :ip
                     match = $1
                     match.sub!(".", '')
                     ary = value.split(".")
 
                     mask = case ary.index(match)
-                    when 0: 8
-                    when 1: 16
-                    when 2: 24
+                    when 0; 8
+                    when 1; 16
+                    when 2; 24
                     else
                         raise AuthStoreError, "Invalid IP pattern %s" % value
                     end
@@ -269,14 +306,18 @@ module Puppet
                     rescue ArgumentError => detail
                         raise AuthStoreError, "Invalid IP address pattern %s" % value
                     end
-                when /^([a-zA-Z][-\w]*\.)+[-\w]+$/: # a full hostname
+                when /^([a-zA-Z][-\w]*\.)+[-\w]+$/ # a full hostname
+                    # Change to /^([a-zA-Z][-\w]*\.)+[-\w]+\.?$/ for FQDN support
                     @name = :domain
                     @pattern = munge_name(value)
-                when /^\*(\.([a-zA-Z][-\w]*)){1,}$/: # *.domain.com
+                when /^\*(\.([a-zA-Z][-\w]*)){1,}$/ # *.domain.com
                     @name = :domain
                     @pattern = munge_name(value)
                     @pattern.pop # take off the '*'
                     @length = @pattern.length
+                when /\$\d+/ # a backreference pattern ala $1.reductivelabs.com or 192.168.0.$1 or $1.$2
+                    @name = :dynamic
+                    @pattern = munge_name(value)
                 else
                     # Else, use the IPAddr class to determine if we've got a
                     # valid IP address.
@@ -285,10 +326,17 @@ module Puppet
                     end
                     begin
                         @pattern = IPAddr.new(value)
+                        @name = :ip
                     rescue ArgumentError => detail
-                        raise AuthStoreError, "Invalid pattern %s" % value
+                        # so nothing matched, let's match as an opaque value
+                        # some sanity checks first
+                        unless value =~ /^[a-zA-Z0-9][-a-zA-Z0-9_.@]*$/
+                            raise AuthStoreError, "Invalid pattern %s" % value
+                        end
+                        @pattern = [value]
+                        @length = nil # force an exact match
+                        @name = :opaque
                     end
-                    @name = :ip
                 end
             end
         end

data/lib/puppet/network/client.rb

@@ -1,7 +1,6 @@
 # the available clients
 
 require 'puppet'
-require 'puppet/daemon'
 require 'puppet/network/xmlrpc/client'
 require 'puppet/util/subclass_loader'
 require 'puppet/util/methodhelper'
@@ -34,7 +33,6 @@ end
 # provide a different interface.
 class Puppet::Network::Client
     Client = self
-    include Puppet::Daemon
     include Puppet::Util
     extend Puppet::Util::SubclassLoader
     include Puppet::Util::MethodHelper

data/lib/puppet/network/client/ca.rb

@@ -45,7 +45,7 @@ class Puppet::Network::Client::CA < Puppet::Network::Client
         end
 
         unless @cert.check_private_key(key)
-            raise InvalidCertificate, "Certificate does not match private key.  Try 'puppetca --clean %s' on the server." % Facter.value(:fqdn)
+            raise InvalidCertificate, "Certificate does not match private key.  Try 'puppetca --clean %s' on the server." % Puppet[:certname]
         end
 
         # Only write the cert out if it passes validating.

data/lib/puppet/network/client/dipper.rb

@@ -2,7 +2,7 @@
 class Puppet::Network::Client::Dipper < Puppet::Network::Client
     @handler = Puppet::Network::Handler.handler(:filebucket)
     @drivername = :Bucket
-    
+
     attr_accessor :name
 
     # Create our bucket client
@@ -25,7 +25,12 @@ class Puppet::Network::Client::Dipper < Puppet::Network::Client
         unless local?
             contents = Base64.encode64(contents)
         end
-        return @driver.addfile(contents,file)
+        begin
+            return @driver.addfile(contents,file)
+        rescue => detail
+            puts detail.backtrace if Puppet[:trace]
+            raise Puppet::Error, "Could not back up %s: %s" % [file, detail]
+        end
     end
 
     # Retrieve a file by sum.

data/lib/puppet/network/format.rb

@@ -0,0 +1,123 @@
+require 'puppet/provider'
+require 'puppet/provider/confiner'
+
+# A simple class for modeling encoding formats for moving
+# instances around the network.
+class Puppet::Network::Format
+    include Puppet::Provider::Confiner
+
+    attr_reader :name, :mime
+    attr_accessor :intern_method, :render_method, :intern_multiple_method, :render_multiple_method, :weight, :required_methods
+
+    def init_attribute(name, default)
+        if value = @options[name]
+            @options.delete(name)
+        else
+            value = default
+        end
+        self.send(name.to_s + "=", value)
+    end
+
+    def initialize(name, options = {}, &block)
+        @name = name.to_s.downcase.intern
+
+        @options = options
+
+        # This must be done early the values can be used to set required_methods
+        define_method_names()
+
+        method_list = {
+            :intern_method => "from_%s" % name,
+            :intern_multiple_method => "from_multiple_%s" % name,
+            :render_multiple_method => "to_multiple_%s" % name,
+            :render_method => "to_%s" % name
+        }
+
+        init_attribute(:mime, "text/%s" % name)
+        init_attribute(:weight, 5)
+        init_attribute(:required_methods, method_list.keys)
+
+        method_list.each do |method, value|
+            init_attribute(method, value)
+        end
+
+        unless @options.empty?
+            raise ArgumentError, "Unsupported option(s) %s" % @options.keys
+        end
+
+        @options = nil
+
+        instance_eval(&block) if block_given?
+    end
+
+    def intern(klass, text)
+        return klass.send(intern_method, text) if klass.respond_to?(intern_method)
+        raise NotImplementedError, "%s does not respond to %s; can not intern instances from %s" % [klass, intern_method, mime]
+    end
+
+    def intern_multiple(klass, text)
+        return klass.send(intern_multiple_method, text) if klass.respond_to?(intern_multiple_method)
+        raise NotImplementedError, "%s does not respond to %s; can not intern multiple instances from %s" % [klass, intern_multiple_method, mime]
+    end
+
+    def mime=(mime)
+        @mime = mime.to_s.downcase
+    end
+
+    def render(instance)
+        return instance.send(render_method) if instance.respond_to?(render_method)
+        raise NotImplementedError, "%s does not respond to %s; can not render instances to %s" % [instance.class, render_method, mime]
+    end
+
+    def render_multiple(instances)
+        # This method implicitly assumes that all instances are of the same type.
+        return instances[0].class.send(render_multiple_method, instances) if instances[0].class.respond_to?(render_multiple_method)
+        raise NotImplementedError, "%s does not respond to %s; can not intern multiple instances to %s" % [instances[0].class, render_multiple_method, mime]
+    end
+
+    def required_methods_present?(klass)
+        [:intern_method, :intern_multiple_method, :render_multiple_method].each do |name|
+            return false unless required_method_present?(name, klass, :class)
+        end
+
+        return false unless required_method_present?(:render_method, klass, :instance)
+
+        return true
+    end
+
+    def supported?(klass)
+        suitable? and required_methods_present?(klass)
+    end
+
+    def to_s
+        "Puppet::Network::Format[%s]" % name
+    end
+
+    private
+
+    def define_method_names
+        @intern_method = "from_%s" % name
+        @render_method = "to_%s" % name
+        @intern_multiple_method = "from_multiple_%s" % name
+        @render_multiple_method = "to_multiple_%s" % name
+    end
+
+    def required_method_present?(name, klass, type)
+        return true unless required_methods.include?(name)
+
+        method = send(name)
+
+        if type == :class
+            has_method = klass.respond_to?(method)
+            message = "has not implemented method '%s'" % method
+        else
+            has_method = klass.instance_methods.include?(method)
+            message = "has not implemented instance method  '%s'" % method
+        end
+
+        return true if has_method
+
+        Puppet.debug "Format %s not supported for %s; %s" % [self.name, klass, message]
+        return false
+    end
+end