puppet 0.24.9 → 0.25.0

data/lib/puppet/network/http/webrick/rest.rb

@@ -1,4 +1,5 @@
 require 'puppet/network/http/handler'
+require 'resolv'
 
 class Puppet::Network::HTTP::WEBrickREST < WEBrick::HTTPServlet::AbstractServlet
 
@@ -10,9 +11,10 @@ class Puppet::Network::HTTP::WEBrickREST < WEBrick::HTTPServlet::AbstractServlet
         initialize_for_puppet(:server => server, :handler => handler)
     end
 
-    # We had to expose this method for testing purposes.
+    # Retrieve the request parameters, including authentication information.
     def params(request)
         result = request.query
+        result = decode_params(result)
         result.merge(client_information(request))
     end
 
@@ -21,29 +23,38 @@ class Puppet::Network::HTTP::WEBrickREST < WEBrick::HTTPServlet::AbstractServlet
         process(request, response)
     end
 
-  private
+    def accept_header(request)
+        request["accept"]
+    end
+
+    def content_type_header(request)
+        request["content-type"]
+    end
 
     def http_method(request)
         request.request_method
     end
 
     def path(request)
-        # LAK:NOTE See http://snurl.com/21zf8  [groups_google_com] 
-        x = '/' + request.path.split('/')[1]
-    end
-
-    def request_key(request)
-        # LAK:NOTE See http://snurl.com/21zf8  [groups_google_com] 
-        x = request.path.split('/')[2]
+        request.path
     end
 
     def body(request)
         request.body
     end
 
-    def encode_result(request, response, result, status = 200)
+    # Set the specified format as the content type of the response.
+    def set_content_type(response, format)
+        response["content-type"] = format_to_mime(format)
+    end
+
+    def set_response(response, result, status = 200)
         response.status = status
-        response.body = result
+        if status >= 200 and status < 300
+            response.body = result
+        else
+            response.reason_phrase = result
+        end
     end
 
     # Retrieve node/cert/ip information from the request object.
@@ -60,6 +71,8 @@ class Puppet::Network::HTTP::WEBrickREST < WEBrick::HTTPServlet::AbstractServlet
         if cert = request.client_cert and nameary = cert.subject.to_a.find { |ary| ary[0] == "CN" }
             result[:node] = nameary[1]
             result[:authenticated] = true
+        else
+            result[:node] = resolve_node(result)
         end
 
         result

data/lib/puppet/network/http_pool.rb

@@ -1,11 +1,24 @@
-require 'puppet/sslcertificates/support'
+require 'puppet/ssl/host'
 require 'net/https'
+require 'puppet/util/cacher'
 
-module Puppet::Network
-end
+module Puppet::Network; end
 
 # Manage Net::HTTP instances for keep-alive.
 module Puppet::Network::HttpPool
+    class << self
+        include Puppet::Util::Cacher
+
+        private
+
+        cached_attr(:http_cache) { Hash.new }
+    end
+
+    # Use the global localhost instance.
+    def self.ssl_host
+        Puppet::SSL::Host.localhost
+    end
+
     # 2008/03/23
     # LAK:WARNING: Enabling this has a high propability of
     # causing corrupt files and who knows what else.  See #1010.
@@ -15,18 +28,12 @@ module Puppet::Network::HttpPool
         HTTP_KEEP_ALIVE
     end
 
-    # This handles reading in the key and such-like.
-    extend Puppet::SSLCertificates::Support
-    @http_cache = {}
-
     # Clear our http cache, closing all connections.
     def self.clear_http_instances
-        @http_cache.each do |name, connection|
+        http_cache.each do |name, connection|
             connection.finish if connection.started?
         end
-        @http_cache.clear
-        @cert = nil
-        @key = nil
+        Puppet::Util::Cacher.expire
     end
 
     # Make sure we set the driver up when we read the cert in.
@@ -44,20 +51,16 @@ module Puppet::Network::HttpPool
     # Use cert information from a Puppet client to set up the http object.
     def self.cert_setup(http)
         # Just no-op if we don't have certs.
-        return false unless (defined?(@cert) and @cert) or self.read_cert
-
-        store = OpenSSL::X509::Store.new
-        store.add_file Puppet[:localcacert]
-        store.purpose = OpenSSL::X509::PURPOSE_SSL_CLIENT
+        return false unless FileTest.exist?(Puppet[:hostcert]) and FileTest.exist?(Puppet[:localcacert])
 
-        http.cert_store = store
+        http.cert_store = ssl_host.ssl_store
         http.ca_file = Puppet[:localcacert]
-        http.cert = self.cert
+        http.cert = ssl_host.certificate.content
         http.verify_mode = OpenSSL::SSL::VERIFY_PEER
-        http.key = self.key
+        http.key = ssl_host.key.content
     end
 
-    # Retrieve a cached http instance of caching is enabled, else return
+    # Retrieve a cached http instance if caching is enabled, else return
     # a new one.
     def self.http_instance(host, port, reset = false)
         # We overwrite the uninitialized @http here with a cached one.
@@ -66,11 +69,11 @@ module Puppet::Network::HttpPool
         # Return our cached instance if we've got a cache, as long as we're not
         # resetting the instance.
         if keep_alive?
-            return @http_cache[key] if ! reset and @http_cache[key]
+            return http_cache[key] if ! reset and http_cache[key]
 
             # Clean up old connections if we have them.
-            if http = @http_cache[key]
-                @http_cache.delete(key)
+            if http = http_cache[key]
+                http_cache.delete(key)
                 http.finish if http.started?
             end
         end
@@ -92,15 +95,11 @@ module Puppet::Network::HttpPool
         http.read_timeout = Puppet[:configtimeout]
         http.open_timeout = Puppet[:configtimeout]
         # JJM Configurable fix for #896.
-        if Puppet[:http_enable_post_connection_check]
-            http.enable_post_connection_check = true
-        else
-            http.enable_post_connection_check = false
-        end
+        http.enable_post_connection_check = Puppet[:http_enable_post_connection_check]
 
         cert_setup(http)
 
-        @http_cache[key] = http if keep_alive?
+        http_cache[key] = http if keep_alive?
 
         return http
     end

data/lib/puppet/network/http_server/mongrel.rb

@@ -3,7 +3,7 @@
 # Author:     Manuel Holtgrewe <purestorm at ggnore.net>
 #
 # Copyright (c) 2006 Manuel Holtgrewe, 2007 Luke Kanies
-# 
+#
 # Permission is hereby granted, free of charge, to any person obtaining
 # a copy of this software and associated documentation files (the
 # "Software"), to deal in the Software without restriction, including
@@ -11,10 +11,10 @@
 # distribute, sublicense, and/or sell copies of the Software, and to
 # permit persons to whom the Software is furnished to do so, subject to
 # the following conditions:
-# 
+#
 # The above copyright notice and this permission notice shall be
 # included in all copies or substantial portions of the Software.
-# 
+#
 # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
 # EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
 # MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
@@ -34,7 +34,6 @@ require 'puppet/network/xmlrpc/server'
 require 'puppet/network/http_server'
 require 'puppet/network/client_request'
 require 'puppet/network/handler'
-require 'puppet/daemon'
 
 require 'resolv'
 
@@ -51,7 +50,6 @@ require 'resolv'
 # </pre>
 module Puppet::Network
     class HTTPServer::Mongrel < ::Mongrel::HttpHandler
-        include Puppet::Daemon
         attr_reader :xmlrpc_server
 
         def initialize(handlers)
@@ -64,11 +62,11 @@ module Puppet::Network
             # behaviour and we have to subclass Mongrel::HttpHandler so our handler
             # works for Mongrel.
             @xmlrpc_server = Puppet::Network::XMLRPCServer.new
-            handlers.each do |name, args|
+            handlers.each do |name|
                 unless handler = Puppet::Network::Handler.handler(name)
                     raise ArgumentError, "Invalid handler %s" % name
                 end
-                @xmlrpc_server.add_handler(handler.interface, handler.new(args))
+                @xmlrpc_server.add_handler(handler.interface, handler.new({}))
             end
         end
 
@@ -115,12 +113,12 @@ module Puppet::Network
                 end
             end
         end
-      
+
         private
 
         def client_info(request)
             params = request.params
-            ip = params["REMOTE_ADDR"]
+            ip = params["HTTP_X_FORWARDED_FOR"] ? params["HTTP_X_FORWARDED_FOR"].split(',').last.strip : params["REMOTE_ADDR"]
             # JJM #906 The following dn.match regular expression is forgiving
             # enough to match the two Distinguished Name string contents
             # coming from Apache, Pound or other reverse SSL proxies.
@@ -146,7 +144,7 @@ module Puppet::Network
         def parse_content_type(str)
             a, *b = str.split(";")
             return a.strip, *b
-        end  
+        end
     end
 end
 

data/lib/puppet/network/http_server/webrick.rb

@@ -1,5 +1,4 @@
 require 'puppet'
-require 'puppet/daemon'
 require 'webrick'
 require 'webrick/https'
 require 'fcntl'
@@ -16,11 +15,10 @@ module Puppet
         # The old-school, pure ruby webrick server, which is the default serving
         # mechanism.
         class HTTPServer::WEBrick < WEBrick::HTTPServer
-            include Puppet::Daemon
             include Puppet::SSLCertificates::Support
 
             # Read the CA cert and CRL and populate an OpenSSL::X509::Store
-            # with them, with flags appropriate for checking client 
+            # with them, with flags appropriate for checking client
             # certificates for revocation
             def x509store
                 if Puppet[:cacrl] == 'false'

data/lib/puppet/network/rest_authconfig.rb

@@ -0,0 +1,89 @@
+require 'puppet/network/authconfig'
+
+module Puppet
+    class Network::RestAuthConfig < Network::AuthConfig
+
+        attr_accessor :rights
+
+        DEFAULT_ACL = [
+            { :acl => "~ ^\/catalog\/([^\/]+)$", :method => :find, :allow => '$1', :authenticated => true },
+            # this one will allow all file access, and thus delegate
+            # to fileserver.conf
+            { :acl => "/file" },
+            { :acl => "/certificate_revocation_list/ca", :method => :find, :authenticated => true },
+            { :acl => "/report", :method => :save, :authenticated => true },
+            { :acl => "/certificate/ca", :method => :find, :authenticated => false },
+            { :acl => "/certificate/", :method => :find, :authenticated => false },
+            { :acl => "/certificate_request", :method => [:find, :save], :authenticated => false },
+        ]
+
+        def self.main
+            add_acl = @main.nil?
+            super
+            @main.insert_default_acl if add_acl and !@main.exists?
+            @main
+        end
+
+        # check wether this request is allowed in our ACL
+        # raise an Puppet::Network::AuthorizedError if the request
+        # is denied.
+        def allowed?(request)
+            read()
+
+            # we're splitting the request in part because
+            # fail_on_deny could as well be called in the XMLRPC context
+            # with a ClientRequest.
+            @rights.fail_on_deny(build_uri(request),
+                                    :node => request.node,
+                                    :ip => request.ip,
+                                    :method => request.method,
+                                    :environment => request.environment,
+                                    :authenticated => request.authenticated)
+        end
+
+        def initialize(file = nil, parsenow = true)
+            super(file || Puppet[:rest_authconfig], parsenow)
+
+            # if we didn't read a file (ie it doesn't exist)
+            # make sure we can create some default rights
+            @rights ||= Puppet::Network::Rights.new
+        end
+
+        def parse()
+            super()
+            insert_default_acl
+        end
+
+        # force regular ACLs to be present
+        def insert_default_acl
+            DEFAULT_ACL.each do |acl|
+                unless rights[acl[:acl]]
+                    Puppet.info "Inserting default '#{acl[:acl]}'(%s) acl because %s" % [acl[:authenticated] ? "auth" : "non-auth" , ( !exists? ? "#{Puppet[:rest_authconfig]} doesn't exist" : "none where found in '#{@file}'")]
+                    mk_acl(acl)
+                end
+            end
+            # queue an empty (ie deny all) right for every other path
+            # actually this is not strictly necessary as the rights system
+            # denies not explicitely allowed paths
+            unless rights["/"]
+                rights.newright("/")
+                rights.restrict_authenticated("/", :any)
+            end
+        end
+
+        def mk_acl(acl)
+            @rights.newright(acl[:acl])
+            @rights.allow(acl[:acl], acl[:allow] || "*")
+
+            if method = acl[:method]
+                method = [method] unless method.is_a?(Array)
+                method.each { |m| @rights.restrict_method(acl[:acl], m) }
+            end
+            @rights.restrict_authenticated(acl[:acl], acl[:authenticated]) unless acl[:authenticated].nil?
+        end
+
+        def build_uri(request)
+            "/#{request.indirection_name}/#{request.key}"
+        end
+    end
+end

data/lib/puppet/network/rest_authorization.rb

@@ -0,0 +1,25 @@
+require 'puppet/network/client_request'
+require 'puppet/network/rest_authconfig'
+
+module Puppet::Network
+
+    module RestAuthorization
+
+
+        # Create our config object if necessary. If there's no configuration file
+        # we install our defaults
+        def authconfig
+            unless defined? @authconfig
+                @authconfig = Puppet::Network::RestAuthConfig.main
+            end
+
+            @authconfig
+        end
+
+        # Verify that our client has access.
+        def check_authorization(request)
+            authconfig.allowed?(request)
+        end
+    end
+end
+

data/lib/puppet/network/rights.rb

@@ -1,15 +1,22 @@
-require 'ipaddr'
 require 'puppet/network/authstore'
+require 'puppet/error'
+
+module Puppet::Network
+
+# this exception is thrown when a request is not authenticated
+class AuthorizationError < Puppet::Error; end
 
 # Define a set of rights and who has access to them.
-class Puppet::Network::Rights < Hash
+# There are two types of rights:
+#  * named rights (ie a common string)
+#  * path based rights (which are matched on a longest prefix basis)
+class Rights
+
     # We basically just proxy directly to our rights.  Each Right stores
     # its own auth abilities.
-    [:allow, :allowed?, :deny].each do |method|
+    [:allow, :deny, :restrict_method, :restrict_environment, :restrict_authenticated].each do |method|
         define_method(method) do |name, *args|
-            name = name.intern if name.is_a? String
-
-            if obj = right(name)
+            if obj = self[name]
                 obj.send(method, *args)
             else
                 raise ArgumentError, "Unknown right '%s'" % name
@@ -17,45 +24,139 @@ class Puppet::Network::Rights < Hash
         end
     end
 
-    def [](name)
-        name = name.intern if name.is_a? String
-        super(name)
+    # Check that name is allowed or not
+    def allowed?(name, *args)
+        begin
+            fail_on_deny(name, :node => args[0], :ip => args[1])
+        rescue AuthorizationError
+            return false
+        rescue ArgumentError
+            # the namespace contract says we should raise this error
+            # if we didn't find the right acl
+            raise
+        end
+        return true
     end
 
-    # Define a new right to which access can be provided.
-    def newright(name)
-        name = name.intern if name.is_a? String
-        shortname = Right.shortname(name)
-        if self.include? name
-            raise ArgumentError, "Right '%s' is already defined" % name
+    def fail_on_deny(name, args = {})
+        res = :nomatch
+        right = @rights.find do |acl|
+            found = false
+            # an acl can return :dunno, which means "I'm not qualified to answer your question,
+            # please ask someone else". This is used when for instance an acl matches, but not for the
+            # current rest method, where we might think some other acl might be more specific.
+            if match = acl.match?(name)
+                args[:match] = match
+                if (res = acl.allowed?(args[:node], args[:ip], args)) != :dunno
+                    # return early if we're allowed
+                    return if res
+                    # we matched, select this acl
+                    found = true
+                end
+            end
+            found
+        end
+
+        # if we end here, then that means we either didn't match
+        # or failed, in any case will throw an error to the outside world
+        if name =~ /^\// or right
+            # we're a patch ACL, let's fail
+            msg = "%s access to %s [%s]" % [ (args[:node].nil? ? args[:ip] : "#{args[:node]}(#{args[:ip]})"), name, args[:method] ]
+
+            msg += " authenticated " if args[:authenticated]
+
+            error = AuthorizationError.new("Forbidden request: " + msg)
+            if right
+                error.file = right.file
+                error.line = right.line
+            end
+            Puppet.warning("Denying access: " + error.to_s)
         else
-            self[name] = Right.new(name, shortname)
+            # there were no rights allowing/denying name
+            # if name is not a path, let's throw
+            error = ArgumentError.new "Unknown namespace right '%s'" % name
         end
+        raise error
+    end
+
+    def initialize()
+        @rights = []
+    end
+
+    def [](name)
+        @rights.find { |acl| acl == name }
+    end
+
+    def include?(name)
+        @rights.include?(name)
+    end
+
+    def each
+        @rights.each { |r| yield r.name,r }
+    end
+
+    # Define a new right to which access can be provided.
+    def newright(name, line=nil, file=nil)
+        add_right( Right.new(name, line, file) )
     end
 
     private
 
+    def add_right(right)
+        if right.acl_type == :name and include?(right.key)
+            raise ArgumentError, "Right '%s' already exists"
+        end
+        @rights << right
+        sort_rights
+        right
+    end
+
+    def sort_rights
+        @rights.sort!
+    end
+
     # Retrieve a right by name.
     def right(name)
-        name = name.intern if name.is_a? String
         self[name]
     end
 
     # A right.
     class Right < Puppet::Network::AuthStore
-        attr_accessor :name, :shortname
+        include Puppet::FileCollection::Lookup
 
-        Puppet::Util.logmethods(self, true)
+        attr_accessor :name, :key, :acl_type
+        attr_accessor :methods, :environment, :authentication
 
-        def self.shortname(name)
-            name.to_s[0..0]
-        end
+        ALL = [:save, :destroy, :find, :search]
 
-        def initialize(name, shortname = nil)
+        Puppet::Util.logmethods(self, true)
+
+        def initialize(name, line, file)
+            @methods = []
+            @environment = []
+            @authentication = true # defaults to authenticated
             @name = name
-            @shortname = shortname
-            unless @shortname
-                @shortname = Right.shortname(name)
+            @line = line || 0
+            @file = file
+
+            case name
+            when Symbol
+                @acl_type = :name
+                @key = name
+            when /^\[(.+)\]$/
+                @acl_type = :name
+                @key = $1.intern if name.is_a?(String)
+            when /^\//
+                @acl_type = :regex
+                @key = Regexp.new("^" + Regexp.escape(name))
+                @methods = ALL
+            when /^~/ # this is a regex
+                @acl_type = :regex
+                @name = name.gsub(/^~\s+/,'')
+                @key = Regexp.new(@name)
+                @methods = ALL
+            else
+                raise ArgumentError, "Unknown right type '%s'" % name
             end
             super()
         end
@@ -68,6 +169,108 @@ class Puppet::Network::Rights < Hash
         def valid?
             true
         end
+
+        def regex?
+            acl_type == :regex
+        end
+
+        # does this right is allowed for this triplet?
+        # if this right is too restrictive (ie we don't match this access method)
+        # then return :dunno so that upper layers have a chance to try another right
+        # tailored to the given method
+        def allowed?(name, ip, args = {})
+            return :dunno if acl_type == :regex and not @methods.include?(args[:method])
+            return :dunno if acl_type == :regex and @environment.size > 0 and not @environment.include?(args[:environment])
+            return :dunno if acl_type == :regex and not @authentication.nil? and args[:authenticated] != @authentication
+
+            begin
+                # make sure any capture are replaced if needed
+                interpolate(args[:match]) if acl_type == :regex and args[:match]
+                res = super(name,ip)
+            ensure
+                reset_interpolation if acl_type == :regex
+            end
+            res
+        end
+
+        # restrict this right to some method only
+        def restrict_method(m)
+            m = m.intern if m.is_a?(String)
+
+            unless ALL.include?(m)
+                raise ArgumentError, "'%s' is not an allowed value for method directive" % m
+            end
+
+            # if we were allowing all methods, then starts from scratch
+            if @methods === ALL
+                @methods = []
+            end
+
+            if @methods.include?(m)
+                raise ArgumentError, "'%s' is already in the '%s' ACL" % [m, name]
+            end
+
+            @methods << m
+        end
+
+        def restrict_environment(env)
+            env = Puppet::Node::Environment.new(env)
+            if @environment.include?(env)
+                raise ArgumentError, "'%s' is already in the '%s' ACL" % [env, name]
+            end
+
+            @environment << env
+        end
+
+        def restrict_authenticated(authentication)
+            case authentication
+            when "yes", "on", "true", true
+                authentication = true
+            when "no", "off", "false", false
+                authentication = false
+            when "all","any", :all, :any
+                authentication = nil
+            else
+                raise ArgumentError, "'%s' incorrect authenticated value: %s" % [name, authentication]
+            end
+            @authentication = authentication
+        end
+
+        def match?(key)
+            # if we are a namespace compare directly
+            return self.key == namespace_to_key(key) if acl_type == :name
+
+            # otherwise match with the regex
+            return self.key.match(key)
+        end
+
+        def namespace_to_key(key)
+            key = key.intern if key.is_a?(String)
+            key
+        end
+
+        # this is where all the magic happens.
+        # we're sorting the rights array with this scheme:
+        #  * namespace rights are all in front
+        #  * regex path rights are then all queued in file order
+        def <=>(rhs)
+            # move namespace rights at front
+            if self.acl_type != rhs.acl_type
+                return self.acl_type == :name ? -1 : 1
+            end
+
+            # sort by creation order (ie first match appearing in the file will win)
+            # that is don't sort, in which case the sort algorithm will order in the
+            # natural array order (ie the creation order)
+            return 0
+        end
+
+        def ==(name)
+            return self.key == namespace_to_key(name) if acl_type == :name
+            return self.name == name.gsub(/^~\s+/,'')
+        end
+
     end
-end
 
+end
+end