puppet 0.24.9 → 0.25.0

data/lib/puppet/ssl/inventory.rb

@@ -0,0 +1,52 @@
+require 'puppet/ssl'
+require 'puppet/ssl/certificate'
+
+# Keep track of all of our known certificates.
+class Puppet::SSL::Inventory
+    attr_reader :path
+
+    # Add a certificate to our inventory.
+    def add(cert)
+        cert = cert.content if cert.is_a?(Puppet::SSL::Certificate)
+
+        # Create our file, if one does not already exist.
+        rebuild unless FileTest.exist?(@path)
+
+        Puppet.settings.write(:cert_inventory, "a") do |f|
+            f.print format(cert)
+        end
+    end
+
+    # Format our certificate for output.
+    def format(cert)
+        iso = '%Y-%m-%dT%H:%M:%S%Z'
+        return "0x%04x %s %s %s\n" % [cert.serial,  cert.not_before.strftime(iso), cert.not_after.strftime(iso), cert.subject]
+    end
+
+    def initialize
+        @path = Puppet[:cert_inventory]
+    end
+
+    # Rebuild the inventory from scratch.  This should happen if
+    # the file is entirely missing or if it's somehow corrupted.
+    def rebuild
+        Puppet.notice "Rebuilding inventory file"
+
+        Puppet.settings.write(:cert_inventory) do |f|
+            f.print "# Inventory of signed certificates\n# SERIAL NOT_BEFORE NOT_AFTER SUBJECT\n"
+        end
+
+        Puppet::SSL::Certificate.search("*").each { |cert| add(cert) }
+    end
+
+    # Find the serial number for a given certificate.
+    def serial(name)
+        return nil unless FileTest.exist?(@path)
+
+        File.readlines(@path).each do |line|
+            next unless line =~ /^(\S+).+\/CN=#{name}$/
+
+            return Integer($1)
+        end
+    end
+end

data/lib/puppet/ssl/key.rb

@@ -0,0 +1,56 @@
+require 'puppet/ssl/base'
+require 'puppet/indirector'
+
+# Manage private and public keys as a pair.
+class Puppet::SSL::Key < Puppet::SSL::Base
+    wraps OpenSSL::PKey::RSA
+
+    extend Puppet::Indirector
+    indirects :key, :terminus_class => :file
+
+    # Because of how the format handler class is included, this
+    # can't be in the base class.
+    def self.supported_formats
+        [:s]
+    end
+
+    attr_accessor :password_file
+
+    # Knows how to create keys with our system defaults.
+    def generate
+        Puppet.info "Creating a new SSL key for %s" % name
+        @content = OpenSSL::PKey::RSA.new(Puppet[:keylength].to_i)
+    end
+
+    def initialize(name)
+        super
+
+        if ca?
+            @password_file = Puppet[:capass]
+        else
+            @password_file = Puppet[:passfile]
+        end
+    end
+
+    def password
+        return nil unless password_file and FileTest.exist?(password_file)
+
+        ::File.read(password_file)
+    end
+
+    # Optionally support specifying a password file.
+    def read(path)
+        return super unless password_file
+
+        #@content = wrapped_class.new(::File.read(path), password)
+        @content = wrapped_class.new(::File.read(path), password)
+    end
+
+    def to_s
+        if pass = password
+            @content.export(OpenSSL::Cipher::DES.new(:EDE3, :CBC), pass)
+        else
+            return super
+        end
+    end
+end

data/lib/puppet/sslcertificates.rb

@@ -53,13 +53,13 @@ module Puppet::SSLCertificates
 
         ex = []
         case hash[:type]
-        when :ca:
+        when :ca
             basic_constraint = "CA:TRUE"
             key_usage = %w{cRLSign keyCertSign}
-        when :terminalsubca:
+        when :terminalsubca
             basic_constraint = "CA:TRUE,pathlen:0"
             key_usage = %w{cRLSign keyCertSign}
-        when :server:
+        when :server
             basic_constraint = "CA:FALSE"
             dnsnames = Puppet[:certdnsnames]
             name = hash[:name].to_s.sub(%r{/CN=},'')
@@ -73,11 +73,11 @@ module Puppet::SSLCertificates
             end
             key_usage = %w{digitalSignature keyEncipherment}
             ext_key_usage = %w{serverAuth clientAuth emailProtection}
-        when :ocsp:
+        when :ocsp
             basic_constraint = "CA:FALSE"
             key_usage = %w{nonRepudiation digitalSignature}
             ext_key_usage = %w{serverAuth OCSPSigning}
-        when :client:
+        when :client
             basic_constraint = "CA:FALSE"
             key_usage = %w{nonRepudiation digitalSignature keyEncipherment}
             ext_key_usage = %w{clientAuth emailProtection}
@@ -93,7 +93,7 @@ module Puppet::SSLCertificates
 
         ex << ef.create_extension("keyUsage", key_usage.join(",")) if key_usage
         ex << ef.create_extension("extendedKeyUsage", ext_key_usage.join(",")) if ext_key_usage
-	    ex << ef.create_extension("subjectAltName", subject_alt_name.join(",")) if ! subject_alt_name.empty?
+        ex << ef.create_extension("subjectAltName", subject_alt_name.join(",")) if ! subject_alt_name.empty?
 
         #if @ca_config[:cdp_location] then
         #  ex << ef.create_extension("crlDistributionPoints",

data/lib/puppet/sslcertificates/ca.rb

@@ -31,7 +31,7 @@ class Puppet::SSLCertificates::CA
                         [file, detail]
                 end
             end
-            
+
         end
     end
 
@@ -39,7 +39,7 @@ class Puppet::SSLCertificates::CA
         File.join(Puppet[:csrdir], [hostname.downcase, "pem"].join("."))
     end
 
-    # this stores signed certs in a directory unrelated to 
+    # this stores signed certs in a directory unrelated to
     # normal client certs
     def host2certfile(hostname)
         File.join(Puppet[:signeddir], [hostname.downcase, "pem"].join("."))
@@ -142,15 +142,15 @@ class Puppet::SSLCertificates::CA
         }
     end
 
-    # List signed certificates.  This returns a list of hostnames, not actual 
-    # files -- the names can be converted to full paths with host2csrfile. 
-    def list_signed 
-        return Dir.entries(Puppet[:signeddir]).find_all { |file| 
-            file =~ /\.pem$/ 
-        }.collect { |file| 
-            file.sub(/\.pem$/, '') 
-        } 
-    end 
+    # List signed certificates.  This returns a list of hostnames, not actual
+    # files -- the names can be converted to full paths with host2csrfile.
+    def list_signed
+        return Dir.entries(Puppet[:signeddir]).find_all { |file|
+            file =~ /\.pem$/
+        }.collect { |file|
+            file.sub(/\.pem$/, '')
+        }
+    end
 
     # Create the root certificate.
     def mkrootcert
@@ -207,7 +207,7 @@ class Puppet::SSLCertificates::CA
         @crl.add_revoked(revoked)
         store_crl
     end
-    
+
     # Take the Puppet config and store it locally.
     def setconfig(hash)
         @config = {}
@@ -306,7 +306,7 @@ class Puppet::SSLCertificates::CA
         end
     end
 
-    # TTL for new certificates in seconds. If config param :ca_ttl is set, 
+    # TTL for new certificates in seconds. If config param :ca_ttl is set,
     # use that, otherwise use :ca_days for backwards compatibility
     def ttl
         days = @config[:ca_days]
@@ -337,7 +337,7 @@ class Puppet::SSLCertificates::CA
             end
         end
     end
-    
+
     private
     def init_crl
         if FileTest.exists?(@config[:cacrl])
@@ -355,7 +355,7 @@ class Puppet::SSLCertificates::CA
             @crl
         end
     end
-        
+
     def store_crl
         # Increment the crlNumber
         e = @crl.extensions.find { |e| e.oid == 'crlNumber' }

data/lib/puppet/sslcertificates/certificate.rb

@@ -98,10 +98,10 @@ class Puppet::SSLCertificates::Certificate
         @encrypt = hash[:encrypt] || false
         @replace = hash[:replace] || false
         @issuer = hash[:issuer] || nil
-        
+
         if hash.include?(:type)
-            case hash[:type] 
-            when :ca, :client, :server: @type = hash[:type]
+            case hash[:type]
+            when :ca, :client, :server; @type = hash[:type]
             else
                 raise "Invalid Cert type %s" % hash[:type]
             end
@@ -168,7 +168,7 @@ class Puppet::SSLCertificates::Certificate
 #                case p
 #                when 0; Puppet.info "key info: ."  # BN_generate_prime
 #                when 1; Puppet.info "key info: +"  # BN_generate_prime
-#                when 2; Puppet.info "key info: *"  # searching good prime,  
+#                when 2; Puppet.info "key info: *"  # searching good prime,
 #                                          # n = #of try,
 #                                          # but also data from BN_generate_prime
 #                when 3; Puppet.info "key info: \n" # found good prime, n==0 - p, n==1 - q,

data/lib/puppet/sslcertificates/inventory.rb

@@ -4,7 +4,7 @@ module Puppet::SSLCertificates
     module Inventory
 
         # Add CERT to the inventory of issued certs in '$cadir/inventory.txt'
-        # If no inventory exists yet, build an inventory and list all the 
+        # If no inventory exists yet, build an inventory and list all the
         # certificates that have been signed so far
         def self.add(cert)
             inited = false
@@ -30,8 +30,8 @@ module Puppet::SSLCertificates
 
         def self.format(cert)
             iso = '%Y-%m-%dT%H:%M:%S%Z'
-            return "0x%04x %s %s %s" % [cert.serial,  
-                                        cert.not_before.strftime(iso), 
+            return "0x%04x %s %s %s" % [cert.serial,
+                                        cert.not_before.strftime(iso),
                                         cert.not_after.strftime(iso),
                                         cert.subject]
         end

data/lib/puppet/transaction.rb

@@ -16,7 +16,7 @@ class Transaction
 
     # The list of events generated in this transaction.
     attr_reader :events
-    
+
     include Puppet::Util
 
     # Add some additional times for reporting
@@ -35,7 +35,7 @@ class Transaction
         if resource.purging? and resource.deleting?
             if deps = relationship_graph.dependents(resource) and ! deps.empty? and deps.detect { |d| ! d.deleting? }
                 resource.warning "%s still depend%s on me -- not purging" %
-                    [deps.collect { |r| r.ref }.join(","), deps.length > 1 ? "":"s"] 
+                    [deps.collect { |r| r.ref }.join(","), deps.length > 1 ? "":"s"]
                 return false
             end
         end
@@ -91,7 +91,7 @@ class Transaction
             if resource.respond_to?(:flush)
                 resource.flush
             end
-            
+
             # And set a trigger for refreshing this resource if it's a
             # self-refresher
             if resource.self_refresh? and ! resource.deleting?
@@ -149,27 +149,27 @@ class Transaction
             change.property.resource
         }.uniq
     end
-    
+
     # Do any necessary cleanup.  If we don't get rid of the graphs, the
     # contained resources might never get cleaned up.
     def cleanup
         if defined? @generated
-            relationship_graph.remove_resource(*@generated)
+            catalog.remove_resource(*@generated)
         end
     end
 
     # Copy an important relationships from the parent to the newly-generated
     # child resource.
-    def copy_relationships(resource, children)
+    def make_parent_child_relationship(resource, children)
         depthfirst = resource.depthfirst?
-        
+
         children.each do |gen_child|
             if depthfirst
                 edge = [gen_child, resource]
             else
                 edge = [resource, gen_child]
             end
-            relationship_graph.add_resource(gen_child) unless relationship_graph.resource(gen_child.ref)
+            relationship_graph.add_vertex(gen_child)
 
             unless relationship_graph.edge?(edge[1], edge[0])
                 relationship_graph.add_edge(*edge)
@@ -188,81 +188,21 @@ class Transaction
 
     # See if the resource generates new resources at evaluation time.
     def eval_generate(resource)
-        if resource.respond_to?(:eval_generate)
-            begin
-                children = resource.eval_generate
-            rescue => detail
-                if Puppet[:trace]
-                    puts detail.backtrace
-                end
-                resource.err "Failed to generate additional resources during transaction: %s" %
-                    detail
-                return nil
-            end
-            
-            if children
-                children.each { |child| child.finish }
-                @generated += children
-                return children
-            end
-        end
+        generate_additional_resources(resource, :eval_generate)
     end
-    
+
     # Evaluate a single resource.
-    def eval_resource(resource, checkskip = true)
+    def eval_resource(resource)
         events = []
-        
+
         if resource.is_a?(Puppet::Type::Component)
             raise Puppet::DevError, "Got a component to evaluate"
         end
-        
-        if checkskip and skip?(resource)
+
+        if skip?(resource)
             @resourcemetrics[:skipped] += 1
         else
-            @resourcemetrics[:scheduled] += 1
-            
-            changecount = @changes.length
-            
-            # We need to generate first regardless, because the recursive
-            # actions sometimes change how the top resource is applied.
-            children = eval_generate(resource)
-            
-            if children and resource.depthfirst?
-                children.each do |child|
-                    # The child will never be skipped when the parent isn't
-                    events += eval_resource(child, false)
-                end
-            end
-
-            # Perform the actual changes
-            seconds = thinmark do
-                events += apply(resource)
-            end
-
-            if children and ! resource.depthfirst?
-                children.each do |child|
-                    events += eval_resource(child, false)
-                end
-            end
-
-            # Create a child/parent relationship.  We do this after everything else because
-            # we want explicit relationships to be able to override automatic relationships,
-            # including this one.
-            if children
-                copy_relationships(resource, children)
-            end
-            
-            # A bit of hackery here -- if skipcheck is true, then we're the
-            # top-level resource.  If that's the case, then make sure all of
-            # the changes list this resource as a proxy.  This is really only
-            # necessary for rollback, since we know the generating resource
-            # during forward changes.
-            if children and checkskip
-                @changes[changecount..-1].each { |change| change.proxy = resource }
-            end
-
-            # Keep track of how long we spend in each type of resource
-            @timemetrics[resource.class.name] += seconds
+            events += eval_children_and_apply_resource(resource)
         end
 
         # Check to see if there are any events for this resource
@@ -277,10 +217,8 @@ class Transaction
             # We have to dup the label here, else we modify the original edge label,
             # which affects whether a given event will match on the next run, which is,
             # of course, bad.
-            edge = orig_edge.class.new(orig_edge.source, orig_edge.target)
-            label = orig_edge.label.dup
-            label[:event] = events.collect { |e| e.name }
-            edge.label = label
+            edge = orig_edge.class.new(orig_edge.source, orig_edge.target, orig_edge.label)
+            edge.event = events.collect { |e| e.name }
             set_trigger(edge)
         end
 
@@ -288,6 +226,50 @@ class Transaction
         events
     end
 
+    def eval_children_and_apply_resource(resource)
+        events = []
+
+        @resourcemetrics[:scheduled] += 1
+
+        changecount = @changes.length
+
+        # We need to generate first regardless, because the recursive
+        # actions sometimes change how the top resource is applied.
+        children = eval_generate(resource)
+
+        if ! children.empty? and resource.depthfirst?
+            children.each do |child|
+                # The child will never be skipped when the parent isn't
+                events += eval_resource(child, false)
+            end
+        end
+
+        # Perform the actual changes
+        seconds = thinmark do
+            events += apply(resource)
+        end
+
+        if ! children.empty? and ! resource.depthfirst?
+            children.each do |child|
+                events += eval_resource(child)
+            end
+        end
+
+        # A bit of hackery here -- if skipcheck is true, then we're the
+        # top-level resource.  If that's the case, then make sure all of
+        # the changes list this resource as a proxy.  This is really only
+        # necessary for rollback, since we know the generating resource
+        # during forward changes.
+        unless children.empty?
+            @changes[changecount..-1].each { |change| change.proxy = resource }
+        end
+
+        # Keep track of how long we spend in each type of resource
+        @timemetrics[resource.class.name] += seconds
+
+        events
+    end
+
     # This method does all the actual work of running a transaction.  It
     # collects all of the changes, executes them, and responds to any
     # necessary events.
@@ -296,9 +278,11 @@ class Transaction
 
         # Start logging.
         Puppet::Util::Log.newdestination(@report)
-        
+
         prepare()
 
+        Puppet.info "Applying configuration version '%s'" % catalog.version if catalog.version
+
         begin
             allevents = @sorted_resources.collect { |resource|
                 if resource.is_a?(Puppet::Type::Component)
@@ -351,43 +335,45 @@ class Transaction
                 skip = true
             end
         end
-        
+
         return skip
     end
-    
-    # Collect any dynamically generated resources.
+
+    # A general method for recursively generating new resources from a
+    # resource.
+    def generate_additional_resources(resource, method)
+        return [] unless resource.respond_to?(method)
+        begin
+            made = resource.send(method)
+        rescue => detail
+            puts detail.backtrace if Puppet[:trace]
+            resource.err "Failed to generate additional resources using '%s': %s" % [method, detail]
+        end
+        return [] unless made
+        made = [made] unless made.is_a?(Array)
+        made.uniq.find_all do |res|
+            begin
+                @catalog.add_resource(res) do |r|
+                    r.finish
+                    make_parent_child_relationship(resource, [r])
+                end
+                true
+            rescue Puppet::Resource::Catalog::DuplicateResourceError
+                res.info "Duplicate generated resource; skipping"
+                false
+            end
+        end
+    end
+
+    # Collect any dynamically generated resources.  This method is called
+    # before the transaction starts.
     def generate
         list = @catalog.vertices
-        
-        # Store a list of all generated resources, so that we can clean them up
-        # after the transaction closes.
-        @generated = []
-        
         newlist = []
         while ! list.empty?
             list.each do |resource|
-                if resource.respond_to?(:generate)
-                    begin
-                        made = resource.generate
-                    rescue => detail
-                        resource.err "Failed to generate additional resources: %s" %
-                            detail
-                    end
-                    next unless made
-                    unless made.is_a?(Array)
-                        made = [made]
-                    end
-                    made.uniq!
-                    made.each do |res|
-                        @catalog.add_resource(res)
-                        res.catalog = catalog
-                        newlist << res
-                        @generated << res
-                        res.finish
-                    end
-                end
+                newlist += generate_additional_resources(resource, :generate)
             end
-            list.clear
             list = newlist
             newlist = []
         end
@@ -429,10 +415,10 @@ class Transaction
     # this should only be called by a Puppet::Type::Component resource now
     # and it should only receive an array
     def initialize(resources)
-        if resources.is_a?(Puppet::Node::Catalog)
+        if resources.is_a?(Puppet::Resource::Catalog)
             @catalog = resources
-        elsif resources.is_a?(Puppet::PGraph)
-            raise "Transactions should get catalogs now, not PGraph"
+        elsif resources.is_a?(Puppet::SimpleGraph)
+            raise "Transactions should get catalogs now, not SimpleGraph"
         else
             raise "Transactions require catalogs"
         end
@@ -497,7 +483,7 @@ class Transaction
             end
         end
     end
-    
+
     # Prepare to evaluate the resources in a transaction.
     def prepare
         # Now add any dynamically generated resources
@@ -506,7 +492,7 @@ class Transaction
         # Then prefetch.  It's important that we generate and then prefetch,
         # so that any generated resources also get prefetched.
         prefetch()
-        
+
         # This will throw an error if there are cycles in the graph.
         @sorted_resources = relationship_graph.topsort
     end
@@ -514,7 +500,7 @@ class Transaction
     def relationship_graph
         catalog.relationship_graph
     end
-    
+
     # Send off the transaction report.
     def send_report
         begin
@@ -524,33 +510,19 @@ class Transaction
             return
         end
 
-        if Puppet[:rrdgraph] == true
-            report.graph()
-        end
-
         if Puppet[:summarize]
             puts report.summary
         end
-        
+
         if Puppet[:report]
             begin
-                reportclient().report(report)
+                report.save()
             rescue => detail
                 Puppet.err "Reporting failed: %s" % detail
             end
         end
     end
 
-    def reportclient
-        unless defined? @reportclient
-            @reportclient = Puppet::Network::Client.report.new(
-                :Server => Puppet[:reportserver]
-            )
-        end
-
-        @reportclient
-    end
-
     # Roll all completed changes back.
     def rollback
         @targets.clear
@@ -576,7 +548,7 @@ class Transaction
                 # this still could get hairy; what if file contents changed,
                 # but a chmod failed?  how would i handle that error? dern
             end
-            
+
             # FIXME This won't work right now.
             relationship_graph.matching_edges(events).each do |edge|
                 @targets[edge.target] << edge
@@ -591,7 +563,7 @@ class Transaction
             events
         }.flatten.reject { |e| e.nil? }
     end
-    
+
     # Is the resource currently scheduled?
     def scheduled?(resource)
         self.ignoreschedules or resource.scheduled?
@@ -608,7 +580,7 @@ class Transaction
         end
         @targets[edge.target] << edge
     end
-    
+
     # Should this resource be skipped?
     def skip?(resource)
         skip = false
@@ -618,12 +590,14 @@ class Transaction
             resource.debug "Not scheduled"
         elsif failed_dependencies?(resource)
             resource.warning "Skipping because of failed dependencies"
+        elsif resource.virtual?
+            resource.debug "Skipping because virtual"
         else
             return false
         end
         return true
     end
-    
+
     # The tags we should be checking.
     def tags
         unless defined? @tags
@@ -634,7 +608,7 @@ class Transaction
                 @tags = tags.split(/\s*,\s*/)
             end
         end
-        
+
         @tags
     end
 
@@ -642,13 +616,13 @@ class Transaction
         tags = [tags] unless tags.is_a?(Array)
         @tags = tags
     end
-    
+
     # Is this resource tagged appropriately?
     def missing_tags?(resource)
         return false if self.ignore_tags? or tags.empty?
         return true unless resource.tagged?(tags)
     end
-    
+
     # Are there any edges that target this resource?
     def targeted?(resource)
         # The default value is a new array so we have to test the length of it.
@@ -691,7 +665,7 @@ class Transaction
                     [callback, subs.length]
             end
             resource.notice message
-            
+
             # At this point, just log failures, don't try to react
             # to them in any way.
             begin