puppet 0.25.5 → 2.6.0

data/lib/puppet/network/authorization.rb

@@ -2,82 +2,75 @@ require 'puppet/network/client_request'
 require 'puppet/network/authconfig'
 
 module Puppet::Network
-    # Most of our subclassing is just so that we can get
-    # access to information from the request object, like
-    # the client name and IP address.
-    class InvalidClientRequest < Puppet::Error; end
-    module Authorization
-        # Create our config object if necessary.  This works even if
-        # there's no configuration file.
-        def authconfig
-            unless defined? @authconfig
-                @authconfig = Puppet::Network::AuthConfig.main()
-            end
+  # Most of our subclassing is just so that we can get
+  # access to information from the request object, like
+  # the client name and IP address.
+  class InvalidClientRequest < Puppet::Error; end
+  module Authorization
+    # Create our config object if necessary.  This works even if
+    # there's no configuration file.
+    def authconfig
+      @authconfig ||= Puppet::Network::AuthConfig.main
 
-            @authconfig
-        end
+      @authconfig
+    end
 
-        # Verify that our client has access.  We allow untrusted access to
-        # puppetca methods but no others.
-        def authorized?(request)
-            msg = "%s client %s access to %s" %
-                [request.authenticated? ? "authenticated" : "unauthenticated",
-                    request, request.call]
+    # Verify that our client has access.  We allow untrusted access to
+    # puppetca methods but no others.
+    def authorized?(request)
+      msg = "#{request.authenticated? ? "authenticated" : "unauthenticated"} client #{request} access to #{request.call}"
 
-            if request.authenticated?
-                if authconfig.exists?
-                    if authconfig.allowed?(request)
-                        Puppet.debug "Allowing " + msg
-                        return true
-                    else
-                        Puppet.notice "Denying " + msg
-                        return false
-                    end
-                else
-                    # This is a hack way of seeing if we're a config master.
-                    if Puppet[:name] == "puppetmasterd"
-                        Puppet.debug "Allowing " + msg
-                        return true
-                    else
-                        Puppet.notice "Denying " + msg
-                        return false
-                    end
-                end
-            else
-                if request.handler == "puppetca"
-                    Puppet.notice "Allowing " + msg
-                else
-                    Puppet.notice "Denying " + msg
-                    return false
-                end
-            end
+      if request.authenticated?
+        if authconfig.exists?
+          if authconfig.allowed?(request)
+            Puppet.debug "Allowing #{msg}"
+            return true
+          else
+            Puppet.notice "Denying #{msg}"
+            return false
+          end
+        else
+          if Puppet.run_mode.master?
+            Puppet.debug "Allowing #{msg}"
+            return true
+          else
+            Puppet.notice "Denying #{msg}"
+            return false
+          end
         end
-
-        # Is this functionality available?
-        def available?(request)
-            if handler_loaded?(request.handler)
-                return true
-            else
-                Puppet.warning "Client %s requested unavailable functionality %s" %
-                    [request, request.handler]
-                return false
-            end
+      else
+        if request.handler == "puppetca"
+          Puppet.notice "Allowing #{msg}"
+        else
+          Puppet.notice "Denying #{msg}"
+          return false
         end
+      end
+    end
 
-        # Make sure that this method is available and authorized.
-        def verify(request)
-            unless available?(request)
-                raise InvalidClientRequest.new(
-                    "Functionality %s not available" % request.handler
-                )
-            end
-            unless authorized?(request)
-                raise InvalidClientRequest.new(
-                    "Host %s not authorized to call %s" %
-                        [request, request.call]
-                )
-            end
-        end
+    # Is this functionality available?
+    def available?(request)
+      if handler_loaded?(request.handler)
+        return true
+      else
+        Puppet.warning "Client #{request} requested unavailable functionality #{request.handler}"
+        return false
+      end
+    end
+
+    # Make sure that this method is available and authorized.
+    def verify(request)
+      unless available?(request)
+        raise InvalidClientRequest.new(
+          "Functionality #{request.handler} not available"
+        )
+      end
+      unless authorized?(request)
+        raise InvalidClientRequest.new(
+          "Host #{request} not authorized to call #{request.call}"
+        )
+      end
     end
+  end
 end
 

data/lib/puppet/network/authstore.rb

@@ -5,252 +5,246 @@ require 'ipaddr'
 require 'puppet/util/logging'
 
 module Puppet
-    class AuthStoreError < Puppet::Error; end
-    class AuthorizationError < Puppet::Error; end
-
-    class Network::AuthStore
-        include Puppet::Util::Logging
-
-        # Mark a given pattern as allowed.
-        def allow(pattern)
-            # a simple way to allow anyone at all to connect
-            if pattern == "*"
-                @globalallow = true
-            else
-                store(:allow, pattern)
-            end
-
-            return nil
-        end
+  class AuthStoreError < Puppet::Error; end
+  class AuthorizationError < Puppet::Error; end
+
+  class Network::AuthStore
+    include Puppet::Util::Logging
+
+    # Mark a given pattern as allowed.
+    def allow(pattern)
+      # a simple way to allow anyone at all to connect
+      if pattern == "*"
+        @globalallow = true
+      else
+        store(:allow, pattern)
+      end
+
+      nil
+    end
 
-        # Is a given combination of name and ip address allowed?  If either input
-        # is non-nil, then both inputs must be provided.  If neither input
-        # is provided, then the authstore is considered local and defaults to "true".
-        def allowed?(name, ip)
-            if name or ip
-                # This is probably unnecessary, and can cause some weirdnesses in
-                # cases where we're operating over localhost but don't have a real
-                # IP defined.
-                unless name and ip
-                    raise Puppet::DevError, "Name and IP must be passed to 'allowed?'"
-                end
-                # else, we're networked and such
-            else
-                # we're local
-                return true
-            end
-
-            # yay insecure overrides
-            if globalallow?
-                return true
-            end
-
-            if decl = declarations.find { |d| d.match?(name, ip) }
-                return decl.result
-            end
-
-            info "defaulting to no access for %s" % name
-            return false
-        end
+    # Is a given combination of name and ip address allowed?  If either input
+    # is non-nil, then both inputs must be provided.  If neither input
+    # is provided, then the authstore is considered local and defaults to "true".
+    def allowed?(name, ip)
+      if name or ip
+        # This is probably unnecessary, and can cause some weirdnesses in
+        # cases where we're operating over localhost but don't have a real
+        # IP defined.
+        raise Puppet::DevError, "Name and IP must be passed to 'allowed?'" unless name and ip
+        # else, we're networked and such
+      else
+        # we're local
+        return true
+      end
+
+      # yay insecure overrides
+      return true if globalallow?
+
+      if decl = declarations.find { |d| d.match?(name, ip) }
+        return decl.result
+      end
+
+      info "defaulting to no access for #{name}"
+      false
+    end
 
-        # Deny a given pattern.
-        def deny(pattern)
-            store(:deny, pattern)
-        end
+    # Deny a given pattern.
+    def deny(pattern)
+      store(:deny, pattern)
+    end
 
-        # Is global allow enabled?
-        def globalallow?
-            @globalallow
-        end
+    # Is global allow enabled?
+    def globalallow?
+      @globalallow
+    end
 
-        # does this auth store has any rules?
-        def empty?
-            @globalallow.nil? && @declarations.size == 0
-        end
+    # does this auth store has any rules?
+    def empty?
+      @globalallow.nil? && @declarations.size == 0
+    end
 
-        def initialize
-            @globalallow = nil
-            @declarations = []
-        end
+    def initialize
+      @globalallow = nil
+      @declarations = []
+    end
 
-        def to_s
-            "authstore"
-        end
+    def to_s
+      "authstore"
+    end
 
-        def interpolate(match)
-            Thread.current[:declarations] = @declarations.collect { |ace| ace.interpolate(match) }.sort
-        end
+    def interpolate(match)
+      Thread.current[:declarations] = @declarations.collect { |ace| ace.interpolate(match) }.sort
+    end
 
-        def reset_interpolation
-            Thread.current[:declarations] = nil
-        end
+    def reset_interpolation
+      Thread.current[:declarations] = nil
+    end
 
-        private
+    private
 
-        # returns our ACEs list, but if we have a modification of it
-        # in our current thread, let's return it
-        # this is used if we want to override the this purely immutable list
-        # by a modified version in a multithread safe way.
-        def declarations
-            Thread.current[:declarations] || @declarations
-        end
+    # returns our ACEs list, but if we have a modification of it
+    # in our current thread, let's return it
+    # this is used if we want to override the this purely immutable list
+    # by a modified version in a multithread safe way.
+    def declarations
+      Thread.current[:declarations] || @declarations
+    end
 
-        # Store the results of a pattern into our hash.  Basically just
-        # converts the pattern and sticks it into the hash.
-        def store(type, pattern)
-            @declarations << Declaration.new(type, pattern)
-            @declarations.sort!
+    # Store the results of a pattern into our hash.  Basically just
+    # converts the pattern and sticks it into the hash.
+    def store(type, pattern)
+      @declarations << Declaration.new(type, pattern)
+      @declarations.sort!
 
-            return nil
-        end
+      nil
+    end
 
-        # A single declaration.  Stores the info for a given declaration,
-        # provides the methods for determining whether a declaration matches,
-        # and handles sorting the declarations appropriately.
-        class Declaration
-            include Puppet::Util
-            include Comparable
-
-            # The type of declaration: either :allow or :deny
-            attr_reader :type
-
-            # The name: :ip or :domain
-            attr_accessor :name
-
-            # The pattern we're matching against.  Can be an IPAddr instance,
-            # or an array of strings, resulting from reversing a hostname
-            # or domain name.
-            attr_reader :pattern
-
-            # The length.  Only used for iprange and domain.
-            attr_accessor :length
-
-            # Sort the declarations most specific first.
-            def <=>(other)
-                compare(exact?, other.exact?) || 
-                compare(ip?, other.ip?)  ||
-                ((length != other.length) &&  (other.length <=> length)) ||
-                compare(deny?, other.deny?) ||
-                ( ip? ? pattern.to_s <=> other.pattern.to_s : pattern <=> other.pattern)
-            end
-
-            def deny?
-                type == :deny
-            end
-
-            def exact?
-                @exact == :exact
-            end
-
-            def initialize(type, pattern)
-                self.type = type
-                self.pattern = pattern
-            end
-
-            # Are we an IP type?
-            def ip?
-                name == :ip
-            end
-
-            # Does this declaration match the name/ip combo?
-            def match?(name, ip)
-                ip? ? pattern.include?(IPAddr.new(ip)) : matchname?(name)
-            end
-
-            # Set the pattern appropriately.  Also sets the name and length.
-            def pattern=(pattern)
-                parse(pattern)
-                @orig = pattern
-            end
-
-            # Mapping a type of statement into a return value.
-            def result
-                type == :allow
-            end
-
-            def to_s
-                "#{type}: #{pattern}"
-            end
-
-            # Set the declaration type.  Either :allow or :deny.
-            def type=(type)
-                type = symbolize(type)
-                unless [:allow, :deny].include?(type)
-                    raise ArgumentError, "Invalid declaration type %s" % type
-                end
-                @type = type
-            end
-
-            # interpolate a pattern to replace any
-            # backreferences by the given match
-            # for instance if our pattern is $1.puppetlabs.com
-            # and we're called with a MatchData whose capture 1 is puppet
-            # we'll return a pattern of puppet.puppetlabs.com
-            def interpolate(match)
-                clone = dup
-                clone.pattern = clone.pattern.reverse.collect do |p|
-                    p.gsub(/\$(\d)/) { |m| match[$1.to_i] }
-                end.join(".")
-                clone
-            end
-
-            private
-
-            # Returns nil if both values are true or both are false, returns
-            # -1 if the first is true, and 1 if the second is true.  Used
-            # in the <=> operator.
-            def compare(me, them)
-                (me and them) ? nil : me ? -1 : them ? 1 : nil
-            end
-
-            # Does the name match our pattern?
-            def matchname?(name)
-                name = munge_name(name)
-                (pattern == name) or (not exact? and pattern.zip(name).all? { |p,n| p == n })
-            end
-
-            # Convert the name to a common pattern.
-            def munge_name(name)
-                # LAK:NOTE http://snurl.com/21zf8  [groups_google_com]
-                # Change to name.downcase.split(".",-1).reverse for FQDN support
-                name.downcase.split(".").reverse
-            end
-
-            # Parse our input pattern and figure out what kind of allowal
-            # statement it is.  The output of this is used for later matching.
-            Octet = '(\d|[1-9]\d|1\d\d|2[0-4]\d|25[0-5])'
-            IPv4 = "#{Octet}\.#{Octet}\.#{Octet}\.#{Octet}"
-            IPv6_full    = "_:_:_:_:_:_:_:_|_:_:_:_:_:_::_?|_:_:_:_:_::((_:)?_)?|_:_:_:_::((_:){0,2}_)?|_:_:_::((_:){0,3}_)?|_:_::((_:){0,4}_)?|_::((_:){0,5}_)?|::((_:){0,6}_)?"
-            IPv6_partial = "_:_:_:_:_:_:|_:_:_:_::(_:)?|_:_::(_:){0,2}|_::(_:){0,3}"
-            # It should be:
-            #     IP = "#{IPv4}|#{IPv6_full}|(#{IPv6_partial}#{IPv4})".gsub(/_/,'([0-9a-fA-F]{1,4})').gsub(/\(/,'(?:')
-            # but ruby's ipaddr lib doesn't support the hybrid format
-            IP = "#{IPv4}|#{IPv6_full}".gsub(/_/,'([0-9a-fA-F]{1,4})').gsub(/\(/,'(?:')
-            def parse(value)
-                @name,@exact,@length,@pattern = *case value
-                when /^(?:#{IP})\/(\d+)$/                                   # 12.34.56.78/24, a001:b002::efff/120, c444:1000:2000::9:192.168.0.1/112
-                    [:ip,:inexact,$1.to_i,IPAddr.new(value)]
-                when /^(#{IP})$/                                          # 10.20.30.40, 
-                    [:ip,:exact,nil,IPAddr.new(value)]
-                when /^(#{Octet}\.){1,3}\*$/                              # an ip address with a '*' at the end
-                    segments = value.split(".")[0..-2]
-                    bits = 8*segments.length
-                    [:ip,:inexact,bits,IPAddr.new((segments+[0,0,0])[0,4].join(".") + "/#{bits}")]
-                when /^(\w[-\w]*\.)+[-\w]+$/                              # a full hostname
-                    # Change to /^(\w[-\w]*\.)+[-\w]+\.?$/ for FQDN support
-                    [:domain,:exact,nil,munge_name(value)]
-                when /^\*(\.(\w[-\w]*)){1,}$/                             # *.domain.com
-                    host_sans_star = munge_name(value)[0..-2]
-                    [:domain,:inexact,host_sans_star.length,host_sans_star]
-                when /\$\d+/                                              # a backreference pattern ala $1.puppetlabs.com or 192.168.0.$1 or $1.$2
-                    [:dynamic,:exact,nil,munge_name(value)]
-                when /^\w[-.@\w]*$/                                       # ? Just like a host name but allow '@'s and ending '.'s
-                    [:opaque,:exact,nil,[value]]
-                else
-                    raise AuthStoreError, "Invalid pattern %s" % value
-                end
-            end
+    # A single declaration.  Stores the info for a given declaration,
+    # provides the methods for determining whether a declaration matches,
+    # and handles sorting the declarations appropriately.
+    class Declaration
+      include Puppet::Util
+      include Comparable
+
+      # The type of declaration: either :allow or :deny
+      attr_reader :type
+
+      # The name: :ip or :domain
+      attr_accessor :name
+
+      # The pattern we're matching against.  Can be an IPAddr instance,
+      # or an array of strings, resulting from reversing a hostname
+      # or domain name.
+      attr_reader :pattern
+
+      # The length.  Only used for iprange and domain.
+      attr_accessor :length
+
+      # Sort the declarations most specific first.
+      def <=>(other)
+        compare(exact?, other.exact?) ||
+        compare(ip?, other.ip?)  ||
+        ((length != other.length) &&  (other.length <=> length)) ||
+        compare(deny?, other.deny?) ||
+        ( ip? ? pattern.to_s <=> other.pattern.to_s : pattern <=> other.pattern)
+      end
+
+      def deny?
+        type == :deny
+      end
+
+      def exact?
+        @exact == :exact
+      end
+
+      def initialize(type, pattern)
+        self.type = type
+        self.pattern = pattern
+      end
+
+      # Are we an IP type?
+      def ip?
+        name == :ip
+      end
+
+      # Does this declaration match the name/ip combo?
+      def match?(name, ip)
+        ip? ? pattern.include?(IPAddr.new(ip)) : matchname?(name)
+      end
+
+      # Set the pattern appropriately.  Also sets the name and length.
+      def pattern=(pattern)
+        parse(pattern)
+        @orig = pattern
+      end
+
+      # Mapping a type of statement into a return value.
+      def result
+        type == :allow
+      end
+
+      def to_s
+        "#{type}: #{pattern}"
+      end
+
+      # Set the declaration type.  Either :allow or :deny.
+      def type=(type)
+        type = symbolize(type)
+        raise ArgumentError, "Invalid declaration type #{type}" unless [:allow, :deny].include?(type)
+        @type = type
+      end
+
+      # interpolate a pattern to replace any
+      # backreferences by the given match
+      # for instance if our pattern is $1.reductivelabs.com
+      # and we're called with a MatchData whose capture 1 is puppet
+      # we'll return a pattern of puppet.reductivelabs.com
+      def interpolate(match)
+        clone = dup
+        clone.pattern = clone.pattern.reverse.collect do |p|
+          p.gsub(/\$(\d)/) { |m| match[$1.to_i] }
+        end.join(".")
+        clone
+      end
+
+      private
+
+      # Returns nil if both values are true or both are false, returns
+      # -1 if the first is true, and 1 if the second is true.  Used
+      # in the <=> operator.
+      def compare(me, them)
+        (me and them) ? nil : me ? -1 : them ? 1 : nil
+      end
+
+      # Does the name match our pattern?
+      def matchname?(name)
+        name = munge_name(name)
+        (pattern == name) or (not exact? and pattern.zip(name).all? { |p,n| p == n })
+      end
+
+      # Convert the name to a common pattern.
+      def munge_name(name)
+        # LAK:NOTE http://snurl.com/21zf8  [groups_google_com]
+        # Change to name.downcase.split(".",-1).reverse for FQDN support
+        name.downcase.split(".").reverse
+      end
+
+      # Parse our input pattern and figure out what kind of allowal
+      # statement it is.  The output of this is used for later matching.
+      Octet = '(\d|[1-9]\d|1\d\d|2[0-4]\d|25[0-5])'
+      IPv4 = "#{Octet}\.#{Octet}\.#{Octet}\.#{Octet}"
+      IPv6_full    = "_:_:_:_:_:_:_:_|_:_:_:_:_:_::_?|_:_:_:_:_::((_:)?_)?|_:_:_:_::((_:){0,2}_)?|_:_:_::((_:){0,3}_)?|_:_::((_:){0,4}_)?|_::((_:){0,5}_)?|::((_:){0,6}_)?"
+      IPv6_partial = "_:_:_:_:_:_:|_:_:_:_::(_:)?|_:_::(_:){0,2}|_::(_:){0,3}"
+      # It should be:
+      #     IP = "#{IPv4}|#{IPv6_full}|(#{IPv6_partial}#{IPv4})".gsub(/_/,'([0-9a-fA-F]{1,4})').gsub(/\(/,'(?:')
+      # but ruby's ipaddr lib doesn't support the hybrid format
+      IP = "#{IPv4}|#{IPv6_full}".gsub(/_/,'([0-9a-fA-F]{1,4})').gsub(/\(/,'(?:')
+      def parse(value)
+        @name,@exact,@length,@pattern = *case value
+        when /^(?:#{IP})\/(\d+)$/                                   # 12.34.56.78/24, a001:b002::efff/120, c444:1000:2000::9:192.168.0.1/112
+          [:ip,:inexact,$1.to_i,IPAddr.new(value)]
+        when /^(#{IP})$/                                          # 10.20.30.40,
+          [:ip,:exact,nil,IPAddr.new(value)]
+        when /^(#{Octet}\.){1,3}\*$/                              # an ip address with a '*' at the end
+          segments = value.split(".")[0..-2]
+          bits = 8*segments.length
+          [:ip,:inexact,bits,IPAddr.new((segments+[0,0,0])[0,4].join(".") + "/#{bits}")]
+        when /^(\w[-\w]*\.)+[-\w]+$/                              # a full hostname
+          # Change to /^(\w[-\w]*\.)+[-\w]+\.?$/ for FQDN support
+          [:domain,:exact,nil,munge_name(value)]
+        when /^\*(\.(\w[-\w]*)){1,}$/                             # *.domain.com
+          host_sans_star = munge_name(value)[0..-2]
+          [:domain,:inexact,host_sans_star.length,host_sans_star]
+        when /\$\d+/                                              # a backreference pattern ala $1.reductivelabs.com or 192.168.0.$1 or $1.$2
+          [:dynamic,:exact,nil,munge_name(value)]
+        when /^\w[-.@\w]*$/                                       # ? Just like a host name but allow '@'s and ending '.'s
+          [:opaque,:exact,nil,[value]]
+        else
+          raise AuthStoreError, "Invalid pattern #{value}"
         end
+      end
     end
+  end
 end