puppet 0.25.5 → 2.6.0

data/lib/puppet/network/http_pool.rb

@@ -6,99 +6,111 @@ module Puppet::Network; end
 
 # Manage Net::HTTP instances for keep-alive.
 module Puppet::Network::HttpPool
-    class << self
-        include Puppet::Util::Cacher
+  class << self
+    include Puppet::Util::Cacher
 
-        private
+    private
 
-        cached_attr(:http_cache) { Hash.new }
-    end
+    cached_attr(:http_cache) { Hash.new }
+  end
 
-    # Use the global localhost instance.
-    def self.ssl_host
-        Puppet::SSL::Host.localhost
-    end
+  # Use the global localhost instance.
+  def self.ssl_host
+    Puppet::SSL::Host.localhost
+  end
 
-    # 2008/03/23
-    # LAK:WARNING: Enabling this has a high propability of
-    # causing corrupt files and who knows what else.  See #1010.
-    HTTP_KEEP_ALIVE = false
+  # 2008/03/23
+  # LAK:WARNING: Enabling this has a high propability of
+  # causing corrupt files and who knows what else.  See #1010.
+  HTTP_KEEP_ALIVE = false
 
-    def self.keep_alive?
-        HTTP_KEEP_ALIVE
-    end
+  def self.keep_alive?
+    HTTP_KEEP_ALIVE
+  end
 
-    # Clear our http cache, closing all connections.
-    def self.clear_http_instances
-        http_cache.each do |name, connection|
-            connection.finish if connection.started?
-        end
-        Puppet::Util::Cacher.expire
+  # Clear our http cache, closing all connections.
+  def self.clear_http_instances
+    http_cache.each do |name, connection|
+      connection.finish if connection.started?
+    end
+    Puppet::Util::Cacher.expire
+  end
+
+  # Make sure we set the driver up when we read the cert in.
+  def self.read_cert
+    if val = super # This calls read_cert from the Puppet::SSLCertificates::Support module.
+      # Clear out all of our connections, since they previously had no cert and now they
+      # should have them.
+      clear_http_instances
+      return val
+    else
+      return false
+    end
+  end
+
+  # Use cert information from a Puppet client to set up the http object.
+  def self.cert_setup(http)
+    # Just no-op if we don't have certs.
+    return false unless FileTest.exist?(Puppet[:hostcert]) and FileTest.exist?(Puppet[:localcacert])
+
+    http.cert_store = ssl_host.ssl_store
+    http.ca_file = Puppet[:localcacert]
+    http.cert = ssl_host.certificate.content
+    http.verify_mode = OpenSSL::SSL::VERIFY_PEER
+    http.key = ssl_host.key.content
+    http.verify_callback = self.method(:ssl_verify_callback).to_proc if Puppet[:debug]
+  end
+
+  def self.ssl_verify_callback(peer_ok, x509_store_ctx)
+    if not peer_ok
+      Puppet.debug "OpenSSL: Error(#{x509_store_ctx.error}): #{x509_store_ctx.error_string}"
+      Puppet.debug "OpenSSL: Cert: #{x509_store_ctx.current_cert.issuer}"
+      Puppet.debug "OpenSSL: Current CRL: #{x509_store_ctx.current_crl}"
+      Puppet.debug "OpenSSL: Chain:"
+      x509_store_ctx.chain.each_index { |i| Puppet.debug "OpenSSL: \t#{i} #{x509_store_ctx.chain[i].issuer}" }
+    end
+    peer_ok
+  end
+
+  # Retrieve a cached http instance if caching is enabled, else return
+  # a new one.
+  def self.http_instance(host, port, reset = false)
+    # We overwrite the uninitialized @http here with a cached one.
+    key = "#{host}:#{port}"
+
+    # Return our cached instance if we've got a cache, as long as we're not
+    # resetting the instance.
+    if keep_alive?
+      return http_cache[key] if ! reset and http_cache[key]
+
+      # Clean up old connections if we have them.
+      if http = http_cache[key]
+        http_cache.delete(key)
+        http.finish if http.started?
+      end
     end
 
-    # Make sure we set the driver up when we read the cert in.
-    def self.read_cert
-        if val = super # This calls read_cert from the Puppet::SSLCertificates::Support module.
-            # Clear out all of our connections, since they previously had no cert and now they
-            # should have them.
-            clear_http_instances
-            return val
-        else
-            return false
-        end
+    args = [host, port]
+    if Puppet[:http_proxy_host] == "none"
+      args << nil << nil
+    else
+      args << Puppet[:http_proxy_host] << Puppet[:http_proxy_port]
     end
+    http = Net::HTTP.new(*args)
 
-    # Use cert information from a Puppet client to set up the http object.
-    def self.cert_setup(http)
-        # Just no-op if we don't have certs.
-        return false unless FileTest.exist?(Puppet[:hostcert]) and FileTest.exist?(Puppet[:localcacert])
+    # Pop open the http client a little; older versions of Net::HTTP(s) didn't
+    # give us a reader for ca_file... Grr...
+    class << http; attr_accessor :ca_file; end
 
-        http.cert_store = ssl_host.ssl_store
-        http.ca_file = Puppet[:localcacert]
-        http.cert = ssl_host.certificate.content
-        http.verify_mode = OpenSSL::SSL::VERIFY_PEER
-        http.key = ssl_host.key.content
-    end
+    http.use_ssl = true
+    # Use configured timeout (#1176)
+    http.read_timeout = Puppet[:configtimeout]
+    http.open_timeout = Puppet[:configtimeout]
 
-    # Retrieve a cached http instance if caching is enabled, else return
-    # a new one.
-    def self.http_instance(host, port, reset = false)
-        # We overwrite the uninitialized @http here with a cached one.
-        key = "%s:%s" % [host, port]
-
-        # Return our cached instance if we've got a cache, as long as we're not
-        # resetting the instance.
-        if keep_alive?
-            return http_cache[key] if ! reset and http_cache[key]
-
-            # Clean up old connections if we have them.
-            if http = http_cache[key]
-                http_cache.delete(key)
-                http.finish if http.started?
-            end
-        end
-
-        args = [host, port]
-        if Puppet[:http_proxy_host] == "none"
-            args << nil << nil
-        else
-            args << Puppet[:http_proxy_host] << Puppet[:http_proxy_port]
-        end
-        http = Net::HTTP.new(*args)
-
-        # Pop open the http client a little; older versions of Net::HTTP(s) didn't
-        # give us a reader for ca_file... Grr...
-        class << http; attr_accessor :ca_file; end
-
-        http.use_ssl = true
-        # Use configured timeout (#1176)
-        http.read_timeout = Puppet[:configtimeout]
-        http.open_timeout = Puppet[:configtimeout]
-
-        cert_setup(http)
-
-        http_cache[key] = http if keep_alive?
-
-        return http
-    end
+    cert_setup(http)
+
+    http_cache[key] = http if keep_alive?
+
+    http
+  end
 end

data/lib/puppet/network/http_server/mongrel.rb

@@ -49,102 +49,102 @@ require 'resolv'
 # handler.xmlrpc_server.add_handler("my.add") { |a, b| a.to_i + b.to_i }
 # </pre>
 module Puppet::Network
-    class HTTPServer::Mongrel < ::Mongrel::HttpHandler
-        attr_reader :xmlrpc_server
-
-        def initialize(handlers)
-            if Puppet[:debug]
-                $mongrel_debug_client = true
-                Puppet.debug 'Mongrel client debugging enabled. [$mongrel_debug_client = true].'
-            end
-            # Create a new instance of BasicServer. We are supposed to subclass it
-            # but that does not make sense since we would not introduce any new
-            # behaviour and we have to subclass Mongrel::HttpHandler so our handler
-            # works for Mongrel.
-            @xmlrpc_server = Puppet::Network::XMLRPCServer.new
-            handlers.each do |name|
-                unless handler = Puppet::Network::Handler.handler(name)
-                    raise ArgumentError, "Invalid handler %s" % name
-                end
-                @xmlrpc_server.add_handler(handler.interface, handler.new({}))
-            end
+  class HTTPServer::Mongrel < ::Mongrel::HttpHandler
+    attr_reader :xmlrpc_server
+
+    def initialize(handlers)
+      if Puppet[:debug]
+        $mongrel_debug_client = true
+        Puppet.debug 'Mongrel client debugging enabled. [$mongrel_debug_client = true].'
+      end
+      # Create a new instance of BasicServer. We are supposed to subclass it
+      # but that does not make sense since we would not introduce any new
+      # behaviour and we have to subclass Mongrel::HttpHandler so our handler
+      # works for Mongrel.
+      @xmlrpc_server = Puppet::Network::XMLRPCServer.new
+      handlers.each do |name|
+        unless handler = Puppet::Network::Handler.handler(name)
+          raise ArgumentError, "Invalid handler #{name}"
         end
+        @xmlrpc_server.add_handler(handler.interface, handler.new({}))
+      end
+    end
 
-        # This method produces the same results as XMLRPC::CGIServer.serve
-        # from Ruby's stdlib XMLRPC implementation.
-        def process(request, response)
-            # Make sure this has been a POST as required for XMLRPC.
-            request_method = request.params[Mongrel::Const::REQUEST_METHOD] || Mongrel::Const::GET
-            if request_method != "POST" then
-                response.start(405) { |head, out| out.write("Method Not Allowed") }
-                return
-            end
-
-            # Make sure the user has sent text/xml data.
-            request_mime = request.params["CONTENT_TYPE"] || "text/plain"
-            if parse_content_type(request_mime).first != "text/xml" then
-                response.start(400) { |head, out| out.write("Bad Request") }
-                return
-            end
-
-            # Make sure there is data in the body at all.
-            length = request.params[Mongrel::Const::CONTENT_LENGTH].to_i
-            if length <= 0 then
-                response.start(411) { |head, out| out.write("Length Required") }
-                return
-            end
-
-            # Check the body to be valid.
-            if request.body.nil? or request.body.size != length then
-                response.start(400) { |head, out| out.write("Bad Request") }
-                return
-            end
-
-            info = client_info(request)
-
-            # All checks above passed through
-            response.start(200) do |head, out|
-                head["Content-Type"] = "text/xml; charset=utf-8"
-                begin
-                    out.write(@xmlrpc_server.process(request.body, info))
-                rescue => detail
-                    puts detail.backtrace
-                    raise
-                end
-            end
+    # This method produces the same results as XMLRPC::CGIServer.serve
+    # from Ruby's stdlib XMLRPC implementation.
+    def process(request, response)
+      # Make sure this has been a POST as required for XMLRPC.
+      request_method = request.params[Mongrel::Const::REQUEST_METHOD] || Mongrel::Const::GET
+      if request_method != "POST"
+        response.start(405) { |head, out| out.write("Method Not Allowed") }
+        return
+      end
+
+      # Make sure the user has sent text/xml data.
+      request_mime = request.params["CONTENT_TYPE"] || "text/plain"
+      if parse_content_type(request_mime).first != "text/xml"
+        response.start(400) { |head, out| out.write("Bad Request") }
+        return
+      end
+
+      # Make sure there is data in the body at all.
+      length = request.params[Mongrel::Const::CONTENT_LENGTH].to_i
+      if length <= 0
+        response.start(411) { |head, out| out.write("Length Required") }
+        return
+      end
+
+      # Check the body to be valid.
+      if request.body.nil? or request.body.size != length
+        response.start(400) { |head, out| out.write("Bad Request") }
+        return
+      end
+
+      info = client_info(request)
+
+      # All checks above passed through
+      response.start(200) do |head, out|
+        head["Content-Type"] = "text/xml; charset=utf-8"
+        begin
+          out.write(@xmlrpc_server.process(request.body, info))
+        rescue => detail
+          puts detail.backtrace
+          raise
         end
+      end
+    end
 
-        private
-
-        def client_info(request)
-            params = request.params
-            ip = params["HTTP_X_FORWARDED_FOR"] ? params["HTTP_X_FORWARDED_FOR"].split(',').last.strip : params["REMOTE_ADDR"]
-            # JJM #906 The following dn.match regular expression is forgiving
-            # enough to match the two Distinguished Name string contents
-            # coming from Apache, Pound or other reverse SSL proxies.
-            if dn = params[Puppet[:ssl_client_header]] and dn_matchdata = dn.match(/^.*?CN\s*=\s*(.*)/)
-                client = dn_matchdata[1].to_str
-                valid = (params[Puppet[:ssl_client_verify_header]] == 'SUCCESS')
-            else
-                begin
-                    client = Resolv.getname(ip)
-                rescue => detail
-                    Puppet.err "Could not resolve %s: %s" % [ip, detail]
-                    client = "unknown"
-                end
-                valid = false
-            end
-
-            info = Puppet::Network::ClientRequest.new(client, ip, valid)
-
-            return info
+    private
+
+    def client_info(request)
+      params = request.params
+      ip = params["HTTP_X_FORWARDED_FOR"] ? params["HTTP_X_FORWARDED_FOR"].split(',').last.strip : params["REMOTE_ADDR"]
+      # JJM #906 The following dn.match regular expression is forgiving
+      # enough to match the two Distinguished Name string contents
+      # coming from Apache, Pound or other reverse SSL proxies.
+      if dn = params[Puppet[:ssl_client_header]] and dn_matchdata = dn.match(/^.*?CN\s*=\s*(.*)/)
+        client = dn_matchdata[1].to_str
+        valid = (params[Puppet[:ssl_client_verify_header]] == 'SUCCESS')
+      else
+        begin
+          client = Resolv.getname(ip)
+        rescue => detail
+          Puppet.err "Could not resolve #{ip}: #{detail}"
+          client = "unknown"
         end
+        valid = false
+      end
 
-        # Taken from XMLRPC::ParseContentType
-        def parse_content_type(str)
-            a, *b = str.split(";")
-            return a.strip, *b
-        end
+      info = Puppet::Network::ClientRequest.new(client, ip, valid)
+
+      info
+    end
+
+    # Taken from XMLRPC::ParseContentType
+    def parse_content_type(str)
+      a, *b = str.split(";")
+      return a.strip, *b
     end
+  end
 end
 

data/lib/puppet/network/http_server/webrick.rb

@@ -10,155 +10,146 @@ require 'puppet/network/client'
 require 'puppet/network/handler'
 
 module Puppet
-    class ServerError < RuntimeError; end
-    module Network
-        # The old-school, pure ruby webrick server, which is the default serving
-        # mechanism.
-        class HTTPServer::WEBrick < WEBrick::HTTPServer
-            include Puppet::SSLCertificates::Support
-
-            # Read the CA cert and CRL and populate an OpenSSL::X509::Store
-            # with them, with flags appropriate for checking client
-            # certificates for revocation
-            def x509store
-                unless File.exist?(Puppet[:cacrl])
-                    # No CRL, no store needed
-                    return nil
-                end
-                crl = OpenSSL::X509::CRL.new(File.read(Puppet[:cacrl]))
-                store = OpenSSL::X509::Store.new
-                store.purpose = OpenSSL::X509::PURPOSE_ANY
-                store.flags = OpenSSL::X509::V_FLAG_CRL_CHECK_ALL|OpenSSL::X509::V_FLAG_CRL_CHECK if Puppet.settings[:certificate_revocation]
-                unless self.ca_cert
-                    raise Puppet::Error, "Could not find CA certificate"
-                end
-
-                store.add_file(Puppet[:localcacert])
-                store.add_crl(crl)
-                return store
-            end
-
-            # Set up the http log.
-            def httplog
-                args = []
-
-                # yuck; separate http logs
-                file = nil
-                Puppet.settings.use(:main, :ssl, Puppet[:name])
-                if Puppet[:name] == "puppetmasterd"
-                    file = Puppet[:masterhttplog]
-                else
-                    file = Puppet[:httplog]
-                end
-
-                # open the log manually to prevent file descriptor leak
-                file_io = open(file, "a+")
-                file_io.sync
-                file_io.fcntl(Fcntl::F_SETFD, Fcntl::FD_CLOEXEC)
-
-                args << file_io
-                if Puppet[:debug]
-                    args << WEBrick::Log::DEBUG
-                end
-
-                log = WEBrick::Log.new(*args)
-
-
-                return log
-            end
-
-            # Create our server, yo.
-            def initialize(hash = {})
-                Puppet.info "Starting server for Puppet version %s" % Puppet.version
-
-                if handlers = hash[:Handlers]
-                    handler_instances = setup_handlers(handlers)
-                else
-                    raise ServerError, "A server must have handlers"
-                end
-
-                unless self.read_cert
-                    if ca = handler_instances.find { |handler| handler.is_a?(Puppet::Network::Handler.ca) }
-                        request_cert(ca)
-                    else
-                        raise Puppet::Error, "No certificate and no CA; cannot get cert"
-                    end
-                end
-
-                setup_webrick(hash)
-
-                begin
-                    super(hash)
-                rescue => detail
-                    puts detail.backtrace if Puppet[:trace]
-                    raise Puppet::Error, "Could not start WEBrick: %s" % detail
-                end
-
-                # make sure children don't inherit the sockets
-                listeners.each { |sock|
-                    sock.fcntl(Fcntl::F_SETFD, Fcntl::FD_CLOEXEC)
-                }
-
-                Puppet.info "Listening on port %s" % hash[:Port]
-
-                # this creates a new servlet for every connection,
-                # but all servlets have the same list of handlers
-                # thus, the servlets can have their own state -- passing
-                # around the requests and such -- but the handlers
-                # have a global state
-
-                # mount has to be called after the server is initialized
-                servlet = Puppet::Network::XMLRPC::WEBrickServlet.new(
-                    handler_instances)
-                self.mount("/RPC2", servlet)
-            end
-
-            # Create a ca client to set up our cert for us.
-            def request_cert(ca)
-                client = Puppet::Network::Client.ca.new(:CA => ca)
-                unless client.request_cert
-                    raise Puppet::Error, "Could get certificate"
-                end
-            end
-
-            # Create all of our handler instances.
-            def setup_handlers(handlers)
-                unless handlers.is_a?(Hash)
-                    raise ServerError, "Handlers must have arguments"
-                end
-
-                handlers.collect { |handler, args|
-                    hclass = nil
-                    unless hclass = Puppet::Network::Handler.handler(handler)
-                        raise ServerError, "Invalid handler %s" % handler
-                    end
-                    hclass.new(args)
-                }
-            end
-
-            # Handle all of the many webrick arguments.
-            def setup_webrick(hash)
-                hash[:Port] ||= Puppet[:masterport]
-                hash[:Logger] ||= self.httplog
-                hash[:AccessLog] ||= [
-                    [ self.httplog, WEBrick::AccessLog::COMMON_LOG_FORMAT ],
-                    [ self.httplog, WEBrick::AccessLog::REFERER_LOG_FORMAT ]
-                ]
-
-                hash[:SSLCertificateStore] = x509store
-                hash[:SSLCertificate] = self.cert
-                hash[:SSLPrivateKey] = self.key
-                hash[:SSLStartImmediately] = true
-                hash[:SSLEnable] = true
-                hash[:SSLCACertificateFile] = Puppet[:localcacert]
-                hash[:SSLVerifyClient] = OpenSSL::SSL::VERIFY_PEER
-                hash[:SSLCertName] = nil
-
-                if addr = Puppet[:bindaddress] and addr != ""
-                    hash[:BindAddress] = addr
-                end
-            end
+  class ServerError < RuntimeError; end
+  module Network
+    # The old-school, pure ruby webrick server, which is the default serving
+    # mechanism.
+    class HTTPServer::WEBrick < WEBrick::HTTPServer
+      include Puppet::SSLCertificates::Support
+
+      # Read the CA cert and CRL and populate an OpenSSL::X509::Store
+      # with them, with flags appropriate for checking client
+      # certificates for revocation
+      def x509store
+        unless File.exist?(Puppet[:cacrl])
+          # No CRL, no store needed
+          return nil
         end
+        crl = OpenSSL::X509::CRL.new(File.read(Puppet[:cacrl]))
+        store = OpenSSL::X509::Store.new
+        store.purpose = OpenSSL::X509::PURPOSE_ANY
+        store.flags = OpenSSL::X509::V_FLAG_CRL_CHECK_ALL|OpenSSL::X509::V_FLAG_CRL_CHECK if Puppet.settings[:certificate_revocation]
+        raise Puppet::Error, "Could not find CA certificate" unless self.ca_cert
+
+        store.add_file(Puppet[:localcacert])
+        store.add_crl(crl)
+        store
+      end
+
+      # Set up the http log.
+      def httplog
+        args = []
+
+        # yuck; separate http logs
+        file = nil
+        Puppet.settings.use(:main, :ssl, Puppet[:name])
+        if Puppet.run_mode.master?
+          file = Puppet[:masterhttplog]
+        else
+          file = Puppet[:httplog]
+        end
+
+        # open the log manually to prevent file descriptor leak
+        file_io = open(file, "a+")
+        file_io.sync
+        file_io.fcntl(Fcntl::F_SETFD, Fcntl::FD_CLOEXEC)
+
+        args << file_io
+        args << WEBrick::Log::DEBUG if Puppet[:debug]
+
+        log = WEBrick::Log.new(*args)
+
+
+        log
+      end
+
+      # Create our server, yo.
+      def initialize(hash = {})
+        Puppet.info "Starting server for Puppet version #{Puppet.version}"
+
+        if handlers = hash[:Handlers]
+          handler_instances = setup_handlers(handlers)
+        else
+          raise ServerError, "A server must have handlers"
+        end
+
+        unless self.read_cert
+          if ca = handler_instances.find { |handler| handler.is_a?(Puppet::Network::Handler.ca) }
+            request_cert(ca)
+          else
+            raise Puppet::Error, "No certificate and no CA; cannot get cert"
+          end
+        end
+
+        setup_webrick(hash)
+
+        begin
+          super(hash)
+        rescue => detail
+          puts detail.backtrace if Puppet[:trace]
+          raise Puppet::Error, "Could not start WEBrick: #{detail}"
+        end
+
+        # make sure children don't inherit the sockets
+        listeners.each { |sock|
+          sock.fcntl(Fcntl::F_SETFD, Fcntl::FD_CLOEXEC)
+        }
+
+        Puppet.info "Listening on port #{hash[:Port]}"
+
+        # this creates a new servlet for every connection,
+        # but all servlets have the same list of handlers
+        # thus, the servlets can have their own state -- passing
+        # around the requests and such -- but the handlers
+        # have a global state
+
+        # mount has to be called after the server is initialized
+        servlet = Puppet::Network::XMLRPC::WEBrickServlet.new( handler_instances)
+        self.mount("/RPC2", servlet)
+      end
+
+      # Create a ca client to set up our cert for us.
+      def request_cert(ca)
+        client = Puppet::Network::Client.ca.new(:CA => ca)
+        raise Puppet::Error, "Could get certificate" unless client.request_cert
+      end
+
+      # Create all of our handler instances.
+      def setup_handlers(handlers)
+        raise ServerError, "Handlers must have arguments" unless handlers.is_a?(Hash)
+
+        handlers.collect { |handler, args|
+          hclass = nil
+          unless hclass = Puppet::Network::Handler.handler(handler)
+            raise ServerError, "Invalid handler #{handler}"
+          end
+          hclass.new(args)
+        }
+      end
+
+      # Handle all of the many webrick arguments.
+      def setup_webrick(hash)
+        hash[:Port] ||= Puppet[:masterport]
+        hash[:Logger] ||= self.httplog
+        hash[:AccessLog] ||= [
+          [ self.httplog, WEBrick::AccessLog::COMMON_LOG_FORMAT ],
+          [ self.httplog, WEBrick::AccessLog::REFERER_LOG_FORMAT ]
+        ]
+
+        hash[:SSLCertificateStore] = x509store
+        hash[:SSLCertificate] = self.cert
+        hash[:SSLPrivateKey] = self.key
+        hash[:SSLStartImmediately] = true
+        hash[:SSLEnable] = true
+        hash[:SSLCACertificateFile] = Puppet[:localcacert]
+        hash[:SSLVerifyClient] = OpenSSL::SSL::VERIFY_PEER
+        hash[:SSLCertName] = nil
+
+        if addr = Puppet[:bindaddress] and addr != ""
+          hash[:BindAddress] = addr
+        end
+      end
     end
+  end
 end