puppet 0.25.5 → 2.6.0

data/lib/puppet/network/rest_authconfig.rb

@@ -1,89 +1,94 @@
 require 'puppet/network/authconfig'
 
 module Puppet
-    class Network::RestAuthConfig < Network::AuthConfig
+  class Network::RestAuthConfig < Network::AuthConfig
 
-        attr_accessor :rights
+    attr_accessor :rights
 
-        DEFAULT_ACL = [
-            { :acl => "~ ^\/catalog\/([^\/]+)$", :method => :find, :allow => '$1', :authenticated => true },
-            # this one will allow all file access, and thus delegate
-            # to fileserver.conf
-            { :acl => "/file" },
-            { :acl => "/certificate_revocation_list/ca", :method => :find, :authenticated => true },
-            { :acl => "/report", :method => :save, :authenticated => true },
-            { :acl => "/certificate/ca", :method => :find, :authenticated => false },
-            { :acl => "/certificate/", :method => :find, :authenticated => false },
-            { :acl => "/certificate_request", :method => [:find, :save], :authenticated => false },
-        ]
+    DEFAULT_ACL = [
+      { :acl => "~ ^\/catalog\/([^\/]+)$", :method => :find, :allow => '$1', :authenticated => true },
+      # this one will allow all file access, and thus delegate
+      # to fileserver.conf
+      { :acl => "/file" },
+      { :acl => "/certificate_revocation_list/ca", :method => :find, :authenticated => true },
+      { :acl => "/report", :method => :save, :authenticated => true },
+      { :acl => "/certificate/ca", :method => :find, :authenticated => false },
+      { :acl => "/certificate/", :method => :find, :authenticated => false },
+      { :acl => "/certificate_request", :method => [:find, :save], :authenticated => false },
+      { :acl => "/status", :method => [:find], :authenticated => true },
+      { :acl => "/resource", :method => [:find, :save, :search], :authenticated => true },
+    ]
 
-        def self.main
-            add_acl = @main.nil?
-            super
-            @main.insert_default_acl if add_acl and !@main.exists?
-            @main
-        end
+    def self.main
+      add_acl = @main.nil?
+      super
+      @main.insert_default_acl if add_acl and !@main.exists?
+      @main
+    end
 
-        # check wether this request is allowed in our ACL
-        # raise an Puppet::Network::AuthorizedError if the request
-        # is denied.
-        def allowed?(request)
-            read()
+    # check wether this request is allowed in our ACL
+    # raise an Puppet::Network::AuthorizedError if the request
+    # is denied.
+    def allowed?(request)
+      read
 
-            # we're splitting the request in part because
-            # fail_on_deny could as well be called in the XMLRPC context
-            # with a ClientRequest.
-            @rights.fail_on_deny(build_uri(request),
-                                    :node => request.node,
-                                    :ip => request.ip,
-                                    :method => request.method,
-                                    :environment => request.environment,
-                                    :authenticated => request.authenticated)
-        end
+      # we're splitting the request in part because
+      # fail_on_deny could as well be called in the XMLRPC context
+      # with a ClientRequest.
 
-        def initialize(file = nil, parsenow = true)
-            super(file || Puppet[:rest_authconfig], parsenow)
+            @rights.fail_on_deny(
+        build_uri(request),
+        
+                  :node => request.node,
+                  :ip => request.ip,
+                  :method => request.method,
+                  :environment => request.environment,
+                  :authenticated => request.authenticated)
+    end
 
-            # if we didn't read a file (ie it doesn't exist)
-            # make sure we can create some default rights
-            @rights ||= Puppet::Network::Rights.new
-        end
+    def initialize(file = nil, parsenow = true)
+      super(file || Puppet[:rest_authconfig], parsenow)
 
-        def parse()
-            super()
-            insert_default_acl
-        end
+      # if we didn't read a file (ie it doesn't exist)
+      # make sure we can create some default rights
+      @rights ||= Puppet::Network::Rights.new
+    end
 
-        # force regular ACLs to be present
-        def insert_default_acl
-            DEFAULT_ACL.each do |acl|
-                unless rights[acl[:acl]]
-                    Puppet.info "Inserting default '#{acl[:acl]}'(%s) acl because %s" % [acl[:authenticated] ? "auth" : "non-auth" , ( !exists? ? "#{Puppet[:rest_authconfig]} doesn't exist" : "none where found in '#{@file}'")]
-                    mk_acl(acl)
-                end
-            end
-            # queue an empty (ie deny all) right for every other path
-            # actually this is not strictly necessary as the rights system
-            # denies not explicitely allowed paths
-            unless rights["/"]
-                rights.newright("/")
-                rights.restrict_authenticated("/", :any)
-            end
+    def parse
+      super()
+      insert_default_acl
+    end
+
+    # force regular ACLs to be present
+    def insert_default_acl
+      DEFAULT_ACL.each do |acl|
+        unless rights[acl[:acl]]
+          Puppet.info "Inserting default '#{acl[:acl]}'(#{acl[:authenticated] ? "auth" : "non-auth"}) acl because #{( !exists? ? "#{Puppet[:rest_authconfig]} doesn't exist" : "none where found in '#{@file}'")}"
+          mk_acl(acl)
         end
+      end
+      # queue an empty (ie deny all) right for every other path
+      # actually this is not strictly necessary as the rights system
+      # denies not explicitely allowed paths
+      unless rights["/"]
+        rights.newright("/")
+        rights.restrict_authenticated("/", :any)
+      end
+    end
 
-        def mk_acl(acl)
-            @rights.newright(acl[:acl])
-            @rights.allow(acl[:acl], acl[:allow] || "*")
+    def mk_acl(acl)
+      @rights.newright(acl[:acl])
+      @rights.allow(acl[:acl], acl[:allow] || "*")
 
-            if method = acl[:method]
-                method = [method] unless method.is_a?(Array)
-                method.each { |m| @rights.restrict_method(acl[:acl], m) }
-            end
-            @rights.restrict_authenticated(acl[:acl], acl[:authenticated]) unless acl[:authenticated].nil?
-        end
+      if method = acl[:method]
+        method = [method] unless method.is_a?(Array)
+        method.each { |m| @rights.restrict_method(acl[:acl], m) }
+      end
+      @rights.restrict_authenticated(acl[:acl], acl[:authenticated]) unless acl[:authenticated].nil?
+    end
 
-        def build_uri(request)
-            "/#{request.indirection_name}/#{request.key}"
-        end
+    def build_uri(request)
+      "/#{request.indirection_name}/#{request.key}"
     end
+  end
 end

data/lib/puppet/network/rest_authorization.rb

@@ -3,23 +3,21 @@ require 'puppet/network/rest_authconfig'
 
 module Puppet::Network
 
-    module RestAuthorization
+  module RestAuthorization
 
 
-        # Create our config object if necessary. If there's no configuration file
-        # we install our defaults
-        def authconfig
-            unless defined? @authconfig
-                @authconfig = Puppet::Network::RestAuthConfig.main
-            end
+    # Create our config object if necessary. If there's no configuration file
+    # we install our defaults
+    def authconfig
+      @authconfig ||= Puppet::Network::RestAuthConfig.main
 
-            @authconfig
-        end
+      @authconfig
+    end
 
-        # Verify that our client has access.
-        def check_authorization(request)
-            authconfig.allowed?(request)
-        end
+    # Verify that our client has access.
+    def check_authorization(request)
+      authconfig.allowed?(request)
     end
+  end
 end
 

data/lib/puppet/network/rights.rb

@@ -12,265 +12,256 @@ class AuthorizationError < Puppet::Error; end
 #  * path based rights (which are matched on a longest prefix basis)
 class Rights
 
-    # We basically just proxy directly to our rights.  Each Right stores
-    # its own auth abilities.
-    [:allow, :deny, :restrict_method, :restrict_environment, :restrict_authenticated].each do |method|
-        define_method(method) do |name, *args|
-            if obj = self[name]
-                obj.send(method, *args)
-            else
-                raise ArgumentError, "Unknown right '%s'" % name
-            end
-        end
+  # We basically just proxy directly to our rights.  Each Right stores
+  # its own auth abilities.
+  [:allow, :deny, :restrict_method, :restrict_environment, :restrict_authenticated].each do |method|
+    define_method(method) do |name, *args|
+      if obj = self[name]
+        obj.send(method, *args)
+      else
+        raise ArgumentError, "Unknown right '#{name}'"
+      end
     end
-
-    # Check that name is allowed or not
-    def allowed?(name, *args)
-        begin
-            fail_on_deny(name, :node => args[0], :ip => args[1])
-        rescue AuthorizationError
-            return false
-        rescue ArgumentError
-            # the namespace contract says we should raise this error
-            # if we didn't find the right acl
-            raise
-        end
-        return true
+  end
+
+  # Check that name is allowed or not
+  def allowed?(name, *args)
+    begin
+      fail_on_deny(name, :node => args[0], :ip => args[1])
+    rescue AuthorizationError
+      return false
+    rescue ArgumentError
+      # the namespace contract says we should raise this error
+      # if we didn't find the right acl
+      raise
     end
-
-    def fail_on_deny(name, args = {})
-        res = :nomatch
-        right = @rights.find do |acl|
-            found = false
-            # an acl can return :dunno, which means "I'm not qualified to answer your question,
-            # please ask someone else". This is used when for instance an acl matches, but not for the
-            # current rest method, where we might think some other acl might be more specific.
-            if match = acl.match?(name)
-                args[:match] = match
-                if (res = acl.allowed?(args[:node], args[:ip], args)) != :dunno
-                    # return early if we're allowed
-                    return if res
-                    # we matched, select this acl
-                    found = true
-                end
-            end
-            found
-        end
-
-        # if we end here, then that means we either didn't match
-        # or failed, in any case will throw an error to the outside world
-        if name =~ /^\// or right
-            # we're a patch ACL, let's fail
-            msg = "%s access to %s [%s]" % [ (args[:node].nil? ? args[:ip] : "#{args[:node]}(#{args[:ip]})"), name, args[:method] ]
-
-            msg += " authenticated " if args[:authenticated]
-
-            error = AuthorizationError.new("Forbidden request: " + msg)
-            if right
-                error.file = right.file
-                error.line = right.line
-            end
-            Puppet.warning("Denying access: " + error.to_s)
-        else
-            # there were no rights allowing/denying name
-            # if name is not a path, let's throw
-            error = ArgumentError.new "Unknown namespace right '%s'" % name
+    true
+  end
+
+  def fail_on_deny(name, args = {})
+    res = :nomatch
+    right = @rights.find do |acl|
+      found = false
+      # an acl can return :dunno, which means "I'm not qualified to answer your question,
+      # please ask someone else". This is used when for instance an acl matches, but not for the
+      # current rest method, where we might think some other acl might be more specific.
+      if match = acl.match?(name)
+        args[:match] = match
+        if (res = acl.allowed?(args[:node], args[:ip], args)) != :dunno
+          # return early if we're allowed
+          return if res
+          # we matched, select this acl
+          found = true
         end
-        raise error
+      end
+      found
     end
 
-    def initialize()
-        @rights = []
+    # if we end here, then that means we either didn't match
+    # or failed, in any case will throw an error to the outside world
+    if name =~ /^\// or right
+      # we're a patch ACL, let's fail
+      msg = "#{(args[:node].nil? ? args[:ip] : "#{args[:node]}(#{args[:ip]})")} access to #{name} [#{args[:method]}]"
+
+      msg += " authenticated " if args[:authenticated]
+
+      error = AuthorizationError.new("Forbidden request: #{msg}")
+      if right
+        error.file = right.file
+        error.line = right.line
+      end
+      Puppet.warning("Denying access: #{error}")
+    else
+      # there were no rights allowing/denying name
+      # if name is not a path, let's throw
+      error = ArgumentError.new "Unknown namespace right '#{name}'"
     end
+    raise error
+  end
 
-    def [](name)
-        @rights.find { |acl| acl == name }
-    end
+  def initialize
+    @rights = []
+  end
 
-    def include?(name)
-        @rights.include?(name)
-    end
+  def [](name)
+    @rights.find { |acl| acl == name }
+  end
 
-    def each
-        @rights.each { |r| yield r.name,r }
-    end
+  def include?(name)
+    @rights.include?(name)
+  end
 
-    # Define a new right to which access can be provided.
-    def newright(name, line=nil, file=nil)
-        add_right( Right.new(name, line, file) )
-    end
+  def each
+    @rights.each { |r| yield r.name,r }
+  end
 
-    private
+  # Define a new right to which access can be provided.
+  def newright(name, line=nil, file=nil)
+    add_right( Right.new(name, line, file) )
+  end
 
-    def add_right(right)
-        if right.acl_type == :name and include?(right.key)
-            raise ArgumentError, "Right '%s' already exists"
-        end
-        @rights << right
-        sort_rights
-        right
-    end
+  private
 
-    def sort_rights
-        @rights.sort!
+  def add_right(right)
+    if right.acl_type == :name and include?(right.key)
+      raise ArgumentError, "Right '%s' already exists"
     end
-
-    # Retrieve a right by name.
-    def right(name)
-        self[name]
+    @rights << right
+    sort_rights
+    right
+  end
+
+  def sort_rights
+    @rights.sort!
+  end
+
+  # Retrieve a right by name.
+  def right(name)
+    self[name]
+  end
+
+  # A right.
+  class Right < Puppet::Network::AuthStore
+    include Puppet::FileCollection::Lookup
+
+    attr_accessor :name, :key, :acl_type
+    attr_accessor :methods, :environment, :authentication
+
+    ALL = [:save, :destroy, :find, :search]
+
+    Puppet::Util.logmethods(self, true)
+
+    def initialize(name, line, file)
+      @methods = []
+      @environment = []
+      @authentication = true # defaults to authenticated
+      @name = name
+      @line = line || 0
+      @file = file
+
+      case name
+      when Symbol
+        @acl_type = :name
+        @key = name
+      when /^\[(.+)\]$/
+        @acl_type = :name
+        @key = $1.intern if name.is_a?(String)
+      when /^\//
+        @acl_type = :regex
+        @key = Regexp.new("^" + Regexp.escape(name))
+        @methods = ALL
+      when /^~/ # this is a regex
+        @acl_type = :regex
+        @name = name.gsub(/^~\s+/,'')
+        @key = Regexp.new(@name)
+        @methods = ALL
+      else
+        raise ArgumentError, "Unknown right type '#{name}'"
+      end
+      super()
     end
 
-    # A right.
-    class Right < Puppet::Network::AuthStore
-        include Puppet::FileCollection::Lookup
-
-        attr_accessor :name, :key, :acl_type
-        attr_accessor :methods, :environment, :authentication
-
-        ALL = [:save, :destroy, :find, :search]
-
-        Puppet::Util.logmethods(self, true)
-
-        def initialize(name, line, file)
-            @methods = []
-            @environment = []
-            @authentication = true # defaults to authenticated
-            @name = name
-            @line = line || 0
-            @file = file
-
-            case name
-            when Symbol
-                @acl_type = :name
-                @key = name
-            when /^\[(.+)\]$/
-                @acl_type = :name
-                @key = $1.intern if name.is_a?(String)
-            when /^\//
-                @acl_type = :regex
-                @key = Regexp.new("^" + Regexp.escape(name))
-                @methods = ALL
-            when /^~/ # this is a regex
-                @acl_type = :regex
-                @name = name.gsub(/^~\s+/,'')
-                @key = Regexp.new(@name)
-                @methods = ALL
-            else
-                raise ArgumentError, "Unknown right type '%s'" % name
-            end
-            super()
-        end
-
-        def to_s
-            "access[%s]" % @name
-        end
-
-        # There's no real check to do at this point
-        def valid?
-            true
-        end
+    def to_s
+      "access[#{@name}]"
+    end
 
-        def regex?
-            acl_type == :regex
-        end
+    # There's no real check to do at this point
+    def valid?
+      true
+    end
 
-        # does this right is allowed for this triplet?
-        # if this right is too restrictive (ie we don't match this access method)
-        # then return :dunno so that upper layers have a chance to try another right
-        # tailored to the given method
-        def allowed?(name, ip, args = {})
-            return :dunno if acl_type == :regex and not @methods.include?(args[:method])
-            return :dunno if acl_type == :regex and @environment.size > 0 and not @environment.include?(args[:environment])
-            return :dunno if acl_type == :regex and not @authentication.nil? and args[:authenticated] != @authentication
-
-            begin
-                # make sure any capture are replaced if needed
-                interpolate(args[:match]) if acl_type == :regex and args[:match]
-                res = super(name,ip)
-            ensure
-                reset_interpolation if acl_type == :regex
-            end
-            res
-        end
+    def regex?
+      acl_type == :regex
+    end
 
-        # restrict this right to some method only
-        def restrict_method(m)
-            m = m.intern if m.is_a?(String)
+    # does this right is allowed for this triplet?
+    # if this right is too restrictive (ie we don't match this access method)
+    # then return :dunno so that upper layers have a chance to try another right
+    # tailored to the given method
+    def allowed?(name, ip, args = {})
+      return :dunno if acl_type == :regex and not @methods.include?(args[:method])
+      return :dunno if acl_type == :regex and @environment.size > 0 and not @environment.include?(args[:environment])
+      return :dunno if acl_type == :regex and not @authentication.nil? and args[:authenticated] != @authentication
+
+      begin
+        # make sure any capture are replaced if needed
+        interpolate(args[:match]) if acl_type == :regex and args[:match]
+        res = super(name,ip)
+      ensure
+        reset_interpolation if acl_type == :regex
+      end
+      res
+    end
 
-            unless ALL.include?(m)
-                raise ArgumentError, "'%s' is not an allowed value for method directive" % m
-            end
+    # restrict this right to some method only
+    def restrict_method(m)
+      m = m.intern if m.is_a?(String)
 
-            # if we were allowing all methods, then starts from scratch
-            if @methods === ALL
-                @methods = []
-            end
+      raise ArgumentError, "'#{m}' is not an allowed value for method directive" unless ALL.include?(m)
 
-            if @methods.include?(m)
-                raise ArgumentError, "'%s' is already in the '%s' ACL" % [m, name]
-            end
+      # if we were allowing all methods, then starts from scratch
+      if @methods === ALL
+        @methods = []
+      end
 
-            @methods << m
-        end
+      raise ArgumentError, "'#{m}' is already in the '#{name}' ACL" if @methods.include?(m)
 
-        def restrict_environment(env)
-            env = Puppet::Node::Environment.new(env)
-            if @environment.include?(env)
-                raise ArgumentError, "'%s' is already in the '%s' ACL" % [env, name]
-            end
+      @methods << m
+    end
 
-            @environment << env
-        end
+    def restrict_environment(env)
+      env = Puppet::Node::Environment.new(env)
+      raise ArgumentError, "'#{env}' is already in the '#{name}' ACL" if @environment.include?(env)
 
-        def restrict_authenticated(authentication)
-            case authentication
-            when "yes", "on", "true", true
-                authentication = true
-            when "no", "off", "false", false
-                authentication = false
-            when "all","any", :all, :any
-                authentication = nil
-            else
-                raise ArgumentError, "'%s' incorrect authenticated value: %s" % [name, authentication]
-            end
-            @authentication = authentication
-        end
+      @environment << env
+    end
 
-        def match?(key)
-            # if we are a namespace compare directly
-            return self.key == namespace_to_key(key) if acl_type == :name
+    def restrict_authenticated(authentication)
+      case authentication
+      when "yes", "on", "true", true
+        authentication = true
+      when "no", "off", "false", false
+        authentication = false
+      when "all","any", :all, :any
+        authentication = nil
+      else
+        raise ArgumentError, "'#{name}' incorrect authenticated value: #{authentication}"
+      end
+      @authentication = authentication
+    end
 
-            # otherwise match with the regex
-            return self.key.match(key)
-        end
+    def match?(key)
+      # if we are a namespace compare directly
+      return self.key == namespace_to_key(key) if acl_type == :name
 
-        def namespace_to_key(key)
-            key = key.intern if key.is_a?(String)
-            key
-        end
+      # otherwise match with the regex
+      self.key.match(key)
+    end
 
-        # this is where all the magic happens.
-        # we're sorting the rights array with this scheme:
-        #  * namespace rights are all in front
-        #  * regex path rights are then all queued in file order
-        def <=>(rhs)
-            # move namespace rights at front
-            if self.acl_type != rhs.acl_type
-                return self.acl_type == :name ? -1 : 1
-            end
-
-            # sort by creation order (ie first match appearing in the file will win)
-            # that is don't sort, in which case the sort algorithm will order in the
-            # natural array order (ie the creation order)
-            return 0
-        end
+    def namespace_to_key(key)
+      key = key.intern if key.is_a?(String)
+      key
+    end
 
-        def ==(name)
-            return self.key == namespace_to_key(name) if acl_type == :name
-            return self.name == name.gsub(/^~\s+/,'')
-        end
+    # this is where all the magic happens.
+    # we're sorting the rights array with this scheme:
+    #  * namespace rights are all in front
+    #  * regex path rights are then all queued in file order
+    def <=>(rhs)
+      # move namespace rights at front
+      return self.acl_type == :name ? -1 : 1 if self.acl_type != rhs.acl_type
+
+      # sort by creation order (ie first match appearing in the file will win)
+      # that is don't sort, in which case the sort algorithm will order in the
+      # natural array order (ie the creation order)
+      0
+    end
 
+    def ==(name)
+      return(acl_type == :name ? self.key == namespace_to_key(name) : self.name == name.gsub(/^~\s+/,''))
     end
 
+  end
+
 end
 end