puppet 0.9.2

data/lib/puppet/server.rb

@@ -0,0 +1,170 @@
+# the server
+#
+# allow things to connect to us and communicate, and stuff
+
+require 'puppet'
+require 'puppet/daemon'
+
+$noservernetworking = false
+
+begin
+    require 'webrick'
+    require 'webrick/https'
+    require 'cgi'
+    require 'xmlrpc/server'
+    require 'xmlrpc/client'
+rescue LoadError => detail
+    $noservernetworking = detail
+end
+
+module Puppet
+    class ServerError < RuntimeError; end
+    #---------------------------------------------------------------
+    if $noservernetworking
+        Puppet.err "Could not create server: %s" % $noservernetworking
+        class Server; end
+    else
+        class Server < WEBrick::HTTPServer
+            include Puppet::Daemon
+
+            def initialize(hash = {})
+                daemonize = nil
+                if hash.include?(:Daemonize)
+                    daemonize = hash[:Daemonize]
+                end
+
+                if daemonize
+                    self.daemonize
+                end
+                # FIXME we should have some kind of access control here, using
+                # :RequestHandler
+                hash[:Port] ||= Puppet[:masterport]
+                hash[:Logger] ||= self.httplog
+                hash[:AccessLog] ||= [
+                    [ self.httplog, WEBrick::AccessLog::COMMON_LOG_FORMAT ],
+                    [ self.httplog, WEBrick::AccessLog::REFERER_LOG_FORMAT ]
+                ]
+
+                if hash.include?(:Handlers)
+                    unless hash[:Handlers].is_a?(Hash)
+                        raise ServerError, "Handlers must have arguments"
+                    end
+
+                    @handlers = hash[:Handlers].collect { |handler, args|
+                        hclass = nil
+                        unless hclass = Handler.handler(handler)
+                            raise ServerError, "Invalid handler %s" % handler
+                        end
+                        hclass.new(args)
+                    }
+                else
+                    raise ServerError, "A server must have handlers"
+                end
+
+                # okay, i need to retrieve my cert and set it up, somehow
+                # the default case will be that i'm also the ca
+                if ca = @handlers.find { |handler| handler.is_a?(Puppet::Server::CA) }
+                    @driver = ca
+                    @secureinit = true
+                    self.fqdn
+                end
+
+                unless self.readcert
+                    unless self.requestcert
+                        raise Puppet::Error, "Cannot start without certificates"
+                    end
+                end
+
+                hash[:SSLCertificate] = @cert
+                hash[:SSLPrivateKey] = @key
+                hash[:SSLStartImmediately] = true
+                hash[:SSLEnable] = true
+                hash[:SSLCACertificateFile] = @cacertfile
+                hash[:SSLVerifyClient] = OpenSSL::SSL::VERIFY_PEER
+                hash[:SSLCertName] = nil
+
+                super(hash)
+
+                Puppet.info "Listening on port %s" % hash[:Port]
+
+                # this creates a new servlet for every connection,
+                # but all servlets have the same list of handlers
+                # thus, the servlets can have their own state -- passing
+                # around the requests and such -- but the handlers
+                # have a global state
+
+                # mount has to be called after the server is initialized
+                self.mount("/RPC2", Puppet::Server::Servlet, @handlers)
+            end
+        end
+    end
+
+    class Server
+        # the base class for the different handlers
+        class Handler
+            attr_accessor :server
+            @subclasses = []
+
+            def self.each
+                @subclasses.each { |c| yield c }
+            end
+
+            def self.handler(name)
+                @subclasses.find { |h|
+                    h.name == name
+                }
+            end
+
+            def self.inherited(sub)
+                @subclasses << sub
+            end
+
+            def self.interface
+                if defined? @interface
+                    return @interface
+                else
+                    raise Puppet::DevError, "Handler %s has no defined interface" %
+                        self
+                end
+            end
+
+            def self.name
+                unless defined? @name
+                    @name = self.to_s.sub(/.+::/, '').intern
+                end
+
+                return @name
+            end
+
+            def initialize(hash = {})
+            end
+        end
+
+        class ServerStatus < Handler
+
+            @interface = XMLRPC::Service::Interface.new("status") { |iface|
+                iface.add_method("int status()")
+            }
+
+            @name = :Status
+
+            def status(status = nil, client = nil, clientip = nil)
+                return 1
+            end
+        end
+
+    end
+
+    #---------------------------------------------------------------
+end
+
+require 'puppet/server/authstore'
+require 'puppet/server/servlet'
+require 'puppet/server/master'
+require 'puppet/server/ca'
+require 'puppet/server/fileserver'
+require 'puppet/server/filebucket'
+require 'puppet/server/logger'
+require 'puppet/client'
+
+# $Id: server.rb 732 2005-10-28 05:39:59Z luke $

data/lib/puppet/server/authstore.rb

@@ -0,0 +1,227 @@
+#!/usr/bin/ruby -w
+
+#--------------------
+# standard module for determining whether a given hostname or IP has access to
+# the requested resource
+#
+# $Id: authstore.rb 742 2005-11-16 17:12:11Z luke $
+
+require 'ipaddr'
+
+module Puppet
+class Server
+    class AuthStoreError < Puppet::Error; end
+    class AuthorizationError < Puppet::Error; end
+
+    class AuthStore
+        ORDER = {
+            :ip => [:ip],
+            :name => [:hostname, :domain]
+        }
+
+        Puppet::Util.logmethods(self, false)
+
+        def allow(pattern)
+            # a simple way to allow anyone at all to connect
+            if pattern == "*"
+                @globalallow = true
+            else
+                store(pattern, @allow)
+            end
+        end
+
+        def allowed?(name, ip)
+            if name or ip
+                unless name and ip
+                    raise Puppet::DevError, "Name and IP must be passed to 'allowed?'"
+                end
+                # else, we're networked and such
+            else
+                # we're local
+                return true
+            end
+
+            # yay insecure overrides
+            if @globalallow
+                return true
+            end
+
+            value = nil
+            ORDER.each { |nametype, array|
+                if nametype == :ip
+                    value = IPAddr.new(ip)
+                else
+                    value = name.split(".").reverse
+                end
+
+                array.each { |type|
+                    [[@deny, false], [@allow, true]].each { |ary|
+                        hash, retval = ary
+                        if hash.include?(type)
+                            hash[type].each { |pattern|
+                                if match?(nametype, value, pattern)
+                                    return retval
+                                end
+                            }
+                        end
+                    }
+                }
+            }
+
+            self.info "Defaulting to false for %s" % name
+            # default to false
+            return false
+        end
+
+        def deny(pattern)
+            store(pattern, @deny)
+        end
+
+        def initialize
+            @globalallow = nil
+            @allow = Hash.new { |hash, key|
+                hash[key] = []
+            }
+            @deny = Hash.new { |hash, key|
+                hash[key] = []
+            }
+        end
+
+        private
+
+        def match?(nametype, value, pattern)
+            if value == pattern # simplest shortcut
+                return true
+            end
+
+            case nametype
+            when :ip: matchip?(value, pattern)
+            when :name: matchname?(value, pattern)
+            else
+                raise Puppet::DevError, "Invalid match type %s" % nametype
+            end
+        end
+
+        def matchip?(value, pattern)
+            # we're just using builtin stuff for this, thankfully
+            if pattern.include?(value)
+                return true
+            else
+                return false
+            end
+        end
+
+        def matchname?(value, pattern)
+            # yay, horribly inefficient
+            if pattern[-1] != '*' # the pattern has no metachars and is not equal
+                                    # thus, no match
+                #Puppet.info "%s is not equal with no * in %s" % [value, pattern]
+                return false
+            else
+                # we know the last field of the pattern is '*'
+                # if everything up to that doesn't match, we're definitely false
+                if pattern[0..-2] != value[0..pattern.length-2]
+                    #Puppet.notice "subpatterns didn't match; %s vs %s" %
+                    #    [pattern[0..-2], value[0..pattern.length-2]]
+                    return false
+                end
+
+                case value.length <=> pattern.length
+                when -1: # value is shorter than pattern
+                    if pattern.length - value.length == 1
+                        # only ever allowed when the value is the domain of a
+                        # splatted pattern
+                        #Puppet.info "allowing splatted domain %s" % [value]
+                        return true
+                    else
+                        return false
+                    end
+                when 0: # value is the same length as pattern
+                    if pattern[-1] == "*"
+                        #Puppet.notice "same length with *"
+                        return true
+                    else
+                        return false
+                    end
+                when 1: # value is longer than pattern
+                    # at this point we've already verified that everything up to
+                    # the '*' in the pattern matches, so we are true
+                    return true
+                end
+            end
+        end
+
+        def store(pattern, hash)
+            type, value = type(pattern)
+
+            if type and value
+                # this won't work once we get beyond simple stuff...
+                hash[type] << value
+            else
+                raise AuthStoreError, "Invalid pattern %s" % pattern
+            end
+        end
+
+        def type(pattern)
+            type = value = nil
+            case pattern
+            when /^(\d+\.){3}\d+$/:
+                type = :ip
+                begin
+                    value = IPAddr.new(pattern)
+                rescue ArgumentError => detail
+                    raise AuthStoreError, "Invalid IP address pattern %s" % pattern
+                end
+            when /^(\d+\.){3}\d+\/(\d+)$/:
+                mask = Integer($2)
+                if mask < 1 or mask > 32
+                    raise AuthStoreError, "Invalid IP mask %s" % mask
+                end
+                type = :ip
+                begin
+                    value = IPAddr.new(pattern)
+                rescue ArgumentError => detail
+                    raise AuthStoreError, "Invalid IP address pattern %s" % pattern
+                end
+            when /^(\d+\.){1,3}\*$/: # an ip address with a '*' at the end
+                type = :ip
+                match = $1
+                match.sub!(".", '')
+                ary = pattern.split(".")
+
+                mask = case ary.index(match)
+                when 0: 8
+                when 1: 16
+                when 2: 24
+                else
+                    raise AuthStoreError, "Invalid IP pattern %s" % pattern
+                end
+
+                ary.pop
+                while ary.length < 4
+                    ary.push("0")
+                end
+
+                begin
+                    value = IPAddr.new(ary.join(".") + "/" + mask.to_s)
+                rescue ArgumentError => detail
+                    raise AuthStoreError, "Invalid IP address pattern %s" % pattern
+                end
+            when /^[\d.]+$/: # necessary so incomplete IP addresses can't look
+                             # like hostnames
+                raise AuthStoreError, "Invalid IP address pattern %s" % pattern
+            when /^([a-zA-Z][-\w]*\.)+[-\w]+$/: # a full hostname
+                type = :hostname
+                value = pattern.split(".").reverse
+            when /^\*\.([a-zA-Z][-\w]*\.)+[-\w]+$/: # this doesn't match TLDs
+                type = :domain
+                value = pattern.split(".").reverse
+            else
+                raise AuthStoreError, "Invalid pattern %s" % pattern
+            end
+
+            return [type, value]
+        end
+    end
+end
+end

data/lib/puppet/server/ca.rb

@@ -0,0 +1,140 @@
+require 'openssl'
+require 'puppet'
+require 'puppet/sslcertificates'
+require 'xmlrpc/server'
+
+# Much of this was taken from QuickCert:
+#   http://segment7.net/projects/ruby/QuickCert/
+
+module Puppet
+class Server
+    class CAError < Puppet::Error; end
+    class CA < Handler
+        attr_reader :ca
+
+        @interface = XMLRPC::Service::Interface.new("puppetca") { |iface|
+            iface.add_method("array getcert(csr)")
+        }
+
+        # FIXME autosign? should probably accept both hostnames and IP addresses
+        def autosign?(hostname)
+            # simple values are easy
+            if @autosign == true or @autosign == false
+                return @autosign
+            end
+
+            # we only otherwise know how to handle files
+            unless @autosign =~ /^\//
+                raise Puppet::Error, "Invalid autosign value %s" %
+                    @autosign
+            end
+
+            unless FileTest.exists?(@autosign)
+                Puppet.info "Autosign is enabled but %s is missing" % @autosign
+                return false
+            end
+            auth = Puppet::Server::AuthStore.new
+            File.open(@autosign) { |f|
+                f.each { |line|
+                    auth.allow(line.chomp)
+                }
+            }
+
+            # for now, just cheat and pass a fake IP address to allowed?
+            return auth.allowed?(hostname, "127.1.1.1")
+        end
+
+        def initialize(hash = {})
+            @autosign = hash[:autosign] || Puppet[:autosign]
+            @ca = Puppet::SSLCertificates::CA.new()
+        end
+
+        # our client sends us a csr, and we either store it for later signing,
+        # or we sign it right away
+        def getcert(csrtext, client = nil, clientip = nil)
+            csr = OpenSSL::X509::Request.new(csrtext)
+
+            # Use the hostname from the CSR, not from the network.
+            subject = csr.subject
+
+            nameary = subject.to_a.find { |ary|
+                ary[0] == "CN"
+            }
+
+            if nameary.nil?
+                Puppet.err(
+                    "Invalid certificate request: could not retrieve server name"
+                )
+                return "invalid"
+            end
+
+            hostname = nameary[1]
+
+            unless @ca
+                Puppet.notice "Host %s asked for signing from non-CA master" % hostname
+                return ""
+            end
+
+            # okay, we're now going to store the public key if we don't already
+            # have it
+            public_key = csr.public_key
+            unless FileTest.directory?(Puppet[:publickeydir])
+                Puppet.recmkdir(Puppet[:publickeydir])
+            end
+            pkeyfile = File.join(Puppet[:publickeydir], [hostname, "pem"].join('.'))
+
+            if FileTest.exists?(pkeyfile)
+                currentkey = File.open(pkeyfile) { |k| k.read }
+                unless currentkey == public_key.to_s
+                    raise Puppet::Error, "public keys for %s differ" % hostname
+                end
+            else
+                File.open(pkeyfile, "w", 0644) { |f|
+                    f.print public_key.to_s
+                }
+            end
+            unless FileTest.directory?(Puppet[:certdir])
+                Puppet.recmkdir(Puppet[:certdir], 0770)
+            end
+            certfile = File.join(Puppet[:certdir], [hostname, "pem"].join("."))
+
+            #puts hostname
+            #puts certfile
+
+            unless FileTest.directory?(Puppet[:csrdir])
+                Puppet.recmkdir(Puppet[:csrdir], 0770)
+            end
+            # first check to see if we already have a signed cert for the host
+            cert, cacert = ca.getclientcert(hostname)
+            if cert and cacert
+                Puppet.info "Retrieving existing certificate for %s" % hostname
+                #Puppet.info "Cert: %s; Cacert: %s" % [cert.class, cacert.class]
+                return [cert.to_pem, cacert.to_pem]
+            elsif @ca
+                if self.autosign?(hostname) or client.nil?
+                    if client.nil?
+                        Puppet.info "Signing certificate for CA server"
+                    end
+                    # okay, we don't have a signed cert
+                    # if we're a CA and autosign is turned on, then go ahead and sign
+                    # the csr and return the results
+                    Puppet.info "Signing certificate for %s" % hostname
+                    cert, cacert = @ca.sign(csr)
+                    Puppet.info "Cert: %s; Cacert: %s" % [cert.class, cacert.class]
+                    return [cert.to_pem, cacert.to_pem]
+                else # just write out the csr for later signing
+                    if @ca.getclientcsr(hostname)
+                        Puppet.info "Not replacing existing request from %s" % hostname
+                    else
+                        Puppet.info "Storing certificate request for %s" % hostname
+                        @ca.storeclientcsr(csr)
+                    end
+                    return ["", ""]
+                end
+            else
+                raise "huh?"
+            end
+        end
+    end
+end
+end