puppet 2.6.18 → 2.7.1

data/lib/puppet/indirector/certificate_request/ca.rb

@@ -7,6 +7,14 @@ class Puppet::SSL::CertificateRequest::Ca < Puppet::Indirector::SslFile
   store_in :csrdir
 
   def save(request)
+    if host = Puppet::SSL::Host.indirection.find(request.key)
+      if Puppet[:allow_duplicate_certs]
+        Puppet.notice "#{request.key} already has a #{host.state} certificate; new certificate will overwrite it"
+      else
+        raise "#{request.key} already has a #{host.state} certificate; ignoring certificate request"
+      end
+    end
+
     result = super
     Puppet.notice "#{request.key} has a waiting certificate request"
     result

data/lib/puppet/indirector/certificate_status.rb

@@ -0,0 +1,4 @@
+require 'puppet/indirector'
+
+class Puppet::Indirector::CertificateStatus
+end

data/lib/puppet/indirector/certificate_status/file.rb

@@ -0,0 +1,82 @@
+require 'puppet'
+require 'puppet/indirector/certificate_status'
+require 'puppet/ssl/certificate'
+require 'puppet/ssl/certificate_authority'
+require 'puppet/ssl/certificate_request'
+require 'puppet/ssl/host'
+require 'puppet/ssl/key'
+
+class Puppet::Indirector::CertificateStatus::File < Puppet::Indirector::Code
+  def ca
+    raise ArgumentError, "This process is not configured as a certificate authority" unless Puppet::SSL::CertificateAuthority.ca?
+    Puppet::SSL::CertificateAuthority.new
+  end
+
+  def destroy(request)
+    deleted = []
+    [
+      Puppet::SSL::Certificate,
+      Puppet::SSL::CertificateRequest,
+      Puppet::SSL::Key,
+    ].collect do |part|
+      if part.indirection.destroy(request.key)
+        deleted << "#{part}"
+      end
+    end
+
+    return "Nothing was deleted" if deleted.empty?
+    "Deleted for #{request.key}: #{deleted.join(", ")}"
+  end
+
+  def save(request)
+    if request.instance.desired_state == "signed"
+      certificate_request = Puppet::SSL::CertificateRequest.indirection.find(request.key)
+      raise Puppet::Error, "Cannot sign for host #{request.key} without a certificate request" unless certificate_request
+      ca.sign(request.key)
+    elsif request.instance.desired_state == "revoked"
+      certificate = Puppet::SSL::Certificate.indirection.find(request.key)
+      raise Puppet::Error, "Cannot revoke host #{request.key} because has it doesn't have a signed certificate" unless certificate
+      ca.revoke(request.key)
+    else
+      raise Puppet::Error, "State #{request.instance.desired_state} invalid; Must specify desired state of 'signed' or 'revoked' for host #{request.key}"
+    end
+
+  end
+
+  def search(request)
+    # Support historic interface wherein users provide classes to filter
+    # the search.  When used via the REST API, the arguments must be
+    # a Symbol or an Array containing Symbol objects.
+    klasses = case request.options[:for]
+    when Class
+      [request.options[:for]]
+    when nil
+      [
+        Puppet::SSL::Certificate,
+        Puppet::SSL::CertificateRequest,
+        Puppet::SSL::Key,
+      ]
+    else
+      [request.options[:for]].flatten.map do |klassname|
+        indirection.class.model(klassname.to_sym)
+      end
+    end
+
+    klasses.collect do |klass|
+      klass.indirection.search(request.key, request.options)
+    end.flatten.collect do |result|
+      result.name
+    end.uniq.collect &Puppet::SSL::Host.method(:new)
+  end
+
+  def find(request)
+    ssl_host = Puppet::SSL::Host.new(request.key)
+    public_key = Puppet::SSL::Certificate.indirection.find(request.key)
+
+    if ssl_host.certificate_request || public_key
+      ssl_host
+    else
+      nil
+    end
+  end
+end

data/lib/puppet/indirector/certificate_status/rest.rb

@@ -0,0 +1,10 @@
+require 'puppet/ssl/host'
+require 'puppet/indirector/rest'
+require 'puppet/indirector/certificate_status'
+
+class Puppet::Indirector::CertificateStatus::Rest < Puppet::Indirector::REST
+  desc "Sign, revoke, search for, or clean certificates & certificate requests over HTTP."
+
+  use_server_setting(:ca_server)
+  use_port_setting(:ca_port)
+end

data/lib/puppet/indirector/couch.rb

@@ -1,6 +1,3 @@
-raise "Couch terminus not supported without couchrest gem" unless Puppet.features.couchdb?
-
-require 'couchrest'
 class Puppet::Indirector::Couch < Puppet::Indirector::Terminus
 
   # The CouchRest database instance. One database instance per Puppet runtime
@@ -13,6 +10,11 @@ class Puppet::Indirector::Couch < Puppet::Indirector::Terminus
     attributes_of get(request)
   end
 
+  def initialize(*args)
+    raise "Couch terminus not supported without couchrest gem" unless Puppet.features.couchdb?
+    super
+  end
+
   # Create or update the couchdb document with the request's data hash.
   #
   def save(request)

data/lib/puppet/indirector/exec.rb

@@ -16,8 +16,8 @@ class Puppet::Indirector::Exec < Puppet::Indirector::Terminus
   private
 
   # Proxy the execution, so it's easier to test.
-  def execute(command, arguments)
-    Puppet::Util.execute(command,arguments)
+  def execute(command)
+    Puppet::Util.execute(command)
   end
 
   # Call the external command and see if it returns our output.
@@ -33,7 +33,7 @@ class Puppet::Indirector::Exec < Puppet::Indirector::Terminus
     # Add our name to it.
     external_command << name
     begin
-      output = execute(external_command, :combine => false)
+      output = execute(external_command)
     rescue Puppet::ExecutionFailure => detail
       raise Puppet::Error, "Failed to find #{name} via exec: #{detail}"
     end

data/lib/puppet/indirector/face.rb

@@ -0,0 +1,127 @@
+require 'puppet/face'
+
+class Puppet::Indirector::Face < Puppet::Face
+  option "--terminus TERMINUS" do
+    summary "The indirector terminus to use."
+    description <<-EOT
+      Indirector faces expose indirected subsystems of Puppet. These
+      subsystems are each able to retrieve and alter a specific type of data
+      (with the familiar actions of `find`, `search`, `save`, and `destroy`)
+      from an arbitrary number of pluggable backends. In Puppet parlance,
+      these backends are called terminuses.
+
+      Almost all indirected subsystems have a `rest` terminus that interacts
+      with the puppet master's data. Most of them have additional terminuses
+      for various local data models, which are in turn used by the indirected
+      subsystem on the puppet master whenever it receives a remote request.
+
+      The terminus for an action is often determined by context, but
+      occasionally needs to be set explicitly. See the "Notes" section of this
+      face's manpage for more details.
+    EOT
+
+    before_action do |action, args, options|
+      set_terminus(options[:terminus])
+    end
+
+    after_action do |action, args, options|
+      indirection.reset_terminus_class
+    end
+  end
+
+  def self.indirections
+    Puppet::Indirector::Indirection.instances.collect { |t| t.to_s }.sort
+  end
+
+  def self.terminus_classes(indirection)
+    Puppet::Indirector::Terminus.terminus_classes(indirection.to_sym).collect { |t| t.to_s }.sort
+  end
+
+  def call_indirection_method(method, key, options)
+    begin
+      result = indirection.__send__(method, key, options)
+    rescue => detail
+      puts detail.backtrace if Puppet[:trace]
+      raise "Could not call '#{method}' on '#{indirection_name}': #{detail}"
+    end
+
+    return result
+  end
+
+  action :destroy do
+    summary "Delete an object."
+    arguments "<key>"
+    when_invoked { |key, options| call_indirection_method(:destroy, key, options) }
+  end
+
+  action :find do
+    summary "Retrieve an object by name."
+    arguments "<key>"
+    when_invoked { |key, options| call_indirection_method(:find, key, options) }
+  end
+
+  action :save do
+    summary "API only: create or overwrite an object."
+    arguments "<object>"
+    description <<-EOT
+      API only: create or overwrite an object. As the Faces framework does not
+      currently accept data from STDIN, save actions cannot currently be invoked
+      from the command line.
+    EOT
+    when_invoked { |key, options| call_indirection_method(:save, key, options) }
+  end
+
+  action :search do
+    summary "Search for an object or retrieve multiple objects."
+    arguments "<query>"
+    when_invoked { |key, options| call_indirection_method(:search, key, options) }
+  end
+
+  # Print the configuration for the current terminus class
+  action :info do
+    summary "Print the default terminus class for this face."
+    description <<-EOT
+      Prints the default terminus class for this subcommand. Note that different
+      run modes may have different default termini; when in doubt, specify the
+      run mode with the '--mode' option.
+    EOT
+
+    when_invoked do |*args|
+      if t = indirection.terminus_class
+        puts "Run mode '#{Puppet.run_mode.name}': #{t}"
+      else
+        $stderr.puts "No default terminus class for run mode '#{Puppet.run_mode.name}'"
+      end
+    end
+  end
+
+  attr_accessor :from
+
+  def indirection_name
+    @indirection_name || name.to_sym
+  end
+
+  # Here's your opportunity to override the indirection name.  By default it
+  # will be the same name as the face.
+  def set_indirection_name(name)
+    @indirection_name = name
+  end
+
+  # Return an indirection associated with a face, if one exists;
+  # One usually does.
+  def indirection
+    unless @indirection
+      @indirection = Puppet::Indirector::Indirection.instance(indirection_name)
+      @indirection or raise "Could not find terminus for #{indirection_name}"
+    end
+    @indirection
+  end
+
+  def set_terminus(from)
+    begin
+      indirection.terminus_class = from
+    rescue => detail
+      raise "Could not set '#{indirection.name}' terminus to '#{from}' (#{detail}); valid terminus types are #{self.class.terminus_classes(indirection.name).join(", ") }"
+    end
+  end
+end

data/lib/puppet/indirector/facts/network_device.rb

@@ -0,0 +1,25 @@
+require 'puppet/node/facts'
+require 'puppet/indirector/code'
+
+class Puppet::Node::Facts::NetworkDevice < Puppet::Indirector::Code
+  desc "Retrieve facts from a network device."
+
+  # Look a device's facts up through the current device.
+  def find(request)
+    result = Puppet::Node::Facts.new(request.key, Puppet::Util::NetworkDevice.current.facts)
+
+    result.add_local_facts
+    result.stringify
+    result.downcase_if_necessary
+
+    result
+  end
+
+  def destroy(facts)
+    raise Puppet::DevError, "You cannot destroy facts in the code store; it is only used for getting facts from a remote device"
+  end
+
+  def save(facts)
+    raise Puppet::DevError, "You cannot save facts to the code store; it is only used for getting facts from a remote device"
+  end
+end

data/lib/puppet/indirector/file.rb

@@ -0,0 +1,79 @@
+require 'puppet/indirector/terminus'
+
+# Store instances as files, usually serialized using some format.
+class Puppet::Indirector::File < Puppet::Indirector::Terminus
+  # Where do we store our data?
+  def data_directory
+    name = Puppet.run_mode.master? ? :server_datadir : :client_datadir
+
+    File.join(Puppet.settings[name], self.class.indirection_name.to_s)
+  end
+
+  def file_format(path)
+    path =~ /\.(\w+)$/ and return $1
+  end
+
+  def file_path(request)
+    File.join(data_directory, request.key + ".#{serialization_format}")
+  end
+
+  def latest_path(request)
+    files = Dir.glob(File.join(data_directory, request.key + ".*"))
+    return nil if files.empty?
+
+    # Return the newest file.
+    files.sort { |a, b| File.stat(b).mtime <=> File.stat(a).mtime }[0]
+  end
+
+  def serialization_format
+    model.default_format
+  end
+
+  # Remove files on disk.
+  def destroy(request)
+    begin
+      removed = false
+      Dir.glob(File.join(data_directory, request.key.to_s + ".*")).each do |file|
+        removed = true
+        File.unlink(file)
+      end
+    rescue => detail
+      raise Puppet::Error, "Could not remove #{request.key}: #{detail}"
+    end
+
+    raise Puppet::Error, "Could not find files for #{request.key} to remove" unless removed
+  end
+
+  # Return a model instance for a given file on disk.
+  def find(request)
+    return nil unless path = latest_path(request)
+    format = file_format(path)
+
+    raise ArgumentError, "File format #{format} is not supported by #{self.class.indirection_name}" unless model.support_format?(format)
+
+    begin
+      return model.convert_from(format, File.read(path))
+    rescue => detail
+      raise Puppet::Error, "Could not convert path #{path} into a #{self.class.indirection_name}: #{detail}"
+    end
+  end
+
+  # Save a new file to disk.
+  def save(request)
+    path = file_path(request)
+
+    dir = File.dirname(path)
+
+    raise Puppet::Error.new("Cannot save #{request.key}; parent directory #{dir} does not exist") unless File.directory?(dir)
+
+    begin
+      File.open(path, "w") { |f| f.print request.instance.render(serialization_format) }
+    rescue => detail
+      raise Puppet::Error, "Could not write #{request.key}: #{detail}" % [request.key, detail]
+    end
+  end
+
+  def path(key)
+    key
+  end
+end

data/lib/puppet/indirector/file_bucket_file/file.rb

@@ -48,10 +48,6 @@ module Puppet::FileBucketFile
       instance.to_s
     end
 
-    def validate_key(request)
-      # There are no ACLs on filebucket files so validating key is not important
-    end
-
     private
 
     def path_match(dir_path, files_original_path)

data/lib/puppet/indirector/indirection.rb

@@ -257,7 +257,7 @@ class Puppet::Indirector::Indirection
 
   # Save the instance in the appropriate terminus.  This method is
   # normally an instance method on the indirected class.
-  def save(key, instance = nil)
+  def save(instance, key = nil)
     request = request(:save, key, instance)
     terminus = prepare(request)
 
@@ -301,7 +301,6 @@ class Puppet::Indirector::Indirection
 
     dest_terminus = terminus(terminus_name)
     check_authorization(request, dest_terminus)
-    dest_terminus.validate(request)
 
     dest_terminus
   end

data/lib/puppet/indirector/inventory/yaml.rb

@@ -0,0 +1,81 @@
+require 'puppet/node/inventory'
+require 'puppet/indirector/yaml'
+
+class Puppet::Node::Inventory::Yaml < Puppet::Indirector::Yaml
+  desc "Return node names matching the fact query"
+
+  # Return the path to a given node's file.
+  def yaml_dir_path
+    base = Puppet.run_mode.master? ? Puppet[:yamldir] : Puppet[:clientyamldir]
+    File.join(base, 'facts', '*.yaml')
+  end
+
+  def node_matches?(facts, options)
+    options.each do |key, value|
+      type, name, operator = key.to_s.split(".")
+      operator ||= 'eq'
+
+      return false unless node_matches_option?(type, name, operator, value, facts)
+    end
+    return true
+  end
+
+  def search(request)
+    node_names = []
+    Dir.glob(yaml_dir_path).each do |file|
+      facts = YAML.load_file(file)
+      node_names << facts.name if node_matches?(facts, request.options)
+    end
+    node_names
+  end
+
+  private
+
+  def node_matches_option?(type, name, operator, value, facts)
+    case type
+    when "meta"
+      case name
+      when "timestamp"
+        compare_timestamp(operator, facts.timestamp, Time.parse(value))
+      end
+    when "facts"
+      compare_facts(operator, facts.values[name], value)
+    end
+  end
+
+  def compare_facts(operator, value1, value2)
+    return false unless value1
+
+    case operator
+    when "eq"
+      value1.to_s == value2.to_s
+    when "le"
+      value1.to_f <= value2.to_f
+    when "ge"
+      value1.to_f >= value2.to_f
+    when "lt"
+      value1.to_f < value2.to_f
+    when "gt"
+      value1.to_f > value2.to_f
+    when "ne"
+      value1.to_s != value2.to_s
+    end
+  end
+
+  def compare_timestamp(operator, value1, value2)
+    case operator
+    when "eq"
+      value1 == value2
+    when "le"
+      value1 <= value2
+    when "ge"
+      value1 >= value2
+    when "lt"
+      value1 < value2
+    when "gt"
+      value1 > value2
+    when "ne"
+      value1 != value2
+    end
+  end
+end