puppet 2.6.18 → 2.7.1

data/lib/puppet/network/rest_authorization.rb

@@ -15,8 +15,8 @@ module Puppet::Network
     end
 
     # Verify that our client has access.
-    def check_authorization(request)
-      authconfig.allowed?(request)
+    def check_authorization(indirection, method, key, params)
+      authconfig.allowed?(indirection, method, key, params)
     end
   end
 end

data/lib/puppet/network/rights.rb

@@ -29,20 +29,15 @@ class Rights
     !is_forbidden_and_why?(name, :node => args[0], :ip => args[1])
   end
 
-  def is_request_forbidden_and_why?(request)
-    methods_to_check = if request.method == :head
+  def is_request_forbidden_and_why?(indirection, method, key, params)
+    methods_to_check = if method == :head
                          # :head is ok if either :find or :save is ok.
                          [:find, :save]
                        else
-                         [request.method]
+                         [method]
                        end
     authorization_failure_exceptions = methods_to_check.map do |method|
-      is_forbidden_and_why?("/#{request.indirection_name}/#{request.key}",
-                            :node => request.node,
-                            :ip => request.ip,
-                            :method => method,
-                            :environment => request.environment,
-                            :authenticated => request.authenticated)
+      is_forbidden_and_why?("/#{indirection}/#{key}", params.merge({:method => method}))
     end
     if authorization_failure_exceptions.include? nil
       # One of the methods we checked is ok, therefore this request is ok.

data/lib/puppet/network/server.rb

@@ -22,7 +22,7 @@ class Puppet::Network::Server
       $stderr.reopen $stdout
       Puppet::Util::Log.reopen
     rescue => detail
-      Puppet::Util.replace_file("/tmp/daemonout", 0644) { |f|
+      Puppet::Util.secure_open("/tmp/daemonout", "w") { |f|
         f.puts "Could not start #{Puppet[:name]}: #{detail}"
       }
       raise "Could not start #{Puppet[:name]}: #{detail}"

data/lib/puppet/network/xmlrpc/client.rb

@@ -0,0 +1,211 @@
+require 'puppet/sslcertificates'
+require 'puppet/network/http_pool'
+require 'openssl'
+require 'puppet/external/base64'
+
+require 'xmlrpc/client'
+require 'net/https'
+require 'yaml'
+
+module Puppet::Network
+  class ClientError < Puppet::Error; end
+  class XMLRPCClientError < Puppet::Error; end
+  class XMLRPCClient < ::XMLRPC::Client
+
+    attr_accessor :puppet_server, :puppet_port
+    @clients = {}
+
+    class << self
+      include Puppet::Util
+      include Puppet::Util::ClassGen
+    end
+
+    # Create a netclient for each handler
+    def self.mkclient(handler)
+      interface = handler.interface
+      namespace = interface.prefix
+
+      # Create a subclass for every client type.  This is
+      # so that all of the methods are on their own class,
+      # so that their namespaces can define the same methods if
+      # they want.
+      constant = handler.name.to_s.capitalize
+      name = namespace.downcase
+      newclient = genclass(name, :hash => @clients, :constant => constant)
+
+      interface.methods.each { |ary|
+        method = ary[0]
+        newclient.send(:define_method,method) { |*args|
+          make_rpc_call(namespace, method, *args)
+        }
+      }
+
+      newclient
+    end
+
+    def self.handler_class(handler)
+      @clients[handler] || self.mkclient(handler)
+    end
+
+    class ErrorHandler
+      def initialize(&block)
+        singleton_class.define_method(:execute, &block)
+      end
+    end
+
+    # Use a class variable so all subclasses have access to it.
+    @@error_handlers = {}
+
+    def self.error_handler(exception)
+      if handler = @@error_handlers[exception.class]
+        return handler
+      else
+        return @@error_handlers[:default]
+      end
+    end
+
+    def self.handle_error(*exceptions, &block)
+      handler = ErrorHandler.new(&block)
+
+      exceptions.each do |exception|
+        @@error_handlers[exception] = handler
+      end
+    end
+
+    handle_error(OpenSSL::SSL::SSLError) do |client, detail, namespace, method|
+      if detail.message =~ /bad write retry/
+        Puppet.warning "Transient SSL write error; restarting connection and retrying"
+        client.recycle_connection
+        return :retry
+      end
+      ["certificate verify failed", "hostname was not match", "hostname not match"].each do |str|
+        Puppet.warning "Certificate validation failed; consider using the certname configuration option" if detail.message.include?(str)
+      end
+      raise XMLRPCClientError, "Certificates were not trusted: #{detail}"
+    end
+
+    handle_error(:default) do |client, detail, namespace, method|
+      if detail.message.to_s =~ /^Wrong size\. Was \d+, should be \d+$/
+        Puppet.warning "XMLRPC returned wrong size.  Retrying."
+        return :retry
+      end
+      Puppet.err "Could not call #{namespace}.#{method}: #{detail.inspect}"
+      error = XMLRPCClientError.new(detail.to_s)
+      error.set_backtrace detail.backtrace
+      raise error
+    end
+
+    handle_error(OpenSSL::SSL::SSLError) do |client, detail, namespace, method|
+      if detail.message =~ /bad write retry/
+        Puppet.warning "Transient SSL write error; restarting connection and retrying"
+        client.recycle_connection
+        return :retry
+      end
+      ["certificate verify failed", "hostname was not match", "hostname not match"].each do |str|
+        Puppet.warning "Certificate validation failed; consider using the certname configuration option" if detail.message.include?(str)
+      end
+      raise XMLRPCClientError, "Certificates were not trusted: #{detail}"
+    end
+
+    handle_error(::XMLRPC::FaultException) do |client, detail, namespace, method|
+      raise XMLRPCClientError, detail.faultString
+    end
+
+    handle_error(Errno::ECONNREFUSED) do |client, detail, namespace, method|
+      msg = "Could not connect to #{client.host} on port #{client.port}"
+      raise XMLRPCClientError, msg
+    end
+
+    handle_error(SocketError) do |client, detail, namespace, method|
+      Puppet.err "Could not find server #{@host}: #{detail}"
+      error = XMLRPCClientError.new("Could not find server #{client.host}")
+      error.set_backtrace detail.backtrace
+      raise error
+    end
+
+    handle_error(Errno::EPIPE, EOFError) do |client, detail, namespace, method|
+      Puppet.info "Other end went away; restarting connection and retrying"
+      client.recycle_connection
+      return :retry
+    end
+
+    handle_error(Timeout::Error) do |client, detail, namespace, method|
+      Puppet.err "Connection timeout calling #{namespace}.#{method}: #{detail}"
+      error = XMLRPCClientError.new("Connection Timeout")
+      error.set_backtrace(detail.backtrace)
+      raise error
+    end
+
+    def make_rpc_call(namespace, method, *args)
+      Puppet.debug "Calling #{namespace}.#{method}"
+      begin
+        call("#{namespace}.#{method}",*args)
+      rescue SystemExit,NoMemoryError
+        raise
+      rescue Exception => detail
+        retry if self.class.error_handler(detail).execute(self, detail, namespace, method) == :retry
+      end
+    ensure
+      http.finish if http.started?
+    end
+
+    def http
+      @http ||= Puppet::Network::HttpPool.http_instance(host, port, true)
+    end
+
+    attr_reader :host, :port
+
+    def initialize(hash = {})
+      hash[:Path] ||= "/RPC2"
+      hash[:Server] ||= Puppet[:server]
+      hash[:Port] ||= Puppet[:masterport]
+      hash[:HTTPProxyHost] ||= Puppet[:http_proxy_host]
+      hash[:HTTPProxyPort] ||= Puppet[:http_proxy_port]
+
+      if "none" == hash[:HTTPProxyHost]
+        hash[:HTTPProxyHost] = nil
+        hash[:HTTPProxyPort] = nil
+      end
+
+
+            super(
+                
+        hash[:Server],
+        hash[:Path],
+        hash[:Port],
+        hash[:HTTPProxyHost],
+        hash[:HTTPProxyPort],
+        
+        nil, # user
+        nil, # password
+        true, # use_ssl
+        Puppet[:configtimeout] # use configured timeout (#1176)
+      )
+      @http = Puppet::Network::HttpPool.http_instance(@host, @port)
+    end
+
+    # Get rid of our existing connection, replacing it with a new one.
+    # This should only happen if we lose our connection somehow (e.g., an EPIPE)
+    # or we've just downloaded certs and we need to create new http instances
+    # with the certs added.
+    def recycle_connection
+      http.finish if http.started?
+      @http = nil
+      self.http # force a new one
+    end
+
+    def start
+        @http.start unless @http.started?
+    rescue => detail
+        Puppet.err "Could not connect to server: #{detail}"
+    end
+
+    def local
+      false
+    end
+
+    def local?
+      false
+    end
+  end
+end

data/lib/puppet/node.rb

@@ -3,6 +3,7 @@ require 'puppet/indirector'
 # A class for managing nodes, including their facts and environment.
 class Puppet::Node
   require 'puppet/node/facts'
+  require 'puppet/node/inventory'
   require 'puppet/node/environment'
 
   # Set up indirection, so that nodes can be looked for in
@@ -56,7 +57,7 @@ class Puppet::Node
 
   # Merge the node facts with parameters from the node source.
   def fact_merge
-      if facts = Puppet::Node::Facts.find(name)
+      if facts = Puppet::Node::Facts.indirection.find(name)
         merge(facts.values)
       end
   rescue => detail

data/lib/puppet/node/environment.rb

@@ -76,12 +76,12 @@ class Puppet::Node::Environment
     # per environment semantics with an efficient most common cases; we almost
     # always just return our thread's known-resource types.  Only at the start
     # of a compilation (after our thread var has been set to nil) or when the
-    # environment has changed do we delve deeper. 
+    # environment has changed do we delve deeper.
     Thread.current[:known_resource_types] = nil if (krt = Thread.current[:known_resource_types]) && krt.environment != self
     Thread.current[:known_resource_types] ||= synchronize {
       if @known_resource_types.nil? or @known_resource_types.require_reparse?
         @known_resource_types = Puppet::Resource::TypeCollection.new(self)
-        @known_resource_types.perform_initial_import
+        @known_resource_types.import_ast(perform_initial_import, '')
       end
       @known_resource_types
     }
@@ -128,7 +128,7 @@ class Puppet::Node::Environment
     to_s.to_sym
   end
 
-  # The only thing we care about when serializing an environment is its 
+  # The only thing we care about when serializing an environment is its
   # identity; everything else is ephemeral and should not be stored or
   # transmitted.
   def to_zaml(z)
@@ -147,5 +147,32 @@ class Puppet::Node::Environment
     end
   end
 
+  private
+
+  def perform_initial_import
+    return empty_parse_result if Puppet.settings[:ignoreimport]
+    parser = Puppet::Parser::Parser.new(self)
+    if code = Puppet.settings.uninterpolated_value(:code, name.to_s) and code != ""
+      parser.string = code
+    else
+      file = Puppet.settings.value(:manifest, name.to_s)
+      parser.file = file
+    end
+    parser.parse
+  rescue => detail
+    known_resource_types.parse_failed = true
+
+    msg = "Could not parse for environment #{self}: #{detail}"
+    error = Puppet::Error.new(msg)
+    error.set_backtrace(detail.backtrace)
+    raise error
+  end
+
+  def empty_parse_result
+    # Return an empty toplevel hostclass to use as the result of
+    # perform_initial_import when no file was actually loaded.
+    return Puppet::Parser::AST::Hostclass.new('')
+  end
+
   @root = new(:'*root*')
 end

data/lib/puppet/node/facts.rb

@@ -15,8 +15,8 @@ class Puppet::Node::Facts
 
   # We want to expire any cached nodes if the facts are saved.
   module NodeExpirer
-    def save(key, instance)
-      Puppet::Node.expire(instance.name)
+    def save(instance, key = nil)
+      Puppet::Node.indirection.expire(instance.name)
       super
     end
   end
@@ -35,7 +35,7 @@ class Puppet::Node::Facts
     @name = name
     @values = values
 
-    add_internal
+    add_timestamp
   end
 
   def downcase_if_necessary
@@ -59,14 +59,6 @@ class Puppet::Node::Facts
     strip_internal == other.send(:strip_internal)
   end
 
-  def timestamp=(time)
-    self.values[:_timestamp] = time
-  end
-
-  def timestamp
-    self.values[:_timestamp]
-  end
-
   def self.from_pson(data)
     result = new(data['name'], data['values'])
     result.timestamp = Time.parse(data['timestamp'])
@@ -83,13 +75,21 @@ class Puppet::Node::Facts
     }.to_pson(*args)
   end
 
-  private
-
   # Add internal data to the facts for storage.
-  def add_internal
-    self.values[:_timestamp] = Time.now
+  def add_timestamp
+    self.timestamp = Time.now
   end
 
+  def timestamp=(time)
+    self.values[:_timestamp] = time
+  end
+
+  def timestamp
+    self.values[:_timestamp]
+  end
+
+  private
+
   # Strip out that internal data.
   def strip_internal
     newvals = values.dup

data/lib/puppet/node/inventory.rb

@@ -0,0 +1,7 @@
+require 'puppet/node'
+require 'puppet/indirector'
+
+class Puppet::Node::Inventory
+  extend Puppet::Indirector
+  indirects :inventory, :terminus_setting => :inventory_terminus
+end

data/lib/puppet/parser/ast.rb

@@ -111,28 +111,32 @@ end
 require 'puppet/parser/ast/arithmetic_operator'
 require 'puppet/parser/ast/astarray'
 require 'puppet/parser/ast/asthash'
-require 'puppet/parser/ast/branch'
 require 'puppet/parser/ast/boolean_operator'
+require 'puppet/parser/ast/branch'
 require 'puppet/parser/ast/caseopt'
 require 'puppet/parser/ast/casestatement'
 require 'puppet/parser/ast/collection'
 require 'puppet/parser/ast/collexpr'
 require 'puppet/parser/ast/comparison_operator'
+require 'puppet/parser/ast/definition'
 require 'puppet/parser/ast/else'
 require 'puppet/parser/ast/function'
+require 'puppet/parser/ast/hostclass'
 require 'puppet/parser/ast/ifstatement'
 require 'puppet/parser/ast/in_operator'
 require 'puppet/parser/ast/leaf'
 require 'puppet/parser/ast/match_operator'
 require 'puppet/parser/ast/minus'
+require 'puppet/parser/ast/node'
 require 'puppet/parser/ast/nop'
 require 'puppet/parser/ast/not'
+require 'puppet/parser/ast/relationship'
 require 'puppet/parser/ast/resource'
 require 'puppet/parser/ast/resource_defaults'
+require 'puppet/parser/ast/resource_instance'
 require 'puppet/parser/ast/resource_override'
 require 'puppet/parser/ast/resource_reference'
 require 'puppet/parser/ast/resourceparam'
 require 'puppet/parser/ast/selector'
 require 'puppet/parser/ast/tag'
 require 'puppet/parser/ast/vardef'
-require 'puppet/parser/ast/relationship'

data/lib/puppet/parser/ast/astarray.rb

@@ -16,25 +16,20 @@ class Puppet::Parser::AST
 
     # Evaluate our children.
     def evaluate(scope)
-      # Make a new array, so we don't have to deal with the details of
-      # flattening and such
-      items = []
-
-      # First clean out any AST::ASTArrays
-      @children.each { |child|
-        if child.instance_of?(AST::ASTArray)
-          child.each do |ac|
-            items << ac
+      result = []
+      @children.each do |child|
+        # Skip things that respond to :instantiate (classes, nodes,
+        # and definitions), because they have already been
+        # instantiated.
+        if !child.respond_to?(:instantiate)
+          item = child.safeevaluate(scope)
+          if !item.nil?
+            # nil values are implicitly removed.
+            result.push(item)
           end
-        else
-          items << child
         end
-      }
-
-      rets = items.flatten.collect { |child|
-        child.safeevaluate(scope)
-      }
-      rets.reject { |o| o.nil? }
+      end
+      result
     end
 
     def push(*ary)
@@ -52,10 +47,4 @@ class Puppet::Parser::AST
       "[" + @children.collect { |c| c.to_s }.join(', ') + "]"
     end
   end
-
-  # A simple container class, containing the parameters for an object.
-  # Used for abstracting the grammar declarations.  Basically unnecessary
-  # except that I kept finding bugs because I had too many arrays that
-  # meant completely different things.
-  class ResourceInstance < ASTArray; end
 end