puppet 2.6.18 → 2.7.1

data/lib/puppet/sslcertificates/inventory.rb

@@ -0,0 +1,38 @@
+# A module for keeping track of all the certificates issued by the CA, ever
+# Maintains the file "$cadir/inventory.txt"
+module Puppet::SSLCertificates
+  module Inventory
+
+    # Add CERT to the inventory of issued certs in '$cadir/inventory.txt'
+    # If no inventory exists yet, build an inventory and list all the
+    # certificates that have been signed so far
+    def self.add(cert)
+      inited = false
+      inited = true if FileTest.exists?(Puppet[:cert_inventory])
+
+      Puppet.settings.write(:cert_inventory, "a") do |f|
+        f.puts((inited ? nil : self.init).to_s + format(cert))
+      end
+    end
+
+    private
+
+    def self.init
+      inv = "# Inventory of signed certificates\n"
+      inv += "# SERIAL NOT_BEFORE NOT_AFTER SUBJECT\n"
+      Dir.glob(File::join(Puppet[:signeddir], "*.pem")) do |f|
+        inv += format(OpenSSL::X509::Certificate.new(File::read(f))) + "\n"
+      end
+      inv
+    end
+
+    def self.format(cert)
+      iso = '%Y-%m-%dT%H:%M:%S%Z'
+      return "0x%04x %s %s %s" % [cert.serial,
+                    cert.not_before.strftime(iso),
+                    cert.not_after.strftime(iso),
+                    cert.subject]
+    end
+  end
+end
+

data/lib/puppet/sslcertificates/support.rb

@@ -0,0 +1,146 @@
+require 'puppet/sslcertificates'
+
+# A module to handle reading of certificates.
+module Puppet::SSLCertificates::Support
+  class MissingCertificate < Puppet::Error; end
+  class InvalidCertificate < Puppet::Error; end
+
+  attr_reader :cacert
+
+  # Some metaprogramming to create methods for retrieving and creating keys.
+  # This probably isn't fewer lines than defining each separately...
+  def self.keytype(name, options, &block)
+    var = "@#{name}"
+
+    maker = "mk_#{name}"
+    reader = "read_#{name}"
+
+    unless param = options[:param]
+      raise ArgumentError, "You must specify the parameter for the key"
+    end
+
+    unless klass = options[:class]
+      raise ArgumentError, "You must specify the class for the key"
+    end
+
+    # Define the method that creates it.
+    define_method(maker, &block)
+
+    # Define the reading method.
+    define_method(reader) do
+      return nil unless FileTest.exists?(Puppet[param]) or rename_files_with_uppercase(Puppet[param])
+
+      begin
+        instance_variable_set(var, klass.new(File.read(Puppet[param])))
+      rescue => detail
+        raise InvalidCertificate, "Could not read #{param}: #{detail}"
+      end
+    end
+
+    # Define the overall method, which just calls the reader and maker
+    # as appropriate.
+    define_method(name) do
+      unless cert = instance_variable_get(var)
+        unless cert = send(reader)
+          cert = send(maker)
+          Puppet.settings.write(param) { |f| f.puts cert.to_pem }
+        end
+        instance_variable_set(var, cert)
+      end
+      cert
+    end
+  end
+
+  # The key pair.
+  keytype :key, :param => :hostprivkey, :class => OpenSSL::PKey::RSA do
+    Puppet.info "Creating a new SSL key at #{Puppet[:hostprivkey]}"
+    key = OpenSSL::PKey::RSA.new(Puppet[:keylength])
+
+    # Our key meta programming can only handle one file, so we have
+    # to separately write out the public key.
+    Puppet.settings.write(:hostpubkey) do |f|
+      f.print key.public_key.to_pem
+    end
+    return key
+  end
+
+  # Our certificate request
+  keytype :csr, :param => :hostcsr, :class => OpenSSL::X509::Request do
+    Puppet.info "Creating a new certificate request for #{Puppet[:certname]}"
+
+    csr = OpenSSL::X509::Request.new
+    csr.version = 0
+    csr.subject = OpenSSL::X509::Name.new([["CN", Puppet[:certname]]])
+    csr.public_key = key.public_key
+    csr.sign(key, OpenSSL::Digest::MD5.new)
+
+    return csr
+  end
+
+  keytype :cert, :param => :hostcert, :class => OpenSSL::X509::Certificate do
+    raise MissingCertificate, "No host certificate"
+  end
+
+  keytype :ca_cert, :param => :localcacert, :class => OpenSSL::X509::Certificate do
+    raise MissingCertificate, "No CA certificate"
+  end
+
+  # Request a certificate from the remote system.  This does all of the work
+  # of creating the cert request, contacting the remote system, and
+  # storing the cert locally.
+  def requestcert
+    begin
+      cert, cacert = caclient.getcert(@csr.to_pem)
+    rescue => detail
+      puts detail.backtrace if Puppet[:trace]
+      raise Puppet::Error.new("Certificate retrieval failed: #{detail}")
+    end
+
+    if cert.nil? or cert == ""
+      return nil
+    end
+    Puppet.settings.write(:hostcert) do |f| f.print cert end
+    Puppet.settings.write(:localcacert) do |f| f.print cacert end
+    #File.open(@certfile, "w", 0644) { |f| f.print cert }
+    #File.open(@cacertfile, "w", 0644) { |f| f.print cacert }
+    begin
+      @cert = OpenSSL::X509::Certificate.new(cert)
+      @cacert = OpenSSL::X509::Certificate.new(cacert)
+      retrieved = true
+    rescue => detail
+      raise Puppet::Error.new(
+        "Invalid certificate: #{detail}"
+      )
+    end
+
+    raise Puppet::DevError, "Received invalid certificate" unless @cert.check_private_key(@key)
+    retrieved
+  end
+
+  # A hack method to deal with files that exist with a different case.
+  # Just renames it; doesn't read it in or anything.
+  def rename_files_with_uppercase(file)
+    dir = File.dirname(file)
+    short = File.basename(file)
+
+    # If the dir isn't present, we clearly don't have the file.
+    #return nil unless FileTest.directory?(dir)
+
+    raise ArgumentError, "Tried to fix SSL files to a file containing uppercase" unless short.downcase == short
+
+    return false unless File.directory?(dir)
+
+    real_file = Dir.entries(dir).reject { |f| f =~ /^\./ }.find do |other|
+      other.downcase == short
+    end
+
+    return nil unless real_file
+
+    full_file = File.join(dir, real_file)
+
+    Puppet.notice "Fixing case in #{full_file}; renaming to #{file}"
+    File.rename(full_file, file)
+
+    true
+  end
+end

data/lib/puppet/status.rb

@@ -10,7 +10,7 @@ class Puppet::Status
     @status = status || {"is_alive" => true}
   end
 
-  def to_pson
+  def to_pson(*args)
     @status.to_pson
   end
 

data/lib/puppet/transaction.rb

@@ -4,6 +4,7 @@
 require 'puppet'
 require 'puppet/util/tagging'
 require 'puppet/application'
+require 'digest/sha1'
 
 class Puppet::Transaction
   require 'puppet/transaction/event'
@@ -11,11 +12,11 @@ class Puppet::Transaction
   require 'puppet/transaction/resource_harness'
   require 'puppet/resource/status'
 
-  attr_accessor :component, :catalog, :ignoreschedules
-  attr_accessor :sorted_resources, :configurator
+  attr_accessor :component, :catalog, :ignoreschedules, :for_network_device
+  attr_accessor :configurator
 
   # The report, once generated.
-  attr_reader :report
+  attr_accessor :report
 
   # Routes and stores any events and subscriptions.
   attr_reader :event_manager
@@ -57,89 +58,59 @@ class Puppet::Transaction
     report.resource_statuses.values.find_all { |status| status.changed }.collect { |status| catalog.resource(status.resource) }
   end
 
+  # Find all of the applied resources (including failed attempts).
+  def applied_resources
+    report.resource_statuses.values.collect { |status| catalog.resource(status.resource) }
+  end
+
   # Copy an important relationships from the parent to the newly-generated
   # child resource.
-  def make_parent_child_relationship(resource, children)
-    depthfirst = resource.depthfirst?
-
-    children.each do |gen_child|
-      if depthfirst
-        edge = [gen_child, resource]
-      else
-        edge = [resource, gen_child]
-      end
-      relationship_graph.add_vertex(gen_child)
-
-      unless relationship_graph.edge?(edge[1], edge[0])
-        relationship_graph.add_edge(*edge)
-      else
-        resource.debug "Skipping automatic relationship to #{gen_child}"
-      end
+  def add_conditional_directed_dependency(parent, child, label=nil)
+    relationship_graph.add_vertex(child)
+    edge = parent.depthfirst? ? [child, parent] : [parent, child]
+    if relationship_graph.edge?(*edge.reverse)
+      parent.debug "Skipping automatic relationship to #{child}"
+    else
+      relationship_graph.add_edge(edge[0],edge[1],label)
     end
   end
 
-  # See if the resource generates new resources at evaluation time.
-  def eval_generate(resource)
-    generate_additional_resources(resource, :eval_generate)
-  end
-
   # Evaluate a single resource.
   def eval_resource(resource, ancestor = nil)
     if skip?(resource)
       resource_status(resource).skipped = true
     else
-      eval_children_and_apply_resource(resource, ancestor)
+      resource_status(resource).scheduled = true
+      apply(resource, ancestor)
     end
 
     # Check to see if there are any events queued for this resource
     event_manager.process_events(resource)
   end
 
-  def eval_children_and_apply_resource(resource, ancestor = nil)
-    resource_status(resource).scheduled = true
-
-    # We need to generate first regardless, because the recursive
-    # actions sometimes change how the top resource is applied.
-    children = eval_generate(resource)
-
-    if ! children.empty? and resource.depthfirst?
-      children.each do |child|
-        # The child will never be skipped when the parent isn't
-        eval_resource(child, ancestor || resource)
-      end
-    end
-
-    # Perform the actual changes
-    apply(resource, ancestor)
-
-    if ! children.empty? and ! resource.depthfirst?
-      children.each do |child|
-        eval_resource(child, ancestor || resource)
-      end
-    end
-  end
-
   # This method does all the actual work of running a transaction.  It
   # collects all of the changes, executes them, and responds to any
   # necessary events.
   def evaluate
+    # Start logging.
+    Puppet::Util::Log.newdestination(@report)
+
     prepare
 
     Puppet.info "Applying configuration version '#{catalog.version}'" if catalog.version
 
-    @sorted_resources.each do |resource|
-      next if stop_processing?
-      if resource.is_a?(Puppet::Type::Component)
-        Puppet.warning "Somehow left a component in the relationship graph"
-        next
-      end
-      ret = nil
-      seconds = thinmark do
-        ret = eval_resource(resource)
+    begin
+      relationship_graph.traverse do |resource|
+        if resource.is_a?(Puppet::Type::Component)
+          Puppet.warning "Somehow left a component in the relationship graph"
+        else
+          seconds = thinmark { eval_resource(resource) }
+          resource.info "Evaluated in %0.2f seconds" % seconds if Puppet[:evaltrace] and @catalog.host_config?
+        end
       end
-
-      resource.info "valuated in %0.2f seconds" % seconds if Puppet[:evaltrace] and @catalog.host_config?
-      ret
+    ensure
+      # And then close the transaction log.
+      Puppet::Util::Log.close(@report)
     end
 
     Puppet.debug "Finishing transaction #{object_id}"
@@ -160,57 +131,87 @@ class Puppet::Transaction
     # enough to check the immediate dependencies, which is why we use
     # a tree from the reversed graph.
     found_failed = false
+
+
+    # When we introduced the :whit into the graph, to reduce the combinatorial
+    # explosion of edges, we also ended up reporting failures for containers
+    # like class and stage.  This is undesirable; while just skipping the
+    # output isn't perfect, it is RC-safe. --daniel 2011-06-07
+    suppress_report = (resource.class == Puppet::Type.type(:whit))
+
     relationship_graph.dependencies(resource).each do |dep|
       next unless failed?(dep)
-      resource.notice "Dependency #{dep} has failures: #{resource_status(dep).failed}"
       found_failed = true
+
+      # See above. --daniel 2011-06-06
+      unless suppress_report then
+        resource.notice "Dependency #{dep} has failures: #{resource_status(dep).failed}"
+      end
     end
 
     found_failed
   end
 
+  def eval_generate(resource)
+    raise Puppet::DevError,"Depthfirst resources are not supported by eval_generate" if resource.depthfirst?
+    begin
+      made = resource.eval_generate.uniq.reverse
+    rescue => detail
+      puts detail.backtrace if Puppet[:trace]
+      resource.err "Failed to generate additional resources using 'eval_generate: #{detail}"
+      return
+    end
+    made.each do |res|
+      begin
+        res.tag(*resource.tags)
+        @catalog.add_resource(res)
+        res.finish
+      rescue Puppet::Resource::Catalog::DuplicateResourceError
+        res.info "Duplicate generated resource; skipping"
+      end
+    end
+    sentinal = Puppet::Type::Whit.new(:name => "completed_#{resource.title}", :catalog => resource.catalog)
+    relationship_graph.adjacent(resource,:direction => :out,:type => :edges).each { |e|
+      add_conditional_directed_dependency(sentinal, e.target, e.label)
+      relationship_graph.remove_edge! e
+    }
+    default_label = Puppet::Resource::Catalog::Default_label
+    made.each do |res|
+      add_conditional_directed_dependency(made.find { |r| r != res && r.name == res.name[0,r.name.length]} || resource, res)
+      add_conditional_directed_dependency(res, sentinal, default_label)
+    end
+    add_conditional_directed_dependency(resource, sentinal, default_label)
+  end
+
   # A general method for recursively generating new resources from a
   # resource.
-  def generate_additional_resources(resource, method)
-    return [] unless resource.respond_to?(method)
+  def generate_additional_resources(resource)
+    return unless resource.respond_to?(:generate)
     begin
-      made = resource.send(method)
+      made = resource.generate
     rescue => detail
       puts detail.backtrace if Puppet[:trace]
-      resource.err "Failed to generate additional resources using '#{method}': #{detail}"
+      resource.err "Failed to generate additional resources using 'generate': #{detail}"
     end
-    return [] unless made
+    return unless made
     made = [made] unless made.is_a?(Array)
-    made.uniq.find_all do |res|
+    made.uniq.each do |res|
       begin
         res.tag(*resource.tags)
-        @catalog.add_resource(res) do |r|
-          r.finish
-          make_parent_child_relationship(resource, [r])
-
-          # Call 'generate' recursively
-          generate_additional_resources(r, method)
-        end
-        true
+        @catalog.add_resource(res)
+        res.finish
+        add_conditional_directed_dependency(resource, res)
+        generate_additional_resources(res)
       rescue Puppet::Resource::Catalog::DuplicateResourceError
         res.info "Duplicate generated resource; skipping"
-        false
       end
     end
   end
 
   # Collect any dynamically generated resources.  This method is called
   # before the transaction starts.
-  def generate
-    list = @catalog.vertices
-    newlist = []
-    while ! list.empty?
-      list.each do |resource|
-        newlist += generate_additional_resources(resource, :generate)
-      end
-      list = newlist
-      newlist = []
-    end
+  def xgenerate
+    @catalog.vertices.each { |resource| generate_additional_resources(resource) }
   end
 
   # Should we ignore tags?
@@ -220,10 +221,13 @@ class Puppet::Transaction
 
   # this should only be called by a Puppet::Type::Component resource now
   # and it should only receive an array
-  def initialize(catalog, report = nil)
+  def initialize(catalog)
     @catalog = catalog
-    @report = report || Report.new("apply", catalog.version)
+
+    @report = Puppet::Transaction::Report.new("apply")
+
     @event_manager = Puppet::Transaction::EventManager.new(self)
+
     @resource_harness = Puppet::Transaction::ResourceHarness.new(self)
   end
 
@@ -253,18 +257,75 @@ class Puppet::Transaction
   # Prepare to evaluate the resources in a transaction.
   def prepare
     # Now add any dynamically generated resources
-    generate
+    xgenerate
 
     # Then prefetch.  It's important that we generate and then prefetch,
     # so that any generated resources also get prefetched.
     prefetch
+  end
 
-    # This will throw an error if there are cycles in the graph.
-    @sorted_resources = relationship_graph.topsort
+
+  # We want to monitor changes in the relationship graph of our
+  # catalog but this is complicated by the fact that the catalog
+  # both is_a graph and has_a graph, by the fact that changes to
+  # the structure of the object can have adverse serialization
+  # effects, by threading issues, by order-of-initialization issues,
+  # etc.
+  #
+  # Since the proper lifetime/scope of the monitoring is a transaction
+  # and the transaction is already commiting a mild law-of-demeter
+  # transgression, we cut the Gordian knot here by simply wrapping the
+  # transaction's view of the resource graph to capture and maintain
+  # the information we need.  Nothing outside the transaction needs
+  # this information, and nothing outside the transaction can see it
+  # except via the Transaction#relationship_graph
+
+  class Relationship_graph_wrapper
+    attr_reader :real_graph,:transaction,:ready,:generated,:done,:unguessable_deterministic_key
+    def initialize(real_graph,transaction)
+      @real_graph = real_graph
+      @transaction = transaction
+      @ready = {}
+      @generated = {}
+      @done = {}
+      @unguessable_deterministic_key = Hash.new { |h,k| h[k] = Digest::SHA1.hexdigest("NaCl, MgSO4 (salts) and then #{k.title}") }
+      vertices.each { |v| check_if_now_ready(v) }
+    end
+    def method_missing(*args,&block)
+      real_graph.send(*args,&block)
+    end
+    def add_vertex(v)
+      real_graph.add_vertex(v)
+      check_if_now_ready(v) # ?????????????????????????????????????????
+    end
+    def add_edge(f,t,label=nil)
+      ready.delete(t)
+      real_graph.add_edge(f,t,label)
+    end
+    def check_if_now_ready(r)
+      ready[r] = true if direct_dependencies_of(r).all? { |r2| done[r2] }
+    end
+    def next_resource
+      ready.keys.sort_by { |r0| unguessable_deterministic_key[r0] }.first
+    end
+    def traverse(&block)
+      real_graph.report_cycles_in_graph
+      while (r = next_resource) && !transaction.stop_processing?
+        if !generated[r] && r.respond_to?(:eval_generate)
+          transaction.eval_generate(r)
+          generated[r] = true
+        else
+          ready.delete(r)
+          yield r
+          done[r] = true
+          direct_dependents_of(r).each { |v| check_if_now_ready(v) }
+        end
+      end
+    end
   end
 
   def relationship_graph
-    catalog.relationship_graph
+    @relationship_graph ||= Relationship_graph_wrapper.new(catalog.relationship_graph,self)
   end
 
   def add_resource_status(status)
@@ -287,9 +348,17 @@ class Puppet::Transaction
     elsif ! scheduled?(resource)
       resource.debug "Not scheduled"
     elsif failed_dependencies?(resource)
-      resource.warning "Skipping because of failed dependencies"
+      # When we introduced the :whit into the graph, to reduce the combinatorial
+      # explosion of edges, we also ended up reporting failures for containers
+      # like class and stage.  This is undesirable; while just skipping the
+      # output isn't perfect, it is RC-safe. --daniel 2011-06-07
+      unless resource.class == Puppet::Type.type(:whit) then
+        resource.warning "Skipping because of failed dependencies"
+      end
     elsif resource.virtual?
       resource.debug "Skipping because virtual"
+    elsif resource.appliable_to_device? ^ for_network_device
+      resource.debug "Skipping #{resource.appliable_to_device? ? 'device' : 'host'} resources because running on a #{for_network_device ? 'device' : 'host'}"
     else
       return false
     end