puppet 2.7.26 → 3.0.0.rc4

data/lib/puppet/network/authconfig.rb

@@ -3,11 +3,26 @@ require 'puppet/network/rights'
 
 module Puppet
   class ConfigurationError < Puppet::Error; end
-  class Network::AuthConfig < Puppet::Util::LoadedFile
-
-    def self.main
-      @main ||= self.new
-    end
+  class Network::AuthConfig
+
+    extend MonitorMixin
+    attr_accessor :rights
+
+    DEFAULT_ACL = [
+      { :acl => "~ ^\/catalog\/([^\/]+)$", :method => :find, :allow => '$1', :authenticated => true },
+      { :acl => "~ ^\/node\/([^\/]+)$", :method => :find, :allow => '$1', :authenticated => true },
+      # this one will allow all file access, and thus delegate
+      # to fileserver.conf
+      { :acl => "/file" },
+      { :acl => "/certificate_revocation_list/ca", :method => :find, :authenticated => true },
+      { :acl => "/report", :method => :save, :authenticated => true },
+      # These allow `auth any`, because if you can do them anonymously you
+      # should probably also be able to do them when trusted.
+      { :acl => "/certificate/ca", :method => :find, :authenticated => :any },
+      { :acl => "/certificate/", :method => :find, :authenticated => :any },
+      { :acl => "/certificate_request", :method => [:find, :save], :authenticated => :any },
+      { :acl => "/status", :method => [:find], :authenticated => true },
+    ]
 
     # Just proxy the setting methods to our rights stuff
     [:allow, :deny].each do |method|
@@ -16,159 +31,46 @@ module Puppet
       end
     end
 
-    # Here we add a little bit of semantics.  They can set auth on a whole
-    # namespace or on just a single method in the namespace.
-    def allowed?(request)
-      name        = request.call.intern
-      namespace   = request.handler.intern
-      method      = request.method.intern
-
-      read
-
-      if @rights.include?(name)
-        return @rights[name].allowed?(request.name, request.ip)
-      elsif @rights.include?(namespace)
-        return @rights[namespace].allowed?(request.name, request.ip)
-      end
-      false
-    end
-
-    # Does the file exist?  Puppetmasterd does not require it, but
-    # puppet agent does.
-    def exists?
-      FileTest.exists?(@file)
-    end
-
-    def initialize(file = nil, parsenow = true)
-      @file = file || Puppet[:authconfig]
-
-      raise Puppet::DevError, "No authconfig file defined" unless @file
-      return unless self.exists?
-      super(@file)
-      @rights = Puppet::Network::Rights.new
-      @configstamp = @configstatted = nil
-      @configtimeout = 60
-
-      read if parsenow
-    end
-
-    # Read the configuration file.
-    def read
-      return unless FileTest.exists?(@file)
-
-      if @configstamp
-        if @configtimeout and @configstatted
-          if Time.now - @configstatted > @configtimeout
-            @configstatted = Time.now
-            tmp = File.stat(@file).ctime
-
-            if tmp == @configstamp
-              return
-            else
-              Puppet.notice "#{tmp} vs #{@configstamp}"
-            end
-          else
-            return
-          end
-        else
-          Puppet.notice "#{@configtimeout} and #{@configstatted}"
+    # force regular ACLs to be present
+    def insert_default_acl
+      DEFAULT_ACL.each do |acl|
+        unless rights[acl[:acl]]
+          Puppet.info "Inserting default '#{acl[:acl]}' (auth #{acl[:authenticated]}) ACL"
+          mk_acl(acl)
         end
       end
-
-      parse
-
-      @configstamp = File.stat(@file).ctime
-      @configstatted = Time.now
+      # queue an empty (ie deny all) right for every other path
+      # actually this is not strictly necessary as the rights system
+      # denies not explicitely allowed paths
+      unless rights["/"]
+        rights.newright("/").restrict_authenticated(:any)
+      end
     end
 
-    private
+    def mk_acl(acl)
+      right = @rights.newright(acl[:acl])
+      right.allow(acl[:allow] || "*")
 
-    def parse
-      newrights = Puppet::Network::Rights.new
-      begin
-        File.open(@file) { |f|
-          right = nil
-          count = 1
-          f.each_line { |line|
-            case line
-            when /^\s*#/ # skip comments
-              count += 1
-              next
-            when /^\s*$/  # skip blank lines
-              count += 1
-              next
-            when /^(?:(\[[\w.]+\])|(path)\s+((?:~\s+)?[^ ]+))\s*$/ # "namespace" or "namespace.method" or "path /path" or "path ~ regex"
-              name = $1
-              name = $3 if $2 == "path"
-              name.chomp!
-              right = newrights.newright(name, count, @file)
-            when /^\s*(allow|deny|method|environment|auth(?:enticated)?)\s+(.+?)(\s*#.*)?$/
-              parse_right_directive(right, $1, $2, count)
-            else
-              raise ConfigurationError, "Invalid line #{count}: #{line}"
-            end
-            count += 1
-          }
-        }
-      rescue Errno::EACCES => detail
-        Puppet.err "Configuration error: Cannot read #{@file}; cannot serve"
-        #raise Puppet::Error, "Cannot read #{@config}"
-      rescue Errno::ENOENT => detail
-        Puppet.err "Configuration error: '#{@file}' does not exit; cannot serve"
-        #raise Puppet::Error, "#{@config} does not exit"
-      #rescue FileServerError => detail
-      #    Puppet.err "FileServer error: #{detail}"
+      if method = acl[:method]
+        method = [method] unless method.is_a?(Array)
+        method.each { |m| right.restrict_method(m) }
       end
-
-      # Verify each of the rights are valid.
-      # We let the check raise an error, so that it can raise an error
-      # pointing to the specific problem.
-      newrights.each { |name, right|
-        right.valid?
-      }
-      @rights = newrights
+      right.restrict_authenticated(acl[:authenticated]) unless acl[:authenticated].nil?
     end
 
-    def parse_right_directive(right, var, value, count)
-      value.strip!
-      case var
-      when "allow"
-        modify_right(right, :allow, value, "allowing %s access", count)
-      when "deny"
-        modify_right(right, :deny, value, "denying %s access", count)
-      when "method"
-        unless right.acl_type == :regex
-          raise ConfigurationError, "'method' directive not allowed in namespace ACL at line #{count} of #{@config}"
-        end
-        modify_right(right, :restrict_method, value, "allowing 'method' %s", count)
-      when "environment"
-        unless right.acl_type == :regex
-          raise ConfigurationError, "'environment' directive not allowed in namespace ACL at line #{count} of #{@config}"
-        end
-        modify_right(right, :restrict_environment, value, "adding environment %s", count)
-      when /auth(?:enticated)?/
-        unless right.acl_type == :regex
-          raise ConfigurationError, "'authenticated' directive not allowed in namespace ACL at line #{count} of #{@config}"
-        end
-        modify_right(right, :restrict_authenticated, value, "adding authentication %s", count)
-      else
-        raise ConfigurationError,
-          "Invalid argument '#{var}' at line #{count}"
+    # check whether this request is allowed in our ACL
+    # raise an Puppet::Network::AuthorizedError if the request
+    # is denied.
+    def check_authorization(indirection, method, key, params)
+      if authorization_failure_exception = @rights.is_request_forbidden_and_why?(indirection, method, key, params)
+        Puppet.warning("Denying access: #{authorization_failure_exception}")
+        raise authorization_failure_exception
       end
     end
 
-    def modify_right(right, method, value, msg, count)
-      value.split(/\s*,\s*/).each do |val|
-        begin
-          val.strip!
-          right.info msg % val
-          right.send(method, val)
-        rescue AuthStoreError => detail
-          raise ConfigurationError, "#{detail} at line #{count} of #{@file}"
-        end
-      end
+    def initialize(rights=nil)
+      @rights = rights || Puppet::Network::Rights.new
+      insert_default_acl
     end
-
   end
 end
-

data/lib/puppet/network/authorization.rb

@@ -1,75 +1,33 @@
 require 'puppet/network/client_request'
 require 'puppet/network/authconfig'
+require 'puppet/network/auth_config_parser'
 
 module Puppet::Network
-  # Most of our subclassing is just so that we can get
-  # access to information from the request object, like
-  # the client name and IP address.
-  class InvalidClientRequest < Puppet::Error; end
-  module Authorization
-    # Create our config object if necessary.  This works even if
-    # there's no configuration file.
-    def authconfig
-      @authconfig ||= Puppet::Network::AuthConfig.main
-
-      @authconfig
-    end
-
-    # Verify that our client has access.  We allow untrusted access to
-    # puppetca methods but no others.
-    def authorized?(request)
-      msg = "#{request.authenticated? ? "authenticated" : "unauthenticated"} client #{request} access to #{request.call}"
-
-      if request.authenticated?
-        if authconfig.exists?
-          if authconfig.allowed?(request)
-            Puppet.debug "Allowing #{msg}"
-            return true
-          else
-            Puppet.notice "Denying #{msg}"
-            return false
-          end
-        else
-          if Puppet.run_mode.master?
-            Puppet.debug "Allowing #{msg}"
-            return true
-          else
-            Puppet.notice "Denying #{msg}"
-            return false
-          end
-        end
-      else
-        if request.handler == "puppetca"
-          Puppet.notice "Allowing #{msg}"
-        else
-          Puppet.notice "Denying #{msg}"
-          return false
+  class AuthConfigLoader
+    # Create our config object if necessary. If there's no configuration file
+    # we install our defaults
+    def self.authconfig
+      @auth_config_file ||= Puppet::Util::LoadedFile.new(Puppet[:rest_authconfig])
+      if (not @auth_config) or @auth_config_file.changed?
+        begin
+          @auth_config = Puppet::Network::AuthConfigParser.new_from_file(Puppet[:rest_authconfig]).parse
+        rescue Errno::ENOENT, Errno::ENOTDIR
+          @auth_config = Puppet::Network::AuthConfig.new
         end
       end
+
+      @auth_config
     end
+  end
 
-    # Is this functionality available?
-    def available?(request)
-      if handler_loaded?(request.handler)
-        return true
-      else
-        Puppet.warning "Client #{request} requested unavailable functionality #{request.handler}"
-        return false
-      end
+  module Authorization
+    def authconfig
+      AuthConfigLoader.authconfig
     end
 
-    # Make sure that this method is available and authorized.
-    def verify(request)
-      unless available?(request)
-        raise InvalidClientRequest.new(
-          "Functionality #{request.handler} not available"
-        )
-      end
-      unless authorized?(request)
-        raise InvalidClientRequest.new(
-          "Host #{request} not authorized to call #{request.call}"
-        )
-      end
+    # Verify that our client has access.
+    def check_authorization(indirection, method, key, params)
+      authconfig.check_authorization(indirection, method, key, params)
     end
   end
 end

data/lib/puppet/network/authstore.rb

@@ -11,18 +11,6 @@ module Puppet
   class Network::AuthStore
     include Puppet::Util::Logging
 
-    # Mark a given pattern as allowed.
-    def allow(pattern)
-      # a simple way to allow anyone at all to connect
-      if pattern == "*"
-        @globalallow = true
-      else
-        store(:allow, pattern)
-      end
-
-      nil
-    end
-
     # Is a given combination of name and ip address allowed?  If either input
     # is non-nil, then both inputs must be provided.  If neither input
     # is provided, then the authstore is considered local and defaults to "true".
@@ -49,11 +37,31 @@ module Puppet
       false
     end
 
+    # Mark a given pattern as allowed.
+    def allow(pattern)
+      # a simple way to allow anyone at all to connect
+      if pattern == "*"
+        @globalallow = true
+      else
+        store(:allow, pattern)
+      end
+
+      nil
+    end
+
+    def allow_ip(pattern)
+      store(:allow_ip, pattern)
+    end
+
     # Deny a given pattern.
     def deny(pattern)
       store(:deny, pattern)
     end
 
+    def deny_ip(pattern)
+      store(:deny_ip, pattern)
+    end
+
     # Is global allow enabled?
     def globalallow?
       @globalallow
@@ -109,8 +117,8 @@ module Puppet
 
       # The type of declaration: either :allow or :deny
       attr_reader :type
+      VALID_TYPES = [ :allow, :deny, :allow_ip, :deny_ip ]
 
-      # The name: :ip or :domain
       attr_accessor :name
 
       # The pattern we're matching against.  Can be an IPAddr instance,
@@ -151,12 +159,7 @@ module Puppet
       # Does this declaration match the name/ip combo?
       def match?(name, ip)
         if ip?
-          if pattern.include?(IPAddr.new(ip))
-            Puppet.deprecation_warning "Authentication based on IP address is deprecated; please use certname-based rules instead"
-            true
-          else
-            false
-          end
+          pattern.include?(IPAddr.new(ip))
         else
           matchname?(name)
         end
@@ -164,13 +167,17 @@ module Puppet
 
       # Set the pattern appropriately.  Also sets the name and length.
       def pattern=(pattern)
-        parse(pattern)
+        if [:allow_ip, :deny_ip].include?(self.type)
+          parse_ip(pattern)
+        else
+          parse(pattern)
+        end
         @orig = pattern
       end
 
       # Mapping a type of statement into a return value.
       def result
-        type == :allow
+        [:allow, :allow_ip].include?(type)
       end
 
       def to_s
@@ -180,7 +187,7 @@ module Puppet
       # Set the declaration type.  Either :allow or :deny.
       def type=(type)
         type = type.intern
-        raise ArgumentError, "Invalid declaration type #{type}" unless [:allow, :deny].include?(type)
+        raise ArgumentError, "Invalid declaration type #{type}" unless VALID_TYPES.include?(type)
         @type = type
       end
 
@@ -235,16 +242,25 @@ module Puppet
       #     IP = "#{IPv4}|#{IPv6_full}|(#{IPv6_partial}#{IPv4})".gsub(/_/,'([0-9a-fA-F]{1,4})').gsub(/\(/,'(?:')
       # but ruby's ipaddr lib doesn't support the hybrid format
       IP = "#{IPv4}|#{IPv6_full}".gsub(/_/,'([0-9a-fA-F]{1,4})').gsub(/\(/,'(?:')
-      def parse(value)
-        @name,@exact,@length,@pattern = *case value
+
+      def parse_ip(value)
+        @name = :ip
+        @exact, @length, @pattern = *case value
         when /^(?:#{IP})\/(\d+)$/                                   # 12.34.56.78/24, a001:b002::efff/120, c444:1000:2000::9:192.168.0.1/112
-          [:ip,:inexact,$1.to_i,IPAddr.new(value)]
+          [:inexact, $1.to_i, IPAddr.new(value)]
         when /^(#{IP})$/                                          # 10.20.30.40,
-          [:ip,:exact,nil,IPAddr.new(value)]
+          [:exact, nil, IPAddr.new(value)]
         when /^(#{Octet}\.){1,3}\*$/                              # an ip address with a '*' at the end
           segments = value.split(".")[0..-2]
           bits = 8*segments.length
-          [:ip,:inexact,bits,IPAddr.new((segments+[0,0,0])[0,4].join(".") + "/#{bits}")]
+          [:inexact, bits, IPAddr.new((segments+[0,0,0])[0,4].join(".") + "/#{bits}")]
+        else
+          raise AuthStoreError, "Invalid IP pattern #{value}"
+        end
+      end
+
+      def parse(value)
+        @name,@exact,@length,@pattern = *case value
         when /^(\w[-\w]*\.)+[-\w]+$/                              # a full hostname
           # Change to /^(\w[-\w]*\.)+[-\w]+\.?$/ for FQDN support
           [:domain,:exact,nil,munge_name(value)]

data/lib/puppet/network/formats.rb

@@ -3,20 +3,12 @@ require 'puppet/network/format_handler'
 Puppet::Network::FormatHandler.create_serialized_formats(:yaml) do
   # Yaml doesn't need the class name; it's serialized.
   def intern(klass, text)
-    data = YAML.load(text, :safe => true, :deserialize_symbols => true)
-    return data if data.is_a?(klass)
-    klass.from_pson(data)
+    YAML.load(text)
   end
 
   # Yaml doesn't need the class name; it's serialized.
   def intern_multiple(klass, text)
-    YAML.load(text, :safe => true, :deserialize_symbols => true).collect do |data|
-      if data.is_a?(klass)
-        data
-      else
-        klass.from_pson(data)
-      end
-    end
+    YAML.load(text)
   end
 
   def render(instance)
@@ -53,15 +45,11 @@ Puppet::Network::FormatHandler.create_serialized_formats(:b64_zlib_yaml) do
   end
 
   def intern(klass, text)
-    requiring_zlib do
-      Puppet::Network::FormatHandler.format(:yaml).intern(klass, decode(text))
-    end
+    decode(text)
   end
 
   def intern_multiple(klass, text)
-    requiring_zlib do
-      Puppet::Network::FormatHandler.format(:yaml).intern_multiple(klass, decode(text))
-    end
+    decode(text)
   end
 
   def render(instance)
@@ -76,15 +64,17 @@ Puppet::Network::FormatHandler.create_serialized_formats(:b64_zlib_yaml) do
     true
   end
 
-  def decode(data)
-    Zlib::Inflate.inflate(Base64.decode64(data))
-  end
-
   def encode(text)
     requiring_zlib do
       Base64.encode64(Zlib::Deflate.deflate(text, Zlib::BEST_COMPRESSION))
     end
   end
+
+  def decode(yaml)
+    requiring_zlib do
+      YAML.load(Zlib::Inflate.inflate(Base64.decode64(yaml)))
+    end
+  end
 end
 
 Puppet::Network::FormatHandler.create(:s, :mime => "text/plain", :extension => "txt")