puppet 2.7.26 → 3.0.0.rc4

data/lib/puppet/network/http_pool.rb

@@ -1,57 +1,19 @@
-require 'puppet/ssl/host'
-require 'net/https'
+require 'puppet/network/http/connection'
 
 module Puppet::Network; end
 
+# This class is basically a placeholder for managing a pool of HTTP connections;
+# at present it does not actually attempt to pool them.  Historically, it did
+# attempt to do so, but this didn't work well based on Puppet's threading model.
+# The pooling functionality has been removed, but this abstraction is still here
+# because the API is used in various places and because it could be useful
+# should we decide to implement pooling at some point in the future.
 module Puppet::Network::HttpPool
-  # Use the global localhost instance.
-  def self.ssl_host
-    Puppet::SSL::Host.localhost
-  end
-
-  # Use cert information from a Puppet client to set up the http object.
-  def self.cert_setup(http)
-    if FileTest.exist?(Puppet[:hostcert]) and FileTest.exist?(Puppet[:localcacert])
-      http.cert_store  = ssl_host.ssl_store
-      http.ca_file     = Puppet[:localcacert]
-      http.cert        = ssl_host.certificate.content
-      http.verify_mode = OpenSSL::SSL::VERIFY_PEER
-      http.key         = ssl_host.key.content
-    else
-      # We don't have the local certificates, so we don't do any verification
-      # or setup at this early stage.  REVISIT: Shouldn't we supply the local
-      # certificate details if we have them?  The original code didn't.
-      # --daniel 2012-06-03
-
-      # Ruby 1.8 defaulted to this, but 1.9 defaults to peer verify, and we
-      # almost always talk to a dedicated, not-standard CA that isn't trusted
-      # out of the box.  This forces the expected state.
-      http.verify_mode = OpenSSL::SSL::VERIFY_NONE
-    end
-  end
 
   # Retrieve a cached http instance if caching is enabled, else return
   # a new one.
-  def self.http_instance(host, port, reset = false)
-    args = [host, port]
-    if Puppet[:http_proxy_host] == "none"
-      args << nil << nil
-    else
-      args << Puppet[:http_proxy_host] << Puppet[:http_proxy_port]
-    end
-    http = Net::HTTP.new(*args)
-
-    # Pop open the http client a little; older versions of Net::HTTP(s) didn't
-    # give us a reader for ca_file... Grr...
-    class << http; attr_accessor :ca_file; end
-
-    http.use_ssl = true
-    # Use configured timeout (#1176)
-    http.read_timeout = Puppet[:configtimeout]
-    http.open_timeout = Puppet[:configtimeout]
-
-    cert_setup(http)
-
-    http
+  def self.http_instance(host, port, use_ssl = true)
+    Puppet::Network::HTTP::Connection.new(host, port, use_ssl)
   end
+
 end

data/lib/puppet/network/resolver.rb

@@ -0,0 +1,85 @@
+require 'resolv'
+module Puppet::Network; end
+
+module Puppet::Network::Resolver
+  # Iterate through the list of servers that service this hostname
+  # and yield each server/port since SRV records have ports in them
+  # It will override whatever masterport setting is already set.
+  def self.each_srv_record(domain, service_name = :puppet, &block)
+    if (domain.nil? or domain.empty?)
+      Puppet.debug "Domain not known; skipping SRV lookup"
+      return
+    end
+
+    Puppet.debug "Searching for SRV records for domain: #{domain}"
+
+    case service_name
+      when :puppet then service = '_x-puppet'
+      when :ca     then service = '_x-puppet-ca'
+      when :report then service = '_x-puppet-report'
+      when :file   then service = '_x-puppet-fileserver'
+    end
+    srv_record = "#{service}._tcp.#{domain}"
+
+    resolver = Resolv::DNS.new
+    records = resolver.getresources(srv_record, Resolv::DNS::Resource::IN::SRV)
+    Puppet.debug "Found #{records.size} SRV records for: #{srv_record}"
+
+    if records.size == 0 && service_name != :puppet
+      # Try the generic :puppet service if no SRV records were found
+      # for the specific service.
+      each_srv_record(domain, :puppet, &block)
+    else
+      each_priority(records) do |priority, records|
+        while next_rr = records.delete(find_weighted_server(records))
+          Puppet.debug "Yielding next server of #{next_rr.target.to_s}:#{next_rr.port}"
+          yield next_rr.target.to_s, next_rr.port
+        end
+      end
+    end
+  end
+
+  private
+
+  def self.each_priority(records)
+    pri_hash = records.inject({}) do |groups, element|
+      groups[element.priority] ||= []
+      groups[element.priority] << element
+      groups
+    end
+
+    pri_hash.keys.sort.each do |key|
+      yield key, pri_hash[key]
+    end
+  end
+
+  def self.find_weighted_server(records)
+    return nil if records.nil? || records.empty?
+    return records.first if records.size == 1
+
+    # Calculate the sum of all weights in the list of resource records,
+    # This is used to then select hosts until the weight exceeds what
+    # random number we selected.  For example, if we have weights of 1 8 and 3:
+    #
+    # |-|---|--------|
+    #        ^
+    # We generate a random number 5, and iterate through the records, adding
+    # the current record's weight to the accumulator until the weight of the
+    # current record plus previous records is greater than the random number.
+
+    total_weight = records.inject(0) { |sum,record|
+      sum + weight(record)
+    }
+    current_weight = 0
+    chosen_weight  = 1 + Kernel.rand(total_weight)
+
+    records.each do |record|
+      current_weight += weight(record)
+      return record if current_weight >= chosen_weight
+    end
+  end
+
+  def self.weight(record)
+    record.weight == 0 ? 1 : record.weight * 10
+  end
+end

data/lib/puppet/network/rights.rb

@@ -6,24 +6,8 @@ module Puppet::Network
 # this exception is thrown when a request is not authenticated
 class AuthorizationError < Puppet::Error; end
 
-# Define a set of rights and who has access to them.
-# There are two types of rights:
-#  * named rights (ie a common string)
-#  * path based rights (which are matched on a longest prefix basis)
+# Rights class manages a list of ACLs for paths.
 class Rights
-
-  # We basically just proxy directly to our rights.  Each Right stores
-  # its own auth abilities.
-  [:allow, :deny, :restrict_method, :restrict_environment, :restrict_authenticated].each do |method|
-    define_method(method) do |name, *args|
-      if obj = self[name]
-        obj.send(method, *args)
-      else
-        raise ArgumentError, "Unknown right '#{name}'"
-      end
-    end
-  end
-
   # Check that name is allowed or not
   def allowed?(name, *args)
     !is_forbidden_and_why?(name, :node => args[0], :ip => args[1])
@@ -67,25 +51,21 @@ class Rights
       found
     end
 
-    # if we end here, then that means we either didn't match
-    # or failed, in any case will throw an error to the outside world
-    if name =~ /^\// or right
-      # we're a patch ACL, let's fail
-      msg = "#{(args[:node].nil? ? args[:ip] : "#{args[:node]}(#{args[:ip]})")} access to #{name} [#{args[:method]}]"
+    # if we end up here, then that means we either didn't match or failed, in any
+    # case will return an error to the outside world
+    host_description = args[:node] ? "#{args[:node]}(#{args[:ip]})" : args[:ip]
 
-      msg += " authenticated " if args[:authenticated]
+    msg = "#{host_description} access to #{name} [#{args[:method]}]"
 
-      error = AuthorizationError.new("Forbidden request: #{msg}")
-      if right
-        error.file = right.file
-        error.line = right.line
-      end
-    else
-      # there were no rights allowing/denying name
-      # if name is not a path, let's throw
-      raise ArgumentError, "Unknown namespace right '#{name}'"
+    if args[:authenticated]
+      msg += " authenticated "
+    end
+
+    if right
+      msg += " at #{right.file}:#{right.line}"
     end
-    error
+
+    AuthorizationError.new("Forbidden request: #{msg}")
   end
 
   def initialize
@@ -96,6 +76,10 @@ class Rights
     @rights.find { |acl| acl == name }
   end
 
+  def empty?
+    @rights.empty?
+  end
+
   def include?(name)
     @rights.include?(name)
   end
@@ -112,18 +96,10 @@ class Rights
   private
 
   def add_right(right)
-    if right.acl_type == :name and include?(right.key)
-      raise ArgumentError, "Right '%s' already exists"
-    end
     @rights << right
-    sort_rights
     right
   end
 
-  def sort_rights
-    @rights.sort!
-  end
-
   # Retrieve a right by name.
   def right(name)
     self[name]
@@ -131,7 +107,9 @@ class Rights
 
   # A right.
   class Right < Puppet::Network::AuthStore
-    attr_accessor :name, :key, :acl_type
+    attr_accessor :name, :key
+    # Overriding Object#methods sucks for debugging. If we're in here in the
+    # future, it would be nice to rename Right#methods
     attr_accessor :methods, :environment, :authentication
     attr_accessor :line, :file
 
@@ -146,26 +124,18 @@ class Rights
       @name = name
       @line = line || 0
       @file = file
+      @methods = ALL
 
       case name
-      when Symbol
-        @acl_type = :name
-        @key = name
-      when /^\[(.+)\]$/
-        @acl_type = :name
-        @key = $1.intern if name.is_a?(String)
       when /^\//
-        @acl_type = :regex
         @key = Regexp.new("^" + Regexp.escape(name))
-        @methods = ALL
       when /^~/ # this is a regex
-        @acl_type = :regex
         @name = name.gsub(/^~\s+/,'')
         @key = Regexp.new(@name)
-        @methods = ALL
       else
         raise ArgumentError, "Unknown right type '#{name}'"
       end
+
       super()
     end
 
@@ -178,25 +148,25 @@ class Rights
       true
     end
 
-    def regex?
-      acl_type == :regex
-    end
-
     # does this right is allowed for this triplet?
     # if this right is too restrictive (ie we don't match this access method)
     # then return :dunno so that upper layers have a chance to try another right
     # tailored to the given method
     def allowed?(name, ip, args = {})
-      return :dunno if acl_type == :regex and not @methods.include?(args[:method])
-      return :dunno if acl_type == :regex and @environment.size > 0 and not @environment.include?(args[:environment])
-      return :dunno if acl_type == :regex and not @authentication.nil? and args[:authenticated] != @authentication
+      if not @methods.include?(args[:method])
+        return :dunno
+      elsif @environment.size > 0 and not @environment.include?(args[:environment])
+        return :dunno
+      elsif (@authentication and not args[:authenticated])
+        return :dunno
+      end
 
       begin
         # make sure any capture are replaced if needed
-        interpolate(args[:match]) if acl_type == :regex and args[:match]
+        interpolate(args[:match]) if args[:match]
         res = super(name,ip)
       ensure
-        reset_interpolation if acl_type == :regex
+        reset_interpolation
       end
       res
     end
@@ -228,10 +198,8 @@ class Rights
       case authentication
       when "yes", "on", "true", true
         authentication = true
-      when "no", "off", "false", false
+      when "no", "off", "false", false, "all" ,"any", :all, :any
         authentication = false
-      when "all","any", :all, :any
-        authentication = nil
       else
         raise ArgumentError, "'#{name}' incorrect authenticated value: #{authentication}"
       end
@@ -239,37 +207,13 @@ class Rights
     end
 
     def match?(key)
-      # if we are a namespace compare directly
-      return self.key == namespace_to_key(key) if acl_type == :name
-
       # otherwise match with the regex
       self.key.match(key)
     end
 
-    def namespace_to_key(key)
-      key = key.intern if key.is_a?(String)
-      key
-    end
-
-    # this is where all the magic happens.
-    # we're sorting the rights array with this scheme:
-    #  * namespace rights are all in front
-    #  * regex path rights are then all queued in file order
-    def <=>(rhs)
-      # move namespace rights at front
-      return self.acl_type == :name ? -1 : 1 if self.acl_type != rhs.acl_type
-
-      # sort by creation order (ie first match appearing in the file will win)
-      # that is don't sort, in which case the sort algorithm will order in the
-      # natural array order (ie the creation order)
-      0
-    end
-
     def ==(name)
-      return(acl_type == :name ? self.key == namespace_to_key(name) : self.name == name.gsub(/^~\s+/,''))
+      self.name == name.gsub(/^~\s+/,'')
     end
-
   end
-
 end
 end

data/lib/puppet/network/server.rb

@@ -2,7 +2,10 @@ require 'puppet/network/http'
 require 'puppet/util/pidlock'
 
 class Puppet::Network::Server
-  attr_reader :server_type, :protocols, :address, :port
+  attr_reader :server_type, :address, :port
+
+  # TODO: does anything actually call this?  It seems like it's a duplicate of
+  # the code in Puppet::Daemon, but that it's not actually called anywhere.
 
   # Put the daemon into the background.
   def daemonize
@@ -16,30 +19,23 @@ class Puppet::Network::Server
 
     Process.setsid
     Dir.chdir("/")
-    begin
-      $stdin.reopen "/dev/null"
-      $stdout.reopen "/dev/null", "a"
-      $stderr.reopen $stdout
-      Puppet::Util::Log.reopen
-    rescue => detail
-      Puppet::Util.replace_file("/tmp/daemonout", 0644) { |f|
-        f.puts "Could not start #{Puppet[:name]}: #{detail}"
-      }
-      raise "Could not start #{Puppet[:name]}: #{detail}"
-    end
+  end
+
+  def close_streams()
+    Puppet::Daemon.close_streams()
   end
 
   # Create a pidfile for our daemon, so we can be stopped and others
   # don't try to start.
   def create_pidfile
-    Puppet::Util.synchronize_on(Puppet[:name],Sync::EX) do
+    Puppet::Util.synchronize_on(Puppet.run_mode.name,Sync::EX) do
       raise "Could not create PID file: #{pidfile}" unless Puppet::Util::Pidlock.new(pidfile).lock
     end
   end
 
   # Remove the pid file for our daemon.
   def remove_pidfile
-    Puppet::Util.synchronize_on(Puppet[:name],Sync::EX) do
+    Puppet::Util.synchronize_on(Puppet.run_mode.name,Sync::EX) do
       Puppet::Util::Pidlock.new(pidfile).unlock
     end
   end
@@ -50,7 +46,7 @@ class Puppet::Network::Server
   end
 
   def initialize(args = {})
-    valid_args = [:handlers, :xmlrpc_handlers, :port]
+    valid_args = [:handlers, :port]
     bad_args = args.keys.find_all { |p| ! valid_args.include?(p) }.collect { |p| p.to_s }.join(",")
     raise ArgumentError, "Invalid argument(s) #{bad_args}" unless bad_args == ""
     @server_type = Puppet[:servertype] or raise "No servertype configuration found."  # e.g.,  WEBrick, Mongrel, etc.
@@ -59,15 +55,12 @@ class Puppet::Network::Server
     @port = args[:port] || Puppet[:masterport] || raise(ArgumentError, "Must specify :port or configure Puppet :masterport")
     @address = determine_bind_address
 
-    @protocols = [ :rest, :xmlrpc ]
     @listening = false
     @routes = {}
-    @xmlrpc_routes = {}
     self.register(args[:handlers]) if args[:handlers]
-    self.register_xmlrpc(args[:xmlrpc_handlers]) if args[:xmlrpc_handlers]
 
     # Make sure we have all of the directories we need to function.
-    Puppet.settings.use(:main, :ssl, Puppet[:name])
+    Puppet.settings.use(:main, :ssl, :application)
   end
 
   # Register handlers for REST networking, based on the Indirector.
@@ -93,29 +86,6 @@ class Puppet::Network::Server
     end
   end
 
-  # Register xmlrpc handlers for backward compatibility.
-  def register_xmlrpc(*namespaces)
-    raise ArgumentError, "XMLRPC namespaces are required." if namespaces.empty?
-    namespaces.flatten.each do |name|
-      Puppet::Network::Handler.handler(name) || raise(ArgumentError, "Cannot locate XMLRPC handler for namespace '#{name}'.")
-      @xmlrpc_routes[name.to_sym] = true
-    end
-  end
-
-  # Unregister xmlrpc handlers.
-  def unregister_xmlrpc(*namespaces)
-    raise "Cannot unregister xmlrpc handlers while server is listening." if listening?
-    namespaces = @xmlrpc_routes.keys if namespaces.empty?
-
-    namespaces.flatten.each do |i|
-      raise(ArgumentError, "XMLRPC handler '#{i}' is unknown.") unless @xmlrpc_routes[i.to_sym]
-    end
-
-    namespaces.flatten.each do |i|
-      @xmlrpc_routes.delete(i.to_sym)
-    end
-  end
-
   def listening?
     @listening
   end
@@ -123,7 +93,7 @@ class Puppet::Network::Server
   def listen
     raise "Cannot listen -- already listening." if listening?
     @listening = true
-    http_server.listen(:address => address, :port => port, :handlers => @routes.keys, :xmlrpc_handlers => @xmlrpc_routes.keys, :protocols => protocols)
+    http_server.listen(:address => address, :port => port, :handlers => @routes.keys)
   end
 
   def unlisten
@@ -138,6 +108,7 @@ class Puppet::Network::Server
 
   def start
     create_pidfile
+    close_streams if Puppet[:daemonize]
     listen
   end