puppet 2.7.6 → 2.7.8

data/lib/puppet/application/agent.rb

@@ -423,9 +423,6 @@ Copyright (c) 2011 Puppet Labs, LLC Licensed under the Apache 2.0 License
 
     exit(Puppet.settings.print_configs ? 0 : 1) if Puppet.settings.print_configs?
 
-    # If noop is set, then also enable diffs
-    Puppet[:show_diff] = true if Puppet[:noop]
-
     args[:Server] = Puppet[:server]
     if options[:fqdn]
       args[:FQDN] = options[:fqdn]

data/lib/puppet/application/apply.rb

@@ -231,9 +231,6 @@ Copyright (c) 2011 Puppet Labs, LLC Licensed under the Apache 2.0 License
   def setup
     exit(Puppet.settings.print_configs ? 0 : 1) if Puppet.settings.print_configs?
 
-    # If noop is set, then also enable diffs
-    Puppet[:show_diff] = true if Puppet[:noop]
-
     Puppet::Util::Log.newdestination(:console) unless options[:logset]
     client = nil
     server = nil

data/lib/puppet/application/queue.rb

@@ -10,7 +10,6 @@ class Puppet::Application::Queue < Puppet::Application
     require 'puppet/daemon'
     @daemon = Puppet::Daemon.new
     @daemon.argv = ARGV.dup
-    Puppet::Util::Log.newdestination(:console)
 
     # Do an initial trap, so that cancels don't get a stack trace.
 
@@ -109,6 +108,26 @@ Copyright (c) 2011 Puppet Labs, LLC Licensed under the Apache 2.0 License
     HELP
   end
 
+  option("--logdest DEST", "-l DEST") do |arg|
+    begin
+      Puppet::Util::Log.newdestination(arg)
+      options[:setdest] = true
+    rescue => detail
+      puts detail.backtrace if Puppet[:debug]
+      $stderr.puts detail.to_s
+    end
+  end
+
+  option("--logdest DEST", "-l DEST") do |arg|
+    begin
+      Puppet::Util::Log.newdestination(arg)
+      options[:setdest] = true
+    rescue => detail
+      puts detail.backtrace if Puppet[:debug]
+      $stderr.puts detail.to_s
+    end
+  end
+
   def main
     require 'puppet/indirector/catalog/queue' # provides Puppet::Indirector::Queue.subscribe
     Puppet.notice "Starting puppetqd #{Puppet.version}"
@@ -139,6 +158,7 @@ Copyright (c) 2011 Puppet Labs, LLC Licensed under the Apache 2.0 License
         Puppet::Util::Log.level = :info
       end
     end
+    Puppet::Util::Log.newdestination(:syslog) unless options[:setdest]
   end
 
   def setup

data/lib/puppet/defaults.rb

@@ -109,8 +109,9 @@ module Puppet
     },
     :diff_args => ["-u", "Which arguments to pass to the diff command when printing differences between files."],
     :diff => ["diff", "Which diff command to use when printing differences between files."],
-    :show_diff => [false, "Whether to print a contextual diff when files are being replaced.  The diff
-      is printed on stdout, so this option is meaningless unless you are running Puppet interactively.
+    :show_diff => [false, "Whether to log and report a contextual diff when files are being replaced.  This causes
+      partial file contents to pass through Puppet's normal logging and reporting system, so this setting should be
+      used with caution if you are sending Puppet's reports to an insecure destination.
       This feature currently requires the `diff/lcs` Ruby library."],
     :daemonize => {
       :default => (Puppet.features.microsoft_windows? ? false : true),
@@ -135,7 +136,8 @@ module Puppet
       :desc => "The node facts terminus.",
       :hook => proc do |value|
         require 'puppet/node/facts'
-        if value.to_s == "rest"
+        # Cache to YAML if we're uploading facts away
+        if %w[rest inventory_service].include? value.to_s
           Puppet::Node::Facts.indirection.cache_class = :yaml
         end
       end
@@ -617,7 +619,7 @@ EOT
       it with the `--no-client` option."],
     :listen => [false, "Whether puppet agent should listen for
       connections.  If this is true, then puppet agent will accept incoming
-      REST API requests, subject to the default ACLs and the ACLs set in 
+      REST API requests, subject to the default ACLs and the ACLs set in
       the `rest_authconfig` file. Puppet agent can respond usefully to
       requests on the `run`, `facts`, `certificate`, and `resource` endpoints."],
     :ca_server => ["$server", "The server to use for certificate

data/lib/puppet/face/file/store.rb

@@ -11,7 +11,7 @@ Puppet::Face.define(:file, '0.0.1') do
     EOT
 
     when_invoked do |path, options|
-      file = Puppet::FileBucket::File.new(File.read(path))
+      file = Puppet::FileBucket::File.new(Puppet::Util.binread(path))
 
       Puppet::FileBucket::File.indirection.terminus_class = :file
       Puppet::FileBucket::File.indirection.save file

data/lib/puppet/feature/base.rb

@@ -22,9 +22,10 @@ Puppet.features.add(:microsoft_windows) do
     require 'win32/service'
     require 'win32ole'
     require 'win32/api'
+    require 'win32/taskscheduler'
     true
   rescue LoadError => err
-    warn "Cannot run on Microsoft Windows without the sys-admin, win32-process, win32-dir & win32-service gems: #{err}" unless Puppet.features.posix?
+    warn "Cannot run on Microsoft Windows without the sys-admin, win32-process, win32-dir, win32-service and win32-taskscheduler gems: #{err}" unless Puppet.features.posix?
   end
 end
 

data/lib/puppet/file_bucket/dipper.rb

@@ -31,7 +31,7 @@ class Puppet::FileBucket::Dipper
   # Back up a file to our bucket
   def backup(file)
     raise(ArgumentError, "File #{file} does not exist") unless ::File.exist?(file)
-    contents = ::File.read(file)
+    contents = Puppet::Util.binread(file)
     begin
       file_bucket_file = Puppet::FileBucket::File.new(contents, :bucket_path => @local_path)
       files_original_path = absolutize_path(file)
@@ -64,7 +64,7 @@ class Puppet::FileBucket::Dipper
   def restore(file,sum)
     restore = true
     if FileTest.exists?(file)
-      cursum = Digest::MD5.hexdigest(::File.read(file))
+      cursum = Digest::MD5.hexdigest(Puppet::Util.binread(file))
 
       # if the checksum has changed...
       # this might be extra effort
@@ -83,6 +83,7 @@ class Puppet::FileBucket::Dipper
           ::File.chmod(changed | 0200, file)
         end
         ::File.open(file, ::File::WRONLY|::File::TRUNC|::File::CREAT) { |of|
+          of.binmode
           of.print(newcontents)
         }
         ::File.chmod(changed, file) if changed

data/lib/puppet/file_serving/content.rb

@@ -41,6 +41,6 @@ class Puppet::FileServing::Content < Puppet::FileServing::Base
   end
 
   def to_raw
-    File.new(full_path, "r")
+    File.new(full_path, "rb")
   end
 end

data/lib/puppet/file_serving/metadata.rb

@@ -59,9 +59,12 @@ class Puppet::FileServing::Metadata < Puppet::FileServing::Base
       @path = path
     end
 
-    [:owner, :group, :mode].each do |method|
+    { :owner => 'S-1-5-32-544',
+      :group => 'S-1-0-0',
+      :mode => 0644
+    }.each do |method, default_value|
       define_method method do
-        Puppet::Util::Windows::Security.send("get_#{method}", @path)
+        Puppet::Util::Windows::Security.send("get_#{method}", @path) || default_value
       end
     end
   end

data/lib/puppet/indirector/facts/inventory_service.rb

@@ -0,0 +1,20 @@
+require 'puppet/node/facts'
+require 'puppet/indirector/rest'
+
+class Puppet::Node::Facts::InventoryService < Puppet::Indirector::REST
+  desc "Find and save facts about nodes using a remote inventory service."
+  use_server_setting(:inventory_server)
+  use_port_setting(:inventory_port)
+
+  # We don't want failing to upload to the inventory service to cause any
+  # failures, so we just suppress them and warn.
+  def save(request)
+    begin
+      super
+      true
+    rescue => e
+      Puppet.warning "Could not upload facts for #{request.key} to inventory service: #{e.to_s}"
+      false
+    end
+  end
+end

data/lib/puppet/indirector/file_bucket_file/file.rb

@@ -27,7 +27,7 @@ module Puppet::FileBucketFile
         raise "could not find diff_with #{request.options[:diff_with]}" unless ::File.exists?(file2_path)
         return `diff #{file_path.inspect} #{file2_path.inspect}`
       else
-        contents = ::File.read file_path
+        contents = Puppet::Util.binread(file_path)
         Puppet.info "FileBucket read #{checksum}"
         model.new(contents)
       end
@@ -83,6 +83,7 @@ module Puppet::FileBucketFile
         # Write the file to disk.
         Puppet::Util.withumask(0007) do
           ::File.open(filename, ::File::WRONLY|::File::CREAT, 0440) do |of|
+            of.binmode
             of.print bucket_file.contents
           end
           ::File.open(paths_path, ::File::WRONLY|::File::CREAT, 0640) do |of|
@@ -121,7 +122,7 @@ module Puppet::FileBucketFile
     # If conflict_check is enabled, verify that the passed text is
     # the same as the text in our file.
     def verify_identical_file!(bucket_file)
-      disk_contents = ::File.read(path_for(bucket_file.bucket_path, bucket_file.checksum_data, 'contents'))
+      disk_contents = Puppet::Util.binread(path_for(bucket_file.bucket_path, bucket_file.checksum_data, 'contents'))
 
       # If the contents don't match, then we've found a conflict.
       # Unlikely, but quite bad.

data/lib/puppet/indirector/report/processor.rb

@@ -26,7 +26,7 @@ class Puppet::Transaction::Report::Processor < Puppet::Indirector::Code
   # LAK:NOTE This isn't necessarily the best design, but it's backward
   # compatible and that's good enough for now.
   def process(report)
-    Puppet.debug "Recieved report to process from #{report.host}"
+    Puppet.debug "Received report to process from #{report.host}"
     processors do |mod|
       Puppet.debug "Processing report from #{report.host} with processor #{mod}"
       # We have to use a dup because we're including a module in the

data/lib/puppet/network/handler/filebucket.rb

@@ -1,6 +1,8 @@
 require 'fileutils'
 require 'digest/md5'
 require 'puppet/external/base64'
+require 'puppet/network/handler'
+require 'xmlrpc/server'
 
 class Puppet::Network::Handler # :nodoc:
   # Accept files and store them by md5 sum, returning the md5 sum back

data/lib/puppet/network/handler/fileserver.rb

@@ -4,7 +4,7 @@ require 'webrick/httpstatus'
 require 'cgi'
 require 'delegate'
 require 'sync'
-require 'xmlrpc/server'
+require 'puppet/network/handler'
 
 require 'puppet/network/handler'
 require 'puppet/network/xmlrpc/server'

data/lib/puppet/network/handler/master.rb

@@ -2,6 +2,7 @@ require 'openssl'
 require 'puppet'
 require 'xmlrpc/server'
 require 'yaml'
+require 'puppet/network/handler'
 
 class Puppet::Network::Handler
   class MasterError < Puppet::Error; end

data/lib/puppet/network/handler/report.rb

@@ -1,5 +1,7 @@
 require 'puppet/util/instance_loader'
 require 'puppet/reports'
+require 'puppet/network/handler'
+require 'xmlrpc/server'
 
 # A simple server for triggering a new run on a Puppet client.
 class Puppet::Network::Handler

data/lib/puppet/network/handler/runner.rb

@@ -1,5 +1,6 @@
 require 'puppet/run'
 require 'puppet/network/handler'
+require 'xmlrpc/server'
 
 class Puppet::Network::Handler
   class MissingMasterError < RuntimeError; end # Cannot find the master client

data/lib/puppet/network/handler/status.rb

@@ -1,3 +1,5 @@
+require 'puppet/network/handler'
+require 'xmlrpc/server'
 class Puppet::Network::Handler
   class Status < Handler
     desc "A simple interface for testing Puppet connectivity."

data/lib/puppet/network/http/mongrel/rest.rb

@@ -28,6 +28,8 @@ class Puppet::Network::HTTP::MongrelREST < Mongrel::HttpHandler
   # testing purposes.
   def params(request)
     params = Mongrel::HttpRequest.query_parse(request.params["QUERY_STRING"])
+    params.merge!(Mongrel::HttpRequest.query_parse(body(request))) if http_method(request).upcase == 'POST'
+
     params = decode_params(params)
     params.merge(client_info(request))
   end
@@ -41,7 +43,12 @@ class Puppet::Network::HTTP::MongrelREST < Mongrel::HttpHandler
 
   # return the request body
   def body(request)
-    request.body.read
+    body = request.body.read
+    # We rewind the body, since read on a StringIO is destructive, and
+    # subsequent reads will return an empty string.
+    request.body.rewind
+
+    body
   end
 
   def set_content_type(response, format)

data/lib/puppet/network/http_server.rb

@@ -0,0 +1,3 @@
+# Just a stub, so we can correctly scope other classes.
+module Puppet::Network::HTTPServer # :nodoc:
+end

data/lib/puppet/network/http_server/mongrel.rb

@@ -0,0 +1,129 @@
+#!/usr/bin/env ruby
+# File:       06-11-14-mongrel_xmlrpc.rb
+# Author:     Manuel Holtgrewe <purestorm at ggnore.net>
+#
+# Copyright (c) 2006 Manuel Holtgrewe, 2007 Luke Kanies
+#
+# This file is based heavily on a file retrieved from
+# http://ttt.ggnore.net/2006/11/15/xmlrpc-with-mongrel-and-ruby-off-rails/
+
+require 'rubygems'
+require 'mongrel'
+require 'xmlrpc/server'
+require 'puppet/network/xmlrpc/server'
+require 'puppet/network/http_server'
+require 'puppet/network/client_request'
+require 'puppet/network/handler'
+
+require 'resolv'
+
+# This handler can be hooked into Mongrel to accept HTTP requests. After
+# checking whether the request itself is sane, the handler forwards it
+# to an internal instance of XMLRPC::BasicServer to process it.
+#
+# You can access the server by calling the Handler's "xmlrpc_server"
+# attribute accessor method and add XMLRPC handlers there. For example:
+#
+# <pre>
+# handler = XmlRpcHandler.new
+# handler.xmlrpc_server.add_handler("my.add") { |a, b| a.to_i + b.to_i }
+# </pre>
+module Puppet::Network
+  class HTTPServer::Mongrel < ::Mongrel::HttpHandler
+    attr_reader :xmlrpc_server
+
+    def initialize(handlers)
+      if Puppet[:debug]
+        $mongrel_debug_client = true
+        Puppet.debug 'Mongrel client debugging enabled. [$mongrel_debug_client = true].'
+      end
+      # Create a new instance of BasicServer. We are supposed to subclass it
+      # but that does not make sense since we would not introduce any new
+      # behaviour and we have to subclass Mongrel::HttpHandler so our handler
+      # works for Mongrel.
+      @xmlrpc_server = Puppet::Network::XMLRPCServer.new
+      handlers.each do |name|
+        unless handler = Puppet::Network::Handler.handler(name)
+          raise ArgumentError, "Invalid handler #{name}"
+        end
+        @xmlrpc_server.add_handler(handler.interface, handler.new({}))
+      end
+    end
+
+    # This method produces the same results as XMLRPC::CGIServer.serve
+    # from Ruby's stdlib XMLRPC implementation.
+    def process(request, response)
+      # Make sure this has been a POST as required for XMLRPC.
+      request_method = request.params[Mongrel::Const::REQUEST_METHOD] || Mongrel::Const::GET
+      if request_method != "POST"
+        response.start(405) { |head, out| out.write("Method Not Allowed") }
+        return
+      end
+
+      # Make sure the user has sent text/xml data.
+      request_mime = request.params["CONTENT_TYPE"] || "text/plain"
+      if parse_content_type(request_mime).first != "text/xml"
+        response.start(400) { |head, out| out.write("Bad Request") }
+        return
+      end
+
+      # Make sure there is data in the body at all.
+      length = request.params[Mongrel::Const::CONTENT_LENGTH].to_i
+      if length <= 0
+        response.start(411) { |head, out| out.write("Length Required") }
+        return
+      end
+
+      # Check the body to be valid.
+      if request.body.nil? or request.body.size != length
+        response.start(400) { |head, out| out.write("Bad Request") }
+        return
+      end
+
+      info = client_info(request)
+
+      # All checks above passed through
+      response.start(200) do |head, out|
+        head["Content-Type"] = "text/xml; charset=utf-8"
+        begin
+          out.write(@xmlrpc_server.process(request.body, info))
+        rescue => detail
+          puts detail.backtrace
+          raise
+        end
+      end
+    end
+
+    private
+
+    def client_info(request)
+      params = request.params
+      ip = params["HTTP_X_FORWARDED_FOR"] ? params["HTTP_X_FORWARDED_FOR"].split(',').last.strip : params["REMOTE_ADDR"]
+      # JJM #906 The following dn.match regular expression is forgiving
+      # enough to match the two Distinguished Name string contents
+      # coming from Apache, Pound or other reverse SSL proxies.
+      if dn = params[Puppet[:ssl_client_header]] and dn_matchdata = dn.match(/^.*?CN\s*=\s*(.*)/)
+        client = dn_matchdata[1].to_str
+        valid = (params[Puppet[:ssl_client_verify_header]] == 'SUCCESS')
+      else
+        begin
+          client = Resolv.getname(ip)
+        rescue => detail
+          Puppet.err "Could not resolve #{ip}: #{detail}"
+          client = "unknown"
+        end
+        valid = false
+      end
+
+      info = Puppet::Network::ClientRequest.new(client, ip, valid)
+
+      info
+    end
+
+    # Taken from XMLRPC::ParseContentType
+    def parse_content_type(str)
+      a, *b = str.split(";")
+      return a.strip, *b
+    end
+  end
+end

data/lib/puppet/network/rest_authconfig.rb

@@ -14,9 +14,11 @@ module Puppet
       { :acl => "/file" },
       { :acl => "/certificate_revocation_list/ca", :method => :find, :authenticated => true },
       { :acl => "/report", :method => :save, :authenticated => true },
-      { :acl => "/certificate/ca", :method => :find, :authenticated => false },
-      { :acl => "/certificate/", :method => :find, :authenticated => false },
-      { :acl => "/certificate_request", :method => [:find, :save], :authenticated => false },
+      # These allow `auth any`, because if you can do them anonymously you
+      # should probably also be able to do them when trusted.
+      { :acl => "/certificate/ca", :method => :find, :authenticated => :any },
+      { :acl => "/certificate/", :method => :find, :authenticated => :any },
+      { :acl => "/certificate_request", :method => [:find, :save], :authenticated => :any },
       { :acl => "/status", :method => [:find], :authenticated => true },
     ]
 
@@ -65,9 +67,15 @@ module Puppet
 
     # force regular ACLs to be present
     def insert_default_acl
+      if exists? then
+        reason = "none were found in '#{@file}'"
+      else
+        reason = "#{Puppet[:rest_authconfig]} doesn't exist"
+      end
+
       DEFAULT_ACL.each do |acl|
         unless rights[acl[:acl]]
-          Puppet.info "Inserting default '#{acl[:acl]}'(#{acl[:authenticated] ? "auth" : "non-auth"}) ACL because #{( !exists? ? "#{Puppet[:rest_authconfig]} doesn't exist" : "none were found in '#{@file}'")}"
+          Puppet.info "Inserting default '#{acl[:acl]}' (auth #{acl[:authenticated]}) ACL because #{reason}"
           mk_acl(acl)
         end
       end