puppet 2.7.9 → 2.7.11

data/lib/puppet/type/file/source.rb

@@ -132,6 +132,10 @@ module Puppet
         next if metadata_method == :checksum and metadata.ftype == "directory"
         next if metadata_method == :checksum and metadata.ftype == "link" and metadata.links == :manage
 
+        if Puppet.features.microsoft_windows?
+          next if [:owner, :group].include?(metadata_method) and !local?
+        end
+
         if resource[param_name].nil? or resource[param_name] == :absent
           resource[param_name] = metadata.send(metadata_method)
         end

data/lib/puppet/type/host.rb

@@ -7,12 +7,26 @@ module Puppet
     newproperty(:ip) do
       desc "The host's IP address, IPv4 or IPv6."
 
-      validate do |value|
-        unless value =~ /^((([0-9a-fA-F]+:){7}[0-9a-fA-F]+)|(([0-9a-fA-F]+:)*[0-9a-fA-F]+)?::(([0-9a-fA-F]+:)*[0-9a-fA-F]+)?)|((25[0-5]|2[0-4][\d]|[0-1]?\d?\d)(\.(25[0-5]|2[0-4]\d|[0-1]?\d?\d)){3})$/
-          raise Puppet::Error, "Invalid IP address"
+
+      def valid_v4?(addr)
+        if /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/ =~ addr
+          return $~.captures.all? {|i| i = i.to_i; i >= 0 and i <= 255 }
         end
+        return false
       end
 
+      def valid_v6?(addr)
+        # http://forums.dartware.com/viewtopic.php?t=452
+        # ...and, yes, it is this hard.  Doing it programatically is harder.
+        return true if addr =~ /^\s*((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){5}(((:[0-9A-Fa-f]{1,4}){1,2})|:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){4}(((:[0-9A-Fa-f]{1,4}){1,3})|((:[0-9A-Fa-f]{1,4})?:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){3}(((:[0-9A-Fa-f]{1,4}){1,4})|((:[0-9A-Fa-f]{1,4}){0,2}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){2}(((:[0-9A-Fa-f]{1,4}){1,5})|((:[0-9A-Fa-f]{1,4}){0,3}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){1}(((:[0-9A-Fa-f]{1,4}){1,6})|((:[0-9A-Fa-f]{1,4}){0,4}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(:(((:[0-9A-Fa-f]{1,4}){1,7})|((:[0-9A-Fa-f]{1,4}){0,5}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:)))(%.+)?\s*$/
+
+        return false
+      end
+
+      validate do |value|
+        return true if valid_v4?(value) or valid_v6?(value)
+        raise Puppet::Error, "Invalid IP address #{value.inspect}"
+      end
     end
 
     # for now we use OrderedList to indicate that the order does matter.

data/lib/puppet/type/k5login.rb

@@ -1,4 +1,5 @@
 # Plug-in type for handling k5login files
+require 'puppet/util'
 
 Puppet::Type.newtype(:k5login) do
   @doc = "Manage the `.k5login` file for a user.  Specify the full path to
@@ -79,8 +80,8 @@ Puppet::Type.newtype(:k5login) do
 
     private
     def write(value)
-      Puppet::Util.secure_open(@resource[:name], "w") do |f|
-        f.puts value.join("\n")
+      Puppet::Util.replace_file(@resource[:name], 0644) do |f|
+        f.puts value
       end
     end
   end

data/lib/puppet/type/schedule.rb

@@ -81,7 +81,8 @@ module Puppet
             }
 
         This is mostly useful for restricting certain resources to being
-        applied in maintenance windows or during off-peak hours.
+        applied in maintenance windows or during off-peak hours. Multiple
+        ranges can be applied in array context.
       EOT
 
       # This is lame; properties all use arrays as values, but parameters don't.
@@ -178,7 +179,7 @@ module Puppet
 
           #self.info limits.inspect
           #self.notice now
-          return now.between?(*limits)
+          return true if now.between?(*limits)
         end
 
         # Else, return false, since our current time isn't between

data/lib/puppet/util.rb

@@ -2,12 +2,13 @@
 
 require 'English'
 require 'puppet/util/monkey_patches'
-require 'sync'
-require 'tempfile'
 require 'puppet/external/lock'
-require 'monitor'
 require 'puppet/util/execution_stub'
 require 'uri'
+require 'sync'
+require 'monitor'
+require 'tempfile'
+require 'pathname'
 
 module Puppet
   # A command failed to execute.
@@ -314,8 +315,7 @@ module Util
 
         3.upto(256){|fd| IO::new(fd).close rescue nil}
 
-        Puppet::Util::SUIDManager.change_group(arguments[:gid], true) if arguments[:gid]
-        Puppet::Util::SUIDManager.change_user(arguments[:uid], true)  if arguments[:uid]
+        Puppet::Util::SUIDManager.change_privileges(arguments[:uid], arguments[:gid], true)
 
         ENV['LANG'] = ENV['LC_ALL'] = ENV['LC_MESSAGES'] = ENV['LANGUAGE'] = 'C'
         Kernel.exec(*command)
@@ -481,33 +481,89 @@ module Util
 
   module_function :memory, :thinmark
 
-  def secure_open(file,must_be_w,&block)
-    raise Puppet::DevError,"secure_open only works with mode 'w'" unless must_be_w == 'w'
-    raise Puppet::DevError,"secure_open only requires a block"    unless block_given?
-    Puppet.warning "#{file} was a symlink to #{File.readlink(file)}" if File.symlink?(file)
-    if File.exists?(file) or File.symlink?(file)
-      wait = File.symlink?(file) ? 5.0 : 0.1
-      File.delete(file)
-      sleep wait # give it a chance to reappear, just in case someone is actively trying something.
-    end
-    begin
-      File.open(file,File::CREAT|File::EXCL|File::TRUNC|File::WRONLY,&block)
-    rescue Errno::EEXIST
-      desc = File.symlink?(file) ? "symlink to #{File.readlink(file)}" : File.stat(file).ftype
-      puts "Warning: #{file} was apparently created by another process (as"
-      puts "a #{desc}) as soon as it was deleted by this process.  Someone may be trying"
-      puts "to do something objectionable (such as tricking you into overwriting system"
-      puts "files if you are running as root)."
-      raise
-    end
-  end
-  module_function :secure_open
-
   # Because IO#binread is only available in 1.9
   def binread(file)
     File.open(file, 'rb') { |f| f.read }
   end
   module_function :binread
+
+  # Replace a file, securely.  This takes a block, and passes it the file
+  # handle of a file open for writing.  Write the replacement content inside
+  # the block and it will safely replace the target file.
+  #
+  # This method will make no changes to the target file until the content is
+  # successfully written and the block returns without raising an error.
+  #
+  # As far as possible the state of the existing file, such as mode, is
+  # preserved.  This works hard to avoid loss of any metadata, but will result
+  # in an inode change for the file.
+  #
+  # Arguments: `filename`, `default_mode`
+  #
+  # The filename is the file we are going to replace.
+  #
+  # The default_mode is the mode to use when the target file doesn't already
+  # exist; if the file is present we copy the existing mode/owner/group values
+  # across.
+  def replace_file(file, default_mode, &block)
+    raise Puppet::DevError, "replace_file requires a block" unless block_given?
+    raise Puppet::DevError, "replace_file is non-functional on Windows" if Puppet.features.microsoft_windows?
+
+    file     = Pathname(file)
+    tempfile = Tempfile.new(file.basename.to_s, file.dirname.to_s)
+
+    file_exists = file.exist?
+
+    # If the file exists, use its current mode/owner/group. If it doesn't, use
+    # the supplied mode, and default to current user/group.
+    if file_exists
+      stat = file.lstat
+
+      # We only care about the four lowest-order octets. Higher octets are
+      # filesystem-specific.
+      mode = stat.mode & 07777
+      uid = stat.uid
+      gid = stat.gid
+    else
+      mode = default_mode
+      uid = Process.euid
+      gid = Process.egid
+    end
+
+    # Set properties of the temporary file before we write the content, because
+    # Tempfile doesn't promise to be safe from reading by other people, just
+    # that it avoids races around creating the file.
+    tempfile.chmod(mode)
+    tempfile.chown(uid, gid)
+
+    # OK, now allow the caller to write the content of the file.
+    yield tempfile
+
+    # Now, make sure the data (which includes the mode) is safe on disk.
+    tempfile.flush
+    begin
+      tempfile.fsync
+    rescue NotImplementedError
+      # fsync may not be implemented by Ruby on all platforms, but
+      # there is absolutely no recovery path if we detect that.  So, we just
+      # ignore the return code.
+      #
+      # However, don't be fooled: that is accepting that we are running in
+      # an unsafe fashion.  If you are porting to a new platform don't stub
+      # that out.
+    end
+
+    tempfile.close
+
+    File.rename(tempfile.path, file)
+
+    # Ideally, we would now fsync the directory as well, but Ruby doesn't
+    # have support for that, and it doesn't matter /that/ much...
+
+    # Return something true, and possibly useful.
+    file
+  end
+  module_function :replace_file
 end
 end
 

data/lib/puppet/util/anonymous_filelock.rb

@@ -0,0 +1,36 @@
+
+class Puppet::Util::AnonymousFilelock
+  attr_reader :lockfile
+
+  def initialize(lockfile)
+    @lockfile = lockfile
+  end
+
+  def anonymous?
+    true
+  end
+
+  def lock(msg = '')
+    return false if locked?
+
+    File.open(@lockfile, 'w') { |fd| fd.print(msg) }
+    true
+  end
+
+  def unlock
+    if locked?
+      File.unlink(@lockfile)
+      true
+    else
+      false
+    end
+  end
+
+  def locked?
+    File.exists? @lockfile
+  end
+
+  def message
+    return File.read(@lockfile) if locked?
+  end
+end

data/lib/puppet/util/docs.rb

@@ -20,10 +20,10 @@ module Puppet::Util::Docs
   def doc
     extra = methods.find_all { |m| m.to_s =~ /^dochook_.+/ }.sort.collect { |m|
       self.send(m)
-    }.join("  ")
+    }.delete_if {|r| r.nil? }.join("  ")
 
     if @doc
-      @doc + extra
+      @doc + (extra.empty? ? '' : "\n\n" + extra)
     else
       extra
     end
@@ -73,6 +73,22 @@ module Puppet::Util::Docs
     value.to_s + (" " * (length - value.to_s.length))
   end
 
+  HEADER_LEVELS = [nil, "#", "##", "###", "####", "#####"]
+
+  def markdown_header(name, level)
+    "#{HEADER_LEVELS[level]} #{name}\n\n"
+  end
+
+  def markdown_definitionlist(term, definition)
+    lines = scrub(definition).split("\n")
+    str = "#{term}\n: #{lines.shift}\n"
+    lines.each do |line|
+      str << "  " if line =~ /\S/
+      str << "#{line}\n"
+    end
+    str << "\n"
+  end
+
   # Handle the inline indentation in the docs.
   def scrub(text)
     # Stupid markdown

data/lib/puppet/util/instrumentation.rb

@@ -0,0 +1,173 @@
+require 'puppet'
+require 'puppet/util/classgen'
+require 'puppet/util/instance_loader'
+
+class Puppet::Util::Instrumentation
+  extend Puppet::Util::ClassGen
+  extend Puppet::Util::InstanceLoader
+  extend MonitorMixin
+
+  # we're using a ruby lazy autoloader to prevent a loop when requiring listeners
+  # since this class sets up an indirection which is also used in Puppet::Indirector::Indirection
+  # which is used to setup indirections...
+  autoload :Listener, 'puppet/util/instrumentation/listener'
+  autoload :Data, 'puppet/util/instrumentation/data'
+
+  # Set up autoloading and retrieving of instrumentation listeners.
+  instance_load :listener, 'puppet/util/instrumentation/listeners'
+
+  class << self
+    attr_accessor :listeners, :listeners_of
+  end
+
+  # instrumentation layer
+
+  # Triggers an instrumentation
+  #
+  # Call this method around the instrumentation point
+  #   Puppet::Util::Instrumentation.instrument(:my_long_computation) do
+  #     ... a long computation
+  #   end
+  #
+  # This will send an event to all the listeners of "my_long_computation".
+  # Note: this method uses ruby yield directive to call the instrumented code.
+  # It is usually way slower than calling start and stop directly around the instrumented code.
+  # For high traffic code path, it is thus advisable to not use this method.
+  def self.instrument(label, data = {})
+    id = self.start(label, data)
+    yield
+  ensure
+    self.stop(label, id, data)
+  end
+
+  # Triggers a "start" instrumentation event
+  #
+  # Important note:
+  #  For proper use, the data hash instance used for start should also
+  #  be used when calling stop. The idea is to use the current scope
+  #  where start is called to retain a reference to 'data' so that it is possible
+  #  to send it back to stop.
+  #  This way listeners can match start and stop events more easily.
+  def self.start(label, data)
+    data[:started] = Time.now
+    publish(label, :start, data)
+    data[:id] = next_id
+  end
+
+  # Triggers a "stop" instrumentation event
+  def self.stop(label, id, data)
+    data[:finished] = Time.now
+    publish(label, :stop, data)
+  end
+
+  def self.publish(label, event, data)
+    each_listener(label) do |k,l|
+      l.notify(label, event, data)
+    end
+  end
+
+  def self.listeners
+    @listeners.values
+  end
+
+  def self.each_listener(label)
+    synchronize {
+      @listeners_of[label] ||= @listeners.select do |k,l|
+        l.listen_to?(label)
+      end
+    }.each do |l|
+      yield l
+    end
+  end
+
+  # Adds a new listener
+  #
+  # Usage:
+  #   Puppet::Util::Instrumentation.new_listener(:my_instrumentation, pattern) do
+  #
+  #     def notify(label, data)
+  #       ... do something for data...
+  #     end
+  #   end
+  #
+  # It is possible to use a "pattern". The listener will be notified only
+  # if the pattern match the label of the event.
+  # The pattern can be a symbol, a string or a regex.
+  # If no pattern is provided, then the listener will be called for every events
+  def self.new_listener(name, options = {}, &block)
+    Puppet.debug "new listener called #{name}"
+    name = symbolize(name)
+    listener = genclass(name, :hash => instance_hash(:listener), :block => block)
+    listener.send(:define_method, :name) do
+      name
+    end
+    subscribe(listener.new, options[:label_pattern], options[:event])
+  end
+
+  def self.subscribe(listener, label_pattern, event)
+    synchronize {
+      raise "Listener #{listener.name} is already subscribed" if @listeners.include?(listener.name)
+      Puppet.debug "registering instrumentation listener #{listener.name}"
+      @listeners[listener.name] = Listener.new(listener, label_pattern, event)
+      listener.subscribed if listener.respond_to?(:subscribed)
+      rehash
+    }
+  end
+
+  def self.unsubscribe(listener)
+    synchronize {
+      Puppet.warning("#{listener.name} hasn't been registered but asked to be unregistered") unless @listeners.include?(listener.name)
+      Puppet.info "unregistering instrumentation listener #{listener.name}"
+      @listeners.delete(listener.name)
+      listener.unsubscribed if listener.respond_to?(:unsubscribed)
+      rehash
+    }
+  end
+
+  def self.init
+    # let's init our probe indirection
+    require 'puppet/util/instrumentation/indirection_probe'
+    synchronize {
+      @listeners ||= {}
+      @listeners_of ||= {}
+      instance_loader(:listener).loadall
+    }
+  end
+
+  def self.clear
+    synchronize {
+      @listeners = {}
+      @listeners_of = {}
+      @id = 0
+    }
+  end
+
+  def self.[](key)
+    synchronize {
+      key = symbolize(key)
+      @listeners[key]
+    }
+  end
+
+  def self.[]=(key, value)
+    synchronize {
+      key = symbolize(key)
+      @listeners[key] = value
+      rehash
+    }
+  end
+
+  private
+
+  # should be called only under the guard
+  # self.synchronize
+  def self.rehash
+    @listeners_of = {}
+  end
+
+  def self.next_id
+    synchronize {
+      @id = (@id || 0) + 1
+    }
+  end
+end