puppet 3.1.1 → 3.2.0.rc1

data/lib/puppet/module_tool/tar/mini.rb

@@ -0,0 +1,39 @@
+class Puppet::ModuleTool::Tar::Mini
+  def initialize(module_name)
+    @module_name = module_name
+  end
+
+  def unpack(sourcefile, destdir)
+    Zlib::GzipReader.open(sourcefile) do |reader|
+      Archive::Tar::Minitar.unpack(reader, destdir) do |action, name, stats|
+        case action
+        when :dir, :file_start
+          validate_entry(destdir, name)
+          Puppet.debug("extracting #{destdir}/#{name}")
+        end
+      end
+    end
+  end
+
+  def pack(sourcedir, destfile)
+    Zlib::GzipWriter.open(destfile) do |writer|
+      Archive::Tar::Minitar.pack(sourcedir, writer)
+    end
+  end
+
+  private
+
+  def validate_entry(destdir, path)
+    if Pathname.new(path).absolute?
+      raise Puppet::ModuleTool::Errors::InvalidPathInPackageError,
+        :requested_package => @module_name, :entry_path => path, :directory => destdir
+    end
+
+    path = File.expand_path File.join(destdir, path)
+
+    if path !~ /\A#{Regexp.escape destdir}/
+      raise Puppet::ModuleTool::Errors::InvalidPathInPackageError,
+        :requested_package => @module_name, :entry_path => path, :directory => destdir
+    end
+  end
+end

data/lib/puppet/module_tool/tar/solaris.rb

@@ -0,0 +1,5 @@
+class Puppet::ModuleTool::Tar::Solaris < Puppet::ModuleTool::Tar::Gnu
+  def unpack(sourcefile, destdir)
+    Puppet::Util::Execution.execute("gtar xzf #{sourcefile} -C #{destdir}")
+  end
+end

data/lib/puppet/network/http.rb

@@ -1,2 +1,3 @@
 module Puppet::Network::HTTP
+  HEADER_ENABLE_PROFILING = "X-Puppet-Profiling"
 end

data/lib/puppet/network/http/connection.rb

@@ -1,6 +1,7 @@
 require 'net/https'
 require 'puppet/ssl/host'
 require 'puppet/ssl/configuration'
+require 'puppet/ssl/validator'
 require 'puppet/network/authentication'
 
 module Puppet::Network::HTTP
@@ -44,38 +45,23 @@ module Puppet::Network::HTTP
     end
 
     def request(method, *args)
-      peer_certs = []
-      verify_errors = []
-
-      connection.verify_callback = proc do |preverify_ok, ssl_context|
-        # We use the callback to collect the certificates for use in
-        # constructing the error message if the verification failed.
-        # This is necessary since we don't have direct access to the
-        # cert that we expected the connection to use otherwise.
-        peer_certs << Puppet::SSL::Certificate.from_instance(ssl_context.current_cert)
-        # And also keep the detailed verification error if such an error occurs
-        if ssl_context.error_string and not preverify_ok
-          verify_errors << "#{ssl_context.error_string} for #{ssl_context.current_cert.subject}"
-        end
-        preverify_ok
-      end
-
+      ssl_validator = Puppet::SSL::Validator.new(:ssl_configuration => ssl_configuration)
+      # Perform our own validation of the SSL connection in addition to OpenSSL
+      ssl_validator.register_verify_callback(connection)
       response = connection.send(method, *args)
-
-      # Now that the request completed successfully, lets check the involved
-      # certificates for approaching expiration dates
-      warn_if_near_expiration(*peer_certs)
+      # Check the peer certs and warn if they're nearing expiration.
+      warn_if_near_expiration(*ssl_validator.peer_certs)
 
       response
     rescue OpenSSL::SSL::SSLError => error
       if error.message.include? "certificate verify failed"
         msg = error.message
-        msg << ": [" + verify_errors.join('; ') + "]"
+        msg << ": [" + ssl_validator.verify_errors.join('; ') + "]"
         raise Puppet::Error, msg
       elsif error.message =~ /hostname (was )?not match/
-        raise unless cert = peer_certs.find { |c| c.name !~ /^puppet ca/i }
+        leaf_ssl_cert = ssl_validator.peer_certs.last
 
-        valid_certnames = [cert.name, *cert.subject_alt_names].uniq
+        valid_certnames = [leaf_ssl_cert.name, *leaf_ssl_cert.subject_alt_names].uniq
         msg = valid_certnames.length > 1 ? "one of #{valid_certnames.join(', ')}" : valid_certnames.first
 
         raise Puppet::Error, "Server hostname '#{connection.address}' did not match server certificate; expected #{msg}"

data/lib/puppet/network/http/handler.rb

@@ -1,10 +1,12 @@
 module Puppet::Network::HTTP
 end
 
+require 'puppet/network/http'
 require 'puppet/network/http/api/v1'
 require 'puppet/network/authorization'
 require 'puppet/network/authentication'
 require 'puppet/network/rights'
+require 'puppet/util/profiler'
 require 'resolv'
 
 module Puppet::Network::HTTP::Handler
@@ -14,6 +16,13 @@ module Puppet::Network::HTTP::Handler
 
   attr_reader :server, :handler
 
+
+  # Retrieve all headers from the http request, as a hash with the header names
+  # (lower-cased) as the keys
+  def headers(request)
+    raise NotImplementedError
+  end
+
   # Retrieve the accept header from the http request.
   def accept_header(request)
     raise NotImplementedError
@@ -63,12 +72,21 @@ module Puppet::Network::HTTP::Handler
 
   # handle an HTTP request
   def process(request, response)
-    indirection, method, key, params = uri2indirection(http_method(request), path(request), params(request))
+    request_headers = headers(request)
+    request_params = params(request)
+    request_method = http_method(request)
+    request_path = path(request)
 
-    check_authorization(indirection, method, key, params)
-    warn_if_near_expiration(client_cert(request))
+    configure_profiler(request_headers, request_params)
 
-    send("do_#{method}", indirection, key, params, request, response)
+    Puppet::Util::Profiler.profile("Processed request #{request_method} #{request_path}") do
+      indirection, method, key, params = uri2indirection(request_method, request_path, request_params)
+
+      check_authorization(indirection, method, key, params)
+      warn_if_near_expiration(client_cert(request))
+
+      send("do_#{method}", indirection, key, params, request, response)
+    end
   rescue SystemExit,NoMemoryError
     raise
   rescue Exception => e
@@ -118,10 +136,15 @@ module Puppet::Network::HTTP::Handler
     format = format_to_use(request)
     set_content_type(response, format)
 
+    rendered_result = result
     if result.respond_to?(:render)
-      set_response(response, result.render(format))
-    else
-      set_response(response, result)
+      Puppet::Util::Profiler.profile("Rendered result in #{format}") do
+       rendered_result = result.render(format)
+      end
+    end
+
+    Puppet::Util::Profiler.profile("Sent response") do
+      set_response(response, rendered_result)
     end
   end
 
@@ -253,4 +276,12 @@ module Puppet::Network::HTTP::Handler
       result
     end
   end
+
+  def configure_profiler(request_headers, request_params)
+    if (request_headers.has_key?(Puppet::Network::HTTP::HEADER_ENABLE_PROFILING.downcase) or Puppet[:profile])
+      Puppet::Util::Profiler.current = Puppet::Util::Profiler::WallClock.new(Puppet.method(:debug), request_params.object_id)
+    else
+      Puppet::Util::Profiler.current = Puppet::Util::Profiler::NONE
+    end
+  end
 end

data/lib/puppet/network/http/rack/rest.rb

@@ -1,5 +1,7 @@
+require 'openssl'
 require 'puppet/network/http/handler'
 require 'puppet/network/http/rack/httphandler'
+require 'puppet/util/ssl'
 
 class Puppet::Network::HTTP::RackREST < Puppet::Network::HTTP::RackHttpHandler
 
@@ -46,6 +48,14 @@ class Puppet::Network::HTTP::RackREST < Puppet::Network::HTTP::RackHttpHandler
     end
   end
 
+  # Retrieve all headers from the http request, as a map.
+  def headers(request)
+    request.env.select {|k,v| k.start_with? 'HTTP_'}.inject({}) do |m, (k,v)|
+      m[k.sub(/^HTTP_/, '').downcase] = v
+      m
+    end
+  end
+
   # Retrieve the accept header from the http request.
   def accept_header(request)
     request.env[HEADER_ACCEPT]
@@ -98,11 +108,12 @@ class Puppet::Network::HTTP::RackREST < Puppet::Network::HTTP::RackHttpHandler
     result = {}
     result[:ip] = request.ip
 
-    # if we find SSL info in the headers, use them to get a hostname.
+    # if we find SSL info in the headers, use them to get a hostname from the CN.
     # try this with :ssl_client_header, which defaults should work for
     # Apache with StdEnvVars.
-    if dn = request.env[Puppet[:ssl_client_header]] and dn_matchdata = dn.match(/^.*?CN\s*=\s*(.*)/)
-      result[:node] = dn_matchdata[1].to_str
+    if subj_str = request.env[Puppet[:ssl_client_header]]
+      subject = Puppet::Util::SSL.subject_from_dn(subj_str)
+      result[:node] = Puppet::Util::SSL.cn_from_subject(subject)
       result[:authenticated] = (request.env[Puppet[:ssl_client_verify_header]] == 'SUCCESS')
     else
       result[:node] = resolve_node(result)

data/lib/puppet/network/http/webrick.rb

@@ -14,10 +14,12 @@ class Puppet::Network::HTTP::WEBrick
   end
 
   def listen(address, port)
-    arguments = {:BindAddress => address, :Port => port}
+    arguments = {:BindAddress => address, :Port => port, :DoNotReverseLookup => true}
     arguments.merge!(setup_logger)
     arguments.merge!(setup_ssl)
 
+    BasicSocket.do_not_reverse_lookup = true
+
     @server = WEBrick::HTTPServer.new(arguments)
     @server.listeners.each { |l| l.start_immediately = false }
 

data/lib/puppet/network/http/webrick/rest.rb

@@ -1,6 +1,7 @@
 require 'puppet/network/http/handler'
 require 'resolv'
 require 'webrick'
+require 'puppet/util/ssl'
 
 class Puppet::Network::HTTP::WEBrickREST < WEBrick::HTTPServlet::AbstractServlet
 
@@ -24,6 +25,14 @@ class Puppet::Network::HTTP::WEBrickREST < WEBrick::HTTPServlet::AbstractServlet
     process(request, response)
   end
 
+  def headers(request)
+    result = {}
+    request.each do |k, v|
+      result[k.downcase] = v
+    end
+    result
+  end
+
   def accept_header(request)
     request["accept"]
   end
@@ -73,8 +82,8 @@ class Puppet::Network::HTTP::WEBrickREST < WEBrick::HTTPServlet::AbstractServlet
     # then we get the hostname from the cert, instead of via IP
     # info
     result[:authenticated] = false
-    if cert = request.client_cert and nameary = cert.subject.to_a.find { |ary| ary[0] == "CN" }
-      result[:node] = nameary[1]
+    if cert = request.client_cert and cn = Puppet::Util::SSL.cn_from_subject(cert.subject)
+      result[:node] = cn
       result[:authenticated] = true
     else
       result[:node] = resolve_node(result)

data/lib/puppet/node/environment.rb

@@ -1,6 +1,7 @@
 require 'puppet/util'
 require 'puppet/util/cacher'
 require 'monitor'
+require 'puppet/parser/parser_factory'
 
 # Just define it, so this class has fewer load dependencies.
 class Puppet::Node
@@ -217,7 +218,8 @@ class Puppet::Node::Environment
 
   def perform_initial_import
     return empty_parse_result if Puppet.settings[:ignoreimport]
-    parser = Puppet::Parser::Parser.new(self)
+#    parser = Puppet::Parser::Parser.new(self)
+    parser = Puppet::Parser::ParserFactory.parser(self)
     if code = Puppet.settings.uninterpolated_value(:code, name.to_s) and code != ""
       parser.string = code
     else

data/lib/puppet/parameter.rb

@@ -18,7 +18,7 @@ require 'puppet/util/docs'
 # @see Puppet::Type
 # @see Puppet::Property
 # @api public
-# 
+#
 class Puppet::Parameter
   include Puppet::Util
   include Puppet::Util::Errors
@@ -36,7 +36,7 @@ class Puppet::Parameter
     #   which seems to works fine without this attribute declaration.
     # @api private
     #
-    attr_reader :validater 
+    attr_reader :validater
 
     # Unused?
     # @todo The term "munger" only appears in this location in the Puppet code base. There is munge and unmunge
@@ -44,14 +44,14 @@ class Puppet::Parameter
     # @api private
     #
     attr_reader :munger
-    
+
     # @return [Symbol] The parameter name as given when it was created.
     attr_reader :name
-    
+
     # @return [Object] The default value of the parameter as determined by the {defaultto} method, or nil if no
     #  default has been set.
     attr_reader :default
-    
+
     # @comment This somewhat odd documentation construct is because the getter and setter are not
     #  orthogonal; the setter uses varargs and this confuses yard. To overcome the problem both the
     #  getter and the setter are documented here. If this issues is fixed, a todo will be displayed
@@ -65,24 +65,24 @@ class Puppet::Parameter
     # @overload required_features
     #   Returns the required _provider features_ as an array of lower case symbols
     # @overload required_features=(*args)
-    #   @param *args [Symbol] one or more names of required provider features 
+    #   @param *args [Symbol] one or more names of required provider features
     #   Sets the required_provider_features_ from one or more values, or array. The given arguments
     #   are flattened, and internalized.
     # @api public
     # @dsl type
     #
     attr_reader :required_features
-    
+
     # @return [Puppet::Parameter::ValueCollection] The set of valid values (or an empty set that accepts any value).
     # @api private
     #
     attr_reader :value_collection
-    
+
     # @return [Boolean] Flag indicating whether this parameter is a meta-parameter or not.
     attr_accessor :metaparam
 
     # Defines how the `default` value of a parameter is computed.
-    # The computation of the parameter's default value is defined by providing a value or a block. 
+    # The computation of the parameter's default value is defined by providing a value or a block.
     # A default of `nil` can not be used.
     # @overload defaultto(value)
     #   Defines the default value with a literal value
@@ -95,7 +95,7 @@ class Puppet::Parameter
     # @see Parameter.default
     # @dsl type
     # @api public
-    # 
+    #
     def defaultto(value = nil, &block)
       if block
         define_method(:default, &block)
@@ -108,7 +108,7 @@ class Puppet::Parameter
       end
     end
 
-    # Produces a documentation string. 
+    # Produces a documentation string.
     # If an enumeration of _valid values_ has been defined, it is appended to the documentation
     # for this parameter specified with the {desc} method.
     # @return [String] Returns a documentation string.
@@ -243,6 +243,9 @@ class Puppet::Parameter
     # @overload validate {|| ... }
     # Defines an optional method that is used to validate the parameter's value.
     # Validation should raise appropriate exceptions, the return value of the given block is ignored.
+    # The easiest way to raise an appropriate exception is to call the method {Puppet::Util::Errors.fail} with
+    # the message as an argument.
+    #
     # @return [void]
     # @dsl type
     # @api public
@@ -256,7 +259,7 @@ class Puppet::Parameter
     # regular expression patterns.
     # @note Each call to this method adds to the set of valid values
     # @param names [Symbol, Regexp] The set of valid literal values and/or patterns for the parameter.
-    # @return [void] 
+    # @return [void]
     # @dsl type
     # @api public
     #
@@ -318,14 +321,14 @@ class Puppet::Parameter
 
   # Initializes the parameter with a required resource reference and optional attribute settings.
   # The option `:resource` must be specified or an exception is raised. Any additional options passed
-  # are used to initialize the attributes of this parameter by treating each key in the `options` hash as 
+  # are used to initialize the attributes of this parameter by treating each key in the `options` hash as
   # the name of the attribute to set, and the value as the value to set.
   # @param options [Hash{Symbol => Object]] Options, where `resource` is required
   # @option options [Puppet::Resource] :resource The resource this parameter holds a value for. Required.
   # @raise [Puppet::DevError] If resource is not specified in the options hash.
   # @api public
   # @note A parameter should be created via the DSL method {Puppet::Type::newparam}
-  # 
+  #
   def initialize(options = {})
     options = symbolize_options(options)
     if resource = options[:resource]
@@ -338,7 +341,7 @@ class Puppet::Parameter
     set_options(options)
   end
 
-  # Writes the given `msg` to the log with the loglevel indicated by the associated resource's 
+  # Writes the given `msg` to the log with the loglevel indicated by the associated resource's
   # `loglevel` parameter.
   # @todo is loglevel a metaparameter? it is looked up with `resource[:loglevel]`
   # @return [void]
@@ -354,7 +357,7 @@ class Puppet::Parameter
 
   # @!attribute [r] name
   # @return [Symbol] The parameter's name as given when it was created.
-  # @note Since a Parameter defines the name at the class level, each Parameter class must be 
+  # @note Since a Parameter defines the name at the class level, each Parameter class must be
   #  unique within a type's inheritance chain.
   # @comment each parameter class must define the name method, and parameter
   #   instances do not change that name this implicitly means that a given
@@ -366,7 +369,7 @@ class Puppet::Parameter
 
   # @return [Boolean] Returns true if this parameter, the associated resource, or overall puppet mode is `noop`.
   # @todo How is noop mode set for a parameter? Is this of value in DSL to inhibit a parameter?
-  # 
+  #
   def noop
     @noop ||= false
     tmp = @noop || self.resource.noop || Puppet[:noop] || false
@@ -377,7 +380,7 @@ class Puppet::Parameter
   # @todo Original comment = _return the full path to us, for logging and rollback; not currently
   #   used_ This is difficult to figure out (if it is used or not as calls are certainly made to "pathbuilder"
   #   method is several places, not just sure if it is this implementation or not.
-  # 
+  #
   # @api private
   def pathbuilder
     if @resource
@@ -424,7 +427,7 @@ class Puppet::Parameter
     ret
   end
 
-  # This is the default implementation of `validate` that may be overridden by the DSL method {validate}. 
+  # This is the default implementation of `validate` that may be overridden by the DSL method {validate}.
   # If no valid values have been defined, the given value is accepted, else it is validated against
   # the literal values (enumerator) and/or patterns defined by calling {newvalues}.
   #
@@ -432,7 +435,7 @@ class Puppet::Parameter
   # @raise [ArgumentError] if the value is not valid
   # @return [void]
   # @api private
-  # 
+  #
   def unsafe_validate(value)
     self.class.value_collection.validate(value)
   end
@@ -441,7 +444,7 @@ class Puppet::Parameter
   # @return [void]
   # @todo Better description of when the various exceptions are raised.ArgumentError is rescued and
   #   changed into Puppet::Error.
-  # @raise [ArgumentError, TypeError, Puppet::DevError, Puppet::Error] under various conditions 
+  # @raise [ArgumentError, TypeError, Puppet::DevError, Puppet::Error] under various conditions
   # A protected validation method that only ever raises useful exceptions.
   # @api public
   #
@@ -475,7 +478,7 @@ class Puppet::Parameter
   #   late-binding (e.g., users might not exist when the value is assigned
   #   but might when it is asked for)."_ does not seem to be correct, the implementation
   #   calls both validate an munge on the given value, so no late binding.
-  # 
+  #
   # The given value is validated and then munged (if munging has been specified). The result is store
   # as the value of this arameter.
   # @return [Object] The given `value` after munging.
@@ -492,7 +495,7 @@ class Puppet::Parameter
   #   Some types don't have providers, in which case we return the resource object itself."_
   #   This does not seem to be true, the default implementation that sets this value may be
   #   {Puppet::Type.provider=} which always gets either the name of a provider or an instance of one.
-  # 
+  #
   def provider
     @resource.provider
   end
@@ -504,7 +507,7 @@ class Puppet::Parameter
   # @todo The original comment says = _"The properties need to return tags so that logs correctly
   #   collect them."_ what if anything of that is of interest to document. Should tags and their relationship
   #   to logs be described. This is a more general concept.
-  # 
+  #
   def tags
     unless defined?(@tags)
       @tags = []
@@ -522,20 +525,20 @@ class Puppet::Parameter
 
   # Produces a String with the value formatted for display to a human.
   # When the parameter value is a:
-  # 
+  #
   # * **single valued parameter value** the result is produced on the
-  #   form `'value'` where _value_ is the string form of the parameter's value. 
+  #   form `'value'` where _value_ is the string form of the parameter's value.
   #
-  # * **Array** the list of values is enclosed in `[]`, and 
+  # * **Array** the list of values is enclosed in `[]`, and
   #   each produced value is separated by a comma.
-  # 
+  #
   # * **Hash** value is output with keys in sorted order enclosed in `{}` with each entry formatted
   #   on the form `'k' => v` where
   #   `k` is the key in string form and _v_ is the value of the key. Entries are comma separated.
   #
   # For both Array and Hash this method is called recursively to format contained values.
   # @note this method does not protect against infinite structures.
-  # 
+  #
   # @return [String] The formatted value in string form.
   #
   def self.format_value_for_display(value)