puppet 3.3.2 → 3.4.0.rc1

data/lib/puppet/indirector/active_record.rb

@@ -1,3 +1,4 @@
+require 'puppet/rails'
 require 'puppet/indirector'
 
 class Puppet::Indirector::ActiveRecord < Puppet::Indirector::Terminus

data/lib/puppet/indirector/catalog/compiler.rb

@@ -41,6 +41,7 @@ class Puppet::Resource::Catalog::Compiler < Puppet::Indirector::Code
     extract_facts_from_request(request)
 
     node = node_from_request(request)
+    node.trusted_data = trusted_hash_from_request(request)
 
     if catalog = compile(node)
       return catalog
@@ -51,6 +52,7 @@ class Puppet::Resource::Catalog::Compiler < Puppet::Indirector::Code
     end
   end
 
+
   # filter-out a catalog to remove exported resources
   def filter(catalog)
     return catalog.filter { |r| r.virtual? } if catalog.respond_to?(:filter)
@@ -70,6 +72,32 @@ class Puppet::Resource::Catalog::Compiler < Puppet::Indirector::Code
 
   private
 
+  # Produces a deeply frozen hash with trusted information
+  # The key :authenticated is always present in the result with one of the values
+  # :remote, :local, false, where :remote is authenticated via cert, :local is trusted by virtue
+  # of running on the same machine (not a remove request), and false is an unauthenticated remot request.
+  # When the trusted hash value for :authenticated == false, there is no other values set in the hash.
+  #
+  def trusted_hash_from_request(request)
+    if request.remote?
+      if request.authenticated?
+        trust_authenticated = 'remote'.freeze
+        client_cert = request.node
+      else
+        trust_authenticated = false
+        client_cert = nil
+      end
+    else
+      trust_authenticated = 'local'.freeze
+      # Always trust local data by picking up the available parameters.
+      request_node = request.options[:use_node]
+      client_cert = request_node ? request_node.parameters['clientcert'] : nil
+    end
+
+    # TODO nil or undef for client_cert missing?
+    trusted_hash = { 'authenticated' => trust_authenticated, 'certname' => client_cert }.freeze
+  end
+
   # Add any extra data necessary to the node.
   def add_node_data(node)
     # Merge in our server-side facts, so they can be used during compilation.

data/lib/puppet/indirector/certificate_request/memory.rb

@@ -0,0 +1,6 @@
+require 'puppet/ssl/certificate_request'
+require 'puppet/indirector/memory'
+
+class Puppet::SSL::CertificateRequest::Memory < Puppet::Indirector::Memory
+  desc "Store certificate requests in memory. This is used for testing puppet."
+end

data/lib/puppet/indirector/data_binding/hiera.rb

@@ -1,6 +1,50 @@
-require 'puppet/indirector/hiera'
+require 'puppet/indirector/code'
+require 'hiera/scope'
 
-class Puppet::DataBinding::Hiera < Puppet::Indirector::Hiera
+class Puppet::DataBinding::Hiera < Puppet::Indirector::Code
   desc "Retrieve data using Hiera."
+
+  def initialize(*args)
+    if ! Puppet.features.hiera?
+      raise "Hiera terminus not supported without hiera library"
+    end
+    super
+  end
+
+  if defined?(::Psych::SyntaxError)
+    DataBindingExceptions = [::StandardError, ::Psych::SyntaxError]
+  else
+    DataBindingExceptions = [::StandardError]
+  end
+
+  def find(request)
+    hiera.lookup(request.key, nil, Hiera::Scope.new(request.options[:variables]), nil, nil)
+  rescue *DataBindingExceptions => detail
+    raise Puppet::DataBinding::LookupError.new(detail.message, detail)
+  end
+
+  private
+
+  def self.hiera_config
+    hiera_config = Puppet.settings[:hiera_config]
+    config = {}
+
+    if Puppet::FileSystem::File.exist?(hiera_config)
+      config = Hiera::Config.load(hiera_config)
+    else
+      Puppet.warning "Config file #{hiera_config} not found, using Hiera defaults"
+    end
+
+    config[:logger] = 'puppet'
+    config
+  end
+
+  def self.hiera
+    @hiera ||= Hiera.new(:config => hiera_config)
+  end
+
+  def hiera
+    self.class.hiera
+  end
 end
 

data/lib/puppet/indirector/direct_file_server.rb

@@ -6,14 +6,14 @@ class Puppet::Indirector::DirectFileServer < Puppet::Indirector::Terminus
   include Puppet::FileServing::TerminusHelper
 
   def find(request)
-    return nil unless FileTest.exists?(request.key)
+    return nil unless Puppet::FileSystem::File.exist?(request.key)
     instance = model.new(request.key)
     instance.links = request.options[:links] if request.options[:links]
     instance
   end
 
   def search(request)
-    return nil unless FileTest.exists?(request.key)
+    return nil unless Puppet::FileSystem::File.exist?(request.key)
     path2instances(request, request.key)
   end
 end

data/lib/puppet/indirector/facts/facter.rb

@@ -6,6 +6,8 @@ class Puppet::Node::Facts::Facter < Puppet::Indirector::Code
     between Puppet and Facter.  It's only `somewhat` abstract because it always
     returns the local host's facts, regardless of what you attempt to find."
 
+  private
+
   def self.reload_facter
     Facter.clear
     Facter.loadfacts
@@ -24,6 +26,26 @@ class Puppet::Node::Facts::Facter < Puppet::Indirector::Code
     end
   end
 
+  def self.setup_external_facts(request)
+    # Add any per-module fact directories to the factpath
+    external_facts_dirs = []
+    request.environment.modules.each do |m|
+         if m.has_external_facts?
+            Puppet.info "Loading external facts from #{m.plugin_fact_directory}"
+            external_facts_dirs << m.plugin_fact_directory
+         end
+    end
+
+    # Add system external fact directory if it exists
+    if File.directory?(Puppet[:pluginfactdest])
+      external_facts_dirs << Puppet[:pluginfactdest]
+    end
+
+    # Add to facter config
+    Facter::Util::Config.external_facts_dirs += external_facts_dirs
+
+  end
+
   def self.load_facts_in_dir(dir)
     return unless FileTest.directory?(dir)
 
@@ -44,12 +66,15 @@ class Puppet::Node::Facts::Facter < Puppet::Indirector::Code
     end
   end
 
+  public
+
   def destroy(facts)
     raise Puppet::DevError, "You cannot destroy facts in the code store; it is only used for getting facts from Facter"
   end
 
   # Look a host's facts up in Facter.
   def find(request)
+    self.class.setup_external_facts(request) if Puppet.features.external_facts?
     self.class.reload_facter
     self.class.load_fact_plugins
     result = Puppet::Node::Facts.new(request.key, Facter.to_hash)

data/lib/puppet/indirector/file_bucket_file/file.rb

@@ -9,41 +9,40 @@ module Puppet::FileBucketFile
 
     desc "Store files in a directory set based on their checksums."
 
-    def initialize
-      Puppet.settings.use(:filebucket)
-    end
-
-    def find( request )
-      checksum, files_original_path = request_to_checksum_and_path( request )
-      dir_path = path_for(request.options[:bucket_path], checksum)
-      file_path = ::File.join(dir_path, 'contents')
-
-      return nil unless ::File.exists?(file_path)
-      return nil unless path_match(dir_path, files_original_path)
-
-      if request.options[:diff_with]
-        file2_path = path_for(request.options[:bucket_path], request.options[:diff_with], 'contents')
-        raise "could not find diff_with #{request.options[:diff_with]}" unless ::File.exists?(file2_path)
-        return `diff #{file_path.inspect} #{file2_path.inspect}`
+    def find(request)
+      checksum, files_original_path = request_to_checksum_and_path(request)
+      contents_file = path_for(request.options[:bucket_path], checksum, 'contents')
+      paths_file = path_for(request.options[:bucket_path], checksum, 'paths')
+
+      if contents_file.exist? && matches(paths_file, files_original_path)
+        if request.options[:diff_with]
+          other_contents_file = path_for(request.options[:bucket_path], request.options[:diff_with], 'contents')
+          raise "could not find diff_with #{request.options[:diff_with]}" unless other_contents_file.exist?
+          return `diff #{contents_file.path.to_s.inspect} #{other_contents_file.path.to_s.inspect}`
+        else
+          Puppet.info "FileBucket read #{checksum}"
+          model.new(contents_file.binread)
+        end
       else
-        contents = IO.binread(file_path)
-        Puppet.info "FileBucket read #{checksum}"
-        model.new(contents)
+        nil
       end
     end
 
     def head(request)
       checksum, files_original_path = request_to_checksum_and_path(request)
-      dir_path = path_for(request.options[:bucket_path], checksum)
+      contents_file = path_for(request.options[:bucket_path], checksum, 'contents')
+      paths_file = path_for(request.options[:bucket_path], checksum, 'paths')
 
-      ::File.exists?(::File.join(dir_path, 'contents')) and path_match(dir_path, files_original_path)
+      contents_file.exist? && matches(paths_file, files_original_path)
     end
 
-    def save( request )
+    def save(request)
       instance = request.instance
-      checksum, files_original_path = request_to_checksum_and_path(request)
+      _, files_original_path = request_to_checksum_and_path(request)
+      contents_file = path_for(instance.bucket_path, instance.checksum_data, 'contents')
+      paths_file = path_for(instance.bucket_path, instance.checksum_data, 'paths')
 
-      save_to_disk(instance, files_original_path)
+      save_to_disk(instance, files_original_path, contents_file, paths_file)
 
       # don't echo the request content back to the agent
       model.new('')
@@ -55,57 +54,46 @@ module Puppet::FileBucketFile
 
     private
 
-    def path_match(dir_path, files_original_path)
+    def matches(paths_file, files_original_path)
+      paths_file.open(0640, 'a+') do |f|
+        path_match(f, files_original_path)
+      end
+    end
+
+    def path_match(file_handle, files_original_path)
       return true unless files_original_path # if no path was provided, it's a match
-      paths_path = ::File.join(dir_path, 'paths')
-      return false unless ::File.exists?(paths_path)
-      ::File.open(paths_path) do |f|
-        f.each_line do |line|
-          return true if line.chomp == files_original_path
-        end
+      file_handle.rewind
+      file_handle.each_line do |line|
+        return true if line.chomp == files_original_path
       end
       return false
     end
 
-    def save_to_disk( bucket_file, files_original_path )
-      filename = path_for(bucket_file.bucket_path, bucket_file.checksum_data, 'contents')
-      dir_path = path_for(bucket_file.bucket_path, bucket_file.checksum_data)
-      paths_path = ::File.join(dir_path, 'paths')
-
-      # If the file already exists, touch it.
-      if ::File.exist?(filename)
-        verify_identical_file!(bucket_file)
-        ::FileUtils.touch(filename)
-      else
-        # Make the directories if necessary.
-        unless ::File.directory?(dir_path)
-          Puppet::Util.withumask(0007) do
-            ::FileUtils.mkdir_p(dir_path)
-          end
+    def save_to_disk(bucket_file, files_original_path, contents_file, paths_file)
+      Puppet::Util.withumask(0007) do
+        unless paths_file.dir.exist?
+          paths_file.dir.mkpath
         end
 
-        Puppet.info "FileBucket adding #{bucket_file.checksum}"
-
-        # Write the file to disk.
-        Puppet::Util.withumask(0007) do
-          ::File.open(filename, ::File::WRONLY|::File::CREAT, 0440) do |of|
-            of.binmode
-            of.print bucket_file.contents
+        paths_file.exclusive_open(0640, 'a+') do |f|
+          if contents_file.exist?
+            verify_identical_file!(contents_file, bucket_file)
+            contents_file.touch
+          else
+            contents_file.open(0440, 'wb') do |of|
+              of.write(bucket_file.contents)
+            end
           end
-          ::File.open(paths_path, ::File::WRONLY|::File::CREAT, 0640) do |of|
-            # path will be written below
-          end
-        end
-      end
 
-      unless path_match(dir_path, files_original_path)
-        ::File.open(paths_path, 'a') do |f|
-          f.puts(files_original_path)
+          unless path_match(f, files_original_path)
+            f.seek(0, IO::SEEK_END)
+            f.puts(files_original_path)
+          end
         end
       end
     end
 
-    def request_to_checksum_and_path( request )
+    def request_to_checksum_and_path(request)
       checksum_type, checksum, path = request.key.split(/\//, 3)
       if path == '' # Treat "md5/<checksum>/" like "md5/<checksum>"
         path = nil
@@ -121,22 +109,20 @@ module Puppet::FileBucketFile
       dir     = ::File.join(digest[0..7].split(""))
       basedir = ::File.join(bucket_path, dir, digest)
 
-      return basedir unless subfile
-      ::File.join(basedir, subfile)
+      Puppet::FileSystem::File.new(subfile ? ::File.join(basedir, subfile) : basedir)
     end
 
-    # If conflict_check is enabled, verify that the passed text is
-    # the same as the text in our file.
-    def verify_identical_file!(bucket_file)
-      disk_contents = IO.binread(path_for(bucket_file.bucket_path, bucket_file.checksum_data, 'contents'))
+    def verify_identical_file!(contents_file, bucket_file)
+      if bucket_file.contents.size == contents_file.size
+        if contents_file.compare_stream(bucket_file.stream)
+          Puppet.info "FileBucket got a duplicate file #{bucket_file.checksum}"
+          return
+        end
+      end
 
-      # If the contents don't match, then we've found a conflict.
+      # If the contents or sizes don't match, then we've found a conflict.
       # Unlikely, but quite bad.
-      if disk_contents != bucket_file.contents
-        raise Puppet::FileBucket::BucketError, "Got passed new contents for sum #{bucket_file.checksum}"
-      else
-        Puppet.info "FileBucket got a duplicate file #{bucket_file.checksum}"
-      end
+      raise Puppet::FileBucket::BucketError, "Got passed new contents for sum #{bucket_file.checksum}"
     end
   end
 end

data/lib/puppet/indirector/indirection.rb

@@ -85,7 +85,7 @@ class Puppet::Indirector::Indirection
   def doc
     text = ""
 
-    text += scrub(@doc) + "\n\n" if @doc
+    text << scrub(@doc) << "\n\n" if @doc
 
     text << "* **Indirected Class**: `#{@indirected_class}`\n";
     if terminus_setting
@@ -180,6 +180,10 @@ class Puppet::Indirector::Indirection
     cache.save(request(:save, nil, instance, options))
   end
 
+  def allow_remote_requests?
+    terminus.allow_remote_requests?
+  end
+
   # Search for an instance in the appropriate terminus, caching the
   # results if caching is configured..
   def find(key, options={})

data/lib/puppet/indirector/json.rb

@@ -21,7 +21,7 @@ class Puppet::Indirector::JSON < Puppet::Indirector::Terminus
   end
 
   def destroy(request)
-    File.unlink(path(request.key))
+    Puppet::FileSystem::File.unlink(path(request.key))
   rescue => detail
     unless detail.is_a? Errno::ENOENT
       raise Puppet::Error, "Could not destroy #{self.name} #{request.key}: #{detail}"

data/lib/puppet/indirector/key/ca.rb

@@ -9,4 +9,8 @@ class Puppet::SSL::Key::Ca < Puppet::Indirector::SslFile
   store_in :privatekeydir
 
   store_ca_at :cakey
+
+  def allow_remote_requests?
+    false
+  end
 end

data/lib/puppet/indirector/key/file.rb

@@ -7,6 +7,10 @@ class Puppet::SSL::Key::File < Puppet::Indirector::SslFile
   store_in :privatekeydir
   store_ca_at :cakey
 
+  def allow_remote_requests?
+    false
+  end
+
   # Where should we store the public key?
   def public_key_path(name)
     if ca?(name)
@@ -20,10 +24,10 @@ class Puppet::SSL::Key::File < Puppet::Indirector::SslFile
   def destroy(request)
     super
 
-    return unless FileTest.exist?(public_key_path(request.key))
+    return unless Puppet::FileSystem::File.exist?(public_key_path(request.key))
 
     begin
-      File.unlink(public_key_path(request.key))
+      Puppet::FileSystem::File.unlink(public_key_path(request.key))
     rescue => detail
       raise Puppet::Error, "Could not remove #{request.key} public key: #{detail}"
     end
@@ -34,7 +38,7 @@ class Puppet::SSL::Key::File < Puppet::Indirector::SslFile
     super
 
     begin
-      Puppet.settings.writesub(:publickeydir, public_key_path(request.key)) { |f| f.print request.instance.content.public_key.to_pem }
+      Puppet.settings.setting(:publickeydir).open_file(public_key_path(request.key), 'w') { |f| f.print request.instance.content.public_key.to_pem }
     rescue => detail
       raise Puppet::Error, "Could not write #{request.key}: #{detail}"
     end

data/lib/puppet/indirector/key/memory.rb

@@ -0,0 +1,6 @@
+require 'puppet/ssl/key'
+require 'puppet/indirector/memory'
+
+class Puppet::SSL::Key::Memory < Puppet::Indirector::Memory
+  desc "Store keys in memory. This is used for testing puppet."
+end

data/lib/puppet/indirector/node/write_only_yaml.rb

@@ -17,7 +17,7 @@ class Puppet::Node::WriteOnlyYaml < Puppet::Indirector::Yaml
   # Overridden to always return nil. This is a write only terminus.
   # @param [Object] request Ignored.
   # @return [nil] This implementation always return nil'
-  # @api
+  # @api public
   def find(request)
     nil
   end
@@ -25,7 +25,7 @@ class Puppet::Node::WriteOnlyYaml < Puppet::Indirector::Yaml
   # Overridden to always return nil. This is a write only terminus.
   # @param [Object] request Ignored.
   # @return [nil] This implementation always return nil
-  # @api
+  # @api public
   def search(request)
     nil
   end