puppet 3.3.2 → 3.4.0.rc1

data/lib/puppet/network/format_support.rb

@@ -1,6 +1,7 @@
 require 'puppet/network/format_handler'
 
 # Provides network serialization support when included
+# @api public
 module Puppet::Network::FormatSupport
   def self.included(klass)
     klass.extend(ClassMethods)
@@ -83,6 +84,10 @@ module Puppet::Network::FormatSupport
     end
   end
 
+  def to_msgpack(*args)
+    to_data_hash.to_msgpack(*args)
+  end
+
   def render(format = nil)
     format ||= self.class.default_format
 
@@ -102,5 +107,14 @@ module Puppet::Network::FormatSupport
   def support_format?(name)
     self.class.support_format?(name)
   end
+
+  # @comment Document to_data_hash here as it is called as a hook from to_msgpack if it exists
+  # @!method to_data_hash(*args)
+  # @api public
+  # @abstract
+  # This method may be implemented to return a hash object that is used for serializing.
+  # The object returned by this method should contain all the info needed to instantiate it again.
+  # If the method exists it will be called from to_msgpack and other serialization methods.
+  # @return [Hash]
 end
 

data/lib/puppet/network/formats.rb

@@ -1,5 +1,31 @@
 require 'puppet/network/format_handler'
 
+Puppet::Network::FormatHandler.create_serialized_formats(:msgpack, :weight => 20, :mime => "application/x-msgpack", :required_methods => [:render_method, :intern_method]) do
+  def intern(klass, text)
+    data = MessagePack.unpack(text)
+    return data if data.is_a?(klass)
+    klass.from_pson(data)
+  end
+
+  def intern_multiple(klass, text)
+    MessagePack.unpack(text).collect do |data|
+      klass.from_pson(data)
+    end
+  end
+
+  def render(instance)
+    instance.to_msgpack
+  end
+
+  def render_multiple(instances)
+    instances.to_msgpack
+  end
+
+  def supported?(klass)
+    Puppet.features.msgpack? && klass.method_defined?(:to_msgpack)
+  end
+end
+
 Puppet::Network::FormatHandler.create_serialized_formats(:yaml) do
   def intern(klass, text)
     data = YAML.load(text, :safe => true, :deserialize_symbols => true)

data/lib/puppet/network/http/connection.rb

@@ -24,17 +24,17 @@ module Puppet::Network::HTTP
 
     OPTION_DEFAULTS = {
       :use_ssl => true,
-      :verify_peer => true,
+      :verify => nil,
       :redirect_limit => 10
     }
 
-    # Creates a new HTTP client connection to `host`:`port`. 
+    # Creates a new HTTP client connection to `host`:`port`.
     # @param host [String] the host to which this client will connect to
     # @param port [Fixnum] the port to which this client will connect to
     # @param options [Hash] options influencing the properties of the created connection,
     #   the following options are recognized:
     #     :use_ssl [Boolean] true to connect with SSL, false otherwise, defaults to true
-    #     :verify_peer [Boolean] true to verify the peer's certificate, false otherwise, defaults to true
+    #     :verify [#setup_connection] An object that will configure any verification to do on the connection
     #     :redirect_limit [Fixnum] the number of allowed redirections, defaults to 10
     #   passing any other option in the options hash results in a Puppet::Error exception
     # @note the HTTP connection itself happens lazily only when {#request}, or one of the {#get}, {#post}, {#delete}, {#head} or {#put} is called
@@ -48,7 +48,7 @@ module Puppet::Network::HTTP
 
       options = OPTION_DEFAULTS.merge(options)
       @use_ssl = options[:use_ssl]
-      @verify_peer = options[:verify_peer]
+      @verify = options[:verify]
       @redirect_limit = options[:redirect_limit]
     end
 
@@ -128,23 +128,19 @@ module Puppet::Network::HTTP
     end
 
     def execute_request(method, *args)
-      ssl_validator = Puppet::SSL::Validator.new(:ssl_configuration => ssl_configuration)
-      # Perform our own validation of the SSL connection in addition to OpenSSL
-      ssl_validator.register_verify_callback(connection)
-
       response = connection.send(method, *args)
 
       # Check the peer certs and warn if they're nearing expiration.
-      warn_if_near_expiration(*ssl_validator.peer_certs)
+      warn_if_near_expiration(*@verify.peer_certs)
 
       response
     rescue OpenSSL::SSL::SSLError => error
       if error.message.include? "certificate verify failed"
         msg = error.message
-        msg << ": [" + ssl_validator.verify_errors.join('; ') + "]"
+        msg << ": [" + @verify.verify_errors.join('; ') + "]"
         raise Puppet::Error, msg
       elsif error.message =~ /hostname (\w+ )?not match/
-        leaf_ssl_cert = ssl_validator.peer_certs.last
+        leaf_ssl_cert = @verify.peer_certs.last
 
         valid_certnames = [leaf_ssl_cert.name, *leaf_ssl_cert.subject_alt_names].uniq
         msg = valid_certnames.length > 1 ? "one of #{valid_certnames.join(', ')}" : valid_certnames.first
@@ -181,23 +177,7 @@ module Puppet::Network::HTTP
 
     # Use cert information from a Puppet client to set up the http object.
     def cert_setup
-      if @verify_peer and FileTest.exist?(Puppet[:hostcert]) and FileTest.exist?(ssl_configuration.ca_auth_file)
-        @connection.cert_store  = ssl_host.ssl_store
-        @connection.ca_file     = ssl_configuration.ca_auth_file
-        @connection.cert        = ssl_host.certificate.content
-        @connection.verify_mode = OpenSSL::SSL::VERIFY_PEER
-        @connection.key         = ssl_host.key.content
-      else
-        # We don't have the local certificates, so we don't do any verification
-        # or setup at this early stage.  REVISIT: Shouldn't we supply the local
-        # certificate details if we have them?  The original code didn't.
-        # --daniel 2012-06-03
-
-        # Ruby 1.8 defaulted to this, but 1.9 defaults to peer verify,
-        # and we almost always talk to a dedicated, not-standard CA that
-        # isn't trusted out of the box.  This forces the expected state.
-        @connection.verify_mode = OpenSSL::SSL::VERIFY_NONE
-      end
+      @verify.setup_connection(@connection)
     end
 
     # This method largely exists for testing purposes, so that we can
@@ -205,18 +185,5 @@ module Puppet::Network::HTTP
     def create_connection(*args)
       Net::HTTP.new(*args)
     end
-
-    # Use the global localhost instance.
-    def ssl_host
-      Puppet::SSL::Host.localhost
-    end
-
-    def ssl_configuration
-      @ssl_configuration ||= Puppet::SSL::Configuration.new(
-          Puppet[:localcacert],
-          :ca_chain_file => Puppet[:ssl_client_ca_chain],
-          :ca_auth_file  => Puppet[:ssl_client_ca_auth]
-      )
-    end
   end
 end

data/lib/puppet/network/http/handler.rb

@@ -89,15 +89,20 @@ module Puppet::Network::HTTP::Handler
     configure_profiler(request_headers, request_params)
 
     Puppet::Util::Profiler.profile("Processed request #{request_method} #{request_path}") do
-      indirection, method, key, params = uri2indirection(request_method, request_path, request_params)
+      indirection_name, method, key, params = uri2indirection(request_method, request_path, request_params)
 
-      check_authorization(indirection, method, key, params)
+      check_authorization(indirection_name, method, key, params)
       warn_if_near_expiration(client_cert(request))
 
+      indirection = Puppet::Indirector::Indirection.instance(indirection_name.to_sym)
+      raise ArgumentError, "Could not find indirection '#{indirection_name}'" unless indirection
+
+      if !indirection.allow_remote_requests?
+        raise HTTPNotFoundError, "No handler for #{indirection.name}"
+      end
+
       send("do_#{method}", indirection, key, params, request, response)
     end
-  rescue SystemExit,NoMemoryError
-    raise
   rescue HTTPError => e
     return do_http_control_exception(response, e)
   rescue Exception => e
@@ -129,19 +134,13 @@ module Puppet::Network::HTTP::Handler
     set_response(response, exception.to_s, status)
   end
 
-  def model(indirection_name)
-    raise ArgumentError, "Could not find indirection '#{indirection_name}'" unless indirection = Puppet::Indirector::Indirection.instance(indirection_name.to_sym)
-    indirection.model
-  end
-
   # Execute our find.
-  def do_find(indirection_name, key, params, request, response)
-    model_class = model(indirection_name)
-    unless result = model_class.indirection.find(key, params)
-      raise HTTPNotFoundError, "Could not find #{indirection_name} #{key}"
+  def do_find(indirection, key, params, request, response)
+    unless result = indirection.find(key, params)
+      raise HTTPNotFoundError, "Could not find #{indirection.name} #{key}"
     end
 
-    format = accepted_response_formatter_for(model_class, request)
+    format = accepted_response_formatter_for(indirection.model, request)
     set_content_type(response, format)
 
     rendered_result = result
@@ -157,9 +156,9 @@ module Puppet::Network::HTTP::Handler
   end
 
   # Execute our head.
-  def do_head(indirection_name, key, params, request, response)
-    unless self.model(indirection_name).indirection.head(key, params)
-      raise HTTPNotFoundError, "Could not find #{indirection_name} #{key}"
+  def do_head(indirection, key, params, request, response)
+    unless indirection.head(key, params)
+      raise HTTPNotFoundError, "Could not find #{indirection.name} #{key}"
     end
 
     # No need to set a response because no response is expected from a
@@ -167,38 +166,35 @@ module Puppet::Network::HTTP::Handler
   end
 
   # Execute our search.
-  def do_search(indirection_name, key, params, request, response)
-    model  = self.model(indirection_name)
-    result = model.indirection.search(key, params)
+  def do_search(indirection, key, params, request, response)
+    result = indirection.search(key, params)
 
     if result.nil?
-      raise HTTPNotFoundError, "Could not find instances in #{indirection_name} with '#{key}'"
+      raise HTTPNotFoundError, "Could not find instances in #{indirection.name} with '#{key}'"
     end
 
-    format = accepted_response_formatter_for(model, request)
+    format = accepted_response_formatter_for(indirection.model, request)
     set_content_type(response, format)
 
-    set_response(response, model.render_multiple(format, result))
+    set_response(response, indirection.model.render_multiple(format, result))
   end
 
   # Execute our destroy.
-  def do_destroy(indirection_name, key, params, request, response)
-    model_class = model(indirection_name)
-    formatter = accepted_response_formatter_or_yaml_for(model_class, request)
+  def do_destroy(indirection, key, params, request, response)
+    formatter = accepted_response_formatter_or_yaml_for(indirection.model, request)
 
-    result = model_class.indirection.destroy(key, params)
+    result = indirection.destroy(key, params)
 
     set_content_type(response, formatter)
     set_response(response, formatter.render(result))
   end
 
   # Execute our save.
-  def do_save(indirection_name, key, params, request, response)
-    model_class = model(indirection_name)
-    formatter = accepted_response_formatter_or_yaml_for(model_class, request)
-    sent_object = read_body_into_model(model_class, request)
+  def do_save(indirection, key, params, request, response)
+    formatter = accepted_response_formatter_or_yaml_for(indirection.model, request)
+    sent_object = read_body_into_model(indirection.model, request)
 
-    result = model_class.indirection.save(sent_object, key)
+    result = indirection.save(sent_object, key)
 
     set_content_type(response, formatter)
     set_response(response, formatter.render(result))

data/lib/puppet/network/http/webrick.rb

@@ -10,7 +10,6 @@ require 'puppet/ssl/configuration'
 class Puppet::Network::HTTP::WEBrick
   def initialize
     @listening = false
-    @mutex = Mutex.new
   end
 
   def listen(address, port)
@@ -25,34 +24,28 @@ class Puppet::Network::HTTP::WEBrick
 
     @server.mount('/', Puppet::Network::HTTP::WEBrickREST, :this_value_is_apparently_necessary_but_unused)
 
-    @mutex.synchronize do
-      raise "WEBrick server is already listening" if @listening
-      @listening = true
-      @thread = Thread.new {
-        @server.start { |sock|
-          raise "Client disconnected before connection could be established" unless IO.select([sock],nil,nil,6.2)
-          sock.accept
-          @server.run(sock)
-        }
-      }
-      sleep 0.1 until @server.status == :Running
+    raise "WEBrick server is already listening" if @listening
+    @listening = true
+    @thread = Thread.new do
+      @server.start do |sock|
+        raise "Client disconnected before connection could be established" unless IO.select([sock],nil,nil,6.2)
+        sock.accept
+        @server.run(sock)
+      end
     end
+    sleep 0.1 until @server.status == :Running
   end
 
   def unlisten
-    @mutex.synchronize do
-      raise "WEBrick server is not listening" unless @listening
-      @server.shutdown
-      wait_for_shutdown
-      @server = nil
-      @listening = false
-    end
+    raise "WEBrick server is not listening" unless @listening
+    @server.shutdown
+    wait_for_shutdown
+    @server = nil
+    @listening = false
   end
 
   def listening?
-    @mutex.synchronize do
-      @listening
-    end
+    @listening
   end
 
   def wait_for_shutdown

data/lib/puppet/network/http_pool.rb

@@ -2,18 +2,52 @@ require 'puppet/network/http/connection'
 
 module Puppet::Network; end
 
-# This class is basically a placeholder for managing a pool of HTTP connections;
-# at present it does not actually attempt to pool them.  Historically, it did
-# attempt to do so, but this didn't work well based on Puppet's threading model.
-# The pooling functionality has been removed, but this abstraction is still here
-# because the API is used in various places and because it could be useful
-# should we decide to implement pooling at some point in the future.
+# This module contains the factory methods that should be used for getting a
+# Puppet::Network::HTTP::Connection instance.
+#
+# The name "HttpPool" is a misnomer, and a leftover of history, but we would
+# like to make this cache connections in the future.
+#
+# @api public
+#
 module Puppet::Network::HttpPool
 
-  # Retrieve a cached http instance if caching is enabled, else return
-  # a new one.
+  # Retrieve a connection for the given host and port.
+  #
+  # @param host [String] The hostname to connect to
+  # @param port [Integer] The port on the host to connect to
+  # @param use_ssl [Boolean] Whether to use an SSL connection
+  # @param verify_peer [Boolean] Whether to verify the peer credentials, if possible. Verification will not take place if the CA certificate is missing.
+  # @return [Puppet::Network::HTTP::Connection]
+  #
+  # @api public
+  #
   def self.http_instance(host, port, use_ssl = true, verify_peer = true)
-    Puppet::Network::HTTP::Connection.new(host, port, :use_ssl => use_ssl, :verify_peer => verify_peer)
+    verifier = if verify_peer
+                 Puppet::SSL::Validator.default_validator()
+               else
+                 Puppet::SSL::Validator.no_validator()
+               end
+
+    Puppet::Network::HTTP::Connection.new(host, port,
+                                          :use_ssl => use_ssl,
+                                          :verify => verifier)
   end
 
+  # Get an http connection that will be secured with SSL and have the
+  # connection verified with the given verifier
+  #
+  # @param host [String] the DNS name to connect to
+  # @param port [Integer] the port to connect to
+  # @param verifier [#setup_connection, #peer_certs, #verify_errors] An object that will setup the appropriate
+  #   verification on a Net::HTTP instance and report any errors and the certificates used.
+  # @return [Puppet::Network::HTTP::Connection]
+  #
+  # @api public
+  #
+  def self.http_ssl_instance(host, port, verifier = Puppet::SSL::Validator.default_validator())
+    Puppet::Network::HTTP::Connection.new(host, port,
+                                          :use_ssl => true,
+                                          :verify => verifier)
+  end
 end

data/lib/puppet/node.rb

@@ -16,7 +16,7 @@ class Puppet::Node
   indirects :node, :terminus_setting => :node_terminus, :doc => "Where to find node information.
     A node is composed of its name, its facts, and its environment."
 
-  attr_accessor :name, :classes, :source, :ipaddress, :parameters
+  attr_accessor :name, :classes, :source, :ipaddress, :parameters, :trusted_data
   attr_reader :time, :facts
 
   ::PSON.register_document_type('Node',self)
@@ -31,17 +31,25 @@ class Puppet::Node
     node
   end
 
-  def to_pson(*args)
+  def to_data_hash
     result = {
+      'name' => name,
+      'environment' => environment.name,
+    }
+    result['classes'] = classes unless classes.empty?
+    result['parameters'] = parameters unless parameters.empty?
+    result
+  end
+
+  def to_pson_data_hash(*args)
+    {
       'document_type' => "Node",
-      'data' => {}
+      'data' =>  to_data_hash,
     }
-    result['data']['name'] = name
-    result['data']['classes'] = classes unless classes.empty?
-    result['data']['parameters'] = parameters unless parameters.empty?
-    result['data']['environment'] = environment.name
+  end
 
-    result.to_pson(*args)
+  def to_pson(*args)
+    to_pson_data_hash.to_pson(*args)
   end
 
   def environment
@@ -84,6 +92,7 @@ class Puppet::Node
   # Merge the node facts with parameters from the node source.
   def fact_merge
     if @facts = Puppet::Node::Facts.indirection.find(name, :environment => environment)
+      @facts.sanitize
       merge(@facts.values)
     end
   rescue => detail
@@ -143,4 +152,11 @@ class Puppet::Node
     end
     tmp.reverse
   end
+
+  # Ensures the data is frozen
+  #
+  def trusted_data=(data)
+    Puppet.warning("Trusted node data modified for node #{name}") unless @trusted_data.nil?
+    @trusted_data = data.freeze
+  end
 end