puppet 3.4.3 → 3.5.0.rc1

data/lib/puppet/network/http/api/v2.rb

@@ -0,0 +1,32 @@
+module Puppet::Network::HTTP::API::V2
+  require 'puppet/network/http/api/v2/environments'
+  require 'puppet/network/http/api/v2/authorization'
+
+  def self.routes
+    path(%r{^/v2\.0}).
+      get(Authorization.new).
+      chain(ENVIRONMENTS, NOT_FOUND)
+  end
+
+  private
+
+  def self.path(path)
+    Puppet::Network::HTTP::Route.path(path)
+  end
+
+  def self.provide(&block)
+    lambda do |request, response|
+      block.call.call(request, response)
+    end
+  end
+
+  NOT_FOUND = Puppet::Network::HTTP::Route.
+    path(/.*/).
+    any(lambda do |req, res|
+      raise Puppet::Network::HTTP::Error::HTTPNotFoundError.new(req.path, Puppet::Network::HTTP::Issues::HANDLER_NOT_FOUND)
+    end)
+
+  ENVIRONMENTS = path(%r{^/environments$}).get(provide do
+    Environments.new(Puppet.lookup(:environments))
+  end)
+end

data/lib/puppet/network/http/api/v2/authorization.rb

@@ -0,0 +1,13 @@
+class Puppet::Network::HTTP::API::V2::Authorization
+  include Puppet::Network::Authorization
+
+  def call(request, response)
+    raise Puppet::Network::HTTP::Error::HTTPNotAuthorizedError, "Only GET requests are authorized for V2 endpoints" unless request.method == "GET"
+
+    begin
+      check_authorization(:find, request.path, request.params)
+    rescue Puppet::Network::AuthorizationError => e
+      raise Puppet::Network::HTTP::Error::HTTPNotAuthorizedError, e.message, e.backtrace
+    end
+  end
+end

data/lib/puppet/network/http/api/v2/environments.rb

@@ -0,0 +1,21 @@
+require 'json'
+
+class Puppet::Network::HTTP::API::V2::Environments
+  def initialize(env_loader)
+    @env_loader = env_loader
+  end
+
+  def call(request, response)
+    response.respond_with(200, "application/json", JSON.dump({
+      "search_paths" => @env_loader.search_paths,
+      "environments" => Hash[@env_loader.list.collect do |env|
+        [env.name, {
+          "settings" => {
+            "modulepath" => env.full_modulepath,
+            "manifest" => env.manifest
+          }
+        }]
+      end]
+    }))
+  end
+end

data/lib/puppet/network/http/connection.rb

@@ -19,13 +19,14 @@ module Puppet::Network::HTTP
   #   certificate configuration for their authentication, and
   # * Provides some useful error handling for any SSL errors that occur
   #   during a request.
+  # @api public
   class Connection
     include Puppet::Network::Authentication
 
     OPTION_DEFAULTS = {
       :use_ssl => true,
       :verify => nil,
-      :redirect_limit => 10
+      :redirect_limit => 10,
     }
 
     @@openssl_initialized = false
@@ -33,13 +34,20 @@ module Puppet::Network::HTTP
     # Creates a new HTTP client connection to `host`:`port`.
     # @param host [String] the host to which this client will connect to
     # @param port [Fixnum] the port to which this client will connect to
-    # @param options [Hash] options influencing the properties of the created connection,
-    #   the following options are recognized:
-    #     :use_ssl [Boolean] true to connect with SSL, false otherwise, defaults to true
-    #     :verify [#setup_connection] An object that will configure any verification to do on the connection
-    #     :redirect_limit [Fixnum] the number of allowed redirections, defaults to 10
-    #   passing any other option in the options hash results in a Puppet::Error exception
-    # @note the HTTP connection itself happens lazily only when {#request}, or one of the {#get}, {#post}, {#delete}, {#head} or {#put} is called
+    # @param options [Hash] options influencing the properties of the created
+    #   connection,
+    # @option options [Boolean] :use_ssl true to connect with SSL, false
+    #   otherwise, defaults to true
+    # @option options [#setup_connection] :verify An object that will configure
+    #   any verification to do on the connection
+    # @option options [Fixnum] :redirect_limit the number of allowed
+    #   redirections, defaults to 10 passing any other option in the options
+    #   hash results in a Puppet::Error exception
+    #
+    # @note the HTTP connection itself happens lazily only when {#request}, or
+    #   one of the {#get}, {#post}, {#delete}, {#head} or {#put} is called
+    # @note The correct way to obtain a connection is to use one of the factory
+    #   methods on {Puppet::Network::HttpPool}
     # @api private
     def initialize(host, port, options = {})
       @host = host
@@ -54,41 +62,59 @@ module Puppet::Network::HTTP
       @redirect_limit = options[:redirect_limit]
     end
 
-    def get(*args)
-      request(:get, *args)
+    # @!macro [new] common_options
+    #   @param options [Hash] options influencing the request made
+    #   @option options [Hash{Symbol => String}] :basic_auth The basic auth
+    #     :username and :password to use for the request
+
+    # @param path [String]
+    # @param headers [Hash{String => String}]
+    # @!macro common_options
+    # @api public
+    def get(path, headers = {}, options = {})
+      request_with_redirects(Net::HTTP::Get.new(path, headers), options)
     end
 
-    def post(*args)
-      request(:post, *args)
+    # @param path [String]
+    # @param data [String]
+    # @param headers [Hash{String => String}]
+    # @!macro common_options
+    # @api public
+    def post(path, data, headers = nil, options = {})
+      request = Net::HTTP::Post.new(path, headers)
+      request.body = data
+      request_with_redirects(request, options)
     end
 
-    def head(*args)
-      request(:head, *args)
+    # @param path [String]
+    # @param headers [Hash{String => String}]
+    # @!macro common_options
+    # @api public
+    def head(path, headers = {}, options = {})
+      request_with_redirects(Net::HTTP::Head.new(path, headers), options)
     end
 
-    def delete(*args)
-      request(:delete, *args)
+    # @param path [String]
+    # @param headers [Hash{String => String}]
+    # @!macro common_options
+    # @api public
+    def delete(path, headers = {'Depth' => 'Infinity'}, options = {})
+      request_with_redirects(Net::HTTP::Delete.new(path, headers), options)
     end
 
-    def put(*args)
-      request(:put, *args)
+    # @param path [String]
+    # @param data [String]
+    # @param headers [Hash{String => String}]
+    # @!macro common_options
+    # @api public
+    def put(path, data, headers = nil, options = {})
+      request = Net::HTTP::Put.new(path, headers)
+      request.body = data
+      request_with_redirects(request, options)
     end
 
     def request(method, *args)
-      current_args = args.dup
-      @redirect_limit.times do |redirection|
-        response = execute_request(method, *args)
-        return response unless [301, 302, 307].include?(response.code.to_i)
-
-        # handle the redirection
-        location = URI.parse(response['location'])
-        @connection = initialize_connection(location.host, location.port, location.scheme == 'https')
-
-        # update to the current request path
-        current_args = [location.path] + current_args.drop(1)
-        # and try again...
-      end
-      raise RedirectionLimitExceededException, "Too many HTTP redirections for #{@host}:#{@port}"
+      self.send(method, *args)
     end
 
     # TODO: These are proxies for the Net::HTTP#request_* methods, which are
@@ -125,12 +151,42 @@ module Puppet::Network::HTTP
 
     private
 
+    def request_with_redirects(request, options)
+      current_request = request
+      @redirect_limit.times do |redirection|
+        apply_options_to(current_request, options)
+
+        response = execute_request(current_request)
+        return response unless [301, 302, 307].include?(response.code.to_i)
+
+        # handle the redirection
+        location = URI.parse(response['location'])
+        @connection = initialize_connection(location.host, location.port, location.scheme == 'https')
+
+        # update to the current request path
+        current_request = current_request.class.new(location.path)
+        current_request.body = request.body
+        request.each do |header, value|
+          current_request[header] = value
+        end
+
+        # and try again...
+      end
+      raise RedirectionLimitExceededException, "Too many HTTP redirections for #{@host}:#{@port}"
+    end
+
+    def apply_options_to(request, options)
+      if options[:basic_auth]
+        request.basic_auth(options[:basic_auth][:user], options[:basic_auth][:password])
+      end
+    end
+
     def connection
       @connection || initialize_connection(@host, @port, @use_ssl)
     end
 
-    def execute_request(method, *args)
-      response = connection.send(method, *args)
+    def execute_request(request)
+      response = connection.request(request)
 
       # Check the peer certs and warn if they're nearing expiration.
       warn_if_near_expiration(*@verify.peer_certs)
@@ -140,14 +196,15 @@ module Puppet::Network::HTTP
       if error.message.include? "certificate verify failed"
         msg = error.message
         msg << ": [" + @verify.verify_errors.join('; ') + "]"
-        raise Puppet::Error, msg
-      elsif error.message =~ /hostname (\w+ )?not match/
+        raise Puppet::Error, msg, error.backtrace
+      elsif error.message =~ /hostname.*not match.*server certificate/
         leaf_ssl_cert = @verify.peer_certs.last
 
         valid_certnames = [leaf_ssl_cert.name, *leaf_ssl_cert.subject_alt_names].uniq
         msg = valid_certnames.length > 1 ? "one of #{valid_certnames.join(', ')}" : valid_certnames.first
+        msg = "Server hostname '#{connection.address}' did not match server certificate; expected #{msg}"
 
-        raise Puppet::Error, "Server hostname '#{connection.address}' did not match server certificate; expected #{msg}"
+        raise Puppet::Error, msg, error.backtrace
       else
         raise
       end

data/lib/puppet/network/http/error.rb

@@ -0,0 +1,69 @@
+require 'json'
+
+module Puppet::Network::HTTP::Error
+  Issues = Puppet::Network::HTTP::Issues
+
+  class HTTPError < Exception
+    attr_reader :status, :issue_kind
+
+    def initialize(message, status, issue_kind)
+      super(message)
+      @status = status
+      @issue_kind = issue_kind
+    end
+
+    def to_json
+      JSON({:message => message, :issue_kind => @issue_kind})
+    end
+  end
+
+  class HTTPNotAcceptableError < HTTPError
+    CODE = 406
+    def initialize(message, issue_kind = Issues::RUNTIME_ERROR)
+      super("Not Acceptable: " + message, CODE, issue_kind)
+    end
+  end
+
+  class HTTPNotFoundError < HTTPError
+    CODE = 404
+    def initialize(message, issue_kind = Issues::RUNTIME_ERROR)
+      super("Not Found: " + message, CODE, issue_kind)
+    end
+  end
+
+  class HTTPNotAuthorizedError < HTTPError
+    CODE = 403
+    def initialize(message, issue_kind = Issues::RUNTIME_ERROR)
+      super("Not Authorized: " + message, CODE, issue_kind)
+    end
+  end
+
+  class HTTPBadRequestError < HTTPError
+    CODE = 400
+    def initialize(message, issue_kind = Issues::RUNTIME_ERROR)
+      super("Bad Request: " + message, CODE, issue_kind)
+    end
+  end
+
+  class HTTPMethodNotAllowedError < HTTPError
+    CODE = 405
+    def initialize(message, issue_kind = Issues::RUNTIME_ERROR)
+      super("Method Not Allowed: " + message, CODE, issue_kind)
+    end
+  end
+
+  class HTTPServerError < HTTPError
+    CODE = 500
+
+    attr_reader :backtrace
+
+    def initialize(original_error, issue_kind = Issues::RUNTIME_ERROR)
+      super("Server Error: " + original_error.message, CODE, issue_kind)
+      @backtrace = original_error.backtrace
+    end
+
+    def to_json
+      JSON({:message => message, :issue_kind => @issue_kind, :stacktrace => self.backtrace})
+    end
+  end
+end

data/lib/puppet/network/http/handler.rb

@@ -3,110 +3,76 @@ end
 
 require 'puppet/network/http'
 require 'puppet/network/http/api/v1'
-require 'puppet/network/authorization'
 require 'puppet/network/authentication'
 require 'puppet/network/rights'
 require 'puppet/util/profiler'
 require 'resolv'
 
 module Puppet::Network::HTTP::Handler
-  include Puppet::Network::HTTP::API::V1
-  include Puppet::Network::Authorization
   include Puppet::Network::Authentication
+  include Puppet::Network::HTTP::Issues
 
   # These shouldn't be allowed to be set by clients
   # in the query string, for security reasons.
   DISALLOWED_KEYS = ["node", "ip"]
 
-  class HTTPError < Exception
-    attr_reader :status
-
-    def initialize(message, status)
-      super(message)
-      @status = status
-    end
-  end
-
-  class HTTPNotAcceptableError < HTTPError
-    def initialize(message)
-      super("Not Acceptable: " + message, 406)
+  def register(routes)
+    # There's got to be a simpler way to do this, right?
+    dupes = {}
+    routes.each { |r| dupes[r.path_matcher] = (dupes[r.path_matcher] || 0) + 1 }
+    dupes = dupes.collect { |pm, count| pm if count > 1 }.compact
+    if dupes.count > 0
+      raise ArgumentError, "Given multiple routes with identical path regexes: #{dupes.map{ |rgx| rgx.inspect }.join(', ')}"
     end
-  end
 
-  class HTTPNotFoundError < HTTPError
-    def initialize(message)
-      super("Not Found: " + message, 404)
+    @routes = routes
+    Puppet.debug("Routes Registered:")
+    @routes.each do |route|
+      Puppet.debug(route.inspect)
     end
   end
 
-  attr_reader :server, :handler
-
   # Retrieve all headers from the http request, as a hash with the header names
   # (lower-cased) as the keys
   def headers(request)
     raise NotImplementedError
   end
 
-  # Retrieve the accept header from the http request.
-  def accept_header(request)
-    raise NotImplementedError
-  end
-
-  # Retrieve the Content-Type header from the http request.
-  def content_type_header(request)
-    raise NotImplementedError
-  end
-
-  def request_format(request)
-    if header = content_type_header(request)
-      header.gsub!(/\s*;.*$/,'') # strip any charset
-      format = Puppet::Network::FormatHandler.mime(header)
-      raise "Client sent a mime-type (#{header}) that doesn't correspond to a format we support" if format.nil?
-      report_if_deprecated(format)
-      return format.name.to_s if format.suitable?
-    end
-
-    raise "No Content-Type header was received, it isn't possible to unserialize the request"
-  end
-
   def format_to_mime(format)
     format.is_a?(Puppet::Network::Format) ? format.mime : format
   end
 
-  def initialize_for_puppet(server)
-    @server = server
-  end
-
   # handle an HTTP request
   def process(request, response)
+    new_response = Puppet::Network::HTTP::Response.new(self, response)
+
     request_headers = headers(request)
     request_params = params(request)
     request_method = http_method(request)
     request_path = path(request)
 
+    new_request = Puppet::Network::HTTP::Request.new(request_headers, request_params, request_method, request_path, request_path, client_cert(request), body(request))
+
     response[Puppet::Network::HTTP::HEADER_PUPPET_VERSION] = Puppet.version
 
     configure_profiler(request_headers, request_params)
+    warn_if_near_expiration(new_request.client_cert)
 
     Puppet::Util::Profiler.profile("Processed request #{request_method} #{request_path}") do
-      indirection_name, method, key, params = uri2indirection(request_method, request_path, request_params)
-
-      check_authorization(indirection_name, method, key, params)
-      warn_if_near_expiration(client_cert(request))
-
-      indirection = Puppet::Indirector::Indirection.instance(indirection_name.to_sym)
-      raise ArgumentError, "Could not find indirection '#{indirection_name}'" unless indirection
-
-      if !indirection.allow_remote_requests?
-        raise HTTPNotFoundError, "No handler for #{indirection.name}"
+      if route = @routes.find { |route| route.matches?(new_request) }
+        route.process(new_request, new_response)
+      else
+        raise Puppet::Network::HTTP::Error::HTTPNotFoundError.new("No route for #{new_request.method} #{new_request.path}", HANDLER_NOT_FOUND)
       end
-
-      send("do_#{method}", indirection, key, params, request, response)
     end
-  rescue HTTPError => e
-    return do_http_control_exception(response, e)
+
+  rescue Puppet::Network::HTTP::Error::HTTPError => e
+    Puppet.info(e.message)
+    new_response.respond_with(e.status, "application/json", e.to_json)
   rescue Exception => e
-    return do_exception(response, e)
+    http_e = Puppet::Network::HTTP::Error::HTTPServerError.new(e)
+    Puppet.err(http_e.message)
+    new_response.respond_with(http_e.status, "application/json", http_e.to_json)
   ensure
     cleanup(request)
   end
@@ -121,85 +87,6 @@ module Puppet::Network::HTTP::Handler
     raise NotImplementedError
   end
 
-  def do_exception(response, exception, status=400)
-    if exception.is_a?(Puppet::Network::AuthorizationError)
-      # make sure we return the correct status code
-      # for authorization issues
-      status = 403 if status == 400
-    end
-
-    Puppet.log_exception(exception)
-
-    set_content_type(response, "text/plain")
-    set_response(response, exception.to_s, status)
-  end
-
-  # Execute our find.
-  def do_find(indirection, key, params, request, response)
-    unless result = indirection.find(key, params)
-      raise HTTPNotFoundError, "Could not find #{indirection.name} #{key}"
-    end
-
-    format = accepted_response_formatter_for(indirection.model, request)
-    set_content_type(response, format)
-
-    rendered_result = result
-    if result.respond_to?(:render)
-      Puppet::Util::Profiler.profile("Rendered result in #{format}") do
-        rendered_result = result.render(format)
-      end
-    end
-
-    Puppet::Util::Profiler.profile("Sent response") do
-      set_response(response, rendered_result)
-    end
-  end
-
-  # Execute our head.
-  def do_head(indirection, key, params, request, response)
-    unless indirection.head(key, params)
-      raise HTTPNotFoundError, "Could not find #{indirection.name} #{key}"
-    end
-
-    # No need to set a response because no response is expected from a
-    # HEAD request.  All we need to do is not die.
-  end
-
-  # Execute our search.
-  def do_search(indirection, key, params, request, response)
-    result = indirection.search(key, params)
-
-    if result.nil?
-      raise HTTPNotFoundError, "Could not find instances in #{indirection.name} with '#{key}'"
-    end
-
-    format = accepted_response_formatter_for(indirection.model, request)
-    set_content_type(response, format)
-
-    set_response(response, indirection.model.render_multiple(format, result))
-  end
-
-  # Execute our destroy.
-  def do_destroy(indirection, key, params, request, response)
-    formatter = accepted_response_formatter_or_yaml_for(indirection.model, request)
-
-    result = indirection.destroy(key, params)
-
-    set_content_type(response, formatter)
-    set_response(response, formatter.render(result))
-  end
-
-  # Execute our save.
-  def do_save(indirection, key, params, request, response)
-    formatter = accepted_response_formatter_or_yaml_for(indirection.model, request)
-    sent_object = read_body_into_model(indirection.model, request)
-
-    result = indirection.save(sent_object, key)
-
-    set_content_type(response, formatter)
-    set_response(response, formatter.render(result))
-  end
-
   # resolve node name from peer's ip address
   # this is used when the request is unauthenticated
   def resolve_node(result)
@@ -213,61 +100,6 @@ module Puppet::Network::HTTP::Handler
 
   private
 
-  def do_http_control_exception(response, exception)
-    msg = exception.message
-    Puppet.info(msg)
-    set_content_type(response, "text/plain")
-    set_response(response, msg, exception.status)
-  end
-
-  def report_if_deprecated(format)
-    if format.name == :yaml || format.name == :b64_zlib_yaml
-      Puppet.deprecation_warning("YAML in network requests is deprecated and will be removed in a future version. See http://links.puppetlabs.com/deprecate_yaml_on_network")
-    end
-  end
-
-  def accepted_response_formatter_for(model_class, request)
-    accepted_formats = accept_header(request) or raise HTTPNotAcceptableError, "Missing required Accept header"
-    response_formatter_for(model_class, request, accepted_formats)
-  end
-
-  def accepted_response_formatter_or_yaml_for(model_class, request)
-    accepted_formats = accept_header(request) || "yaml"
-    response_formatter_for(model_class, request, accepted_formats)
-  end
-
-  def response_formatter_for(model_class, request, accepted_formats)
-    formatter = Puppet::Network::FormatHandler.most_suitable_format_for(
-      accepted_formats.split(/\s*,\s*/),
-      model_class.supported_formats)
-
-    if formatter.nil?
-      raise HTTPNotAcceptableError, "No supported formats are acceptable (Accept: #{accepted_formats})"
-    end
-
-    report_if_deprecated(formatter)
-    formatter
-  end
-
-  def read_body_into_model(model_class, request)
-    data = body(request).to_s
-
-    format = request_format(request)
-    model_class.convert_from(format, data)
-  end
-
-  def get?(request)
-    http_method(request) == 'GET'
-  end
-
-  def put?(request)
-    http_method(request) == 'PUT'
-  end
-
-  def delete?(request)
-    http_method(request) == 'DELETE'
-  end
-
   # methods to be overridden by the including web server class
 
   def http_method(request)