puppet 3.8.7 → 4.0.0.rc1

data/lib/puppet/settings/base_setting.rb

@@ -2,32 +2,17 @@ require 'puppet/settings/errors'
 
 # The base setting type
 class Puppet::Settings::BaseSetting
-  attr_accessor :name, :desc, :section, :default, :call_on_define, :call_hook
+  attr_accessor :name, :desc, :section, :default, :call_hook
   attr_reader :short, :deprecated
 
   def self.available_call_hook_values
     [:on_define_and_write, :on_initialize_and_write, :on_write_only]
   end
 
-  def call_on_define
-    Puppet.deprecation_warning "call_on_define has been deprecated.  Please use call_hook_on_define?"
-    call_hook_on_define?
-  end
-
-  def call_on_define=(value)
-    if value
-      Puppet.deprecation_warning ":call_on_define has been changed to :call_hook => :on_define_and_write. Please change #{name}."
-      @call_hook = :on_define_and_write
-    else
-      Puppet.deprecation_warning ":call_on_define => :false has been changed to :call_hook => :on_write_only. Please change #{name}."
-      @call_hook = :on_write_only
-    end
-  end
-
   def call_hook=(value)
     if value.nil?
       Puppet.warning "Setting :#{name} :call_hook is nil, defaulting to :on_write_only"
-      value ||= :on_write_only
+      value = :on_write_only
     end
     raise ArgumentError, "Invalid option #{value} for call_hook" unless self.class.available_call_hook_values.include? value
     @call_hook = value
@@ -41,19 +26,6 @@ class Puppet::Settings::BaseSetting
     call_hook == :on_initialize_and_write
   end
 
-  #added as a proper method, only to generate a deprecation warning
-  #and return value from
-  def setbycli
-    Puppet.deprecation_warning "Puppet.settings.setting(#{name}).setbycli is deprecated. Use Puppet.settings.set_by_cli?(#{name}) instead."
-    @settings.set_by_cli?(name)
-  end
-
-  def setbycli=(value)
-    Puppet.deprecation_warning "Puppet.settings.setting(#{name}).setbycli= is deprecated. You should not manually set that values were specified on the command line."
-    @settings.set_value(name, @settings[name], :cli) if value
-    raise ArgumentError, "Cannot unset setbycli" unless value
-  end
-
   # get the arguments in getopt format
   def getopt_args
     if short
@@ -192,4 +164,8 @@ class Puppet::Settings::BaseSetting
   def allowed_on_commandline?
     @deprecated == :allowed_on_commandline
   end
+
+  def inspect
+    %Q{<#{self.class}:#{self.object_id} @name="#{@name}" @section="#{@section}" @default="#{@default}" @call_hook="#{@call_hook}">}
+  end
 end

data/lib/puppet/settings/config_file.rb

@@ -7,20 +7,26 @@ require 'puppet/settings/ini_file'
 #
 class Puppet::Settings::ConfigFile
 
-  ALLOWED_SECTION_NAMES = ['main', 'master', 'agent', 'user'].freeze
-
   ##
   # @param value_converter [Proc] a function that will convert strings into ruby types
-  #
   def initialize(value_converter)
     @value_converter = value_converter
   end
 
-  def parse_file(file, text)
+  # @param file [String, File] pointer to the file whose text we are parsing
+  # @param text [String] the actual text of the inifile to be parsed
+  # @param allowed_section_names [Array] an optional array of accepted section
+  #   names; if this list is non-empty, sections outside of it will raise an
+  #   error.
+  # @return A Struct with a +sections+ array representing each configuration section
+  def parse_file(file, text, allowed_section_names = [])
     result = Conf.new
+    if !allowed_section_names.empty?
+      allowed_section_names << 'main' unless allowed_section_names.include?('main')
+    end
 
     ini = Puppet::Settings::IniFile.parse(StringIO.new(text))
-    unique_sections_in(ini, file).each do |section_name|
+    unique_sections_in(ini, file, allowed_section_names).each do |section_name|
       section = Section.new(section_name.to_sym)
       result.with_section(section)
 
@@ -73,13 +79,10 @@ class Puppet::Settings::ConfigFile
 
 private
 
-  def unique_sections_in(ini, file)
+  def unique_sections_in(ini, file, allowed_section_names)
     ini.section_lines.collect do |section|
-      if section.name == "application_defaults" || section.name == "global_defaults"
-        raise Puppet::Error, "Illegal section '#{section.name}' in config file #{file} at line #{section.line_number}"
-      end
-      if !ALLOWED_SECTION_NAMES.include?(section.name)
-        Puppet.deprecation_warning("Sections other than #{ALLOWED_SECTION_NAMES.join(', ')} are deprecated in puppet.conf. Please use the directory environments feature to specify environments. (See http://docs.puppetlabs.com/puppet/latest/reference/environments.html)")
+      if !allowed_section_names.empty? && !allowed_section_names.include?(section.name)
+        raise(Puppet::Error, "Illegal section '#{section.name}' in config file #{file} at line #{section.line_number}. The only valid puppet.conf sections are: [#{allowed_section_names.join(", ")}]. Please use the directory environments feature to specify environments. (See http://docs.puppetlabs.com/puppet/latest/reference/environments.html)")
       end
       section.name
     end.uniq

data/lib/puppet/settings/duration_setting.rb

@@ -21,7 +21,7 @@ class Puppet::Settings::DurationSetting < Puppet::Settings::BaseSetting
   # Convert the value to an integer, parsing numeric string with units if necessary.
   def munge(value)
     case
-    when value.is_a?(Integer)
+    when value.is_a?(Integer) || value.nil?
       value
     when (value.is_a?(String) and value =~ FORMAT)
       $1.to_i * UNITMAP[$2 || 's']

data/lib/puppet/settings/environment_conf.rb

@@ -1,7 +1,9 @@
 # Configuration settings for a single directory Environment.
 # @api private
 class Puppet::Settings::EnvironmentConf
-  VALID_SETTINGS = [:modulepath, :manifest, :config_version, :environment_timeout, :parser].freeze
+
+  ENVIRONMENT_CONF_ONLY_SETTINGS = [:modulepath, :manifest, :config_version].freeze
+  VALID_SETTINGS = (ENVIRONMENT_CONF_ONLY_SETTINGS + [:environment_timeout, :environment_data_provider]).freeze
 
   # Given a path to a directory environment, attempts to load and parse an
   # environment.conf in ini format, and return an EnvironmentConf instance.
@@ -37,8 +39,8 @@ class Puppet::Settings::EnvironmentConf
   # Configuration values are exactly those returned by the environment object,
   # without interpolation.  This is a special case for the default configured
   # environment returned by the Puppet::Environments::StaticPrivate loader.
-  def self.static_for(environment, parser, environment_timeout = 0)
-    Static.new(environment, environment_timeout, parser)
+  def self.static_for(environment, environment_timeout = 0)
+    Static.new(environment, environment_timeout)
   end
 
   attr_reader :section, :path_to_env, :global_modulepath
@@ -90,6 +92,12 @@ class Puppet::Settings::EnvironmentConf
     end
   end
 
+  def environment_data_provider
+    get_setting(:environment_data_provider, Puppet.settings.value(:environment_data_provider)) do |value|
+      value
+    end
+  end
+
   def modulepath
     default_modulepath = [File.join(@path_to_env, "modules")] + @global_module_path
     get_setting(:modulepath, default_modulepath) do |modulepath|
@@ -100,12 +108,6 @@ class Puppet::Settings::EnvironmentConf
     end
   end
 
-  def parser
-    get_setting(:parser, Puppet.settings.value(:parser)) do |value|
-      value
-    end
-  end
-
   def config_version
     get_setting(:config_version) do |config_version|
       absolute(config_version)
@@ -158,12 +160,12 @@ class Puppet::Settings::EnvironmentConf
   # @api private
   class Static
     attr_reader :environment_timeout
-    attr_reader :parser
+    attr_reader :environment_data_provider
 
-    def initialize(environment, environment_timeout, parser)
+    def initialize(environment, environment_timeout, environment_data_provider = 'none')
       @environment = environment
       @environment_timeout = environment_timeout
-      @parser = parser
+      @environment_data_provider = environment_data_provider
     end
 
     def manifest

data/lib/puppet/settings/file_setting.rb

@@ -219,16 +219,15 @@ class Puppet::Settings::FileSetting < Puppet::Settings::StringSetting
     Puppet::Util::SUIDManager.asuser(*chown) do
       # Update the umask to make non-executable files
       Puppet::Util.withumask(File.umask ^ 0111) do
-        yielded_value = case self.mode
-                        when String
-                          self.mode.to_i(8)
-                        when NilClass
-                          0640
-                        else
-                          self.mode
-                        end
-
-        yield yielded_value
+        mode = case mode.class
+                 when String
+                   mode.to_i(8)
+                 when NilClass
+                   0640
+                 else
+                   mode
+                 end
+        yield mode
       end
     end
   end

data/lib/puppet/settings/ttl_setting.rb

@@ -3,8 +3,6 @@
 # to live in seconds, and the symbolic entry 'unlimited' is an infinite amount of time.
 #
 class Puppet::Settings::TTLSetting < Puppet::Settings::BaseSetting
-  INFINITY = 1.0 / 0.0
-
   # How we convert from various units to seconds.
   UNITMAP = {
     # 365 days isn't technically a year, but is sufficient for most purposes
@@ -37,7 +35,7 @@ class Puppet::Settings::TTLSetting < Puppet::Settings::BaseSetting
       value
 
     when value == 'unlimited'
-      INFINITY
+      Float::INFINITY
 
     when (value.is_a?(String) and value =~ FORMAT)
       $1.to_i * UNITMAP[$2 || 's']

data/lib/puppet/ssl/certificate.rb

@@ -32,13 +32,6 @@ DOC
     content.not_after
   end
 
-  def near_expiration?(interval = nil)
-    return false unless expiration
-    interval ||= Puppet[:certificate_expire_warning]
-    # Certificate expiration timestamps are always in UTC
-    expiration < Time.now.utc + interval
-  end
-
   # This name is what gets extracted from the subject before being passed
   # to the constructor, so it's not downcased
   def unmunged_name
@@ -60,6 +53,43 @@ DOC
         Puppet::SSL::Oids.subtree_of?('ppPrivCertExt', ext.oid)
     end
 
-    custom_exts.map { |ext| {'oid' => ext.oid, 'value' => ext.value} }
+    custom_exts.map do |ext|
+      {'oid' => ext.oid, 'value' => get_ext_val(ext.oid)}
+    end
+  end
+
+  private
+
+
+  # Extract the extensions sequence from the wrapped certificate's raw ASN.1 form
+  def exts_seq
+    # See RFC-2459 section 4.1 (https://tools.ietf.org/html/rfc2459#section-4.1)
+    # to see where this is defined. Essentially this is saying "in the first
+    # sequence in the certificate, find the item that's tagged with 3. This
+    # is where the extensions are stored."
+    @extensions_tag ||= 3
+
+    @exts_seq ||= OpenSSL::ASN1.decode(content.to_der).value[0].find do |data|
+      (data.tag == @extensions_tag) && (data.tag_class == :CONTEXT_SPECIFIC)
+    end.value[0]
   end
+
+  # Get the DER parsed value of an X.509 extension by it's OID, or short name
+  # if one has been registered with OpenSSL.
+  def get_ext_val(oid)
+    ext_obj = exts_seq.value.find do |ext_seq|
+      ext_seq.value[0].value == oid
+    end
+
+    raw_val = ext_obj.value.last.value
+
+    begin
+      OpenSSL::ASN1.decode(raw_val).value
+    rescue OpenSSL::ASN1::ASN1Error
+      # This is required to maintain backward compatibility with the previous
+      # way trusted facts were signed. See PUP-3560
+      raw_val
+    end
+  end
+
 end

data/lib/puppet/ssl/certificate_authority/interface.rb

@@ -5,7 +5,7 @@ module Puppet
       # CA.  Its job is to provide a CLI-like interface to the CA class.
       class Interface
         INTERFACE_METHODS = [:destroy, :list, :revoke, :generate, :sign, :print, :verify, :fingerprint, :reinventory]
-
+        DESTRUCTIVE_METHODS = [:destroy, :revoke]
         SUBJECTLESS_METHODS = [:list, :reinventory]
 
         class InterfaceError < ArgumentError; end
@@ -18,6 +18,12 @@ module Puppet
             raise ArgumentError, "You must provide hosts or --all when using #{method}"
           end
 
+          destructive_subjects = [:signed, :all].include?(subjects)
+          if DESTRUCTIVE_METHODS.include?(method) && destructive_subjects
+            subject_text = (subjects == :all ? subjects : "all signed")
+            raise ArgumentError, "Refusing to #{method} #{subject_text} certs, provide an explicit list of certs to #{method}"
+          end
+
           # if the interface implements the method, use it instead of the ca's method
           if respond_to?(method)
             send(method, ca)

data/lib/puppet/ssl/certificate_factory.rb

@@ -6,12 +6,12 @@ require 'puppet/ssl'
 # @api private
 module Puppet::SSL::CertificateFactory
 
-  # Create, add extensions to, and sign a new X509 certificate.
+  # Create a new X509 certificate and add any needed extensions to the cert.
   #
   # @param cert_type [Symbol] The certificate type to create, which specifies
   #   what extensions are added to the certificate.
   #   One of (:ca, :terminalsubca, :server, :ocsp, :client)
-  # @param csr [OpenSSL::X509::Request] The signing request associated with
+  # @param csr [Puppet::SSL::CertificateRequest] The signing request associated with
   #   the certificate being created.
   # @param issuer [OpenSSL::X509::Certificate, OpenSSL::X509::Request] An X509 CSR
   #   if this is a self signed certificate, or the X509 certificate of the CA if
@@ -213,7 +213,7 @@ module Puppet::SSL::CertificateFactory
       # This is not an X509v3 extension which means that the extension
       # factory cannot generate it. We need to generate the extension
       # manually.
-      OpenSSL::X509::Extension.new(oid, val, crit)
+      OpenSSL::X509::Extension.new(oid, OpenSSL::ASN1::UTF8String.new(val).to_der, crit)
     end
   end
 end

data/lib/puppet/ssl/certificate_request.rb

@@ -107,6 +107,37 @@ DOC
     @content
   end
 
+  def ext_value_to_ruby_value(asn1_arr)
+    # A list of ASN1 types than can't be directly converted to a Ruby type
+    @non_convertable ||= [OpenSSL::ASN1::EndOfContent,
+                          OpenSSL::ASN1::BitString,
+                          OpenSSL::ASN1::Null,
+                          OpenSSL::ASN1::Enumerated,
+                          OpenSSL::ASN1::UTCTime,
+                          OpenSSL::ASN1::GeneralizedTime,
+                          OpenSSL::ASN1::Sequence,
+                          OpenSSL::ASN1::Set]
+
+    begin
+      # Attempt to decode the extension's DER data located in the original OctetString
+      asn1_val = OpenSSL::ASN1.decode(asn1_arr.last.value)
+    rescue OpenSSL::ASN1::ASN1Error
+      # This is to allow supporting the old-style of not DER encoding trusted facts
+      return asn1_arr.last.value
+    end
+
+    # If the extension value can not be directly converted to an atomic Ruby
+    # type, use the original ASN1 value. This is needed to work around a bug
+    # in Ruby's OpenSSL library which doesn't convert the value of unknown
+    # extension OIDs properly. See PUP-3560
+    if @non_convertable.include?(asn1_val.class) then
+      # Allows OpenSSL to take the ASN1 value and turn it into something Ruby understands
+      OpenSSL::X509::Extension.new(asn1_arr.first.value, asn1_val.to_der).value
+    else
+      asn1_val.value
+    end
+  end
+
   # Return the set of extensions requested on this CSR, in a form designed to
   # be useful to Ruby: an array of hashes.  Which, not coincidentally, you can pass
   # successfully to the OpenSSL constructor later, if you want.
@@ -128,7 +159,8 @@ DOC
     index = -1
     extensions.map do |ext_values|
       index += 1
-      context = "#{attribute.oid} extension index #{index}"
+
+      value = ext_value_to_ruby_value(ext_values)
 
       # OK, turn that into an extension, to unpack the content.  Lovely that
       # we have to swap the order of arguments to the underlying method, or
@@ -137,13 +169,9 @@ DOC
       # fixed component in the sequence.
       case ext_values.length
       when 2
-        ev = OpenSSL::X509::Extension.new(ext_values[0].value, ext_values[1].value)
-        { "oid" => ev.oid, "value" => ev.value }
-
+        {"oid" => ext_values[0].value, "value" => value}
       when 3
-        ev = OpenSSL::X509::Extension.new(ext_values[0].value, ext_values[2].value, ext_values[1].value)
-        { "oid" => ev.oid, "value" => ev.value, "critical" => ev.critical? }
-
+        {"oid" => ext_values[0].value, "value" => value, "critical" => ext_values[1].value}
       else
         raise Puppet::Error, "In #{attribute.oid}, expected extension record #{index} to have two or three items, but found #{ext_values.length}"
       end
@@ -227,7 +255,7 @@ DOC
             raise Puppet::Error, "Cannot specify CSR extension request #{oid}: conflicts with internally used extension request"
           end
 
-          ext = OpenSSL::X509::Extension.new(oid, value.to_s, false)
+          ext = OpenSSL::X509::Extension.new(oid, OpenSSL::ASN1::UTF8String.new(value.to_s).to_der, false)
           extensions << ext
         rescue OpenSSL::X509::ExtensionError => e
           raise Puppet::Error, "Cannot create CSR with extension request #{oid}: #{e.message}", e.backtrace

data/lib/puppet/ssl/configuration.rb

@@ -4,23 +4,17 @@ module Puppet
 module SSL
   # Puppet::SSL::Configuration is intended to separate out the following concerns:
   # * CA certificates that authenticate peers (ca_auth_file)
-  # * CA certificates that build trust but do not authenticate (ca_chain_file)
   # * Who clients trust as distinct from who servers trust.  We should not
   #   assume one single self signed CA cert for everyone.
 class Configuration
   def initialize(localcacert, options={})
-    if (options[:ca_chain_file] and not options[:ca_auth_file])
-      raise ArgumentError, "The CA auth chain is required if the chain file is provided"
-    end
     @localcacert = localcacert
-    @ca_chain_file = options[:ca_chain_file]
     @ca_auth_file = options[:ca_auth_file]
   end
 
-  # The ca_chain_file method is intended to return the PEM bundle of CA certs
-  # establishing trust but not used for peer authentication.
+  # @deprecated Use {#ca_auth_file} instead.
   def ca_chain_file
-    @ca_chain_file || ca_auth_file
+    ca_auth_file
   end
 
   # The ca_auth_file method is intended to return the PEM bundle of CA certs

data/lib/puppet/ssl/host.rb

@@ -126,11 +126,6 @@ DOC
     instance
   end
 
-  def self.from_pson(pson)
-    Puppet.deprecation_warning("from_pson is being removed in favour of from_data_hash.")
-    self.from_data_hash(pson)
-  end
-
   # Puppet::SSL::Host is actually indirected now so the original implementation
   # has been moved into the certificate_status indirector.  This method does not
   # appear to be in use in `puppet cert -l`.
@@ -326,9 +321,7 @@ ERROR_STRING
       return if certificate
       generate
       return if certificate
-    rescue SystemExit,NoMemoryError
-      raise
-    rescue Exception => detail
+    rescue StandardError => detail
       Puppet.log_exception(detail, "Could not request certificate: #{detail.message}")
       if time < 1
         puts "Exiting; failed to retrieve certificate and waitforcert is disabled"