puppet 4.0.0 → 4.9.1

data/lib/puppet/settings/file_setting.rb

@@ -185,6 +185,11 @@ class Puppet::Settings::FileSetting < Puppet::Settings::StringSetting
   end
 
   # @api private
+  # @param option [String] Extra file operation mode information to use
+  #   (defaults to read-only mode 'r')
+  #   This is the standard mechanism Ruby uses in the IO class, and therefore
+  #   encoding may be explicitly like fmode : encoding or fmode : "BOM|UTF-*"
+  #   for example, a:ASCII or w+:UTF-8
   def exclusive_open(option = 'r', &block)
     controlled_access do |mode|
       Puppet::FileSystem.exclusive_open(file(), mode, option, &block)
@@ -192,6 +197,11 @@ class Puppet::Settings::FileSetting < Puppet::Settings::StringSetting
   end
 
   # @api private
+  # @param option [String] Extra file operation mode information to use
+  #   (defaults to read-only mode 'r')
+  #   This is the standard mechanism Ruby uses in the IO class, and therefore
+  #   encoding may be explicitly like fmode : encoding or fmode : "BOM|UTF-*"
+  #   for example, a:ASCII or w+:UTF-8
   def open(option = 'r', &block)
     controlled_access do |mode|
       Puppet::FileSystem.open(file, mode, option, &block)
@@ -219,15 +229,16 @@ class Puppet::Settings::FileSetting < Puppet::Settings::StringSetting
     Puppet::Util::SUIDManager.asuser(*chown) do
       # Update the umask to make non-executable files
       Puppet::Util.withumask(File.umask ^ 0111) do
-        mode = case mode.class
-                 when String
-                   mode.to_i(8)
-                 when NilClass
-                   0640
-                 else
-                   mode
-                 end
-        yield mode
+        yielded_value = case self.mode
+                        when String
+                          self.mode.to_i(8)
+                        when NilClass
+                          0640
+                        else
+                          self.mode
+                        end
+
+        yield yielded_value
       end
     end
   end

data/lib/puppet/settings/ini_file.rb

@@ -13,9 +13,9 @@ class Puppet::Settings::IniFile
     config = new([DefaultSection.new])
     config_fh.each_line do |line|
       case line
-      when /^(\s*)\[(\w+)\](\s*)$/
+      when /^(\s*)\[([[:word:]]+)\](\s*)$/
         config.append(SectionLine.new($1, $2, $3))
-      when /^(\s*)(\w+)(\s*=\s*)(.*?)(\s*)$/
+      when /^(\s*)([[:word:]]+)(\s*=\s*)(.*?)(\s*)$/
         config.append(SettingLine.new($1, $2, $3, $4, $5))
       else
         config.append(Line.new(line))

data/lib/puppet/settings/server_list_setting.rb

@@ -0,0 +1,20 @@
+class Puppet::Settings::ServerListSetting < Puppet::Settings::ArraySetting
+
+  def type
+    :server_list
+  end
+
+  def munge(value)
+    servers = super 
+    servers.map! { |server| 
+      case server
+      when String
+        server.split(':')
+      when Array
+        server
+      else
+        raise ArgumentError, "Expected an Array of String, got a #{value.class}"
+      end
+    }
+  end
+end

data/lib/puppet/settings/symbolic_enum_setting.rb

@@ -0,0 +1,17 @@
+class Puppet::Settings::SymbolicEnumSetting < Puppet::Settings::BaseSetting
+  attr_accessor :values
+
+  def type
+    :symbolic_enum
+  end
+
+  def munge(value)
+    sym = value.to_sym
+    if values.include?(sym)
+      sym
+    else
+      raise Puppet::Settings::ValidationError,
+        "Invalid value '#{value}' for parameter #{@name}. Allowed values are '#{values.join("', '")}'"
+    end
+  end
+end

data/lib/puppet/settings.rb

@@ -3,6 +3,7 @@ require 'getoptlong'
 require 'puppet/util/watched_file'
 require 'puppet/util/command_line/puppet_option_parser'
 require 'forwardable'
+require 'fileutils'
 
 # The class for handling configuration files.
 class Puppet::Settings
@@ -13,6 +14,7 @@ class Puppet::Settings
   require 'puppet/settings/base_setting'
   require 'puppet/settings/string_setting'
   require 'puppet/settings/enum_setting'
+  require 'puppet/settings/symbolic_enum_setting'
   require 'puppet/settings/array_setting'
   require 'puppet/settings/file_setting'
   require 'puppet/settings/directory_setting'
@@ -27,6 +29,7 @@ class Puppet::Settings
   require 'puppet/settings/config_file'
   require 'puppet/settings/value_translator'
   require 'puppet/settings/environment_conf'
+  require 'puppet/settings/server_list_setting'
 
   # local reference for convenience
   PuppetOptionParser = Puppet::Util::CommandLine::PuppetOptionParser
@@ -338,9 +341,27 @@ class Puppet::Settings
     call_hooks_deferred_to_application_initialization
     issue_deprecations
 
+    REQUIRED_APP_SETTINGS.each do |key|
+      create_ancestors(Puppet[key])
+    end
+
     @app_defaults_initialized = true
   end
 
+  # Create ancestor directories.
+  #
+  # @param dir [String] absolute path for a required application default directory
+  # @api private
+
+  def create_ancestors(dir)
+    parent_dir = File.dirname(dir)
+
+    if !File.exist?(parent_dir)
+      FileUtils.mkdir_p(parent_dir)
+    end
+  end
+  private :create_ancestors
+
   def call_hooks_deferred_to_application_initialization(options = {})
     @hooks_to_call_on_application_initialization.each do |setting|
       begin
@@ -542,7 +563,7 @@ class Puppet::Settings
           # will have associated hooks that it ends up being less work this
           # way overall.
           if setting.call_hook_on_initialize?
-            @hooks_to_call_on_application_initialization << setting
+            @hooks_to_call_on_application_initialization |= [ setting ]
           else
             setting.handle(ChainedValues.new(
               preferred_run_mode,
@@ -615,7 +636,7 @@ class Puppet::Settings
     # because multiple sections could set the same value
     # and I'm too lazy to only set the metadata once.
     if @configuration_file
-      searchpath(nil, preferred_run_mode).reverse.each do |source|
+      searchpath(nil, preferred_run_mode).reverse_each do |source|
         if source.type == :section && section = @configuration_file.sections[source.name]
           apply_metadata_from_section(section)
         end
@@ -644,8 +665,10 @@ class Puppet::Settings
       :ttl        => TTLSetting,
       :array      => ArraySetting,
       :enum       => EnumSetting,
+      :symbolic_enum   => SymbolicEnumSetting,
       :priority   => PrioritySetting,
       :autosign   => AutosignSetting,
+      :server_list => ServerListSetting
   }
 
   # Create a new setting.  The value is passed in because it's used to determine
@@ -730,13 +753,13 @@ class Puppet::Settings
 
   class SearchPathElement < Struct.new(:name, :type); end
 
-  # The order in which to search for values.
+  # The order in which to search for values, without defaults.
   #
   # @param environment [String,Symbol] symbolic reference to an environment name
   # @param run_mode [Symbol] symbolic reference to a Puppet run mode
   # @return [Array<SearchPathElement>]
   # @api private
-  def searchpath(environment = nil, run_mode = preferred_run_mode)
+  def configsearchpath(environment = nil, run_mode = preferred_run_mode)
     searchpath = [
       SearchPathElement.new(:memory, :values),
       SearchPathElement.new(:cli, :values),
@@ -744,6 +767,16 @@ class Puppet::Settings
     searchpath << SearchPathElement.new(environment.intern, :environment) if environment
     searchpath << SearchPathElement.new(run_mode, :section) if run_mode
     searchpath << SearchPathElement.new(:main, :section)
+  end
+
+  # The order in which to search for values.
+  #
+  # @param environment [String,Symbol] symbolic reference to an environment name
+  # @param run_mode [Symbol] symbolic reference to a Puppet run mode
+  # @return [Array<SearchPathElement>]
+  # @api private
+  def searchpath(environment = nil, run_mode = preferred_run_mode)
+    searchpath = configsearchpath(environment, run_mode)
     searchpath << SearchPathElement.new(:application_defaults, :values)
     searchpath << SearchPathElement.new(:overridden_defaults, :values)
   end
@@ -780,6 +813,34 @@ class Puppet::Settings
     !@value_sets[:cli].lookup(param).nil?
   end
 
+  # Get values from a search path entry.
+  # @api private
+  def searchpath_values(source)
+    case source.type
+    when :values
+      @value_sets[source.name]
+    when :section
+      if @configuration_file && section = @configuration_file.sections[source.name]
+        ValuesFromSection.new(source.name, section)
+      end
+    when :environment
+      ValuesFromEnvironmentConf.new(source.name)
+    else
+      raise(Puppet::DevError, "Unknown searchpath case: #{source.type} for the #{source} settings path element.")
+    end
+  end
+
+  # Allow later inspection to determine if the setting was set by user
+  # config, rather than a default setting.
+  def set_by_config?(param, environment = nil, run_mode = preferred_run_mode)
+    param = param.to_sym
+    configsearchpath(environment, run_mode).any? do |source|
+      if vals = searchpath_values(source)
+        vals.lookup(param)
+      end
+    end
+  end
+
   # Patches the value for a param in a section.
   # This method is required to support the use case of unifying --dns-alt-names and
   # --dns_alt_names in the certificate face. Ideally this should be cleaned up.
@@ -817,7 +878,7 @@ class Puppet::Settings
   #           also supports additional options such as "mode", "owner", "group"
   #       :directory - A (single) directory path; puppet may attempt to create this file depending on how the settings are used.  This type
   #           also supports additional options such as "mode", "owner", "group"
-  #       :path - This is intended to be used for settings whose value can contain multiple directory paths, respresented
+  #       :path - This is intended to be used for settings whose value can contain multiple directory paths, represented
   #           as strings separated by the system path separator (e.g. system path, module path, etc.).
   #     [:mode] => an (optional) octal value to be used as the permissions/mode for :file and :directory settings
   #     [:owner] => optional owner username/uid for :file and :directory settings
@@ -849,7 +910,7 @@ class Puppet::Settings
         if tryconfig.call_hook_on_define?
           call << tryconfig
         elsif tryconfig.call_hook_on_initialize?
-          @hooks_to_call_on_application_initialization << tryconfig
+          @hooks_to_call_on_application_initialization |= [ tryconfig ]
         end
       end
 
@@ -928,6 +989,8 @@ Generated on #{Time.now}.
 
     return if sections.empty?
 
+    Puppet.debug("Applying settings catalog for sections #{sections.join(', ')}")
+
     begin
       catalog = to_catalog(*sections).to_ral
     rescue => detail
@@ -1018,7 +1081,7 @@ Generated on #{Time.now}.
   #
   # @api private
   # @todo this code duplicates {Puppet::Util::RunMode#which_dir} as described
-  #   in {http://projects.puppetlabs.com/issues/16637 #16637}
+  #   in {https://projects.puppetlabs.com/issues/16637 #16637}
   def which_configuration_file
     if explicit_config_file? or Puppet.features.root? then
       return main_config_file
@@ -1124,26 +1187,13 @@ Generated on #{Time.now}.
 
   # Yield each search source in turn.
   def value_sets_for(environment, mode)
-    searchpath(environment, mode).collect do |source|
-      case source.type
-      when :values
-        @value_sets[source.name]
-      when :section
-        if @configuration_file && section = @configuration_file.sections[source.name]
-          ValuesFromSection.new(source.name, section)
-        end
-      when :environment
-        ValuesFromEnvironmentConf.new(source.name)
-      else
-        raise(Puppet::DevError, "Unknown searchpath case: #{source.type} for the #{source} settings path element.")
-      end
-    end.compact
+    searchpath(environment, mode).collect { |source| searchpath_values(source) }.compact
   end
 
   # Read the file in.
   # @api private
   def read_file(file)
-    return Puppet::FileSystem.read(file)
+    return Puppet::FileSystem.read(file, :encoding => 'utf-8')
   end
 
   # Private method for internal test use only; allows to do a comprehensive clear of all settings between tests.
@@ -1312,12 +1362,21 @@ Generated on #{Time.now}.
           "Attempt to assign a value to unknown setting #{name.inspect}"
       end
 
-      if default.has_hook?
-        default.handle(value)
-      end
-
+      # This little exception-handling dance ensures that a hook is
+      # able to check whether a value for itself has been explicitly
+      # set, while still preserving the existing value if the hook
+      # throws (as was existing behavior)
+      old_value = @values[name]
       @values[name] = value
-    end
+      begin
+        if default.has_hook?
+          default.handle(value)
+        end
+      rescue Exception => e
+        @values[name] = old_value
+        raise e
+      end
+     end
 
     def inspect
       %Q{<#{self.class}:#{self.object_id} @name="#{@name}" @values="#{@values}">}
@@ -1371,7 +1430,7 @@ Generated on #{Time.now}.
     end
 
     def conf
-      @conf ||= if environments = Puppet.lookup(:environments)
+      @conf ||= if environments = Puppet.lookup(:environments) { nil }
                   environments.get_conf(@environment_name)
                 end
     end

data/lib/puppet/ssl/certificate_authority/interface.rb

@@ -8,6 +8,9 @@ module Puppet
         DESTRUCTIVE_METHODS = [:destroy, :revoke]
         SUBJECTLESS_METHODS = [:list, :reinventory]
 
+        CERT_STATUS_GLYPHS = {:signed => '+', :request => ' ', :invalid => '-'}
+        VALID_CONFIRMATION_VALUES = %w{y Y yes Yes YES}
+
         class InterfaceError < ArgumentError; end
 
         attr_reader :method, :subjects, :digest, :options
@@ -71,19 +74,30 @@ module Puppet
           return if hosts.empty?
 
           hosts.uniq.sort.each do |host|
+            verify_error = nil
+
             begin
               ca.verify(host) unless requests.include?(host)
             rescue Puppet::SSL::CertificateAuthority::CertificateVerificationError => details
-              verify_error = details.to_s
+              verify_error = "(#{details.to_s})"
             end
 
             if verify_error
-              certs[:invalid][host] = [ Puppet::SSL::Certificate.indirection.find(host), verify_error ]
+              type = :invalid
+              cert = Puppet::SSL::Certificate.indirection.find(host)
             elsif (signed and signed.include?(host))
-              certs[:signed][host]  = Puppet::SSL::Certificate.indirection.find(host)
+              type = :signed
+              cert = Puppet::SSL::Certificate.indirection.find(host)
             else
-              certs[:request][host] = Puppet::SSL::CertificateRequest.indirection.find(host)
+              type = :request
+              cert = Puppet::SSL::CertificateRequest.indirection.find(host)
             end
+
+            certs[type][host] = {
+              :cert         => cert,
+              :type         => type,
+              :verify_error => verify_error,
+            }
           end
 
           names = certs.values.map(&:keys).flatten
@@ -95,37 +109,133 @@ module Puppet
           output = [:request, :signed, :invalid].map do |type|
             next if certs[type].empty?
 
-            certs[type].map do |host,info|
-              format_host(ca, host, type, info, name_width)
+            certs[type].map do |host, info|
+              format_host(host, info, name_width, options[:format])
             end
           end.flatten.compact.sort.join("\n")
 
           puts output
         end
 
-        def format_host(ca, host, type, info, width)
-          cert, verify_error = info
-          alt_names = case type
-                      when :signed
-                        cert.subject_alt_names
-                      when :request
-                        cert.subject_alt_names
-                      else
-                        []
-                      end
+        def format_host(host, info, width, format)
+          case format
+          when :machine
+            machine_host_formatting(host, info)
+          when :human
+            human_host_formatting(host, info)
+          else
+            if options[:verbose]
+              machine_host_formatting(host, info)
+            else
+              legacy_host_formatting(host, info, width)
+            end
+          end
+        end
+
+        def machine_host_formatting(host, info)
+          type         = info[:type]
+          verify_error = info[:verify_error]
+          cert         = info[:cert]
+          alt_names    = cert.subject_alt_names - [host]
+          extensions   = format_attrs_and_exts(cert)
+
+          glyph       = CERT_STATUS_GLYPHS[type]
+          name        = host.inspect
+          fingerprint = cert.digest(@digest).to_s
+
+          expiration  = cert.expiration.iso8601 if type == :signed
+
+          if type != :invalid
+            if !alt_names.empty?
+              extensions.unshift("alt names: #{alt_names.map(&:inspect).join(', ')}")
+            end
+
+            if !extensions.empty?
+              metadata_string = "(#{extensions.join(', ')})" unless extensions.empty?
+            end
+          end
+
+          [glyph, name, fingerprint, expiration, metadata_string, verify_error].compact.join(' ')
+        end
+
+        def human_host_formatting(host, info)
+          type         = info[:type]
+          verify_error = info[:verify_error]
+          cert         = info[:cert]
+          alt_names    = cert.subject_alt_names - [host]
+          extensions   = format_attrs_and_exts(cert)
+
+          glyph       = CERT_STATUS_GLYPHS[type]
+          fingerprint = cert.digest(@digest).to_s
+
+          if type == :invalid || (extensions.empty? && alt_names.empty?)
+            extension_string = ''
+          else
+            if !alt_names.empty?
+              extensions.unshift("alt names: #{alt_names.map(&:inspect).join(', ')}")
+            end
+
+            extension_string = "\n    Extensions:\n      "
+            extension_string << extensions.join("\n      ")
+          end
 
-          alt_names.delete(host)
+          if type == :signed
+            expiration_string = "\n    Expiration: #{cert.expiration.iso8601}"
+          else
+            expiration_string = ''
+          end
 
-          alt_str = "(alt names: #{alt_names.map(&:inspect).join(', ')})" unless alt_names.empty?
+          status = case type
+                   when :invalid then "Invalid - #{verify_error}"
+                   when :request then "Request Pending"
+                   when :signed then "Signed"
+                   end
+
+          output = "#{glyph} #{host.inspect}"
+          output << "\n  #{fingerprint}"
+          output << "\n    Status: #{status}"
+          output << expiration_string
+          output << extension_string
+          output << "\n"
+
+          output
+        end
 
-          glyph = {:signed => '+', :request => ' ', :invalid => '-'}[type]
+        def legacy_host_formatting(host, info, width)
+          type         = info[:type]
+          verify_error = info[:verify_error]
+          cert         = info[:cert]
+          alt_names    = cert.subject_alt_names - [host]
+          extensions   = format_attrs_and_exts(cert)
 
-          name = host.inspect.ljust(width)
+          glyph       = CERT_STATUS_GLYPHS[type]
+          name        = host.inspect.ljust(width)
           fingerprint = cert.digest(@digest).to_s
 
-          explanation = "(#{verify_error})" if verify_error
+          if type != :invalid
+            if alt_names.empty?
+              alt_name_string = nil
+            else
+              alt_name_string = "(alt names: #{alt_names.map(&:inspect).join(', ')})"
+            end
+
+            if extensions.empty?
+              extension_string = nil
+            else
+              extension_string = "**"
+            end
+          end
 
-          [glyph, name, fingerprint, alt_str, explanation].compact.join(' ')
+          [glyph, name, fingerprint, alt_name_string, verify_error, extension_string].compact.join(' ')
+        end
+
+        def format_attrs_and_exts(cert)
+          exts = []
+          exts += cert.custom_extensions if cert.respond_to?(:custom_extensions)
+          exts += cert.custom_attributes if cert.respond_to?(:custom_attributes)
+          exts += cert.request_extensions if cert.respond_to?(:request_extensions)
+
+          exts.map {|e| "#{e['oid']}: #{e['value'].inspect}" }.sort
         end
 
         # Set the method to apply.
@@ -140,7 +250,7 @@ module Puppet
             if value = ca.print(host)
               puts value
             else
-              Puppet.err "Could not find certificate for #{host}"
+              raise ArgumentError, "Could not find certificate for #{host}"
             end
           end
         end
@@ -151,17 +261,47 @@ module Puppet
             if cert = (Puppet::SSL::Certificate.indirection.find(host) || Puppet::SSL::CertificateRequest.indirection.find(host))
               puts "#{host} #{cert.digest(@digest)}"
             else
-              Puppet.err "Could not find certificate for #{host}"
+	      raise ArgumentError, "Could not find certificate for #{host}"
             end
           end
         end
 
-        # Signs given certificates or waiting of subjects == :all
+        # Signs given certificates or all waiting if subjects == :all
         def sign(ca)
           list = subjects == :all ? ca.waiting? : subjects
           raise InterfaceError, "No waiting certificate requests to sign" if list.empty?
+
+          signing_options = options.select { |k,_|
+            [:allow_authorization_extensions, :allow_dns_alt_names].include?(k)
+          }
+
           list.each do |host|
-            ca.sign(host, options[:allow_dns_alt_names])
+            cert = Puppet::SSL::CertificateRequest.indirection.find(host)
+
+            raise InterfaceError, "Could not find CSR for: #{host.inspect}." unless cert
+
+            # ca.sign will also do this - and it should if it is called
+            # elsewhere - but we want to reject an attempt to sign a
+            # problematic csr as early as possible for usability concerns.
+            ca.check_internal_signing_policies(host, cert, signing_options)
+
+            name_width = host.inspect.length
+            info = {:type => :request, :cert => cert}
+            host_string = format_host(host, info, name_width, options[:format])
+            puts "Signing Certificate Request for:\n#{host_string}"
+
+            if options[:interactive]
+              STDOUT.print "Sign Certificate Request? [y/N] "
+
+              if !options[:yes]
+                input = STDIN.gets.chomp
+                raise InterfaceError, "NOT Signing Certificate Request" unless VALID_CONFIRMATION_VALUES.include?(input)
+              else
+                puts "Assuming YES from `-y' or `--assume-yes' flag"
+              end
+            end
+
+            ca.sign(host, signing_options)
           end
         end