puppet 4.10.12-universal-darwin → 5.0.0-universal-darwin

data/lib/puppet/network/http/api/indirected_routes.rb

@@ -40,7 +40,7 @@ class Puppet::Network::HTTP::API::IndirectedRoutes
       # TODO: should we tell the user we found an indirection but it doesn't
       # allow remote requests, or just pretend there's no handler at all? what
       # are the security implications for the former?
-      raise Puppet::Network::HTTP::Error::HTTPNotFoundError.new("No handler for #{indirection.name}", :NO_INDIRECTION_REMOTE_REQUESTS)
+      raise Puppet::Network::HTTP::Error::HTTPNotFoundError.new(_("No handler for %{indirection}") % { indirection: indirection.name }, :NO_INDIRECTION_REMOTE_REQUESTS)
     end
 
     trusted = Puppet::Context::TrustedInformation.remote(params[:authenticated], params[:node], certificate)
@@ -57,7 +57,7 @@ class Puppet::Network::HTTP::API::IndirectedRoutes
 
     if indirection_name !~ /^\w+$/
       raise Puppet::Network::HTTP::Error::HTTPBadRequestError.new(
-        "The indirection name must be purely alphanumeric, not '#{indirection_name}'")
+        _("The indirection name must be purely alphanumeric, not '%{indirection_name}'") % { indirection_name: indirection_name })
     end
 
     # this also depluralizes the indirection_name if it is a search
@@ -67,24 +67,24 @@ class Puppet::Network::HTTP::API::IndirectedRoutes
     # request
     if url_prefix != IndirectionType.url_prefix_for(indirection_name)
       raise Puppet::Network::HTTP::Error::HTTPBadRequestError.new(
-        "Indirection '#{indirection_name}' does not match url prefix '#{url_prefix}'")
+        _("Indirection '%{indirection_name}' does not match url prefix '%{url_prefix}'") % { indirection_name: indirection_name, url_prefix: url_prefix })
     end
 
     indirection = Puppet::Indirector::Indirection.instance(indirection_name.to_sym)
     if !indirection
       raise Puppet::Network::HTTP::Error::HTTPNotFoundError.new(
-        "Could not find indirection '#{indirection_name}'",
+        _("Could not find indirection '%{indirection_name}'") % { indirection_name: indirection_name },
         Puppet::Network::HTTP::Issues::HANDLER_NOT_FOUND)
     end
 
     if !environment
       raise Puppet::Network::HTTP::Error::HTTPBadRequestError.new(
-        "An environment parameter must be specified")
+        _("An environment parameter must be specified"))
     end
 
     if ! Puppet::Node::Environment.valid_name?(environment)
       raise Puppet::Network::HTTP::Error::HTTPBadRequestError.new(
-        "The environment must be purely alphanumeric, not '#{environment}'")
+        _("The environment must be purely alphanumeric, not '%{environment}'") % { environment: environment })
     end
 
     configured_environment = Puppet.lookup(:environments).get(environment)
@@ -101,14 +101,14 @@ class Puppet::Network::HTTP::API::IndirectedRoutes
 
     if configured_environment.nil?
       raise Puppet::Network::HTTP::Error::HTTPNotFoundError.new(
-        "Could not find environment '#{environment}'")
+        _("Could not find environment '%{environment}'") % { environment: environment })
     end
 
     params.delete(:bucket_path)
 
     if key == "" or key.nil?
       raise Puppet::Network::HTTP::Error::HTTPBadRequestError.new(
-        "No request key specified in #{uri}")
+        _("No request key specified in %{uri}") % { uri: uri })
     end
 
     [indirection, method, key, params]
@@ -119,27 +119,28 @@ class Puppet::Network::HTTP::API::IndirectedRoutes
   # Execute our find.
   def do_find(indirection, key, params, request, response)
     unless result = indirection.find(key, params)
-      raise Puppet::Network::HTTP::Error::HTTPNotFoundError.new("Could not find #{indirection.name} #{key}", Puppet::Network::HTTP::Issues::RESOURCE_NOT_FOUND)
+      raise Puppet::Network::HTTP::Error::HTTPNotFoundError.new(_("Could not find %{value0} %{key}") % { value0: indirection.name, key: key }, Puppet::Network::HTTP::Issues::RESOURCE_NOT_FOUND)
     end
 
-    format = accepted_response_formatter_for(indirection.model, request)
-
     rendered_result = result
-    if result.respond_to?(:render)
-      Puppet::Util::Profiler.profile("Rendered result in #{format}", [:http, :v3_render, format]) do
-        rendered_result = result.render(format)
+
+    rendered_format = first_response_formatter_for(indirection.model, request) do |format|
+      if result.respond_to?(:render)
+        Puppet::Util::Profiler.profile(_("Rendered result in %{format}") % { format: format }, [:http, :v3_render, format]) do
+          rendered_result = result.render(format)
+        end
       end
     end
 
-    Puppet::Util::Profiler.profile("Sent response", [:http, :v3_response]) do
-      response.respond_with(200, format, rendered_result)
+    Puppet::Util::Profiler.profile(_("Sent response"), [:http, :v3_response]) do
+      response.respond_with(200, rendered_format, rendered_result)
     end
   end
 
   # Execute our head.
   def do_head(indirection, key, params, request, response)
     unless indirection.head(key, params)
-      raise Puppet::Network::HTTP::Error::HTTPNotFoundError.new("Could not find #{indirection.name} #{key}", Puppet::Network::HTTP::Issues::RESOURCE_NOT_FOUND)
+      raise Puppet::Network::HTTP::Error::HTTPNotFoundError.new(_("Could not find %{indirection} %{key}") % { indirection: indirection.name, key: key }, Puppet::Network::HTTP::Issues::RESOURCE_NOT_FOUND)
     end
 
     # No need to set a response because no response is expected from a
@@ -151,17 +152,21 @@ class Puppet::Network::HTTP::API::IndirectedRoutes
     result = indirection.search(key, params)
 
     if result.nil?
-      raise Puppet::Network::HTTP::Error::HTTPNotFoundError.new("Could not find instances in #{indirection.name} with '#{key}'", Puppet::Network::HTTP::Issues::RESOURCE_NOT_FOUND)
+      raise Puppet::Network::HTTP::Error::HTTPNotFoundError.new(_("Could not find instances in %{indirection} with '%{key}'") % { indirection: indirection.name, key: key }, Puppet::Network::HTTP::Issues::RESOURCE_NOT_FOUND)
     end
 
-    format = accepted_response_formatter_for(indirection.model, request)
+    rendered_result = nil
+
+    rendered_format = first_response_formatter_for(indirection.model, request) do |format|
+      rendered_result = indirection.model.render_multiple(format, result)
+    end
 
-    response.respond_with(200, format, indirection.model.render_multiple(format, result))
+    response.respond_with(200, rendered_format, rendered_result)
   end
 
   # Execute our destroy.
   def do_destroy(indirection, key, params, request, response)
-    formatter = accepted_response_formatter_or_pson_for(indirection.model, request)
+    formatter = accepted_response_formatter_or_json_for(indirection.model, request)
 
     result = indirection.destroy(key, params)
 
@@ -170,7 +175,7 @@ class Puppet::Network::HTTP::API::IndirectedRoutes
 
   # Execute our save.
   def do_save(indirection, key, params, request, response)
-    formatter = accepted_response_formatter_or_pson_for(indirection.model, request)
+    formatter = accepted_response_formatter_or_json_for(indirection.model, request)
     sent_object = read_body_into_model(indirection.model, request)
 
     result = indirection.save(sent_object, key)
@@ -178,30 +183,64 @@ class Puppet::Network::HTTP::API::IndirectedRoutes
     response.respond_with(200, formatter, formatter.render(result))
   end
 
-  def accepted_response_formatter_for(model_class, request)
-    accepted_formats = request.headers['accept'] or raise Puppet::Network::HTTP::Error::HTTPNotAcceptableError.new("Missing required Accept header", Puppet::Network::HTTP::Issues::MISSING_HEADER_FIELD)
-    request.response_formatter_for(model_class.supported_formats, accepted_formats)
+  # Return the first response formatter that didn't cause the yielded
+  # block to raise a FormatError.
+  def first_response_formatter_for(model, request, &block)
+    formats = accepted_response_formatters_for(model, request)
+    formatter = formats.find do |format|
+      begin
+        yield format
+        true
+      rescue Puppet::Network::FormatHandler::FormatError => e
+        false
+      end
+    end
+
+    return formatter if formatter
+
+    raise Puppet::Network::HTTP::Error::HTTPNotAcceptableError.new(
+            _("No supported formats are acceptable (Accept: %{accepted_formats})") % { accepted_formats: formats },
+            Puppet::Network::HTTP::Issues::UNSUPPORTED_FORMAT)
+  end
+
+  # Return an array of response formatters that the client accepts and
+  # the server supports.
+  def accepted_response_formatters_for(model_class, request)
+    request.response_formatters_for(model_class.supported_formats)
   end
 
-  def accepted_response_formatter_or_pson_for(model_class, request)
-    accepted_formats = request.headers['accept'] || "text/pson"
-    request.response_formatter_for(model_class.supported_formats, accepted_formats)
+  # Return the first response formatter that the client accepts and
+  # the server supports, or default to 'application/json'.
+  def accepted_response_formatter_or_json_for(model_class, request)
+    request.response_formatters_for(model_class.supported_formats, "application/json").first
   end
 
   def read_body_into_model(model_class, request)
     data = request.body.to_s
+    formatter = request.formatter
+
+    if formatter.supported?(model_class)
+      begin
+        return model_class.convert_from(formatter.name.to_s, data)
+      rescue => e
+        raise Puppet::Network::HTTP::Error::HTTPBadRequestError.new(
+          _("The request body is invalid: %{message}") % { message: e.message })
+      end
+    end
 
-    format = request.format
-    model_class.convert_from(format, data)
+    #TRANSLATORS "mime-type" is a keyword and should not be translated
+    raise Puppet::Network::HTTP::Error::HTTPUnsupportedMediaTypeError.new(
+      _("Client sent a mime-type (%{header}) that doesn't correspond to a format we support") % { header: request.headers['content-type'] },
+      Puppet::Network::HTTP::Issues::UNSUPPORTED_MEDIA_TYPE)
   end
 
   def indirection_method(http_method, indirection)
     raise Puppet::Network::HTTP::Error::HTTPMethodNotAllowedError.new(
-      "No support for http method #{http_method}") unless METHOD_MAP[http_method]
+      _("No support for http method %{http_method}") % { http_method: http_method }) unless METHOD_MAP[http_method]
 
     unless method = METHOD_MAP[http_method][plurality(indirection)]
       raise Puppet::Network::HTTP::Error::HTTPBadRequestError.new(
-        "No support for plurality #{plurality(indirection)} for #{http_method} operations")
+        _("No support for plurality %{indirection} for %{http_method} operations") % { indirection: plurality(indirection), http_method: http_method })
     end
 
     method
@@ -215,7 +254,7 @@ class Puppet::Network::HTTP::API::IndirectedRoutes
   def self.request_to_uri_and_body(request)
     url_prefix = IndirectionType.url_prefix_for(request.indirection_name.to_s)
     indirection = request.method == :search ? pluralize(request.indirection_name.to_s) : request.indirection_name.to_s
-    ["#{url_prefix}/#{indirection}/#{request.escaped_key}", "environment=#{request.environment.name}&#{request.query_string}"]
+    ["#{url_prefix}/#{indirection}/#{Puppet::Util.uri_encode(request.key)}", "environment=#{request.environment.name}&#{request.query_string}"]
   end
 
   def self.pluralize(indirection)

data/lib/puppet/network/http/api/master/v3/environment.rb

@@ -8,45 +8,64 @@ class Puppet::Network::HTTP::API::Master::V3::Environment
     code_id = request.params[:code_id]
 
     if env.nil?
-      raise Puppet::Network::HTTP::Error::HTTPNotFoundError.new("#{env_name} is not a known environment", Puppet::Network::HTTP::Issues::RESOURCE_NOT_FOUND)
+      raise Puppet::Network::HTTP::Error::HTTPNotFoundError.new(_("%{env_name} is not a known environment") % { env_name: env_name }, Puppet::Network::HTTP::Issues::RESOURCE_NOT_FOUND)
     end
 
     catalog = Puppet::Parser::EnvironmentCompiler.compile(env, code_id).to_resource
 
-    # This reads code_id off the catalog rather than using the one from the
-    # request. There shouldn't really be a case where the two differ, but if
-    # they do, the one from the catalog itself is authoritative.
-    env_graph = {:environment => env.name, :applications => {}, :code_id => catalog.code_id}
+    env_graph = build_environment_graph(catalog)
+
+    response.respond_with(200, "application/json", JSON.dump(env_graph))
+  end
+
+  def build_environment_graph(catalog)
+    # This reads catalog and code_id off the catalog rather than using the one
+    # from the request. There shouldn't really be a case where the two differ,
+    # but if they do, the one from the catalog itself is authoritative.
+    env_graph = {:environment => catalog.environment, :applications => {}, :code_id => catalog.code_id}
     applications = catalog.resources.select do |res|
       type = res.resource_type
       type.is_a?(Puppet::Resource::Type) && type.application?
     end
     applications.each do |app|
-      app_components = {}
+      file, line = app.file, app.line
+      nodes = app['nodes']
+
+      required_components = catalog.direct_dependents_of(app).map {|comp| comp.ref}
+      mapped_components = nodes.values.flatten.map {|comp| comp.ref}
+
+      nonexistent_components = mapped_components - required_components
+      if nonexistent_components.any?
+        raise Puppet::ParseError.new("Application #{app} assigns nodes to non-existent components: #{nonexistent_components.join(', ')}", file, line)
+      end
+
+      missing_components = required_components - mapped_components
+      if missing_components.any?
+        raise Puppet::ParseError.new("Application #{app} has components without assigned nodes: #{missing_components.join(', ')}", file, line)
+      end
+
       # Turn the 'nodes' hash into a map component ref => node name
       node_mapping = {}
-      app['nodes'].each do |node, comps|
+      nodes.each do |node, comps|
         comps = [comps] unless comps.is_a?(Array)
         comps.each do |comp|
-          raise Puppet::ParseError, "Application #{app} maps component #{comp} to multiple nodes" if node_mapping.include?(comp.ref)
+          raise Puppet::ParseError.new(_("Application %{app} assigns multiple nodes to component %{comp}") % { app: app, comp: comp }, file, line) if node_mapping.include?(comp.ref)
           node_mapping[comp.ref] = node.title
         end
       end
 
+      app_components = {}
       catalog.direct_dependents_of(app).each do |comp|
-        mapped_node = node_mapping[comp.ref]
-        if mapped_node.nil?
-          raise Puppet::ParseError, "Component #{comp} is not mapped to any node"
-        end
         app_components[comp.ref] = {
           :produces => comp.export.map(&:ref),
           :consumes => prerequisites(comp).map(&:ref),
-          :node => mapped_node
+          :node => node_mapping[comp.ref]
         }
       end
       env_graph[:applications][app.ref] = app_components
     end
-    response.respond_with(200, "application/json", JSON.dump(env_graph))
+
+    env_graph
   end
 
   private

data/lib/puppet/network/http/compression.rb

@@ -27,7 +27,7 @@ module Puppet::Network::HTTP::Compression
       when nil, 'identity'
         return response.body
       else
-        raise Net::HTTPError.new("Unknown content encoding - #{response['content-encoding']}", response)
+        raise Net::HTTPError.new(_("Unknown content encoding - %{encoding}") % { encoding: response['content-encoding'] }, response)
       end
     end
 
@@ -40,12 +40,14 @@ module Puppet::Network::HTTP::Compression
       when nil, 'identity'
         uncompressor = IdentityAdapter.new
       else
-        raise Net::HTTPError.new("Unknown content encoding - #{response['content-encoding']}", response)
+        raise Net::HTTPError.new(_("Unknown content encoding - %{encoding}") % { encoding: response['content-encoding'] }, response)
       end
 
-      yield uncompressor
-
-      uncompressor.close
+      begin
+        yield uncompressor
+      ensure
+        uncompressor.close
+      end
     end
 
     def add_accept_encoding(headers={})
@@ -56,7 +58,7 @@ module Puppet::Network::HTTP::Compression
     # This adapters knows how to uncompress both 'zlib' stream (the deflate algorithm from Content-Encoding)
     # and GZip streams.
     class ZlibAdapter
-      def initialize
+      def initialize(uncompressor = Zlib::Inflate.new(15 + 32))
         # Create an inflater that knows to parse GZip streams and zlib streams.
         # This uses a property of the C Zlib library, documented as follow:
         #   windowBits can also be greater than 15 for optional gzip decoding. Add
@@ -64,7 +66,7 @@ module Puppet::Network::HTTP::Compression
         #   detection, or add 16 to decode only the gzip format (the zlib format will
         #   return a Z_DATA_ERROR).  If a gzip stream is being decoded, strm->adler is
         #   a crc32 instead of an adler32.
-        @uncompressor = Zlib::Inflate.new(15 + 32)
+        @uncompressor = uncompressor
         @first = true
       end
 
@@ -87,6 +89,7 @@ module Puppet::Network::HTTP::Compression
 
       def close
         @uncompressor.finish
+      ensure
         @uncompressor.close
       end
     end

data/lib/puppet/network/http/connection.rb

@@ -4,7 +4,6 @@ require 'puppet/ssl/configuration'
 require 'puppet/ssl/validator'
 require 'puppet/network/http'
 require 'uri'
-require 'time'
 
 module Puppet::Network::HTTP
 
@@ -31,14 +30,14 @@ module Puppet::Network::HTTP
 
     # Creates a new HTTP client connection to `host`:`port`.
     # @param host [String] the host to which this client will connect to
-    # @param port [Fixnum] the port to which this client will connect to
+    # @param port [Integer] the port to which this client will connect to
     # @param options [Hash] options influencing the properties of the created
     #   connection,
     # @option options [Boolean] :use_ssl true to connect with SSL, false
     #   otherwise, defaults to true
     # @option options [#setup_connection] :verify An object that will configure
     #   any verification to do on the connection
-    # @option options [Fixnum] :redirect_limit the number of allowed
+    # @option options [Integer] :redirect_limit the number of allowed
     #   redirections, defaults to 10 passing any other option in the options
     #   hash results in a Puppet::Error exception
     #
@@ -52,7 +51,7 @@ module Puppet::Network::HTTP
       @port = port
 
       unknown_options = options.keys - OPTION_DEFAULTS.keys
-      raise Puppet::Error, "Unrecognized option(s): #{unknown_options.map(&:inspect).sort.join(', ')}" unless unknown_options.empty?
+      raise Puppet::Error, _("Unrecognized option(s): %{opts}") % { opts: unknown_options.map(&:inspect).sort.join(', ') } unless unknown_options.empty?
 
       options = OPTION_DEFAULTS.merge(options)
       @use_ssl = options[:use_ssl]
@@ -63,9 +62,13 @@ module Puppet::Network::HTTP
     end
 
     # @!macro [new] common_options
-    #   @param options [Hash] options influencing the request made
+    #   @param options [Hash] options influencing the request made. Any
+    #   options not recognized by this class will be ignored - no error will
+    #   be thrown.
     #   @option options [Hash{Symbol => String}] :basic_auth The basic auth
-    #     :username and :password to use for the request
+    #     :username and :password to use for the request, :metric_id Ignored
+    #     by this class - used by Puppet Server only. The metric id by which
+    #     to track metrics on requests.
 
     # @param path [String]
     # @param headers [Hash{String => String}]
@@ -194,7 +197,7 @@ module Puppet::Network::HTTP
         # and try again...
       end
 
-      raise RedirectionLimitExceededException, "Too many HTTP redirections for #{@host}:#{@port}"
+      raise RedirectionLimitExceededException, _("Too many HTTP redirections for %{host}:%{port}") % { host: @host, port: @port }
     end
 
     def apply_options_to(request, options)
@@ -206,14 +209,7 @@ module Puppet::Network::HTTP
     end
 
     def execute_request(connection, request)
-      start = Time.now
       connection.request(request)
-    rescue EOFError => e
-      elapsed = (Time.now - start).to_f.round(3)
-      uri = @site.addr + request.path.split('?')[0]
-      eof = EOFError.new(_('request %{uri} interrupted after %{elapsed} seconds') % {uri: uri, elapsed: elapsed})
-      eof.set_backtrace(e.backtrace) unless e.backtrace.empty?
-      raise eof
     end
 
     def with_connection(site, &block)
@@ -223,17 +219,17 @@ module Puppet::Network::HTTP
       end
       response
     rescue OpenSSL::SSL::SSLError => error
-      if error.message.include? "certificate verify failed"
+      # can be nil
+      peer_cert = @verify.peer_certs.last
+
+      if peer_cert && !OpenSSL::SSL.verify_certificate_identity(peer_cert.content, site.host)
+        valid_certnames = [peer_cert.name, *peer_cert.subject_alt_names].uniq
+        msg = valid_certnames.length > 1 ? _("one of %{certnames}") % { certnames: valid_certnames.join(', ') } : valid_certnames.first
+        msg += _("Server hostname '%{host}' did not match server certificate; expected %{msg}") % { host: site.host, msg: msg }
+        raise Puppet::Error, msg, error.backtrace
+      elsif error.message.include? "certificate verify failed"
         msg = error.message
         msg << ": [" + @verify.verify_errors.join('; ') + "]"
-        raise Puppet::Error, msg, error.backtrace
-      elsif error.message =~ /hostname.*not match.*server certificate/
-        leaf_ssl_cert = @verify.peer_certs.last
-
-        valid_certnames = [leaf_ssl_cert.name, *leaf_ssl_cert.subject_alt_names].uniq
-        msg = valid_certnames.length > 1 ? "one of #{valid_certnames.join(', ')}" : valid_certnames.first
-        msg = "Server hostname '#{site.host}' did not match server certificate; expected #{msg}"
-
         raise Puppet::Error, msg, error.backtrace
       else
         raise

data/lib/puppet/network/http/error.rb

@@ -20,50 +20,54 @@ module Puppet::Network::HTTP::Error
   class HTTPNotAcceptableError < HTTPError
     CODE = 406
     def initialize(message, issue_kind = Issues::RUNTIME_ERROR)
-      super("Not Acceptable: " + message, CODE, issue_kind)
+      super(_("Not Acceptable: ") + message, CODE, issue_kind)
     end
   end
 
   class HTTPNotFoundError < HTTPError
     CODE = 404
     def initialize(message, issue_kind = Issues::RUNTIME_ERROR)
-      super("Not Found: " + message, CODE, issue_kind)
+      super(_("Not Found: ") + message, CODE, issue_kind)
     end
   end
 
   class HTTPNotAuthorizedError < HTTPError
     CODE = 403
     def initialize(message, issue_kind = Issues::RUNTIME_ERROR)
-      super("Not Authorized: " + message, CODE, issue_kind)
+      super(_("Not Authorized: ") + message, CODE, issue_kind)
     end
   end
 
   class HTTPBadRequestError < HTTPError
     CODE = 400
     def initialize(message, issue_kind = Issues::RUNTIME_ERROR)
-      super("Bad Request: " + message, CODE, issue_kind)
+      super(_("Bad Request: ") + message, CODE, issue_kind)
     end
   end
 
   class HTTPMethodNotAllowedError < HTTPError
     CODE = 405
     def initialize(message, issue_kind = Issues::RUNTIME_ERROR)
-      super("Method Not Allowed: " + message, CODE, issue_kind)
+      super(_("Method Not Allowed: ") + message, CODE, issue_kind)
+    end
+  end
+
+  class HTTPUnsupportedMediaTypeError < HTTPError
+    CODE = 415
+    def initialize(message, issue_kind = Issues::RUNTIME_ERROR)
+      super(_("Unsupported Media Type: ") + message, CODE, issue_kind)
     end
   end
 
   class HTTPServerError < HTTPError
     CODE = 500
 
-    attr_reader :backtrace
-
     def initialize(original_error, issue_kind = Issues::RUNTIME_ERROR)
-      super("Server Error: " + original_error.message, CODE, issue_kind)
-      @backtrace = ["Warning: The 'stacktrace' property is deprecated and will be removed in a future version of Puppet. For security reasons, stacktraces are not returned with Puppet HTTP Error responses."]
+      super(_("Server Error: ") + original_error.message, CODE, issue_kind)
     end
 
     def to_json
-      JSON({:message => message, :issue_kind => @issue_kind, :stacktrace => self.backtrace})
+      JSON({:message => message, :issue_kind => @issue_kind})
     end
   end
 end