puppet 5.0.0 → 6.0.0

data/lib/puppet/rest/route.rb

@@ -0,0 +1,84 @@
+require 'uri'
+require 'puppet/util/connection'
+
+module Puppet::Rest
+  class Route
+    attr_reader :server
+
+    # Create a Route containing information for querying the given API,
+    # hosted at a server determined either by SRV service or by the
+    # fallback server on the fallback port.
+    # @param [String] api the path leading to the root of the API. Must
+    #                 contain a trailing slash for proper endpoint path
+    #                 construction
+    # @param [Symbol] server_setting the setting to check for special
+    #                 server configuration
+    # @param [Symbol] port_setting the setting to check for speical
+    #                  port configuration
+    # @param [Symbol] srv_service the name of the service when using SRV
+    #                 records
+    def initialize(api:, server_setting: :server, port_setting: :masterport, srv_service: :puppet)
+      @api = api
+      @default_server = Puppet::Util::Connection.determine_server(server_setting)
+      @default_port = Puppet::Util::Connection.determine_port(port_setting, server_setting)
+      @srv_service = srv_service
+    end
+
+    # Select a server and port to create a base URL for the API specified by this
+    # route. If the connection fails and SRV records are in use, the next suitable
+    # server will be tried. If SRV records are not in use or no successful connection
+    # could be made, fall back to the configured server and port for this API, taking
+    # into account failover settings.
+    # @parma [Puppet::Network::Resolver] dns_resolver the DNS resolver to use to check
+    #                                    SRV records
+    # @yield [URI] supply a base URL to make a request with
+    # @raise [Puppet::Error] if connection to selected server and port fails, and SRV
+    #                        records are not in use
+    def with_base_url(dns_resolver)
+      if @server && @port
+        # First try connecting to the previously selected server and port.
+        begin
+          return yield(base_url)
+        rescue SystemCallError => e
+          if Puppet[:use_srv_records]
+            Puppet.debug "Connection to cached server and port #{@server}:#{@port} failed, reselecting."
+          else
+            raise Puppet::Error, _("Connection to cached server and port %{server}:%{port} failed: %{message}") %
+              { server: @server, port: @port, message: e.message }
+          end
+        end
+      end
+
+      if Puppet[:use_srv_records]
+        dns_resolver.each_srv_record(@srv_service) do |srv_server, srv_port|
+          # Try each of the servers for this service in weighted order
+          # until a working one is found.
+          begin
+            @server = srv_server
+            @port = srv_port
+            return yield(base_url)
+          rescue SystemCallError
+            Puppet.debug "Connection to selected server and port #{@server}:#{@port} failed. Trying next cached SRV record."
+            @server = nil
+            @port = nil
+          end
+        end
+      end
+
+      # If not using SRV records, fall back to the defaults calculated above
+      @server = @default_server
+      @port = @default_port
+
+      Puppet.debug "No more servers in SRV record, falling back to #{@server}:#{@port}" if Puppet[:use_srv_records]
+      return yield(base_url)
+    end
+
+    private
+
+    # Returns a URI built from the information stored by this route,
+    # e.g. 'https://myserver.com:555/myapi/v1/'
+    def base_url
+      URI::HTTPS.build(host: @server, port: @port, path: @api)
+    end
+  end
+end

data/lib/puppet/rest/routes.rb

@@ -0,0 +1,154 @@
+require 'puppet/rest/route'
+require 'puppet/network/http_pool'
+require 'puppet/network/http/compression'
+
+module Puppet::Rest
+  module Routes
+
+    extend Puppet::Network::HTTP::Compression.module
+
+    ACCEPT_ENCODING = 'gzip;q=1.0,deflate;q=0.6,identity;q=0.3'
+
+    def self.ca
+      @ca ||= Route.new(api: '/puppet-ca/v1/',
+                        server_setting: :ca_server,
+                        port_setting: :ca_port,
+                        srv_service: :ca)
+    end
+
+    # Make an HTTP request to fetch the named certificate
+    # @param [String] name the name of the certificate to fetch
+    # @param [Puppet::Rest::SSLContext] ssl_context the ssl content to use when making the request
+    # @raise [Puppet::Rest::ResponseError] if the response status is not OK
+    # @return [String] the PEM-encoded certificate or certificate bundle
+    def self.get_certificate(name, ssl_context)
+      ca.with_base_url(Puppet::Network::Resolver.new) do |url|
+        header = { 'Accept' => 'text/plain', 'Accept-Encoding' => ACCEPT_ENCODING }
+        url.path += "certificate/#{name}"
+
+        use_ssl = url.is_a? URI::HTTPS
+
+        # Deeper levels of the code assume that if we have any number of
+        # certificate related files, we have all of the certificate related
+        # files. This assumption caused us to download the certificate twice.
+        # We have to hard code `verify_mode=false` so we don't attempt to
+        # download the certificate so that we can download the certificate.
+        #
+        # This is related to PUP-9094. We won't have so many issues with this
+        # once we are using the httpclient gem to handle this work. We were
+        # unable to get this work completed in time for Puppet 6.0.0, so we had
+        # to switch back to using Puppet::Network::HttpPool, which has
+        # unfortunate limitations (i.e., an all or nothing approach to cert
+        # verification).
+        verify_mode = false
+
+        client = Puppet::Network::HttpPool.http_instance(url.host, url.port, use_ssl, verify_mode)
+
+        response = client.get(url.request_uri, header)
+        unless response.code.to_i == 200
+          raise Puppet::Rest::ResponseError.new(response.message, response)
+        end
+
+        Puppet.info _("Downloaded certificate for %{name} from %{server}") % { name: name, server: ca.server }
+
+        uncompress_body(response)
+      end
+    end
+
+    # Make an HTTP request to fetch the named crl
+    # @param [String] name the crl to fetch
+    # @param [Puppet::Rest::SSLContext] ssl_context the ssl content to use when making the request
+    # @raise [Puppet::Rest::ResponseError] if the response status is not OK
+    # @return [String] the PEM-encoded crl
+    def self.get_crls(name, ssl_context)
+      ca.with_base_url(Puppet::Network::Resolver.new) do |url|
+        header = { 'Accept' => 'text/plain', 'Accept-Encoding' => ACCEPT_ENCODING }
+        url.path += "certificate_revocation_list/#{name}"
+
+        use_ssl = url.is_a? URI::HTTPS
+
+        # Deeper levels of the code assume that if we have any number of
+        # certificate related files, we have all of the certificate related
+        # files. Unfortunately, this causes us to get stuck in an infinite loop,
+        # so we have to hard code `verify_mode=false` so we don't attempt to use
+        # files that do not exist yet in order to download those files.
+        #
+        # This is related to PUP-9094. We won't have so many issues with this
+        # once we are using the httpclient gem to handle this work. We were
+        # unable to get this work completed in time for Puppet 6.0.0, so we had
+        # to switch back to using Puppet::Network::HttpPool, which has
+        # unfortunate limitations (i.e., an all or nothing approach to cert
+        # verification).
+        verify_mode = false
+
+        client = Puppet::Network::HttpPool.http_instance(url.host, url.port, use_ssl, verify_mode)
+
+        response = client.get(url.request_uri, header)
+        unless response.code.to_i == 200
+          raise Puppet::Rest::ResponseError.new(response.message, response)
+        end
+
+        Puppet.debug _("Downloaded certificate revocation list for %{name} from %{server}") % { name: name, server: ca.server }
+
+        uncompress_body(response)
+      end
+    end
+
+    # Make an HTTP request to send the named CSR
+    # @param [String] csr_pem the contents of the CSR to sent to the CA
+    # @param [String] name the name of the host whose CSR is being submitted
+    # @param [Puppet::Rest::SSLContext] ssl_context the ssl content to use when making the request
+    # @rasies [Puppet::Rest::ResponseError] if the response status is not OK
+    def self.put_certificate_request(csr_pem, name, ssl_context)
+      ca.with_base_url(Puppet::Network::Resolver.new) do |url|
+        header = { 'Accept' => 'text/plain',
+                   'Accept-Encoding' => ACCEPT_ENCODING,
+                   'Content-Type' => 'text/plain' }
+        url.path += "certificate_request/#{name}"
+
+        use_ssl = url.is_a? URI::HTTPS
+
+        # See notes above as to why verify_mode is hardcoded to false
+        verify_mode = false
+
+        client = Puppet::Network::HttpPool.http_instance(url.host, url.port, use_ssl, verify_mode)
+
+        response = client.put(url.request_uri, csr_pem, header)
+        if response.code.to_i == 200
+          Puppet.debug "Submitted certificate request to server."
+        else
+          raise Puppet::Rest::ResponseError.new(response.message, response)
+        end
+      end
+    end
+
+    # Make an HTTP request to get the named CSR
+    # @param [String] name the name of the host whose CSR is being queried
+    # @param [Puppet::Rest::SSLContext] ssl_context the ssl content to use when making the request
+    # @rasies [Puppet::Rest::ResponseError] if the response status is not OK
+    # @return [String] the PEM encoded certificate request
+    def self.get_certificate_request(name, ssl_context)
+      ca.with_base_url(Puppet::Network::Resolver.new) do |url|
+        header = { 'Accept' => 'text/plain', 'Accept-Encoding' => ACCEPT_ENCODING }
+        url.path += "certificate_request/#{name}"
+
+        use_ssl = url.is_a? URI::HTTPS
+
+        # See notes above as to why verify_mode is hardcoded to false
+        verify_mode = false
+
+        client = Puppet::Network::HttpPool.http_instance(url.host, url.port, use_ssl, verify_mode)
+
+
+        response = client.get(url.request_uri, header)
+        unless response.code.to_i == 200
+          raise Puppet::Rest::ResponseError.new(response.message, response)
+        end
+
+        Puppet.debug _("Downloaded existing certificate request for %{name} from %{server}") % { name: name, server: ca.server }
+
+        uncompress_body(response)
+      end
+    end
+  end
+end

data/lib/puppet/rest/ssl_context.rb

@@ -0,0 +1,13 @@
+module Puppet::Rest
+  class SSLContext
+
+    attr_reader :verify_mode, :cert_store
+
+    # @param [OpenSSL::SSL::VERIFY_NONE, OpenSSL::SSL::VERIFY_PEER] verify_mode
+    # @param [OpenSSL::X509::SSLStore] cert_store
+    def initialize(verify_mode, cert_store = OpenSSL::X509::Store.new)
+      @verify_mode = verify_mode
+      @cert_store = cert_store
+    end
+  end
+end

data/lib/puppet/settings/base_setting.rb

@@ -11,10 +11,14 @@ class Puppet::Settings::BaseSetting
 
   def call_hook=(value)
     if value.nil?
-      Puppet.warning "Setting :#{name} :call_hook is nil, defaulting to :on_write_only"
+      #TRANSLATORS ':%{name}', ':call_hook', and ':on_write_only' should not be translated
+      Puppet.warning _("Setting :%{name} :call_hook is nil, defaulting to :on_write_only") % { name: name }
       value = :on_write_only
     end
-    raise ArgumentError, "Invalid option #{value} for call_hook" unless self.class.available_call_hook_values.include? value
+    unless self.class.available_call_hook_values.include?(value)
+      #TRANSLATORS 'call_hook' is a Puppet option name and should not be translated
+      raise ArgumentError, _("Invalid option %{value} for call_hook") % { value: value }
+    end
     @call_hook = value
   end
 
@@ -67,16 +71,23 @@ class Puppet::Settings::BaseSetting
     @call_hook = :on_write_only if args[:hook] and not args[:call_hook]
     @has_hook = false
 
-    raise ArgumentError, "Cannot reference :call_hook for :#{@name} if no :hook is defined" if args[:call_hook] and not args[:hook]
+    if args[:call_hook] and not args[:hook]
+      #TRANSLATORS ':call_hook' and ':hook' are specific setting names and should not be translated
+      raise ArgumentError, _("Cannot reference :call_hook for :%{name} if no :hook is defined") % { name: @name }
+    end
 
     args.each do |param, value|
       method = param.to_s + "="
-      raise ArgumentError, "#{self.class} (setting '#{args[:name]}') does not accept #{param}" unless self.respond_to? method
+      unless self.respond_to? method
+        raise ArgumentError, _("%{class_name} (setting '%{setting}') does not accept %{parameter}") %
+            { class_name: self.class, setting: args[:name], parameter: param }
+      end
 
       self.send(method, value)
     end
-
-    raise ArgumentError, "You must provide a description for the #{self.name} config option" unless self.desc
+    unless self.desc
+      raise ArgumentError, _("You must provide a description for the %{class_name} config option") % { class_name: self.name }
+    end
   end
 
   def iscreated
@@ -87,9 +98,9 @@ class Puppet::Settings::BaseSetting
     @iscreated
   end
 
-  # short name for the celement
+  # short name for the element
   def short=(value)
-    raise ArgumentError, "Short names can only be one character." if value.to_s.length != 1
+    raise ArgumentError, _("Short names can only be one character.") if value.to_s.length != 1
     @short = value.to_s
   end
 
@@ -146,12 +157,21 @@ class Puppet::Settings::BaseSetting
     value
   end
 
+  # Print the value for the user in a config compatible format
+  def print(value)
+    munge(value)
+  end
+
   def set_meta(meta)
     Puppet.notice("#{name} does not support meta data. Ignoring.")
   end
 
   def deprecated=(deprecation)
-    raise(ArgumentError, "'#{deprecation}' is an unknown setting deprecation state.  Must be either :completely or :allowed_on_commandline") unless [:completely, :allowed_on_commandline].include?(deprecation)
+    unless [:completely, :allowed_on_commandline].include?(deprecation)
+      #TRANSLATORS 'deprecated' is a Puppet setting and ':completely' and ':allowed_on_commandline' are possible values and should not be translated
+      raise ArgumentError, _("Unsupported deprecated value '%{deprecation}'.") % { deprecation: deprecation } +
+          ' ' + _("Supported values for deprecated are ':completely' or ':allowed_on_commandline'")
+    end
     @deprecated = deprecation
   end
 

data/lib/puppet/settings/certificate_revocation_setting.rb

@@ -0,0 +1,21 @@
+require 'puppet/settings/base_setting'
+
+class Puppet::Settings::CertificateRevocationSetting < Puppet::Settings::BaseSetting
+
+  def type
+    :certificate_revocation
+  end
+
+  def munge(value)
+    case value
+    when 'chain', 'true', TrueClass
+      :chain
+    when 'leaf'
+      :leaf
+    when 'false', FalseClass, NilClass
+      false
+    else
+      raise Puppet::Settings::ValidationError, _("Invalid certificate revocation value %{value}: must be one of 'true', 'chain', 'leaf', or 'false'") % { value: value }
+    end
+  end
+end

data/lib/puppet/settings/config_file.rb

@@ -25,8 +25,7 @@ class Puppet::Settings::ConfigFile
       allowed_section_names << 'main' unless allowed_section_names.include?('main')
     end
 
-    # in Ruby 1.9.3 strings are not UTF-8 by default, so ensure text is treated properly
-    ini = Puppet::Settings::IniFile.parse(StringIO.new(text).set_encoding(Encoding::UTF_8))
+    ini = Puppet::Settings::IniFile.parse(text.encode(Encoding::UTF_8))
     unique_sections_in(ini, file, allowed_section_names).each do |section_name|
       section = Section.new(section_name.to_sym)
       result.with_section(section)
@@ -83,7 +82,15 @@ private
   def unique_sections_in(ini, file, allowed_section_names)
     ini.section_lines.collect do |section|
       if !allowed_section_names.empty? && !allowed_section_names.include?(section.name)
-        raise(Puppet::Error, _("Illegal section '%{name}' in config file %{file} at line %{line}. The only valid puppet.conf sections are: [%{allowed_sections}]. Please use the directory environments feature to specify environments. (See https://docs.puppet.com/puppet/latest/reference/environments.html)") % { name: section.name, file: file, line: section.line_number, allowed_sections: allowed_section_names.join(", ") })
+        error_location_str = Puppet::Util::Errors.error_location(file, section.line_number)
+        message = _("Illegal section '%{name}' in config file at %{error_location}.") %
+            { name: section.name, error_location: error_location_str }
+        #TRANSLATORS 'puppet.conf' is the name of the puppet configuration file and should not be translated.
+        message += ' ' + _("The only valid puppet.conf sections are: [%{allowed_sections_list}].") %
+            { allowed_sections_list: allowed_section_names.join(", ") }
+        message += ' ' + _("Please use the directory environments feature to specify environments.")
+        message += ' ' + _("(See https://puppet.com/docs/puppet/latest/environments_about.html)")
+        raise(Puppet::Error, message)
       end
       section.name
     end.uniq
@@ -123,16 +130,18 @@ private
     value = string.sub(/\{\s*([^}]+)\s*\}/) do
       params = $1
       params.split(/\s*,\s*/).each do |str|
-        if str =~ /^\s*(\w+)\s*=\s*([\w\d]+)\s*$/
+        if str =~ /^\s*(\w+)\s*=\s*([\w]+)\s*$/
           param, value = $1.intern, $2
           result[param] = value
-          raise ArgumentError, "Invalid file option '#{param}'" unless [:owner, :mode, :group].include?(param)
+          unless [:owner, :mode, :group].include?(param)
+            raise ArgumentError, _("Invalid file option '%{parameter}'") % { parameter: param }
+          end
 
           if param == :mode and value !~ /^\d+$/
-            raise ArgumentError, "File modes must be numbers"
+            raise ArgumentError, _("File modes must be numbers")
           end
         else
-          raise ArgumentError, "Could not parse '#{string}'"
+          raise ArgumentError, _("Could not parse '%{string}'") % { string: string }
         end
       end
       ''

data/lib/puppet/settings/environment_conf.rb

@@ -22,7 +22,6 @@ class Puppet::Settings::EnvironmentConf
   def self.load_from(path_to_env, global_module_path)
     path_to_env = File.expand_path(path_to_env)
     conf_file = File.join(path_to_env, 'environment.conf')
-    config = nil
 
     begin
       config = Puppet.settings.parse_file(conf_file)
@@ -66,13 +65,11 @@ class Puppet::Settings::EnvironmentConf
     if disable_per_environment_manifest
       environment_conf_manifest = absolute(raw_setting(:manifest))
       if environment_conf_manifest && fallback_manifest_directory != environment_conf_manifest
-        errmsg = ["The 'disable_per_environment_manifest' setting is true, but the",
-        "environment located at #{@path_to_env} has a manifest setting in its",
-        "environment.conf of '#{environment_conf_manifest}' which does not match",
-        "the default_manifest setting '#{puppet_conf_manifest}'. If this",
-        "environment is expecting to find modules in",
-        "'#{environment_conf_manifest}', they will not be available!"]
-        Puppet.err(errmsg.join(' '))
+        #TRANSLATORS 'disable_per_environment_manifest' is a setting and 'environment.conf' is a file name and should not be translated
+        message = _("The 'disable_per_environment_manifest' setting is true, but the environment located at %{path_to_env} has a manifest setting in its environment.conf of '%{environment_conf}' which does not match the default_manifest setting '%{puppet_conf}'.") %
+            { path_to_env: @path_to_env, environment_conf: environment_conf_manifest, puppet_conf: puppet_conf_manifest }
+        message += ' ' + _("If this environment is expecting to find modules in '%{environment_conf}', they will not be available!") % { environment_conf: environment_conf_manifest }
+        Puppet.err(message)
       end
       fallback_manifest_directory.to_s
     else
@@ -104,7 +101,7 @@ class Puppet::Settings::EnvironmentConf
       path = modulepath.kind_of?(String) ?
         modulepath.split(File::PATH_SEPARATOR) :
         modulepath
-      path.map { |p| absolute(p) }.join(File::PATH_SEPARATOR)
+      path.map { |p| expand_glob(absolute(p)) }.flatten.join(File::PATH_SEPARATOR)
     end
   end
 
@@ -138,13 +135,25 @@ class Puppet::Settings::EnvironmentConf
     section_keys = config.sections.keys
     main = config.sections[:main]
     if section_keys.size > 1
-      Puppet.warning(_("Invalid sections in environment.conf at '%{path_to_conf_file}'. Environment conf may not have sections. The following sections are being ignored: '%{sections}'") % { path_to_conf_file: path_to_conf_file, sections: (section_keys - [:main]).join(',') })
+      # warn once per config file path
+      Puppet.warn_once(
+        :invalid_settings_section, "EnvironmentConf-section:#{path_to_conf_file}",
+        _("Invalid sections in environment.conf at '%{path_to_conf_file}'. Environment conf may not have sections. The following sections are being ignored: '%{sections}'") % {
+          path_to_conf_file: path_to_conf_file,
+          sections: (section_keys - [:main]).join(',')
+        })
       valid = false
     end
 
     extraneous_settings = main.settings.map(&:name) - VALID_SETTINGS
     if !extraneous_settings.empty?
-      Puppet.warning(_("Invalid settings in environment.conf at '%{path_to_conf_file}'. The following unknown setting(s) are being ignored: %{ignored_settings}") % { path_to_conf_file: path_to_conf_file, ignored_settings: extraneous_settings.join(', ') })
+      # warn once per config file path
+      Puppet.warn_once(
+        :invalid_settings, "EnvironmentConf-settings:#{path_to_conf_file}",
+        _("Invalid settings in environment.conf at '%{path_to_conf_file}'. The following unknown setting(s) are being ignored: %{ignored_settings}") % {
+          path_to_conf_file: path_to_conf_file,
+          ignored_settings: extraneous_settings.join(', ')
+        })
       valid = false
     end
 
@@ -157,6 +166,15 @@ class Puppet::Settings::EnvironmentConf
     yield value
   end
 
+  def expand_glob(path)
+    return nil if path.nil?
+    if path =~ /[*?\[\{]/
+      Dir.glob(path)
+    else
+      path
+    end
+  end
+
   def absolute(path)
     return nil if path.nil?
     if path =~ /^\$/

data/lib/puppet/settings/file_setting.rb

@@ -156,7 +156,7 @@ class Puppet::Settings::FileSetting < Puppet::Settings::StringSetting
       end
 
       # REMIND fails on Windows because chown/chgrp functionality not supported yet
-      if Puppet.features.root? and !Puppet.features.microsoft_windows?
+      if Puppet.features.root? and !Puppet::Util::Platform.windows?
         resource[:owner] = self.owner if self.owner
         resource[:group] = self.group if self.group
       end

data/lib/puppet/settings/ini_file.rb

@@ -12,7 +12,7 @@ class Puppet::Settings::IniFile
   def self.parse(config_fh)
     config = new([DefaultSection.new])
     config_fh.each_line do |line|
-      case line
+      case line.chomp
       when /^(\s*)\[([[:word:]]+)\](\s*)$/
         config.append(SectionLine.new($1, $2, $3))
       when /^(\s*)([[:word:]]+)(\s*=\s*)(.*?)(\s*)$/
@@ -34,6 +34,15 @@ class Puppet::Settings::IniFile
     @lines << line
   end
 
+  def delete(section, name)
+    delete_offset = @lines.index(setting(section, name))
+    next_offset = delete_offset + 1
+    if next_offset < @lines.length
+      @lines[next_offset].previous = @lines[delete_offset].previous
+    end
+    @lines.delete_at(delete_offset)
+  end
+
   def insert_after(line, new_line)
     new_line.previous = line
 
@@ -76,7 +85,30 @@ class Puppet::Settings::IniFile
     lines.select { |line| line.is_a?(SettingLine) }
   end
 
+  def settings_exist_in_default_section?
+    lines_in(DEFAULT_SECTION_NAME).any? { |line| line.is_a?(SettingLine) }
+  end
+
+  def section_exists_with_default_section_name?
+    section_lines.any? do |section|
+      !section.is_a?(DefaultSection) && section.name == DEFAULT_SECTION_NAME
+    end
+  end
+
+  def set_default_section_write_sectionline(value)
+    if index = @lines.find_index { |line| line.is_a?(DefaultSection) }
+      @lines[index].write_sectionline = true
+    end
+  end
+
   def write(fh)
+    # If no real section line for the default section exists, configure the
+    # DefaultSection object to write its section line. (DefaultSection objects
+    # don't write the section line unless explicitly configured to do so)
+    if settings_exist_in_default_section? && !section_exists_with_default_section_name?
+      set_default_section_write_sectionline(true)
+    end
+
     fh.truncate(0)
     fh.rewind
     @lines.each do |line|
@@ -99,6 +131,14 @@ class Puppet::Settings::IniFile
       end
     end
 
+    def delete(section_name, name)
+      setting = @config.setting(section_name, name)
+      if setting
+        @config.delete(section_name, name)
+        setting.to_s.chomp
+      end
+    end
+
     private
 
     def add_setting(section_name, name, value)
@@ -131,41 +171,55 @@ class Puppet::Settings::IniFile
   Line = Struct.new(:text) do
     include LineNumber
 
+    def to_s
+      text
+    end
+
     def write(fh)
-      fh.puts(text)
+      fh.puts(to_s)
     end
   end
 
   SettingLine = Struct.new(:prefix, :name, :infix, :value, :suffix) do
     include LineNumber
 
+    def to_s
+      "#{prefix}#{name}#{infix}#{value}#{suffix}"
+    end
+
     def write(fh)
-      fh.write(prefix)
-      fh.write(name)
-      fh.write(infix)
-      fh.write(value)
-      fh.puts(suffix)
+      fh.puts(to_s)
+    end
+
+    def ==(other)
+      super(other) && self.line_number == other.line_number
     end
   end
 
   SectionLine = Struct.new(:prefix, :name, :suffix) do
     include LineNumber
 
+    def to_s
+      "#{prefix}[#{name}]#{suffix}"
+    end
+
     def write(fh)
-      fh.write(prefix)
-      fh.write("[")
-      fh.write(name)
-      fh.write("]")
-      fh.puts(suffix)
+      fh.puts(to_s)
     end
   end
 
   class DefaultSection < SectionLine
+    attr_accessor :write_sectionline
+
     def initialize
+      @write_sectionline = false
       super("", DEFAULT_SECTION_NAME, "")
     end
 
     def write(fh)
+      if @write_sectionline
+        super(fh)
+      end
     end
   end
 end

data/lib/puppet/settings/ttl_setting.rb

@@ -25,6 +25,11 @@ class Puppet::Settings::TTLSetting < Puppet::Settings::BaseSetting
     self.class.munge(value, @name)
   end
 
+  def print(value)
+    val = munge(value)
+    val == Float::INFINITY ? 'unlimited' : val
+  end
+
   # Convert the value to Numeric, parsing numeric string with units if necessary.
   def self.munge(value, param_name)
     case