puppet 5.3.4 → 6.29.0

data/lib/puppet/util/rubygems.rb

@@ -21,7 +21,7 @@ module Puppet::Util::RubyGems
       # @api private
       def source
         if has_rubygems?
-          Gem::Specification.respond_to?(:latest_specs) ? Gems18Source : OldGemsSource
+          Gems18Source
         else
           NoGemsSource
         end
@@ -41,7 +41,11 @@ module Puppet::Util::RubyGems
     def directories
       # `require 'mygem'` will consider and potentially load
       # prerelease gems, so we need to match that behavior.
-      Gem::Specification.latest_specs(true).collect do |spec|
+      #
+      # Just load the stub which points to the gem path, and
+      # delay loading the full specification until if/when the
+      # gem is required.
+      Gem::Specification.stubs.collect do |spec|
         File.join(spec.full_gem_path, 'lib')
       end
     end
@@ -51,18 +55,6 @@ module Puppet::Util::RubyGems
     end
   end
 
-  # RubyGems < 1.8.0
-  # @api private
-  class OldGemsSource < Source
-    def directories
-      @paths ||= Gem.latest_load_paths
-    end
-
-    def clear_paths
-      Gem.clear_paths
-    end
-  end
-
   # @api private
   class NoGemsSource < Source
     def directories

data/lib/puppet/util/run_mode.rb

@@ -11,15 +11,19 @@ module Puppet
 
       def self.[](name)
         @run_modes ||= {}
-        if Puppet.features.microsoft_windows?
+        if Puppet::Util::Platform.windows?
           @run_modes[name] ||= WindowsRunMode.new(name)
         else
           @run_modes[name] ||= UnixRunMode.new(name)
         end
       end
 
+      def server?
+        name == :master || name == :server
+      end
+
       def master?
-        name == :master
+        name == :master || name == :server
       end
 
       def agent?

data/lib/puppet/util/selinux.rb

@@ -13,7 +13,11 @@ require 'pathname'
 
 module Puppet::Util::SELinux
 
-  def selinux_support?
+  S_IFREG = 0100000
+  S_IFDIR = 0040000
+  S_IFLNK = 0120000
+
+  def self.selinux_support?
     return false unless defined?(Selinux)
     if Selinux.is_selinux_enabled == 1
       return true
@@ -21,6 +25,10 @@ module Puppet::Util::SELinux
     false
   end
 
+  def selinux_support?
+    Puppet::Util::SELinux.selinux_support?
+  end
+
   # Retrieve and return the full context of the file.  If we don't have
   # SELinux support or if the SELinux call fails then return nil.
   def get_selinux_current_context(file)
@@ -34,7 +42,7 @@ module Puppet::Util::SELinux
 
   # Retrieve and return the default context of the file.  If we don't have
   # SELinux support or if the SELinux call fails to file a default then return nil.
-  def get_selinux_default_context(file)
+  def get_selinux_default_context(file, resource_ensure=nil)
     return nil unless selinux_support?
     # If the filesystem has no support for SELinux labels, return a default of nil
     # instead of what matchpathcon would return
@@ -44,8 +52,14 @@ module Puppet::Util::SELinux
     begin
       filestat = file_lstat(file)
       mode = filestat.mode
-    rescue Errno::EACCES, Errno::ENOENT
+    rescue Errno::EACCES
       mode = 0
+    rescue Errno::ENOENT
+      if resource_ensure
+        mode = get_create_mode(resource_ensure)
+      else
+        mode = 0
+      end
     end
 
     retval = Selinux.matchpathcon(file, mode)
@@ -132,8 +146,8 @@ module Puppet::Util::SELinux
   # Puppet uses.  This will set the file's SELinux context to the policy's
   # default context (if any) if it differs from the context currently on
   # the file.
-  def set_selinux_default_context(file)
-    new_context = get_selinux_default_context(file)
+  def set_selinux_default_context(file, resource_ensure=nil)
+    new_context = get_selinux_default_context(file, resource_ensure)
     return nil unless new_context
     cur_context = get_selinux_current_context(file)
     if new_context != cur_context
@@ -190,10 +204,26 @@ module Puppet::Util::SELinux
   def selinux_label_support?(file)
     fstype = find_fs(file)
     return false if fstype.nil?
-    filesystems = ['ext2', 'ext3', 'ext4', 'gfs', 'gfs2', 'xfs', 'jfs', 'btrfs']
+    filesystems = ['ext2', 'ext3', 'ext4', 'gfs', 'gfs2', 'xfs', 'jfs', 'btrfs', 'tmpfs']
     filesystems.include?(fstype)
   end
 
+  # Get mode file type bits set based on ensure on
+  # the file resource. This helps SELinux determine
+  # what context a new resource being created should have.
+  def get_create_mode(resource_ensure)
+    mode = 0
+    case resource_ensure
+    when :present, :file
+      mode |= S_IFREG
+    when :directory
+      mode |= S_IFDIR
+    when :link
+      mode |= S_IFLNK
+    end
+    mode
+  end
+
   # Internal helper function to read and parse /proc/mounts
   def read_mounts
     mounts = ""
@@ -202,7 +232,9 @@ module Puppet::Util::SELinux
         # If possible we use read_nonblock in a loop rather than read to work-
         # a linux kernel bug.  See ticket #1963 for details.
         mountfh = File.open("/proc/mounts")
-        mounts += mountfh.read_nonblock(1024) while true
+        loop do
+          mounts += mountfh.read_nonblock(1024)
+        end
       else
         # Otherwise we shell out and let cat do it for us
         mountfh = IO.popen("/bin/cat /proc/mounts")
@@ -232,7 +264,8 @@ module Puppet::Util::SELinux
   # Internal helper function to return which type of filesystem a given file
   # path resides on
   def find_fs(path)
-    return nil unless mounts = read_mounts
+    mounts = read_mounts
+    return nil unless mounts
 
     # cleanpath eliminates useless parts of the path (like '.', or '..', or
     # multiple slashes), without touching the filesystem, and without

data/lib/puppet/util/skip_tags.rb

@@ -6,4 +6,8 @@ class Puppet::Util::SkipTags
   def initialize(stags)
     self.tags = stags unless defined?(@tags)
   end
+
+  def split_qualified_tags?
+    false
+  end
 end

data/lib/puppet/util/ssl.rb

@@ -1,6 +1,8 @@
+require 'puppet/ssl/openssl_loader'
+
 ##
 # SSL is a private module with class methods that help work with x.509
-# subjects.
+# subjects and errors.
 #
 # @api private
 module Puppet::Util::SSL
@@ -50,4 +52,32 @@ module Puppet::Util::SSL
   def self.is_possibly_valid_dn?(dn)
     dn =~ /=/
   end
+
+  ##
+  # Extract and format meaningful error messages from OpenSSL::OpenSSLErrors
+  # and a Validator. Re-raises the error if unknown.
+  #
+  # @api private
+  #
+  # @param [OpenSSL::OpenSSLError] error An error thrown during creating a
+  #   connection
+  # @param [Puppet::SSL::DefaultValidator] verifier A Validator who may have
+  #   invalidated the connection
+  # @param [String] host The DNS name of the other end of the SSL connection
+  #
+  # @raises [Puppet::Error, OpenSSL::OpenSSLError]
+  def self.handle_connection_error(error, verifier, host)
+    # can be nil
+    peer_cert = verifier.peer_certs.last
+
+    if error.message.include? "certificate verify failed"
+      msg = error.message
+      msg << ": [" + verifier.verify_errors.join('; ') + "]"
+      raise Puppet::Error, msg, error.backtrace
+    elsif peer_cert && !OpenSSL::SSL.verify_certificate_identity(peer_cert, host)
+      raise Puppet::SSL::CertMismatchError.new(peer_cert, host)
+    else
+      raise error
+    end
+  end
 end

data/lib/puppet/util/storage.rb

@@ -1,5 +1,4 @@
 require 'yaml'
-require 'sync'
 require 'singleton'
 require 'puppet/util/yaml'
 
@@ -55,7 +54,7 @@ class Puppet::Util::Storage
     end
     Puppet::Util.benchmark(:debug, "Loaded state in %{seconds} seconds") do
       begin
-        @@state = Puppet::Util::Yaml.load_file(filename)
+        @@state = Puppet::Util::Yaml.safe_load_file(filename, [Symbol, Time])
       rescue Puppet::Util::Yaml::YamlLoadError => detail
         Puppet.err _("Checksumfile %{filename} is corrupt (%{detail}); replacing") % { filename: filename, detail: detail }
 
@@ -82,6 +81,18 @@ class Puppet::Util::Storage
 
     Puppet.info _("Creating state file %{file}") % { file: Puppet[:statefile] } unless Puppet::FileSystem.exist?(Puppet[:statefile])
 
+    if Puppet[:statettl] == 0 || Puppet[:statettl] == Float::INFINITY
+      Puppet.debug "Not pruning old state cache entries"
+    else
+      Puppet::Util.benchmark(:debug, "Pruned old state cache entries in %{seconds} seconds") do
+        ttl_cutoff = Time.now - Puppet[:statettl]
+
+        @@state.reject! do |k,v|
+          @@state[k][:checked] && @@state[k][:checked] < ttl_cutoff
+        end
+      end
+    end
+
     Puppet::Util.benchmark(:debug, "Stored state in %{seconds} seconds") do
       Puppet::Util::Yaml.dump(@@state, Puppet[:statefile])
     end

data/lib/puppet/util/suidmanager.rb

@@ -1,4 +1,3 @@
-require 'facter'
 require 'puppet/util/warnings'
 require 'forwardable'
 require 'etc'
@@ -18,7 +17,7 @@ module Puppet::Util::SUIDManager
 
   def osx_maj_ver
     return @osx_maj_ver unless @osx_maj_ver.nil?
-    @osx_maj_ver = Facter.value('macosx_productversion_major') || false
+    @osx_maj_ver = Puppet.runtime[:facter].value('macosx_productversion_major') || false
   end
   module_function :osx_maj_ver
 
@@ -47,10 +46,12 @@ module Puppet::Util::SUIDManager
   module_function :groups=
 
   def self.root?
-    return Process.uid == 0 unless Puppet.features.microsoft_windows?
-
-    require 'puppet/util/windows/user'
-    Puppet::Util::Windows::User.admin?
+    if Puppet::Util::Platform.windows?
+      require 'puppet/util/windows/user'
+      Puppet::Util::Windows::User.admin?
+    else
+      Process.uid == 0
+    end
   end
 
   # Methods to handle changing uid/gid of the running process. In general,
@@ -61,7 +62,7 @@ module Puppet::Util::SUIDManager
   # If running on Windows or without root, the block will be run with the
   # current euid/egid.
   def asuser(new_uid=nil, new_gid=nil)
-    return yield if Puppet.features.microsoft_windows?
+    return yield if Puppet::Util::Platform.windows?
     return yield unless root?
     return yield unless new_uid or new_gid
 

data/lib/puppet/util/symbolic_file_mode.rb

@@ -19,25 +19,37 @@ module SymbolicFileMode
     return false
   end
 
+  def display_mode(value)
+    if value =~ /^0?[0-7]{1,4}$/
+      value.rjust(4, "0")
+    else
+      value
+    end
+  end
+
   def normalize_symbolic_mode(value)
     return nil if value.nil?
 
     # We need to treat integers as octal numbers.
-    if value.is_a? Numeric then
-      return value.to_s(8)
-    elsif value =~ /^0?[0-7]{1,4}$/ then
-      return value.to_i(8).to_s(8)
+    #
+    # "A numeric mode is from one to four octal digits (0-7), derived by adding
+    # up the bits with values 4, 2, and 1. Omitted digits are assumed to be
+    # leading zeros."
+    if value.is_a? Numeric
+      value.to_s(8)
+    elsif value =~ /^0?[0-7]{1,4}$/
+      value.to_i(8).to_s(8) # strip leading 0's
     else
-      return value
+      value
     end
   end
 
   def symbolic_mode_to_int(modification, to_mode = 0, is_a_directory = false)
-    if modification.nil? or modification == '' then
+    if modification.nil? or modification == ''
       raise Puppet::Error, _("An empty mode string is illegal")
-    end
-    if modification =~ /^[0-7]+$/ then return modification.to_i(8) end
-    if modification =~ /^\d+$/ then
+    elsif modification =~ /^[0-7]+$/
+      return modification.to_i(8)
+    elsif modification =~ /^\d+$/
       raise Puppet::Error, _("Numeric modes must be in octal, not decimal!")
     end
 
@@ -84,31 +96,31 @@ module SymbolicFileMode
 
           dsl.split('').each do |op|
             case op
-            when /[-+=]/ then
+            when /[-+=]/
               action = op
               # Clear all bits, if this is assignment
               value  = 0 if op == '='
 
-            when /[ugo]/ then
+            when /[ugo]/
               value = actions[action].call(value, snapshot_mode[op])
 
-            when /[rwx]/ then
+            when /[rwx]/
               value = actions[action].call(value, SymbolicMode[op])
 
-            when 'X' then
+            when 'X'
               # Only meaningful in combination with "set" actions.
-              if action != '+' then
+              if action != '+'
                 raise Puppet::Error, _("X only works with the '+' operator")
               end
 
               # As per the BSD manual page, set if this is a directory, or if
               # any execute bit is set on the original (unmodified) mode.
               # Ignored otherwise; it is "add if", not "add or clear".
-              if is_a_directory or original_mode['any x?'] then
+              if is_a_directory or original_mode['any x?']
                 value = actions[action].call(value, ExecBit)
               end
 
-            when /[st]/ then
+            when /[st]/
               bit = SymbolicSpecialToBit[op][who] or fail _("internal error")
               final_mode['s'] = actions[action].call(final_mode['s'], bit)
 
@@ -122,7 +134,7 @@ module SymbolicFileMode
         end
 
       rescue Puppet::Error => e
-        if part.inspect != modification.inspect then
+        if part.inspect != modification.inspect
           rest = " at #{part.inspect}"
         else
           rest = ''

data/lib/puppet/util/tag_set.rb

@@ -5,7 +5,7 @@ class Puppet::Util::TagSet < Set
   include Puppet::Network::FormatSupport
 
   def self.from_yaml(yaml)
-    self.new(YAML.load(yaml))
+    self.new(Puppet::Util::Yaml.safe_load(yaml, [Symbol]))
   end
 
   def to_yaml

data/lib/puppet/util/tagging.rb

@@ -1,7 +1,8 @@
+# frozen_string_literal: true
 require 'puppet/util/tag_set'
 
 module Puppet::Util::Tagging
-  ValidTagRegex = /\A[[:alnum:]_][[:alnum:]_:.-]*\Z/
+  ValidTagRegex = /\A[[:alnum:]_][[:alnum:]_:.-]*\Z/u
 
   # Add a tag to the current tag set.
   # When a tag set is used for a scope, these tags will be added to all of
@@ -10,14 +11,14 @@ module Puppet::Util::Tagging
   def tag(*ary)
     @tags ||= new_tags
 
-    ary.flatten.each do |tag|
+    ary.flatten.compact.each do |tag|
       name = tag.to_s.downcase
       # Add the tag before testing if it's valid since this means that
       # we never need to test the same valid tag twice. This speeds things
       # up since we get a lot of duplicates and rarely fail on bad tags
       if @tags.add?(name)
         # not seen before, so now we test if it is valid
-        if name =~ ValidTagRegex
+        if valid_tag?(name)
           if split_qualified_tags?
           # avoid adding twice by first testing if the string contains '::'
             @tags.merge(name.split('::')) if name.include?('::')
@@ -40,7 +41,7 @@ module Puppet::Util::Tagging
   # since that results in testing the same string twice
   #
   def tag_if_valid(name)
-    if name.is_a?(String) && name =~ ValidTagRegex
+    if name.is_a?(String) && valid_tag?(name)
       name = name.downcase
       @tags ||= new_tags
       if @tags.add?(name) && name.include?('::')
@@ -87,7 +88,7 @@ module Puppet::Util::Tagging
 
   # Merge tags from a tagged instance with no attempts to split, downcase
   # or verify the tags
-  def merge_tags(tag_source)
+  def merge_tags_from(tag_source)
     @tags ||= new_tags
     tag_source.merge_into(@tags)
   end
@@ -106,6 +107,19 @@ module Puppet::Util::Tagging
     tag(*tags)
   end
 
+  def valid_tag?(maybe_tag)
+    begin
+      tag_enc = maybe_tag.encoding
+      if tag_enc == Encoding::UTF_8 || tag_enc == Encoding::ASCII
+        maybe_tag =~ ValidTagRegex
+      else
+        maybe_tag.encode(Encoding::UTF_8) =~ ValidTagRegex
+      end
+    rescue Encoding::UndefinedConversionError, Encoding::InvalidByteSequenceError
+      false
+    end
+  end
+
   private
 
   def split_qualified_tags?

data/lib/puppet/util/warnings.rb

@@ -20,8 +20,6 @@ module Puppet::Util::Warnings
     nil
   end
 
-  protected
-
   def self.maybe_log(message, klass)
     @stampwarnings ||= {}
     @stampwarnings[klass] ||= []