puppet 5.3.4 → 6.29.0

data/lib/puppet/indirector/indirection.rb

@@ -1,14 +1,13 @@
 require 'puppet/util/docs'
 require 'puppet/util/profiler'
-require 'puppet/util/methodhelper'
 require 'puppet/indirector/envelope'
 require 'puppet/indirector/request'
+require 'puppet/thread_local'
 
 # The class that connects functional classes with their different collection
 # back-ends.  Each indirection has a set of associated terminus classes,
 # each of which is a subclass of Puppet::Indirector::Terminus.
 class Puppet::Indirector::Indirection
-  include Puppet::Util::MethodHelper
   include Puppet::Util::Docs
 
   attr_accessor :name, :model
@@ -31,7 +30,8 @@ class Puppet::Indirector::Indirection
   # Find an indirected model by name.  This is provided so that Terminus classes
   # can specifically hook up with the indirections they are associated with.
   def self.model(name)
-    return nil unless match = @@indirections.find { |i| i.name == name }
+    match = @@indirections.find { |i| i.name == name }
+    return nil unless match
     match.model
   end
 
@@ -46,11 +46,14 @@ class Puppet::Indirector::Indirection
     cache_class ? true : false
   end
 
-  attr_reader :cache_class
+  def cache_class
+    @cache_class.value
+  end
+
   # Define a terminus class to be used for caching.
   def cache_class=(class_name)
     validate_terminus_class(class_name) if class_name
-    @cache_class = class_name
+    @cache_class.value = class_name
   end
 
   # This is only used for testing.
@@ -89,25 +92,39 @@ class Puppet::Indirector::Indirection
     text
   end
 
-  def initialize(model, name, options = {})
+  def initialize(model, name, doc: nil, indirected_class: nil, cache_class: nil, terminus_class: nil, terminus_setting: nil, extend: nil)
     @model = model
     @name = name
     @termini = {}
 
-    @cache_class = nil
-    @terminus_class = nil
+    @doc = doc
 
     raise(ArgumentError, _("Indirection %{name} is already defined") % { name: @name }) if @@indirections.find { |i| i.name == @name }
     @@indirections << self
 
-    @indirected_class = options.delete(:indirected_class)
-    if mod = options[:extend]
-      extend(mod)
-      options.delete(:extend)
-    end
+    @indirected_class = indirected_class
+    self.extend(extend) if extend
+
+    # Setting these depend on the indirection already being installed so they have to be at the end
+    set_global_setting(:cache_class, cache_class)
+    set_global_setting(:terminus_class, terminus_class)
+    set_global_setting(:terminus_setting, terminus_setting)
+  end
 
-    # This is currently only used for cache_class and terminus_class.
-    set_options(options)
+  # Use this to set indirector settings globally across threads.
+  def set_global_setting(setting, value)
+    case setting
+    when :cache_class
+      validate_terminus_class(value) if !value.nil?
+      @cache_class = Puppet::ThreadLocal.new(value)
+    when :terminus_class
+      validate_terminus_class(value) if !value.nil?
+      @terminus_class = Puppet::ThreadLocal.new(value)
+    when :terminus_setting
+      @terminus_setting = Puppet::ThreadLocal.new(value)
+    else
+      raise(ArgumentError, _("The setting %{setting} is not a valid indirection setting.") % {setting: setting})
+    end
   end
 
   # Set up our request object.
@@ -123,29 +140,36 @@ class Puppet::Indirector::Indirection
     termini[terminus_name] ||= make_terminus(terminus_name)
   end
 
-  # This can be used to select the terminus class.
-  attr_accessor :terminus_setting
+  # These can be used to select the terminus class.
+  def terminus_setting
+    @terminus_setting.value
+  end
+
+  def terminus_setting=(setting)
+    @terminus_setting.value = setting
+  end
 
   # Determine the terminus class.
   def terminus_class
-    unless @terminus_class
-      if setting = self.terminus_setting
+    unless @terminus_class.value
+      setting = self.terminus_setting
+      if setting
         self.terminus_class = Puppet.settings[setting]
       else
         raise Puppet::DevError, _("No terminus class nor terminus setting was provided for indirection %{name}") % { name: self.name}
       end
     end
-    @terminus_class
+    @terminus_class.value
   end
 
   def reset_terminus_class
-    @terminus_class = nil
+    @terminus_class.value = nil
   end
 
   # Specify the terminus class to use.
   def terminus_class=(klass)
     validate_terminus_class(klass)
-    @terminus_class = klass
+    @terminus_class.value = klass
   end
 
   # This is used by terminus_class= and cache=.
@@ -165,9 +189,10 @@ class Puppet::Indirector::Indirection
   def expire(key, options={})
     request = request(:expire, key, nil, options)
 
-    return nil unless cache?
+    return nil unless cache? && !request.ignore_cache_save?
 
-    return nil unless instance = cache.find(request(:find, key, nil, options))
+    instance = cache.find(request(:find, key, nil, options))
+    return nil unless instance
 
     Puppet.info _("Expiring the %{cache} cache of %{instance}") % { cache: self.name, instance: instance.name }
 
@@ -198,7 +223,7 @@ class Puppet::Indirector::Indirection
       result = terminus.find(request)
       if not result.nil?
         result.expiration ||= self.expiration if result.respond_to?(:expiration)
-        if cache?
+        if cache? && !request.ignore_cache_save?
           Puppet.info _("Caching %{indirection} for %{request}") % { indirection: self.name, request: request.key }
           begin
             cache.save request(:save, key, result, options)
@@ -237,13 +262,14 @@ class Puppet::Indirector::Indirection
 
   def find_in_cache(request)
     # See if our instance is in the cache and up to date.
-    return nil unless cache? and ! request.ignore_cache? and cached = cache.find(request)
+    cached = cache.find(request) if cache? && ! request.ignore_cache?
+    return nil unless cached
     if cached.expired?
       Puppet.info _("Not using expired %{indirection} for %{request} from cache; expired at %{expiration}") % { indirection: self.name, request: request.key, expiration: cached.expiration }
       return nil
     end
 
-    Puppet.debug "Using cached #{self.name} for #{request.key}"
+    Puppet.debug { "Using cached #{self.name} for #{request.key}" }
     cached
   rescue => detail
     Puppet.log_exception(detail, _("Cached %{indirection} for %{request} failed: %{detail}") % { indirection: self.name, request: request.key, detail: detail })
@@ -270,7 +296,8 @@ class Puppet::Indirector::Indirection
     request = request(:search, key, nil, options)
     terminus = prepare(request)
 
-    if result = terminus.search(request)
+    result = terminus.search(request)
+    if result
       raise Puppet::DevError, _("Search results from terminus %{terminus_name} are not an array") % { terminus_name: terminus.name } unless result.is_a?(Array)
       result.each do |instance|
         next unless instance.respond_to? :expiration
@@ -286,10 +313,10 @@ class Puppet::Indirector::Indirection
     request = request(:save, key, instance, options)
     terminus = prepare(request)
 
-    result = terminus.save(request)
+    result = terminus.save(request) if !request.ignore_terminus?
 
     # If caching is enabled, save our document there
-    cache.save(request) if cache?
+    cache.save(request) if cache? && !request.ignore_cache_save?
 
     result
   end
@@ -336,7 +363,8 @@ class Puppet::Indirector::Indirection
   # Create a new terminus instance.
   def make_terminus(terminus_class)
     # Load our terminus class.
-    unless klass = Puppet::Indirector::Terminus.terminus_class(self.name, terminus_class)
+    klass = Puppet::Indirector::Terminus.terminus_class(self.name, terminus_class)
+    unless klass
       raise ArgumentError, _("Could not find terminus %{terminus_class} for indirection %{indirection}") % { terminus_class: terminus_class, indirection: self.name }
     end
     klass.new

data/lib/puppet/indirector/json.rb

@@ -14,7 +14,7 @@ class Puppet::Indirector::JSON < Puppet::Indirector::Terminus
     filename = path(request.key)
     FileUtils.mkdir_p(File.dirname(filename))
 
-    Puppet::Util.replace_file(filename, 0660) {|f| f.print to_json(request.instance).force_encoding(Encoding::BINARY) }
+    Puppet::FileSystem.replace_file(filename, 0660) {|f| f.print to_json(request.instance).force_encoding(Encoding::BINARY) }
   rescue TypeError => detail
     Puppet.log_exception(detail, _("Could not save %{json} %{request}: %{detail}") % { json: self.name, request: request.key, detail: detail })
   end
@@ -41,12 +41,16 @@ class Puppet::Indirector::JSON < Puppet::Indirector::Terminus
       raise ArgumentError, _("invalid key")
     end
 
-    base = Puppet.run_mode.master? ? Puppet[:server_datadir] : Puppet[:client_datadir]
+    base = data_dir
     File.join(base, self.class.indirection_name.to_s, name.to_s + ext)
   end
 
   private
 
+  def data_dir()
+    Puppet.run_mode.server? ? Puppet[:server_datadir] : Puppet[:client_datadir]
+  end
+
   def load_json_from_file(file, key)
     json = nil
 

data/lib/puppet/indirector/key/file.rb

@@ -1,11 +1,11 @@
 require 'puppet/indirector/ssl_file'
 require 'puppet/ssl/key'
 
+# @deprecated
 class Puppet::SSL::Key::File < Puppet::Indirector::SslFile
   desc "Manage SSL private and public keys on disk."
 
   store_in :privatekeydir
-  store_ca_at :cakey
 
   def allow_remote_requests?
     false
@@ -13,11 +13,7 @@ class Puppet::SSL::Key::File < Puppet::Indirector::SslFile
 
   # Where should we store the public key?
   def public_key_path(name)
-    if ca?(name)
-      Puppet[:capub]
-    else
-      File.join(Puppet[:publickeydir], name.to_s + ".pem")
-    end
+    File.join(Puppet[:publickeydir], name.to_s + ".pem")
   end
 
   # Remove the public key, in addition to the private key

data/lib/puppet/indirector/key/memory.rb

@@ -1,6 +1,7 @@
 require 'puppet/ssl/key'
 require 'puppet/indirector/memory'
 
+# @deprecated
 class Puppet::SSL::Key::Memory < Puppet::Indirector::Memory
   desc "Store keys in memory. This is used for testing puppet."
 end

data/lib/puppet/indirector/msgpack.rb

@@ -21,7 +21,7 @@ class Puppet::Indirector::Msgpack < Puppet::Indirector::Terminus
     filename = path(request.key)
     FileUtils.mkdir_p(File.dirname(filename))
 
-    Puppet::Util.replace_file(filename, 0660) {|f| f.print to_msgpack(request.instance) }
+    Puppet::FileSystem.replace_file(filename, 0660) {|f| f.print to_msgpack(request.instance) }
   rescue TypeError => detail
     Puppet.log_exception(detail, _("Could not save %{name} %{request}: %{detail}") % { name: self.name, request: request.key, detail: detail })
   end
@@ -48,7 +48,7 @@ class Puppet::Indirector::Msgpack < Puppet::Indirector::Terminus
       raise ArgumentError, _("invalid key")
     end
 
-    base = Puppet.run_mode.master? ? Puppet[:server_datadir] : Puppet[:client_datadir]
+    base = Puppet.run_mode.server? ? Puppet[:server_datadir] : Puppet[:client_datadir]
     File.join(base, self.class.indirection_name.to_s, name.to_s + ext)
   end
 

data/lib/puppet/indirector/node/exec.rb

@@ -3,7 +3,7 @@ require 'puppet/indirector/exec'
 
 class Puppet::Node::Exec < Puppet::Indirector::Exec
   desc "Call an external program to get node information.  See
-  the [External Nodes](https://docs.puppetlabs.com/guides/external_nodes.html) page for more information."
+  the [External Nodes](https://puppet.com/docs/puppet/latest/lang_write_functions_in_puppet.html) page for more information."
   include Puppet::Util
 
   def command
@@ -38,11 +38,10 @@ class Puppet::Node::Exec < Puppet::Indirector::Exec
   # Turn our outputted objects into a Puppet::Node instance.
   def create_node(name, result, facts = nil)
     node = Puppet::Node.new(name)
-    set = false
     [:parameters, :classes, :environment].each do |param|
-      if value = result[param]
+      value = result[param]
+      if value
         node.send(param.to_s + "=", value)
-        set = true
       end
     end
 
@@ -52,7 +51,7 @@ class Puppet::Node::Exec < Puppet::Indirector::Exec
 
   # Translate the yaml string into Ruby objects.
   def translate(name, output)
-    YAML.load(output).inject({}) do |hash, data|
+    Puppet::Util::Yaml.safe_load(output, [Symbol]).inject({}) do |hash, data|
       case data[0]
       when String
         hash[data[0].intern] = data[1]

data/lib/puppet/indirector/node/json.rb

@@ -0,0 +1,8 @@
+require 'puppet/node'
+require 'puppet/indirector/json'
+
+class Puppet::Node::Json < Puppet::Indirector::JSON
+  desc "Store node information as flat files, serialized using JSON,
+    or deserialize stored JSON nodes."
+
+end

data/lib/puppet/indirector/node/rest.rb

@@ -4,4 +4,28 @@ require 'puppet/indirector/rest'
 class Puppet::Node::Rest < Puppet::Indirector::REST
   desc "Get a node via REST. Puppet agent uses this to allow the puppet master
     to override its environment."
+
+  def find(request)
+    return super unless use_http_client?
+
+    session = Puppet.lookup(:http_session)
+    api = session.route_to(:puppet)
+    _, node = api.get_node(
+      request.key,
+      environment: request.environment.to_s,
+      configured_environment: request.options[:configured_environment],
+      transaction_uuid: request.options[:transaction_uuid]
+    )
+    node
+  rescue Puppet::HTTP::ResponseError => e
+    if e.response.code == 404
+      return nil unless request.options[:fail_on_404]
+
+      _, body = parse_response(e.response.nethttp)
+      msg = _("Find %{uri} resulted in 404 with the message: %{body}") % { uri: elide(e.response.url.path, 100), body: body }
+      raise Puppet::Error, msg
+    else
+      raise convert_to_http_error(e.response.nethttp)
+    end
+  end
 end

data/lib/puppet/indirector/node/yaml.rb

@@ -4,10 +4,4 @@ require 'puppet/indirector/yaml'
 class Puppet::Node::Yaml < Puppet::Indirector::Yaml
   desc "Store node information as flat files, serialized using YAML,
     or deserialize stored YAML nodes."
-
-  protected
-
-  def fix(object)
-    object
-  end
 end

data/lib/puppet/indirector/report/json.rb

@@ -0,0 +1,34 @@
+require 'puppet/transaction/report'
+require 'puppet/indirector/json'
+
+class Puppet::Transaction::Report::Json < Puppet::Indirector::JSON
+  include Puppet::Util::SymbolicFileMode
+
+  desc "Store last report as a flat file, serialized using JSON."
+
+  # Force report to be saved there
+  def path(name,ext='.json')
+    Puppet[:lastrunreport]
+  end
+
+  def save(request)
+    filename = path(request.key)
+    mode = Puppet.settings.setting(:lastrunreport).mode
+
+    unless valid_symbolic_mode?(mode)
+      raise Puppet::DevError, _("replace_file mode: %{mode} is invalid") % { mode: mode }
+    end
+
+    mode = symbolic_mode_to_int(normalize_symbolic_mode(mode))
+
+    FileUtils.mkdir_p(File.dirname(filename))
+
+    begin
+      Puppet::FileSystem.replace_file(filename, mode) do |fh|
+        fh.print JSON.dump(request.instance)
+      end
+    rescue TypeError => detail
+      Puppet.err _("Could not save %{indirection} %{request}: %{detail}") % { indirection: self.name, request: request.key, detail: detail }
+    end
+  end
+end

data/lib/puppet/indirector/report/processor.rb

@@ -26,9 +26,9 @@ class Puppet::Transaction::Report::Processor < Puppet::Indirector::Code
   # LAK:NOTE This isn't necessarily the best design, but it's backward
   # compatible and that's good enough for now.
   def process(report)
-    Puppet.debug "Received report to process from #{report.host}"
+    Puppet.debug { "Received report to process from #{report.host}" }
     processors do |mod|
-      Puppet.debug "Processing report from #{report.host} with processor #{mod}"
+      Puppet.debug { "Processing report from #{report.host} with processor #{mod}" }
       # We have to use a dup because we're including a module in the
       # report.
       newrep = report.dup
@@ -49,7 +49,8 @@ class Puppet::Transaction::Report::Processor < Puppet::Indirector::Code
   def processors(&blk)
     return [] if Puppet[:reports] == "none"
     reports.each do |name|
-      if mod = Puppet::Reports.report(name)
+      mod = Puppet::Reports.report(name)
+      if mod
         yield(mod)
       else
         Puppet.warning _("No report named '%{name}'") % { name: name }

data/lib/puppet/indirector/report/rest.rb

@@ -7,6 +7,25 @@ class Puppet::Transaction::Report::Rest < Puppet::Indirector::REST
   use_port_setting(:report_port)
   use_srv_service(:report)
 
+  def save(request)
+    return super unless use_http_client?
+
+    session = Puppet.lookup(:http_session)
+    api = session.route_to(:report)
+    response = api.put_report(
+      request.key,
+      request.instance,
+      environment: request.environment.to_s
+    )
+    content_type, body = parse_response(response)
+    deserialize_save(content_type, body)
+  rescue Puppet::HTTP::ResponseError => e
+    return nil if e.response.code == 404
+
+    raise convert_to_http_error(e.response.nethttp)
+  end
+
+  # This is called by the superclass when not using our httpclient.
   def handle_response(request, response)
     if !response.is_a?(Net::HTTPSuccess)
       server_version = response[Puppet::Network::HTTP::HEADER_PUPPET_VERSION]

data/lib/puppet/indirector/report/yaml.rb

@@ -2,10 +2,33 @@ require 'puppet/transaction/report'
 require 'puppet/indirector/yaml'
 
 class Puppet::Transaction::Report::Yaml < Puppet::Indirector::Yaml
+  include Puppet::Util::SymbolicFileMode
+
   desc "Store last report as a flat file, serialized using YAML."
 
   # Force report to be saved there
   def path(name,ext='.yaml')
     Puppet[:lastrunreport]
   end
+
+  def save(request)
+    filename = path(request.key)
+    mode = Puppet.settings.setting(:lastrunreport).mode
+
+    unless valid_symbolic_mode?(mode)
+      raise Puppet::DevError, _("replace_file mode: %{mode} is invalid") % { mode: mode }
+    end
+
+    mode = symbolic_mode_to_int(normalize_symbolic_mode(mode))
+
+    FileUtils.mkdir_p(File.dirname(filename))
+
+    begin
+      Puppet::FileSystem.replace_file(filename, mode) do |fh|
+        fh.print YAML.dump(request.instance)
+      end
+    rescue TypeError => detail
+      Puppet.err _("Could not save %{indirection} %{request}: %{detail}") % { indirection: self.name, request: request.key, detail: detail }
+    end
+  end
 end

data/lib/puppet/indirector/request.rb

@@ -3,14 +3,16 @@ require 'uri'
 require 'puppet/indirector'
 require 'puppet/network/resolver'
 require 'puppet/util/psych_support'
+require 'puppet/util/warnings'
 
 # This class encapsulates all of the information you need to make an
 # Indirection call, and as a result also handles REST calls.  It's somewhat
 # analogous to an HTTP Request object, except tuned for our Indirector.
 class Puppet::Indirector::Request
   include Puppet::Util::PsychSupport
+  include Puppet::Util::Warnings
 
-  attr_accessor :key, :method, :options, :instance, :node, :ip, :authenticated, :ignore_cache, :ignore_terminus
+  attr_accessor :key, :method, :options, :instance, :node, :ip, :authenticated, :ignore_cache, :ignore_cache_save, :ignore_terminus
 
   attr_accessor :server, :port, :uri, :protocol
 
@@ -18,7 +20,7 @@ class Puppet::Indirector::Request
 
   # trusted_information is specifically left out because we can't serialize it
   # and keep it "trusted"
-  OPTION_ATTRIBUTES = [:ip, :node, :authenticated, :ignore_terminus, :ignore_cache, :instance, :environment]
+  OPTION_ATTRIBUTES = [:ip, :node, :authenticated, :ignore_terminus, :ignore_cache, :ignore_cache_save, :instance, :environment]
 
   # Is this an authenticated request?
   def authenticated?
@@ -50,6 +52,10 @@ class Puppet::Indirector::Request
     ignore_cache
   end
 
+  def ignore_cache_save?
+    ignore_cache_save
+  end
+
   def ignore_terminus?
     ignore_terminus
   end
@@ -93,8 +99,9 @@ class Puppet::Indirector::Request
   end
 
   def model
-    raise ArgumentError, _("Could not find indirection '%{indirection}'") % { indirection: indirection_name } unless i = indirection
-    i.model
+    ind = indirection
+    raise ArgumentError, _("Could not find indirection '%{indirection}'") % { indirection: indirection_name } unless ind
+    ind.model
   end
 
   # Are we trying to interact with multiple resources, or just one?
@@ -163,7 +170,8 @@ class Puppet::Indirector::Request
     result = options.dup
 
     OPTION_ATTRIBUTES.each do |attribute|
-      if value = send(attribute)
+      value = send(attribute)
+      if value
         result[attribute] = value
       end
     end
@@ -181,7 +189,11 @@ class Puppet::Indirector::Request
     return yield(self) if !self.server.nil?
 
     if Puppet.settings[:use_srv_records]
-      Puppet::Network::Resolver.each_srv_record(Puppet.settings[:srv_domain], srv_service) do |srv_server, srv_port|
+      # We may want to consider not creating a new resolver here
+      # every request eventually, to take advantage of the resolver's
+      # caching behavior.
+      resolver = Puppet::Network::Resolver.new
+      resolver.each_srv_record(Puppet.settings[:srv_domain], srv_service) do |srv_server, srv_port|
         begin
           self.server = srv_server
           self.port   = srv_port
@@ -192,30 +204,39 @@ class Puppet::Indirector::Request
       end
     end
 
-    # ... Fall back onto the default server.
-    begin
-      bound_server = Puppet.lookup(:server)
-    rescue
-      if primary_server = Puppet.settings[:server_list][0]
-        bound_server = primary_server[0]
-      else
-        bound_server = Puppet.settings[:server]
+    if default_server
+      self.server = default_server
+    else
+      self.server = Puppet.lookup(:server) do
+        primary_server = Puppet.settings[:server_list][0]
+        if primary_server
+          #TRANSLATORS 'server_list' is the name of a setting and should not be translated
+          debug_once _("Selected server from first entry of the `server_list` setting: %{server}") % {server: primary_server[0]}
+          primary_server[0]
+        else
+          #TRANSLATORS 'server' is the name of a setting and should not be translated
+          debug_once _("Selected server from the `server` setting: %{server}") % {server: Puppet.settings[:server]}
+          Puppet.settings[:server]
+        end
       end
     end
 
-    begin
-      bound_port = Puppet.lookup(:serverport)
-    rescue
-      if primary_server = Puppet.settings[:server_list][0]
-        bound_port = primary_server[1]
-      else
-        bound_port = Puppet.settings[:masterport]
+    if default_port
+      self.port = default_port
+    else
+      self.port = Puppet.lookup(:serverport) do
+        primary_server = Puppet.settings[:server_list][0]
+        if primary_server
+          #TRANSLATORS 'server_list' is the name of a setting and should not be translated
+          debug_once _("Selected port from the first entry of the `server_list` setting: %{port}") % {port: primary_server[1]}
+          primary_server[1]
+        else
+          #TRANSLATORS 'serverport' is the name of a setting and should not be translated
+          debug_once _("Selected port from the `serverport` setting: %{port}") % {port: Puppet.settings[:serverport]}
+          Puppet.settings[:serverport]
+        end
       end
     end
-    self.server = default_server || bound_server
-    self.port   = default_port || bound_port
-
-    Puppet.debug "No more servers left, falling back to #{self.server}:#{self.port}" if Puppet.settings[:use_srv_records]
 
     return yield(self)
   end
@@ -251,12 +272,12 @@ class Puppet::Indirector::Request
       return
     end
 
-    @server = uri.host if uri.host
+    @server = uri.host if uri.host && !uri.host.empty?
 
     # If the URI class can look up the scheme, it will provide a port,
     # otherwise it will default to '0'.
     if uri.port.to_i == 0 and uri.scheme == "puppet"
-      @port = Puppet.settings[:masterport].to_i
+      @port = Puppet.settings[:serverport].to_i
     else
       @port = uri.port.to_i
     end
@@ -269,6 +290,6 @@ class Puppet::Indirector::Request
       @protocol = uri.scheme
     end
 
-    @key = URI.unescape(uri.path.sub(/^\//, ''))
+    @key = Puppet::Util.uri_unescape(uri.path.sub(/^\//, ''))
   end
 end

data/lib/puppet/indirector/resource/ral.rb

@@ -24,10 +24,13 @@ class Puppet::Resource::Ral < Puppet::Indirector::Code
     type(request).instances.map do |res|
       res.to_resource
     end.find_all do |res|
-      conditions.all? {|property, value| res.to_resource[property].to_s == value.to_s}
-    end.sort do |a,b|
-      a.title <=> b.title
-    end
+      conditions.all? do |property, value|
+        # even though `res` is an instance of Puppet::Resource, calling
+        # `res[:name]` on it returns nil, and for some reason it is necessary
+        # to invoke the Puppet::Resource#copy_as_resource copy constructor...
+        res.copy_as_resource[property].to_s == value.to_s
+      end
+    end.sort_by(&:title)
   end
 
   def save( request )

data/lib/puppet/indirector/resource/validator.rb

@@ -1,7 +1,7 @@
 module Puppet::Resource::Validator
   def validate_key(request)
     type, title = request.key.split('/', 2)
-    unless type.downcase == request.instance.type.downcase and title == request.instance.title
+    unless type.casecmp(request.instance.type).zero? and title == request.instance.title
       raise Puppet::Indirector::ValidationError, _("Resource instance does not match request key")
     end
   end