puppet 5.3.4 → 6.29.0

data/lib/puppet/network/authconfig.rb

@@ -10,10 +10,6 @@ module Puppet
       Puppet::Network::HTTP::MASTER_URL_PREFIX
     end
 
-    def self.ca_url_prefix
-      Puppet::Network::HTTP::CA_URL_PREFIX
-    end
-
     def self.default_acl
       [
       # Master API V3
@@ -28,17 +24,8 @@ module Puppet
       { :acl => "#{master_url_prefix}/v3/file" },
 
       { :acl => "#{master_url_prefix}/v3/status", :method => [:find], :authenticated => true },
-
-      # CA API V1
-      { :acl => "#{ca_url_prefix}/v1/certificate_revocation_list/ca", :method => :find, :authenticated => true },
-
-      # These allow `auth any`, because if you can do them anonymously you
-      # should probably also be able to do them when trusted.
-      { :acl => "#{ca_url_prefix}/v1/certificate/ca", :method => :find, :authenticated => :any },
-      { :acl => "#{ca_url_prefix}/v1/certificate/", :method => :find, :authenticated => :any },
-      { :acl => "#{ca_url_prefix}/v1/certificate_request", :method => [:find, :save], :authenticated => :any },
       ]
-      end
+    end
 
     # Just proxy the setting methods to our rights stuff
     [:allow, :deny].each do |method|
@@ -67,7 +54,8 @@ module Puppet
       right = @rights.newright(acl[:acl])
       right.allow(acl[:allow] || "*")
 
-      if method = acl[:method]
+      method = acl[:method]
+      if method
         method = [method] unless method.is_a?(Array)
         method.each { |m| right.restrict_method(m) }
       end
@@ -78,7 +66,8 @@ module Puppet
     # raise an Puppet::Network::AuthorizedError if the request
     # is denied.
     def check_authorization(method, path, params)
-      if authorization_failure_exception = @rights.is_request_forbidden_and_why?(method, path, params)
+      authorization_failure_exception = @rights.is_request_forbidden_and_why?(method, path, params)
+      if authorization_failure_exception
         Puppet.warning(_("Denying access: %{authorization_failure_exception}") % { authorization_failure_exception: authorization_failure_exception })
         raise authorization_failure_exception
       end

data/lib/puppet/network/authstore.rb

@@ -16,7 +16,7 @@ module Puppet
     # is provided, then the authstore is considered local and defaults to "true".
     def allowed?(name, ip)
       if name or ip
-        # This is probably unnecessary, and can cause some weirdnesses in
+        # This is probably unnecessary, and can cause some weirdness in
         # cases where we're operating over localhost but don't have a real
         # IP defined.
         raise Puppet::DevError, _("Name and IP must be passed to 'allowed?'") unless name and ip
@@ -29,7 +29,8 @@ module Puppet
       # yay insecure overrides
       return true if globalallow?
 
-      if decl = declarations.find { |d| d.match?(name, ip) }
+      decl = declarations.find { |d| d.match?(name, ip) }
+      if decl
         return decl.result
       end
 

data/lib/puppet/network/format_support.rb

@@ -45,13 +45,11 @@ module Puppet::Network::FormatSupport
       end.sort do |a, b|
         # It's an inverse sort -- higher weight formats go first.
         b.weight <=> a.weight
-      end.collect do |f|
-        f.name
       end
 
-      result = put_preferred_format_first(result)
+      result = put_preferred_format_first(result).map(&:name)
 
-      Puppet.debug "#{friendly_name} supports formats: #{result.join(' ')}"
+      Puppet.debug { "#{friendly_name} supports formats: #{result.join(' ')}" }
 
       result
     end
@@ -76,13 +74,20 @@ module Puppet::Network::FormatSupport
     end
 
     def put_preferred_format_first(list)
-      preferred_format = Puppet.settings[:preferred_serialization_format].to_sym
-      if list.include?(preferred_format)
-        list.delete(preferred_format)
-        list.unshift(preferred_format)
+      preferred_format = Puppet.settings[:preferred_serialization_format].to_s
+
+      preferred = list.select { |format|
+        format.mime.end_with?(preferred_format)
+      }
+
+      if preferred.empty?
+        Puppet.debug { "Value of 'preferred_serialization_format' (#{preferred_format}) is invalid for #{friendly_name}, using default (#{list.first.name})" }
       else
-        Puppet.debug "Value of 'preferred_serialization_format' (#{preferred_format}) is invalid for #{friendly_name}, using default (#{list.first})"
+        list = preferred + list.reject { |format|
+          format.mime.end_with?(preferred_format)
+        }
       end
+
       list
     end
   end
@@ -97,7 +102,7 @@ module Puppet::Network::FormatSupport
   end
 
   def to_json(*args)
-    to_data_hash.to_json(*args)
+    Puppet::Util::Json.dump(to_data_hash, *args)
   end
 
   def render(format = nil)

data/lib/puppet/network/formats.rb

@@ -1,5 +1,5 @@
 require 'puppet/network/format_handler'
-require 'json'
+require 'puppet/util/json'
 
 Puppet::Network::FormatHandler.create_serialized_formats(:msgpack, :weight => 20, :mime => "application/x-msgpack", :required_methods => [:render_method, :intern_method], :intern_method => :from_data_hash) do
 
@@ -23,13 +23,25 @@ Puppet::Network::FormatHandler.create_serialized_formats(:msgpack, :weight => 20
 end
 
 Puppet::Network::FormatHandler.create_serialized_formats(:yaml) do
+  def allowed_yaml_classes
+    @allowed_yaml_classes ||= [
+      Puppet::Node::Facts,
+      Puppet::Node,
+      Puppet::Transaction::Report,
+      Puppet::Resource,
+      Puppet::Resource::Catalog
+    ]
+  end
+
   def intern(klass, text)
-    data = YAML.load(text)
+    data = Puppet::Util::Yaml.safe_load(text, allowed_yaml_classes)
     data_to_instance(klass, data)
+  rescue Puppet::Util::Yaml::YamlLoadError => e
+    raise Puppet::Network::FormatHandler::FormatError, _("Serialized YAML did not contain a valid instance of %{klass}: %{message}") % { klass: klass, message: e.message }
   end
 
   def intern_multiple(klass, text)
-    data = YAML.load(text)
+    data = Puppet::Util::Yaml.safe_load(text, allowed_yaml_classes)
     unless data.respond_to?(:collect)
       raise Puppet::Network::FormatHandler::FormatError, _("Serialized YAML did not contain a collection of instances when calling intern_multiple")
     end
@@ -37,6 +49,8 @@ Puppet::Network::FormatHandler.create_serialized_formats(:yaml) do
     data.collect do |datum|
       data_to_instance(klass, datum)
     end
+  rescue Puppet::Util::Yaml::YamlLoadError => e
+    raise Puppet::Network::FormatHandler::FormatError, _("Serialized YAML did not contain a valid instance of %{klass}: %{message}") % { klass: klass, message: e.message }
   end
 
   def data_to_instance(klass, data)
@@ -91,7 +105,8 @@ Puppet::Network::FormatHandler.create_serialized_formats(:pson, :weight => 10, :
   # If they pass class information, we want to ignore it.
   # This is required for compatibility with Puppet 3.x
   def data_to_instance(klass, data)
-    if data.is_a?(Hash) and d = data['data']
+    d = data['data'] if data.is_a?(Hash)
+    if d
       data = d
     end
     return data if data.is_a?(klass)
@@ -101,19 +116,17 @@ end
 
 Puppet::Network::FormatHandler.create_serialized_formats(:json, :mime => 'application/json', :charset => Encoding::UTF_8, :weight => 15, :required_methods => [:render_method, :intern_method], :intern_method => :from_data_hash) do
   def intern(klass, text)
-    data_to_instance(klass, JSON.parse(text))
+    data_to_instance(klass, Puppet::Util::Json.load(text))
   end
 
   def intern_multiple(klass, text)
-    JSON.parse(text).collect do |data|
+    Puppet::Util::Json.load(text).collect do |data|
       data_to_instance(klass, data)
     end
   end
 
-  # JSON monkey-patches Array, so this works.
-  # https://github.com/ruby/ruby/blob/ruby_1_9_3/ext/json/generator/generator.c#L1416
   def render_multiple(instances)
-    instances.to_json
+    Puppet::Util::Json.dump(instances)
   end
 
   # Unlike PSON, we do not need to unwrap the data envelope, because legacy 3.x agents
@@ -162,10 +175,155 @@ Puppet::Network::FormatHandler.create(:console,
     end
 
     # ...or pretty-print the inspect outcome.
-    JSON.pretty_generate(datum, :quirks_mode => true)
+    Puppet::Util::Json.dump(datum, :pretty => true, :quirks_mode => true)
+  end
+
+  def render_multiple(data)
+    data.collect(&:render).join("\n")
+  end
+end
+
+Puppet::Network::FormatHandler.create(:flat,
+                                      :mime   => 'text/x-flat-text',
+                                      :weight => 0) do
+
+  def flatten_hash(hash)
+    hash.each_with_object({}) do |(k, v), h|
+      if v.is_a? Hash
+        flatten_hash(v).map do |h_k, h_v|
+          h["#{k}.#{h_k}"] = h_v
+        end
+      elsif v.is_a? Array
+        v.each_with_index do |el, i|
+          if el.is_a? Hash
+            flatten_hash(el).map do |el_k, el_v|
+              h["#{k}.#{i}.#{el_k}"] = el_v
+            end
+          else
+            h["#{k}.#{i}"] = el
+          end
+        end
+      else
+        h[k] = v
+      end
+    end
+  end
+
+  def flatten_array(array)
+    a={}
+    array.each_with_index do |el, i|
+      if el.is_a? Hash
+        flatten_hash(el).map do |el_k, el_v|
+          a["#{i}.#{el_k}"] = el_v
+        end
+      else
+        a["#{i}"] = el
+      end
+    end
+    a
+  end
+
+  def construct_output(data)
+    output = ''
+    data.each do |key, value|
+      output << "#{key}=#{value}"
+      output << "\n"
+    end
+    output
   end
 
+  def render(datum)
+    return datum if datum.is_a?(String) || datum.is_a?(Numeric)
+    # Simple hash
+    if datum.is_a?(Hash)
+      data = flatten_hash(datum)
+      return construct_output(data)
+    elsif datum.is_a?(Array)
+      data = flatten_array(datum)
+      return construct_output(data)
+    end
+    Puppet::Util::Json.dump(datum, :pretty => true, :quirks_mode => true)
+  end
   def render_multiple(data)
     data.collect(&:render).join("\n")
   end
 end
+
+
+Puppet::Network::FormatHandler.create(:rich_data_json, mime: 'application/vnd.puppet.rich+json', charset: Encoding::UTF_8, weight: 30) do
+  def intern(klass, text)
+    Puppet.override({:rich_data => true}) do
+      data_to_instance(klass, Puppet::Util::Json.load(text))
+    end
+  end
+
+  def intern_multiple(klass, text)
+    Puppet.override({:rich_data => true}) do
+      Puppet::Util::Json.load(text).collect do |data|
+        data_to_instance(klass, data)
+      end
+    end
+  end
+
+  def render(instance)
+    Puppet.override({:rich_data => true}) do
+      instance.to_json
+    end
+  end
+
+  def render_multiple(instances)
+    Puppet.override({:rich_data => true}) do
+      Puppet::Util::Json.dump(instances)
+    end
+  end
+
+  def data_to_instance(klass, data)
+    Puppet.override({:rich_data => true}) do
+      return data if data.is_a?(klass)
+      klass.from_data_hash(data)
+    end
+  end
+
+  def supported?(klass)
+    klass == Puppet::Resource::Catalog &&
+      Puppet.lookup(:current_environment).rich_data?
+  end
+end
+
+Puppet::Network::FormatHandler.create_serialized_formats(:rich_data_msgpack, mime: "application/vnd.puppet.rich+msgpack", weight: 35) do
+  confine :feature => :msgpack
+
+  def intern(klass, text)
+    Puppet.override(rich_data: true) do
+      data = MessagePack.unpack(text)
+      return data if data.is_a?(klass)
+      klass.from_data_hash(data)
+    end
+  end
+
+  def intern_multiple(klass, text)
+    Puppet.override(rich_data: true) do
+      MessagePack.unpack(text).collect do |data|
+        klass.from_data_hash(data)
+      end
+    end
+  end
+
+  def render_multiple(instances)
+    Puppet.override(rich_data: true) do
+      instances.to_msgpack
+    end
+  end
+
+  def render(instance)
+    Puppet.override(rich_data: true) do
+      instance.to_msgpack
+    end
+  end
+
+  def supported?(klass)
+    suitable? &&
+      klass == Puppet::Resource::Catalog &&
+      Puppet.lookup(:current_environment).rich_data?
+  end
+end

data/lib/puppet/network/http/api/indirected_routes.rb

@@ -43,8 +43,14 @@ class Puppet::Network::HTTP::API::IndirectedRoutes
       raise Puppet::Network::HTTP::Error::HTTPNotFoundError.new(_("No handler for %{indirection}") % { indirection: indirection.name }, :NO_INDIRECTION_REMOTE_REQUESTS)
     end
 
-    trusted = Puppet::Context::TrustedInformation.remote(params[:authenticated], params[:node], certificate)
-    Puppet.override(:trusted_information => trusted) do
+    overrides = {
+      trusted_information: Puppet::Context::TrustedInformation.remote(params[:authenticated], params[:node], certificate),
+    }
+    if params[:environment]
+      overrides[:current_environment] = params[:environment]
+    end
+
+    Puppet.override(overrides) do
       send("do_#{method}", indirection, key, params, request, response)
     end
   end
@@ -99,7 +105,7 @@ class Puppet::Network::HTTP::API::IndirectedRoutes
       raise Puppet::Network::HTTP::Error::HTTPNotAuthorizedError.new(e.message)
     end
 
-    if configured_environment.nil?
+    if configured_environment.nil? && indirection.terminus.require_environment?
       raise Puppet::Network::HTTP::Error::HTTPNotFoundError.new(
         _("Could not find environment '%{environment}'") % { environment: environment })
     end
@@ -114,11 +120,23 @@ class Puppet::Network::HTTP::API::IndirectedRoutes
     [indirection, method, key, params]
   end
 
+  def self.request_to_uri(request)
+    uri, body = request_to_uri_and_body(request)
+    "#{uri}?#{body}"
+  end
+
+  def self.request_to_uri_and_body(request)
+    url_prefix = IndirectionType.url_prefix_for(request.indirection_name.to_s)
+    indirection = request.method == :search ? pluralize(request.indirection_name.to_s) : request.indirection_name.to_s
+    ["#{url_prefix}/#{indirection}/#{Puppet::Util.uri_encode(request.key)}", "environment=#{request.environment.name}&#{request.query_string}"]
+  end
+
   private
 
   # Execute our find.
   def do_find(indirection, key, params, request, response)
-    unless result = indirection.find(key, params)
+    result = indirection.find(key, params)
+    unless result
       raise Puppet::Network::HTTP::Error::HTTPNotFoundError.new(_("Could not find %{value0} %{key}") % { value0: indirection.name, key: key }, Puppet::Network::HTTP::Issues::RESOURCE_NOT_FOUND)
     end
 
@@ -191,7 +209,8 @@ class Puppet::Network::HTTP::API::IndirectedRoutes
       begin
         yield format
         true
-      rescue Puppet::Network::FormatHandler::FormatError => e
+      rescue Puppet::Network::FormatHandler::FormatError => err
+        Puppet.log_exception(err, err.message, level: :debug)
         false
       end
     end
@@ -199,7 +218,7 @@ class Puppet::Network::HTTP::API::IndirectedRoutes
     return formatter if formatter
 
     raise Puppet::Network::HTTP::Error::HTTPNotAcceptableError.new(
-            _("No supported formats are acceptable (Accept: %{accepted_formats})") % { accepted_formats: formats },
+            _("No supported formats are acceptable (Accept: %{accepted_formats})") % { accepted_formats: formats.map(&:mime).join(', ') },
             Puppet::Network::HTTP::Issues::UNSUPPORTED_FORMAT)
   end
 
@@ -238,33 +257,25 @@ class Puppet::Network::HTTP::API::IndirectedRoutes
     raise Puppet::Network::HTTP::Error::HTTPMethodNotAllowedError.new(
       _("No support for http method %{http_method}") % { http_method: http_method }) unless METHOD_MAP[http_method]
 
-    unless method = METHOD_MAP[http_method][plurality(indirection)]
-      raise Puppet::Network::HTTP::Error::HTTPBadRequestError.new(
+      method = METHOD_MAP[http_method][plurality(indirection)]
+      unless method
+        raise Puppet::Network::HTTP::Error::HTTPBadRequestError.new(
         _("No support for plurality %{indirection} for %{http_method} operations") % { indirection: plurality(indirection), http_method: http_method })
-    end
+      end
 
     method
   end
 
-  def self.request_to_uri(request)
-    uri, body = request_to_uri_and_body(request)
-    "#{uri}?#{body}"
-  end
-
-  def self.request_to_uri_and_body(request)
-    url_prefix = IndirectionType.url_prefix_for(request.indirection_name.to_s)
-    indirection = request.method == :search ? pluralize(request.indirection_name.to_s) : request.indirection_name.to_s
-    ["#{url_prefix}/#{indirection}/#{Puppet::Util.uri_encode(request.key)}", "environment=#{request.environment.name}&#{request.query_string}"]
-  end
-
   def self.pluralize(indirection)
     return(indirection == "status" ? "statuses" : indirection + "s")
   end
+  private_class_method :pluralize
 
   def plurality(indirection)
     # NOTE These specific hooks for paths are ridiculous, but it's a *many*-line
     # fix to not need this, and our goal is to move away from the complication
     # that leads to the fix being too long.
+    return :singular if indirection == "facts"
     return :singular if indirection == "status"
     return :singular if indirection == "certificate_status"
 

data/lib/puppet/network/http/api/master/v3/environment.rb

@@ -1,8 +1,11 @@
-require 'json'
+require 'puppet/util/json'
 require 'puppet/parser/environment_compiler'
 
+# @deprecated application orchestration will be removed in puppet 7
 class Puppet::Network::HTTP::API::Master::V3::Environment
   def call(request, response)
+    Puppet.deprecation_warning("Application orchestration is deprecated. See https://puppet.com/docs/puppet/5.5/deprecated_language.html")
+
     env_name = request.routing_path.split('/').last
     env = Puppet.lookup(:environments).get(env_name)
     code_id = request.params[:code_id]
@@ -15,7 +18,7 @@ class Puppet::Network::HTTP::API::Master::V3::Environment
 
     env_graph = build_environment_graph(catalog)
 
-    response.respond_with(200, "application/json", JSON.dump(env_graph))
+    response.respond_with(200, "application/json", Puppet::Util::Json.dump(env_graph))
   end
 
   def build_environment_graph(catalog)

data/lib/puppet/network/http/api/master/v3/environments.rb

@@ -1,4 +1,4 @@
-require 'json'
+require 'puppet/util/json'
 
 class Puppet::Network::HTTP::API::Master::V3::Environments
   def initialize(env_loader)
@@ -6,7 +6,7 @@ class Puppet::Network::HTTP::API::Master::V3::Environments
   end
 
   def call(request, response)
-    response.respond_with(200, "application/json", JSON.dump({
+    response.respond_with(200, "application/json", Puppet::Util::Json.dump({
       "search_paths" => @env_loader.search_paths,
       "environments" => Hash[@env_loader.list.collect do |env|
         [env.name, {
@@ -31,5 +31,4 @@ class Puppet::Network::HTTP::API::Master::V3::Environments
       ttl
     end
   end
-
 end

data/lib/puppet/network/http/api.rb

@@ -20,8 +20,7 @@ class Puppet::Network::HTTP::API
                                                                       "or point them to a server running Puppet 3.\n\n" +
                                                                       "Master Info:\n" +
                                                                       "  Puppet version: #{Puppet.version}\n" +
-                                                                      "  Supported /puppet API versions: #{Puppet::Network::HTTP::MASTER_URL_VERSIONS}\n" +
-                                                                      "  Supported /puppet-ca API versions: #{Puppet::Network::HTTP::CA_URL_VERSIONS}",
+                                                                      "  Supported /puppet API versions: #{Puppet::Network::HTTP::MASTER_URL_VERSIONS}\n",
                                                                   Puppet::Network::HTTP::Issues::HANDLER_NOT_FOUND)
       end)
   end
@@ -33,12 +32,4 @@ class Puppet::Network::HTTP::API
       chain(Puppet::Network::HTTP::API::Master::V3.routes,
             Puppet::Network::HTTP::API.not_found)
   end
-
-  def self.ca_routes
-    ca_prefix = Regexp.new("^#{Puppet::Network::HTTP::CA_URL_PREFIX}/")
-    Puppet::Network::HTTP::Route.path(ca_prefix).
-      any.
-      chain(Puppet::Network::HTTP::API::CA::V1.routes,
-            Puppet::Network::HTTP::API.not_found)
-  end
 end

data/lib/puppet/network/http/base_pool.rb

@@ -0,0 +1,36 @@
+# Base pool for HTTP connections.
+#
+# @api private
+class Puppet::Network::HTTP::BasePool
+  def start(site, verifier, http)
+    Puppet.debug("Starting connection for #{site}")
+    if site.use_ssl?
+      verifier.setup_connection(http)
+      begin
+        http.start
+        print_ssl_info(http) if Puppet::Util::Log.sendlevel?(:debug)
+      rescue OpenSSL::SSL::SSLError => error
+        verifier.handle_connection_error(http, error)
+      end
+    else
+      http.start
+    end
+  end
+
+  private
+
+  def print_ssl_info(http)
+    buffered_io = http.instance_variable_get(:@socket)
+    return unless buffered_io
+
+    socket = buffered_io.io
+    return unless socket
+
+    cipher = if Puppet::Util::Platform.jruby?
+               socket.cipher
+             else
+               socket.cipher.first
+             end
+    Puppet.debug("Using #{socket.ssl_version} with cipher #{cipher}")
+  end
+end

data/lib/puppet/network/http/compression.rb

@@ -20,9 +20,11 @@ module Puppet::Network::HTTP::Compression
     def uncompress_body(response)
       case response['content-encoding']
       when 'gzip'
+        Puppet.deprecation_warning(_('Puppet::Network::HTTP::Compression::Active#uncompress_body is deprecated.'))
         # ZLib::GzipReader has an associated encoding, by default Encoding.default_external
         return Zlib::GzipReader.new(StringIO.new(response.body), :encoding => Encoding::BINARY).read
       when 'deflate'
+        Puppet.deprecation_warning(_('Puppet::Network::HTTP::Compression::Active#uncompress_body is deprecated.'))
         return Zlib::Inflate.new.inflate(response.body)
       when nil, 'identity'
         return response.body
@@ -32,7 +34,8 @@ module Puppet::Network::HTTP::Compression
     end
 
     def uncompress(response)
-      raise Net::HTTPError.new("No block passed") unless block_given?
+      Puppet.deprecation_warning(_('Puppet::Network::HTTP::Compression::Active#uncompress is deprecated.'))
+      raise Net::HTTPError.new("No block passed", response) unless block_given?
 
       case response['content-encoding']
       when 'gzip','deflate'
@@ -71,6 +74,7 @@ module Puppet::Network::HTTP::Compression
       end
 
       def uncompress(chunk)
+        Puppet.deprecation_warning(_('Puppet::Network::HTTP::Compression::ZlibAdapter#uncompress is deprecated.'))
         out = @uncompressor.inflate(chunk)
         @first = false
         return out
@@ -97,6 +101,7 @@ module Puppet::Network::HTTP::Compression
 
   module None
     def uncompress_body(response)
+      Puppet.deprecation_warning(_('Puppet::Network::HTTP::Compression::None#uncompress_body is deprecated.'))
       response.body
     end
 
@@ -105,12 +110,14 @@ module Puppet::Network::HTTP::Compression
     end
 
     def uncompress(response)
+      Puppet.deprecation_warning(_('Puppet::Network::HTTP::Compression::None#uncompress is deprecated.'))
       yield IdentityAdapter.new
     end
   end
 
   class IdentityAdapter
     def uncompress(chunk)
+      Puppet.deprecation_warning(_('Puppet::Network::HTTP::Compression::IdentityAdapter#uncompress is deprecated.'))
       chunk
     end