puppet 5.5.22 → 6.0.0

data/lib/puppet/resource/type.rb

@@ -11,7 +11,6 @@ class Puppet::Resource::Type
   include Puppet::Util::Warnings
   include Puppet::Util::Errors
 
-  # @deprecated application orchestration will be removed in puppet 7 (capability_mapping, application, site)
   RESOURCE_KINDS = [:hostclass, :node, :definition, :capability_mapping, :application, :site]
 
   # Map the names used in our documentation to the names used internally
@@ -34,7 +33,7 @@ class Puppet::Resource::Type
   DOUBLE_COLON = '::'.freeze
   EMPTY_ARRAY = [].freeze
 
-  attr_accessor :file, :line, :doc, :code, :parent, :resource_type_collection, :override
+  attr_accessor :file, :line, :doc, :code, :parent, :resource_type_collection
   attr_reader :namespace, :arguments, :behaves_like, :module_name
 
   # The attributes 'produces' and 'consumes' are arrays of the blueprints
@@ -63,7 +62,6 @@ class Puppet::Resource::Type
   # Are we a child of the passed class?  Do a recursive search up our
   # parentage tree to figure it out.
   def child_of?(klass)
-    return true if override
     return false unless parent
 
     return(klass == parent_type ? true : parent_type.child_of?(klass))
@@ -71,8 +69,6 @@ class Puppet::Resource::Type
 
   # Evaluate the resources produced by the given resource. These resources are
   # evaluated in a separate but identical scope from the rest of the resource.
-  #
-  # @deprecated application orchestration will be removed in puppet 7
   def evaluate_produces(resource, scope)
     # Only defined types and classes can produce capabilities
     return unless definition? || hostclass?
@@ -163,23 +159,19 @@ class Puppet::Resource::Type
     @module_name = options[:module_name]
   end
 
-  # @deprecated application orchestration will be removed in puppet 7
   def produces
     @produces || EMPTY_ARRAY
   end
 
-  # @deprecated application orchestration will be removed in puppet 7
   def consumes
     @consumes || EMPTY_ARRAY
   end
 
-  # @deprecated application orchestration will be removed in puppet 7
   def add_produces(blueprint)
     @produces ||= []
     @produces << blueprint
   end
 
-  # @deprecated application orchestration will be removed in puppet 7
   def add_consumes(blueprint)
     @consumes ||= []
     @consumes << blueprint
@@ -241,7 +233,6 @@ class Puppet::Resource::Type
     when :node
       :node
     when :site
-      # @deprecated application orchestration will be removed in puppet 7
       :site
     end
 

data/lib/puppet/rest/client.rb

@@ -0,0 +1,83 @@
+require 'httpclient'
+
+require 'puppet'
+require 'puppet/rest/response'
+require 'puppet/rest/errors'
+require 'puppet/util/ssl'
+
+module Puppet::Rest
+  class Client
+    attr_reader :dns_resolver
+
+    # Create a new HTTP client for querying the given API.
+    # @param [Puppet::Rest::SSLContext] ssl_context the SSL configuration for this client
+    # @param [Integer] receive_timeout how long in seconds this client will wait
+    #                  for a response after making a request
+    # @param [HTTPClient] client the third-party HTTP client wrapped by this
+    #                     class. This param is only used for testing.
+    def initialize(ssl_context:,
+                   receive_timeout: Puppet[:http_read_timeout],
+                   client: HTTPClient.new(agent_name: nil,
+                                          default_header: {
+                                            'User-Agent' => Puppet[:http_user_agent],
+                                            'X-PUPPET-VERSION' => Puppet::PUPPETVERSION
+                                          }))
+      @client = client
+      @client.tcp_keepalive = true
+      @client.connect_timeout = Puppet[:http_connect_timeout]
+      @client.receive_timeout = receive_timeout
+      @client.transparent_gzip_decompression = true
+
+      if Puppet[:http_debug]
+        @client.debug_dev = $stderr
+      end
+
+      @ca_path = Puppet[:ssl_client_ca_auth] || Puppet[:localcacert]
+      @verifier = Puppet::SSL::Validator::DefaultValidator.new(@ca_path)
+      configure_verify_mode(ssl_context)
+
+      @dns_resolver = Puppet::Network::Resolver.new
+    end
+
+    # Make a GET request to the specified URL with the specified params.
+    # @param [URI::HTTPS] url the full path to query
+    # @param [Hash] query any URL params to add to send to the endpoint
+    # @param [Hash] header any additional entries to add to the default header
+    # @yields [String] chunks of the response body
+    # @raise [Puppet::Rest::ResponseError] if the response status is not OK
+    def get(url, query: nil, header: nil, &block)
+      begin
+        @client.get_content(url.to_s, { query: query, header: header }) do |chunk|
+          block.call(chunk)
+        end
+      rescue HTTPClient::BadResponseError => e
+        raise Puppet::Rest::ResponseError.new(e.message, Puppet::Rest::Response.new(e.res))
+      rescue OpenSSL::OpenSSLError => e
+        Puppet::Util::SSL.handle_connection_error(e, @verifier, url.host)
+      end
+    end
+
+    # Make a PUT request to the specified URL with the specified params.
+    # @param [URI::HTTPS] url the full path to query
+    # @param [String/Hash] body the contents of the PUT request
+    # @param [Hash] query any URL params to add to send to the endpoint
+    # @param [Hash] header any additional entries to add to the default header
+    # @return [Puppet::Rest::Response]
+    def put(url, body:, query: nil, header: nil)
+      begin
+        response = @client.put(url.to_s, body: body, query: query, header: header)
+        Puppet::Rest::Response.new(response)
+      rescue OpenSSL::OpenSSLError => e
+        Puppet::Util::SSL.handle_connection_error(e, @verifier, url.host)
+      end
+    end
+
+    private
+
+    def configure_verify_mode(ssl_context)
+      @client.ssl_config.verify_callback = @verifier
+      @client.ssl_config.cert_store = ssl_context.cert_store
+      @client.ssl_config.verify_mode = ssl_context.verify_mode
+    end
+  end
+end

data/lib/puppet/rest/errors.rb

@@ -0,0 +1,14 @@
+module Puppet::Rest
+  class ResponseError < Puppet::Error
+    attr_reader :response
+
+    # Error thrown when request status is not OK.
+    # @param [String] msg the error message
+    # @param [Puppet::Rest::Response] response the response from the failed
+    #                                 request
+    def initialize(msg, response = nil)
+      super(msg)
+      @response = response
+    end
+  end
+end

data/lib/puppet/rest/response.rb

@@ -0,0 +1,34 @@
+module Puppet::Rest
+  # This is a wrapper for the HTTP::Message class of the HTTPClient
+  # gem. It is designed to wrap a message sent as an HTTP response.
+  class Response
+    def initialize(message)
+      @message = message
+    end
+
+    def body
+      @message.body
+    end
+
+    def content_type
+      @message.content_type
+    end
+
+    def content_encoding
+      @message.headers['Content-Encoding']
+    end
+
+    def status_code
+      @message.status
+    end
+
+    def ok?
+      @message.ok?
+    end
+
+    def to_exception
+      message = _("Error %{code} on SERVER: %{returned_message}") % { code: status_code, returned_message: body }
+      Puppet::Rest::ResponseError.new(message, self)
+    end
+  end
+end

data/lib/puppet/rest/route.rb

@@ -0,0 +1,84 @@
+require 'uri'
+require 'puppet/util/connection'
+
+module Puppet::Rest
+  class Route
+    attr_reader :server
+
+    # Create a Route containing information for querying the given API,
+    # hosted at a server determined either by SRV service or by the
+    # fallback server on the fallback port.
+    # @param [String] api the path leading to the root of the API. Must
+    #                 contain a trailing slash for proper endpoint path
+    #                 construction
+    # @param [Symbol] server_setting the setting to check for special
+    #                 server configuration
+    # @param [Symbol] port_setting the setting to check for speical
+    #                  port configuration
+    # @param [Symbol] srv_service the name of the service when using SRV
+    #                 records
+    def initialize(api:, server_setting: :server, port_setting: :masterport, srv_service: :puppet)
+      @api = api
+      @default_server = Puppet::Util::Connection.determine_server(server_setting)
+      @default_port = Puppet::Util::Connection.determine_port(port_setting, server_setting)
+      @srv_service = srv_service
+    end
+
+    # Select a server and port to create a base URL for the API specified by this
+    # route. If the connection fails and SRV records are in use, the next suitable
+    # server will be tried. If SRV records are not in use or no successful connection
+    # could be made, fall back to the configured server and port for this API, taking
+    # into account failover settings.
+    # @parma [Puppet::Network::Resolver] dns_resolver the DNS resolver to use to check
+    #                                    SRV records
+    # @yield [URI] supply a base URL to make a request with
+    # @raise [Puppet::Error] if connection to selected server and port fails, and SRV
+    #                        records are not in use
+    def with_base_url(dns_resolver)
+      if @server && @port
+        # First try connecting to the previously selected server and port.
+        begin
+          return yield(base_url)
+        rescue SystemCallError => e
+          if Puppet[:use_srv_records]
+            Puppet.debug "Connection to cached server and port #{@server}:#{@port} failed, reselecting."
+          else
+            raise Puppet::Error, _("Connection to cached server and port %{server}:%{port} failed: %{message}") %
+              { server: @server, port: @port, message: e.message }
+          end
+        end
+      end
+
+      if Puppet[:use_srv_records]
+        dns_resolver.each_srv_record(@srv_service) do |srv_server, srv_port|
+          # Try each of the servers for this service in weighted order
+          # until a working one is found.
+          begin
+            @server = srv_server
+            @port = srv_port
+            return yield(base_url)
+          rescue SystemCallError
+            Puppet.debug "Connection to selected server and port #{@server}:#{@port} failed. Trying next cached SRV record."
+            @server = nil
+            @port = nil
+          end
+        end
+      end
+
+      # If not using SRV records, fall back to the defaults calculated above
+      @server = @default_server
+      @port = @default_port
+
+      Puppet.debug "No more servers in SRV record, falling back to #{@server}:#{@port}" if Puppet[:use_srv_records]
+      return yield(base_url)
+    end
+
+    private
+
+    # Returns a URI built from the information stored by this route,
+    # e.g. 'https://myserver.com:555/myapi/v1/'
+    def base_url
+      URI::HTTPS.build(host: @server, port: @port, path: @api)
+    end
+  end
+end

data/lib/puppet/rest/routes.rb

@@ -0,0 +1,154 @@
+require 'puppet/rest/route'
+require 'puppet/network/http_pool'
+require 'puppet/network/http/compression'
+
+module Puppet::Rest
+  module Routes
+
+    extend Puppet::Network::HTTP::Compression.module
+
+    ACCEPT_ENCODING = 'gzip;q=1.0,deflate;q=0.6,identity;q=0.3'
+
+    def self.ca
+      @ca ||= Route.new(api: '/puppet-ca/v1/',
+                        server_setting: :ca_server,
+                        port_setting: :ca_port,
+                        srv_service: :ca)
+    end
+
+    # Make an HTTP request to fetch the named certificate
+    # @param [String] name the name of the certificate to fetch
+    # @param [Puppet::Rest::SSLContext] ssl_context the ssl content to use when making the request
+    # @raise [Puppet::Rest::ResponseError] if the response status is not OK
+    # @return [String] the PEM-encoded certificate or certificate bundle
+    def self.get_certificate(name, ssl_context)
+      ca.with_base_url(Puppet::Network::Resolver.new) do |url|
+        header = { 'Accept' => 'text/plain', 'Accept-Encoding' => ACCEPT_ENCODING }
+        url.path += "certificate/#{name}"
+
+        use_ssl = url.is_a? URI::HTTPS
+
+        # Deeper levels of the code assume that if we have any number of
+        # certificate related files, we have all of the certificate related
+        # files. This assumption caused us to download the certificate twice.
+        # We have to hard code `verify_mode=false` so we don't attempt to
+        # download the certificate so that we can download the certificate.
+        #
+        # This is related to PUP-9094. We won't have so many issues with this
+        # once we are using the httpclient gem to handle this work. We were
+        # unable to get this work completed in time for Puppet 6.0.0, so we had
+        # to switch back to using Puppet::Network::HttpPool, which has
+        # unfortunate limitations (i.e., an all or nothing approach to cert
+        # verification).
+        verify_mode = false
+
+        client = Puppet::Network::HttpPool.http_instance(url.host, url.port, use_ssl, verify_mode)
+
+        response = client.get(url.request_uri, header)
+        unless response.code.to_i == 200
+          raise Puppet::Rest::ResponseError.new(response.message, response)
+        end
+
+        Puppet.info _("Downloaded certificate for %{name} from %{server}") % { name: name, server: ca.server }
+
+        uncompress_body(response)
+      end
+    end
+
+    # Make an HTTP request to fetch the named crl
+    # @param [String] name the crl to fetch
+    # @param [Puppet::Rest::SSLContext] ssl_context the ssl content to use when making the request
+    # @raise [Puppet::Rest::ResponseError] if the response status is not OK
+    # @return [String] the PEM-encoded crl
+    def self.get_crls(name, ssl_context)
+      ca.with_base_url(Puppet::Network::Resolver.new) do |url|
+        header = { 'Accept' => 'text/plain', 'Accept-Encoding' => ACCEPT_ENCODING }
+        url.path += "certificate_revocation_list/#{name}"
+
+        use_ssl = url.is_a? URI::HTTPS
+
+        # Deeper levels of the code assume that if we have any number of
+        # certificate related files, we have all of the certificate related
+        # files. Unfortunately, this causes us to get stuck in an infinite loop,
+        # so we have to hard code `verify_mode=false` so we don't attempt to use
+        # files that do not exist yet in order to download those files.
+        #
+        # This is related to PUP-9094. We won't have so many issues with this
+        # once we are using the httpclient gem to handle this work. We were
+        # unable to get this work completed in time for Puppet 6.0.0, so we had
+        # to switch back to using Puppet::Network::HttpPool, which has
+        # unfortunate limitations (i.e., an all or nothing approach to cert
+        # verification).
+        verify_mode = false
+
+        client = Puppet::Network::HttpPool.http_instance(url.host, url.port, use_ssl, verify_mode)
+
+        response = client.get(url.request_uri, header)
+        unless response.code.to_i == 200
+          raise Puppet::Rest::ResponseError.new(response.message, response)
+        end
+
+        Puppet.debug _("Downloaded certificate revocation list for %{name} from %{server}") % { name: name, server: ca.server }
+
+        uncompress_body(response)
+      end
+    end
+
+    # Make an HTTP request to send the named CSR
+    # @param [String] csr_pem the contents of the CSR to sent to the CA
+    # @param [String] name the name of the host whose CSR is being submitted
+    # @param [Puppet::Rest::SSLContext] ssl_context the ssl content to use when making the request
+    # @rasies [Puppet::Rest::ResponseError] if the response status is not OK
+    def self.put_certificate_request(csr_pem, name, ssl_context)
+      ca.with_base_url(Puppet::Network::Resolver.new) do |url|
+        header = { 'Accept' => 'text/plain',
+                   'Accept-Encoding' => ACCEPT_ENCODING,
+                   'Content-Type' => 'text/plain' }
+        url.path += "certificate_request/#{name}"
+
+        use_ssl = url.is_a? URI::HTTPS
+
+        # See notes above as to why verify_mode is hardcoded to false
+        verify_mode = false
+
+        client = Puppet::Network::HttpPool.http_instance(url.host, url.port, use_ssl, verify_mode)
+
+        response = client.put(url.request_uri, csr_pem, header)
+        if response.code.to_i == 200
+          Puppet.debug "Submitted certificate request to server."
+        else
+          raise Puppet::Rest::ResponseError.new(response.message, response)
+        end
+      end
+    end
+
+    # Make an HTTP request to get the named CSR
+    # @param [String] name the name of the host whose CSR is being queried
+    # @param [Puppet::Rest::SSLContext] ssl_context the ssl content to use when making the request
+    # @rasies [Puppet::Rest::ResponseError] if the response status is not OK
+    # @return [String] the PEM encoded certificate request
+    def self.get_certificate_request(name, ssl_context)
+      ca.with_base_url(Puppet::Network::Resolver.new) do |url|
+        header = { 'Accept' => 'text/plain', 'Accept-Encoding' => ACCEPT_ENCODING }
+        url.path += "certificate_request/#{name}"
+
+        use_ssl = url.is_a? URI::HTTPS
+
+        # See notes above as to why verify_mode is hardcoded to false
+        verify_mode = false
+
+        client = Puppet::Network::HttpPool.http_instance(url.host, url.port, use_ssl, verify_mode)
+
+
+        response = client.get(url.request_uri, header)
+        unless response.code.to_i == 200
+          raise Puppet::Rest::ResponseError.new(response.message, response)
+        end
+
+        Puppet.debug _("Downloaded existing certificate request for %{name} from %{server}") % { name: name, server: ca.server }
+
+        uncompress_body(response)
+      end
+    end
+  end
+end

data/lib/puppet/rest/ssl_context.rb

@@ -0,0 +1,13 @@
+module Puppet::Rest
+  class SSLContext
+
+    attr_reader :verify_mode, :cert_store
+
+    # @param [OpenSSL::SSL::VERIFY_NONE, OpenSSL::SSL::VERIFY_PEER] verify_mode
+    # @param [OpenSSL::X509::SSLStore] cert_store
+    def initialize(verify_mode, cert_store = OpenSSL::X509::Store.new)
+      @verify_mode = verify_mode
+      @cert_store = cert_store
+    end
+  end
+end