puppet 6.0.10 → 6.1.0

data/lib/puppet/rest/client.rb

@@ -0,0 +1,83 @@
+require 'httpclient'
+
+require 'puppet'
+require 'puppet/rest/response'
+require 'puppet/rest/errors'
+require 'puppet/util/ssl'
+
+module Puppet::Rest
+  class Client
+    attr_reader :dns_resolver
+
+    # Create a new HTTP client for querying the given API.
+    # @param [Puppet::Rest::SSLContext] ssl_context the SSL configuration for this client
+    # @param [Integer] receive_timeout how long in seconds this client will wait
+    #                  for a response after making a request
+    # @param [HTTPClient] client the third-party HTTP client wrapped by this
+    #                     class. This param is only used for testing.
+    def initialize(ssl_context:,
+                   receive_timeout: Puppet[:http_read_timeout],
+                   client: HTTPClient.new(agent_name: nil,
+                                          default_header: {
+                                            'User-Agent' => Puppet[:http_user_agent],
+                                            'X-PUPPET-VERSION' => Puppet::PUPPETVERSION
+                                          }))
+      @client = client
+      @client.tcp_keepalive = true
+      @client.connect_timeout = Puppet[:http_connect_timeout]
+      @client.receive_timeout = receive_timeout
+      @client.transparent_gzip_decompression = true
+
+      if Puppet[:http_debug]
+        @client.debug_dev = $stderr
+      end
+
+      @ca_path = Puppet[:ssl_client_ca_auth] || Puppet[:localcacert]
+      @verifier = Puppet::SSL::Validator::DefaultValidator.new(@ca_path)
+      configure_verify_mode(ssl_context)
+
+      @dns_resolver = Puppet::Network::Resolver.new
+    end
+
+    # Make a GET request to the specified URL with the specified params.
+    # @param [URI::HTTPS] url the full path to query
+    # @param [Hash] query any URL params to add to send to the endpoint
+    # @param [Hash] header any additional entries to add to the default header
+    # @yields [String] chunks of the response body
+    # @raise [Puppet::Rest::ResponseError] if the response status is not OK
+    def get(url, query: nil, header: nil, &block)
+      begin
+        @client.get_content(url.to_s, { query: query, header: header }) do |chunk|
+          block.call(chunk)
+        end
+      rescue HTTPClient::BadResponseError => e
+        raise Puppet::Rest::ResponseError.new(e.message, Puppet::Rest::Response.new(e.res))
+      rescue OpenSSL::OpenSSLError => e
+        Puppet::Util::SSL.handle_connection_error(e, @verifier, url.host)
+      end
+    end
+
+    # Make a PUT request to the specified URL with the specified params.
+    # @param [URI::HTTPS] url the full path to query
+    # @param [String/Hash] body the contents of the PUT request
+    # @param [Hash] query any URL params to add to send to the endpoint
+    # @param [Hash] header any additional entries to add to the default header
+    # @return [Puppet::Rest::Response]
+    def put(url, body:, query: nil, header: nil)
+      begin
+        response = @client.put(url.to_s, body: body, query: query, header: header)
+        Puppet::Rest::Response.new(response)
+      rescue OpenSSL::OpenSSLError => e
+        Puppet::Util::SSL.handle_connection_error(e, @verifier, url.host)
+      end
+    end
+
+    private
+
+    def configure_verify_mode(ssl_context)
+      @client.ssl_config.verify_callback = @verifier
+      @client.ssl_config.cert_store = ssl_context.cert_store
+      @client.ssl_config.verify_mode = ssl_context.verify_mode
+    end
+  end
+end

data/lib/puppet/rest/route.rb

@@ -50,7 +50,7 @@ module Puppet::Rest
       end
 
       if Puppet[:use_srv_records]
-        dns_resolver.each_srv_record(Puppet[:srv_domain], @srv_service) do |srv_server, srv_port|
+        dns_resolver.each_srv_record(@srv_service) do |srv_server, srv_port|
           # Try each of the servers for this service in weighted order
           # until a working one is found.
           begin

data/lib/puppet/settings.rb

@@ -255,7 +255,7 @@ class Puppet::Settings
     @global_defaults_initialized
   end
 
-  def initialize_global_settings(args = [], require_config = true)
+  def initialize_global_settings(args = [])
     raise Puppet::DevError, _("Attempting to initialize global default settings more than once!") if global_defaults_initialized?
 
     # The first two phases of the lifecycle of a puppet application are:
@@ -264,7 +264,7 @@ class Puppet::Settings
     # 2) Parse the puppet config file(s).
 
     parse_global_options(args)
-    parse_config_files(require_config)
+    parse_config_files
 
     @global_defaults_initialized = true
   end
@@ -590,19 +590,14 @@ class Puppet::Settings
   end
 
   # Parse the configuration file.  Just provides thread safety.
-  def parse_config_files(require_config = true)
+  def parse_config_files
     file = which_configuration_file
     if Puppet::FileSystem.exist?(file)
       begin
         text = read_file(file)
       rescue => detail
-        message = _("Could not load %{file}: %{detail}") % { file: file, detail: detail}
-        if require_config
-          Puppet.log_and_raise(detail, message)
-        else
-          Puppet.log_exception(detail, message)
-          return
-        end
+        Puppet.log_exception(detail, "Could not load #{file}: #{detail}")
+        return
       end
     else
       return

data/lib/puppet/settings/server_list_setting.rb

@@ -4,15 +4,6 @@ class Puppet::Settings::ServerListSetting < Puppet::Settings::ArraySetting
     :server_list
   end
 
-  def print(value)
-    if value.is_a?(Array)
-      #turn into a string
-      value.map {|item| item.join(":") }.join(",")
-    else
-      value
-    end
-  end
-  
   def munge(value)
     servers = super 
     servers.map! { |server| 

data/lib/puppet/ssl/host.rb

@@ -6,6 +6,13 @@ require 'puppet/ssl/certificate_request_attributes'
 require 'puppet/rest/errors'
 require 'puppet/rest/routes'
 require 'puppet/rest/ssl_context'
+begin
+  # This may fail when being loaded from Puppet Server. However loading the
+  # client monkey patches the SSL Store and we need to have those monkey
+  # patches in as soon as possible on the agent.
+  require 'puppet/rest/client'
+rescue LoadError
+end
 
 # The class that manages all aspects of our SSL certificates --
 # private keys, public keys, requests, etc.
@@ -116,6 +123,10 @@ class Puppet::SSL::Host
     true
   end
 
+  def http_client(ssl_context)
+    Puppet::Rest::Client.new(ssl_context: ssl_context)
+  end
+
   def certificate
     unless @certificate
       generate_key unless key

data/lib/puppet/ssl/validator/default_validator.rb

@@ -9,7 +9,6 @@ require 'puppet/ssl'
 class Puppet::SSL::Validator::DefaultValidator #< class Puppet::SSL::Validator
   attr_reader :peer_certs
   attr_reader :verify_errors
-  attr_reader :last_error
 
   FIVE_MINUTES_AS_SECONDS = 5 * 60
 
@@ -34,8 +33,6 @@ class Puppet::SSL::Validator::DefaultValidator #< class Puppet::SSL::Validator
   def reset!
     @peer_certs = []
     @verify_errors = []
-    @hostname = nil
-    @last_error = nil
   end
 
   # Performs verification of the SSL connection and collection of the
@@ -81,32 +78,6 @@ class Puppet::SSL::Validator::DefaultValidator #< class Puppet::SSL::Validator
       error_string = store_context.error_string || "OpenSSL error #{error}"
 
       case error
-      when OpenSSL::X509::V_OK
-        if @hostname
-          # chain is from leaf to root, opposite of the order that `call` is invoked
-          chain_cert = store_context.chain.first
-          peer_cert = @peer_certs.last
-
-          # ruby 2.4 doesn't compare certs based on value, so force to DER byte array
-          if peer_cert && chain_cert && peer_cert.to_der == chain_cert.to_der && !OpenSSL::SSL.verify_certificate_identity(peer_cert, @hostname)
-            valid_certnames = [peer_cert.subject.to_s.sub(/.*=/, ''),
-                               *Puppet::SSL::Certificate.subject_alt_names_for(peer_cert)].uniq
-            if valid_certnames.size > 1
-              expected_certnames = _("expected one of %{certnames}") % { certnames: valid_certnames.join(', ') }
-            else
-              expected_certnames = _("expected %{certname}") % { certname: valid_certnames.first }
-            end
-
-            msg = _("Server hostname '%{host}' did not match server certificate; %{expected_certnames}") % { host: @hostname, expected_certnames: expected_certnames }
-            @last_error = Puppet::Error.new(msg)
-            return false
-          else
-            @verify_errors << "#{error_string} for #{current_cert.subject}"
-          end
-        else
-          @verify_errors << "#{error_string} for #{current_cert.subject}"
-        end
-
       when OpenSSL::X509::V_ERR_CRL_NOT_YET_VALID
         # current_crl can be nil
         # https://github.com/ruby/ruby/blob/ruby_1_9_3/ext/openssl/ossl_x509store.c#L501-L510
@@ -141,8 +112,6 @@ class Puppet::SSL::Validator::DefaultValidator #< class Puppet::SSL::Validator
   # @api private
   #
   def setup_connection(connection, ssl_host = Puppet.lookup(:ssl_host))
-    @hostname = connection.address
-
     if ssl_certificates_are_present?
       connection.cert_store = ssl_host.ssl_store
       connection.ca_file = @ca_path

data/lib/puppet/syntax_checkers/epp.rb

@@ -0,0 +1,34 @@
+# A syntax checker for JSON.
+# @api public
+require 'puppet/syntax_checkers'
+class Puppet::SyntaxCheckers::EPP < Puppet::Plugins::SyntaxCheckers::SyntaxChecker
+
+  # Checks the text for Puppet Language EPP syntax issues and reports them to the given acceptor.
+  #
+  # Error messages from the checker are capped at 100 chars from the source text.
+  #
+  # @param text [String] The text to check
+  # @param syntax [String] The syntax identifier in mime style (only accepts 'pp')
+  # @param acceptor [#accept] A Diagnostic acceptor
+  # @param source_pos [Puppet::Pops::Adapters::SourcePosAdapter] A source pos adapter with location information
+  # @api public
+  #
+  def check(text, syntax, acceptor, source_pos)
+    raise ArgumentError.new(_("EPP syntax checker: the text to check must be a String.")) unless text.is_a?(String)
+    raise ArgumentError.new(_("EPP syntax checker: the syntax identifier must be a String, e.g. pp")) unless syntax == 'epp'
+    raise ArgumentError.new(_("EPP syntax checker: invalid Acceptor, got: '%{klass}'.") % { klass: acceptor.class.name }) unless acceptor.is_a?(Puppet::Pops::Validation::Acceptor)
+
+    begin
+      Puppet::Pops::Parser::EvaluatingParser::EvaluatingEppParser.singleton.parse_string(text)
+    rescue => e
+      # Cap the message to 100 chars and replace newlines
+      msg = _("EPP syntax checker: \"%{message}\"") % { message: e.message().slice(0,500).gsub(/\r?\n/, "\\n") }
+
+      # TODO: improve the pops API to allow simpler diagnostic creation while still maintaining capabilities
+      # and the issue code. (In this case especially, where there is only a single error message being issued).
+      #
+      issue = Puppet::Pops::Issues::issue(:ILLEGAL_EPP) { msg }
+      acceptor.accept(Puppet::Pops::Validation::Diagnostic.new(:error, issue, source_pos.file, source_pos, {}))
+    end
+  end
+end

data/lib/puppet/syntax_checkers/pp.rb

@@ -0,0 +1,34 @@
+# A syntax checker for JSON.
+# @api public
+require 'puppet/syntax_checkers'
+class Puppet::SyntaxCheckers::PP < Puppet::Plugins::SyntaxCheckers::SyntaxChecker
+
+  # Checks the text for Puppet Language syntax issues and reports them to the given acceptor.
+  #
+  # Error messages from the checker are capped at 100 chars from the source text.
+  #
+  # @param text [String] The text to check
+  # @param syntax [String] The syntax identifier in mime style (only accepts 'pp')
+  # @param acceptor [#accept] A Diagnostic acceptor
+  # @param source_pos [Puppet::Pops::Adapters::SourcePosAdapter] A source pos adapter with location information
+  # @api public
+  #
+  def check(text, syntax, acceptor, source_pos)
+    raise ArgumentError.new(_("PP syntax checker: the text to check must be a String.")) unless text.is_a?(String)
+    raise ArgumentError.new(_("PP syntax checker: the syntax identifier must be a String, e.g. pp")) unless syntax == 'pp'
+    raise ArgumentError.new(_("PP syntax checker: invalid Acceptor, got: '%{klass}'.") % { klass: acceptor.class.name }) unless acceptor.is_a?(Puppet::Pops::Validation::Acceptor)
+
+    begin
+      Puppet::Pops::Parser::EvaluatingParser.singleton.parse_string(text)
+    rescue => e
+      # Cap the message to 100 chars and replace newlines
+      msg = _("PP syntax checker: \"%{message}\"") % { message: e.message().slice(0,500).gsub(/\r?\n/, "\\n") }
+
+      # TODO: improve the pops API to allow simpler diagnostic creation while still maintaining capabilities
+      # and the issue code. (In this case especially, where there is only a single error message being issued).
+      #
+      issue = Puppet::Pops::Issues::issue(:ILLEGAL_PP) { msg }
+      acceptor.accept(Puppet::Pops::Validation::Diagnostic.new(:error, issue, source_pos.file, source_pos, {}))
+    end
+  end
+end

data/lib/puppet/transaction.rb

@@ -56,8 +56,6 @@ class Puppet::Transaction
     @prefetched_providers = Hash.new { |h,k| h[k] = {} }
 
     @prefetch_failed_providers = Hash.new { |h,k| h[k] = {} }
-
-    @failed_dependencies_already_notified = Set.new()
   end
 
   # Invoke the pre_run_check hook in every resource in the catalog.
@@ -293,9 +291,8 @@ class Puppet::Transaction
     if s && s.dependency_failed?
       # See above. --daniel 2011-06-06
       unless suppress_report then
-        s.failed_dependencies.find_all { |d| !(@failed_dependencies_already_notified.include?(d.ref)) }.each do |dep|
+        s.failed_dependencies.each do |dep|
           resource.notice _("Dependency %{dep} has failures: %{status}") % { dep: dep, status: resource_status(dep).failed }
-          @failed_dependencies_already_notified.add(dep.ref)
         end
       end
     end
@@ -358,17 +355,15 @@ class Puppet::Transaction
     Puppet.debug "Prefetching #{provider_class.name} resources for #{type_name}"
     begin
       provider_class.prefetch(resources)
-    rescue LoadError, Puppet::MissingCommand => detail
+    rescue Exception => detail
+      if !detail.is_a?(LoadError) && !detail.is_a?(Puppet::MissingCommand)
+        raise unless Puppet.settings[:future_features]
+        
+        @prefetch_failed_providers[type_name][provider_class.name] = true
+      end
       #TRANSLATORS `prefetch` is a function name and should not be translated
       message = _("Could not prefetch %{type_name} provider '%{name}': %{detail}") % { type_name: type_name, name: provider_class.name, detail: detail }
       Puppet.log_exception(detail, message)
-    rescue StandardError => detail
-      message = _("Could not prefetch %{type_name} provider '%{name}': %{detail}") % { type_name: type_name, name: provider_class.name, detail: detail }
-      Puppet.log_exception(detail, message)
-
-      raise unless Puppet.settings[:future_features]
-
-      @prefetch_failed_providers[type_name][provider_class.name] = true
     end
     @prefetched_providers[type_name][provider_class.name] = true
   end

data/lib/puppet/transaction/event_manager.rb

@@ -155,7 +155,11 @@ class Puppet::Transaction::EventManager
     return true
   rescue => detail
     resource_error_message = _("Failed to call %{callback}: %{detail}") % { callback: callback, detail: detail }
-    resource.err(resource_error_message)
+    resource.err resource_error_message
+    if not resource.is_a?(Puppet::Type.type(:whit))
+      add_callback_status_event(resource, callback, resource_error_message, "failure")
+    end
+
     transaction.resource_status(resource).failed_to_restart = true
     transaction.resource_status(resource).fail_with_event(resource_error_message)
     resource.log_exception(detail)

data/lib/puppet/transaction/resource_harness.rb

@@ -161,7 +161,6 @@ class Puppet::Transaction::ResourceHarness
         name = param.name.to_s
         event.message ||= _("could not create change error message for %{name}") % { name: name }
         event.calculate_corrective_change(@persistence.get_system_value(context.resource.ref, name))
-        event.message << ' (corrective)' if event.corrective_change
         context.record(event)
         event.send_log
         context.synced_params << param.name

data/lib/puppet/type.rb

@@ -391,6 +391,12 @@ class Type
     @key_attributes_cache ||= key_attribute_parameters.collect { |p| p.name }
   end
 
+  # Returns any parameters that should be included by default in puppet resource's output
+  # @return [Array<Symbol>] the parameters to include
+  def self.parameters_to_include
+    []
+  end
+
   # Returns a mapping from the title string to setting of attribute values.
   # This default implementation provides a mapping of title to the one and only _namevar_ present
   # in the type's definition.

data/lib/puppet/type/exec.rb

@@ -581,15 +581,7 @@ module Puppet
           val = @parameters[check].value
           val = [val] unless val.is_a? Array
           val.each do |value|
-            if !@parameters[check].check(value)
-              # Give a debug message so users can figure out what command would have been
-              # but don't print sensitive commands or parameters in the clear
-              cmdstring = @parameters[:command].sensitive ? "[command redacted]" : @parameters[:command].value
-
-              debug(_("'%{cmd}' won't be executed because of failed check '%{check}'") % { cmd: cmdstring, check: check })
-
-              return false 
-            end
+            return false unless @parameters[check].check(value)
           end
         end
       }
@@ -622,25 +614,11 @@ module Puppet
 
     private
     def set_sensitive_parameters(sensitive_parameters)
-      # If any are sensitive, mark all as sensitive
-      sensitive = false
-      parameters_to_check = [:command, :unless, :onlyif]
-
-      parameters_to_check.each do |p| 
-        if sensitive_parameters.include?(p)
-          sensitive_parameters.delete(p)
-          sensitive = true
-        end
+      # Respect sensitive commands
+      if sensitive_parameters.include?(:command)
+        sensitive_parameters.delete(:command)
+        parameter(:command).sensitive = true
       end
-
-      if sensitive
-        parameters_to_check.each do |p|
-          if parameters.include?(p)
-            parameter(p).sensitive = true
-          end
-        end
-      end
-
       super(sensitive_parameters)
     end
   end

data/lib/puppet/type/file/mode.rb

@@ -116,13 +116,8 @@ module Puppet
     # If we're not following links and we're a link, then we just turn
     # off mode management entirely.
     def insync?(currentvalue)
-      if provider.respond_to?(:munge_windows_system_group)
-        munged_mode = provider.munge_windows_system_group(currentvalue, @should)
-        return false if munged_mode.nil?
-        currentvalue = munged_mode
-      end
       if stat = @resource.stat and stat.ftype == "link" and @resource[:links] != :follow
-        self.debug _("Not managing symlink mode")
+        self.debug "Not managing symlink mode"
         return true
       else
         return super(currentvalue)