puppet 6.11.1-universal-darwin → 6.16.0-universal-darwin

data/lib/puppet/loaders.rb

@@ -1,3 +1,5 @@
+require 'puppet/concurrent/synchronized'
+
 module Puppet
   module Pops
     require 'puppet/pops/loaders'
@@ -22,6 +24,10 @@ module Puppet
       require 'puppet/pops/loader/predefined_loader'
       require 'puppet/pops/loader/generic_plan_instantiator'
       require 'puppet/pops/loader/puppet_plan_instantiator'
+
+      # The implementation of synchronized applies it to all subclasses so we
+      # want to add it to be base class after any subclasses are created
+      Loader.include Puppet::Concurrent::Synchronized
     end
   end
 

data/lib/puppet/metatype/manager.rb

@@ -70,68 +70,68 @@ module Manager
   # @dsl type
   # @api public
   def newtype(name, options = {}, &block)
-    # Handle backward compatibility
-    unless options.is_a?(Hash)
-      #TRANSLATORS 'Puppet::Type.newtype' should not be translated
-      Puppet.warning(_("Puppet::Type.newtype(%{name}) now expects a hash as the second argument, not %{argument}") %
-                         { name: name, argument: options.inspect})
-    end
-
-    # First make sure we don't have a method sitting around
-    name = name.intern
-    newmethod = "new#{name}"
+    @manager_lock.synchronize do
+      # Handle backward compatibility
+      unless options.is_a?(Hash)
+        #TRANSLATORS 'Puppet::Type.newtype' should not be translated
+        Puppet.warning(_("Puppet::Type.newtype(%{name}) now expects a hash as the second argument, not %{argument}") %
+                       { name: name, argument: options.inspect})
+      end
 
-    # Used for method manipulation.
-    selfobj = singleton_class
+      # First make sure we don't have a method sitting around
+      name = name.intern
+      newmethod = "new#{name}"
 
-    @types ||= {}
+      # Used for method manipulation.
+      selfobj = singleton_class
 
-    if @types.include?(name)
-      if self.respond_to?(newmethod)
-        # Remove the old newmethod
-        selfobj.send(:remove_method,newmethod)
+      if @types.include?(name)
+        if self.respond_to?(newmethod)
+          # Remove the old newmethod
+          selfobj.send(:remove_method,newmethod)
+        end
       end
-    end
-
-    # Then create the class.
 
-    klass = genclass(
-      name,
-      :parent => Puppet::Type,
-      :overwrite => true,
-      :hash => @types,
-      :attributes => options,
-      &block
-    )
-
-    # Now define a "new<type>" method for convenience.
-    if self.respond_to? newmethod
-      # Refuse to overwrite existing methods like 'newparam' or 'newtype'.
-      #TRANSLATORS 'new%{method}' will become a method name, do not translate this string
-      Puppet.warning(_("'new%{method}' method already exists; skipping") % { method: name.to_s })
-    else
-      selfobj.send(:define_method, newmethod) do |*args|
-        klass.new(*args)
+      # Then create the class.
+
+      klass = genclass(
+        name,
+        :parent => Puppet::Type,
+        :overwrite => true,
+        :hash => @types,
+        :attributes => options,
+        &block
+      )
+
+      # Now define a "new<type>" method for convenience.
+      if self.respond_to? newmethod
+        # Refuse to overwrite existing methods like 'newparam' or 'newtype'.
+        #TRANSLATORS 'new%{method}' will become a method name, do not translate this string
+        Puppet.warning(_("'new%{method}' method already exists; skipping") % { method: name.to_s })
+      else
+        selfobj.send(:define_method, newmethod) do |*args|
+          klass.new(*args)
+        end
       end
-    end
 
-    # If they've got all the necessary methods defined and they haven't
-    # already added the property, then do so now.
-    klass.ensurable if klass.ensurable? and ! klass.validproperty?(:ensure)
+      # If they've got all the necessary methods defined and they haven't
+      # already added the property, then do so now.
+      klass.ensurable if klass.ensurable? and ! klass.validproperty?(:ensure)
 
-    # Now set up autoload any providers that might exist for this type.
+      # Now set up autoload any providers that might exist for this type.
 
-    klass.providerloader = Puppet::Util::Autoload.new(klass, "puppet/provider/#{klass.name}")
+      klass.providerloader = Puppet::Util::Autoload.new(klass, "puppet/provider/#{klass.name}")
 
-    # We have to load everything so that we can figure out the default provider.
-    klass.providerloader.loadall(Puppet.lookup(:current_environment))
-    klass.providify unless klass.providers.empty?
+      # We have to load everything so that we can figure out the default provider.
+      klass.providerloader.loadall(Puppet.lookup(:current_environment))
+      klass.providify unless klass.providers.empty?
 
-    loc = block_given? ? block.source_location : nil
-    uri = loc.nil? ? nil : URI("#{Puppet::Util.path_to_uri(loc[0])}?line=#{loc[1]}")
-    Puppet::Pops::Loaders.register_runtime3_type(name, uri)
+      loc = block_given? ? block.source_location : nil
+      uri = loc.nil? ? nil : URI("#{Puppet::Util.path_to_uri(loc[0])}?line=#{loc[1]}")
+      Puppet::Pops::Loaders.register_runtime3_type(name, uri)
 
-    klass
+      klass
+    end
   end
 
   # Removes an existing type.
@@ -151,47 +151,47 @@ module Manager
   # @return [Puppet::Type, nil] the type or nil if the type was not defined and could not be loaded
   #
   def type(name)
-    # Avoid loading if name obviously is not a type name
-    if name.to_s.include?(':')
-      return nil
-    end
+    @manager_lock.synchronize do
+      # Avoid loading if name obviously is not a type name
+      if name.to_s.include?(':')
+        return nil
+      end
 
-    @types ||= {}
+      # We are overwhelmingly symbols here, which usually match, so it is worth
+      # having this special-case to return quickly.  Like, 25K symbols vs. 300
+      # strings in this method. --daniel 2012-07-17
+      return @types[name] if @types.include? name
 
-    # We are overwhelmingly symbols here, which usually match, so it is worth
-    # having this special-case to return quickly.  Like, 25K symbols vs. 300
-    # strings in this method. --daniel 2012-07-17
-    return @types[name] if @types.include? name
+      # Try mangling the name, if it is a string.
+      if name.is_a? String
+        name = name.downcase.intern
+        return @types[name] if @types.include? name
+      end
+      # Try loading the type.
+      if typeloader.load(name, Puppet.lookup(:current_environment))
+        #TRANSLATORS 'puppet/type/%{name}' should not be translated
+        Puppet.warning(_("Loaded puppet/type/%{name} but no class was created") % { name: name }) unless @types.include? name
+      elsif !Puppet[:always_retry_plugins]
+        # PUP-5482 - Only look for a type once if plugin retry is disabled
+        @types[name] = nil
+      end
 
-    # Try mangling the name, if it is a string.
-    if name.is_a? String
-      name = name.downcase.intern
-      return @types[name] if @types.include? name
-    end
-    # Try loading the type.
-    if typeloader.load(name, Puppet.lookup(:current_environment))
-      #TRANSLATORS 'puppet/type/%{name}' should not be translated
-      Puppet.warning(_("Loaded puppet/type/%{name} but no class was created") % { name: name }) unless @types.include? name
-    elsif !Puppet[:always_retry_plugins]
-      # PUP-5482 - Only look for a type once if plugin retry is disabled
-      @types[name] = nil
+      # ...and I guess that is that, eh.
+      return @types[name]
     end
-
-    # ...and I guess that is that, eh.
-    return @types[name]
   end
 
   # Creates a loader for Puppet types.
   # Defaults to an instance of {Puppet::Util::Autoload} if no other auto loader has been set.
   # @return [Puppet::Util::Autoload] the loader to use.
   # @api private
-def typeloader
-  unless defined?(@typeloader)
-    @typeloader = Puppet::Util::Autoload.new(self, "puppet/type")
-  end
+  def typeloader
+    unless defined?(@typeloader)
+      @typeloader = Puppet::Util::Autoload.new(self, "puppet/type")
+    end
 
-  @typeloader
-end
+    @typeloader
+  end
 end
 end
 

data/lib/puppet/network/http/base_pool.rb

@@ -4,10 +4,11 @@
 class Puppet::Network::HTTP::BasePool
   def start(site, verifier, http)
     Puppet.debug("Starting connection for #{site}")
-    if verifier
+    if site.use_ssl?
       verifier.setup_connection(http)
       begin
         http.start
+        print_ssl_info(http) if Puppet::Util::Log.sendlevel?(:debug)
       rescue OpenSSL::SSL::SSLError => error
         verifier.handle_connection_error(http, error)
       end
@@ -15,4 +16,21 @@ class Puppet::Network::HTTP::BasePool
       http.start
     end
   end
+
+  private
+
+  def print_ssl_info(http)
+    buffered_io = http.instance_variable_get(:@socket)
+    return unless buffered_io
+
+    socket = buffered_io.io
+    return unless socket
+
+    cipher = if Puppet::Util::Platform.jruby?
+               socket.cipher
+             else
+               socket.cipher.first
+             end
+    Puppet.debug("Using #{socket.ssl_version} with cipher #{cipher}")
+  end
 end

data/lib/puppet/network/http/compression.rb

@@ -20,9 +20,11 @@ module Puppet::Network::HTTP::Compression
     def uncompress_body(response)
       case response['content-encoding']
       when 'gzip'
+        Puppet.deprecation_warning(_('Puppet::Network::HTTP::Compression::Active#uncompress_body is deprecated.'))
         # ZLib::GzipReader has an associated encoding, by default Encoding.default_external
         return Zlib::GzipReader.new(StringIO.new(response.body), :encoding => Encoding::BINARY).read
       when 'deflate'
+        Puppet.deprecation_warning(_('Puppet::Network::HTTP::Compression::Active#uncompress_body is deprecated.'))
         return Zlib::Inflate.new.inflate(response.body)
       when nil, 'identity'
         return response.body
@@ -32,6 +34,7 @@ module Puppet::Network::HTTP::Compression
     end
 
     def uncompress(response)
+      Puppet.deprecation_warning(_('Puppet::Network::HTTP::Compression::Active#uncompress is deprecated.'))
       raise Net::HTTPError.new("No block passed", response) unless block_given?
 
       case response['content-encoding']
@@ -71,6 +74,7 @@ module Puppet::Network::HTTP::Compression
       end
 
       def uncompress(chunk)
+        Puppet.deprecation_warning(_('Puppet::Network::HTTP::Compression::ZlibAdapter#uncompress is deprecated.'))
         out = @uncompressor.inflate(chunk)
         @first = false
         return out
@@ -97,6 +101,7 @@ module Puppet::Network::HTTP::Compression
 
   module None
     def uncompress_body(response)
+      Puppet.deprecation_warning(_('Puppet::Network::HTTP::Compression::None#uncompress_body is deprecated.'))
       response.body
     end
 
@@ -105,12 +110,14 @@ module Puppet::Network::HTTP::Compression
     end
 
     def uncompress(response)
+      Puppet.deprecation_warning(_('Puppet::Network::HTTP::Compression::None#uncompress is deprecated.'))
       yield IdentityAdapter.new
     end
   end
 
   class IdentityAdapter
     def uncompress(chunk)
+      Puppet.deprecation_warning(_('Puppet::Network::HTTP::Compression::IdentityAdapter#uncompress is deprecated.'))
       chunk
     end
 

data/lib/puppet/network/http/connection.rb

@@ -213,6 +213,10 @@ module Puppet::Network::HTTP
               current_request[header] = value
             end
           when 429, 503
+            if connection.started?
+              Puppet.debug("Closing connection for #{current_site}")
+              connection.finish
+            end
             response = handle_retry_after(current_response)
           else
             response = current_response
@@ -339,6 +343,8 @@ module Puppet::Network::HTTP
     end
 
     def with_connection(site, &block)
+      Puppet.deprecation_warning(_('Puppet::Network::HTTP::Connection is deprecated. Please use Puppet::Network::HTTP::ConnectionAdapter instead.'))
+
       response = nil
       @pool.with_connection(site, @verifier) do |conn|
         response = yield conn

data/lib/puppet/network/http/connection_adapter.rb

@@ -0,0 +1,182 @@
+class Puppet::Network::HTTP::ConnectionAdapter < Puppet::Network::HTTP::Connection
+  def initialize(host, port, options = {})
+    super(host, port, options)
+
+    @client = Puppet.runtime[:http]
+  end
+
+  def get(path, headers = {}, options = {})
+    headers ||= {}
+    options[:ssl_context] ||= resolve_ssl_context
+    options[:redirect_limit] ||= @redirect_limit
+
+    with_error_handling do
+      resp = @client.get(to_url(path), headers: headers, options: options)
+      resp.nethttp
+    end
+  end
+
+  def post(path, data, headers = nil, options = {})
+    headers ||= {}
+    headers['Content-Type'] ||= "application/x-www-form-urlencoded"
+    data ||= ''
+    options[:ssl_context] ||= resolve_ssl_context
+    options[:redirect_limit] ||= @redirect_limit
+
+    with_error_handling do
+      resp = @client.post(to_url(path), data, headers: headers, options: options)
+      resp.nethttp
+    end
+  end
+
+  def head(path, headers = {}, options = {})
+    headers ||= {}
+    options[:ssl_context] ||= resolve_ssl_context
+    options[:redirect_limit] ||= @redirect_limit
+
+    with_error_handling do
+      resp = @client.head(to_url(path), headers: headers, options: options)
+      resp.nethttp
+    end
+  end
+
+  def delete(path, headers = {'Depth' => 'Infinity'}, options = {})
+    headers ||= {}
+    options[:ssl_context] ||= resolve_ssl_context
+    options[:redirect_limit] ||= @redirect_limit
+
+    with_error_handling do
+      resp = @client.delete(to_url(path), headers: headers, options: options)
+      resp.nethttp
+    end
+  end
+
+  def put(path, data, headers = nil, options = {})
+    headers ||= {}
+    headers['Content-Type'] ||= "application/x-www-form-urlencoded"
+    data ||= ''
+    options[:ssl_context] ||= resolve_ssl_context
+    options[:redirect_limit] ||= @redirect_limit
+
+    with_error_handling do
+      resp = @client.put(to_url(path), data, headers: headers, options: options)
+      resp.nethttp
+    end
+  end
+
+  def request_get(*args, &block)
+    path, headers = *args
+    headers ||= {}
+    options = {
+      ssl_context: resolve_ssl_context,
+      redirect_limit: @redirect_limit
+    }
+
+    resp = @client.get(to_url(path), headers: headers, options: options) do |response|
+      yield response.nethttp if block_given?
+    end
+    resp.nethttp
+  end
+
+  def request_head(*args, &block)
+    path, headers = *args
+    headers ||= {}
+    options = {
+      ssl_context: resolve_ssl_context,
+      redirect_limit: @redirect_limit
+    }
+
+    response = @client.head(to_url(path), headers: headers, options: options)
+    yield response.nethttp if block_given?
+    response.nethttp
+  end
+
+  def request_post(*args, &block)
+    path, data, headers = *args
+    headers ||= {}
+    headers['Content-Type'] ||= "application/x-www-form-urlencoded"
+    options = {
+      ssl_context: resolve_ssl_context,
+      redirect_limit: @redirect_limit
+    }
+
+    resp = @client.post(to_url(path), data, headers: headers, options: options) do |response|
+      yield response.nethttp if block_given?
+    end
+    resp.nethttp
+  end
+
+  private
+
+  # The old Connection class ignores the ssl_context on the Puppet stack,
+  # and always loads certs/keys based on what is currently in the filesystem.
+  # If the files are missing, it would attempt to bootstrap the certs/keys
+  # while in the process of making a network request, due to the call to
+  # Puppet.lookup(:ssl_host) in Puppet::SSL::Validator::DefaultValidator#setup_connection.
+  # This class doesn't preserve the boostrap behavior because that is handled
+  # outside of this class, and can only be triggered by running `puppet ssl` or
+  # `puppet agent`.
+  def resolve_ssl_context
+    # don't need an ssl context for http connections
+    return nil unless @site.use_ssl?
+
+    # if our verifier has an ssl_context, use that
+    ctx = @verifier.ssl_context
+    return ctx if ctx
+
+    # load available certs
+    cert = Puppet::X509::CertProvider.new
+    ssl = Puppet::SSL::SSLProvider.new
+    begin
+      password = cert.load_private_key_password
+      ssl.load_context(certname: Puppet[:certname], password: password)
+    rescue Puppet::SSL::SSLError => e
+      Puppet.log_exception(e)
+
+      # if we don't have cacerts, then create a root context that doesn't
+      # trust anything. The old code used to fallback to VERIFY_NONE,
+      # which we don't want to emulate.
+      ssl.create_root_context(cacerts: [])
+    end
+  end
+
+  def to_url(path)
+    if path =~ /^https?:\/\//
+      # The old Connection class accepts a URL as the request path, and sends
+      # it in "absolute-form" in the request line, e.g. GET https://puppet:8140/.
+      # See https://httpwg.org/specs/rfc7230.html#absolute-form. It just so happens
+      # to work because HTTP 1.1 servers are required to accept absolute-form even
+      # though clients are only supposed to send them to proxies, so the proxy knows
+      # what upstream server to CONNECT to. This method creates a URL using the
+      # scheme/host/port that the connection was created with, and appends the path
+      # portion of the absolute-form. The resulting request will use "origin-form"
+      # as it should have done all along.
+      url = URI(path)
+      URI("#{@site.addr}/#{normalize_path(url.path)}")
+    else
+      URI("#{@site.addr}/#{Puppet::Util.uri_encode(normalize_path(path))}")
+    end
+  end
+
+  def normalize_path(path)
+    if path[0] == '/'
+      path[1..-1]
+    else
+      path
+    end
+  end
+
+  def with_error_handling(&block)
+    yield
+  rescue Puppet::HTTP::TooManyRedirects => e
+    raise Puppet::Network::HTTP::RedirectionLimitExceededException.new(_("Too many HTTP redirections for %{host}:%{port}") % { host: @host, port: @port }, e)
+  rescue Puppet::HTTP::HTTPError => e
+    Puppet.log_exception(e, e.message)
+    case e.cause
+    when Net::OpenTimeout, Net::ReadTimeout, Net::HTTPError, EOFError
+      raise e.cause
+    else
+      raise e
+    end
+  end
+end