puppet 6.16.0-universal-darwin → 7.0.0-universal-darwin

data/lib/puppet/http/errors.rb

@@ -1,14 +1,26 @@
 module Puppet::HTTP
+  # A base class for puppet http errors
+  # @api public
   class HTTPError < Puppet::Error; end
 
+  # A connection error such as if the server refuses the connection.
+  # @api public
   class ConnectionError < HTTPError; end
 
+  # A failure to route to the server such as if the `server_list` is exhausted.
+  # @api public
   class RouteError < HTTPError; end
 
+  # An HTTP protocol error, such as the server's response missing a required header.
+  # @api public
   class ProtocolError < HTTPError; end
 
+  # An error serializing or deserializing an object via REST.
+  # @api public
   class SerializationError < HTTPError; end
 
+  # An error due to an unsuccessful HTTP response, such as HTTP 500.
+  # @api public
   class ResponseError < HTTPError
     attr_reader :response
 
@@ -18,12 +30,16 @@ module Puppet::HTTP
     end
   end
 
+  # An error if asked to follow too many redirects (such as HTTP 301).
+  # @api public
   class TooManyRedirects < HTTPError
     def initialize(addr)
       super(_("Too many HTTP redirections for %{addr}") % { addr: addr})
     end
   end
 
+  # An error if asked to retry (such as HTTP 503) too many times.
+  # @api public
   class TooManyRetryAfters < HTTPError
     def initialize(addr)
       super(_("Too many HTTP retries for %{addr}") % { addr: addr})

data/lib/puppet/http/external_client.rb

@@ -1,4 +1,3 @@
-#
 # Adapts an external http_client_class to the HTTP client API. The former
 # is typically registered by puppetserver and only implements a subset of
 # the Puppet::Network::HTTP::Connection methods. As a result, only the
@@ -7,10 +6,10 @@
 #
 # @api private
 class Puppet::HTTP::ExternalClient < Puppet::HTTP::Client
-  # Create an external http client
+
+  # Create an external http client.
   #
   # @param [Class] http_client_class The class to create to handle the request
-  # @api private
   def initialize(http_client_class)
     @http_client_class = http_client_class
   end
@@ -23,7 +22,7 @@ class Puppet::HTTP::ExternalClient < Puppet::HTTP::Client
     options[:use_ssl] = url.scheme == 'https'
 
     client = @http_client_class.new(url.host, url.port, options)
-    response = Puppet::HTTP::Response.new(client.get(url.request_uri, headers, options), url)
+    response = Puppet::HTTP::ResponseNetHTTP.new(url, client.get(url.request_uri, headers, options))
 
     if block_given?
       yield response
@@ -45,7 +44,7 @@ class Puppet::HTTP::ExternalClient < Puppet::HTTP::Client
     options[:use_ssl] = url.scheme == 'https'
 
     client = @http_client_class.new(url.host, url.port, options)
-    response = Puppet::HTTP::Response.new(client.post(url.request_uri, body, headers, options), url)
+    response = Puppet::HTTP::ResponseNetHTTP.new(url, client.post(url.request_uri, body, headers, options))
 
     if block_given?
       yield response
@@ -58,8 +57,7 @@ class Puppet::HTTP::ExternalClient < Puppet::HTTP::Client
     raise Puppet::HTTP::HTTPError.new(e.message, e)
   end
 
-  # Close the external http client.
-  #
+  # (see Puppet::HTTP::Client#close)
   # @api private
   def close
     # This is a noop as puppetserver doesn't provide a way to close its http client.

data/lib/puppet/{network/http → http}/factory.rb

@@ -1,15 +1,14 @@
 require 'puppet/ssl/openssl_loader'
 require 'net/http'
-require 'puppet/util/http_proxy'
+require 'puppet/http'
 
-# Factory for <tt>Net::HTTP</tt> objects.
+# Factory for `Net::HTTP` objects.
 #
-# Encapsulates the logic for creating a <tt>Net::HTTP</tt> object based on the
-# specified {Puppet::Network::HTTP::Site Site} and puppet settings.
+# Encapsulates the logic for creating a `Net::HTTP` object based on the
+# specified {Site} and puppet settings.
 #
 # @api private
-#
-class Puppet::Network::HTTP::Factory
+class Puppet::HTTP::Factory
   @@openssl_initialized = false
 
   KEEP_ALIVE_TIMEOUT = 2**31 - 1
@@ -25,16 +24,14 @@ class Puppet::Network::HTTP::Factory
   def create_connection(site)
     Puppet.debug("Creating new connection for #{site}")
 
-    http = Puppet::Util::HttpProxy.proxy(URI(site.addr))
+    http = Puppet::HTTP::Proxy.proxy(URI(site.addr))
     http.use_ssl = site.use_ssl?
     http.read_timeout = Puppet[:http_read_timeout]
     http.open_timeout = Puppet[:http_connect_timeout]
     http.keep_alive_timeout = KEEP_ALIVE_TIMEOUT if http.respond_to?(:keep_alive_timeout=)
 
-    if http.respond_to?(:max_retries)
-      # 0 means make one request and never retry
-      http.max_retries = 0
-    end
+    # 0 means make one request and never retry
+    http.max_retries = 0
 
     if Puppet[:sourceaddress]
       Puppet.debug("Using source IP #{Puppet[:sourceaddress]}")

data/lib/puppet/{network/http → http}/pool.rb

@@ -1,5 +1,5 @@
-# A pool for persistent <tt>Net::HTTP</tt> connections. Connections are
-# stored in the pool indexed by their {Puppet::Network::HTTP::Site Site}.
+# A pool for persistent `Net::HTTP` connections. Connections are
+# stored in the pool indexed by their {Site}.
 # Connections are borrowed from the pool, yielded to the caller, and
 # released back into the pool. If a connection is expired, it will be
 # closed either when a connection to that site is requested, or when
@@ -7,13 +7,12 @@
 # same site, and will be reused in MRU order.
 #
 # @api private
-#
-class Puppet::Network::HTTP::Pool < Puppet::Network::HTTP::BasePool
+class Puppet::HTTP::Pool
   attr_reader :factory, :keepalive_timeout
 
   def initialize(keepalive_timeout)
     @pool = {}
-    @factory = Puppet::Network::HTTP::Factory.new
+    @factory = Puppet::HTTP::Factory.new
     @keepalive_timeout = keepalive_timeout
   end
 
@@ -40,9 +39,9 @@ class Puppet::Network::HTTP::Pool < Puppet::Network::HTTP::BasePool
   end
 
   def close
-    @pool.each_pair do |site, sessions|
-      sessions.each do |session|
-        close_connection(site, session.connection)
+    @pool.each_pair do |site, entries|
+      entries.each do |entry|
+        close_connection(site, entry.connection)
       end
     end
     @pool.clear
@@ -53,6 +52,25 @@ class Puppet::Network::HTTP::Pool < Puppet::Network::HTTP::BasePool
     @pool
   end
 
+  # Start a persistent connection
+  #
+  # @api private
+  def start(site, verifier, http)
+    Puppet.debug("Starting connection for #{site}")
+    if site.use_ssl?
+      verifier.setup_connection(http)
+      begin
+        http.start
+        print_ssl_info(http) if Puppet::Util::Log.sendlevel?(:debug)
+      rescue OpenSSL::SSL::SSLError => error
+        verifier.handle_connection_error(http, error)
+      end
+    else
+      http.start
+    end
+  end
+
+
   # Safely close a persistent connection.
   # Don't try to close a connection that's already closed.
   #
@@ -72,17 +90,17 @@ class Puppet::Network::HTTP::Pool < Puppet::Network::HTTP::BasePool
   #
   # @api private
   def borrow(site, verifier)
-    @pool[site] = active_sessions(site)
-    index = @pool[site].index do |session|
-      (verifier.nil? && session.verifier.nil?) ||
-        (!verifier.nil? && verifier.reusable?(session.verifier))
+    @pool[site] = active_entries(site)
+    index = @pool[site].index do |entry|
+      (verifier.nil? && entry.verifier.nil?) ||
+        (!verifier.nil? && verifier.reusable?(entry.verifier))
     end
-    session = index ? @pool[site].delete_at(index) : nil
-    if session
+    entry = index ? @pool[site].delete_at(index) : nil
+    if entry
       @pool.delete(site) if @pool[site].empty?
 
       Puppet.debug("Using cached connection for #{site}")
-      session.connection
+      entry.connection
     else
       http = @factory.create_connection(site)
 
@@ -107,31 +125,48 @@ class Puppet::Network::HTTP::Pool < Puppet::Network::HTTP::BasePool
   # @api private
   def release(site, verifier, http)
     expiration = Time.now + @keepalive_timeout
-    session = Puppet::Network::HTTP::Session.new(http, verifier, expiration)
+    entry = Puppet::HTTP::PoolEntry.new(http, verifier, expiration)
     Puppet.debug("Caching connection for #{site}")
 
-    sessions = @pool[site]
-    if sessions
-      sessions.unshift(session)
+    entries = @pool[site]
+    if entries
+      entries.unshift(entry)
     else
-      @pool[site] = [session]
+      @pool[site] = [entry]
     end
   end
 
-  # Returns an Array of sessions whose connections are not expired.
+  # Returns an Array of entries whose connections are not expired.
   #
   # @api private
-  def active_sessions(site)
+  def active_entries(site)
     now = Time.now
 
-    sessions = @pool[site] || []
-    sessions.select do |session|
-      if session.expired?(now)
-        close_connection(site, session.connection)
+    entries = @pool[site] || []
+    entries.select do |entry|
+      if entry.expired?(now)
+        close_connection(site, entry.connection)
         false
       else
         true
       end
     end
   end
+
+  private
+
+  def print_ssl_info(http)
+    buffered_io = http.instance_variable_get(:@socket)
+    return unless buffered_io
+
+    socket = buffered_io.io
+    return unless socket
+
+    cipher = if Puppet::Util::Platform.jruby?
+               socket.cipher
+             else
+               socket.cipher.first
+             end
+    Puppet.debug("Using #{socket.ssl_version} with cipher #{cipher}")
+  end
 end

data/lib/puppet/{network/http/session.rb → http/pool_entry.rb}

@@ -1,9 +1,8 @@
-# An HTTP session that references a persistent HTTP connection and
+# An entry in the peristent HTTP pool that references the connection and
 # an expiration time for the connection.
 #
 # @api private
-#
-class Puppet::Network::HTTP::Session
+class Puppet::HTTP::PoolEntry
   attr_reader :connection, :verifier
 
   def initialize(connection, verifier, expiration_time)

data/lib/puppet/http/proxy.rb

@@ -0,0 +1,137 @@
+require 'uri'
+require 'puppet/ssl/openssl_loader'
+
+module Puppet::HTTP::Proxy
+  def self.proxy(uri)
+    if http_proxy_host && !no_proxy?(uri)
+      Net::HTTP.new(uri.host, uri.port, self.http_proxy_host, self.http_proxy_port, self.http_proxy_user, self.http_proxy_password)
+    else
+      http = Net::HTTP.new(uri.host, uri.port, nil, nil, nil, nil)
+      # Net::HTTP defaults the proxy port even though we said not to
+      # use one. Set it to nil so caller is not surprised
+      http.proxy_port = nil
+      http
+    end
+  end
+
+  def self.http_proxy_env
+    # Returns a URI object if proxy is set, or nil
+    proxy_env = ENV["http_proxy"] || ENV["HTTP_PROXY"]
+    begin
+      return URI.parse(proxy_env) if proxy_env
+    rescue URI::InvalidURIError
+      return nil
+    end
+    return nil
+  end
+
+  # The documentation around the format of the no_proxy variable seems
+  # inconsistent.  Some suggests the use of the * as a way of matching any
+  # hosts under a domain, e.g.:
+  #   *.example.com
+  # Other documentation suggests that just a leading '.' indicates a domain
+  # level exclusion, e.g.:
+  #   .example.com
+  # We'll accommodate both here.
+  def self.no_proxy?(dest)
+    no_proxy = self.no_proxy
+    unless no_proxy
+      return false
+    end
+
+    unless dest.is_a? URI
+      begin
+        dest = URI.parse(dest)
+      rescue URI::InvalidURIError
+        return false
+      end
+    end
+
+    no_proxy.split(/\s*,\s*/).each do |d|
+      host, port = d.split(':')
+      host = Regexp.escape(host).gsub('\*', '.*')
+
+      #If this no_proxy entry specifies a port, we want to match it against
+      #the destination port.  Otherwise just match hosts.
+      if port
+        no_proxy_regex  = %r(#{host}:#{port}$)
+        dest_string     = "#{dest.host}:#{dest.port}"
+      else
+        no_proxy_regex  = %r(#{host}$)
+        dest_string     = "#{dest.host}"
+      end
+
+      if no_proxy_regex.match(dest_string)
+        return true
+      end
+    end
+
+    return false
+  end
+
+  def self.http_proxy_host
+    env = self.http_proxy_env
+
+    if env and env.host
+      return env.host
+    end
+
+    if Puppet.settings[:http_proxy_host] == 'none'
+      return nil
+    end
+
+    return Puppet.settings[:http_proxy_host]
+  end
+
+  def self.http_proxy_port
+    env = self.http_proxy_env
+
+    if env and env.port
+      return env.port
+    end
+
+    return Puppet.settings[:http_proxy_port]
+  end
+
+  def self.http_proxy_user
+    env = self.http_proxy_env
+
+    if env and env.user
+      return env.user
+    end
+
+    if Puppet.settings[:http_proxy_user] == 'none'
+      return nil
+    end
+
+    return Puppet.settings[:http_proxy_user]
+  end
+
+  def self.http_proxy_password
+    env = self.http_proxy_env
+
+    if env and env.password
+      return env.password
+    end
+
+    if Puppet.settings[:http_proxy_user] == 'none' or Puppet.settings[:http_proxy_password] == 'none'
+      return nil
+    end
+
+    return Puppet.settings[:http_proxy_password]
+  end
+
+  def self.no_proxy
+    no_proxy_env = ENV["no_proxy"] || ENV["NO_PROXY"]
+
+    if no_proxy_env
+      return no_proxy_env
+    end
+
+    if Puppet.settings[:no_proxy] == 'none'
+      return nil
+    end
+
+    return Puppet.settings[:no_proxy]
+  end
+end

data/lib/puppet/http/redirector.rb

@@ -1,23 +1,16 @@
-#
-# @api private
-#
 # Handle HTTP redirects
 #
+# @api private
 class Puppet::HTTP::Redirector
-  #
-  # @api private
-  #
   # Create a new redirect handler
   #
   # @param [Integer] redirect_limit maximum number of redirects allowed
   #
+  # @api private
   def initialize(redirect_limit)
     @redirect_limit = redirect_limit
   end
 
-  #
-  # @api private
-  #
   # Determine of the HTTP response code indicates a redirect
   #
   # @param [Net::HTTP] request request that received the response
@@ -25,6 +18,7 @@ class Puppet::HTTP::Redirector
   #
   # @return [Boolean] true if the response code is 301, 302, or 307.
   #
+  # @api private
   def redirect?(request, response)
     # Net::HTTPRedirection is not used because historically puppet
     # has only handled these, and we're not a browser
@@ -36,9 +30,6 @@ class Puppet::HTTP::Redirector
     end
   end
 
-  #
-  # @api private
-  #
   # Implement the HTTP request redirection
   #
   # @param [Net::HTTP] request request that has been redirected
@@ -48,17 +39,12 @@ class Puppet::HTTP::Redirector
   # @return [Net::HTTP] A new request based on the original request, but with
   #   the redirected location
   #
+  # @api private
   def redirect_to(request, response, redirects)
     raise Puppet::HTTP::TooManyRedirects.new(request.uri) if redirects >= @redirect_limit
 
     location = parse_location(response)
-    if location.relative?
-      url = request.uri.dup
-      url.path = location.path
-    else
-      url = location.dup
-    end
-    url.query = request.uri.query
+    url = request.uri.merge(location)
 
     new_request = request.class.new(url)
     new_request.body = request.body
@@ -66,6 +52,14 @@ class Puppet::HTTP::Redirector
       new_request[header] = value
     end
 
+    # mimic private Net::HTTP#addr_port
+    new_request['Host'] = if (location.scheme == 'https' && location.port == 443) ||
+                             (location.scheme == 'http' && location.port == 80)
+                            location.host
+                          else
+                            "#{location.host}:#{location.port}"
+                          end
+
     new_request
   end