puppet 6.16.0 → 7.0.0

data/lib/puppet/network/http/connection_adapter.rb

@@ -1,182 +0,0 @@
-class Puppet::Network::HTTP::ConnectionAdapter < Puppet::Network::HTTP::Connection
-  def initialize(host, port, options = {})
-    super(host, port, options)
-
-    @client = Puppet.runtime[:http]
-  end
-
-  def get(path, headers = {}, options = {})
-    headers ||= {}
-    options[:ssl_context] ||= resolve_ssl_context
-    options[:redirect_limit] ||= @redirect_limit
-
-    with_error_handling do
-      resp = @client.get(to_url(path), headers: headers, options: options)
-      resp.nethttp
-    end
-  end
-
-  def post(path, data, headers = nil, options = {})
-    headers ||= {}
-    headers['Content-Type'] ||= "application/x-www-form-urlencoded"
-    data ||= ''
-    options[:ssl_context] ||= resolve_ssl_context
-    options[:redirect_limit] ||= @redirect_limit
-
-    with_error_handling do
-      resp = @client.post(to_url(path), data, headers: headers, options: options)
-      resp.nethttp
-    end
-  end
-
-  def head(path, headers = {}, options = {})
-    headers ||= {}
-    options[:ssl_context] ||= resolve_ssl_context
-    options[:redirect_limit] ||= @redirect_limit
-
-    with_error_handling do
-      resp = @client.head(to_url(path), headers: headers, options: options)
-      resp.nethttp
-    end
-  end
-
-  def delete(path, headers = {'Depth' => 'Infinity'}, options = {})
-    headers ||= {}
-    options[:ssl_context] ||= resolve_ssl_context
-    options[:redirect_limit] ||= @redirect_limit
-
-    with_error_handling do
-      resp = @client.delete(to_url(path), headers: headers, options: options)
-      resp.nethttp
-    end
-  end
-
-  def put(path, data, headers = nil, options = {})
-    headers ||= {}
-    headers['Content-Type'] ||= "application/x-www-form-urlencoded"
-    data ||= ''
-    options[:ssl_context] ||= resolve_ssl_context
-    options[:redirect_limit] ||= @redirect_limit
-
-    with_error_handling do
-      resp = @client.put(to_url(path), data, headers: headers, options: options)
-      resp.nethttp
-    end
-  end
-
-  def request_get(*args, &block)
-    path, headers = *args
-    headers ||= {}
-    options = {
-      ssl_context: resolve_ssl_context,
-      redirect_limit: @redirect_limit
-    }
-
-    resp = @client.get(to_url(path), headers: headers, options: options) do |response|
-      yield response.nethttp if block_given?
-    end
-    resp.nethttp
-  end
-
-  def request_head(*args, &block)
-    path, headers = *args
-    headers ||= {}
-    options = {
-      ssl_context: resolve_ssl_context,
-      redirect_limit: @redirect_limit
-    }
-
-    response = @client.head(to_url(path), headers: headers, options: options)
-    yield response.nethttp if block_given?
-    response.nethttp
-  end
-
-  def request_post(*args, &block)
-    path, data, headers = *args
-    headers ||= {}
-    headers['Content-Type'] ||= "application/x-www-form-urlencoded"
-    options = {
-      ssl_context: resolve_ssl_context,
-      redirect_limit: @redirect_limit
-    }
-
-    resp = @client.post(to_url(path), data, headers: headers, options: options) do |response|
-      yield response.nethttp if block_given?
-    end
-    resp.nethttp
-  end
-
-  private
-
-  # The old Connection class ignores the ssl_context on the Puppet stack,
-  # and always loads certs/keys based on what is currently in the filesystem.
-  # If the files are missing, it would attempt to bootstrap the certs/keys
-  # while in the process of making a network request, due to the call to
-  # Puppet.lookup(:ssl_host) in Puppet::SSL::Validator::DefaultValidator#setup_connection.
-  # This class doesn't preserve the boostrap behavior because that is handled
-  # outside of this class, and can only be triggered by running `puppet ssl` or
-  # `puppet agent`.
-  def resolve_ssl_context
-    # don't need an ssl context for http connections
-    return nil unless @site.use_ssl?
-
-    # if our verifier has an ssl_context, use that
-    ctx = @verifier.ssl_context
-    return ctx if ctx
-
-    # load available certs
-    cert = Puppet::X509::CertProvider.new
-    ssl = Puppet::SSL::SSLProvider.new
-    begin
-      password = cert.load_private_key_password
-      ssl.load_context(certname: Puppet[:certname], password: password)
-    rescue Puppet::SSL::SSLError => e
-      Puppet.log_exception(e)
-
-      # if we don't have cacerts, then create a root context that doesn't
-      # trust anything. The old code used to fallback to VERIFY_NONE,
-      # which we don't want to emulate.
-      ssl.create_root_context(cacerts: [])
-    end
-  end
-
-  def to_url(path)
-    if path =~ /^https?:\/\//
-      # The old Connection class accepts a URL as the request path, and sends
-      # it in "absolute-form" in the request line, e.g. GET https://puppet:8140/.
-      # See https://httpwg.org/specs/rfc7230.html#absolute-form. It just so happens
-      # to work because HTTP 1.1 servers are required to accept absolute-form even
-      # though clients are only supposed to send them to proxies, so the proxy knows
-      # what upstream server to CONNECT to. This method creates a URL using the
-      # scheme/host/port that the connection was created with, and appends the path
-      # portion of the absolute-form. The resulting request will use "origin-form"
-      # as it should have done all along.
-      url = URI(path)
-      URI("#{@site.addr}/#{normalize_path(url.path)}")
-    else
-      URI("#{@site.addr}/#{Puppet::Util.uri_encode(normalize_path(path))}")
-    end
-  end
-
-  def normalize_path(path)
-    if path[0] == '/'
-      path[1..-1]
-    else
-      path
-    end
-  end
-
-  def with_error_handling(&block)
-    yield
-  rescue Puppet::HTTP::TooManyRedirects => e
-    raise Puppet::Network::HTTP::RedirectionLimitExceededException.new(_("Too many HTTP redirections for %{host}:%{port}") % { host: @host, port: @port }, e)
-  rescue Puppet::HTTP::HTTPError => e
-    Puppet.log_exception(e, e.message)
-    case e.cause
-    when Net::OpenTimeout, Net::ReadTimeout, Net::HTTPError, EOFError
-      raise e.cause
-    else
-      raise e
-    end
-  end
-end

data/lib/puppet/network/http/nocache_pool.rb

@@ -1,28 +0,0 @@
-# A pool that does not cache HTTP connections.
-#
-# @api private
-class Puppet::Network::HTTP::NoCachePool < Puppet::Network::HTTP::BasePool
-  def initialize(factory = Puppet::Network::HTTP::Factory.new)
-    Puppet.deprecation_warning(_('Puppet::Network::HTTP::NoCachePool is deprecated.'))
-    @factory = factory
-  end
-
-  # Yields a <tt>Net::HTTP</tt> connection.
-  #
-  # @yieldparam http [Net::HTTP] An HTTP connection
-  def with_connection(site, verifier, &block)
-    http = @factory.create_connection(site)
-    start(site, verifier, http)
-    begin
-      yield http
-    ensure
-      return unless http.started?
-      Puppet.debug("Closing connection for #{site}")
-      http.finish
-    end
-  end
-
-  def close
-    # do nothing
-  end
-end

data/lib/puppet/network/rest_controller.rb

@@ -1,2 +0,0 @@
-class Puppet::Network::RESTController # :nodoc:
-end

data/lib/puppet/network/rights.rb

@@ -1,210 +0,0 @@
-require 'puppet/network/authstore'
-require 'puppet/error'
-
-module Puppet::Network
-
-# this exception is thrown when a request is not authenticated
-class AuthorizationError < Puppet::Error; end
-
-# Rights class manages a list of ACLs for paths.
-class Rights
-  # Check that name is allowed or not
-  def allowed?(name, *args)
-    !is_forbidden_and_why?(name, :node => args[0], :ip => args[1])
-  end
-
-  def is_request_forbidden_and_why?(method, path, params)
-    methods_to_check = if method == :head
-                         # :head is ok if either :find or :save is ok.
-                         [:find, :save]
-                       else
-                         [method]
-                       end
-    authorization_failure_exceptions = methods_to_check.map do |m|
-      is_forbidden_and_why?(path, params.merge({:method => m}))
-    end
-    if authorization_failure_exceptions.include? nil
-      # One of the methods we checked is ok, therefore this request is ok.
-      nil
-    else
-      # Just need to return any of the failure exceptions.
-      authorization_failure_exceptions.first
-    end
-  end
-
-  def is_forbidden_and_why?(name, args = {})
-    res = :nomatch
-    @rights.find do |acl|
-      found = false
-      # an acl can return :dunno, which means "I'm not qualified to answer your question,
-      # please ask someone else". This is used when for instance an acl matches, but not for the
-      # current rest method, where we might think some other acl might be more specific.
-      match = acl.match?(name)
-      if match
-        args[:match] = match
-        if (res = acl.allowed?(args[:node], args[:ip], args)) != :dunno
-          # return early if we're allowed
-          return nil if res
-          # we matched, select this acl
-          found = true
-        end
-      end
-      found
-    end
-
-    # if we end up here, then that means we either didn't match or failed, in any
-    # case will return an error to the outside world
-    msg = "#{name} [#{args[:method]}]"
-
-    AuthorizationError.new(_("Forbidden request: %{msg}") % { msg: msg })
-  end
-
-  def initialize
-    @rights = []
-  end
-
-  def [](name)
-    @rights.find { |acl| acl == name }
-  end
-
-  def empty?
-    @rights.empty?
-  end
-
-  def include?(name)
-    @rights.include?(name)
-  end
-
-  def each
-    @rights.each { |r| yield r.name,r }
-  end
-
-  # Define a new right to which access can be provided.
-  def newright(name, line=nil, file=nil)
-    add_right( Right.new(name, line, file) )
-  end
-
-  private
-
-  def add_right(right)
-    @rights << right
-    right
-  end
-
-  # Retrieve a right by name.
-  def right(name)
-    self[name]
-  end
-
-  # A right.
-  class Right < Puppet::Network::AuthStore
-    attr_accessor :name, :key
-    # Overriding Object#methods sucks for debugging. If we're in here in the
-    # future, it would be nice to rename Right#methods
-    attr_accessor :methods, :environment, :authentication
-    attr_accessor :line, :file
-
-    ALL = [:save, :destroy, :find, :search]
-
-    Puppet::Util.logmethods(self, true)
-
-    def initialize(name, line, file)
-      @methods = []
-      @environment = []
-      @authentication = true # defaults to authenticated
-      @name = name
-      @line = line || 0
-      @file = file
-      @methods = ALL
-
-      case name
-      when /^\//
-        @key = Regexp.new("^" + Regexp.escape(name))
-      when /^~/ # this is a regex
-        @name = name.gsub(/^~\s+/,'')
-        @key = Regexp.new(@name)
-      else
-        raise ArgumentError, _("Unknown right type '%{name}'") % { name: name }
-      end
-
-      super()
-    end
-
-    def to_s
-      "access[#{@name}]"
-    end
-
-    # There's no real check to do at this point
-    def valid?
-      true
-    end
-
-    # does this right is allowed for this triplet?
-    # if this right is too restrictive (ie we don't match this access method)
-    # then return :dunno so that upper layers have a chance to try another right
-    # tailored to the given method
-    def allowed?(name, ip, args = {})
-      if not @methods.include?(args[:method])
-        return :dunno
-      elsif @environment.size > 0 and not @environment.include?(args[:environment])
-        return :dunno
-      elsif (@authentication and not args[:authenticated])
-        return :dunno
-      end
-
-      begin
-        # make sure any capture are replaced if needed
-        interpolate(args[:match]) if args[:match]
-        res = super(name,ip)
-      ensure
-        reset_interpolation
-      end
-      res
-    end
-
-    # restrict this right to some method only
-    def restrict_method(m)
-      m = m.intern if m.is_a?(String)
-
-      raise ArgumentError, _("'%{m}' is not an allowed value for method directive") % { m: m } unless ALL.include?(m)
-
-      # if we were allowing all methods, then starts from scratch
-      if @methods === ALL
-        @methods = []
-      end
-
-      raise ArgumentError, _("'%{m}' is already in the '%{name}' ACL") % { m: m, name: name } if @methods.include?(m)
-
-      @methods << m
-    end
-
-    def restrict_environment(environment)
-      env = Puppet.lookup(:environments).get(environment)
-      raise ArgumentError, _("'%{env}' is already in the '%{name}' ACL") % { env: env, name: name } if @environment.include?(env)
-
-      @environment << env
-    end
-
-    def restrict_authenticated(authentication)
-      case authentication
-      when "yes", "on", "true", true
-        authentication = true
-      when "no", "off", "false", false, "all" ,"any", :all, :any
-        authentication = false
-      else
-        raise ArgumentError, _("'%{name}' incorrect authenticated value: %{authentication}") % { name: name, authentication: authentication }
-      end
-      @authentication = authentication
-    end
-
-    def match?(key)
-      # otherwise match with the regex
-      self.key.match(key)
-    end
-
-    def ==(name)
-      self.name == name.gsub(/^~\s+/,'')
-    end
-  end
-end
-end

data/lib/puppet/parser/compiler/catalog_validator/env_relationship_validator.rb

@@ -1,64 +0,0 @@
-class Puppet::Parser::Compiler
-  # Validator that asserts that all capability resources that are referenced by 'consume' or 'require' has
-  # been exported by some other resource in the environment
-  class CatalogValidator::EnvironmentRelationshipValidator < CatalogValidator
-
-    def validate
-      assumed_exports = {}
-      exported = {}
-      catalog.resources.each do |resource|
-        next unless resource.is_a?(Puppet::Parser::Resource)
-        resource.eachparam do |param|
-          pclass = Puppet::Type.metaparamclass(param.name)
-          validate_relationship(resource, param, assumed_exports, exported) if !pclass.nil? && pclass < Puppet::Type::RelationshipMetaparam
-        end
-      end
-      assumed_exports.each_pair do |key, (param, cap)|
-        raise CatalogValidationError.new(_("Capability '%{cap}' referenced by '%{param}' is never exported") % { cap: cap, param: param.name }, param.file, param.line) unless exported.include?(key)
-      end
-      nil
-    end
-
-    private
-
-    def validate_relationship(resource, param, assumed_exports, exported)
-      case param.name
-      when :require, :consume
-        add_capability_ref(param, param.value, assumed_exports)
-      when :export
-        add_exported(resource, param, param.value, exported)
-      end
-    end
-
-    def add_capability_ref(param, value, assumed_exports)
-      case value
-      when Array
-        value.each { |v| add_capability_ref(param, v, assumed_exports) }
-      when Puppet::Resource
-        rt = value.resource_type
-        unless rt.nil? || !rt.is_capability?
-          title_key = catalog.title_key_for_ref(value.ref)
-          assumed_exports[title_key] = [param, value]
-        end
-        nil
-      end
-    end
-
-    def add_exported(resource, param, value, hash)
-      case value
-      when Array
-        value.each { |v| add_exported(resource, param, v, hash) }
-      when Puppet::Resource
-        rt = value.resource_type
-        unless rt.nil? || !rt.is_capability?
-          title_key = catalog.title_key_for_ref(value.ref)
-          if hash.include?(title_key)
-            raise CatalogValidationError.new(_("'%{value}' is exported by both '%{hash}' and '%{resource}'") % { value: value, hash: hash[title_key], resource: resource }, param.file, param.line)
-          else
-            hash[title_key] = resource
-          end
-        end
-      end
-    end
-  end
-end