puppet 6.23.0 → 7.0.0

data/lib/puppet/network/http/base_pool.rb

@@ -1,36 +0,0 @@
-# Base pool for HTTP connections.
-#
-# @api private
-class Puppet::Network::HTTP::BasePool
-  def start(site, verifier, http)
-    Puppet.debug("Starting connection for #{site}")
-    if site.use_ssl?
-      verifier.setup_connection(http)
-      begin
-        http.start
-        print_ssl_info(http) if Puppet::Util::Log.sendlevel?(:debug)
-      rescue OpenSSL::SSL::SSLError => error
-        verifier.handle_connection_error(http, error)
-      end
-    else
-      http.start
-    end
-  end
-
-  private
-
-  def print_ssl_info(http)
-    buffered_io = http.instance_variable_get(:@socket)
-    return unless buffered_io
-
-    socket = buffered_io.io
-    return unless socket
-
-    cipher = if Puppet::Util::Platform.jruby?
-               socket.cipher
-             else
-               socket.cipher.first
-             end
-    Puppet.debug("Using #{socket.ssl_version} with cipher #{cipher}")
-  end
-end

data/lib/puppet/network/http/compression.rb

@@ -1,127 +0,0 @@
-require 'puppet/network/http'
-
-module Puppet::Network::HTTP::Compression
-  # from https://github.com/ruby/ruby/blob/v2_1_3/lib/net/http/generic_request.rb#L40
-  ACCEPT_ENCODING = "gzip;q=1.0,deflate;q=0.6,identity;q=0.3"
-
-  # this module function allows to use the right underlying
-  # methods depending on zlib presence
-  def module
-    return(Puppet.features.zlib? ? Active : None)
-  end
-  module_function :module
-
-  module Active
-    require 'zlib'
-    require 'stringio'
-
-    # return an uncompressed body if the response has been
-    # compressed
-    def uncompress_body(response)
-      case response['content-encoding']
-      when 'gzip'
-        Puppet.deprecation_warning(_('Puppet::Network::HTTP::Compression::Active#uncompress_body is deprecated.'))
-        # ZLib::GzipReader has an associated encoding, by default Encoding.default_external
-        return Zlib::GzipReader.new(StringIO.new(response.body), :encoding => Encoding::BINARY).read
-      when 'deflate'
-        Puppet.deprecation_warning(_('Puppet::Network::HTTP::Compression::Active#uncompress_body is deprecated.'))
-        return Zlib::Inflate.new.inflate(response.body)
-      when nil, 'identity'
-        return response.body
-      else
-        raise Net::HTTPError.new(_("Unknown content encoding - %{encoding}") % { encoding: response['content-encoding'] }, response)
-      end
-    end
-
-    def uncompress(response)
-      Puppet.deprecation_warning(_('Puppet::Network::HTTP::Compression::Active#uncompress is deprecated.'))
-      raise Net::HTTPError.new("No block passed", response) unless block_given?
-
-      case response['content-encoding']
-      when 'gzip','deflate'
-        uncompressor = ZlibAdapter.new
-      when nil, 'identity'
-        uncompressor = IdentityAdapter.new
-      else
-        raise Net::HTTPError.new(_("Unknown content encoding - %{encoding}") % { encoding: response['content-encoding'] }, response)
-      end
-
-      begin
-        yield uncompressor
-      ensure
-        uncompressor.close
-      end
-    end
-
-    def add_accept_encoding(headers={})
-      headers['accept-encoding'] = Puppet::Network::HTTP::Compression::ACCEPT_ENCODING
-      headers
-    end
-
-    # This adapters knows how to uncompress both 'zlib' stream (the deflate algorithm from Content-Encoding)
-    # and GZip streams.
-    class ZlibAdapter
-      def initialize(uncompressor = Zlib::Inflate.new(15 + 32))
-        # Create an inflater that knows to parse GZip streams and zlib streams.
-        # This uses a property of the C Zlib library, documented as follow:
-        #   windowBits can also be greater than 15 for optional gzip decoding. Add
-        #   32 to windowBits to enable zlib and gzip decoding with automatic header
-        #   detection, or add 16 to decode only the gzip format (the zlib format will
-        #   return a Z_DATA_ERROR).  If a gzip stream is being decoded, strm->adler is
-        #   a crc32 instead of an adler32.
-        @uncompressor = uncompressor
-        @first = true
-      end
-
-      def uncompress(chunk)
-        Puppet.deprecation_warning(_('Puppet::Network::HTTP::Compression::ZlibAdapter#uncompress is deprecated.'))
-        out = @uncompressor.inflate(chunk)
-        @first = false
-        return out
-      rescue Zlib::DataError
-        # it can happen that we receive a raw deflate stream
-        # which might make our inflate throw a data error.
-        # in this case, we try with a verbatim (no header)
-        # deflater.
-        @uncompressor = Zlib::Inflate.new
-        if @first then
-          @first = false
-          retry
-        end
-        raise
-      end
-
-      def close
-        @uncompressor.finish
-      ensure
-        @uncompressor.close
-      end
-    end
-  end
-
-  module None
-    def uncompress_body(response)
-      Puppet.deprecation_warning(_('Puppet::Network::HTTP::Compression::None#uncompress_body is deprecated.'))
-      response.body
-    end
-
-    def add_accept_encoding(headers)
-      headers
-    end
-
-    def uncompress(response)
-      Puppet.deprecation_warning(_('Puppet::Network::HTTP::Compression::None#uncompress is deprecated.'))
-      yield IdentityAdapter.new
-    end
-  end
-
-  class IdentityAdapter
-    def uncompress(chunk)
-      Puppet.deprecation_warning(_('Puppet::Network::HTTP::Compression::IdentityAdapter#uncompress is deprecated.'))
-      chunk
-    end
-
-    def close
-    end
-  end
-end

data/lib/puppet/network/http/connection_adapter.rb

@@ -1,184 +0,0 @@
-class Puppet::Network::HTTP::ConnectionAdapter < Puppet::Network::HTTP::Connection
-  def initialize(host, port, options = {})
-    super(host, port, options)
-
-    @client = Puppet.runtime[:http]
-  end
-
-  def get(path, headers = {}, options = {})
-    headers ||= {}
-    options[:ssl_context] ||= resolve_ssl_context
-    options[:redirect_limit] ||= @redirect_limit
-
-    with_error_handling do
-      resp = @client.get(to_url(path), headers: headers, options: options)
-      resp.nethttp
-    end
-  end
-
-  def post(path, data, headers = nil, options = {})
-    headers ||= {}
-    headers['Content-Type'] ||= "application/x-www-form-urlencoded"
-    data ||= ''
-    options[:ssl_context] ||= resolve_ssl_context
-    options[:redirect_limit] ||= @redirect_limit
-
-    with_error_handling do
-      resp = @client.post(to_url(path), data, headers: headers, options: options)
-      resp.nethttp
-    end
-  end
-
-  def head(path, headers = {}, options = {})
-    headers ||= {}
-    options[:ssl_context] ||= resolve_ssl_context
-    options[:redirect_limit] ||= @redirect_limit
-
-    with_error_handling do
-      resp = @client.head(to_url(path), headers: headers, options: options)
-      resp.nethttp
-    end
-  end
-
-  def delete(path, headers = {'Depth' => 'Infinity'}, options = {})
-    headers ||= {}
-    options[:ssl_context] ||= resolve_ssl_context
-    options[:redirect_limit] ||= @redirect_limit
-
-    with_error_handling do
-      resp = @client.delete(to_url(path), headers: headers, options: options)
-      resp.nethttp
-    end
-  end
-
-  def put(path, data, headers = nil, options = {})
-    headers ||= {}
-    headers['Content-Type'] ||= "application/x-www-form-urlencoded"
-    data ||= ''
-    options[:ssl_context] ||= resolve_ssl_context
-    options[:redirect_limit] ||= @redirect_limit
-
-    with_error_handling do
-      resp = @client.put(to_url(path), data, headers: headers, options: options)
-      resp.nethttp
-    end
-  end
-
-  def request_get(*args, &block)
-    path, headers = *args
-    headers ||= {}
-    options = {
-      ssl_context: resolve_ssl_context,
-      redirect_limit: @redirect_limit
-    }
-
-    resp = @client.get(to_url(path), headers: headers, options: options) do |response|
-      yield response.nethttp if block_given?
-    end
-    resp.nethttp
-  end
-
-  def request_head(*args, &block)
-    path, headers = *args
-    headers ||= {}
-    options = {
-      ssl_context: resolve_ssl_context,
-      redirect_limit: @redirect_limit
-    }
-
-    response = @client.head(to_url(path), headers: headers, options: options)
-    yield response.nethttp if block_given?
-    response.nethttp
-  end
-
-  def request_post(*args, &block)
-    path, data, headers = *args
-    headers ||= {}
-    headers['Content-Type'] ||= "application/x-www-form-urlencoded"
-    options = {
-      ssl_context: resolve_ssl_context,
-      redirect_limit: @redirect_limit
-    }
-
-    resp = @client.post(to_url(path), data, headers: headers, options: options) do |response|
-      yield response.nethttp if block_given?
-    end
-    resp.nethttp
-  end
-
-  private
-
-  # The old Connection class ignores the ssl_context on the Puppet stack,
-  # and always loads certs/keys based on what is currently in the filesystem.
-  # If the files are missing, it would attempt to bootstrap the certs/keys
-  # while in the process of making a network request, due to the call to
-  # Puppet.lookup(:ssl_host) in Puppet::SSL::Validator::DefaultValidator#setup_connection.
-  # This class doesn't preserve the boostrap behavior because that is handled
-  # outside of this class, and can only be triggered by running `puppet ssl` or
-  # `puppet agent`.
-  def resolve_ssl_context
-    # don't need an ssl context for http connections
-    return nil unless @site.use_ssl?
-
-    # if our verifier has an ssl_context, use that
-    ctx = @verifier.ssl_context
-    return ctx if ctx
-
-    # load available certs
-    cert = Puppet::X509::CertProvider.new
-    ssl = Puppet::SSL::SSLProvider.new
-    begin
-      password = cert.load_private_key_password
-      ssl.load_context(certname: Puppet[:certname], password: password)
-    rescue Puppet::SSL::SSLError => e
-      Puppet.log_exception(e)
-
-      # if we don't have cacerts, then create a root context that doesn't
-      # trust anything. The old code used to fallback to VERIFY_NONE,
-      # which we don't want to emulate.
-      ssl.create_root_context(cacerts: [])
-    end
-  end
-
-  def to_url(path)
-    if path =~ /^https?:\/\//
-      # The old Connection class accepts a URL as the request path, and sends
-      # it in "absolute-form" in the request line, e.g. GET https://puppet:8140/.
-      # See https://httpwg.org/specs/rfc7230.html#absolute-form. It just so happens
-      # to work because HTTP 1.1 servers are required to accept absolute-form even
-      # though clients are only supposed to send them to proxies, so the proxy knows
-      # what upstream server to CONNECT to. This method creates a URL using the
-      # scheme/host/port that the connection was created with, and appends the path
-      # and query portions of the absolute-form. The resulting request will use "origin-form"
-      # as it should have done all along.
-      abs_form = URI(path)
-      url = URI("#{@site.addr}/#{normalize_path(abs_form.path)}")
-      url.query = abs_form.query if abs_form.query
-      url
-    else
-      URI("#{@site.addr}/#{normalize_path(path)}")
-    end
-  end
-
-  def normalize_path(path)
-    if path[0] == '/'
-      path[1..-1]
-    else
-      path
-    end
-  end
-
-  def with_error_handling(&block)
-    yield
-  rescue Puppet::HTTP::TooManyRedirects => e
-    raise Puppet::Network::HTTP::RedirectionLimitExceededException.new(_("Too many HTTP redirections for %{host}:%{port}") % { host: @host, port: @port }, e)
-  rescue Puppet::HTTP::HTTPError => e
-    Puppet.log_exception(e, e.message)
-    case e.cause
-    when Net::OpenTimeout, Net::ReadTimeout, Net::HTTPError, EOFError
-      raise e.cause
-    else
-      raise e
-    end
-  end
-end

data/lib/puppet/network/http/nocache_pool.rb

@@ -1,28 +0,0 @@
-# A pool that does not cache HTTP connections.
-#
-# @api private
-class Puppet::Network::HTTP::NoCachePool < Puppet::Network::HTTP::BasePool
-  def initialize(factory = Puppet::Network::HTTP::Factory.new)
-    Puppet.deprecation_warning(_('Puppet::Network::HTTP::NoCachePool is deprecated.'))
-    @factory = factory
-  end
-
-  # Yields a <tt>Net::HTTP</tt> connection.
-  #
-  # @yieldparam http [Net::HTTP] An HTTP connection
-  def with_connection(site, verifier, &block)
-    http = @factory.create_connection(site)
-    start(site, verifier, http)
-    begin
-      yield http
-    ensure
-      return unless http.started?
-      Puppet.debug("Closing connection for #{site}")
-      http.finish
-    end
-  end
-
-  def close
-    # do nothing
-  end
-end

data/lib/puppet/network/rest_controller.rb

@@ -1,2 +0,0 @@
-class Puppet::Network::RESTController # :nodoc:
-end

data/lib/puppet/network/rights.rb

@@ -1,210 +0,0 @@
-require 'puppet/network/authstore'
-require 'puppet/error'
-
-module Puppet::Network
-
-# this exception is thrown when a request is not authenticated
-class AuthorizationError < Puppet::Error; end
-
-# Rights class manages a list of ACLs for paths.
-class Rights
-  # Check that name is allowed or not
-  def allowed?(name, *args)
-    !is_forbidden_and_why?(name, :node => args[0], :ip => args[1])
-  end
-
-  def is_request_forbidden_and_why?(method, path, params)
-    methods_to_check = if method == :head
-                         # :head is ok if either :find or :save is ok.
-                         [:find, :save]
-                       else
-                         [method]
-                       end
-    authorization_failure_exceptions = methods_to_check.map do |m|
-      is_forbidden_and_why?(path, params.merge({:method => m}))
-    end
-    if authorization_failure_exceptions.include? nil
-      # One of the methods we checked is ok, therefore this request is ok.
-      nil
-    else
-      # Just need to return any of the failure exceptions.
-      authorization_failure_exceptions.first
-    end
-  end
-
-  def is_forbidden_and_why?(name, args = {})
-    res = :nomatch
-    @rights.find do |acl|
-      found = false
-      # an acl can return :dunno, which means "I'm not qualified to answer your question,
-      # please ask someone else". This is used when for instance an acl matches, but not for the
-      # current rest method, where we might think some other acl might be more specific.
-      match = acl.match?(name)
-      if match
-        args[:match] = match
-        if (res = acl.allowed?(args[:node], args[:ip], args)) != :dunno
-          # return early if we're allowed
-          return nil if res
-          # we matched, select this acl
-          found = true
-        end
-      end
-      found
-    end
-
-    # if we end up here, then that means we either didn't match or failed, in any
-    # case will return an error to the outside world
-    msg = "#{name} [#{args[:method]}]"
-
-    AuthorizationError.new(_("Forbidden request: %{msg}") % { msg: msg })
-  end
-
-  def initialize
-    @rights = []
-  end
-
-  def [](name)
-    @rights.find { |acl| acl == name }
-  end
-
-  def empty?
-    @rights.empty?
-  end
-
-  def include?(name)
-    @rights.include?(name)
-  end
-
-  def each
-    @rights.each { |r| yield r.name,r }
-  end
-
-  # Define a new right to which access can be provided.
-  def newright(name, line=nil, file=nil)
-    add_right( Right.new(name, line, file) )
-  end
-
-  private
-
-  def add_right(right)
-    @rights << right
-    right
-  end
-
-  # Retrieve a right by name.
-  def right(name)
-    self[name]
-  end
-
-  # A right.
-  class Right < Puppet::Network::AuthStore
-    attr_accessor :name, :key
-    # Overriding Object#methods sucks for debugging. If we're in here in the
-    # future, it would be nice to rename Right#methods
-    attr_accessor :methods, :environment, :authentication
-    attr_accessor :line, :file
-
-    ALL = [:save, :destroy, :find, :search]
-
-    Puppet::Util.logmethods(self, true)
-
-    def initialize(name, line, file)
-      @methods = []
-      @environment = []
-      @authentication = true # defaults to authenticated
-      @name = name
-      @line = line || 0
-      @file = file
-      @methods = ALL
-
-      case name
-      when /^\//
-        @key = Regexp.new("^" + Regexp.escape(name))
-      when /^~/ # this is a regex
-        @name = name.gsub(/^~\s+/,'')
-        @key = Regexp.new(@name)
-      else
-        raise ArgumentError, _("Unknown right type '%{name}'") % { name: name }
-      end
-
-      super()
-    end
-
-    def to_s
-      "access[#{@name}]"
-    end
-
-    # There's no real check to do at this point
-    def valid?
-      true
-    end
-
-    # does this right is allowed for this triplet?
-    # if this right is too restrictive (ie we don't match this access method)
-    # then return :dunno so that upper layers have a chance to try another right
-    # tailored to the given method
-    def allowed?(name, ip, args = {})
-      if not @methods.include?(args[:method])
-        return :dunno
-      elsif @environment.size > 0 and not @environment.include?(args[:environment])
-        return :dunno
-      elsif (@authentication and not args[:authenticated])
-        return :dunno
-      end
-
-      begin
-        # make sure any capture are replaced if needed
-        interpolate(args[:match]) if args[:match]
-        res = super(name,ip)
-      ensure
-        reset_interpolation
-      end
-      res
-    end
-
-    # restrict this right to some method only
-    def restrict_method(m)
-      m = m.intern if m.is_a?(String)
-
-      raise ArgumentError, _("'%{m}' is not an allowed value for method directive") % { m: m } unless ALL.include?(m)
-
-      # if we were allowing all methods, then starts from scratch
-      if @methods === ALL
-        @methods = []
-      end
-
-      raise ArgumentError, _("'%{m}' is already in the '%{name}' ACL") % { m: m, name: name } if @methods.include?(m)
-
-      @methods << m
-    end
-
-    def restrict_environment(environment)
-      env = Puppet.lookup(:environments).get(environment)
-      raise ArgumentError, _("'%{env}' is already in the '%{name}' ACL") % { env: env, name: name } if @environment.include?(env)
-
-      @environment << env
-    end
-
-    def restrict_authenticated(authentication)
-      case authentication
-      when "yes", "on", "true", true
-        authentication = true
-      when "no", "off", "false", false, "all" ,"any", :all, :any
-        authentication = false
-      else
-        raise ArgumentError, _("'%{name}' incorrect authenticated value: %{authentication}") % { name: name, authentication: authentication }
-      end
-      @authentication = authentication
-    end
-
-    def match?(key)
-      # otherwise match with the regex
-      self.key.match(key)
-    end
-
-    def ==(name)
-      self.name == name.gsub(/^~\s+/,'')
-    end
-  end
-end
-end