puppet 6.29.0 → 7.0.0

data/lib/puppet/{network/http → http}/pool.rb

@@ -1,5 +1,5 @@
-# A pool for persistent <tt>Net::HTTP</tt> connections. Connections are
-# stored in the pool indexed by their {Puppet::Network::HTTP::Site Site}.
+# A pool for persistent `Net::HTTP` connections. Connections are
+# stored in the pool indexed by their {Site}.
 # Connections are borrowed from the pool, yielded to the caller, and
 # released back into the pool. If a connection is expired, it will be
 # closed either when a connection to that site is requested, or when
@@ -7,13 +7,12 @@
 # same site, and will be reused in MRU order.
 #
 # @api private
-#
-class Puppet::Network::HTTP::Pool < Puppet::Network::HTTP::BasePool
+class Puppet::HTTP::Pool
   attr_reader :factory, :keepalive_timeout
 
   def initialize(keepalive_timeout)
     @pool = {}
-    @factory = Puppet::Network::HTTP::Factory.new
+    @factory = Puppet::HTTP::Factory.new
     @keepalive_timeout = keepalive_timeout
   end
 
@@ -40,9 +39,9 @@ class Puppet::Network::HTTP::Pool < Puppet::Network::HTTP::BasePool
   end
 
   def close
-    @pool.each_pair do |site, sessions|
-      sessions.each do |session|
-        close_connection(site, session.connection)
+    @pool.each_pair do |site, entries|
+      entries.each do |entry|
+        close_connection(site, entry.connection)
       end
     end
     @pool.clear
@@ -53,6 +52,25 @@ class Puppet::Network::HTTP::Pool < Puppet::Network::HTTP::BasePool
     @pool
   end
 
+  # Start a persistent connection
+  #
+  # @api private
+  def start(site, verifier, http)
+    Puppet.debug("Starting connection for #{site}")
+    if site.use_ssl?
+      verifier.setup_connection(http)
+      begin
+        http.start
+        print_ssl_info(http) if Puppet::Util::Log.sendlevel?(:debug)
+      rescue OpenSSL::SSL::SSLError => error
+        verifier.handle_connection_error(http, error)
+      end
+    else
+      http.start
+    end
+  end
+
+
   # Safely close a persistent connection.
   # Don't try to close a connection that's already closed.
   #
@@ -72,17 +90,17 @@ class Puppet::Network::HTTP::Pool < Puppet::Network::HTTP::BasePool
   #
   # @api private
   def borrow(site, verifier)
-    @pool[site] = active_sessions(site)
-    index = @pool[site].index do |session|
-      (verifier.nil? && session.verifier.nil?) ||
-        (!verifier.nil? && verifier.reusable?(session.verifier))
+    @pool[site] = active_entries(site)
+    index = @pool[site].index do |entry|
+      (verifier.nil? && entry.verifier.nil?) ||
+        (!verifier.nil? && verifier.reusable?(entry.verifier))
     end
-    session = index ? @pool[site].delete_at(index) : nil
-    if session
+    entry = index ? @pool[site].delete_at(index) : nil
+    if entry
       @pool.delete(site) if @pool[site].empty?
 
       Puppet.debug("Using cached connection for #{site}")
-      session.connection
+      entry.connection
     else
       http = @factory.create_connection(site)
 
@@ -107,31 +125,48 @@ class Puppet::Network::HTTP::Pool < Puppet::Network::HTTP::BasePool
   # @api private
   def release(site, verifier, http)
     expiration = Time.now + @keepalive_timeout
-    session = Puppet::Network::HTTP::Session.new(http, verifier, expiration)
+    entry = Puppet::HTTP::PoolEntry.new(http, verifier, expiration)
     Puppet.debug("Caching connection for #{site}")
 
-    sessions = @pool[site]
-    if sessions
-      sessions.unshift(session)
+    entries = @pool[site]
+    if entries
+      entries.unshift(entry)
     else
-      @pool[site] = [session]
+      @pool[site] = [entry]
     end
   end
 
-  # Returns an Array of sessions whose connections are not expired.
+  # Returns an Array of entries whose connections are not expired.
   #
   # @api private
-  def active_sessions(site)
+  def active_entries(site)
     now = Time.now
 
-    sessions = @pool[site] || []
-    sessions.select do |session|
-      if session.expired?(now)
-        close_connection(site, session.connection)
+    entries = @pool[site] || []
+    entries.select do |entry|
+      if entry.expired?(now)
+        close_connection(site, entry.connection)
         false
       else
         true
       end
     end
   end
+
+  private
+
+  def print_ssl_info(http)
+    buffered_io = http.instance_variable_get(:@socket)
+    return unless buffered_io
+
+    socket = buffered_io.io
+    return unless socket
+
+    cipher = if Puppet::Util::Platform.jruby?
+               socket.cipher
+             else
+               socket.cipher.first
+             end
+    Puppet.debug("Using #{socket.ssl_version} with cipher #{cipher}")
+  end
 end

data/lib/puppet/{network/http/session.rb → http/pool_entry.rb}

@@ -1,9 +1,8 @@
-# An HTTP session that references a persistent HTTP connection and
+# An entry in the peristent HTTP pool that references the connection and
 # an expiration time for the connection.
 #
 # @api private
-#
-class Puppet::Network::HTTP::Session
+class Puppet::HTTP::PoolEntry
   attr_reader :connection, :verifier
 
   def initialize(connection, verifier, expiration_time)

data/lib/puppet/http/proxy.rb

@@ -0,0 +1,137 @@
+require 'uri'
+require 'puppet/ssl/openssl_loader'
+
+module Puppet::HTTP::Proxy
+  def self.proxy(uri)
+    if http_proxy_host && !no_proxy?(uri)
+      Net::HTTP.new(uri.host, uri.port, self.http_proxy_host, self.http_proxy_port, self.http_proxy_user, self.http_proxy_password)
+    else
+      http = Net::HTTP.new(uri.host, uri.port, nil, nil, nil, nil)
+      # Net::HTTP defaults the proxy port even though we said not to
+      # use one. Set it to nil so caller is not surprised
+      http.proxy_port = nil
+      http
+    end
+  end
+
+  def self.http_proxy_env
+    # Returns a URI object if proxy is set, or nil
+    proxy_env = ENV["http_proxy"] || ENV["HTTP_PROXY"]
+    begin
+      return URI.parse(proxy_env) if proxy_env
+    rescue URI::InvalidURIError
+      return nil
+    end
+    return nil
+  end
+
+  # The documentation around the format of the no_proxy variable seems
+  # inconsistent.  Some suggests the use of the * as a way of matching any
+  # hosts under a domain, e.g.:
+  #   *.example.com
+  # Other documentation suggests that just a leading '.' indicates a domain
+  # level exclusion, e.g.:
+  #   .example.com
+  # We'll accommodate both here.
+  def self.no_proxy?(dest)
+    no_proxy = self.no_proxy
+    unless no_proxy
+      return false
+    end
+
+    unless dest.is_a? URI
+      begin
+        dest = URI.parse(dest)
+      rescue URI::InvalidURIError
+        return false
+      end
+    end
+
+    no_proxy.split(/\s*,\s*/).each do |d|
+      host, port = d.split(':')
+      host = Regexp.escape(host).gsub('\*', '.*')
+
+      #If this no_proxy entry specifies a port, we want to match it against
+      #the destination port.  Otherwise just match hosts.
+      if port
+        no_proxy_regex  = %r(#{host}:#{port}$)
+        dest_string     = "#{dest.host}:#{dest.port}"
+      else
+        no_proxy_regex  = %r(#{host}$)
+        dest_string     = "#{dest.host}"
+      end
+
+      if no_proxy_regex.match(dest_string)
+        return true
+      end
+    end
+
+    return false
+  end
+
+  def self.http_proxy_host
+    env = self.http_proxy_env
+
+    if env and env.host
+      return env.host
+    end
+
+    if Puppet.settings[:http_proxy_host] == 'none'
+      return nil
+    end
+
+    return Puppet.settings[:http_proxy_host]
+  end
+
+  def self.http_proxy_port
+    env = self.http_proxy_env
+
+    if env and env.port
+      return env.port
+    end
+
+    return Puppet.settings[:http_proxy_port]
+  end
+
+  def self.http_proxy_user
+    env = self.http_proxy_env
+
+    if env and env.user
+      return env.user
+    end
+
+    if Puppet.settings[:http_proxy_user] == 'none'
+      return nil
+    end
+
+    return Puppet.settings[:http_proxy_user]
+  end
+
+  def self.http_proxy_password
+    env = self.http_proxy_env
+
+    if env and env.password
+      return env.password
+    end
+
+    if Puppet.settings[:http_proxy_user] == 'none' or Puppet.settings[:http_proxy_password] == 'none'
+      return nil
+    end
+
+    return Puppet.settings[:http_proxy_password]
+  end
+
+  def self.no_proxy
+    no_proxy_env = ENV["no_proxy"] || ENV["NO_PROXY"]
+
+    if no_proxy_env
+      return no_proxy_env
+    end
+
+    if Puppet.settings[:no_proxy] == 'none'
+      return nil
+    end
+
+    return Puppet.settings[:no_proxy]
+  end
+end

data/lib/puppet/http/redirector.rb

@@ -1,23 +1,16 @@
-#
-# @api private
-#
 # Handle HTTP redirects
 #
+# @api private
 class Puppet::HTTP::Redirector
-  #
-  # @api private
-  #
   # Create a new redirect handler
   #
   # @param [Integer] redirect_limit maximum number of redirects allowed
   #
+  # @api private
   def initialize(redirect_limit)
     @redirect_limit = redirect_limit
   end
 
-  #
-  # @api private
-  #
   # Determine of the HTTP response code indicates a redirect
   #
   # @param [Net::HTTP] request request that received the response
@@ -25,6 +18,7 @@ class Puppet::HTTP::Redirector
   #
   # @return [Boolean] true if the response code is 301, 302, or 307.
   #
+  # @api private
   def redirect?(request, response)
     # Net::HTTPRedirection is not used because historically puppet
     # has only handled these, and we're not a browser
@@ -36,9 +30,6 @@ class Puppet::HTTP::Redirector
     end
   end
 
-  #
-  # @api private
-  #
   # Implement the HTTP request redirection
   #
   # @param [Net::HTTP] request request that has been redirected
@@ -48,6 +39,7 @@ class Puppet::HTTP::Redirector
   # @return [Net::HTTP] A new request based on the original request, but with
   #   the redirected location
   #
+  # @api private
   def redirect_to(request, response, redirects)
     raise Puppet::HTTP::TooManyRedirects.new(request.uri) if redirects >= @redirect_limit
 
@@ -57,11 +49,6 @@ class Puppet::HTTP::Redirector
     new_request = request.class.new(url)
     new_request.body = request.body
     request.each do |header, value|
-      unless Puppet[:location_trusted]
-        # skip adding potentially sensitive header to other hosts
-        next if header.casecmp('Authorization').zero? && request.uri.host.casecmp(location.host) != 0
-        next if header.casecmp('Cookie').zero? && request.uri.host.casecmp(location.host) != 0
-      end
       new_request[header] = value
     end
 

data/lib/puppet/http/resolver/server_list.rb

@@ -1,12 +1,10 @@
-#
-# @api private
-#
 # Use the server_list setting to resolve a service. This resolver is only used
 # if server_list is set either on the command line or in the configuration file.
 #
+# @api public
 class Puppet::HTTP::Resolver::ServerList < Puppet::HTTP::Resolver
-  #
-  # @api private
+
+  # Create a server list resolver.
   #
   # @param [Puppet::HTTP::Client] client
   # @param [Array<String>] server_list_setting array of servers set via the
@@ -24,15 +22,12 @@ class Puppet::HTTP::Resolver::ServerList < Puppet::HTTP::Resolver
     @services = services
   end
 
-  #
-  # @api private
-  #
   # Walk the server_list to find a server and port that will connect successfully.
   #
-  # @param [Puppet::HTTP::Session] session <description>
+  # @param [Puppet::HTTP::Session] session
   # @param [Symbol] name the name of the service being resolved
   # @param [Puppet::SSL::SSLContext] ssl_context
-  # @param [Proc] canceled_handler (nil) optional callback allowing a resolver
+  # @param [Proc] canceled_handler optional callback allowing a resolver
   #   to cancel resolution.
   #
   # @return [nil] return nil if the service to be resolved does not support
@@ -43,6 +38,7 @@ class Puppet::HTTP::Resolver::ServerList < Puppet::HTTP::Resolver
   # @raise [Puppet::Error] raise if none of the servers defined in server_list
   #   are available
   #
+  # @api public
   def resolve(session, name, ssl_context: nil, canceled_handler: nil)
     # If we're configured to use an explicit service host, e.g. report_server
     # then don't use server_list to resolve the `:report` service.
@@ -54,7 +50,7 @@ class Puppet::HTTP::Resolver::ServerList < Puppet::HTTP::Resolver
     end
 
     # Return the first simple service status endpoint we can connect to
-    @server_list_setting.value.each_with_index do |server, index|
+    @server_list_setting.value.each do |server|
       host = server[0]
       port = server[1] || @default_port
 
@@ -64,21 +60,10 @@ class Puppet::HTTP::Resolver::ServerList < Puppet::HTTP::Resolver
         @resolved_url = service.url
         return Puppet::HTTP::Service.create_service(@client, session, name, @resolved_url.host, @resolved_url.port)
       rescue Puppet::HTTP::ResponseError => detail
-        if index < @server_list_setting.value.length - 1
-          Puppet.warning(_("Puppet server %{host}:%{port} is unavailable: %{code} %{reason}") %
-                              { host: service.url.host, port: service.url.port, code: detail.response.code, reason: detail.response.reason } +
-                              ' ' + _("Trying with next server from server_list."))
-        else
-          Puppet.log_exception(detail, _("Puppet server %{host}:%{port} is unavailable: %{code} %{reason}") %
-                               { host: service.url.host, port: service.url.port, code: detail.response.code, reason: detail.response.reason })
-        end
+        Puppet.log_exception(detail, _("Puppet server %{host}:%{port} is unavailable: %{code} %{reason}") %
+                             { host: service.url.host, port: service.url.port, code: detail.response.code, reason: detail.response.reason })
       rescue Puppet::HTTP::HTTPError => detail
-        if index < @server_list_setting.value.length - 1
-          Puppet.warning(_("Unable to connect to server from server_list setting: %{detail}") % {detail: detail} +
-                             ' ' + _("Trying with next server from server_list."))
-        else
-          Puppet.log_exception(detail, _("Unable to connect to server from server_list setting: %{detail}") % {detail: detail})
-        end
+        Puppet.log_exception(detail, _("Unable to connect to server from server_list setting: %{detail}") % {detail: detail})
       end
     end
 

data/lib/puppet/http/resolver/settings.rb

@@ -1,24 +1,21 @@
-#
-# @api private
-#
 # Resolve a service using settings. This is the default resolver if none of the
 # other resolvers find a functional connection.
 #
+# @api public
 class Puppet::HTTP::Resolver::Settings < Puppet::HTTP::Resolver
-  #
-  # @api private
-  #
+
   # Resolve a service using the default server and port settings for this service.
   #
   # @param [Puppet::HTTP::Session] session
   # @param [Symbol] name the name of the service to be resolved
   # @param [Puppet::SSL::SSLContext] ssl_context
-  # @param [Proc] canceled_handler (nil) optional callback allowing a resolver
+  # @param [Proc] canceled_handler optional callback allowing a resolver
   #   to cancel resolution.
   #
   # @return [Puppet::HTTP::Service] if the service successfully connects,
   #   return it. Otherwise, return nil.
   #
+  # @api public
   def resolve(session, name, ssl_context: nil, canceled_handler: nil)
     service = Puppet::HTTP::Service.create_service(@client, session, name)
     check_connection?(session, service, ssl_context: ssl_context) ? service : nil

data/lib/puppet/http/resolver/srv.rb

@@ -1,11 +1,9 @@
+# Resolve a service using DNS SRV records.
 #
-# @api private
-#
-# Resolve a service using SRV
-#
+# @api public
 class Puppet::HTTP::Resolver::SRV < Puppet::HTTP::Resolver
-  #
-  # @api private
+
+  # Create an DNS SRV resolver.
   #
   # @param [Puppet::HTTP::Client] client
   # @param [String] domain srv domain
@@ -14,23 +12,21 @@ class Puppet::HTTP::Resolver::SRV < Puppet::HTTP::Resolver
   def initialize(client, domain:, dns: Resolv::DNS.new)
     @client = client
     @srv_domain = domain
-    @delegate = Puppet::Network::Resolver.new(dns)
+    @delegate = Puppet::HTTP::DNS.new(dns)
   end
 
-  #
-  # @api private
-  #
   # Walk the available srv records and return the first that successfully connects
   #
   # @param [Puppet::HTTP::Session] session
   # @param [Symbol] name the service being resolved
   # @param [Puppet::SSL::SSLContext] ssl_context
-  # @param [Proc] canceled_handler (nil) optional callback allowing a resolver
+  # @param [Proc] canceled_handler optional callback allowing a resolver
   #   to cancel resolution.
   #
   # @return [Puppet::HTTP::Service] if an available service is found, return
   #   it. Return nil otherwise.
   #
+  # @api public
   def resolve(session, name, ssl_context: nil, canceled_handler: nil)
     # Here we pass our HTTP service name as the DNS SRV service name
     # This is fine for :ca, but note that :puppet and :file are handled

data/lib/puppet/http/resolver.rb

@@ -1,26 +1,17 @@
-#
-# @api private
-#
 # Resolver base class. Each resolver represents a different strategy for
 # resolving a service name into a list of candidate servers and ports.
 #
 # @abstract Subclass and override {#resolve} to create a new resolver.
-#
+# @api public
 class Puppet::HTTP::Resolver
   #
-  # @api private
-  #
-  # Create a new resolver
+  # Create a new resolver.
   #
   # @param [Puppet::HTTP::Client] client
-  #
   def initialize(client)
     @client = client
   end
 
-  #
-  # @api private
-  #
   # Return a working server/port for the resolver. This is the base
   # implementation and is meant to be a placeholder.
   #
@@ -33,14 +24,12 @@ class Puppet::HTTP::Resolver
   #
   # @raise [NotImplementedError] this base class is not implemented
   #
+  # @api public
   def resolve(session, name, ssl_context: nil, canceled_handler: nil)
     raise NotImplementedError
   end
 
-  #
-  # @api private
-  #
-  # Check a given connection to establish if it can be relied on for future use
+  # Check a given connection to establish if it can be relied on for future use.
   #
   # @param [Puppet::HTTP::Session] session
   # @param [Puppet::HTTP::Service] service
@@ -48,6 +37,7 @@ class Puppet::HTTP::Resolver
   #
   # @return [Boolean] Returns true if a connection is successful, false otherwise
   #
+  # @api public
   def check_connection?(session, service, ssl_context: nil)
     service.connect(ssl_context: ssl_context)
     return true