puppet 6.29.0 → 7.0.0

data/lib/puppet/ssl/validator/default_validator.rb

@@ -1,209 +0,0 @@
-require 'puppet/ssl/openssl_loader'
-require 'puppet/ssl'
-
-# Perform peer certificate verification against the known CA.
-# If there is no CA information known, then no verification is performed
-#
-# @deprecated
-# @api private
-#
-class Puppet::SSL::Validator::DefaultValidator #< class Puppet::SSL::Validator
-  attr_reader :peer_certs
-  attr_reader :verify_errors
-  attr_reader :last_error
-
-  FIVE_MINUTES_AS_SECONDS = 5 * 60
-
-  # Creates a new DefaultValidator, optionally with an SSL Configuration and SSL Host.
-  #
-  # @param ca_path [String] Filepath for the cacert
-  #
-  # @api private
-  #
-  def initialize(
-    ca_path = Puppet[:ssl_client_ca_auth] || Puppet[:localcacert])
-
-    reset!
-    @ca_path = ca_path
-  end
-
-
-  # Resets this validator to its initial validation state. The ssl configuration is not changed.
-  #
-  # @api private
-  #
-  def reset!
-    @peer_certs = []
-    @verify_errors = []
-    @hostname = nil
-    @last_error = nil
-  end
-
-  # Performs verification of the SSL connection and collection of the
-  # certificates for use in constructing the error message if the verification
-  # failed.  This callback will be executed once for each certificate in a
-  # chain being verified.
-  #
-  # From the [OpenSSL
-  # documentation](https://www.openssl.org/docs/ssl/SSL_CTX_set_verify.html):
-  # The `verify_callback` function is used to control the behaviour when the
-  # SSL_VERIFY_PEER flag is set. It must be supplied by the application and
-  # receives two arguments: preverify_ok indicates, whether the verification of
-  # the certificate in question was passed (preverify_ok=1) or not
-  # (preverify_ok=0). x509_store_ctx is a pointer to the complete context used for
-  # the certificate chain verification.
-  #
-  # See {Puppet::Network::HTTP::Connection} for more information and where this
-  # class is intended to be used.
-  #
-  # @param [Boolean] preverify_ok indicates whether the verification of the
-  #   certificate in question was passed (preverify_ok=true)
-  # @param [OpenSSL::X509::StoreContext] store_context holds the X509 store context
-  #   for the chain being verified.
-  #
-  # @return [Boolean] false if the peer is invalid, true otherwise.
-  #
-  # @api private
-  #
-  def call(preverify_ok, store_context)
-    current_cert = store_context.current_cert
-    @peer_certs << current_cert
-
-    # We must make a copy since the scope of the store_context will be lost
-    # across invocations of this method.
-    if preverify_ok
-      # If we've copied all of the certs in the chain out of the SSL library
-      if @peer_certs.length == store_context.chain.length
-        # (#20027) The peer cert must be issued by a specific authority
-        preverify_ok = valid_peer?
-      end
-    else
-      error = store_context.error || 0
-      error_string = store_context.error_string || "OpenSSL error #{error}"
-
-      case error
-      when OpenSSL::X509::V_OK
-        if @hostname
-          # chain is from leaf to root, opposite of the order that `call` is invoked
-          chain_cert = store_context.chain.first
-
-          # ruby 2.4 doesn't compare certs based on value, so force to DER byte array
-          if current_cert && chain_cert && current_cert.to_der == chain_cert.to_der && !OpenSSL::SSL.verify_certificate_identity(current_cert, @hostname)
-            @last_error = Puppet::SSL::CertMismatchError.new(current_cert, @hostname)
-            return false
-          else
-            @verify_errors << "#{error_string} for #{current_cert.subject.to_utf8}"
-          end
-        else
-          @verify_errors << "#{error_string} for #{current_cert.subject.to_utf8}"
-        end
-
-      when OpenSSL::X509::V_ERR_CRL_NOT_YET_VALID
-        # current_crl can be nil
-        # https://github.com/ruby/ruby/blob/ruby_1_9_3/ext/openssl/ossl_x509store.c#L501-L510
-        crl = store_context.current_crl
-        if crl
-          if crl.last_update && crl.last_update < Time.now + FIVE_MINUTES_AS_SECONDS
-            Puppet.debug { "Ignoring CRL not yet valid, current time #{Time.now.utc}, CRL last updated #{crl.last_update.utc}" }
-            preverify_ok = true
-          else
-            @verify_errors << "#{error_string} for #{crl.issuer.to_utf8}"
-          end
-        else
-          @verify_errors << error_string
-        end
-      else
-        @verify_errors << "#{error_string} for #{current_cert.subject.to_utf8}"
-      end
-    end
-    preverify_ok
-  rescue => ex
-    @verify_errors << ex.message
-    false
-  end
-
-  # Registers the instance's call method with the connection.
-  #
-  # @param [Net::HTTP] connection The connection to validate
-  #
-  # @param [Puppet::SSL::Host] host The host object containing SSL data
-  # @return [void]
-  #
-  # @api private
-  #
-  def setup_connection(connection, ssl_host = Puppet.lookup(:ssl_host))
-    @hostname = connection.address
-
-    if ssl_certificates_are_present?
-      connection.cert_store = ssl_host.ssl_store
-      connection.ca_file = @ca_path
-      connection.cert = ssl_host.certificate.content
-      connection.key = ssl_host.key.content
-      connection.verify_mode = OpenSSL::SSL::VERIFY_PEER
-      connection.verify_callback = self
-    else
-      connection.verify_mode = OpenSSL::SSL::VERIFY_NONE
-    end
-  end
-
-  ##
-  # Decode a string of concatenated certificates
-  #
-  # @return [Array<OpenSSL::X509::Certificate>]
-  def decode_cert_bundle(bundle_str)
-    re = /-----BEGIN CERTIFICATE-----.*?-----END CERTIFICATE-----/m
-    pem_ary = bundle_str.scan(re)
-    pem_ary.map do |pem_str|
-      OpenSSL::X509::Certificate.new(pem_str)
-    end
-  end
-
-  # read_file makes testing easier.
-  def read_file(path)
-    # https://www.ietf.org/rfc/rfc2459.txt defines the x509 V3 certificate format
-    # CA bundles are concatenated X509 certificates, but may also include
-    # comments, which could have UTF-8 characters
-    Puppet::FileSystem.read(path, :encoding => Encoding::UTF_8)
-  end
-
-  # Validates the peer certificates against the authorized certificates.
-  #
-  # @api private
-  #
-  def valid_peer?
-    descending_cert_chain = @peer_certs.reverse
-    authz_ca_certs = decode_cert_bundle(read_file(@ca_path))
-
-    if not has_authz_peer_cert(descending_cert_chain, authz_ca_certs)
-      msg = "The server presented a SSL certificate chain which does not include a " <<
-        "CA listed in the ssl_client_ca_auth file.  "
-      msg << "Authorized Issuers: #{authz_ca_certs.collect {|c| c.subject.to_utf8}.join(', ')}  " <<
-        "Peer Chain: #{descending_cert_chain.collect {|c| c.subject.to_utf8}.join(' => ')}"
-      @verify_errors << msg
-      false
-    else
-      true
-    end
-  end
-
-  # Checks if the set of peer_certs contains at least one certificate issued
-  # by a certificate listed in authz_certs
-  #
-  # @return [Boolean]
-  #
-  # @api private
-  #
-  def has_authz_peer_cert(peer_certs, authz_certs)
-    peer_certs.any? do |peer_cert|
-      authz_certs.any? do |authz_cert|
-        peer_cert.verify(authz_cert.public_key)
-      end
-    end
-  end
-
-  # @api private
-  #
-  def ssl_certificates_are_present?
-    Puppet::FileSystem.exist?(Puppet[:hostcert]) && Puppet::FileSystem.exist?(@ca_path)
-  end
-end

data/lib/puppet/ssl/validator/no_validator.rb

@@ -1,22 +0,0 @@
-require 'puppet/ssl/openssl_loader'
-require 'puppet/ssl'
-
-# Performs no SSL verification
-#
-# @deprecated
-# @api private
-#
-class Puppet::SSL::Validator::NoValidator < Puppet::SSL::Validator
-
-  def setup_connection(connection)
-    connection.verify_mode = OpenSSL::SSL::VERIFY_NONE
-  end
-
-  def peer_certs
-    []
-  end
-
-  def verify_errors
-    []
-  end
-end

data/lib/puppet/ssl/validator.rb

@@ -1,61 +0,0 @@
-require 'puppet/ssl/openssl_loader'
-
-# API for certificate verification
-#
-# @deprecated
-# @api public
-class Puppet::SSL::Validator
-
-  # Factory method for creating an instance of a null/no validator.
-  # This method does not have to be implemented by concrete implementations of this API.
-  #
-  # @return [Puppet::SSL::Validator] produces a validator that performs no validation
-  #
-  # @api public
-  #
-  def self.no_validator()
-    @@no_validator_cache ||= Puppet::SSL::Validator::NoValidator.new()
-  end
-
-  # Factory method for creating an instance of the default Puppet validator.
-  # This method does not have to be implemented by concrete implementations of this API.
-  #
-  # @return [Puppet::SSL::Validator] produces a validator that performs no validation
-  #
-  # @api public
-  #
-  def self.default_validator()
-    Puppet::SSL::Validator::DefaultValidator.new()
-  end
-
-  # Array of peer certificates
-  # @return [Array<Puppet::SSL::Certificate>] peer certificates
-  #
-  # @api public
-  #
-  def peer_certs
-    raise NotImplementedError, "Concrete class should have implemented this method"
-  end
-
-  # Contains the result of validation
-  # @return [Array<String>, nil] nil, empty Array, or Array with messages
-  #
-  # @api public
-  #
-  def verify_errors
-    raise NotImplementedError, "Concrete class should have implemented this method"
-  end
-
-  # Registers the connection to validate.
-  #
-  # @param [Net::HTTP] connection The connection to validate
-  #
-  # @return [void]
-  #
-  # @api public
-  #
-  def setup_connection(connection)
-    raise NotImplementedError, "Concrete class should have implemented this method"
-  end
-end
-

data/lib/puppet/ssl/verifier_adapter.rb

@@ -1,58 +0,0 @@
-# Allows a `Puppet::SSL::Validator` to be used in situations where a
-# `Verifier` is required, while preserving the legacy validator behavior of:
-#
-# * Loading CA certs from `ssl_client_ca_auth` or `localcacert`
-# * Verifying each cert in the peer's chain is contained in the file
-#   loaded above.
-#
-class Puppet::SSL::VerifierAdapter
-  attr_reader :validator, :ssl_context
-
-  def initialize(validator)
-    @validator = validator
-
-    if validator.is_a?(Puppet::SSL::Validator::NoValidator)
-      ssl = Puppet::SSL::SSLProvider.new
-      @ssl_context = ssl.create_insecure_context
-    else
-      # nil means use the default SSLContext
-      @ssl_context = nil
-    end
-  end
-
-  # Return true if `self` is reusable with `verifier` meaning they
-  # are both using the same class of `Puppet::SSL::Validator`. In this
-  # case we only care the Validator class is the same. We can't require
-  # the same instances, because a new instance is created each time
-  # HttpPool.http_instance is called.
-  #
-  # @param verifier [Puppet::SSL::Verifier] the verifier to compare against
-  # @return [Boolean] return true if a cached connection can be used, false otherwise
-  def reusable?(verifier)
-    verifier.instance_of?(self.class) &&
-      verifier.validator.instance_of?(@validator.class)
-  end
-
-  # Configure the `http` connection based on the current `ssl_context`.
-  #
-  # @param http [Net::HTTP] connection
-  # @api private
-  def setup_connection(http)
-    @validator.setup_connection(http)
-  end
-
-  # Handle an SSL connection error.
-  #
-  # @param http [Net::HTTP] connection
-  # @param error [OpenSSL::SSL::SSLError] connection error
-  # @return (see Puppet::SSL::Verifier#handle_connection_error)
-  # @raise [Puppet::SSL::CertVerifyError] SSL connection failed due to a
-  #   verification error with the server's certificate or chain
-  # @raise [Puppet::Error] server hostname does not match certificate
-  # @raise [OpenSSL::SSL::SSLError] low-level SSL connection failure
-  def handle_connection_error(http, error)
-    raise @validator.last_error if @validator.respond_to?(:last_error) && @validator.last_error
-
-    Puppet::Util::SSL.handle_connection_error(error, @validator, http.address)
-  end
-end

data/lib/puppet/status.rb

@@ -1,40 +0,0 @@
-require 'puppet/indirector'
-
-class Puppet::Status
-  extend Puppet::Indirector
-  indirects :status, :terminus_class => :local
-
-  attr_accessor :status
-
-  def initialize( status = nil )
-    @status = status || {"is_alive" => true}
-  end
-
-  def to_data_hash
-    @status
-  end
-
-  def self.from_data_hash(data)
-    if data.include?('status')
-      self.new(data['status'])
-    else
-      self.new(data)
-    end
-  end
-
-  def name
-    "status"
-  end
-
-  def name=(name)
-    # NOOP
-  end
-
-  def version
-    @status['version']
-  end
-
-  def version=(version)
-    @status['version'] = version
-  end
-end

data/lib/puppet/util/connection.rb

@@ -1,88 +0,0 @@
-require 'puppet'
-require 'puppet/util/warnings'
-
-module Puppet::Util
-  module Connection
-    extend Puppet::Util::Warnings
-
-    # The logic for server and port is kind of gross. In summary:
-    # IF an endpoint-specific setting is requested AND that setting has been set by the user
-    #    Use that setting.
-    #         The defaults for these settings are the "normal" server/serverport settings, so
-    #         when they are unset we instead want to "fall back" to the failover-selected
-    #         host/port pair.
-    # ELSE IF we have a failover-selected host/port
-    #    Use what the failover logic came up with
-    # ELSE IF the server_list setting is in use
-    #    Use the first entry - failover hasn't happened yet, but that
-    #    setting is still authoritative
-    # ELSE
-    #    Go for the legacy server/serverport settings, and hope for the best
-
-    # Determines which server to use based on the specified setting, taking into
-    # account HA fallback from server_list.
-    # @param [Symbol] setting The preferred server setting to use
-    # @return [String] the name of the server for use in the request
-    def self.determine_server(setting)
-      if setting && setting != :server && Puppet.settings.set_by_config?(setting)
-        debug_once _("Selected server from the %{setting} setting: %{server}") % {setting: setting, server: Puppet.settings[setting]}
-        Puppet[setting]
-      else
-        server = Puppet.lookup(:server) do
-          primary_server = Puppet.settings[:server_list][0]
-          if primary_server
-            #TRANSLATORS 'server_list' is the name of a setting and should not be translated
-            debug_once _("Dynamically-bound server lookup failed; using first entry from the `server_list` setting: %{server}") % {server: primary_server[0]}
-            primary_server[0]
-          else
-            setting ||= :server
-            debug_once _("Dynamically-bound server lookup failed, falling back to %{setting} setting: %{server}") % {setting: setting, server: Puppet.settings[setting]}
-            Puppet.settings[setting]
-          end
-        end
-        server
-      end
-    end
-
-    # Determines which port to use based on the specified setting, taking into
-    # account HA fallback from server_list.
-    # For port there's a little bit of an extra snag: setting a specific
-    # server setting and relying on the default port for that server is
-    # common, so we also want to check if the assocaited SERVER setting
-    # has been set by the user. If either of those are set we ignore the
-    # failover-selected port.
-    # @param [Symbol] port_setting The preferred port setting to use
-    # @param [Symbol] server_setting The server setting assoicated with this route.
-    # @return [Integer] the port to use for use in the request
-    def self.determine_port(port_setting, server_setting)
-      if (port_setting && port_setting != :serverport && Puppet.settings.set_by_config?(port_setting)) ||
-         (server_setting && server_setting != :server && Puppet.settings.set_by_config?(server_setting))
-        debug_once _("Selected port from the %{setting} setting: %{port}") % {setting: port_setting, port: Puppet.settings[port_setting].to_i}
-        Puppet.settings[port_setting].to_i
-      else
-        port = Puppet.lookup(:serverport) do
-          primary_server = Puppet.settings[:server_list][0]
-          if primary_server
-            # Port might not be set, so we want to fallback in that
-            # case. We know we don't need to use `setting` here, since
-            # the default value of every port setting is `serverport`
-            if primary_server[1]
-              #TRANSLATORS 'server_list' is the name of a setting and should not be translated
-              debug_once _("Dynamically-bound port lookup failed; using first entry from the `server_list` setting: %{port}") % {port: primary_server[1]}
-              primary_server[1]
-            else
-              #TRANSLATORS 'serverport' is the name of a setting and should not be translated
-              debug_once _("Dynamically-bound port lookup failed; falling back to `serverport` setting: %{port}") % {port: Puppet.settings[:serverport]}
-              Puppet.settings[:serverport]
-            end
-          else
-            port_setting ||= :serverport
-            debug_once _("Dynamically-bound port lookup failed; falling back to %{setting} setting: %{port}") % {setting: port_setting, port: Puppet.settings[port_setting]}
-            Puppet.settings[port_setting]
-          end
-        end
-        port.to_i
-      end
-    end
-  end
-end

data/lib/puppet/util/fact_dif.rb

@@ -1,81 +0,0 @@
-require 'json'
-
-class FactDif
-  def initialize(old_output, new_output, exclude_list, save_structured)
-    @c_facter = JSON.parse(old_output)
-    @next_facter = JSON.parse(new_output)
-    @exclude_list = exclude_list
-    @save_structured = save_structured
-    @flat_diff = []
-    @diff = {}
-  end
-
-  def difs
-    search_hash(((@c_facter.to_a - @next_facter.to_a) | (@next_facter.to_a - @c_facter.to_a)).to_h)
-
-    @flat_diff.sort_by { |a| a[0] }.each do |pair|
-      fact_path = pair[0]
-      value = pair[1]
-      compare(fact_path, value, @c_facter)
-      compare(fact_path, value, @next_facter)
-    end
-
-    @diff
-  end
-
-  private
-
-  def search_hash(sh, path = [])
-    if sh.is_a?(Hash)
-      sh.each do |k, v|
-        search_hash(v, path.push(k))
-        path.pop
-      end
-    elsif sh.is_a?(Array)
-      sh.each_with_index do |v, index|
-        search_hash(v, path.push(index))
-        path.pop
-      end
-    else
-      @flat_diff.push([path.dup, sh])
-    end
-  end
-
-  def compare(fact_path, given_value, compared_hash)
-    compared_value = compared_hash.dig(*fact_path)
-    if different?(compared_value, given_value) && !excluded?(fact_path.join('.'))
-      fact_path = fact_path.map{|f| f.to_s.include?('.') ? "\"#{f}\"" : f}.join('.') unless @save_structured
-      if compared_hash == @c_facter
-        bury(*fact_path, { :new_value => given_value, :old_value => compared_value }, @diff)
-      else
-        bury(*fact_path, { :new_value => compared_value, :old_value => given_value }, @diff)
-      end
-    end
-  end
-
-  def bury(*paths, value, hash)
-    if paths.count > 1
-      path = paths.shift
-      hash[path] = Hash.new unless hash.key?(path)
-      bury(*paths, value, hash[path])
-    else
-      hash[*paths] = value
-    end
-  end
-
-  def different?(new, old)
-    if old.is_a?(String) && new.is_a?(String) && (old.include?(',') || new.include?(','))
-      old_values = old.split(',')
-      new_values = new.split(',')
-
-      diff = (old_values - new_values) | (new_values - old_values)
-      return diff.size.positive?
-    end
-
-    old != new
-  end
-
-  def excluded?(fact_name)
-    @exclude_list.any? {|excluded_fact| fact_name =~ /#{excluded_fact}/}
-  end
-end

data/lib/puppet/util/ssl.rb

@@ -1,83 +0,0 @@
-require 'puppet/ssl/openssl_loader'
-
-##
-# SSL is a private module with class methods that help work with x.509
-# subjects and errors.
-#
-# @api private
-module Puppet::Util::SSL
-
-  @@dn_parsers = nil
-  @@no_name = nil
-
-  # Given a DN string, parse it into an OpenSSL certificate subject.  This
-  # method will flexibly handle both OpenSSL and RFC2253 formats, as given by
-  # nginx and Apache, respectively.
-  #
-  # @param [String] dn the x.509 Distinguished Name (DN) string.
-  #
-  # @return [OpenSSL::X509::Name] the certificate subject
-  def self.subject_from_dn(dn)
-    if is_possibly_valid_dn?(dn)
-      parsers = @@dn_parsers ||= [
-            OpenSSL::X509::Name.method(:parse_rfc2253),
-            OpenSSL::X509::Name.method(:parse_openssl)
-        ]
-      parsers.each do |parser|
-        begin
-          return parser.call(dn)
-        rescue OpenSSL::X509::NameError
-        end
-      end
-    end
-
-    @@no_name ||= OpenSSL::X509::Name.new
-  end
-
-  ##
-  # cn_from_subject extracts the CN from the given OpenSSL certificate
-  # subject.
-  #
-  # @api private
-  #
-  # @param [OpenSSL::X509::Name] subject the subject to extract the CN field from
-  #
-  # @return [String, nil] the CN, or nil if not found
-  def self.cn_from_subject(subject)
-    if subject.respond_to? :to_a
-      (subject.to_a.assoc('CN') || [])[1]
-    end
-  end
-
-  def self.is_possibly_valid_dn?(dn)
-    dn =~ /=/
-  end
-
-  ##
-  # Extract and format meaningful error messages from OpenSSL::OpenSSLErrors
-  # and a Validator. Re-raises the error if unknown.
-  #
-  # @api private
-  #
-  # @param [OpenSSL::OpenSSLError] error An error thrown during creating a
-  #   connection
-  # @param [Puppet::SSL::DefaultValidator] verifier A Validator who may have
-  #   invalidated the connection
-  # @param [String] host The DNS name of the other end of the SSL connection
-  #
-  # @raises [Puppet::Error, OpenSSL::OpenSSLError]
-  def self.handle_connection_error(error, verifier, host)
-    # can be nil
-    peer_cert = verifier.peer_certs.last
-
-    if error.message.include? "certificate verify failed"
-      msg = error.message
-      msg << ": [" + verifier.verify_errors.join('; ') + "]"
-      raise Puppet::Error, msg, error.backtrace
-    elsif peer_cert && !OpenSSL::SSL.verify_certificate_identity(peer_cert, host)
-      raise Puppet::SSL::CertMismatchError.new(peer_cert, host)
-    else
-      raise error
-    end
-  end
-end