summaryrefslogtreecommitdiffstats
path: root/lib/puppet/network
Commit message (Collapse)AuthorAgeFilesLines
* Fix #3408 - enable puppetd http compressionBrice Figureau2010-02-171-0/+112
| | | | | | | | | | | | | | | | | | | | | | | This patch adds HTTP response decompression (both gzip and deflate streams). This feature is disabled by default, and enabled with --http_compression. This feature can be activated only if the local ruby version supports the zlib ruby extension. HTTP response decompression is active for all REST communications and file sourcing. To enable http compression on the server side, it is needed to use a reverse proxy like Apache or Nginx with adhoc configuration: Nginx: gzip on; gzip_types text/pson text/json text/marshall text/yaml application/x-raw text/plain; Apache: LoadModule deflate_module /usr/lib/apache2/modules/mod_deflate.so AddOutputFilterByType DEFLATE text/plain text/pson text/json text/marshall text/yaml application/x-raw Signed-off-by: Brice Figureau <brice-puppet@daysofwonder.com>
* Add master side file content streamingBrice Figureau2010-02-173-4/+39
| | | | | | | | | This patch allows the puppetmaster to serve file chunks by chunks without ever reading the file content in RAM. This allows serving large files directly with the master without impacting the master memory footprint. Signed-off-by: Brice Figureau <brice-puppet@daysofwonder.com>
* WIP - trying to fix #3460Luke Kanies2010-02-171-1/+1
| | | | | | | | Signed-off-by: Luke Kanies <luke@puppetlabs.com> Conflicts: lib/puppet/ssl/host.rb
* Adding #3518 - basic dot format supportLuke Kanies2010-02-171-0/+3
| | | | | | | This allows you to ask for a node's catalog in dot format, for inputting into graphviz et al. Signed-off-by: Luke Kanies <luke@reductivelabs.com>
* Fixed #3672 - Error message on duplicate fileserver mounts incorrectJames Turnbull2010-02-171-2/+2
|
* Partial fix to #2837 - changed warning message to debugJames Turnbull2010-02-171-1/+1
|
* Removing tests for code that was removed in the REST refactorLuke Kanies2010-04-121-38/+0
| | | | Signed-off-by: Luke Kanies <luke@puppetlabs.com>
* The pure-ruby YAML lib doesn't accept parametersJesse Wolfe2010-04-091-1/+1
|
* REST: hide Request objectJesse Wolfe2010-02-171-1/+1
| | | | | | This change to the REST branch restores some sanity by explicitly allowing a destination URL for indirector save() calls, removing a hack that I was using to accomplish this.
* Feature #3394 REST Runner, preparationJesse Wolfe2010-02-171-2/+2
| | | | Rename Puppet::Agent::Runner to Puppet::Run, for consistency
* Feature #3383 Part 2: Remove RAL XMLRPCJesse Wolfe2010-02-171-190/+0
| | | | | | | The XMLRPC interface for RAL resources was broken, and has been completely replaced by the REST interface. Signed-off-by: Jesse Wolfe <jes5199@gmail.com>
* Feature #3383 RAL over RESTJesse Wolfe2010-02-171-0/+1
| | | | | | | | ralsh --host works now, and is using REST. A node running puppetd --listen will allow ralsh to find, search, and modify live resources, via REST. Signed-off-by: Jesse Wolfe <jes5199@gmail.com>
* Feature #3347 REST-ified FileBucketJesse Wolfe2010-02-173-220/+6
| | | | | | | | | | | | | | | | FileBucket Files have been reimplemented as an indirector terminus so that they can be transmitted over REST. The old Network::Client.dipper has been replaced with a compatibility later in FileBucket::Dipper that uses the indirector to access filebucket termini. Slightly revised patch: * No longer allows nil contents in FileBucket outside of initialization * Uses File.exist? instead of the deprecated File.exists? * Tweaks JSON serialization and de-serialization to include "path" Deferred issues: * Feature #3371 "FileBucket should not keep files in memory". * Feature #3372 "Replace FileBucket Dipper with more idiomatic calls"
* Feature #3115 REST-ified status()Jesse Wolfe2010-02-172-1/+10
| | | | | | | | | | | | | | | | | | This patch re-implements the status() remote procedure as a REST interface. A running server returns key-value pairs, currently the only implemented key is "is_alive" which will always be set to true. Some future tool will consume this by: Puppet::Status.indirection.terminus_class = :rest Puppet::Status.find('https://puppet:8140/production/status/default') Now with unit tests. plus fixes a typo. plus integration test and default security setting. plus tests suggested by Brice. Signed-off-by: Jesse Wolfe <jes5199@gmail.com>
* Adding filename extension support to formats.Luke Kanies2010-02-173-2/+10
| | | | | | | | This is toward fixing #1943 - we need the ability to easily convert between file extensions and file formats. Signed-off-by: Luke Kanies <luke@madstop.com>
* Removing Interpreter classLuke Kanies2010-02-171-3/+0
| | | | | | | It's no longer necessary, given the new ResourceTypeCollection class. Signed-off-by: Luke Kanies <luke@reductivelabs.com>
* Merge branch '0.25.x'Markus Roberts2010-02-093-2/+4
|\ | | | | | | | | | | | | | | | | | | Conflicts: lib/puppet/agent.rb lib/puppet/application/puppet.rb lib/puppet/configurer.rb man/man5/puppet.conf.5 spec/integration/defaults.rb spec/unit/configurer.rb
| * Fix #1842 Net::HTTP#enable_post_connection_check doesn't work anymoreJesse Wolfe2010-01-301-2/+0
| | | | | | | | | | | | | | | | | | | | The setting enable_post_connection_check doesn't exist on very many versions of ruby, and on those systems there's no way to disable domain name checking on HTTPS. The recommended work-around is to replace certificates when they have incorrect hostnames. Signed-off-by: Jesse Wolfe <jes5199@gmail.com>
| * Partial reversion of patch for #3088 to fix #3104 (Exception misreported)Markus Roberts2010-01-242-2/+2
| | | | | | | | | | | | | | In my patch for #3088 I made a erroneous assumption about the ruby exception hierarchy and thus missed the fact that Timeout::error descends from both SignalError and Interrupt. This is a partial reversion of the patch for #3088 to let these through so that more useful error messages can be produced.
| * Fix for #3088 (catching Exception also traps SystemExit)Markus Roberts2010-01-242-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | Changing rescues from the default to Exception (to catch errors that don't descend from StandardError) had the unintended consequence of catching (and suppressing) SystemExit. This patch restores the behavior of by reraising the exception. Of the other exceptions that fall through the same crack (NoMemoryError, SignalException, LoadError, Interrupt, NotImplementedError, and ScriptError) this patch also reraises NoMemoryError, SignalException, and Interrupt in the same way and leaves the rest captured.
* | Merge branch '0.25.x'James Turnbull2010-01-139-153/+90
|\| | | | | | | | | | | Conflicts: lib/puppet/ssl/host.rb spec/spec_helper.rb
| * Fix for temporary file security wholeMarkus Roberts2010-01-051-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We create temporary files in /tmp/ with predictable names. These could be used by an attacker to DoS a box by setting a symlink to some other file (say, /etc/shadow) and waiting for us to overwrite it. The minimalistic solution employed by this patch is to wrap all such file writing with a paranoid wrapper that: 1) Check to see if the target exists 2) Issues a warning if it was a symlink 3) Deletes it 4) Waits (0.1 seconds if it was a file, 5 seconds if it was a symlink) 5) Opens the file with EXCL, which will fail if the file has come back. If this succeeds (as it normally will) it has exactly the same semantics as the original code (a must, as we are right at a release boundary). However, under no circumstances will it follow a preexisting symlink (the operating system guarantees this with EXCL) so the danger of an exploit has been converted into the possibility of a failure, with an appropriate warning.
| * Fix for #2967 (RFC-1123 problem and regression on wildcarded domains)Markus Roberts2009-12-241-1/+1
| | | | | | | | | | | | | | | | | | | | The core bug here was a regression introduced by my IPv6 patch. Wildcarded domains are stored as ["com","reductivelabs","*"] but the code in question was assuming it was in normal order. Added tests to prevet recurrence. Signed-off-by: Markus Roberts <Markus@reality.com>
| * Code smell reductionsMarkus Roberts2009-12-231-15/+2
| | | | | | | | | | | | These are a grab-bag of code simplification changes I made in the process of figuring out what was going on with #2881; they should all be absolutely behavior neutral.
| * A slide down the RFC-1123 slope towards MS Windows compatibility and chaosMarkus Roberts2009-12-222-5/+6
| |
| * Adds partial IPv6 support to authstoreMarkus Roberts2009-12-181-5/+11
| | | | | | | | | | | | | | | | This removes some of the IPv4 centricism from authstore's handling of IP addresses. It isn't full IPv6 support (and doesn't even fully handle all the cases within its limited scope, as ruby's IPAddr library does not work with hybrid addresses), but it should simplify adding IPv6 support when the time comes.
| * Fix for #2567 (Authstore does unintended/pointless DNS lookups)Markus Roberts2009-12-181-5/+0
| | | | | | | | | | This patch fixes #2567 by always pre-validating IP addresses with a strict regular expression check before calling IPAddr.new() on them.
| * Enabling steps for #2567 (Authstore does unintended/pointless DNS lookups)Markus Roberts2009-12-181-117/+46
| | | | | | | | | | | | | | | | | | | | This commit refactors the code in authstore to enable a fix for #2567, goes part of the way towards fixing #2708 (DNS/reverse DNS dependence), and is a start on #2623 (authstore needs to be refactored), though it stops short of fully addressing some of the more egregious structural issues ("opaque", ill-placed pattern transformations, etc.). Signed-off-by: Markus Roberts <Markus@reality.com>
| * Fixing 2855 Inadvertent zlib dependencyJesse Wolfe2009-12-161-4/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | Disables the b64_zlib_yaml format if zlib cannot be loaded. I've added a --no-zlib to make it possible to test this on a single machine, but it might also be useful if someone finds themselves failing to connect to a server that doesn't have zlib installed. FactHandler' format is still hard-coded to YAML rather than using facts.class.default_format Signed-off-by: Jesse Wolfe <jes5199@gmail.com>
| * 2877 race condition in webrickJesse Wolfe2009-12-151-1/+2
| | | | | | | | | | | | | | Make sure that we don't try to do anything to webrick until it has really started. Signed-off-by: Jesse Wolfe <jes5199@gmail.com>
| * Fixing 2886: Failing specs in format_handlerJesse Wolfe2009-12-031-2/+10
| | | | | | | | | | | | | | Clean up warning messages so that they don't fail when run inside the test class. Signed-off-by: Jesse Wolfe <jes5199@gmail.com>
| * Fixing 2725 Error message when permissions incorrect on file server directoryJesse Wolfe2009-12-021-0/+1
| | | | | | | | | | | | | | No message was being displayed on the server if a file could not be opened by the file server. Signed-off-by: Jesse Wolfe <jes5199@gmail.com>
| * 2842 Format debugging should be removedJesse Wolfe2009-12-022-14/+8
| | | | | | | | | | | | | | | | | | Replace this message that looks like an error debug: Format s not supported for Puppet::FileServing::Metadata; has not implemented method 'from_s' with debug: file_metadata supports formats: b64_zlib_yaml marshal pson raw yaml; using pson Signed-off-by: Jesse Wolfe <jes5199@gmail.com>
* | Merge branch '0.25.x'Luke Kanies2009-12-217-30/+66
|\| | | | | | | | | | | | | | | Conflicts: lib/puppet/agent.rb lib/puppet/application/puppetd.rb lib/puppet/parser/ast/leaf.rb lib/puppet/util/rdoc/parser.rb
| * rack: SSL Env vars can only be in Request.envChristian Hofstaedtler2009-11-183-26/+8
| | | | | | | | | | | | | | | | This reverts commit c702f76b271515e9c42dcb923d379fbfac4c83cd and turns it into a documentation only fix. As it turns out, ENV should have never been used at all, as the Rack docs say nothing about it *and* Passenger's behaviour in 2.2.3 + 2.2.4 was completely broken and still is half-way broken in 2.2.5 (but is OK with the Rack specs).
| * Fix #2671, preferred_serialization_format does not complain about invalid valuesBruce Williams2009-11-171-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | This modifies `supported_formats` to warn when the `preferred_serialization_format` setting is invalid (and ignored in favor of the default value). I built the tests for this behavior alongside the existing FormatHandler tests for *valid* `preferred_serialization_format` values (and did some restructuring to extract common setup code to `before` blocks). Signed-off-by: Bruce Williams <bruce@codefluency.com>
| * Fix #2753 - Do not "global allow" plugins/modules mount if some rules have ↵Brice Figureau2009-10-271-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | been parsed When fixing #2424, we were adding a global allow (ie allow(*)) to the plugins/modules mount. Unfortunately global allow always win against any other rules that can be defined in fileserver.conf. This patch makes sure we add those global allow entries only if we didn't get any rules from fileserver.conf Signed-off-by: Brice Figureau <brice-puppet@daysofwonder.com>
| * Re-fixed #2750 - Stop disabling the CRL or checking for a disabled CRLJohn A. Barbuto2009-10-271-4/+1
| | | | | | | | | | | | This was deprecated in commit 1cfb0215 and was keeping puppetd from starting in listen mode. Signed-off-by: John A. Barbuto <jbarbuto@corp.sourceforge.com>
| * Workaround #2668 - Compress facts so that the request size limit triggers ↵Brice Figureau2009-10-251-0/+50
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | less often This is not the right fix, but more a hackish workaround. Since 0.25, the facts are transmitted as GET parameters when a node asks for a catalog. Most proxies or webserver have a size limit which is sometimes reached. In this case the request is denied and the node can't get its catalog. The idea is to compress facts (some non-scientific studies show a 57% fact size decrease for an average node) when transmitting those when asking for a catalog. Signed-off-by: Brice Figureau <brice-puppet@daysofwonder.com>
* | Always using the CA_name constant instead of "ca"Luke Kanies2009-11-201-1/+1
|/ | | | Signed-off-by: Luke Kanies <luke@madstop.com>
* Bundling of pure ruby json lib as "pson"Markus Roberts2009-10-171-9/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Bundeling and renaming the pure ruby json library to addresses a number of cross version serliaization bugs (#2615, et al). This patch adds a subset of the files from the json_pure gem to lib/puppet/external/pson (renamed to avoid conflicts with rails) so that we will always have a known-good erialization format available. The pure ruby json gem as distibuted defers to the compiled version if it is installed. This is problematic in some circumstances so the files that have been brought over have been modified to always and only use the bundled version. It's a large patch, so here's a breakdown of the change categories: The majority of the lines are only marginally interesting: * The json lib itself (in lib/puppet/external/pson) make up the bulk of the lines. * Renaming of json to pson make up the second largest group. Somewhat more interesting are the following, which can be located by searching the diffs for the indicated strings: * Adjusting tests to reflect the changes * Changing the encoding/decoding behavior so that nested structures (e.g. resources) don't serialize as escaped strings. This should make it much easier to process the results with external tools, if needed. Search for "to_pson" and "to_pson_data_hash" * Cleaning up the envelope/metadata * Now provides a document_type (as opposed to a ruby class name) by using a symple registration scheme instead of constant lookup (search for "document_type") * Added an api_version (search for "api_version") * Added a hash for document metadata (search for "metadata") * Removing the yaml monkeypatch and instead disabling yaml serialization on ruby 1.8.1 in favor of pson (search for "yaml") * Cleaning up the json/rails feature interaction (they're now totally independent) (search for "feature")
* Fix for #2637 (Webrick accpting connections on dead sockets)Markus Roberts2009-09-151-1/+8
| | | | | | | | | | There was a race condition between the layers (SSL vs. TCP/IP) that permitted the creation of non-functional connections when webrick managed the connection. This patch moves the responsibility into our code via the provided callbacks and makes sure the socket is valid before accepting the connection. Signed-off-by: Markus Roberts <Markus@reality.com>
* Fix for #2600 (wrong number of arguments under older mongrel)Markus Roberts2009-09-152-14/+12
| | | | | | | | | | | | | | | | | | This was an API compatibility problem with mongrel's HTTPResponse.start() method between Mongrel 1.0.x and 1.1.x (the number of parameters changed). The older version does not provide the option to set the response header message which was used (redundantly with the response body) to return the error message when the HTTP response was signaling an error. In order to suport the older version the call was wrapped with a fallback and the coresponding code in the other rest implementations was adjusted to always send the error message in the response body. Then the rest terminus was adjusted to pull the message from the response body (if it is present) rather than from the header (which is only used as a fallback for dealing with older puppetmasters), and the tests were augmeted to verify this behaviour. Signed-off-by: Markus Roberts <Markus@reality.com>
* Fixs #2620 authconf interpolation, #2570 0-9 in domain namesMarkus Roberts2009-09-141-53/+29
| | | | | | | | | | | | | | Partial refactoring to clean up the case in the ticket (host name containing dots, begining and ending with a digit, was mistaken for an IP address) and a range of related edge cases. Stopped short of a full refactoring (put off to 0.26 as #2623) Added tests for numerous edge cases. This also fixes the issue raised in #2570. Signed-off-by: Markus Roberts <Markus@reality.com>
* Fix for #2531; adds tests to confirm problem and related cases,Markus Roberts2009-08-181-1/+3
| | | | | | | notes fixes specific issue by eliminating the specal case for opaque strings which caused them to be strings when everything else was arrays; adds nots and pending tests where FQDN support could be added but stops short of a full refactor.
* Fix #2517 - Stack overflow when CA cert missingMarkus Roberts2009-08-131-7/+3
| | | | | | | | | | | | | | This was a "There's A Hole In The Bucket" problem caused when trying to establish a connection to get a certificate before there was a certificate with which to establish the connection, ad infinitum. The solution was to test for the presence of the CA cert as well as the host cert before attempting to use them. This patch modifies existing tests to pass with the new code (by stubbing out the additional FileTests) and adds a new test which catches the original problem. Signed-off-by: Markus Roberts <Markus@reality.com>
* Fix #2516 - Fix format detection when content-type contains charsetBrice Figureau2009-08-132-1/+4
| | | | | | | | | | | | | | | | | | Even though Puppet never transmist a charset information in its response/request content-type, some proxy (especially Apache with the infamous AddDefaultCharset configuration) may add this "incorrect" information. This patch makes sure that only the mime-type is used when looking for the format associated with a response or a request. The patch also provides a better error message when the client or server code is fed with a request whose mime-type can not be mapped to a known format. It also fixes a typo noticed by the original reporter. Signed-off-by: Brice Figureau <brice-puppet@daysofwonder.com>
* Fixing #2484 - "format missing" messages are betterLuke Kanies2009-08-041-2/+2
| | | | Signed-off-by: Luke Kanies <luke@madstop.com>
* rack: SSL Env vars can be in Request.env or ENVChristian Hofstaedtler2009-08-033-8/+26
| | | | | | | Fix #2386, by checking either Request.env or ENV for the SSL environment variables. This is necessary as Passenger 2.2.3 changed the location of these vars, even though the Rack spec says nothing about ENV or these variables.
* rack: don't directly use the forbidden HTTP_CONTENT_TYPE env var (fixes rack ↵Christian Hofstaedtler2009-08-031-1/+1
| | | | specification conformance)
generated by cgit (git 2.34.1) at 2025-09-27 08:12:29 +0000