summaryrefslogtreecommitdiffstats
path: root/lib/puppet/network
Commit message (Collapse)AuthorAgeFilesLines
...
* Fix #1875 - Add a REST authorization systemBrice Figureau2009-04-233-1/+128
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch introduces a new configuration file (and configuration setting to set it). Each REST request is checked against this configuration file, and is either allowed or denied. The configuration file has the following format: path /uripath method <methods> allow <ip> or <name> deny <ip> or <name> or path ~ <regex> method <methods> allow <ip> or <name> deny <ip> or <name> where regex is a ruby regex. This last syntax allows deny/allow interpolation from the regex captures: path ~ /files[^/]+/files/([^/]+)/([^/])/ method find allow $2.$1 If you arrange your files/ directory to have files in 'domain.com/host/', then only the referenced host will be able to access their files, other hosts will be denied. For instance: files/reductivelabs.com/dns/... files/reductivelabs.com/www/... then only files in dns can be accessible by dns.reductivelabs.com and so on... If the auth.conf file doesn't exist puppet uses sane defaults that allows clients to check-in and ask for their configurations... Signed-off-by: Brice Figureau <brice-puppet@daysofwonder.com>
* Enhance authconfig format to support uri paths and regexBrice Figureau2009-04-232-64/+220
| | | | | | | | | | | | | | | | | | | | | This patch introduces a new set of directive to the authconfig parser/file format: path /uripath or patch ~ <regex> This directive declares a new kind of ACL based on the uri path. method save, find This directive which is to be used under path directive restricts a path ACL to only some REST verbs. The ACL path system matches on path prefix possible, or on regex matches (first match wins). If no path are matching, then the authorization is not allowed. The same if no ACL matches for the given REST verb. The old namespace right matching still works as usual. Signed-off-by: Brice Figureau <brice-puppet@daysofwonder.com>
* Add dynamic authorization to authstoreBrice Figureau2009-04-231-1/+40
| | | | | | | | | | | | | | | | | | | | | | The idea is to have allow/deny authorization directives that are dynamic: their evaluation is deferred until we perform the authorization checking in allowed?. This is done to allow replacing backreferences in allow/deny directives by parameters of the match that selected this right. For instance, it is possible to: allow $1.$2 And using Right::interpolate() with the result of a regex match using 2 captures, will evaluate $1.$2 to those captures. For instance, if we captured [host, reductivelabs.com], then the allow directive is replaced by: allow host.reductivelabs.com It is then safe to call allowed?, after which we can reset the interpolation. This interpolation is thread-safe. Signed-off-by: Brice Figureau <brice-puppet@daysofwonder.com> authconfig regex support
* Adding support for specifying a preferred serialization formatLuke Kanies2009-04-221-1/+14
| | | | | | | | | | This isn't that great, but at least it provides basic tuning of the format. Also removing the catalog_format default, since it's no longer used. Signed-off-by: Luke Kanies <luke@madstop.com>
* Switching to Indirected ActiveRecordLuke Kanies2009-04-221-0/+1
| | | | | | | | | | | This is mostly a configuration change, with some code getting removed. Also adding an extra require in Format; Puppet::Provider requires Puppet::Provider::Confiner, so the constant lookup is weird. Signed-off-by: Luke Kanies <luke@madstop.com>
* Fix #2101 - fix failing testBrice Figureau2009-03-271-1/+5
| | | | | | | | This code hasn't been modified since the introduction of the fileset recurselimit parameter. Tests depending on this code were failing. Signed-off-by: Brice Figureau <brice-puppet@daysofwonder.com>
* Forbidding REST clients to set the node or IPLuke Kanies2009-03-201-1/+7
| | | | | | | | This is done for security reasons - if a client is unauthenticated, we don't want them to be able to just configure their own authentication information. Signed-off-by: Luke Kanies <luke@madstop.com>
* Fixing #1557 - Environments are now in REST URIsLuke Kanies2009-03-206-55/+26
| | | | | | | | | | | | | | | | | | This commit includes multiple, related changes, all in one commit because the whole thing was necessary to reach a functional tree again: * The URI starts with the environment, so: /production/certificate/foo /development/file_content/path/to/your/file * All REST handling is done by a single instance mounted at / for webrick and Mongrel, rather than having individual instances mounted at, say, /certificate. * All REST URI translation is done by an API module. Currently only the 'v1' module exists with no support for additional modules, but it's well-separated and will be easy to expand as we need it. Signed-off-by: Luke Kanies <luke@madstop.com>
* Moving the REST API functions into a moduleLuke Kanies2009-03-203-57/+68
| | | | | | | | | | | | | This module is now used by the client and server side, rather than having a Handler module that's 90% server functionality but also used by the client. While we don't automatically get api choice from this, it at least provides a pattern for how we'll handle API development over time. Signed-off-by: Luke Kanies <luke@madstop.com>
* Using the Handler for the REST api on both sides of the connectionLuke Kanies2009-03-201-47/+35
| | | | | | | | | | Things are actually in a broken state here because we've got a conflict between how the two sides do their work and some extraction needs to get done. This commit is just a stopping-point so I can do the necessary refactoring. Signed-off-by: Luke Kanies <luke@madstop.com>
* Adding REST::Handler methods for converting between indirection and urisLuke Kanies2009-03-201-0/+46
| | | | | | | | | | This is the first main phase to having a common module for handling the REST api - this Handler module will be included by all of the web server REST modules and the Indirector Request class, so there's a common place that understands how the URI consists. Signed-off-by: Luke Kanies <luke@madstop.com>
* Correctly handling numerical REST argumentsLuke Kanies2009-03-101-0/+2
| | | | Signed-off-by: Luke Kanies <luke@madstop.com>
* Fixed #1849 - Ruby 1.9 portability: `when' doesn't like colons, replace with ↵James Turnbull2009-02-266-27/+27
| | | | semicolons
* Correctly handling URI escaping throughout the REST processLuke Kanies2009-02-191-0/+3
| | | | | | | | | | This means, at the least, that we can now serve files via REST when they have spaces and other weird characters in their names. This involves a small change to many files. Signed-off-by: Luke Kanies <luke@madstop.com>
* Migrating the old FileServer to the new Module/Environment codeLuke Kanies2009-02-191-12/+13
| | | | | | | The interface is *much* cleaner, and I'd removed one of the methods used in this code. Signed-off-by: Luke Kanies <luke@madstop.com>
* Adding clarity to query string handling in REST callsLuke Kanies2009-02-183-1/+19
| | | | | | | | | | | | We previously only handled simple strings as values, but we know handle true and false as booleans, we URI-escape all strings, and we can yaml-encode and then escape arrays of strings. This could get abused a bit, in that we're just yaml-dumping anything that's an array, but it should be pretty safe. Mmmm, should. Signed-off-by: Luke Kanies <luke@madstop.com>
* Providing better information when an exception is encountered during network ↵Luke Kanies2009-02-181-1/+1
| | | | | | communication Signed-off-by: Luke Kanies <luke@madstop.com>
* Merge branch '0.24.x'Luke Kanies2009-02-131-53/+113
|\ | | | | | | | | | | | | | | | | | | Conflicts: lib/puppet/indirector/facts/facter.rb lib/puppet/provider/augeas/augeas.rb lib/puppet/util/filetype.rb spec/unit/indirector/facts/facter.rb spec/unit/provider/augeas/augeas.rb test/util/filetype.rb
| * Fixing #961 - closing the http connection after every xmlrpc callLuke Kanies2009-02-121-1/+3
| | | | | | | | | | | | | | | | There were apparently some circumstances that resulted in the connection not being closed; this just closes it every time if it's still open after the rpc call is complete. Signed-off-by: Luke Kanies <luke@madstop.com>
| * Refactoring the XMLRPC::Client error-handlingLuke Kanies2009-02-121-53/+111
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | I split it all into smaller, manageable chunks, and used methods for each step, instead of having one huge call. Note that I made all of the tests first, then refactored the code, so I'm confident there's no behavior change. I don't know that this is actually a lot cleaner, but it seems that way to me. I'm open to skipping this, but I think it makes the whole thing a lot cleaner. Signed-off-by: Luke Kanies <luke@madstop.com>
* | Adding an Agent::Runner class.Luke Kanies2009-02-061-42/+9
| | | | | | | | | | | | | | This will eventually be used by puppetrun, but for now is just called by the old-school Runner handler. Signed-off-by: Luke Kanies <luke@madstop.com>
* | Creating and using a new Puppet::Daemon classLuke Kanies2009-02-062-4/+0
| | | | | | | | | | | | | | | | | | | | | | | | This replaces the short-lived EventManager class, all of the service- and timer-related code in puppet.rb, and moves code from agent.rb, server.rb, and other places into one class responsible for starting, stopping, pids, and more. The Daemon module is no longer in existence, so it's been removed from the classes that were using it. Signed-off-by: Luke Kanies <luke@madstop.com>
* | Not using 'master' client for testingLuke Kanies2009-02-061-2/+0
| | | | | | | | | | | | | | That class is gone, so until the Client class is no longer necessary, using a different class. Signed-off-by: Luke Kanies <luke@madstop.com>
* | Adding better error-handling to format renderingLuke Kanies2009-02-061-4/+39
| | | | | | | | | | | | | | We now always get the format name and the method that failed. Signed-off-by: Luke Kanies <luke@madstop.com>
* | Renmaing Puppet::Network::Client::Master to Puppet::AgentLuke Kanies2009-02-061-523/+0
| | | | | | | | | | | | | | | | | | Made minor changes, including removing the parent class. The functionality hasn't changed yet -- that comes in later patches -- but all but a couple of the older tests pass. Signed-off-by: Luke Kanies <luke@madstop.com>
* | Fixing #1729 - puppetmasterd can now read certs at startupLuke Kanies2008-12-182-4/+7
| | | | | | | | | | | | | | | | | | | | The main aspect of this solution is to create a site-wide Puppet::SSL::Host instance to cache ssl key and certificate, so that by the time we've switched UIDs, we've got the key and cert in memory. Then webrick just uses that, rather than creating a new Host instance. Signed-off-by: Luke Kanies <luke@madstop.com>
* | Deprecating the Puppet::Type.create.Luke Kanies2008-12-182-2/+2
| | | | | | | | | | | | | | This method is no longer necessary; you can use the normal 'new' class method. Signed-off-by: Luke Kanies <luke@madstop.com>
* | Deprecating 'Puppet.type'; replacing all instances with Puppet::Type.typeLuke Kanies2008-12-182-3/+3
| | | | | | | | Signed-off-by: Luke Kanies <luke@madstop.com>
* | Renaming Puppet::Node::Catalog to Puppet::Resource::CatalogLuke Kanies2008-12-182-2/+2
| | | | | | | | Signed-off-by: Luke Kanies <luke@madstop.com>
* | Merge branch '0.24.x'Luke Kanies2008-12-022-2/+4
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Conflicts: bin/puppetca lib/puppet/type/group.rb lib/puppet/type/tidy.rb lib/puppet/util/settings.rb Also edited the following files so tests will pass: lib/puppet/type/component.rb spec/unit/ssl/certificate_request.rb spec/unit/type/computer.rb spec/unit/type/mcx.rb spec/unit/type/resources.rb spec/unit/util/settings.rb spec/unit/util/storage.rb test/ral/type/zone.rb
| * Fixing splaytime testsLuke Kanies2008-12-011-1/+1
| | | | | | | | Signed-off-by: Luke Kanies <luke@madstop.com>
| * Fixing #1749 - Splay now hopefully behaves "better" for small values.Luke Kanies2008-12-011-1/+1
| | | | | | | | Signed-off-by: Luke Kanies <luke@madstop.com>
| * Removing the included testing gems; you must now install them yourself.Luke Kanies2008-11-251-1/+3
| | | | | | | | | | | | Everything passes, but autotest doesn't include color. Signed-off-by: Luke Kanies <luke@madstop.com>
* | Refactoring the Cacher interface to always require attribute declaration.Luke Kanies2008-11-111-14/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Previously you could dynamically use cached values, but the new interface requires a single static declaration of the attribute: cached_attr(:myattr) { my_init_code() } This is cleaner, because it makes it easy to turn the code into an init method and generally makes the whole thing easier to think about. Most of this commit is going through the different classes that already using the Caching engine. Signed-off-by: Luke Kanies <luke@madstop.com>
* | Changing the Cacher.invalidate method to Cacher.expire.Luke Kanies2008-11-111-1/+1
| | | | | | | | Signed-off-by: Luke Kanies <luke@madstop.com>
* | Merge branch '0.24.x' Removed the 'after' blocks that call Type.clear,Luke Kanies2008-10-174-52/+191
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | since that method is deprecated. Conflicts: CHANGELOG bin/puppetca lib/puppet/file_serving/fileset.rb lib/puppet/network/xmlrpc/client.rb lib/puppet/type/file/selcontext.rb spec/unit/file_serving/metadata.rb spec/unit/type/file.rb
| * Fixing the broken tests resulting from the fix for #1551.Luke Kanies2008-10-081-1/+1
| | | | | | | | | | | | The test was expecting the current time, albeit as an integer. Signed-off-by: Luke Kanies <luke@madstop.com>
| * Fix #1636 - part2 - correct some client errors.Brice Figureau2008-10-091-3/+7
| | | | | | | | | | | | | | | | | | #1636 original patch was incomplete, and on some cases, the client could report: "Failed to generate additional resources during transaction: None of the provided sources exist" The server was trying to recurse when asking to list files and thus was returning an empty response instead of a "file" response.
| * Fix several small regressions in plugins mountBrice Figureau2008-10-091-5/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Since a30ecf2aeffd71960bd806fb28cd6d1b8adc2452, reclist has one parameter less, but Puppet::Network::Handler::PluginMount.list wasn't ported to the new API. While mounting plugins, reclist wasn't requiring 'file_serving/fileset', leading to an NameError. The change to the new API meant that we lost the existance test of plugins mount directory. It was failing when the client was mounting module plugins that weren't existing (like facter and no custom facts defined). Signed-off-by: Brice Figureau <brice-puppet@daysofwonder.com>
| * Fixed #1473 - Rescue Timeout::Error in xmlrpc clientsAndrew Shafer2008-10-071-4/+4
| | | | | | | | | | Added a rescue block for Timeout::Error (which isn't a subclass of StandardError) Removed a Dev Error conditional to facilitate testing
| * Fixing #947 - pluginsync no longer fails poorly when no plugins existLuke Kanies2008-10-031-2/+4
| | | | | | | | | | | | Note that it still fails -- it's just a more reasonable failure. Signed-off-by: Luke Kanies <luke@madstop.com>
| * Fixed error message typoJames Turnbull2008-10-031-1/+1
| |
| * Fixed #1603 - Added support for running Puppet inside a Rack applicationJames Turnbull2008-09-301-0/+148
| |
| * Make fileserver use fileset for recursion and handle dangling links by ↵Paul Nasrat2008-09-301-41/+24
| | | | | | | | ignoring them fixing #1544
* | Merge branch 'feature/master/1481'Luke Kanies2008-09-237-8/+51
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This merges in the new fileserving code -- we're now using REST to do fileserving, rather than xmlrpc. Conflicts: lib/puppet/parameter.rb lib/puppet/type/file.rb spec/unit/type/file.rb
| * | Adding automatic attribute collection to the new fileserving code.Luke Kanies2008-08-261-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Basically, this just includes a consistent method for collecting info (either content or metadata) and then calls that method when returning instances via the indirector. It's such a large commit mostly because of small changes in the normal code and large changes in the testing to accomodate those small changes. Signed-off-by: Luke Kanies <luke@madstop.com>
| * | Causing format selection to fail intelligently if no suitable format can be ↵Luke Kanies2008-08-261-1/+12
| | | | | | | | | | | | | | | | | | picked. Signed-off-by: Luke Kanies <luke@madstop.com>
| * | Fixing the rest backends for webrick and mongrel so the get the whole ↵Luke Kanies2008-08-262-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | request key. Also adding the Content work necessary to demonstrate that this is actually required. Signed-off-by: Luke Kanies <luke@madstop.com>
| * | Adding weights to network formats, and sorting them based on the weight.Luke Kanies2008-08-263-3/+14
| | | | | | | | | | | | | | | | | | | | | This way the new hackish RAW format will only ever be used if it's specifically chosen. Signed-off-by: Luke Kanies <luke@madstop.com>
| * | Adding a hackish raw format.Luke Kanies2008-08-261-1/+21
| | | | | | | | | | | | | | | | | | | | | | | | | | | As the comment in the file says, we don't really have enough data to know what a good design would look like, and I think this format will be a bit of a one-off, so I'm just throwing up some barriers to keep people from doing silly things with it. Signed-off-by: Luke Kanies <luke@madstop.com>
generated by cgit (git 2.34.1) at 2026-01-07 13:31:51 +0000