summaryrefslogtreecommitdiffstats
path: root/lib/puppet
Commit message (Collapse)AuthorAgeFilesLines
...
* Unify auth/unauthenticated request authorization systemBrice Figureau2009-04-232-37/+28
| | | | | | | | | | | | | Before this change, unauthenticated REST requests where inconditionnaly allowed, as long as they were to the certificate terminus. This could be a security hole, so now the REST requests, authenticated or unauthenticated are all submitted to the REST authorization layer. The default authorizations now contains directives to allow unauthenticated requests to the various certificate terminus to allow new hosts. The conf/auth.conf file has been modified to match such defaults. Signed-off-by: Brice Figureau <brice-puppet@daysofwonder.com>
* Allow REST auth system to restrict an ACL to authenticated or ↵Brice Figureau2009-04-232-7/+30
| | | | | | | | | | | | | unauthenticated request Introduces a new auth.conf directive (auth or authenticated) which takes an argument (on,yes/off,no/all,any). This can be used to restrict an ACL to only some state of authentication of a REST request, or any. If no auth directive is given, the ACL will only trigger for authenticated requests. Signed-off-by: Brice Figureau <brice-puppet@daysofwonder.com>
* Fill REST request node with reverse lookup of IP addressBrice Figureau2009-04-233-0/+16
| | | | Signed-off-by: Brice Figureau <brice-puppet@daysofwonder.com>
* Refactor rest authorization to raise exceptions deeperBrice Figureau2009-04-235-56/+94
| | | | | | | | | | | | | The idea is to raise an AuthorizationException at the same place we check the authorization instead of in an upper level to be able to spot where the authorization took place in the exception backtrace. Moreover, this changes also makes Rights::allowed? to return the matching acl so that the upper layer can have a chance to report which ACL resulted in the match. Signed-off-by: Brice Figureau <brice-puppet@daysofwonder.com>
* Add environment support in the REST authorization layerBrice Figureau2009-04-233-16/+23
| | | | | | | | | With the help of the new auth.conf directive 'environment', any ACL can now be restricted to a specific environment. Omission of the directive means that the ACL will apply to all the defined environment. Signed-off-by: Brice Figureau <brice-puppet@daysofwonder.com>
* Fix #1875 - Add a REST authorization systemBrice Figureau2009-04-234-1/+133
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch introduces a new configuration file (and configuration setting to set it). Each REST request is checked against this configuration file, and is either allowed or denied. The configuration file has the following format: path /uripath method <methods> allow <ip> or <name> deny <ip> or <name> or path ~ <regex> method <methods> allow <ip> or <name> deny <ip> or <name> where regex is a ruby regex. This last syntax allows deny/allow interpolation from the regex captures: path ~ /files[^/]+/files/([^/]+)/([^/])/ method find allow $2.$1 If you arrange your files/ directory to have files in 'domain.com/host/', then only the referenced host will be able to access their files, other hosts will be denied. For instance: files/reductivelabs.com/dns/... files/reductivelabs.com/www/... then only files in dns can be accessible by dns.reductivelabs.com and so on... If the auth.conf file doesn't exist puppet uses sane defaults that allows clients to check-in and ask for their configurations... Signed-off-by: Brice Figureau <brice-puppet@daysofwonder.com>
* Enhance authconfig format to support uri paths and regexBrice Figureau2009-04-232-64/+220
| | | | | | | | | | | | | | | | | | | | | This patch introduces a new set of directive to the authconfig parser/file format: path /uripath or patch ~ <regex> This directive declares a new kind of ACL based on the uri path. method save, find This directive which is to be used under path directive restricts a path ACL to only some REST verbs. The ACL path system matches on path prefix possible, or on regex matches (first match wins). If no path are matching, then the authorization is not allowed. The same if no ACL matches for the given REST verb. The old namespace right matching still works as usual. Signed-off-by: Brice Figureau <brice-puppet@daysofwonder.com>
* Add dynamic authorization to authstoreBrice Figureau2009-04-231-1/+40
| | | | | | | | | | | | | | | | | | | | | | The idea is to have allow/deny authorization directives that are dynamic: their evaluation is deferred until we perform the authorization checking in allowed?. This is done to allow replacing backreferences in allow/deny directives by parameters of the match that selected this right. For instance, it is possible to: allow $1.$2 And using Right::interpolate() with the result of a regex match using 2 captures, will evaluate $1.$2 to those captures. For instance, if we captured [host, reductivelabs.com], then the allow directive is replaced by: allow host.reductivelabs.com It is then safe to call allowed?, after which we can reset the interpolation. This interpolation is thread-safe. Signed-off-by: Brice Figureau <brice-puppet@daysofwonder.com> authconfig regex support
* Adding support for specifying a preferred serialization formatLuke Kanies2009-04-222-4/+19
| | | | | | | | | | This isn't that great, but at least it provides basic tuning of the format. Also removing the catalog_format default, since it's no longer used. Signed-off-by: Luke Kanies <luke@madstop.com>
* Fixing #2149 - Facts are passed as part of the catalog requestLuke Kanies2009-04-224-18/+56
| | | | | | | | | | | | | | | This removes the requirement of shared fact caching on the servers, since the server responding to the catalog request will receive the facts as part of the request. The facts are serialized as a parameter to the request, rather than each being set as a separate request parameter. This hard-codes yaml as the serialization format for the facts, because I couldn't get marshal to work and it's just not as big a deal for such a small amount of data. Signed-off-by: Luke Kanies <luke@madstop.com>
* Fixing #2182 - SimpleGraph#walk is now iterativeLuke Kanies2009-04-221-4/+15
| | | | | | | | It was previously recursive, and was causing significant performance problems for large, wide graphs. Signed-off-by: Luke Kanies <luke@madstop.com>
* Fixing #2181 - Using Sets instead of Arrays in SimpleGraphLuke Kanies2009-04-221-10/+10
| | | | | | This can cause a huge speedup for large numbers of edges. Signed-off-by: Luke Kanies <luke@madstop.com>
* Removing code that was backported and is now not neededLuke Kanies2009-04-221-49/+0
| | | | Signed-off-by: Luke Kanies <luke@madstop.com>
* Finishing class renamesLuke Kanies2009-04-221-2/+2
| | | | | | | | | | I missed some of the Catalog mentions, and its constant changed. I've also added tests so this will get caught next time. Signed-off-by: Luke Kanies <luke@madstop.com>
* Added class_name tags to has_many relationshipssteve mcintosh2009-04-221-3/+3
|
* Adding time debugging for catalog storage to active_recordLuke Kanies2009-04-221-3/+5
| | | | Signed-off-by: Luke Kanies <luke@madstop.com>
* Adding defaults necessary for queueingLuke Kanies2009-04-221-2/+19
| | | | These are all of the defaults needed to configure queueing.
* Adding daemonization to puppetqdLuke Kanies2009-04-221-1/+17
| | | | | | | | This will need to be modified on the merge into 0.25, because the daemon module becomes a class, but that should be easy enough. Signed-off-by: Luke Kanies <luke@madstop.com>
* Using a setting for configuring queueingLuke Kanies2009-04-223-12/+6
| | | | | | | Removing class methods and such, and switching to relying solely on a setting for the queue configuration. Signed-off-by: Luke Kanies <luke@madstop.com>
* Adding puppetqd executable.Luke Kanies2009-04-221-0/+107
| | | | | | | | This uses the backported Application class, with a couple of backported monkey-patches so the class works as expected but in 0.24. Signed-off-by: Luke Kanies <luke@madstop.com>
* Adding "rubygems" and "stomp" featuresLuke Kanies2009-04-222-0/+12
| | | | Signed-off-by: Luke Kanies <luke@madstop.com>
* Removing unnecessary parser variables when yaml-dumpingLuke Kanies2009-04-226-6/+27
| | | | | | | | | Also working around a YAML bug in Ruby. And fixing tests that were broken in a previous commit in this rebase but not caught earlier. Signed-off-by: Luke Kanies <luke@madstop.com>
* Add queue indirection as an option for catalog storage.Ethan Rowe2009-04-221-0/+5
| | | | | | This eventually will allow catalog storage ("storeconfigs") to be taken out of the critical request-handling path of puppetmasterd, such that: * Puppet::Node::Catalog can be serialized to a message queue via the indirector's "save" method * a separate process can use Puppet::Node::Catalog::Queue.subscribe to pick up these catalog objects as they come in and can save them to the database through the :active_record terminus
* Introduce abstract queue terminus within the indirection system.Ethan Rowe2009-04-221-0/+78
| | | | The queue abstract terminus allows the standard indirector behaviors to interact with a message queue broker, such that the indirector's "save" method writes the relevant model object out to a queue on the message broker. While the indirector's "find" method does not map to a message queue, the queue terminus class offers a "subscribe" method that allows for easy implementation of an event loop, receiving indirected objects saved to a queue as they come in.
* Introduce queue client "plugin" namespace and interface, with a Stomp client ↵Ethan Rowe2009-04-222-0/+132
| | | | | | | | | | | implementation. Puppet::Util::Queue provides queue client mix-in behaviors that enable easy queue client management for consumer classes. Some relevant behaviors include: * standard Puppet instance loader behavior for loading queue client modules on-demand based on the client module specified by symbolic name * singleton registry of known queue client types (based on symbol-to-class mappings from the instance loading behavior) * simple interface for working with an actual queue client instance Puppet::Util::Queue::Stomp wraps the Stomp::Client class to provide an initial queue client option supporting the Stomp messaging protocol. This defines the interface for all Puppet queue client plugins going forward.
* renaming a methodLuke Kanies2009-04-222-10/+10
| | | | Signed-off-by: Luke Kanies <luke@madstop.com>
* Adjusted parameter name and puppet tag classes to use new cache accumulator ↵Ethan Rowe2009-04-222-18/+7
| | | | | | behavior for storeconfigs. Removed per-class implementatiosn of accumulate_by_name from affected classes.
* Initial implementation of a "cache accumulator" behavior.Ethan Rowe2009-04-221-0/+65
| | | | | | | | | | | | | Mix Puppet::Util::CacheAccumulator into an ActiveRecord-like class, and then for any attribute in that class on which you are likely to call find_or_create_by_*, specify: accumulates :foo and instead of :find_or_create_by_foo use :accumulate_by_foo. The class will cache known results keyed by values of :foo. Do an initial bulk-lookup: class.accumulate_by_foo('foo1', 'foo2', 'foo3', 'foo4')
* Saving rails resources as I create them, which saves about 10%Luke Kanies2009-04-221-0/+2
| | | | Signed-off-by: Luke Kanies <luke@madstop.com>
* Changing rails value serialization to deal with booleansLuke Kanies2009-04-221-3/+17
| | | | | | | | The database was automatically converting booleans to strings, and value comparison was not working correctly as a result. Signed-off-by: Luke Kanies <luke@madstop.com>
* Adding equality to ResourceReferenceLuke Kanies2009-04-221-4/+2
| | | | | | | This is used by the Parser subclass when testing equality with db-backed references. Signed-off-by: Luke Kanies <luke@madstop.com>
* Adding some more fine-grained benchmarks to Rails supportLuke Kanies2009-04-222-22/+26
| | | | Signed-off-by: Luke Kanies <luke@madstop.com>
* Adding a Rails-specific benchmarking moduleLuke Kanies2009-04-224-39/+108
| | | | | | | This just slightly simplifies adding lots of time-debug stuff in Rails. Signed-off-by: Luke Kanies <luke@madstop.com>
* Adding simplistic param_name/puppet_tag cachingLuke Kanies2009-04-223-2/+22
| | | | | | | This has a drastic affect on performance - cuts about 25% off of the store time. Signed-off-by: Luke Kanies <luke@madstop.com>
* Adding more time debugging to Rails code, and refactoring a bitLuke Kanies2009-04-222-30/+10
| | | | | | | | There is an accumulation in the resource tags (hackish enough but soon to be replaced), and I've fixed a small bug in the tags merging that was causing lots of extra work (like 3x). Signed-off-by: Luke Kanies <luke@madstop.com>
* Refactoring the Rails integrationLuke Kanies2009-04-228-270/+314
| | | | | | | | This moves all code from the Parser class into the ActiveRecord classes, and gets rid of 'ar_hash_merge'. Signed-off-by: Luke Kanies <luke@madstop.com>
* Adding a common Settings method for setting valuesLuke Kanies2009-04-221-34/+34
| | | | | | | | We were previously missing some hooks for settings set via the command-line, because different code paths were being used. Signed-off-by: Luke Kanies <luke@madstop.com>
* Switching to Indirected ActiveRecordLuke Kanies2009-04-224-41/+20
| | | | | | | | | | | This is mostly a configuration change, with some code getting removed. Also adding an extra require in Format; Puppet::Provider requires Puppet::Provider::Confiner, so the constant lookup is weird. Signed-off-by: Luke Kanies <luke@madstop.com>
* Adding ActiveRecord terminus classes for CatalogLuke Kanies2009-04-221-0/+34
| | | | | | | | This provides the last piece of ActiveRecord integration. It's pretty much just pass-through and *only* works if you're storing Parser resources to the db. Signed-off-by: Luke Kanies <luke@madstop.com>
* Adding ActiveRecord terminus classes for Node and Facts.Luke Kanies2009-04-224-1/+95
| | | | | | | | | This is most of the way to replacing standard StoreConfigs integration with the Indirector. We still need to convert the Catalog and then change all of the integraiton points (which is mostly the 'store' call in the Compiler). Signed-off-by: Luke Kanies <luke@madstop.com>
* Fixing #2180 - Catalogs yaml dump the resource table firstLuke Kanies2009-04-211-0/+14
| | | | | | | | This fixes a ruby bug (http://rubyforge.org/tracker/?group_id=426&atid=1698&func=detail&aid=8886) that otherwise results in yaml producing text it can't read back in. Signed-off-by: Luke Kanies <luke@madstop.com>
* Partially fixing #1765 - node searching supports strict hostname checkingLuke Kanies2009-04-222-1/+8
| | | | | | | | With the new 'strict_hostname_checking' option enabled, the compiler will only search for the literal certificate name in its list of nodes. Signed-off-by: Luke Kanies <luke@madstop.com>
* Removing unused Node codeLuke Kanies2009-04-221-11/+0
| | | | Signed-off-by: Luke Kanies <luke@madstop.com>
* Fixing #1885 - Relationships metaparams do not cascadeLuke Kanies2009-04-221-6/+2
| | | | | | | | | | | | | | | Because we now pass catalogs around, rather than a tree of resources, we no longer lose the metaparam information in definitions and classes. Thus, we no longer need to pass them down to contained resources. Ideally we'd remove cascading of all metaparams (which is ticket #1903) but 'schedule' and 'noop' are inherently recursive but not in a way that the graph support can currently easily solve, so that's going to have to wait for a later release. Signed-off-by: Luke Kanies <luke@madstop.com>
* Fix #2142 - Convert pkgdmg provider to use plists instead of string scanning ↵Nigel Kersten2009-04-221-18/+25
| | | | | | | | | | | | | | for future proofing update pkgdmg patch with feedback from dev-list initial checking of pkgdmg package provider tests clean up fail conditions to raise Puppet::Error instead Finalized tests for pkgdmg provider remove duplicate facter/util/plist require
* Fixing #2171 - All certificate files are written with default permsLuke Kanies2009-04-222-5/+7
| | | | | | | | | | We were already writing all specific files with appropriate permissions; this change makes all of the files that are part of a group (which largely means files saved by puppetmasterd and puppetca) are also written using the correct permissions. Signed-off-by: Luke Kanies <luke@madstop.com>
* Fixing #2112 - Transactions handle conflicting generated resourcesLuke Kanies2009-04-175-39/+16
| | | | | | | | | | This commit rips out all of the 'implicit resource' crap, replacing it with a simple system that just skips resources that the catalog says are in conflict. Removes a bunch of code, and fixes the bug to boot. Signed-off-by: Luke Kanies <luke@madstop.com>
* Adding another stacktrace for debuggingLuke Kanies2009-04-171-0/+1
| | | | Signed-off-by: Luke Kanies <luke@madstop.com>
* Fixing puppet -e; it got broken in the move to ApplicationLuke Kanies2009-04-171-1/+3
| | | | Signed-off-by: Luke Kanies <luke@madstop.com>
* Partially fixing #2029 - failed caches doesn't throw an exceptionLuke Kanies2009-04-171-7/+17
| | | | | | | If the main terminus fails you get an exception, but not if a cache terminus fails. Signed-off-by: Luke Kanies <luke@madstop.com>
generated by cgit (git 2.34.1) at 2025-09-26 00:10:14 +0000