summaryrefslogtreecommitdiffstats
path: root/spec
Commit message (Collapse)AuthorAgeFilesLines
...
* Fixing #2234 - fixing all of the tests broken by my bindaddress fixLuke Kanies2009-05-157-11/+42
| | | | Signed-off-by: Luke Kanies <luke@madstop.com>
* Fixing #2221 - pluginsignore should work againLuke Kanies2009-05-152-1/+25
| | | | | | | | We weren't splitting on whitespace, which is necessary since the settings don't support arrays but files expect them. Signed-off-by: Luke Kanies <luke@madstop.com>
* Fix failing test: file.close! and file.path ordering fixBrice Figureau2009-05-151-1/+2
| | | | | | | | | | | On ruby 1.8.7 file.close! nils the internal file path. So the following pattern: file = temp file.close! file = file.path doesn't work. Signed-off-by: Brice Figureau <brice-puppet@daysofwonder.com>
* Confine stomp tests to Stomp enabled systemsBrice Figureau2009-05-151-0/+4
| | | | Signed-off-by: Brice Figureau <brice-puppet@daysofwonder.com>
* Fix bug #2124 - ssh_authorized_key always changes target if target is not ↵Francois Deppierraz2009-05-151-1/+8
| | | | defined
* Fix #1409 once again, including testFrancois Deppierraz2009-05-061-0/+9
| | | | | | | "user doesn't exit" error appeared once again after the changes which were applied in order to fix #2004. Validation must only check attributes presence, not their value.
* Fixing #2200 - puppetqd expects Daemon to be a classLuke Kanies2009-05-041-0/+185
| | | | | | | | | | | I *swear* I wrote tests for the daemon, but I can't find them in any of my branches so I rewrote them. In the course of writing them, I also fixed the usage of Daemon. Signed-off-by: Luke Kanies <luke@madstop.com>
* Removing unneeded test stubsLuke Kanies2009-05-031-8/+0
| | | | Signed-off-by: Luke Kanies <luke@madstop.com>
* Fixing #2195 - the Server class handles bindaddressLuke Kanies2009-05-032-43/+37
| | | | | | | The Server class has all of the logic now, instead of doing weird things in the defaults. Signed-off-by: Luke Kanies <luke@madstop.com>
* puppetmasterd can now run as a standard Rack application (config.ru-style)Christian Hofstaedtler2009-05-021-0/+41
|
* Add XMLRPC compatibility for RackChristian Hofstaedtler2009-05-022-0/+188
|
* Puppet as a Rack applicationChristian Hofstaedtler2009-05-022-0/+265
| | | | | | | This lays the ground: a wrapper for the REST handler, and an application confirming to the Rack standard. Also includes a base class for Rack handlers, as RackREST will not stay the only one, and there needs to be a central place where client authentication data can be checked.
* Add an unmunge capability to type parameters and propertiesBrice Figureau2009-05-022-0/+26
| | | | | | | | | | | | | Unmunge is the reverse of munge. While munge allows the type to return a different parameter value or properties should than the one it was created with, unmunge does the reverse. It can be used for instance to store a value in a different representation but still be able to return genuine value to the outside world. Signed-off-by: Brice Figureau <brice-puppet@daysofwonder.com>
* Fix #2218 - Ruby YAML bug prevents reloading catalog in puppetdBrice Figureau2009-05-022-4/+21
| | | | | | | | | | | | | | | | | | | Because of ruby bug: http://rubyforge.org/tracker/?group_id=426&atid=1698&func=detail&aid=8886 and http://redmine.ruby-lang.org/issues/show/1331 YAML dump of hashes using ruby objects as keys is incorrect leading to an error when deserializing the YAML in puppetd. The error is easy to correct by a post-process fix-up of the generated YAML, which transforms: &id004 !ruby/object:Puppet::Relationship ? to the correct: ? &id004 !ruby/object:Puppet::Relationship Signed-off-by: Brice Figureau <brice-puppet@daysofwonder.com>
* Fix #2207 - type was doing its own tag management leading to subtile bugsBrice Figureau2009-04-291-0/+26
| | | | | | | | | This patch moves Type to use Puppet::Util::Tagging as the other part of Puppet. This brings uniformity and consistency in the way the tags are used and/or compared to each other. Type was storing tags in Symbol format, which produced #2207. Signed-off-by: Brice Figureau <brice-puppet@daysofwonder.com>
* Fixing #2183 - checksum buffer size is now 4096bLuke Kanies2009-04-241-1/+1
| | | | Signed-off-by: Luke Kanies <luke@madstop.com>
* Fixing #2187 - Puppet::Resource is expected by Rails supportLuke Kanies2009-04-242-0/+91
| | | | | | | | | | | | | We previously used and expected Puppet::Parser::Resource instances, but 0.25 converts them all to Puppet::Resource instances before they're passed out of the compiler, so the Rails integration had to be changed to expect that. There's still some muddling, because the rails resources only generate parser resources, but that works for now because that's what we expect when collecting resources. Signed-off-by: Luke Kanies <luke@madstop.com>
* Adding an 'Exported' attribute to Puppet::ResourceLuke Kanies2009-04-241-0/+7
| | | | | | This is required for Rails support. Signed-off-by: Luke Kanies <luke@madstop.com>
* Making sure the cert name is searched firstLuke Kanies2009-04-241-9/+12
| | | | | | | | | | | The cert name should be searched first in default circumstances, even if it disagrees with the hostname. Brice's change to the way catalogs are searched for didn't quite work when the hostname and certname didn't agree *and* the certname was fully qualified. Signed-off-by: Luke Kanies <luke@madstop.com>
* Removing deprecated concurrency setting usage in railsLuke Kanies2009-04-241-7/+0
| | | | Signed-off-by: Luke Kanies <luke@madstop.com>
* Always making sure graph edges appear firstLuke Kanies2009-04-241-0/+7
| | | | | | | If we don't do this, there's a chance we'll get hit by the ruby yaml bug again. Signed-off-by: Luke Kanies <luke@madstop.com>
* Failing to enable storeconfigs if ActiveRecord isn't availableLuke Kanies2009-04-251-0/+7
| | | | | | This is the last step to fixing #2189. Signed-off-by: Luke Kanies <luke@madstop.com>
* Modifying the Settings#handlearg prototypeLuke Kanies2009-04-251-0/+14
| | | | | | | | I'd made the argument no longer optional because I thought the method was rarely used, but it's used in puppetd a good bit. Signed-off-by: Luke Kanies <luke@madstop.com>
* Fix configurer to retrieve catalog with client certnameBrice Figureau2009-04-231-3/+3
| | | | | | | | | | | | | | | | | Rationale: Before this change, the catalog was retrived with this uri: /catalog/hostname On the server side, the corresponding node was found by using the request node, then finding if this node also match hostname (which it does of course). But it is not possible to have an ACL matching the hostname part of the uri, because it: * it would be compared to the node name (certname), which obviously is not the same * it is not possible to create a dynamic allow/deny rule on a non-fqdn Signed-off-by: Brice Figureau <brice-puppet@daysofwonder.com>
* Unify auth/unauthenticated request authorization systemBrice Figureau2009-04-232-52/+48
| | | | | | | | | | | | | Before this change, unauthenticated REST requests where inconditionnaly allowed, as long as they were to the certificate terminus. This could be a security hole, so now the REST requests, authenticated or unauthenticated are all submitted to the REST authorization layer. The default authorizations now contains directives to allow unauthenticated requests to the various certificate terminus to allow new hosts. The conf/auth.conf file has been modified to match such defaults. Signed-off-by: Brice Figureau <brice-puppet@daysofwonder.com>
* Allow REST auth system to restrict an ACL to authenticated or ↵Brice Figureau2009-04-232-5/+86
| | | | | | | | | | | | | unauthenticated request Introduces a new auth.conf directive (auth or authenticated) which takes an argument (on,yes/off,no/all,any). This can be used to restrict an ACL to only some state of authentication of a REST request, or any. If no auth directive is given, the ACL will only trigger for authenticated requests. Signed-off-by: Brice Figureau <brice-puppet@daysofwonder.com>
* Fill REST request node with reverse lookup of IP addressBrice Figureau2009-04-233-4/+30
| | | | Signed-off-by: Brice Figureau <brice-puppet@daysofwonder.com>
* Refactor rest authorization to raise exceptions deeperBrice Figureau2009-04-2310-81/+119
| | | | | | | | | | | | | The idea is to raise an AuthorizationException at the same place we check the authorization instead of in an upper level to be able to spot where the authorization took place in the exception backtrace. Moreover, this changes also makes Rights::allowed? to return the matching acl so that the upper layer can have a chance to report which ACL resulted in the match. Signed-off-by: Brice Figureau <brice-puppet@daysofwonder.com>
* Add environment support in the REST authorization layerBrice Figureau2009-04-233-6/+53
| | | | | | | | | With the help of the new auth.conf directive 'environment', any ACL can now be restricted to a specific environment. Omission of the directive means that the ACL will apply to all the defined environment. Signed-off-by: Brice Figureau <brice-puppet@daysofwonder.com>
* Fix some indirector failing testsBrice Figureau2009-04-235-5/+19
| | | | | | | The authorization system should stubbed to let all the rest tests to succeed :-) Signed-off-by: Brice Figureau <brice-puppet@daysofwonder.com>
* Fix #1875 - Add a REST authorization systemBrice Figureau2009-04-233-0/+207
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch introduces a new configuration file (and configuration setting to set it). Each REST request is checked against this configuration file, and is either allowed or denied. The configuration file has the following format: path /uripath method <methods> allow <ip> or <name> deny <ip> or <name> or path ~ <regex> method <methods> allow <ip> or <name> deny <ip> or <name> where regex is a ruby regex. This last syntax allows deny/allow interpolation from the regex captures: path ~ /files[^/]+/files/([^/]+)/([^/])/ method find allow $2.$1 If you arrange your files/ directory to have files in 'domain.com/host/', then only the referenced host will be able to access their files, other hosts will be denied. For instance: files/reductivelabs.com/dns/... files/reductivelabs.com/www/... then only files in dns can be accessible by dns.reductivelabs.com and so on... If the auth.conf file doesn't exist puppet uses sane defaults that allows clients to check-in and ask for their configurations... Signed-off-by: Brice Figureau <brice-puppet@daysofwonder.com>
* Enhance authconfig format to support uri paths and regexBrice Figureau2009-04-232-21/+453
| | | | | | | | | | | | | | | | | | | | | This patch introduces a new set of directive to the authconfig parser/file format: path /uripath or patch ~ <regex> This directive declares a new kind of ACL based on the uri path. method save, find This directive which is to be used under path directive restricts a path ACL to only some REST verbs. The ACL path system matches on path prefix possible, or on regex matches (first match wins). If no path are matching, then the authorization is not allowed. The same if no ACL matches for the given REST verb. The old namespace right matching still works as usual. Signed-off-by: Brice Figureau <brice-puppet@daysofwonder.com>
* Add RSpec unit tests for network rightsBrice Figureau2009-04-231-0/+54
| | | | Signed-off-by: Brice Figureau <brice-puppet@daysofwonder.com>
* Add RSpec unit tests for authconfigBrice Figureau2009-04-231-0/+173
| | | | Signed-off-by: Brice Figureau <brice-puppet@daysofwonder.com>
* Adding support for specifying a preferred serialization formatLuke Kanies2009-04-222-4/+11
| | | | | | | | | | This isn't that great, but at least it provides basic tuning of the format. Also removing the catalog_format default, since it's no longer used. Signed-off-by: Luke Kanies <luke@madstop.com>
* Fixing the FormatHandler test to use symbols for format namesLuke Kanies2009-04-221-22/+25
| | | | | | | Formats guarantee that symbols are used, so it makes sense for the tests to do so. Signed-off-by: Luke Kanies <luke@madstop.com>
* Fixing #2149 - Facts are passed as part of the catalog requestLuke Kanies2009-04-224-22/+94
| | | | | | | | | | | | | | | This removes the requirement of shared fact caching on the servers, since the server responding to the catalog request will receive the facts as part of the request. The facts are serialized as a parameter to the request, rather than each being set as a separate request parameter. This hard-codes yaml as the serialization format for the facts, because I couldn't get marshal to work and it's just not as big a deal for such a small amount of data. Signed-off-by: Luke Kanies <luke@madstop.com>
* Adding better logging when cached indirection resources are usedLuke Kanies2009-04-221-1/+1
| | | | Signed-off-by: Luke Kanies <luke@madstop.com>
* Fixing #2181 - Using Sets instead of Arrays in SimpleGraphLuke Kanies2009-04-221-0/+1
| | | | | | This can cause a huge speedup for large numbers of edges. Signed-off-by: Luke Kanies <luke@madstop.com>
* Finishing class renamesLuke Kanies2009-04-221-0/+57
| | | | | | | | | | I missed some of the Catalog mentions, and its constant changed. I've also added tests so this will get caught next time. Signed-off-by: Luke Kanies <luke@madstop.com>
* Fixing some rails tests that sometimes failedLuke Kanies2009-04-221-0/+1
| | | | | | At least, I think they're fixed; it's hard to test. Signed-off-by: Luke Kanies <luke@madstop.com>
* Adding time debugging for catalog storage to active_recordLuke Kanies2009-04-221-0/+2
| | | | Signed-off-by: Luke Kanies <luke@madstop.com>
* Using a setting for configuring queueingLuke Kanies2009-04-222-12/+5
| | | | | | | Removing class methods and such, and switching to relying solely on a setting for the queue configuration. Signed-off-by: Luke Kanies <luke@madstop.com>
* Removing unnecessary parser variables when yaml-dumpingLuke Kanies2009-04-223-11/+13
| | | | | | | | | Also working around a YAML bug in Ruby. And fixing tests that were broken in a previous commit in this rebase but not caught earlier. Signed-off-by: Luke Kanies <luke@madstop.com>
* Add queue indirection as an option for catalog storage.Ethan Rowe2009-04-221-0/+20
| | | | | | This eventually will allow catalog storage ("storeconfigs") to be taken out of the critical request-handling path of puppetmasterd, such that: * Puppet::Node::Catalog can be serialized to a message queue via the indirector's "save" method * a separate process can use Puppet::Node::Catalog::Queue.subscribe to pick up these catalog objects as they come in and can save them to the database through the :active_record terminus
* Introduce abstract queue terminus within the indirection system.Ethan Rowe2009-04-221-0/+87
| | | | The queue abstract terminus allows the standard indirector behaviors to interact with a message queue broker, such that the indirector's "save" method writes the relevant model object out to a queue on the message broker. While the indirector's "find" method does not map to a message queue, the queue terminus class offers a "subscribe" method that allows for easy implementation of an event loop, receiving indirected objects saved to a queue as they come in.
* Introduce queue client "plugin" namespace and interface, with a Stomp client ↵Ethan Rowe2009-04-222-0/+157
| | | | | | | | | | | implementation. Puppet::Util::Queue provides queue client mix-in behaviors that enable easy queue client management for consumer classes. Some relevant behaviors include: * standard Puppet instance loader behavior for loading queue client modules on-demand based on the client module specified by symbolic name * singleton registry of known queue client types (based on symbol-to-class mappings from the instance loading behavior) * simple interface for working with an actual queue client instance Puppet::Util::Queue::Stomp wraps the Stomp::Client class to provide an initial queue client option supporting the Stomp messaging protocol. This defines the interface for all Puppet queue client plugins going forward.
* Initial implementation of a "cache accumulator" behavior.Ethan Rowe2009-04-221-0/+69
| | | | | | | | | | | | | Mix Puppet::Util::CacheAccumulator into an ActiveRecord-like class, and then for any attribute in that class on which you are likely to call find_or_create_by_*, specify: accumulates :foo and instead of :find_or_create_by_foo use :accumulate_by_foo. The class will cache known results keyed by values of :foo. Do an initial bulk-lookup: class.accumulate_by_foo('foo1', 'foo2', 'foo3', 'foo4')
* Changing rails value serialization to deal with booleansLuke Kanies2009-04-221-0/+52
| | | | | | | | The database was automatically converting booleans to strings, and value comparison was not working correctly as a result. Signed-off-by: Luke Kanies <luke@madstop.com>
* Refactoring the Rails integrationLuke Kanies2009-04-222-4/+4
| | | | | | | | This moves all code from the Parser class into the ActiveRecord classes, and gets rid of 'ar_hash_merge'. Signed-off-by: Luke Kanies <luke@madstop.com>
generated by cgit (git 2.34.1) at 2025-09-29 06:02:28 +0000