path: root/lib/puppet/network/handler/fileserver.rb

require 'puppet'
require 'puppet/network/authstore'
require 'webrick/httpstatus'
require 'cgi'
require 'delegate'
require 'sync'
require 'xmlrpc/server'

require 'puppet/network/handler'
require 'puppet/network/xmlrpc/server'
require 'puppet/file_serving'
require 'puppet/file_serving/metadata'
require 'puppet/network/handler'

class Puppet::Network::Handler
  AuthStoreError = Puppet::AuthStoreError
  class FileServerError < Puppet::Error; end
  class FileServer < Handler
    desc "The interface to Puppet's fileserving abilities."

    attr_accessor :local

    CHECKPARAMS = [:mode, :type, :owner, :group, :checksum]

    # Special filserver module for puppet's module system
    MODULES = "modules"
    PLUGINS = "plugins"

    @interface = XMLRPC::Service::Interface.new("fileserver") { |iface|
      iface.add_method("string describe(string, string)")
      iface.add_method("string list(string, string, boolean, array)")
      iface.add_method("string retrieve(string, string)")
    }

    def self.params
      CHECKPARAMS.dup
    end

    # If the configuration file exists, then create (if necessary) a LoadedFile
    # object to manage it; else, return nil.
    def configuration
      # Short-circuit the default case.
      return @configuration if defined?(@configuration)

      config_path = @passed_configuration_path || Puppet[:fileserverconfig]
      return nil unless FileTest.exist?(config_path)

      # The file exists but we don't have a LoadedFile instance for it.
      @configuration = Puppet::Util::LoadedFile.new(config_path)
    end

    # Create our default mounts for modules and plugins.  This is duplicated code,
    # but I'm not really worried about that.
    def create_default_mounts
      @mounts = {}
      Puppet.debug "No file server configuration file; autocreating #{MODULES} mount with default permissions"
      mount = Mount.new(MODULES)
      mount.allow("*")
      @mounts[MODULES] = mount

      Puppet.debug "No file server configuration file; autocreating #{PLUGINS} mount with default permissions"
      mount = PluginMount.new(PLUGINS)
      mount.allow("*")
      @mounts[PLUGINS] = mount
    end

    # Describe a given file.  This returns all of the manageable aspects
    # of that file.
    def describe(url, links = :follow, client = nil, clientip = nil)
      links = links.intern if links.is_a? String

      mount, path = convert(url, client, clientip)

      mount.debug("Describing #{url} for #{client}") if client

      # use the mount to resolve the path for us.
      return "" unless full_path = mount.file_path(path, client)

      metadata = Puppet::FileServing::Metadata.new(url, :path => full_path, :links => links)

      return "" unless metadata.exist?

      begin
        metadata.collect
      rescue => detail
        puts detail.backtrace if Puppet[:trace]
        Puppet.err detail
        return ""
      end

      metadata.attributes_with_tabs
    end

    # Create a new fileserving module.
    def initialize(hash = {})
      @mounts = {}
      @files = {}

      @local = hash[:Local]

      @noreadconfig = true if hash[:Config] == false

      @passed_configuration_path = hash[:Config]

      if hash.include?(:Mount)
        @passedconfig = true
        raise Puppet::DevError, "Invalid mount hash #{hash[:Mount].inspect}" unless hash[:Mount].is_a?(Hash)

        hash[:Mount].each { |dir, name|
          self.mount(dir, name) if FileTest.exists?(dir)
        }
        self.mount(nil, MODULES)
        self.mount(nil, PLUGINS)
      else
        @passedconfig = false
        if configuration
          readconfig(false) # don't check the file the first time.
        else
          create_default_mounts
        end
      end
    end

    # List a specific directory's contents.
    def list(url, links = :ignore, recurse = false, ignore = false, client = nil, clientip = nil)
      mount, path = convert(url, client, clientip)

      mount.debug "Listing #{url} for #{client}" if client

      return "" unless mount.path_exists?(path, client)

      desc = mount.list(path, recurse, ignore, client)

      if desc.length == 0
        mount.notice "Got no information on //#{mount}/#{path}"
        return ""
      end

      desc.collect { |sub| sub.join("\t") }.join("\n")
    end

    def local?
      self.local
    end

    # Is a given mount available?
    def mounted?(name)
      @mounts.include?(name)
    end

    # Mount a new directory with a name.
    def mount(path, name)
      if @mounts.include?(name)
        if @mounts[name] != path
          raise FileServerError, "#{@mounts[name].path} is already mounted at #{name}"
        else
          # it's already mounted; no problem
          return
        end
      end

      # Let the mounts do their own error-checking.
      @mounts[name] = Mount.new(name, path)
      @mounts[name].info "Mounted #{path}"

      @mounts[name]
    end

    # Retrieve a file from the local disk and pass it to the remote
    # client.
    def retrieve(url, links = :ignore, client = nil, clientip = nil)
      links = links.intern if links.is_a? String

      mount, path = convert(url, client, clientip)

      mount.info "Sending #{url} to #{client}" if client

      unless mount.path_exists?(path, client)
        mount.debug "#{mount} reported that #{path} does not exist"
        return ""
      end

      links = links.intern if links.is_a? String

      if links == :ignore and FileTest.symlink?(path)
        mount.debug "I think that #{path} is a symlink and we're ignoring them"
        return ""
      end

      str = mount.read_file(path, client)

      if @local
        return str
      else
        return CGI.escape(str)
      end
    end

    def umount(name)
      @mounts.delete(name) if @mounts.include? name
    end

    private

    def authcheck(file, mount, client, clientip)
      # If we're local, don't bother passing in information.
      if local?
        client = nil
        clientip = nil
      end
      unless mount.allowed?(client, clientip)
        mount.warning "#{client} cannot access #{file}"
        raise Puppet::AuthorizationError, "Cannot access #{mount}"
      end
    end

    # Take a URL and some client info and return a mount and relative
    # path pair.
    #
    def convert(url, client, clientip)
      readconfig

      url = URI.unescape(url)

      mount, stub = splitpath(url, client)

      authcheck(url, mount, client, clientip)

      return mount, stub
    end

    # Return the mount for the Puppet modules; allows file copying from
    # the modules.
    def modules_mount(module_name, client)
      # Find our environment, if we have one.
      unless hostname = (client || Facter.value("hostname"))
        raise ArgumentError, "Could not find hostname"
      end
      env = (node = Puppet::Node.indirection.find(hostname)) ? node.environment : nil

      # And use the environment to look up the module.
      (mod = Puppet::Node::Environment.new(env).module(module_name) and mod.files?) ? @mounts[MODULES].copy(mod.name, mod.file_directory) : nil
    end

    # Read the configuration file.
    def readconfig(check = true)
      return if @noreadconfig

      return unless configuration

      return if check and ! @configuration.changed?

      newmounts = {}
      begin
        File.open(@configuration.file) { |f|
          mount = nil
          count = 1
          f.each { |line|
            case line
            when /^\s*#/; next # skip comments
            when /^\s*$/; next # skip blank lines
            when /\[([-\w]+)\]/
              name = $1
              raise FileServerError, "#{newmounts[name]} is already mounted as #{name} in #{@configuration.file}" if newmounts.include?(name)
              mount = Mount.new(name)
              newmounts[name] = mount
            when /^\s*(\w+)\s+(.+)$/
              var = $1
              value = $2
              case var
              when "path"
                raise FileServerError.new("No mount specified for argument #{var} #{value}") unless mount
                if mount.name == MODULES
                  Puppet.warning "The '#{mount.name}' module can not have a path. Ignoring attempt to set it"
                else
                  begin
                    mount.path = value
                  rescue FileServerError => detail
                    Puppet.err "Removing mount #{mount.name}: #{detail}"
                    newmounts.delete(mount.name)
                  end
                end
              when "allow"
                raise FileServerError.new("No mount specified for argument #{var} #{value}") unless mount
                value.split(/\s*,\s*/).each { |val|
                  begin
                    mount.info "allowing #{val} access"
                    mount.allow(val)
                  rescue AuthStoreError => detail
                    puts detail.backtrace if Puppet[:trace]

                      raise FileServerError.new(
                        detail.to_s,

                      count, @configuration.file)
                  end
                }
              when "deny"
                raise FileServerError.new("No mount specified for argument #{var} #{value}") unless mount
                value.split(/\s*,\s*/).each { |val|
                  begin
                    mount.info "denying #{val} access"
                    mount.deny(val)
                  rescue AuthStoreError => detail

                    raise FileServerError.new(
                      detail.to_s,

                      count, @configuration.file)
                  end
                }
              else
                raise FileServerError.new("Invalid argument '#{var}'", count, @configuration.file)
              end
            else
              raise FileServerError.new("Invalid line '#{line.chomp}'", count, @configuration.file)
            end
            count += 1
          }
        }
      rescue Errno::EACCES => detail
        Puppet.err "FileServer error: Cannot read #{@configuration}; cannot serve"
        #raise Puppet::Error, "Cannot read #{@configuration}"
      rescue Errno::ENOENT => detail
        Puppet.err "FileServer error: '#{@configuration}' does not exist; cannot serve"
      end

      unless newmounts[MODULES]
        Puppet.debug "No #{MODULES} mount given; autocreating with default permissions"
        mount = Mount.new(MODULES)
        mount.allow("*")
        newmounts[MODULES] = mount
      end

      unless newmounts[PLUGINS]
        Puppet.debug "No #{PLUGINS} mount given; autocreating with default permissions"
        mount = PluginMount.new(PLUGINS)
        mount.allow("*")
        newmounts[PLUGINS] = mount
      end

      unless newmounts[PLUGINS].valid?
        Puppet.debug "No path given for #{PLUGINS} mount; creating a special PluginMount"
        # We end up here if the user has specified access rules for
        # the plugins mount, without specifying a path (which means
        # they want to have the default behaviour for the mount, but
        # special access control).  So we need to move all the
        # user-specified access controls into the new PluginMount
        # object...
        mount = PluginMount.new(PLUGINS)
        # Yes, you're allowed to hate me for this.

          mount.instance_variable_set(
            :@declarations,

              newmounts[PLUGINS].instance_variable_get(:@declarations)
              )
        newmounts[PLUGINS] = mount
      end

      # Verify each of the mounts are valid.
      # We let the check raise an error, so that it can raise an error
      # pointing to the specific problem.
      newmounts.each { |name, mount|
        raise FileServerError, "Invalid mount #{name}" unless mount.valid?
      }
      @mounts = newmounts
    end

    # Split the path into the separate mount point and path.
    def splitpath(dir, client)
      # the dir is based on one of the mounts
      # so first retrieve the mount path
      mount = nil
      path = nil
      if dir =~ %r{/([-\w]+)}
        # Strip off the mount name.
        mount_name, path = dir.sub(%r{^/}, '').split(File::Separator, 2)

        unless mount = modules_mount(mount_name, client)
          unless mount = @mounts[mount_name]
            raise FileServerError, "Fileserver module '#{mount_name}' not mounted"
          end
        end
      else
        raise FileServerError, "Fileserver error: Invalid path '#{dir}'"
      end

      if path.nil? or path == ''
        path = '/'
      elsif path
        # Remove any double slashes that might have occurred
        path = URI.unescape(path.gsub(/\/\//, "/"))
      end

      return mount, path
    end

    def to_s
      "fileserver"
    end

    # A simple class for wrapping mount points.  Instances of this class
    # don't know about the enclosing object; they're mainly just used for
    # authorization.
    class Mount < Puppet::Network::AuthStore
      attr_reader :name

      @@syncs = {}

      @@files = {}

      Puppet::Util.logmethods(self, true)

      # Create a map for a specific client.
      def clientmap(client)
        {
          "h" => client.sub(/\..*$/, ""),
          "H" => client,
          "d" => client.sub(/[^.]+\./, "") # domain name
        }
      end

      # Replace % patterns as appropriate.
      def expand(path, client = nil)
        # This map should probably be moved into a method.
        map = nil

        if client
          map = clientmap(client)
        else
          Puppet.notice "No client; expanding '#{path}' with local host"
          # Else, use the local information
          map = localmap
        end
        path.gsub(/%(.)/) do |v|
          key = $1
          if key == "%"
            "%"
          else
            map[key] || v
          end
        end
      end

      # Do we have any patterns in our path, yo?
      def expandable?
        if defined?(@expandable)
          @expandable
        else
          false
        end
      end

      # Return a fully qualified path, given a short path and
      # possibly a client name.
      def file_path(relative_path, node = nil)
        full_path = path(node)

        unless full_path
          p self
          raise ArgumentError.new("Mounts without paths are not usable") unless full_path
        end

        # If there's no relative path name, then we're serving the mount itself.
        return full_path unless relative_path and relative_path != "/"

        File.join(full_path, relative_path)
      end

      # Create out object.  It must have a name.
      def initialize(name, path = nil)
        unless name =~ %r{^[-\w]+$}
          raise FileServerError, "Invalid name format '#{name}'"
        end
        @name = name

        if path
          self.path = path
        else
          @path = nil
        end

        @files = {}

        super()
      end

      def fileobj(path, links, client)
        obj = nil
        if obj = @files[file_path(path, client)]
          # This can only happen in local fileserving, but it's an
          # important one.  It'd be nice if we didn't just set
          # the check params every time, but I'm not sure it's worth
          # the effort.
          obj[:audit] = CHECKPARAMS
        else

          obj = Puppet::Type.type(:file).new(

            :name => file_path(path, client),

            :audit => CHECKPARAMS
          )
          @files[file_path(path, client)] = obj
        end

        if links == :manage
          links = :follow
        end

        # This, ah, might be completely redundant
        obj[:links] = links unless obj[:links] == links

        obj
      end

      # Read the contents of the file at the relative path given.
      def read_file(relpath, client)
        File.read(file_path(relpath, client))
      end

      # Cache this manufactured map, since if it's used it's likely
      # to get used a lot.
      def localmap
        unless defined?(@@localmap)
          @@localmap = {
            "h" =>  Facter.value("hostname"),
            "H" => [Facter.value("hostname"),
              Facter.value("domain")].join("."),
            "d" =>  Facter.value("domain")
          }
        end
        @@localmap
      end

      # Return the path as appropriate, expanding as necessary.
      def path(client = nil)
        if expandable?
          return expand(@path, client)
        else
          return @path
        end
      end

      # Set the path.
      def path=(path)
        # FIXME: For now, just don't validate paths with replacement
        # patterns in them.
        if path =~ /%./
          # Mark that we're expandable.
          @expandable = true
        else
          raise FileServerError, "#{path} does not exist" unless FileTest.exists?(path)
          raise FileServerError, "#{path} is not a directory" unless FileTest.directory?(path)
          raise FileServerError, "#{path} is not readable" unless FileTest.readable?(path)
          @expandable = false
        end
        @path = path
      end

      # Verify that the path given exists within this mount's subtree.
      #
      def path_exists?(relpath, client = nil)
        File.exists?(file_path(relpath, client))
      end

      # Return the current values for the object.
      def properties(obj)
        obj.retrieve.inject({}) { |props, ary| props[ary[0].name] = ary[1]; props }
      end

      # Retrieve a specific directory relative to a mount point.
      # If they pass in a client, then expand as necessary.
      def subdir(dir = nil, client = nil)
        basedir = self.path(client)

        dirname = if dir
          File.join(basedir, *dir.split("/"))
        else
          basedir
        end

        dirname
      end

      def sync(path)
        @@syncs[path] ||= Sync.new
        @@syncs[path]
      end

      def to_s
        "mount[#{@name}]"
      end

      # Verify our configuration is valid.  This should really check to
      # make sure at least someone will be allowed, but, eh.
      def valid?
        if name == MODULES
          return @path.nil?
        else
          return ! @path.nil?
        end
      end

      # Return a new mount with the same properties as +self+, except
      # with a different name and path.
      def copy(name, path)
        result = self.clone
        result.path = path
        result.instance_variable_set(:@name, name)
        result
      end

      # List the contents of the relative path +relpath+ of this mount.
      #
      # +recurse+ is the number of levels to recurse into the tree,
      # or false to provide no recursion or true if you just want to
      # go for broke.
      #
      # +ignore+ is an array of filenames to ignore when traversing
      # the list.
      #
      # The return value of this method is a complex nest of arrays,
      # which describes a directory tree.  Each file or directory is
      # represented by an array, where the first element is the path
      # of the file (relative to the root of the mount), and the
      # second element is the type.  A directory is represented by an
      # array as well, where the first element is a "directory" array,
      # while the remaining elements are other file or directory
      # arrays.  Confusing?  Hell yes.  As an added bonus, all names
      # must start with a slash, because... well, I'm fairly certain
      # a complete explanation would involve the words "crack pipe"
      # and "bad batch".
      #
      def list(relpath, recurse, ignore, client = nil)
        abspath = file_path(relpath, client)
        if FileTest.exists?(abspath)
          if FileTest.directory?(abspath) and recurse
            return reclist(abspath, recurse, ignore)
          else
            return [["/", File.stat(abspath).ftype]]
          end
        end
        nil
      end

      def reclist(abspath, recurse, ignore)
        require 'puppet/file_serving'
        require 'puppet/file_serving/fileset'
        if recurse.is_a?(Fixnum)
          args = { :recurse => true, :recurselimit => recurse, :links => :follow }
        else
          args = { :recurse => recurse, :links => :follow }
        end
        args[:ignore] = ignore if ignore
        fs = Puppet::FileServing::Fileset.new(abspath, args)
        ary = fs.files.collect do |file|
          if file == "."
            file = "/"
          else
            file = File.join("/", file )
          end
          stat = fs.stat(File.join(abspath, file))
          next if stat.nil?
          [ file, stat.ftype ]
        end

        ary.compact
      end

    end

    # A special mount class specifically for the plugins mount -- just
    # has some magic to effectively do a union mount of the 'plugins'
    # directory of all modules.
    #
    class PluginMount < Mount
      def path(client)
        ''
      end

      def mod_path_exists?(mod, relpath, client = nil)
        ! mod.plugin(relpath).nil?
      end

      def path_exists?(relpath, client = nil)
        !valid_modules(client).find { |mod| mod.plugin(relpath) }.nil?
      end

      def valid?
        true
      end

      def mod_file_path(mod, relpath, client = nil)
        File.join(mod, PLUGINS, relpath)
      end

      def file_path(relpath, client = nil)
        return nil unless mod = valid_modules(client).find { |m| m.plugin(relpath) }
        mod.plugin(relpath)
      end

      # create a list of files by merging all modules
      def list(relpath, recurse, ignore, client = nil)
        result = []
        valid_modules(client).each do |mod|
          if modpath = mod.plugin(relpath)
            if FileTest.directory?(modpath) and recurse
              ary = reclist(modpath, recurse, ignore)
              ary ||= []
              result += ary
            else
              result += [["/", File.stat(modpath).ftype]]
            end
          end
        end
        result
      end

      private
      def valid_modules(client)
        Puppet::Node::Environment.new.modules.find_all { |mod| mod.exist? }
      end

      def add_to_filetree(f, filetree)
        first, rest = f.split(File::SEPARATOR, 2)
      end
    end
  end
end