merged maint

6 files changed, 115 insertions, 97 deletions

diff --git a/src/lib/Bcfg2/Server/Plugins/NagiosGen.py b/src/lib/Bcfg2/Server/Plugins/NagiosGen.py
index 0c7b1daf7..4e8b09f30 100644
--- a/src/lib/Bcfg2/Server/Plugins/NagiosGen.py
+++ b/src/lib/Bcfg2/Server/Plugins/NagiosGen.py
@@ -65,7 +65,12 @@ class NagiosGen(Bcfg2.Server.Plugin.Plugin,
 
     def createhostconfig(self, entry, metadata):
         """Build host specific configuration file."""
-        host_address = socket.gethostbyname(metadata.hostname)
+        try:
+            host_address = socket.gethostbyname(metadata.hostname)
+        except socket.gaierror:
+            LOGGER.error("Failed to find IP address for %s" %
+                         metadata.hostname)
+            raise Bcfg2.Server.Plugin.PluginExecutionError
         host_groups = [grp for grp in metadata.groups
                        if os.path.isfile('%s/%s-group.cfg' % (self.data, grp))]
         host_config = ['define host {',
diff --git a/src/lib/Bcfg2/Server/Plugins/Packages/Source.py b/src/lib/Bcfg2/Server/Plugins/Packages/Source.py
index 2bc4b4dc2..332d0c488 100644
--- a/src/lib/Bcfg2/Server/Plugins/Packages/Source.py
+++ b/src/lib/Bcfg2/Server/Plugins/Packages/Source.py
@@ -1,7 +1,6 @@
 import os
 import re
 import sys
-import base64
 import Bcfg2.Server.Plugin
 from Bcfg2.Bcfg2Py3k import HTTPError, HTTPBasicAuthHandler, \
      HTTPPasswordMgrWithDefaultRealm, install_opener, build_opener, \
@@ -51,7 +50,18 @@ class Source(Bcfg2.Server.Plugin.Debuggable):
         for key, tag in [('components', 'Component'), ('arches', 'Arch'),
                          ('blacklist', 'Blacklist'),
                          ('whitelist', 'Whitelist')]:
-            self.__dict__[key] = [item.text for item in xsource.findall(tag)]
+            setattr(self, key, [item.text for item in xsource.findall(tag)])
+        self.server_options = dict()
+        self.client_options = dict()
+        opts = xsource.findall("Options")
+        for el in opts:
+            repoopts = dict([(k, v)
+                             for k, v in el.attrib.items()
+                             if k != "clientonly" and k != "serveronly"])
+            if el.get("clientonly", "false").lower() == "false":
+                self.server_options.update(repoopts)
+            if el.get("serveronly", "false").lower() == "false":
+                self.client_options.update(repoopts)
 
         self.gpgkeys = [el.text for el in xsource.findall("GPGKey")]
 
@@ -149,12 +159,10 @@ class Source(Bcfg2.Server.Plugin.Debuggable):
                 if match:
                     name = match.group(1)
                     break
-            if name is None:
-                # couldn't figure out the name from the URL or URL map
-                # (which probably means its a screwy URL), so we just
-                # generate a random one
-                name = base64.b64encode(os.urandom(16))[:-2]
-            rname = "%s-%s" % (self.groups[0], name)
+            if name is not None:
+                rname = "%s-%s" % (self.groups[0], name)
+            else:
+                rname = self.groups[0]
         # see yum/__init__.py in the yum source, lines 441-449, for
         # the source of this regex.  yum doesn't like anything but
         # string.ascii_letters, string.digits, and [-_.:].  There
@@ -185,6 +193,10 @@ class Source(Bcfg2.Server.Plugin.Debuggable):
                                 if a in metadata.groups]
         vdict = dict()
         for agrp in agroups:
+            if agrp not in self.provides:
+                self.logger.warning("%s provides no packages for %s" %
+                                    (self, agrp))
+                continue
             for key, value in list(self.provides[agrp].items()):
                 if key not in vdict:
                     vdict[key] = set(value)
diff --git a/src/lib/Bcfg2/Server/Plugins/Packages/Yum.py b/src/lib/Bcfg2/Server/Plugins/Packages/Yum.py
index ddc1aa0f9..87909dc4c 100644
--- a/src/lib/Bcfg2/Server/Plugins/Packages/Yum.py
+++ b/src/lib/Bcfg2/Server/Plugins/Packages/Yum.py
@@ -4,14 +4,13 @@ import time
 import copy
 import glob
 import socket
-import random
 import logging
 import threading
 import lxml.etree
 from UserDict import DictMixin
 from subprocess import Popen, PIPE, STDOUT
 import Bcfg2.Server.Plugin
-from Bcfg2.Bcfg2Py3k import StringIO, cPickle, HTTPError, ConfigParser, file
+from Bcfg2.Bcfg2Py3k import StringIO, cPickle, HTTPError, URLError, ConfigParser, file
 from Bcfg2.Server.Plugins.Packages.Collection import Collection
 from Bcfg2.Server.Plugins.Packages.Source import SourceInitError, Source, \
      fetch_url
@@ -200,6 +199,13 @@ class YumCollection(Collection):
                         config.set(reponame, "includepkgs",
                                    " ".join(source.whitelist))
 
+                    if raw:
+                        opts = source.server_options
+                    else:
+                        opts = source.client_options
+                    for opt, val in opts.items():
+                        config.set(reponame, opt, val)
+
         if raw:
             return config
         else:
@@ -560,6 +566,11 @@ class YumSource(Source):
         except ValueError:
             self.logger.error("Packages: Bad url string %s" % rmdurl)
             return []
+        except URLError:
+            err = sys.exc_info()[1]
+            self.logger.error("Packages: Failed to fetch url %s. %s" %
+                              (rmdurl, err))
+            return []
         except HTTPError:
             err = sys.exc_info()[1]
             self.logger.error("Packages: Failed to fetch url %s. code=%s" %
diff --git a/src/lib/Bcfg2/Server/Plugins/Packages/__init__.py b/src/lib/Bcfg2/Server/Plugins/Packages/__init__.py
index 228bbfeb8..765d1c89d 100644
--- a/src/lib/Bcfg2/Server/Plugins/Packages/__init__.py
+++ b/src/lib/Bcfg2/Server/Plugins/Packages/__init__.py
@@ -92,8 +92,8 @@ class Packages(Bcfg2.Server.Plugin.Plugin,
         if entry.tag == 'Package':
             collection = self._get_collection(metadata)
             entry.set('version', self.core.setup.cfp.get("packages",
-                                                 "version",
-                                                 default="auto"))
+                                                         "version",
+                                                         default="auto"))
             entry.set('type', collection.ptype)
         elif entry.tag == 'Path':
             if (entry.get("name") == self.core.setup.cfp.get("packages",
diff --git a/src/lib/Bcfg2/Server/Plugins/Probes.py b/src/lib/Bcfg2/Server/Plugins/Probes.py
index 042146aa7..8ef6c8737 100644
--- a/src/lib/Bcfg2/Server/Plugins/Probes.py
+++ b/src/lib/Bcfg2/Server/Plugins/Probes.py
@@ -41,56 +41,25 @@ class ClientProbeDataSet(dict):
         dict.__init__(self, *args, **kwargs)
 
 
-class ProbeData(object):
+class ProbeData(str):
     """ a ProbeData object emulates a str object, but also has .xdata
     and .json properties to provide convenient ways to use ProbeData
     objects as XML or JSON data """
+    def __new__(cls, data):
+        return str.__new__(cls, data)
+    
     def __init__(self, data):
-        self.data = data
+        str.__init__(self)
         self._xdata = None
         self._json = None
         self._yaml = None
 
-    def __str__(self):
-        return str(self.data)
-
-    def __repr__(self):
-        return repr(self.data)
-
-    def __getattr__(self, name):
-        """ make ProbeData act like a str object """
-        return getattr(self.data, name)
-
-    def __complex__(self):
-        return complex(self.data)
-
-    def __int__(self):
-        return int(self.data)
-
-    def __long__(self):
-        return long(self.data)
-
-    def __float__(self):
-        return float(self.data)
-
-    def __eq__(self, other):
-        return str(self) == str(other)
-
-    def __ne__(self, other):
-        return str(self) != str(other)
-
-    def __gt__(self, other):
-        return str(self) > str(other)
-
-    def __lt__(self, other):
-        return str(self) < str(other)
-
-    def __ge__(self, other):
-        return self > other or self == other
-
-    def __le__(self, other):
-        return self < other or self == other
-
+    @property
+    def data(self):
+        """ provide backwards compatibility with broken ProbeData
+        object in bcfg2 1.2.0 thru 1.2.2 """
+        return str(self)
+        
     @property
     def xdata(self):
         if self._xdata is None:
diff --git a/src/lib/Bcfg2/Server/Plugins/SSLCA.py b/src/lib/Bcfg2/Server/Plugins/SSLCA.py
index 1091fc2c8..d207c45a2 100644
--- a/src/lib/Bcfg2/Server/Plugins/SSLCA.py
+++ b/src/lib/Bcfg2/Server/Plugins/SSLCA.py
@@ -3,12 +3,15 @@ import Bcfg2.Options
 import lxml.etree
 import posixpath
 import tempfile
-import pipes
 import os
 from subprocess import Popen, PIPE, STDOUT
 # Compatibility import
 from Bcfg2.Bcfg2Py3k import ConfigParser
 
+try:
+    from hashlib import md5
+except ImportError:
+    from md5 import md5
 
 class SSLCA(Bcfg2.Server.Plugin.GroupSpool):
     """
@@ -22,6 +25,10 @@ class SSLCA(Bcfg2.Server.Plugin.GroupSpool):
     cert_specs = {}
     CAs = {}
 
+    def __init__(self, core, datastore):
+        Bcfg2.Server.Plugin.GroupSpool.__init__(self, core, datastore)
+        self.infoxml = dict()
+
     def HandleEvent(self, event=None):
         """
         Updates which files this plugin handles based upon filesystem events.
@@ -37,7 +44,7 @@ class SSLCA(Bcfg2.Server.Plugin.GroupSpool):
         else:
             ident = self.handles[event.requestID][:-1]
 
-        fname = "".join([ident, '/', event.filename])
+        fname = os.path.join(ident, event.filename)
 
         if event.filename.endswith('.xml'):
             if action in ['exists', 'created', 'changed']:
@@ -69,6 +76,10 @@ class SSLCA(Bcfg2.Server.Plugin.GroupSpool):
                     cp.read(self.core.cfile)
                     self.CAs[ca] = dict(cp.items('sslca_' + ca))
                     self.Entries['Path'][ident] = self.get_cert
+                elif event.filename.endswith("info.xml"):
+                    self.infoxml[ident] = Bcfg2.Server.Plugin.InfoXML(epath,
+                                                                      noprio=True)
+                    self.infoxml[ident].HandleEvent(event)
             if action == 'deleted':
                 if ident in self.Entries['Path']:
                     del self.Entries['Path'][ident]
@@ -92,28 +103,27 @@ class SSLCA(Bcfg2.Server.Plugin.GroupSpool):
         either grabs a prexisting key hostfile, or triggers the generation
         of a new key if one doesn't exist.
         """
-        # set path type and permissions, otherwise bcfg2 won't bind the file
-        permdata = {'owner': 'root',
-                    'group': 'root',
-                    'type': 'file',
-                    'perms': '644'}
-        [entry.attrib.__setitem__(key, permdata[key]) for key in permdata]
-
         # check if we already have a hostfile, or need to generate a new key
         # TODO: verify key fits the specs
         path = entry.get('name')
-        filename = "".join([path, '/', path.rsplit('/', 1)[1],
-                            '.H_', metadata.hostname])
+        filename = os.path.join(path, "%s.H_%s" % (os.path.basename(path),
+                                                   metadata.hostname))
         if filename not in list(self.entries.keys()):
             key = self.build_key(filename, entry, metadata)
             open(self.data + filename, 'w').write(key)
             entry.text = key
-            self.entries[filename] = self.__child__("%s%s" % (self.data,
-                                                              filename))
+            self.entries[filename] = self.__child__(self.data + filename)
             self.entries[filename].HandleEvent()
         else:
             entry.text = self.entries[filename].data
 
+        entry.set("type", "file")
+        if path in self.infoxml:
+            Bcfg2.Server.Plugin.bind_info(entry, metadata,
+                                          infoxml=self.infoxml[path])
+        else:
+            Bcfg2.Server.Plugin.bind_info(entry, metadata)
+
     def build_key(self, filename, entry, metadata):
         """
         generates a new key according the the specification
@@ -132,56 +142,61 @@ class SSLCA(Bcfg2.Server.Plugin.GroupSpool):
         either grabs a prexisting cert hostfile, or triggers the generation
         of a new cert if one doesn't exist.
         """
-        # set path type and permissions, otherwise bcfg2 won't bind the file
-        permdata = {'owner': 'root',
-                    'group': 'root',
-                    'type': 'file',
-                    'perms': '644'}
-        [entry.attrib.__setitem__(key, permdata[key]) for key in permdata]
-
         path = entry.get('name')
-        filename = "".join([path, '/', path.rsplit('/', 1)[1],
-                            '.H_', metadata.hostname])
+        filename = os.path.join(path, "%s.H_%s" % (os.path.basename(path),
+                                                   metadata.hostname))
 
         # first - ensure we have a key to work with
         key = self.cert_specs[entry.get('name')].get('key')
-        key_filename = "".join([key, '/', key.rsplit('/', 1)[1],
-                                '.H_', metadata.hostname])
+        key_filename = os.path.join(key, "%s.H_%s" % (os.path.basename(key),
+                                                      metadata.hostname))
         if key_filename not in self.entries:
             e = lxml.etree.Element('Path')
-            e.attrib['name'] = key
+            e.set('name', key)
             self.core.Bind(e, metadata)
 
         # check if we have a valid hostfile
-        if filename in list(self.entries.keys()) and self.verify_cert(filename,
-                                                                      key_filename,
-                                                                      entry):
+        if (filename in list(self.entries.keys()) and 
+            self.verify_cert(filename, key_filename, entry)):
             entry.text = self.entries[filename].data
         else:
             cert = self.build_cert(key_filename, entry, metadata)
             open(self.data + filename, 'w').write(cert)
-            self.entries[filename] = self.__child__("%s%s" % (self.data,
-                                                              filename))
+            self.entries[filename] = self.__child__(self.data + filename)
             self.entries[filename].HandleEvent()
             entry.text = cert
 
+        entry.set("type", "file")
+        if path in self.infoxml:
+            Bcfg2.Server.Plugin.bind_info(entry, metadata,
+                                          infoxml=self.infoxml[path])
+        else:
+            Bcfg2.Server.Plugin.bind_info(entry, metadata)
+
     def verify_cert(self, filename, key_filename, entry):
-        if self.verify_cert_against_ca(filename, entry):
-            if self.verify_cert_against_key(filename, key_filename):
-                return True
-        return False
+        do_verify = self.CAs[self.cert_specs[entry.get('name')]['ca']].get('verify_certs', True)
+        if do_verify:
+            return (self.verify_cert_against_ca(filename, entry) and
+                    self.verify_cert_against_key(filename, key_filename))
+        return True
 
     def verify_cert_against_ca(self, filename, entry):
         """
         check that a certificate validates against the ca cert,
         and that it has not expired.
         """
-        chaincert = self.CAs[self.cert_specs[entry.get('name')]['ca']].get('chaincert')
+        chaincert = \
+            self.CAs[self.cert_specs[entry.get('name')]['ca']].get('chaincert')
         cert = self.data + filename
-        res = Popen(["openssl", "verify", "-CAfile", chaincert, cert],
+        res = Popen(["openssl", "verify", "-untrusted", chaincert, "-purpose",
+                     "sslserver", cert],
                     stdout=PIPE, stderr=STDOUT).stdout.read()
         if res == cert + ": OK\n":
+            self.debug_log("SSLCA: %s verified successfully against CA" %
+                           entry.get("name"))
             return True
+        self.logger.warning("SSLCA: %s failed verification against CA: %s" %
+                            (entry.get("name"), res))
         return False
 
     def verify_cert_against_key(self, filename, key_filename):
@@ -190,14 +205,20 @@ class SSLCA(Bcfg2.Server.Plugin.GroupSpool):
         """
         cert = self.data + filename
         key = self.data + key_filename
-        cmd = ("openssl x509 -noout -modulus -in %s | openssl md5" %
-               pipes.quote(cert))
-        cert_md5 = Popen(cmd, shell=True, stdout=PIPE, stderr=STDOUT).stdout.read()
-        cmd = ("openssl rsa -noout -modulus -in %s | openssl md5" %
-               pipes.quote(key))
-        key_md5 = Popen(cmd, shell=True, stdout=PIPE, stderr=STDOUT).stdout.read()
+        cert_md5 = \
+            md5(Popen(["openssl", "x509", "-noout", "-modulus", "-in", cert],
+                      stdout=PIPE,
+                      stderr=STDOUT).stdout.read().strip()).hexdigest()
+        key_md5 = \
+            md5(Popen(["openssl", "rsa", "-noout", "-modulus", "-in", key],
+                      stdout=PIPE,
+                      stderr=STDOUT).stdout.read().strip()).hexdigest()
         if cert_md5 == key_md5:
+            self.debug_log("SSLCA: %s verified successfully against key %s" %
+                           (filename, key_filename))
             return True
+        self.logger.warning("SSLCA: %s failed verification against key %s" %
+                            (filename, key_filename))
         return False
 
     def build_cert(self, key_filename, entry, metadata):