1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
|
#--
# Author:: Adam Jacob (<adam@opscode.com>)
# Author:: Thom May (<thom@clearairturbulence.org>)
# Author:: Nuo Yan (<nuo@opscode.com>)
# Author:: Christopher Brown (<cb@opscode.com>)
# Author:: Christopher Walters (<cw@opscode.com>)
# Copyright:: Copyright (c) 2009, 2010 Opscode, Inc.
# License:: Apache License, Version 2.0
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
require 'net/https'
require 'uri'
require 'chef/json_compat'
require 'tempfile'
require 'chef/rest/auth_credentials'
require 'chef/rest/rest_request'
require 'chef/monkey_patches/string'
class Chef
# == Chef::REST
# Chef's custom REST client with built-in JSON support and RSA signed header
# authentication.
class REST
attr_reader :auth_credentials
attr_accessor :url, :cookies, :sign_on_redirect, :redirect_limit
# Create a REST client object. The supplied +url+ is used as the base for
# all subsequent requests. For example, when initialized with a base url
# http://localhost:4000, a call to +get_rest+ with 'nodes' will make an
# HTTP GET request to http://localhost:4000/nodes
def initialize(url, client_name=Chef::Config[:node_name], signing_key_filename=Chef::Config[:client_key], options={})
@url = url
@cookies = CookieJar.instance
@default_headers = options[:headers] || {}
@auth_credentials = AuthCredentials.new(client_name, signing_key_filename)
@sign_on_redirect, @sign_request = true, true
@redirects_followed = 0
@redirect_limit = 10
end
def signing_key_filename
@auth_credentials.key_file
end
def client_name
@auth_credentials.client_name
end
def signing_key
@auth_credentials.raw_key
end
# Register the client
#--
# Requires you to load chef/api_client beforehand. explicit require is removed since
# most users of this class have no need for chef/api_client. This functionality
# should be moved anyway...
def register(name=Chef::Config[:node_name], destination=Chef::Config[:client_key])
if (File.exists?(destination) && !File.writable?(destination))
raise Chef::Exceptions::CannotWritePrivateKey, "I cannot write your private key to #{destination} - check permissions?"
end
nc = Chef::ApiClient.new
nc.name(name)
catch(:done) do
retries = config[:client_registration_retries] || 5
0.upto(retries) do |n|
begin
response = nc.save(true, true)
Chef::Log.debug("Registration response: #{response.inspect}")
raise Chef::Exceptions::CannotWritePrivateKey, "The response from the server did not include a private key!" unless response.has_key?("private_key")
# Write out the private key
::File.open(destination, "w") {|f|
f.chmod(0600)
f.print(response["private_key"])
}
throw :done
rescue IOError
raise Chef::Exceptions::CannotWritePrivateKey, "I cannot write your private key to #{destination}"
rescue Net::HTTPFatalError => e
Chef::Log.warn("Failed attempt #{n} of #{retries+1} on client creation")
raise unless e.response.code == "500"
end
end
end
true
end
# Send an HTTP GET request to the path
#
# Using this method to +fetch+ a file is considered deprecated.
#
# === Parameters
# path:: The path to GET
# raw:: Whether you want the raw body returned, or JSON inflated. Defaults
# to JSON inflated.
def get_rest(path, raw=false, headers={})
if raw
streaming_request(create_url(path), headers)
else
api_request(:GET, create_url(path), headers)
end
end
# Send an HTTP DELETE request to the path
def delete_rest(path, headers={})
api_request(:DELETE, create_url(path), headers)
end
# Send an HTTP POST request to the path
def post_rest(path, json, headers={})
api_request(:POST, create_url(path), headers, json)
end
# Send an HTTP PUT request to the path
def put_rest(path, json, headers={})
api_request(:PUT, create_url(path), headers, json)
end
# Streams a download to a tempfile, then yields the tempfile to a block.
# After the download, the tempfile will be closed and unlinked.
# If you rename the tempfile, it will not be deleted.
# Beware that if the server streams infinite content, this method will
# stream it until you run out of disk space.
def fetch(path, headers={})
streaming_request(create_url(path), headers) {|tmp_file| yield tmp_file }
end
def create_url(path)
if path =~ /^(http|https):\/\//
URI.parse(path)
else
URI.parse("#{@url}/#{path}")
end
end
def sign_requests?
auth_credentials.sign_requests? && @sign_request
end
# ==== DEPRECATED
# Use +api_request+ instead
#--
# Actually run an HTTP request. First argument is the HTTP method,
# which should be one of :GET, :PUT, :POST or :DELETE. Next is the
# URL, then an object to include in the body (which will be converted with
# .to_json). The limit argument is unused, it is present for backwards
# compatibility. Configure the redirect limit with #redirect_limit=
# instead.
#
# Typically, you won't use this method -- instead, you'll use one of
# the helper methods (get_rest, post_rest, etc.)
#
# Will return the body of the response on success.
def run_request(method, url, headers={}, data=false, limit=nil, raw=false)
json_body = data ? Chef::JSONCompat.to_json(data) : nil
headers = build_headers(method, url, headers, json_body, raw)
tf = nil
retriable_rest_request(method, url, json_body, headers) do |rest_request|
res = rest_request.call do |response|
if raw
tf = stream_to_tempfile(url, response)
else
response.read_body
end
end
if res.kind_of?(Net::HTTPSuccess)
if res['content-type'] =~ /json/
response_body = res.body.chomp
Chef::JSONCompat.from_json(response_body)
else
if method == :HEAD
true
elsif raw
tf
else
res.body
end
end
elsif res.kind_of?(Net::HTTPFound) or res.kind_of?(Net::HTTPMovedPermanently)
follow_redirect {run_request(:GET, create_url(res['location']), {}, false, nil, raw)}
elsif res.kind_of?(Net::HTTPNotModified)
false
else
if res['content-type'] =~ /json/
exception = Chef::JSONCompat.from_json(res.body)
msg = "HTTP Request Returned #{res.code} #{res.message}: "
msg << (exception["error"].respond_to?(:join) ? exception["error"].join(", ") : exception["error"].to_s)
Chef::Log.warn(msg)
end
res.error!
end
end
end
# Runs an HTTP request to a JSON API. File Download not supported.
def api_request(method, url, headers={}, data=false)
json_body = data ? Chef::JSONCompat.to_json(data) : nil
headers = build_headers(method, url, headers, json_body)
retriable_rest_request(method, url, json_body, headers) do |rest_request|
response = rest_request.call {|r| r.read_body}
if response.kind_of?(Net::HTTPSuccess)
if response['content-type'] =~ /json/
Chef::JSONCompat.from_json(response.body.chomp)
else
Chef::Log.warn("Expected JSON response, but got content-type '#{response['content-type']}'")
response.body
end
elsif redirect_location = redirected_to(response)
follow_redirect {api_request(:GET, create_url(redirect_location))}
else
if response['content-type'] =~ /json/
exception = Chef::JSONCompat.from_json(response.body)
msg = "HTTP Request Returned #{response.code} #{response.message}: "
msg << (exception["error"].respond_to?(:join) ? exception["error"].join(", ") : exception["error"].to_s)
Chef::Log.info(msg)
end
response.error!
end
end
end
# Makes a streaming download request. <b>Doesn't speak JSON.</b>
# Streams the response body to a tempfile. If a block is given, it's
# passed to Tempfile.open(), which means that the tempfile will automatically
# be unlinked after the block is executed.
#
# If no block is given, the tempfile is returned, which means it's up to
# you to unlink the tempfile when you're done with it.
def streaming_request(url, headers, &block)
headers = build_headers(:GET, url, headers, nil, true)
retriable_rest_request(:GET, url, nil, headers) do |rest_request|
tempfile = nil
response = rest_request.call do |r|
if block_given? && r.kind_of?(Net::HTTPSuccess)
begin
tempfile = stream_to_tempfile(url, r, &block)
yield tempfile
ensure
tempfile.close!
end
else
tempfile = stream_to_tempfile(url, r)
end
end
if response.kind_of?(Net::HTTPSuccess)
tempfile
elsif redirect_location = redirected_to(response)
# TODO: test tempfile unlinked when following redirects.
tempfile && tempfile.close!
follow_redirect {streaming_request(create_url(redirect_location), {}, &block)}
else
tempfile && tempfile.close!
response.error!
end
end
end
def retriable_rest_request(method, url, req_body, headers)
rest_request = Chef::REST::RESTRequest.new(method, url, req_body, headers)
Chef::Log.debug("Sending HTTP Request via #{method} to #{url.host}:#{url.port}#{rest_request.path}")
http_attempts = 0
begin
http_attempts += 1
res = yield rest_request
rescue SocketError, Errno::ETIMEDOUT => e
e.message.replace "Error connecting to #{url} - #{e.message}"
raise e
rescue Errno::ECONNREFUSED
if http_retry_count - http_attempts + 1 > 0
Chef::Log.error("Connection refused connecting to #{url.host}:#{url.port} for #{rest_request.path}, retry #{http_attempts}/#{http_retry_count}")
sleep(http_retry_delay)
retry
end
raise Errno::ECONNREFUSED, "Connection refused connecting to #{url.host}:#{url.port} for #{rest_request.path}, giving up"
rescue Timeout::Error
if http_retry_count - http_attempts + 1 > 0
Chef::Log.error("Timeout connecting to #{url.host}:#{url.port} for #{rest_request.path}, retry #{http_attempts}/#{http_retry_count}")
sleep(http_retry_delay)
retry
end
raise Timeout::Error, "Timeout connecting to #{url.host}:#{url.port} for #{rest_request.path}, giving up"
rescue Net::HTTPFatalError => e
if http_retry_count - http_attempts + 1 > 0
sleep_time = 1 + (2 ** http_attempts) + rand(2 ** http_attempts)
Chef::Log.error("Server returned error for #{url}, retrying #{http_attempts}/#{http_retry_count} in #{sleep_time}s")
sleep(sleep_time)
retry
end
raise
end
end
def authentication_headers(method, url, json_body=nil)
request_params = {:http_method => method, :path => url.path, :body => json_body, :host => "#{url.host}:#{url.port}"}
request_params[:body] ||= ""
auth_credentials.signature_headers(request_params)
end
def http_retry_delay
config[:http_retry_delay]
end
def http_retry_count
config[:http_retry_count]
end
def config
Chef::Config
end
def follow_redirect
raise Chef::Exceptions::RedirectLimitExceeded if @redirects_followed >= redirect_limit
@redirects_followed += 1
Chef::Log.debug("Following redirect #{@redirects_followed}/#{redirect_limit}")
if @sign_on_redirect
yield
else
@sign_request = false
yield
end
ensure
@redirects_followed = 0
@sign_request = true
end
private
def redirected_to(response)
if response.kind_of?(Net::HTTPFound) || response.kind_of?(Net::HTTPMovedPermanently)
response['location']
else
nil
end
end
def build_headers(method, url, headers={}, json_body=false, raw=false)
headers = @default_headers.merge(headers)
headers['Accept'] = "application/json" unless raw
headers["Content-Type"] = 'application/json' if json_body
headers['Content-Length'] = json_body.bytesize.to_s if json_body
headers.merge!(authentication_headers(method, url, json_body)) if sign_requests?
headers.merge!(Chef::Config[:custom_http_headers]) if Chef::Config[:custom_http_headers]
headers
end
def stream_to_tempfile(url, response)
tf = Tempfile.open("chef-rest")
if RUBY_PLATFORM =~ /mswin|mingw32|windows/
tf.binmode #required for binary files on Windows platforms
end
Chef::Log.debug("Streaming download from #{url.to_s} to tempfile #{tf.path}")
# Stolen from http://www.ruby-forum.com/topic/166423
# Kudos to _why!
size, total = 0, response.header['Content-Length'].to_i
response.read_body do |chunk|
tf.write(chunk)
size += chunk.size
end
tf.close
tf
rescue Exception
tf.close!
raise
end
end
end
|