Jira (PUP-5469) Indirector cache classes don't validate their return values

[Charlie Sharpsteen (JIRA)]

Title: Message Title

Charlie Sharpsteen created an issue   Puppet / PUP-5469 Indirector cache classes don't validate their return values Issue Type: Bug Affects Versions: PUP 4.2.3 Assignee: Unassigned Components: Platform Created: 2015/11/03 1:07 PM Labels: support Priority: Normal Reporter: Charlie Sharpsteen Puppet uses the YAML indirector terminii to cache various pieces of data. Catalog compilation relies on this terminus to maintain the state of agent facts during operations such as node retrieval. If facts cannot be read from the cache, the compiler will fall back to retrieving them from PuppetDB which triggers PUP-5441 and can result in a catalog that was compiled using stale information. The YAML terminii do not perform any validation to ensure an oject of the proper type is being returned from the cache. Thus, if something adjusts the behavior of Ruby YAML serialization and deserialization, compilation will start failing with cryptic errors or, in some cases, continue on without the user receiving any indication that outdated facts are being used. Reproduction Case Install a PE 2015.2 monolithic master. Add the safe_yaml gem to the Puppet Server: /opt/puppetlabs/bin/puppetserver gem install safe_yaml Simulate a Puppet plugin that loads safe_yaml by adding an inline_template call to the site manifest of the production environment: node default { $foo = inline_template('<% require "safe_yaml" %>') } This will Outcome The first catalog compilation will succeed: # puppet agent -t Info: Retrieving pluginfacts Info: Retrieving plugin Info: Loading facts Info: Caching catalog for pe-201522-master.puppetdebug.vlan Info: Applying configuration version '1446582492' Subsequent compilations will fail because safe_yaml has been loaded which causes the Ruby YAML libary to start returning plain hashes instead of Puppet::Indirector::Yaml instances: # puppet agent -t Info: Retrieving pluginfacts Info: Retrieving plugin Info: Loading facts Error: Could not retrieve catalog from remote server: Error 400 on SERVER: Attempt to assign to a reserved variable name: 'trusted' on node pe-201522-master.puppetdebug.vlan Warning: Not using cache on failed catalog Error: Could not retrieve catalog; skipping run The only indication of trouble is an error message recorded in the Puppet Server logs: 2015-11-03 20:45:05,507 DEBUG [puppet-server] Puppet Caching environment 'production' (ttl = 0 sec) 2015-11-03 20:45:05,554 ERROR [puppet-server] Puppet Cached facts for pe-201522-agent.puppetdebug.vlan failed: undefined method `expired?' for #<Hash:0x353d56da> /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/indirector/indirection.rb:228:in `find_in_cache' /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/indirector/indirection.rb:186:in `find' /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/node.rb:108:in `fact_merge' /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/indirector/node/classifier.rb:104:in `retrieve_classification' /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/indirector/node/classifier.rb:44:in `find' org/jruby/RubyArray.java:1613:in `each' /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/indirector/node/classifier.rb:43:in `find' /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/indirector/indirection.rb:194:in `find' /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/indirector/catalog/compiler.rb:109:in `find_node' /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/util/profiler/around_profiler.rb:58:in `profile' /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/util/profiler.rb:51:in `profile' /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/indirector/catalog/compiler.rb:106:in `find_node' /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/indirector/catalog/compiler.rb:146:in `node_from_request' /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/indirector/catalog/compiler.rb:47:in `find' /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/indirector/indirection.rb:194:in `find' /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/network/http/api/indirected_routes.rb:134:in `do_find' /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/network/http/api/indirected_routes.rb:48:in `call' /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/context.rb:64:in `override' /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet.rb:234:in `override' /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/network/http/api/indirected_routes.rb:47:in `call' /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/network/http/route.rb:82:in `process' org/jruby/RubyArray.java:1613:in `each' /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/network/http/route.rb:81:in `process' /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/network/http/route.rb:87:in `process' /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/network/http/route.rb:87:in `process' /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/network/http/handler.rb:60:in `process' /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/util/profiler/around_profiler.rb:58:in `profile' /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/util/profiler.rb:51:in `profile' /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/network/http/handler.rb:58:in `process' file:/opt/puppetlabs/server/apps/puppetserver/puppet-server-release.jar!/puppet-server-lib/puppet/server/master.rb:39:in `handleRequest' Puppet$$Server$$Master_1555992597.gen:13:in `handleRequest' request_handler_core.clj:274:in `invoke' request_handler_service.clj:14:in `handle_request' request_handler.clj:3:in `invoke' request_handler.clj:3:in `invoke' core.clj:626:in `invoke' core.clj:2468:in `doInvoke' master_core.clj:47:in `invoke' ring.clj:22:in `invoke' ring.clj:13:in `invoke' comidi.clj:267:in `invoke' ringutils.clj:106:in `invoke' ringutils.clj:62:in `invoke' ringutils.clj:68:in `invoke' ringutils.clj:118:in `invoke' http.clj:152:in `invoke' http.clj:152:in `invoke' http.clj:148:in `invoke' comidi.clj:314:in `invoke' jetty9_core.clj:408:in `invoke' 2015-11-03 20:45:05,678 INFO [puppet-server] Puppet Caching facts for pe-201522-agent.puppetdebug.vlan 2015-11-03 20:45:05,694 INFO [puppet-server] Puppet Caching node for pe-201522-agent.puppetdebug.vlan 2015-11-03 20:45:05,721 ERROR [puppet-server] Puppet Attempt to assign to a reserved variable name: 'trusted' on node pe-201522-agent.puppetdebug.vlan Expected Outcome Subclasses of Puppet::Indirector::Yaml explicitly create objects from cached data rather than relying on YAML parser magic. Add Comment   This message was sent by Atlassian JIRA (v6.4.12#64027-sha1:e3691cc) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at http://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.