Upgrade to Ring 1.1.1

Ring 1.1.1 contains the necessary changes to its servlet adapter to allow for
inspection of client-supplied SSL certificates. Upgrading also requires an
upgrade to Jetty 7. This required some changes in the handful of monkeypatches
we made to ring-jetty-adapter, though the new versions of ring obviate some of
them (ring now includes support for client-auth, so we no longer need to roll
our own).

The new version of Jetty pulls in its own version of various logging libraries,
and one of these conflicts with the version required by some of the other
libraries we're using. To resolve this conflict, I've excluded the problematic
library from each dependency that tries to fold it in itself, and instead
explicitly require a specific version.

Signed-off-by: Deepak Giridharagopal <deepak@puppetlabs.com>
Utility func for creating a lazy sequence of lines from a file

Signed-off-by: Deepak Giridharagopal <deepak@puppetlabs.com>
Funcs for extracting the CN from an x509 certificate

The JDK helpfully includes a set of classes for parsing x509 certificates and
RFC 2253 LDAP distinguished names, which makes extracting the CN
straightforward.

When encountering a DN with multiple CN's contained within, I opt for the
most-specific CN (which, according to the RFC, is the one that appears last).

Signed-off-by: Deepak Giridharagopal <deepak@puppetlabs.com>
(#14947) Restrict acceptable client certificates by CN

This patchset implements an optional whitelist for HTTPS clients. If
enabled by the user, we validate that the CN of the supplied client
certificate exactly matches an entry in the whitelist. This feature is
off by default.

This is implemented as ring middleware and a single, additional
configuration option. For plain HTTP connections, all clients are
allowed (as no client certificate will be present).

Signed-off-by: Deepak Giridharagopal <deepak@puppetlabs.com>
Acceptance tests for certificate whitelisting

Signed-off-by: Deepak Giridharagopal <deepak@puppetlabs.com>
Improved "logging of last resort"

There are certain points in the lifecycle of PuppetDB where it's
critical that we properly log an exception, even if that means we spam
different log targets (logfiles, stdout, stderr, etc) and duplicate
output.

Daemon startup is one of these critical points. An error during
startup should be logged as thoroughly as possible, as there's no
really good way to debug the issue otherwise (as the daemon will
terminate upon error, making it hard to do meaningful
live-debugging). This becomes doubly-important when you consider that
99% of users are launching PuppetDB via an init script of some sort,
and init scripts can do funky things with the stdout and stderr
streams of launched processes. On some platforms, that stuff is
captured for you. On others, it goes to the users interactive
terminal. And still on others, it ends up in the aether never to be
seen again.

The other critical point is when a thread dies due to an unhandled
exception. I'd prefer that never occur but, well, shit happens yo. You
can register a callback with the JVM whenever a unhandled exception
occurs, so we can use the same verbose logging routines we employ
during daemon startup to ensure that unhandled exceptions get some
degree of debuggability.

Better safe than sorry, and I'd prefer to err on the side of logging
too much during these critical sections of code than log too little.

Signed-off-by: Deepak Giridharagopal <deepak@puppetlabs.com>
Safely ordered and more thorough catch-all logging

We now log to stdout first, prior to using the system logger. This
avoids a situation where the system logger is misconfigured (or is
otherwise broken) and attempts to log to it would themselves trigger
an exception.

This also allows us to ensure that the information logged to stdout is
properly flushed prior to forwarding the exception to the system
logger. That means we can reduce the likelihood of interleaved output
on stdout.

Finally, we replace the call to `printStackTrace` with the
`print-cause-trace` function that's part of the clojure.stacktrace
library.

Signed-off-by: Deepak Giridharagopal <deepak@puppetlabs.com>
Merge pull request #199 from cprice-puppet/bug/master/fix-185-specs

Fix test that was broken on 1.8.5
Merge pull request #198 from grimradical/catch-all-logging

Improved "logging of last resort"
(#15321) Add aliases for namevars that are munged via title_pattern

When we are creating aliases for resources (in order to ensure
dependency resolution in the catalog), we need to take into account
the case where the resource type defines one or more title_patterns,
which, when used to set the value of the namevar, may munge the value
via regex awesomeness.  'File' is an example of such a resource, as
it will strip trailing slashes from the title to set the :path
parameter if :path is not specified.

Because this title_pattern munging happens as a side effect of the
Puppet::Resource#to_hash method, it is important that our namevar
alias code search that hash for necessary aliases rather than
searching the Puppet::Resource instance directly.

This commit changes add_namevar_aliases to do that.  I plan to
file a ticket for puppet core about the fact that the to_hash
method probably should not need to be relied upon to trigger
this side effect.
Port node query compiler to the resource form

This makes the code much more similar for the two types of queries, and
probably also much faster for complex queries. Right now that means a
lot of duplication, but hopefully it will allow for future unification
into a single query API.
(#15059) Stop loading non-SSL content in the dashboard

This commit gets rid of two places where we were
potentially loading non-SSL content into the dashboard.

1. We import some CSS from googleapis.com.  Because google
   is doing magical browser-specific DOM stuff based on
   the User-Agent header, I thought it would be better to
   just change our request to use https rather than trying
   to re-invent that wheel.

2. We were pulling down some javascript from github.  I've
   made a local copy of it and added the original download
   URL and License into the header, so that we can serve
   it locally.
Merge pull request #201 from cprice-puppet/feature/master/15059-serve-css-locally

(#15059) Stop loading non-SSL content in the dashboard
Properly handle non-string node queries

Previously, these would result in 500 errors as the database failed the
comparisons because of mismatched types. Now, all equality comparisons
will be done against strings, and all numeric comparisons will be done
against numbers.

For equality comparisons, non-string arguments will be converted. This
allows natural queries against numbers or booleans to work despite all
fact values technically being strings.

For numeric comparisons, non-numeric arguments will be converted.
However, if the argument doesn't represent a number, the query will
be rejected.
Cleanup JSON examples in documentation

Some of these were using Clojure expressions, when they're really
talking about the REST API which is JSON.
Merge pull request #200 from cprice-puppet/bug/master/15321-file-resource-trailing-slash

(#15321) Add aliases for namevars that are munged via title_pattern
Allow complex storeconfigs queries

This is pretty simple, since the plumbing is already there in the Puppet
language, the collector, and PuppetDB's query API. All we need to do is
teach the terminus how to build PuppetDB queries for complex
expressions.
Remove redundant wording about JSON
Don't handle "=" in resource queries

Puppet language only allows "==" and passes it directly through, which
means we will never get a "=" operator. Leaving this code could be
misleading, so it's better to be precise.
Add acceptance tests for complex queries

This adds tests for 'and', 'or', and nested queries.