(#294) Fix missing hyphen in tag name

Hyphen is allowed in tag names, but was being stripped by a broken
regular expression. It needs escaping to be treated literally.

This fixes #294.
Adds protection against injection attacks to the nodejs layer

The nodejs layer of the Razor back-end was wide open to injection attacks. Not
only did all commands perform shell expansion of the command line, some paths
where also directly mapped to the file system without first checking if they
contained '..' segments. I had no problems letting Razor server up my private
ssh key for instance. This commits adds some code to prevent injection attacks
from happening. It consist of the following:
1. All calls to exec() has been replaced by calls to execFile() to avoid shell
   expansion.
2. When the execFile results in errors, those errors are now handled. They
   were previously ignored.
3. Splitting, decoding, and validation of request path was refactored into one
   function.
4. A new exception type InvalidURIPathError was introduced.
5. All path segments are checked for length (<200 characters) and validated
   with a regexp that ensures that they don't contain any control characters.
6. Several tests were added to verify that some known types of injection
   attacks are trapped.
Changed all instances of "invert" in tag.rb to "inverse" to work properly with the tag matching capability of both Razor and puppetlabs-razor
Prevents web access to the Razor config

One of the points in the security assessment of Razor was
"Unauthenticated access to Razor configuration file".

This commit ensures that this file cannot be accessed using
the web interface by letting the Ruby CLI preventing access
to the 'config' slice for all calls using the -w flag.

A new flag, '-j' was introduced to enable the nodejs layer
to obtain the config in json format. The Ruby CLI will block
all attemts to combine the -w and -j flags.

The prevention check was added to the Ruby layer rather than
in the nodejs layer for two reasons:
1. There are ongoing discussions about replacing nodejs.
2. The check would have been added for all http methods. In
   the Ruby CLI, it was enough to add it in one place.

A more elaborate solution where the check was moved into the
'config' slice was considered but rejected because I wanted
to keep the alteration as limited (and thus easy to review)
as possible.

The commit also contains some tests to verify that the config
is impossible to obtain using the web.
pool.sks-keyservers.net GPG key server is unreliable

The `pool.sks-keyservers.net` machines occasionally time-out trying to fetch
the GPG key, which leads to an acceptance test failure - because we can't get
the key required to install Puppet, which means we can't install Razor.

We should make sure we at least try more than once to fetch the key, and
ideally use a second source so that we increase the chance of successfully
finding the public key material.

This shouldn't change the overall robustness of the system because all the
various key servers exchange keying data with each other routinely, and we are
not looking for keys that rapidly change.

This implements that, trying with `pgp.mit.edu` and then `keyserver.pgp.com`
if we fail on fetching the key from sks; that should be fairly robust.

Closes #375.

Signed-off-by: Daniel Pittman <daniel@rimspace.net>
Added Razor init scripts for Debian and RedHat

This adds wrapper init scripts that smooth the path between the `daemons`
based Ruby script for starting the Razor service and the system.

That consists of providing the correct sequencing and packaging hooks to end
up invoking that Ruby script to perform the actual action.

This ensures that LSB tools, chkconfig, and related system integrations will
behave as expected when the packages are installed.

This closes #320 for now.

Signed-off-by: Daniel Pittman <daniel@rimspace.net>
Razor packages must not overwrite git deployments

The general opinion of the community was that installing packages over the top
of an existing git deployment of Razor is a bad idea, and they should refuse
to install.

I tend to agree: that is the most conservative approach, and puts the
responsibility on the end user to decide how they want to handle the
change over.

This shouldn't last forever, but we should at least initially have pre-install
and pre-upgrade code that refuses to install if /opt/razor/.git exists.

This implements that using pre-install scripts to check for the git directory
being present - but only for the first install; upgrades ignore it, so that
managing configuration through git will work after that first install is
pushed through.

This closes #322.

Signed-off-by: Daniel Pittman <daniel@rimspace.net>
Use fully-qualified VM hostname for internal tests

Using a fully-qualified VM hostname makes it much easier to run acceptance
tests over a remote network through the VPN - in turn, reducing friction when
it comes to building new acceptance tests.

Signed-off-by: Daniel Pittman <daniel@rimspace.net>
Test packages refuse to install over git deployments

This adds an acceptance test to verify that we don't install packages over the
top of an existing git deployment.  This should help ensure that our
preinstall scripts actually work to abort in that case.

In the words of Knuth, "Beware of bugs in the above code; I have only proved
it correct, not tried it." -- in this case, I have verified it as far as I am
able, but limitations of internal package repositories, multiple Jenkins
deployments, and branch testing mean that I am unfortunately unable to run
this through a full CI suite in the real world.

Consequently I expect something to blow up when faced with reality, although
it should only be a minor deviation in the road.  (None of this is helped, of
course, by bugs in other products that make it harder to verify success or
failure than I might like.)

Signed-off-by: Daniel Pittman <daniel@rimspace.net>
Merge pull request #376 from daniel-pittman/feature/master/375-increase-gpg-key-server-robustness

pool.sks-keyservers.net GPG key server is unreliable
Merge pull request #320 from daniel-pittman/feature/master/320-implement-real-init-dot-d-script-for-razor

Implement a real init.d style script for Razor
Merge pull request #322 from daniel-pittman/feature/master/322-refuse-to-install-over-git-deployments

Ensure that the Razor packages will not install over an existing git-based deployment.
Handle platforms with "purged" packages in git install test

When we validate that packages refuse to install over the top of an existing
git-based deployment, we end up with a package that isn't installed.

Unfortunately, that is represented by two distinct states in Puppet, `absent`
and `purged`, with only a subset of platforms supporting the later state, and
even then, only sometimes reporting it.

This means that the test was broken in the real world: it reported `absent` on
my test bench, but put into production it reported `purged`, and we
incorrectly decided that the package was installed when it actually wasn't.

This makes the obvious update to the check, so that we handle both cases, and
should fix the acceptance test failure after #322 merged.

Signed-off-by: Daniel Pittman <daniel@rimspace.net>
Merge pull request #385 from daniel-pittman/feature/master/322-refuse-to-install-over-git-deployments

Handle platforms with "purged" packages in git install test
Define confdir in redhat spec

In commit 0fd1f7c, init scripts were added for Razor, and packaging artifacts
were updated to install them. However, as written, the redhat spec file
attempts to install the init script using a macro '%{confdir}' that is not
defined. This causes rpm packaging to fail, because the path to the init script
is invalid.  This commit defines the missing %{confdir} macro as ext/redhat so
that the install succeeds and package build completes. This solution was chosen
over just hardcoding the path 'ext/redhat' because macros are generally more
reusable and maintainable, but in this case it feels like a toss-up since we
use this path only once.
Merge pull request #386 from MosesMendoza/define_confidr_in_redhat_spec

Define confdir in redhat spec
Update internal package repository layout

This updates the acceptance tests to handle the new "consistent snapshot of
internal package repositories" process, in conjunction with our
CI infrastructure.

Essentially, the CI system captures the version of the internal Razor packages
we are testing at the start of the run, and the acceptance suite then uses
that consistent snapshot for the entire run.

This avoids a problem where you could wind up with the package versions
changing between the start of an acceptance run and the end of the same run,
triggered when, for example, we commit multiple pull requests in
quick succession.

This shouldn't have any user-visible change outside our own testing and
package release process.

Signed-off-by: Daniel Pittman <daniel@rimspace.net>
Merge pull request #389 from daniel-pittman/feature/master/388-handle-updated-internal-package-repo-layout

Update internal package repository layout
Merge pull request #308 from tdb/bug/master/294-fix-hypen-in-tag-name

(#294) Fix missing hyphen in tag name
Merge pull request #362 from virtualswede/32f0b31045c5f77e1016a7b255459a5bc73e8d66

Changed all instances of "invert" in tag.rb to "inverse" to work properly with the tag matching capability of both Razor and puppetlabs-razor < new pull request