diff --git a/lib/puppet.rb b/lib/puppet.rb
index 329a5a893..940b63c16 100644
--- a/lib/puppet.rb
+++ b/lib/puppet.rb
@@ -1,270 +1,274 @@
 require 'puppet/version'
 
 # see the bottom of the file for further inclusions
 # Also see the new Vendor support - towards the end
 #
 require 'facter'
 require 'puppet/error'
 require 'puppet/util'
 require 'puppet/util/autoload'
 require 'puppet/settings'
 require 'puppet/util/feature'
 require 'puppet/util/suidmanager'
 require 'puppet/util/run_mode'
 require 'puppet/external/pson/common'
 require 'puppet/external/pson/version'
 require 'puppet/external/pson/pure'
 
 #------------------------------------------------------------
 # the top-level module
 #
 # all this really does is dictate how the whole system behaves, through
 # preferences for things like debugging
 #
 # it's also a place to find top-level commands like 'debug'
 
 # The main Puppet class. Everything is contained here.
 #
 # @api public
 module Puppet
   require 'puppet/file_system'
   require 'puppet/context'
   require 'puppet/environments'
 
   class << self
     include Puppet::Util
     attr_reader :features
     attr_writer :name
   end
 
   # the hash that determines how our system behaves
   @@settings = Puppet::Settings.new
 
   # The services running in this process.
   @services ||= []
 
   require 'puppet/util/logging'
 
   extend Puppet::Util::Logging
 
   # The feature collection
   @features = Puppet::Util::Feature.new('puppet/feature')
 
   # Load the base features.
   require 'puppet/feature/base'
 
   # Store a new default value.
   def self.define_settings(section, hash)
     @@settings.define_settings(section, hash)
   end
 
   # Get the value for a setting
   #
   # @param [Symbol] param the setting to retrieve
   #
   # @api public
   def self.[](param)
     if param == :debug
       return Puppet::Util::Log.level == :debug
     else
       return @@settings[param]
     end
   end
 
   # setting access and stuff
   def self.[]=(param,value)
     @@settings[param] = value
   end
 
   def self.clear
     @@settings.clear
   end
 
   def self.debug=(value)
     if value
       Puppet::Util::Log.level=(:debug)
     else
       Puppet::Util::Log.level=(:notice)
     end
   end
 
   def self.settings
     @@settings
   end
 
 
   def self.run_mode
     # This sucks (the existence of this method); there are a lot of places in our code that branch based the value of
     # "run mode", but there used to be some really confusing code paths that made it almost impossible to determine
     # when during the lifecycle of a puppet application run the value would be set properly.  A lot of the lifecycle
     # stuff has been cleaned up now, but it still seems frightening that we rely so heavily on this value.
     #
     # I'd like to see about getting rid of the concept of "run_mode" entirely, but there are just too many places in
     # the code that call this method at the moment... so I've settled for isolating it inside of the Settings class
     # (rather than using a global variable, as we did previously...).  Would be good to revisit this at some point.
     #
     # --cprice 2012-03-16
     Puppet::Util::RunMode[@@settings.preferred_run_mode]
   end
 
   # Load all of the settings.
   require 'puppet/defaults'
 
   def self.genmanifest
     if Puppet[:genmanifest]
       puts Puppet.settings.to_manifest
       exit(0)
     end
   end
 
   # Parse the config file for this process.
   # @deprecated Use {initialize_settings}
   def self.parse_config()
     Puppet.deprecation_warning("Puppet.parse_config is deprecated; please use Faces API (which will handle settings and state management for you), or (less desirable) call Puppet.initialize_settings")
     Puppet.initialize_settings
   end
 
   # Initialize puppet's settings. This is intended only for use by external tools that are not
   #  built off of the Faces API or the Puppet::Util::Application class. It may also be used
   #  to initialize state so that a Face may be used programatically, rather than as a stand-alone
   #  command-line tool.
   #
   # @api public
   # @param args [Array<String>] the command line arguments to use for initialization
   # @return [void]
   def self.initialize_settings(args = [])
     do_initialize_settings_for_run_mode(:user, args)
   end
 
   # Initialize puppet's settings for a specified run_mode.
   #
   # @deprecated Use {initialize_settings}
   def self.initialize_settings_for_run_mode(run_mode)
     Puppet.deprecation_warning("initialize_settings_for_run_mode may be removed in a future release, as may run_mode itself")
     do_initialize_settings_for_run_mode(run_mode, [])
   end
 
   # private helper method to provide the implementation details of initializing for a run mode,
   #  but allowing us to control where the deprecation warning is issued
   def self.do_initialize_settings_for_run_mode(run_mode, args)
     Puppet.settings.initialize_global_settings(args)
     run_mode = Puppet::Util::RunMode[run_mode]
     Puppet.settings.initialize_app_defaults(Puppet::Settings.app_defaults_for_run_mode(run_mode))
     Puppet.push_context(Puppet.base_context(Puppet.settings), "Initial context after settings initialization")
     Puppet::Parser::Functions.reset
     Puppet::Util::Log.level = Puppet[:log_level]
   end
   private_class_method :do_initialize_settings_for_run_mode
 
   # Create a new type.  Just proxy to the Type class.  The mirroring query
   # code was deprecated in 2008, but this is still in heavy use.  I suppose
   # this can count as a soft deprecation for the next dev. --daniel 2011-04-12
   def self.newtype(name, options = {}, &block)
     Puppet::Type.newtype(name, options, &block)
   end
 
   # Load vendored (setup paths, and load what is needed upfront).
   # See the Vendor class for how to add additional vendored gems/code
   require "puppet/vendor"
   Puppet::Vendor.load_vendored
 
   # Set default for YAML.load to unsafe so we don't affect programs
   # requiring puppet -- in puppet we will call safe explicitly
   SafeYAML::OPTIONS[:default_mode] = :unsafe
 
   # The bindings used for initialization of puppet
   # @api private
   def self.base_context(settings)
     environments = settings[:environmentpath]
     modulepath = Puppet::Node::Environment.split_path(settings[:basemodulepath])
 
     if environments.empty?
       loaders = [Puppet::Environments::Legacy.new]
     else
       loaders = Puppet::Environments::Directories.from_path(environments, modulepath)
       # in case the configured environment (used for the default sometimes)
       # doesn't exist
       default_environment = Puppet[:environment].to_sym
       if default_environment == :production
         loaders << Puppet::Environments::StaticPrivate.new(
           Puppet::Node::Environment.create(Puppet[:environment].to_sym,
                                            [],
                                            Puppet::Node::Environment::NO_MANIFEST))
       end
     end
 
     {
-      :environments => Puppet::Environments::Cached.new(*loaders)
+      :environments => Puppet::Environments::Cached.new(*loaders),
+      :http_pool => proc {
+        require 'puppet/network/http'
+        Puppet::Network::HTTP::NoCachePool.new
+      }
     }
   end
 
   # A simple set of bindings that is just enough to limp along to
   # initialization where the {base_context} bindings are put in place
   # @api private
   def self.bootstrap_context
     root_environment = Puppet::Node::Environment.create(:'*root*', [], Puppet::Node::Environment::NO_MANIFEST)
     {
       :current_environment => root_environment,
       :root_environment => root_environment
     }
   end
 
   # @param overrides [Hash] A hash of bindings to be merged with the parent context.
   # @param description [String] A description of the context.
   # @api private
   def self.push_context(overrides, description = "")
     @context.push(overrides, description)
   end
 
   # Return to the previous context.
   # @raise [StackUnderflow] if the current context is the root
   # @api private
   def self.pop_context
     @context.pop
   end
 
   # Lookup a binding by name or return a default value provided by a passed block (if given).
   # @api private
   def self.lookup(name, &block)
     @context.lookup(name, &block)
   end
 
   # @param bindings [Hash] A hash of bindings to be merged with the parent context.
   # @param description [String] A description of the context.
   # @yield [] A block executed in the context of the temporarily pushed bindings.
   # @api private
   def self.override(bindings, description = "", &block)
     @context.override(bindings, description, &block)
   end
 
   # @api private
   def self.mark_context(name)
     @context.mark(name)
   end
 
   # @api private
   def self.rollback_context(name)
     @context.rollback(name)
   end
 
   require 'puppet/node'
 
   # The single instance used for normal operation
   @context = Puppet::Context.new(bootstrap_context)
 end
 
 # This feels weird to me; I would really like for us to get to a state where there is never a "require" statement
 #  anywhere besides the very top of a file.  That would not be possible at the moment without a great deal of
 #  effort, but I think we should strive for it and revisit this at some point.  --cprice 2012-03-16
 
 require 'puppet/indirector'
 require 'puppet/type'
 require 'puppet/resource'
 require 'puppet/parser'
 require 'puppet/network'
 require 'puppet/ssl'
 require 'puppet/module'
 require 'puppet/data_binding'
 require 'puppet/util/storage'
 require 'puppet/status'
 require 'puppet/file_bucket/file'
diff --git a/lib/puppet/configurer.rb b/lib/puppet/configurer.rb
index 213627039..503725555 100644
--- a/lib/puppet/configurer.rb
+++ b/lib/puppet/configurer.rb
@@ -1,286 +1,298 @@
 # The client for interacting with the puppetmaster config server.
 require 'sync'
 require 'timeout'
 require 'puppet/network/http_pool'
 require 'puppet/util'
 require 'securerandom'
 
 class Puppet::Configurer
   require 'puppet/configurer/fact_handler'
   require 'puppet/configurer/plugin_handler'
 
   include Puppet::Configurer::FactHandler
   include Puppet::Configurer::PluginHandler
 
   # For benchmarking
   include Puppet::Util
 
   attr_reader :compile_time, :environment
 
   # Provide more helpful strings to the logging that the Agent does
   def self.to_s
     "Puppet configuration client"
   end
 
   def execute_postrun_command
     execute_from_setting(:postrun_command)
   end
 
   def execute_prerun_command
     execute_from_setting(:prerun_command)
   end
 
   # Initialize and load storage
   def init_storage
       Puppet::Util::Storage.load
       @compile_time ||= Puppet::Util::Storage.cache(:configuration)[:compile_time]
   rescue => detail
     Puppet.log_exception(detail, "Removing corrupt state file #{Puppet[:statefile]}: #{detail}")
     begin
       Puppet::FileSystem.unlink(Puppet[:statefile])
       retry
     rescue => detail
       raise Puppet::Error.new("Cannot remove #{Puppet[:statefile]}: #{detail}", detail)
     end
   end
 
   def initialize
     Puppet.settings.use(:main, :ssl, :agent)
 
     @running = false
     @splayed = false
     @environment = Puppet[:environment]
     @transaction_uuid = SecureRandom.uuid
   end
 
   # Get the remote catalog, yo.  Returns nil if no catalog can be found.
   def retrieve_catalog(query_options)
     query_options ||= {}
     # First try it with no cache, then with the cache.
     unless (Puppet[:use_cached_catalog] and result = retrieve_catalog_from_cache(query_options)) or result = retrieve_new_catalog(query_options)
       if ! Puppet[:usecacheonfailure]
         Puppet.warning "Not using cache on failed catalog"
         return nil
       end
       result = retrieve_catalog_from_cache(query_options)
     end
 
     return nil unless result
 
     convert_catalog(result, @duration)
   end
 
   # Convert a plain resource catalog into our full host catalog.
   def convert_catalog(result, duration)
     catalog = result.to_ral
     catalog.finalize
     catalog.retrieval_duration = duration
     catalog.write_class_file
     catalog.write_resource_file
     catalog
   end
 
   def get_facts(options)
     if options[:pluginsync]
       remote_environment_for_plugins = Puppet::Node::Environment.remote(@environment)
       download_plugins(remote_environment_for_plugins)
     end
 
     if Puppet::Resource::Catalog.indirection.terminus_class == :rest
       # This is a bit complicated.  We need the serialized and escaped facts,
       # and we need to know which format they're encoded in.  Thus, we
       # get a hash with both of these pieces of information.
       #
       # facts_for_uploading may set Puppet[:node_name_value] as a side effect
       return facts_for_uploading
     end
   end
 
   def prepare_and_retrieve_catalog(options, query_options)
     # set report host name now that we have the fact
     options[:report].host = Puppet[:node_name_value]
 
     unless catalog = (options.delete(:catalog) || retrieve_catalog(query_options))
       Puppet.err "Could not retrieve catalog; skipping run"
       return
     end
     catalog
   end
 
   # Retrieve (optionally) and apply a catalog. If a catalog is passed in
   # the options, then apply that one, otherwise retrieve it.
   def apply_catalog(catalog, options)
     report = options[:report]
     report.configuration_version = catalog.version
 
     benchmark(:notice, "Finished catalog run") do
       catalog.apply(options)
     end
 
     report.finalize_report
     report
   end
 
   # The code that actually runs the catalog.
   # This just passes any options on to the catalog,
   # which accepts :tags and :ignoreschedules.
   def run(options = {})
+    pool = Puppet::Network::HTTP::Pool.new(Puppet[:http_keepalive_timeout])
+    begin
+      Puppet.override(:http_pool => pool) do
+        run_internal(options)
+      end
+    ensure
+      pool.close
+    end
+  end
+
+  def run_internal(options)
     # We create the report pre-populated with default settings for
     # environment and transaction_uuid very early, this is to ensure
     # they are sent regardless of any catalog compilation failures or
     # exceptions.
     options[:report] ||= Puppet::Transaction::Report.new("apply", nil, @environment, @transaction_uuid)
     report = options[:report]
     init_storage
 
     Puppet::Util::Log.newdestination(report)
 
     begin
       unless Puppet[:node_name_fact].empty?
         query_options = get_facts(options)
       end
 
       # We only need to find out the environment to run in if we don't already have a catalog
       unless options[:catalog]
         begin
           if node = Puppet::Node.indirection.find(Puppet[:node_name_value],
               :environment => @environment, :ignore_cache => true, :transaction_uuid => @transaction_uuid,
               :fail_on_404 => true)
 
             # If we have deserialized a node from a rest call, we want to set
             # an environment instance as a simple 'remote' environment reference.
             if !node.has_environment_instance? && node.environment_name
               node.environment = Puppet::Node::Environment.remote(node.environment_name)
             end
 
             if node.environment.to_s != @environment
               Puppet.warning "Local environment: \"#{@environment}\" doesn't match server specified node environment \"#{node.environment}\", switching agent to \"#{node.environment}\"."
               @environment = node.environment.to_s
               report.environment = @environment
               query_options = nil
             end
           end
         rescue SystemExit,NoMemoryError
           raise
         rescue Exception => detail
           Puppet.warning("Unable to fetch my node definition, but the agent run will continue:")
           Puppet.warning(detail)
         end
       end
 
       current_environment = Puppet.lookup(:current_environment)
       local_node_environment =
       if current_environment.name == @environment.intern
         current_environment
       else
         Puppet::Node::Environment.create(@environment,
                                          current_environment.modulepath,
                                          current_environment.manifest,
                                          current_environment.config_version)
       end
       Puppet.push_context({:current_environment => local_node_environment}, "Local node environment for configurer transaction")
 
       query_options = get_facts(options) unless query_options
 
       # get_facts returns nil during puppet apply
       query_options ||= {}
       query_options[:transaction_uuid] = @transaction_uuid
 
       unless catalog = prepare_and_retrieve_catalog(options, query_options)
         return nil
       end
 
       # Here we set the local environment based on what we get from the
       # catalog. Since a change in environment means a change in facts, and
       # facts may be used to determine which catalog we get, we need to
       # rerun the process if the environment is changed.
       tries = 0
       while catalog.environment and not catalog.environment.empty? and catalog.environment != @environment
         if tries > 3
           raise Puppet::Error, "Catalog environment didn't stabilize after #{tries} fetches, aborting run"
         end
         Puppet.warning "Local environment: \"#{@environment}\" doesn't match server specified environment \"#{catalog.environment}\", restarting agent run with environment \"#{catalog.environment}\""
         @environment = catalog.environment
         report.environment = @environment
         return nil unless catalog = prepare_and_retrieve_catalog(options, query_options)
         tries += 1
       end
 
       execute_prerun_command or return nil
       apply_catalog(catalog, options)
       report.exit_status
     rescue => detail
       Puppet.log_exception(detail, "Failed to apply catalog: #{detail}")
       return nil
     ensure
       execute_postrun_command or return nil
     end
   ensure
     # Between Puppet runs we need to forget the cached values.  This lets us
     # pick up on new functions installed by gems or new modules being added
     # without the daemon being restarted.
     $env_module_directories = nil
 
     Puppet::Util::Log.close(report)
     send_report(report)
     Puppet.pop_context
   end
+  private :run_internal
 
   def send_report(report)
     puts report.summary if Puppet[:summarize]
     save_last_run_summary(report)
     Puppet::Transaction::Report.indirection.save(report, nil, :environment => @environment) if Puppet[:report]
   rescue => detail
     Puppet.log_exception(detail, "Could not send report: #{detail}")
   end
 
   def save_last_run_summary(report)
     mode = Puppet.settings.setting(:lastrunfile).mode
     Puppet::Util.replace_file(Puppet[:lastrunfile], mode) do |fh|
       fh.print YAML.dump(report.raw_summary)
     end
   rescue => detail
     Puppet.log_exception(detail, "Could not save last run local report: #{detail}")
   end
 
   private
 
   def execute_from_setting(setting)
     return true if (command = Puppet[setting]) == ""
 
     begin
       Puppet::Util::Execution.execute([command])
       true
     rescue => detail
       Puppet.log_exception(detail, "Could not run command from #{setting}: #{detail}")
       false
     end
   end
 
   def retrieve_catalog_from_cache(query_options)
     result = nil
     @duration = thinmark do
       result = Puppet::Resource::Catalog.indirection.find(Puppet[:node_name_value],
         query_options.merge(:ignore_terminus => true, :environment => @environment))
     end
     Puppet.notice "Using cached catalog"
     result
   rescue => detail
     Puppet.log_exception(detail, "Could not retrieve catalog from cache: #{detail}")
     return nil
   end
 
   def retrieve_new_catalog(query_options)
     result = nil
     @duration = thinmark do
       result = Puppet::Resource::Catalog.indirection.find(Puppet[:node_name_value],
         query_options.merge(:ignore_cache => true, :environment => @environment, :fail_on_404 => true))
     end
     result
   rescue SystemExit,NoMemoryError
     raise
   rescue Exception => detail
     Puppet.log_exception(detail, "Could not retrieve catalog from remote server: #{detail}")
     return nil
   end
 end
diff --git a/lib/puppet/defaults.rb b/lib/puppet/defaults.rb
index c1dabc2f6..c3c580435 100644
--- a/lib/puppet/defaults.rb
+++ b/lib/puppet/defaults.rb
@@ -1,2019 +1,2030 @@
 module Puppet
 
   def self.default_diffargs
     if (Facter.value(:kernel) == "AIX" && Facter.value(:kernelmajversion) == "5300")
       ""
     else
       "-u"
     end
   end
 
   ############################################################################################
   # NOTE: For information about the available values for the ":type" property of settings,
   #   see the docs for Settings.define_settings
   ############################################################################################
 
   AS_DURATION = %q{This setting can be a time interval in seconds (30 or 30s), minutes (30m), hours (6h), days (2d), or years (5y).}
   STORECONFIGS_ONLY = %q{This setting is only used by the ActiveRecord storeconfigs and inventory backends, which are deprecated.}
 
   # This is defined first so that the facter implementation is replaced before other setting defaults are evaluated.
   define_settings(:main,
     :cfacter => {
         :default => false,
         :type    => :boolean,
         :desc    => 'Whether or not to use the native facter (cfacter) implementation instead of the Ruby one (facter). Defaults to false.',
         :hook    => proc do |value|
           return unless value
           raise ArgumentError, 'facter has already evaluated facts.' if Facter.instance_variable_get(:@collection)
           require 'puppet/facts'
           raise ArgumentError, 'cfacter version 0.2.0 or later is not installed.' unless Puppet::Facts.replace_facter
         end
     }
   )
 
   define_settings(:main,
     :confdir  => {
         :default  => nil,
         :type     => :directory,
         :desc     => "The main Puppet configuration directory.  The default for this setting
           is calculated based on the user.  If the process is running as root or
           the user that Puppet is supposed to run as, it defaults to a system
           directory, but if it's running as any other user, it defaults to being
           in the user's home directory.",
     },
     :vardir   => {
         :default  => nil,
         :type     => :directory,
         :owner    => "service",
         :group    => "service",
         :desc     => "Where Puppet stores dynamic and growing data.  The default for this
           setting is calculated specially, like `confdir`_.",
     },
 
     ### NOTE: this setting is usually being set to a symbol value.  We don't officially have a
     ###     setting type for that yet, but we might want to consider creating one.
     :name     => {
         :default  => nil,
         :desc     => "The name of the application, if we are running as one.  The
           default is essentially $0 without the path or `.rb`.",
     }
   )
 
   define_settings(:main,
     :logdir => {
         :default  => nil,
         :type     => :directory,
         :mode     => 0750,
         :owner    => "service",
         :group    => "service",
         :desc     => "The directory in which to store log files",
     },
     :log_level => {
       :default    => 'notice',
       :type       => :enum,
       :values     => ["debug","info","notice","warning","err","alert","emerg","crit"],
       :desc       => "Default logging level for messages from Puppet. Allowed values are:
 
         * debug
         * info
         * notice
         * warning
         * err
         * alert
         * emerg
         * crit
         ",
     },
     :disable_warnings => {
       :default => [],
       :type    => :array,
       :desc    => "A comma-separated list of warning types to suppress. If large numbers
         of warnings are making Puppet's logs too large or difficult to use, you
         can temporarily silence them with this setting.
 
         If you are preparing to upgrade Puppet to a new major version, you
         should re-enable all warnings for a while.
 
         Valid values for this setting are:
 
         * `deprecations` --- disables deprecation warnings.",
       :hook      => proc do |value|
         values = munge(value)
         valid   = %w[deprecations]
         invalid = values - (values & valid)
         if not invalid.empty?
           raise ArgumentError, "Cannot disable unrecognized warning types #{invalid.inspect}. Valid values are #{valid.inspect}."
         end
       end
     }
   )
 
   define_settings(:main,
     :priority => {
       :default => nil,
       :type    => :priority,
       :desc    => "The scheduling priority of the process.  Valid values are 'high',
         'normal', 'low', or 'idle', which are mapped to platform-specific
         values.  The priority can also be specified as an integer value and
         will be passed as is, e.g. -5.  Puppet must be running as a privileged
         user in order to increase scheduling priority.",
     },
     :trace => {
         :default  => false,
         :type     => :boolean,
         :desc     => "Whether to print stack traces on some errors",
     },
     :profile => {
         :default  => false,
         :type     => :boolean,
         :desc     => "Whether to enable experimental performance profiling",
     },
     :autoflush => {
       :default => true,
       :type       => :boolean,
       :desc       => "Whether log files should always flush to disk.",
       :hook       => proc { |value| Log.autoflush = value }
     },
     :syslogfacility => {
         :default  => "daemon",
         :desc     => "What syslog facility to use when logging to syslog.
           Syslog has a fixed list of valid facilities, and you must
           choose one of those; you cannot just make one up."
     },
     :statedir => {
         :default  => "$vardir/state",
         :type     => :directory,
         :mode     => 01755,
         :desc     => "The directory where Puppet state is stored.  Generally,
           this directory can be removed without causing harm (although it
           might result in spurious service restarts)."
     },
     :rundir => {
       :default  => nil,
       :type     => :directory,
       :mode     => 0755,
       :owner    => "service",
       :group    => "service",
       :desc     => "Where Puppet PID files are kept."
     },
     :genconfig => {
         :default  => false,
         :type     => :boolean,
         :desc     => "When true, causes Puppet applications to print an example config file
           to stdout and exit. The example will include descriptions of each
           setting, and the current (or default) value of each setting,
           incorporating any settings overridden on the CLI (with the exception
           of `genconfig` itself). This setting only makes sense when specified
           on the command line as `--genconfig`.",
     },
     :genmanifest => {
         :default  => false,
         :type     => :boolean,
         :desc     => "Whether to just print a manifest to stdout and exit.  Only makes
           sense when specified on the command line as `--genmanifest`.  Takes into account arguments specified
           on the CLI.",
     },
     :configprint => {
         :default  => "",
         :desc     => "Print the value of a specific configuration setting.  If the name of a
           setting is provided for this, then the value is printed and puppet
           exits.  Comma-separate multiple values.  For a list of all values,
           specify 'all'.",
     },
     :color => {
       :default => "ansi",
       :type    => :string,
       :desc    => "Whether to use colors when logging to the console.  Valid values are
         `ansi` (equivalent to `true`), `html`, and `false`, which produces no color.
         Defaults to false on Windows, as its console does not support ansi colors.",
     },
     :mkusers => {
         :default  => false,
         :type     => :boolean,
         :desc     => "Whether to create the necessary user and group that puppet agent will run as.",
     },
     :manage_internal_file_permissions => {
         :default  => true,
         :type     => :boolean,
         :desc     => "Whether Puppet should manage the owner, group, and mode of files it uses internally",
     },
     :onetime => {
         :default  => false,
         :type     => :boolean,
         :desc     => "Perform one configuration run and exit, rather than spawning a long-running
           daemon. This is useful for interactively running puppet agent, or
           running puppet agent from cron.",
         :short    => 'o',
     },
     :path => {
         :default          => "none",
         :desc             => "The shell search path.  Defaults to whatever is inherited
           from the parent process.",
         :call_hook => :on_define_and_write,
         :hook             => proc do |value|
           ENV["PATH"] = "" if ENV["PATH"].nil?
           ENV["PATH"] = value unless value == "none"
           paths = ENV["PATH"].split(File::PATH_SEPARATOR)
           Puppet::Util::Platform.default_paths.each do |path|
             ENV["PATH"] += File::PATH_SEPARATOR + path unless paths.include?(path)
           end
           value
         end
     },
     :libdir => {
         :type           => :directory,
         :default        => "$vardir/lib",
         :desc           => "An extra search path for Puppet.  This is only useful
           for those files that Puppet will load on demand, and is only
           guaranteed to work for those cases.  In fact, the autoload
           mechanism is responsible for making sure this directory
           is in Ruby's search path\n",
       :call_hook => :on_initialize_and_write,
       :hook             => proc do |value|
         $LOAD_PATH.delete(@oldlibdir) if defined?(@oldlibdir) and $LOAD_PATH.include?(@oldlibdir)
         @oldlibdir = value
         $LOAD_PATH << value
       end
     },
     :ignoreimport => {
         :default  => false,
         :type     => :boolean,
         :desc     => "If true, allows the parser to continue without requiring
           all files referenced with `import` statements to exist. This setting was primarily
           designed for use with commit hooks for parse-checking.",
     },
     :environment => {
         :default  => "production",
         :desc     => "The environment Puppet is running in.  For clients
           (e.g., `puppet agent`) this determines the environment itself, which
           is used to find modules and much more.  For servers (i.e., `puppet master`)
           this provides the default environment for nodes we know nothing about."
     },
     :environmentpath => {
       :default => "",
       :desc    => "A search path for directory environments, as a list of directories
         separated by the system path separator character. (The POSIX path separator
         is ':', and the Windows path separator is ';'.)
 
         This setting must have a value set to enable **directory environments.** The
         recommended value is `$confdir/environments`. For more details, see
         http://docs.puppetlabs.com/puppet/latest/reference/environments.html",
       :type    => :path,
     },
     :diff_args => {
         :default  => lambda { default_diffargs },
         :desc     => "Which arguments to pass to the diff command when printing differences between
           files. The command to use can be chosen with the `diff` setting.",
     },
     :diff => {
       :default => (Puppet.features.microsoft_windows? ? "" : "diff"),
       :desc    => "Which diff command to use when printing differences between files. This setting
           has no default value on Windows, as standard `diff` is not available, but Puppet can use many
           third-party diff tools.",
     },
     :show_diff => {
         :type     => :boolean,
         :default  => false,
         :desc     => "Whether to log and report a contextual diff when files are being replaced.
           This causes partial file contents to pass through Puppet's normal
           logging and reporting system, so this setting should be used with
           caution if you are sending Puppet's reports to an insecure
           destination. This feature currently requires the `diff/lcs` Ruby
           library.",
     },
     :daemonize => {
         :type     => :boolean,
         :default  => (Puppet.features.microsoft_windows? ? false : true),
         :desc     => "Whether to send the process into the background.  This defaults
           to true on POSIX systems, and to false on Windows (where Puppet
           currently cannot daemonize).",
         :short    => "D",
         :hook     => proc do |value|
           if value and Puppet.features.microsoft_windows?
             raise "Cannot daemonize on Windows"
           end
       end
     },
     :maximum_uid => {
         :default  => 4294967290,
         :desc     => "The maximum allowed UID.  Some platforms use negative UIDs
           but then ship with tools that do not know how to handle signed ints,
           so the UIDs show up as huge numbers that can then not be fed back into
           the system.  This is a hackish way to fail in a slightly more useful
           way when that happens.",
     },
     :route_file => {
       :default    => "$confdir/routes.yaml",
       :desc       => "The YAML file containing indirector route configuration.",
     },
     :node_terminus => {
       :type       => :terminus,
       :default    => "plain",
       :desc       => "Where to find information about nodes.",
     },
     :node_cache_terminus => {
       :type       => :terminus,
       :default    => nil,
       :desc       => "How to store cached nodes.
       Valid values are (none), 'json', 'msgpack', 'yaml' or write only yaml ('write_only_yaml').
       The master application defaults to 'write_only_yaml', all others to none.",
     },
     :data_binding_terminus => {
       :type    => :terminus,
       :default => "hiera",
       :desc    => "Where to retrive information about data.",
     },
     :hiera_config => {
       :default => "$confdir/hiera.yaml",
       :desc    => "The hiera configuration file. Puppet only reads this file on startup, so you must restart the puppet master every time you edit it.",
       :type    => :file,
     },
     :binder => {
       :default => false,
       :desc    => "Turns the binding system on or off. This includes bindings in modules.
         The binding system aggregates data from modules and other locations and makes them available for lookup.
         The binding system is experimental and any or all of it may change.",
       :type    => :boolean,
     },
     :binder_config => {
       :default => nil,
       :desc    => "The binder configuration file. Puppet reads this file on each request to configure the bindings system.
       If set to nil (the default), a $confdir/binder_config.yaml is optionally loaded. If it does not exists, a default configuration
       is used. If the setting :binding_config is specified, it must reference a valid and existing yaml file.",
       :type    => :file,
     },
     :catalog_terminus => {
       :type       => :terminus,
       :default    => "compiler",
       :desc       => "Where to get node catalogs.  This is useful to change if, for instance,
       you'd like to pre-compile catalogs and store them in memcached or some other easily-accessed store.",
     },
     :catalog_cache_terminus => {
       :type       => :terminus,
       :default    => nil,
       :desc       => "How to store cached catalogs. Valid values are 'json', 'msgpack' and 'yaml'. The agent application defaults to 'json'."
     },
     :facts_terminus => {
       :default => 'facter',
       :desc => "The node facts terminus.",
       :call_hook => :on_initialize_and_write,
       :hook => proc do |value|
         require 'puppet/node/facts'
         # Cache to YAML if we're uploading facts away
         if %w[rest inventory_service].include? value.to_s
           Puppet.info "configuring the YAML fact cache because a remote terminus is active"
           Puppet::Node::Facts.indirection.cache_class = :yaml
         end
       end
     },
     :inventory_terminus => {
       :type       => :terminus,
       :default    => "$facts_terminus",
       :desc       => "Should usually be the same as the facts terminus",
     },
     :default_file_terminus => {
       :type       => :terminus,
       :default    => "rest",
       :desc       => "The default source for files if no server is given in a
       uri, e.g. puppet:///file. The default of `rest` causes the file to be
       retrieved using the `server` setting. When running `apply` the default
       is `file_server`, causing requests to be filled locally."
     },
     :httplog => {
         :default  => "$logdir/http.log",
         :type     => :file,
         :owner    => "root",
         :mode     => 0640,
         :desc     => "Where the puppet agent web server logs.",
     },
     :http_proxy_host => {
       :default    => "none",
       :desc       => "The HTTP proxy host to use for outgoing connections.  Note: You
       may need to use a FQDN for the server hostname when using a proxy. Environment variable
       http_proxy or HTTP_PROXY will override this value",
     },
     :http_proxy_port => {
       :default    => 3128,
       :desc       => "The HTTP proxy port to use for outgoing connections",
     },
     :http_proxy_user => {
       :default    => "none",
       :desc       => "The user name for an authenticated HTTP proxy. Requires http_proxy_host.",
     },
     :http_proxy_password =>{
       :default    => "none",
       :hook       => proc do |value|
         if Puppet.settings[:http_proxy_password] =~ /[@!# \/]/
           raise "Special characters in passwords must be URL compliant, we received #{value}"
         end
       end,
       :desc       => "The password for the user of an authenticated HTTP proxy. Requires http_proxy_user.
       NOTE: Special characters must be escaped or encoded for URL compliance",
     },
+    :http_keepalive_timeout => {
+      :default    => "4s",
+      :type       => :duration,
+      :desc       => "The maximum amount of time a persistent HTTP connection can remain idle in the connection pool, before it is closed.  This timeout should be shorter than the keepalive timeout used on the HTTP server, e.g. Apache KeepAliveTimeout directive.
+      #{AS_DURATION}"
+    },
+    :http_debug => {
+      :default    => false,
+      :type       => :boolean,
+      :desc       => "Whether to write HTTP request and responses to stderr. This should never be used in a production environment."
+    },
     :filetimeout => {
       :default    => "15s",
       :type       => :duration,
       :desc       => "The minimum time to wait between checking for updates in
       configuration files.  This timeout determines how quickly Puppet checks whether
       a file (such as manifests or templates) has changed on disk. #{AS_DURATION}",
     },
     :environment_timeout => {
       :default    => "3m",
       :type       => :ttl,
       :desc       => "The time to live for a cached environment.
       #{AS_DURATION}
       This setting can also be set to `unlimited`, which causes the environment to
       be cached until the master is restarted."
     },
     :queue_type => {
       :default    => "stomp",
       :desc       => "Which type of queue to use for asynchronous processing.",
     },
     :queue_type => {
       :default    => "stomp",
       :desc       => "Which type of queue to use for asynchronous processing.",
     },
     :queue_source => {
       :default    => "stomp://localhost:61613/",
       :desc       => "Which type of queue to use for asynchronous processing.  If your stomp server requires
       authentication, you can include it in the URI as long as your stomp client library is at least 1.1.1",
     },
     :async_storeconfigs => {
         :default  => false,
         :type     => :boolean,
         :desc     => "Whether to use a queueing system to provide asynchronous database integration.
       Requires that `puppet queue` be running.",
         :hook     => proc do |value|
           if value
             # This reconfigures the termini for Node, Facts, and Catalog
             Puppet.settings.override_default(:storeconfigs, true)
 
             # But then we modify the configuration
             Puppet::Resource::Catalog.indirection.cache_class = :queue
             Puppet.settings.override_default(:catalog_cache_terminus, :queue)
           else
             raise "Cannot disable asynchronous storeconfigs in a running process"
           end
         end
     },
     :thin_storeconfigs => {
       :default  => false,
       :type     => :boolean,
       :desc     =>
     "Boolean; whether Puppet should store only facts and exported resources in the storeconfigs
     database. This will improve the performance of exported resources with the older
     `active_record` backend, but will disable external tools that search the storeconfigs database.
     Thinning catalogs is generally unnecessary when using PuppetDB to store catalogs.",
       :hook     => proc do |value|
         Puppet.settings.override_default(:storeconfigs, true) if value
         end
       },
     :config_version => {
       :default    => "",
       :desc       => "How to determine the configuration version.  By default, it will be the
       time that the configuration is parsed, but you can provide a shell script to override how the
       version is determined.  The output of this script will be added to every log message in the
       reports, allowing you to correlate changes on your hosts to the source version on the server.
 
       Setting a global value for config_version in puppet.conf is deprecated. Please set a
       per-environment value in environment.conf instead. For more info, see
       http://docs.puppetlabs.com/puppet/latest/reference/environments.html",
       :deprecated => :allowed_on_commandline,
     },
     :zlib => {
         :default  => true,
         :type     => :boolean,
         :desc     => "Boolean; whether to use the zlib library",
     },
     :prerun_command => {
       :default    => "",
       :desc       => "A command to run before every agent run.  If this command returns a non-zero
       return code, the entire Puppet run will fail.",
     },
     :postrun_command => {
       :default    => "",
       :desc       => "A command to run after every agent run.  If this command returns a non-zero
       return code, the entire Puppet run will be considered to have failed, even though it might have
       performed work during the normal run.",
     },
     :freeze_main => {
         :default  => false,
         :type     => :boolean,
         :desc     => "Freezes the 'main' class, disallowing any code to be added to it.  This
           essentially means that you can't have any code outside of a node,
           class, or definition other than in the site manifest.",
     },
     :stringify_facts => {
       :default => true,
       :type    => :boolean,
       :desc    => "Flatten fact values to strings using #to_s. Means you can't have arrays or
         hashes as fact values.",
     },
     :trusted_node_data => {
       :default => false,
       :type    => :boolean,
       :desc    => "Stores trusted node data in a hash called $trusted.
         When true also prevents $trusted from being overridden in any scope.",
     },
     :immutable_node_data => {
       :default => '$trusted_node_data',
       :type    => :boolean,
       :desc    => "When true, also prevents $trusted and $facts from being overridden in any scope",
     }
   )
   Puppet.define_settings(:module_tool,
     :module_repository  => {
       :default  => 'https://forgeapi.puppetlabs.com',
       :desc     => "The module repository",
     },
     :module_working_dir => {
         :default  => '$vardir/puppet-module',
         :desc     => "The directory into which module tool data is stored",
     },
     :module_skeleton_dir => {
         :default  => '$module_working_dir/skeleton',
         :desc     => "The directory which the skeleton for module tool generate is stored.",
     },
     :forge_authorization => {
         :default  => nil,
         :desc     => "The authorization key to connect to the Puppet Forge. Leave blank for unauthorized or license based connections",
     },
     :module_groups => {
         :default  => nil,
         :desc     => "Extra module groups to request from the Puppet Forge",
     }
   )
 
     Puppet.define_settings(
     :main,
 
     # We have to downcase the fqdn, because the current ssl stuff (as oppsed to in master) doesn't have good facilities for
     # manipulating naming.
     :certname => {
       :default => lambda { Puppet::Settings.default_certname.downcase },
       :desc => "The name to use when handling certificates. When a node
         requests a certificate from the CA puppet master, it uses the value of the
         `certname` setting as its requested Subject CN.
 
         This is the name used when managing a node's permissions in
         [auth.conf](http://docs.puppetlabs.com/puppet/latest/reference/config_file_auth.html).
         In most cases, it is also used as the node's name when matching
         [node definitions](http://docs.puppetlabs.com/puppet/latest/reference/lang_node_definitions.html)
         and requesting data from an ENC. (This can be changed with the `node_name_value`
         and `node_name_fact` settings, although you should only do so if you have
         a compelling reason.)
 
         A node's certname is available in Puppet manifests as `$trusted['certname']`. (See
         [Facts and Built-In Variables](http://docs.puppetlabs.com/puppet/latest/reference/lang_facts_and_builtin_vars.html)
         for more details.)
 
         * For best compatibility, you should limit the value of `certname` to
           only use letters, numbers, periods, underscores, and dashes. (That is,
           it should match `/\A[a-z0-9._-]+\Z/`.)
         * The special value `ca` is reserved, and can't be used as the certname
           for a normal node.
 
         Defaults to the node's fully qualified domain name.",
       :hook => proc { |value| raise(ArgumentError, "Certificate names must be lower case; see #1168") unless value == value.downcase }},
     :certdnsnames => {
       :default => '',
       :hook    => proc do |value|
         unless value.nil? or value == '' then
           Puppet.warning <<WARN
 The `certdnsnames` setting is no longer functional,
 after CVE-2011-3872. We ignore the value completely.
 
 For your own certificate request you can set `dns_alt_names` in the
 configuration and it will apply locally.  There is no configuration option to
 set DNS alt names, or any other `subjectAltName` value, for another nodes
 certificate.
 
 Alternately you can use the `--dns_alt_names` command line option to set the
 labels added while generating your own CSR.
 WARN
         end
       end,
       :desc    => <<EOT
 The `certdnsnames` setting is no longer functional,
 after CVE-2011-3872. We ignore the value completely.
 
 For your own certificate request you can set `dns_alt_names` in the
 configuration and it will apply locally.  There is no configuration option to
 set DNS alt names, or any other `subjectAltName` value, for another nodes
 certificate.
 
 Alternately you can use the `--dns_alt_names` command line option to set the
 labels added while generating your own CSR.
 EOT
     },
     :dns_alt_names => {
       :default => '',
       :desc    => <<EOT,
 The comma-separated list of alternative DNS names to use for the local host.
 
 When the node generates a CSR for itself, these are added to the request
 as the desired `subjectAltName` in the certificate: additional DNS labels
 that the certificate is also valid answering as.
 
 This is generally required if you use a non-hostname `certname`, or if you
 want to use `puppet kick` or `puppet resource -H` and the primary certname
 does not match the DNS name you use to communicate with the host.
 
 This is unnecessary for agents, unless you intend to use them as a server for
 `puppet kick` or remote `puppet resource` management.
 
 It is rarely necessary for servers; it is usually helpful only if you need to
 have a pool of multiple load balanced masters, or for the same master to
 respond on two physically separate networks under different names.
 EOT
     },
     :csr_attributes => {
       :default => "$confdir/csr_attributes.yaml",
       :type => :file,
       :desc => <<EOT
 An optional file containing custom attributes to add to certificate signing
 requests (CSRs). You should ensure that this file does not exist on your CA
 puppet master; if it does, unwanted certificate extensions may leak into
 certificates created with the `puppet cert generate` command.
 
 If present, this file must be a YAML hash containing a `custom_attributes` key
 and/or an `extension_requests` key. The value of each key must be a hash, where
 each key is a valid OID and each value is an object that can be cast to a string.
 
 Custom attributes can be used by the CA when deciding whether to sign the
 certificate, but are then discarded. Attribute OIDs can be any OID value except
 the standard CSR attributes (i.e. attributes described in RFC 2985 section 5.4).
 This is useful for embedding a pre-shared key for autosigning policy executables
 (see the `autosign` setting), often by using the `1.2.840.113549.1.9.7`
 ("challenge password") OID.
 
 Extension requests will be permanently embedded in the final certificate.
 Extension OIDs must be in the "ppRegCertExt" (`1.3.6.1.4.1.34380.1.1`) or
 "ppPrivCertExt" (`1.3.6.1.4.1.34380.1.2`) OID arcs. The ppRegCertExt arc is
 reserved for four of the most common pieces of data to embed: `pp_uuid` (`.1`),
 `pp_instance_id` (`.2`), `pp_image_name` (`.3`), and `pp_preshared_key` (`.4`)
 --- in the YAML file, these can be referred to by their short descriptive names
 instead of their full OID. The ppPrivCertExt arc is unregulated, and can be used
 for site-specific extensions.
 EOT
     },
     :certdir => {
       :default => "$ssldir/certs",
       :type   => :directory,
       :mode => 0755,
       :owner => "service",
       :group => "service",
       :desc => "The certificate directory."
     },
     :ssldir => {
       :default => "$confdir/ssl",
       :type   => :directory,
       :mode => 0771,
       :owner => "service",
       :group => "service",
       :desc => "Where SSL certificates are kept."
     },
     :publickeydir => {
       :default => "$ssldir/public_keys",
       :type   => :directory,
       :mode => 0755,
       :owner => "service",
       :group => "service",
       :desc => "The public key directory."
     },
     :requestdir => {
       :default => "$ssldir/certificate_requests",
       :type => :directory,
       :mode => 0755,
       :owner => "service",
       :group => "service",
       :desc => "Where host certificate requests are stored."
     },
     :privatekeydir => {
       :default => "$ssldir/private_keys",
       :type   => :directory,
       :mode => 0750,
       :owner => "service",
       :group => "service",
       :desc => "The private key directory."
     },
     :privatedir => {
       :default => "$ssldir/private",
       :type   => :directory,
       :mode => 0750,
       :owner => "service",
       :group => "service",
       :desc => "Where the client stores private certificate information."
     },
     :passfile => {
       :default => "$privatedir/password",
       :type   => :file,
       :mode => 0640,
       :owner => "service",
       :group => "service",
       :desc => "Where puppet agent stores the password for its private key.
         Generally unused."
     },
     :hostcsr => {
       :default => "$ssldir/csr_$certname.pem",
       :type   => :file,
       :mode => 0644,
       :owner => "service",
       :group => "service",
       :desc => "Where individual hosts store and look for their certificate requests."
     },
     :hostcert => {
       :default => "$certdir/$certname.pem",
       :type   => :file,
       :mode => 0644,
       :owner => "service",
       :group => "service",
       :desc => "Where individual hosts store and look for their certificates."
     },
     :hostprivkey => {
       :default => "$privatekeydir/$certname.pem",
       :type   => :file,
       :mode => 0640,
       :owner => "service",
       :group => "service",
       :desc => "Where individual hosts store and look for their private key."
     },
     :hostpubkey => {
       :default => "$publickeydir/$certname.pem",
       :type   => :file,
       :mode => 0644,
       :owner => "service",
       :group => "service",
       :desc => "Where individual hosts store and look for their public key."
     },
     :localcacert => {
       :default => "$certdir/ca.pem",
       :type   => :file,
       :mode => 0644,
       :owner => "service",
       :group => "service",
       :desc => "Where each client stores the CA certificate."
     },
     :ssl_client_ca_auth => {
       :type  => :file,
       :mode  => 0644,
       :owner => "service",
       :group => "service",
       :desc  => "Certificate authorities who issue server certificates.  SSL servers will not be
         considered authentic unless they possess a certificate issued by an authority
         listed in this file.  If this setting has no value then the Puppet master's CA
         certificate (localcacert) will be used."
     },
     :ssl_server_ca_auth => {
       :type  => :file,
       :mode  => 0644,
       :owner => "service",
       :group => "service",
       :desc  => "Certificate authorities who issue client certificates.  SSL clients will not be
         considered authentic unless they possess a certificate issued by an authority
         listed in this file.  If this setting has no value then the Puppet master's CA
         certificate (localcacert) will be used."
     },
     :hostcrl => {
       :default => "$ssldir/crl.pem",
       :type   => :file,
       :mode => 0644,
       :owner => "service",
       :group => "service",
       :desc => "Where the host's certificate revocation list can be found.
         This is distinct from the certificate authority's CRL."
     },
     :certificate_revocation => {
         :default  => true,
         :type     => :boolean,
         :desc     => "Whether certificate revocation should be supported by downloading a
           Certificate Revocation List (CRL)
           to all clients.  If enabled, CA chaining will almost definitely not work.",
     },
     :certificate_expire_warning => {
       :default  => "60d",
       :type     => :duration,
       :desc     => "The window of time leading up to a certificate's expiration that a notification
         will be logged. This applies to CA, master, and agent certificates. #{AS_DURATION}"
     },
     :digest_algorithm => {
         :default  => 'md5',
         :type     => :enum,
         :values => ["md5", "sha256"],
         :desc     => 'Which digest algorithm to use for file resources and the filebucket.
                       Valid values are md5, sha256. Default is md5.',
     }
   )
 
     define_settings(
     :ca,
     :ca_name => {
       :default    => "Puppet CA: $certname",
       :desc       => "The name to use the Certificate Authority certificate.",
     },
     :cadir => {
       :default => "$ssldir/ca",
       :type => :directory,
       :owner => "service",
       :group => "service",
       :mode => 0755,
       :desc => "The root directory for the certificate authority."
     },
     :cacert => {
       :default => "$cadir/ca_crt.pem",
       :type => :file,
       :owner => "service",
       :group => "service",
       :mode => 0644,
       :desc => "The CA certificate."
     },
     :cakey => {
       :default => "$cadir/ca_key.pem",
       :type => :file,
       :owner => "service",
       :group => "service",
       :mode => 0640,
       :desc => "The CA private key."
     },
     :capub => {
       :default => "$cadir/ca_pub.pem",
       :type => :file,
       :owner => "service",
       :group => "service",
       :mode => 0644,
       :desc => "The CA public key."
     },
     :cacrl => {
       :default => "$cadir/ca_crl.pem",
       :type => :file,
       :owner => "service",
       :group => "service",
       :mode => 0644,
       :desc => "The certificate revocation list (CRL) for the CA. Will be used if present but otherwise ignored.",
     },
     :caprivatedir => {
       :default => "$cadir/private",
       :type => :directory,
       :owner => "service",
       :group => "service",
       :mode => 0750,
       :desc => "Where the CA stores private certificate information."
     },
     :csrdir => {
       :default => "$cadir/requests",
       :type => :directory,
       :owner => "service",
       :group => "service",
       :mode  => 0755,
       :desc => "Where the CA stores certificate requests"
     },
     :signeddir => {
       :default => "$cadir/signed",
       :type => :directory,
       :owner => "service",
       :group => "service",
       :mode => 0755,
       :desc => "Where the CA stores signed certificates."
     },
     :capass => {
       :default => "$caprivatedir/ca.pass",
       :type => :file,
       :owner => "service",
       :group => "service",
       :mode => 0640,
       :desc => "Where the CA stores the password for the private key."
     },
     :serial => {
       :default => "$cadir/serial",
       :type => :file,
       :owner => "service",
       :group => "service",
       :mode => 0644,
       :desc => "Where the serial number for certificates is stored."
     },
     :autosign => {
       :default => "$confdir/autosign.conf",
       :type => :autosign,
       :desc => "Whether (and how) to autosign certificate requests. This setting
         is only relevant on a puppet master acting as a certificate authority (CA).
 
         Valid values are true (autosigns all certificate requests; not recommended),
         false (disables autosigning certificates), or the absolute path to a file.
 
         The file specified in this setting may be either a **configuration file**
         or a **custom policy executable.** Puppet will automatically determine
         what it is: If the Puppet user (see the `user` setting) can execute the
         file, it will be treated as a policy executable; otherwise, it will be
         treated as a config file.
 
         If a custom policy executable is configured, the CA puppet master will run it
         every time it receives a CSR. The executable will be passed the subject CN of the
         request _as a command line argument,_ and the contents of the CSR in PEM format
         _on stdin._ It should exit with a status of 0 if the cert should be autosigned
         and non-zero if the cert should not be autosigned.
 
         If a certificate request is not autosigned, it will persist for review. An admin
         user can use the `puppet cert sign` command to manually sign it, or can delete
         the request.
 
         For info on autosign configuration files, see
         [the guide to Puppet's config files](http://docs.puppetlabs.com/guides/configuring.html).",
     },
     :allow_duplicate_certs => {
       :default    => false,
       :type       => :boolean,
       :desc       => "Whether to allow a new certificate
       request to overwrite an existing certificate.",
     },
     :ca_ttl => {
       :default    => "5y",
       :type       => :duration,
       :desc       => "The default TTL for new certificates.
       #{AS_DURATION}"
     },
     :req_bits => {
       :default    => 4096,
       :desc       => "The bit length of the certificates.",
     },
     :keylength => {
       :default    => 4096,
       :desc       => "The bit length of keys.",
     },
     :cert_inventory => {
       :default => "$cadir/inventory.txt",
       :type => :file,
       :mode => 0644,
       :owner => "service",
       :group => "service",
       :desc => "The inventory file. This is a text file to which the CA writes a
         complete listing of all certificates."
     }
   )
 
   # Define the config default.
 
     define_settings(:application,
       :config_file_name => {
           :type     => :string,
           :default  => Puppet::Settings.default_config_file_name,
           :desc     => "The name of the puppet config file.",
       },
       :config => {
           :type => :file,
           :default  => "$confdir/${config_file_name}",
           :desc     => "The configuration file for the current puppet application.",
       },
       :pidfile => {
           :type => :file,
           :default  => "$rundir/${run_mode}.pid",
           :desc     => "The file containing the PID of a running process.
             This file is intended to be used by service management frameworks
             and monitoring systems to determine if a puppet process is still in
             the process table.",
       },
       :bindaddress => {
         :default    => "0.0.0.0",
         :desc       => "The address a listening server should bind to.",
       }
   )
 
   define_settings(:master,
     :user => {
       :default    => "puppet",
       :desc       => "The user puppet master should run as.",
     },
     :group => {
       :default    => "puppet",
       :desc       => "The group puppet master should run as.",
     },
     :manifestdir => {
       :default    => "$confdir/manifests",
       :type       => :directory,
       :desc       => "Used to build the default value of the `manifest` setting. Has no other purpose.
 
         This setting is deprecated.",
       :deprecated => :completely,
     },
     :manifest => {
       :default    => "$manifestdir/site.pp",
       :type       => :file_or_directory,
       :desc       => "The entry-point manifest for puppet master. This can be one file
         or a directory of manifests to be evaluated in alphabetical order. Puppet manages
         this path as a directory if one exists or if the path ends with a / or \\.
 
         Setting a global value for `manifest` in puppet.conf is deprecated. Please use
         directory environments instead. If you need to use something other than the
         environment's `manifests` directory as the main manifest, you can set
         `manifest` in environment.conf. For more info, see
         http://docs.puppetlabs.com/puppet/latest/reference/environments.html",
       :deprecated => :allowed_on_commandline,
     },
     :code => {
       :default    => "",
       :desc       => "Code to parse directly.  This is essentially only used
       by `puppet`, and should only be set if you're writing your own Puppet
       executable.",
     },
     :masterlog => {
       :default => "$logdir/puppetmaster.log",
       :type => :file,
       :owner => "service",
       :group => "service",
       :mode => 0660,
       :desc => "This file is literally never used, although Puppet may create it
         as an empty file. For more context, see the `puppetdlog` setting and
         puppet master's `--logdest` command line option.
 
         This setting is deprecated and will be removed in a future version of Puppet.",
       :deprecated => :completely
     },
     :masterhttplog => {
       :default => "$logdir/masterhttp.log",
       :type => :file,
       :owner => "service",
       :group => "service",
       :mode => 0660,
       :create => true,
       :desc => "Where the puppet master web server saves its access log. This is
         only used when running a WEBrick puppet master. When puppet master is
         running under a Rack server like Passenger, that web server will have
         its own logging behavior."
     },
     :masterport => {
       :default    => 8140,
       :desc       => "The port for puppet master traffic. For puppet master,
       this is the port to listen on; for puppet agent, this is the port
       to make requests on. Both applications use this setting to get the port.",
     },
     :node_name => {
       :default    => "cert",
       :desc       => "How the puppet master determines the client's identity
       and sets the 'hostname', 'fqdn' and 'domain' facts for use in the manifest,
       in particular for determining which 'node' statement applies to the client.
       Possible values are 'cert' (use the subject's CN in the client's
       certificate) and 'facter' (use the hostname that the client
       reported in its facts)",
     },
     :bucketdir => {
       :default => "$vardir/bucket",
       :type => :directory,
       :mode => 0750,
       :owner => "service",
       :group => "service",
       :desc => "Where FileBucket files are stored."
     },
     :rest_authconfig => {
       :default    => "$confdir/auth.conf",
       :type       => :file,
       :desc       => "The configuration file that defines the rights to the different
       rest indirections.  This can be used as a fine-grained
       authorization system for `puppet master`.",
     },
     :ca => {
       :default    => true,
       :type       => :boolean,
       :desc       => "Whether the master should function as a certificate authority.",
     },
     :basemodulepath => {
       :default => "$confdir/modules#{File::PATH_SEPARATOR}/usr/share/puppet/modules",
       :type => :path,
       :desc => "The search path for **global** modules. Should be specified as a
         list of directories separated by the system path separator character. (The
         POSIX path separator is ':', and the Windows path separator is ';'.)
 
         If you are using directory environments, these are the modules that will
         be used by _all_ environments. Note that the `modules` directory of the active
         environment will have priority over any global directories. For more info, see
         http://docs.puppetlabs.com/puppet/latest/reference/environments.html
 
         This setting also provides the default value for the deprecated `modulepath`
         setting, which is used when directory environments are disabled.",
     },
     :modulepath => {
       :default => "$basemodulepath",
       :type => :path,
       :desc => "The search path for modules, as a list of directories separated by the system
         path separator character. (The POSIX path separator is ':', and the
         Windows path separator is ';'.)
 
         Setting a global value for `modulepath` in puppet.conf is deprecated. Please use
         directory environments instead. If you need to use something other than the
         default modulepath of `<ACTIVE ENVIRONMENT'S MODULES DIR>:$basemodulepath`,
         you can set `modulepath` in environment.conf. For more info, see
         http://docs.puppetlabs.com/puppet/latest/reference/environments.html",
       :deprecated => :allowed_on_commandline,
     },
     :ssl_client_header => {
       :default    => "HTTP_X_CLIENT_DN",
       :desc       => "The header containing an authenticated client's SSL DN.
       This header must be set by the proxy to the authenticated client's SSL
       DN (e.g., `/CN=puppet.puppetlabs.com`).  Puppet will parse out the Common
       Name (CN) from the Distinguished Name (DN) and use the value of the CN
       field for authorization.
 
       Note that the name of the HTTP header gets munged by the web server
       common gateway inteface: an `HTTP_` prefix is added, dashes are converted
       to underscores, and all letters are uppercased.  Thus, to use the
       `X-Client-DN` header, this setting should be `HTTP_X_CLIENT_DN`.",
     },
     :ssl_client_verify_header => {
       :default    => "HTTP_X_CLIENT_VERIFY",
       :desc       => "The header containing the status message of the client
       verification. This header must be set by the proxy to 'SUCCESS' if the
       client successfully authenticated, and anything else otherwise.
 
       Note that the name of the HTTP header gets munged by the web server
       common gateway inteface: an `HTTP_` prefix is added, dashes are converted
       to underscores, and all letters are uppercased.  Thus, to use the
       `X-Client-Verify` header, this setting should be
       `HTTP_X_CLIENT_VERIFY`.",
     },
     # To make sure this directory is created before we try to use it on the server, we need
     # it to be in the server section (#1138).
     :yamldir => {
       :default => "$vardir/yaml",
       :type => :directory,
       :owner => "service",
       :group => "service",
       :mode => "750",
       :desc => "The directory in which YAML data is stored, usually in a subdirectory."},
     :server_datadir => {
       :default => "$vardir/server_data",
       :type => :directory,
       :owner => "service",
       :group => "service",
       :mode => "750",
       :desc => "The directory in which serialized data is stored, usually in a subdirectory."},
     :reports => {
       :default    => "store",
       :desc       => "The list of report handlers to use. When using multiple report handlers,
         their names should be comma-separated, with whitespace allowed. (For example,
         `reports = http, tagmail`.)
 
         This setting is relevant to puppet master and puppet apply. The puppet
         master will call these report handlers with the reports it receives from
         agent nodes, and puppet apply will call them with its own report. (In
         all cases, the node applying the catalog must have `report = true`.)
 
         See the report reference for information on the built-in report
         handlers; custom report handlers can also be loaded from modules.
         (Report handlers are loaded from the lib directory, at
         `puppet/reports/NAME.rb`.)",
     },
     :reportdir => {
       :default => "$vardir/reports",
       :type => :directory,
       :mode => 0750,
       :owner => "service",
       :group => "service",
       :desc => "The directory in which to store reports. Each node gets
         a separate subdirectory in this directory. This setting is only
         used when the `store` report processor is enabled (see the
         `reports` setting)."},
     :reporturl => {
       :default    => "http://localhost:3000/reports/upload",
       :desc       => "The URL that reports should be forwarded to. This setting
         is only used when the `http` report processor is enabled (see the
         `reports` setting).",
     },
     :fileserverconfig => {
       :default    => "$confdir/fileserver.conf",
       :type       => :file,
       :desc       => "Where the fileserver configuration is stored.",
     },
     :strict_hostname_checking => {
       :default    => false,
       :desc       => "Whether to only search for the complete
             hostname as it is in the certificate when searching for node information
             in the catalogs.",
     }
   )
 
   define_settings(:metrics,
     :rrddir => {
       :type     => :directory,
       :default  => "$vardir/rrd",
       :mode     => 0750,
       :owner    => "service",
       :group    => "service",
       :desc     => "The directory where RRD database files are stored.
         Directories for each reporting host will be created under
         this directory."
     },
     :rrdinterval => {
       :default  => "$runinterval",
       :type     => :duration,
       :desc     => "How often RRD should expect data.
             This should match how often the hosts report back to the server. #{AS_DURATION}",
     }
   )
 
   define_settings(:device,
     :devicedir =>  {
         :default  => "$vardir/devices",
         :type     => :directory,
         :mode     => "750",
         :desc     => "The root directory of devices' $vardir.",
     },
     :deviceconfig => {
         :default  => "$confdir/device.conf",
         :desc     => "Path to the device config file for puppet device.",
     }
   )
 
   define_settings(:agent,
     :node_name_value => {
       :default => "$certname",
       :desc => "The explicit value used for the node name for all requests the agent
         makes to the master. WARNING: This setting is mutually exclusive with
         node_name_fact.  Changing this setting also requires changes to the default
         auth.conf configuration on the Puppet Master.  Please see
         http://links.puppetlabs.com/node_name_value for more information."
     },
     :node_name_fact => {
       :default => "",
       :desc => "The fact name used to determine the node name used for all requests the agent
         makes to the master. WARNING: This setting is mutually exclusive with
         node_name_value.  Changing this setting also requires changes to the default
         auth.conf configuration on the Puppet Master.  Please see
         http://links.puppetlabs.com/node_name_fact for more information.",
       :hook => proc do |value|
         if !value.empty? and Puppet[:node_name_value] != Puppet[:certname]
           raise "Cannot specify both the node_name_value and node_name_fact settings"
         end
       end
     },
     :localconfig => {
       :default => "$statedir/localconfig",
       :type => :file,
       :owner => "root",
       :mode => 0660,
       :desc => "Where puppet agent caches the local configuration.  An
         extension indicating the cache format is added automatically."},
     :statefile => {
       :default => "$statedir/state.yaml",
       :type => :file,
       :mode => 0660,
       :desc => "Where puppet agent and puppet master store state associated
         with the running configuration.  In the case of puppet master,
         this file reflects the state discovered through interacting
         with clients."
       },
     :clientyamldir => {
       :default => "$vardir/client_yaml",
       :type => :directory,
       :mode => "750",
       :desc => "The directory in which client-side YAML data is stored."
     },
     :client_datadir => {
       :default => "$vardir/client_data",
       :type => :directory,
       :mode => "750",
       :desc => "The directory in which serialized data is stored on the client."
     },
     :classfile => {
       :default => "$statedir/classes.txt",
       :type => :file,
       :owner => "root",
       :mode => 0640,
       :desc => "The file in which puppet agent stores a list of the classes
         associated with the retrieved configuration.  Can be loaded in
         the separate `puppet` executable using the `--loadclasses`
         option."},
     :resourcefile => {
       :default => "$statedir/resources.txt",
       :type => :file,
       :owner => "root",
       :mode => 0640,
       :desc => "The file in which puppet agent stores a list of the resources
         associated with the retrieved configuration."  },
     :puppetdlog => {
       :default => "$logdir/puppetd.log",
       :type => :file,
       :owner => "root",
       :mode => 0640,
       :desc => "The fallback log file. This is only used when the `--logdest` option
         is not specified AND Puppet is running on an operating system where both
         the POSIX syslog service and the Windows Event Log are unavailable. (Currently,
         no supported operating systems match that description.)
 
         Despite the name, both puppet agent and puppet master will use this file
         as the fallback logging destination.
 
         For control over logging destinations, see the `--logdest` command line
         option in the manual pages for puppet master, puppet agent, and puppet
         apply. You can see man pages by running `puppet <SUBCOMMAND> --help`,
         or read them online at http://docs.puppetlabs.com/references/latest/man/."
     },
     :server => {
       :default => "puppet",
       :desc => "The puppet master server to which the puppet agent should connect."
     },
     :use_srv_records => {
       :default    => false,
       :type       => :boolean,
       :desc       => "Whether the server will search for SRV records in DNS for the current domain.",
     },
     :srv_domain => {
       :default    => lambda { Puppet::Settings.domain_fact },
       :desc       => "The domain which will be queried to find the SRV records of servers to use.",
     },
     :ignoreschedules => {
       :default    => false,
       :type       => :boolean,
       :desc       => "Boolean; whether puppet agent should ignore schedules.  This is useful
       for initial puppet agent runs.",
     },
     :default_schedules => {
       :default    => true,
       :type       => :boolean,
       :desc       => "Boolean; whether to generate the default schedule resources. Setting this to
       false is useful for keeping external report processors clean of skipped schedule resources.",
     },
     :puppetport => {
       :default    => 8139,
       :desc       => "Which port puppet agent listens on.",
     },
     :noop => {
       :default    => false,
       :type       => :boolean,
       :desc       => "Whether to apply catalogs in noop mode, which allows Puppet to
         partially simulate a normal run. This setting affects puppet agent and
         puppet apply.
 
         When running in noop mode, Puppet will check whether each resource is in sync,
         like it does when running normally. However, if a resource attribute is not in
         the desired state (as declared in the catalog), Puppet will take no
         action, and will instead report the changes it _would_ have made. These
         simulated changes will appear in the report sent to the puppet master, or
         be shown on the console if running puppet agent or puppet apply in the
         foreground. The simulated changes will not send refresh events to any
         subscribing or notified resources, although Puppet will log that a refresh
         event _would_ have been sent.
 
         **Important note:**
         [The `noop` metaparameter](http://docs.puppetlabs.com/references/latest/metaparameter.html#noop)
         allows you to apply individual resources in noop mode, and will override
         the global value of the `noop` setting. This means a resource with
         `noop => false` _will_ be changed if necessary, even when running puppet
         agent with `noop = true` or `--noop`. (Conversely, a resource with
         `noop => true` will only be simulated, even when noop mode is globally disabled.)",
     },
     :runinterval => {
       :default  => "30m",
       :type     => :duration,
       :desc     => "How often puppet agent applies the catalog.
           Note that a runinterval of 0 means \"run continuously\" rather than
           \"never run.\" If you want puppet agent to never run, you should start
           it with the `--no-client` option. #{AS_DURATION}",
     },
     :listen => {
       :default    => false,
       :type       => :boolean,
       :desc       => "Whether puppet agent should listen for
       connections.  If this is true, then puppet agent will accept incoming
       REST API requests, subject to the default ACLs and the ACLs set in
       the `rest_authconfig` file. Puppet agent can respond usefully to
       requests on the `run`, `facts`, `certificate`, and `resource` endpoints.",
     },
     :ca_server => {
       :default    => "$server",
       :desc       => "The server to use for certificate
       authority requests.  It's a separate server because it cannot
       and does not need to horizontally scale.",
     },
     :ca_port => {
       :default    => "$masterport",
       :desc       => "The port to use for the certificate authority.",
     },
     :catalog_format => {
       :default => "",
       :desc => "(Deprecated for 'preferred_serialization_format') What format to
         use to dump the catalog.  Only supports 'marshal' and 'yaml'.  Only
         matters on the client, since it asks the server for a specific format.",
       :hook => proc { |value|
         if value
           Puppet.deprecation_warning "Setting 'catalog_format' is deprecated; use 'preferred_serialization_format' instead."
           Puppet.settings.override_default(:preferred_serialization_format, value)
         end
       }
     },
     :preferred_serialization_format => {
       :default    => "pson",
       :desc       => "The preferred means of serializing
       ruby instances for passing over the wire.  This won't guarantee that all
       instances will be serialized using this method, since not all classes
       can be guaranteed to support this format, but it will be used for all
       classes that support it.",
     },
     :report_serialization_format => {
       :default => "pson",
       :type => :enum,
       :values => ["pson", "yaml"],
       :desc => "The serialization format to use when sending reports to the
       `report_server`. Possible values are `pson` and `yaml`. This setting
       affects puppet agent, but not puppet apply (which processes its own
       reports).
 
       This should almost always be set to `pson`. It can be temporarily set to
       `yaml` to let agents using this Puppet version connect to a puppet master
       running Puppet 3.0.0 through 3.2.x.
 
       Note that this is set to 'yaml' automatically if the agent detects an
       older master, so should never need to be set explicitly."
     },
     :legacy_query_parameter_serialization => {
         :default    => false,
         :type       => :boolean,
         :desc => "The serialization format to use when sending file_metadata
       query parameters.  Older versions of puppet master expect certain query
       parameters to be serialized as yaml, which is deprecated.
 
       This should almost always be false. It can be temporarily set to true
       to let agents using this Puppet version connect to a puppet master
       running Puppet 3.0.0 through 3.2.x.
 
       Note that this is set to true automatically if the agent detects an
       older master, so should never need to be set explicitly."
     },
     :agent_catalog_run_lockfile => {
       :default    => "$statedir/agent_catalog_run.lock",
       :type       => :string, # (#2888) Ensure this file is not added to the settings catalog.
       :desc       => "A lock file to indicate that a puppet agent catalog run is currently in progress.
         The file contains the pid of the process that holds the lock on the catalog run.",
     },
     :agent_disabled_lockfile => {
         :default    => "$statedir/agent_disabled.lock",
         :type       => :file,
         :desc       => "A lock file to indicate that puppet agent runs have been administratively
           disabled.  File contains a JSON object with state information.",
     },
     :usecacheonfailure => {
       :default    => true,
       :type       => :boolean,
       :desc       => "Whether to use the cached configuration when the remote
         configuration will not compile.  This option is useful for testing
         new configurations, where you want to fix the broken configuration
         rather than reverting to a known-good one.",
     },
     :use_cached_catalog => {
       :default    => false,
       :type       => :boolean,
       :desc       => "Whether to only use the cached catalog rather than compiling a new catalog
         on every run.  Puppet can be run with this enabled by default and then selectively
         disabled when a recompile is desired.",
     },
     :ignoremissingtypes => {
       :default    => false,
       :type       => :boolean,
       :desc       => "Skip searching for classes and definitions that were missing during a
         prior compilation. The list of missing objects is maintained per-environment and
         persists until the environment is cleared or the master is restarted.",
     },
     :ignorecache => {
       :default    => false,
       :type       => :boolean,
       :desc       => "Ignore cache and always recompile the configuration.  This is
         useful for testing new configurations, where the local cache may in
         fact be stale even if the timestamps are up to date - if the facts
         change or if the server changes.",
     },
     :dynamicfacts => {
       :default    => "memorysize,memoryfree,swapsize,swapfree",
       :desc       => "(Deprecated) Facts that are dynamic; these facts will be ignored when deciding whether
         changed facts should result in a recompile.  Multiple facts should be
         comma-separated.",
       :hook => proc { |value|
         if value
           Puppet.deprecation_warning "The dynamicfacts setting is deprecated and will be ignored."
         end
       }
     },
     :splaylimit => {
       :default    => "$runinterval",
       :type       => :duration,
       :desc       => "The maximum time to delay before runs.  Defaults to being the same as the
         run interval. #{AS_DURATION}",
     },
     :splay => {
       :default    => false,
       :type       => :boolean,
       :desc       => "Whether to sleep for a pseudo-random (but consistent) amount of time before
         a run.",
     },
     :clientbucketdir => {
       :default  => "$vardir/clientbucket",
       :type     => :directory,
       :mode     => 0750,
       :desc     => "Where FileBucket files are stored locally."
     },
     :configtimeout => {
       :default  => "2m",
       :type     => :duration,
       :desc     => "How long the client should wait for the configuration to be retrieved
         before considering it a failure.  This can help reduce flapping if too
         many clients contact the server at one time. #{AS_DURATION}",
     },
     :report_server => {
       :default  => "$server",
       :desc     => "The server to send transaction reports to.",
     },
     :report_port => {
       :default  => "$masterport",
       :desc     => "The port to communicate with the report_server.",
     },
     :inventory_server => {
       :default  => "$server",
       :desc     => "The server to send facts to.",
     },
     :inventory_port => {
       :default  => "$masterport",
       :desc     => "The port to communicate with the inventory_server.",
     },
     :report => {
       :default  => true,
       :type     => :boolean,
       :desc     => "Whether to send reports after every transaction.",
     },
     :lastrunfile =>  {
       :default  => "$statedir/last_run_summary.yaml",
       :type     => :file,
       :mode     => 0644,
       :desc     => "Where puppet agent stores the last run report summary in yaml format."
     },
     :lastrunreport =>  {
       :default  => "$statedir/last_run_report.yaml",
       :type     => :file,
       :mode     => 0640,
       :desc     => "Where puppet agent stores the last run report in yaml format."
     },
     :graph => {
       :default  => false,
       :type     => :boolean,
       :desc     => "Whether to create dot graph files for the different
         configuration graphs.  These dot files can be interpreted by tools
         like OmniGraffle or dot (which is part of ImageMagick).",
     },
     :graphdir => {
       :default    => "$statedir/graphs",
       :type       => :directory,
       :desc       => "Where to store dot-outputted graphs.",
     },
     :http_compression => {
       :default    => false,
       :type       => :boolean,
       :desc       => "Allow http compression in REST communication with the master.
         This setting might improve performance for agent -> master
         communications over slow WANs. Your puppet master needs to support
         compression (usually by activating some settings in a reverse-proxy in
         front of the puppet master, which rules out webrick). It is harmless to
         activate this settings if your master doesn't support compression, but
         if it supports it, this setting might reduce performance on high-speed LANs.",
     },
     :waitforcert => {
       :default  => "2m",
       :type     => :duration,
       :desc     => "How frequently puppet agent should ask for a signed certificate.
 
       When starting for the first time, puppet agent will submit a certificate
       signing request (CSR) to the server named in the `ca_server` setting
       (usually the puppet master); this may be autosigned, or may need to be
       approved by a human, depending on the CA server's configuration.
 
       Puppet agent cannot apply configurations until its approved certificate is
       available. Since the certificate may or may not be available immediately,
       puppet agent will repeatedly try to fetch it at this interval. You can
       turn off waiting for certificates by specifying a time of 0, in which case
       puppet agent will exit if it cannot get a cert.
       #{AS_DURATION}",
     },
     :ordering => {
       :type => :enum,
       :values => ["manifest", "title-hash", "random"],
       :default => "title-hash",
       :desc => "How unrelated resources should be ordered when applying a catalog.
       Allowed values are `title-hash`, `manifest`, and `random`. This
       setting affects puppet agent and puppet apply, but not puppet master.
 
       * `title-hash` (the default) will order resources randomly, but will use
         the same order across runs and across nodes.
       * `manifest` will use the order in which the resources were declared in
         their manifest files.
       * `random` will order resources randomly and change their order with each
         run. This can work like a fuzzer for shaking out undeclared dependencies.
 
       Regardless of this setting's value, Puppet will always obey explicit
       dependencies set with the before/require/notify/subscribe metaparameters
       and the `->`/`~>` chaining arrows; this setting only affects the relative
       ordering of _unrelated_ resources."
     }
   )
 
   define_settings(:inspect,
     :archive_files => {
         :type     => :boolean,
         :default  => false,
         :desc     => "During an inspect run, whether to archive files whose contents are audited to a file bucket.",
     },
     :archive_file_server => {
         :default  => "$server",
         :desc     => "During an inspect run, the file bucket server to archive files to if archive_files is set.",
     }
   )
 
   # Plugin information.
 
   define_settings(
     :main,
     :plugindest => {
       :type       => :directory,
       :default    => "$libdir",
       :desc       => "Where Puppet should store plugins that it pulls down from the central
       server.",
     },
     :pluginsource => {
       :default    => "puppet://$server/plugins",
       :desc       => "From where to retrieve plugins.  The standard Puppet `file` type
       is used for retrieval, so anything that is a valid file source can
       be used here.",
     },
     :pluginfactdest => {
       :type     => :directory,
       :default  => "$vardir/facts.d",
       :desc     => "Where Puppet should store external facts that are being handled by pluginsync",
     },
     :pluginfactsource => {
       :default  => "puppet://$server/pluginfacts",
       :desc     => "Where to retrieve external facts for pluginsync",
     },
     :pluginsync => {
       :default    => true,
       :type       => :boolean,
       :desc       => "Whether plugins should be synced with the central server.",
     },
 
     :pluginsignore => {
         :default  => ".svn CVS .git",
         :desc     => "What files to ignore when pulling down plugins.",
     }
   )
 
   # Central fact information.
 
     define_settings(
     :main,
     :factpath => {
       :type     => :path,
       :default  => "$vardir/lib/facter#{File::PATH_SEPARATOR}$vardir/facts",
       :desc     => "Where Puppet should look for facts.  Multiple directories should
         be separated by the system path separator character. (The POSIX path
         separator is ':', and the Windows path separator is ';'.)",
 
       :call_hook => :on_initialize_and_write, # Call our hook with the default value, so we always get the value added to facter.
       :hook => proc do |value|
         paths = value.split(File::PATH_SEPARATOR)
         Facter.search(*paths)
       end
     }
   )
 
 
     define_settings(
     :tagmail,
     :tagmap => {
       :default    => "$confdir/tagmail.conf",
       :desc       => "The mapping between reporting tags and email addresses.",
     },
     :sendmail => {
       :default    => which('sendmail') || '',
       :desc       => "Where to find the sendmail binary with which to send email.",
     },
 
     :reportfrom => {
         :default  => lambda { "report@#{Puppet::Settings.default_certname.downcase}" },
         :desc     => "The 'from' email address for the reports.",
     },
 
     :smtpserver => {
         :default  => "none",
         :desc     => "The server through which to send email reports.",
     },
     :smtpport => {
         :default  => 25,
         :desc     => "The TCP port through which to send email reports.",
     },
     :smtphelo => {
         :default  => lambda { Facter.value 'fqdn' },
         :desc     => "The name by which we identify ourselves in SMTP HELO for reports.
           If you send to a smtpserver which does strict HELO checking (as with Postfix's
           `smtpd_helo_restrictions` access controls), you may need to ensure this resolves.",
     }
   )
 
     define_settings(
     :rails,
     :dblocation => {
       :default  => "$statedir/clientconfigs.sqlite3",
       :type     => :file,
       :mode     => 0660,
       :owner    => "service",
       :group    => "service",
       :desc     => "The sqlite database file. #{STORECONFIGS_ONLY}"
     },
     :dbadapter => {
       :default  => "sqlite3",
       :desc     => "The type of database to use. #{STORECONFIGS_ONLY}",
     },
     :dbmigrate => {
       :default  => false,
       :type     => :boolean,
       :desc     => "Whether to automatically migrate the database. #{STORECONFIGS_ONLY}",
     },
     :dbname => {
       :default  => "puppet",
       :desc     => "The name of the database to use. #{STORECONFIGS_ONLY}",
     },
     :dbserver => {
       :default  => "localhost",
       :desc     => "The database server for caching. Only
       used when networked databases are used.",
     },
     :dbport => {
       :default  => "",
       :desc     => "The database password for caching. Only
         used when networked databases are used. #{STORECONFIGS_ONLY}",
     },
     :dbuser => {
       :default  => "puppet",
       :desc     => "The database user for caching. Only
         used when networked databases are used. #{STORECONFIGS_ONLY}",
     },
     :dbpassword => {
       :default  => "puppet",
       :desc     => "The database password for caching. Only
         used when networked databases are used. #{STORECONFIGS_ONLY}",
     },
     :dbconnections => {
       :default  => '',
       :desc     => "The number of database connections for networked
         databases.  Will be ignored unless the value is a positive integer. #{STORECONFIGS_ONLY}",
     },
     :dbsocket => {
       :default  => "",
       :desc     => "The database socket location. Only used when networked
         databases are used.  Will be ignored if the value is an empty string. #{STORECONFIGS_ONLY}",
     },
     :railslog => {
       :default  => "$logdir/rails.log",
       :type     => :file,
       :mode     => 0600,
       :owner    => "service",
       :group    => "service",
       :desc     => "Where Rails-specific logs are sent. #{STORECONFIGS_ONLY}"
     },
 
     :rails_loglevel => {
         :default  => "info",
         :desc     => "The log level for Rails connections.  The value must be
           a valid log level within Rails.  Production environments normally use `info`
           and other environments normally use `debug`. #{STORECONFIGS_ONLY}",
     }
   )
 
     define_settings(
     :couchdb,
 
     :couchdb_url => {
         :default  => "http://127.0.0.1:5984/puppet",
         :desc     => "The url where the puppet couchdb database will be created.
           Only used when `facts_terminus` is set to `couch`.",
     }
   )
 
     define_settings(
     :transaction,
     :tags => {
       :default    => "",
       :desc       => "Tags to use to find resources.  If this is set, then
         only resources tagged with the specified tags will be applied.
         Values must be comma-separated.",
     },
     :evaltrace => {
       :default    => false,
       :type       => :boolean,
       :desc       => "Whether each resource should log when it is
         being evaluated.  This allows you to interactively see exactly
         what is being done.",
     },
     :summarize => {
         :default  => false,
         :type     => :boolean,
         :desc     => "Whether to print a transaction summary.",
     }
   )
 
     define_settings(
     :main,
     :external_nodes => {
         :default  => "none",
         :desc     => "An external command that can produce node information.  The command's output
           must be a YAML dump of a hash, and that hash must have a `classes` key and/or
           a `parameters` key, where `classes` is an array or hash and
           `parameters` is a hash.  For unknown nodes, the command should
           exit with a non-zero exit code.
 
           This command makes it straightforward to store your node mapping
           information in other data sources like databases.",
     }
     )
 
         define_settings(
         :ldap,
     :ldapssl => {
       :default  => false,
       :type   => :boolean,
       :desc   => "Whether SSL should be used when searching for nodes.
         Defaults to false because SSL usually requires certificates
         to be set up on the client side.",
     },
     :ldaptls => {
       :default  => false,
       :type     => :boolean,
       :desc     => "Whether TLS should be used when searching for nodes.
         Defaults to false because TLS usually requires certificates
         to be set up on the client side.",
     },
     :ldapserver => {
       :default  => "ldap",
       :desc     => "The LDAP server.  Only used if `node_terminus` is set to `ldap`.",
     },
     :ldapport => {
       :default  => 389,
       :desc     => "The LDAP port.  Only used if `node_terminus` is set to `ldap`.",
     },
 
     :ldapstring => {
       :default  => "(&(objectclass=puppetClient)(cn=%s))",
       :desc     => "The search string used to find an LDAP node.",
     },
     :ldapclassattrs => {
       :default  => "puppetclass",
       :desc     => "The LDAP attributes to use to define Puppet classes.  Values
         should be comma-separated.",
     },
     :ldapstackedattrs => {
       :default  => "puppetvar",
       :desc     => "The LDAP attributes that should be stacked to arrays by adding
         the values in all hierarchy elements of the tree.  Values
         should be comma-separated.",
     },
     :ldapattrs => {
       :default  => "all",
       :desc     => "The LDAP attributes to include when querying LDAP for nodes.  All
         returned attributes are set as variables in the top-level scope.
         Multiple values should be comma-separated.  The value 'all' returns
         all attributes.",
     },
     :ldapparentattr => {
       :default  => "parentnode",
       :desc     => "The attribute to use to define the parent node.",
     },
     :ldapuser => {
       :default  => "",
       :desc     => "The user to use to connect to LDAP.  Must be specified as a
         full DN.",
     },
     :ldappassword => {
       :default  => "",
       :desc     => "The password to use to connect to LDAP.",
     },
     :ldapbase => {
         :default  => "",
         :desc     => "The search base for LDAP searches.  It's impossible to provide
           a meaningful default here, although the LDAP libraries might
           have one already set.  Generally, it should be the 'ou=Hosts'
           branch under your main directory.",
     }
   )
 
   define_settings(:master,
     :storeconfigs => {
       :default  => false,
       :type     => :boolean,
       :desc     => "Whether to store each client's configuration, including catalogs, facts,
         and related data.  This also enables the import and export of resources in
         the Puppet language - a mechanism for exchange resources between nodes.
 
         By default this uses ActiveRecord and an SQL database to store and query
         the data; this, in turn, will depend on Rails being available.
 
         You can adjust the backend using the storeconfigs_backend setting.",
       # Call our hook with the default value, so we always get the libdir set.
       :call_hook => :on_initialize_and_write,
       :hook => proc do |value|
         require 'puppet/node'
         require 'puppet/node/facts'
         if value
           if not Puppet.settings[:async_storeconfigs]
             Puppet::Resource::Catalog.indirection.cache_class = :store_configs
             Puppet.settings.override_default(:catalog_cache_terminus, :store_configs)
           end
           Puppet::Node::Facts.indirection.cache_class = :store_configs
 
           Puppet::Resource.indirection.terminus_class = :store_configs
         end
       end
     },
     :storeconfigs_backend => {
       :type => :terminus,
       :default => "active_record",
       :desc => "Configure the backend terminus used for StoreConfigs.
         By default, this uses the ActiveRecord store, which directly talks to the
         database from within the Puppet Master process."
     }
   )
 
   define_settings(:parser,
     :templatedir => {
         :default  => "$vardir/templates",
         :type     => :directory,
         :desc     => "Where Puppet looks for template files.  Can be a list of colon-separated
           directories.
 
           This setting is deprecated. Please put your templates in modules instead.",
         :deprecated => :completely,
     },
 
     :allow_variables_with_dashes => {
       :default => false,
       :desc    => <<-'EOT'
         Permit hyphens (`-`) in variable names and issue deprecation warnings about
         them. This setting **should always be `false`;** setting it to `true`
         will cause subtle and wide-ranging bugs. It will be removed in a future version.
 
         Hyphenated variables caused major problems in the language, but were allowed
         between Puppet 2.7.3 and 2.7.14. If you used them during this window, we
         apologize for the inconvenience --- you can temporarily set this to `true`
         in order to upgrade, and can rename your variables at your leisure. Please
         revert it to `false` after you have renamed all affected variables.
       EOT
     },
     :parser => {
       :default => "current",
       :desc => <<-'EOT'
         Selects the parser to use for parsing puppet manifests (in puppet DSL
         language/'.pp' files). Available choices are `current` (the default)
         and `future`.
 
         The `current` parser means that the released version of the parser should
         be used.
 
         The `future` parser is a "time travel to the future" allowing early
         exposure to new language features. What these features are will vary from
         release to release and they may be invididually configurable.
 
         Available Since Puppet 3.2.
       EOT
     },
    :max_errors => {
      :default => 10,
      :desc => <<-'EOT'
        Sets the max number of logged/displayed parser validation errors in case
        multiple errors have been detected. A value of 0 is the same as a value of 1; a
        minimum of one error is always raised.  The count is per manifest.
      EOT
    },
    :max_warnings => {
      :default => 10,
      :desc => <<-'EOT'
        Sets the max number of logged/displayed parser validation warnings in
        case multiple warnings have been detected. A value of 0 blocks logging of
        warnings.  The count is per manifest.
      EOT
      },
   :max_deprecations => {
     :default => 10,
     :desc => <<-'EOT'
       Sets the max number of logged/displayed parser validation deprecation
       warnings in case multiple deprecation warnings have been detected. A value of 0
       blocks the logging of deprecation warnings.  The count is per manifest.
     EOT
     },
   :strict_variables => {
     :default => false,
     :type => :boolean,
     :desc => <<-'EOT'
       Makes the parser raise errors when referencing unknown variables. (This does not affect
       referencing variables that are explicitly set to undef).
     EOT
     }
   )
   define_settings(:puppetdoc,
     :document_all => {
         :default  => false,
         :type     => :boolean,
         :desc     => "Whether to document all resources when using `puppet doc` to
           generate manifest documentation.",
     }
   )
 end
diff --git a/lib/puppet/network/http.rb b/lib/puppet/network/http.rb
index a2712b8d5..68a345e63 100644
--- a/lib/puppet/network/http.rb
+++ b/lib/puppet/network/http.rb
@@ -1,15 +1,20 @@
 module Puppet::Network::HTTP
   HEADER_ENABLE_PROFILING = "X-Puppet-Profiling"
   HEADER_PUPPET_VERSION = "X-Puppet-Version"
 
   require 'puppet/network/http/issues'
   require 'puppet/network/http/error'
   require 'puppet/network/http/route'
   require 'puppet/network/http/api'
   require 'puppet/network/http/api/v1'
   require 'puppet/network/http/api/v2'
   require 'puppet/network/http/handler'
   require 'puppet/network/http/response'
   require 'puppet/network/http/request'
+  require 'puppet/network/http/site'
+  require 'puppet/network/http/session'
+  require 'puppet/network/http/factory'
+  require 'puppet/network/http/nocache_pool'
+  require 'puppet/network/http/pool'
   require 'puppet/network/http/memory_response'
 end
diff --git a/lib/puppet/network/http/connection.rb b/lib/puppet/network/http/connection.rb
index a2ce6eef3..388f8ba37 100644
--- a/lib/puppet/network/http/connection.rb
+++ b/lib/puppet/network/http/connection.rb
@@ -1,254 +1,240 @@
 require 'net/https'
 require 'puppet/ssl/host'
 require 'puppet/ssl/configuration'
 require 'puppet/ssl/validator'
 require 'puppet/network/authentication'
+require 'puppet/network/http'
 require 'uri'
 
 module Puppet::Network::HTTP
 
   # This will be raised if too many redirects happen for a given HTTP request
   class RedirectionLimitExceededException < Puppet::Error ; end
 
   # This class provides simple methods for issuing various types of HTTP
   # requests.  It's interface is intended to mirror Ruby's Net::HTTP
   # object, but it provides a few important bits of additional
   # functionality.  Notably:
   #
   # * Any HTTPS requests made using this class will use Puppet's SSL
   #   certificate configuration for their authentication, and
   # * Provides some useful error handling for any SSL errors that occur
   #   during a request.
   # @api public
   class Connection
     include Puppet::Network::Authentication
 
     OPTION_DEFAULTS = {
       :use_ssl => true,
       :verify => nil,
       :redirect_limit => 10,
     }
 
-    @@openssl_initialized = false
-
     # Creates a new HTTP client connection to `host`:`port`.
     # @param host [String] the host to which this client will connect to
     # @param port [Fixnum] the port to which this client will connect to
     # @param options [Hash] options influencing the properties of the created
     #   connection,
     # @option options [Boolean] :use_ssl true to connect with SSL, false
     #   otherwise, defaults to true
     # @option options [#setup_connection] :verify An object that will configure
     #   any verification to do on the connection
     # @option options [Fixnum] :redirect_limit the number of allowed
     #   redirections, defaults to 10 passing any other option in the options
     #   hash results in a Puppet::Error exception
     #
     # @note the HTTP connection itself happens lazily only when {#request}, or
     #   one of the {#get}, {#post}, {#delete}, {#head} or {#put} is called
     # @note The correct way to obtain a connection is to use one of the factory
     #   methods on {Puppet::Network::HttpPool}
     # @api private
     def initialize(host, port, options = {})
       @host = host
       @port = port
 
       unknown_options = options.keys - OPTION_DEFAULTS.keys
       raise Puppet::Error, "Unrecognized option(s): #{unknown_options.map(&:inspect).sort.join(', ')}" unless unknown_options.empty?
 
       options = OPTION_DEFAULTS.merge(options)
       @use_ssl = options[:use_ssl]
       @verify = options[:verify]
       @redirect_limit = options[:redirect_limit]
+      @site = Puppet::Network::HTTP::Site.new(@use_ssl ? 'https' : 'http', host, port)
+      @pool = Puppet.lookup(:http_pool)
     end
 
     # @!macro [new] common_options
     #   @param options [Hash] options influencing the request made
     #   @option options [Hash{Symbol => String}] :basic_auth The basic auth
     #     :username and :password to use for the request
 
     # @param path [String]
     # @param headers [Hash{String => String}]
     # @!macro common_options
     # @api public
     def get(path, headers = {}, options = {})
       request_with_redirects(Net::HTTP::Get.new(path, headers), options)
     end
 
     # @param path [String]
     # @param data [String]
     # @param headers [Hash{String => String}]
     # @!macro common_options
     # @api public
     def post(path, data, headers = nil, options = {})
       request = Net::HTTP::Post.new(path, headers)
       request.body = data
       request_with_redirects(request, options)
     end
 
     # @param path [String]
     # @param headers [Hash{String => String}]
     # @!macro common_options
     # @api public
     def head(path, headers = {}, options = {})
       request_with_redirects(Net::HTTP::Head.new(path, headers), options)
     end
 
     # @param path [String]
     # @param headers [Hash{String => String}]
     # @!macro common_options
     # @api public
     def delete(path, headers = {'Depth' => 'Infinity'}, options = {})
       request_with_redirects(Net::HTTP::Delete.new(path, headers), options)
     end
 
     # @param path [String]
     # @param data [String]
     # @param headers [Hash{String => String}]
     # @!macro common_options
     # @api public
     def put(path, data, headers = nil, options = {})
       request = Net::HTTP::Put.new(path, headers)
       request.body = data
       request_with_redirects(request, options)
     end
 
     def request(method, *args)
       self.send(method, *args)
     end
 
     # TODO: These are proxies for the Net::HTTP#request_* methods, which are
     # almost the same as the "get", "post", etc. methods that we've ported above,
-    # but they are able to accept a code block and will yield to it.  For now
+    # but they are able to accept a code block and will yield to it, which is
+    # necessary to stream responses, e.g. file content.  For now
     # we're not funneling these proxy implementations through our #request
     # method above, so they will not inherit the same error handling.  In the
     # future we may want to refactor these so that they are funneled through
     # that method and do inherit the error handling.
     def request_get(*args, &block)
-      connection.request_get(*args, &block)
+      with_connection(@site) do |connection|
+        connection.request_get(*args, &block)
+      end
     end
 
     def request_head(*args, &block)
-      connection.request_head(*args, &block)
+      with_connection(@site) do |connection|
+        connection.request_head(*args, &block)
+      end
     end
 
     def request_post(*args, &block)
-      connection.request_post(*args, &block)
+      with_connection(@site) do |connection|
+        connection.request_post(*args, &block)
+      end
     end
     # end of Net::HTTP#request_* proxies
 
+    # The address to connect to.
     def address
-      connection.address
+      @site.host
     end
 
+    # The port to connect to.
     def port
-      connection.port
+      @site.port
     end
 
+    # Whether to use ssl
     def use_ssl?
-      connection.use_ssl?
+      @site.use_ssl?
     end
 
     private
 
     def request_with_redirects(request, options)
       current_request = request
-      @redirect_limit.times do |redirection|
-        apply_options_to(current_request, options)
+      current_site = @site
+      response = nil
+
+      0.upto(@redirect_limit) do |redirection|
+        return response if response
+
+        with_connection(current_site) do |connection|
+          apply_options_to(current_request, options)
 
-        response = execute_request(current_request)
-        return response unless [301, 302, 307].include?(response.code.to_i)
+          current_response = execute_request(connection, current_request)
 
-        # handle the redirection
-        location = URI.parse(response['location'])
-        @connection = initialize_connection(location.host, location.port, location.scheme == 'https')
+          if [301, 302, 307].include?(current_response.code.to_i)
 
-        # update to the current request path
-        current_request = current_request.class.new(location.path)
-        current_request.body = request.body
-        request.each do |header, value|
-          current_request[header] = value
+            # handle the redirection
+            location = URI.parse(current_response['location'])
+            current_site = current_site.move_to(location)
+
+            # update to the current request path
+            current_request = current_request.class.new(location.path)
+            current_request.body = request.body
+            request.each do |header, value|
+              current_request[header] = value
+            end
+          else
+            response = current_response
+          end
         end
 
         # and try again...
       end
+
       raise RedirectionLimitExceededException, "Too many HTTP redirections for #{@host}:#{@port}"
     end
 
     def apply_options_to(request, options)
       if options[:basic_auth]
         request.basic_auth(options[:basic_auth][:user], options[:basic_auth][:password])
       end
     end
 
-    def connection
-      @connection || initialize_connection(@host, @port, @use_ssl)
-    end
-
-    def execute_request(request)
+    def execute_request(connection, request)
       response = connection.request(request)
 
       # Check the peer certs and warn if they're nearing expiration.
       warn_if_near_expiration(*@verify.peer_certs)
 
       response
     rescue OpenSSL::SSL::SSLError => error
       if error.message.include? "certificate verify failed"
         msg = error.message
         msg << ": [" + @verify.verify_errors.join('; ') + "]"
         raise Puppet::Error, msg, error.backtrace
       elsif error.message =~ /hostname.*not match.*server certificate/
         leaf_ssl_cert = @verify.peer_certs.last
 
         valid_certnames = [leaf_ssl_cert.name, *leaf_ssl_cert.subject_alt_names].uniq
         msg = valid_certnames.length > 1 ? "one of #{valid_certnames.join(', ')}" : valid_certnames.first
         msg = "Server hostname '#{connection.address}' did not match server certificate; expected #{msg}"
 
         raise Puppet::Error, msg, error.backtrace
       else
         raise
       end
     end
 
-    def initialize_connection(host, port, use_ssl)
-      args = [host, port]
-      if Puppet[:http_proxy_host] == "none"
-        args << nil << nil
-      else
-        args << Puppet[:http_proxy_host] << Puppet[:http_proxy_port]
+    def with_connection(site, &block)
+      response = nil
+      @pool.with_connection(site, @verify) do |conn|
+        response = yield conn
       end
-
-      @connection = create_connection(*args)
-
-      # Pop open the http client a little; older versions of Net::HTTP(s) didn't
-      # give us a reader for ca_file... Grr...
-      class << @connection; attr_accessor :ca_file; end
-
-      @connection.use_ssl = use_ssl
-      # Use configured timeout (#1176)
-      @connection.read_timeout = Puppet[:configtimeout]
-      @connection.open_timeout = Puppet[:configtimeout]
-
-      cert_setup
-
-      @connection
-    end
-
-    # Use cert information from a Puppet client to set up the http object.
-    def cert_setup
-      # PUP-1411, make sure that openssl is initialized before we try to connect
-      if ! @@openssl_initialized
-        OpenSSL::SSL::SSLContext.new
-        @@openssl_initialized = true
-      end
-
-      @verify.setup_connection(@connection)
-    end
-
-    # This method largely exists for testing purposes, so that we can
-    # mock the actual HTTP connection.
-    def create_connection(*args)
-      Net::HTTP.new(*args)
+      response
     end
   end
 end
diff --git a/lib/puppet/network/http/factory.rb b/lib/puppet/network/http/factory.rb
new file mode 100644
index 000000000..8e60ad2c6
--- /dev/null
+++ b/lib/puppet/network/http/factory.rb
@@ -0,0 +1,44 @@
+require 'openssl'
+require 'net/http'
+
+# Factory for <tt>Net::HTTP</tt> objects.
+#
+# Encapsulates the logic for creating a <tt>Net::HTTP</tt> object based on the
+# specified {Puppet::Network::HTTP::Site Site} and puppet settings.
+#
+# @api private
+#
+class Puppet::Network::HTTP::Factory
+  @@openssl_initialized = false
+
+  def initialize
+    # PUP-1411, make sure that openssl is initialized before we try to connect
+    if ! @@openssl_initialized
+      OpenSSL::SSL::SSLContext.new
+      @@openssl_initialized = true
+    end
+  end
+
+  def create_connection(site)
+    Puppet.debug("Creating new connection for #{site}")
+
+    args = [site.host, site.port]
+    if Puppet[:http_proxy_host] == "none"
+      args << nil << nil
+    else
+      args << Puppet[:http_proxy_host] << Puppet[:http_proxy_port]
+    end
+
+    http = Net::HTTP.new(*args)
+    http.use_ssl = site.use_ssl?
+    # Use configured timeout (#1176)
+    http.read_timeout = Puppet[:configtimeout]
+    http.open_timeout = Puppet[:configtimeout]
+
+    if Puppet[:http_debug]
+      http.set_debug_output($stderr)
+    end
+
+    http
+  end
+end
diff --git a/lib/puppet/network/http/nocache_pool.rb b/lib/puppet/network/http/nocache_pool.rb
new file mode 100644
index 000000000..d80e0409a
--- /dev/null
+++ b/lib/puppet/network/http/nocache_pool.rb
@@ -0,0 +1,21 @@
+# A pool that does not cache HTTP connections.
+#
+# @api private
+class Puppet::Network::HTTP::NoCachePool
+  def initialize(factory = Puppet::Network::HTTP::Factory.new)
+    @factory = factory
+  end
+
+  # Yields a <tt>Net::HTTP</tt> connection.
+  #
+  # @yieldparam http [Net::HTTP] An HTTP connection
+  def with_connection(site, verify, &block)
+    http = @factory.create_connection(site)
+    verify.setup_connection(http)
+    yield http
+  end
+
+  def close
+    # do nothing
+  end
+end
diff --git a/lib/puppet/network/http/pool.rb b/lib/puppet/network/http/pool.rb
new file mode 100644
index 000000000..b817b472b
--- /dev/null
+++ b/lib/puppet/network/http/pool.rb
@@ -0,0 +1,120 @@
+# A pool for persistent <tt>Net::HTTP</tt> connections. Connections are
+# stored in the pool indexed by their {Puppet::Network::HTTP::Site Site}.
+# Connections are borrowed from the pool, yielded to the caller, and
+# released back into the pool. If a connection is expired, it will be
+# closed either when a connection to that site is requested, or when
+# the pool is closed. The pool can store multiple connections to the
+# same site, and will be reused in MRU order.
+#
+# @api private
+#
+class Puppet::Network::HTTP::Pool
+  FIFTEEN_SECONDS = 15
+
+  attr_reader :factory
+
+  def initialize(keepalive_timeout = FIFTEEN_SECONDS)
+    @pool = {}
+    @factory = Puppet::Network::HTTP::Factory.new
+    @keepalive_timeout = keepalive_timeout
+  end
+
+  def with_connection(site, verify, &block)
+    reuse = true
+
+    http = borrow(site, verify)
+    begin
+      if http.use_ssl? && http.verify_mode != OpenSSL::SSL::VERIFY_PEER
+        reuse = false
+      end
+
+      yield http
+    rescue => detail
+      reuse = false
+      raise detail
+    ensure
+      if reuse
+        release(site, http)
+      else
+        close_connection(site, http)
+      end
+    end
+  end
+
+  def close
+    @pool.each_pair do |site, sessions|
+      sessions.each do |session|
+        close_connection(site, session.connection)
+      end
+    end
+    @pool.clear
+  end
+
+  # @api private
+  def pool
+    @pool
+  end
+
+  # Safely close a persistent connection.
+  #
+  # @api private
+  def close_connection(site, http)
+    Puppet.debug("Closing connection for #{site}")
+    http.finish
+  rescue => detail
+    Puppet.log_exception(detail, "Failed to close connection for #{site}: #{detail}")
+  end
+
+  # Borrow and take ownership of a persistent connection. If a new
+  # connection is created, it will be started prior to being returned.
+  #
+  # @api private
+  def borrow(site, verify)
+    @pool[site] = active_sessions(site)
+    session = @pool[site].shift
+    if session
+      Puppet.debug("Using cached connection for #{site}")
+      session.connection
+    else
+      http = @factory.create_connection(site)
+      verify.setup_connection(http)
+
+      Puppet.debug("Starting connection for #{site}")
+      http.start
+      http
+    end
+  end
+
+  # Release a connection back into the pool.
+  #
+  # @api private
+  def release(site, http)
+    expiration = Time.now + @keepalive_timeout
+    session = Puppet::Network::HTTP::Session.new(http, expiration)
+    Puppet.debug("Caching connection for #{site}")
+
+    sessions = @pool[site]
+    if sessions
+      sessions.unshift(session)
+    else
+      @pool[site] = [session]
+    end
+  end
+
+  # Returns an Array of sessions whose connections are not expired.
+  #
+  # @api private
+  def active_sessions(site)
+    now = Time.now
+
+    sessions = @pool[site] || []
+    sessions.select do |session|
+      if session.expired?(now)
+        close_connection(site, session.connection)
+        false
+      else
+        true
+      end
+    end
+  end
+end
diff --git a/lib/puppet/network/http/session.rb b/lib/puppet/network/http/session.rb
new file mode 100644
index 000000000..21136a12d
--- /dev/null
+++ b/lib/puppet/network/http/session.rb
@@ -0,0 +1,17 @@
+# An HTTP session that references a persistent HTTP connection and
+# an expiration time for the connection.
+#
+# @api private
+#
+class Puppet::Network::HTTP::Session
+  attr_reader :connection
+
+  def initialize(connection, expiration_time)
+    @connection = connection
+    @expiration_time = expiration_time
+  end
+
+  def expired?(now)
+    @expiration_time <= now
+  end
+end
diff --git a/lib/puppet/network/http/site.rb b/lib/puppet/network/http/site.rb
new file mode 100644
index 000000000..c219e6021
--- /dev/null
+++ b/lib/puppet/network/http/site.rb
@@ -0,0 +1,39 @@
+# Represents a site to which HTTP connections are made. It is a value
+# object, and is suitable for use in a hash. If two sites are equal,
+# then a persistent connection made to the first site, can be re-used
+# for the second.
+#
+# @api private
+#
+class Puppet::Network::HTTP::Site
+  attr_reader :scheme, :host, :port
+
+  def initialize(scheme, host, port)
+    @scheme = scheme
+    @host = host
+    @port = port.to_i
+  end
+
+  def addr
+    "#{@scheme}://#{@host}:#{@port.to_s}"
+  end
+  alias to_s addr
+
+  def ==(rhs)
+    (@scheme == rhs.scheme) && (@host == rhs.host) && (@port == rhs.port)
+  end
+
+  alias eql? ==
+
+  def hash
+    [@scheme, @host, @port].hash
+  end
+
+  def use_ssl?
+    @scheme == 'https'
+  end
+
+  def move_to(uri)
+    self.class.new(uri.scheme, uri.host, uri.port)
+  end
+end
diff --git a/lib/puppet/network/http_pool.rb b/lib/puppet/network/http_pool.rb
index 8c2783d36..5bab3803e 100644
--- a/lib/puppet/network/http_pool.rb
+++ b/lib/puppet/network/http_pool.rb
@@ -1,62 +1,61 @@
 require 'puppet/network/http/connection'
 
 module Puppet::Network; end
 
 # This module contains the factory methods that should be used for getting a
-# {Puppet::Network::HTTP::Connection} instance.
-#
-# @note The name "HttpPool" is a misnomer, and a leftover of history, but we would
-#   like to make this cache connections in the future.
+# {Puppet::Network::HTTP::Connection} instance. The pool may return a new
+# connection or a persistent cached connection, depending on the underlying
+# pool implementation in use.
 #
 # @api public
 #
 module Puppet::Network::HttpPool
 
   @http_client_class = Puppet::Network::HTTP::Connection
 
   def self.http_client_class
     @http_client_class
   end
   def self.http_client_class=(klass)
     @http_client_class = klass
   end
 
   # Retrieve a connection for the given host and port.
   #
   # @param host [String] The hostname to connect to
   # @param port [Integer] The port on the host to connect to
   # @param use_ssl [Boolean] Whether to use an SSL connection
   # @param verify_peer [Boolean] Whether to verify the peer credentials, if possible. Verification will not take place if the CA certificate is missing.
   # @return [Puppet::Network::HTTP::Connection]
   #
   # @api public
   #
   def self.http_instance(host, port, use_ssl = true, verify_peer = true)
     verifier = if verify_peer
                  Puppet::SSL::Validator.default_validator()
                else
                  Puppet::SSL::Validator.no_validator()
                end
 
     http_client_class.new(host, port,
                             :use_ssl => use_ssl,
                             :verify => verifier)
   end
 
   # Get an http connection that will be secured with SSL and have the
   # connection verified with the given verifier
   #
   # @param host [String] the DNS name to connect to
   # @param port [Integer] the port to connect to
   # @param verifier [#setup_connection, #peer_certs, #verify_errors] An object that will setup the appropriate
   #   verification on a Net::HTTP instance and report any errors and the certificates used.
   # @return [Puppet::Network::HTTP::Connection]
   #
   # @api public
   #
   def self.http_ssl_instance(host, port, verifier = Puppet::SSL::Validator.default_validator())
     http_client_class.new(host, port,
                             :use_ssl => true,
                             :verify => verifier)
   end
 end
diff --git a/lib/puppet/ssl.rb b/lib/puppet/ssl.rb
index 596feb933..f22c82d0e 100644
--- a/lib/puppet/ssl.rb
+++ b/lib/puppet/ssl.rb
@@ -1,12 +1,13 @@
 # Just to make the constants work out.
 require 'puppet'
 require 'openssl'
 
 module Puppet::SSL # :nodoc:
   CA_NAME = "ca"
+  require 'puppet/ssl/configuration'
   require 'puppet/ssl/host'
   require 'puppet/ssl/oids'
   require 'puppet/ssl/validator'
   require 'puppet/ssl/validator/no_validator'
   require 'puppet/ssl/validator/default_validator'
 end
diff --git a/lib/puppet/ssl/validator/default_validator.rb b/lib/puppet/ssl/validator/default_validator.rb
index e8e1d16e1..1f31499e2 100644
--- a/lib/puppet/ssl/validator/default_validator.rb
+++ b/lib/puppet/ssl/validator/default_validator.rb
@@ -1,153 +1,154 @@
 require 'openssl'
+require 'puppet/ssl'
 
 # Perform peer certificate verification against the known CA.
 # If there is no CA information known, then no verification is performed
 #
 # @api private
 #
 class Puppet::SSL::Validator::DefaultValidator #< class Puppet::SSL::Validator
   attr_reader :peer_certs
   attr_reader :verify_errors
   attr_reader :ssl_configuration
 
   # Creates a new DefaultValidator, optionally with an SSL Configuration and SSL Host.
   #
   # @param ssl_configuration [Puppet::SSL::Configuration] (a default configuration) ssl_configuration the SSL configuration to use
   # @param ssl_host [Puppet::SSL::Host] (Puppet::SSL::Host.localhost) the SSL host to use
   #
   # @api private
   #
   def initialize(
       ssl_configuration = Puppet::SSL::Configuration.new(
                                         Puppet[:localcacert], {
                                           :ca_chain_file => Puppet[:ssl_client_ca_chain],
                                           :ca_auth_file  => Puppet[:ssl_client_ca_auth]
                                         }),
       ssl_host = Puppet::SSL::Host.localhost)
 
     reset!
     @ssl_configuration = ssl_configuration
     @ssl_host = ssl_host
   end
 
 
   # Resets this validator to its initial validation state. The ssl configuration is not changed.
   #
   # @api private
   #
   def reset!
     @peer_certs = []
     @verify_errors = []
   end
 
   # Performs verification of the SSL connection and collection of the
   # certificates for use in constructing the error message if the verification
   # failed.  This callback will be executed once for each certificate in a
   # chain being verified.
   #
   # From the [OpenSSL
   # documentation](http://www.openssl.org/docs/ssl/SSL_CTX_set_verify.html):
   # The `verify_callback` function is used to control the behaviour when the
   # SSL_VERIFY_PEER flag is set. It must be supplied by the application and
   # receives two arguments: preverify_ok indicates, whether the verification of
   # the certificate in question was passed (preverify_ok=1) or not
   # (preverify_ok=0). x509_ctx is a pointer to the complete context used for
   # the certificate chain verification.
   #
   # See {Puppet::Network::HTTP::Connection} for more information and where this
   # class is intended to be used.
   #
   # @param [Boolean] preverify_ok indicates whether the verification of the
   #   certificate in question was passed (preverify_ok=true)
   # @param [OpenSSL::SSL::SSLContext] ssl_context holds the SSLContext for the
   #   chain being verified.
   #
   # @return [Boolean] false if the peer is invalid, true otherwise.
   #
   # @api private
   #
   def call(preverify_ok, ssl_context)
     # We must make a copy since the scope of the ssl_context will be lost
     # across invocations of this method.
     current_cert = ssl_context.current_cert
     @peer_certs << Puppet::SSL::Certificate.from_instance(current_cert)
 
     if preverify_ok
       # If we've copied all of the certs in the chain out of the SSL library
       if @peer_certs.length == ssl_context.chain.length
         # (#20027) The peer cert must be issued by a specific authority
         preverify_ok = valid_peer?
       end
     else
       if ssl_context.error_string
         @verify_errors << "#{ssl_context.error_string} for #{current_cert.subject}"
       end
     end
     preverify_ok
   rescue => ex
     @verify_errors << ex.message
     false
   end
 
   # Registers the instance's call method with the connection.
   #
   # @param [Net::HTTP] connection The connection to validate
   #
   # @return [void]
   #
   # @api private
   #
   def setup_connection(connection)
     if ssl_certificates_are_present?
       connection.cert_store = @ssl_host.ssl_store
       connection.ca_file = @ssl_configuration.ca_auth_file
       connection.cert = @ssl_host.certificate.content
       connection.key = @ssl_host.key.content
       connection.verify_mode = OpenSSL::SSL::VERIFY_PEER
       connection.verify_callback = self
     else
       connection.verify_mode = OpenSSL::SSL::VERIFY_NONE
     end
   end
 
   # Validates the peer certificates against the authorized certificates.
   #
   # @api private
   #
   def valid_peer?
     descending_cert_chain = @peer_certs.reverse.map {|c| c.content }
     authz_ca_certs = ssl_configuration.ca_auth_certificates
 
     if not has_authz_peer_cert(descending_cert_chain, authz_ca_certs)
       msg = "The server presented a SSL certificate chain which does not include a " <<
         "CA listed in the ssl_client_ca_auth file.  "
       msg << "Authorized Issuers: #{authz_ca_certs.collect {|c| c.subject}.join(', ')}  " <<
         "Peer Chain: #{descending_cert_chain.collect {|c| c.subject}.join(' => ')}"
       @verify_errors << msg
       false
     else
       true
     end
   end
 
   # Checks if the set of peer_certs contains at least one certificate issued
   # by a certificate listed in authz_certs
   #
   # @return [Boolean]
   #
   # @api private
   #
   def has_authz_peer_cert(peer_certs, authz_certs)
     peer_certs.any? do |peer_cert|
       authz_certs.any? do |authz_cert|
         peer_cert.verify(authz_cert.public_key)
       end
     end
   end
 
   # @api private
   #
   def ssl_certificates_are_present?
     Puppet::FileSystem.exist?(Puppet[:hostcert]) && Puppet::FileSystem.exist?(@ssl_configuration.ca_auth_file)
   end
 end
diff --git a/lib/puppet/ssl/validator/no_validator.rb b/lib/puppet/ssl/validator/no_validator.rb
index 1141b6952..b019369cc 100644
--- a/lib/puppet/ssl/validator/no_validator.rb
+++ b/lib/puppet/ssl/validator/no_validator.rb
@@ -1,17 +1,20 @@
+require 'openssl'
+require 'puppet/ssl'
+
 # Performs no SSL verification
 # @api private
 #
 class Puppet::SSL::Validator::NoValidator < Puppet::SSL::Validator
 
   def setup_connection(connection)
     connection.verify_mode = OpenSSL::SSL::VERIFY_NONE
   end
 
   def peer_certs
     []
   end
 
   def verify_errors
     []
   end
 end
diff --git a/spec/unit/network/http/connection_spec.rb b/spec/unit/network/http/connection_spec.rb
old mode 100644
new mode 100755
index a5e6f64ae..034f6af01
--- a/spec/unit/network/http/connection_spec.rb
+++ b/spec/unit/network/http/connection_spec.rb
@@ -1,271 +1,289 @@
 #! /usr/bin/env ruby
 require 'spec_helper'
 require 'puppet/network/http/connection'
 require 'puppet/network/authentication'
 
 describe Puppet::Network::HTTP::Connection do
 
   let (:host) { "me" }
   let (:port) { 54321 }
   subject { Puppet::Network::HTTP::Connection.new(host, port, :verify => Puppet::SSL::Validator.no_validator) }
   let (:httpok) { Net::HTTPOK.new('1.1', 200, '') }
 
   context "when providing HTTP connections" do
-    after do
-      Puppet::Network::HTTP::Connection.instance_variable_set("@ssl_host", nil)
-    end
-
     context "when initializing http instances" do
-      before :each do
-        # All of the cert stuff is tested elsewhere
-        Puppet::Network::HTTP::Connection.stubs(:cert_setup)
-      end
-
       it "should return an http instance created with the passed host and port" do
-        http = subject.send(:connection)
-        http.should be_an_instance_of Net::HTTP
-        http.address.should == host
-        http.port.should    == port
+        conn = Puppet::Network::HTTP::Connection.new(host, port, :verify => Puppet::SSL::Validator.no_validator)
+
+        expect(conn.address).to eq(host)
+        expect(conn.port).to eq(port)
       end
 
       it "should enable ssl on the http instance by default" do
-        http = subject.send(:connection)
-        http.should be_use_ssl
-      end
+        conn = Puppet::Network::HTTP::Connection.new(host, port, :verify => Puppet::SSL::Validator.no_validator)
 
-      it "can set ssl using an option" do
-        Puppet::Network::HTTP::Connection.new(host, port, :use_ssl => false, :verify => Puppet::SSL::Validator.no_validator).send(:connection).should_not be_use_ssl
-        Puppet::Network::HTTP::Connection.new(host, port, :use_ssl => true, :verify => Puppet::SSL::Validator.no_validator).send(:connection).should be_use_ssl
+        expect(conn).to be_use_ssl
       end
 
-      context "proxy and timeout settings should propagate" do
-        subject { Puppet::Network::HTTP::Connection.new(host, port, :verify => Puppet::SSL::Validator.no_validator).send(:connection) }
-        before :each do
-          Puppet[:http_proxy_host] = "myhost"
-          Puppet[:http_proxy_port] = 432
-          Puppet[:configtimeout]   = 120
-        end
+      it "can disable ssl using an option" do
+        conn = Puppet::Network::HTTP::Connection.new(host, port, :use_ssl => false, :verify => Puppet::SSL::Validator.no_validator)
 
-        its(:open_timeout)  { should == Puppet[:configtimeout] }
-        its(:read_timeout)  { should == Puppet[:configtimeout] }
-        its(:proxy_address) { should == Puppet[:http_proxy_host] }
-        its(:proxy_port)    { should == Puppet[:http_proxy_port] }
+        expect(conn).to_not be_use_ssl
       end
 
-      it "should not set a proxy if the value is 'none'" do
-        Puppet[:http_proxy_host] = 'none'
-        subject.send(:connection).proxy_address.should be_nil
+      it "can enable ssl using an option" do
+        conn = Puppet::Network::HTTP::Connection.new(host, port, :use_ssl => true, :verify => Puppet::SSL::Validator.no_validator)
+
+        expect(conn).to be_use_ssl
       end
 
       it "should raise Puppet::Error when invalid options are specified" do
         expect { Puppet::Network::HTTP::Connection.new(host, port, :invalid_option => nil) }.to raise_error(Puppet::Error, 'Unrecognized option(s): :invalid_option')
       end
     end
   end
 
   context "when methods that accept a block are called with a block" do
     let (:host) { "my_server" }
     let (:port) { 8140 }
     let (:subject) { Puppet::Network::HTTP::Connection.new(host, port, :use_ssl => false, :verify => Puppet::SSL::Validator.no_validator) }
 
     before :each do
       httpok.stubs(:body).returns ""
 
       # This stubbing relies a bit more on knowledge of the internals of Net::HTTP
       # than I would prefer, but it works on ruby 1.8.7 and 1.9.3, and it seems
       # valuable enough to have tests for blocks that this is probably warranted.
       socket = stub_everything("socket")
       TCPSocket.stubs(:open).returns(socket)
 
       Net::HTTP::Post.any_instance.stubs(:exec).returns("")
       Net::HTTP::Head.any_instance.stubs(:exec).returns("")
       Net::HTTP::Get.any_instance.stubs(:exec).returns("")
       Net::HTTPResponse.stubs(:read_new).returns(httpok)
     end
 
     [:request_get, :request_head, :request_post].each do |method|
       context "##{method}" do
         it "should yield to the block" do
           block_executed = false
           subject.send(method, "/foo", {}) do |response|
             block_executed = true
           end
           block_executed.should == true
         end
       end
     end
   end
 
   context "when validating HTTPS requests" do
     include PuppetSpec::Files
 
     let (:host) { "my_server" }
     let (:port) { 8140 }
 
     it "should provide a useful error message when one is available and certificate validation fails", :unless => Puppet.features.microsoft_windows? do
       connection = Puppet::Network::HTTP::Connection.new(
         host, port,
         :verify => ConstantErrorValidator.new(:fails_with => 'certificate verify failed',
                                               :error_string => 'shady looking signature'))
 
       expect do
         connection.get('request')
       end.to raise_error(Puppet::Error, "certificate verify failed: [shady looking signature]")
     end
 
     it "should provide a helpful error message when hostname was not match with server certificate", :unless => Puppet.features.microsoft_windows? do
       Puppet[:confdir] = tmpdir('conf')
 
       connection = Puppet::Network::HTTP::Connection.new(
         host, port,
         :verify => ConstantErrorValidator.new(
           :fails_with => 'hostname was not match with server certificate',
           :peer_certs => [Puppet::SSL::CertificateAuthority.new.generate(
             'not_my_server', :dns_alt_names => 'foo,bar,baz')]))
 
       expect do
         connection.get('request')
       end.to raise_error(Puppet::Error) do |error|
         error.message =~ /Server hostname 'my_server' did not match server certificate; expected one of (.+)/
         $1.split(', ').should =~ %w[DNS:foo DNS:bar DNS:baz DNS:not_my_server not_my_server]
       end
     end
 
     it "should pass along the error message otherwise" do
       connection = Puppet::Network::HTTP::Connection.new(
         host, port,
         :verify => ConstantErrorValidator.new(:fails_with => 'some other message'))
 
       expect do
         connection.get('request')
       end.to raise_error(/some other message/)
     end
 
     it "should check all peer certificates for upcoming expiration", :unless => Puppet.features.microsoft_windows? do
       Puppet[:confdir] = tmpdir('conf')
       cert = Puppet::SSL::CertificateAuthority.new.generate(
         'server', :dns_alt_names => 'foo,bar,baz')
 
       connection = Puppet::Network::HTTP::Connection.new(
         host, port,
         :verify => NoProblemsValidator.new(cert))
 
       Net::HTTP.any_instance.stubs(:request).returns(httpok)
 
       connection.expects(:warn_if_near_expiration).with(cert)
 
       connection.get('request')
     end
 
     class ConstantErrorValidator
       def initialize(args)
         @fails_with = args[:fails_with]
         @error_string = args[:error_string] || ""
         @peer_certs = args[:peer_certs] || []
       end
 
       def setup_connection(connection)
         connection.stubs(:request).with do
           true
         end.raises(OpenSSL::SSL::SSLError.new(@fails_with))
       end
 
       def peer_certs
         @peer_certs
       end
 
       def verify_errors
         [@error_string]
       end
     end
 
     class NoProblemsValidator
       def initialize(cert)
         @cert = cert
       end
 
       def setup_connection(connection)
       end
 
       def peer_certs
         [@cert]
       end
 
       def verify_errors
         []
       end
     end
   end
 
   context "when response is a redirect" do
-    let (:other_host) { "redirected" }
-    let (:other_port) { 9292 }
+    let (:site)       { Puppet::Network::HTTP::Site.new('http', 'my_server', 8140) }
+    let (:other_site) { Puppet::Network::HTTP::Site.new('http', 'redirected', 9292) }
     let (:other_path) { "other-path" }
-    let (:subject) { Puppet::Network::HTTP::Connection.new("my_server", 8140, :use_ssl => false, :verify => Puppet::SSL::Validator.no_validator) }
-    let (:httpredirection) { Net::HTTPFound.new('1.1', 302, 'Moved Temporarily') }
-
-    before :each do
-      httpredirection['location'] = "http://#{other_host}:#{other_port}/#{other_path}"
-      httpredirection.stubs(:read_body).returns("This resource has moved")
-
-      socket = stub_everything("socket")
-      TCPSocket.stubs(:open).returns(socket)
+    let (:verify) { Puppet::SSL::Validator.no_validator }
+    let (:subject) { Puppet::Network::HTTP::Connection.new(site.host, site.port, :use_ssl => false, :verify => verify) }
+    let (:httpredirection) do
+      response = Net::HTTPFound.new('1.1', 302, 'Moved Temporarily')
+      response['location'] = "#{other_site.addr}/#{other_path}"
+      response.stubs(:read_body).returns("This resource has moved")
+      response
+    end
 
-      Net::HTTP::Get.any_instance.stubs(:exec).returns("")
-      Net::HTTP::Post.any_instance.stubs(:exec).returns("")
+    def create_connection(site, options)
+      options[:use_ssl] = site.use_ssl?
+      Puppet::Network::HTTP::Connection.new(site.host, site.port, options)
     end
 
     it "should redirect to the final resource location" do
-      httpok.stubs(:read_body).returns(:body)
-      Net::HTTPResponse.stubs(:read_new).returns(httpredirection).then.returns(httpok)
+      http = stub('http')
+      http.stubs(:request).returns(httpredirection).then.returns(httpok)
 
-      subject.get("/foo").body.should == :body
-      subject.port.should == other_port
-      subject.address.should == other_host
+      seq = sequence('redirection')
+      pool = Puppet.lookup(:http_pool)
+      pool.expects(:with_connection).with(site, anything).yields(http).in_sequence(seq)
+      pool.expects(:with_connection).with(other_site, anything).yields(http).in_sequence(seq)
+
+      conn = create_connection(site, :verify => verify)
+      conn.get('/foo')
     end
 
-    it "should raise an error after too many redirections" do
-      Net::HTTPResponse.stubs(:read_new).returns(httpredirection)
+    def expects_redirection(conn, &block)
+      http = stub('http')
+      http.stubs(:request).returns(httpredirection)
+
+      pool = Puppet.lookup(:http_pool)
+      pool.expects(:with_connection).with(site, anything).yields(http)
+      pool
+    end
 
+    def expects_limit_exceeded(conn)
       expect {
-        subject.get("/foo")
+        conn.get('/')
       }.to raise_error(Puppet::Network::HTTP::RedirectionLimitExceededException)
     end
+
+    it "should not redirect when the limit is 0" do
+      conn = create_connection(site, :verify => verify, :redirect_limit => 0)
+
+      pool = expects_redirection(conn)
+      pool.expects(:with_connection).with(other_site, anything).never
+
+      expects_limit_exceeded(conn)
+    end
+
+    it "should redirect only once" do
+      conn = create_connection(site, :verify => verify, :redirect_limit => 1)
+
+      pool = expects_redirection(conn)
+      pool.expects(:with_connection).with(other_site, anything).once
+
+      expects_limit_exceeded(conn)
+    end
+
+    it "should raise an exception when the redirect limit is exceeded" do
+      conn = create_connection(site, :verify => verify, :redirect_limit => 3)
+
+      pool = expects_redirection(conn)
+      pool.expects(:with_connection).with(other_site, anything).times(3)
+
+      expects_limit_exceeded(conn)
+    end
   end
 
   it "allows setting basic auth on get requests" do
     expect_request_with_basic_auth
 
     subject.get('/path', nil, :basic_auth => { :user => 'user', :password => 'password' })
   end
 
   it "allows setting basic auth on post requests" do
     expect_request_with_basic_auth
 
     subject.post('/path', 'data', nil, :basic_auth => { :user => 'user', :password => 'password' })
   end
 
   it "allows setting basic auth on head requests" do
     expect_request_with_basic_auth
 
     subject.head('/path', nil, :basic_auth => { :user => 'user', :password => 'password' })
   end
 
   it "allows setting basic auth on delete requests" do
     expect_request_with_basic_auth
 
     subject.delete('/path', nil, :basic_auth => { :user => 'user', :password => 'password' })
   end
 
   it "allows setting basic auth on put requests" do
     expect_request_with_basic_auth
 
     subject.put('/path', 'data', nil, :basic_auth => { :user => 'user', :password => 'password' })
   end
 
   def expect_request_with_basic_auth
     Net::HTTP.any_instance.expects(:request).with do |request|
       expect(request['authorization']).to match(/^Basic/)
     end.returns(httpok)
   end
 end
diff --git a/spec/unit/network/http/factory_spec.rb b/spec/unit/network/http/factory_spec.rb
new file mode 100755
index 000000000..107ededcd
--- /dev/null
+++ b/spec/unit/network/http/factory_spec.rb
@@ -0,0 +1,82 @@
+#! /usr/bin/env ruby
+require 'spec_helper'
+require 'puppet/network/http'
+
+describe Puppet::Network::HTTP::Factory do
+  before :each do
+    Puppet::SSL::Key.indirection.terminus_class = :memory
+    Puppet::SSL::CertificateRequest.indirection.terminus_class = :memory
+  end
+
+  let(:site) { Puppet::Network::HTTP::Site.new('https', 'www.example.com', 443) }
+  def create_connection(site)
+    factory = Puppet::Network::HTTP::Factory.new
+
+    factory.create_connection(site)
+  end
+
+  it 'creates a connection for the site' do
+    conn = create_connection(site)
+
+    expect(conn.use_ssl?).to be_true
+    expect(conn.address).to eq(site.host)
+    expect(conn.port).to eq(site.port)
+  end
+
+  it 'creates a connection that has not yet been started' do
+    conn = create_connection(site)
+
+    expect(conn).to_not be_started
+  end
+
+  it 'creates a connection supporting at least HTTP 1.1' do
+    conn = create_connection(site)
+
+    expect(any_of(conn.class.version_1_1?, conn.class.version_1_1?)).to be_true
+  end
+
+  context "proxy settings" do
+    let(:proxy_host) { 'myhost' }
+    let(:proxy_port) { 432 }
+
+    it "should not set a proxy if the value is 'none'" do
+      Puppet[:http_proxy_host] = 'none'
+      conn = create_connection(site)
+
+      expect(conn.proxy_address).to be_nil
+    end
+
+    it 'sets proxy_address' do
+      Puppet[:http_proxy_host] = proxy_host
+      conn = create_connection(site)
+
+      expect(conn.proxy_address).to eq(proxy_host)
+    end
+
+    it 'sets proxy address and port' do
+      Puppet[:http_proxy_host] = proxy_host
+      Puppet[:http_proxy_port] = proxy_port
+      conn = create_connection(site)
+
+      expect(conn.proxy_port).to eq(proxy_port)
+    end
+
+    context 'socket timeouts' do
+      let(:timeout) { 5 }
+
+      it 'sets open timeout' do
+        Puppet[:configtimeout] = timeout
+        conn = create_connection(site)
+
+        expect(conn.open_timeout).to eq(timeout)
+      end
+
+      it 'sets read timeout' do
+        Puppet[:configtimeout] = timeout
+        conn = create_connection(site)
+
+        expect(conn.read_timeout).to eq(timeout)
+      end
+    end
+  end
+end
diff --git a/spec/unit/network/http/nocache_pool_spec.rb b/spec/unit/network/http/nocache_pool_spec.rb
new file mode 100755
index 000000000..69e2d2e9a
--- /dev/null
+++ b/spec/unit/network/http/nocache_pool_spec.rb
@@ -0,0 +1,43 @@
+#! /usr/bin/env ruby
+require 'spec_helper'
+
+require 'puppet/network/http'
+require 'puppet/network/http/connection'
+
+describe Puppet::Network::HTTP::NoCachePool do
+  let(:site) { Puppet::Network::HTTP::Site.new('https', 'rubygems.org', 443) }
+  let(:verify) { stub('verify', :setup_connection => nil) }
+
+  it 'yields a connection' do
+    http  = stub('http')
+
+    factory = Puppet::Network::HTTP::Factory.new
+    factory.stubs(:create_connection).returns(http)
+    pool = Puppet::Network::HTTP::NoCachePool.new(factory)
+
+    expect { |b|
+      pool.with_connection(site, verify, &b)
+    }.to yield_with_args(http)
+  end
+
+  it 'yields a new connection each time' do
+    http1  = stub('http1')
+    http2  = stub('http2')
+
+    factory = Puppet::Network::HTTP::Factory.new
+    factory.stubs(:create_connection).returns(http1).then.returns(http2)
+    pool = Puppet::Network::HTTP::NoCachePool.new(factory)
+
+    expect { |b|
+      pool.with_connection(site, verify, &b)
+    }.to yield_with_args(http1)
+
+    expect { |b|
+      pool.with_connection(site, verify, &b)
+    }.to yield_with_args(http2)
+  end
+
+  it 'has a close method' do
+    Puppet::Network::HTTP::NoCachePool.new.close
+  end
+end
diff --git a/spec/unit/network/http/pool_spec.rb b/spec/unit/network/http/pool_spec.rb
new file mode 100755
index 000000000..aef100953
--- /dev/null
+++ b/spec/unit/network/http/pool_spec.rb
@@ -0,0 +1,269 @@
+#! /usr/bin/env ruby
+require 'spec_helper'
+
+require 'openssl'
+require 'puppet/network/http'
+require 'puppet/network/http_pool'
+
+describe Puppet::Network::HTTP::Pool do
+  before :each do
+    Puppet::SSL::Key.indirection.terminus_class = :memory
+    Puppet::SSL::CertificateRequest.indirection.terminus_class = :memory
+  end
+
+  let(:site) do
+    Puppet::Network::HTTP::Site.new('https', 'rubygems.org', 443)
+  end
+
+  let(:different_site) do
+    Puppet::Network::HTTP::Site.new('https', 'github.com', 443)
+  end
+
+  let(:verify) do
+    stub('verify', :setup_connection => nil)
+  end
+
+  def create_pool
+    Puppet::Network::HTTP::Pool.new
+  end
+
+  def create_pool_with_connections(site, *connections)
+    pool = Puppet::Network::HTTP::Pool.new
+    connections.each do |conn|
+      pool.release(site, conn)
+    end
+    pool
+  end
+
+  def create_pool_with_expired_connections(site, *connections)
+    # setting keepalive timeout to -1 ensures any newly added
+    # connections have already expired
+    pool = Puppet::Network::HTTP::Pool.new(-1)
+    connections.each do |conn|
+      pool.release(site, conn)
+    end
+    pool
+  end
+
+  def create_connection(site)
+    stub(site.addr, :started? => false, :start => nil, :finish => nil, :use_ssl? => true, :verify_mode => OpenSSL::SSL::VERIFY_PEER)
+  end
+
+  context 'when yielding a connection' do
+    it 'yields a connection' do
+      conn = create_connection(site)
+      pool = create_pool_with_connections(site, conn)
+
+      expect { |b|
+        pool.with_connection(site, verify, &b)
+      }.to yield_with_args(conn)
+    end
+
+    it 'returns the connection to the pool' do
+      conn = create_connection(site)
+      pool = create_pool
+      pool.release(site, conn)
+
+      pool.with_connection(site, verify) { |c| }
+
+      expect(pool.pool[site].first.connection).to eq(conn)
+    end
+
+    it 'can yield multiple connections to the same site' do
+      lru_conn = create_connection(site)
+      mru_conn = create_connection(site)
+      pool = create_pool_with_connections(site, lru_conn, mru_conn)
+
+      pool.with_connection(site, verify) do |a|
+        expect(a).to eq(mru_conn)
+
+        pool.with_connection(site, verify) do |b|
+          expect(b).to eq(lru_conn)
+        end
+      end
+    end
+
+    it 'propagates exceptions' do
+      conn = create_connection(site)
+      pool = create_pool
+      pool.release(site, conn)
+
+      expect {
+        pool.with_connection(site, verify) do |c|
+          raise IOError, 'connection reset'
+        end
+      }.to raise_error(IOError, 'connection reset')
+    end
+
+    it 'does not re-cache connections when an error occurs' do
+      # we're not distinguishing between network errors that would
+      # suggest we close the socket, and other errors
+      conn = create_connection(site)
+      pool = create_pool
+      pool.release(site, conn)
+
+      pool.expects(:release).with(site, conn).never
+
+      pool.with_connection(site, verify) do |c|
+        raise IOError, 'connection reset'
+      end rescue nil
+    end
+
+    context 'when releasing connections' do
+      it 'releases HTTP connections' do
+        conn = create_connection(site)
+        conn.expects(:use_ssl?).returns(false)
+
+        pool = create_pool_with_connections(site, conn)
+        pool.expects(:release).with(site, conn)
+
+        pool.with_connection(site, verify) {|c| }
+      end
+
+      it 'releases secure HTTPS connections' do
+        conn = create_connection(site)
+        conn.expects(:use_ssl?).returns(true)
+        conn.expects(:verify_mode).returns(OpenSSL::SSL::VERIFY_PEER)
+
+        pool = create_pool_with_connections(site, conn)
+        pool.expects(:release).with(site, conn)
+
+        pool.with_connection(site, verify) {|c| }
+      end
+
+      it 'closes insecure HTTPS connections' do
+        conn = create_connection(site)
+        conn.expects(:use_ssl?).returns(true)
+        conn.expects(:verify_mode).returns(OpenSSL::SSL::VERIFY_NONE)
+
+        pool = create_pool_with_connections(site, conn)
+
+        pool.expects(:release).with(site, conn).never
+
+        pool.with_connection(site, verify) {|c| }
+      end
+    end
+  end
+
+  context 'when borrowing' do
+    it 'returns a new connection if the pool is empty' do
+      conn = create_connection(site)
+      pool = create_pool
+      pool.factory.expects(:create_connection).with(site).returns(conn)
+
+      expect(pool.borrow(site, verify)).to eq(conn)
+    end
+
+    it 'returns a matching connection' do
+      conn = create_connection(site)
+      pool = create_pool_with_connections(site, conn)
+
+      pool.factory.expects(:create_connection).never
+
+      expect(pool.borrow(site, verify)).to eq(conn)
+    end
+
+    it 'returns a new connection if there are no matching sites' do
+      different_conn = create_connection(different_site)
+      pool = create_pool_with_connections(different_site, different_conn)
+
+      conn = create_connection(site)
+      pool.factory.expects(:create_connection).with(site).returns(conn)
+
+      expect(pool.borrow(site, verify)).to eq(conn)
+    end
+
+    it 'returns started connections' do
+      conn = create_connection(site)
+      conn.expects(:start)
+
+      pool = create_pool
+      pool.factory.expects(:create_connection).with(site).returns(conn)
+
+      expect(pool.borrow(site, verify)).to eq(conn)
+    end
+
+    it "doesn't start a cached connection" do
+      conn = create_connection(site)
+      conn.expects(:start).never
+
+      pool = create_pool_with_connections(site, conn)
+      pool.borrow(site, verify)
+    end
+
+    it 'returns the most recently used connection from the pool' do
+      least_recently_used = create_connection(site)
+      most_recently_used = create_connection(site)
+
+      pool = create_pool_with_connections(site, least_recently_used, most_recently_used)
+      expect(pool.borrow(site, verify)).to eq(most_recently_used)
+    end
+
+    it 'finishes expired connections' do
+      conn = create_connection(site)
+      conn.expects(:finish)
+
+      pool = create_pool_with_expired_connections(site, conn)
+      pool.factory.expects(:create_connection => stub('conn', :start => nil))
+
+      pool.borrow(site, verify)
+    end
+
+    it 'logs an exception if it fails to close an expired connection' do
+      Puppet.expects(:log_exception).with(is_a(IOError), "Failed to close connection for #{site}: read timeout")
+
+      conn = create_connection(site)
+      conn.expects(:finish).raises(IOError, 'read timeout')
+
+      pool = create_pool_with_expired_connections(site, conn)
+      pool.factory.expects(:create_connection => stub('open_conn', :start => nil))
+
+      pool.borrow(site, verify)
+    end
+  end
+
+  context 'when releasing a connection' do
+    it 'adds the connection to an empty pool' do
+      conn = create_connection(site)
+
+      pool = create_pool
+      pool.release(site, conn)
+
+      expect(pool.pool[site].first.connection).to eq(conn)
+    end
+
+    it 'adds the connection to a pool with a connection for the same site' do
+      pool = create_pool
+      pool.release(site, create_connection(site))
+      pool.release(site, create_connection(site))
+
+      expect(pool.pool[site].count).to eq(2)
+    end
+
+    it 'adds the connection to a pool with a connection for a different site' do
+      pool = create_pool
+      pool.release(site, create_connection(site))
+      pool.release(different_site, create_connection(different_site))
+
+      expect(pool.pool[site].count).to eq(1)
+      expect(pool.pool[different_site].count).to eq(1)
+    end
+  end
+
+  context 'when closing' do
+    it 'clears the pool' do
+      pool = create_pool
+      pool.close
+
+      expect(pool.pool).to be_empty
+    end
+
+    it 'closes all cached connections' do
+      conn = create_connection(site)
+      conn.expects(:finish)
+
+      pool = create_pool_with_connections(site, conn)
+      pool.close
+    end
+  end
+end
diff --git a/spec/unit/network/http/session_spec.rb b/spec/unit/network/http/session_spec.rb
new file mode 100755
index 000000000..4eba67d7d
--- /dev/null
+++ b/spec/unit/network/http/session_spec.rb
@@ -0,0 +1,43 @@
+#! /usr/bin/env ruby
+require 'spec_helper'
+
+require 'puppet/network/http'
+
+describe Puppet::Network::HTTP::Session do
+  let(:connection) { stub('connection') }
+
+  def create_session(connection, expiration_time = nil)
+    expiration_time ||= Time.now + 60 * 60
+
+    Puppet::Network::HTTP::Session.new(connection, expiration_time)
+  end
+
+  it 'provides access to its connection' do
+    session = create_session(connection)
+
+    session.connection.should == connection
+  end
+
+  it 'expires a connection whose expiration time is in the past' do
+    now = Time.now
+    past = now - 1
+
+    session = create_session(connection, past)
+    session.expired?(now).should be_true
+  end
+
+  it 'expires a connection whose expiration time is now' do
+    now = Time.now
+
+    session = create_session(connection, now)
+    session.expired?(now).should be_true
+  end
+
+  it 'does not expire a connection whose expiration time is in the future' do
+    now = Time.now
+    future = now + 1
+
+    session = create_session(connection, future)
+    session.expired?(now).should be_false
+  end
+end
diff --git a/spec/unit/network/http/site_spec.rb b/spec/unit/network/http/site_spec.rb
new file mode 100755
index 000000000..06fcbf83d
--- /dev/null
+++ b/spec/unit/network/http/site_spec.rb
@@ -0,0 +1,90 @@
+#! /usr/bin/env ruby
+require 'spec_helper'
+
+require 'puppet/network/http'
+
+describe Puppet::Network::HTTP::Site do
+  let(:scheme)      { 'https' }
+  let(:host)        { 'rubygems.org' }
+  let(:port)        { 443 }
+
+  def create_site(scheme, host, port)
+    Puppet::Network::HTTP::Site.new(scheme, host, port)
+  end
+
+  it 'accepts scheme, host, and port' do
+    site = create_site(scheme, host, port)
+
+    expect(site.scheme).to eq(scheme)
+    expect(site.host).to eq(host)
+    expect(site.port).to eq(port)
+  end
+
+  it 'generates an external URI string' do
+    site = create_site(scheme, host, port)
+
+    expect(site.addr).to eq("https://rubygems.org:443")
+  end
+
+  it 'considers sites to be different when the scheme is different' do
+    https_site = create_site('https', host, port)
+    http_site = create_site('http', host, port)
+
+    expect(https_site).to_not eq(http_site)
+  end
+
+  it 'considers sites to be different when the host is different' do
+    rubygems_site = create_site(scheme, 'rubygems.org', port)
+    github_site = create_site(scheme, 'github.com', port)
+
+    expect(rubygems_site).to_not eq(github_site)
+  end
+
+  it 'considers sites to be different when the port is different' do
+    site_443 = create_site(scheme, host, 443)
+    site_80 = create_site(scheme, host, 80)
+
+    expect(site_443).to_not eq(site_80)
+  end
+
+  it 'compares values when determining equality' do
+    site = create_site(scheme, host, port)
+
+    sites = {}
+    sites[site] = site
+
+    another_site = create_site(scheme, host, port)
+
+    expect(sites.include?(another_site)).to be_true
+  end
+
+  it 'computes the same hash code for equivalent objects' do
+    site = create_site(scheme, host, port)
+    same_site = create_site(scheme, host, port)
+
+    expect(site.hash).to eq(same_site.hash)
+  end
+
+  it 'uses ssl with https' do
+    site = create_site('https', host, port)
+
+    expect(site).to be_use_ssl
+  end
+
+  it 'does not use ssl with http' do
+    site = create_site('http', host, port)
+
+    expect(site).to_not be_use_ssl
+  end
+
+  it 'moves to a new URI location' do
+    site = create_site('http', 'host1', 80)
+
+    uri = URI.parse('https://host2:443/some/where/else')
+    new_site = site.move_to(uri)
+
+    expect(new_site.scheme).to eq('https')
+    expect(new_site.host).to eq('host2')
+    expect(new_site.port).to eq(443)
+  end
+end
diff --git a/spec/unit/network/http_pool_spec.rb b/spec/unit/network/http_pool_spec.rb
index d8b84232e..a9c5783f2 100755
--- a/spec/unit/network/http_pool_spec.rb
+++ b/spec/unit/network/http_pool_spec.rb
@@ -1,95 +1,98 @@
 #! /usr/bin/env ruby
 require 'spec_helper'
 require 'puppet/network/http_pool'
 
 describe Puppet::Network::HttpPool do
   before :each do
     Puppet::SSL::Key.indirection.terminus_class = :memory
     Puppet::SSL::CertificateRequest.indirection.terminus_class = :memory
   end
 
   describe "when managing http instances" do
-
     it "should return an http instance created with the passed host and port" do
       http = Puppet::Network::HttpPool.http_instance("me", 54321)
       http.should be_an_instance_of Puppet::Network::HTTP::Connection
       http.address.should == 'me'
       http.port.should    == 54321
     end
 
     it "should support using an alternate http client implementation" do
       begin
         class FooClient
           def initialize(host, port, options = {})
             @host = host
             @port = port
           end
           attr_reader :host, :port
         end
 
         orig_class = Puppet::Network::HttpPool.http_client_class
         Puppet::Network::HttpPool.http_client_class = FooClient
         http = Puppet::Network::HttpPool.http_instance("me", 54321)
         http.should be_an_instance_of FooClient
         http.host.should == 'me'
         http.port.should == 54321
       ensure
         Puppet::Network::HttpPool.http_client_class = orig_class
       end
     end
 
     it "should enable ssl on the http instance by default" do
       Puppet::Network::HttpPool.http_instance("me", 54321).should be_use_ssl
     end
 
     it "can set ssl using an option" do
       Puppet::Network::HttpPool.http_instance("me", 54321, false).should_not be_use_ssl
       Puppet::Network::HttpPool.http_instance("me", 54321, true).should be_use_ssl
     end
 
-
     describe 'peer verification' do
       def setup_standard_ssl_configuration
         ca_cert_file = File.expand_path('/path/to/ssl/certs/ca_cert.pem')
 
         Puppet[:ssl_client_ca_auth] = ca_cert_file
         Puppet::FileSystem.stubs(:exist?).with(ca_cert_file).returns(true)
       end
 
       def setup_standard_hostcert
         host_cert_file = File.expand_path('/path/to/ssl/certs/host_cert.pem')
         Puppet::FileSystem.stubs(:exist?).with(host_cert_file).returns(true)
 
         Puppet[:hostcert] = host_cert_file
       end
 
       def setup_standard_ssl_host
         cert = stub('cert', :content => 'real_cert')
         key  = stub('key',  :content => 'real_key')
         host = stub('host', :certificate => cert, :key => key, :ssl_store => stub('store'))
 
         Puppet::SSL::Host.stubs(:localhost).returns(host)
       end
 
       before do
         setup_standard_ssl_configuration
         setup_standard_hostcert
         setup_standard_ssl_host
       end
 
-      it 'can enable peer verification' do
-        Puppet::Network::HttpPool.http_instance("me", 54321, true, true).send(:connection).verify_mode.should == OpenSSL::SSL::VERIFY_PEER
+      it 'enables peer verification by default' do
+        response = Net::HTTPOK.new('1.1', 200, 'body')
+        conn = Puppet::Network::HttpPool.http_instance("me", 54321, true)
+        conn.expects(:execute_request).with { |http, request| expect(http.verify_mode).to eq(OpenSSL::SSL::VERIFY_PEER) }.returns(response)
+        conn.get('/')
       end
 
       it 'can disable peer verification' do
-        Puppet::Network::HttpPool.http_instance("me", 54321, true, false).send(:connection).verify_mode.should == OpenSSL::SSL::VERIFY_NONE
+        response = Net::HTTPOK.new('1.1', 200, 'body')
+        conn = Puppet::Network::HttpPool.http_instance("me", 54321, true, false)
+        conn.expects(:execute_request).with { |http, request| expect(http.verify_mode).to eq(OpenSSL::SSL::VERIFY_NONE) }.returns(response)
+        conn.get('/')
       end
     end
 
     it "should not cache http instances" do
       Puppet::Network::HttpPool.http_instance("me", 54321).
         should_not equal(Puppet::Network::HttpPool.http_instance("me", 54321))
     end
   end
-
 end
diff --git a/spec/unit/network/http_spec.rb b/spec/unit/network/http_spec.rb
new file mode 100755
index 000000000..4a149d3a8
--- /dev/null
+++ b/spec/unit/network/http_spec.rb
@@ -0,0 +1,10 @@
+#! /usr/bin/env ruby
+require 'spec_helper'
+require 'puppet/network/http'
+
+describe Puppet::Network::HTTP do
+  it 'defines an http_pool context' do
+    pool = Puppet.lookup(:http_pool)
+    expect(pool).to be_a(Puppet::Network::HTTP::NoCachePool)
+  end
+end
diff --git a/spec/unit/ssl/validator_spec.rb b/spec/unit/ssl/validator_spec.rb
index 2b8cfb0f9..ade1575dc 100644
--- a/spec/unit/ssl/validator_spec.rb
+++ b/spec/unit/ssl/validator_spec.rb
@@ -1,354 +1,353 @@
 require 'spec_helper'
 require 'puppet/ssl'
-require 'puppet/ssl/configuration'
 
 describe Puppet::SSL::Validator::DefaultValidator do
   let(:ssl_context) do
     mock('OpenSSL::X509::StoreContext')
   end
 
   let(:ssl_configuration) do
     Puppet::SSL::Configuration.new(
       Puppet[:localcacert],
       :ca_chain_file => Puppet[:ssl_client_ca_chain],
       :ca_auth_file  => Puppet[:ssl_client_ca_auth])
   end
 
   let(:ssl_host) do
     stub('ssl_host',
          :ssl_store => nil,
          :certificate => stub('cert', :content => nil),
          :key => stub('key', :content => nil))
   end
 
   subject do
     described_class.new(ssl_configuration,
                         ssl_host)
   end
 
   before :each do
     ssl_configuration.stubs(:read_file).
       with(Puppet[:localcacert]).
       returns(root_ca)
   end
 
   describe '#call' do
     before :each do
       ssl_context.stubs(:current_cert).returns(*cert_chain_in_callback_order)
       ssl_context.stubs(:chain).returns(cert_chain)
     end
 
     context 'When pre-verification is not OK' do
       context 'and the ssl_context is in an error state' do
         before :each do
           ssl_context.stubs(:error_string).returns("Something went wrong.")
         end
 
         it 'makes the error available via #verify_errors' do
           subject.call(false, ssl_context)
           msg_suffix = OpenSSL::X509::Certificate.new(root_ca).subject
           subject.verify_errors.should == ["Something went wrong. for #{msg_suffix}"]
         end
       end
     end
 
     context 'When pre-verification is OK' do
       context 'and the ssl_context is in an error state' do
         before :each do
           ssl_context.stubs(:error_string).returns("Something went wrong.")
         end
 
         it 'does not make the error available via #verify_errors' do
           subject.call(true, ssl_context)
           subject.verify_errors.should == []
         end
       end
 
       context 'and the chain is valid' do
         it 'is true for each CA certificate in the chain' do
           (cert_chain.length - 1).times do
             subject.call(true, ssl_context).should be_true
           end
         end
 
         it 'is true for the SSL certificate ending the chain' do
           (cert_chain.length - 1).times do
             subject.call(true, ssl_context)
           end
           subject.call(true, ssl_context).should be_true
         end
       end
 
       context 'and the chain is invalid' do
         before :each do
           ssl_configuration.stubs(:read_file).
             with(Puppet[:localcacert]).
             returns(agent_ca)
         end
 
         it 'is true for each CA certificate in the chain' do
           (cert_chain.length - 1).times do
             subject.call(true, ssl_context).should be_true
           end
         end
 
         it 'is false for the SSL certificate ending the chain' do
           (cert_chain.length - 1).times do
             subject.call(true, ssl_context)
           end
           subject.call(true, ssl_context).should be_false
         end
       end
 
       context 'an error is raised inside of #call' do
         before :each do
           ssl_context.expects(:current_cert).raises(StandardError, "BOOM!")
         end
 
         it 'is false' do
           subject.call(true, ssl_context).should be_false
         end
 
         it 'makes the error available through #verify_errors' do
           subject.call(true, ssl_context)
           subject.verify_errors.should == ["BOOM!"]
         end
       end
     end
   end
 
   describe '#setup_connection' do
     it 'updates the connection for verification' do
       subject.stubs(:ssl_certificates_are_present?).returns(true)
       connection = mock('Net::HTTP')
 
       connection.expects(:cert_store=).with(ssl_host.ssl_store)
       connection.expects(:ca_file=).with(ssl_configuration.ca_auth_file)
       connection.expects(:cert=).with(ssl_host.certificate.content)
       connection.expects(:key=).with(ssl_host.key.content)
       connection.expects(:verify_callback=).with(subject)
       connection.expects(:verify_mode=).with(OpenSSL::SSL::VERIFY_PEER)
 
       subject.setup_connection(connection)
     end
 
     it 'does not perform verification if certificate files are missing' do
       subject.stubs(:ssl_certificates_are_present?).returns(false)
       connection = mock('Net::HTTP')
 
       connection.expects(:verify_mode=).with(OpenSSL::SSL::VERIFY_NONE)
 
       subject.setup_connection(connection)
     end
   end
 
   describe '#valid_peer?' do
     before :each do
       peer_certs = cert_chain_in_callback_order.map do |c|
         Puppet::SSL::Certificate.from_instance(c)
       end
       subject.instance_variable_set(:@peer_certs, peer_certs)
     end
 
     context 'when the peer presents a valid chain' do
       before :each do
         subject.stubs(:has_authz_peer_cert).returns(true)
       end
 
       it 'is true' do
         subject.valid_peer?.should be_true
       end
     end
 
     context 'when the peer presents an invalid chain' do
       before :each do
         subject.stubs(:has_authz_peer_cert).returns(false)
       end
 
       it 'is false' do
         subject.valid_peer?.should be_false
       end
 
       it 'makes a helpful error message available via #verify_errors' do
         subject.valid_peer?
         subject.verify_errors.should == [expected_authz_error_msg]
       end
     end
   end
 
   describe '#has_authz_peer_cert' do
     context 'when the Root CA is listed as authorized' do
       it 'returns true when the SSL cert is issued by the Master CA' do
         subject.has_authz_peer_cert(cert_chain, [root_ca_cert]).should be_true
       end
 
       it 'returns true when the SSL cert is issued by the Agent CA' do
         subject.has_authz_peer_cert(cert_chain_agent_ca, [root_ca_cert]).should be_true
       end
     end
 
     context 'when the Master CA is listed as authorized' do
       it 'returns false when the SSL cert is issued by the Master CA' do
         subject.has_authz_peer_cert(cert_chain, [master_ca_cert]).should be_true
       end
 
       it 'returns true when the SSL cert is issued by the Agent CA' do
         subject.has_authz_peer_cert(cert_chain_agent_ca, [master_ca_cert]).should be_false
       end
     end
 
     context 'when the Agent CA is listed as authorized' do
       it 'returns true when the SSL cert is issued by the Master CA' do
         subject.has_authz_peer_cert(cert_chain, [agent_ca_cert]).should be_false
       end
 
       it 'returns true when the SSL cert is issued by the Agent CA' do
         subject.has_authz_peer_cert(cert_chain_agent_ca, [agent_ca_cert]).should be_true
       end
     end
   end
 
   def root_ca
     <<-ROOT_CA
 -----BEGIN CERTIFICATE-----
 MIICYDCCAcmgAwIBAgIJALf2Pk2HvtBzMA0GCSqGSIb3DQEBBQUAMEkxEDAOBgNV
 BAMMB1Jvb3QgQ0ExGjAYBgNVBAsMEVNlcnZlciBPcGVyYXRpb25zMRkwFwYDVQQK
 DBBFeGFtcGxlIE9yZywgTExDMB4XDTEzMDMzMDA1NTA0OFoXDTMzMDMyNTA1NTA0
 OFowSTEQMA4GA1UEAwwHUm9vdCBDQTEaMBgGA1UECwwRU2VydmVyIE9wZXJhdGlv
 bnMxGTAXBgNVBAoMEEV4YW1wbGUgT3JnLCBMTEMwgZ8wDQYJKoZIhvcNAQEBBQAD
 gY0AMIGJAoGBAMGSpafR4lboYOPfPJC1wVHHl0gD49ZVRjOlJ9jidEUjBdFXK6SA
 S1tecDv2G4tM1ANmfMKjZl0m+KaZ8O2oq0g6kxkq1Mg0eSNvlnEyehjmTLRzHC2i
 a0biH2wMtCLzfAoXDKy4GPlciBPE9mup5I8Kien5s91t92tc7K8AJ8oBAgMBAAGj
 UDBOMB0GA1UdDgQWBBQwTdZqjjXOIFK2hOM0bcOrnhQw2jAfBgNVHSMEGDAWgBQw
 TdZqjjXOIFK2hOM0bcOrnhQw2jAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBBQUA
 A4GBACs8EZRrzgzAlcKC1Tz8GYlNHQg0XhpbEDm+p2mOV//PuDD190O+UBpWxo9Q
 rrkkx8En0wXQZJf6iH3hwewwHLOq5yXZKbJN+SmvJvRNL95Yhyy08Y9N65tJveE7
 rPsNU/Tx19jHC87oXlmAePLI4IaUHXrWb7CRbY9TEcPdmj1R
 -----END CERTIFICATE-----
     ROOT_CA
   end
 
   def master_ca
     <<-MASTER_CA
 -----BEGIN CERTIFICATE-----
 MIICljCCAf+gAwIBAgIBAjANBgkqhkiG9w0BAQUFADBJMRAwDgYDVQQDDAdSb290
 IENBMRowGAYDVQQLDBFTZXJ2ZXIgT3BlcmF0aW9uczEZMBcGA1UECgwQRXhhbXBs
 ZSBPcmcsIExMQzAeFw0xMzAzMzAwNTUwNDhaFw0zMzAzMjUwNTUwNDhaMH4xJDAi
 BgNVBAMTG0ludGVybWVkaWF0ZSBDQSAobWFzdGVyLWNhKTEfMB0GCSqGSIb3DQEJ
 ARYQdGVzdEBleGFtcGxlLm9yZzEZMBcGA1UEChMQRXhhbXBsZSBPcmcsIExMQzEa
 MBgGA1UECxMRU2VydmVyIE9wZXJhdGlvbnMwXDANBgkqhkiG9w0BAQEFAANLADBI
 AkEAvo/az3oR69SP92jGnUHMJLEyyD1Ui1BZ/rUABJcQTRQqn3RqtlfYePWZnUaZ
 srKbXRS4q0w5Vqf1kx5w3q5tIwIDAQABo4GcMIGZMHkGA1UdIwRyMHCAFDBN1mqO
 Nc4gUraE4zRtw6ueFDDaoU2kSzBJMRAwDgYDVQQDDAdSb290IENBMRowGAYDVQQL
 DBFTZXJ2ZXIgT3BlcmF0aW9uczEZMBcGA1UECgwQRXhhbXBsZSBPcmcsIExMQ4IJ
 ALf2Pk2HvtBzMA8GA1UdEwEB/wQFMAMBAf8wCwYDVR0PBAQDAgEGMA0GCSqGSIb3
 DQEBBQUAA4GBACRfa1YPS7RQUuhYovGgV0VYqxuATC7WwdIRihVh5FceSXKgSIbz
 BKmOBAy/KixEhpnHTbkpaJ0d9ITkvjMTmj3M5YMahKaQA5niVPckQPecMMd6jg9U
 l1k75xLLIcrlsDYo3999KOSSchH2K7bLT7TuQ2okdP6FHWmeWmudewlu
 -----END CERTIFICATE-----
     MASTER_CA
   end
 
   def agent_ca
     <<-AGENT_CA
 -----BEGIN CERTIFICATE-----
 MIIClTCCAf6gAwIBAgIBATANBgkqhkiG9w0BAQUFADBJMRAwDgYDVQQDDAdSb290
 IENBMRowGAYDVQQLDBFTZXJ2ZXIgT3BlcmF0aW9uczEZMBcGA1UECgwQRXhhbXBs
 ZSBPcmcsIExMQzAeFw0xMzAzMzAwNTUwNDhaFw0zMzAzMjUwNTUwNDhaMH0xIzAh
 BgNVBAMTGkludGVybWVkaWF0ZSBDQSAoYWdlbnQtY2EpMR8wHQYJKoZIhvcNAQkB
 FhB0ZXN0QGV4YW1wbGUub3JnMRkwFwYDVQQKExBFeGFtcGxlIE9yZywgTExDMRow
 GAYDVQQLExFTZXJ2ZXIgT3BlcmF0aW9uczBcMA0GCSqGSIb3DQEBAQUAA0sAMEgC
 QQDkEj/Msmi4hJImxP5+ocixMTHuYC1M1E2p4QcuzOkZYrfHf+5hJMcahfYhLiXU
 jHBredOXhgSisHh6CLSb/rKzAgMBAAGjgZwwgZkweQYDVR0jBHIwcIAUME3Wao41
 ziBStoTjNG3Dq54UMNqhTaRLMEkxEDAOBgNVBAMMB1Jvb3QgQ0ExGjAYBgNVBAsM
 EVNlcnZlciBPcGVyYXRpb25zMRkwFwYDVQQKDBBFeGFtcGxlIE9yZywgTExDggkA
 t/Y+TYe+0HMwDwYDVR0TAQH/BAUwAwEB/zALBgNVHQ8EBAMCAQYwDQYJKoZIhvcN
 AQEFBQADgYEAujSj9rxIxJHEuuYXb15L30yxs9Tdvy4OCLiKdjvs9Z7gG8Pbutls
 ooCwyYAkmzKVs/8cYjZJnvJrPEW1gFwqX7Xknp85Cfrl+/pQEPYq5sZVa5BIm9tI
 0EvlDax/Hd28jI6Bgq5fsTECNl9GDGknCy7vwRZem0h+hI56lzR3pYE=
 -----END CERTIFICATE-----
     AGENT_CA
   end
 
   # Signed by the master CA (Good)
   def master_issued_by_master_ca
 <<-GOOD_SSL_CERT
 -----BEGIN CERTIFICATE-----
 MIICZzCCAhGgAwIBAgIBATANBgkqhkiG9w0BAQUFADB+MSQwIgYDVQQDExtJbnRl
 cm1lZGlhdGUgQ0EgKG1hc3Rlci1jYSkxHzAdBgkqhkiG9w0BCQEWEHRlc3RAZXhh
 bXBsZS5vcmcxGTAXBgNVBAoTEEV4YW1wbGUgT3JnLCBMTEMxGjAYBgNVBAsTEVNl
 cnZlciBPcGVyYXRpb25zMB4XDTEzMDMzMDA1NTA0OFoXDTMzMDMyNTA1NTA0OFow
 HjEcMBoGA1UEAwwTbWFzdGVyMS5leGFtcGxlLm9yZzBcMA0GCSqGSIb3DQEBAQUA
 A0sAMEgCQQDACW8fryVZH0dC7vYUASonVBKYcILnKN2O9QX7RenZGN1TWek9LQxr
 yQFDyp7WJ8jUw6nENGniLU8J+QSSxryjAgMBAAGjgdkwgdYwWwYDVR0jBFQwUqFN
 pEswSTEQMA4GA1UEAwwHUm9vdCBDQTEaMBgGA1UECwwRU2VydmVyIE9wZXJhdGlv
 bnMxGTAXBgNVBAoMEEV4YW1wbGUgT3JnLCBMTEOCAQIwDAYDVR0TAQH/BAIwADAL
 BgNVHQ8EBAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMD0GA1Ud
 EQQ2MDSCE21hc3RlcjEuZXhhbXBsZS5vcmeCB21hc3RlcjGCBnB1cHBldIIMcHVw
 cGV0bWFzdGVyMA0GCSqGSIb3DQEBBQUAA0EAo8PvgLrah6jQVs6YCBxOTn13PDip
 fVbcRsFd0dtIr00N61bCqr6Fa0aRwy424gh6bVJTNmk2zoaH7r025dZRhw==
 -----END CERTIFICATE-----
 GOOD_SSL_CERT
   end
 
   # Signed by the agent CA, not the master CA (Rogue)
   def master_issued_by_agent_ca
 <<-BAD_SSL_CERT
 -----BEGIN CERTIFICATE-----
 MIICZjCCAhCgAwIBAgIBBDANBgkqhkiG9w0BAQUFADB9MSMwIQYDVQQDExpJbnRl
 cm1lZGlhdGUgQ0EgKGFnZW50LWNhKTEfMB0GCSqGSIb3DQEJARYQdGVzdEBleGFt
 cGxlLm9yZzEZMBcGA1UEChMQRXhhbXBsZSBPcmcsIExMQzEaMBgGA1UECxMRU2Vy
 dmVyIE9wZXJhdGlvbnMwHhcNMTMwMzMwMDU1MDQ4WhcNMzMwMzI1MDU1MDQ4WjAe
 MRwwGgYDVQQDDBNtYXN0ZXIxLmV4YW1wbGUub3JnMFwwDQYJKoZIhvcNAQEBBQAD
 SwAwSAJBAPnCDnryLLXWepGLqsdBWlytfeakE/yijM8GlE/yT0SbpJInIhJR1N1A
 0RskriHrxTU5qQEhd0RIja7K5o4NYksCAwEAAaOB2TCB1jBbBgNVHSMEVDBSoU2k
 SzBJMRAwDgYDVQQDDAdSb290IENBMRowGAYDVQQLDBFTZXJ2ZXIgT3BlcmF0aW9u
 czEZMBcGA1UECgwQRXhhbXBsZSBPcmcsIExMQ4IBATAMBgNVHRMBAf8EAjAAMAsG
 A1UdDwQEAwIFoDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwPQYDVR0R
 BDYwNIITbWFzdGVyMS5leGFtcGxlLm9yZ4IHbWFzdGVyMYIGcHVwcGV0ggxwdXBw
 ZXRtYXN0ZXIwDQYJKoZIhvcNAQEFBQADQQA841IzHLlnn4RIJ0/BOZ/16iWC1dNr
 jV9bELC5OxeMNSsVXbFNeTHwbHEYjDg5dQ6eUkxPdBSMWBeQwe2Mw+xG
 -----END CERTIFICATE-----
 BAD_SSL_CERT
   end
 
   def cert_chain
     [ master_issued_by_master_ca, master_ca, root_ca ].map do |pem|
       OpenSSL::X509::Certificate.new(pem)
     end
   end
 
   def cert_chain_agent_ca
     [ master_issued_by_agent_ca, agent_ca, root_ca ].map do |pem|
       OpenSSL::X509::Certificate.new(pem)
     end
   end
 
   def cert_chain_in_callback_order
     cert_chain.reverse
   end
 
   let :authz_error_prefix do
     "The server presented a SSL certificate chain which does not include a CA listed in the ssl_client_ca_auth file.  "
   end
 
   let :expected_authz_error_msg do
     authz_ca_certs = ssl_configuration.ca_auth_certificates
     msg = authz_error_prefix
     msg << "Authorized Issuers: #{authz_ca_certs.collect {|c| c.subject}.join(', ')}  "
     msg << "Peer Chain: #{cert_chain.collect {|c| c.subject}.join(' => ')}"
     msg
   end
 
   let :root_ca_cert do
     OpenSSL::X509::Certificate.new(root_ca)
   end
 
   let :master_ca_cert do
     OpenSSL::X509::Certificate.new(master_ca)
   end
 
   let :agent_ca_cert do
     OpenSSL::X509::Certificate.new(agent_ca)
   end
 end