diff --git a/lib/puppet/network/authstore.rb b/lib/puppet/network/authstore.rb
index 4ddd14feb..51fd34138 100755
--- a/lib/puppet/network/authstore.rb
+++ b/lib/puppet/network/authstore.rb
@@ -1,250 +1,259 @@
 # standard module for determining whether a given hostname or IP has access to
 # the requested resource
 
 require 'ipaddr'
 require 'puppet/util/logging'
 
 module Puppet
   class AuthStoreError < Puppet::Error; end
   class AuthorizationError < Puppet::Error; end
 
   class Network::AuthStore
     include Puppet::Util::Logging
 
     # Mark a given pattern as allowed.
     def allow(pattern)
       # a simple way to allow anyone at all to connect
       if pattern == "*"
         @globalallow = true
       else
         store(:allow, pattern)
       end
 
       nil
     end
 
     # Is a given combination of name and ip address allowed?  If either input
     # is non-nil, then both inputs must be provided.  If neither input
     # is provided, then the authstore is considered local and defaults to "true".
     def allowed?(name, ip)
       if name or ip
         # This is probably unnecessary, and can cause some weirdnesses in
         # cases where we're operating over localhost but don't have a real
         # IP defined.
         raise Puppet::DevError, "Name and IP must be passed to 'allowed?'" unless name and ip
         # else, we're networked and such
       else
         # we're local
         return true
       end
 
       # yay insecure overrides
       return true if globalallow?
 
       if decl = declarations.find { |d| d.match?(name, ip) }
         return decl.result
       end
 
       info "defaulting to no access for #{name}"
       false
     end
 
     # Deny a given pattern.
     def deny(pattern)
       store(:deny, pattern)
     end
 
     # Is global allow enabled?
     def globalallow?
       @globalallow
     end
 
     # does this auth store has any rules?
     def empty?
       @globalallow.nil? && @declarations.size == 0
     end
 
     def initialize
       @globalallow = nil
       @declarations = []
     end
 
     def to_s
       "authstore"
     end
 
     def interpolate(match)
       Thread.current[:declarations] = @declarations.collect { |ace| ace.interpolate(match) }.sort
     end
 
     def reset_interpolation
       Thread.current[:declarations] = nil
     end
 
     private
 
     # returns our ACEs list, but if we have a modification of it
     # in our current thread, let's return it
     # this is used if we want to override the this purely immutable list
     # by a modified version in a multithread safe way.
     def declarations
       Thread.current[:declarations] || @declarations
     end
 
     # Store the results of a pattern into our hash.  Basically just
     # converts the pattern and sticks it into the hash.
     def store(type, pattern)
       @declarations << Declaration.new(type, pattern)
       @declarations.sort!
 
       nil
     end
 
     # A single declaration.  Stores the info for a given declaration,
     # provides the methods for determining whether a declaration matches,
     # and handles sorting the declarations appropriately.
     class Declaration
       include Puppet::Util
       include Comparable
 
       # The type of declaration: either :allow or :deny
       attr_reader :type
 
       # The name: :ip or :domain
       attr_accessor :name
 
       # The pattern we're matching against.  Can be an IPAddr instance,
       # or an array of strings, resulting from reversing a hostname
       # or domain name.
       attr_reader :pattern
 
       # The length.  Only used for iprange and domain.
       attr_accessor :length
 
       # Sort the declarations most specific first.
       def <=>(other)
         compare(exact?, other.exact?) ||
         compare(ip?, other.ip?)  ||
         ((length != other.length) &&  (other.length <=> length)) ||
         compare(deny?, other.deny?) ||
         ( ip? ? pattern.to_s <=> other.pattern.to_s : pattern <=> other.pattern)
       end
 
       def deny?
         type == :deny
       end
 
       def exact?
         @exact == :exact
       end
 
       def initialize(type, pattern)
         self.type = type
         self.pattern = pattern
       end
 
       # Are we an IP type?
       def ip?
         name == :ip
       end
 
       # Does this declaration match the name/ip combo?
       def match?(name, ip)
         ip? ? pattern.include?(IPAddr.new(ip)) : matchname?(name)
       end
 
       # Set the pattern appropriately.  Also sets the name and length.
       def pattern=(pattern)
         parse(pattern)
         @orig = pattern
       end
 
       # Mapping a type of statement into a return value.
       def result
         type == :allow
       end
 
       def to_s
         "#{type}: #{pattern}"
       end
 
       # Set the declaration type.  Either :allow or :deny.
       def type=(type)
         type = symbolize(type)
         raise ArgumentError, "Invalid declaration type #{type}" unless [:allow, :deny].include?(type)
         @type = type
       end
 
       # interpolate a pattern to replace any
       # backreferences by the given match
       # for instance if our pattern is $1.reductivelabs.com
       # and we're called with a MatchData whose capture 1 is puppet
       # we'll return a pattern of puppet.reductivelabs.com
       def interpolate(match)
         clone = dup
-        clone.pattern = clone.pattern.reverse.collect do |p|
-          p.gsub(/\$(\d)/) { |m| match[$1.to_i] }
-        end.join(".")
+        if @name == :dynamic
+          clone.pattern = clone.pattern.reverse.collect do |p|
+            p.gsub(/\$(\d)/) { |m| match[$1.to_i] }
+          end.join(".")
+        end
         clone
       end
 
       private
 
       # Returns nil if both values are true or both are false, returns
       # -1 if the first is true, and 1 if the second is true.  Used
       # in the <=> operator.
       def compare(me, them)
         (me and them) ? nil : me ? -1 : them ? 1 : nil
       end
 
       # Does the name match our pattern?
       def matchname?(name)
-        name = munge_name(name)
-        (pattern == name) or (not exact? and pattern.zip(name).all? { |p,n| p == n })
+        case @name
+          when :domain, :dynamic, :opaque
+            name = munge_name(name)
+            (pattern == name) or (not exact? and pattern.zip(name).all? { |p,n| p == n })
+          when :regex
+            Regexp.new(pattern.slice(1..-2)).match(name)
+        end
       end
 
       # Convert the name to a common pattern.
       def munge_name(name)
         # LAK:NOTE http://snurl.com/21zf8  [groups_google_com]
         # Change to name.downcase.split(".",-1).reverse for FQDN support
         name.downcase.split(".").reverse
       end
 
       # Parse our input pattern and figure out what kind of allowal
       # statement it is.  The output of this is used for later matching.
       Octet = '(\d|[1-9]\d|1\d\d|2[0-4]\d|25[0-5])'
       IPv4 = "#{Octet}\.#{Octet}\.#{Octet}\.#{Octet}"
       IPv6_full    = "_:_:_:_:_:_:_:_|_:_:_:_:_:_::_?|_:_:_:_:_::((_:)?_)?|_:_:_:_::((_:){0,2}_)?|_:_:_::((_:){0,3}_)?|_:_::((_:){0,4}_)?|_::((_:){0,5}_)?|::((_:){0,6}_)?"
       IPv6_partial = "_:_:_:_:_:_:|_:_:_:_::(_:)?|_:_::(_:){0,2}|_::(_:){0,3}"
       # It should be:
       #     IP = "#{IPv4}|#{IPv6_full}|(#{IPv6_partial}#{IPv4})".gsub(/_/,'([0-9a-fA-F]{1,4})').gsub(/\(/,'(?:')
       # but ruby's ipaddr lib doesn't support the hybrid format
       IP = "#{IPv4}|#{IPv6_full}".gsub(/_/,'([0-9a-fA-F]{1,4})').gsub(/\(/,'(?:')
       def parse(value)
         @name,@exact,@length,@pattern = *case value
         when /^(?:#{IP})\/(\d+)$/                                   # 12.34.56.78/24, a001:b002::efff/120, c444:1000:2000::9:192.168.0.1/112
           [:ip,:inexact,$1.to_i,IPAddr.new(value)]
         when /^(#{IP})$/                                          # 10.20.30.40,
           [:ip,:exact,nil,IPAddr.new(value)]
         when /^(#{Octet}\.){1,3}\*$/                              # an ip address with a '*' at the end
           segments = value.split(".")[0..-2]
           bits = 8*segments.length
           [:ip,:inexact,bits,IPAddr.new((segments+[0,0,0])[0,4].join(".") + "/#{bits}")]
         when /^(\w[-\w]*\.)+[-\w]+$/                              # a full hostname
           # Change to /^(\w[-\w]*\.)+[-\w]+\.?$/ for FQDN support
           [:domain,:exact,nil,munge_name(value)]
         when /^\*(\.(\w[-\w]*)){1,}$/                             # *.domain.com
           host_sans_star = munge_name(value)[0..-2]
           [:domain,:inexact,host_sans_star.length,host_sans_star]
         when /\$\d+/                                              # a backreference pattern ala $1.reductivelabs.com or 192.168.0.$1 or $1.$2
           [:dynamic,:exact,nil,munge_name(value)]
         when /^\w[-.@\w]*$/                                       # ? Just like a host name but allow '@'s and ending '.'s
           [:opaque,:exact,nil,[value]]
+        when /^\/.*\/$/                                           # a regular expression
+          [:regex,:inexact,nil,value]
         else
           raise AuthStoreError, "Invalid pattern #{value}"
         end
       end
     end
   end
 end
 
diff --git a/spec/unit/network/authstore_spec.rb b/spec/unit/network/authstore_spec.rb
index d62c8abaa..d5ff42d6e 100755
--- a/spec/unit/network/authstore_spec.rb
+++ b/spec/unit/network/authstore_spec.rb
@@ -1,369 +1,400 @@
 #!/usr/bin/env rspec
 require 'spec_helper'
 
 require 'puppet/network/authconfig'
 
 describe Puppet::Network::AuthStore do
-  describe "when checking if the acl has some entries" do
-    before :each do
-      @authstore = Puppet::Network::AuthStore.new
-    end
+  before :each do
+    @authstore = Puppet::Network::AuthStore.new
+  end
 
+  describe "when checking if the acl has some entries" do
     it "should be empty if no ACE have been entered" do
       @authstore.should be_empty
     end
 
     it "should not be empty if it is a global allow" do
       @authstore.allow('*')
 
       @authstore.should_not be_empty
     end
 
     it "should not be empty if at least one allow has been entered" do
       @authstore.allow('1.1.1.*')
 
       @authstore.should_not be_empty
     end
 
     it "should not be empty if at least one deny has been entered" do
       @authstore.deny('1.1.1.*')
 
       @authstore.should_not be_empty
     end
   end
+
+  describe "when checking global allow" do
+    it "should not be enabled by default" do
+      @authstore.should_not be_globalallow
+      @authstore.should_not be_allowed('foo.bar.com', '192.168.1.1')
+    end
+
+    it "should always allow when enabled" do
+      @authstore.allow('*')
+
+      @authstore.should be_globalallow
+      @authstore.should be_allowed('foo.bar.com', '192.168.1.1')
+    end
+  end
+
+  describe "when checking a regex type of allow" do
+    before :each do
+      @authstore.allow('/^(test-)?host[0-9]+\.other-domain\.(com|org|net)$|some-domain\.com/')
+      @ip = '192.168.1.1'
+    end
+    ['host5.other-domain.com', 'test-host12.other-domain.net', 'foo.some-domain.com'].each { |name|
+      it "should allow the host #{name}" do
+        @authstore.should be_allowed(name, @ip)
+      end
+    }
+    ['host0.some-other-domain.com',''].each { |name|
+      it "should not allow the host #{name}" do
+        @authstore.should_not be_allowed(name, @ip)
+      end
+    }
+  end
 end
 
 describe Puppet::Network::AuthStore::Declaration do
 
   ['100.101.99.98','100.100.100.100','1.2.3.4','11.22.33.44'].each { |ip|
     describe "when the pattern is a simple numeric IP such as #{ip}" do
       before :each do
         @declaration = Puppet::Network::AuthStore::Declaration.new(:allow,ip)
       end
       it "should match the specified IP" do
         @declaration.should be_match('www.testsite.org',ip)
       end
       it "should not match other IPs" do
         @declaration.should_not be_match('www.testsite.org','200.101.99.98')
       end
     end
 
     (1..3).each { |n|
       describe "when the pattern is a IP mask with #{n} numeric segments and a *" do
         before :each do
           @ip_pattern = ip.split('.')[0,n].join('.')+'.*'
           @declaration = Puppet::Network::AuthStore::Declaration.new(:allow,@ip_pattern)
         end
         it "should match an IP in the range" do
           @declaration.should be_match('www.testsite.org',ip)
         end
         it "should not match other IPs" do
           @declaration.should_not be_match('www.testsite.org','200.101.99.98')
         end
         it "should not match IPs that differ in the last non-wildcard segment" do
           other = ip.split('.')
           other[n-1].succ!
           @declaration.should_not be_match('www.testsite.org',other.join('.'))
         end
       end
     }
   }
 
   describe "when the pattern is a numeric IP with a back reference" do
     before :each do
       @ip = '100.101.$1'
       @declaration = Puppet::Network::AuthStore::Declaration.new(:allow,@ip).interpolate('12.34'.match(/(.*)/))
     end
     it "should match an IP with the appropriate interpolation" do
       @declaration.should be_match('www.testsite.org',@ip.sub(/\$1/,'12.34'))
     end
     it "should not match other IPs" do
       @declaration.should_not be_match('www.testsite.org',@ip.sub(/\$1/,'66.34'))
     end
   end
 
   [
     "02001:0000:1234:0000:0000:C1C0:ABCD:0876",
     "2001:0000:1234:0000:00001:C1C0:ABCD:0876",
     " 2001:0000:1234:0000:0000:C1C0:ABCD:0876  0",
     "2001:0000:1234: 0000:0000:C1C0:ABCD:0876",
     "3ffe:0b00:0000:0001:0000:0000:000a",
     "FF02:0000:0000:0000:0000:0000:0000:0000:0001",
     "3ffe:b00::1::a",
     "1:2:3::4:5::7:8",
     "12345::6:7:8",
     "1::5:400.2.3.4",
     "1::5:260.2.3.4",
     "1::5:256.2.3.4",
     "1::5:1.256.3.4",
     "1::5:1.2.256.4",
     "1::5:1.2.3.256",
     "1::5:300.2.3.4",
     "1::5:1.300.3.4",
     "1::5:1.2.300.4",
     "1::5:1.2.3.300",
     "1::5:900.2.3.4",
     "1::5:1.900.3.4",
     "1::5:1.2.900.4",
     "1::5:1.2.3.900",
     "1::5:300.300.300.300",
     "1::5:3000.30.30.30",
     "1::400.2.3.4",
     "1::260.2.3.4",
     "1::256.2.3.4",
     "1::1.256.3.4",
     "1::1.2.256.4",
     "1::1.2.3.256",
     "1::300.2.3.4",
     "1::1.300.3.4",
     "1::1.2.300.4",
     "1::1.2.3.300",
     "1::900.2.3.4",
     "1::1.900.3.4",
     "1::1.2.900.4",
     "1::1.2.3.900",
     "1::300.300.300.300",
     "1::3000.30.30.30",
     "::400.2.3.4",
     "::260.2.3.4",
     "::256.2.3.4",
     "::1.256.3.4",
     "::1.2.256.4",
     "::1.2.3.256",
     "::300.2.3.4",
     "::1.300.3.4",
     "::1.2.300.4",
     "::1.2.3.300",
     "::900.2.3.4",
     "::1.900.3.4",
     "::1.2.900.4",
     "::1.2.3.900",
     "::300.300.300.300",
     "::3000.30.30.30",
     "2001:DB8:0:0:8:800:200C:417A:221", # unicast, full
     "FF01::101::2" # multicast, compressed
   ].each { |invalid_ip|
     describe "when the pattern is an invalid IPv6 address such as #{invalid_ip}" do
       it "should raise an exception" do
         lambda { Puppet::Network::AuthStore::Declaration.new(:allow,invalid_ip) }.should raise_error
       end
     end
   }
 
   [
     "1.2.3.4",
     "2001:0000:1234:0000:0000:C1C0:ABCD:0876",
     "3ffe:0b00:0000:0000:0001:0000:0000:000a",
     "FF02:0000:0000:0000:0000:0000:0000:0001",
     "0000:0000:0000:0000:0000:0000:0000:0001",
     "0000:0000:0000:0000:0000:0000:0000:0000",
     "::ffff:192.168.1.26",
     "2::10",
     "ff02::1",
     "fe80::",
     "2002::",
     "2001:db8::",
     "2001:0db8:1234::",
     "::ffff:0:0",
     "::1",
     "::ffff:192.168.1.1",
     "1:2:3:4:5:6:7:8",
     "1:2:3:4:5:6::8",
     "1:2:3:4:5::8",
     "1:2:3:4::8",
     "1:2:3::8",
     "1:2::8",
     "1::8",
     "1::2:3:4:5:6:7",
     "1::2:3:4:5:6",
     "1::2:3:4:5",
     "1::2:3:4",
     "1::2:3",
     "1::8",
     "::2:3:4:5:6:7:8",
     "::2:3:4:5:6:7",
     "::2:3:4:5:6",
     "::2:3:4:5",
     "::2:3:4",
     "::2:3",
     "::8",
     "1:2:3:4:5:6::",
     "1:2:3:4:5::",
     "1:2:3:4::",
     "1:2:3::",
     "1:2::",
     "1::",
     "1:2:3:4:5::7:8",
     "1:2:3:4::7:8",
     "1:2:3::7:8",
     "1:2::7:8",
     "1::7:8",
     "1:2:3:4:5:6:1.2.3.4",
     "1:2:3:4:5::1.2.3.4",
     "1:2:3:4::1.2.3.4",
     "1:2:3::1.2.3.4",
     "1:2::1.2.3.4",
     "1::1.2.3.4",
     "1:2:3:4::5:1.2.3.4",
     "1:2:3::5:1.2.3.4",
     "1:2::5:1.2.3.4",
     "1::5:1.2.3.4",
     "1::5:11.22.33.44",
     "fe80::217:f2ff:254.7.237.98",
     "fe80::217:f2ff:fe07:ed62",
     "2001:DB8:0:0:8:800:200C:417A", # unicast, full
     "FF01:0:0:0:0:0:0:101", # multicast, full
     "0:0:0:0:0:0:0:1", # loopback, full
     "0:0:0:0:0:0:0:0", # unspecified, full
     "2001:DB8::8:800:200C:417A", # unicast, compressed
     "FF01::101", # multicast, compressed
     "::1", # loopback, compressed, non-routable
     "::", # unspecified, compressed, non-routable
     "0:0:0:0:0:0:13.1.68.3", # IPv4-compatible IPv6 address, full, deprecated
     "0:0:0:0:0:FFFF:129.144.52.38", # IPv4-mapped IPv6 address, full
     "::13.1.68.3", # IPv4-compatible IPv6 address, compressed, deprecated
     "::FFFF:129.144.52.38", # IPv4-mapped IPv6 address, compressed
     "2001:0DB8:0000:CD30:0000:0000:0000:0000/60", # full, with prefix
     "2001:0DB8::CD30:0:0:0:0/60", # compressed, with prefix
     "2001:0DB8:0:CD30::/60", # compressed, with prefix #2
     "::/128", # compressed, unspecified address type, non-routable
     "::1/128", # compressed, loopback address type, non-routable
     "FF00::/8", # compressed, multicast address type
     "FE80::/10", # compressed, link-local unicast, non-routable
     "FEC0::/10", # compressed, site-local unicast, deprecated
     "127.0.0.1", # standard IPv4, loopback, non-routable
     "0.0.0.0", # standard IPv4, unspecified, non-routable
     "255.255.255.255", # standard IPv4
     "fe80:0000:0000:0000:0204:61ff:fe9d:f156",
     "fe80:0:0:0:204:61ff:fe9d:f156",
     "fe80::204:61ff:fe9d:f156",
     "fe80:0000:0000:0000:0204:61ff:254.157.241.086",
     "fe80:0:0:0:204:61ff:254.157.241.86",
     "fe80::204:61ff:254.157.241.86",
     "::1",
     "fe80::",
     "fe80::1"
   ].each { |ip|
     describe "when the pattern is a valid IP such as #{ip}" do
       before :each do
         @declaration = Puppet::Network::AuthStore::Declaration.new(:allow,ip)
       end
       it "should match the specified IP" do
         @declaration.should be_match('www.testsite.org',ip)
       end
       it "should not match other IPs" do
         @declaration.should_not be_match('www.testsite.org','200.101.99.98')
       end
     end unless ip =~ /:.*\./ # Hybrid IPs aren't supported by ruby's ipaddr
   }
 
   {
   'spirit.mars.nasa.gov' => 'a PQDN',
   'ratchet.2ndsiteinc.com' => 'a PQDN with digits',
   'a.c.ru' => 'a PQDN with short segments',
   }.each {|pqdn,desc|
     describe "when the pattern is #{desc}" do
       before :each do
         @host = pqdn
         @declaration = Puppet::Network::AuthStore::Declaration.new(:allow,@host)
       end
       it "should match the specified PQDN" do
         @declaration.should be_match(@host,'200.101.99.98')
       end
       it "should not match a similar FQDN" do
         pending "FQDN consensus"
         @declaration.should_not be_match(@host+'.','200.101.99.98')
       end
     end
   }
 
   ['abc.12seps.edu.phisher.biz','www.google.com','slashdot.org'].each { |host|
     (1...(host.split('.').length)).each { |n|
       describe "when the pattern is #{"*."+host.split('.')[-n,n].join('.')}" do
         before :each do
           @pattern = "*."+host.split('.')[-n,n].join('.')
           @declaration = Puppet::Network::AuthStore::Declaration.new(:allow,@pattern)
         end
         it "should match #{host}" do
           @declaration.should be_match(host,'1.2.3.4')
         end
         it "should not match www.testsite.gov" do
           @declaration.should_not be_match('www.testsite.gov','200.101.99.98')
         end
         it "should not match hosts that differ in the first non-wildcard segment" do
           other = host.split('.')
           other[-n].succ!
           @declaration.should_not be_match(other.join('.'),'1.2.3.4')
         end
       end
     }
   }
 
   describe "when the pattern is a FQDN" do
     before :each do
       @host = 'spirit.mars.nasa.gov.'
       @declaration = Puppet::Network::AuthStore::Declaration.new(:allow,@host)
     end
     it "should match the specified FQDN" do
       pending "FQDN consensus"
       @declaration.should be_match(@host,'200.101.99.98')
     end
     it "should not match a similar PQDN" do
       @declaration.should_not be_match(@host[0..-2],'200.101.99.98')
     end
   end
 
 
   describe "when the pattern is an opaque string with a back reference" do
     before :each do
       @host = 'c216f41a-f902-4bfb-a222-850dd957bebb'
       @item = "/catalog/#{@host}"
       @pattern = %{^/catalog/([^/]+)$}
       @declaration = Puppet::Network::AuthStore::Declaration.new(:allow,'$1')
     end
     it "should match an IP with the appropriate interpolation" do
       @declaration.interpolate(@item.match(@pattern)).should be_match(@host,'10.0.0.5')
     end
   end
 
   describe "when the pattern is an opaque string with a back reference and the matched data contains dots" do
     before :each do
       @host = 'admin.mgmt.nym1'
       @item = "/catalog/#{@host}"
       @pattern = %{^/catalog/([^/]+)$}
       @declaration = Puppet::Network::AuthStore::Declaration.new(:allow,'$1')
     end
     it "should match a name with the appropriate interpolation" do
       @declaration.interpolate(@item.match(@pattern)).should be_match(@host,'10.0.0.5')
     end
   end
 
   describe "when the pattern is an opaque string with a back reference and the matched data contains dots with an initial prefix that looks like an IP address" do
     before :each do
       @host = '01.admin.mgmt.nym1'
       @item = "/catalog/#{@host}"
       @pattern = %{^/catalog/([^/]+)$}
       @declaration = Puppet::Network::AuthStore::Declaration.new(:allow,'$1')
     end
     it "should match a name with the appropriate interpolation" do
       @declaration.interpolate(@item.match(@pattern)).should be_match(@host,'10.0.0.5')
     end
   end
 
   describe "when comparing patterns" do
     before :each do
       @ip        = Puppet::Network::AuthStore::Declaration.new(:allow,'127.0.0.1')
       @host_name = Puppet::Network::AuthStore::Declaration.new(:allow,'www.hard_knocks.edu')
       @opaque    = Puppet::Network::AuthStore::Declaration.new(:allow,'hey_dude')
     end
     it "should consider ip addresses before host names" do
       (@ip < @host_name).should be_true
     end
     it "should consider ip addresses before opaque strings" do
       (@ip < @opaque).should be_true
     end
     it "should consider host_names before opaque strings" do
       (@host_name < @opaque).should be_true
     end
   end
 end