chef 11.6.2-x86-mingw32 → 11.8.0.rc.1-x86-mingw32

data/spec/unit/http/ssl_policies_spec.rb

@@ -0,0 +1,170 @@
+#--
+# Author:: Daniel DeLeo (<dan@opscode.com>)
+# Copyright:: Copyright (c) 2009, 2010, 2013 Opscode, Inc.
+# License:: Apache License, Version 2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+require 'spec_helper'
+require 'chef/http/ssl_policies'
+
+describe "HTTP SSL Policy" do
+
+  before do
+    Chef::Config[:ssl_client_cert] = nil
+    Chef::Config[:ssl_client_key]  = nil
+    Chef::Config[:ssl_ca_path]     = nil
+    Chef::Config[:ssl_ca_file]     = nil
+  end
+
+  let(:unconfigured_http_client) { Net::HTTP.new("example.com", 443) }
+  let(:http_client) do
+    unconfigured_http_client.use_ssl = true
+    ssl_policy.apply
+    unconfigured_http_client
+  end
+
+  describe Chef::HTTP::DefaultSSLPolicy do
+
+    let(:ssl_policy) { Chef::HTTP::DefaultSSLPolicy.new(unconfigured_http_client) }
+
+    describe "when configured with :ssl_verify_mode set to :verify peer" do
+      before do
+        Chef::Config[:ssl_verify_mode] = :verify_peer
+      end
+
+      it "configures the HTTP client to use SSL when given a URL with the https protocol" do
+        http_client.use_ssl?.should be_true
+      end
+
+      it "sets the OpenSSL verify mode to verify_peer" do
+        http_client.verify_mode.should == OpenSSL::SSL::VERIFY_PEER
+      end
+
+      it "raises a ConfigurationError if :ssl_ca_path is set to a path that doesn't exist" do
+        Chef::Config[:ssl_ca_path] = "/dev/null/nothing_here"
+        lambda {http_client}.should raise_error(Chef::Exceptions::ConfigurationError)
+      end
+
+      it "should set the CA path if that is set in the configuration" do
+        Chef::Config[:ssl_ca_path] = File.join(CHEF_SPEC_DATA, "ssl")
+        http_client.ca_path.should == File.join(CHEF_SPEC_DATA, "ssl")
+      end
+
+      it "raises a ConfigurationError if :ssl_ca_file is set to a file that does not exist" do
+        Chef::Config[:ssl_ca_file] = "/dev/null/nothing_here"
+        lambda {http_client}.should raise_error(Chef::Exceptions::ConfigurationError)
+      end
+
+      it "should set the CA file if that is set in the configuration" do
+        Chef::Config[:ssl_ca_file] = CHEF_SPEC_DATA + '/ssl/5e707473.0'
+        http_client.ca_file.should == CHEF_SPEC_DATA + '/ssl/5e707473.0'
+      end
+    end
+
+    describe "when configured with :ssl_verify_mode set to :verify peer" do
+      before do
+        @url = URI.parse("https://chef.example.com:4443/")
+        Chef::Config[:ssl_verify_mode] = :verify_none
+      end
+
+      it "sets the OpenSSL verify mode to :verify_none" do
+        http_client.verify_mode.should == OpenSSL::SSL::VERIFY_NONE
+      end
+    end
+
+    describe "when configured with a client certificate" do
+      before {@url = URI.parse("https://chef.example.com:4443/")}
+
+      it "raises ConfigurationError if the certificate file doesn't exist" do
+        Chef::Config[:ssl_client_cert] = "/dev/null/nothing_here"
+        Chef::Config[:ssl_client_key]  = CHEF_SPEC_DATA + '/ssl/chef-rspec.key'
+        lambda {http_client}.should raise_error(Chef::Exceptions::ConfigurationError)
+      end
+
+      it "raises ConfigurationError if the certificate file doesn't exist" do
+        Chef::Config[:ssl_client_cert] = CHEF_SPEC_DATA + '/ssl/chef-rspec.cert'
+        Chef::Config[:ssl_client_key]  = "/dev/null/nothing_here"
+        lambda {http_client}.should raise_error(Chef::Exceptions::ConfigurationError)
+      end
+
+      it "raises a ConfigurationError if one of :ssl_client_cert and :ssl_client_key is set but not both" do
+        Chef::Config[:ssl_client_cert] = "/dev/null/nothing_here"
+        Chef::Config[:ssl_client_key]  = nil
+        lambda {http_client}.should raise_error(Chef::Exceptions::ConfigurationError)
+      end
+
+      it "configures the HTTP client's cert and private key" do
+        Chef::Config[:ssl_client_cert] = CHEF_SPEC_DATA + '/ssl/chef-rspec.cert'
+        Chef::Config[:ssl_client_key]  = CHEF_SPEC_DATA + '/ssl/chef-rspec.key'
+        http_client.cert.to_s.should == OpenSSL::X509::Certificate.new(IO.read(CHEF_SPEC_DATA + '/ssl/chef-rspec.cert')).to_s
+        http_client.key.to_s.should  == IO.read(CHEF_SPEC_DATA + '/ssl/chef-rspec.key')
+      end
+    end
+
+    context "when additional certs are located in the trusted_certs dir" do
+      let(:self_signed_crt_path) { File.join(CHEF_SPEC_DATA, "trusted_certs", "example.crt") }
+      let(:self_signed_crt) { OpenSSL::X509::Certificate.new(File.read(self_signed_crt_path)) }
+
+      let(:additional_pem_path) { File.join(CHEF_SPEC_DATA, "trusted_certs", "opscode.pem") }
+      let(:additional_pem) { OpenSSL::X509::Certificate.new(File.read(additional_pem_path)) }
+
+      before do
+        Chef::Config.trusted_certs_dir = File.join(CHEF_SPEC_DATA, "trusted_certs")
+      end
+
+      it "enables verification of self-signed certificates" do
+        http_client.cert_store.verify(self_signed_crt).should be_true
+      end
+
+      it "enables verification of cert chains" do
+        # This cert is signed by DigiCert so it would be valid in normal SSL usage.
+        # The chain goes:
+        # trusted root -> intermediate -> opscode.pem
+        # In this test, the intermediate has to be loaded and trusted in order
+        # for verification to work correctly.
+        # If the machine running the test doesn't have ruby SSL configured correctly,
+        # then the root cert also has to be loaded for the test to succeed.
+        # The system under test **SHOULD** do both of these things.
+        http_client.cert_store.verify(additional_pem).should be_true
+      end
+
+      context "and some certs are duplicates" do
+        it "skips duplicate certs" do
+          # For whatever reason, OpenSSL errors out when adding a
+          # cert you already have to the certificate store.
+          ssl_policy.set_custom_certs
+          ssl_policy.set_custom_certs #should not raise an error
+        end
+      end
+    end
+  end
+
+  describe Chef::HTTP::APISSLPolicy do
+
+    let(:ssl_policy) { Chef::HTTP::APISSLPolicy.new(unconfigured_http_client) }
+
+    context "when verify_api_cert is set" do
+      before do
+        Chef::Config[:verify_api_cert] = true
+      end
+
+      it "sets the OpenSSL verify mode to verify_peer" do
+        http_client.verify_mode.should == OpenSSL::SSL::VERIFY_PEER
+      end
+    end
+
+  end
+end
+

data/spec/unit/knife/bootstrap_spec.rb

@@ -22,16 +22,6 @@ Chef::Knife::Bootstrap.load_deps
 require 'net/ssh'
 
 describe Chef::Knife::Bootstrap do
-  before(:all) do
-    @original_config = Chef::Config.hash_dup
-    @original_knife_config = Chef::Config[:knife].dup
-  end
-
-  after(:all) do
-    Chef::Config.configuration = @original_config
-    Chef::Config[:knife] = @original_knife_config
-  end
-
   before(:each) do
     Chef::Log.logger = Logger.new(StringIO.new)
     @knife = Chef::Knife::Bootstrap.new
@@ -133,6 +123,34 @@ describe Chef::Knife::Bootstrap do
     @knife.name_args.first.should == "barf"
   end
 
+  describe "specifying no_proxy with various entries" do
+    subject(:knife) { described_class.new }
+    let(:options){ ["--bootstrap-no-proxy", setting] }
+    let(:template_file) { File.expand_path(File.join(CHEF_SPEC_DATA, "bootstrap", "no_proxy.erb")) }
+    let(:rendered_template) do
+      knife.instance_variable_set("@template_file", template_file)
+      knife.parse_options(options)
+      template_string = knife.read_template
+      knife.render_template(template_string)
+    end
+
+    context "via --bootstrap-no-proxy" do
+      let(:setting) { "api.opscode.com" }
+
+      it "renders the client.rb with a single FQDN no_proxy entry" do
+        rendered_template.should match(%r{.*no_proxy\s*"api.opscode.com".*})
+      end
+    end
+
+    context "via --bootstrap-no-proxy multiple" do
+      let(:setting) { "api.opscode.com,172.16.10.*" }
+
+      it "renders the client.rb with comma-separated FQDN and wildcard IP address no_proxy entries" do
+        rendered_template.should match(%r{.*no_proxy\s*"api.opscode.com,172.16.10.\*".*})
+      end
+    end
+  end
+
   describe "specifying the encrypted data bag secret key" do
     subject(:knife) { described_class.new }
     let(:secret) { "supersekret" }
@@ -182,7 +200,6 @@ describe Chef::Knife::Bootstrap do
       it "renders the client.rb with an encrypted_data_bag_secret entry" do
         rendered_template.should match(%r{encrypted_data_bag_secret\s*"/etc/chef/encrypted_data_bag_secret"})
       end
-      after(:each) { Chef::Config.configuration = @original_config }
     end
   end
 
@@ -216,7 +233,7 @@ describe Chef::Knife::Bootstrap do
       it "configures the ssh port" do
         @knife_ssh.config[:ssh_port].should == '4001'
       end
-  
+
       it "configures the ssh agent forwarding" do
         @knife_ssh.config[:forward_agent].should == true
       end
@@ -241,7 +258,7 @@ describe Chef::Knife::Bootstrap do
       it "uses the password from --ssh-password for sudo when --use-sudo-password is set" do
         @knife.config[:use_sudo] = true
         @knife.config[:use_sudo_password] = true
-        @knife.ssh_command.should include("echo #{@knife.config[:ssh_password]} | sudo -S")
+        @knife.ssh_command.should include("echo \'#{@knife.config[:ssh_password]}\' | sudo -S")
       end
 
       it "should not honor --use-sudo-password when --use-sudo is not set" do
@@ -276,7 +293,7 @@ describe Chef::Knife::Bootstrap do
       it "configures the ssh port" do
         @knife_ssh.config[:ssh_port].should == '2430'
       end
-  
+
       it "configures the ssh agent forwarding" do
         @knife_ssh.config[:forward_agent].should == true
       end

data/spec/unit/knife/client_bulk_delete_spec.rb

@@ -6,9 +6,9 @@
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
 # You may obtain a copy of the License at
-# 
+#
 #     http://www.apache.org/licenses/LICENSE-2.0
-# 
+#
 # Unless required by applicable law or agreed to in writing, software
 # distributed under the License is distributed on an "AS IS" BASIS,
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
@@ -37,31 +37,31 @@ describe Chef::Knife::ClientBulkDelete do
     end
     Chef::ApiClient.stub!(:list).and_return(@clients)
   end
-  
+
   describe "run" do
-    
+
     it "should get the list of the clients" do
       Chef::ApiClient.should_receive(:list).and_return(@clients)
       @knife.run
     end
-    
+
     it "should print the clients you are about to delete" do
       @knife.run
       @stdout.string.should match(/#{@knife.ui.list(@clients.keys.sort, :columns_down)}/)
     end
-    
+
     it "should confirm you really want to delete them" do
       @knife.ui.should_receive(:confirm)
       @knife.run
     end
-    
+
     it "should delete each client" do
       @clients.each_value do |c|
         c.should_receive(:destroy)
       end
       @knife.run
     end
-    
+
     it "should only delete clients that match the regex" do
       @knife.name_args = ["tim"]
       @clients["tim"].should_receive(:destroy)

data/spec/unit/knife/client_create_spec.rb

@@ -6,9 +6,9 @@
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
 # You may obtain a copy of the License at
-# 
+#
 #     http://www.apache.org/licenses/LICENSE-2.0
-# 
+#
 # Unless required by applicable law or agreed to in writing, software
 # distributed under the License is distributed on an "AS IS" BASIS,
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

data/spec/unit/knife/client_delete_spec.rb

@@ -6,9 +6,9 @@
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
 # You may obtain a copy of the License at
-# 
+#
 #     http://www.apache.org/licenses/LICENSE-2.0
-# 
+#
 # Unless required by applicable law or agreed to in writing, software
 # distributed under the License is distributed on an "AS IS" BASIS,
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

data/spec/unit/knife/client_edit_spec.rb

@@ -6,9 +6,9 @@
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
 # You may obtain a copy of the License at
-# 
+#
 #     http://www.apache.org/licenses/LICENSE-2.0
-# 
+#
 # Unless required by applicable law or agreed to in writing, software
 # distributed under the License is distributed on an "AS IS" BASIS,
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

data/spec/unit/knife/client_list_spec.rb

@@ -6,9 +6,9 @@
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
 # You may obtain a copy of the License at
-# 
+#
 #     http://www.apache.org/licenses/LICENSE-2.0
-# 
+#
 # Unless required by applicable law or agreed to in writing, software
 # distributed under the License is distributed on an "AS IS" BASIS,
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

data/spec/unit/knife/client_reregister_spec.rb

@@ -6,9 +6,9 @@
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
 # You may obtain a copy of the License at
-# 
+#
 #     http://www.apache.org/licenses/LICENSE-2.0
-# 
+#
 # Unless required by applicable law or agreed to in writing, software
 # distributed under the License is distributed on an "AS IS" BASIS,
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

data/spec/unit/knife/client_show_spec.rb

@@ -6,9 +6,9 @@
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
 # You may obtain a copy of the License at
-# 
+#
 #     http://www.apache.org/licenses/LICENSE-2.0
-# 
+#
 # Unless required by applicable law or agreed to in writing, software
 # distributed under the License is distributed on an "AS IS" BASIS,
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

data/spec/unit/knife/config_file_selection_spec.rb

@@ -6,9 +6,9 @@
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
 # You may obtain a copy of the License at
-# 
+#
 #     http://www.apache.org/licenses/LICENSE-2.0
-# 
+#
 # Unless required by applicable law or agreed to in writing, software
 # distributed under the License is distributed on an "AS IS" BASIS,
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
@@ -20,14 +20,38 @@ require File.expand_path(File.dirname(__FILE__) + '/../../spec_helper')
 require 'tmpdir'
 
 describe Chef::Knife do
+
+  let(:missing_config_fetcher) do
+    double(Chef::ConfigFetcher, :config_missing? => true)
+  end
+
+  let(:available_config_fetcher) do
+    double(Chef::ConfigFetcher, :config_missing? => false,
+                                :read_config => "")
+  end
+
+  def have_config_file(path)
+    Chef::ConfigFetcher.should_receive(:new).at_least(1).times.with(path, nil).and_return(available_config_fetcher)
+  end
+
+  before do
+    # Make sure tests can run when HOME is not set...
+    @original_home = ENV["HOME"]
+    ENV["HOME"] = Dir.tmpdir
+  end
+
+  after do
+    ENV["HOME"] = @original_home
+  end
+
   before :each do
     Chef::Config.stub!(:from_file).and_return(true)
+    Chef::ConfigFetcher.stub(:new).and_return(missing_config_fetcher)
   end
 
   it "configure knife from KNIFE_HOME env variable" do
     env_config = File.expand_path(File.join(Dir.tmpdir, 'knife.rb'))
-    File.stub!(:exist?).and_return(false)
-    File.stub!(:exist?).with(env_config).and_return(true)
+    have_config_file(env_config)
 
     ENV['KNIFE_HOME'] = Dir.tmpdir
     @knife = Chef::Knife.new
@@ -37,39 +61,33 @@ describe Chef::Knife do
 
    it "configure knife from PWD" do
     pwd_config = "#{Dir.pwd}/knife.rb"
-    File.stub!(:exist?).and_return do | arg |
-      [ pwd_config ].include? arg
-    end
+    have_config_file(pwd_config)
 
     @knife = Chef::Knife.new
     @knife.configure_chef
     @knife.config[:config_file].should == pwd_config
   end
-  
+
   it "configure knife from UPWARD" do
     upward_dir = File.expand_path "#{Dir.pwd}/.chef"
     upward_config = File.expand_path "#{upward_dir}/knife.rb"
-    File.stub!(:exist?).and_return do | arg |
-      [ upward_config ].include? arg
-    end
+    have_config_file(upward_config)
     Chef::Knife.stub!(:chef_config_dir).and_return(upward_dir)
-    
+
     @knife = Chef::Knife.new
     @knife.configure_chef
     @knife.config[:config_file].should == upward_config
   end
-  
+
   it "configure knife from HOME" do
     home_config = File.expand_path(File.join("#{ENV['HOME']}", "/.chef/knife.rb"))
-    File.stub!(:exist?).and_return do | arg |
-      [ home_config ].include? arg
-    end
-    
+    have_config_file(home_config)
+
     @knife = Chef::Knife.new
     @knife.configure_chef
     @knife.config[:config_file].should == home_config
   end
-  
+
   it "configure knife from nothing" do
     ::File.stub!(:exist?).and_return(false)
     @knife = Chef::Knife.new
@@ -77,7 +95,7 @@ describe Chef::Knife do
     @knife.configure_chef
     @knife.config[:config_file].should be_nil
   end
-  
+
   it "configure knife precedence" do
     env_config = File.join(Dir.tmpdir, 'knife.rb')
     pwd_config = "#{Dir.pwd}/knife.rb"
@@ -85,34 +103,33 @@ describe Chef::Knife do
     upward_config = File.expand_path "#{upward_dir}/knife.rb"
     home_config = File.expand_path(File.join("#{ENV['HOME']}", "/.chef/knife.rb"))
     configs = [ env_config, pwd_config, upward_config, home_config ]
-    File.stub!(:exist?).and_return do | arg |
-      configs.include? arg
-    end
+
     Chef::Knife.stub!(:chef_config_dir).and_return(upward_dir)
     ENV['KNIFE_HOME'] = Dir.tmpdir
-   
+
     @knife = Chef::Knife.new
+
     @knife.configure_chef
-    @knife.config[:config_file].should == env_config
-    
-    configs.delete env_config
-    @knife.config.delete :config_file
+    @knife.config[:config_file].should be_nil
+
+    have_config_file(home_config)
+    @knife = Chef::Knife.new
     @knife.configure_chef
-    @knife.config[:config_file].should == pwd_config
+    @knife.config[:config_file].should == home_config
 
-    configs.delete pwd_config
-    @knife.config.delete :config_file
+    have_config_file(upward_config)
+    @knife = Chef::Knife.new
     @knife.configure_chef
     @knife.config[:config_file].should == upward_config
 
-    configs.delete upward_config
-    @knife.config.delete :config_file
+    have_config_file(pwd_config)
+    @knife = Chef::Knife.new
     @knife.configure_chef
-    @knife.config[:config_file].should == home_config
+    @knife.config[:config_file].should == pwd_config
 
-    configs.delete home_config
-    @knife.config.delete :config_file
+    have_config_file(env_config)
+    @knife = Chef::Knife.new
     @knife.configure_chef
-    @knife.config[:config_file].should be_nil
+    @knife.config[:config_file].should == env_config
   end
 end