puppet 0.24.9 → 0.25.0

data/spec/unit/ssl/certificate_authority/interface.rb

@@ -0,0 +1,269 @@
+#!/usr/bin/env ruby
+
+require File.dirname(__FILE__) + '/../../../spec_helper'
+
+require 'puppet/ssl/certificate_authority'
+
+describe "a normal interface method", :shared => true do
+    it "should call the method on the CA for each host specified if an array was provided" do
+        @ca.expects(@method).with("host1")
+        @ca.expects(@method).with("host2")
+
+        @applier = Puppet::SSL::CertificateAuthority::Interface.new(@method, %w{host1 host2})
+
+        @applier.apply(@ca)
+    end
+
+    it "should call the method on the CA for all existing certificates if :all was provided" do
+        @ca.expects(:list).returns %w{host1 host2}
+
+        @ca.expects(@method).with("host1")
+        @ca.expects(@method).with("host2")
+
+        @applier = Puppet::SSL::CertificateAuthority::Interface.new(@method, :all)
+
+        @applier.apply(@ca)
+    end
+end
+
+describe Puppet::SSL::CertificateAuthority::Interface do
+    before do
+        @class = Puppet::SSL::CertificateAuthority::Interface
+    end
+    describe "when initializing" do
+        it "should set its method using its settor" do
+            @class.any_instance.expects(:method=).with(:generate)
+            @class.new(:generate, :all)
+        end
+
+        it "should set its subjects using the settor" do
+            @class.any_instance.expects(:subjects=).with(:all)
+            @class.new(:generate, :all)
+        end
+    end
+
+    describe "when setting the method" do
+        it "should set the method" do
+            @class.new(:generate, :all).method.should == :generate
+        end
+
+        it "should fail if the method isn't a member of the INTERFACE_METHODS array" do
+            Puppet::SSL::CertificateAuthority::Interface::INTERFACE_METHODS.expects(:include?).with(:thing).returns false
+
+            lambda { @class.new(:thing, :all) }.should raise_error(ArgumentError)
+        end
+    end
+
+    describe "when setting the subjects" do
+        it "should set the subjects" do
+            @class.new(:generate, :all).subjects.should == :all
+        end
+
+        it "should fail if the subjects setting isn't :all or an array" do
+            lambda { @class.new(:generate, "other") }.should raise_error(ArgumentError)
+        end
+    end
+
+    it "should have a method for triggering the application" do
+        @class.new(:generate, :all).should respond_to(:apply)
+    end
+
+    describe "when applying" do
+        before do
+            # We use a real object here, because :verify can't be stubbed, apparently.
+            @ca = Object.new
+        end
+
+        it "should raise InterfaceErrors" do
+            @applier = @class.new(:revoke, :all)
+
+            @ca.expects(:list).raises Puppet::SSL::CertificateAuthority::Interface::InterfaceError
+
+            lambda { @applier.apply(@ca) }.should raise_error(Puppet::SSL::CertificateAuthority::Interface::InterfaceError)
+        end
+
+        it "should log non-Interface failures rather than failing" do
+            @applier = @class.new(:revoke, :all)
+
+            @ca.expects(:list).raises ArgumentError
+
+            Puppet.expects(:err)
+
+            lambda { @applier.apply(@ca) }.should_not raise_error
+        end
+
+        describe "with an empty array specified and the method is not list" do
+            it "should fail" do
+                @applier = @class.new(:sign, [])
+                lambda { @applier.apply(@ca) }.should raise_error(ArgumentError)
+            end
+        end
+
+        describe ":generate" do
+            it "should fail if :all was specified" do
+                @applier = @class.new(:generate, :all)
+                lambda { @applier.apply(@ca) }.should raise_error(ArgumentError)
+            end
+
+            it "should call :generate on the CA for each host specified" do
+                @applier = @class.new(:generate, %w{host1 host2})
+
+                @ca.expects(:generate).with("host1")
+                @ca.expects(:generate).with("host2")
+
+                @applier.apply(@ca)
+            end
+        end
+
+        describe ":verify" do
+            before { @method = :verify }
+            #it_should_behave_like "a normal interface method"
+
+            it "should call the method on the CA for each host specified if an array was provided" do
+                # LAK:NOTE Mocha apparently doesn't allow you to mock :verify, but I'm confident this works in real life.
+            end
+
+            it "should call the method on the CA for all existing certificates if :all was provided" do
+                # LAK:NOTE Mocha apparently doesn't allow you to mock :verify, but I'm confident this works in real life.
+            end
+        end
+
+        describe ":destroy" do
+            before { @method = :destroy }
+            it_should_behave_like "a normal interface method"
+        end
+
+        describe ":revoke" do
+            before { @method = :revoke }
+            it_should_behave_like "a normal interface method"
+        end
+
+        describe ":sign" do
+            describe "and an array of names was provided" do
+                before do
+                    @applier = @class.new(:sign, %w{host1 host2})
+                end
+
+                it "should sign the specified waiting certificate requests" do
+                    @ca.expects(:sign).with("host1")
+                    @ca.expects(:sign).with("host2")
+
+                    @applier.apply(@ca)
+                end
+            end
+
+            describe "and :all was provided" do
+                it "should sign all waiting certificate requests" do
+                    @ca.stubs(:waiting?).returns(%w{cert1 cert2})
+
+                    @ca.expects(:sign).with("cert1")
+                    @ca.expects(:sign).with("cert2")
+
+                    @applier = @class.new(:sign, :all)
+                    @applier.apply(@ca)
+                end
+
+                it "should fail if there are no waiting certificate requests" do
+                    @ca.stubs(:waiting?).returns([])
+
+                    @applier = @class.new(:sign, :all)
+                    lambda { @applier.apply(@ca) }.should raise_error(Puppet::SSL::CertificateAuthority::Interface::InterfaceError)
+                end
+            end
+        end
+
+        describe ":list" do
+            describe "and an empty array was provided" do
+                it "should print a string containing all certificate requests" do
+                    @ca.expects(:waiting?).returns %w{host1 host2}
+                    @ca.stubs(:verify)
+
+                    @applier = @class.new(:list, [])
+
+                    @applier.expects(:puts).with "host1\nhost2"
+
+                    @applier.apply(@ca)
+                end
+            end
+
+            describe "and :all was provided" do
+                it "should print a string containing all certificate requests and certificates" do
+                    @ca.expects(:waiting?).returns %w{host1 host2}
+                    @ca.expects(:list).returns %w{host3 host4}
+                    @ca.stubs(:verify)
+                    @ca.expects(:verify).with("host3").raises(Puppet::SSL::CertificateAuthority::CertificateVerificationError.new(23), "certificate revoked")
+
+                    @applier = @class.new(:list, :all)
+
+                    @applier.expects(:puts).with "host1"
+                    @applier.expects(:puts).with "host2"
+                    @applier.expects(:puts).with "- host3 (certificate revoked)"
+                    @applier.expects(:puts).with "+ host4"
+
+                    @applier.apply(@ca)
+                end
+            end
+
+            describe "and an array of names was provided" do
+                it "should print a string of all named hosts that have a waiting request" do
+                    @ca.expects(:waiting?).returns %w{host1 host2}
+                    @ca.expects(:list).returns %w{host3 host4}
+                    @ca.stubs(:verify)
+
+                    @applier = @class.new(:list, %w{host1 host2 host3 host4})
+
+                    @applier.expects(:puts).with "host1"
+                    @applier.expects(:puts).with "host2"
+                    @applier.expects(:puts).with "+ host3"
+                    @applier.expects(:puts).with "+ host4"
+
+                    @applier.apply(@ca)
+                end
+            end
+        end
+
+        describe ":print" do
+            describe "and :all was provided" do
+                it "should print all certificates" do
+                    @ca.expects(:list).returns %w{host1 host2}
+
+                    @applier = @class.new(:print, :all)
+
+                    @ca.expects(:print).with("host1").returns "h1"
+                    @applier.expects(:puts).with "h1"
+
+                    @ca.expects(:print).with("host2").returns "h2"
+                    @applier.expects(:puts).with "h2"
+
+                    @applier.apply(@ca)
+                end
+            end
+
+            describe "and an array of names was provided" do
+                it "should print each named certificate if found" do
+                    @applier = @class.new(:print, %w{host1 host2})
+
+                    @ca.expects(:print).with("host1").returns "h1"
+                    @applier.expects(:puts).with "h1"
+
+                    @ca.expects(:print).with("host2").returns "h2"
+                    @applier.expects(:puts).with "h2"
+
+                    @applier.apply(@ca)
+                end
+
+                it "should log any named but not found certificates" do
+                    @applier = @class.new(:print, %w{host1 host2})
+
+                    @ca.expects(:print).with("host1").returns "h1"
+                    @applier.expects(:puts).with "h1"
+
+                    @ca.expects(:print).with("host2").returns nil
+                    Puppet.expects(:err).with { |msg| msg.include?("host2") }
+
+                    @applier.apply(@ca)
+                end
+            end
+        end
+    end
+end

data/spec/unit/ssl/certificate_factory.rb

@@ -0,0 +1,107 @@
+#!/usr/bin/env ruby
+
+require File.dirname(__FILE__) + '/../../spec_helper'
+
+require 'puppet/ssl/certificate_factory'
+
+describe Puppet::SSL::CertificateFactory do
+    before do
+        @cert_type = mock 'cert_type'
+        @name = mock 'name'
+        @csr = stub 'csr', :subject => @name
+        @issuer = mock 'issuer'
+        @serial = mock 'serial'
+
+        @factory = Puppet::SSL::CertificateFactory.new(@cert_type, @csr, @issuer, @serial)
+    end
+
+    describe "when initializing" do
+        it "should set its :cert_type to its first argument" do
+            @factory.cert_type.should equal(@cert_type)
+        end
+
+        it "should set its :csr to its second argument" do
+            @factory.csr.should equal(@csr)
+        end
+
+        it "should set its :issuer to its third argument" do
+            @factory.issuer.should equal(@issuer)
+        end
+
+        it "should set its :serial to its fourth argument" do
+            @factory.serial.should equal(@serial)
+        end
+
+        it "should set its name to the subject of the csr" do
+            @factory.name.should equal(@name)
+        end
+    end
+
+    describe "when generating the certificate" do
+        before do
+            @cert = mock 'cert'
+
+            @cert.stub_everything
+
+            @factory.stubs :build_extensions
+
+            @factory.stubs :set_ttl
+
+            @issuer_name = mock 'issuer_name'
+            @issuer.stubs(:subject).returns @issuer_name
+
+            @public_key = mock 'public_key'
+            @csr.stubs(:public_key).returns @public_key
+
+            OpenSSL::X509::Certificate.stubs(:new).returns @cert
+        end
+
+        it "should return a new X509 certificate" do
+            OpenSSL::X509::Certificate.expects(:new).returns @cert
+            @factory.result.should equal(@cert)
+        end
+
+        it "should set the certificate's version to 2" do
+            @cert.expects(:version=).with 2
+            @factory.result
+        end
+
+        it "should set the certificate's subject to the CSR's subject" do
+            @cert.expects(:subject=).with @name
+            @factory.result
+        end
+
+        it "should set the certificate's issuer to the Issuer's subject" do
+            @cert.expects(:issuer=).with @issuer_name
+            @factory.result
+        end
+
+        it "should set the certificate's public key to the CSR's public key" do
+            @cert.expects(:public_key=).with @public_key
+            @factory.result
+        end
+
+        it "should set the certificate's serial number to the provided serial number" do
+            @cert.expects(:serial=).with @serial
+            @factory.result
+        end
+
+        it "should build extensions for the certificate" do
+            @factory.expects(:build_extensions)
+            @factory.result
+        end
+
+        it "should set the ttl of the certificate" do
+            @factory.expects(:set_ttl)
+            @factory.result
+        end
+    end
+
+    describe "when building extensions" do
+        it "should have tests"
+    end
+
+    describe "when setting the ttl" do
+        it "should have tests"
+    end
+end

data/spec/unit/ssl/certificate_request.rb

@@ -0,0 +1,193 @@
+#!/usr/bin/env ruby
+
+require File.dirname(__FILE__) + '/../../spec_helper'
+
+require 'puppet/ssl/certificate_request'
+require 'puppet/ssl/key'
+
+describe Puppet::SSL::CertificateRequest do
+    before do
+        @class = Puppet::SSL::CertificateRequest
+    end
+
+    it "should be extended with the Indirector module" do
+        @class.metaclass.should be_include(Puppet::Indirector)
+    end
+
+    it "should indirect certificate_request" do
+        @class.indirection.name.should == :certificate_request
+    end
+
+    it "should use any provided name as its name" do
+        @class.new("myname").name.should == "myname"
+    end
+
+    it "should only support the text format" do
+        @class.supported_formats.should == [:s]
+    end
+
+    describe "when converting from a string" do
+        it "should create a CSR instance with its name set to the CSR subject and its content set to the extracted CSR" do
+            csr = stub 'csr', :subject => "/CN=Foo.madstop.com"
+            OpenSSL::X509::Request.expects(:new).with("my csr").returns(csr)
+
+            mycsr = stub 'sslcsr'
+            mycsr.expects(:content=).with(csr)
+
+            @class.expects(:new).with("foo.madstop.com").returns mycsr
+
+            @class.from_s("my csr")
+        end
+    end
+
+    describe "when managing instances" do
+        before do
+            @request = @class.new("myname")
+        end
+
+        it "should have a name attribute" do
+            @request.name.should == "myname"
+        end
+
+        it "should downcase its name" do
+            @class.new("MyName").name.should == "myname"
+        end
+
+        it "should have a content attribute" do
+            @request.should respond_to(:content)
+        end
+
+        it "should be able to read requests from disk" do
+            path = "/my/path"
+            File.expects(:read).with(path).returns("my request")
+            request = mock 'request'
+            OpenSSL::X509::Request.expects(:new).with("my request").returns(request)
+            @request.read(path).should equal(request)
+            @request.content.should equal(request)
+        end
+
+        it "should return an empty string when converted to a string with no request" do
+            @request.to_s.should == ""
+        end
+
+        it "should convert the request to pem format when converted to a string" do
+            request = mock 'request', :to_pem => "pem"
+            @request.content = request
+            @request.to_s.should == "pem"
+        end
+
+        it "should have a :to_text method that it delegates to the actual key" do
+            real_request = mock 'request'
+            real_request.expects(:to_text).returns "requesttext"
+            @request.content = real_request
+            @request.to_text.should == "requesttext"
+        end
+    end
+
+    describe "when generating" do
+        before do
+            @instance = @class.new("myname")
+
+            key = Puppet::SSL::Key.new("myname")
+            @key = key.generate
+
+            @request = OpenSSL::X509::Request.new
+            OpenSSL::X509::Request.expects(:new).returns(@request)
+
+            @request.stubs(:verify).returns(true)
+        end
+
+        it "should use the content of the provided key if the key is a Puppet::SSL::Key instance" do
+            key = Puppet::SSL::Key.new("test")
+            key.expects(:content).returns @key
+
+            @request.expects(:sign).with{ |key, digest| key == @key }
+            @instance.generate(key)
+        end
+
+        it "should log that it is creating a new certificate request" do
+            Puppet.expects(:info)
+            @instance.generate(@key)
+        end
+
+        it "should set the subject to [CN, name]" do
+            subject = mock 'subject'
+            OpenSSL::X509::Name.expects(:new).with([["CN", @instance.name]]).returns(subject)
+            @request.expects(:subject=).with(subject)
+            @instance.generate(@key)
+        end
+
+        it "should set the version to 0" do
+            @request.expects(:version=).with(0)
+            @instance.generate(@key)
+        end
+
+        it "should set the public key to the provided key's public key" do
+            # Yay, the private key extracts a new key each time.
+            pubkey = @key.public_key
+            @key.stubs(:public_key).returns pubkey
+            @request.expects(:public_key=).with(@key.public_key)
+            @instance.generate(@key)
+        end
+
+        it "should sign the csr with the provided key and a digest" do
+            digest = mock 'digest'
+            OpenSSL::Digest::MD5.expects(:new).returns(digest)
+            @request.expects(:sign).with(@key, digest)
+            @instance.generate(@key)
+        end
+
+        it "should verify the generated request using the public key" do
+            # Stupid keys don't have a competent == method.
+            @request.expects(:verify).with { |public_key| public_key.to_s == @key.public_key.to_s }.returns true
+            @instance.generate(@key)
+        end
+
+        it "should fail if verification fails" do
+            @request.expects(:verify).returns false
+
+            lambda { @instance.generate(@key) }.should raise_error(Puppet::Error)
+        end
+
+        it "should return the generated request" do
+            @instance.generate(@key).should equal(@request)
+        end
+
+        it "should set its content to the generated request" do
+            @instance.generate(@key)
+            @instance.content.should equal(@request)
+        end
+    end
+
+    describe "when a CSR is saved" do
+        it "should allow arguments" do
+            csr = Puppet::SSL::CertificateRequest.new("me")
+            csr.class.indirection.stubs(:save)
+
+            lambda { csr.save :ipaddress => "foo" }.should_not raise_error
+        end
+
+        describe "and a CA is available" do
+            it "should save the CSR and trigger autosigning" do
+                ca = mock 'ca', :autosign
+                Puppet::SSL::CertificateAuthority.expects(:instance).returns ca
+
+                csr = Puppet::SSL::CertificateRequest.new("me")
+                Puppet::SSL::CertificateRequest.indirection.expects(:save).with(csr)
+
+                csr.save
+            end
+        end
+
+        describe "and a CA is not available" do
+            it "should save the CSR" do
+                Puppet::SSL::CertificateAuthority.expects(:instance).returns nil
+
+                csr = Puppet::SSL::CertificateRequest.new("me")
+                Puppet::SSL::CertificateRequest.indirection.expects(:save).with(csr)
+
+                csr.save
+            end
+        end
+    end
+end