puppet 0.25.5 → 2.6.0

data/test/network/authconfig.rb

@@ -7,65 +7,63 @@ require 'puppettest'
 require 'puppet/network/authconfig'
 
 class TestAuthConfig < Test::Unit::TestCase
-    include PuppetTest
+  include PuppetTest
 
-    def request(call, client, ip)
-        r = Puppet::Network::ClientRequest.new(client, ip, false)
-        h, m = call.split(".")
-        r.handler = h
-        r.method = m
-        r
-    end
+  def request(call, client, ip)
+    r = Puppet::Network::ClientRequest.new(client, ip, false)
+    h, m = call.split(".")
+    r.handler = h
+    r.method = m
+    r
+  end
 
-    def test_parsingconfigfile
-        file = tempfile()
-        assert(Puppet[:authconfig], "No config path")
+  def test_parsingconfigfile
+    file = tempfile
+    assert(Puppet[:authconfig], "No config path")
 
-        Puppet[:authconfig] = file
+    Puppet[:authconfig] = file
 
-        File.open(file, "w") { |f|
-            f.puts "[pelementserver.describe]
-    allow *.madstop.com
-    deny 10.10.1.1
+    File.open(file, "w") { |f|
+      f.puts "[pelementserver.describe]
+  allow *.madstop.com
+  deny 10.10.1.1
 
 [fileserver]
-    allow *.madstop.com
-    deny 10.10.1.1
+  allow *.madstop.com
+  deny 10.10.1.1
 
 [fileserver.list]
-    allow 10.10.1.1
+  allow 10.10.1.1
 "
-        }
-
-        config = nil
-        assert_nothing_raised {
-            config = Puppet::Network::AuthConfig.new(file)
-        }
-
-        assert_nothing_raised {
-            assert(config.allowed?(request("pelementserver.describe",
-                "culain.madstop.com", "1.1.1.1")), "Did not allow host")
-            assert(! config.allowed?(request("pelementserver.describe",
-                "culain.madstop.com", "10.10.1.1")), "Allowed host")
-            assert(config.allowed?(request("fileserver.yay",
-                "culain.madstop.com", "10.1.1.1")), "Did not allow host to fs")
-            assert(! config.allowed?(request("fileserver.yay",
-                "culain.madstop.com", "10.10.1.1")), "Allowed host to fs")
-            assert(config.allowed?(request("fileserver.list",
-                "culain.madstop.com", "10.10.1.1")), "Did not allow host to fs.list")
-        }
-    end
-
-    def test_singleton
-        auth = nil
-        assert_nothing_raised { auth = Puppet::Network::AuthConfig.main }
-        assert(auth, "did not get main authconfig")
-
-        other = nil
-        assert_nothing_raised { other = Puppet::Network::AuthConfig.main }
-        assert_equal(auth.object_id, other.object_id,
-            "did not get same authconfig from class")
-    end
+    }
+
+    config = nil
+    assert_nothing_raised {
+      config = Puppet::Network::AuthConfig.new(file)
+    }
+
+    assert_nothing_raised {
+      assert(config.allowed?(request("pelementserver.describe", "culain.madstop.com", "1.1.1.1")), "Did not allow host")
+      assert(! config.allowed?(request("pelementserver.describe", "culain.madstop.com", "10.10.1.1")), "Allowed host")
+      assert(config.allowed?(request("fileserver.yay", "culain.madstop.com", "10.1.1.1")), "Did not allow host to fs")
+      assert(! config.allowed?(request("fileserver.yay", "culain.madstop.com", "10.10.1.1")), "Allowed host to fs")
+      assert(config.allowed?(request("fileserver.list", "culain.madstop.com", "10.10.1.1")), "Did not allow host to fs.list")
+    }
+  end
+
+  def test_singleton
+    auth = nil
+    assert_nothing_raised { auth = Puppet::Network::AuthConfig.main }
+    assert(auth, "did not get main authconfig")
+
+    other = nil
+    assert_nothing_raised { other = Puppet::Network::AuthConfig.main }
+
+          assert_equal(
+        auth.object_id, other.object_id,
+        
+      "did not get same authconfig from class")
+  end
 end
 
 

data/test/network/authorization.rb

@@ -7,131 +7,132 @@ require 'puppet/network/authorization'
 require 'mocha'
 
 class TestAuthConfig < Test::Unit::TestCase
-    include PuppetTest
-
-    # A mock class for authconfig
-    class FakeAuth
-        class << self
-            attr_accessor :allow, :exists
-        end
-        def allowed?(req)
-            self.class.allow
-        end
-        def exists?
-            self.class.exists
-        end
-    end
-
-    class AuthTest
-        include Puppet::Network::Authorization
-
-        def clear
-            @loaded.clear
-        end
+  include PuppetTest
 
-        def load(name)
-            @loaded ||= []
-            @loaded << name
-        end
-
-        def handler_loaded?(name)
-            @loaded ||= []
-            @loaded.include?(name)
-        end
+  # A mock class for authconfig
+  class FakeAuth
+    class << self
+      attr_accessor :allow, :exists
+    end
+    def allowed?(req)
+      self.class.allow
+    end
+    def exists?
+      self.class.exists
     end
+  end
 
-    def setup
-        super
-        @obj = AuthTest.new
-
-        # Override the authconfig to make life easier
-        class << @obj
-            def authconfig
-                @authconfig ||= FakeAuth.new
-                @authconfig
-            end
-        end
-        @request = Puppet::Network::ClientRequest.new("host", "ip", false)
-        @request.handler = "foo"
-        @request.method = "bar"
+  class AuthTest
+    include Puppet::Network::Authorization
+
+    def clear
+      @loaded.clear
     end
 
-    def test_authconfig
-        obj = AuthTest.new
-        auth = nil
-        assert_nothing_raised { auth = obj.send(:authconfig) }
-        assert(auth, "did not get auth")
-        assert_equal(Puppet::Network::AuthConfig.main.object_id, auth.object_id,
-            "did not get main authconfig")
+    def load(name)
+      @loaded ||= []
+      @loaded << name
     end
 
-    def test_authorize
-        # Make sure that unauthenticated clients can do puppetca stuff, but
-        # nothing else.
-        @request.handler = "puppetca"
-        @request.method = "yay"
-        assert(@obj.authorized?(@request), "Did not allow unauthenticated ca call")
-        assert_logged(:notice, /Allowing/, "did not log call")
-        @request.handler = "other"
-        assert(! @obj.authorized?(@request), "Allowed unauthencated other call")
-        assert_logged(:notice, /Denying/, "did not log call")
-
-        @request.authenticated = true
-        # We start without the namespace auth file, so everything should
-        # start out denied
-        assert(! @obj.authorized?(@request), "Allowed call with no config file")
-        assert_logged(:notice, /Denying/, "did not log call")
-
-        # Now set our name to the master, so calls are allowed
-        Puppet[:name] = "puppetmasterd"
-        assert(@obj.authorized?(@request),
-            "Denied call with no config file and master")
-        assert_logged(:debug, /Allowing/, "did not log call")
-
-        # Now "create" the file, so we do real tests
-        FakeAuth.exists = true
-
-        # We start out denying
-        assert(! @obj.authorized?(@request), "Allowed call when denying")
-        assert_logged(:notice, /Denying/, "did not log call")
-
-        FakeAuth.allow = true
-        assert(@obj.authorized?(@request), "Denied call when allowing")
-        assert_logged(:debug, /Allowing/, "did not log call")
+    def handler_loaded?(name)
+      @loaded ||= []
+      @loaded.include?(name)
     end
+  end
 
-    def test_available?
-        # Start out false
-        assert(! @obj.available?(@request), "Defaulted to true")
-        assert_logged(:warning, /requested unavailable/, "did not log call")
+  def setup
+    super
+    @obj = AuthTest.new
 
-        @obj.load(@request.handler)
-        assert(@obj.available?(@request), "did not see it loaded")
+    # Override the authconfig to make life easier
+    class << @obj
+      def authconfig
+        @authconfig ||= FakeAuth.new
+      end
     end
-
-    # Make sure we raise things appropriately
-    def test_verify
-        # Start out unavailabl
-        assert_raise(Puppet::Network::InvalidClientRequest) do
-            @obj.verify(@request)
-        end
-        class << @obj
-            def available?(req)
-                true
-            end
-        end
-        assert_raise(Puppet::Network::InvalidClientRequest) do
-            @obj.verify(@request)
-        end
-        class << @obj
-            def authorized?(req)
-                true
-            end
-        end
-        assert_nothing_raised do
-            @obj.verify(@request)
-        end
+    @request = Puppet::Network::ClientRequest.new("host", "ip", false)
+    @request.handler = "foo"
+    @request.method = "bar"
+  end
+
+  def test_authconfig
+    obj = AuthTest.new
+    auth = nil
+    assert_nothing_raised { auth = obj.send(:authconfig) }
+    assert(auth, "did not get auth")
+    assert_equal(Puppet::Network::AuthConfig.main.object_id, auth.object_id, "did not get main authconfig")
+  end
+
+  def test_authorize
+    # Make sure that unauthenticated clients can do puppetca stuff, but
+    # nothing else.
+    @request.handler = "puppetca"
+    @request.method = "yay"
+    assert(@obj.authorized?(@request), "Did not allow unauthenticated ca call")
+    assert_logged(:notice, /Allowing/, "did not log call")
+    @request.handler = "other"
+    assert(! @obj.authorized?(@request), "Allowed unauthencated other call")
+    assert_logged(:notice, /Denying/, "did not log call")
+
+    @request.authenticated = true
+    # We start without the namespace auth file, so everything should
+    # start out denied
+    assert(! @obj.authorized?(@request), "Allowed call with no config file")
+    assert_logged(:notice, /Denying/, "did not log call")
+
+    # Now set our run_mode to master, so calls are allowed
+    Puppet.run_mode.stubs(:master?).returns true
+
+          assert(
+        @obj.authorized?(@request),
+        
+      "Denied call with no config file and master")
+    assert_logged(:debug, /Allowing/, "did not log call")
+
+    # Now "create" the file, so we do real tests
+    FakeAuth.exists = true
+
+    # We start out denying
+    assert(! @obj.authorized?(@request), "Allowed call when denying")
+    assert_logged(:notice, /Denying/, "did not log call")
+
+    FakeAuth.allow = true
+    assert(@obj.authorized?(@request), "Denied call when allowing")
+    assert_logged(:debug, /Allowing/, "did not log call")
+  end
+
+  def test_available?
+    # Start out false
+    assert(! @obj.available?(@request), "Defaulted to true")
+    assert_logged(:warning, /requested unavailable/, "did not log call")
+
+    @obj.load(@request.handler)
+    assert(@obj.available?(@request), "did not see it loaded")
+  end
+
+  # Make sure we raise things appropriately
+  def test_verify
+    # Start out unavailabl
+    assert_raise(Puppet::Network::InvalidClientRequest) do
+      @obj.verify(@request)
+    end
+    class << @obj
+      def available?(req)
+        true
+      end
+    end
+    assert_raise(Puppet::Network::InvalidClientRequest) do
+      @obj.verify(@request)
+    end
+    class << @obj
+      def authorized?(req)
+        true
+      end
+    end
+    assert_nothing_raised do
+      @obj.verify(@request)
     end
+  end
 end
 
 

data/test/network/authstore.rb

@@ -7,486 +7,534 @@ require 'mocha'
 require 'puppet/network/authstore'
 
 class TestAuthStore < Test::Unit::TestCase
-    include PuppetTest
-    Declaration = Puppet::Network::AuthStore::Declaration
-    def mkstore
-        store = nil
-        assert_nothing_raised {
-            store = Puppet::Network::AuthStore.new
-        }
-
-        return store
+  include PuppetTest
+  Declaration = Puppet::Network::AuthStore::Declaration
+  def mkstore
+    store = nil
+    assert_nothing_raised {
+      store = Puppet::Network::AuthStore.new
+    }
+
+    store
+  end
+
+  def setup
+    super
+    @store = mkstore
+  end
+
+  def test_localallow
+    Puppet[:trace] = false
+    assert_nothing_raised {
+      assert(@store.allowed?(nil, nil), "Store disallowed local access")
+    }
+
+    assert_raise(Puppet::DevError) {
+      @store.allowed?("kirby.madstop.com", nil)
+    }
+
+    assert_raise(Puppet::DevError) {
+      @store.allowed?(nil, "192.168.0.1")
+    }
+  end
+
+  def test_simpleips
+    %w{
+      192.168.0.5
+      7.0.48.7
+    }.each { |ip|
+      assert_nothing_raised("Failed to @store IP address #{ip}") {
+        @store.allow(ip)
+      }
+
+      assert(@store.allowed?("hosttest.com", ip), "IP #{ip} not allowed")
+    }
+
+    #assert_raise(Puppet::AuthStoreError) {
+    #    @store.allow("192.168.674.0")
+    #}
+  end
+
+  def test_ipranges
+    %w{
+      192.168.0.*
+      192.168.1.0/24
+      192.178.*
+      193.179.0.0/8
+    }.each { |range|
+      assert_nothing_raised("Failed to @store IP range #{range}") {
+        @store.allow(range)
+      }
+    }
+
+    %w{
+      192.168.0.1
+      192.168.1.5
+      192.178.0.5
+      193.0.0.1
+    }.each { |ip|
+      assert(@store.allowed?("fakename.com", ip), "IP #{ip} is not allowed")
+    }
+  end
+
+  def test_iprangedenials
+    assert_nothing_raised("Failed to @store overlapping IP ranges") {
+      @store.allow("192.168.0.0/16")
+      @store.deny("192.168.0.0/24")
+    }
+
+    assert(@store.allowed?("fake.name", "192.168.1.50"), "/16 ip not allowed")
+    assert(! @store.allowed?("fake.name", "192.168.0.50"), "/24 ip allowed")
+  end
+
+  def test_subdomaindenails
+    assert_nothing_raised("Failed to @store overlapping IP ranges") {
+      @store.allow("*.madstop.com")
+      @store.deny("*.sub.madstop.com")
+    }
+
+
+      assert(
+        @store.allowed?("hostname.madstop.com", "192.168.1.50"),
+
+      "hostname not allowed")
+
+        assert(
+          ! @store.allowed?("name.sub.madstop.com", "192.168.0.50"),
+
+      "subname name allowed")
+  end
+
+  def test_orderingstuff
+    assert_nothing_raised("Failed to @store overlapping IP ranges") {
+      @store.allow("*.madstop.com")
+      @store.deny("192.168.0.0/24")
+    }
+
+
+      assert(
+        @store.allowed?("hostname.madstop.com", "192.168.1.50"),
+
+      "hostname not allowed")
+
+        assert(
+          ! @store.allowed?("hostname.madstop.com", "192.168.0.50"),
+
+      "Host allowed over IP")
+  end
+
+  def test_globalallow
+    assert_nothing_raised("Failed to add global allow") {
+      @store.allow("*")
+    }
+
+    [
+      %w{hostname.com 192.168.0.4},
+      %w{localhost 192.168.0.1},
+      %w{localhost 127.0.0.1}
+
+    ].each { |ary|
+      assert(@store.allowed?(*ary), "Failed to allow #{ary.join(",")}")
+    }
+  end
+
+  def test_store
+    assert_nothing_raised do
+
+      assert_nil(
+        @store.send(:store, :allow, "*.host.com"),
+
+        "store did not return nil")
     end
+    assert_equal([Declaration.new(:allow, "*.host.com")],
+      @store.send(:instance_variable_get, "@declarations"),
+      "Did not store declaration")
 
-    def setup
-        super
-        @store = mkstore
-    end
-
-    def test_localallow
-        Puppet[:trace] = false
-        assert_nothing_raised {
-            assert(@store.allowed?(nil, nil), "Store disallowed local access")
-        }
+    # Now add another one and make sure it gets sorted appropriately
+    assert_nothing_raised do
 
-        assert_raise(Puppet::DevError) {
-            @store.allowed?("kirby.madstop.com", nil)
-        }
+      assert_nil(
+        @store.send(:store, :allow, "me.host.com"),
 
-        assert_raise(Puppet::DevError) {
-            @store.allowed?(nil, "192.168.0.1")
-        }
+        "store did not return nil")
     end
 
-    def test_simpleips
-        %w{
-            192.168.0.5
-            7.0.48.7
-        }.each { |ip|
-            assert_nothing_raised("Failed to @store IP address %s" % ip) {
-                @store.allow(ip)
-            }
-
-            assert(@store.allowed?("hosttest.com", ip), "IP %s not allowed" % ip)
-        }
-
-        #assert_raise(Puppet::AuthStoreError) {
-        #    @store.allow("192.168.674.0")
-        #}
-    end
 
-    def test_ipranges
-        %w{
-            192.168.0.*
-            192.168.1.0/24
-            192.178.*
-            193.179.0.0/8
-        }.each { |range|
-            assert_nothing_raised("Failed to @store IP range %s" % range) {
-                @store.allow(range)
-            }
-        }
-
-        %w{
-            192.168.0.1
-            192.168.1.5
-            192.178.0.5
-            193.0.0.1
-        }.each { |ip|
-            assert(@store.allowed?("fakename.com", ip), "IP %s is not allowed" % ip)
-        }
-    end
+      assert_equal(
+        [
+          Declaration.new(:allow, "me.host.com"),
 
-    def test_iprangedenials
-        assert_nothing_raised("Failed to @store overlapping IP ranges") {
-            @store.allow("192.168.0.0/16")
-            @store.deny("192.168.0.0/24")
-        }
+          Declaration.new(:allow, "*.host.com")
+    ],
+      @store.send(:instance_variable_get, "@declarations"),
+      "Did not sort declarations")
+  end
 
-        assert(@store.allowed?("fake.name", "192.168.1.50"), "/16 ip not allowed")
-        assert(! @store.allowed?("fake.name", "192.168.0.50"), "/24 ip allowed")
-    end
+  def test_allow_and_deny
+    store = Puppet::Network::AuthStore.new
+    store.expects(:store).with(:allow, "host.com")
+    store.allow("host.com")
+
+    store = Puppet::Network::AuthStore.new
+    store.expects(:store).with(:deny, "host.com")
+    store.deny("host.com")
 
-    def test_subdomaindenails
-        assert_nothing_raised("Failed to @store overlapping IP ranges") {
-            @store.allow("*.madstop.com")
-            @store.deny("*.sub.madstop.com")
-        }
+    store = Puppet::Network::AuthStore.new
+    assert_nothing_raised do
 
-        assert(@store.allowed?("hostname.madstop.com", "192.168.1.50"),
-            "hostname not allowed")
-        assert(! @store.allowed?("name.sub.madstop.com", "192.168.0.50"),
-            "subname name allowed")
+      assert_nil(
+        store.allow("*"),
+
+        "allow did not return nil")
     end
 
-    def test_orderingstuff
-        assert_nothing_raised("Failed to @store overlapping IP ranges") {
-            @store.allow("*.madstop.com")
-            @store.deny("192.168.0.0/24")
-        }
 
-        assert(@store.allowed?("hostname.madstop.com", "192.168.1.50"),
-            "hostname not allowed")
-        assert(! @store.allowed?("hostname.madstop.com", "192.168.0.50"),
-            "Host allowed over IP")
+      assert(
+        store.globalallow?,
+
+      "did not enable global allow")
+  end
+
+  def test_hostnames
+    Puppet[:trace] = false
+    %w{
+      kirby.madstop.com
+      luke.madstop.net
+      name-other.madstop.net
+    }.each { |name|
+      assert_nothing_raised("Failed to @store simple name #{name}") {
+        @store.allow(name)
+      }
+      assert(@store.allowed?(name, "192.168.0.1"), "Name #{name} not allowed")
+    }
+
+    %w{
+      ^invalid!
+      inval$id
+
+    }.each { |pat|
+
+      assert_raise(
+        Puppet::AuthStoreError,
+
+        "name '#{pat}' was allowed") {
+        @store.allow(pat)
+      }
+    }
+  end
+
+  def test_domains
+    assert_nothing_raised("Failed to @store domains") {
+      @store.allow("*.a.very.long.domain.name.com")
+      @store.allow("*.madstop.com")
+      @store.allow("*.some-other.net")
+      @store.allow("*.much.longer.more-other.net")
+    }
+
+    %w{
+      madstop.com
+      culain.madstop.com
+      kirby.madstop.com
+      funtest.some-other.net
+      ya-test.madstop.com
+      some.much.much.longer.more-other.net
+    }.each { |name|
+      assert(@store.allowed?(name, "192.168.0.1"), "Host #{name} not allowed")
+    }
+
+    assert_raise(Puppet::AuthStoreError) {
+      @store.allow("domain.*.com")
+    }
+
+
+      assert(
+        !@store.allowed?("very.long.domain.name.com", "1.2.3.4"),
+
+      "Long hostname allowed")
+
+    assert_raise(Puppet::AuthStoreError) {
+      @store.allow("domain.*.other.com")
+    }
+  end
+
+  # #531
+  def test_case_insensitivity
+    @store.allow("hostname.com")
+
+    %w{hostname.com Hostname.COM hostname.Com HOSTNAME.COM}.each do |name|
+      assert(@store.allowed?(name, "127.0.0.1"), "did not allow #{name}")
     end
+  end
 
-    def test_globalallow
-        assert_nothing_raised("Failed to add global allow") {
-            @store.allow("*")
-        }
+  def test_allowed?
+    Puppet[:trace] = false
 
-        [
-            %w{hostname.com 192.168.0.4},
-            %w{localhost 192.168.0.1},
-            %w{localhost 127.0.0.1}
+      assert(
+        @store.allowed?(nil, nil),
 
-        ].each { |ary|
-            assert(@store.allowed?(*ary), "Failed to allow %s" % [ary.join(",")])
-        }
+      "Did not default to true for local checks")
+    assert_raise(Puppet::DevError, "did not fail on one input") do
+      @store.allowed?("host.com", nil)
     end
-
-    def test_store
-        assert_nothing_raised do
-            assert_nil(@store.send(:store, :allow, "*.host.com"),
-                "store did not return nil")
-        end
-        assert_equal([Declaration.new(:allow, "*.host.com")],
-                     @store.send(:instance_variable_get, "@declarations"),
-            "Did not store declaration")
-
-        # Now add another one and make sure it gets sorted appropriately
-        assert_nothing_raised do
-            assert_nil(@store.send(:store, :allow, "me.host.com"),
-                "store did not return nil")
-        end
-
-        assert_equal([
-                     Declaration.new(:allow, "me.host.com"),
-                     Declaration.new(:allow, "*.host.com")
-        ],
-            @store.send(:instance_variable_get, "@declarations"),
-            "Did not sort declarations")
+    assert_raise(Puppet::DevError, "did not fail on one input") do
+      @store.allowed?(nil, "192.168.0.1")
     end
 
-    def test_allow_and_deny
-        store = Puppet::Network::AuthStore.new
-        store.expects(:store).with(:allow, "host.com")
-        store.allow("host.com")
+  end
 
-        store = Puppet::Network::AuthStore.new
-        store.expects(:store).with(:deny, "host.com")
-        store.deny("host.com")
+  # Make sure more specific allows and denies win over generalities
+  def test_specific_overrides
+    @store.allow("host.madstop.com")
+    @store.deny("*.madstop.com")
 
-        store = Puppet::Network::AuthStore.new
-        assert_nothing_raised do
-            assert_nil(store.allow("*"),
-                "allow did not return nil")
-        end
 
-        assert(store.globalallow?,
-            "did not enable global allow")
-    end
+      assert(
+        @store.allowed?("host.madstop.com", "192.168.0.1"),
 
-    def test_hostnames
-        Puppet[:trace] = false
-        %w{
-            kirby.madstop.com
-            luke.madstop.net
-            name-other.madstop.net
-        }.each { |name|
-            assert_nothing_raised("Failed to @store simple name %s" % name) {
-                @store.allow(name)
-            }
-            assert(@store.allowed?(name, "192.168.0.1"), "Name %s not allowed" % name)
-        }
-
-        %w{
-            ^invalid!
-            inval$id
-
-        }.each { |pat|
-            assert_raise(Puppet::AuthStoreError,
-                "name '%s' was allowed" % pat) {
-                @store.allow(pat)
-            }
-        }
-    end
+      "More specific allowal by name failed")
 
-    def test_domains
-        assert_nothing_raised("Failed to @store domains") {
-            @store.allow("*.a.very.long.domain.name.com")
-            @store.allow("*.madstop.com")
-            @store.allow("*.some-other.net")
-            @store.allow("*.much.longer.more-other.net")
-        }
-
-        %w{
-            madstop.com
-            culain.madstop.com
-            kirby.madstop.com
-            funtest.some-other.net
-            ya-test.madstop.com
-            some.much.much.longer.more-other.net
-        }.each { |name|
-            assert(@store.allowed?(name, "192.168.0.1"), "Host %s not allowed" % name)
-        }
-
-        assert_raise(Puppet::AuthStoreError) {
-            @store.allow("domain.*.com")
-        }
-
-        assert(!@store.allowed?("very.long.domain.name.com", "1.2.3.4"),
-            "Long hostname allowed")
-
-        assert_raise(Puppet::AuthStoreError) {
-            @store.allow("domain.*.other.com")
-        }
-    end
+    @store.allow("192.168.0.1")
+    @store.deny("192.168.0.0/24")
 
-    # #531
-    def test_case_insensitivity
-        @store.allow("hostname.com")
 
-        %w{hostname.com Hostname.COM hostname.Com HOSTNAME.COM}.each do |name|
-            assert(@store.allowed?(name, "127.0.0.1"),
-                "did not allow %s" % name)
-        end
-    end
+      assert(
+        @store.allowed?("host.madstop.com", "192.168.0.1"),
 
-    def test_allowed?
-        Puppet[:trace] = false
-        assert(@store.allowed?(nil, nil),
-            "Did not default to true for local checks")
-        assert_raise(Puppet::DevError, "did not fail on one input") do
-            @store.allowed?("host.com", nil)
-        end
-        assert_raise(Puppet::DevError, "did not fail on one input") do
-            @store.allowed?(nil, "192.168.0.1")
-        end
+      "More specific allowal by ip failed")
+  end
 
-    end
+  def test_dynamic_backreferences
+    @store.allow("$1.madstop.com")
 
-    # Make sure more specific allows and denies win over generalities
-    def test_specific_overrides
-        @store.allow("host.madstop.com")
-        @store.deny("*.madstop.com")
+    assert_nothing_raised { @store.interpolate([nil, "host"]) }
+    assert(@store.allowed?("host.madstop.com", "192.168.0.1"), "interpolation failed")
+    assert_nothing_raised { @store.reset_interpolation }
+  end
 
-        assert(@store.allowed?("host.madstop.com", "192.168.0.1"),
-            "More specific allowal by name failed")
+  def test_dynamic_ip
+    @store.allow("192.168.0.$1")
 
-        @store.allow("192.168.0.1")
-        @store.deny("192.168.0.0/24")
+    assert_nothing_raised { @store.interpolate([nil, "12"]) }
+    assert(@store.allowed?("host.madstop.com", "192.168.0.12"), "interpolation failed")
+    assert_nothing_raised { @store.reset_interpolation }
+  end
 
-        assert(@store.allowed?("host.madstop.com", "192.168.0.1"),
-            "More specific allowal by ip failed")
-    end
+  def test_multiple_dynamic_backreferences
+    @store.allow("$1.$2")
 
-    def test_dynamic_backreferences
-        @store.allow("$1.madstop.com")
+    assert_nothing_raised { @store.interpolate([nil, "host", "madstop.com"]) }
+    assert(@store.allowed?("host.madstop.com", "192.168.0.1"), "interpolation failed")
+    assert_nothing_raised { @store.reset_interpolation }
+  end
 
-        assert_nothing_raised { @store.interpolate([nil, "host"]) }
-        assert(@store.allowed?("host.madstop.com", "192.168.0.1"), "interpolation failed")
-        assert_nothing_raised { @store.reset_interpolation }
-    end
+  def test_multithreaded_allow_with_dynamic_backreferences
+    @store.allow("$1.madstop.com")
 
-    def test_dynamic_ip
-        @store.allow("192.168.0.$1")
+    threads = []
+    9.times { |a|
+      threads << Thread.new {
+        9.times { |b|
+        Thread.pass
+        @store.interpolate([nil, "a#{b}", "madstop.com"])
+        Thread.pass
+        assert( @store.allowed?("a#{b}.madstop.com", "192.168.0.1") )
+        Thread.pass
+        @store.reset_interpolation
+        Thread.pass
+      }
+      }
+    }
+    threads.each { |th| th.join }
+  end
 
-        assert_nothing_raised { @store.interpolate([nil, "12"]) }
-        assert(@store.allowed?("host.madstop.com", "192.168.0.12"), "interpolation failed")
-        assert_nothing_raised { @store.reset_interpolation }
+end
+
+class TestAuthStoreDeclaration < PuppetTest::TestCase
+  include PuppetTest
+  Declaration = Puppet::Network::AuthStore::Declaration
+
+  def setup
+    super
+    @decl = Declaration.new(:allow, "hostname.com")
+  end
+
+  def test_parse
+    {
+      "192.168.0.1" =>        [:ip, IPAddr.new("192.168.0.1"), nil],
+      "2001:700:300:1800::" => [:ip, IPAddr.new("2001:700:300:1800::"), nil],
+      "2001:700:300:1800::/64" => [:ip, IPAddr.new("2001:700:300:1800::/64"), 64],
+      "192.168.0.1/32" =>     [:ip, IPAddr.new("192.168.0.1/32"), 32],
+      "192.168.0.1/24" =>     [:ip, IPAddr.new("192.168.0.1/24"), 24],
+      "192.*" =>              [:ip, IPAddr.new("192.0.0.0/8"), 8],
+      "192.168.*" =>          [:ip, IPAddr.new("192.168.0.0/16"), 16],
+      "192.168.0.*" =>        [:ip, IPAddr.new("192.168.0.0/24"), 24],
+      "hostname.com" =>       [:domain, %w{com hostname}, nil],
+      "Hostname.COM" =>       [:domain, %w{com hostname}, nil],
+      "billy.Hostname.COM" => [:domain, %w{com hostname billy}, nil],
+      "billy-jean.Hostname.COM" => [:domain, %w{com hostname billy-jean}, nil],
+      "*.hostname.COM" => [:domain, %w{com hostname}, 2],
+      "*.hostname.COM" => [:domain, %w{com hostname}, 2],
+      "$1.hostname.COM" => [:dynamic, %w{com hostname $1}, nil],
+      "192.168.$1.$2" => [:dynamic, %w{$2 $1 168 192}, nil],
+      "8A5BC90C-B8FD-4CBC-81DA-BAD84D551791" => [:opaque, %w{8A5BC90C-B8FD-4CBC-81DA-BAD84D551791}, nil]
+    }.each do |input, output|
+
+      # Create a new decl each time, so values aren't cached.
+      assert_nothing_raised do
+        @decl = Declaration.new(:allow, input)
+      end
+
+      [:name, :pattern, :length].zip(output).each do |method, value|
+        assert_equal(value, @decl.send(method), "Got incorrect value for #{method} from #{input}")
+      end
     end
 
-    def test_multiple_dynamic_backreferences
-        @store.allow("$1.$2")
+    %w{-hostname.com hostname.*}.each do |input|
+      assert_raise(Puppet::AuthStoreError, "Did not fail on #{input}") do
+        @decl.pattern = input
+      end
+    end
 
-        assert_nothing_raised { @store.interpolate([nil, "host", "madstop.com"]) }
-        assert(@store.allowed?("host.madstop.com", "192.168.0.1"), "interpolation failed")
-        assert_nothing_raised { @store.reset_interpolation }
+    ["hostname .com", "192.168 .0.1"].each do |input|
+      assert_raise(Puppet::AuthStoreError, "Did not fail on #{input}") do
+        @decl.pattern = input
+      end
     end
+  end
 
-    def test_multithreaded_allow_with_dynamic_backreferences
-        @store.allow("$1.madstop.com")
-
-        threads = []
-        9.times { |a|
-            threads << Thread.new {
-                9.times { |b|
-                Thread.pass
-                @store.interpolate([nil, "a#{b}", "madstop.com"])
-                Thread.pass
-                assert( @store.allowed?("a#{b}.madstop.com", "192.168.0.1") )
-                Thread.pass
-                @store.reset_interpolation
-                Thread.pass
-            }
-            }
-        }
-        threads.each { |th| th.join }
+  def test_result
+    ["allow", :allow].each do |val|
+      assert_nothing_raised { @decl.type = val }
+      assert_equal(true, @decl.result, "did not result to true with #{val.inspect}")
     end
 
-end
+    [:deny, "deny"].each do |val|
+      assert_nothing_raised { @decl.type = val }
 
-class TestAuthStoreDeclaration < PuppetTest::TestCase
-    include PuppetTest
-    Declaration = Puppet::Network::AuthStore::Declaration
+        assert_equal(
+          false, @decl.result,
 
-    def setup
-        super
-        @decl = Declaration.new(:allow, "hostname.com")
+          "did not result to false with #{val.inspect}")
     end
 
-    def test_parse
-        {
-            "192.168.0.1" =>        [:ip, IPAddr.new("192.168.0.1"), nil],
-            "2001:700:300:1800::" => [:ip, IPAddr.new("2001:700:300:1800::"), nil],
-            "2001:700:300:1800::/64" => [:ip, IPAddr.new("2001:700:300:1800::/64"), 64],
-            "192.168.0.1/32" =>     [:ip, IPAddr.new("192.168.0.1/32"), 32],
-            "192.168.0.1/24" =>     [:ip, IPAddr.new("192.168.0.1/24"), 24],
-            "192.*" =>              [:ip, IPAddr.new("192.0.0.0/8"), 8],
-            "192.168.*" =>          [:ip, IPAddr.new("192.168.0.0/16"), 16],
-            "192.168.0.*" =>        [:ip, IPAddr.new("192.168.0.0/24"), 24],
-            "hostname.com" =>       [:domain, %w{com hostname}, nil],
-            "Hostname.COM" =>       [:domain, %w{com hostname}, nil],
-            "billy.Hostname.COM" => [:domain, %w{com hostname billy}, nil],
-            "billy-jean.Hostname.COM" => [:domain, %w{com hostname billy-jean}, nil],
-            "*.hostname.COM" => [:domain, %w{com hostname}, 2],
-            "*.hostname.COM" => [:domain, %w{com hostname}, 2],
-            "$1.hostname.COM" => [:dynamic, %w{com hostname $1}, nil],
-            "192.168.$1.$2" => [:dynamic, %w{$2 $1 168 192}, nil],
-            "8A5BC90C-B8FD-4CBC-81DA-BAD84D551791" => [:opaque, %w{8A5BC90C-B8FD-4CBC-81DA-BAD84D551791}, nil]
-        }.each do |input, output|
-
-            # Create a new decl each time, so values aren't cached.
-            assert_nothing_raised do
-                @decl = Declaration.new(:allow, input)
-            end
-
-            [:name, :pattern, :length].zip(output).each do |method, value|
-                assert_equal(value, @decl.send(method),
-                    "Got incorrect value for %s from %s" % [method, input])
-            end
-        end
-
-        %w{-hostname.com hostname.*}.each do |input|
-            assert_raise(Puppet::AuthStoreError, "Did not fail on %s" % input) do
-                @decl.pattern = input
-            end
-        end
-
-        ["hostname .com", "192.168 .0.1"].each do |input|
-            assert_raise(Puppet::AuthStoreError, "Did not fail on %s" % input) do
-                @decl.pattern = input
-            end
-        end
+    ["yay", 1, nil, false, true].each do |val|
+      assert_raise(ArgumentError, "Did not fail on #{val.inspect}") do
+        @decl.type = val
+      end
     end
-
-    def test_result
-        ["allow", :allow].each do |val|
-            assert_nothing_raised { @decl.type = val }
-            assert_equal(true, @decl.result, "did not result to true with %s" %
-                val.inspect)
-        end
-
-        [:deny, "deny"].each do |val|
-            assert_nothing_raised { @decl.type = val }
-            assert_equal(false, @decl.result,
-                "did not result to false with %s" % val.inspect)
-        end
-
-        ["yay", 1, nil, false, true].each do |val|
-            assert_raise(ArgumentError, "Did not fail on %s" % val.inspect) do
-                @decl.type = val
-            end
-        end
+  end
+
+  def test_munge_name
+    {
+      "hostname.com" => %w{com hostname},
+      "alley.hostname.com" => %w{com hostname alley},
+      "*.hostname.com" => %w{com hostname *},
+      "*.HOSTNAME.Com" => %w{com hostname *},
+      "*.HOSTNAME.Com" => %w{com hostname *},
+
+    }.each do |input, output|
+      assert_equal(output, @decl.send(:munge_name, input), "munged #{input} incorrectly")
     end
+  end
 
-    def test_munge_name
-        {
-            "hostname.com" => %w{com hostname},
-            "alley.hostname.com" => %w{com hostname alley},
-            "*.hostname.com" => %w{com hostname *},
-            "*.HOSTNAME.Com" => %w{com hostname *},
-            "*.HOSTNAME.Com" => %w{com hostname *},
-
-        }.each do |input, output|
-            assert_equal(output, @decl.send(:munge_name, input),
-                "munged %s incorrectly" % input)
-        end
-    end
+  # Make sure people can specify TLDs
+  def test_match_tlds
+    assert_nothing_raised {
+      @decl.pattern = "*.tld"
+    }
 
-    # Make sure people can specify TLDs
-    def test_match_tlds
-        assert_nothing_raised {
-            @decl.pattern = "*.tld"
-        }
+    assert_equal(%w{tld}, @decl.pattern, "Failed to allow custom tld")
+  end
 
-        assert_equal(%w{tld}, @decl.pattern, "Failed to allow custom tld")
-    end
+  # Make sure we sort correctly.
+  def test_sorting
+    # Make sure declarations with no length sort first.
+    host_exact = Declaration.new(:allow, "host.com")
+    host_range = Declaration.new(:allow, "*.host.com")
 
-    # Make sure we sort correctly.
-    def test_sorting
-        # Make sure declarations with no length sort first.
-        host_exact = Declaration.new(:allow, "host.com")
-        host_range = Declaration.new(:allow, "*.host.com")
+    ip_exact = Declaration.new(:allow, "192.168.0.1")
+    ip_range = Declaration.new(:allow, "192.168.0.*")
 
-        ip_exact = Declaration.new(:allow, "192.168.0.1")
-        ip_range = Declaration.new(:allow, "192.168.0.*")
 
-        assert_equal(-1, host_exact <=> host_range,
-            "exact name match did not sort first")
+      assert_equal(
+        -1, host_exact <=> host_range,
 
-        assert_equal(-1, ip_exact <=> ip_range,
-            "exact ip match did not sort first")
+      "exact name match did not sort first")
 
-        # Next make sure we sort by length
-        ip_long = Declaration.new(:allow, "192.168.*")
-        assert_equal(-1, ip_range <=> ip_long, "/16 sorted before /24 in ip")
 
-        # Now try it using masks
-        ip24 = Declaration.new(:allow, "192.168.0.0/24")
-        ip16 = Declaration.new(:allow, "192.168.0.0/16")
+        assert_equal(
+          -1, ip_exact <=> ip_range,
 
-        assert_equal(-1, ip24 <=> ip16, "/16 sorted before /24 in ip with masks")
+      "exact ip match did not sort first")
 
-        # Make sure ip checks sort before host checks
-        assert_equal(-1, ip_exact <=> host_exact,
-            "IP exact did not sort before host exact")
+    # Next make sure we sort by length
+    ip_long = Declaration.new(:allow, "192.168.*")
+    assert_equal(-1, ip_range <=> ip_long, "/16 sorted before /24 in ip")
 
-        assert_equal(-1, ip_range <=> host_range,
-            "IP range did not sort before host range")
+    # Now try it using masks
+    ip24 = Declaration.new(:allow, "192.168.0.0/24")
+    ip16 = Declaration.new(:allow, "192.168.0.0/16")
 
-        host_long = Declaration.new(:allow, "*.domain.host.com")
+    assert_equal(-1, ip24 <=> ip16, "/16 sorted before /24 in ip with masks")
 
-        assert_equal(-1, host_long <=> host_range, "did not sort by domain length")
+    # Make sure ip checks sort before host checks
+    assert_equal(-1, ip_exact <=> host_exact, "IP exact did not sort before host exact")
 
-        # Now make sure denies sort before allows, for equivalent
-        # declarations.
-        host_deny = Declaration.new(:deny, "host.com")
-        assert_equal(-1, host_deny <=> host_exact, "deny did not sort before allow when exact")
 
-        host_range_deny = Declaration.new(:deny, "*.host.com")
-        assert_equal(-1, host_range_deny <=> host_range,
-            "deny did not sort before allow when ranged")
+      assert_equal(
+        -1, ip_range <=> host_range,
 
-        ip_allow = Declaration.new(:allow, "192.168.0.0/16")
-        ip_deny = Declaration.new(:deny, "192.168.0.0/16")
+      "IP range did not sort before host range")
 
-        assert_equal(-1, ip_deny <=> ip_allow,
-            "deny did not sort before allow in ip range")
+    host_long = Declaration.new(:allow, "*.domain.host.com")
 
-        %w{host.com *.domain.com 192.168.0.1 192.168.0.1/24}.each do |decl|
-            assert_equal(0, Declaration.new(:allow, decl) <=>
-                Declaration.new(:allow, decl),
-                "Equivalent declarations for %s were considered different" %
-                decl
-            )
-        end
-    end
+    assert_equal(-1, host_long <=> host_range, "did not sort by domain length")
 
-    def test_match?
-        host = Declaration.new(:allow, "host.com")
-        host.expects(:matchname?).with("host.com")
-        host.match?("host.com", "192.168.0.1")
+    # Now make sure denies sort before allows, for equivalent
+    # declarations.
+    host_deny = Declaration.new(:deny, "host.com")
+    assert_equal(-1, host_deny <=> host_exact, "deny did not sort before allow when exact")
 
-        ip = Declaration.new(:allow, "192.168.0.1")
-        ip.pattern.expects(:include?)
-        ip.match?("host.com", "192.168.0.1")
-    end
+    host_range_deny = Declaration.new(:deny, "*.host.com")
+    assert_equal(-1, host_range_deny <=> host_range, "deny did not sort before allow when ranged")
+
+    ip_allow = Declaration.new(:allow, "192.168.0.0/16")
+    ip_deny = Declaration.new(:deny, "192.168.0.0/16")
 
-    def test_matchname?
-        host = Declaration.new(:allow, "host.com")
-        assert(host.send(:matchname?, "host.com"), "exact did not match")
-        assert(! host.send(:matchname?, "yay.com"), "incorrect match")
-
-        domain = Declaration.new(:allow, "*.domain.com")
-        %w{host.domain.com domain.com very.long.domain.com very-long.domain.com
-        }.each do |name|
-            assert(domain.send(:matchname?, name),
-                "Did not match %s" % name)
-        end
+
+      assert_equal(
+        -1, ip_deny <=> ip_allow,
+
+      "deny did not sort before allow in ip range")
+
+    %w{host.com *.domain.com 192.168.0.1 192.168.0.1/24}.each do |decl|
+      assert_equal(0, Declaration.new(:allow, decl) <=>
+        Declaration.new(:allow, decl),
+        "Equivalent declarations for #{decl} were considered different"
+      )
+    end
+  end
+
+  def test_match?
+    host = Declaration.new(:allow, "host.com")
+    host.expects(:matchname?).with("host.com")
+    host.match?("host.com", "192.168.0.1")
+
+    ip = Declaration.new(:allow, "192.168.0.1")
+    ip.pattern.expects(:include?)
+    ip.match?("host.com", "192.168.0.1")
+  end
+
+  def test_matchname?
+    host = Declaration.new(:allow, "host.com")
+    assert(host.send(:matchname?, "host.com"), "exact did not match")
+    assert(! host.send(:matchname?, "yay.com"), "incorrect match")
+
+    domain = Declaration.new(:allow, "*.domain.com")
+    %w{host.domain.com domain.com very.long.domain.com very-long.domain.com }.each do |name|
+      assert(domain.send(:matchname?, name), "Did not match #{name}")
     end
+  end
 end