puppet 0.9.2

data/lib/puppet/util.rb

@@ -0,0 +1,138 @@
+# A module to collect utility functions.
+
+module Puppet
+module Util
+    # Execute a block as a given user or group
+    def self.asuser(user = nil, group = nil)
+        require 'etc'
+
+        uid = nil
+        gid = nil
+        olduid = nil
+        oldgid = nil
+
+        begin
+            # the groupid, if we got passed a group
+            # The gid has to be changed first, because, well, otherwise we won't
+            # be able to
+            if group
+                if group.is_a?(Integer)
+                    gid = group
+                else
+                    unless obj = Puppet::Type::Group[group]
+                        obj = Puppet::Type::Group.create(
+                            :name => group,
+                            :check => [:gid]
+                        )
+                    end
+                    obj.retrieve
+                    gid = obj.is(:gid)
+                    unless gid.is_a?(Integer)
+                        raise Puppet::Error, "Could not find group %s" % group
+                    end
+                end
+
+                if Process.gid != gid
+                    oldgid = Process.gid
+                    begin
+                        Process.egid = gid
+                    rescue => detail
+                        raise Puppet::Error, "Could not change GID: %s" % detail
+                    end
+                end
+            end
+
+            if user
+                # Retrieve the user id
+                if user.is_a?(Integer)
+                    uid = user
+                else
+                    unless obj = Puppet::Type::User[user]
+                        obj = Puppet::Type::User.create(
+                            :name => user,
+                            :check => [:uid, :gid]
+                        )
+                    end
+                    obj.retrieve
+                    uid = obj.is(:uid)
+                    unless uid.is_a?(Integer)
+                        raise Puppet::Error, "Could not find user %s" % user
+                    end
+                end
+
+                # Now change the uid
+                if Process.uid != uid
+                    olduid = Process.uid
+                    begin
+                        Process.euid = uid
+                    rescue => detail
+                        raise Puppet::Error, "Could not change UID: %s" % detail
+                    end
+                end
+            end
+
+            retval = yield
+        ensure
+            if olduid
+                Process.euid = olduid
+            end
+
+            if oldgid
+                Process.egid = oldgid
+            end
+        end
+
+        return retval
+    end
+
+    # Create instance methods for each of the log levels.  This allows
+    # the messages to be a little richer.  Most classes will be calling this
+    # method.
+    def self.logmethods(klass, useself = true)
+        Puppet::Log.eachlevel { |level|
+            klass.send(:define_method, level, proc { |args|
+                if args.is_a?(Array)
+                    args = args.join(" ")
+                end
+                if useself
+                    Puppet::Log.create(
+                        :level => level,
+                        :message => args
+                    )
+                else
+                    Puppet::Log.create(
+                        :level => level,
+                        :source => self,
+                        :message => args
+                    )
+                end
+            })
+        }
+    end
+
+    # XXX this should all be done using puppet objects, not using
+    # normal mkdir
+    def self.recmkdir(dir,mode = 0755)
+        if FileTest.exist?(dir)
+            return false
+        else
+            tmp = dir.sub(/^\//,'')
+            path = [File::SEPARATOR]
+            tmp.split(File::SEPARATOR).each { |dir|
+                path.push dir
+                if ! FileTest.exist?(File.join(path))
+                    Dir.mkdir(File.join(path), mode)
+                elsif FileTest.directory?(File.join(path))
+                    next
+                else FileTest.exist?(File.join(path))
+                    raise "Cannot create %s: basedir %s is a file" %
+                        [dir, File.join(path)]
+                end
+            }
+            return true
+        end
+    end
+end
+end
+
+# $Id: util.rb 743 2005-11-16 21:39:31Z luke $

data/test/certmgr/certmgr.rb

@@ -0,0 +1,265 @@
+#!/usr/bin/ruby
+
+if __FILE__ == $0
+    $:.unshift '../../lib'
+    $:.unshift '..'
+    $puppetbase = "../.."
+end
+
+require 'puppet'
+require 'puppet/sslcertificates.rb'
+require 'test/unit'
+require 'puppettest'
+
+# so, what kind of things do we want to test?
+
+# we don't need to test function, since we're confident in the
+# library tests.  We do, however, need to test how things are actually
+# working in the language.
+
+# so really, we want to do things like test that our ast is correct
+# and test whether we've got things in the right scopes
+
+class TestCertMgr < Test::Unit::TestCase
+    include TestPuppet
+    def setup
+        super
+        #@dir = File.join(Puppet[:certdir], "testing")
+        @dir = File.join(@configpath, "certest")
+        Puppet.notice @dir
+        system("mkdir -p %s" % @dir)
+    end
+
+    def mkPassFile()
+        keyfile = File.join(@dir, "tmpkeyfile")
+        @@tmpfiles << keyfile
+        unless FileTest.exists?(@dir)
+            system("mkdir -p %s" % @dir)
+        end
+        File.open(keyfile, "w", 0600) { |f|
+            f.print "as;dklj23rlkjzdflij23wr"
+        }
+
+        return keyfile
+    end
+
+    def mkCA
+        ca = nil
+        assert_nothing_raised {
+            ca = Puppet::SSLCertificates::CA.new()
+        }
+
+        return ca
+    end
+
+    def testCreateSelfSignedCertificate
+        cert = nil
+        name = "testing"
+        newcert = proc {
+            Puppet::SSLCertificates::Certificate.new(
+                :name => name,
+                :selfsign => true
+            )
+        }
+        assert_nothing_raised {
+            cert = newcert.call()
+        }
+        assert_nothing_raised {
+            cert.mkselfsigned
+        }
+
+        assert_raise(Puppet::Error) {
+            cert.mkselfsigned
+        }
+
+        assert_nothing_raised {
+            cert.write
+        }
+
+        assert(FileTest.exists?(cert.certfile))
+
+        assert_nothing_raised {
+            cert.delete
+        }
+
+        assert_nothing_raised {
+            cert = newcert.call()
+        }
+        assert_nothing_raised {
+            cert.mkselfsigned
+        }
+
+        assert_nothing_raised {
+            cert.delete
+        }
+
+    end
+
+    def disabled_testCreateEncryptedSelfSignedCertificate
+        cert = nil
+        name = "testing"
+        keyfile = mkPassFile
+        assert_nothing_raised {
+            cert = Puppet::SSLCertificates::Certificate.new(
+                :name => name,
+                :selfsign => true,
+                :capass => keyfile
+            )
+        }
+        assert_nothing_raised {
+            cert.mkselfsigned
+        }
+        assert_nothing_raised {
+            cert.mkhash
+        }
+
+        assert_raise(Puppet::Error) {
+            cert.mkselfsigned
+        }
+
+        assert(FileTest.exists?(cert.certfile))
+        assert(FileTest.exists?(cert.hash))
+
+        assert_nothing_raised {
+            cert.delete
+        }
+
+        assert_nothing_raised {
+            cert.mkselfsigned
+        }
+
+        assert_nothing_raised {
+            cert.delete
+        }
+
+    end
+
+    def testCreateCA
+        ca = nil
+        assert_nothing_raised {
+            ca = Puppet::SSLCertificates::CA.new()
+        }
+
+        # make the CA again and verify it doesn't fail because everything
+        # still exists
+        assert_nothing_raised {
+            ca = Puppet::SSLCertificates::CA.new()
+        }
+
+    end
+
+    def testSignCert
+        ca = mkCA()
+
+        cert = nil
+        assert_nothing_raised {
+            cert = Puppet::SSLCertificates::Certificate.new(
+                :name => "signedcertest",
+                :state => "TN",
+                :city => "Nashville",
+                :country => "US",
+                :email => "luke@madstop.com",
+                :org => "Reductive",
+                :ou => "Development",
+                :encrypt => mkPassFile()
+            )
+
+        }
+
+        assert_nothing_raised {
+            cert.mkcsr
+        }
+
+        signedcert = nil
+        cacert = nil
+
+        assert_nothing_raised {
+            signedcert, cacert = ca.sign(cert.csr)
+        }
+
+        assert_instance_of(OpenSSL::X509::Certificate, signedcert)
+        assert_instance_of(OpenSSL::X509::Certificate, cacert)
+
+        assert_nothing_raised {
+            cert.cert = signedcert
+            cert.cacert = cacert
+            cert.write
+        }
+        #system("find %s" % Puppet[:ssldir])
+        #system("cp -R %s /tmp/ssltesting" % Puppet[:ssldir])
+
+        output = nil
+        assert_nothing_raised {
+            output = %x{openssl verify -CAfile #{Puppet[:cacert]} -purpose sslserver #{cert.certfile}}
+            #output = %x{openssl verify -CApath #{Puppet[:certdir]} -purpose sslserver #{cert.certfile}}
+        }
+
+        assert_equal($?,0)
+        assert_equal(File.join(Puppet[:certdir], "signedcertest.pem: OK\n"), output)
+    end
+
+    def mkcert(hostname)
+        cert = nil
+        assert_nothing_raised {
+            cert = Puppet::SSLCertificates::Certificate.new(:name => hostname)
+            cert.mkcsr
+        }
+        
+        return cert
+    end 
+ 
+
+    def test_interactiveca
+        ca = nil
+
+        assert_nothing_raised {
+            ca = Puppet::SSLCertificates::CA.new
+        }
+
+        # basic initialization
+        hostname = "test.hostname.com"
+        cert = mkcert(hostname)
+
+        # create the csr
+        csr = nil
+        assert_nothing_raised {
+            csr = cert.mkcsr
+        }
+
+        assert_nothing_raised {
+            ca.storeclientcsr(csr)
+        }
+
+        # store it
+        pulledcsr = nil
+        assert_nothing_raised {
+            pulledcsr = ca.getclientcsr(hostname)
+        }
+
+        assert_equal(csr.to_pem, pulledcsr.to_pem)
+
+        signedcert = nil
+        assert_nothing_raised {
+            signedcert, cacert = ca.sign(csr)
+        }
+
+        assert_instance_of(OpenSSL::X509::Certificate, signedcert)
+        newsignedcert = nil
+        assert_nothing_raised {
+            newsignedcert, cacert = ca.getclientcert(hostname)
+        }
+
+        assert(newsignedcert)
+
+        assert_equal(signedcert.to_pem, newsignedcert.to_pem)
+    end
+
+    def test_cafailures
+        ca = mkCA()
+        cert = cacert = nil
+        assert_nothing_raised {
+            cert, cacert = ca.getclientcert("nohost")
+        }
+        assert_nil(cert)
+    end
+end

data/test/client/client.rb

@@ -0,0 +1,203 @@
+if __FILE__ == $0
+    $:.unshift '..'
+    $:.unshift '../../lib'
+    $puppetbase = "../.."
+end
+
+require 'puppet'
+require 'puppet/client'
+require 'puppet/server'
+require 'test/unit'
+require 'puppettest.rb'
+
+# $Id: client.rb 724 2005-10-22 22:27:20Z luke $
+
+class TestClient < Test::Unit::TestCase
+	include ServerTest
+    # a single run through of connect, auth, etc.
+    def test_sslInitWithAutosigningLocalServer
+        # autosign everything, for simplicity
+        Puppet[:autosign] = true
+
+        # create a server to which to connect
+        mkserver()
+
+        # create our client
+        client = nil
+        assert_nothing_raised {
+            client = Puppet::Client::MasterClient.new(
+                :Server => "localhost",
+                :Port => @@port
+            )
+        }
+
+        # get our certs
+        assert_nothing_raised {
+            client.initcerts
+        }
+
+        # make sure all of our cert files exist
+        certfile = File.join(Puppet[:certdir], [client.fqdn, "pem"].join("."))
+        keyfile = File.join(Puppet[:privatekeydir], [client.fqdn, "pem"].join("."))
+        publickeyfile = File.join(Puppet[:publickeydir], [client.fqdn, "pem"].join("."))
+
+        assert(File.exists?(keyfile))
+        assert(File.exists?(certfile))
+        assert(File.exists?(publickeyfile))
+
+        # verify we can retrieve the configuration
+        assert_nothing_raised("Client could not retrieve configuration") {
+            client.getconfig
+        }
+
+        # and apply it
+        assert_nothing_raised("Client could not apply configuration") {
+            client.apply
+        }
+
+        # and verify that it did what it was supposed to
+        assert(FileTest.exists?(@createdfile),
+            "Applied file does not exist")
+    end
+
+
+    # here we create two servers; we 
+    def test_failureWithUntrustedCerts
+        Puppet[:autosign] = true
+
+        # create a pair of clients with no certs
+        nonemaster = nil
+        assert_nothing_raised {
+            nonemaster = Puppet::Client::MasterClient.new(
+                :Server => "localhost",
+                :Port => @@port
+            )
+        }
+
+        nonebucket = nil
+        assert_nothing_raised {
+            nonebucket = Puppet::Client::Dipper.new(
+                :Server => "localhost",
+                :Port => @@port
+            )
+        }
+
+        # create a ca so we can create a set of certs
+        ca = nil
+        assert_nothing_raised {
+            ca = Puppet::Client::CAClient.new(:CA => true, :Local => true)
+            ca.requestcert
+        }
+
+        # initialize our clients with this set of certs
+        certmaster = nil
+        assert_nothing_raised {
+            certmaster = Puppet::Client::MasterClient.new(
+                :Server => "localhost",
+                :Port => @@port
+            )
+        }
+
+        certbucket = nil
+        assert_nothing_raised {
+            certbucket = Puppet::Client::Dipper.new(
+                :Server => "localhost",
+                :Port => @@port
+            )
+        }
+
+        # clean up the existing certs, so the server creates a new CA
+        system("rm -rf %s" % Puppet[:ssldir])
+
+        # start our server
+        mkserver
+
+        # now verify that our client cannot do non-cert operations
+        # because its certs are signed by a different CA
+        assert_raise(Puppet::NetworkClientError,
+            "Client was allowed to call getconfig with no certs") {
+            nonemaster.getconfig
+        }
+        assert_raise(Puppet::NetworkClientError,
+            "Client was allowed to call getconfig with untrusted certs") {
+            certmaster.getconfig
+        }
+
+        assert_raise(Puppet::NetworkClientError,
+            "Client was allowed to call backup with no certs") {
+            nonebucket.backup("/etc/passwd")
+        }
+        assert_raise(Puppet::NetworkClientError,
+            "Client was allowed to call backup with untrusted certs") {
+            certbucket.backup("/etc/passwd")
+        }
+    end
+
+    # disabled because the server needs to have its certs in place
+    # in order to start at all
+    # i don't think this test makes much sense anyway
+    def disabled_test_sslInitWithNonsigningLocalServer
+        Puppet[:autosign] = false
+        Puppet[:ssldir] = "/tmp/puppetclientcertests"
+        @@tmpfiles.push Puppet[:ssldir]
+
+        file = File.join($puppetbase, "examples", "code", "head")
+
+        server = nil
+        port = 8086
+        assert_nothing_raised {
+            server = Puppet::Server.new(
+                :Port => port,
+                :Handlers => {
+                    :CA => {}, # so that certs autogenerate
+                    :Master => {
+                        :File => file,
+                    },
+                }
+            )
+        }
+
+        spid = fork {
+            trap(:INT) { server.shutdown }
+            server.start
+        }
+
+        @@tmppids << spid
+        client = nil
+        assert_nothing_raised {
+            client = Puppet::Client.new(:Server => "localhost", :Port => port)
+        }
+        certfile = File.join(Puppet[:certdir], [client.fqdn, "pem"].join("."))
+        cafile = File.join(Puppet[:certdir], ["ca", "pem"].join("."))
+        assert_nil(client.initcerts)
+        assert(! File.exists?(certfile))
+
+        ca = nil
+        assert_nothing_raised {
+            ca = Puppet::SSLCertificates::CA.new()
+        }
+
+
+        csr = nil
+        assert_nothing_raised {
+            csr = ca.getclientcsr(client.fqdn)
+        }
+
+        assert(csr)
+
+        cert = nil
+        assert_nothing_raised {
+            cert, cacert = ca.sign(csr)
+            File.open(certfile, "w") { |f| f.print cert.to_pem }
+            File.open(cafile, "w") { |f| f.print cacert.to_pem }
+        }
+
+        # this time it should get the cert correctly
+        assert_nothing_raised {
+            client.initcerts
+        }
+
+        # this isn't a very good test, since i just wrote the file out
+        assert(File.exists?(certfile))
+    end
+end