puppet 2.6.17 → 2.6.18

data/spec/unit/network/http/handler_spec.rb

@@ -417,6 +417,7 @@ describe Puppet::Network::HTTP::Handler do
 
         @model_instance = stub('indirected model instance', :save => true)
         @model_class.stubs(:convert_from).returns(@model_instance)
+        @model_class.stubs(:===).with(@model_instance).returns(true)
 
         @format = stub 'format', :suitable? => true, :name => "format", :mime => "text/format"
         Puppet::Network::FormatHandler.stubs(:format).returns @format

data/spec/unit/network/http/rack/rest_spec.rb

@@ -92,6 +92,23 @@ describe "Puppet::Network::HTTP::RackREST", :if => Puppet.features.rack? do
           @handler.set_response(@response, @file, 200)
         end
       end
+
+      it "should ensure the body has been read on success" do
+        req = mk_req('/production/report/foo', :method => 'PUT')
+        req.body.expects(:read).at_least_once
+
+        Puppet::Transaction::Report.stubs(:save)
+
+        @handler.process(req, @response)
+      end
+
+      it "should ensure the body has been partially read on failure" do
+        req = mk_req('/production/report/foo')
+        req.body.expects(:read).with(1)
+        req.stubs(:check_authorization).raises(Exception)
+
+        @handler.process(req, @response)
+      end
     end
 
     describe "and determining the request parameters" do

data/spec/unit/network/http/webrick_spec.rb

@@ -320,6 +320,10 @@ describe Puppet::Network::HTTP::WEBrick do
       @server.setup_ssl[:SSLEnable].should be_true
     end
 
+    it "should reject SSLv2" do
+      @server.setup_ssl[:SSLOptions].should == OpenSSL::SSL::OP_NO_SSLv2
+    end
+
     it "should configure the verification method as 'OpenSSL::SSL::VERIFY_PEER'" do
       @server.setup_ssl[:SSLVerifyClient].should == OpenSSL::SSL::VERIFY_PEER
     end

data/spec/unit/network/http_pool_spec.rb

@@ -24,38 +24,34 @@ describe Puppet::Network::HttpPool do
   end
 
   describe "when managing http instances" do
-    def stub_settings(settings)
-      settings.each do |param, value|
-        Puppet.settings.stubs(:value).with(param).returns(value)
-      end
-    end
-
-    before do
+    before :each do
       # All of the cert stuff is tested elsewhere
       Puppet::Network::HttpPool.stubs(:cert_setup)
     end
 
     it "should return an http instance created with the passed host and port" do
-      http = stub 'http', :use_ssl= => nil, :read_timeout= => nil, :open_timeout= => nil, :started? => false
-      Net::HTTP.expects(:new).with("me", 54321, nil, nil).returns(http)
-      Puppet::Network::HttpPool.http_instance("me", 54321).should equal(http)
+      http = Puppet::Network::HttpPool.http_instance("me", 54321)
+      http.should be_an_instance_of Net::HTTP
+      http.address.should == 'me'
+      http.port.should    == 54321
     end
 
     it "should enable ssl on the http instance" do
-      Puppet::Network::HttpPool.http_instance("me", 54321).instance_variable_get("@use_ssl").should be_true
+      Puppet::Network::HttpPool.http_instance("me", 54321).should be_use_ssl
     end
 
-    it "should set the read timeout" do
-      Puppet::Network::HttpPool.http_instance("me", 54321).read_timeout.should == 120
-    end
-
-    it "should set the open timeout" do
-      Puppet::Network::HttpPool.http_instance("me", 54321).open_timeout.should == 120
+    context "proxy and timeout settings should propagate" do
+      subject { Puppet::Network::HttpPool.http_instance("me", 54321) }
+      before :each do
+        Puppet[:http_proxy_host] = "myhost"
+        Puppet[:http_proxy_port] = 432
+        Puppet[:configtimeout]   = 120
+      end
     end
 
-    it "should create the http instance with the proxy host and port set if the http_proxy is not set to 'none'" do
-      stub_settings :http_proxy_host => "myhost", :http_proxy_port => 432, :configtimeout => 120
-      Puppet::Network::HttpPool.http_instance("me", 54321).open_timeout.should == 120
+    it "should not set a proxy if the value is 'none'" do
+      Puppet[:http_proxy_host] = 'none'
+      Puppet::Network::HttpPool.http_instance("me", 54321).proxy_address.should be_nil
     end
 
     describe "and http keep-alive is enabled" do
@@ -64,19 +60,24 @@ describe Puppet::Network::HttpPool do
       end
 
       it "should cache http instances" do
-        stub_settings :http_proxy_host => "myhost", :http_proxy_port => 432, :configtimeout => 120
         old = Puppet::Network::HttpPool.http_instance("me", 54321)
         Puppet::Network::HttpPool.http_instance("me", 54321).should equal(old)
       end
 
       it "should have a mechanism for getting a new http instance instead of the cached instance" do
-        stub_settings :http_proxy_host => "myhost", :http_proxy_port => 432, :configtimeout => 120
+        Puppet[:http_proxy_host] = "myhost"
+        Puppet[:http_proxy_port] = 432
+        Puppet[:configtimeout] = 120
+
         old = Puppet::Network::HttpPool.http_instance("me", 54321)
         Puppet::Network::HttpPool.http_instance("me", 54321, true).should_not equal(old)
       end
 
       it "should close existing, open connections when requesting a new connection" do
-        stub_settings :http_proxy_host => "myhost", :http_proxy_port => 432, :configtimeout => 120
+        Puppet[:http_proxy_host] = "myhost"
+        Puppet[:http_proxy_port] = 432
+        Puppet[:configtimeout] = 120
+
         old = Puppet::Network::HttpPool.http_instance("me", 54321)
         old.expects(:started?).returns(true)
         old.expects(:finish)
@@ -84,7 +85,9 @@ describe Puppet::Network::HttpPool do
       end
 
       it "should have a mechanism for clearing the http cache" do
-        stub_settings :http_proxy_host => "myhost", :http_proxy_port => 432, :configtimeout => 120
+        Puppet[:http_proxy_host] = "myhost"
+        Puppet[:http_proxy_port] = 432
+        Puppet[:configtimeout] = 120
         old = Puppet::Network::HttpPool.http_instance("me", 54321)
         Puppet::Network::HttpPool.http_instance("me", 54321).should equal(old)
         old = Puppet::Network::HttpPool.http_instance("me", 54321)
@@ -93,7 +96,9 @@ describe Puppet::Network::HttpPool do
       end
 
       it "should close open http connections when clearing the cache" do
-        stub_settings :http_proxy_host => "myhost", :http_proxy_port => 432, :configtimeout => 120
+        Puppet[:http_proxy_host] = "myhost"
+        Puppet[:http_proxy_port] = 432
+        Puppet[:configtimeout] = 120
         one = Puppet::Network::HttpPool.http_instance("me", 54321)
         one.expects(:started?).returns(true)
         one.expects(:finish).returns(true)
@@ -101,7 +106,9 @@ describe Puppet::Network::HttpPool do
       end
 
       it "should not close unopened http connections when clearing the cache" do
-        stub_settings :http_proxy_host => "myhost", :http_proxy_port => 432, :configtimeout => 120
+        Puppet[:http_proxy_host] = "myhost"
+        Puppet[:http_proxy_port] = 432
+        Puppet[:configtimeout] = 120
         one = Puppet::Network::HttpPool.http_instance("me", 54321)
         one.expects(:started?).returns(false)
         one.expects(:finish).never
@@ -115,7 +122,9 @@ describe Puppet::Network::HttpPool do
       end
 
       it "should not cache http instances" do
-        stub_settings :http_proxy_host => "myhost", :http_proxy_port => 432, :configtimeout => 120
+        Puppet[:http_proxy_host] = "myhost"
+        Puppet[:http_proxy_port] = 432
+        Puppet[:configtimeout] = 120
         old = Puppet::Network::HttpPool.http_instance("me", 54321)
         Puppet::Network::HttpPool.http_instance("me", 54321).should_not equal(old)
       end
@@ -126,81 +135,85 @@ describe Puppet::Network::HttpPool do
     end
   end
 
-  describe "when adding certificate information to http instances" do
-    before do
-      @http = mock 'http'
-      [:cert_store=, :verify_mode=, :ca_file=, :cert=, :key=].each { |m| @http.stubs(m) }
-      @store = stub 'store'
-
-      @cert = stub 'cert', :content => "real_cert"
-      @key = stub 'key', :content => "real_key"
-      @host = stub 'host', :certificate => @cert, :key => @key, :ssl_store => @store
-
-      Puppet[:confdir] = "/sometthing/else"
-      Puppet.settings.stubs(:value).returns "/some/file"
-      Puppet.settings.stubs(:value).with(:hostcert).returns "/host/cert"
-      Puppet.settings.stubs(:value).with(:localcacert).returns "/local/ca/cert"
-
-      FileTest.stubs(:exist?).with("/host/cert").returns true
-      FileTest.stubs(:exist?).with("/local/ca/cert").returns true
-
-      Puppet::Network::HttpPool.stubs(:ssl_host).returns @host
-    end
-
-    after do
-      Puppet.settings.clear
+  describe "when doing SSL setup for http instances" do
+    let :http do
+      http = Net::HTTP.new('localhost', 443)
+      http.use_ssl = true
+      http
     end
 
-    it "should do nothing if no host certificate is on disk" do
-      FileTest.expects(:exist?).with("/host/cert").returns false
-      @http.expects(:cert=).never
-      Puppet::Network::HttpPool.cert_setup(@http)
-    end
+    let :store do stub('store') end
 
-    it "should do nothing if no local certificate is on disk" do
-      FileTest.expects(:exist?).with("/local/ca/cert").returns false
-      @http.expects(:cert=).never
-      Puppet::Network::HttpPool.cert_setup(@http)
+    before :each do
+      Puppet[:hostcert]    = '/host/cert'
+      Puppet[:localcacert] = '/local/ca/cert'
+      cert  = stub 'cert', :content => 'real_cert'
+      key   = stub 'key',  :content => 'real_key'
+      host  = stub 'host', :certificate => cert, :key => key, :ssl_store => store
+      Puppet::Network::HttpPool.stubs(:ssl_host).returns(host)
     end
 
-    it "should add a certificate store from the ssl host" do
-      @http.expects(:cert_store=).with(@store)
+    shared_examples "HTTPS setup without all certificates" do
+      subject { Puppet::Network::HttpPool.cert_setup(http); http }
 
-      Puppet::Network::HttpPool.cert_setup(@http)
+      it                { should be_use_ssl }
+      its(:cert)        { should be_nil }
+      its(:ca_file)     { should be_nil }
+      its(:key)         { should be_nil }
+      its(:verify_mode) { should == OpenSSL::SSL::VERIFY_NONE }
     end
 
-    it "should add the client certificate" do
-      @http.expects(:cert=).with("real_cert")
+    context "with neither a host cert or a local CA cert" do
+      before :each do
+        FileTest.stubs(:exist?).with(Puppet[:hostcert]).returns(false)
+        FileTest.stubs(:exist?).with(Puppet[:localcacert]).returns(false)
+      end
 
-      Puppet::Network::HttpPool.cert_setup(@http)
+      include_examples "HTTPS setup without all certificates"
     end
 
-    it "should add the client key" do
-      @http.expects(:key=).with("real_key")
+    context "with there is no host certificate" do
+      before :each do
+        FileTest.stubs(:exist?).with(Puppet[:hostcert]).returns(false)
+        FileTest.stubs(:exist?).with(Puppet[:localcacert]).returns(true)
+      end
 
-      Puppet::Network::HttpPool.cert_setup(@http)
+      include_examples "HTTPS setup without all certificates"
     end
 
-    it "should set the verify mode to OpenSSL::SSL::VERIFY_PEER" do
-      @http.expects(:verify_mode=).with(OpenSSL::SSL::VERIFY_PEER)
+    context "with there is no local CA certificate" do
+      before :each do
+        FileTest.stubs(:exist?).with(Puppet[:hostcert]).returns(true)
+        FileTest.stubs(:exist?).with(Puppet[:localcacert]).returns(false)
+      end
 
-      Puppet::Network::HttpPool.cert_setup(@http)
+      include_examples "HTTPS setup without all certificates"
     end
 
-    it "should set the ca file" do
-      Puppet.settings.stubs(:value).returns "/some/file"
-      FileTest.stubs(:exist?).with(Puppet[:hostcert]).returns true
+    context "with both the host and CA cert" do
+      subject { Puppet::Network::HttpPool.cert_setup(http); http }
 
-      Puppet.settings.stubs(:value).with(:localcacert).returns "/ca/cert/file"
-      FileTest.stubs(:exist?).with("/ca/cert/file").returns true
-      @http.expects(:ca_file=).with("/ca/cert/file")
+      before :each do
+        FileTest.expects(:exist?).with(Puppet[:hostcert]).returns(true)
+        FileTest.expects(:exist?).with(Puppet[:localcacert]).returns(true)
+      end
 
-      Puppet::Network::HttpPool.cert_setup(@http)
+      it                { should be_use_ssl }
+      its(:cert_store)  { should equal store }
+      its(:cert)        { should == "real_cert" }
+      its(:key)         { should == "real_key" }
+      its(:verify_mode) { should == OpenSSL::SSL::VERIFY_PEER }
+      its(:ca_file)     { should == Puppet[:localcacert] }
     end
 
     it "should set up certificate information when creating http instances" do
-      Puppet::Network::HttpPool.expects(:cert_setup).with { |i| i.is_a?(Net::HTTP) }
-      Puppet::Network::HttpPool.http_instance("one", "two")
+      Puppet::Network::HttpPool.expects(:cert_setup).with do |http|
+        http.should be_an_instance_of Net::HTTP
+        http.address.should == "one"
+        http.port.should == 2
+      end
+
+      Puppet::Network::HttpPool.http_instance("one", 2)
     end
   end
 end

data/spec/unit/network/rest_authconfig_spec.rb

@@ -12,7 +12,7 @@ describe Puppet::Network::RestAuthConfig do
     # to fileserver.conf
     { :acl => "/file" },
     { :acl => "/certificate_revocation_list/ca", :method => :find, :authenticated => true },
-    { :acl => "/report", :method => :save, :authenticated => true },
+    { :acl => "~ ^\/report\/([^\/]+)$", :method => :save, :allow => '$1', :authenticated => true },
     { :acl => "/certificate/ca", :method => :find, :authenticated => false },
     { :acl => "/certificate/", :method => :find, :authenticated => false },
     { :acl => "/certificate_request", :method => [:find, :save], :authenticated => false },
@@ -104,7 +104,22 @@ describe Puppet::Network::RestAuthConfig do
     end
   end
 
+  it '(CVE-2013-2275) allows report submission only for the node matching the certname by default' do
+    acl = {
+      :acl => "~ ^\/report\/([^\/]+)$",
+      :method => :save,
+      :allow => '$1',
+      :authenticated => true
+    }
+    @authconfig.stubs(:mk_acl)
+    @authconfig.expects(:mk_acl).with(acl)
+    @authconfig.insert_default_acl
+  end
+
   it "should create default ACL entries if no file have been read" do
+    # The singleton instance is stored as an instance variable we don't have
+    # access to, so.. instance_variable_set. Alas.
+    Puppet::Network::RestAuthConfig.instance_variable_set(:@main, nil)
     Puppet::Network::RestAuthConfig.any_instance.stubs(:exists?).returns(false)
 
     Puppet::Network::RestAuthConfig.any_instance.expects(:insert_default_acl)
@@ -141,7 +156,5 @@ describe Puppet::Network::RestAuthConfig do
 
       @authconfig.insert_default_acl
     end
-
   end
-
 end

data/spec/unit/parser/functions/inline_template_spec.rb

@@ -56,4 +56,17 @@ describe "the inline_template function" do
     lambda { @scope.function_inline_template("1") }.should raise_error(Puppet::ParseError)
   end
 
-end
+  it "is not interfered with by a variable called 'string' (#14093)" do
+    @scope.setvar("string", "this is a variable")
+    inline_template("this is a template").should == "this is a template"
+  end
+
+  it "has access to a variable called 'string' (#14093)" do
+    @scope.setvar('string', "this is a variable")
+    inline_template("string was: <%= @string %>").should == "string was: this is a variable"
+  end
+
+  def inline_template(*templates)
+    @scope.function_inline_template(templates)
+  end
+end

data/spec/unit/parser/functions/template_spec.rb

@@ -51,6 +51,16 @@ describe "the template function" do
     @scope.function_template(["1","2"]).should == "result1result2"
   end
 
+  it "is not interfered with by having a variable named 'string' (#14093)" do
+    @scope.setvar('string', "this output should not be seen")
+    eval_template("some text that is static").should == "some text that is static"
+  end
+
+  it "has access to a variable named 'string' (#14093)" do
+    @scope.setvar('string', "the string value")
+    eval_template("string was: <%= @string %>").should == "string was: the string value"
+  end
+
   it "should raise an error if the template raises an error" do
     tw = stub_everything 'template_wrapper'
     Puppet::Parser::TemplateWrapper.stubs(:new).returns(tw)
@@ -59,4 +69,11 @@ describe "the template function" do
     lambda { @scope.function_template("1") }.should raise_error(Puppet::ParseError)
   end
 
-end
+  def eval_template(content)
+    File.stubs(:read).with("template").returns(content)
+    Puppet::Parser::Files.stubs(:find_template).returns("template")
+    env = Puppet::Node::Environment.new('production')
+    @scope.compiler = stub('compiler', :environment => env)
+    @scope.function_template(['template'])
+  end
+end

data/spec/unit/parser/templatewrapper_spec.rb

@@ -25,16 +25,14 @@ describe Puppet::Parser::TemplateWrapper do
 
   it "should check template file existance and read its content" do
     Puppet::Parser::Files.expects(:find_template).with("fake_template", @scope.environment.to_s).returns("/tmp/fake_template")
-    File.expects(:read).with("/tmp/fake_template").returns("template content")
 
     @tw.file = @file
   end
 
   it "should mark the file for watching" do
-    Puppet::Parser::Files.expects(:find_template).returns("/tmp/fake_template")
-    File.stubs(:read)
+    full_file_name = given_a_template_file("fake_template", "content")
 
-    @known_resource_types.expects(:watch_file).with("/tmp/fake_template")
+    @known_resource_types.expects(:watch_file).with(full_file_name)
     @tw.file = @file
   end
 
@@ -54,7 +52,7 @@ describe Puppet::Parser::TemplateWrapper do
   end
 
   it "should return the processed template contents with a call to result" do
-    template_mock = mock("template", :result => "woot!")
+    template_mock = mock("template", :result => "woot!", :filename= => nil)
     File.expects(:read).with("/tmp/fake_template").returns("template contents")
     ERB.expects(:new).with("template contents", 0, "-").returns(template_mock)
 
@@ -62,8 +60,15 @@ describe Puppet::Parser::TemplateWrapper do
     @tw.result.should eql("woot!")
   end
 
+  it "provides access to the name of the template via #file" do
+    full_file_name = given_a_template_file("fake_template", "<%= file %>")
+
+    @tw.file = "fake_template"
+    @tw.result.should == full_file_name
+  end
+
   it "should return the processed template contents with a call to result and a string" do
-    template_mock = mock("template", :result => "woot!")
+    template_mock = mock("template", :result => "woot!", :filename= => nil)
     ERB.expects(:new).with("template contents", 0, "-").returns(template_mock)
 
     @tw.result("template contents").should eql("woot!")
@@ -114,7 +119,7 @@ describe Puppet::Parser::TemplateWrapper do
   end
 
   it "should set all of the scope's variables as instance variables" do
-    template_mock = mock("template", :result => "woot!")
+    template_mock = mock("template", :result => "woot!", :filename= => nil)
     ERB.expects(:new).with("template contents", 0, "-").returns(template_mock)
 
     @scope.expects(:to_hash).returns("one" => "foo")
@@ -124,7 +129,7 @@ describe Puppet::Parser::TemplateWrapper do
   end
 
   it "should not error out if one of the variables is a symbol" do
-    template_mock = mock("template", :result => "woot!")
+    template_mock = mock("template", :result => "woot!", :filename= => nil)
     ERB.expects(:new).with("template contents", 0, "-").returns(template_mock)
 
     @scope.expects(:to_hash).returns(:_timestamp => "1234")
@@ -133,7 +138,7 @@ describe Puppet::Parser::TemplateWrapper do
 
   %w{! . ; :}.each do |badchar|
     it "should translate #{badchar} to _ when setting the instance variables" do
-    template_mock = mock("template", :result => "woot!")
+    template_mock = mock("template", :result => "woot!", :filename= => nil)
     ERB.expects(:new).with("template contents", 0, "-").returns(template_mock)
 
     @scope.expects(:to_hash).returns("one#{badchar}" => "foo")
@@ -142,4 +147,14 @@ describe Puppet::Parser::TemplateWrapper do
     @tw.instance_variable_get("@one_").should == "foo"
   end
   end
+
+  def given_a_template_file(name, contents)
+    full_name = "/full/path/to/#{name}"
+    Puppet::Parser::Files.stubs(:find_template).
+      with(name, anything()).
+      returns(full_name)
+    File.stubs(:read).with(full_name).returns(contents)
+
+    full_name
+  end
 end