puppet 2.6.18 → 2.7.1

data/tasks/rake/manpages.rake

@@ -0,0 +1,69 @@
+# require 'fileutils'
+
+desc "Build Puppet manpages"
+task :gen_manpages do
+  require 'puppet/face'
+  require 'fileutils'
+
+  helpface = Puppet::Face[:help, '0.0.1']
+  manface  = Puppet::Face[:man, '0.0.1']
+  sbins = Dir.glob(%w{sbin/*})
+  bins  = Dir.glob(%w{bin/*})
+  non_face_applications = helpface.legacy_applications
+  faces = Puppet::Face.faces
+  ronn_args = '--manual="Puppet manual" --organization="Puppet Labs, LLC" -r'
+
+  # Locate ronn
+  ronn = %x{which ronn}.chomp
+  unless File.executable?(ronn) then fail("Ronn does not appear to be installed.") end
+
+#   def write_manpage(text, filename)
+#     IO.popen("#{ronn} #{ronn_args} -r > #{filename}") do |fh| fh.write text end
+#   end
+
+  # Create puppet.conf.5 man page
+#   IO.popen("#{ronn} #{ronn_args} > ./man/man5/puppet.conf.5", 'w') do |fh|
+#     fh.write %x{RUBYLIB=./lib:$RUBYLIB bin/puppetdoc --reference configuration}
+#   end
+  %x{RUBYLIB=./lib:$RUBYLIB bin/puppetdoc --reference configuration > ./man/man5/puppetconf.5.ronn}
+  %x{#{ronn} #{ronn_args} ./man/man5/puppetconf.5.ronn}
+  FileUtils.mv("./man/man5/puppetconf.5", "./man/man5/puppet.conf.5")
+  FileUtils.rm("./man/man5/puppetconf.5.ronn")
+
+  # Create LEGACY binary man pages (i.e. delete me for 2.8.0)
+  binary = bins + sbins
+  binary.each do |bin|
+    b = bin.gsub( /^s?bin\//, "")
+    %x{RUBYLIB=./lib:$RUBYLIB #{bin} --help > ./man/man8/#{b}.8.ronn}
+    %x{#{ronn} #{ronn_args} ./man/man8/#{b}.8.ronn}
+    FileUtils.rm("./man/man8/#{b}.8.ronn")
+  end
+
+  # Create regular non-face man pages
+  non_face_applications.each do |app|
+    %x{RUBYLIB=./lib:$RUBYLIB bin/puppet #{app} --help > ./man/man8/puppet-#{app}.8.ronn}
+    %x{#{ronn} #{ronn_args} ./man/man8/puppet-#{app}.8.ronn}
+    FileUtils.rm("./man/man8/puppet-#{app}.8.ronn")
+  end
+
+  # Create face man pages
+  faces.each do |face|
+    File.open("./man/man8/puppet-#{face}.8.ronn", 'w') do |fh|
+      # For some reason no one understands at the moment, it duplicates termini,
+      # so we have to remove the dupes with a gsub.
+      fh.write manface.man("#{face}", {:render_as => :s}).gsub(/^(\* `[^`]+`)\n\1/, '\1')
+    end
+
+    %x{#{ronn} #{ronn_args} ./man/man8/puppet-#{face}.8.ronn}
+    FileUtils.rm("./man/man8/puppet-#{face}.8.ronn")
+  end
+
+  # Vile hack: create puppet resource man page
+  # Currently, the useless resource face wins against puppet resource in puppet
+  # man. (And actually, it even gets removed from the list of legacy
+  # applications.) So we overwrite it with the correct man page at the end.
+  %x{RUBYLIB=./lib:$RUBYLIB bin/puppet resource --help > ./man/man8/puppet-resource.8.ronn}
+  %x{#{ronn} #{ronn_args} ./man/man8/puppet-resource.8.ronn}
+  FileUtils.rm("./man/man8/puppet-resource.8.ronn")
+
+end

data/test/certmgr/certmgr.rb

@@ -0,0 +1,308 @@
+#!/usr/bin/env ruby
+
+require File.expand_path(File.dirname(__FILE__) + '/../lib/puppettest')
+
+require 'puppet'
+require 'puppet/sslcertificates.rb'
+require 'puppettest'
+require 'puppettest/certificates'
+require 'mocha'
+
+class TestCertMgr < Test::Unit::TestCase
+  include PuppetTest::Certificates
+  def setup
+    super
+    #@dir = File.join(Puppet[:certdir], "testing")
+    @dir = File.join(@configpath, "certest")
+    system("mkdir -p #{@dir}")
+
+    Puppet::Util::SUIDManager.stubs(:asuser).yields
+  end
+
+  def testCreateSelfSignedCertificate
+    cert = nil
+    name = "testing"
+    newcert = proc {
+
+            Puppet::SSLCertificates::Certificate.new(
+                
+        :name => name,
+        
+        :selfsign => true
+      )
+    }
+    assert_nothing_raised {
+      cert = newcert.call
+    }
+    assert_nothing_raised {
+      cert.mkselfsigned
+    }
+
+    assert_raise(Puppet::Error) {
+      cert.mkselfsigned
+    }
+
+    assert_nothing_raised {
+      cert.write
+    }
+
+    assert(FileTest.exists?(cert.certfile))
+
+    assert_nothing_raised {
+      cert.delete
+    }
+
+    assert_nothing_raised {
+      cert = newcert.call
+    }
+    assert_nothing_raised {
+      cert.mkselfsigned
+    }
+
+    assert_nothing_raised {
+      cert.delete
+    }
+
+  end
+
+  def disabled_testCreateEncryptedSelfSignedCertificate
+    cert = nil
+    name = "testing"
+    keyfile = mkPassFile
+    assert_nothing_raised {
+
+            cert = Puppet::SSLCertificates::Certificate.new(
+                
+        :name => name,
+        :selfsign => true,
+        
+        :capass => keyfile
+      )
+    }
+    assert_nothing_raised {
+      cert.mkselfsigned
+    }
+    assert_nothing_raised {
+      cert.mkhash
+    }
+
+    assert_raise(Puppet::Error) {
+      cert.mkselfsigned
+    }
+
+    assert(FileTest.exists?(cert.certfile))
+    assert(FileTest.exists?(cert.hash))
+
+    assert_nothing_raised {
+      cert.delete
+    }
+
+    assert_nothing_raised {
+      cert.mkselfsigned
+    }
+
+    assert_nothing_raised {
+      cert.delete
+    }
+
+  end
+
+  def testCreateCA
+    ca = nil
+    assert_nothing_raised {
+      ca = Puppet::SSLCertificates::CA.new
+    }
+
+    # make the CA again and verify it doesn't fail because everything
+    # still exists
+    assert_nothing_raised {
+      ca = Puppet::SSLCertificates::CA.new
+    }
+
+  end
+
+  def testSignCert
+    ca = mkCA()
+
+    cert = nil
+    assert_nothing_raised {
+
+            cert = Puppet::SSLCertificates::Certificate.new(
+                
+        :name => "signedcertest",
+        :property => "TN",
+        :city => "Nashville",
+        :country => "US",
+        :email => "luke@madstop.com",
+        :org => "Puppet",
+        :ou => "Development",
+        
+        :encrypt => mkPassFile()
+      )
+
+    }
+
+    assert_nothing_raised {
+      cert.mkcsr
+    }
+
+    signedcert = nil
+    cacert = nil
+
+    assert_nothing_raised {
+      signedcert, cacert = ca.sign(cert.csr)
+    }
+
+    assert_instance_of(OpenSSL::X509::Certificate, signedcert)
+    assert_instance_of(OpenSSL::X509::Certificate, cacert)
+
+    assert_nothing_raised {
+      cert.cert = signedcert
+      cert.cacert = cacert
+      cert.write
+    }
+    #system("find #{Puppet[:ssldir]}")
+    #system("cp -R #{Puppet[:ssldir]} /tmp/ssltesting")
+
+    output = nil
+    assert_nothing_raised {
+      output = %x{openssl verify -CAfile #{Puppet[:cacert]} -purpose sslserver #{cert.certfile}}
+      #output = %x{openssl verify -CApath #{Puppet[:certdir]} -purpose sslserver #{cert.certfile}}
+    }
+
+    assert_equal($CHILD_STATUS,0)
+    assert_equal(File.join(Puppet[:certdir], "signedcertest.pem: OK\n"), output)
+  end
+
+
+  def test_interactiveca
+    ca = nil
+
+    assert_nothing_raised {
+      ca = Puppet::SSLCertificates::CA.new
+    }
+
+    # basic initialization
+    hostname = "test.hostname.com"
+    cert = mkcert(hostname)
+
+    # create the csr
+    csr = nil
+    assert_nothing_raised {
+      csr = cert.mkcsr
+    }
+
+    assert_nothing_raised {
+      ca.storeclientcsr(csr)
+    }
+
+    # store it
+    pulledcsr = nil
+    assert_nothing_raised {
+      pulledcsr = ca.getclientcsr(hostname)
+    }
+
+    assert_equal(csr.to_pem, pulledcsr.to_pem)
+
+    signedcert = nil
+    assert_nothing_raised {
+      signedcert, cacert = ca.sign(csr)
+    }
+
+    assert_instance_of(OpenSSL::X509::Certificate, signedcert)
+    newsignedcert = nil
+    assert_nothing_raised {
+      newsignedcert, cacert = ca.getclientcert(hostname)
+    }
+
+    assert(newsignedcert)
+
+    assert_equal(signedcert.to_pem, newsignedcert.to_pem)
+  end
+
+  def test_cafailures
+    ca = mkCA()
+    cert = cacert = nil
+    assert_nothing_raised {
+      cert, cacert = ca.getclientcert("nohost")
+    }
+    assert_nil(cert)
+  end
+
+  def test_crl
+    ca = mkCA()
+    h1 = mksignedcert(ca, "host1.example.com")
+    h2 = mksignedcert(ca, "host2.example.com")
+
+    assert(ca.cert.verify(ca.cert.public_key))
+    assert(h1.verify(ca.cert.public_key))
+    assert(h2.verify(ca.cert.public_key))
+
+    crl = ca.crl
+    assert_not_nil(crl)
+
+    store = mkStore(ca)
+    assert( store.verify(ca.cert))
+    assert( store.verify(h1, [ca.cert]))
+    assert( store.verify(h2, [ca.cert]))
+
+    ca.revoke(h1.serial)
+
+    oldcert = File.read(Puppet.settings[:cacert])
+    oldserial = File.read(Puppet.settings[:serial])
+
+    # Recreate the CA from disk
+    ca = mkCA()
+    newcert = File.read(Puppet.settings[:cacert])
+    newserial = File.read(Puppet.settings[:serial])
+    assert_equal(oldcert, newcert, "The certs are not equal after making a new CA.")
+    assert_equal(oldserial, newserial, "The serials are not equal after making a new CA.")
+    store = mkStore(ca)
+    assert( store.verify(ca.cert), "Could not verify CA certs after reloading certs.")
+    assert(!store.verify(h1, [ca.cert]), "Incorrectly verified revoked cert.")
+    assert( store.verify(h2, [ca.cert]), "Could not verify certs with reloaded CA.")
+
+    ca.revoke(h2.serial)
+    assert_equal(1, ca.crl.extensions.size)
+
+    # Recreate the CA from disk
+    ca = mkCA()
+    store = mkStore(ca)
+    assert( store.verify(ca.cert))
+    assert(!store.verify(h1, [ca.cert]), "first revoked cert passed")
+    assert(!store.verify(h2, [ca.cert]), "second revoked cert passed")
+  end
+
+  def test_ttl
+    cert = mksignedcert
+    assert_equal(5 * 365 * 24 * 60 * 60,  cert.not_after - cert.not_before)
+
+    Puppet[:ca_ttl] = 7 * 24 * 60 * 60
+    cert = mksignedcert
+    assert_equal(7 * 24 * 60 * 60,  cert.not_after - cert.not_before)
+
+    Puppet[:ca_ttl] = "2y"
+    cert = mksignedcert
+    assert_equal(2 * 365 * 24 * 60 * 60,  cert.not_after - cert.not_before)
+
+    Puppet[:ca_ttl] = "2y"
+    cert = mksignedcert
+    assert_equal(2 * 365 * 24 * 60 * 60,  cert.not_after - cert.not_before)
+
+    Puppet[:ca_ttl] = "1h"
+    cert = mksignedcert
+    assert_equal(60 * 60,  cert.not_after - cert.not_before)
+
+    Puppet[:ca_ttl] = "900s"
+    cert = mksignedcert
+    assert_equal(900,  cert.not_after - cert.not_before)
+
+    # This needs to be last, to make sure that setting ca_days
+    # overrides setting ca_ttl
+    Puppet[:ca_days] = 3
+    cert = mksignedcert
+    assert_equal(3 * 24 * 60 * 60,  cert.not_after - cert.not_before)
+
+  end
+end
+

data/test/certmgr/inventory.rb

@@ -0,0 +1,69 @@
+#!/usr/bin/env ruby
+
+require File.expand_path(File.dirname(__FILE__) + '/../lib/puppettest')
+
+require 'puppet'
+require 'puppettest/certificates'
+require 'puppet/sslcertificates/inventory.rb'
+require 'mocha'
+
+class TestCertInventory < Test::Unit::TestCase
+  include PuppetTest::Certificates
+
+  Inventory = Puppet::SSLCertificates::Inventory
+
+  def setup
+    super
+    Puppet::Util::SUIDManager.stubs(:asuser).yields
+  end
+
+  def test_format
+    cert = mksignedcert
+
+    format = nil
+    assert_nothing_raised do
+      format = Inventory.format(cert)
+    end
+
+
+      assert(
+        format =~ /^0x0001 \S+ \S+ #{cert.subject}/,
+
+        "Did not create correct format")
+    end
+
+  def test_init
+    # First create a couple of certificates
+    ca = mkCA
+
+    cert1 = mksignedcert(ca, "host1.madstop.com")
+    cert2 = mksignedcert(ca, "host2.madstop.com")
+
+    init = nil
+    assert_nothing_raised do
+      init = Inventory.init
+    end
+
+    [cert1, cert2].each do |cert|
+      assert(init.include?(cert.subject.to_s), "Did not catch #{cert.subject}")
+    end
+  end
+
+  def test_add
+    ca = mkCA
+    cert = mksignedcert(ca, "host.domain.com")
+
+    assert_nothing_raised do
+      file = mock
+      file.expects(:puts).with do |written|
+        written.include? cert.subject.to_s
+      end
+      Puppet::Util::Settings.any_instance.stubs(:write)
+      Puppet::Util::Settings.any_instance.expects(:write).
+        with(:cert_inventory, 'a').yields(file)
+
+      Puppet::SSLCertificates::Inventory.add(cert)
+    end
+  end
+end
+

data/test/certmgr/support.rb

@@ -0,0 +1,105 @@
+#!/usr/bin/env ruby
+
+require File.expand_path(File.dirname(__FILE__) + '/../lib/puppettest')
+
+require 'puppettest'
+require 'puppet/sslcertificates/support'
+require 'mocha'
+
+class TestCertSupport < Test::Unit::TestCase
+  include PuppetTest
+  MissingCertificate = Puppet::SSLCertificates::Support::MissingCertificate
+
+  class CertUser
+    include Puppet::SSLCertificates::Support
+  end
+
+  def setup
+    super
+    Puppet::Util::SUIDManager.stubs(:asuser).yields
+    @user = CertUser.new
+    @ca = Puppet::SSLCertificates::CA.new
+    @client = Puppet::Network::Client.ca.new(:CA => @ca)
+  end
+
+  # Yay, metaprogramming
+  def test_keytype
+    [:key, :csr, :cert, :ca_cert].each do |name|
+      assert(Puppet::SSLCertificates::Support.method_defined?(name), "No retrieval method for #{name}")
+      maker = "mk_#{name}"
+      assert(Puppet::SSLCertificates::Support.method_defined?(maker), "No maker method for #{name}")
+    end
+  end
+
+  def test_keys
+    keys = [:hostprivkey, :hostpubkey].each { |n| Puppet[n] = tempfile }
+
+    key = nil
+    assert_nothing_raised do
+      key = @user.key
+    end
+
+    assert_logged(:info, /Creating a new SSL/, "Did not log about new key")
+    keys.each do |file|
+
+            assert(
+        FileTest.exists?(Puppet[file]),
+        
+        "Did not create #{file} key file")
+    end
+
+    # Make sure it's a valid key
+    assert_nothing_raised("Created key is invalid") do
+      OpenSSL::PKey::RSA.new(File.read(Puppet[:hostprivkey]))
+    end
+
+    # now make sure we can read it in
+    other = CertUser.new
+    assert_nothing_raised("Could not read key in") do
+      other.key
+    end
+
+    assert_equal(@user.key.to_s, other.key.to_s, "Keys are not equal")
+  end
+
+  def test_csr
+    csr = nil
+    assert_nothing_raised("Could not create csr") do
+      csr = @user.csr
+    end
+
+    assert(FileTest.exists?(Puppet[:hostcsr]), "did not create csr file")
+    assert_instance_of(OpenSSL::X509::Request, csr)
+  end
+
+  def test_cacert
+    @user = CertUser.new
+
+    assert_raise(MissingCertificate, "Did not fail when missing cacert") do
+      @user.ca_cert
+    end
+  end
+
+  # Fixing #1382.  This test will always fail on Darwin, because its
+  # FS is case-insensitive.
+  unless Facter.value(:operatingsystem) == "Darwin"
+    def test_uppercase_files_are_renamed_and_read
+      # Write a key out to disk in a file containing upper-case.
+      key = OpenSSL::PKey::RSA.new(32)
+      should_path = Puppet[:hostprivkey]
+
+      dir, file = File.split(should_path)
+      newfile = file.sub(/^([-a-z.0-9]+)\./) { $1.upcase + "."}
+      upper_path = File.join(dir, newfile)
+p upper_path
+      File.open(upper_path, "w") { |f| f.print key.to_s }
+
+      user = CertUser.new
+
+      assert_equal(key.to_s, user.read_key.to_s, "Did not read key in from disk")
+      assert(! FileTest.exist?(upper_path), "Upper case file was not removed")
+      assert(FileTest.exist?(should_path), "File was not renamed to lower-case file")
+      assert_equal(key.to_s, user.read_key.to_s, "Did not read key in from disk")
+    end
+  end
+end