puppet 2.7.19 → 2.7.20.rc1

data/spec/unit/util/selinux_spec.rb

@@ -1,6 +1,7 @@
 #!/usr/bin/env rspec
 require 'spec_helper'
 
+require 'pathname'
 require 'puppet/util/selinux'
 include Puppet::Util::SELinux
 
@@ -33,7 +34,7 @@ describe Puppet::Util::SELinux do
     end
   end
 
-  describe "filesystem detection" do
+  describe "read_mounts" do
     before :each do
       fh = stub 'fh', :close => nil
       File.stubs(:open).with("/proc/mounts").returns fh
@@ -48,6 +49,17 @@ describe Puppet::Util::SELinux do
         '/proc' => 'proc',
         '/dev' => 'tmpfs' }
     end
+  end
+
+  describe "filesystem detection" do
+    before :each do
+      self.stubs(:read_mounts).returns({
+        '/'        => 'ext3',
+        '/sys'     => 'sysfs',
+        '/mnt/nfs' => 'nfs',
+        '/proc'    => 'proc',
+        '/dev'     => 'tmpfs' })
+    end
 
     it "should match a path on / to ext3" do
       find_fs('/etc/puppet/testfile').should == "ext3"
@@ -65,41 +77,21 @@ describe Puppet::Util::SELinux do
       selinux_label_support?('/mnt/nfs/testfile').should be_false
     end
 
-    it "should follow symlinks when determining file systems" do
-      self.stubs(:realpath).with('/mnt/symlink/testfile').returns('/mnt/nfs/dest/testfile')
+    it "(#8714) don't follow symlinks when determining file systems", :unless => Puppet.features.microsoft_windows? do
+      scratch = Pathname(PuppetSpec::Files.tmpdir('selinux'))
 
-      selinux_label_support?('/mnt/symlink/testfile').should be_false
-    end
+      self.stubs(:read_mounts).returns({
+          '/'             => 'ext3',
+          scratch + 'nfs' => 'nfs',
+        })
 
-  end
+      (scratch + 'foo').make_symlink('nfs/bar')
+      selinux_label_support?(scratch + 'foo').should be_true
+    end
 
-  describe "realpath" do
     it "should handle files that don't exist" do
-
-      # Since I'm stubbing Pathname.new for this test,
-      # I need to also stub the internal calls to Pathname.new,
-      # which happen in Pathname.dirname and Parthname.basename
-      # I want those to return real Pathname objects,
-      # so I'm creating them before the stub is in place.
-      realpaths = Hash.new {|hash, path| hash[path] = Pathname.new(path) }
-      paths = ['symlink', '/mnt']
-      paths.each { |path| realpaths[path] }
-
-      realpaths['/mnt/symlink'] = stubs "Pathname"
-      realpaths['/mnt/symlink'].stubs(:realpath).returns(realpaths['/mnt/nfs/dest'])
-      realpaths['/mnt/symlink'].stubs(:exist?).returns(true)
-
-      realpaths['/mnt/symlink/nonexistant'] = stubs "Pathname"
-      realpaths['/mnt/symlink/nonexistant'].stubs(:realpath).raises(Errno::ENOENT)
-      realpaths['/mnt/symlink/nonexistant'].stubs(:exist?).returns(false)
-      realpaths['/mnt/symlink/nonexistant'].stubs(:dirname).returns(realpaths['/mnt/symlink'])
-      realpaths['/mnt/symlink/nonexistant'].stubs(:basename).returns(realpaths['nonexistant'])
-
-      realpaths.each do |path, value|
-        Pathname.stubs(:new).with(path).returns(value)
-      end
-
-      realpath('/mnt/symlink/nonexistant').should == '/mnt/nfs/dest/nonexistant'
+      scratch = Pathname(PuppetSpec::Files.tmpdir('selinux'))
+      selinux_label_support?(scratch + 'nonesuch').should be_true
     end
   end
 

data/spec/unit/util/windows/sid_spec.rb

@@ -0,0 +1,100 @@
+#!/usr/bin/env ruby
+require 'spec_helper'
+
+describe "Puppet::Util::Windows::SID", :if => Puppet.features.microsoft_windows? do
+  if Puppet.features.microsoft_windows?
+    require 'puppet/util/windows'
+    class SIDTester
+      include Puppet::Util::Windows::SID
+    end
+  end
+
+  let(:subject)      { SIDTester.new }
+  let(:sid)          { Win32::Security::SID::LocalSystem }
+  let(:invalid_sid)  { 'bogus' }
+  let(:unknown_sid)  { 'S-0-0-0' }
+  let(:unknown_name) { 'chewbacca' }
+
+  context "#name_to_sid" do
+    it "should return nil if the account does not exist" do
+      subject.name_to_sid(unknown_name).should be_nil
+    end
+
+    it "should accept unqualified account name" do
+      subject.name_to_sid('SYSTEM').should == sid
+    end
+
+    it "should be case-insensitive" do
+      subject.name_to_sid('SYSTEM').should == subject.name_to_sid('system')
+    end
+
+    it "should accept domain qualified account names" do
+      subject.name_to_sid('NT AUTHORITY\SYSTEM').should == sid
+    end
+
+    it "should be the identity function for any sid" do
+      subject.name_to_sid(sid).should == sid
+    end
+  end
+
+  context "#sid_to_name" do
+    it "should return nil if given a sid for an account that doesn't exist" do
+      subject.sid_to_name(unknown_sid).should be_nil
+    end
+
+    it "should accept a sid" do
+      subject.sid_to_name(sid).should == "NT AUTHORITY\\SYSTEM"
+    end
+  end
+
+  context "#sid_ptr_to_string" do
+    it "should raise if given an invalid sid" do
+      expect {
+        subject.sid_ptr_to_string(nil)
+      }.to raise_error(Puppet::Error, /Invalid SID/)
+    end
+
+    it "should yield a valid sid pointer" do
+      string = nil
+      subject.string_to_sid_ptr(sid) do |ptr|
+        string = subject.sid_ptr_to_string(ptr)
+      end
+      string.should == sid
+    end
+  end
+
+  context "#string_to_sid_ptr" do
+    it "should yield sid_ptr" do
+      ptr = nil
+      subject.string_to_sid_ptr(sid) do |p|
+        ptr = p
+      end
+      ptr.should_not be_nil
+    end
+
+    it "should raise on an invalid sid" do
+      expect {
+        subject.string_to_sid_ptr(invalid_sid)
+      }.to raise_error(Puppet::Error, /Failed to convert string SID/)
+    end
+  end
+
+  context "#valid_sid?" do
+    it "should return true for a valid SID" do
+      subject.valid_sid?(sid).should be_true
+    end
+
+    it "should return false for an invalid SID" do
+      subject.valid_sid?(invalid_sid).should be_false
+    end
+
+    it "should raise if the conversion fails" do
+      subject.expects(:string_to_sid_ptr).with(sid).
+        raises(Puppet::Util::Windows::Error.new("Failed to convert string SID: #{sid}", Windows::Error::ERROR_ACCESS_DENIED))
+
+      expect {
+        subject.string_to_sid_ptr(sid) {|ptr| }
+      }.to raise_error(Puppet::Util::Windows::Error, /Failed to convert string SID: #{sid}/)
+    end
+  end
+end

data/spec/unit/util/zaml_spec.rb

@@ -16,43 +16,71 @@ require 'spec_helper'
 require 'puppet/util/monkey_patches'
 
 describe "Pure ruby yaml implementation" do
+  def can_round_trip(value)
+    YAML.load(value.to_yaml).should == value
+  end
+
   {
-  7            => "--- 7",
-  3.14159      => "--- 3.14159",
-  "3.14159"    => '--- "3.14159"',
-  "+3.14159"   => '--- "+3.14159"',
-  "0x123abc"   => '--- "0x123abc"',
-  "-0x123abc"  => '--- "-0x123abc"',
-  "-0x123"     => '--- "-0x123"',
-  "+0x123"     => '--- "+0x123"',
-  "0x123.456"  => "--- 0x123.456",
-  'test'       => "--- test",
-  []           => "--- []",
-  :symbol      => "--- !ruby/sym symbol",
-  {:a => "A"}  => "--- \n  !ruby/sym a: A",
-  {:a => "x\ny"} => "--- \n  !ruby/sym a: |-\n    x\n    y" 
-  }.each { |o,y|
-    it "should convert the #{o.class} #{o.inspect} to yaml" do
-      o.to_yaml.should == y
+    7            => "--- 7",
+    3.14159      => "--- 3.14159",
+    "3.14159"    => '--- "3.14159"',
+    "+3.14159"   => '--- "+3.14159"',
+    "0x123abc"   => '--- "0x123abc"',
+    "-0x123abc"  => '--- "-0x123abc"',
+    "-0x123"     => '--- "-0x123"',
+    "+0x123"     => '--- "+0x123"',
+    "0x123.456"  => '--- "0x123.456"',
+    'test'       => "--- test",
+    []           => "--- []",
+    :symbol      => "--- !ruby/sym symbol",
+    {:a => "A"}  => "--- \n  !ruby/sym a: A",
+    {:a => "x\ny"} => "--- \n  !ruby/sym a: |-\n    x\n    y"
+  }.each do |data, serialized|
+    it "should convert the #{data.class} #{data.inspect} to yaml" do
+      data.to_yaml.should == serialized
     end
-    it "should produce yaml for the #{o.class} #{o.inspect} that can be reconstituted" do
-      YAML.load(o.to_yaml).should == o
+
+    it "should produce yaml for the #{data.class} #{data.inspect} that can be reconstituted" do
+      can_round_trip data
+    end
+  end
+
+  [
+    { :a => "a:" },
+    { :a => "a:", :b => "b:" },
+    ["a:", "b:"],
+    { :a => "/:", :b => "/:" },
+    { :a => "a/:", :b => "a/:" },
+    { :a => "\"" },
+    { :a => {}.to_yaml },
+    { :a => [].to_yaml },
+    { :a => "".to_yaml },
+    { :a => :a.to_yaml },
+
+    { "a:" => "b" },
+    { :a.to_yaml => "b" },
+    { [1, 2, 3] => "b" },
+    { "b:" => { "a" => [] } }
+  ].each do |value|
+    it "properly escapes #{value.inspect}, which contains YAML characters" do
+      can_round_trip value
     end
-  }
+  end
+
   #
   # Can't test for equality on raw objects
   {
-  Object.new                   => "--- !ruby/object {}",
-  [Object.new]                 => "--- \n  - !ruby/object {}",
-  {Object.new => Object.new}   => "--- \n  ? !ruby/object {}\n  : !ruby/object {}"
-  }.each { |o,y|
+    Object.new                   => "--- !ruby/object {}",
+    [Object.new]                 => "--- \n  - !ruby/object {}",
+    {Object.new => Object.new}   => "--- \n  ? !ruby/object {}\n  : !ruby/object {}"
+  }.each do |o,y|
     it "should convert the #{o.class} #{o.inspect} to yaml" do
       o.to_yaml.should == y
     end
     it "should produce yaml for the #{o.class} #{o.inspect} that can be reconstituted" do
       lambda { YAML.load(o.to_yaml) }.should_not raise_error
     end
-  }
+  end
 
   it "should emit proper labels and backreferences for common objects" do
     # Note: this test makes assumptions about the names ZAML chooses
@@ -104,3 +132,115 @@ describe "UTF-8 encoded String#to_yaml (Bug #11246)" do
     end
   end
 end
+
+describe "binary data" do
+  subject { "M\xC0\xDF\xE5tt\xF6" }
+
+  if String.method_defined?(:encoding)
+    def binary(str)
+      str.force_encoding('binary')
+    end
+  else
+    def binary(str)
+      str
+    end
+  end
+
+  it "should not explode encoding binary data" do
+    expect { subject.to_yaml }.not_to raise_error
+  end
+
+  it "should mark the binary data as binary" do
+    subject.to_yaml.should =~ /!binary/
+  end
+
+  it "should round-trip the data" do
+    yaml = subject.to_yaml
+    read = YAML.load(yaml)
+    binary(read).should == binary(subject)
+  end
+
+  [
+    "\xC0\xAE",                 # over-long UTF-8 '.' character
+    "\xC0\x80",                 # over-long NULL byte
+    "\xC0\xFF",
+    "\xC1\xAE",
+    "\xC1\x80",
+    "\xC1\xFF",
+    "\x80",                     # first continuation byte
+    "\xbf",                     # last continuation byte
+    # all possible continuation bytes in one shot
+    "\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8A\x8B\x8C\x8D\x8E\x8F" +
+    "\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9A\x9B\x9C\x9D\x9E\x9F" +
+    "\xA0\xA1\xA2\xA3\xA4\xA5\xA6\xA7\xA8\xA9\xAA\xAB\xAC\xAD\xAE\xAF" +
+    "\xB0\xB1\xB2\xB3\xB4\xB5\xB6\xB7\xB8\xB9\xBA\xBB\xBC\xBD\xBE\xBF",
+    # lonely start characters - first, all possible two byte sequences
+    "\xC0 \xC1 \xC2 \xC3 \xC4 \xC5 \xC6 \xC7 \xC8 \xC9 \xCA \xCB \xCC \xCD \xCE \xCF " +
+    "\xD0 \xD1 \xD2 \xD3 \xD4 \xD5 \xD6 \xD7 \xD8 \xD9 \xDA \xDB \xDC \xDD \xDE \xDF ",
+    # and so for three byte sequences, four, five, and six, as follow.
+    "\xE0 \xE1 \xE2 \xE3 \xE4 \xE5 \xE6 \xE7 \xE8 \xE9 \xEA \xEB \xEC \xED \xEE \xEF ",
+    "\xF0 \xF1 \xF2 \xF3 \xF4 \xF5 \xF6 \xF7 ",
+    "\xF8 \xF9 \xFA \xFB ",
+    "\xFC \xFD ",
+    # sequences with the last byte missing
+    "\xC0", "\xE0", "\xF0\x80\x80", "\xF8\x80\x80\x80", "\xFC\x80\x80\x80\x80",
+    "\xDF", "\xEF\xBF", "\xF7\xBF\xBF", "\xFB\xBF\xBF\xBF", "\xFD\xBF\xBF\xBF\xBF",
+    # impossible bytes
+    "\xFE", "\xFF", "\xFE\xFE\xFF\xFF",
+    # over-long '/' character
+    "\xC0\xAF",
+    "\xE0\x80\xAF",
+    "\xF0\x80\x80\xAF",
+    "\xF8\x80\x80\x80\xAF",
+    "\xFC\x80\x80\x80\x80\xAF",
+    # maximum overlong sequences
+    "\xc1\xbf",
+    "\xe0\x9f\xbf",
+    "\xf0\x8f\xbf\xbf",
+    "\xf8\x87\xbf\xbf\xbf",
+    "\xfc\x83\xbf\xbf\xbf\xbf",
+    # overlong NUL
+    "\xc0\x80",
+    "\xe0\x80\x80",
+    "\xf0\x80\x80\x80",
+    "\xf8\x80\x80\x80\x80",
+    "\xfc\x80\x80\x80\x80\x80",
+  ].each do |input|
+    # It might seem like we should more correctly reject these sequences in
+    # the encoder, and I would personally agree, but the sad reality is that
+    # we do not distinguish binary and textual data in our language, and so we
+    # wind up with the same thing - a string - containing both.
+    #
+    # That leads to the position where we must treat these invalid sequences,
+    # which are both legitimate binary content, and illegitimate potential
+    # attacks on the system, as something that passes through correctly in
+    # a string. --daniel 2012-07-14
+    it "binary encode highly dubious non-compliant UTF-8 input #{input.inspect}" do
+      encoded = ZAML.dump(binary(input))
+      encoded.should =~ /!binary/
+      YAML.load(encoded).should == input
+    end
+  end
+end
+
+describe "multi-line values" do
+  [
+    "none",
+    "one\n",
+    "two\n\n",
+    ["one\n", "two"],
+    ["two\n\n", "three"],
+    { "\nkey"        => "value" },
+    { "key\n"        => "value" },
+    { "\nkey\n"      => "value" },
+    { "key\nkey"     => "value" },
+    { "\nkey\nkey"   => "value" },
+    { "key\nkey\n"   => "value" },
+    { "\nkey\nkey\n" => "value" },
+  ].each do |input|
+    it "handles #{input.inspect} without corruption" do
+      zaml = ZAML.dump(input)
+      YAML.load(zaml).should == input
+    end
+  end
+end

data/spec/unit/util_spec.rb

@@ -394,7 +394,9 @@ describe Puppet::Util do
           Process.expects(:CloseHandle).with(thread_handle)
           Process.expects(:CloseHandle).with(process_handle)
 
-          expect { Puppet::Util.execute('test command') }.should raise_error(RuntimeError)
+          expect {
+            Puppet::Util.execute('test command')
+          }.to raise_error(RuntimeError)
         end
       end
     end
@@ -691,14 +693,6 @@ describe Puppet::Util do
         newhash.should == resulthash
       end
     end
-
-    describe "#symbolizehash!" do
-      it "should symbolize the hash in place" do
-        localhash = myhash
-        Puppet::Util.symbolizehash!(localhash)
-        localhash.should == resulthash
-      end
-    end
   end
 
   context "#replace_file" do

data/spec/watchr.rb

@@ -80,13 +80,9 @@ end
 def run_spec_files(files)
   files = Array(files)
   return if files.empty?
-  if File.exist?(File.expand_path("~/.rspec")) then
-    opts = ''                   # use the user defaults
-  else
-    opts = File.readlines('spec/spec.opts').collect { |l| l.chomp }.join(" ")
-  end
   begin
-    run_spec("rspec #{opts} --tty #{files.join(' ')}")
+    # End users can put additional options into ~/.rspec
+    run_spec("rspec --tty #{files.join(' ')}")
   rescue => detail
     puts "Failed to load #{files}: #{detail}"
   end

data/tasks/rake/gem.rake

@@ -1,4 +1,5 @@
 require 'fileutils'
+require 'puppet/version'
 
 GEM_FILES = FileList[
     '[A-Z]*',
@@ -20,13 +21,14 @@ EXECUTABLES = FileList[
 ]
 
 SBIN = Dir.glob("sbin/*")
+GEMVERSION = Puppet.version.gsub('-','.')
 
 spec = Gem::Specification.new do |spec|
     spec.platform = Gem::Platform::RUBY
     spec.name = 'puppet'
     spec.files = GEM_FILES.to_a
     spec.executables = EXECUTABLES.gsub(/sbin\/|bin\//, '').to_a
-    spec.version = Puppet::PUPPETVERSION
+    spec.version = GEMVERSION
     spec.add_dependency('facter', '~> 1.5')
     spec.summary = 'Puppet, an automated configuration management tool'
     spec.description = 'Puppet, an automated configuration management tool'
@@ -52,7 +54,7 @@ desc "Create the gem"
 task :create_gem => :prepare_gem do
     Dir.mkdir("pkg") rescue nil
     Gem::Builder.new(spec).build
-    FileUtils.move("puppet-#{Puppet::PUPPETVERSION}.gem", "pkg")
+    FileUtils.move("puppet-#{GEMVERSION}.gem", "pkg")
     SBIN.each do |f|
        fn = f.gsub(/sbin\/(.*)/, '\1')
        FileUtils.rm_r "bin/" + fn