puppet 2.7.26 → 3.0.0.rc4

data/spec/integration/faces/documentation_spec.rb

@@ -1,4 +1,4 @@
-#!/usr/bin/env rspec
+#! /usr/bin/env ruby -S rspec
 require 'spec_helper'
 require 'puppet/face'
 
@@ -14,42 +14,49 @@ describe "documentation of faces" do
   # Can we actually generate documentation for the face, and the actions it
   # has?  This avoids situations where the ERB template turns out to have a
   # bug in it, triggered in something the user might do.
-  Puppet::Face.faces.sort.each do |face_name|
-    # REVISIT: We should walk all versions of the face here...
-    let :help do Puppet::Face[:help, :current] end
-
-    context "generating help" do
-      it "for #{face_name}" do
-        expect {
-          text = help.help(face_name)
-          text.should be_an_instance_of String
-          text.length.should be > 100
-        }.not_to raise_error
-      end
 
-      Puppet::Face[face_name, :current].actions.sort.each do |action_name|
-        it "for #{face_name}.#{action_name}" do
+  context "face help messages" do
+    # we need to set a bunk module path here, because without doing so,
+    #  the autoloader will try to use it before it is initialized.
+    Puppet[:modulepath] = "/dev/null"
+
+    Puppet::Face.faces.sort.each do |face_name|
+      # REVISIT: We should walk all versions of the face here...
+      let :help do Puppet::Face[:help, :current] end
+
+      context "generating help" do
+        it "for #{face_name}" do
           expect {
-            text = help.help(face_name, action_name)
+            text = help.help(face_name)
             text.should be_an_instance_of String
             text.length.should be > 100
           }.not_to raise_error
         end
+
+        Puppet::Face[face_name, :current].actions.sort.each do |action_name|
+          it "for #{face_name}.#{action_name}" do
+            expect {
+              text = help.help(face_name, action_name)
+              text.should be_an_instance_of String
+              text.length.should be > 100
+            }.not_to raise_error
+          end
+        end
       end
-    end
 
-    ########################################################################
-    # Ensure that we have authorship and copyright information in *our* faces;
-    # if you apply this to third party faces you might well be disappointed.
-    context "licensing of Puppet Labs face '#{face_name}'" do
-      subject { Puppet::Face[face_name, :current] }
-      its :license   do should =~ /Apache\s*2/ end
-      its :copyright do should =~ /Puppet Labs/ end
-
-      # REVISIT: This is less that ideal, I think, but right now I am more
-      # comfortable watching us ship with some copyright than without any; we
-      # can redress that when it becomes appropriate. --daniel 2011-04-27
-      its :copyright do should =~ /20\d{2}/ end
+      ########################################################################
+      # Ensure that we have authorship and copyright information in *our* faces;
+      # if you apply this to third party faces you might well be disappointed.
+      context "licensing of Puppet Labs face '#{face_name}'" do
+        subject { Puppet::Face[face_name, :current] }
+        its :license   do should =~ /Apache\s*2/ end
+        its :copyright do should =~ /Puppet Labs/ end
+
+        # REVISIT: This is less that ideal, I think, but right now I am more
+        # comfortable watching us ship with some copyright than without any; we
+        # can redress that when it becomes appropriate. --daniel 2011-04-27
+        its :copyright do should =~ /20\d{2}/ end
+      end
     end
   end
 end

data/spec/integration/file_serving/content_spec.rb

@@ -1,5 +1,4 @@
-#!/usr/bin/env rspec
-
+#! /usr/bin/env ruby -S rspec
 require 'spec_helper'
 
 require 'puppet/file_serving/content'

data/spec/integration/file_serving/fileset_spec.rb

@@ -1,4 +1,4 @@
-#!/usr/bin/env rspec
+#! /usr/bin/env ruby -S rspec
 require 'spec_helper'
 
 require 'puppet/file_serving/fileset'

data/spec/integration/file_serving/metadata_spec.rb

@@ -1,5 +1,4 @@
-#!/usr/bin/env rspec
-
+#! /usr/bin/env ruby -S rspec
 require 'spec_helper'
 
 require 'puppet/file_serving/metadata'

data/spec/integration/file_serving/terminus_helper_spec.rb

@@ -1,4 +1,4 @@
-#!/usr/bin/env rspec
+#! /usr/bin/env ruby -S rspec
 require 'spec_helper'
 
 require 'puppet/file_serving/terminus_helper'

data/spec/integration/indirector/catalog/compiler_spec.rb

@@ -1,4 +1,4 @@
-#!/usr/bin/env rspec
+#! /usr/bin/env ruby -S rspec
 require 'spec_helper'
 
 require 'puppet/resource/catalog'
@@ -11,7 +11,6 @@ describe Puppet::Resource::Catalog::Compiler do
     @catalog = Puppet::Resource::Catalog.new
     @catalog.add_resource(@one = Puppet::Resource.new(:file, "/one"))
     @catalog.add_resource(@two = Puppet::Resource.new(:file, "/two"))
-    Puppet::Resource::Catalog.indirection.terminus.stubs(:validate)
   end
 
   after { Puppet.settings.clear }

data/spec/integration/indirector/catalog/queue_spec.rb

@@ -1,4 +1,4 @@
-#!/usr/bin/env rspec
+#! /usr/bin/env ruby -S rspec
 require 'spec_helper'
 
 require 'puppet/resource/catalog'
@@ -6,7 +6,7 @@ require 'puppet/resource/catalog'
 describe "Puppet::Resource::Catalog::Queue", :if => Puppet.features.pson? do
   before do
     Puppet::Resource::Catalog.indirection.terminus(:queue)
-    @catalog = Puppet::Resource::Catalog.new("foo")
+    @catalog = Puppet::Resource::Catalog.new
 
     @one = Puppet::Resource.new(:file, "/one")
     @two = Puppet::Resource.new(:file, "/two")
@@ -27,7 +27,7 @@ describe "Puppet::Resource::Catalog::Queue", :if => Puppet.features.pson? do
 
     client.expects(:publish_message).with(:catalog, @catalog.to_pson)
 
-    request = Puppet::Indirector::Request.new(:catalog, :save, "foo", :instance => @catalog)
+    request = Puppet::Indirector::Request.new(:catalog, :save, "foo", @catalog)
 
     terminus.save(request)
   end

data/spec/integration/indirector/direct_file_server_spec.rb

@@ -1,9 +1,9 @@
-#!/usr/bin/env rspec
+#! /usr/bin/env ruby -S rspec
 require 'spec_helper'
 
 require 'puppet/indirector/file_content/file'
 
-describe Puppet::Indirector::DirectFileServer, " when interacting with the filesystem and the model", :fails_on_windows => true do
+describe Puppet::Indirector::DirectFileServer, " when interacting with the filesystem and the model" do
   include PuppetSpec::Files
 
   before do
@@ -14,19 +14,23 @@ describe Puppet::Indirector::DirectFileServer, " when interacting with the files
   end
 
   it "should return an instance of the model" do
-    FileTest.expects(:exists?).with(@filepath).returns(true)
+    pending("porting to Windows", :if => Puppet.features.microsoft_windows?) do
+      FileTest.expects(:exists?).with(@filepath).returns(true)
 
-    @terminus.find(@terminus.indirection.request(:find, "file://host#{@filepath}")).should be_instance_of(Puppet::FileServing::Content)
+      @terminus.find(@terminus.indirection.request(:find, "file://host#{@filepath}", nil)).should be_instance_of(Puppet::FileServing::Content)
+    end
   end
 
   it "should return an instance capable of returning its content" do
-    FileTest.expects(:exists?).with(@filepath).returns(true)
-    File.stubs(:lstat).with(@filepath).returns(stub("stat", :ftype => "file"))
-    IO.expects(:binread).with(@filepath).returns("my content")
+    pending("porting to Windows", :if => Puppet.features.microsoft_windows?) do
+      FileTest.expects(:exists?).with(@filepath).returns(true)
+      File.stubs(:lstat).with(@filepath).returns(stub("stat", :ftype => "file"))
+      IO.expects(:binread).with(@filepath).returns("my content")
 
-    instance = @terminus.find(@terminus.indirection.request(:find, "file://host#{@filepath}"))
+      instance = @terminus.find(@terminus.indirection.request(:find, "file://host#{@filepath}", nil))
 
-    instance.content.should == "my content"
+      instance.content.should == "my content"
+    end
   end
 end
 
@@ -41,7 +45,7 @@ describe Puppet::Indirector::DirectFileServer, " when interacting with FileServi
     File.open(File.join(path, "one"), "w") { |f| f.print "one content" }
     File.open(File.join(path, "two"), "w") { |f| f.print "two content" }
 
-    @request = @terminus.indirection.request(:search, "file:///#{path}", :recurse => true)
+    @request = @terminus.indirection.request(:search, "file:///#{path}", nil, :recurse => true)
   end
 
   it "should return an instance for every file in the fileset" do

data/spec/integration/indirector/facts/facter_spec.rb

@@ -0,0 +1,22 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper'
+
+require 'puppet_spec/compiler'
+
+describe Puppet::Node::Facts::Facter do
+  include PuppetSpec::Compiler
+
+  it "preserves case in fact values" do
+    Facter.add(:downcase_test) do
+      setcode do
+        "AaBbCc"
+      end
+    end
+
+    Facter.stubs(:clear)
+
+    cat = compile_to_catalog('notify { $downcase_test: }',
+                             Puppet::Node.indirection.find('foo'))
+    cat.resource("Notify[AaBbCc]").should be
+  end
+end

data/spec/integration/indirector/file_content/file_server_spec.rb

@@ -1,4 +1,4 @@
-#!/usr/bin/env rspec
+#! /usr/bin/env ruby -S rspec
 require 'spec_helper'
 
 require 'puppet/indirector/file_content/file_server'

data/spec/integration/indirector/file_metadata/file_server_spec.rb

@@ -1,4 +1,4 @@
-#!/usr/bin/env rspec
+#! /usr/bin/env ruby -S rspec
 require 'spec_helper'
 
 require 'puppet/indirector/file_metadata/file_server'

data/spec/integration/indirector/node/ldap_spec.rb

@@ -1,4 +1,4 @@
-#!/usr/bin/env rspec
+#! /usr/bin/env ruby -S rspec
 require 'spec_helper'
 
 require 'puppet/indirector/node/ldap'

data/spec/integration/network/authconfig_spec.rb

@@ -0,0 +1,238 @@
+require 'spec_helper'
+
+require 'puppet/network/authconfig'
+require 'puppet/network/auth_config_parser'
+
+RSpec::Matchers.define :allow do |params|
+
+  match do |auth|
+    begin
+      auth.check_authorization(params[0], params[1], params[2], params[3])
+      true
+    rescue Puppet::Network::AuthorizationError
+      false
+    end
+  end
+
+  failure_message_for_should do |instance|
+    "expected #{params[3][:node]}/#{params[3][:ip]} to be allowed"
+  end
+
+  failure_message_for_should_not do |instance|
+    "expected #{params[3][:node]}/#{params[3][:ip]} to be forbidden"
+  end
+end
+
+describe Puppet::Network::AuthConfig do
+  include PuppetSpec::Files
+
+  def add_rule(rule)
+    parser = Puppet::Network::AuthConfigParser.new(
+      "path /test\n#{rule}\n"
+    )
+    @auth = parser.parse
+  end
+
+  def add_regex_rule(regex, rule)
+    parser = Puppet::Network::AuthConfigParser.new(
+      "path ~ #{regex}\n#{rule}\n"
+    )
+    @auth = parser.parse
+  end
+
+  def request(args = {})
+    args = {
+      :key => 'key',
+      :node => 'host.domain.com',
+      :ip => '10.1.1.1',
+      :authenticated => true
+    }.merge(args)
+    ['test', :find, args[:key], args]
+  end
+
+  describe "allow" do
+    it "should not match IP addresses" do
+      add_rule("allow 10.1.1.1")
+
+      @auth.should_not allow(request)
+    end
+
+    it "should not accept CIDR IPv4 address" do
+      expect {
+        add_rule("allow 10.0.0.0/8")
+      }.to raise_error Puppet::ConfigurationError, /Invalid pattern 10\.0\.0\.0\/8/
+    end
+
+    it "should not match wildcard IPv4 address" do
+      expect {
+        add_rule("allow 10.1.1.*")
+      }.to raise_error Puppet::ConfigurationError, /Invalid pattern 10\.1\.1\.*/
+    end
+
+    it "should not match IPv6 address" do
+      expect {
+        add_rule("allow 2001:DB8::8:800:200C:417A")
+      }.to raise_error Puppet::ConfigurationError, /Invalid pattern 2001/
+    end
+
+    it "should support hostname" do
+      add_rule("allow host.domain.com")
+
+      @auth.should allow(request)
+    end
+
+    it "should support wildcard host" do
+      add_rule("allow *.domain.com")
+
+      @auth.should allow(request)
+    end
+
+    it "should support hostname backreferences" do
+      add_regex_rule('^/test/([^/]+)$', "allow $1.domain.com")
+
+      @auth.should allow(request(:key => 'host'))
+    end
+
+    it "should support opaque strings" do
+      add_rule("allow this-is-opaque@or-not")
+
+      @auth.should allow(request(:node => 'this-is-opaque@or-not'))
+    end
+
+    it "should support opaque strings and backreferences" do
+      add_regex_rule('^/test/([^/]+)$', "allow $1")
+
+      @auth.should allow(request(:key => 'this-is-opaque@or-not', :node => 'this-is-opaque@or-not'))
+    end
+
+    it "should support hostname ending with '.'" do
+      pending('bug #7589')
+      add_rule("allow host.domain.com.")
+
+      @auth.should allow(request(:node => 'host.domain.com.'))
+    end
+
+    it "should support hostname ending with '.' and backreferences" do
+      pending('bug #7589')
+      add_regex_rule('^/test/([^/]+)$',"allow $1")
+
+      @auth.should allow(request(:node => 'host.domain.com.'))
+    end
+
+    it "should support trailing whitespace" do
+      add_rule('allow host.domain.com    ')
+
+      @auth.should allow(request)
+    end
+
+    it "should support inlined comments" do
+      add_rule('allow host.domain.com # will it work?')
+
+      @auth.should allow(request)
+    end
+
+    it "should deny non-matching host" do
+      add_rule("allow inexistant")
+
+      @auth.should_not allow(request)
+    end
+  end
+
+  describe "allow_ip" do
+    it "should not warn when matches against IP addresses fail" do
+      add_rule("allow_ip 10.1.1.2")
+
+      @auth.should_not allow(request)
+
+      @logs.should_not be_any {|log| log.level == :warning and log.message =~ /Authentication based on IP address is deprecated/}
+    end
+
+    it "should support IPv4 address" do
+      add_rule("allow_ip 10.1.1.1")
+
+      @auth.should allow(request)
+    end
+
+    it "should support CIDR IPv4 address" do
+      add_rule("allow_ip 10.0.0.0/8")
+
+      @auth.should allow(request)
+    end
+
+    it "should support wildcard IPv4 address" do
+      add_rule("allow_ip 10.1.1.*")
+
+      @auth.should allow(request)
+    end
+
+    it "should support IPv6 address" do
+      add_rule("allow_ip 2001:DB8::8:800:200C:417A")
+
+      @auth.should allow(request(:ip => '2001:DB8::8:800:200C:417A'))
+    end
+
+    it "should support hostname" do
+      expect {
+        add_rule("allow_ip host.domain.com")
+      }.to raise_error Puppet::ConfigurationError, /Invalid IP pattern host.domain.com/
+    end
+  end
+
+  describe "deny" do
+    it "should deny denied hosts" do
+      add_rule <<-EOALLOWRULE
+        deny host.domain.com
+        allow *.domain.com
+      EOALLOWRULE
+
+      @auth.should_not allow(request)
+    end
+
+    it "denies denied hosts after allowing them" do
+      add_rule <<-EOALLOWRULE
+        allow *.domain.com
+        deny host.domain.com
+      EOALLOWRULE
+
+      @auth.should_not allow(request)
+    end
+
+    it "should not deny based on IP" do
+      add_rule <<-EOALLOWRULE
+        deny 10.1.1.1
+        allow host.domain.com
+      EOALLOWRULE
+
+      @auth.should allow(request)
+    end
+
+    it "should not deny based on IP (ordering #2)" do
+      add_rule <<-EOALLOWRULE
+        allow host.domain.com
+        deny 10.1.1.1
+      EOALLOWRULE
+
+      @auth.should allow(request)
+    end
+  end
+
+  describe "deny_ip" do
+    it "should deny based on IP" do
+      add_rule <<-EOALLOWRULE
+        deny_ip 10.1.1.1
+        allow host.domain.com
+      EOALLOWRULE
+
+      @auth.should_not allow(request)
+    end
+
+    it "should deny based on IP (ordering #2)" do
+      add_rule <<-EOALLOWRULE
+        allow host.domain.com
+        deny_ip 10.1.1.1
+      EOALLOWRULE
+
+      @auth.should_not allow(request)
+    end
+  end
+end