puppet 2.7.26 → 3.0.0.rc4

data/spec/unit/network/http_pool_spec.rb

@@ -1,52 +1,25 @@
-#!/usr/bin/env rspec
+#! /usr/bin/env ruby -S rspec
 require 'spec_helper'
 require 'puppet/network/http_pool'
 
 describe Puppet::Network::HttpPool do
-  after do
-    Puppet::Network::HttpPool.instance_variable_set("@ssl_host", nil)
-  end
-
-  it "should use the global SSL::Host instance to get its certificate information" do
-    host = mock 'host'
-    Puppet::SSL::Host.expects(:localhost).with.returns host
-    Puppet::Network::HttpPool.ssl_host.should equal(host)
-  end
 
   describe "when managing http instances" do
-    before :each do
-      # All of the cert stuff is tested elsewhere
-      Puppet::Network::HttpPool.stubs(:cert_setup)
-    end
 
     it "should return an http instance created with the passed host and port" do
       http = Puppet::Network::HttpPool.http_instance("me", 54321)
-      http.should be_an_instance_of Net::HTTP
+      http.should be_an_instance_of Puppet::Network::HTTP::Connection
       http.address.should == 'me'
       http.port.should    == 54321
     end
 
-    it "should enable ssl on the http instance" do
+    it "should enable ssl on the http instance by default" do
       Puppet::Network::HttpPool.http_instance("me", 54321).should be_use_ssl
     end
 
-    context "proxy and timeout settings should propagate" do
-      subject { Puppet::Network::HttpPool.http_instance("me", 54321) }
-      before :each do
-        Puppet[:http_proxy_host] = "myhost"
-        Puppet[:http_proxy_port] = 432
-        Puppet[:configtimeout]   = 120
-      end
-
-      its(:open_timeout)  { should == Puppet[:configtimeout] }
-      its(:read_timeout)  { should == Puppet[:configtimeout] }
-      its(:proxy_address) { should == Puppet[:http_proxy_host] }
-      its(:proxy_port)    { should == Puppet[:http_proxy_port] }
-    end
-
-    it "should not set a proxy if the value is 'none'" do
-      Puppet[:http_proxy_host] = 'none'
-      Puppet::Network::HttpPool.http_instance("me", 54321).proxy_address.should be_nil
+    it "can set ssl using an option" do
+      Puppet::Network::HttpPool.http_instance("me", 54321, false).should_not be_use_ssl
+      Puppet::Network::HttpPool.http_instance("me", 54321, true).should be_use_ssl
     end
 
     it "should not cache http instances" do
@@ -55,86 +28,4 @@ describe Puppet::Network::HttpPool do
     end
   end
 
-  describe "when doing SSL setup for http instances" do
-    let :http do
-      http = Net::HTTP.new('localhost', 443)
-      http.use_ssl = true
-      http
-    end
-
-    let :store do stub('store') end
-
-    before :each do
-      Puppet[:hostcert]    = '/host/cert'
-      Puppet[:localcacert] = '/local/ca/cert'
-
-      cert  = stub 'cert', :content => 'real_cert'
-      key   = stub 'key',  :content => 'real_key'
-      host  = stub 'host', :certificate => cert, :key => key, :ssl_store => store
-      Puppet::Network::HttpPool.stubs(:ssl_host).returns(host)
-    end
-
-    shared_examples "HTTPS setup without all certificates" do
-      subject { Puppet::Network::HttpPool.cert_setup(http); http }
-
-      it                { should be_use_ssl }
-      its(:cert)        { should be_nil }
-      its(:ca_file)     { should be_nil }
-      its(:key)         { should be_nil }
-      its(:verify_mode) { should == OpenSSL::SSL::VERIFY_NONE }
-    end
-
-    context "with neither a host cert or a local CA cert" do
-      before :each do
-        FileTest.stubs(:exist?).with(Puppet[:hostcert]).returns(false)
-        FileTest.stubs(:exist?).with(Puppet[:localcacert]).returns(false)
-      end
-
-      include_examples "HTTPS setup without all certificates"
-    end
-
-    context "with there is no host certificate" do
-      before :each do
-        FileTest.stubs(:exist?).with(Puppet[:hostcert]).returns(false)
-        FileTest.stubs(:exist?).with(Puppet[:localcacert]).returns(true)
-      end
-
-      include_examples "HTTPS setup without all certificates"
-    end
-
-    context "with there is no local CA certificate" do
-      before :each do
-        FileTest.stubs(:exist?).with(Puppet[:hostcert]).returns(true)
-        FileTest.stubs(:exist?).with(Puppet[:localcacert]).returns(false)
-      end
-
-      include_examples "HTTPS setup without all certificates"
-    end
-
-    context "with both the host and CA cert" do
-      subject { Puppet::Network::HttpPool.cert_setup(http); http }
-
-      before :each do
-        FileTest.expects(:exist?).with(Puppet[:hostcert]).returns(true)
-        FileTest.expects(:exist?).with(Puppet[:localcacert]).returns(true)
-      end
-
-      it                { should be_use_ssl }
-      its(:cert_store)  { should equal store }
-      its(:cert)        { should == "real_cert" }
-      its(:key)         { should == "real_key" }
-      its(:verify_mode) { should == OpenSSL::SSL::VERIFY_PEER }
-      its(:ca_file)     { should == Puppet[:localcacert] }
-    end
-
-    it "should set up certificate information when creating http instances" do
-      Puppet::Network::HttpPool.expects(:cert_setup).with do |http|
-        http.should be_an_instance_of Net::HTTP
-        http.address.should == "one"
-        http.port.should == 2
-      end
-
-      Puppet::Network::HttpPool.http_instance("one", 2)
-    end
-  end
 end

data/spec/unit/network/http_spec.rb

@@ -1,4 +1,4 @@
-#!/usr/bin/env rspec
+#! /usr/bin/env ruby -S rspec
 require 'spec_helper'
 
 require 'puppet/network/http'

data/spec/unit/network/resolver_spec.rb

@@ -0,0 +1,207 @@
+#!/usr/bin/env ruby
+require 'spec_helper'
+require 'puppet/network/resolver'
+
+describe Puppet::Network::Resolver do
+  before do
+    @dns_mock_object = mock('dns')
+    Resolv::DNS.stubs(:new).returns(@dns_mock_object)
+
+    @rr_type         = Resolv::DNS::Resource::IN::SRV
+    @test_srv_domain = "domain.com"
+    @test_a_hostname = "puppet.domain.com"
+    @test_port       = 1000
+
+    # The records we should use.
+    @test_records = [
+      #                                  priority,  weight, port, hostname
+      Resolv::DNS::Resource::IN::SRV.new(0,         20,     8140, "puppet1.domain.com"),
+      Resolv::DNS::Resource::IN::SRV.new(0,         80,     8140, "puppet2.domain.com"),
+      Resolv::DNS::Resource::IN::SRV.new(1,         1,      8140, "puppet3.domain.com"),
+      Resolv::DNS::Resource::IN::SRV.new(4,         1,      8140, "puppet4.domain.com")
+    ]
+  end
+
+  describe 'when the domain is not known' do
+    before :each do
+      @dns_mock_object.stubs(:getresources).returns(@test_records)
+    end
+
+    describe 'because domain is nil' do
+      it 'does not yield' do
+        Puppet::Network::Resolver.each_srv_record(nil) do |_,_,_|
+          raise Exception.new("nil domain caused SRV lookup")
+        end
+      end
+    end
+
+    describe 'because domain is an empty string' do
+      it 'does not yield' do
+        Puppet::Network::Resolver.each_srv_record('') do |_,_,_|
+          raise Exception.new("nil domain caused SRV lookup")
+        end
+      end
+    end
+  end
+
+  describe "when resolving a host without SRV records" do
+    it "should not yield anything" do
+      # No records returned for a DNS entry without any SRV records
+      @dns_mock_object.expects(:getresources).with(
+        "_x-puppet._tcp.#{@test_a_hostname}",
+        @rr_type
+      ).returns([])
+
+      Puppet::Network::Resolver.each_srv_record(@test_a_hostname) do |hostname, port, remaining|
+        raise Exception.new("host with no records passed block")
+      end
+    end
+  end
+
+  describe "when resolving a host with SRV records" do
+    it "should iterate through records in priority order" do
+      # The order of the records that should be returned,
+      # an array means unordered (for weight)
+      order = {
+        0 => ["puppet1.domain.com", "puppet2.domain.com"],
+        1 => ["puppet3.domain.com"],
+        2 => ["puppet4.domain.com"]
+      }
+
+      @dns_mock_object.expects(:getresources).with(
+        "_x-puppet._tcp.#{@test_srv_domain}",
+        @rr_type
+      ).returns(@test_records)
+
+      Puppet::Network::Resolver.each_srv_record(@test_srv_domain) do |hostname, port|
+        expected_priority = order.keys.min
+
+        order[expected_priority].should include(hostname)
+        port.should_not be(@test_port)
+
+        # Remove the host from our expected hosts
+        order[expected_priority].delete hostname
+
+        # Remove this priority level if we're done with it
+        order.delete expected_priority if order[expected_priority] == []
+      end
+    end
+
+    it "should fall back to the :puppet service if no records are found for a more specific service" do
+      # The order of the records that should be returned,
+      # an array means unordered (for weight)
+      order = {
+        0 => ["puppet1.domain.com", "puppet2.domain.com"],
+        1 => ["puppet3.domain.com"],
+        2 => ["puppet4.domain.com"]
+      }
+
+      @dns_mock_object.expects(:getresources).with(
+        "_x-puppet-report._tcp.#{@test_srv_domain}",
+        @rr_type
+      ).returns([])
+
+      @dns_mock_object.expects(:getresources).with(
+        "_x-puppet._tcp.#{@test_srv_domain}",
+        @rr_type
+      ).returns(@test_records)
+
+      Puppet::Network::Resolver.each_srv_record(@test_srv_domain, :report) do |hostname, port|
+        expected_priority = order.keys.min
+
+        order[expected_priority].should include(hostname)
+        port.should_not be(@test_port)
+
+        # Remove the host from our expected hosts
+        order[expected_priority].delete hostname
+
+        # Remove this priority level if we're done with it
+        order.delete expected_priority if order[expected_priority] == []
+      end
+    end
+
+    it "should use SRV records from the specific service if they exist" do
+      # The order of the records that should be returned,
+      # an array means unordered (for weight)
+      order = {
+        0 => ["puppet1.domain.com", "puppet2.domain.com"],
+        1 => ["puppet3.domain.com"],
+        2 => ["puppet4.domain.com"]
+      }
+
+      bad_records = [
+        #                                  priority,  weight, port, hostname
+        Resolv::DNS::Resource::IN::SRV.new(0,         20,     8140, "puppet1.bad.domain.com"),
+        Resolv::DNS::Resource::IN::SRV.new(0,         80,     8140, "puppet2.bad.domain.com"),
+        Resolv::DNS::Resource::IN::SRV.new(1,         1,      8140, "puppet3.bad.domain.com"),
+        Resolv::DNS::Resource::IN::SRV.new(4,         1,      8140, "puppet4.bad.domain.com")
+      ]
+
+      @dns_mock_object.expects(:getresources).with(
+        "_x-puppet-report._tcp.#{@test_srv_domain}",
+        @rr_type
+      ).returns(@test_records)
+
+      @dns_mock_object.stubs(:getresources).with(
+        "_x-puppet._tcp.#{@test_srv_domain}",
+        @rr_type
+      ).returns(bad_records)
+
+      Puppet::Network::Resolver.each_srv_record(@test_srv_domain, :report) do |hostname, port|
+        expected_priority = order.keys.min
+
+        order[expected_priority].should include(hostname)
+        port.should_not be(@test_port)
+
+        # Remove the host from our expected hosts
+        order[expected_priority].delete hostname
+
+        # Remove this priority level if we're done with it
+        order.delete expected_priority if order[expected_priority] == []
+      end
+    end
+  end
+
+  describe "when finding weighted servers" do
+    it "should return nil when no records were found" do
+      Puppet::Network::Resolver.find_weighted_server([]).should == nil
+    end
+
+    it "should return the first record when one record is passed" do
+      result = Puppet::Network::Resolver.find_weighted_server([@test_records.first])
+      result.should == @test_records.first
+    end
+
+    {
+      "all have weights"  => [1, 3, 2, 4],
+      "some have weights" => [2, 0, 1, 0],
+      "none have weights" => [0, 0, 0, 0],
+    }.each do |name, weights|
+      it "should return correct results when #{name}" do
+        records = []
+        count   = 0
+        weights.each do |w|
+          count += 1
+          #                                             priority, weight, port, server
+          records << Resolv::DNS::Resource::IN::SRV.new(0,        w,      1,    count.to_s)
+        end
+
+        seen  = Hash.new(0)
+        total_weight = records.inject(0) do |sum, record|
+          sum + Puppet::Network::Resolver.weight(record)
+        end
+
+        total_weight.times do |n|
+          Kernel.expects(:rand).once.with(total_weight).returns(n)
+          server = Puppet::Network::Resolver.find_weighted_server(records)
+          seen[server] += 1
+        end
+
+        seen.length.should == records.length
+        records.each do |record|
+          seen[record].should == Puppet::Network::Resolver.weight(record)
+        end
+      end
+    end
+  end
+end

data/spec/unit/network/rights_spec.rb

@@ -1,4 +1,4 @@
-#!/usr/bin/env rspec
+#! /usr/bin/env ruby -S rspec
 require 'spec_helper'
 
 require 'puppet/network/rights'
@@ -12,10 +12,10 @@ describe Puppet::Network::Rights do
     [:find, :save].each do |allowed_method|
       it "should allow the request if only #{allowed_method} is allowed" do
         rights = Puppet::Network::Rights.new
-        rights.newright("/")
-        rights.allow("/", "*")
-        rights.restrict_method("/", allowed_method)
-        rights.restrict_authenticated("/", :any)
+        right = rights.newright("/")
+        right.allow("*")
+        right.restrict_method(allowed_method)
+        right.restrict_authenticated(:any)
         rights.is_request_forbidden_and_why?(:indirection_name, :head, "key", {}).should == nil
       end
     end
@@ -28,48 +28,10 @@ describe Puppet::Network::Rights do
     end
   end
 
-  [:allow, :deny, :restrict_method, :restrict_environment, :restrict_authenticated].each do |m|
-    it "should have a #{m} method" do
-      @right.should respond_to(m)
-    end
-
-    describe "when using #{m}" do
-      it "should delegate to the correct acl" do
-        acl = stub 'acl'
-        @right.stubs(:[]).returns(acl)
-
-        acl.expects(m).with("me")
-
-        @right.send(m, 'thisacl', "me")
-      end
-    end
-  end
-
   it "should throw an error if type can't be determined" do
     lambda { @right.newright("name") }.should raise_error
   end
 
-  describe "when creating new namespace ACLs" do
-
-    it "should throw an error if the ACL already exists" do
-      @right.newright("[name]")
-
-      lambda { @right.newright("[name]") }.should raise_error
-    end
-
-    it "should create a new ACL with the correct name" do
-      @right.newright("[name]")
-
-      @right["name"].key.should == :name
-    end
-
-    it "should create an ACL of type Puppet::Network::AuthStore" do
-      @right.newright("[name]")
-
-      @right["name"].should be_a_kind_of(Puppet::Network::AuthStore)
-    end
-  end
-
   describe "when creating new path ACLs" do
     it "should not throw an error if the ACL already exists" do
       @right.newright("/name")
@@ -129,18 +91,6 @@ describe Puppet::Network::Rights do
       @right.include?("name").should be_false
     end
 
-    it "should return true if a namespace rights exist" do
-      @right.newright("[name]")
-
-      @right.include?("name").should be_true
-    end
-
-    it "should return false if no matching namespace rights exist" do
-      @right.newright("[name]")
-
-      @right.include?("notname").should be_false
-    end
-
     it "should return true if a path right exists" do
       @right.newright("/name")
 
@@ -170,7 +120,7 @@ describe Puppet::Network::Rights do
     before :each do
       @right.stubs(:right).returns(nil)
 
-      @pathacl = stub 'pathacl', :acl_type => :regex, :"<=>" => 1, :line => 0, :file => 'dummy'
+      @pathacl = stub 'pathacl', :"<=>" => 1, :line => 0, :file => 'dummy'
       Puppet::Network::Rights::Right.stubs(:new).returns(@pathacl)
     end
 
@@ -190,33 +140,6 @@ describe Puppet::Network::Rights do
       @right.allowed?("namespace", :args1, :args2).should be_false
     end
 
-    it "should first check namespace rights" do
-      acl = stub 'acl', :acl_type => :name, :key => :namespace
-      Puppet::Network::Rights::Right.stubs(:new).returns(acl)
-
-      @right.newright("[namespace]")
-      acl.expects(:match?).returns(true)
-      acl.expects(:allowed?).with { |node,ip,h| node == "node" and ip == "ip" }.returns(true)
-
-      @right.is_forbidden_and_why?("namespace", { :node => "node", :ip => "ip" } ).should == nil
-    end
-
-    it "should then check for path rights if no namespace match" do
-      acl = stub 'nmacl', :acl_type => :name, :key => :namespace, :"<=>" => -1, :line => 0, :file => 'dummy'
-      acl.stubs(:match?).returns(false)
-      Puppet::Network::Rights::Right.stubs(:new).with("[namespace]").returns(acl)
-
-      @right.newright("[namespace]")
-      @right.newright("/path/to/there", 0, nil)
-
-      @pathacl.stubs(:match?).returns(true)
-
-      acl.expects(:allowed?).never
-      @pathacl.expects(:allowed?).returns(true)
-
-      @right.is_forbidden_and_why?("/path/to/there", {}).should == nil
-    end
-
     it "should pass the match? return to allowed?" do
       @right.newright("/path/to/there")
 
@@ -226,18 +149,12 @@ describe Puppet::Network::Rights do
       @right.is_forbidden_and_why?("/path/to/there", {}).should == nil
     end
 
-    describe "with namespace acls" do
-      it "should return an ArgumentError if this namespace right doesn't exist" do
-        lambda { @right.is_forbidden_and_why?("namespace") }.should raise_error(ArgumentError)
-      end
-    end
-
     describe "with path acls" do
       before :each do
-        @long_acl = stub 'longpathacl', :name => "/path/to/there", :acl_type => :regex, :line => 0, :file => 'dummy'
+        @long_acl = stub 'longpathacl', :name => "/path/to/there", :line => 0, :file => 'dummy'
         Puppet::Network::Rights::Right.stubs(:new).with("/path/to/there", 0, nil).returns(@long_acl)
 
-        @short_acl = stub 'shortpathacl', :name => "/path/to", :acl_type => :regex, :line => 0, :file => 'dummy'
+        @short_acl = stub 'shortpathacl', :name => "/path/to", :line => 0, :file => 'dummy'
         Puppet::Network::Rights::Right.stubs(:new).with("/path/to", 0, nil).returns(@short_acl)
 
         @long_acl.stubs(:"<=>").with(@short_acl).returns(0)
@@ -245,14 +162,14 @@ describe Puppet::Network::Rights do
       end
 
       it "should select the first match" do
-        @right.newright("/path/to/there", 0)
         @right.newright("/path/to", 0)
+        @right.newright("/path/to/there", 0)
 
         @long_acl.stubs(:match?).returns(true)
         @short_acl.stubs(:match?).returns(true)
 
-        @long_acl.expects(:allowed?).returns(true)
-        @short_acl.expects(:allowed?).never
+        @short_acl.expects(:allowed?).returns(true)
+        @long_acl.expects(:allowed?).never
 
         @right.is_forbidden_and_why?("/path/to/there/and/there", {}).should == nil
       end
@@ -308,10 +225,10 @@ describe Puppet::Network::Rights do
 
     describe "with regex acls" do
       before :each do
-        @regex_acl1 = stub 'regex_acl1', :name => "/files/(.*)/myfile", :acl_type => :regex, :line => 0, :file => 'dummy'
+        @regex_acl1 = stub 'regex_acl1', :name => "/files/(.*)/myfile", :line => 0, :file => 'dummy'
         Puppet::Network::Rights::Right.stubs(:new).with("~ /files/(.*)/myfile", 0, nil).returns(@regex_acl1)
 
-        @regex_acl2 = stub 'regex_acl2', :name => "/files/(.*)/myfile/", :acl_type => :regex, :line => 0, :file => 'dummy'
+        @regex_acl2 = stub 'regex_acl2', :name => "/files/(.*)/myfile/", :line => 0, :file => 'dummy'
         Puppet::Network::Rights::Right.stubs(:new).with("~ /files/(.*)/myfile/", 0, nil).returns(@regex_acl2)
 
         @regex_acl1.stubs(:"<=>").with(@regex_acl2).returns(0)
@@ -383,10 +300,6 @@ describe Puppet::Network::Rights do
     end
 
     describe "with path" do
-      it "should say it's a regex ACL" do
-        @acl.acl_type.should == :regex
-      end
-
       it "should match up to its path length" do
         @acl.match?("/path/that/works").should_not be_nil
       end
@@ -405,10 +318,6 @@ describe Puppet::Network::Rights do
         @acl = Puppet::Network::Rights::Right.new("~ .rb$",0, nil)
       end
 
-      it "should say it's a regex ACL" do
-        @acl.acl_type.should == :regex
-      end
-
       it "should match as a regex" do
         @acl.match?("this should work.rb").should_not be_nil
       end
@@ -461,22 +370,13 @@ describe Puppet::Network::Rights do
       end
     end
 
-    ["off", "no", "false", false].each do |auth|
-      it "should allow filtering on unauthenticated requests with '#{auth}'" do
+    ["off", "no", "false", false, "all", "any", :all, :any].each do |auth|
+      it "should allow filtering on authenticated or unauthenticated requests with '#{auth}'" do
         @acl.restrict_authenticated(auth)
-
         @acl.authentication.should be_false
       end
     end
 
-    ["all", "any", :all, :any].each do |auth|
-      it "should not use request authenticated state filtering with '#{auth}'" do
-        @acl.restrict_authenticated(auth)
-
-        @acl.authentication.should be_nil
-      end
-    end
-
     describe "when checking right authorization" do
       it "should return :dunno if this right is not restricted to the given method" do
         @acl.restrict_method(:destroy)