puppet 3.2.4 → 3.3.0.rc2

data/spec/unit/ssl/certificate_authority_spec.rb

@@ -333,7 +333,7 @@ describe Puppet::SSL::CertificateAuthority do
 
         expect do
           @ca.sign(@name, false, @request)
-        end.not_to raise_error(Puppet::SSL::CertificateAuthority::CertificateSigningError)
+        end.not_to raise_error
       end
 
       it "should save the resulting certificate" do
@@ -748,6 +748,13 @@ describe Puppet::SSL::CertificateAuthority do
       @ca.list.should == %w{cert1 cert2}
     end
 
+    it "should list the full certificates" do
+      cert1 = stub 'cert1', :name => "cert1"
+      cert2 = stub 'cert2', :name => "cert2"
+      Puppet::SSL::Certificate.indirection.expects(:search).with("*").returns [cert1, cert2]
+      @ca.list_certificates.should == [cert1, cert2]
+    end
+
     describe "and printing certificates" do
       it "should return nil if the certificate cannot be found" do
         Puppet::SSL::Certificate.indirection.expects(:find).with("myhost").returns nil
@@ -860,6 +867,35 @@ describe Puppet::SSL::CertificateAuthority do
 
         expect { @ca.verify("me") }.to raise_error
       end
+
+      describe "certificate_is_alive?" do
+        it "should return false if verification fails" do
+          @cert.expects(:content).returns "mycert"
+
+          @store.expects(:verify).with("mycert").returns false
+
+          @ca.certificate_is_alive?(@cert).should be_false
+        end
+
+        it "should return true if verification passes" do
+          @cert.expects(:content).returns "mycert"
+
+          @store.expects(:verify).with("mycert").returns true
+
+          @ca.certificate_is_alive?(@cert).should be_true
+        end
+
+        it "should used a cached instance of the x509 store" do
+          OpenSSL::X509::Store.stubs(:new).returns(@store).once
+
+          @cert.expects(:content).returns "mycert"
+
+          @store.expects(:verify).with("mycert").returns true
+
+          @ca.certificate_is_alive?(@cert)
+          @ca.certificate_is_alive?(@cert)
+        end
+      end
     end
 
     describe "and revoking certificates" do
@@ -935,37 +971,137 @@ describe Puppet::SSL::CertificateAuthority do
     it "should be able to generate a complete new SSL host" do
       @ca.should respond_to(:generate)
     end
+  end
+end
 
-    describe "and generating certificates" do
-      before do
-        @host = stub 'host', :generate_certificate_request => nil
-        Puppet::SSL::Host.stubs(:new).returns @host
-        Puppet::SSL::Certificate.indirection.stubs(:find).returns nil
+require 'puppet/indirector/memory'
+
+describe "CertificateAuthority.generate" do
+
+  def expect_to_increment_serial_file
+    Puppet.settings.expects(:readwritelock).with(:serial)
+  end
+
+  def expect_to_sign_a_cert
+    expect_to_increment_serial_file
+    Puppet.settings.expects(:write).with(:cert_inventory, "a")
+  end
+
+  def expect_to_write_the_ca_password
+    Puppet.settings.expects(:write).with(:capass)
+  end
+
+  def expect_ca_initialization
+    expect_to_write_the_ca_password
+    expect_to_sign_a_cert
+  end
+
+  def avoid_rebuilding_inventory_for_every_cert
+    Puppet::SSL::Inventory.any_instance.stubs(:rebuild)
+  end
 
-        @ca.stubs(:sign)
+  INDIRECTED_CLASSES = [
+    Puppet::SSL::Certificate,
+    Puppet::SSL::CertificateRequest,
+    Puppet::SSL::CertificateRevocationList,
+    Puppet::SSL::Key,
+  ]
+
+  INDIRECTED_CLASSES.each do |const|
+    class const::Memory < Puppet::Indirector::Memory
+
+      # @return Array of all the indirector's values
+      #
+      # This mirrors Puppet::Indirector::SslFile#search which returns all files
+      # in the directory.
+      def search(request)
+        return @instances.values
+      end
+    end
+  end
+
+  before do
+    avoid_rebuilding_inventory_for_every_cert
+    INDIRECTED_CLASSES.each { |const| const.indirection.terminus_class = :memory }
+  end
+
+  after do
+    INDIRECTED_CLASSES.each do |const|
+      const.indirection.terminus_class = :file
+      const.indirection.termini.clear
+    end
+  end
+
+  describe "when generating certificates" do
+    let(:ca) { Puppet::SSL::CertificateAuthority.new }
+
+    before do
+      expect_ca_initialization 
+    end
+
+    it "should fail if a certificate already exists for the host" do
+      cert = Puppet::SSL::Certificate.new('pre.existing')
+      Puppet::SSL::Certificate.indirection.save(cert)
+      expect { ca.generate(cert.name) }.to raise_error(ArgumentError, /a certificate already exists/i)
+    end
+
+    describe "that do not yet exist" do
+      let(:cn) { "new.host" }
+
+      def expect_cert_does_not_exist(cn)
+        expect( Puppet::SSL::Certificate.indirection.find(cn) ).to be_nil
       end
 
-      it "should fail if a certificate already exists for the host" do
-        Puppet::SSL::Certificate.indirection.expects(:find).with("him").returns "something"
+      before do
+        expect_to_sign_a_cert
+        expect_cert_does_not_exist(cn)
+      end
 
-        expect { @ca.generate("him") }.to raise_error(ArgumentError)
+      it "should return the created certificate" do
+        cert = ca.generate(cn)
+        expect( cert ).to be_kind_of(Puppet::SSL::Certificate)
+        expect( cert.name ).to eq(cn)
       end
 
-      it "should create a new Host instance with the correct name" do
-        Puppet::SSL::Host.expects(:new).with("him").returns @host
+      it "should not have any subject_alt_names by default" do
+        cert = ca.generate(cn)
+        expect( cert.subject_alt_names ).to be_empty
+      end
 
-        @ca.generate("him")
+      it "should have subject_alt_names if passed dns_alt_names" do
+        cert = ca.generate(cn, :dns_alt_names => 'foo,bar')
+        expect( cert.subject_alt_names ).to match_array(["DNS:#{cn}",'DNS:foo','DNS:bar'])
       end
 
-      it "should use the Host to generate the certificate request" do
-        @host.expects :generate_certificate_request
+      context "if autosign is false" do
+        before do
+          Puppet[:autosign] = false
+        end
 
-        @ca.generate("him")
+        it "should still generate and explicitly sign the request" do
+          cert = nil
+          cert = ca.generate(cn)
+          expect(cert.name).to eq(cn)
+        end
       end
 
-      it "should sign the generated request" do
-        @ca.expects(:sign).with("him", false)
-        @ca.generate("him")
+      context "if autosign is true (Redmine #6112)" do
+
+        def run_mode_must_be_master_for_autosign_to_be_attempted
+          Puppet.stubs(:run_mode).returns(Puppet::Util::RunMode[:master])
+        end
+
+        before do
+          Puppet[:autosign] = true
+          run_mode_must_be_master_for_autosign_to_be_attempted
+          Puppet::Util::Log.level = :info
+        end
+
+        it "should generate a cert without attempting to sign again" do
+          cert = ca.generate(cn)
+          expect(cert.name).to eq(cn)
+          expect(@logs.map(&:message)).to include("Autosigning #{cn}")
+        end
       end
     end
   end

data/spec/unit/transaction/additional_resource_generator_spec.rb

@@ -0,0 +1,419 @@
+require 'spec_helper'
+require 'puppet/transaction'
+require 'puppet_spec/compiler'
+require 'matchers/relationship_graph_matchers'
+require 'matchers/include_in_order'
+
+describe Puppet::Transaction::AdditionalResourceGenerator do
+  include PuppetSpec::Compiler
+  include PuppetSpec::Files
+  include RelationshipGraphMatchers
+
+  let(:prioritizer) { Puppet::Graph::SequentialPrioritizer.new }
+
+  def find_vertex(graph, type, title)
+    graph.vertices.find {|v| v.type == type and v.title == title}
+  end
+
+  Puppet::Type.newtype(:generator) do
+    include PuppetSpec::Compiler
+
+    newparam(:name) do
+      isnamevar
+    end
+
+    newparam(:kind) do
+      defaultto :eval_generate
+      newvalues(:eval_generate, :generate)
+    end
+
+    newparam(:code)
+
+    def respond_to?(method_name)
+      method_name == self[:kind] || super
+    end
+
+    def eval_generate
+      eval_code
+    end
+
+    def generate
+      eval_code
+    end
+
+    def eval_code
+      if self[:code]
+        compile_to_ral(self[:code]).resources.select { |r| r.ref =~ /Notify/ }
+      else
+        []
+      end
+    end
+  end
+
+  context "when applying eval_generate" do
+    it "should add the generated resources to the catalog" do
+      catalog = compile_to_ral(<<-MANIFEST)
+        generator { thing:
+          code => 'notify { hello: }'
+        }
+      MANIFEST
+
+      eval_generate_resources_in(catalog, relationship_graph_for(catalog), 'Generator[thing]')
+
+      expect(catalog).to have_resource('Notify[hello]')
+    end
+
+    it "should add a sentinel whit for the resource" do
+      graph = relationships_after_eval_generating(<<-MANIFEST, 'Generator[thing]')
+        generator { thing:
+          code => 'notify { hello: }'
+        }
+      MANIFEST
+
+      find_vertex(graph, :whit, "completed_thing").must be_a(Puppet::Type.type(:whit))
+    end
+
+    it "should replace dependencies on the resource with dependencies on the sentinel" do
+      graph = relationships_after_eval_generating(<<-MANIFEST, 'Generator[thing]')
+        generator { thing:
+          code => 'notify { hello: }'
+        }
+
+        notify { last: require => Generator['thing'] }
+      MANIFEST
+
+      expect(graph).to enforce_order_with_edge(
+        'Whit[completed_thing]', 'Notify[last]')
+    end
+
+    it "should add an edge from the nearest ancestor to the generated resource" do
+      graph = relationships_after_eval_generating(<<-MANIFEST, 'Generator[thing]')
+        generator { thing:
+          code => 'notify { hello: } notify { goodbye: }'
+        }
+      MANIFEST
+
+      expect(graph).to enforce_order_with_edge(
+        'Generator[thing]', 'Notify[hello]')
+      expect(graph).to enforce_order_with_edge(
+        'Generator[thing]', 'Notify[goodbye]')
+    end
+
+    it "should add an edge from each generated resource to the sentinel" do
+      graph = relationships_after_eval_generating(<<-MANIFEST, 'Generator[thing]')
+        generator { thing:
+          code => 'notify { hello: } notify { goodbye: }'
+        }
+      MANIFEST
+
+      expect(graph).to enforce_order_with_edge(
+        'Notify[hello]', 'Whit[completed_thing]')
+      expect(graph).to enforce_order_with_edge(
+        'Notify[goodbye]', 'Whit[completed_thing]')
+    end
+
+    it "should add an edge from the resource to the sentinel" do
+      graph = relationships_after_eval_generating(<<-MANIFEST, 'Generator[thing]')
+        generator { thing:
+          code => 'notify { hello: }'
+        }
+      MANIFEST
+
+      expect(graph).to enforce_order_with_edge(
+        'Generator[thing]', 'Whit[completed_thing]')
+    end
+
+    it "should contain the generated resources in the same container as the generator" do
+      catalog = compile_to_ral(<<-MANIFEST)
+        class container {
+          generator { thing:
+            code => 'notify { hello: }'
+          }
+        }
+
+        include container
+      MANIFEST
+
+      eval_generate_resources_in(catalog, relationship_graph_for(catalog), 'Generator[thing]')
+
+      expect(catalog).to contain_resources_equally('Generator[thing]', 'Notify[hello]')
+    end
+
+    it "should return false if an error occured when generating resources" do
+      catalog = compile_to_ral(<<-MANIFEST)
+        generator { thing:
+          code => 'fail("not a good generation")'
+        }
+      MANIFEST
+
+      generator = Puppet::Transaction::AdditionalResourceGenerator.new(catalog, relationship_graph_for(catalog), prioritizer)
+
+      expect(generator.eval_generate(catalog.resource('Generator[thing]'))).
+        to eq(false)
+    end
+
+    it "should return true if resources were generated" do
+      catalog = compile_to_ral(<<-MANIFEST)
+        generator { thing:
+          code => 'notify { hello: }'
+        }
+      MANIFEST
+
+      generator = Puppet::Transaction::AdditionalResourceGenerator.new(catalog, relationship_graph_for(catalog), prioritizer)
+
+      expect(generator.eval_generate(catalog.resource('Generator[thing]'))).
+        to eq(true)
+    end
+
+    it "should not add a sentinel if no resources are generated" do
+      catalog = compile_to_ral(<<-MANIFEST)
+        generator { thing: }
+      MANIFEST
+      relationship_graph = relationship_graph_for(catalog)
+
+      generator = Puppet::Transaction::AdditionalResourceGenerator.new(catalog, relationship_graph, prioritizer)
+
+      expect(generator.eval_generate(catalog.resource('Generator[thing]'))).
+        to eq(false)
+      expect(find_vertex(relationship_graph, :whit, "completed_thing")).to be_nil
+    end
+
+    it "orders generated resources with the generator" do
+      graph = relationships_after_eval_generating(<<-MANIFEST, 'Generator[thing]')
+        notify { before: }
+        generator { thing:
+          code => 'notify { hello: }'
+        }
+        notify { after: }
+      MANIFEST
+
+      expect(order_resources_traversed_in(graph)).to(
+        include_in_order("Notify[before]", "Generator[thing]", "Notify[hello]", "Notify[after]"))
+    end
+
+    it "orders the generator in manifest order with dependencies" do
+      graph = relationships_after_eval_generating(<<-MANIFEST, 'Generator[thing]')
+        notify { before: }
+        generator { thing:
+          code => 'notify { hello: } notify { goodbye: }'
+        }
+        notify { third: require => Generator['thing'] }
+        notify { after: }
+      MANIFEST
+
+      expect(order_resources_traversed_in(graph)).to(
+        include_in_order("Notify[before]",
+                         "Generator[thing]",
+                         "Notify[hello]",
+                         "Notify[goodbye]",
+                         "Notify[third]",
+                         "Notify[after]"))
+    end
+
+    it "duplicate generated resources are made dependent on the generator" do
+      graph = relationships_after_eval_generating(<<-MANIFEST, 'Generator[thing]')
+        notify { before: }
+        notify { hello: }
+        generator { thing:
+          code => 'notify { before: }'
+        }
+        notify { third: require => Generator['thing'] }
+        notify { after: }
+      MANIFEST
+
+      expect(order_resources_traversed_in(graph)).to(
+        include_in_order("Notify[hello]", "Generator[thing]", "Notify[before]", "Notify[third]", "Notify[after]"))
+    end
+
+    it "preserves dependencies on duplicate generated resources" do
+      graph = relationships_after_eval_generating(<<-MANIFEST, 'Generator[thing]')
+        notify { before: }
+        generator { thing:
+          code => 'notify { hello: } notify { before: }',
+          require => 'Notify[before]'
+        }
+        notify { third: require => Generator['thing'] }
+        notify { after: }
+      MANIFEST
+
+      expect(order_resources_traversed_in(graph)).to(
+        include_in_order("Notify[before]", "Generator[thing]", "Notify[hello]", "Notify[third]", "Notify[after]"))
+    end
+
+    def relationships_after_eval_generating(manifest, resource_to_generate)
+      catalog = compile_to_ral(manifest)
+      relationship_graph = relationship_graph_for(catalog)
+
+      eval_generate_resources_in(catalog, relationship_graph, resource_to_generate)
+
+      relationship_graph
+    end
+
+    def eval_generate_resources_in(catalog, relationship_graph, resource_to_generate)
+      generator = Puppet::Transaction::AdditionalResourceGenerator.new(catalog, relationship_graph, prioritizer)
+      generator.eval_generate(catalog.resource(resource_to_generate))
+    end
+  end
+
+  context "when applying generate" do
+    it "should add the generated resources to the catalog" do
+      catalog = compile_to_ral(<<-MANIFEST)
+        generator { thing:
+          kind => generate,
+          code => 'notify { hello: }'
+        }
+      MANIFEST
+
+      generate_resources_in(catalog, relationship_graph_for(catalog), 'Generator[thing]')
+
+      expect(catalog).to have_resource('Notify[hello]')
+    end
+
+    it "should contain the generated resources in the same container as the generator" do
+      catalog = compile_to_ral(<<-MANIFEST)
+        class container {
+          generator { thing:
+            kind => generate,
+            code => 'notify { hello: }'
+          }
+        }
+
+        include container
+      MANIFEST
+
+      generate_resources_in(catalog, relationship_graph_for(catalog), 'Generator[thing]')
+
+      expect(catalog).to contain_resources_equally('Generator[thing]', 'Notify[hello]')
+    end
+
+    it "should add an edge from the nearest ancestor to the generated resource" do
+      graph = relationships_after_generating(<<-MANIFEST, 'Generator[thing]')
+        generator { thing:
+          kind => generate,
+          code => 'notify { hello: } notify { goodbye: }'
+        }
+      MANIFEST
+
+      expect(graph).to enforce_order_with_edge(
+        'Generator[thing]', 'Notify[hello]')
+      expect(graph).to enforce_order_with_edge(
+        'Generator[thing]', 'Notify[goodbye]')
+    end
+
+    it "orders generated resources with the generator" do
+      graph = relationships_after_generating(<<-MANIFEST, 'Generator[thing]')
+        notify { before: }
+        generator { thing:
+          kind => generate,
+          code => 'notify { hello: }'
+        }
+        notify { after: }
+      MANIFEST
+
+      expect(order_resources_traversed_in(graph)).to(
+        include_in_order("Notify[before]", "Generator[thing]", "Notify[hello]", "Notify[after]"))
+    end
+
+    it "duplicate generated resources are made dependent on the generator" do
+      graph = relationships_after_generating(<<-MANIFEST, 'Generator[thing]')
+        notify { before: }
+        notify { hello: }
+        generator { thing:
+          kind => generate,
+          code => 'notify { before: }'
+        }
+        notify { third: require => Generator['thing'] }
+        notify { after: }
+      MANIFEST
+
+      expect(order_resources_traversed_in(graph)).to(
+        include_in_order("Notify[hello]", "Generator[thing]", "Notify[before]", "Notify[third]", "Notify[after]"))
+    end
+
+    it "preserves dependencies on duplicate generated resources" do
+      graph = relationships_after_generating(<<-MANIFEST, 'Generator[thing]')
+        notify { before: }
+        generator { thing:
+          kind => generate,
+          code => 'notify { hello: } notify { before: }',
+          require => 'Notify[before]'
+        }
+        notify { third: require => Generator['thing'] }
+        notify { after: }
+      MANIFEST
+
+      expect(order_resources_traversed_in(graph)).to(
+        include_in_order("Notify[before]", "Generator[thing]", "Notify[hello]", "Notify[third]", "Notify[after]"))
+    end
+
+    it "orders the generator in manifest order with dependencies" do
+      graph = relationships_after_generating(<<-MANIFEST, 'Generator[thing]')
+        notify { before: }
+        generator { thing:
+          kind => generate,
+          code => 'notify { hello: } notify { goodbye: }'
+        }
+        notify { third: require => Generator['thing'] }
+        notify { after: }
+      MANIFEST
+
+      expect(order_resources_traversed_in(graph)).to(
+        include_in_order("Notify[before]",
+                         "Generator[thing]",
+                         "Notify[hello]",
+                         "Notify[goodbye]",
+                         "Notify[third]",
+                         "Notify[after]"))
+    end
+
+    def relationships_after_generating(manifest, resource_to_generate)
+      catalog = compile_to_ral(manifest)
+      relationship_graph = relationship_graph_for(catalog)
+
+      generate_resources_in(catalog, relationship_graph, resource_to_generate)
+
+      relationship_graph
+    end
+
+    def generate_resources_in(catalog, relationship_graph, resource_to_generate)
+      generator = Puppet::Transaction::AdditionalResourceGenerator.new(catalog, relationship_graph, prioritizer)
+      generator.generate_additional_resources(catalog.resource(resource_to_generate))
+    end
+  end
+
+  def relationship_graph_for(catalog)
+    relationship_graph = Puppet::Graph::RelationshipGraph.new(prioritizer)
+    relationship_graph.populate_from(catalog)
+    relationship_graph
+  end
+
+  def order_resources_traversed_in(relationships)
+    order_seen = []
+    relationships.traverse { |resource| order_seen << resource.ref }
+    order_seen
+  end
+
+  RSpec::Matchers.define :contain_resources_equally do |*resource_refs|
+    match do |catalog|
+      @containers = resource_refs.collect do |resource_ref|
+        catalog.container_of(catalog.resource(resource_ref)).ref
+      end
+
+      @containers.all? { |resource_ref| resource_ref == @containers[0] }
+    end
+
+    def failure_message_for_should
+      "expected #{@expected.join(', ')} to all be contained in the same resource but the containment was #{@expected.zip(@containers).collect { |(res, container)| res + ' => ' + container }.join(', ')}"
+    end
+  end
+end
+
+RSpec::Matchers.define :have_resource do |expected_resource|
+  match do |actual_catalog|
+    actual_catalog.resource(expected_resource)
+  end
+
+  def failure_message_for_should
+    "expected #{@actual.to_dot} to include #{@expected[0]}"
+  end
+end