puppet 3.3.2 → 3.4.0.rc1

data/spec/integration/parser/parser_spec.rb

@@ -213,11 +213,11 @@ describe "Puppet::Parser::Parser" do
       end
 
       it 'should flag illegal use of non r-value producing <| |>' do
-        expect { @parser.parse("$a = file <| |>") }.to raise_error(/A Virtual Query does not produce a value at line 1:6/)
+        expect { @parser.parse("$a = File <| |>") }.to raise_error(/A Virtual Query does not produce a value at line 1:6/)
       end
 
       it 'should flag illegal use of non r-value producing <<| |>>' do
-        expect { @parser.parse("$a = file <<| |>>") }.to raise_error(/An Exported Query does not produce a value at line 1:6/)
+        expect { @parser.parse("$a = File <<| |>>") }.to raise_error(/An Exported Query does not produce a value at line 1:6/)
       end
 
       it 'should flag illegal use of non r-value producing define' do

data/spec/integration/provider/cron/crontab_spec.rb

@@ -10,12 +10,12 @@ describe Puppet::Type.type(:cron).provider(:crontab), '(integration)', :unless =
     Puppet::Type.type(:cron).stubs(:defaultprovider).returns described_class
     Puppet::FileBucket::Dipper.any_instance.stubs(:backup) # Don't backup to filebucket
 
-    # I dont want to execute anything
+    # I don't want to execute anything
     described_class.stubs(:filetype).returns Puppet::Util::FileType::FileTypeFlat
     described_class.stubs(:default_target).returns crontab_user1
 
-    # I dont want to stub Time.now to get a static header because I dont know
-    # where Time.now is used elsewere so just go with a very simple header
+    # I don't want to stub Time.now to get a static header because I don't know
+    # where Time.now is used elsewhere, so just go with a very simple header
     described_class.stubs(:header).returns "# HEADER: some simple\n# HEADER: header\n"
     FileUtils.cp(my_fixture('crontab_user1'), crontab_user1)
     FileUtils.cp(my_fixture('crontab_user2'), crontab_user2)
@@ -191,8 +191,6 @@ describe Puppet::Type.type(:cron).provider(:crontab), '(integration)', :unless =
         File.read(crontab_user2).should == File.read(my_fixture('moved_cronjob_input2'))
       end
     end
-
-    it "should not add multiple headers"
   end
 
 end

data/spec/integration/resource/catalog_spec.rb

@@ -21,7 +21,7 @@ describe Puppet::Resource::Catalog do
       terminus = Puppet::Resource::Catalog.indirection.terminus(:yaml)
       terminus.expects(:path).with("me").returns "/my/yaml/file"
 
-      FileTest.expects(:exist?).with("/my/yaml/file").returns false
+      Puppet::FileSystem::File.expects(:exist?).with("/my/yaml/file").returns false
       Puppet::Resource::Catalog.indirection.find("me").should be_nil
     end
 

data/spec/integration/ssl/autosign_spec.rb

@@ -0,0 +1,90 @@
+require 'spec_helper'
+
+describe "autosigning" do
+  include PuppetSpec::Files
+
+  let(:puppet_dir) { tmpdir("ca_autosigning") }
+  let(:csr_attributes_content) do
+    {
+      'custom_attributes' => {
+        '1.3.6.1.4.1.34380.2.0' => 'hostname.domain.com',
+        '1.3.6.1.4.1.34380.2.1' => 'my passphrase',
+        '1.3.6.1.4.1.34380.2.2' => # system IPs in hex
+          [ 0xC0A80001, # 192.168.0.1
+            0xC0A80101 ], # 192.168.1.1
+      },
+      'extension_requests' => {
+        'pp_uuid' => 'abcdef',
+        '1.3.6.1.4.1.34380.1.1.2' => '1234', # pp_instance_id
+        '1.3.6.1.4.1.34380.1.2.1' => 'some-value', # private extension
+      },
+    }
+  end
+
+  let(:host) { Puppet::SSL::Host.new }
+
+  before do
+    Puppet.settings[:confdir] = puppet_dir
+    Puppet.settings[:vardir] = puppet_dir
+
+    # This is necessary so the terminus instances don't lie around.
+    Puppet::SSL::Key.indirection.termini.clear
+  end
+
+  context "with extension requests from csr_attributes file" do
+    let(:ca) { Puppet::SSL::CertificateAuthority.new }
+
+    def write_csr_attributes
+      File.open(Puppet.settings[:csr_attributes], 'w') do |file|
+        file.puts YAML.dump(csr_attributes_content)
+      end
+    end
+
+    context "and subjectAltName" do
+      it "raises an error if you include subjectAltName in csr_attributes" do
+        csr_attributes_content['extension_requests']['subjectAltName'] = 'foo'
+        write_csr_attributes
+        expect { host.generate_certificate_request }.to raise_error(Puppet::Error, /subjectAltName.*conflicts with internally used extension request/)
+      end
+
+      it "properly merges subjectAltName when in settings" do
+        Puppet.settings[:dns_alt_names] = 'althostname.nowhere'
+        write_csr_attributes
+        host.generate_certificate_request
+        csr = Puppet::SSL::CertificateRequest.indirection.find(host.name)
+        expect(csr.subject_alt_names).to include('DNS:althostname.nowhere')
+      end
+    end
+
+    context "without subjectAltName" do
+
+      before do
+        write_csr_attributes
+        host.generate_certificate_request
+      end
+
+      it "pulls extension attributes from the csr_attributes file into the certificate" do
+        csr = Puppet::SSL::CertificateRequest.indirection.find(host.name)
+        expect(csr.request_extensions).to have(3).items
+        expect(csr.request_extensions).to include('oid' => 'pp_uuid', 'value' => 'abcdef')
+        expect(csr.request_extensions).to include('oid' => 'pp_instance_id', 'value' => '1234')
+        expect(csr.request_extensions).to include('oid' => '1.3.6.1.4.1.34380.1.2.1', 'value' => 'some-value')
+      end
+
+      it "copies extension requests to certificate" do
+        cert = ca.sign(host.name)
+        expect(cert.custom_extensions).to include('oid' => 'pp_uuid', 'value' => 'abcdef')
+        expect(cert.custom_extensions).to include('oid' => 'pp_instance_id', 'value' => '1234')
+        expect(cert.custom_extensions).to include('oid' => '1.3.6.1.4.1.34380.1.2.1', 'value' => 'some-value')
+      end
+
+      it "does not copy custom attributes to certificate" do
+        cert = ca.sign(host.name)
+        cert.custom_extensions.each do |ext|
+          expect(Puppet::SSL::Oids.subtree_of?('1.3.6.1.4.1.34380.2', ext['oid'])).to be_false
+        end
+      end
+    end
+
+  end
+end

data/spec/integration/ssl/certificate_authority_spec.rb

@@ -6,8 +6,9 @@ require 'puppet/ssl/certificate_authority'
 describe Puppet::SSL::CertificateAuthority, :unless => Puppet.features.microsoft_windows? do
   include PuppetSpec::Files
 
+  let(:ca) { @ca }
+
   before do
-    # Get a safe temporary file
     dir = tmpdir("ca_integration_testing")
 
     Puppet.settings[:confdir] = dir
@@ -15,103 +16,58 @@ describe Puppet::SSL::CertificateAuthority, :unless => Puppet.features.microsoft
     Puppet.settings[:group] = Process.gid
 
     Puppet::SSL::Host.ca_location = :local
-    @ca = Puppet::SSL::CertificateAuthority.new
-  end
-
-  after {
-    Puppet::SSL::Host.ca_location = :none
-
-    Puppet.settings.clear
-
-    Puppet::SSL::CertificateAuthority.instance_variable_set("@instance", nil)
-  }
 
-  it "should create a CA host" do
-    @ca.host.should be_ca
-  end
-
-  it "should be able to generate a certificate" do
-    @ca.generate_ca_certificate
-
-    @ca.host.certificate.should be_instance_of(Puppet::SSL::Certificate)
+    # this has the side-effect of creating the various directories that we need
+    @ca = Puppet::SSL::CertificateAuthority.new
   end
 
   it "should be able to generate a new host certificate" do
-    @ca.generate("newhost")
+    ca.generate("newhost")
 
     Puppet::SSL::Certificate.indirection.find("newhost").should be_instance_of(Puppet::SSL::Certificate)
   end
 
   it "should be able to revoke a host certificate" do
-    @ca.generate("newhost")
+    ca.generate("newhost")
 
-    @ca.revoke("newhost")
+    ca.revoke("newhost")
 
-    lambda { @ca.verify("newhost") }.should raise_error
-  end
-
-  it "should have a CRL" do
-    @ca.generate_ca_certificate
-    @ca.crl.should_not be_nil
-  end
-
-  it "should be able to read in a previously created CRL" do
-    @ca.generate_ca_certificate
-
-    # Create it to start with.
-    @ca.crl
-
-    Puppet::SSL::CertificateAuthority.new.crl.should_not be_nil
+    expect { ca.verify("newhost") }.to raise_error(Puppet::SSL::CertificateAuthority::CertificateVerificationError, "certificate revoked")
   end
 
   describe "when signing certificates" do
-    before do
-      @host = Puppet::SSL::Host.new("luke.madstop.com")
-
-      # We have to provide the key, since when we're in :ca_only mode, we can only interact
-      # with the CA key.
-      key = Puppet::SSL::Key.new(@host.name)
-      key.generate
-
-      @host.key = key
-      @host.generate_certificate_request
-
-      path = File.join(Puppet[:requestdir], "luke.madstop.com.pem")
-    end
-
-    it "should be able to sign certificates" do
-      @ca.sign("luke.madstop.com")
-    end
-
     it "should save the signed certificate" do
-      @ca.sign("luke.madstop.com")
+      host = certificate_request_for("luke.madstop.com")
+
+      ca.sign("luke.madstop.com")
 
       Puppet::SSL::Certificate.indirection.find("luke.madstop.com").should be_instance_of(Puppet::SSL::Certificate)
     end
 
     it "should be able to sign multiple certificates" do
-      @other = Puppet::SSL::Host.new("other.madstop.com")
-      okey = Puppet::SSL::Key.new(@other.name)
-      okey.generate
-      @other.key = okey
-      @other.generate_certificate_request
+      host = certificate_request_for("luke.madstop.com")
+      other = certificate_request_for("other.madstop.com")
 
-      @ca.sign("luke.madstop.com")
-      @ca.sign("other.madstop.com")
+      ca.sign("luke.madstop.com")
+      ca.sign("other.madstop.com")
 
       Puppet::SSL::Certificate.indirection.find("other.madstop.com").should be_instance_of(Puppet::SSL::Certificate)
       Puppet::SSL::Certificate.indirection.find("luke.madstop.com").should be_instance_of(Puppet::SSL::Certificate)
     end
 
     it "should save the signed certificate to the :signeddir" do
-      @ca.sign("luke.madstop.com")
+      host = certificate_request_for("luke.madstop.com")
+
+      ca.sign("luke.madstop.com")
 
       client_cert = File.join(Puppet[:signeddir], "luke.madstop.com.pem")
       File.read(client_cert).should == Puppet::SSL::Certificate.indirection.find("luke.madstop.com").content.to_s
     end
 
     it "should save valid certificates" do
-      @ca.sign("luke.madstop.com")
+      host = certificate_request_for("luke.madstop.com")
+
+      ca.sign("luke.madstop.com")
 
       unless ssl = Puppet::Util::which('openssl')
         pending "No ssl available"
@@ -124,21 +80,58 @@ describe Puppet::SSL::CertificateAuthority, :unless => Puppet.features.microsoft
     end
 
     it "should verify proof of possession when signing certificates" do
-      csr = @host.certificate_request
-      wrong_key = Puppet::SSL::Key.new(@host.name)
+      host = certificate_request_for("luke.madstop.com")
+      csr = host.certificate_request
+      wrong_key = Puppet::SSL::Key.new(host.name)
       wrong_key.generate
 
       csr.content.public_key = wrong_key.content.public_key
       # The correct key has to be removed so we can save the incorrect one
-      Puppet::SSL::CertificateRequest.indirection.destroy(@host.name)
+      Puppet::SSL::CertificateRequest.indirection.destroy(host.name)
       Puppet::SSL::CertificateRequest.indirection.save(csr)
 
       expect {
-        @ca.sign(@host.name)
+        ca.sign(host.name)
       }.to raise_error(
         Puppet::SSL::CertificateAuthority::CertificateSigningError,
         "CSR contains a public key that does not correspond to the signing key"
       )
     end
   end
+
+  it "allows autosigning certificates concurrently", :unless => Puppet::Util::Platform.windows? do
+    Puppet[:autosign] = true
+    hosts = (0..4).collect { |i| certificate_request_for("host#{i}") }
+
+    run_in_parallel(5) do |i|
+      ca.autosign(Puppet::SSL::CertificateRequest.indirection.find(hosts[i].name))
+    end
+
+    certs = hosts.collect { |host| Puppet::SSL::Certificate.indirection.find(host.name).content }
+    serial_numbers = certs.collect(&:serial)
+
+    serial_numbers.sort.should == [2, 3, 4, 5, 6] # serial 1 is the ca certificate
+  end
+
+  def certificate_request_for(hostname)
+    key = Puppet::SSL::Key.new(hostname)
+    key.generate
+
+    host = Puppet::SSL::Host.new(hostname)
+    host.key = key
+    host.generate_certificate_request
+
+    host
+  end
+
+  def run_in_parallel(number)
+    children = []
+    number.times do |i|
+      children << Kernel.fork do
+        yield i
+      end
+    end
+
+    children.each { |pid| Process.wait(pid) }
+  end
 end

data/spec/integration/ssl/certificate_revocation_list_spec.rb

@@ -29,7 +29,7 @@ describe Puppet::SSL::CertificateRevocationList do
   it "should be able to read in written out CRLs with no revoked certificates" do
     ca = Puppet::SSL::CertificateAuthority.new
 
-    raise "CRL not created" unless FileTest.exist?(Puppet[:hostcrl])
+    raise "CRL not created" unless Puppet::FileSystem::File.exist?(Puppet[:hostcrl])
 
     crl = Puppet::SSL::CertificateRevocationList.new("crl_int_testing")
     crl.read(Puppet[:hostcrl])

data/spec/integration/ssl/host_spec.rb

@@ -70,7 +70,7 @@ describe Puppet::SSL::Host do
       @ca = Puppet::SSL::Host.new(Puppet::SSL::Host.ca_name)
       @ca.generate_key
 
-      FileTest.should_not be_exist(File.join(Puppet[:privatekeydir], "ca.pem"))
+      Puppet::FileSystem::File.exist?(File.join(Puppet[:privatekeydir], "ca.pem")).should be_false
     end
   end
 

data/spec/integration/transaction_spec.rb

@@ -64,7 +64,7 @@ describe Puppet::Transaction do
     catalog.add_resource resource
 
     catalog.apply
-    FileTest.should be_exist(path)
+    Puppet::FileSystem::File.exist?(path).should be_true
   end
 
   it "should not apply virtual exported resources" do
@@ -189,8 +189,8 @@ describe Puppet::Transaction do
 
     catalog = mk_catalog(file, exec1, exec2)
     catalog.apply
-    FileTest.should be_exist(file1)
-    FileTest.should be_exist(file2)
+    Puppet::FileSystem::File.exist?(file1).should be_true
+    Puppet::FileSystem::File.exist?(file2).should be_true
   end
 
   it "should not let one failed refresh result in other refreshes failing" do
@@ -223,7 +223,7 @@ describe Puppet::Transaction do
 
     catalog = mk_catalog(file, exec1, exec2)
     catalog.apply
-    FileTest.should be_exists(newfile)
+    Puppet::FileSystem::File.exist?(newfile).should be_true
   end
 
   it "should still trigger skipped resources" do
@@ -251,18 +251,18 @@ describe Puppet::Transaction do
 
     # Run it once
     catalog.apply
-    FileTest.should be_exists(fname)
+    Puppet::FileSystem::File.exist?(fname).should be_true
 
     # Now remove it, so it can get created again
-    File.unlink(fname)
+    Puppet::FileSystem::File.unlink(fname)
 
     file[:content] = "some content"
 
     catalog.apply
-    FileTest.should be_exists(fname)
+    Puppet::FileSystem::File.exist?(fname).should be_true
 
     # Now remove it, so it can get created again
-    File.unlink(fname)
+    Puppet::FileSystem::File.unlink(fname)
 
     # And tag our exec
     exec.tag("testrun")
@@ -275,7 +275,7 @@ describe Puppet::Transaction do
     file[:content] = "totally different content"
 
     catalog.apply
-    FileTest.should be_exists(fname)
+    Puppet::FileSystem::File.exist?(fname).should be_true
   end
 
   it "should not attempt to evaluate resources with failed dependencies" do
@@ -302,8 +302,8 @@ describe Puppet::Transaction do
     catalog = mk_catalog(exec, file1, file2)
     catalog.apply
 
-    FileTest.should_not be_exists(file1[:path])
-    FileTest.should_not be_exists(file2[:path])
+    Puppet::FileSystem::File.exist?(file1[:path]).should be_false
+    Puppet::FileSystem::File.exist?(file2[:path]).should be_false
   end
 
   it "should not trigger subscribing resources on failure" do
@@ -328,8 +328,8 @@ describe Puppet::Transaction do
     catalog = mk_catalog(exec, create_file1, create_file2)
     catalog.apply
 
-    FileTest.should_not be_exists(file1)
-    FileTest.should_not be_exists(file2)
+    Puppet::FileSystem::File.exist?(file1).should be_false
+    Puppet::FileSystem::File.exist?(file2).should be_false
   end
 
   # #801 -- resources only checked in noop should be rescheduled immediately.

data/spec/integration/type/exec_spec.rb

@@ -33,7 +33,7 @@ describe Puppet::Type.type(:exec) do
     catalog.add_resource exec
     catalog.apply
 
-    File.should_not be_exist(path)
+    Puppet::FileSystem::File.exist?(path).should be_false
   end
 
   it "should execute the command if onlyif returns zero" do
@@ -72,6 +72,6 @@ describe Puppet::Type.type(:exec) do
     catalog.add_resource exec
     catalog.apply
 
-    File.should_not be_exist(path)
+    Puppet::FileSystem::File.exist?(path).should be_false
   end
 end