puppet 3.3.2 → 3.4.0.rc1

data/spec/unit/ssl/certificate_factory_spec.rb

@@ -115,6 +115,24 @@ describe Puppet::SSL::CertificateFactory do
       end
     end
 
+    it "can add custom extension requests" do
+      csr = Puppet::SSL::CertificateRequest.new(name)
+      csr.generate(key)
+
+      csr.stubs(:request_extensions).returns([
+        {'oid' => '1.3.6.1.4.1.34380.1.2.1', 'value' => 'some-value'},
+        {'oid' => 'pp_uuid', 'value' => 'some-uuid'},
+      ])
+
+      cert = subject.build(:client, csr, issuer, serial)
+
+      priv_ext = cert.extensions.find {|ext| ext.oid == '1.3.6.1.4.1.34380.1.2.1'}
+      uuid_ext = cert.extensions.find {|ext| ext.oid == 'pp_uuid'}
+
+      expect(priv_ext.value).to eq 'some-value'
+      expect(uuid_ext.value).to eq 'some-uuid'
+    end
+
     # Can't check the CA here, since that requires way more infrastructure
     # that I want to build up at this time.  We can verify the critical
     # values, though, which are non-CA certs. --daniel 2011-10-11

data/spec/unit/ssl/certificate_request_attributes_spec.rb

@@ -0,0 +1,61 @@
+require 'spec_helper'
+
+require 'puppet/ssl/certificate_request_attributes'
+
+describe Puppet::SSL::CertificateRequestAttributes do
+
+  let(:expected) do
+    {
+      "custom_attributes" => {
+        "1.3.6.1.4.1.34380.2.2"=>[3232235521, 3232235777], # system IPs in hex
+        "1.3.6.1.4.1.34380.2.0"=>"hostname.domain.com",
+      }
+    }
+  end
+  let(:csr_attributes_hash) { expected.dup }
+  let(:csr_attributes_path) { '/some/where/csr_attributes.yaml' }
+  let(:csr_attributes) { Puppet::SSL::CertificateRequestAttributes.new(csr_attributes_path) }
+
+  it "initializes with a path" do
+    expect(csr_attributes.path).to eq(csr_attributes_path)
+  end
+
+  describe "loading" do
+    it "returns nil when loading from a non-existent file" do
+      expect(csr_attributes.load).to be_false
+    end
+
+    context "with an available attributes file" do
+      before do
+        Puppet::FileSystem::File.expects(:exist?).with(csr_attributes_path).returns(true)
+        Puppet::Util::Yaml.expects(:load_file).with(csr_attributes_path).returns(csr_attributes_hash)
+      end
+
+      it "loads csr attributes from a file when the file is present" do
+        expect(csr_attributes.load).to be_true
+      end
+
+      it "exposes custom_attributes" do
+        csr_attributes.load
+        expect(csr_attributes.custom_attributes).to eq(expected['custom_attributes'])
+      end
+
+      it "returns an empty hash if custom_attributes points to nil" do
+        csr_attributes_hash["custom_attributes"] = nil
+        csr_attributes.load
+        expect(csr_attributes.custom_attributes).to eq({})
+      end
+
+      it "returns an empty hash if custom_attributes key is not present" do
+        csr_attributes_hash.delete("custom_attributes")
+        csr_attributes.load
+        expect(csr_attributes.custom_attributes).to eq({})
+      end
+
+      it "raise a Puppet::Error if an unexpected root key is defined" do
+        csr_attributes_hash['unintentional'] = 'data'
+        expect { csr_attributes.load }.to raise_error(Puppet::Error, /unexpected attributes.*unintentional/)
+      end
+    end
+  end
+end

data/spec/unit/ssl/certificate_request_spec.rb

@@ -178,6 +178,109 @@ describe Puppet::SSL::CertificateRequest do
       end
     end
 
+    context "with custom CSR attributes" do
+
+      it "adds attributes with single values" do
+        csr_attributes = {
+          '1.3.6.1.4.1.34380.1.2.1' => 'CSR specific info',
+          '1.3.6.1.4.1.34380.1.2.2' => 'more CSR specific info',
+        }
+
+        request.generate(key, :csr_attributes => csr_attributes)
+
+        attrs = request.custom_attributes
+        attrs.should include({'oid' => '1.3.6.1.4.1.34380.1.2.1', 'value' => 'CSR specific info'})
+        attrs.should include({'oid' => '1.3.6.1.4.1.34380.1.2.2', 'value' => 'more CSR specific info'})
+      end
+
+      ['extReq', '1.2.840.113549.1.9.14'].each do |oid|
+        it "doesn't overwrite standard PKCS#9 CSR attribute '#{oid}'" do
+          expect do
+            request.generate(key, :csr_attributes => {oid => 'data'})
+          end.to raise_error ArgumentError, /Cannot specify.*#{oid}/
+        end
+      end
+
+      ['msExtReq', '1.3.6.1.4.1.311.2.1.14'].each do |oid|
+        it "doesn't overwrite Microsoft extension request OID '#{oid}'" do
+          expect do
+            request.generate(key, :csr_attributes => {oid => 'data'})
+          end.to raise_error ArgumentError, /Cannot specify.*#{oid}/
+        end
+      end
+
+      it "raises an error if an attribute cannot be created" do
+        csr_attributes = { "thats.no.moon" => "death star" }
+
+        expect do
+          request.generate(key, :csr_attributes => csr_attributes)
+        end.to raise_error Puppet::Error, /Cannot create CSR with attribute thats\.no\.moon: first num too large/
+      end
+    end
+
+    context "with extension requests" do
+      let(:extension_data) do
+        {
+          '1.3.6.1.4.1.34380.1.1.31415' => 'pi',
+          '1.3.6.1.4.1.34380.1.1.2718'  => 'e',
+        }
+      end
+
+      it "adds an extreq attribute to the CSR" do
+        request.generate(key, :extension_requests => extension_data)
+
+        exts = request.content.attributes.select { |attr| attr.oid = 'extReq' }
+        exts.length.should == 1
+      end
+
+      it "adds an extension for each entry in the extension request structure" do
+        request.generate(key, :extension_requests => extension_data)
+
+        exts = request.request_extensions
+
+        exts.should include('oid' => '1.3.6.1.4.1.34380.1.1.31415', 'value' => 'pi')
+        exts.should include('oid' => '1.3.6.1.4.1.34380.1.1.2718', 'value' => 'e')
+      end
+
+      it "defines the extensions as non-critical" do
+        request.generate(key, :extension_requests => extension_data)
+        request.request_extensions.each do |ext|
+          ext['critical'].should be_false
+        end
+      end
+
+      it "rejects the subjectAltNames extension" do
+        san_names = ['subjectAltName', '2.5.29.17']
+        san_field = 'DNS:first.tld, DNS:second.tld'
+
+        san_names.each do |name|
+          expect do
+            request.generate(key, :extension_requests => {name => san_field})
+          end.to raise_error Puppet::Error, /conflicts with internally used extension/
+        end
+      end
+
+      it "merges the extReq attribute with the subjectAltNames extension" do
+        request.generate(key,
+                         :dns_alt_names => 'first.tld, second.tld',
+                         :extension_requests => extension_data)
+        exts = request.request_extensions
+
+        exts.should include('oid' => '1.3.6.1.4.1.34380.1.1.31415', 'value' => 'pi')
+        exts.should include('oid' => '1.3.6.1.4.1.34380.1.1.2718', 'value' => 'e')
+        exts.should include('oid' => 'subjectAltName', 'value' => 'DNS:first.tld, DNS:myname, DNS:second.tld')
+
+        request.subject_alt_names.should eq ['DNS:first.tld', 'DNS:myname', 'DNS:second.tld']
+      end
+
+      it "raises an error if the OID could not be created" do
+        exts = {"thats.no.moon" => "death star"}
+        expect do
+          request.generate(key, :extension_requests => exts)
+        end.to raise_error Puppet::Error, /Cannot create CSR with extension request thats\.no\.moon: first num too large/
+      end
+    end
+
     it "should sign the csr with the provided key" do
       request.generate(key)
       request.content.verify(key.content.public_key).should be_true

data/spec/unit/ssl/certificate_spec.rb

@@ -75,6 +75,17 @@ describe Puppet::SSL::Certificate do
   end
 
   describe "when managing instances" do
+
+    def build_cert(opts)
+      key = Puppet::SSL::Key.new('quux')
+      key.generate
+      csr = Puppet::SSL::CertificateRequest.new('quux')
+      csr.generate(key, opts)
+
+      raw_cert = Puppet::SSL::CertificateFactory.build('client', csr, csr.content, 14)
+      @class.from_instance(raw_cert)
+    end
+
     before do
       @certificate = @class.new("myname")
     end
@@ -93,33 +104,35 @@ describe Puppet::SSL::Certificate do
 
     describe "#subject_alt_names" do
       it "should list all alternate names when the extension is present" do
-        key = Puppet::SSL::Key.new('quux')
-        key.generate
-
-        csr = Puppet::SSL::CertificateRequest.new('quux')
-        csr.generate(key, :dns_alt_names => 'foo, bar,baz')
-
-        raw_csr = csr.content
-
-        cert = Puppet::SSL::CertificateFactory.build('server', csr, raw_csr, 14)
-        certificate = @class.from_s(cert.to_pem)
+        certificate = build_cert(:dns_alt_names => 'foo, bar,baz')
         certificate.subject_alt_names.
           should =~ ['DNS:foo', 'DNS:bar', 'DNS:baz', 'DNS:quux']
       end
 
       it "should return an empty list of names if the extension is absent" do
-        key = Puppet::SSL::Key.new('quux')
-        key.generate
+        certificate = build_cert({})
+        certificate.subject_alt_names.should be_empty
+      end
+    end
 
-        csr = Puppet::SSL::CertificateRequest.new('quux')
-        csr.generate(key)
+    describe "custom extensions" do
+      it "returns extensions under the ppRegCertExt" do
+        exts = {'pp_uuid' => 'abcdfd'}
+        cert = build_cert(:extension_requests => exts)
+        expect(cert.custom_extensions).to include('oid' => 'pp_uuid', 'value' => 'abcdfd')
+      end
 
-        raw_csr = csr.content
+      it "returns extensions under the ppPrivCertExt" do
+        exts = {'1.3.6.1.4.1.34380.1.2.1' => 'x509 :('}
+        cert = build_cert(:extension_requests => exts)
+        expect(cert.custom_extensions).to include('oid' => '1.3.6.1.4.1.34380.1.2.1', 'value' => 'x509 :(')
+      end
 
-        cert = Puppet::SSL::CertificateFactory.build('client', csr, raw_csr, 14)
-        certificate = @class.from_s(cert.to_pem)
-        certificate.subject_alt_names.should be_empty
+      it "doesn't return standard extensions" do
+        cert = build_cert(:dns_alt_names => 'foo')
+        expect(cert.custom_extensions).to be_empty
       end
+
     end
 
     it "should return a nil expiration if there is no actual certificate" do

data/spec/unit/ssl/host_spec.rb

@@ -9,9 +9,24 @@ def base_pson_comparison(result, pson_hash)
   result["state"].should       == pson_hash["desired_state"]
 end
 
+# the json-schema gem doesn't support windows
+if not Puppet.features.microsoft_windows?
+  HOST_SCHEMA = JSON.parse(File.read(File.join(File.dirname(__FILE__), '../../../api/schemas/host.json')))
+
+  describe "host schema" do
+    it "should validate against the json meta-schema" do
+      JSON::Validator.validate!(JSON_META_SCHEMA, HOST_SCHEMA)
+    end
+  end
+end
+
 describe Puppet::SSL::Host do
   include PuppetSpec::Files
 
+  def validate_json_for_host(host)
+    JSON::Validator.validate!(HOST_SCHEMA, host.to_pson)
+  end
+
   before do
     Puppet::SSL::Host.indirection.terminus_class = :file
 
@@ -823,7 +838,7 @@ describe Puppet::SSL::Host do
       let(:host) do
         Puppet::SSL::Host.new("bazinga")
       end
-      
+
       let(:pson_hash) do
         {
           "fingerprint"   => host.certificate_request.fingerprint,
@@ -831,15 +846,20 @@ describe Puppet::SSL::Host do
           "name"          => host.name
         }
       end
-      
+
       it "should be able to identify a host with an unsigned certificate request" do
         host.generate_certificate_request
 
         result = PSON.parse(Puppet::SSL::Host.new(host.name).to_pson)
-        
+
         base_pson_comparison result, pson_hash
       end
-      
+
+      it "should validate against the schema", :unless => Puppet.features.microsoft_windows? do
+        host.generate_certificate_request
+        validate_json_for_host(host)
+      end
+
       describe "explicit fingerprints" do
         [:SHA1, :SHA256, :SHA512].each do |md|
           it "should include #{md}" do
@@ -854,7 +874,7 @@ describe Puppet::SSL::Host do
           end
         end
       end
-      
+
       describe "dns_alt_names" do
         describe "when not specified" do
           it "should include the dns_alt_names associated with the certificate" do
@@ -867,22 +887,28 @@ describe Puppet::SSL::Host do
           end
         end
 
-        [ "", 
+        [ "",
           "test, alt, names"
         ].each do |alt_names|
           describe "when #{alt_names}" do
-            it "should include the dns_alt_names associated with the certificate" do
+            before(:each) do
               host.generate_certificate_request :dns_alt_names => alt_names
+            end
+
+            it "should include the dns_alt_names associated with the certificate" do
               pson_hash["desired_alt_names"] = host.certificate_request.subject_alt_names
 
               result = PSON.parse(Puppet::SSL::Host.new(host.name).to_pson)
               base_pson_comparison result, pson_hash
               result["dns_alt_names"].should == pson_hash["desired_alt_names"]
             end
+
+            it "should validate against the schema", :unless => Puppet.features.microsoft_windows? do
+              validate_json_for_host(host)
+            end
           end
         end
       end
-      
 
       it "should be able to identify a host with a signed certificate" do
         host.generate_certificate_request

data/spec/unit/ssl/inventory_spec.rb

@@ -20,7 +20,7 @@ describe Puppet::SSL::Inventory, :unless => Puppet.features.microsoft_windows? d
     before do
       Puppet[:cert_inventory] = cert_inventory
 
-      FileTest.stubs(:exist?).with(cert_inventory).returns true
+      Puppet::FileSystem::File.stubs(:exist?).with(cert_inventory).returns true
 
       @inventory = @class.new
 
@@ -28,86 +28,51 @@ describe Puppet::SSL::Inventory, :unless => Puppet.features.microsoft_windows? d
     end
 
     describe "and creating the inventory file" do
-      before do
-        Puppet.settings.stubs(:write)
-        FileTest.stubs(:exist?).with(cert_inventory).returns false
-
-        Puppet::SSL::Certificate.indirection.stubs(:search).returns []
-      end
-
-      it "should log that it is building a new inventory file" do
-        Puppet.expects(:notice)
-
-        @inventory.rebuild
-      end
-
-      it "should use the Settings to write to the file" do
-        Puppet.settings.expects(:write).with(:cert_inventory)
-
-        @inventory.rebuild
-      end
-
-      it "should add a header to the file" do
-        fh = mock 'filehandle'
-        Puppet.settings.stubs(:write).yields fh
-        fh.expects(:print).with { |str| str =~ /^#/ }
-
-        @inventory.rebuild
-      end
-
-      it "should add formatted information on all existing certificates" do
-        cert1 = mock 'cert1'
-        cert2 = mock 'cert2'
-
+      it "re-adds all of the existing certificates" do
+        inventory_file = StringIO.new
+        Puppet.settings.setting(:cert_inventory).stubs(:open).yields(inventory_file)
+
+        cert1 = Puppet::SSL::Certificate.new("cert1")
+        cert1.content = stub 'cert1',
+          :serial => 2,
+          :not_before => Time.now,
+          :not_after => Time.now,
+          :subject => "/CN=smocking"
+        cert2 = Puppet::SSL::Certificate.new("cert2")
+        cert2.content = stub 'cert2',
+          :serial => 3,
+          :not_before => Time.now,
+          :not_after => Time.now,
+          :subject => "/CN=mocking bird"
         Puppet::SSL::Certificate.indirection.expects(:search).with("*").returns [cert1, cert2]
 
-        @class.any_instance.expects(:add).with(cert1)
-        @class.any_instance.expects(:add).with(cert2)
-
         @inventory.rebuild
+
+        expect(inventory_file.string).to match(/\/CN=smocking/)
+        expect(inventory_file.string).to match(/\/CN=mocking bird/)
       end
     end
 
     describe "and adding a certificate" do
-      it "should build the inventory file if one does not exist" do
-        Puppet[:cert_inventory] = cert_inventory
-        Puppet.settings.stubs(:write)
-
-        FileTest.expects(:exist?).with(cert_inventory).returns false
-
-        @inventory.expects(:rebuild)
-
-        @inventory.add(@cert)
-      end
 
       it "should use the Settings to write to the file" do
-        Puppet.settings.expects(:write).with(:cert_inventory, "a")
+        Puppet.settings.setting(:cert_inventory).expects(:open).with("a")
 
         @inventory.add(@cert)
       end
 
-      it "should use the actual certificate if it was passed a Puppet certificate" do
+      it "should add formatted certificate information to the end of the file" do
         cert = Puppet::SSL::Certificate.new("mycert")
         cert.content = @cert
 
-        fh = stub 'filehandle', :print => nil
-        Puppet.settings.stubs(:write).yields fh
-
-        @inventory.expects(:format).with(@cert)
-
-        @inventory.add(@cert)
-      end
-
-      it "should add formatted certificate information to the end of the file" do
-        fh = mock 'filehandle'
-
-        Puppet.settings.stubs(:write).yields fh
+        fh = StringIO.new
+        Puppet.settings.setting(:cert_inventory).expects(:open).with("a").yields(fh)
 
         @inventory.expects(:format).with(@cert).returns "myformat"
 
-        fh.expects(:print).with("myformat")
-
         @inventory.add(@cert)
+
+        expect(fh.string).to eq("myformat")
       end
     end
 
@@ -152,7 +117,7 @@ describe Puppet::SSL::Inventory, :unless => Puppet.features.microsoft_windows? d
 
     describe "and finding a serial number" do
       it "should return nil if the inventory file is missing" do
-        FileTest.expects(:exist?).with(cert_inventory).returns false
+        Puppet::FileSystem::File.expects(:exist?).with(cert_inventory).returns false
         @inventory.serial(:whatever).should be_nil
       end