puppet 3.3.2 → 3.4.0.rc1

data/spec/unit/util/tagging_spec.rb

@@ -3,92 +3,129 @@ require 'spec_helper'
 
 require 'puppet/util/tagging'
 
-describe Puppet::Util::Tagging, "when adding tags" do
-  before do
-    @tagger = Object.new
-    @tagger.extend(Puppet::Util::Tagging)
-  end
-
-  it "should have a method for adding tags" do
-    @tagger.should be_respond_to(:tag)
-  end
-
-  it "should have a method for returning all tags" do
-    @tagger.should be_respond_to(:tags)
-  end
+describe Puppet::Util::Tagging do
+  let(:tagger) { Object.new.extend(Puppet::Util::Tagging) }
 
   it "should add tags to the returned tag list" do
-    @tagger.tag("one")
-    @tagger.tags.should be_include("one")
-  end
-
-  it "should not add duplicate tags to the returned tag list" do
-    @tagger.tag("one")
-    @tagger.tag("one")
-    @tagger.tags.should == ["one"]
+    tagger.tag("one")
+    expect(tagger.tags).to include("one")
   end
 
   it "should return a duplicate of the tag list, rather than the original" do
-    @tagger.tag("one")
-    tags = @tagger.tags
+    tagger.tag("one")
+    tags = tagger.tags
     tags << "two"
-    @tagger.tags.should_not be_include("two")
+    expect(tagger.tags).to_not include("two")
   end
 
   it "should add all provided tags to the tag list" do
-    @tagger.tag("one", "two")
-    @tagger.tags.should be_include("one")
-    @tagger.tags.should be_include("two")
+    tagger.tag("one", "two")
+    expect(tagger.tags).to include("one")
+    expect(tagger.tags).to include("two")
   end
 
   it "should fail on tags containing '*' characters" do
-    expect { @tagger.tag("bad*tag") }.to raise_error(Puppet::ParseError)
+    expect { tagger.tag("bad*tag") }.to raise_error(Puppet::ParseError)
   end
 
   it "should fail on tags starting with '-' characters" do
-    expect { @tagger.tag("-badtag") }.to raise_error(Puppet::ParseError)
+    expect { tagger.tag("-badtag") }.to raise_error(Puppet::ParseError)
   end
 
   it "should fail on tags containing ' ' characters" do
-    expect { @tagger.tag("bad tag") }.to raise_error(Puppet::ParseError)
+    expect { tagger.tag("bad tag") }.to raise_error(Puppet::ParseError)
   end
 
   it "should allow alpha tags" do
-    expect { @tagger.tag("good_tag") }.to_not raise_error
+    expect { tagger.tag("good_tag") }.not_to raise_error
   end
 
   it "should allow tags containing '.' characters" do
-    expect { @tagger.tag("good.tag") }.to_not raise_error
+    expect { tagger.tag("good.tag") }.to_not raise_error(Puppet::ParseError)
   end
 
   it "should add qualified classes as tags" do
-    @tagger.tag("one::two")
-    @tagger.tags.should be_include("one::two")
+    tagger.tag("one::two")
+    expect(tagger.tags).to include("one::two")
   end
 
   it "should add each part of qualified classes as tags" do
-    @tagger.tag("one::two::three")
-    @tagger.tags.should be_include("one")
-    @tagger.tags.should be_include("two")
-    @tagger.tags.should be_include("three")
+    tagger.tag("one::two::three")
+    expect(tagger.tags).to include('one')
+    expect(tagger.tags).to include("two")
+    expect(tagger.tags).to include("three")
   end
 
   it "should indicate when the object is tagged with a provided tag" do
-    @tagger.tag("one")
-    @tagger.should be_tagged("one")
+    tagger.tag("one")
+    expect(tagger).to be_tagged("one")
   end
 
   it "should indicate when the object is not tagged with a provided tag" do
-    @tagger.should_not be_tagged("one")
+    expect(tagger).to_not be_tagged("one")
   end
 
   it "should indicate when the object is tagged with any tag in an array" do
-    @tagger.tag("one")
-    @tagger.should be_tagged("one","two","three")
+    tagger.tag("one")
+    expect(tagger).to be_tagged("one","two","three")
   end
 
   it "should indicate when the object is not tagged with any tag in an array" do
-    @tagger.tag("one")
-    @tagger.should_not be_tagged("two","three")
+    tagger.tag("one")
+    expect(tagger).to_not be_tagged("two","three")
+  end
+
+  context "when tagging" do
+    it "converts symbols to strings" do
+      tagger.tag(:hello)
+      expect(tagger.tags).to include('hello')
+    end
+
+    it "downcases tags" do
+      tagger.tag(:HEllO)
+      tagger.tag("GooDByE")
+      expect(tagger).to be_tagged("hello")
+      expect(tagger).to be_tagged("goodbye")
+    end
+
+    it "accepts hyphenated tags" do
+      tagger.tag("my-tag")
+      expect(tagger).to be_tagged("my-tag")
+    end
+  end
+
+  context "when querying if tagged" do
+    it "responds true if queried on the entire set" do
+      tagger.tag("one", "two")
+      expect(tagger).to be_tagged("one", "two")
+    end
+
+    it "responds true if queried on a subset" do
+      tagger.tag("one", "two", "three")
+      expect(tagger).to be_tagged("two", "one")
+    end
+
+    it "responds true if queried on an overlapping but not fully contained set" do
+      tagger.tag("one", "two")
+      expect(tagger).to be_tagged("zero", "one")
+    end
+
+    it "responds false if queried on a disjoint set" do
+      tagger.tag("one", "two", "three")
+      expect(tagger).to_not be_tagged("five")
+    end
+
+    it "responds false if queried on the empty set" do
+      expect(tagger).to_not be_tagged
+    end
+  end
+
+  context "when assigning tags" do
+    it "splits a string on ','" do
+      tagger.tags = "one, two, three"
+      expect(tagger).to be_tagged("one")
+      expect(tagger).to be_tagged("two")
+      expect(tagger).to be_tagged("three")
+    end
   end
 end

data/spec/unit/util/watcher_spec.rb

@@ -14,7 +14,10 @@ describe Puppet::Util::Watcher do
     let(:filename) { "fake" }
 
     def after_reading_the_sequence(initial, *results)
-      expectation = File.stubs(:stat).with(filename)
+      mock_file = mock(filename)
+      Puppet::FileSystem::File.expects(:new).with(filename).at_least(1).returns mock_file
+
+      expectation = mock_file.stubs(:stat)
       ([initial] + results).each do |result|
         expectation = if result.is_a? Class
                         expectation.raises(result)

data/spec/unit/util/windows/access_control_entry_spec.rb

@@ -0,0 +1,67 @@
+#!/usr/bin/env ruby
+require 'spec_helper'
+require 'puppet/util/windows'
+
+describe "Puppet::Util::Windows::AccessControlEntry", :if => Puppet.features.microsoft_windows? do
+  let(:klass) { Puppet::Util::Windows::AccessControlEntry }
+  let(:sid) { 'S-1-5-18' }
+  let(:mask) { Windows::File::FILE_ALL_ACCESS }
+
+  it "creates an access allowed ace" do
+    ace = klass.new(sid, mask)
+
+    ace.type.should == klass::ACCESS_ALLOWED_ACE_TYPE
+  end
+
+  it "creates an access denied ace" do
+    ace = klass.new(sid, mask, 0, klass::ACCESS_DENIED_ACE_TYPE)
+
+    ace.type.should == klass::ACCESS_DENIED_ACE_TYPE
+  end
+
+  it "creates a non-inherited ace by default" do
+    ace = klass.new(sid, mask)
+
+    ace.should_not be_inherited
+  end
+
+  it "creates an inherited ace" do
+    ace = klass.new(sid, mask, klass::INHERITED_ACE)
+
+    ace.should be_inherited
+  end
+
+  it "creates a non-inherit-only ace by default" do
+    ace = klass.new(sid, mask)
+
+    ace.should_not be_inherit_only
+  end
+
+  it "creates an inherit-only ace" do
+    ace = klass.new(sid, mask, klass::INHERIT_ONLY_ACE)
+
+    ace.should be_inherit_only
+  end
+
+  context "when comparing aces" do
+    let(:ace1) { klass.new(sid, mask, klass::INHERIT_ONLY_ACE, klass::ACCESS_DENIED_ACE_TYPE) }
+    let(:ace2) { klass.new(sid, mask, klass::INHERIT_ONLY_ACE, klass::ACCESS_DENIED_ACE_TYPE) }
+
+    it "returns true if different objects have the same set of values" do
+    ace1.should == ace2
+    end
+
+    it "returns false if different objects have different sets of values" do
+      ace = klass.new(sid, mask)
+      ace.should_not == ace1
+    end
+
+    it "returns true when testing if two objects are eql?" do
+      ace1.eql?(ace2)
+    end
+
+    it "returns false when comparing object identity" do
+      ace1.should_not be_equal(ace2)
+    end
+  end
+end

data/spec/unit/util/windows/access_control_list_spec.rb

@@ -0,0 +1,133 @@
+#!/usr/bin/env ruby
+require 'spec_helper'
+require 'puppet/util/windows'
+
+describe "Puppet::Util::Windows::AccessControlList", :if => Puppet.features.microsoft_windows? do
+  let(:klass) { Puppet::Util::Windows::AccessControlList }
+  let(:system_sid) { 'S-1-5-18' }
+  let(:admins_sid) { 'S-1-5-544' }
+  let(:none_sid)   { 'S-1-0-0' }
+
+  let(:system_ace) do
+    Puppet::Util::Windows::AccessControlEntry.new(system_sid, 0x1)
+  end
+  let(:admins_ace) do
+    Puppet::Util::Windows::AccessControlEntry.new(admins_sid, 0x2)
+  end
+  let(:none_ace) do
+    Puppet::Util::Windows::AccessControlEntry.new(none_sid, 0x3)
+  end
+
+  it "constructs an empty list" do
+    acl = klass.new
+
+    acl.to_a.should be_empty
+  end
+
+  it "supports copy constructor" do
+    aces = klass.new([system_ace]).to_a
+
+    aces.to_a.should == [system_ace]
+  end
+
+  context "appending" do
+    it "appends an allow ace" do
+      acl = klass.new
+      acl.allow(system_sid, 0x1, 0x2)
+
+      acl.first.type.should == klass::ACCESS_ALLOWED_ACE_TYPE
+    end
+
+    it "appends a deny ace" do
+      acl = klass.new
+      acl.deny(system_sid, 0x1, 0x2)
+
+      acl.first.type.should == klass::ACCESS_DENIED_ACE_TYPE
+    end
+
+    it "always appends, never overwrites an ACE" do
+      acl = klass.new([system_ace])
+      acl.allow(admins_sid, admins_ace.mask, admins_ace.flags)
+
+      aces = acl.to_a
+      aces.size.should == 2
+      aces[0].should == system_ace
+      aces[1].sid.should == admins_sid
+      aces[1].mask.should == admins_ace.mask
+      aces[1].flags.should == admins_ace.flags
+    end
+  end
+
+  context "reassigning" do
+    it "preserves the mask from the old sid when reassigning to the new sid" do
+      dacl = klass.new([system_ace])
+
+      dacl.reassign!(system_ace.sid, admins_ace.sid)
+      # we removed system, so ignore prepended ace
+      ace = dacl.to_a[1]
+      ace.sid.should == admins_sid
+      ace.mask.should == system_ace.mask
+    end
+
+    it "matches multiple sids" do
+      dacl = klass.new([system_ace, system_ace])
+
+      dacl.reassign!(system_ace.sid, admins_ace.sid)
+      # we removed system, so ignore prepended ace
+      aces = dacl.to_a
+      aces.size.should == 3
+      aces.to_a[1,2].each do |ace|
+        ace.sid.should == admins_ace.sid
+      end
+    end
+
+    it "preserves aces for sids that don't match, in their original order" do
+      dacl = klass.new([system_ace, admins_ace])
+
+      dacl.reassign!(system_sid, none_sid)
+      aces = dacl.to_a
+      aces[1].sid == admins_ace.sid
+    end
+
+    it "preserves inherited aces, even if the sids match" do
+      flags = Puppet::Util::Windows::AccessControlEntry::INHERITED_ACE
+      inherited_ace = Puppet::Util::Windows::AccessControlEntry.new(system_sid, 0x1, flags)
+      dacl = klass.new([inherited_ace, system_ace])
+      dacl.reassign!(system_sid, none_sid)
+      aces = dacl.to_a
+
+      aces[0].sid.should == system_sid
+    end
+
+    it "prepends an explicit ace for the new sid with the same mask and basic inheritance as the inherited ace" do
+      expected_flags =
+        Puppet::Util::Windows::AccessControlEntry::OBJECT_INHERIT_ACE |
+        Puppet::Util::Windows::AccessControlEntry::CONTAINER_INHERIT_ACE |
+        Puppet::Util::Windows::AccessControlEntry::INHERIT_ONLY_ACE
+
+      flags = Puppet::Util::Windows::AccessControlEntry::INHERITED_ACE | expected_flags
+
+      inherited_ace = Puppet::Util::Windows::AccessControlEntry.new(system_sid, 0x1, flags)
+      dacl = klass.new([inherited_ace])
+      dacl.reassign!(system_sid, none_sid)
+      aces = dacl.to_a
+
+      aces.size.should == 2
+      aces[0].sid.should == none_sid
+      aces[0].should_not be_inherited
+      aces[0].flags.should == expected_flags
+
+      aces[1].sid.should == system_sid
+      aces[1].should be_inherited
+    end
+
+    it "makes a copy of the ace prior to modifying it" do
+      arr = [system_ace]
+
+      acl = klass.new(arr)
+      acl.reassign!(system_sid, none_sid)
+
+      arr[0].sid.should == system_sid
+    end
+  end
+end

data/spec/unit/util/windows/root_certs_spec.rb

@@ -3,13 +3,15 @@ require 'spec_helper'
 require 'puppet/util/windows'
 
 describe "Puppet::Util::Windows::RootCerts", :if => Puppet::Util::Platform.windows? do
-  let(:klass) { Puppet::Util::Windows::RootCerts }
-  let(:x509) { 'mycert' }
-
-  context '#each' do
-    it "should enumerate each root cert" do
-      klass.expects(:load_certs).returns([x509])
-      klass.instance.to_a.should == [x509]
-    end
+  let(:x509_store) { Puppet::Util::Windows::RootCerts.instance.to_a }
+
+  it "should return at least one X509 certificate" do
+    expect(x509_store.to_a).to have_at_least(1).items
+  end
+
+  it "should return an X509 certificate with a subject" do
+    x509 = x509_store.first
+
+    expect(x509.subject.to_s).to match(/CN=.*/)
   end
 end

data/spec/unit/util/windows/security_descriptor_spec.rb

@@ -0,0 +1,117 @@
+#!/usr/bin/env ruby
+
+require 'spec_helper'
+require 'puppet/util/windows'
+
+describe "Puppet::Util::Windows::SecurityDescriptor", :if => Puppet.features.microsoft_windows? do
+  let(:system_sid) { Win32::Security::SID::LocalSystem }
+  let(:admins_sid) { Win32::Security::SID::BuiltinAdministrators }
+  let(:group_sid) { Win32::Security::SID::Nobody }
+  let(:new_sid)   { 'S-1-5-32-500-1-2-3' }
+
+  def empty_dacl
+    Puppet::Util::Windows::AccessControlList.new
+  end
+
+  def system_ace_dacl
+    dacl = Puppet::Util::Windows::AccessControlList.new
+    dacl.allow(system_sid, 0x1)
+    dacl
+  end
+
+  context "owner" do
+    it "changes the owner" do
+      sd = Puppet::Util::Windows::SecurityDescriptor.new(system_sid, group_sid, system_ace_dacl)
+      sd.owner = new_sid
+
+      sd.owner.should == new_sid
+    end
+
+    it "performs a noop if the new owner is the same as the old one" do
+      dacl = system_ace_dacl
+      sd = Puppet::Util::Windows::SecurityDescriptor.new(system_sid, group_sid, dacl)
+      sd.owner = sd.owner
+
+      sd.dacl.object_id.should == dacl.object_id
+    end
+
+    it "prepends SYSTEM when security descriptor owner is no longer SYSTEM" do
+      sd = Puppet::Util::Windows::SecurityDescriptor.new(system_sid, group_sid, system_ace_dacl)
+      sd.owner = new_sid
+
+      aces = sd.dacl.to_a
+      aces.size.should == 2
+      aces[0].sid.should == system_sid
+      aces[1].sid.should == new_sid
+    end
+
+    it "does not prepend SYSTEM when DACL already contains inherited SYSTEM ace" do
+      sd = Puppet::Util::Windows::SecurityDescriptor.new(admins_sid, system_sid, empty_dacl)
+      sd.dacl.allow(admins_sid, 0x1)
+      sd.dacl.allow(system_sid, 0x1, Puppet::Util::Windows::AccessControlEntry::INHERITED_ACE)
+      sd.owner = new_sid
+
+      aces = sd.dacl.to_a
+      aces.size.should == 2
+      aces[0].sid.should == new_sid
+    end
+
+    it "does not prepend SYSTEM when security descriptor owner wasn't SYSTEM" do
+      sd = Puppet::Util::Windows::SecurityDescriptor.new(group_sid, group_sid, empty_dacl)
+      sd.dacl.allow(group_sid, 0x1)
+      sd.owner = new_sid
+
+      aces = sd.dacl.to_a
+      aces.size.should == 1
+      aces[0].sid.should == new_sid
+    end
+  end
+
+  context "group" do
+    it "changes the group" do
+      sd = Puppet::Util::Windows::SecurityDescriptor.new(system_sid, group_sid, system_ace_dacl)
+      sd.group = new_sid
+
+      sd.group.should == new_sid
+    end
+
+    it "performs a noop if the new group is the same as the old one" do
+      dacl = system_ace_dacl
+      sd = Puppet::Util::Windows::SecurityDescriptor.new(system_sid, group_sid, dacl)
+      sd.group = sd.group
+
+      sd.dacl.object_id.should == dacl.object_id
+    end
+
+    it "prepends SYSTEM when security descriptor group is no longer SYSTEM" do
+      sd = Puppet::Util::Windows::SecurityDescriptor.new(new_sid, system_sid, system_ace_dacl)
+      sd.group = new_sid
+
+      aces = sd.dacl.to_a
+      aces.size.should == 2
+      aces[0].sid.should == system_sid
+      aces[1].sid.should == new_sid
+    end
+
+    it "does not prepend SYSTEM when DACL already contains inherited SYSTEM ace" do
+      sd = Puppet::Util::Windows::SecurityDescriptor.new(admins_sid, admins_sid, empty_dacl)
+      sd.dacl.allow(admins_sid, 0x1)
+      sd.dacl.allow(system_sid, 0x1, Puppet::Util::Windows::AccessControlEntry::INHERITED_ACE)
+      sd.group = new_sid
+
+      aces = sd.dacl.to_a
+      aces.size.should == 2
+      aces[0].sid.should == new_sid
+    end
+
+    it "does not prepend SYSTEM when security descriptor group wasn't SYSTEM" do
+      sd = Puppet::Util::Windows::SecurityDescriptor.new(group_sid, group_sid, empty_dacl)
+      sd.dacl.allow(group_sid, 0x1)
+      sd.group = new_sid
+
+      aces = sd.dacl.to_a
+      aces.size.should == 1
+      aces[0].sid.should == new_sid
+    end
+  end
+end