puppet 3.4.3 → 3.5.0.rc1

data/spec/unit/ssl/certificate_authority/interface_spec.rb

@@ -185,7 +185,7 @@ describe Puppet::SSL::CertificateAuthority::Interface do
         @digest = mock("digest")
         @digest.stubs(:to_s).returns("(fingerprint)")
         @ca.expects(:waiting?).returns %w{host1 host2 host3}
-        @ca.expects(:list).returns %w{host4 host5 host6}
+        @ca.expects(:list).returns(%w{host4 host5 host6}).at_most(1)
         @csr.stubs(:digest).returns @digest
         @cert.stubs(:digest).returns @digest
         @ca.stubs(:verify)
@@ -207,6 +207,7 @@ describe Puppet::SSL::CertificateAuthority::Interface do
 
       describe "and :all was provided" do
         it "should print a string containing all certificate requests and certificates" do
+          @ca.expects(:list).returns %w{host4 host5 host6}
           @ca.stubs(:verify).with("host4").raises(Puppet::SSL::CertificateAuthority::CertificateVerificationError.new(23), "certificate revoked")
 
           applier = @class.new(:list, :to => :all)
@@ -226,6 +227,7 @@ describe Puppet::SSL::CertificateAuthority::Interface do
 
       describe "and :signed was provided" do
         it "should print a string containing all signed certificate requests and certificates" do
+          @ca.expects(:list).returns %w{host4 host5 host6}
           applier = @class.new(:list, :to => :signed)
 
           applier.expects(:puts).with(<<-OUTPUT.chomp)

data/spec/unit/ssl/certificate_authority_spec.rb

@@ -165,7 +165,7 @@ describe Puppet::SSL::CertificateAuthority do
     it "should create and store a password at :capass" do
       Puppet[:capass] = File.expand_path("/path/to/pass")
 
-      Puppet::FileSystem::File.expects(:exist?).with(Puppet[:capass]).returns false
+      Puppet::FileSystem.expects(:exist?).with(Puppet[:capass]).returns false
 
       fh = StringIO.new
       Puppet.settings.setting(:capass).expects(:open).with('w').yields fh
@@ -619,7 +619,7 @@ describe Puppet::SSL::CertificateAuthority do
         it "should do nothing if no autosign.conf exists" do
           Puppet[:autosign] = autosign
           non_existent_file = Puppet::FileSystem::MemoryFile.a_missing_file(autosign)
-          Puppet::FileSystem::File.overlay(non_existent_file) do
+          Puppet::FileSystem.overlay(non_existent_file) do
             @ca.expects(:sign).never
             @ca.autosign(csr)
           end
@@ -634,7 +634,7 @@ describe Puppet::SSL::CertificateAuthority do
 
           describe "when creating the AuthStore instance to verify autosigning" do
             it "should create an AuthStore with each line in the configuration file allowed to be autosigned" do
-              Puppet::FileSystem::File.overlay(Puppet::FileSystem::MemoryFile.a_regular_file_containing(autosign, "one\ntwo\n")) do
+              Puppet::FileSystem.overlay(Puppet::FileSystem::MemoryFile.a_regular_file_containing(autosign, "one\ntwo\n")) do
                 Puppet::Network::AuthStore.stubs(:new).returns store
 
                 store.expects(:allow).with("one")
@@ -645,7 +645,7 @@ describe Puppet::SSL::CertificateAuthority do
             end
 
             it "should reparse the autosign configuration on each call" do
-              Puppet::FileSystem::File.overlay(Puppet::FileSystem::MemoryFile.a_regular_file_containing(autosign, "one")) do
+              Puppet::FileSystem.overlay(Puppet::FileSystem::MemoryFile.a_regular_file_containing(autosign, "one")) do
                 Puppet::Network::AuthStore.stubs(:new).times(2).returns store
 
                 @ca.autosign(csr)
@@ -654,7 +654,7 @@ describe Puppet::SSL::CertificateAuthority do
             end
 
             it "should ignore comments" do
-              Puppet::FileSystem::File.overlay(Puppet::FileSystem::MemoryFile.a_regular_file_containing(autosign, "one\n#two\n")) do
+              Puppet::FileSystem.overlay(Puppet::FileSystem::MemoryFile.a_regular_file_containing(autosign, "one\n#two\n")) do
                 Puppet::Network::AuthStore.stubs(:new).returns store
 
                 store.expects(:allow).with("one")
@@ -664,7 +664,7 @@ describe Puppet::SSL::CertificateAuthority do
             end
 
             it "should ignore blank lines" do
-              Puppet::FileSystem::File.overlay(Puppet::FileSystem::MemoryFile.a_regular_file_containing(autosign, "one\n\n")) do
+              Puppet::FileSystem.overlay(Puppet::FileSystem::MemoryFile.a_regular_file_containing(autosign, "one\n\n")) do
                 Puppet::Network::AuthStore.stubs(:new).returns store
 
                 store.expects(:allow).with("one")
@@ -687,7 +687,7 @@ describe Puppet::SSL::CertificateAuthority do
         end
 
         it "autosigns the CSR if the autosign command returned true" do
-          Puppet::FileSystem::File.overlay(autosign_executable) do
+          Puppet::FileSystem.overlay(autosign_executable) do
             autosign_cmd.expects(:allowed?).with(csr).returns true
 
             @ca.expects(:sign).with('host')
@@ -696,7 +696,7 @@ describe Puppet::SSL::CertificateAuthority do
         end
 
         it "doesn't autosign the CSR if the autosign_command returned false" do
-          Puppet::FileSystem::File.overlay(autosign_executable) do
+          Puppet::FileSystem.overlay(autosign_executable) do
             autosign_cmd.expects(:allowed?).with(csr).returns false
 
             @ca.expects(:sign).never
@@ -960,7 +960,9 @@ describe Puppet::SSL::CertificateAuthority do
 
         it "handles very large serial numbers" do
           bighex = '0x4000000000000000000000000000000000000000'
-          @ca.crl.expects(:revoke).with { |serial, key| serial == 2**(159-1) }
+          bighex_int = 365375409332725729550921208179070754913983135744
+
+          @ca.crl.expects(:revoke).with(bighex_int, anything)
           Puppet::SSL::Certificate.indirection.expects(:find).with(bighex).returns nil
 
           @ca.revoke(bighex)

data/spec/unit/ssl/certificate_factory_spec.rb

@@ -14,9 +14,9 @@ describe Puppet::SSL::CertificateFactory do
     csr
   end
   let :issuer do
-    cert = OpenSSL::X509::Certificate.new
-    cert.subject = OpenSSL::X509::Name.new([["CN", 'issuer.local']])
-    cert
+    cert = Puppet::SSL::CertificateAuthority.new
+    cert.generate_ca_certificate
+    cert.host.certificate.content
   end
 
   describe "when generating the certificate" do
@@ -76,7 +76,7 @@ describe Puppet::SSL::CertificateFactory do
       cert.not_after.to_i.should == now.to_i + 12
     end
 
-    it "should build extensions for the certificate" do
+    it "should adds an extension for the nsComment" do
       cert = subject.build(:server, csr, issuer, serial)
       cert.extensions.map {|x| x.to_h }.find {|x| x["oid"] == "nsComment" }.should ==
         { "oid"      => "nsComment",
@@ -84,6 +84,21 @@ describe Puppet::SSL::CertificateFactory do
           "critical" => false }
     end
 
+    it "should add an extension for the subjectKeyIdentifer" do
+      cert = subject.build(:server, csr, issuer, serial)
+      ef = OpenSSL::X509::ExtensionFactory.new(issuer, cert)
+      cert.extensions.map { |x| x.to_h }.find {|x| x["oid"] == "subjectKeyIdentifier" }.should ==
+        ef.create_extension("subjectKeyIdentifier", "hash", false).to_h
+    end
+
+
+    it "should add an extension for the authorityKeyIdentifer" do
+      cert = subject.build(:server, csr, issuer, serial)
+      ef = OpenSSL::X509::ExtensionFactory.new(issuer, cert)
+      cert.extensions.map { |x| x.to_h }.find {|x| x["oid"] == "authorityKeyIdentifier" }.should ==
+        ef.create_extension("authorityKeyIdentifier", "keyid:always", false).to_h
+    end
+
     # See #2848 for why we are doing this: we need to make sure that
     # subjectAltName is set if the CSR has it, but *not* if it is set when the
     # certificate is built!

data/spec/unit/ssl/certificate_request_attributes_spec.rb

@@ -27,7 +27,7 @@ describe Puppet::SSL::CertificateRequestAttributes do
 
     context "with an available attributes file" do
       before do
-        Puppet::FileSystem::File.expects(:exist?).with(csr_attributes_path).returns(true)
+        Puppet::FileSystem.expects(:exist?).with(csr_attributes_path).returns(true)
         Puppet::Util::Yaml.expects(:load_file).with(csr_attributes_path, {}).returns(csr_attributes_hash)
       end
 

data/spec/unit/ssl/certificate_revocation_list_spec.rb

@@ -5,34 +5,64 @@ require 'puppet/ssl/certificate_revocation_list'
 
 describe Puppet::SSL::CertificateRevocationList do
   before do
-    @cert = stub 'cert', :subject => "mysubject"
-    @key = stub 'key', :private? => true
-
+    ca = Puppet::SSL::CertificateAuthority.new
+    ca.generate_ca_certificate
+    @cert = ca.host.certificate.content
+    @key = ca.host.key.content
     @class = Puppet::SSL::CertificateRevocationList
   end
 
+  def expects_time_close_to_now(time)
+    expect(time.to_i).to be_within(5*60).of(Time.now.to_i)
+  end
+
+  def expects_time_close_to_five_years(time)
+    future = Time.now + Puppet::SSL::CertificateRevocationList::FIVE_YEARS
+    expect(time.to_i).to be_within(5*60).of(future.to_i)
+  end
+
+  def expects_crlnumber_extension(crl, value)
+    crlNumber = crl.content.extensions.find { |ext| ext.oid == "crlNumber" }
+
+    expect(crlNumber.value).to eq(value.to_s)
+    expect(crlNumber).to_not be_critical
+  end
+
+  def expects_authkeyid_extension(crl, cert)
+    subjectKeyId = cert.extensions.find { |ext| ext.oid == 'subjectKeyIdentifier' }.value
+
+    authKeyId = crl.content.extensions.find { |ext| ext.oid == "authorityKeyIdentifier" }
+    expect(authKeyId.value.chomp).to eq("keyid:#{subjectKeyId}")
+    expect(authKeyId).to_not be_critical
+  end
+
+  def expects_crlreason_extension(crl, reason)
+    revoke = crl.content.revoked.first
+
+    crlNumber = crl.content.extensions.find { |ext| ext.oid == "crlNumber" }
+    expect(revoke.serial.to_s).to eq(crlNumber.value)
+
+    crlReason = revoke.extensions.find { |ext| ext.oid = 'CRLReason' }
+    expect(crlReason.value).to eq(reason)
+    expect(crlReason).to_not be_critical
+  end
+
   it "should only support the text format" do
     @class.supported_formats.should == [:s]
   end
 
   describe "when converting from a string" do
-    it "should create a CRL instance with its name set to 'foo' and its content set to the extracted CRL" do
-      crl = stub 'crl', :is_a? => true
-      OpenSSL::X509::CRL.expects(:new).returns(crl)
+    it "deserializes a CRL" do
+      crl = @class.new('foo')
+      crl.generate(@cert, @key)
 
-      mycrl = stub 'sslcrl'
-      mycrl.expects(:content=).with(crl)
-
-      @class.expects(:new).with("foo").returns mycrl
-
-      @class.from_s("my crl").should == mycrl
+      new_crl = @class.from_s(crl.to_s)
+      expect(new_crl.content.to_text).to eq(crl.content.to_text)
     end
   end
 
   describe "when an instance" do
     before do
-      @class.any_instance.stubs(:read_or_generate)
-
       @crl = @class.new("whatever")
     end
 
@@ -47,63 +77,55 @@ describe Puppet::SSL::CertificateRevocationList do
 
   describe "when generating the crl" do
     before do
-      @real_crl = mock 'crl'
-      @real_crl.stub_everything
-
-      OpenSSL::X509::CRL.stubs(:new).returns(@real_crl)
-
-      @class.any_instance.stubs(:read_or_generate)
-
       @crl = @class.new("crl")
     end
 
     it "should set its issuer to the subject of the passed certificate" do
-      @real_crl.expects(:issuer=).with(@cert.subject)
-
-      @crl.generate(@cert, @key)
+      @crl.generate(@cert, @key).issuer.to_s.should == @cert.subject.to_s
     end
 
     it "should set its version to 1" do
-      @real_crl.expects(:version=).with(1)
-
-      @crl.generate(@cert, @key)
+      @crl.generate(@cert, @key).version.should == 1
     end
 
     it "should create an instance of OpenSSL::X509::CRL" do
-      OpenSSL::X509::CRL.expects(:new).returns(@real_crl)
-
-      @crl.generate(@cert, @key)
+      @crl.generate(@cert, @key).should be_an_instance_of(OpenSSL::X509::CRL)
     end
 
-    # The next three tests aren't good, but at least they
-    # specify the behaviour.
     it "should add an extension for the CRL number" do
-      @real_crl.expects(:extensions=)
       @crl.generate(@cert, @key)
+
+      expects_crlnumber_extension(@crl, 0)
     end
 
-    it "should set the last update time" do
-      @real_crl.expects(:last_update=)
+    it "should add an extension for the authority key identifier" do
       @crl.generate(@cert, @key)
+
+      expects_authkeyid_extension(@crl, @cert)
     end
 
-    it "should set the next update time" do
-      @real_crl.expects(:next_update=)
-      @crl.generate(@cert, @key)
+    it "returns the last update time in UTC" do
+      # http://tools.ietf.org/html/rfc5280#section-5.1.2.4
+      thisUpdate = @crl.generate(@cert, @key).last_update
+      thisUpdate.should be_utc
+      expects_time_close_to_now(thisUpdate)
     end
 
-    it "should sign the CRL" do
-      @real_crl.expects(:sign).with { |key, digest| key == @key }
-      @crl.generate(@cert, @key)
+    it "returns the next update time in UTC 5 years from now" do
+      # http://tools.ietf.org/html/rfc5280#section-5.1.2.5
+      nextUpdate = @crl.generate(@cert, @key).next_update
+      nextUpdate.should be_utc
+      expects_time_close_to_five_years(nextUpdate)
     end
 
-    it "should set the content to the generated crl" do
-      @crl.generate(@cert, @key)
-      @crl.content.should equal(@real_crl)
+    it "should verify using the CA public_key" do
+      @crl.generate(@cert, @key).verify(@key.public_key).should be_true
     end
 
-    it "should return the generated crl" do
-      @crl.generate(@cert, @key).should equal(@real_crl)
+    it "should set the content to the generated crl" do
+      # this test shouldn't be needed since we test the return of generate() which should be the content field
+      @crl.generate(@cert, @key)
+      @crl.content.should be_an_instance_of(OpenSSL::X509::CRL)
     end
   end
 
@@ -111,47 +133,26 @@ describe Puppet::SSL::CertificateRevocationList do
   # SSL stuff is very complicated.  It just hits the high points.
   describe "when revoking a certificate" do
     before do
-      @class.wrapped_class.any_instance.stubs(:issuer=)
-      @class.wrapped_class.any_instance.stubs(:sign)
-
       @crl = @class.new("crl")
       @crl.generate(@cert, @key)
-      @crl.content.stubs(:sign)
 
       Puppet::SSL::CertificateRevocationList.indirection.stubs :save
-
-      @key = mock 'key'
     end
 
     it "should require a serial number and the CA's private key" do
-      lambda { @crl.revoke }.should raise_error(ArgumentError)
-    end
-
-    it "should default to OpenSSL::OCSP::REVOKED_STATUS_KEYCOMPROMISE as the revocation reason" do
-      # This makes it a bit more of an integration test than we'd normally like, but that's life
-      # with openssl.
-      reason = OpenSSL::ASN1::Enumerated(OpenSSL::OCSP::REVOKED_STATUS_KEYCOMPROMISE)
-      OpenSSL::ASN1.expects(:Enumerated).with(OpenSSL::OCSP::REVOKED_STATUS_KEYCOMPROMISE).returns reason
-
-      @crl.revoke(1, @key)
+      expect { @crl.revoke }.to raise_error(ArgumentError)
     end
 
     it "should mark the CRL as updated at a time that makes it valid now" do
-      time = Time.now
-      Time.stubs(:now).returns time
-
-      @crl.content.expects(:last_update=).with(time - 1)
-
       @crl.revoke(1, @key)
+
+      expects_time_close_to_now(@crl.content.last_update)
     end
 
     it "should mark the CRL valid for five years" do
-      time = Time.now
-      Time.stubs(:now).returns time
-
-      @crl.content.expects(:next_update=).with(time + (5 * 365*24*60*60))
-
       @crl.revoke(1, @key)
+
+      expects_time_close_to_five_years(@crl.content.next_update)
     end
 
     it "should sign the CRL with the CA's private key and a digest instance" do
@@ -163,5 +164,33 @@ describe Puppet::SSL::CertificateRevocationList do
       Puppet::SSL::CertificateRevocationList.indirection.expects(:save).with(@crl, nil)
       @crl.revoke(1, @key)
     end
+
+    it "adds the crlNumber extension containing the serial number" do
+      serial = 1
+      @crl.revoke(serial, @key)
+
+      expects_crlnumber_extension(@crl, serial)
+    end
+
+    it "adds the CA cert's subjectKeyId as the authorityKeyIdentifier to the CRL" do
+      @crl.revoke(1, @key)
+
+      expects_authkeyid_extension(@crl, @cert)
+    end
+
+    it "adds a non-critical CRL reason specifying key compromise by default" do
+      # http://tools.ietf.org/html/rfc5280#section-5.3.1
+      serial = 1
+      @crl.revoke(serial, @key)
+
+      expects_crlreason_extension(@crl, 'Key Compromise')
+    end
+
+    it "allows alternate reasons to be specified" do
+      serial = 1
+      @crl.revoke(serial, @key, OpenSSL::OCSP::REVOKED_STATUS_CACOMPROMISE)
+
+      expects_crlreason_extension(@crl, 'CA Compromise')
+    end
   end
 end

data/spec/unit/ssl/host_spec.rb

@@ -2,6 +2,7 @@
 require 'spec_helper'
 
 require 'puppet/ssl/host'
+require 'matchers/json'
 
 def base_pson_comparison(result, pson_hash)
   result["fingerprint"].should == pson_hash["fingerprint"]
@@ -9,24 +10,10 @@ def base_pson_comparison(result, pson_hash)
   result["state"].should       == pson_hash["desired_state"]
 end
 
-# the json-schema gem doesn't support windows
-if not Puppet.features.microsoft_windows?
-  HOST_SCHEMA = JSON.parse(File.read(File.join(File.dirname(__FILE__), '../../../api/schemas/host.json')))
-
-  describe "host schema" do
-    it "should validate against the json meta-schema" do
-      JSON::Validator.validate!(JSON_META_SCHEMA, HOST_SCHEMA)
-    end
-  end
-end
-
 describe Puppet::SSL::Host do
+  include JSONMatchers
   include PuppetSpec::Files
 
-  def validate_json_for_host(host)
-    JSON::Validator.validate!(HOST_SCHEMA, host.to_pson)
-  end
-
   before do
     Puppet::SSL::Host.indirection.terminus_class = :file
 
@@ -855,9 +842,10 @@ describe Puppet::SSL::Host do
         base_pson_comparison result, pson_hash
       end
 
-      it "should validate against the schema", :unless => Puppet.features.microsoft_windows? do
+      it "should validate against the schema" do
         host.generate_certificate_request
-        validate_json_for_host(host)
+
+        expect(host.to_pson).to validate_against('api/schemas/host.json')
       end
 
       describe "explicit fingerprints" do
@@ -903,8 +891,8 @@ describe Puppet::SSL::Host do
               result["dns_alt_names"].should == pson_hash["desired_alt_names"]
             end
 
-            it "should validate against the schema", :unless => Puppet.features.microsoft_windows? do
-              validate_json_for_host(host)
+            it "should validate against the schema" do
+              expect(host.to_pson).to validate_against('api/schemas/host.json')
             end
           end
         end
@@ -943,7 +931,7 @@ describe Puppet::SSL::Host do
           "name"  => host.name,
           "desired_state" => host.desired_state,
         }
-        generated_host = Puppet::SSL::Host.from_pson(pson_hash)
+        generated_host = Puppet::SSL::Host.from_data_hash(pson_hash)
         generated_host.desired_state.should == host.desired_state
         generated_host.name.should == host.name
       end