puppet 3.7.0-x64-mingw32

data/spec/unit/network/http/api/v2/authorization_spec.rb

@@ -0,0 +1,57 @@
+require 'spec_helper'
+
+require 'puppet/network/http'
+
+describe Puppet::Network::HTTP::API::V2::Authorization do
+  HTTP = Puppet::Network::HTTP
+
+  let(:response) { HTTP::MemoryResponse.new }
+  let(:authz) { HTTP::API::V2::Authorization.new }
+
+  it "only authorizes GET requests" do
+    request = HTTP::Request.from_hash({
+      :method => "POST"
+    })
+
+    expect do
+      authz.call(request, response)
+    end.to raise_error(HTTP::Error::HTTPNotAuthorizedError)
+  end
+
+  it "accepts v2 api requests that match allowed authconfig entries" do
+    request = HTTP::Request.from_hash({
+      :path => "/v2.0/environments",
+      :method => "GET",
+      :params => { :authenticated => true, :node => "testing", :ip => "127.0.0.1" }
+    })
+
+    authz.stubs(:authconfig).returns(Puppet::Network::AuthConfigParser.new(<<-AUTH).parse)
+path /v2.0/environments
+method find
+allow *
+    AUTH
+
+    expect do
+      authz.call(request, response)
+    end.to_not raise_error
+  end
+
+  it "rejects v2 api requests that are disallowed by authconfig entries" do
+    request = HTTP::Request.from_hash({
+      :path => "/v2.0/environments",
+      :method => "GET",
+      :params => { :node => "testing", :ip => "127.0.0.1" }
+    })
+
+    authz.stubs(:authconfig).returns(Puppet::Network::AuthConfigParser.new(<<-AUTH).parse)
+path /v2.0/environments
+method find
+auth any
+deny testing
+    AUTH
+
+    expect do
+      authz.call(request, response)
+    end.to raise_error(HTTP::Error::HTTPNotAuthorizedError, /Forbidden request/)
+  end
+end

data/spec/unit/network/http/api/v2/environments_spec.rb

@@ -0,0 +1,63 @@
+require 'spec_helper'
+
+require 'puppet/node/environment'
+require 'puppet/network/http'
+require 'matchers/json'
+
+describe Puppet::Network::HTTP::API::V2::Environments do
+  include JSONMatchers
+
+  it "responds with all of the available environments" do
+    environment = Puppet::Node::Environment.create(:production, ["/first", "/second"], '/manifests')
+    loader = Puppet::Environments::Static.new(environment)
+    handler = Puppet::Network::HTTP::API::V2::Environments.new(loader)
+    response = Puppet::Network::HTTP::MemoryResponse.new
+
+    handler.call(Puppet::Network::HTTP::Request.from_hash(:headers => { 'accept' => 'application/json' }), response)
+
+    expect(response.code).to eq(200)
+    expect(response.type).to eq("application/json")
+    expect(JSON.parse(response.body)).to eq({
+      "search_paths" => loader.search_paths,
+      "environments" => {
+        "production" => {
+          "settings" => {
+            "modulepath" => [File.expand_path("/first"), File.expand_path("/second")],
+            "manifest" => File.expand_path("/manifests"),
+            "environment_timeout" => 0,
+            "config_version" => ""
+          }
+        }
+      }
+    })
+  end
+
+  it "the response conforms to the environments schema for unlimited timeout" do
+    conf_stub = stub 'conf_stub'
+    conf_stub.expects(:environment_timeout).returns(1.0 / 0.0)
+    environment = Puppet::Node::Environment.create(:production, [])
+    env_loader = Puppet::Environments::Static.new(environment)
+    env_loader.expects(:get_conf).with(:production).returns(conf_stub)
+    handler = Puppet::Network::HTTP::API::V2::Environments.new(env_loader)
+    response = Puppet::Network::HTTP::MemoryResponse.new
+
+    handler.call(Puppet::Network::HTTP::Request.from_hash(:headers => { 'accept' => 'application/json' }), response)
+
+    expect(response.body).to validate_against('api/schemas/environments.json')
+  end
+
+  it "the response conforms to the environments schema for integer timeout" do
+    conf_stub = stub 'conf_stub'
+    conf_stub.expects(:environment_timeout).returns(1)
+    environment = Puppet::Node::Environment.create(:production, [])
+    env_loader = Puppet::Environments::Static.new(environment)
+    env_loader.expects(:get_conf).with(:production).returns(conf_stub)
+    handler = Puppet::Network::HTTP::API::V2::Environments.new(env_loader)
+    response = Puppet::Network::HTTP::MemoryResponse.new
+
+    handler.call(Puppet::Network::HTTP::Request.from_hash(:headers => { 'accept' => 'application/json' }), response)
+
+    expect(response.body).to validate_against('api/schemas/environments.json')
+  end
+
+end

data/spec/unit/network/http/api/v2_spec.rb

@@ -0,0 +1,14 @@
+require 'spec_helper'
+
+require 'puppet/network/http'
+
+describe Puppet::Network::HTTP::API::V2 do
+  it "responds to unknown paths with a 404" do
+    response = Puppet::Network::HTTP::MemoryResponse.new
+    request = Puppet::Network::HTTP::Request.from_hash(:path => "/v2.0/unknown")
+
+    expect do
+      Puppet::Network::HTTP::API::V2.routes.process(request, response)
+    end.to raise_error(Puppet::Network::HTTP::Error::HTTPNotFoundError)
+  end
+end

data/spec/unit/network/http/compression_spec.rb

@@ -0,0 +1,196 @@
+#! /usr/bin/env ruby
+require 'spec_helper'
+
+describe "http compression" do
+
+  describe "when zlib is not available" do
+    before(:each) do
+      Puppet.features.stubs(:zlib?).returns false
+
+      require 'puppet/network/http/compression'
+      class HttpUncompressor
+        include Puppet::Network::HTTP::Compression::None
+      end
+
+      @uncompressor = HttpUncompressor.new
+    end
+
+    it "should have a module function that returns the None underlying module" do
+      Puppet::Network::HTTP::Compression.module.should == Puppet::Network::HTTP::Compression::None
+    end
+
+    it "should not add any Accept-Encoding header" do
+      @uncompressor.add_accept_encoding({}).should == {}
+    end
+
+    it "should not tamper the body" do
+      response = stub 'response', :body => "data"
+      @uncompressor.uncompress_body(response).should == "data"
+    end
+
+    it "should yield an identity uncompressor" do
+      response = stub 'response'
+      @uncompressor.uncompress(response) { |u|
+        u.should be_instance_of(Puppet::Network::HTTP::Compression::IdentityAdapter)
+      }
+    end
+  end
+
+  describe "when zlib is available", :if => Puppet.features.zlib? do
+    before(:each) do
+      Puppet.features.stubs(:zlib?).returns true
+
+      require 'puppet/network/http/compression'
+      class HttpUncompressor
+        include Puppet::Network::HTTP::Compression::Active
+      end
+
+      @uncompressor = HttpUncompressor.new
+    end
+
+    it "should have a module function that returns the Active underlying module" do
+      Puppet::Network::HTTP::Compression.module.should == Puppet::Network::HTTP::Compression::Active
+    end
+
+    it "should add an Accept-Encoding header when http compression is available" do
+      Puppet[:http_compression] = true
+      headers = @uncompressor.add_accept_encoding({})
+      headers.should have_key('accept-encoding')
+      headers['accept-encoding'].should =~ /gzip/
+      headers['accept-encoding'].should =~ /deflate/
+      headers['accept-encoding'].should =~ /identity/
+    end
+
+    it "should not add Accept-Encoding header if http compression is not available" do
+      Puppet[:http_compression] = false
+      @uncompressor.add_accept_encoding({}).should == {}
+    end
+
+    describe "when uncompressing response body" do
+      before do
+        @response = stub 'response'
+        @response.stubs(:[]).with('content-encoding')
+        @response.stubs(:body).returns("mydata")
+      end
+
+      it "should return untransformed response body with no content-encoding" do
+        @uncompressor.uncompress_body(@response).should == "mydata"
+      end
+
+      it "should return untransformed response body with 'identity' content-encoding" do
+        @response.stubs(:[]).with('content-encoding').returns('identity')
+        @uncompressor.uncompress_body(@response).should == "mydata"
+      end
+
+      it "should use a Zlib inflater with 'deflate' content-encoding" do
+        @response.stubs(:[]).with('content-encoding').returns('deflate')
+
+        inflater = stub 'inflater'
+        Zlib::Inflate.expects(:new).returns(inflater)
+        inflater.expects(:inflate).with("mydata").returns "uncompresseddata"
+
+        @uncompressor.uncompress_body(@response).should == "uncompresseddata"
+      end
+
+      it "should use a GzipReader with 'gzip' content-encoding" do
+        @response.stubs(:[]).with('content-encoding').returns('gzip')
+
+        io = stub 'io'
+        StringIO.expects(:new).with("mydata").returns io
+
+        reader = stub 'gzip reader'
+        Zlib::GzipReader.expects(:new).with(io).returns(reader)
+        reader.expects(:read).returns "uncompresseddata"
+
+        @uncompressor.uncompress_body(@response).should == "uncompresseddata"
+      end
+    end
+
+    describe "when uncompressing by chunk" do
+      before do
+        @response = stub 'response'
+        @response.stubs(:[]).with('content-encoding')
+
+        @inflater = stub_everything 'inflater'
+        Zlib::Inflate.stubs(:new).returns(@inflater)
+      end
+
+      it "should yield an identity uncompressor with no content-encoding" do
+        @uncompressor.uncompress(@response) { |u|
+          u.should be_instance_of(Puppet::Network::HTTP::Compression::IdentityAdapter)
+        }
+      end
+
+      it "should yield an identity uncompressor with 'identity' content-encoding" do
+        @response.stubs(:[]).with('content-encoding').returns 'identity'
+        @uncompressor.uncompress(@response) { |u|
+          u.should be_instance_of(Puppet::Network::HTTP::Compression::IdentityAdapter)
+        }
+      end
+
+      %w{gzip deflate}.each do |c|
+        it "should yield a Zlib uncompressor with '#{c}' content-encoding" do
+          @response.stubs(:[]).with('content-encoding').returns c
+          @uncompressor.uncompress(@response) { |u|
+            u.should be_instance_of(Puppet::Network::HTTP::Compression::Active::ZlibAdapter)
+          }
+        end
+      end
+
+      it "should close the underlying adapter" do
+        adapter = stub_everything 'adapter'
+        Puppet::Network::HTTP::Compression::IdentityAdapter.expects(:new).returns(adapter)
+
+        adapter.expects(:close)
+        @uncompressor.uncompress(@response) { |u| }
+      end
+    end
+
+    describe "zlib adapter" do
+      before do
+        @inflater = stub_everything 'inflater'
+        Zlib::Inflate.stubs(:new).returns(@inflater)
+        @adapter = Puppet::Network::HTTP::Compression::Active::ZlibAdapter.new
+      end
+
+      it "should initialize the underlying inflater with gzip/zlib header parsing" do
+        Zlib::Inflate.expects(:new).with(15+32)
+        Puppet::Network::HTTP::Compression::Active::ZlibAdapter.new
+      end
+
+      it "should inflate the given chunk" do
+        @inflater.expects(:inflate).with("chunk")
+        @adapter.uncompress("chunk")
+      end
+
+      it "should return the inflated chunk" do
+        @inflater.stubs(:inflate).with("chunk").returns("uncompressed")
+        @adapter.uncompress("chunk").should == "uncompressed"
+      end
+
+      it "should try a 'regular' inflater on Zlib::DataError" do
+        @inflater.expects(:inflate).raises(Zlib::DataError.new("not a zlib stream"))
+        inflater = stub_everything 'inflater2'
+        inflater.expects(:inflate).with("chunk").returns("uncompressed")
+        Zlib::Inflate.expects(:new).with.returns(inflater)
+        @adapter.uncompress("chunk")
+      end
+
+      it "should raise the error the second time" do
+        @inflater.stubs(:inflate).raises(Zlib::DataError.new("not a zlib stream"))
+        Zlib::Inflate.expects(:new).with.returns(@inflater)
+        lambda { @adapter.uncompress("chunk") }.should raise_error
+      end
+
+      it "should finish the stream on close" do
+        @inflater.expects(:finish)
+        @adapter.close
+      end
+
+      it "should close the stream on close" do
+        @inflater.expects(:close)
+        @adapter.close
+      end
+    end
+  end
+end

data/spec/unit/network/http/connection_spec.rb

@@ -0,0 +1,306 @@
+#! /usr/bin/env ruby
+require 'spec_helper'
+require 'puppet/network/http/connection'
+require 'puppet/network/authentication'
+
+describe Puppet::Network::HTTP::Connection do
+
+  let (:host) { "me" }
+  let (:port) { 54321 }
+  subject { Puppet::Network::HTTP::Connection.new(host, port, :verify => Puppet::SSL::Validator.no_validator) }
+  let (:httpok) { Net::HTTPOK.new('1.1', 200, '') }
+
+  context "when providing HTTP connections" do
+    context "when initializing http instances" do
+      it "should return an http instance created with the passed host and port" do
+        conn = Puppet::Network::HTTP::Connection.new(host, port, :verify => Puppet::SSL::Validator.no_validator)
+
+        expect(conn.address).to eq(host)
+        expect(conn.port).to eq(port)
+      end
+
+      it "should enable ssl on the http instance by default" do
+        conn = Puppet::Network::HTTP::Connection.new(host, port, :verify => Puppet::SSL::Validator.no_validator)
+
+        expect(conn).to be_use_ssl
+      end
+
+      it "can disable ssl using an option" do
+        conn = Puppet::Network::HTTP::Connection.new(host, port, :use_ssl => false, :verify => Puppet::SSL::Validator.no_validator)
+
+        expect(conn).to_not be_use_ssl
+      end
+
+      it "can enable ssl using an option" do
+        conn = Puppet::Network::HTTP::Connection.new(host, port, :use_ssl => true, :verify => Puppet::SSL::Validator.no_validator)
+
+        expect(conn).to be_use_ssl
+      end
+
+      it "should raise Puppet::Error when invalid options are specified" do
+        expect { Puppet::Network::HTTP::Connection.new(host, port, :invalid_option => nil) }.to raise_error(Puppet::Error, 'Unrecognized option(s): :invalid_option')
+      end
+    end
+  end
+
+  context "when methods that accept a block are called with a block" do
+    let (:host) { "my_server" }
+    let (:port) { 8140 }
+    let (:subject) { Puppet::Network::HTTP::Connection.new(host, port, :use_ssl => false, :verify => Puppet::SSL::Validator.no_validator) }
+
+    before :each do
+      httpok.stubs(:body).returns ""
+
+      # This stubbing relies a bit more on knowledge of the internals of Net::HTTP
+      # than I would prefer, but it works on ruby 1.8.7 and 1.9.3, and it seems
+      # valuable enough to have tests for blocks that this is probably warranted.
+      socket = stub_everything("socket")
+      TCPSocket.stubs(:open).returns(socket)
+
+      Net::HTTP::Post.any_instance.stubs(:exec).returns("")
+      Net::HTTP::Head.any_instance.stubs(:exec).returns("")
+      Net::HTTP::Get.any_instance.stubs(:exec).returns("")
+      Net::HTTPResponse.stubs(:read_new).returns(httpok)
+    end
+
+    [:request_get, :request_head, :request_post].each do |method|
+      context "##{method}" do
+        it "should yield to the block" do
+          block_executed = false
+          subject.send(method, "/foo", {}) do |response|
+            block_executed = true
+          end
+          block_executed.should == true
+        end
+      end
+    end
+  end
+
+  class ConstantErrorValidator
+    def initialize(args)
+      @fails_with = args[:fails_with]
+      @error_string = args[:error_string] || ""
+      @peer_certs = args[:peer_certs] || []
+    end
+
+    def setup_connection(connection)
+      connection.stubs(:start).raises(OpenSSL::SSL::SSLError.new(@fails_with))
+    end
+
+    def peer_certs
+      @peer_certs
+    end
+
+    def verify_errors
+      [@error_string]
+    end
+  end
+
+  class NoProblemsValidator
+    def initialize(cert)
+      @cert = cert
+    end
+
+    def setup_connection(connection)
+    end
+
+    def peer_certs
+      [@cert]
+    end
+
+    def verify_errors
+      []
+    end
+  end
+
+  shared_examples_for 'ssl verifier' do
+    include PuppetSpec::Files
+
+    let (:host) { "my_server" }
+    let (:port) { 8140 }
+
+    it "should provide a useful error message when one is available and certificate validation fails", :unless => Puppet.features.microsoft_windows? do
+      connection = Puppet::Network::HTTP::Connection.new(
+        host, port,
+        :verify => ConstantErrorValidator.new(:fails_with => 'certificate verify failed',
+                                              :error_string => 'shady looking signature'))
+
+      expect do
+        connection.get('request')
+      end.to raise_error(Puppet::Error, "certificate verify failed: [shady looking signature]")
+    end
+
+    it "should provide a helpful error message when hostname was not match with server certificate", :unless => Puppet.features.microsoft_windows? do
+      Puppet[:confdir] = tmpdir('conf')
+
+      connection = Puppet::Network::HTTP::Connection.new(
+      host, port,
+      :verify => ConstantErrorValidator.new(
+        :fails_with => 'hostname was not match with server certificate',
+        :peer_certs => [Puppet::SSL::CertificateAuthority.new.generate(
+          'not_my_server', :dns_alt_names => 'foo,bar,baz')]))
+
+      expect do
+        connection.get('request')
+      end.to raise_error(Puppet::Error) do |error|
+        error.message =~ /Server hostname 'my_server' did not match server certificate; expected one of (.+)/
+        $1.split(', ').should =~ %w[DNS:foo DNS:bar DNS:baz DNS:not_my_server not_my_server]
+      end
+    end
+
+    it "should pass along the error message otherwise" do
+      connection = Puppet::Network::HTTP::Connection.new(
+        host, port,
+        :verify => ConstantErrorValidator.new(:fails_with => 'some other message'))
+
+      expect do
+        connection.get('request')
+      end.to raise_error(/some other message/)
+    end
+
+    it "should check all peer certificates for upcoming expiration", :unless => Puppet.features.microsoft_windows? do
+      Puppet[:confdir] = tmpdir('conf')
+      cert = Puppet::SSL::CertificateAuthority.new.generate(
+        'server', :dns_alt_names => 'foo,bar,baz')
+
+      connection = Puppet::Network::HTTP::Connection.new(
+        host, port,
+        :verify => NoProblemsValidator.new(cert))
+
+      Net::HTTP.any_instance.stubs(:start)
+      Net::HTTP.any_instance.stubs(:request).returns(httpok)
+
+      connection.expects(:warn_if_near_expiration).with(cert)
+
+      connection.get('request')
+    end
+  end
+
+  context "when using single use HTTPS connections" do
+    it_behaves_like 'ssl verifier' do
+    end
+  end
+
+  context "when using persistent HTTPS connections" do
+    around :each do |example|
+      pool = Puppet::Network::HTTP::Pool.new
+      Puppet.override(:http_pool => pool) do
+        example.run
+      end
+      pool.close
+    end
+
+    it_behaves_like 'ssl verifier' do
+    end
+  end
+
+  context "when response is a redirect" do
+    let (:site)       { Puppet::Network::HTTP::Site.new('http', 'my_server', 8140) }
+    let (:other_site) { Puppet::Network::HTTP::Site.new('http', 'redirected', 9292) }
+    let (:other_path) { "other-path" }
+    let (:verify) { Puppet::SSL::Validator.no_validator }
+    let (:subject) { Puppet::Network::HTTP::Connection.new(site.host, site.port, :use_ssl => false, :verify => verify) }
+    let (:httpredirection) do
+      response = Net::HTTPFound.new('1.1', 302, 'Moved Temporarily')
+      response['location'] = "#{other_site.addr}/#{other_path}"
+      response.stubs(:read_body).returns("This resource has moved")
+      response
+    end
+
+    def create_connection(site, options)
+      options[:use_ssl] = site.use_ssl?
+      Puppet::Network::HTTP::Connection.new(site.host, site.port, options)
+    end
+
+    it "should redirect to the final resource location" do
+      http = stub('http')
+      http.stubs(:request).returns(httpredirection).then.returns(httpok)
+
+      seq = sequence('redirection')
+      pool = Puppet.lookup(:http_pool)
+      pool.expects(:with_connection).with(site, anything).yields(http).in_sequence(seq)
+      pool.expects(:with_connection).with(other_site, anything).yields(http).in_sequence(seq)
+
+      conn = create_connection(site, :verify => verify)
+      conn.get('/foo')
+    end
+
+    def expects_redirection(conn, &block)
+      http = stub('http')
+      http.stubs(:request).returns(httpredirection)
+
+      pool = Puppet.lookup(:http_pool)
+      pool.expects(:with_connection).with(site, anything).yields(http)
+      pool
+    end
+
+    def expects_limit_exceeded(conn)
+      expect {
+        conn.get('/')
+      }.to raise_error(Puppet::Network::HTTP::RedirectionLimitExceededException)
+    end
+
+    it "should not redirect when the limit is 0" do
+      conn = create_connection(site, :verify => verify, :redirect_limit => 0)
+
+      pool = expects_redirection(conn)
+      pool.expects(:with_connection).with(other_site, anything).never
+
+      expects_limit_exceeded(conn)
+    end
+
+    it "should redirect only once" do
+      conn = create_connection(site, :verify => verify, :redirect_limit => 1)
+
+      pool = expects_redirection(conn)
+      pool.expects(:with_connection).with(other_site, anything).once
+
+      expects_limit_exceeded(conn)
+    end
+
+    it "should raise an exception when the redirect limit is exceeded" do
+      conn = create_connection(site, :verify => verify, :redirect_limit => 3)
+
+      pool = expects_redirection(conn)
+      pool.expects(:with_connection).with(other_site, anything).times(3)
+
+      expects_limit_exceeded(conn)
+    end
+  end
+
+  it "allows setting basic auth on get requests" do
+    expect_request_with_basic_auth
+
+    subject.get('/path', nil, :basic_auth => { :user => 'user', :password => 'password' })
+  end
+
+  it "allows setting basic auth on post requests" do
+    expect_request_with_basic_auth
+
+    subject.post('/path', 'data', nil, :basic_auth => { :user => 'user', :password => 'password' })
+  end
+
+  it "allows setting basic auth on head requests" do
+    expect_request_with_basic_auth
+
+    subject.head('/path', nil, :basic_auth => { :user => 'user', :password => 'password' })
+  end
+
+  it "allows setting basic auth on delete requests" do
+    expect_request_with_basic_auth
+
+    subject.delete('/path', nil, :basic_auth => { :user => 'user', :password => 'password' })
+  end
+
+  it "allows setting basic auth on put requests" do
+    expect_request_with_basic_auth
+
+    subject.put('/path', 'data', nil, :basic_auth => { :user => 'user', :password => 'password' })
+  end
+
+  def expect_request_with_basic_auth
+    Net::HTTP.any_instance.expects(:request).with do |request|
+      expect(request['authorization']).to match(/^Basic/)
+    end.returns(httpok)
+  end
+end