puppet 4.0.0 → 4.9.1

data/lib/puppet/ssl/certificate_authority.rb

@@ -127,7 +127,7 @@ class Puppet::SSL::CertificateAuthority
     host.generate_certificate_request(:dns_alt_names => san)
     # CSR may have been implicitly autosigned, generating a certificate
     # Or sign explicitly
-    host.certificate || sign(name, !!san)
+    host.certificate || sign(name, {allow_dns_alt_names: !!san})
   end
 
   # Generate our CA certificate.
@@ -145,7 +145,8 @@ class Puppet::SSL::CertificateAuthority
     request.generate(host.key)
 
     # Create a self-signed certificate.
-    @certificate = sign(host.name, false, request)
+    @certificate = sign(host.name, {allow_dns_alt_names: false,
+                                    self_signing_csr: request})
 
     # And make sure we initialize our CRL.
     crl
@@ -188,7 +189,7 @@ class Puppet::SSL::CertificateAuthority
   #
   # @return [Array<String>]
   def list(name='*')
-    list_certificates(name).collect { |c| c.name }
+    Puppet::SSL::Certificate.indirection.search(name).collect { |c| c.name }
   end
 
   # Return all the certificate objects as found by the indirector
@@ -204,7 +205,10 @@ class Puppet::SSL::CertificateAuthority
   # @param name [Array<string>] filter to cerificate names
   #
   # @return [Array<Puppet::SSL::Certificate>]
+  #
+  # @deprecated Use Puppet::SSL::CertificateAuthority#list or Puppet Server Certificate status API
   def list_certificates(name='*')
+    Puppet.deprecation_warning("Puppet::SSL::CertificateAuthority#list_certificates is deprecated. Please use Puppet::SSL::CertificateAuthority#list or the certificate status API to query certificate information. See https://docs.puppet.com/puppet/latest/http_api/http_certificate_status.html")
     Puppet::SSL::Certificate.indirection.search(name)
   end
 
@@ -271,8 +275,13 @@ class Puppet::SSL::CertificateAuthority
   end
 
   # Sign a given certificate request.
-  def sign(hostname, allow_dns_alt_names = false, self_signing_csr = nil)
-    # This is a self-signed certificate
+  def sign(hostname, options={})
+    options[:allow_authorization_extensions] ||= false
+    options[:allow_dns_alt_names] ||= false
+    options[:self_signing_csr] ||= nil
+
+    self_signing_csr = options.delete(:self_signing_csr)
+
     if self_signing_csr
       # # This is a self-signed certificate, which is for the CA.  Since this
       # # forces the certificate to be self-signed, anyone who manages to trick
@@ -282,7 +291,6 @@ class Puppet::SSL::CertificateAuthority
       cert_type = :ca
       issuer = csr.content
     else
-      allow_dns_alt_names = true if hostname == Puppet[:certname].downcase
       unless csr = Puppet::SSL::CertificateRequest.indirection.find(hostname)
         raise ArgumentError, "Could not find certificate request for #{hostname}"
       end
@@ -292,7 +300,7 @@ class Puppet::SSL::CertificateAuthority
 
       # Make sure that the CSR conforms to our internal signing policies.
       # This will raise if the CSR doesn't conform, but just in case...
-      check_internal_signing_policies(hostname, csr, allow_dns_alt_names) or
+      check_internal_signing_policies(hostname, csr, options) or
         raise CertificateSigningError.new(hostname), "CSR had an unknown failure checking internal signing policies, will not sign!"
     end
 
@@ -320,12 +328,18 @@ class Puppet::SSL::CertificateAuthority
     cert
   end
 
-  def check_internal_signing_policies(hostname, csr, allow_dns_alt_names)
+  def check_internal_signing_policies(hostname, csr, options = {})
+    options[:allow_authorization_extensions] ||= false
+    options[:allow_dns_alt_names] ||= false
+    # This allows for masters to bootstrap themselves in certain scenarios
+    options[:allow_dns_alt_names] = true if hostname == Puppet[:certname].downcase
+
     # Reject unknown request extensions.
     unknown_req = csr.request_extensions.reject do |x|
       RequestExtensionWhitelist.include? x["oid"] or
         Puppet::SSL::Oids.subtree_of?('ppRegCertExt', x["oid"], true) or
-        Puppet::SSL::Oids.subtree_of?('ppPrivCertExt', x["oid"], true)
+        Puppet::SSL::Oids.subtree_of?('ppPrivCertExt', x["oid"], true) or
+        Puppet::SSL::Oids.subtree_of?('ppAuthCertExt', x["oid"], true)
     end
 
     if unknown_req and not unknown_req.empty?
@@ -356,10 +370,22 @@ class Puppet::SSL::CertificateAuthority
       raise CertificateSigningError.new(hostname), "CSR contains a public key that does not correspond to the signing key"
     end
 
+    auth_extensions = csr.request_extensions.select do |extension|
+      Puppet::SSL::Oids.subtree_of?('ppAuthCertExt', extension['oid'], true)
+    end
+
+    if auth_extensions.any? && !options[:allow_authorization_extensions]
+      ext_names = auth_extensions.map do |extension|
+        extension['oid']
+      end
+
+      raise CertificateSigningError.new(hostname), "CSR '#{csr.name}' contains authorization extensions (#{ext_names.join(', ')}), which are disallowed by default. Use `puppet cert --allow-authorization-extensions sign #{csr.name}` to sign this request."
+    end
+
     unless csr.subject_alt_names.empty?
       # If you alt names are allowed, they are required. Otherwise they are
       # disallowed. Self-signed certs are implicitly trusted, however.
-      unless allow_dns_alt_names
+      unless options[:allow_dns_alt_names]
         raise CertificateSigningError.new(hostname), "CSR '#{csr.name}' contains subject alternative names (#{csr.subject_alt_names.join(', ')}), which are disallowed. Use `puppet cert --allow-dns-alt-names sign #{csr.name}` to sign this request."
       end
 
@@ -394,6 +420,11 @@ class Puppet::SSL::CertificateAuthority
   #   of the X509 Store
   #
   # @return [OpenSSL::X509::Store]
+  #
+  # @deprecated Strictly speaking, #x509_store is marked API private, so we
+  #   don't need to publicly deprecate it. But it marked as deprecated here to
+  #   avoid the exceedingly small chance that someone comes in and uses it from
+  #   within this class before it is removed.
   def x509_store(options = {})
     if (options[:cache])
       return @x509store unless @x509store.nil?
@@ -441,7 +472,10 @@ class Puppet::SSL::CertificateAuthority
   # @param cert [Puppet::SSL::Certificate] the certificate to check validity of
   #
   # @return [Boolean] true if signed, false if unsigned or revoked
+  #
+  # @deprecated use Puppet::SSL::CertificateAuthority#verify or Puppet Server certificate status API
   def certificate_is_alive?(cert)
+    Puppet.deprecation_warning("Puppet::SSL::CertificateAuthority#certificate_is_alive? is deprecated. Please use Puppet::SSL::CertificateAuthority#verify or the certificate status API to query certificate information. See https://docs.puppet.com/puppet/latest/http_api/http_certificate_status.html")
     x509_store(:cache => true).verify(cert.content)
   end
 
@@ -460,7 +494,7 @@ class Puppet::SSL::CertificateAuthority
     unless cert = Puppet::SSL::Certificate.indirection.find(name)
       raise ArgumentError, "Could not find a certificate for #{name}"
     end
-    store = x509_store
+    store = create_x509_store
 
     raise CertificateVerificationError.new(store.error), store.error_string unless store.verify(cert.content)
   end

data/lib/puppet/ssl/certificate_factory.rb

@@ -62,7 +62,7 @@ module Puppet::SSL::CertificateFactory
   #   extensions to.
   # @param csr [OpenSSL::X509::Request] The CSR associated with the given
   #   certificate, which may specify requested extensions for the given cert.
-  #   See http://tools.ietf.org/html/rfc2985 Section 5.4.2 Extension request
+  #   See https://tools.ietf.org/html/rfc2985 Section 5.4.2 Extension request
   # @param issuer [OpenSSL::X509::Certificate, OpenSSL::X509::Request] An X509 CSR
   #   if this is a self signed certificate, or the X509 certificate of the CA if
   #   this is a CA signed certificate.
@@ -100,7 +100,7 @@ module Puppet::SSL::CertificateFactory
     # something went wrong up there. --daniel 2011-10-11
     defaults = { "nsComment" => "Puppet Ruby/OpenSSL Internal Certificate" }
 
-    # See http://www.openssl.org/docs/apps/x509v3_config.html
+    # See https://www.openssl.org/docs/apps/x509v3_config.html
     # for information about the special meanings of 'hash', 'keyid', 'issuer'
     override = {
       "subjectKeyIdentifier"   => "hash",
@@ -126,7 +126,7 @@ module Puppet::SSL::CertificateFactory
       # complaint that the issuer keyid can't be fetched, which breaks all
       # sorts of things in our test suite and, e.g., bootstrapping the CA.
       #
-      # http://tools.ietf.org/html/rfc5280#section-4.2.1.1 says that, to be a
+      # https://tools.ietf.org/html/rfc5280#section-4.2.1.1 says that, to be a
       # conforming CA we MAY omit the field if we are self-signed, which I
       # think gives us a pass in the specific case.
       #

data/lib/puppet/ssl/certificate_request.rb

@@ -23,7 +23,7 @@ require 'puppet/ssl/certificate_signer'
 #
 # This behavior is dictated by PKCS#9/RFC 2985 section 5.4.2.
 #
-# @see http://tools.ietf.org/html/rfc2985 "RFC 2985 Section 5.4.2 Extension request"
+# @see https://tools.ietf.org/html/rfc2985 "RFC 2985 Section 5.4.2 Extension request"
 #
 class Puppet::SSL::CertificateRequest < Puppet::SSL::Base
   wraps OpenSSL::X509::Request
@@ -193,7 +193,7 @@ DOC
   #
   # The format of CSR attributes is specified in PKCS#10/RFC 2986
   #
-  # @see http://tools.ietf.org/html/rfc2986 "RFC 2986 Certification Request Syntax Specification"
+  # @see https://tools.ietf.org/html/rfc2986 "RFC 2986 Certification Request Syntax Specification"
   #
   # @api public
   #
@@ -289,8 +289,8 @@ DOC
   # that in turn holds the elements. This is why we have to unpack an array
   # every time we unpack a Set/Seq.
   #
-  # @see http://tools.ietf.org/html/rfc2985#ref-10 5.4.2 CSR Extension Request structure
-  # @see http://tools.ietf.org/html/rfc5280 4.1 Certificate Extension structure
+  # @see https://tools.ietf.org/html/rfc2985#ref-10 5.4.2 CSR Extension Request structure
+  # @see https://tools.ietf.org/html/rfc5280 4.1 Certificate Extension structure
   #
   # @api private
   #

data/lib/puppet/ssl/certificate_signer.rb

@@ -1,6 +1,6 @@
 # Take care of signing a certificate in a FIPS 140-2 compliant manner.
 #
-# @see http://projects.puppetlabs.com/issues/17295
+# @see https://projects.puppetlabs.com/issues/17295
 #
 # @api private
 class Puppet::SSL::CertificateSigner

data/lib/puppet/ssl/host.rb

@@ -213,12 +213,12 @@ DOC
       raise Puppet::Error, <<ERROR_STRING
 The certificate retrieved from the master does not match the agent's private key.
 Certificate fingerprint: #{certificate.fingerprint}
-To fix this, remove the certificate from both the master and the agent and then start a puppet run, which will automatically regenerate a certficate.
+To fix this, remove the certificate from both the master and the agent and then start a puppet run, which will automatically regenerate a certificate.
 On the master:
   puppet cert clean #{Puppet[:certname]}
 On the agent:
   1a. On most platforms: find #{Puppet[:ssldir]} -name #{Puppet[:certname]}.pem -delete
-  1b. On Windows: del "#{Puppet[:ssldir]}/#{Puppet[:certname]}.pem" /f
+  1b. On Windows: del "#{Puppet[:certdir].gsub('/', '\\')}\\#{Puppet[:certname]}.pem" /f
   2. puppet agent -t
 ERROR_STRING
     end
@@ -227,13 +227,35 @@ ERROR_STRING
   # Generate all necessary parts of our ssl host.
   def generate
     generate_key unless key
-    generate_certificate_request unless certificate_request
+    # ask indirector to find any existing requests and download them
+    existing_request = certificate_request
+
+    # if CSR downloaded from master, but the local keypair was just generated and
+    # does not match the public key in the CSR, fail hard
+    if !existing_request.nil? &&
+      (key.content.public_key.to_s != existing_request.content.public_key.to_s)
+
+      raise Puppet::Error, <<ERROR_STRING
+The CSR retrieved from the master does not match the agent's public key.
+CSR fingerprint: #{existing_request.fingerprint}
+CSR public key: #{existing_request.content.public_key.to_text}
+Agent public key: #{key.content.public_key.to_text}
+To fix this, remove the CSR from both the master and the agent and then start a puppet run, which will automatically regenerate a CSR.
+On the master:
+  puppet cert clean #{Puppet[:certname]}
+On the agent:
+  1a. On most platforms: find #{Puppet[:ssldir]} -name #{Puppet[:certname]}.pem -delete
+  1b. On Windows: del "#{Puppet[:certdir].gsub('/', '\\')}\\#{Puppet[:certname]}.pem" /f
+  2. puppet agent -t
+ERROR_STRING
+    end
+    generate_certificate_request unless existing_request
 
     # If we can get a CA instance, then we're a valid CA, and we
     # should use it to sign our request; else, just try to read
     # the cert.
     if ! certificate and ca = Puppet::SSL::CertificateAuthority.instance
-      ca.sign(self.name, true)
+      ca.sign(self.name, {allow_dns_alt_names: true})
     end
   end
 

data/lib/puppet/ssl/oids.rb

@@ -13,6 +13,7 @@ require 'puppet/ssl'
 # -- privateExtensions can be extended by enterprises to suit their own needs
 # registeredExtensions OBJECT IDENTIFIER ::= { puppetCertExtensions 1 }
 # privateExtensions OBJECT IDENTIFIER ::= { puppetCertExtensions 2 }
+# authorizationExtensions OBJECT IDENTIFIER ::= { puppetCertExtensions 3 }
 #
 # -- subtree of common registered extensions
 # -- The short names for these OIDs are intentionally lowercased and formatted
@@ -25,6 +26,10 @@ require 'puppet/ssl'
 # @api private
 module Puppet::SSL::Oids
 
+  # Note: When updating the following OIDs make sure to also update the OID
+  # definitions here:
+  # https://github.com/puppetlabs/puppetserver/blob/master/src/clj/puppetlabs/puppetserver/certificate_authority.clj#L122-L159
+
   PUPPET_OIDS = [
     ["1.3.6.1.4.1.34380", 'puppetlabs', 'Puppet Labs'],
     ["1.3.6.1.4.1.34380.1", 'ppCertExt', 'Puppet Certificate Extension'],
@@ -48,8 +53,21 @@ module Puppet::SSL::Oids
     ["1.3.6.1.4.1.34380.1.1.15", 'pp_department', 'Puppet Node Department Name'],
     ["1.3.6.1.4.1.34380.1.1.16", 'pp_cluster', 'Puppet Node Cluster Name'],
     ["1.3.6.1.4.1.34380.1.1.17", 'pp_provisioner', 'Puppet Node Provisioner Name'],
-    
+    ["1.3.6.1.4.1.34380.1.1.18", 'pp_region', 'Puppet Node Region Name'],
+    ["1.3.6.1.4.1.34380.1.1.19", 'pp_datacenter', 'Puppet Node Datacenter Name'],
+    ["1.3.6.1.4.1.34380.1.1.20", 'pp_zone', 'Puppet Node Zone Name'],
+    ["1.3.6.1.4.1.34380.1.1.21", 'pp_network', 'Puppet Node Network Name'],
+    ["1.3.6.1.4.1.34380.1.1.22", 'pp_securitypolicy', 'Puppet Node Security Policy Name'],
+    ["1.3.6.1.4.1.34380.1.1.23", 'pp_cloudplatform', 'Puppet Node Cloud Platform Name'],
+    ["1.3.6.1.4.1.34380.1.1.24", 'pp_apptier', 'Puppet Node Application Tier'],
+    ["1.3.6.1.4.1.34380.1.1.25", 'pp_hostname', 'Puppet Node Hostname'],
+
     ["1.3.6.1.4.1.34380.1.2", 'ppPrivCertExt', 'Puppet Private Certificate Extension'],
+
+    ["1.3.6.1.4.1.34380.1.3", 'ppAuthCertExt', 'Puppet Certificate Authorization Extension'],
+
+    ["1.3.6.1.4.1.34380.1.3.1",  'pp_authorization', 'Certificate Extension Authorization'],
+    ["1.3.6.1.4.1.34380.1.3.13", 'pp_auth_role', 'Puppet Node Role Name for Authorization'],
   ]
 
   # Register our custom Puppet OIDs with OpenSSL so they can be used as CSR
@@ -61,7 +79,7 @@ module Puppet::SSL::Oids
     end
   end
 
-  # Parse and load custom OID mapping file that enables custom OIDs to be resolved
+  # Parse custom OID mapping file that enables custom OIDs to be resolved
   # into user-friendly names.
   #
   # @param custom_oid_file [String] File to obtain custom OIDs mapping from
@@ -76,7 +94,7 @@ module Puppet::SSL::Oids
   #  '1.3.6.1.4.1.34380.1.2.1.2':
   #    shortname: 'myothershortname'
   #    longname: 'Other Long name'
-  def self.load_custom_oid_file(custom_oid_file, map_key='oid_mapping')
+  def self.parse_custom_oid_file(custom_oid_file, map_key='oid_mapping')
     if File.exists?(custom_oid_file) && File.readable?(custom_oid_file)
       mapping = nil
       begin
@@ -102,6 +120,28 @@ module Puppet::SSL::Oids
         oid_defns << [oid, shortname, longname]
       end
 
+      oid_defns
+    end
+  end
+
+  # Load custom OID mapping file that enables custom OIDs to be resolved
+  # into user-friendly names.
+  #
+  # @param custom_oid_file [String] File to obtain custom OIDs mapping from
+  # @param map_key [String] Hash key in which custom OIDs mapping is stored
+  #
+  # @example Custom OID mapping file
+  # ---
+  # oid_mapping:
+  #  '1.3.6.1.4.1.34380.1.2.1.1':
+  #    shortname : 'myshortname'
+  #    longname  : 'Long name'
+  #  '1.3.6.1.4.1.34380.1.2.1.2':
+  #    shortname: 'myothershortname'
+  #    longname: 'Other Long name'
+  def self.load_custom_oid_file(custom_oid_file, map_key='oid_mapping')
+    oid_defns = parse_custom_oid_file(custom_oid_file, map_key)
+    unless oid_defns.nil?
       begin
         oid_defns.each do |oid_defn|
           OpenSSL::ASN1::ObjectId.register(*oid_defn)

data/lib/puppet/ssl/validator/default_validator.rb

@@ -16,7 +16,7 @@ class Puppet::SSL::Validator::DefaultValidator #< class Puppet::SSL::Validator
   # Creates a new DefaultValidator, optionally with an SSL Configuration and SSL Host.
   #
   # @param ssl_configuration [Puppet::SSL::Configuration] (a default configuration) ssl_configuration the SSL configuration to use
-  # @param ssl_host [Puppet::SSL::Host] (Puppet::SSL::Host.localhost) the SSL host to use
+  # @param ssl_host [Puppet::SSL::Host] The SSL host to use
   #
   # @api private
   #
@@ -25,7 +25,7 @@ class Puppet::SSL::Validator::DefaultValidator #< class Puppet::SSL::Validator
                                         Puppet[:localcacert], {
                                           :ca_auth_file  => Puppet[:ssl_client_ca_auth]
                                         }),
-      ssl_host = Puppet::SSL::Host.localhost)
+      ssl_host = Puppet.lookup(:ssl_host))
 
     reset!
     @ssl_configuration = ssl_configuration
@@ -48,7 +48,7 @@ class Puppet::SSL::Validator::DefaultValidator #< class Puppet::SSL::Validator
   # chain being verified.
   #
   # From the [OpenSSL
-  # documentation](http://www.openssl.org/docs/ssl/SSL_CTX_set_verify.html):
+  # documentation](https://www.openssl.org/docs/ssl/SSL_CTX_set_verify.html):
   # The `verify_callback` function is used to control the behaviour when the
   # SSL_VERIFY_PEER flag is set. It must be supplied by the application and
   # receives two arguments: preverify_ok indicates, whether the verification of

data/lib/puppet/syntax_checkers/base64.rb

@@ -0,0 +1,41 @@
+# A syntax checker for Base64.
+# @api public
+require 'puppet/syntax_checkers'
+require 'base64'
+class Puppet::SyntaxCheckers::Base64 < Puppet::Plugins::SyntaxCheckers::SyntaxChecker
+
+  # Checks the text for BASE64 syntax issues and reports them to the given acceptor.
+  # This checker allows the most relaxed form of Base64, including newlines and missing padding.
+  # It also accept URLsafe input.
+  #
+  # @param text [String] The text to check
+  # @param syntax [String] The syntax identifier in mime style (e.g. 'base64', 'text/xxx+base64')
+  # @param acceptor [#accept] A Diagnostic acceptor
+  # @param source_pos [Puppet::Pops::Adapters::SourcePosAdapter] A source pos adapter with location information
+  # @api public
+  #
+  def check(text, syntax, acceptor, source_pos)
+    raise ArgumentError.new("Base64 syntax checker: the text to check must be a String.") unless text.is_a?(String)
+    raise ArgumentError.new("Base64 syntax checker: the syntax identifier must be a String, e.g. json, data+json") unless syntax.is_a?(String)
+    raise ArgumentError.new("Base64 syntax checker: invalid Acceptor, got: '#{acceptor.class.name}'.") unless acceptor.is_a?(Puppet::Pops::Validation::Acceptor)
+    cleaned_text = text.gsub(/[\r?\n[:blank:]]/, '')
+    begin
+      # Do a strict decode64 on text with all whitespace stripped since the non strict version
+      # simply skips all non base64 characters
+      Base64.strict_decode64(cleaned_text)
+    rescue => e
+      if (cleaned_text.bytes.to_a.size * 8) % 6 != 0
+        msg2 = "padding is not correct"
+      else
+        msg2 = "contains letters outside strict base 64 range (or whitespace)"
+      end
+      msg = "Base64 syntax checker: Cannot parse invalid Base64 string - #{msg2}"
+
+      # TODO: improve the pops API to allow simpler diagnostic creation while still maintaining capabilities
+      # and the issue code. (In this case especially, where there is only a single error message being issued).
+      #
+      issue = Puppet::Pops::Issues::issue(:ILLEGAL_BASE64) { msg }
+      acceptor.accept(Puppet::Pops::Validation::Diagnostic.new(:error, issue, source_pos.locator.file, source_pos, {}))
+    end
+  end
+end

data/lib/puppet/syntax_checkers/json.rb

@@ -4,8 +4,6 @@ require 'puppet/syntax_checkers'
 class Puppet::SyntaxCheckers::Json < Puppet::Plugins::SyntaxCheckers::SyntaxChecker
 
   # Checks the text for JSON syntax issues and reports them to the given acceptor.
-  # This implementation is abstract, it raises {NotImplementedError} since a subclass should have implemented the
-  # method.
   #
   # Error messages from the checker are capped at 100 chars from the source text.
   #

data/lib/puppet/test/test_helper.rb

@@ -38,7 +38,7 @@ module Puppet::Test
     def self.initialize()
       # This meta class instance variable is used as a guard to ensure that
       # before_each, and after_each are only called once. This problem occurs
-      # when there are more than one puppet test infrastructure "orchestrator in us.
+      # when there are more than one puppet test infrastructure orchestrator in use.
       # The use of both puppetabs-spec_helper, and rodjek-rspec_puppet will cause
       # two resets of the puppet environment, and will cause problem rolling back to
       # a known point as there is no way to differentiate where the calls are coming
@@ -84,7 +84,7 @@ module Puppet::Test
     #
     ROLLBACK_MARK = "initial testing state"
 
-    # Call this method once per test, prior to execution of each invididual test.
+    # Call this method once per test, prior to execution of each individual test.
     # @return nil
     def self.before_each_test()
       # When using both rspec-puppet and puppet-rspec-helper, there are two packages trying
@@ -121,7 +121,13 @@ module Puppet::Test
       end
 
       # The process environment is a shared, persistent resource.
-      $old_env = ENV.to_hash
+      # Can't use Puppet.features.microsoft_windows? as it may be mocked out in a test.  This can cause test recurring test failures
+      if (!!File::ALT_SEPARATOR)
+        mode = :windows
+      else
+        mode = :posix
+      end
+      $old_env = Puppet::Util.get_environment(mode)
 
       # So is the load_path
       $old_load_path = $LOAD_PATH.dup
@@ -171,13 +177,19 @@ module Puppet::Test
       end
       $saved_indirection_state = nil
 
+      # Can't use Puppet.features.microsoft_windows? as it may be mocked out in a test.  This can cause test recurring test failures
+      if (!!File::ALT_SEPARATOR)
+        mode = :windows
+      else
+        mode = :posix
+      end
       # Restore the global process environment.  Can't just assign because this
       # is a magic variable, sadly, and doesn't do that™.  It is sufficiently
       # faster to use the compare-then-set model to avoid excessive work that it
       # justifies the complexity.  --daniel 2012-03-15
-      unless ENV.to_hash == $old_env
-        ENV.clear
-        $old_env.each {|k, v| ENV[k] = v }
+      unless Puppet::Util.get_environment(mode) == $old_env
+        Puppet::Util.clear_environment(mode)
+        $old_env.each {|k, v| Puppet::Util.set_env(k, v, mode) }
       end
 
       # Restore the load_path late, to avoid messing with stubs from the test.
@@ -226,7 +238,6 @@ module Puppet::Test
       #
       # I would make these even shorter, but OpenSSL doesn't support anything
       # below 512 bits.  Sad, really, because a 0 bit key would be just fine.
-      Puppet[:req_bits]  = 512
       Puppet[:keylength] = 512
 
       # Although we setup a testing context during initialization, some tests

data/lib/puppet/transaction/additional_resource_generator.rb

@@ -5,10 +5,15 @@
 #
 # @api private
 class Puppet::Transaction::AdditionalResourceGenerator
+  attr_writer :relationship_graph
+  # [boolean] true if any resource has attempted and failed to generate resources
+  attr_reader :resources_failed_to_generate
+
   def initialize(catalog, relationship_graph, prioritizer)
     @catalog = catalog
     @relationship_graph = relationship_graph
     @prioritizer = prioritizer
+    @resources_failed_to_generate = false
   end
 
   def generate_additional_resources(resource)
@@ -16,17 +21,30 @@ class Puppet::Transaction::AdditionalResourceGenerator
     begin
       generated = resource.generate
     rescue => detail
+      @resources_failed_to_generate = true
       resource.log_exception(detail, "Failed to generate additional resources using 'generate': #{detail}")
     end
     return unless generated
     generated = [generated] unless generated.is_a?(Array)
-    generated.collect do |res|
+    generated.collect! do |res|
       @catalog.resource(res.ref) || res
-    end.each do |res|
-      priority = @prioritizer.generate_priority_contained_in(resource, res)
-      add_resource(res, resource, priority)
+    end
+    unless resource.depthfirst?
+      # This is reversed because PUP-1963 changed how generated
+      # resources were added to the catalog. It exists for backwards
+      # compatibility only, and can probably be removed in Puppet 5
+      #
+      # Previously, resources were given sequential priorities in the
+      # relationship graph. Post-1963, resources are added to the
+      # catalog one by one adjacent to the parent resource. This
+      # causes an implicit reversal of their application order from
+      # the old code. The reverse makes it all work like it did.
+      generated.reverse!
+    end
+    generated.each do |res|
+      add_resource(res, resource)
 
-      add_conditional_directed_dependency(resource, res)
+      add_generated_directed_dependency(resource, res)
       generate_additional_resources(res)
     end
   end
@@ -38,6 +56,7 @@ class Puppet::Transaction::AdditionalResourceGenerator
       generated = replace_duplicates_with_catalog_resources(resource.eval_generate)
       return false if generated.empty?
     rescue => detail
+      @resources_failed_to_generate = true
       resource.log_exception(detail, "Failed to generate additional resources using 'eval_generate': #{detail}")
       return false
     end
@@ -60,6 +79,13 @@ class Puppet::Transaction::AdditionalResourceGenerator
 
   def contain_generated_resources_in(resource, made)
     sentinel = Puppet::Type.type(:whit).new(:name => "completed_#{resource.title}", :catalog => resource.catalog)
+    # Tag the completed whit with all of the tags of the generating resource
+    # except the type name to allow event propogation to succeed beyond the whit
+    # "boundary" when filtering resources with tags. We include auto-generated
+    # tags such as the type name to support implicit filtering as well as
+    # explicit. Note that resource#tags returns a duplicate of the resource's
+    # tags.
+    sentinel.tag(*resource.tags)
     priority = @prioritizer.generate_priority_contained_in(resource, sentinel)
     @relationship_graph.add_vertex(sentinel, priority)
 
@@ -102,16 +128,83 @@ class Puppet::Transaction::AdditionalResourceGenerator
     end
   end
 
-  def add_resource(res, parent_resource, priority)
+  def add_resource(res, parent_resource, priority=nil)
     if @catalog.resource(res.ref).nil?
       res.tag(*parent_resource.tags)
-      @catalog.add_resource(res)
-      @relationship_graph.add_vertex(res, priority)
+      if parent_resource.depthfirst?
+        @catalog.add_resource_before(parent_resource, res)
+      else
+        @catalog.add_resource_after(parent_resource, res)
+      end
       @catalog.add_edge(@catalog.container_of(parent_resource), res)
+      if @relationship_graph && priority
+        # If we have a relationship_graph we should add the resource
+        # to it (this is an eval_generate). If we don't, then the
+        # relationship_graph has not yet been created and we can skip
+        # adding it.
+        @relationship_graph.add_vertex(res, priority)
+      end
       res.finish
     end
   end
 
+  # add correct edge for depth- or breadth- first traversal of
+  # generated resource. Skip generating the edge if there is already
+  # some sort of edge between the two resources.
+  def add_generated_directed_dependency(parent, child, label=nil)
+    if parent.depthfirst?
+      source = child
+      target = parent
+    else
+      source = parent
+      target = child
+    end
+
+    # For each potential relationship metaparam, check if parent or
+    # child references the other. If there are none, we should add our
+    # edge.
+    edge_exists = Puppet::Type.relationship_params.any? { |param|
+      param_sym = param.name.to_sym
+
+      if parent[param_sym]
+        parent_contains = parent[param_sym].any? { |res|
+          res.ref == child.ref
+        }
+      else
+        parent_contains = false
+      end
+
+      if child[param_sym]
+        child_contains = child[param_sym].any? { |res|
+          res.ref == parent.ref
+        }
+      else
+        child_contains = false
+      end
+
+      parent_contains || child_contains
+    }
+
+    if not edge_exists
+      # We *cannot* use target.to_resource here!
+      #
+      # For reasons that are beyond my (and, perhaps, human)
+      # comprehension, to_resource will call retrieve. This is
+      # problematic if a generated resource needs the system to be
+      # changed by a previous resource (think a file on a path
+      # controlled by a mount resource).
+      #
+      # Instead of using to_resource, we just construct a resource as
+      # if the arguments to the Type instance had been passed to a
+      # Resource instead.
+      resource = ::Puppet::Resource.new(target.class, target.title,
+                                        :parameters => target.original_parameters)
+
+      source[:before] ||= []
+      source[:before] << resource
+    end
+  end
+
   # Copy an important relationships from the parent to the newly-generated
   # child resource.
   def add_conditional_directed_dependency(parent, child, label=nil)