puppet 5.0.0 → 6.0.0

data/spec/unit/network/formats_spec.rb

@@ -150,6 +150,32 @@ describe "Puppet Network Format" do
         yaml.intern_multiple(Puppet::Node, YAML.dump(["hello"]))
       end.to raise_error(Puppet::Network::FormatHandler::FormatError, /did not contain a valid instance/)
     end
+
+    it 'accepts indirected classes' do
+      [
+        Puppet::Node::Facts.new('foo', {}),
+        Puppet::Node.new('foo'),
+        Puppet::Resource.new('File', '/foo'),
+        Puppet::Transaction::Report.new('foo'),
+        Puppet::Resource::Catalog.new
+      ].each { |obj| yaml.intern(obj.class, YAML.dump(obj.to_data_hash)) }
+    end
+
+    it 'raises when interning an instance of an unacceptable indirected type' do
+      obj = Puppet::SSL::Key.new('foo')
+
+      expect {
+        yaml.intern(obj.class, YAML.dump(obj))
+      }.to raise_error(Puppet::Network::FormatHandler::FormatError, /Tried to load unspecified class: Puppet::SSL::Key/)
+    end
+
+    it 'raises when interning multple instances of an unacceptable indirected type' do
+      obj = Puppet::SSL::Key.new('foo')
+
+      expect {
+        yaml.intern_multiple(obj.class, YAML.dump([obj]))
+      }.to raise_error(Puppet::Network::FormatHandler::FormatError, /Tried to load unspecified class: Puppet::SSL::Key/)
+    end
   end
 
   describe "plaintext" do
@@ -333,14 +359,6 @@ describe "Puppet Network Format" do
       expect(json.weight).to eq(15)
     end
 
-    it "should use a native parser implementation" do
-      expect(JSON.parser.name).to eq("JSON::Ext::Parser")
-    end
-
-    it "should use a native generator implementation" do
-      expect(JSON.generator.name).to eq("JSON::Ext::Generator")
-    end
-
     it "should render an instance as JSON" do
       instance = FormatsTest.new("foo")
       expect(json.render(instance)).to eq({"string" => "foo"}.to_json)
@@ -352,20 +370,20 @@ describe "Puppet Network Format" do
     end
 
     it "should intern an instance from a JSON hash" do
-      text = JSON.dump({"string" => "parsed_json"})
+      text = Puppet::Util::Json.dump({"string" => "parsed_json"})
       instance = json.intern(FormatsTest, text)
       expect(instance.string).to eq("parsed_json")
     end
 
     it "should skip data_to_hash if data is already an instance of the specified class" do
       # The rest terminus for the report indirected type relies on this behavior
-      data = JSON.dump([1, 2])
+      data = Puppet::Util::Json.dump([1, 2])
       instance = json.intern(Array, data)
       expect(instance).to eq([1, 2])
     end
 
     it "should intern multiple instances from a JSON array of hashes" do
-      text = JSON.dump(
+      text = Puppet::Util::Json.dump(
         [
           {
             "string" => "BAR"
@@ -379,7 +397,7 @@ describe "Puppet Network Format" do
     end
 
     it "should reject wrapped data from legacy clients as they've never supported JSON" do
-      text = JSON.dump(
+      text = Puppet::Util::Json.dump(
         {
           "type" => "FormatsTest",
           "data" => {
@@ -394,7 +412,7 @@ describe "Puppet Network Format" do
     it "fails intelligibly when given invalid data" do
       expect do
         json.intern(Puppet::Node, '')
-      end.to raise_error(JSON::ParserError, /A JSON text must at least contain two octets|unexpected token at ''/)
+      end.to raise_error(Puppet::Util::Json::ParseError)
     end
   end
 

data/spec/unit/network/http/api/indirected_routes_spec.rb

@@ -51,7 +51,7 @@ describe Puppet::Network::HTTP::API::IndirectedRoutes do
     end
 
     it "should fail if the indirection does not have the correct version" do
-      expect(lambda { handler.uri2indirection("GET", "#{Puppet::Network::HTTP::CA_URL_PREFIX}/v3/certificate/foo", params) }).to raise_error(bad_request_error)
+      expect(lambda { handler.uri2indirection("GET", "#{Puppet::Network::HTTP::MASTER_URL_PREFIX}/v1/node/bar", params) }).to raise_error(bad_request_error)
     end
 
     it "should not pass a buck_path parameter through (See Bugs #13553, #13518, #13511)" do
@@ -106,6 +106,10 @@ describe Puppet::Network::HTTP::API::IndirectedRoutes do
       expect(handler.uri2indirection("GET", "#{master_url_prefix}/nodes/bar", params)[1]).to eq(:search)
     end
 
+    it "should choose 'save' as the indirection method if the http method is a PUT and the indirection name is facts" do
+      expect(handler.uri2indirection("PUT", "#{master_url_prefix}/facts/puppet.node.test", params)[0].name).to eq(:facts)
+    end
+
     it "should change indirection name to 'status' if the http method is a GET and the indirection name is statuses" do
       expect(handler.uri2indirection("GET", "#{master_url_prefix}/statuses/bar", params)[0].name).to eq(:status)
     end
@@ -128,7 +132,7 @@ describe Puppet::Network::HTTP::API::IndirectedRoutes do
 
     it "should not URI unescape the indirection key" do
       escaped = Puppet::Util.uri_encode("foo bar")
-      indirection, _, key, _ = handler.uri2indirection("GET", "#{master_url_prefix}/node/#{escaped}", params)
+      _, _, key, _ = handler.uri2indirection("GET", "#{master_url_prefix}/node/#{escaped}", params)
       expect(key).to eq(escaped)
     end
 
@@ -136,13 +140,13 @@ describe Puppet::Network::HTTP::API::IndirectedRoutes do
       key_escaped = Puppet::Util.uri_encode("foo bar")
       uri_escaped = "#{master_url_prefix}/node/#{key_escaped}"
       handler.expects(:check_authorization).with(anything, uri_escaped, anything)
-      indirection, _, _, _ = handler.uri2indirection("GET", uri_escaped, params)
+      _, _, _, _ = handler.uri2indirection("GET", uri_escaped, params)
     end
 
-    it "should not pass through an environment to check_authorization and fail if the environment is unknown" do
+    it "when the environment is unknown should remove :environment from params passed to check_authorization and therefore fail" do
       handler.expects(:check_authorization).with(anything,
                                                  anything,
-                                                 Not(has_entry(:environment)))
+                                                 Not(has_key(:environment)))
       expect(lambda { handler.uri2indirection("GET",
                                               "#{master_url_prefix}/node/bar",
                                               {:environment => 'bogus'}) }).to raise_error(not_found_error)

data/spec/unit/network/http/api/master/v3/authorization_spec.rb

@@ -3,17 +3,15 @@ require 'spec_helper'
 require 'puppet/network/http'
 
 describe Puppet::Network::HTTP::API::Master::V3::Authorization do
-  HTTP = Puppet::Network::HTTP
-
-  let(:response) { HTTP::MemoryResponse.new }
-  let(:authz) { HTTP::API::Master::V3::Authorization.new }
+  let(:response) { Puppet::Network::HTTP::MemoryResponse.new }
+  let(:authz) { Puppet::Network::HTTP::API::Master::V3::Authorization.new }
   let(:noop_handler) {
     lambda do |request, response|
     end
   }
 
   it "accepts v3 api requests that match allowed authconfig entries" do
-    request = HTTP::Request.from_hash({
+    request = Puppet::Network::HTTP::Request.from_hash({
       :path => "/v3/environments",
       :method => "GET",
       :params => { :authenticated => true, :node => "testing", :ip => "127.0.0.1" }
@@ -35,7 +33,7 @@ allow *
   end
 
   it "rejects v3 api requests that are disallowed by authconfig entries" do
-    request = HTTP::Request.from_hash({
+    request = Puppet::Network::HTTP::Request.from_hash({
       :path => "/v3/environments",
       :method => "GET",
       :params => { :authenticated => true, :node => "testing", :ip => "127.0.0.1" }
@@ -54,6 +52,6 @@ deny testing
 
     expect do
       handler.call(request, response)
-    end.to raise_error(HTTP::Error::HTTPNotAuthorizedError, /Forbidden request/)
+    end.to raise_error(Puppet::Network::HTTP::Error::HTTPNotAuthorizedError, /Forbidden request/)
   end
 end

data/spec/unit/network/http/api/master/v3/environment_spec.rb

@@ -9,7 +9,6 @@ describe Puppet::Network::HTTP::API::Master::V3::Environment do
   let(:loader) { Puppet::Environments::Static.new(environment) }
 
   around :each do |example|
-    Puppet[:app_management] = true
     Puppet.override(:environments => loader) do
       Puppet::Type.newtype :sql, :is_capability => true do
         newparam :name, :namevar => true

data/spec/unit/network/http/api_spec.rb

@@ -39,11 +39,9 @@ describe Puppet::Network::HTTP::API do
 
   describe "Puppet API" do
     let(:handler) { PuppetSpec::Handler.new(Puppet::Network::HTTP::API.master_routes,
-                                            Puppet::Network::HTTP::API.ca_routes,
                                             Puppet::Network::HTTP::API.not_found_upgrade) }
 
     let(:master_prefix) { Puppet::Network::HTTP::MASTER_URL_PREFIX }
-    let(:ca_prefix) { Puppet::Network::HTTP::CA_URL_PREFIX }
 
     it "raises a not-found error for non-CA or master routes and suggests an upgrade" do
       req = Puppet::Network::HTTP::Request.from_hash(:path => "/unknown")
@@ -61,7 +59,6 @@ describe Puppet::Network::HTTP::API do
         expect(res[:status]).to eq(404)
         expect(res[:body]).to include("Puppet version: #{Puppet.version}")
         expect(res[:body]).to include("Supported /puppet API versions: #{Puppet::Network::HTTP::MASTER_URL_VERSIONS}")
-        expect(res[:body]).to include("Supported /puppet-ca API versions: #{Puppet::Network::HTTP::CA_URL_VERSIONS}")
       end
 
       it "gives an upgrade message for CA routes" do
@@ -71,7 +68,6 @@ describe Puppet::Network::HTTP::API do
         expect(res[:status]).to eq(404)
         expect(res[:body]).to include("Puppet version: #{Puppet.version}")
         expect(res[:body]).to include("Supported /puppet API versions: #{Puppet::Network::HTTP::MASTER_URL_VERSIONS}")
-        expect(res[:body]).to include("Supported /puppet-ca API versions: #{Puppet::Network::HTTP::CA_URL_VERSIONS}")
       end
     end
 
@@ -101,27 +97,5 @@ describe Puppet::Network::HTTP::API do
         expect(res[:body]).not_to include("Puppet version: #{Puppet.version}")
       end
     end
-
-    describe "when processing CA routes" do
-      it "responds to v1 indirector requests" do
-        Puppet::SSL::Certificate.indirection.stubs(:find).returns "foo"
-        req = Puppet::Network::HTTP::Request.from_hash(:path => "#{ca_prefix}/v1/certificate/foo",
-                                                       :params => {:environment => "production"},
-                                                       :headers => {'accept' => "s"})
-        res = {}
-        handler.process(req, res)
-        expect(res[:body]).to eq("foo")
-        expect(res[:status]).to eq(200)
-      end
-
-      it "responds with a not found error to non-v1 requests and does not suggest an upgrade" do
-        req = Puppet::Network::HTTP::Request.from_hash(:path => "#{ca_prefix}/unknown")
-        res = {}
-        handler.process(req, res)
-        expect(res[:status]).to eq(404)
-        expect(res[:body]).to include("No route for GET #{ca_prefix}/unknown")
-        expect(res[:body]).not_to include("Puppet version: #{Puppet.version}")
-      end
-    end
   end
 end

data/spec/unit/network/http/compression_spec.rb

@@ -9,7 +9,8 @@ describe "http compression" do
     str = StringIO.new
     writer = Zlib::GzipWriter.new(str)
     writer.write(data)
-    writer.close.string
+    writer.close
+    str.string
   end
 
   def stubs_response_with(response, content_encoding, body)
@@ -110,9 +111,11 @@ describe "http compression" do
           # \u{2070E} - 𠜎 - http://www.fileformat.info/info/unicode/char/2070E/index.htm - 0xF0 0xA0 0x9C 0x8E / 240 160 156 142
 
           pson = "foo\u06ff\u16A0\u{2070E}".to_pson # unicode expression eqivalent of "foo\xDB\xBF\xE1\x9A\xA0\xF0\xA0\x9C\x8E\" per above
-          writer = Zlib::GzipWriter.new(StringIO.new)
+          compressed_body_io = StringIO.new
+          writer = Zlib::GzipWriter.new(compressed_body_io)
           writer.write(pson)
-          compressed_body = writer.close.string
+          writer.close
+          compressed_body = compressed_body_io.string
 
           begin
             default_external = Encoding.default_external

data/spec/unit/network/http/connection_spec.rb

@@ -1,6 +1,8 @@
 #! /usr/bin/env ruby
 require 'spec_helper'
 require 'puppet/network/http/connection'
+require 'puppet_spec/validators'
+require 'puppet/test_ca'
 
 describe Puppet::Network::HTTP::Connection do
 
@@ -62,43 +64,6 @@ describe Puppet::Network::HTTP::Connection do
     end
   end
 
-  class ConstantErrorValidator
-    def initialize(args)
-      @fails_with = args[:fails_with]
-      @error_string = args[:error_string] || ""
-      @peer_certs = args[:peer_certs] || []
-    end
-
-    def setup_connection(connection)
-      connection.stubs(:start).raises(OpenSSL::SSL::SSLError.new(@fails_with))
-    end
-
-    def peer_certs
-      @peer_certs
-    end
-
-    def verify_errors
-      [@error_string]
-    end
-  end
-
-  class NoProblemsValidator
-    def initialize(cert)
-      @cert = cert
-    end
-
-    def setup_connection(connection)
-    end
-
-    def peer_certs
-      [@cert]
-    end
-
-    def verify_errors
-      []
-    end
-  end
-
   shared_examples_for 'ssl verifier' do
     include PuppetSpec::Files
 
@@ -113,7 +78,7 @@ describe Puppet::Network::HTTP::Connection do
       WebMock.enable!
     end
 
-    it "should provide a useful error message when one is available and certificate validation fails", :unless => Puppet.features.microsoft_windows? do
+    it "should provide a useful error message when one is available and certificate validation fails", :unless => Puppet::Util::Platform.windows? do
       connection = Puppet::Network::HTTP::Connection.new(
         host, port,
         :verify => ConstantErrorValidator.new(:fails_with => 'certificate verify failed',
@@ -124,20 +89,20 @@ describe Puppet::Network::HTTP::Connection do
       end.to raise_error(Puppet::Error, "certificate verify failed: [shady looking signature]")
     end
 
-    it "should provide a helpful error message when hostname was not match with server certificate", :unless => Puppet.features.microsoft_windows? do
+    it "should provide a helpful error message when hostname was not match with server certificate", :unless => Puppet::Util::Platform.windows? || RUBY_PLATFORM == 'java' do
       Puppet[:confdir] = tmpdir('conf')
 
       connection = Puppet::Network::HTTP::Connection.new(
       host, port,
       :verify => ConstantErrorValidator.new(
         :fails_with => 'hostname was not match with server certificate',
-        :peer_certs => [Puppet::SSL::CertificateAuthority.new.generate(
-          'not_my_server', :dns_alt_names => 'foo,bar,baz')]))
+        :peer_certs => [Puppet::TestCa.new.generate('not_my_server',
+                                                    :subject_alt_names => 'DNS:foo,DNS:bar,DNS:baz,DNS:not_my_server').content]))
 
       expect do
         connection.get('request')
       end.to raise_error(Puppet::Error) do |error|
-        error.message =~ /Server hostname 'my_server' did not match server certificate; expected one of (.+)/
+        error.message =~ /\AServer hostname 'my_server' did not match server certificate; expected one of (.+)/
         expect($1.split(', ')).to match_array(%w[DNS:foo DNS:bar DNS:baz DNS:not_my_server not_my_server])
       end
     end
@@ -152,10 +117,10 @@ describe Puppet::Network::HTTP::Connection do
       end.to raise_error(/some other message/)
     end
 
-    it "should check all peer certificates for upcoming expiration", :unless => Puppet.features.microsoft_windows? do
+    it "should check all peer certificates for upcoming expiration", :unless => Puppet::Util::Platform.windows? || RUBY_PLATFORM == 'java' do
       Puppet[:confdir] = tmpdir('conf')
-      cert = Puppet::SSL::CertificateAuthority.new.generate(
-        'server', :dns_alt_names => 'foo,bar,baz')
+      cert = Puppet::TestCa.new.generate('server',
+                                         :subject_alt_names => 'DNS:foo,DNS:bar,DNS:baz,DNS:server')
 
       connection = Puppet::Network::HTTP::Connection.new(
         host, port,
@@ -169,12 +134,12 @@ describe Puppet::Network::HTTP::Connection do
     end
   end
 
-  context "when using single use HTTPS connections" do
+  context "when using single use HTTPS connections", :unless => RUBY_PLATFORM == 'java' do
     it_behaves_like 'ssl verifier' do
     end
   end
 
-  context "when using persistent HTTPS connections" do
+  context "when using persistent HTTPS connections", :unless => RUBY_PLATFORM == 'java' do
     around :each do |example|
       pool = Puppet::Network::HTTP::Pool.new
       Puppet.override(:http_pool => pool) do
@@ -261,6 +226,93 @@ describe Puppet::Network::HTTP::Connection do
     end
   end
 
+  context "when response indicates an overloaded server" do
+    let(:http) { stub('http') }
+    let(:site) { Puppet::Network::HTTP::Site.new('http', 'my_server', 8140) }
+    let(:verify) { Puppet::SSL::Validator.no_validator }
+    let(:httpunavailable) { Net::HTTPServiceUnavailable.new('1.1', 503, 'Service Unavailable') }
+
+    subject { Puppet::Network::HTTP::Connection.new(site.host, site.port, :use_ssl => false, :verify => verify) }
+
+    context "when parsing Retry-After headers" do
+      # Private method. Create a reference that can be called by tests.
+      let(:header_parser) { subject.method(:parse_retry_after_header) }
+
+      it "returns 0 when parsing a RFC 2822 date that has passed" do
+        test_date = 'Wed, 13 Apr 2005 15:18:05 GMT'
+
+        expect(header_parser.call(test_date)).to eq(0)
+      end
+    end
+
+    it "should return a 503 response if Retry-After is not set" do
+      http.stubs(:request).returns(httpunavailable)
+
+      pool = Puppet.lookup(:http_pool)
+      pool.expects(:with_connection).with(site, anything).yields(http)
+
+      result = subject.get('/foo')
+
+      expect(result.code).to eq(503)
+    end
+
+    it "should return a 503 response if Retry-After is not convertible to an Integer or RFC 2822 Date" do
+      httpunavailable['Retry-After'] = 'foo'
+      http.stubs(:request).returns(httpunavailable)
+
+      pool = Puppet.lookup(:http_pool)
+      pool.expects(:with_connection).with(site, anything).yields(http)
+
+      result = subject.get('/foo')
+
+      expect(result.code).to eq(503)
+    end
+
+    it "should sleep and retry if Retry-After is an Integer" do
+      httpunavailable['Retry-After'] = '42'
+      http.stubs(:request).returns(httpunavailable).then.returns(httpok)
+
+      pool = Puppet.lookup(:http_pool)
+      pool.expects(:with_connection).with(site, anything).twice.yields(http)
+
+      ::Kernel.expects(:sleep).with(42)
+
+      result = subject.get('/foo')
+
+      expect(result.code).to eq(200)
+    end
+
+    it "should sleep and retry if Retry-After is an RFC 2822 Date" do
+      httpunavailable['Retry-After'] = 'Wed, 13 Apr 2005 15:18:05 GMT'
+      http.stubs(:request).returns(httpunavailable).then.returns(httpok)
+
+      now = DateTime.new(2005, 4, 13, 8, 17, 5, '-07:00')
+      DateTime.stubs(:now).returns(now)
+
+      pool = Puppet.lookup(:http_pool)
+      pool.expects(:with_connection).with(site, anything).twice.yields(http)
+
+      ::Kernel.expects(:sleep).with(60)
+
+      result = subject.get('/foo')
+
+      expect(result.code).to eq(200)
+    end
+
+    it "should sleep for no more than the Puppet runinterval" do
+      httpunavailable['Retry-After'] = '60'
+      http.stubs(:request).returns(httpunavailable).then.returns(httpok)
+      Puppet[:runinterval] = 30
+
+      pool = Puppet.lookup(:http_pool)
+      pool.expects(:with_connection).with(site, anything).twice.yields(http)
+
+      ::Kernel.expects(:sleep).with(30)
+
+      subject.get('/foo')
+    end
+  end
+
   it "allows setting basic auth on get requests" do
     expect_request_with_basic_auth
 

data/spec/unit/network/http/factory_spec.rb

@@ -78,21 +78,42 @@ describe Puppet::Network::HTTP::Factory do
 
       expect(conn.proxy_port).to eq(proxy_port)
     end
+  end
 
-    context 'socket timeouts' do
-      it 'sets open timeout' do
-        Puppet[:http_connect_timeout] = "10s"
-        conn = create_connection(site)
+  context 'socket timeouts' do
+    it 'sets open timeout' do
+      Puppet[:http_connect_timeout] = "10s"
+      conn = create_connection(site)
 
-        expect(conn.open_timeout).to eq(10)
-      end
+      expect(conn.open_timeout).to eq(10)
+    end
+
+    it 'sets read timeout' do
+      Puppet[:http_read_timeout] = "2m"
+      conn = create_connection(site)
 
-      it 'sets read timeout' do
-        Puppet[:http_read_timeout] = "2m"
-        conn = create_connection(site)
+      expect(conn.read_timeout).to eq(120)
+    end
+  end
+
+  it "disables ruby's http_keepalive_timeout" do
+    conn = create_connection(site)
+
+    expect(conn.keep_alive_timeout).to eq(2147483647)
+  end
+
+  context 'source address' do
+    it 'defaults to system-defined' do
+      conn = create_connection(site)
+
+      expect(conn.local_host).to be(nil)
+    end
+
+    it 'sets the local_host address' do
+      Puppet[:sourceaddress] = "127.0.0.1"
+      conn = create_connection(site)
 
-        expect(conn.read_timeout).to eq(120)
-      end
+      expect(conn.local_host).to eq('127.0.0.1')
     end
   end
 end

data/spec/unit/network/http/handler_spec.rb

@@ -52,9 +52,10 @@ describe Puppet::Network::HTTP::Handler do
 
     it "raises an error if multiple routes with the same path regex are registered" do
       expect do
-        handler = PuppetSpec::Handler.new(
+        PuppetSpec::Handler.new(
           Puppet::Network::HTTP::Route.path(%r{^/foo}).get(respond("ignored")),
-          Puppet::Network::HTTP::Route.path(%r{^/foo}).post(respond("also ignored")))
+          Puppet::Network::HTTP::Route.path(%r{^/foo}).post(respond("also ignored"))
+        )
       end.to raise_error(ArgumentError)
     end