puppet 5.0.0 → 6.0.0

data/spec/integration/util/windows/principal_spec.rb

@@ -2,13 +2,13 @@
 require 'spec_helper'
 require 'puppet/util/windows'
 
-describe Puppet::Util::Windows::SID::Principal, :if => Puppet.features.microsoft_windows? do
+describe Puppet::Util::Windows::SID::Principal, :if => Puppet::Util::Platform.windows? do
 
   let (:current_user_sid) { Puppet::Util::Windows::ADSI::User.current_user_sid }
   let (:system_bytes) { [1, 1, 0, 0, 0, 0, 0, 5, 18, 0, 0, 0] }
-  let (:null_sid_bytes) { bytes = [1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0] }
+  let (:null_sid_bytes) { [1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0] }
   let (:administrator_bytes) { [1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0] }
-  let (:computer_sid) { Puppet::Util::Windows::SID.name_to_sid_object(Puppet::Util::Windows::ADSI.computer_name) }
+  let (:computer_sid) { Puppet::Util::Windows::SID.name_to_principal(Puppet::Util::Windows::ADSI.computer_name) }
   # BUILTIN is localized on German Windows, but not French
   # looking this up like this dilutes the values of the tests as we're comparing two mechanisms
   # for returning the same values, rather than to a known good
@@ -23,6 +23,7 @@ describe Puppet::Util::Windows::SID::Principal, :if => Puppet.features.microsoft
       expect(principal.domain).to eq('')
       expect(principal.domain_account).to eq('NULL SID')
       expect(principal.account_type).to eq(:SidTypeWellKnownGroup)
+      expect(principal.to_s).to eq('NULL SID')
     end
 
     it "should create an instance from a well-known account prefixed with NT AUTHORITY" do
@@ -39,6 +40,7 @@ describe Puppet::Util::Windows::SID::Principal, :if => Puppet.features.microsoft
         expect(principal.account).to eq('SYSTEM')
         expect(principal.domain).to eq('NT AUTHORITY')
         expect(principal.domain_account).to eq('NT AUTHORITY\\SYSTEM')
+        expect(principal.to_s).to eq('NT AUTHORITY\\SYSTEM')
       end
 
       # Windows API LookupAccountSid behaves differently if current user is SYSTEM
@@ -87,6 +89,7 @@ describe Puppet::Util::Windows::SID::Principal, :if => Puppet.features.microsoft
       expect(principal.domain).to eq(domain)
       expect(principal.domain_account).to eq(qualified_name)
       expect(principal.account_type).to eq(:SidTypeAlias)
+      expect(principal.to_s).to eq(qualified_name)
     end
 
     it "should raise an error when trying to lookup an account that doesn't exist" do
@@ -106,6 +109,7 @@ describe Puppet::Util::Windows::SID::Principal, :if => Puppet.features.microsoft
       expect(principal.account).to eq(builtin_localized)
       expect(principal.domain).to eq(builtin_localized)
       expect(principal.domain_account).to eq(builtin_localized)
+      expect(principal.to_s).to eq(builtin_localized)
     end
 
     it "should return a BUILTIN domain principal for BUILTIN account names" do
@@ -115,6 +119,7 @@ describe Puppet::Util::Windows::SID::Principal, :if => Puppet.features.microsoft
       expect(principal.account).to eq(builtin_localized)
       expect(principal.domain).to eq(builtin_localized)
       expect(principal.domain_account).to eq(builtin_localized)
+      expect(principal.to_s).to eq(builtin_localized)
     end
 
   end
@@ -135,6 +140,7 @@ describe Puppet::Util::Windows::SID::Principal, :if => Puppet.features.microsoft
       expect(principal.domain).to eq(computer_sid.domain)
       expect(principal.domain_account).to eq(guest_name)
       expect(principal.account_type).to eq(:SidTypeUser)
+      expect(principal.to_s).to eq(guest_name)
     end
 
     it "should create an instance from a well-known group SID" do
@@ -145,6 +151,7 @@ describe Puppet::Util::Windows::SID::Principal, :if => Puppet.features.microsoft
       expect(principal.domain).to eq('')
       expect(principal.domain_account).to eq('NULL SID')
       expect(principal.account_type).to eq(:SidTypeWellKnownGroup)
+      expect(principal.to_s).to eq('NULL SID')
     end
 
     it "should create an instance from a well-known BUILTIN Alias SID" do
@@ -160,6 +167,7 @@ describe Puppet::Util::Windows::SID::Principal, :if => Puppet.features.microsoft
       expect(principal.domain).to eq(domain)
       expect(principal.domain_account).to eq(qualified_name)
       expect(principal.account_type).to eq(:SidTypeAlias)
+      expect(principal.to_s).to eq(qualified_name)
     end
 
     it "should raise an error when trying to lookup nil" do
@@ -214,6 +222,7 @@ describe Puppet::Util::Windows::SID::Principal, :if => Puppet.features.microsoft
       expect(principal.account).to eq(builtin_localized)
       expect(principal.domain).to eq(builtin_localized)
       expect(principal.domain_account).to eq(builtin_localized)
+      expect(principal.to_s).to eq(builtin_localized)
     end
   end
 

data/spec/integration/util/windows/process_spec.rb

@@ -3,10 +3,10 @@
 require 'spec_helper'
 require 'facter'
 
-describe "Puppet::Util::Windows::Process", :if => Puppet.features.microsoft_windows?  do
+describe "Puppet::Util::Windows::Process", :if => Puppet::Util::Platform.windows?  do
   describe "as an admin" do
     it "should have the SeCreateSymbolicLinkPrivilege necessary to create symlinks on Vista / 2008+",
-      :if => Facter.value(:kernelmajversion).to_f >= 6.0 && Puppet.features.microsoft_windows? do
+      :if => Facter.value(:kernelmajversion).to_f >= 6.0 && Puppet::Util::Platform.windows? do
       # this is a bit of a lame duck test since it requires running user to be admin
       # a better integration test would create a new user with the privilege and verify
       expect(Puppet::Util::Windows::User).to be_admin
@@ -14,7 +14,7 @@ describe "Puppet::Util::Windows::Process", :if => Puppet.features.microsoft_wind
     end
 
     it "should not have the SeCreateSymbolicLinkPrivilege necessary to create symlinks on 2003 and earlier",
-      :if => Facter.value(:kernelmajversion).to_f < 6.0 && Puppet.features.microsoft_windows? do
+      :if => Facter.value(:kernelmajversion).to_f < 6.0 && Puppet::Util::Platform.windows? do
       expect(Puppet::Util::Windows::User).to be_admin
       expect(Puppet::Util::Windows::Process.process_privilege_symlink?).to be_falsey
     end
@@ -34,6 +34,51 @@ describe "Puppet::Util::Windows::Process", :if => Puppet.features.microsoft_wind
     end
   end
 
+  describe "when reading environment variables" do
+    after :each do
+      # spec\integration\test\test_helper_spec.rb calls set_environment_strings
+      # after :all and thus needs access to the real APIs once again
+      Puppet::Util::Windows::Process.unstub(:GetEnvironmentStringsW)
+      Puppet::Util::Windows::Process.unstub(:FreeEnvironmentStringsW)
+    end
+
+    it "will ignore only keys or values with corrupt byte sequences" do
+      arraydest = []
+      Puppet::Util::Log.newdestination(Puppet::Test::LogCollector.new(arraydest))
+
+      env_vars = {}
+
+      # Create a UTF-16LE version of the below null separated environment string
+      # "a=b\x00c=d\x00e=\xDD\xDD\x00f=g\x00\x00"
+      env_var_block =
+        "a=b\x00".encode(Encoding::UTF_16LE) +
+        "c=d\x00".encode(Encoding::UTF_16LE) +
+        'e='.encode(Encoding::UTF_16LE) + "\xDD\xDD".force_encoding(Encoding::UTF_16LE) + "\x00".encode(Encoding::UTF_16LE) +
+        "f=g\x00\x00".encode(Encoding::UTF_16LE)
+
+      env_var_block_bytes = env_var_block.bytes.to_a
+
+      FFI::MemoryPointer.new(:byte, env_var_block_bytes.count) do |ptr|
+        # uchar here is synonymous with byte
+        ptr.put_array_of_uchar(0, env_var_block_bytes)
+
+        # stub the block of memory that the Win32 API would typically return via pointer
+        Puppet::Util::Windows::Process.expects(:GetEnvironmentStringsW).returns(ptr)
+        # stub out the real API call to free memory, else process crashes
+        Puppet::Util::Windows::Process.expects(:FreeEnvironmentStringsW)
+
+        env_vars = Puppet::Util::Windows::Process.get_environment_strings
+      end
+
+      # based on corrupted memory, the e=\xDD\xDD should have been removed from the set
+      expect(env_vars).to eq({'a' => 'b', 'c' => 'd', 'f' => 'g'})
+
+      # and Puppet should emit a warning about it
+      expect(arraydest.last.level).to eq(:warning)
+      expect(arraydest.last.message).to eq("Discarding environment variable e=\uFFFD which contains invalid bytes")
+    end
+  end
+
   describe "when setting environment variables" do
     it "can properly handle env var values with = in them" do
       begin

data/spec/integration/util/windows/registry_spec.rb

@@ -146,7 +146,7 @@ describe Puppet::Util::Windows::Registry do
 
       # proof that local encodings (such as IBM437 are no longer relevant)
       it "will return a UTF-8 string from a REG_SZ registry value (written as UTF-16LE)",
-        :if => Puppet::Util::Platform.windows? && RUBY_VERSION >= '2.1' do
+        :if => Puppet::Util::Platform.windows? do
 
         # create a UTF-16LE byte array representing "–™"
         utf_16_bytes = ENDASH_UTF_16 + TM_UTF_16

data/spec/integration/util/windows/security_spec.rb

@@ -1,14 +1,14 @@
 #!/usr/bin/env ruby
 require 'spec_helper'
 
-if Puppet.features.microsoft_windows?
+if Puppet::Util::Platform.windows?
   class WindowsSecurityTester
     require 'puppet/util/windows/security'
     include Puppet::Util::Windows::Security
   end
 end
 
-describe "Puppet::Util::Windows::Security", :if => Puppet.features.microsoft_windows? do
+describe "Puppet::Util::Windows::Security", :if => Puppet::Util::Platform.windows? do
   include PuppetSpec::Files
 
   before :all do
@@ -114,7 +114,7 @@ describe "Puppet::Util::Windows::Security", :if => Puppet.features.microsoft_win
 
         after :each do
           winsec.set_mode(WindowsSecurityTester::S_IRWXU, parent)
-          winsec.set_mode(WindowsSecurityTester::S_IRWXU, path) if Puppet::FileSystem.exist?(path)
+          begin winsec.set_mode(WindowsSecurityTester::S_IRWXU, path) rescue nil end
         end
 
         describe "#supports_acl?" do
@@ -167,6 +167,19 @@ describe "Puppet::Util::Windows::Security", :if => Puppet.features.microsoft_win
           it "should allow setting to a group the current owner is not a member of" do
             winsec.set_group(sids[:power_users], path)
           end
+
+          it "should consider a mode of 7 for group to be FullControl (F)" do
+            winsec.set_group(sids[:power_users], path)
+            winsec.set_mode(0070, path)
+
+            group_ace = winsec.get_aces_for_path_by_sid(path, sids[:power_users])
+            # there should only be a single ace for the given group
+            expect(group_ace.count).to eq(1)
+            expect(group_ace[0].mask).to eq(klass::FILE_ALL_ACCESS)
+
+            # ensure that mode is still read as 070 (written as 70)
+            expect((winsec.get_mode(path) & 0777).to_s(8).rjust(3, '0')).to eq("070")
+          end
         end
 
         describe "#group" do
@@ -211,7 +224,58 @@ describe "Puppet::Util::Windows::Security", :if => Puppet.features.microsoft_win
             end
           end
 
-          it "should round-trip all 128 modes that do not require deny ACEs" do
+          it "should round-trip all 128 modes that do not require deny ACEs, where owner and group are different" do
+            # windows defaults set Administrators, None when Administrator
+            # or Administrators, SYSTEM when System
+            # but we can guarantee group is different by explicitly setting to Users
+            winsec.set_group(sids[:users], path)
+
+            0.upto(1).each do |s|
+              0.upto(7).each do |u|
+                0.upto(u).each do |g|
+                  0.upto(g).each do |o|
+                    # if user is superset of group, and group superset of other, then
+                    # no deny ace is required, and mode can be converted to win32
+                    # access mask, and back to mode without loss of information
+                    # (provided the owner and group are not the same)
+                    next if ((u & g) != g) or ((g & o) != o)
+
+                    mode = (s << 9 | u << 6 | g << 3 | o << 0)
+                    winsec.set_mode(mode, path)
+                    expect(winsec.get_mode(path).to_s(8)).to eq(mode.to_s(8))
+                  end
+                end
+              end
+            end
+          end
+
+          it "should round-trip all 54 modes that do not require deny ACEs, where owner and group are same" do
+            winsec.set_group(winsec.get_owner(path), path)
+
+            0.upto(1).each do |s|
+              0.upto(7).each do |ug|
+                0.upto(ug).each do |o|
+                  # if user and group superset of other, then
+                  # no deny ace is required, and mode can be converted to win32
+                  # access mask, and back to mode without loss of information
+                  # (provided the owner and group are the same)
+                  next if ((ug & o) != o)
+                  mode = (s << 9 | ug << 6 | ug << 3 | o << 0)
+                  winsec.set_mode(mode, path)
+                  expect(winsec.get_mode(path).to_s(8)).to eq(mode.to_s(8))
+                end
+              end
+            end
+          end
+
+          # The SYSTEM user is a special case therefore we need to test that we round trip correctly when set
+          it "should round-trip all 128 modes that do not require deny ACEs, when simulating a SYSTEM service" do
+            # The owner and group for files/dirs created, when running as a service under Local System are
+            # Owner = Administrators
+            # Group = SYSTEM
+            winsec.set_owner(sids[:administrators], path)
+            winsec.set_group(sids[:system], path)
+
             0.upto(1).each do |s|
               0.upto(7).each do |u|
                 0.upto(u).each do |g|
@@ -406,13 +470,13 @@ describe "Puppet::Util::Windows::Security", :if => Puppet.features.microsoft_win
         end
       end
 
-      describe "for an administrator", :if => (Puppet.features.root? && Puppet.features.microsoft_windows?) do
+      describe "for an administrator", :if => (Puppet.features.root? && Puppet::Util::Platform.windows?) do
         before :each do
           is_dir = Puppet::FileSystem.directory?(path)
           winsec.set_mode(WindowsSecurityTester::S_IRWXU | WindowsSecurityTester::S_IRWXG, path)
           set_group_depending_on_current_user(path)
           winsec.set_owner(sids[:guest], path)
-          expected_error = RUBY_VERSION =~ /^2\./ && is_dir ? Errno::EISDIR : Errno::EACCES
+          expected_error = is_dir ? Errno::EISDIR : Errno::EACCES
           expect { File.open(path, 'r') }.to raise_error(expected_error)
         end
 
@@ -553,6 +617,32 @@ describe "Puppet::Util::Windows::Security", :if => Puppet.features.microsoft_win
           # end
         end
 
+        describe "#mode=" do
+          # setting owner to SYSTEM requires root
+          it "should round-trip all 54 modes that do not require deny ACEs, when simulating a SYSTEM scheduled task" do
+            # The owner and group for files/dirs created, when running as a Scheduled Task as Local System are
+            # Owner = SYSTEM
+            # Group = SYSTEM
+            winsec.set_group(sids[:system], path)
+            winsec.set_owner(sids[:system], path)
+
+            0.upto(1).each do |s|
+              0.upto(7).each do |ug|
+                0.upto(ug).each do |o|
+                  # if user and group superset of other, then
+                  # no deny ace is required, and mode can be converted to win32
+                  # access mask, and back to mode without loss of information
+                  # (provided the owner and group are the same)
+                  next if ((ug & o) != o)
+                  mode = (s << 9 | ug << 6 | ug << 3 | o << 0)
+                  winsec.set_mode(mode, path)
+                  expect(winsec.get_mode(path).to_s(8)).to eq(mode.to_s(8))
+                end
+              end
+            end
+          end
+        end
+
         describe "when the parent directory" do
           before :each do
             winsec.set_owner(sids[:current_user], parent)
@@ -734,11 +824,11 @@ describe "Puppet::Util::Windows::Security", :if => Puppet.features.microsoft_win
       let (:explorer) { File.join(Dir::WINDOWS, "explorer.exe") }
 
       it "should get the owner" do
-        expect(winsec.get_owner(explorer)).to match /^S-1-5-/
+        expect(winsec.get_owner(explorer)).to match(/^S-1-5-/)
       end
 
       it "should get the group" do
-        expect(winsec.get_group(explorer)).to match /^S-1-5-/
+        expect(winsec.get_group(explorer)).to match(/^S-1-5-/)
       end
 
       it "should get the mode" do

data/spec/integration/util/windows/user_spec.rb

@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe "Puppet::Util::Windows::User", :if => Puppet.features.microsoft_windows? do
+describe "Puppet::Util::Windows::User", :if => Puppet::Util::Platform.windows? do
   describe "2003 without UAC" do
     before :each do
       Puppet::Util::Windows::Process.stubs(:windows_major_version).returns(5)

data/spec/integration/util_spec.rb

@@ -5,7 +5,7 @@ require 'spec_helper'
 describe Puppet::Util do
   include PuppetSpec::Files
 
-  describe "#execute" do
+  describe "#execute", unless: Puppet::Util::Platform.jruby? do
     it "should properly allow stdout and stderr to share a file" do
       command = "ruby -e '(1..10).each {|i| (i%2==0) ? $stdout.puts(i) : $stderr.puts(i)}'"
 
@@ -29,7 +29,7 @@ describe Puppet::Util do
     end
   end
 
-  describe "#replace_file on Windows", :if => Puppet.features.microsoft_windows? do
+  describe "#replace_file on Windows", :if => Puppet::Util::Platform.windows? do
     it "replace_file should preserve original ACEs from existing replaced file on Windows" do
 
       file = tmpfile("somefile")
@@ -109,7 +109,7 @@ describe Puppet::Util do
     end
   end
 
-  describe "#which on Windows", :if => Puppet.features.microsoft_windows? do
+  describe "#which on Windows", :if => Puppet::Util::Platform.windows? do
     let (:rune_utf8) { "\u16A0\u16C7\u16BB\u16EB\u16D2\u16E6\u16A6\u16EB\u16A0\u16B1\u16A9\u16A0\u16A2\u16B1\u16EB\u16A0\u16C1\u16B1\u16AA\u16EB\u16B7\u16D6\u16BB\u16B9\u16E6\u16DA\u16B3\u16A2\u16D7" }
     let (:filename) { 'foo.exe' }
     let (:filepath) { File.expand_path('C:\\' + rune_utf8 + '\\' + filename) }

data/spec/lib/matchers/json.rb

@@ -9,7 +9,7 @@ module JSONMatchers
     end
 
     def json(instance)
-      JSON.parse(instance.to_json)
+      Puppet::Util::Json.load(instance.to_json)
     end
 
     def attr_value(attrs, instance)
@@ -28,6 +28,7 @@ module JSONMatchers
     end
 
     def matches?(instance)
+      @instance = instance
       result = attr_value(@attributes, instance)
       if @value
         result == @value
@@ -36,19 +37,19 @@ module JSONMatchers
       end
     end
 
-    def failure_message(instance)
+    def failure_message
       if @value
-        "expected #{instance.inspect} to set #{@attributes.inspect} to #{@value.inspect}; got #{attr_value(@attributes, instance).inspect}"
+        "expected #{@instance.inspect} to set #{@attributes.inspect} to #{@value.inspect}; got #{attr_value(@attributes, @instance).inspect}"
       else
-        "expected #{instance.inspect} to set #{@attributes.inspect} but was nil"
+        "expected #{@instance.inspect} to set #{@attributes.inspect} but was nil"
       end
     end
 
-    def failure_message_when_negated(instance)
+    def failure_message_when_negated
       if @value
-        "expected #{instance.inspect} not to set #{@attributes.inspect} to #{@value.inspect}"
+        "expected #{@instance.inspect} not to set #{@attributes.inspect} to #{@value.inspect}"
       else
-        "expected #{instance.inspect} not to set #{@attributes.inspect} to nil"
+        "expected #{@instance.inspect} not to set #{@attributes.inspect} to nil"
       end
     end
   end
@@ -74,7 +75,7 @@ module JSONMatchers
 
     def matches?(klass)
       raise "Must specify json with 'from'" unless @json
-
+      @klass = klass
       @instance = format.intern(klass, @json)
       if @value
         @instance.send(@attribute) == @value
@@ -83,48 +84,42 @@ module JSONMatchers
       end
     end
 
-    def failure_message(klass)
+    def failure_message
       if @value
-        "expected #{klass} to read #{@attribute} from #{@json} as #{@value.inspect}; got #{@instance.send(@attribute).inspect}"
+        "expected #{@klass} to read #{@attribute} from #{@json} as #{@value.inspect}; got #{@instance.send(@attribute).inspect}"
       else
-        "expected #{klass} to read #{@attribute} from #{@json} but was nil"
+        "expected #{@klass} to read #{@attribute} from #{@json} but was nil"
       end
     end
 
-    def failure_message_when_negated(klass)
+    def failure_message_when_negated
       if @value
-        "expected #{klass} not to set #{@attribute} to #{@value}"
+        "expected #{@klass} not to set #{@attribute} to #{@value}"
       else
-        "expected #{klass} not to set #{@attribute} to nil"
+        "expected #{@klass} not to set #{@attribute} to nil"
       end
     end
   end
 
-  if !Puppet.features.microsoft_windows?
-    require 'json'
-    require 'json-schema'
+  require 'puppet/util/json'
+  require 'json-schema'
 
-    class SchemaMatcher
-      JSON_META_SCHEMA = JSON.parse(File.read('api/schemas/json-meta-schema.json'))
+  class SchemaMatcher
+    JSON_META_SCHEMA = Puppet::Util::Json.load(File.read('api/schemas/json-meta-schema.json'))
 
-      def initialize(schema)
-        @schema = schema
-      end
+    def initialize(schema)
+      @schema = schema
+    end
 
-      def matches?(json)
-        JSON::Validator.validate!(JSON_META_SCHEMA, @schema)
-        JSON::Validator.validate!(@schema, json)
-      end
+    def matches?(json)
+      JSON::Validator.validate!(JSON_META_SCHEMA, @schema)
+      JSON::Validator.validate!(@schema, json)
     end
   end
 
   def validate_against(schema_file)
-    if Puppet.features.microsoft_windows?
-      pending("Schema checks cannot be done on windows because of json-schema problems")
-    else
-      schema = JSON.parse(File.read(schema_file))
-      SchemaMatcher.new(schema)
-    end
+    schema = Puppet::Util::Json.load(File.read(schema_file))
+    SchemaMatcher.new(schema)
   end
 
   def set_json_attribute(*attributes)

data/{lib/puppet/ssl → spec/lib/puppet}/certificate_factory.rb

@@ -4,7 +4,7 @@ require 'puppet/ssl'
 # certificates.
 #
 # @api private
-module Puppet::SSL::CertificateFactory
+module Puppet::CertificateFactory
 
   # Create a new X509 certificate and add any needed extensions to the cert.
   #
@@ -19,12 +19,11 @@ module Puppet::SSL::CertificateFactory
   # @param serial [Integer] The serial number for the given certificate, which
   #   MUST be unique for the given CA.
   # @param ttl [String] The duration of the validity for the given certificate.
-  #   defaults to Puppet[:ca_ttl]
   #
   # @api public
   #
   # @return [OpenSSL::X509::Certificate]
-  def self.build(cert_type, csr, issuer, serial, ttl = nil)
+  def self.build(cert_type, csr, issuer, serial, ttl = 3600)
     # Work out if we can even build the requested type of certificate.
     build_extensions = "build_#{cert_type.to_s}_extensions"
     respond_to?(build_extensions) or
@@ -47,15 +46,13 @@ module Puppet::SSL::CertificateFactory
     # clock fail, and better than having every cert we generate expire a day
     # before the user expected it to when they asked for "one year".
     cert.not_before = Time.now - (60*60*24)
-    cert.not_after  = Time.now + (ttl || Puppet[:ca_ttl])
+    cert.not_after  = Time.now + ttl
 
     add_extensions_to(cert, csr, issuer, send(build_extensions))
 
     return cert
   end
 
-  private
-
   # Add X509v3 extensions to the given certificate.
   #
   # @param cert [OpenSSL::X509::Certificate] The certificate to add the
@@ -114,6 +111,7 @@ module Puppet::SSL::CertificateFactory
       generate_extension(ef, oid, *val)
     end
   end
+  private_class_method :add_extensions_to
 
   # Woot! We're a CA.
   def self.build_ca_extensions
@@ -216,4 +214,5 @@ module Puppet::SSL::CertificateFactory
       OpenSSL::X509::Extension.new(oid, OpenSSL::ASN1::UTF8String.new(val).to_der, crit)
     end
   end
+  private_class_method :generate_extension
 end

data/spec/lib/puppet/test_ca.rb

@@ -0,0 +1,109 @@
+module Puppet
+  class TestCa
+
+    CERT_VALID_FROM = (Time.now - (60*60*24)).freeze
+    CERT_VALID_UNTIL = (Time.now + 600)
+
+    CA_EXTENSIONS = [
+      ["basicConstraints", "CA:TRUE", true],
+      ["keyUsage", "keyCertSign, cRLSign", true],
+      ["subjectKeyIdentifier", "hash", false],
+      ["nsComment", "Puppet Server Internal Certificate", false],
+      ["authorityKeyIdentifier", "keyid:always", false]
+    ].freeze
+
+    attr_reader :ca_cert, :ca_crl
+
+    def initialize
+      @digest = OpenSSL::Digest::SHA256.new
+      @key = OpenSSL::PKey::RSA.new(1024)
+      @ca_cert = self_signed_ca
+      @ca_crl = create_crl
+    end
+
+    def sign(csr, opts = {})
+      cert = OpenSSL::X509::Certificate.new
+      cert.public_key = csr.public_key
+      cert.subject = csr.subject
+      cert.issuer = @ca_cert.subject
+      cert.version = 2
+      cert.serial = 1
+      cert.not_before = CERT_VALID_FROM
+      cert.not_after =  CERT_VALID_UNTIL
+      ef = extension_factory_for(@ca_cert, cert)
+      if opts[:subject_alt_names]
+        ext = ef.create_extension(["subjectAltName", opts[:subject_alt_names], false])
+        cert.add_extension(ext)
+      end
+      cert.sign(@key, @digest)
+      Puppet::SSL::Certificate.from_instance(cert)
+    end
+
+    def revoke(cert)
+      revoked = OpenSSL::X509::Revoked.new
+      revoked.serial = cert.serial
+      revoked.time = Time.now
+      enum = OpenSSL::ASN1::Enumerated(OpenSSL::OCSP::REVOKED_STATUS_KEYCOMPROMISE)
+      ext = OpenSSL::X509::Extension.new("CRLReason", enum)
+      revoked.add_extensions(ext)
+      @crl.add_revoked(revoked)
+    end
+
+    def generate(name, opts)
+      host_key = OpenSSL::PKey::RSA.new(1024)
+      csr = create_csr(name, host_key)
+      sign(csr, opts)
+    end
+
+    private
+
+    def create_csr(name, key)
+      csr = OpenSSL::X509::Request.new
+      csr.public_key = key.public_key
+      csr.subject = OpenSSL::X509::Name.new([["CN", name]])
+      csr.version = 2
+      csr.sign(key, @digest)
+      csr
+    end
+
+    def self_signed_ca
+      cert = OpenSSL::X509::Certificate.new
+      cert.public_key = @key.public_key
+      cert.subject = OpenSSL::X509::Name.new([["CN", "Test CA"]])
+      cert.issuer = cert.subject
+      cert.version = 2
+      cert.serial = 1
+      cert.not_before = CERT_VALID_FROM
+      cert.not_after  = CERT_VALID_UNTIL
+      ef = extension_factory_for(cert, cert)
+      CA_EXTENSIONS.each do |ext|
+        extension = ef.create_extension(*ext)
+        cert.add_extension(extension)
+      end
+      cert.sign(@key, @digest)
+      cert
+    end
+
+    def create_crl
+      crl = OpenSSL::X509::CRL.new
+      crl.version = 1
+      crl.issuer = @ca_cert.subject
+      ef = extension_factory_for(@ca_cert)
+      crl.add_extension(
+        ef.create_extension(["authorityKeyIdentifier", "keyid:always", false]))
+      crl.add_extension(
+        OpenSSL::X509::Extension.new("crlNumber", OpenSSL::ASN1::Integer(0)))
+      crl.last_update = CERT_VALID_FROM
+      crl.next_update = CERT_VALID_UNTIL
+      crl.sign(@key, @digest)
+      crl
+    end
+
+    def extension_factory_for(ca, cert = nil)
+      ef = OpenSSL::X509::ExtensionFactory.new
+      ef.issuer_certificate  = ca
+      ef.subject_certificate = cert if cert
+      ef
+    end
+  end
+end