puppet 5.3.5 → 5.3.6

data/man/man8/puppet-status.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET\-STATUS" "8" "June 2017" "Puppet Labs, LLC" "Puppet manual"
+.TH "PUPPET\-STATUS" "8" "April 2018" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\-status\fR \- View puppet server status\.

data/man/man8/puppet.8

@@ -1,7 +1,7 @@
 .\" generated with Ronn/v0.7.3
 .\" http://github.com/rtomayko/ronn/tree/0.7.3
 .
-.TH "PUPPET" "8" "June 2017" "Puppet Labs, LLC" "Puppet manual"
+.TH "PUPPET" "8" "April 2018" "Puppet, Inc." "Puppet manual"
 .
 .SH "NAME"
 \fBpuppet\fR
@@ -16,4 +16,4 @@ Available subcommands:
 agent The puppet agent daemon apply Apply Puppet manifests locally ca Local Puppet Certificate Authority management\. (Deprecated) catalog Compile, save, view, and convert catalogs\. cert Manage certificates and requests certificate Provide access to the CA for certificate management\. certificate_request Manage certificate requests\. (Deprecated) certificate_revocation_list Manage the list of revoked certificates\. (Deprecated) config Interact with Puppet\'s settings\. describe Display help about resource types device Manage remote network devices doc Generate Puppet references epp Interact directly with the EPP template parser/renderer\. facts Retrieve and store facts\. filebucket Store and retrieve files in a filebucket generate Generates Puppet code from Ruby definitions\. help Display Puppet help\. key Create, save, and remove certificate keys\. (Deprecated) lookup Interactive Hiera lookup man Display Puppet manual pages\. master The puppet master daemon module Creates, installs and searches for modules on the Puppet Forge\. node View and manage node definitions\. parser Interact directly with the parser\. plugin Interact with the Puppet plugin system\. report Create, display, and submit reports\. resource The resource abstraction layer shell status View puppet server status\. (Deprecated)
 .
 .P
-See \'puppet help \fIsubcommand\fR \fIaction\fR\' for help on a specific subcommand action\. See \'puppet help \fIsubcommand\fR\' for help on a specific subcommand\. Puppet v5\.0\.0
+See \'puppet help \fIsubcommand\fR \fIaction\fR\' for help on a specific subcommand action\. See \'puppet help \fIsubcommand\fR\' for help on a specific subcommand\. Puppet v5\.3\.6

data/spec/integration/application/lookup_spec.rb

@@ -90,6 +90,27 @@ describe 'lookup' do
       expect(lookup('a')).to eql('value a')
     end
 
+    context 'uses node_terminus' do
+      require 'puppet/indirector/node/exec'
+      require 'puppet/indirector/node/plain'
+
+      let(:node) { Puppet::Node.new('testnode', :environment => env) }
+
+      it ':plain without --compile' do
+        Puppet.settings[:node_terminus] = 'exec'
+        Puppet::Node::Plain.any_instance.expects(:find).returns(node)
+        Puppet::Node::Exec.any_instance.expects(:find).never
+        expect(lookup('a')).to eql('value a')
+      end
+
+      it 'configured in Puppet settings with --compile' do
+        Puppet.settings[:node_terminus] = 'exec'
+        Puppet::Node::Plain.any_instance.expects(:find).never
+        Puppet::Node::Exec.any_instance.expects(:find).returns(node)
+        expect(lookup('a', :compile => true)).to eql('value a')
+      end
+    end
+
     context 'configured with the wrong environment' do
       let(:env) { Puppet::Node::Environment.create(env_name.to_sym, [File.join(populated_env_dir, env_name, 'modules')]) }
       it 'does not find data in non-existing environment' do

data/spec/integration/util/windows/adsi_spec.rb

@@ -81,6 +81,91 @@ describe Puppet::Util::Windows::ADSI::Group,
   end
 
   describe '.members' do
+    it 'should return a list of members resolvable with Puppet::Util::Windows::ADSI::Group.name_sid_hash' do
+      temp_groupname = "g#{SecureRandom.uuid}"
+      temp_username  = "u#{SecureRandom.uuid}"[0..12]
+
+      # select a virtual account that requires an authority to be able to resolve to SID
+      # the Dhcp service is chosen for no particular reason aside from it's a service available on all Windows versions
+      dhcp_virtualaccount = Puppet::Util::Windows::SID.name_to_principal('NT SERVICE\Dhcp')
+
+      # adding :SidTypeGroup as a group member will cause error in IAdsUser::Add
+      # adding :SidTypeDomain (such as S-1-5-80 / NT SERVICE or computer name) won't error
+      #   but also won't be returned as a group member
+      # uncertain how to obtain :SidTypeComputer (perhaps AD? the local machine is :SidTypeDomain)
+      users = [
+        # Use sid_to_name to get localized names of SIDs - BUILTIN, SYSTEM, NT AUTHORITY, Everyone are all localized
+        # :SidTypeWellKnownGroup
+        # SYSTEM is prefixed with the NT Authority authority, resolveable with or without authority
+        { :sid => 'S-1-5-18', :name => Puppet::Util::Windows::SID.sid_to_name('S-1-5-18') },
+        # Everyone is not prefixed with an authority, resolveable with or without NT AUTHORITY authority
+        { :sid => 'S-1-1-0', :name => Puppet::Util::Windows::SID.sid_to_name('S-1-1-0') },
+        # Dhcp service account is prefixed with NT SERVICE authority, requires authority to resolve SID
+        # behavior is similar to IIS APPPOOL\DefaultAppPool
+        { :sid => dhcp_virtualaccount.sid, :name => dhcp_virtualaccount.domain_account },
+
+        # :SidTypeAlias with authority component
+        # Administrators group is prefixed with BUILTIN authority, can be resolved with or without authority
+        { :sid => 'S-1-5-32-544', :name => Puppet::Util::Windows::SID.sid_to_name('S-1-5-32-544') },
+      ]
+
+      begin
+        # :SidTypeUser as user on localhost, can be resolved with or without authority prefix
+        user = Puppet::Util::Windows::ADSI::User.create(temp_username)
+        user.commit()
+        users.push({ :sid => user.sid.sid, :name => Puppet::Util::Windows::ADSI.computer_name + '\\' + temp_username })
+
+        # create a test group and add above 5 members by SID
+        group = described_class.create(temp_groupname)
+        group.commit()
+        group.set_members(users.map { |u| u[:sid]} )
+
+        # most importantly make sure that all name are convertible to SIDs
+        expect { described_class.name_sid_hash(group.members) }.to_not raise_error
+
+        # also verify the names returned are as expected
+        expected_usernames = users.map { |u| u[:name] }
+        expect(group.members.map(&:domain_account)).to eq(expected_usernames)
+      ensure
+        described_class.delete(temp_groupname) if described_class.exists?(temp_groupname)
+        Puppet::Util::Windows::ADSI::User.delete(temp_username) if Puppet::Util::Windows::ADSI::User.exists?(temp_username)
+      end
+    end
+
+    it 'should return a list of Principal objects even with unresolvable SIDs' do
+      members = [
+        # NULL SID is not localized
+        stub('WIN32OLE', {
+          :objectSID => [1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0],
+          :Name => 'NULL SID',
+          :ole_respond_to? => true,
+        }),
+        # unresolvable SID is a different story altogether
+        stub('WIN32OLE', {
+          # completely valid SID, but Name is just a stringified version
+          :objectSID => [1, 5, 0, 0, 0, 0, 0, 5, 21, 0, 0, 0, 5, 113, 65, 218, 15, 127, 9, 57, 219, 4, 84, 126, 88, 4, 0, 0],
+          :Name => 'S-1-5-21-3661721861-956923663-2119435483-1112',
+          :ole_respond_to? => true,
+        })
+      ]
+
+      admins_name = Puppet::Util::Windows::SID.sid_to_name('S-1-5-32-544')
+      admins = Puppet::Util::Windows::ADSI::Group.new(admins_name)
+
+      # touch the native_group member to have it lazily loaded, so COM objects can be stubbed
+      admins.native_group
+      admins.native_group.stubs(:Members).returns(members)
+
+      # well-known NULL SID
+      expect(admins.members[0].sid).to eq('S-1-0-0')
+      expect(admins.members[0].account_type).to eq(:SidTypeWellKnownGroup)
+
+      # unresolvable SID
+      expect(admins.members[1].sid).to eq('S-1-5-21-3661721861-956923663-2119435483-1112')
+      expect(admins.members[1].account).to eq('S-1-5-21-3661721861-956923663-2119435483-1112 (unresolvable)')
+      expect(admins.members[1].account_type).to eq(:SidTypeUnknown)
+    end
+
     it 'should return a list of members with UTF-8 names' do
       begin
         original_codepage = Encoding.default_external
@@ -88,7 +173,7 @@ describe Puppet::Util::Windows::ADSI::Group,
 
         # lookup by English name Administrators is not OK on localized Windows
         admins = Puppet::Util::Windows::ADSI::Group.new(administrators_principal.account)
-        admins.members.each do |name|
+        admins.members.map(&:domain_account).each do |name|
           expect(name.encoding).to be(Encoding::UTF_8)
         end
       ensure

data/spec/integration/util/windows/principal_spec.rb

@@ -8,7 +8,7 @@ describe Puppet::Util::Windows::SID::Principal, :if => Puppet.features.microsoft
   let (:system_bytes) { [1, 1, 0, 0, 0, 0, 0, 5, 18, 0, 0, 0] }
   let (:null_sid_bytes) { bytes = [1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0] }
   let (:administrator_bytes) { [1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0] }
-  let (:computer_sid) { Puppet::Util::Windows::SID.name_to_sid_object(Puppet::Util::Windows::ADSI.computer_name) }
+  let (:computer_sid) { Puppet::Util::Windows::SID.name_to_principal(Puppet::Util::Windows::ADSI.computer_name) }
   # BUILTIN is localized on German Windows, but not French
   # looking this up like this dilutes the values of the tests as we're comparing two mechanisms
   # for returning the same values, rather than to a known good
@@ -23,6 +23,7 @@ describe Puppet::Util::Windows::SID::Principal, :if => Puppet.features.microsoft
       expect(principal.domain).to eq('')
       expect(principal.domain_account).to eq('NULL SID')
       expect(principal.account_type).to eq(:SidTypeWellKnownGroup)
+      expect(principal.to_s).to eq('NULL SID')
     end
 
     it "should create an instance from a well-known account prefixed with NT AUTHORITY" do
@@ -39,6 +40,7 @@ describe Puppet::Util::Windows::SID::Principal, :if => Puppet.features.microsoft
         expect(principal.account).to eq('SYSTEM')
         expect(principal.domain).to eq('NT AUTHORITY')
         expect(principal.domain_account).to eq('NT AUTHORITY\\SYSTEM')
+        expect(principal.to_s).to eq('NT AUTHORITY\\SYSTEM')
       end
 
       # Windows API LookupAccountSid behaves differently if current user is SYSTEM
@@ -87,6 +89,7 @@ describe Puppet::Util::Windows::SID::Principal, :if => Puppet.features.microsoft
       expect(principal.domain).to eq(domain)
       expect(principal.domain_account).to eq(qualified_name)
       expect(principal.account_type).to eq(:SidTypeAlias)
+      expect(principal.to_s).to eq(qualified_name)
     end
 
     it "should raise an error when trying to lookup an account that doesn't exist" do
@@ -106,6 +109,7 @@ describe Puppet::Util::Windows::SID::Principal, :if => Puppet.features.microsoft
       expect(principal.account).to eq(builtin_localized)
       expect(principal.domain).to eq(builtin_localized)
       expect(principal.domain_account).to eq(builtin_localized)
+      expect(principal.to_s).to eq(builtin_localized)
     end
 
     it "should return a BUILTIN domain principal for BUILTIN account names" do
@@ -115,6 +119,7 @@ describe Puppet::Util::Windows::SID::Principal, :if => Puppet.features.microsoft
       expect(principal.account).to eq(builtin_localized)
       expect(principal.domain).to eq(builtin_localized)
       expect(principal.domain_account).to eq(builtin_localized)
+      expect(principal.to_s).to eq(builtin_localized)
     end
 
   end
@@ -135,6 +140,7 @@ describe Puppet::Util::Windows::SID::Principal, :if => Puppet.features.microsoft
       expect(principal.domain).to eq(computer_sid.domain)
       expect(principal.domain_account).to eq(guest_name)
       expect(principal.account_type).to eq(:SidTypeUser)
+      expect(principal.to_s).to eq(guest_name)
     end
 
     it "should create an instance from a well-known group SID" do
@@ -145,6 +151,7 @@ describe Puppet::Util::Windows::SID::Principal, :if => Puppet.features.microsoft
       expect(principal.domain).to eq('')
       expect(principal.domain_account).to eq('NULL SID')
       expect(principal.account_type).to eq(:SidTypeWellKnownGroup)
+      expect(principal.to_s).to eq('NULL SID')
     end
 
     it "should create an instance from a well-known BUILTIN Alias SID" do
@@ -160,6 +167,7 @@ describe Puppet::Util::Windows::SID::Principal, :if => Puppet.features.microsoft
       expect(principal.domain).to eq(domain)
       expect(principal.domain_account).to eq(qualified_name)
       expect(principal.account_type).to eq(:SidTypeAlias)
+      expect(principal.to_s).to eq(qualified_name)
     end
 
     it "should raise an error when trying to lookup nil" do
@@ -214,6 +222,7 @@ describe Puppet::Util::Windows::SID::Principal, :if => Puppet.features.microsoft
       expect(principal.account).to eq(builtin_localized)
       expect(principal.domain).to eq(builtin_localized)
       expect(principal.domain_account).to eq(builtin_localized)
+      expect(principal.to_s).to eq(builtin_localized)
     end
   end
 

data/spec/unit/application/cert_spec.rb

@@ -191,9 +191,9 @@ describe Puppet::Application::Cert => true do
       @cert_app.subcommand = :destroy
       @cert_app.command_line.stubs(:args).returns(["unsigned-node"])
 
-      Puppet::SSL::CertificateAuthority::Interface.expects(:new).returns(@iface).with { |cert_mode,to| cert_mode == :destroy
-        to[:to] == ["unsigned-node"]
-      }
+      Puppet::SSL::CertificateAuthority::Interface.unstub(:new)
+      Puppet::SSL::CertificateAuthority::Interface.expects(:new).with(:revoke, anything).never
+      Puppet::SSL::CertificateAuthority::Interface.expects(:new).with(:destroy, {:to => ['unsigned-node'], :digest => nil}).returns(@iface)
 
       @cert_app.main
     end
@@ -203,16 +203,28 @@ describe Puppet::Application::Cert => true do
       @cert_app.command_line.stubs(:args).returns(["host","unsigned-node"])
 
       Puppet::SSL::CertificateAuthority::Interface.expects(:new).returns(@iface).with { |cert_mode,to|
-        cert_mode == :revoke
+        cert_mode == :revoke &&
         to[:to] == ["host"]
       }
       Puppet::SSL::CertificateAuthority::Interface.expects(:new).returns(@iface).with { |cert_mode,to|
-        cert_mode == :destroy
+        cert_mode == :destroy &&
         to[:to] == ["host","unsigned-node"]
       }
 
       @cert_app.main
     end
+
+    it "should refuse to destroy all certificates" do
+      @cert_app.subcommand = :destroy
+      @cert_app.all = true
+
+      Puppet::SSL::CertificateAuthority::Interface.unstub(:new)
+      Puppet::SSL::CertificateAuthority::Interface.expects(:new).never
+
+      Puppet.expects(:log_exception).with {|e| e.message == "Refusing to destroy all certs, provide an explicit list of certs to destroy"}
+
+      expect { @cert_app.main }.to exit_with(24)
+    end
   end
 
   describe "when identifying subcommands" do

data/spec/unit/application/device_spec.rb

@@ -5,6 +5,7 @@ require 'puppet/application/device'
 require 'puppet/util/network_device/config'
 require 'ostruct'
 require 'puppet/configurer'
+require 'puppet/application/apply'
 
 describe Puppet::Application::Device do
   include PuppetSpec::Files
@@ -127,6 +128,18 @@ describe Puppet::Application::Device do
       expect(@device.args[:Port]).to eq("42")
     end
 
+    it "should store the target options with --target" do
+      @device.options.expects(:[]=).with(:target,'test123')
+
+      @device.handle_target('test123')
+    end
+
+    it "should store the resource options with --resource" do
+      @device.options.expects(:[]=).with(:resource,true)
+
+      @device.handle_resource(true)
+    end
+
   end
 
   describe "during setup" do
@@ -277,7 +290,11 @@ describe Puppet::Application::Device do
       Puppet.stubs(:notice)
       @device.options.stubs(:[]).with(:detailed_exitcodes).returns(false)
       @device.options.stubs(:[]).with(:target).returns(nil)
+      @device.options.stubs(:[]).with(:apply).returns(nil)
+      @device.options.stubs(:[]).with(:resource).returns(false)
+      @device.options.stubs(:[]).with(:to_yaml).returns(false)
       @device.options.stubs(:[]).with(:client)
+      @device.command_line.stubs(:args).returns([])
       Puppet::Util::NetworkDevice::Config.stubs(:devices).returns({})
     end
 
@@ -286,6 +303,12 @@ describe Puppet::Application::Device do
       @device.run_command
     end
 
+    it "should exit if resource is requested without target" do
+      @device.options.stubs(:[]).with(:resource).returns(true)
+      Puppet.expects(:err).with "resource command requires target"
+      expect { @device.main }.to exit_with 1
+    end
+
     it "should get the device list" do
       device_hash = stub_everything 'device hash'
       Puppet::Util::NetworkDevice::Config.expects(:devices).returns(device_hash)
@@ -301,8 +324,8 @@ describe Puppet::Application::Device do
       }
 
       Puppet::Util::NetworkDevice::Config.expects(:devices).returns(device_hash)
-      Puppet.expects(:info).with("starting applying configuration to device1 at ssh://testhost")
-      Puppet.expects(:info).with("starting applying configuration to device2 at https://testhost:443/some/path").never
+      URI.expects(:parse).with("ssh://user:pass@testhost")
+      URI.expects(:parse).with("https://user:pass@testhost/some/path").never
       expect { @device.main }.to exit_with 1
     end
 
@@ -318,6 +341,32 @@ describe Puppet::Application::Device do
       expect { @device.main }.to exit_with 1
     end
 
+    it "should error if target is passed and the apply path is incorrect" do
+      @device.options.stubs(:[]).with(:apply).returns('file.pp')
+      @device.options.stubs(:[]).with(:target).returns('device1')
+
+      File.expects(:file?).returns(false)
+      Puppet.expects(:err).with(regexp_matches(/does not exist, cannot apply/))
+      expect { @device.main }.to exit_with 1
+    end
+
+    it "should run an apply" do
+      @device.options.stubs(:[]).with(:apply).returns('file.pp')
+      @device.options.stubs(:[]).with(:target).returns('device1')
+      device_hash = {
+        "device1" => OpenStruct.new(:name => "device1", :url => "ssh://user:pass@testhost", :provider => "cisco"),
+      }
+      Puppet::Util::NetworkDevice::Config.expects(:devices).returns(device_hash)
+      Puppet::Util::NetworkDevice.stubs(:init)
+      File.expects(:file?).returns(true)
+
+      Puppet::Util::CommandLine.expects(:new).once
+      Puppet::Application::Apply.expects(:new).once
+
+      Puppet::Configurer.expects(:new).never
+      expect { @device.main }.to exit_with 1
+    end
+
     it "should exit if the device list is empty" do
       expect { @device.main }.to exit_with 1
     end
@@ -356,6 +405,51 @@ describe Puppet::Application::Device do
         expect { @device.main }.to exit_with 1
       end
 
+      it "should raise an error if no type is given" do
+        @device.options.stubs(:[]).with(:resource).returns(true)
+        @device.options.stubs(:[]).with(:target).returns('device1')
+        @device.command_line.stubs(:args).returns([])
+        Puppet.expects(:log_exception).with {|e| e.message == "You must specify the type to display"}
+        expect { @device.main }.to exit_with 1
+      end
+
+      it "should raise an error if the type is not found" do
+        @device.options.stubs(:[]).with(:resource).returns(true)
+        @device.options.stubs(:[]).with(:target).returns('device1')
+        @device.command_line.stubs(:args).returns(['nope'])
+        Puppet.expects(:log_exception).with {|e| e.message == "Could not find type nope"}
+        expect { @device.main }.to exit_with 1
+      end
+
+      it "should retrieve all resources of a type" do
+        @device.options.stubs(:[]).with(:resource).returns(true)
+        @device.options.stubs(:[]).with(:target).returns('device1')
+        @device.command_line.stubs(:args).returns(['user'])
+        Puppet::Resource.indirection.expects(:search).with('user/', {}).returns([])
+        expect { @device.main }.to exit_with 1
+      end
+
+      it "should retrieve named resources of a type" do
+        @device.options.stubs(:[]).with(:resource).returns(true)
+        @device.options.stubs(:[]).with(:target).returns('device1')
+        @device.command_line.stubs(:args).returns(['user', 'title'])
+        Puppet::Resource.indirection.expects(:find).with('user/title')
+        expect { @device.main }.to exit_with 1
+      end
+
+      it "should output resources as YAML" do
+        resources = [
+          Puppet::Type.type(:user).new(:name => "title").to_resource,
+        ]
+        @device.options.stubs(:[]).with(:resource).returns(true)
+        @device.options.stubs(:[]).with(:target).returns('device1')
+        @device.options.stubs(:[]).with(:to_yaml).returns(true)
+        @device.command_line.stubs(:args).returns(['user'])
+        Puppet::Resource.indirection.expects(:search).with('user/', {}).returns(resources)
+        @device.expects(:puts).with("user:\n  title:\n")
+        expect { @device.main }.to exit_with 1
+      end
+
       it "should make sure all the required folders and files are created" do
         Puppet.settings.expects(:use).with(:main, :agent, :ssl).twice
         expect { @device.main }.to exit_with 1

data/spec/unit/indirector/rest_spec.rb

@@ -723,6 +723,49 @@ describe Puppet::Indirector::REST do
     end
   end
 
+  describe '#handle_response' do
+    # There are multiple request types to choose from, this may not be the one I want for this situation
+    let(:response) { mock_response(200, 'body') }
+    let(:connection) { stub('mock http connection', :put => response, :verify_callback= => nil) }
+    let(:instance) { model.new('the thing', 'some contents') }
+    let(:request) { save_request(instance.name, instance) }
+
+    before :each do
+      terminus.stubs(:network).returns(connection)
+    end
+
+    it 'adds server_agent_version to the context if not already set' do
+      Puppet.expects(:push_context).with(:server_agent_version => Puppet.version)
+      terminus.handle_response(request, response)
+    end
+
+    it 'does not add server_agent_version to the context if it is already set' do
+      Puppet.override(:server_agent_version => "5.3.4") do
+        Puppet.expects(:push_context).never
+        terminus.handle_response(request, response)
+      end
+    end
+
+    it 'downgrades to pson and emits a warning' do
+      response.stubs(:[]).with(Puppet::Network::HTTP::HEADER_PUPPET_VERSION).returns('4.2.8')
+      Puppet[:preferred_serialization_format] = 'other'
+
+      Puppet.expects(:warning).with('Downgrading to PSON for future requests')
+
+      terminus.handle_response(request, response)
+
+      expect(Puppet[:preferred_serialization_format]).to eq('pson')
+    end
+
+    it 'preserves the set serialization format' do
+      Puppet[:preferred_serialization_format] = 'other'
+
+      expect(Puppet[:preferred_serialization_format]).to eq('other')
+
+      terminus.handle_response(request, response)
+    end
+  end
+
   context 'dealing with SRV settings' do
     [
       :destroy,