puppet 5.5.16 → 5.5.21

data/spec/unit/network/http/factory_spec.rb

@@ -42,10 +42,11 @@ describe Puppet::Network::HTTP::Factory do
   context "proxy settings" do
     let(:proxy_host) { 'myhost' }
     let(:proxy_port) { 432 }
+    let(:proxy_user) { 'mo' }
+    let(:proxy_pass) { 'password' }
 
-    it "should not set a proxy if the value is 'none'" do
+    it "should not set a proxy if the http_proxy_host setting is 'none'" do
       Puppet[:http_proxy_host] = 'none'
-      expect(Puppet::Util::HttpProxy).to receive(:no_proxy?).and_return(false)
       conn = create_connection(site)
 
       expect(conn.proxy_address).to be_nil
@@ -54,7 +55,18 @@ describe Puppet::Network::HTTP::Factory do
     it 'should not set a proxy if a no_proxy env var matches the destination' do
       Puppet[:http_proxy_host] = proxy_host
       Puppet[:http_proxy_port] = proxy_port
-      expect(Puppet::Util::HttpProxy).to receive(:no_proxy?).and_return(true)
+      Puppet::Util.withenv('NO_PROXY' => site.host) do
+        conn = create_connection(site)
+
+        expect(conn.proxy_address).to be_nil
+        expect(conn.proxy_port).to be_nil
+      end
+    end
+
+    it 'should not set a proxy if the no_proxy setting matches the destination' do
+      Puppet[:http_proxy_host] = proxy_host
+      Puppet[:http_proxy_port] = proxy_port
+      Puppet[:no_proxy] = site.host
       conn = create_connection(site)
 
       expect(conn.proxy_address).to be_nil
@@ -63,7 +75,6 @@ describe Puppet::Network::HTTP::Factory do
 
     it 'sets proxy_address' do
       Puppet[:http_proxy_host] = proxy_host
-      expect(Puppet::Util::HttpProxy).to receive(:no_proxy?).and_return(false)
       conn = create_connection(site)
 
       expect(conn.proxy_address).to eq(proxy_host)
@@ -72,11 +83,22 @@ describe Puppet::Network::HTTP::Factory do
     it 'sets proxy address and port' do
       Puppet[:http_proxy_host] = proxy_host
       Puppet[:http_proxy_port] = proxy_port
-      expect(Puppet::Util::HttpProxy).to receive(:no_proxy?).and_return(false)
       conn = create_connection(site)
 
       expect(conn.proxy_port).to eq(proxy_port)
     end
+
+    it 'sets proxy user and password' do
+      Puppet[:http_proxy_host] = proxy_host
+      Puppet[:http_proxy_port] = proxy_port
+      Puppet[:http_proxy_user] = proxy_user
+      Puppet[:http_proxy_password] = proxy_pass
+
+      conn = create_connection(site)
+
+      expect(conn.proxy_user).to eq(proxy_user)
+      expect(conn.proxy_pass).to eq(proxy_pass)
+    end
   end
 
   context 'socket timeouts' do

data/spec/unit/network/http/pool_spec.rb

@@ -60,6 +60,8 @@ describe Puppet::Network::HTTP::Pool do
 
     it 'returns the connection to the pool' do
       conn = create_connection(site)
+      expect(conn).to receive(:started?).and_return(true)
+
       pool = create_pool
       pool.release(site, conn)
 
@@ -137,6 +139,7 @@ describe Puppet::Network::HTTP::Pool do
       it 'releases HTTP connections' do
         conn = create_connection(site)
         expect(conn).to receive(:use_ssl?).and_return(false)
+        expect(conn).to receive(:started?).and_return(true)
 
         pool = create_pool_with_connections(site, conn)
         expect(pool).to receive(:release).with(site, conn)
@@ -148,6 +151,7 @@ describe Puppet::Network::HTTP::Pool do
         conn = create_connection(site)
         expect(conn).to receive(:use_ssl?).and_return(true)
         expect(conn).to receive(:verify_mode).and_return(OpenSSL::SSL::VERIFY_PEER)
+        expect(conn).to receive(:started?).and_return(true)
 
         pool = create_pool_with_connections(site, conn)
         expect(pool).to receive(:release).with(site, conn)
@@ -166,6 +170,19 @@ describe Puppet::Network::HTTP::Pool do
 
         pool.with_connection(site, verify) {|c| }
       end
+
+      it "doesn't add a closed  connection back to the pool" do
+        http = Net::HTTP.new(site.addr)
+        http.use_ssl = true
+        http.verify_mode = OpenSSL::SSL::VERIFY_PEER
+        http.start
+
+        pool = create_pool_with_connections(site, http)
+
+        pool.with_connection(site, verify) {|c| c.finish}
+
+        expect(pool.pool[site]).to be_empty
+      end
     end
   end
 
@@ -228,6 +245,7 @@ describe Puppet::Network::HTTP::Pool do
 
     it 'finishes expired connections' do
       conn = create_connection(site)
+      allow(conn).to receive(:started?).and_return(true)
       expect(conn).to receive(:finish)
 
       pool = create_pool_with_expired_connections(site, conn)
@@ -241,6 +259,7 @@ describe Puppet::Network::HTTP::Pool do
       expect(Puppet).to receive(:log_exception).with(be_a(IOError), "Failed to close connection for #{site}: read timeout")
 
       conn = create_connection(site)
+      expect(conn).to receive(:started?).and_return(true)
       expect(conn).to receive(:finish).and_raise(IOError, 'read timeout')
 
       pool = create_pool_with_expired_connections(site, conn)
@@ -289,10 +308,23 @@ describe Puppet::Network::HTTP::Pool do
 
     it 'closes all cached connections' do
       conn = create_connection(site)
+      allow(conn).to receive(:started?).and_return(true)
       expect(conn).to receive(:finish)
 
       pool = create_pool_with_connections(site, conn)
       pool.close
     end
+
+    it 'allows a connection to be closed multiple times safely' do
+      http = Net::HTTP.new(site.addr)
+      http.use_ssl = true
+      http.verify_mode = OpenSSL::SSL::VERIFY_PEER
+      http.start
+
+      pool = create_pool
+
+      expect(pool.close_connection(site, http)).to eq(true)
+      expect(pool.close_connection(site, http)).to eq(false)
+    end
   end
 end

data/spec/unit/node_spec.rb

@@ -414,7 +414,9 @@ end
 
 describe Puppet::Node, "when generating the list of names to search through" do
   before do
-    @node = Puppet::Node.new("foo.domain.com", :parameters => {"hostname" => "yay", "domain" => "domain.com"})
+    Puppet[:strict_hostname_checking] = false
+    @node = Puppet::Node.new("foo.domain.com",
+                             :parameters => {"hostname" => "yay", "domain" => "domain.com"})
   end
 
   it "returns an array of names" do
@@ -445,7 +447,6 @@ describe Puppet::Node, "when generating the list of names to search through" do
 
   describe "and :node_name is set to 'cert'" do
     before do
-      Puppet[:strict_hostname_checking] = false
       Puppet[:node_name] = "cert"
     end
 
@@ -454,8 +455,11 @@ describe Puppet::Node, "when generating the list of names to search through" do
     end
 
     describe "and strict hostname checking is enabled" do
-      it "only uses the passed-in key" do
+      before do
         Puppet[:strict_hostname_checking] = true
+      end
+
+      it "only uses the passed-in key" do
         expect(@node.names).to eq(["foo.domain.com"])
       end
     end
@@ -463,7 +467,6 @@ describe Puppet::Node, "when generating the list of names to search through" do
 
   describe "and :node_name is set to 'facter'" do
     before do
-      Puppet[:strict_hostname_checking] = false
       Puppet[:node_name] = "facter"
     end
 

data/spec/unit/parser/environment_compiler_spec.rb

@@ -367,6 +367,13 @@ EOS
       }.to raise_error(/'Cap\[cap\]' is exported by both 'Prod\[one\]' and 'Prod\[two\]'/)
     end
 
+    it "issues deprecation warnings" do
+      expect {compile_collect_log(MANIFEST_WO_NODE)}.not_to raise_error
+      expect(warnings).to include(/Capability Mapping is deprecated/) # there are two of these
+      expect(warnings).to include(/Application is deprecated/)
+      expect(warnings).to include(/Site Definition is deprecated/)
+    end
+
     context "for producing node" do
       let(:compiled_node) { Puppet::Node.new('first', :environment => env) }
       let(:compiled_catalog) { compile_to_catalog(MANIFEST, compiled_node)}

data/spec/unit/pops/evaluator/evaluating_parser_spec.rb

@@ -442,21 +442,26 @@ describe 'Puppet::Pops::Evaluator::EvaluatorImpl' do
       }.each do |source, coerced_val|
           it "should warn about numeric coercion in '#{source}' when strict = warning" do
             Puppet[:strict] = :warning
+            expect(Puppet::Pops::Evaluator::Runtime3Support::EvaluationError).not_to receive(:new)
             collect_notices(source)
             expect(warnings).to include(/The string '#{coerced_val}' was automatically coerced to the numerical value #{coerced_val}/)
           end
 
           it "should not warn about numeric coercion in '#{source}' if strict = off" do
             Puppet[:strict] = :off
+            expect(Puppet::Pops::Evaluator::Runtime3Support::EvaluationError).not_to receive(:new)
             collect_notices(source)
             expect(warnings).to_not include(/The string '#{coerced_val}' was automatically coerced to the numerical value #{coerced_val}/)
           end
 
         it "should error when finding numeric coercion in '#{source}' if strict = error" do
           Puppet[:strict] = :error
-          expect { parser.evaluate_string(scope, source, __FILE__) }.to raise_error(
-            /The string '#{coerced_val}' was automatically coerced to the numerical value #{coerced_val}/
-            )
+          expect {
+            parser.evaluate_string(scope, source, __FILE__)
+          }.to raise_error {|error|
+            expect(error.message).to match(/The string '#{coerced_val}' was automatically coerced to the numerical value #{coerced_val}/)
+            expect(error.backtrace.first).to match(/runtime3_support\.rb.+optionally_fail/)
+          }
         end
       end
 

data/spec/unit/pops/validator/validator_spec.rb

@@ -599,6 +599,13 @@ describe "validating 4x" do
     end
   end
 
+  context 'for hash keys' do
+    it "should not allow reassignment of hash keys" do
+      source = "$my_hash = {'one' => '1', 'two' => '2' }; $my_hash['one']='1.5'"
+      expect(validate(parse(source))).to have_issue(Puppet::Pops::Issues::ILLEGAL_INDEXED_ASSIGNMENT)
+    end
+  end
+
   context 'for parameter names' do
     ['class', 'define'].each do |word|
       it "should require that #{word} parameter names are unique" do

data/spec/unit/provider/exec_spec.rb

@@ -1,7 +1,12 @@
 require 'spec_helper'
 require 'puppet/provider/exec'
+require 'puppet_spec/compiler'
+require 'puppet_spec/files'
 
 describe Puppet::Provider::Exec do
+  include PuppetSpec::Compiler
+  include PuppetSpec::Files
+
   describe "#extractexe" do
     it "should return the first element of an array" do
       expect(subject.extractexe(['one', 'two'])).to eq('one')
@@ -31,4 +36,208 @@ describe Puppet::Provider::Exec do
       end
     end
   end
+
+  context "when handling sensitive data" do
+    before :each do
+      Puppet[:log_level] = 'debug'
+    end
+
+    let(:supersecret) { 'supersecret' }
+    let(:path) do
+      if Puppet::Util::Platform.windows?
+        # The `apply_compiled_manifest` helper doesn't add the `path` fact, so
+        # we can't reference that in our manifest. Windows PATHs can contain
+        # double quotes and trailing backslashes, which confuse HEREDOC
+        # interpolation below. So sanitize it:
+        ENV['PATH'].split(File::PATH_SEPARATOR).map do |dir|
+          dir.gsub(/"/, '\"').gsub(/\\$/, '')
+        end.join(File::PATH_SEPARATOR)
+      else
+        ENV['PATH']
+      end
+    end
+
+    def ruby_exit_0
+      "ruby -e 'exit 0'"
+    end
+
+    def echo_from_ruby_exit_0(message)
+      # Escape double quotes due to HEREDOC interpolation below
+      "ruby -e 'puts \"#{message}\"; exit 0'".gsub(/"/, '\"')
+    end
+
+    def echo_from_ruby_exit_1(message)
+      # Escape double quotes due to HEREDOC interpolation below
+      "ruby -e 'puts \"#{message}\"; exit 1'".gsub(/"/, '\"')
+    end
+
+    context "when validating the command" do
+      it "redacts the arguments if the command is relative" do
+        expect {
+          apply_compiled_manifest(<<-MANIFEST)
+            exec { 'echo':
+              command => Sensitive.new('echo #{supersecret}')
+            }
+          MANIFEST
+        }.to raise_error do |err|
+          expect(err).to be_a(Puppet::Error)
+          expect(err.message).to match(/'echo' is not qualified and no path was specified. Please qualify the command or specify a path./)
+          expect(err.message).to_not match(/#{supersecret}/)
+        end
+      end
+
+      it "redacts the arguments if the command is a directory" do
+        dir = tmpdir('exec')
+        apply_compiled_manifest(<<-MANIFEST)
+          exec { 'echo':
+            command => Sensitive.new('#{dir} #{supersecret}'),
+          }
+        MANIFEST
+        expect(@logs).to include(an_object_having_attributes(level: :err, message: /'#{dir}' is a directory, not a file/))
+        expect(@logs).to_not include(an_object_having_attributes(message: /#{supersecret}/))
+      end
+
+      it "redacts the arguments if the command isn't executable" do
+        file = tmpfile('exec')
+        Puppet::FileSystem.touch(file)
+        Puppet::FileSystem.chmod(0644, file)
+
+        apply_compiled_manifest(<<-MANIFEST)
+          exec { 'echo':
+            command => Sensitive.new('#{file} #{supersecret}'),
+          }
+        MANIFEST
+        # Execute permission works differently on Windows, but execute will fail since the
+        # file doesn't have a valid extension and isn't a valid executable. The raised error
+        # will be Errno::EIO, which is not useful. The Windows execute code needs to raise
+        # Puppet::Util::Windows::Error so the Win32 error message is preserved.
+        pending("PUP-3561 Needs to raise a meaningful Puppet::Error") if Puppet::Util::Platform.windows?
+        expect(@logs).to include(an_object_having_attributes(level: :err, message: /'#{file}' is not executable/))
+        expect(@logs).to_not include(an_object_having_attributes(message: /#{supersecret}/))
+      end
+
+      it "redacts the arguments if the relative command cannot be resolved using the path parameter" do
+        file = File.basename(tmpfile('exec'))
+        dir = tmpdir('exec')
+
+        apply_compiled_manifest(<<-MANIFEST)
+          exec { 'echo':
+            command => Sensitive.new('#{file} #{supersecret}'),
+            path    => "#{dir}",
+          }
+        MANIFEST
+        expect(@logs).to include(an_object_having_attributes(level: :err, message: /Could not find command '#{file}'/))
+        expect(@logs).to_not include(an_object_having_attributes(message: /#{supersecret}/))
+      end
+    end
+
+    it "redacts the command on success" do
+      command = echo_from_ruby_exit_0(supersecret)
+
+      apply_compiled_manifest(<<-MANIFEST)
+        exec { 'true':
+          command => Sensitive.new("#{command}"),
+          path    => "#{path}",
+        }
+      MANIFEST
+      expect(@logs).to include(an_object_having_attributes(level: :debug, message: "Executing '[redacted]'", source: /Exec\[true\]/))
+      expect(@logs).to include(an_object_having_attributes(level: :debug, message: "Executing: '[redacted]'", source: "Puppet"))
+      expect(@logs).to include(an_object_having_attributes(level: :notice, message: "executed successfully"))
+      expect(@logs).to_not include(an_object_having_attributes(message: /#{supersecret}/))
+    end
+
+    it "redacts the command on failure" do
+      command = echo_from_ruby_exit_1(supersecret)
+
+      apply_compiled_manifest(<<-MANIFEST)
+        exec { 'false':
+          command => Sensitive.new("#{command}"),
+          path    => "#{path}",
+        }
+      MANIFEST
+      expect(@logs).to include(an_object_having_attributes(level: :debug, message: "Executing '[redacted]'", source: /Exec\[false\]/))
+      expect(@logs).to include(an_object_having_attributes(level: :debug, message: "Executing: '[redacted]'", source: "Puppet"))
+      expect(@logs).to include(an_object_having_attributes(level: :err, message: "[command redacted] returned 1 instead of one of [0]"))
+      expect(@logs).to_not include(an_object_having_attributes(message: /#{supersecret}/))
+    end
+
+    context "when handling checks" do
+      let(:onlyifsecret) { "onlyifsecret" }
+      let(:unlesssecret) { "unlesssecret" }
+
+      it "redacts command and onlyif outputs" do
+        onlyif = echo_from_ruby_exit_0(onlyifsecret)
+
+        apply_compiled_manifest(<<-MANIFEST)
+          exec { 'true':
+            command => Sensitive.new("#{ruby_exit_0}"),
+            onlyif  => Sensitive.new("#{onlyif}"),
+            path    => "#{path}",
+          }
+        MANIFEST
+        expect(@logs).to include(an_object_having_attributes(level: :debug, message: "Executing check '[redacted]'"))
+        expect(@logs).to include(an_object_having_attributes(level: :debug, message: "Executing '[redacted]'", source: /Exec\[true\]/))
+        expect(@logs).to include(an_object_having_attributes(level: :debug, message: "Executing: '[redacted]'", source: "Puppet"))
+        expect(@logs).to include(an_object_having_attributes(level: :debug, message: "[output redacted]"))
+        expect(@logs).to include(an_object_having_attributes(level: :notice, message: "executed successfully"))
+        expect(@logs).to_not include(an_object_having_attributes(message: /#{onlyifsecret}/))
+      end
+
+      it "redacts the command that would have been executed but didn't due to onlyif" do
+        command = echo_from_ruby_exit_0(supersecret)
+        onlyif = echo_from_ruby_exit_1(onlyifsecret)
+
+        apply_compiled_manifest(<<-MANIFEST)
+          exec { 'true':
+            command => Sensitive.new("#{command}"),
+            onlyif  => Sensitive.new("#{onlyif}"),
+            path    => "#{path}",
+          }
+        MANIFEST
+        expect(@logs).to include(an_object_having_attributes(level: :debug, message: "Executing check '[redacted]'"))
+        expect(@logs).to include(an_object_having_attributes(level: :debug, message: "Executing: '[redacted]'", source: "Puppet"))
+        expect(@logs).to include(an_object_having_attributes(level: :debug, message: "[output redacted]"))
+        expect(@logs).to include(an_object_having_attributes(level: :debug, message: "'[command redacted]' won't be executed because of failed check 'onlyif'"))
+        expect(@logs).to_not include(an_object_having_attributes(message: /#{supersecret}/))
+        expect(@logs).to_not include(an_object_having_attributes(message: /#{onlyifsecret}/))
+      end
+
+      it "redacts command and unless outputs" do
+        unlesscmd = echo_from_ruby_exit_1(unlesssecret)
+
+        apply_compiled_manifest(<<-MANIFEST)
+          exec { 'true':
+            command => Sensitive.new("#{ruby_exit_0}"),
+            unless  => Sensitive.new("#{unlesscmd}"),
+            path    => "#{path}",
+          }
+        MANIFEST
+        expect(@logs).to include(an_object_having_attributes(level: :debug, message: "Executing check '[redacted]'"))
+        expect(@logs).to include(an_object_having_attributes(level: :debug, message: "Executing '[redacted]'", source: /Exec\[true\]/))
+        expect(@logs).to include(an_object_having_attributes(level: :debug, message: "Executing: '[redacted]'", source: "Puppet"))
+        expect(@logs).to include(an_object_having_attributes(level: :debug, message: "[output redacted]"))
+        expect(@logs).to include(an_object_having_attributes(level: :notice, message: "executed successfully"))
+        expect(@logs).to_not include(an_object_having_attributes(message: /#{unlesssecret}/))
+      end
+
+      it "redacts the command that would have been executed but didn't due to unless" do
+        command = echo_from_ruby_exit_0(supersecret)
+        unlesscmd = echo_from_ruby_exit_0(unlesssecret)
+
+        apply_compiled_manifest(<<-MANIFEST)
+          exec { 'true':
+            command => Sensitive.new("#{command}"),
+            unless  => Sensitive.new("#{unlesscmd}"),
+            path    => "#{path}",
+          }
+        MANIFEST
+        expect(@logs).to include(an_object_having_attributes(level: :debug, message: "Executing check '[redacted]'"))
+        expect(@logs).to include(an_object_having_attributes(level: :debug, message: "Executing: '[redacted]'", source: "Puppet"))
+        expect(@logs).to include(an_object_having_attributes(level: :debug, message: "[output redacted]"))
+        expect(@logs).to include(an_object_having_attributes(level: :debug, message: "'[command redacted]' won't be executed because of failed check 'unless'"))
+        expect(@logs).to_not include(an_object_having_attributes(message: /#{supersecret}/))
+        expect(@logs).to_not include(an_object_having_attributes(message: /#{unlesssecret}/))
+      end
+    end
+  end
 end