puppet 5.5.22-x64-mingw32 → 6.0.0-x64-mingw32

data/spec/unit/application/resource_spec.rb

@@ -1,3 +1,4 @@
+#! /usr/bin/env ruby
 require 'spec_helper'
 
 require 'puppet/application/resource'
@@ -5,10 +6,9 @@ require 'puppet_spec/character_encoding'
 
 describe Puppet::Application::Resource do
   include PuppetSpec::Files
-
   before :each do
     @resource_app = Puppet::Application[:resource]
-    allow(Puppet::Util::Log).to receive(:newdestination)
+    Puppet::Util::Log.stubs(:newdestination)
   end
 
   describe "in preinit" do
@@ -21,17 +21,17 @@ describe Puppet::Application::Resource do
   describe "when handling options" do
     [:debug, :verbose, :edit].each do |option|
       it "should store argument value when calling handle_#{option}" do
-        expect(@resource_app.options).to receive(:[]=).with(option, 'arg')
+        @resource_app.options.expects(:[]=).with(option, 'arg')
         @resource_app.send("handle_#{option}".to_sym, 'arg')
       end
     end
 
     it "should load a display all types with types option" do
-      type1 = double('type1', :name => :type1)
-      type2 = double('type2', :name => :type2)
-      allow(Puppet::Type).to receive(:loadall)
-      allow(Puppet::Type).to receive(:eachtype).and_yield(type1).and_yield(type2)
-      expect(@resource_app).to receive(:puts).with(['type1','type2'])
+      type1 = stub_everything 'type1', :name => :type1
+      type2 = stub_everything 'type2', :name => :type2
+      Puppet::Type.stubs(:loadall)
+      Puppet::Type.stubs(:eachtype).multiple_yields(type1,type2)
+      @resource_app.expects(:puts).with(['type1','type2'])
       expect { @resource_app.handle_types(nil) }.to exit_with 0
     end
 
@@ -43,10 +43,10 @@ describe Puppet::Application::Resource do
     end
 
     it "should get a parameter in the printed data if extra_params are passed" do
-      tty  = double("tty",  :tty? => true )
+      tty  = stub("tty",  :tty? => true )
       path = tmpfile('testfile')
       command_line = Puppet::Util::CommandLine.new("puppet", [ 'resource', 'file', path ], tty )
-      allow(@resource_app).to receive(:command_line).and_return(command_line)
+      @resource_app.stubs(:command_line).returns command_line
 
       # provider is a parameter that should always be available
       @resource_app.extra_params = [ :provider ]
@@ -57,70 +57,75 @@ describe Puppet::Application::Resource do
 
   describe "during setup" do
     before :each do
-      allow(Puppet::Log).to receive(:newdestination)
+      Puppet::Log.stubs(:newdestination)
     end
 
     it "should set console as the log destination" do
-      expect(Puppet::Log).to receive(:newdestination).with(:console)
+      Puppet::Log.expects(:newdestination).with(:console)
 
       @resource_app.setup
     end
 
     it "should set log level to debug if --debug was passed" do
-      allow(@resource_app.options).to receive(:[]).with(:debug).and_return(true)
+      @resource_app.options.stubs(:[]).with(:debug).returns(true)
       @resource_app.setup
       expect(Puppet::Log.level).to eq(:debug)
     end
 
     it "should set log level to info if --verbose was passed" do
-      allow(@resource_app.options).to receive(:[]).with(:debug).and_return(false)
-      allow(@resource_app.options).to receive(:[]).with(:verbose).and_return(true)
+      @resource_app.options.stubs(:[]).with(:debug).returns(false)
+      @resource_app.options.stubs(:[]).with(:verbose).returns(true)
       @resource_app.setup
       expect(Puppet::Log.level).to eq(:info)
     end
+
   end
 
   describe "when running" do
     before :each do
-      @type = double('type', :properties => [])
-      allow(@resource_app.command_line).to receive(:args).and_return(['mytype'])
-      allow(Puppet::Type).to receive(:type).and_return(@type)
+      @type = stub_everything 'type', :properties => []
+      @resource_app.command_line.stubs(:args).returns(['mytype'])
+      Puppet::Type.stubs(:type).returns(@type)
+
+      @res = stub_everything "resource"
+      @res.stubs(:prune_parameters).returns(@res)
+      @res.stubs(:to_manifest).returns("resource")
+      @report = stub_everything "report"
 
-      @res = double("resource")
-      allow(@res).to receive(:prune_parameters).and_return(@res)
-      allow(@res).to receive(:to_manifest).and_return("resource")
-      @report = double("report")
+      @resource_app.stubs(:puts)
 
-      allow(@resource_app).to receive(:puts)
+      Puppet::Resource.indirection.stubs(:find  ).never
+      Puppet::Resource.indirection.stubs(:search).never
+      Puppet::Resource.indirection.stubs(:save  ).never
     end
 
     it "should raise an error if no type is given" do
-      allow(@resource_app.command_line).to receive(:args).and_return([])
+      @resource_app.command_line.stubs(:args).returns([])
       expect { @resource_app.main }.to raise_error(RuntimeError, "You must specify the type to display")
     end
 
     it "should raise an error if the type is not found" do
-      allow(Puppet::Type).to receive(:type).and_return(nil)
+      Puppet::Type.stubs(:type).returns(nil)
 
       expect { @resource_app.main }.to raise_error(RuntimeError, 'Could not find type mytype')
     end
 
     it "should search for resources" do
-      expect(Puppet::Resource.indirection).to receive(:search).with('mytype/', {}).and_return([])
+      Puppet::Resource.indirection.expects(:search).with('mytype/', {}).returns([])
       @resource_app.main
     end
 
     it "should describe the given resource" do
-      allow(@resource_app.command_line).to receive(:args).and_return(['type','name'])
-      expect(Puppet::Resource.indirection).to receive(:find).with('type/name').and_return(@res)
+      @resource_app.command_line.stubs(:args).returns(['type','name'])
+      Puppet::Resource.indirection.expects(:find).with('type/name').returns(@res)
       @resource_app.main
     end
 
     it "should add given parameters to the object" do
-      allow(@resource_app.command_line).to receive(:args).and_return(['type','name','param=temp'])
+      @resource_app.command_line.stubs(:args).returns(['type','name','param=temp'])
 
-      expect(Puppet::Resource.indirection).to receive(:save).with(@res, 'type/name').and_return([@res, @report])
-      expect(Puppet::Resource).to receive(:new).with('type', 'name', :parameters => {'param' => 'temp'}).and_return(@res)
+      Puppet::Resource.indirection.expects(:save).with(@res, 'type/name').returns([@res, @report])
+      Puppet::Resource.expects(:new).with('type', 'name', :parameters => {'param' => 'temp'}).returns(@res)
 
       @resource_app.main
     end
@@ -132,11 +137,11 @@ describe Puppet::Application::Resource do
         Puppet::Type.type(:user).new(:name => "\u2603".force_encoding(Encoding::UTF_8)).to_resource,
         Puppet::Type.type(:user).new(:name => "Jos\xE9".force_encoding(Encoding::ISO_8859_1)).to_resource
       ]
-      expect(Puppet::Resource.indirection).to receive(:search).with('user/', {}).and_return(resources)
-      allow(@resource_app.command_line).to receive(:args).and_return(['user'])
+      Puppet::Resource.indirection.expects(:search).with('user/', {}).returns(resources)
+      @resource_app.command_line.stubs(:args).returns(['user'])
 
       # All of our output should be in external encoding
-      expect(@resource_app).to receive(:puts) { |args| expect(args.encoding).to eq(Encoding::ISO_8859_1) }
+      @resource_app.expects(:puts).with { |args| expect(args.encoding).to eq(Encoding::ISO_8859_1) }
 
       # This would raise an error if we weren't handling it
       PuppetSpec::CharacterEncoding.with_external_encoding(Encoding::ISO_8859_1) do
@@ -147,12 +152,12 @@ describe Puppet::Application::Resource do
 
   describe "when handling file type" do
     before :each do
-      allow(Facter).to receive(:loadfacts)
+      Facter.stubs(:loadfacts)
       @resource_app.preinit
     end
 
     it "should raise an exception if no file specified" do
-      allow(@resource_app.command_line).to receive(:args).and_return(['file'])
+      @resource_app.command_line.stubs(:args).returns(['file'])
 
       expect { @resource_app.main }.to raise_error(RuntimeError, /Listing all file instances is not supported/)
     end
@@ -160,10 +165,12 @@ describe Puppet::Application::Resource do
     it "should output a file resource when given a file path" do
       path = File.expand_path('/etc')
       res = Puppet::Type.type(:file).new(:path => path).to_resource
-      expect(Puppet::Resource.indirection).to receive(:find).and_return(res)
+      Puppet::Resource.indirection.expects(:find).returns(res)
 
-      allow(@resource_app.command_line).to receive(:args).and_return(['file', path])
-      expect(@resource_app).to receive(:puts).with(/file \{ '#{Regexp.escape(path)}'/m)
+      @resource_app.command_line.stubs(:args).returns(['file', path])
+      @resource_app.expects(:puts).with do |args|
+        expect(args).to match(/file \{ '#{Regexp.escape(path)}'/m)
+      end
 
       @resource_app.main
     end
@@ -180,9 +187,8 @@ describe Puppet::Application::Resource do
           @instances ||= [new(:name => name)]
         end
       end
-
-      allow(@resource_app.command_line).to receive(:args).and_return(['testing', 'hello'])
-      expect(@resource_app).to receive(:puts).with("testing { 'hello':\n}")
+      @resource_app.command_line.stubs(:args).returns(['testing', 'hello'])
+      @resource_app.expects(:puts).with { |args| expect(args).to eql("testing { 'hello':\n}") }
       expect { @resource_app.main }.not_to raise_error
     end
   end

data/spec/unit/application/ssl_spec.rb

@@ -0,0 +1,322 @@
+require 'spec_helper'
+require 'puppet/application/ssl'
+require 'webmock/rspec'
+require 'openssl'
+
+describe Puppet::Application::Ssl, unless: Puppet::Util::Platform.jruby? do
+  let(:ssl) { Puppet::Application[:ssl] }
+  let(:name) { 'ssl-client' }
+
+  def generate_cert(name, issuer = nil, issuer_key = nil)
+    # generate CA key pair
+    private_key = OpenSSL::PKey::RSA.new(512)
+    public_key = private_key.public_key
+
+    # generate CSR
+    csr = OpenSSL::X509::Request.new
+    csr.version = 0
+    csr.subject = OpenSSL::X509::Name.new([["CN", name]])
+    csr.public_key = public_key
+    csr.sign(private_key, OpenSSL::Digest::SHA256.new)
+
+    # is it self-signed?
+    issuer ||= csr.subject
+    issuer_key ||= private_key
+
+    # issue cert
+    cert = OpenSSL::X509::Certificate.new
+    cert.version    = 2 # X509v3
+    cert.subject    = csr.subject
+    cert.issuer     = issuer
+    cert.public_key = csr.public_key
+    cert.serial     = 1
+    cert.not_before = Time.now - (60*60*24)
+    cert.not_after  = Time.now + (60*60*24)
+
+    # Ugly hack, but we need to make sure the CA cert has the proper
+    # X509v3 Basic Constraints to be a valid CA certificate.
+    if name == 'ca'
+      extension_factory = OpenSSL::X509::ExtensionFactory.new
+      extension_factory.subject_certificate = cert
+      extension_factory.issuer_certificate = cert
+
+      extensions = {
+        "keyUsage"         => [%w{cRLSign keyCertSign}, true],
+        "basicConstraints" => ["CA:TRUE", true],
+      }
+
+      cert.extensions = extensions.map do |oid, (val, crit)|
+        val = val.join(', ') unless val.is_a? String
+
+        if Puppet::SSL::Oids.subtree_of?('id-ce', oid) or Puppet::SSL::Oids.subtree_of?('id-pkix', oid)
+          # Attempt to create a X509v3 certificate extension. Standard certificate
+          # extensions may need access to the associated subject certificate and
+          # issuing certificate, so must be created by the OpenSSL::X509::ExtensionFactory
+          # which provides that context.
+          extension_factory.create_ext(oid, val, crit)
+        else
+          # This is not an X509v3 extension which means that the extension
+          # factory cannot generate it. We need to generate the extension
+          # manually.
+          OpenSSL::X509::Extension.new(oid, OpenSSL::ASN1::UTF8String.new(val).to_der, crit)
+        end
+      end
+    end
+
+    cert.sign(issuer_key, OpenSSL::Digest::SHA256.new)
+
+    {:private_key => private_key, :csr => csr, :cert => cert}
+  end
+
+  def generate_crl(name, issuer, issuer_key)
+    crl = OpenSSL::X509::CRL.new
+    crl.version = 1
+    crl.issuer = issuer
+    crl.last_update = Time.now - (60*60*24)
+    crl.next_update =  Time.now + (60*60*24)
+    crl.extensions = [OpenSSL::X509::Extension.new('crlNumber', OpenSSL::ASN1::Integer(0))]
+    crl.sign(issuer_key, OpenSSL::Digest::SHA256.new)
+
+    crl
+  end
+
+  before :all do
+    @ca = generate_cert('ca')
+    @crl = generate_crl('ca', @ca[:cert].subject, @ca[:private_key])
+    @host = generate_cert('ssl-client', @ca[:cert].subject, @ca[:private_key])
+  end
+
+  before do
+    WebMock.disable_net_connect!
+
+    Puppet.settings.use(:main)
+    Puppet[:certname] = name
+
+    # Host assumes ca cert and crl are present
+    File.open(Puppet[:localcacert], 'w') { |f| f.write(@ca[:cert].to_pem) }
+    File.open(Puppet[:hostcrl], 'w') { |f| f.write(@crl.to_pem) }
+
+    # Setup our ssl client
+    File.open(Puppet[:hostprivkey], 'w') { |f| f.write(@host[:private_key].to_pem) }
+    File.open(Puppet[:hostpubkey], 'w') { |f| f.write(@host[:private_key].public_key.to_pem) }
+  end
+
+  def expects_command_to_output(expected_message = nil, code = 0)
+    expect {
+      expect {
+        ssl.run_command
+      }.to exit_with(code)
+    }.to output(expected_message).to_stdout
+  end
+
+  shared_examples_for 'an ssl action' do
+    it 'downloads the CA bundle first when missing' do
+      File.delete(Puppet[:localcacert])
+      stub_request(:get, %r{puppet-ca/v1/certificate/ca}).to_return(status: 200, body: @ca[:cert].to_pem)
+      stub_request(:get, %r{puppet-ca/v1/certificate_request/#{name}}).to_return(status: 404)
+      stub_request(:put, %r{puppet-ca/v1/certificate_request/#{name}}).to_return(status: 200)
+      stub_request(:get, %r{puppet-ca/v1/certificate/#{name}}).to_return(status: 404)
+
+      expects_command_to_output
+
+      expect(File.read(Puppet[:localcacert])).to eq(@ca[:cert].to_pem)
+    end
+
+    it 'downloads the CRL bundle first when missing' do
+      File.delete(Puppet[:hostcrl])
+      stub_request(:get, %r{puppet-ca/v1/certificate_revocation_list/ca}).to_return(status: 200, body: @crl.to_pem)
+      stub_request(:get, %r{puppet-ca/v1/certificate_request/#{name}}).to_return(status: 404)
+      stub_request(:put, %r{puppet-ca/v1/certificate_request/#{name}}).to_return(status: 200)
+      stub_request(:get, %r{puppet-ca/v1/certificate/#{name}}).to_return(status: 404)
+
+      expects_command_to_output
+
+      expect(File.read(Puppet[:hostcrl])).to eq(@crl.to_pem)
+    end
+  end
+
+  context 'when generating help' do
+    it 'prints usage when no arguments are specified' do
+      ssl.command_line.args << 'whoops'
+
+      expects_command_to_output(/Unknown action 'whoops'/, 1)
+    end
+
+    it 'rejects unknown actions' do
+      expects_command_to_output(/^puppet-ssl.*SYNOPSIS/m, 1)
+    end
+  end
+
+  context 'when submitting a CSR' do
+    let(:csr_path) { File.join(Puppet[:requestdir], "#{name}.pem") }
+
+    before do
+      ssl.command_line.args << 'submit_request'
+    end
+
+    it_behaves_like 'an ssl action'
+
+    it 'submits the CSR and saves it locally' do
+      stub_request(:get, %r{puppet-ca/v1/certificate_request/#{name}}).to_return(status: 404)
+      stub_request(:put, %r{puppet-ca/v1/certificate_request/#{name}}).to_return(status: 200)
+      stub_request(:get, %r{puppet-ca/v1/certificate/#{name}}).to_return(status: 404)
+
+      expects_command_to_output(%r{Submitted certificate request for '#{name}' to https://.*}, 0)
+
+      expect(Puppet::FileSystem).to be_exist(csr_path)
+    end
+
+    it 'detects when a CSR with the same public key has already been submitted' do
+      stub_request(:get, %r{puppet-ca/v1/certificate_request/#{name}}).to_return(status: 404)
+      stub_request(:put, %r{puppet-ca/v1/certificate_request/#{name}}).to_return(status: 200)
+      stub_request(:get, %r{puppet-ca/v1/certificate/#{name}}).to_return(status: 404)
+
+      expects_command_to_output(%r{Submitted certificate request for '#{name}' to https://.*}, 0)
+
+      stub_request(:get, %r{puppet-ca/v1/certificate_request/#{name}}).to_return(status: 200, body: @host[:csr].to_pem)
+      #  we skip :put
+      stub_request(:get, %r{puppet-ca/v1/certificate/#{name}}).to_return(status: 404)
+
+      expects_command_to_output
+    end
+
+    it "warns if the local CSR doesn't match the local public key, and submits a new CSR" do
+      # write out the local CSR
+      File.open(csr_path, 'w') { |f| f.write(@host[:csr].to_pem) }
+
+      # generate a new host key, whose public key doesn't match
+      private_key = OpenSSL::PKey::RSA.new(512)
+      public_key = private_key.public_key
+      File.open(Puppet[:hostprivkey], 'w') { |f| f.write(private_key.to_pem) }
+      File.open(Puppet[:hostpubkey], 'w') { |f| f.write(public_key.to_pem) }
+
+      # expect CSR to contain the new pub key
+      stub_request(:put, %r{puppet-ca/v1/certificate_request/#{name}}).with do |request|
+        sent_pem = OpenSSL::X509::Request.new(request.body).public_key.to_pem
+        expect(sent_pem).to eq(public_key.to_pem)
+      end.to_return(status: 200)
+      stub_request(:get, %r{puppet-ca/v1/certificate/#{name}}).to_return(status: 404)
+
+      Puppet.stubs(:warning) # ignore unrelated warnings
+      Puppet.expects(:warning).with("The local CSR does not match the agent's public key. Generating a new CSR.")
+      expects_command_to_output(%r{Submitted certificate request for '#{name}' to https://.*}, 0)
+    end
+
+    it 'downloads the certificate when autosigning is enabled' do
+      stub_request(:get, %r{puppet-ca/v1/certificate_request/#{name}}).to_return(status: 404)
+      stub_request(:put, %r{puppet-ca/v1/certificate_request/#{name}}).to_return(status: 200)
+      stub_request(:get, %r{puppet-ca/v1/certificate/#{name}}).to_return(status: 200, body: @host[:cert].to_pem)
+
+      expects_command_to_output(%r{Submitted certificate request for '#{name}' to https://.*}, 0)
+
+      expect(Puppet::FileSystem).to be_exist(Puppet[:hostcert])
+    end
+
+    it 'accepts dns alt names' do
+      Puppet[:dns_alt_names] = 'majortom'
+
+      stub_request(:get, %r{puppet-ca/v1/certificate_request/#{name}}).to_return(status: 404)
+      stub_request(:put, %r{puppet-ca/v1/certificate_request/#{name}}).to_return(status: 200)
+      stub_request(:get, %r{puppet-ca/v1/certificate/#{name}}).to_return(status: 404)
+
+      expects_command_to_output
+
+      csr = Puppet::SSL::CertificateRequest.new(name)
+      csr.read(csr_path)
+      expect(csr.subject_alt_names).to include('DNS:majortom')
+    end
+  end
+
+  context 'when downloading a certificate' do
+    before do
+      ssl.command_line.args << 'download_cert'
+    end
+
+    it_behaves_like 'an ssl action'
+
+    it 'downloads a new cert' do
+      stub_request(:get, %r{puppet-ca/v1/certificate/#{name}}).to_return(status: 200, body: @host[:cert].to_pem)
+
+      expects_command_to_output(%r{Downloaded certificate '#{name}' with fingerprint .*})
+
+      expect(File.read(Puppet[:hostcert])).to eq(@host[:cert].to_pem)
+    end
+
+    it 'overwrites an existing cert' do
+      File.open(Puppet[:hostcert], 'w') { |f| f.write "existing certificate" }
+
+      stub_request(:get, %r{puppet-ca/v1/certificate/#{name}}).to_return(status: 200, body: @host[:cert].to_pem)
+
+      expects_command_to_output(%r{Downloaded certificate '#{name}' with fingerprint .*})
+
+      expect(File.read(Puppet[:hostcert])).to eq(@host[:cert].to_pem)
+    end
+
+    it "reports an error if the downloaded cert's public key doesn't match our private key" do
+      File.open(Puppet[:hostcert], 'w') { |f| f.write "existing cert" }
+
+      # generate a new host key, whose public key doesn't match the cert
+      private_key = OpenSSL::PKey::RSA.new(512)
+      File.open(Puppet[:hostprivkey], 'w') { |f| f.write(private_key.to_pem) }
+      File.open(Puppet[:hostpubkey], 'w') { |f| f.write(private_key.public_key.to_pem) }
+
+      stub_request(:get, %r{puppet-ca/v1/certificate/#{name}}).to_return(status: 200, body: @host[:cert].to_pem)
+
+      expects_command_to_output(%r{^Failed to download certificate: The certificate retrieved from the master does not match the agent's private key. Did you forget to run as root?}, 1)
+    end
+
+    it "prints a message if there isn't a cert to download" do
+      stub_request(:get, %r{puppet-ca/v1/certificate/#{name}}).to_return(status: 404)
+
+      expects_command_to_output(/No certificate for '#{name}' on CA/)
+    end
+  end
+
+  context 'when verifying' do
+    before do
+      ssl.command_line.args << 'verify'
+
+      File.open(Puppet[:hostcert], 'w') { |f| f.write(@host[:cert].to_pem) }
+    end
+
+    it 'reports if the key is missing' do
+      File.delete(Puppet[:hostprivkey])
+
+      expects_command_to_output(/The host's private key is missing/, 1)
+    end
+
+    it 'reports if the cert is missing' do
+      File.delete(Puppet[:hostcert])
+
+      expects_command_to_output(/The host's certificate is missing/, 1)
+    end
+
+    it 'reports if the key and cert are mismatched' do
+      # generate new keys
+      private_key = OpenSSL::PKey::RSA.new(512)
+      public_key = private_key.public_key
+      File.open(Puppet[:hostprivkey], 'w') { |f| f.write(private_key.to_pem) }
+      File.open(Puppet[:hostpubkey], 'w') { |f| f.write(public_key.to_pem) }
+
+      expects_command_to_output(/The host's key does not match the certificate/, 1)
+    end
+
+    it 'reports if the cert verification fails' do
+      # generate a new CA to force an error
+      ca = generate_cert('ca')
+      File.open(Puppet[:localcacert], 'w') { |f| f.write(ca[:cert].to_pem) }
+
+      # and CRL for that CA
+      crl = generate_crl('ca', ca[:cert].subject, ca[:private_key])
+      File.open(Puppet[:hostcrl], 'w') { |f| f.write(crl.to_pem) }
+
+      expects_command_to_output(/Failed to verify certificate '#{name}': certificate signature failure \(7\)/, 1)
+    end
+
+    it 'reports when verification succeeds' do
+      OpenSSL::X509::Store.any_instance.stubs(:verify).returns(true)
+
+      expects_command_to_output(/Verified certificate '#{name}'/, 0)
+    end
+  end
+end