puppet 5.5.22-x86-mingw32 → 6.0.0-x86-mingw32

data/spec/unit/indirector/certificate_request/disabled_ca_spec.rb

@@ -1,32 +0,0 @@
-require 'spec_helper'
-require 'puppet/indirector/certificate_request/disabled_ca'
-
-describe Puppet::SSL::CertificateRequest::DisabledCa do
-  def request(type, remote)
-    r = Puppet::Indirector::Request.new(:certificate_request, type, "foo.com", nil)
-    if remote
-      r.ip   = '10.0.0.1'
-      r.node = 'agent.example.com'
-    end
-    r
-  end
-
-  context "when not a CA" do
-    before :each do
-      Puppet[:ca] = false
-      Puppet::SSL::Host.ca_location = :none
-    end
-
-    [:find, :head, :search, :save, :destroy].each do |name|
-      it "should fail remote #{name} requests" do
-        expect { subject.send(name, request(name, true)) }.
-          to raise_error Puppet::Error, /is not a CA/
-      end
-
-      it "should forward local #{name} requests" do
-        expect(Puppet::SSL::CertificateRequest.indirection.terminus(:file)).to receive(name)
-        subject.send(name, request(name, false))
-      end
-    end
-  end
-end

data/spec/unit/indirector/certificate_revocation_list/ca_spec.rb

@@ -1,15 +0,0 @@
-require 'spec_helper'
-
-require 'puppet/indirector/certificate_revocation_list/ca'
-
-describe Puppet::SSL::CertificateRevocationList::Ca do
-  it "should have documentation" do
-    expect(Puppet::SSL::CertificateRevocationList::Ca.doc).to be_instance_of(String)
-  end
-
-  it "should use the :cacrl setting as the crl location" do
-    allow(Puppet.settings).to receive(:use)
-    Puppet[:cacrl] = File.expand_path("/request/dir")
-    expect(Puppet::SSL::CertificateRevocationList::Ca.new.path("whatever")).to eq(Puppet[:cacrl])
-  end
-end

data/spec/unit/indirector/certificate_revocation_list/disabled_ca_spec.rb

@@ -1,32 +0,0 @@
-require 'spec_helper'
-require 'puppet/indirector/certificate_revocation_list/disabled_ca'
-
-describe Puppet::SSL::CertificateRevocationList::DisabledCa do
-  def request(type, remote)
-    r = Puppet::Indirector::Request.new(:certificate_revocation_list, type, "foo.com", nil)
-    if remote
-      r.ip   = '10.0.0.1'
-      r.node = 'agent.example.com'
-    end
-    r
-  end
-
-  context "when not a CA" do
-    before :each do
-      Puppet[:ca] = false
-      Puppet::SSL::Host.ca_location = :none
-    end
-
-    [:find, :head, :search, :save, :destroy].each do |name|
-      it "should fail remote #{name} requests" do
-        expect { subject.send(name, request(name, true)) }.
-          to raise_error Puppet::Error, /is not a CA/
-      end
-
-      it "should forward local #{name} requests" do
-        expect(Puppet::SSL::CertificateRevocationList.indirection.terminus(:file)).to receive(name)
-        subject.send(name, request(name, false))
-      end
-    end
-  end
-end

data/spec/unit/indirector/certificate_revocation_list/file_spec.rb

@@ -1,16 +0,0 @@
-require 'spec_helper'
-
-require 'puppet/indirector/certificate_revocation_list/file'
-
-describe Puppet::SSL::CertificateRevocationList::File do
-  it "should have documentation" do
-    expect(Puppet::SSL::CertificateRevocationList::File.doc).to be_instance_of(String)
-  end
-
-  it "should always store the file to :hostcrl location" do
-    crl = File.expand_path("/host/crl")
-    Puppet[:hostcrl] = crl
-    allow(Puppet.settings).to receive(:use)
-    expect(Puppet::SSL::CertificateRevocationList::File.file_location).to eq(crl)
-  end
-end

data/spec/unit/indirector/certificate_revocation_list/rest_spec.rb

@@ -1,33 +0,0 @@
-require 'spec_helper'
-
-require 'puppet/indirector/certificate_revocation_list/rest'
-
-describe Puppet::SSL::CertificateRevocationList::Rest do
-  before do
-    @searcher = Puppet::SSL::CertificateRevocationList::Rest.new
-  end
-
-  it "should be a sublcass of Puppet::Indirector::REST" do
-    expect(Puppet::SSL::CertificateRevocationList::Rest.superclass).to equal(Puppet::Indirector::REST)
-  end
-
-  it "should set server_setting to :ca_server" do
-    expect(Puppet::SSL::CertificateRevocationList::Rest.server_setting).to eq(:ca_server)
-  end
-
-  it "should set port_setting to :ca_port" do
-    expect(Puppet::SSL::CertificateRevocationList::Rest.port_setting).to eq(:ca_port)
-  end
-
-  it "should use the :ca SRV service" do
-    expect(Puppet::SSL::CertificateRevocationList::Rest.srv_service).to eq(:ca)
-  end
-
-  it "temporarily disables revocation checking when finding a CRL and no CRL is available" do
-    expect(Puppet::FileSystem).to receive(:exist?).with(Puppet[:hostcrl]).and_return(false)
-    Puppet.override({:certificate_revocation => :chain}) do
-      expect(Puppet).to receive(:override).with({:certificate_revocation => false}, anything)
-      subject.find(nil)
-    end
-  end
-end

data/spec/unit/indirector/certificate_status/file_spec.rb

@@ -1,190 +0,0 @@
-require 'spec_helper'
-require 'puppet/ssl/host'
-require 'puppet/indirector/certificate_status'
-require 'tempfile'
-
-describe "Puppet::Indirector::CertificateStatus::File" do
-  include PuppetSpec::Files
-
-  before :all do
-    Puppet::SSL::Host.configure_indirection(:file)
-  end
-
-  before do
-    allow(Puppet::SSL::CertificateAuthority).to receive(:ca?).and_return(true)
-    @terminus = Puppet::SSL::Host.indirection.terminus(:file)
-
-    @tmpdir = tmpdir("certificate_status_ca_testing")
-    Puppet[:confdir] = @tmpdir
-    Puppet[:vardir] = @tmpdir
-
-    # localcacert is where each client stores the CA certificate
-    # cacert is where the master stores the CA certificate
-    # Since we need to play the role of both for testing we need them to be the same and exist
-    Puppet[:cacert] = Puppet[:localcacert]
-  end
-
-  def generate_csr(host)
-    host.generate_key
-    csr = Puppet::SSL::CertificateRequest.new(host.name)
-    csr.generate(host.key.content)
-    Puppet::SSL::CertificateRequest.indirection.save(csr)
-  end
-
-  def sign_csr(host)
-    host.desired_state = "signed"
-    @terminus.save(Puppet::Indirector::Request.new(:certificate_status, :save, host.name, host))
-  end
-
-  def generate_signed_cert(host)
-    generate_csr(host)
-    sign_csr(host)
-
-    @terminus.find(Puppet::Indirector::Request.new(:certificate_status, :find, host.name, host))
-  end
-
-  def generate_revoked_cert(host)
-    generate_signed_cert(host)
-
-    host.desired_state = "revoked"
-
-    @terminus.save(Puppet::Indirector::Request.new(:certificate_status, :save, host.name, host))
-  end
-
-  it "should be a terminus on SSL::Host" do
-    expect(@terminus).to be_instance_of(Puppet::Indirector::CertificateStatus::File)
-  end
-
-  it "should create a CA instance if none is present" do
-    expect(@terminus.ca).to be_instance_of(Puppet::SSL::CertificateAuthority)
-  end
-
-  describe "when creating the CA" do
-    it "should fail if it is not a valid CA" do
-      expect(Puppet::SSL::CertificateAuthority).to receive(:ca?).and_return(false)
-      expect { @terminus.ca }.to raise_error(ArgumentError, "This process is not configured as a certificate authority")
-    end
-  end
-
-  it "should be indirected with the name 'certificate_status'" do
-    expect(Puppet::SSL::Host.indirection.name).to eq(:certificate_status)
-  end
-
-  describe "when finding" do
-    before do
-      @host = Puppet::SSL::Host.new("foo")
-      Puppet.settings.use(:main)
-    end
-
-    it "should return the Puppet::SSL::Host when a CSR exists for the host" do
-      generate_csr(@host)
-      request = Puppet::Indirector::Request.new(:certificate_status, :find, "foo", @host)
-
-      retrieved_host = @terminus.find(request)
-
-      expect(retrieved_host.name).to eq(@host.name)
-      expect(retrieved_host.certificate_request.content.to_s.chomp).to eq(@host.certificate_request.content.to_s.chomp)
-    end
-
-    it "should return the Puppet::SSL::Host when a public key exists for the host" do
-      generate_signed_cert(@host)
-      request = Puppet::Indirector::Request.new(:certificate_status, :find, "foo", @host)
-
-      retrieved_host = @terminus.find(request)
-
-      expect(retrieved_host.name).to eq(@host.name)
-      expect(retrieved_host.certificate.content.to_s.chomp).to eq(@host.certificate.content.to_s.chomp)
-    end
-
-    it "should return nil when neither a CSR nor public key exist for the host" do
-      request = Puppet::Indirector::Request.new(:certificate_status, :find, "foo", @host)
-      expect(@terminus.find(request)).to eq(nil)
-    end
-  end
-
-  describe "when saving" do
-    before do
-      @host = Puppet::SSL::Host.new("foobar")
-      Puppet.settings.use(:main)
-    end
-
-    describe "when signing a cert" do
-      before do
-        @host.desired_state = "signed"
-        @request = Puppet::Indirector::Request.new(:certificate_status, :save, "foobar", @host)
-      end
-
-      it "should fail if no CSR is on disk" do
-        expect { @terminus.save(@request) }.to raise_error(Puppet::Error, /certificate request/)
-      end
-
-      it "should sign the on-disk CSR when it is present" do
-        signed_host = generate_signed_cert(@host)
-
-        expect(signed_host.state).to eq("signed")
-        expect(Puppet::SSL::Certificate.indirection.find("foobar")).to be_instance_of(Puppet::SSL::Certificate)
-      end
-    end
-
-    describe "when revoking a cert" do
-      before do
-        @request = Puppet::Indirector::Request.new(:certificate_status, :save, "foobar", @host)
-      end
-
-      it "should fail if no certificate is on disk" do
-        @host.desired_state = "revoked"
-        expect { @terminus.save(@request) }.to raise_error(Puppet::Error, /Cannot revoke/)
-      end
-
-      it "should revoke the certificate when it is present" do
-        generate_revoked_cert(@host)
-
-        expect(@host.state).to eq('revoked')
-      end
-    end
-  end
-
-  describe "when deleting" do
-    before do
-      Puppet.settings.use(:main)
-    end
-
-    it "should not delete anything if no certificate, request, or key is on disk" do
-      host = Puppet::SSL::Host.new("clean_me")
-      request = Puppet::Indirector::Request.new(:certificate_status, :delete, "clean_me", host)
-      expect(@terminus.destroy(request)).to eq("Nothing was deleted")
-    end
-
-    it "should clean certs, cert requests, keys" do
-      signed_host = Puppet::SSL::Host.new("clean_signed_cert")
-      generate_signed_cert(signed_host)
-      signed_request = Puppet::Indirector::Request.new(:certificate_status, :delete, "clean_signed_cert", signed_host)
-      expect(@terminus.destroy(signed_request)).to eq("Deleted for clean_signed_cert: Puppet::SSL::Certificate, Puppet::SSL::Key")
-
-      requested_host = Puppet::SSL::Host.new("clean_csr")
-      generate_csr(requested_host)
-      csr_request = Puppet::Indirector::Request.new(:certificate_status, :delete, "clean_csr", requested_host)
-      expect(@terminus.destroy(csr_request)).to eq("Deleted for clean_csr: Puppet::SSL::CertificateRequest, Puppet::SSL::Key")
-    end
-  end
-
-  describe "when searching" do
-    it "should return a list of all hosts with certificate requests, signed certs, or revoked certs" do
-      Puppet.settings.use(:main)
-
-      signed_host = Puppet::SSL::Host.new("signed_host")
-      generate_signed_cert(signed_host)
-
-      requested_host = Puppet::SSL::Host.new("requested_host")
-      generate_csr(requested_host)
-
-      revoked_host = Puppet::SSL::Host.new("revoked_host")
-      generate_revoked_cert(revoked_host)
-
-      retrieved_hosts = @terminus.search(Puppet::Indirector::Request.new(:certificate_status, :search, "all", signed_host))
-
-      results = retrieved_hosts.map {|h| [h.name, h.state]}.sort{ |h,i| h[0] <=> i[0] }
-      expect(results).to eq([["ca","signed"],["requested_host","requested"],["revoked_host","revoked"],["signed_host","signed"]])
-    end
-  end
-end

data/spec/unit/indirector/certificate_status/rest_spec.rb

@@ -1,17 +0,0 @@
-require 'spec_helper'
-require 'puppet/ssl/host'
-require 'puppet/indirector/certificate_status'
-
-describe "Puppet::CertificateStatus::Rest" do
-  before do
-    @terminus = Puppet::SSL::Host.indirection.terminus(:rest)
-  end
-
-  it "should be a terminus on Puppet::SSL::Host" do
-    expect(@terminus).to be_instance_of(Puppet::Indirector::CertificateStatus::Rest)
-  end
-
-  it "should use the :ca SRV service" do
-    expect(Puppet::Indirector::CertificateStatus::Rest.srv_service).to eq(:ca)
-  end
-end

data/spec/unit/indirector/code_spec.rb

@@ -1,30 +0,0 @@
-require 'spec_helper'
-require 'puppet/indirector/code'
-
-describe Puppet::Indirector::Code do
-  before(:each) do
-    allow(Puppet::Indirector::Terminus).to receive(:register_terminus_class)
-    @model = double('model')
-    @indirection = double('indirection', :name => :mystuff, :register_terminus_type => nil, :model => @model)
-    allow(Puppet::Indirector::Indirection).to receive(:instance).and_return(@indirection)
-
-    module Testing; end
-    @code_class = class Testing::MyCode < Puppet::Indirector::Code
-      self
-    end
-
-    @searcher = @code_class.new
-  end
-
-  it "should not have a find() method defined" do
-    expect(@searcher).not_to respond_to(:find)
-  end
-
-  it "should not have a save() method defined" do
-    expect(@searcher).not_to respond_to(:save)
-  end
-
-  it "should not have a destroy() method defined" do
-    expect(@searcher).not_to respond_to(:destroy)
-  end
-end

data/spec/unit/indirector/key/ca_spec.rb

@@ -1,22 +0,0 @@
-require 'spec_helper'
-
-require 'puppet/indirector/key/ca'
-
-describe Puppet::SSL::Key::Ca do
-  it "should have documentation" do
-    expect(Puppet::SSL::Key::Ca.doc).to be_instance_of(String)
-  end
-
-  it "should use the :privatekeydir as the collection directory" do
-    Puppet[:privatekeydir] = "/key/dir"
-    expect(Puppet::SSL::Key::Ca.collection_directory).to eq(Puppet[:privatekeydir])
-  end
-
-  it "should store the ca key at the :cakey location" do
-    allow(Puppet.settings).to receive(:use)
-    Puppet[:cakey] = "/ca/key"
-    file = Puppet::SSL::Key::Ca.new
-    allow(file).to receive(:ca?).and_return(true)
-    expect(file.path("whatever")).to eq(Puppet[:cakey])
-  end
-end

data/spec/unit/indirector/key/disabled_ca_spec.rb

@@ -1,32 +0,0 @@
-require 'spec_helper'
-require 'puppet/indirector/key/disabled_ca'
-
-describe Puppet::SSL::Key::DisabledCa do
-  def request(type, remote)
-    r = Puppet::Indirector::Request.new(:key, type, "foo.com", nil)
-    if remote
-      r.ip   = '10.0.0.1'
-      r.node = 'agent.example.com'
-    end
-    r
-  end
-
-  context "when not a CA" do
-    before :each do
-      Puppet[:ca] = false
-      Puppet::SSL::Host.ca_location = :none
-    end
-
-    [:find, :head, :search, :save, :destroy].each do |name|
-      it "should fail remote #{name} requests" do
-        expect { subject.send(name, request(name, true)) }.
-          to raise_error Puppet::Error, /is not a CA/
-      end
-
-      it "should forward local #{name} requests" do
-        expect(Puppet::SSL::Key.indirection.terminus(:file)).to receive(name)
-        subject.send(name, request(name, false))
-      end
-    end
-  end
-end

data/spec/unit/indirector/ldap_spec.rb

@@ -1,151 +0,0 @@
-require 'spec_helper'
-
-require 'puppet/indirector/ldap'
-
-describe Puppet::Indirector::Ldap do
-  before do
-    @indirection = double('indirection', :name => :testing)
-    allow(Puppet::Indirector::Indirection).to receive(:instance).and_return(@indirection)
-    module Testing; end
-    @ldap_class = class Testing::MyLdap < Puppet::Indirector::Ldap
-      self
-    end
-
-    @connection = double('ldap')
-  end
-
-  describe "when instantiating ldap" do
-    it "should be deprecated" do
-      expect(Puppet).to receive(:deprecation_warning).with("Puppet::Indirector::Ldap is deprecated and will be removed in a future release of Puppet.")
-
-      @ldap_class.new
-    end
-
-    it "should not emit a deprecation warning when they are disabled" do
-      expect(Puppet).not_to receive(:warning).with(/Puppet::Indirector::Ldap is deprecated/)
-      Puppet[:disable_warnings] = ['deprecations']
-
-      @ldap_class.new
-    end
-
-    it "should only emit the deprecation warning once" do
-      expect(Puppet).to receive(:warning).with(/Puppet::Indirector::Ldap is deprecated/).once
-
-      @ldap_class.new
-      @ldap_class.new
-    end
-  end
-
-  describe "when searching ldap" do
-    before do
-      @searcher = @ldap_class.new
-      # Stub everything, and we can selectively replace with an expect as
-      # we need to for testing.
-      allow(@searcher).to receive(:connection).and_return(@connection)
-      allow(@searcher).to receive(:search_filter).and_return(:filter)
-      allow(@searcher).to receive(:search_base).and_return(:base)
-      allow(@searcher).to receive(:process)
-
-      @request = double('request', :key => "yay")
-    end
-
-    it "should call the ldapsearch method with the search filter" do
-      expect(@searcher).to receive(:search_filter).with("yay").and_return("yay's filter")
-      expect(@searcher).to receive(:ldapsearch).with("yay's filter")
-      @searcher.find @request
-    end
-
-    it "should fail if no block is passed to the ldapsearch method" do
-      expect { @searcher.ldapsearch("blah") }.to raise_error(ArgumentError)
-    end
-
-    it "should use the results of the ldapbase method as the ldap search base" do
-      allow(@searcher).to receive(:search_base).and_return("mybase")
-      expect(@connection).to receive(:search).with("mybase", anything, anything, anything)
-
-      @searcher.find @request
-    end
-
-    it "should default to the value of the :search_base setting as the result of the ldapbase method" do
-      Puppet[:ldapbase] = "myldapbase"
-      searcher = @ldap_class.new
-      expect(searcher.search_base).to eq("myldapbase")
-    end
-
-    it "should use the results of the :search_attributes method as the list of attributes to return" do
-      allow(@searcher).to receive(:search_attributes).and_return(:myattrs)
-      expect(@connection).to receive(:search).with(anything, anything, anything, :myattrs)
-
-      @searcher.find @request
-    end
-
-    it "should use depth 2 when searching" do
-      expect(@connection).to receive(:search).with(anything, 2, anything, anything)
-
-      @searcher.find @request
-    end
-
-    it "should call process() on the first found entry" do
-      expect(@connection).to receive(:search).and_yield("myresult")
-      expect(@searcher).to receive(:process).with("myresult")
-      @searcher.find @request
-    end
-
-    it "should reconnect and retry the search if there is a failure" do
-      run = false
-      allow(@connection).to receive(:search) do |*args|
-        if run
-          true
-        else
-          run = true
-          raise "failed"
-        end
-      end.and_yield("myresult")
-      expect(@searcher).to receive(:process).with("myresult")
-
-      @searcher.find @request
-    end
-
-    it "should not reconnect on failure more than once" do
-      count = 0
-      allow(@connection).to receive(:search) do |*_|
-        count += 1
-        raise ArgumentError, "yay"
-      end
-      expect { @searcher.find(@request) }.to raise_error(Puppet::Error)
-      expect(count).to eq(2)
-    end
-
-    it "should return true if an entry is found" do
-      expect(@connection).to receive(:search).and_yield("result")
-      expect(@searcher.ldapsearch("whatever") { |r| }).to be_truthy
-    end
-  end
-
-  describe "when connecting to ldap", :if => Puppet.features.ldap? do
-    it "should create and start a Util::Ldap::Connection instance" do
-      conn = double('connection', :connection => "myconn", :start => nil)
-      expect(Puppet::Util::Ldap::Connection).to receive(:instance).and_return(conn)
-
-      expect(@searcher.connection).to eq("myconn")
-    end
-
-    it "should only create the ldap connection when asked for it the first time" do
-      conn = double('connection', :connection => "myconn", :start => nil)
-      expect(Puppet::Util::Ldap::Connection).to receive(:instance).and_return(conn)
-
-      @searcher.connection
-    end
-
-    it "should cache the connection" do
-      conn = double('connection', :connection => "myconn", :start => nil)
-      expect(Puppet::Util::Ldap::Connection).to receive(:instance).and_return(conn)
-
-      expect(@searcher.connection).to equal(@searcher.connection)
-    end
-  end
-
-  describe "when reconnecting to ldap", :if => (Puppet.features.root? and Facter.value("hostname") == "culain") do
-    it "should reconnect to ldap when connections are lost"
-  end
-end