puppet 5.5.22 → 6.0.0

data/spec/unit/ssl/certificate_revocation_list_spec.rb

@@ -1,196 +0,0 @@
-require 'spec_helper'
-
-require 'puppet/ssl/certificate_revocation_list'
-
-describe Puppet::SSL::CertificateRevocationList do
-  before do
-    ca = Puppet::SSL::CertificateAuthority.new
-    ca.generate_ca_certificate
-    @cert = ca.host.certificate.content
-    @key = ca.host.key.content
-    @class = Puppet::SSL::CertificateRevocationList
-  end
-
-  def expects_time_close_to_now(time)
-    expect(time.to_i).to be_within(5*60).of(Time.now.to_i)
-  end
-
-  def expects_time_close_to_five_years(time)
-    future = Time.now + Puppet::SSL::CertificateRevocationList::FIVE_YEARS
-    expect(time.to_i).to be_within(5*60).of(future.to_i)
-  end
-
-  def expects_crlnumber_extension(crl, value)
-    crlNumber = crl.content.extensions.find { |ext| ext.oid == "crlNumber" }
-
-    expect(crlNumber.value).to eq(value.to_s)
-    expect(crlNumber).to_not be_critical
-  end
-
-  def expects_authkeyid_extension(crl, cert)
-    subjectKeyId = cert.extensions.find { |ext| ext.oid == 'subjectKeyIdentifier' }.value
-
-    authKeyId = crl.content.extensions.find { |ext| ext.oid == "authorityKeyIdentifier" }
-    expect(authKeyId.value.chomp).to eq("keyid:#{subjectKeyId}")
-    expect(authKeyId).to_not be_critical
-  end
-
-  def expects_crlreason_extension(crl, reason)
-    revoke = crl.content.revoked.first
-
-    crlNumber = crl.content.extensions.find { |ext| ext.oid == "crlNumber" }
-    expect(revoke.serial.to_s).to eq(crlNumber.value)
-
-    crlReason = revoke.extensions.find { |ext| ext.oid = 'CRLReason' }
-    expect(crlReason.value).to eq(reason)
-    expect(crlReason).to_not be_critical
-  end
-
-  it "should only support the text format" do
-    expect(@class.supported_formats).to eq([:s])
-  end
-
-  describe "when converting from a string" do
-    it "deserializes a CRL" do
-      crl = @class.new('foo')
-      crl.generate(@cert, @key)
-
-      new_crl = @class.from_s(crl.to_s)
-      expect(new_crl.content.to_text).to eq(crl.content.to_text)
-    end
-  end
-
-  describe "when an instance" do
-    before do
-      @crl = @class.new("whatever")
-    end
-
-    it "should always use 'crl' for its name" do
-      expect(@crl.name).to eq("crl")
-    end
-
-    it "should have a content attribute" do
-      expect(@crl).to respond_to(:content)
-    end
-  end
-
-  describe "when generating the crl" do
-    before do
-      @crl = @class.new("crl")
-    end
-
-    it "should set its issuer to the subject of the passed certificate" do
-      expect(@crl.generate(@cert, @key).issuer.to_s).to eq(@cert.subject.to_s)
-    end
-
-    it "should set its version to 1" do
-      expect(@crl.generate(@cert, @key).version).to eq(1)
-    end
-
-    it "should create an instance of OpenSSL::X509::CRL" do
-      expect(@crl.generate(@cert, @key)).to be_an_instance_of(OpenSSL::X509::CRL)
-    end
-
-    it "should add an extension for the CRL number" do
-      @crl.generate(@cert, @key)
-
-      expects_crlnumber_extension(@crl, 0)
-    end
-
-    it "should add an extension for the authority key identifier" do
-      @crl.generate(@cert, @key)
-
-      expects_authkeyid_extension(@crl, @cert)
-    end
-
-    it "returns the last update time in UTC" do
-      # https://tools.ietf.org/html/rfc5280#section-5.1.2.4
-      thisUpdate = @crl.generate(@cert, @key).last_update
-      expect(thisUpdate).to be_utc
-      expects_time_close_to_now(thisUpdate)
-    end
-
-    it "returns the next update time in UTC 5 years from now" do
-      # https://tools.ietf.org/html/rfc5280#section-5.1.2.5
-      nextUpdate = @crl.generate(@cert, @key).next_update
-      expect(nextUpdate).to be_utc
-      expects_time_close_to_five_years(nextUpdate)
-    end
-
-    it "should verify using the CA public_key" do
-      expect(@crl.generate(@cert, @key).verify(@key.public_key)).to be_truthy
-    end
-
-    it "should set the content to the generated crl" do
-      # this test shouldn't be needed since we test the return of generate() which should be the content field
-      @crl.generate(@cert, @key)
-      expect(@crl.content).to be_an_instance_of(OpenSSL::X509::CRL)
-    end
-  end
-
-  # This test suite isn't exactly complete, because the
-  # SSL stuff is very complicated.  It just hits the high points.
-  describe "when revoking a certificate" do
-    before do
-      @crl = @class.new("crl")
-      @crl.generate(@cert, @key)
-
-      allow(Puppet::SSL::CertificateRevocationList.indirection).to receive(:save)
-    end
-
-    it "should require a serial number and the CA's private key" do
-      expect { @crl.revoke }.to raise_error(ArgumentError)
-    end
-
-    it "should mark the CRL as updated at a time that makes it valid now" do
-      @crl.revoke(1, @key)
-
-      expects_time_close_to_now(@crl.content.last_update)
-    end
-
-    it "should mark the CRL valid for five years" do
-      @crl.revoke(1, @key)
-
-      expects_time_close_to_five_years(@crl.content.next_update)
-    end
-
-    it "should sign the CRL with the CA's private key and a digest instance" do
-      digest = Puppet::SSL::CertificateSigner.new.digest
-      expect(@crl.content).to receive(:sign).with(@key, be_a(digest))
-      @crl.revoke(1, @key)
-    end
-
-    it "should save the CRL" do
-      expect(Puppet::SSL::CertificateRevocationList.indirection).to receive(:save).with(@crl, any_args)
-      @crl.revoke(1, @key)
-    end
-
-    it "adds the crlNumber extension containing the serial number" do
-      serial = 1
-      @crl.revoke(serial, @key)
-
-      expects_crlnumber_extension(@crl, serial)
-    end
-
-    it "adds the CA cert's subjectKeyId as the authorityKeyIdentifier to the CRL" do
-      @crl.revoke(1, @key)
-
-      expects_authkeyid_extension(@crl, @cert)
-    end
-
-    it "adds a non-critical CRL reason specifying key compromise by default" do
-      # https://tools.ietf.org/html/rfc5280#section-5.3.1
-      serial = 1
-      @crl.revoke(serial, @key)
-
-      expects_crlreason_extension(@crl, 'Key Compromise')
-    end
-
-    it "allows alternate reasons to be specified" do
-      serial = 1
-      @crl.revoke(serial, @key, OpenSSL::OCSP::REVOKED_STATUS_CACOMPROMISE)
-
-      expects_crlreason_extension(@crl, 'CA Compromise')
-    end
-  end
-end

data/spec/unit/ssl/configuration_spec.rb

@@ -1,138 +0,0 @@
-require 'spec_helper'
-require 'puppet/ssl/configuration'
-
-describe Puppet::SSL::Configuration do
-  let(:localcacert) { "/path/to/certs/ca.pem" }
-
-  let(:ssl_server_ca_auth) { "/path/to/certs/ssl_server_ca_auth.pem" }
-
-  # different UTF-8 widths
-  # 1-byte A
-  # 2-byte ۿ - http://www.fileformat.info/info/unicode/char/06ff/index.htm - 0xDB 0xBF / 219 191
-  # 3-byte ᚠ - http://www.fileformat.info/info/unicode/char/16A0/index.htm - 0xE1 0x9A 0xA0 / 225 154 160
-  # 4-byte 𠜎 - http://www.fileformat.info/info/unicode/char/2070E/index.htm - 0xF0 0xA0 0x9C 0x8E / 240 160 156 142
-  let (:mixed_utf8) { "A\u06FF\u16A0\u{2070E}" } # Aۿᚠ𠜎
-
-  it "should require the localcacert argument" do
-    expect { subject }.to raise_error ArgumentError
-  end
-
-  context "Default configuration" do
-    subject do
-      described_class.new(localcacert)
-    end
-
-    it "#ca_chain_file == localcacert" do
-      expect(subject.ca_chain_file).to eq(localcacert)
-    end
-
-    it "#ca_auth_file == localcacert" do
-      expect(subject.ca_auth_file).to eq(localcacert)
-    end
-  end
-
-  context "Explicitly configured" do
-    subject do
-      options = {
-        :ca_auth_file  => ssl_server_ca_auth,
-      }
-      Puppet::SSL::Configuration.new(localcacert, options)
-    end
-
-    it "#ca_chain_file == ssl_server_ca_chain" do
-      expect(subject.ca_chain_file).to eq(ssl_server_ca_auth)
-    end
-
-    it "#ca_auth_file == ssl_server_ca_auth" do
-      expect(subject.ca_auth_file).to eq(ssl_server_ca_auth)
-    end
-
-    it "#ca_auth_certificates returns an Array<OpenSSL::X509::Certificate>" do
-      expect(Puppet::FileSystem).to receive(:read).with(subject.ca_auth_file, :encoding => Encoding::UTF_8).and_return(master_ca_pem + root_ca_pem)
-      certs = subject.ca_auth_certificates
-      certs.each { |cert| expect(cert).to be_a_kind_of OpenSSL::X509::Certificate }
-    end
-  end
-
-  context "Partially configured" do
-    describe "#ca_chain_file" do
-      subject do
-        described_class.new(localcacert, { :ca_auth_file => ssl_server_ca_auth })
-      end
-
-      it "should use ca_auth_file" do
-        expect(subject.ca_chain_file).to eq(ssl_server_ca_auth)
-      end
-    end
-  end
-
-  # This is the Intermediate CA specifically designated for issuing master
-  # certificates.  It is signed by the Root CA.
-  def master_ca_pem
-    @master_ca_pem ||= <<-AUTH_BUNDLE
-# Master CA #{mixed_utf8}
------BEGIN CERTIFICATE-----
-MIICljCCAf+gAwIBAgIBAjANBgkqhkiG9w0BAQUFADBJMRAwDgYDVQQDDAdSb290
-IENBMRowGAYDVQQLDBFTZXJ2ZXIgT3BlcmF0aW9uczEZMBcGA1UECgwQRXhhbXBs
-ZSBPcmcsIExMQzAeFw0xMzAzMzAwNTUwNDhaFw0zMzAzMjUwNTUwNDhaMH4xJDAi
-BgNVBAMTG0ludGVybWVkaWF0ZSBDQSAobWFzdGVyLWNhKTEfMB0GCSqGSIb3DQEJ
-ARYQdGVzdEBleGFtcGxlLm9yZzEZMBcGA1UEChMQRXhhbXBsZSBPcmcsIExMQzEa
-MBgGA1UECxMRU2VydmVyIE9wZXJhdGlvbnMwXDANBgkqhkiG9w0BAQEFAANLADBI
-AkEAvo/az3oR69SP92jGnUHMJLEyyD1Ui1BZ/rUABJcQTRQqn3RqtlfYePWZnUaZ
-srKbXRS4q0w5Vqf1kx5w3q5tIwIDAQABo4GcMIGZMHkGA1UdIwRyMHCAFDBN1mqO
-Nc4gUraE4zRtw6ueFDDaoU2kSzBJMRAwDgYDVQQDDAdSb290IENBMRowGAYDVQQL
-DBFTZXJ2ZXIgT3BlcmF0aW9uczEZMBcGA1UECgwQRXhhbXBsZSBPcmcsIExMQ4IJ
-ALf2Pk2HvtBzMA8GA1UdEwEB/wQFMAMBAf8wCwYDVR0PBAQDAgEGMA0GCSqGSIb3
-DQEBBQUAA4GBACRfa1YPS7RQUuhYovGgV0VYqxuATC7WwdIRihVh5FceSXKgSIbz
-BKmOBAy/KixEhpnHTbkpaJ0d9ITkvjMTmj3M5YMahKaQA5niVPckQPecMMd6jg9U
-l1k75xLLIcrlsDYo3999KOSSchH2K7bLT7TuQ2okdP6FHWmeWmudewlu
------END CERTIFICATE-----
-    AUTH_BUNDLE
-  end
-
-  # This is the Root CA
-  def root_ca_pem
-    @root_ca_pem ||= <<-LOCALCACERT
-# Root CA #{mixed_utf8}
------BEGIN CERTIFICATE-----
-MIICYDCCAcmgAwIBAgIJALf2Pk2HvtBzMA0GCSqGSIb3DQEBBQUAMEkxEDAOBgNV
-BAMMB1Jvb3QgQ0ExGjAYBgNVBAsMEVNlcnZlciBPcGVyYXRpb25zMRkwFwYDVQQK
-DBBFeGFtcGxlIE9yZywgTExDMB4XDTEzMDMzMDA1NTA0OFoXDTMzMDMyNTA1NTA0
-OFowSTEQMA4GA1UEAwwHUm9vdCBDQTEaMBgGA1UECwwRU2VydmVyIE9wZXJhdGlv
-bnMxGTAXBgNVBAoMEEV4YW1wbGUgT3JnLCBMTEMwgZ8wDQYJKoZIhvcNAQEBBQAD
-gY0AMIGJAoGBAMGSpafR4lboYOPfPJC1wVHHl0gD49ZVRjOlJ9jidEUjBdFXK6SA
-S1tecDv2G4tM1ANmfMKjZl0m+KaZ8O2oq0g6kxkq1Mg0eSNvlnEyehjmTLRzHC2i
-a0biH2wMtCLzfAoXDKy4GPlciBPE9mup5I8Kien5s91t92tc7K8AJ8oBAgMBAAGj
-UDBOMB0GA1UdDgQWBBQwTdZqjjXOIFK2hOM0bcOrnhQw2jAfBgNVHSMEGDAWgBQw
-TdZqjjXOIFK2hOM0bcOrnhQw2jAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBBQUA
-A4GBACs8EZRrzgzAlcKC1Tz8GYlNHQg0XhpbEDm+p2mOV//PuDD190O+UBpWxo9Q
-rrkkx8En0wXQZJf6iH3hwewwHLOq5yXZKbJN+SmvJvRNL95Yhyy08Y9N65tJveE7
-rPsNU/Tx19jHC87oXlmAePLI4IaUHXrWb7CRbY9TEcPdmj1R
------END CERTIFICATE-----
-    LOCALCACERT
-  end
-
-  # This is the intermediate CA designated to issue Agent SSL certs.  It is
-  # signed by the Root CA.
-  def agent_ca_pem
-    @agent_ca_pem ||= <<-AGENT_CA
-# Agent CA #{mixed_utf8}
------BEGIN CERTIFICATE-----
-MIIClTCCAf6gAwIBAgIBATANBgkqhkiG9w0BAQUFADBJMRAwDgYDVQQDDAdSb290
-IENBMRowGAYDVQQLDBFTZXJ2ZXIgT3BlcmF0aW9uczEZMBcGA1UECgwQRXhhbXBs
-ZSBPcmcsIExMQzAeFw0xMzAzMzAwNTUwNDhaFw0zMzAzMjUwNTUwNDhaMH0xIzAh
-BgNVBAMTGkludGVybWVkaWF0ZSBDQSAoYWdlbnQtY2EpMR8wHQYJKoZIhvcNAQkB
-FhB0ZXN0QGV4YW1wbGUub3JnMRkwFwYDVQQKExBFeGFtcGxlIE9yZywgTExDMRow
-GAYDVQQLExFTZXJ2ZXIgT3BlcmF0aW9uczBcMA0GCSqGSIb3DQEBAQUAA0sAMEgC
-QQDkEj/Msmi4hJImxP5+ocixMTHuYC1M1E2p4QcuzOkZYrfHf+5hJMcahfYhLiXU
-jHBredOXhgSisHh6CLSb/rKzAgMBAAGjgZwwgZkweQYDVR0jBHIwcIAUME3Wao41
-ziBStoTjNG3Dq54UMNqhTaRLMEkxEDAOBgNVBAMMB1Jvb3QgQ0ExGjAYBgNVBAsM
-EVNlcnZlciBPcGVyYXRpb25zMRkwFwYDVQQKDBBFeGFtcGxlIE9yZywgTExDggkA
-t/Y+TYe+0HMwDwYDVR0TAQH/BAUwAwEB/zALBgNVHQ8EBAMCAQYwDQYJKoZIhvcN
-AQEFBQADgYEAujSj9rxIxJHEuuYXb15L30yxs9Tdvy4OCLiKdjvs9Z7gG8Pbutls
-ooCwyYAkmzKVs/8cYjZJnvJrPEW1gFwqX7Xknp85Cfrl+/pQEPYq5sZVa5BIm9tI
-0EvlDax/Hd28jI6Bgq5fsTECNl9GDGknCy7vwRZem0h+hI56lzR3pYE=
------END CERTIFICATE-----
-AGENT_CA
-  end
-end

data/spec/unit/ssl/inventory_spec.rb

@@ -1,155 +0,0 @@
-require 'spec_helper'
-
-require 'puppet/ssl/inventory'
-
-describe Puppet::SSL::Inventory, :unless => Puppet.features.microsoft_windows? do
-  let(:cert_inventory) { File.expand_path("/inven/tory") }
-
-  # different UTF-8 widths
-  # 1-byte A
-  # 2-byte ۿ - http://www.fileformat.info/info/unicode/char/06ff/index.htm - 0xDB 0xBF / 219 191
-  # 3-byte ᚠ - http://www.fileformat.info/info/unicode/char/16A0/index.htm - 0xE1 0x9A 0xA0 / 225 154 160
-  # 4-byte ܎ - http://www.fileformat.info/info/unicode/char/2070E/index.htm - 0xF0 0xA0 0x9C 0x8E / 240 160 156 142
-  let (:mixed_utf8) { "A\u06FF\u16A0\u{2070E}" } # Aۿᚠ܎
-
-  before do
-    @class = Puppet::SSL::Inventory
-  end
-
-  describe "when initializing" do
-    it "should set its path to the inventory file" do
-      Puppet[:cert_inventory] = cert_inventory
-      expect(@class.new.path).to eq(cert_inventory)
-    end
-  end
-
-  describe "when managing an inventory" do
-    before do
-      Puppet[:cert_inventory] = cert_inventory
-
-      allow(Puppet::FileSystem).to receive(:exist?).with(cert_inventory).and_return(true)
-
-      @inventory = @class.new
-
-      @cert = double('cert')
-    end
-
-    describe "and creating the inventory file" do
-      it "re-adds all of the existing certificates" do
-        inventory_file = StringIO.new
-        allow(Puppet.settings.setting(:cert_inventory)).to receive(:open).and_yield(inventory_file)
-
-        cert1 = Puppet::SSL::Certificate.new("cert1")
-        cert1.content = double(
-          'cert1',
-          :serial => 2,
-          :not_before => Time.now,
-          :not_after => Time.now,
-          :subject => "/CN=smocking",
-        )
-        cert2 = Puppet::SSL::Certificate.new("cert2")
-        cert2.content = double(
-          'cert2',
-          :serial => 3,
-          :not_before => Time.now,
-          :not_after => Time.now,
-          :subject => "/CN=mocking bird",
-        )
-        expect(Puppet::SSL::Certificate.indirection).to receive(:search).with("*").and_return([cert1, cert2])
-
-        @inventory.rebuild
-
-        expect(inventory_file.string).to match(/\/CN=smocking/)
-        expect(inventory_file.string).to match(/\/CN=mocking bird/)
-      end
-    end
-
-    describe "and adding a certificate" do
-      it "should use the Settings to write to the file" do
-        expect(Puppet.settings.setting(:cert_inventory)).to receive(:open).with('a:UTF-8')
-
-        @inventory.add(@cert)
-      end
-
-      it "should add formatted certificate information to the end of the file" do
-        cert = Puppet::SSL::Certificate.new("mycert")
-        cert.content = @cert
-
-        fh = StringIO.new
-        expect(Puppet.settings.setting(:cert_inventory)).to receive(:open).with('a:UTF-8').and_yield(fh)
-
-        expect(@inventory).to receive(:format).with(@cert).and_return("myformat")
-
-        @inventory.add(@cert)
-
-        expect(fh.string).to eq("myformat")
-      end
-
-      it "can use UTF-8 in the CN per RFC 5280" do
-        cert = Puppet::SSL::Certificate.new("mycert")
-        cert.content = double(
-          'cert',
-          :serial => 1,
-          :not_before => Time.now,
-          :not_after => Time.now,
-          :subject => "/CN=#{mixed_utf8}",
-        )
-
-        fh = StringIO.new
-        expect(Puppet.settings.setting(:cert_inventory)).to receive(:open).with('a:UTF-8').and_yield(fh)
-
-        @inventory.add(cert)
-
-        expect(fh.string).to match(/\/CN=#{mixed_utf8}/)
-      end
-    end
-
-    describe "and formatting a certificate" do
-      before do
-        @cert = double('cert', :not_before => Time.now, :not_after => Time.now, :subject => "mycert", :serial => 15)
-      end
-
-      it "should print the serial number as a 4 digit hex number in the first field" do
-        expect(@inventory.format(@cert).split[0]).to eq("0x000f") # 15 in hex
-      end
-
-      it "should print the not_before date in '%Y-%m-%dT%H:%M:%S%Z' format in the second field" do
-        expect(@cert.not_before).to receive(:strftime).with('%Y-%m-%dT%H:%M:%S%Z').and_return("before_time")
-
-        expect(@inventory.format(@cert).split[1]).to eq("before_time")
-      end
-
-      it "should print the not_after date in '%Y-%m-%dT%H:%M:%S%Z' format in the third field" do
-        expect(@cert.not_after).to receive(:strftime).with('%Y-%m-%dT%H:%M:%S%Z').and_return("after_time")
-
-        expect(@inventory.format(@cert).split[2]).to eq("after_time")
-      end
-
-      it "should print the subject in the fourth field" do
-        expect(@inventory.format(@cert).split[3]).to eq("mycert")
-      end
-
-      it "should add a carriage return" do
-        expect(@inventory.format(@cert)).to match(/\n$/)
-      end
-
-      it "should produce a line consisting of the serial number, start date, expiration date, and subject" do
-        # Just make sure our serial and subject bracket the lines.
-        expect(@inventory.format(@cert)).to match(/^0x.+mycert$/)
-      end
-    end
-
-    describe "and finding serial numbers" do
-      it "should return an empty array if the inventory file is missing" do
-        expect(Puppet::FileSystem).to receive(:exist?).with(cert_inventory).and_return(false)
-        expect(@inventory.serials(:whatever)).to be_empty
-      end
-
-      it "should return the all the serial numbers from the lines matching the provided name" do
-        expect(File).to receive(:readlines).with(cert_inventory, :encoding => Encoding::UTF_8).and_return(["0x00f blah blah /CN=me\n", "0x001 blah blah /CN=you\n", "0x002 blah blah /CN=me\n"])
-
-        expect(@inventory.serials("me")).to eq([15, 2])
-      end
-    end
-  end
-end