puppet 6.0.10 → 6.1.0

data/spec/unit/network/http/api/master/v3/authorization_spec.rb

@@ -17,7 +17,7 @@ describe Puppet::Network::HTTP::API::Master::V3::Authorization do
       :params => { :authenticated => true, :node => "testing", :ip => "127.0.0.1" }
     })
 
-    allow(authz).to receive(:authconfig).and_return(Puppet::Network::AuthConfigParser.new(<<-AUTH).parse)
+    authz.stubs(:authconfig).returns(Puppet::Network::AuthConfigParser.new(<<-AUTH).parse)
 path /v3/environments
 method find
 allow *
@@ -39,7 +39,7 @@ allow *
       :params => { :authenticated => true, :node => "testing", :ip => "127.0.0.1" }
     })
 
-    allow(authz).to receive(:authconfig).and_return(Puppet::Network::AuthConfigParser.new(<<-AUTH).parse)
+    authz.stubs(:authconfig).returns(Puppet::Network::AuthConfigParser.new(<<-AUTH).parse)
 path /v3/environments
 method find
 auth any

data/spec/unit/network/http/api/master/v3/environment_spec.rb

@@ -175,7 +175,7 @@ describe Puppet::Network::HTTP::API::Master::V3::Environment do
   it "uses code_id from the catalog if it differs from the request" do
     request = Puppet::Network::HTTP::Request.from_hash(:params => {:code_id => '12345'}, :routing_path => "environment/production")
 
-    allow_any_instance_of(Puppet::Resource::Catalog).to receive(:code_id).and_return('67890')
+    Puppet::Resource::Catalog.any_instance.stubs(:code_id).returns('67890')
 
     subject.call(request, response)
 

data/spec/unit/network/http/api/master/v3/environments_spec.rb

@@ -33,11 +33,11 @@ describe Puppet::Network::HTTP::API::Master::V3::Environments do
   end
 
   it "the response conforms to the environments schema for unlimited timeout" do
-    conf_stub = double('conf_stub')
-    expect(conf_stub).to receive(:environment_timeout).and_return(Float::INFINITY)
+    conf_stub = stub 'conf_stub'
+    conf_stub.expects(:environment_timeout).returns(Float::INFINITY)
     environment = Puppet::Node::Environment.create(:production, [])
     env_loader = Puppet::Environments::Static.new(environment)
-    expect(env_loader).to receive(:get_conf).with(:production).and_return(conf_stub)
+    env_loader.expects(:get_conf).with(:production).returns(conf_stub)
     handler = Puppet::Network::HTTP::API::Master::V3::Environments.new(env_loader)
     response = Puppet::Network::HTTP::MemoryResponse.new
 
@@ -47,11 +47,11 @@ describe Puppet::Network::HTTP::API::Master::V3::Environments do
   end
 
   it "the response conforms to the environments schema for integer timeout" do
-    conf_stub = double('conf_stub')
-    expect(conf_stub).to receive(:environment_timeout).and_return(1)
+    conf_stub = stub 'conf_stub'
+    conf_stub.expects(:environment_timeout).returns(1)
     environment = Puppet::Node::Environment.create(:production, [])
     env_loader = Puppet::Environments::Static.new(environment)
-    expect(env_loader).to receive(:get_conf).with(:production).and_return(conf_stub)
+    env_loader.expects(:get_conf).with(:production).returns(conf_stub)
     handler = Puppet::Network::HTTP::API::Master::V3::Environments.new(env_loader)
     response = Puppet::Network::HTTP::MemoryResponse.new
 
@@ -59,4 +59,5 @@ describe Puppet::Network::HTTP::API::Master::V3::Environments do
 
     expect(response.body).to validate_against('api/schemas/environments.json')
   end
+
 end

data/spec/unit/network/http/api_spec.rb

@@ -1,3 +1,5 @@
+#! /usr/bin/env ruby
+
 require 'spec_helper'
 require 'puppet_spec/handler'
 require 'puppet/network/http'

data/spec/unit/network/http/compression_spec.rb

@@ -1,8 +1,9 @@
+#! /usr/bin/env ruby
 require 'spec_helper'
 
 describe "http compression" do
   let(:data)            { "uncompresseddata" }
-  let(:response)        { double('response') }
+  let(:response)        { stub 'response' }
   let(:compressed_zlib) { Zlib::Deflate.deflate(data) }
   let(:compressed_gzip) do
     str = StringIO.new
@@ -13,13 +14,13 @@ describe "http compression" do
   end
 
   def stubs_response_with(response, content_encoding, body)
-    allow(response).to receive(:[]).with('content-encoding').and_return(content_encoding)
-    allow(response).to receive(:body).and_return(body)
+    response.stubs(:[]).with('content-encoding').returns(content_encoding)
+    response.stubs(:body).returns(body)
   end
 
   describe "when zlib is not available" do
     before(:each) do
-      allow(Puppet.features).to receive(:zlib?).and_return(false)
+      Puppet.features.stubs(:zlib?).returns false
 
       require 'puppet/network/http/compression'
       class HttpUncompressor
@@ -38,12 +39,12 @@ describe "http compression" do
     end
 
     it "should not tamper the body" do
-      response = double('response', :body => data)
+      response = stub 'response', :body => data
       expect(@uncompressor.uncompress_body(response)).to eq(data)
     end
 
     it "should yield an identity uncompressor" do
-      response = double('response')
+      response = stub 'response'
       @uncompressor.uncompress(response) { |u|
         expect(u).to be_instance_of(Puppet::Network::HTTP::Compression::IdentityAdapter)
       }
@@ -168,19 +169,19 @@ describe "http compression" do
 
       it "should close the underlying adapter" do
         stubs_response_with(response, 'identity', data)
-        adapter = double('adapter')
-        expect(Puppet::Network::HTTP::Compression::IdentityAdapter).to receive(:new).and_return(adapter)
+        adapter = stub_everything 'adapter'
+        Puppet::Network::HTTP::Compression::IdentityAdapter.expects(:new).returns(adapter)
 
-        expect(adapter).to receive(:close)
+        adapter.expects(:close)
         uncompressor.uncompress(response) { |u| }
       end
 
       it "should close the underlying adapter if the yielded block raises" do
         stubs_response_with(response, 'identity', data)
-        adapter = double('adapter')
-        expect(Puppet::Network::HTTP::Compression::IdentityAdapter).to receive(:new).and_return(adapter)
+        adapter = stub_everything 'adapter'
+        Puppet::Network::HTTP::Compression::IdentityAdapter.expects(:new).returns(adapter)
 
-        expect(adapter).to receive(:close)
+        adapter.expects(:close)
         expect {
           uncompressor.uncompress(response) { |u| raise ArgumentError, "whoops" }
         }.to raise_error(ArgumentError, "whoops")
@@ -189,7 +190,7 @@ describe "http compression" do
 
     describe "zlib adapter" do
       it "should initialize the underlying inflater with gzip/zlib header parsing" do
-        expect(Zlib::Inflate).to receive(:new).with(15 + 32)
+        Zlib::Inflate.expects(:new).with(15+32)
 
         Puppet::Network::HTTP::Compression::Active::ZlibAdapter.new
       end
@@ -202,7 +203,7 @@ describe "http compression" do
 
       it "should try a 'regular' inflater on Zlib::DataError" do
         inflater = Zlib::Inflate.new(15 + 32)
-        expect(inflater).to receive(:inflate).and_raise(Zlib::DataError.new("not a zlib stream"))
+        inflater.expects(:inflate).raises(Zlib::DataError.new("not a zlib stream"))
         adapter = Puppet::Network::HTTP::Compression::Active::ZlibAdapter.new(inflater)
 
         expect(adapter.uncompress(compressed_zlib)).to eq(data)
@@ -210,25 +211,25 @@ describe "http compression" do
 
       it "should raise the error the second time" do
         inflater = Zlib::Inflate.new(15 + 32)
-        expect(inflater).to receive(:inflate).and_raise(Zlib::DataError.new("not a zlib stream"))
+        inflater.expects(:inflate).raises(Zlib::DataError.new("not a zlib stream"))
         adapter = Puppet::Network::HTTP::Compression::Active::ZlibAdapter.new(inflater)
 
         expect { adapter.uncompress("this is not compressed data") }.to raise_error(Zlib::DataError, /incorrect header check/)
       end
 
       it "should finish and close the stream" do
-        inflater = double('inflater')
-        expect(inflater).to receive(:finish)
-        expect(inflater).to receive(:close)
+        inflater = stub 'inflater'
+        inflater.expects(:finish)
+        inflater.expects(:close)
         adapter = Puppet::Network::HTTP::Compression::Active::ZlibAdapter.new(inflater)
 
         adapter.close
       end
 
       it "should close the stream even if finish raises" do
-        inflater = double('inflater')
-        expect(inflater).to receive(:finish).and_raise(Zlib::BufError)
-        expect(inflater).to receive(:close)
+        inflater = stub 'inflater'
+        inflater.expects(:finish).raises(Zlib::BufError)
+        inflater.expects(:close)
 
         adapter = Puppet::Network::HTTP::Compression::Active::ZlibAdapter.new(inflater)
         expect {

data/spec/unit/network/http/connection_spec.rb

@@ -1,9 +1,11 @@
+#! /usr/bin/env ruby
 require 'spec_helper'
 require 'puppet/network/http/connection'
 require 'puppet_spec/validators'
 require 'puppet/test_ca'
 
 describe Puppet::Network::HTTP::Connection do
+
   let (:host) { "me" }
   let (:port) { 54321 }
   subject { Puppet::Network::HTTP::Connection.new(host, port, :verify => Puppet::SSL::Validator.no_validator) }
@@ -62,6 +64,94 @@ describe Puppet::Network::HTTP::Connection do
     end
   end
 
+  shared_examples_for 'ssl verifier' do
+    include PuppetSpec::Files
+
+    let (:host) { "my_server" }
+    let (:port) { 8140 }
+
+    before :all do
+      WebMock.disable!
+    end
+
+    after :all do
+      WebMock.enable!
+    end
+
+    it "should provide a useful error message when one is available and certificate validation fails", :unless => Puppet::Util::Platform.windows? do
+      connection = Puppet::Network::HTTP::Connection.new(
+        host, port,
+        :verify => ConstantErrorValidator.new(:fails_with => 'certificate verify failed',
+                                              :error_string => 'shady looking signature'))
+
+      expect do
+        connection.get('request')
+      end.to raise_error(Puppet::Error, "certificate verify failed: [shady looking signature]")
+    end
+
+    it "should provide a helpful error message when hostname was not match with server certificate", :unless => Puppet::Util::Platform.windows? || RUBY_PLATFORM == 'java' do
+      Puppet[:confdir] = tmpdir('conf')
+
+      connection = Puppet::Network::HTTP::Connection.new(
+      host, port,
+      :verify => ConstantErrorValidator.new(
+        :fails_with => 'hostname was not match with server certificate',
+        :peer_certs => [Puppet::TestCa.new.generate('not_my_server',
+                                                    :subject_alt_names => 'DNS:foo,DNS:bar,DNS:baz,DNS:not_my_server')[:cert]]))
+
+      expect do
+        connection.get('request')
+      end.to raise_error(Puppet::Error) do |error|
+        error.message =~ /\AServer hostname 'my_server' did not match server certificate; expected one of (.+)/
+        expect($1.split(', ')).to match_array(%w[DNS:foo DNS:bar DNS:baz DNS:not_my_server not_my_server])
+      end
+    end
+
+    it "should pass along the error message otherwise" do
+      connection = Puppet::Network::HTTP::Connection.new(
+        host, port,
+        :verify => ConstantErrorValidator.new(:fails_with => 'some other message'))
+
+      expect do
+        connection.get('request')
+      end.to raise_error(/some other message/)
+    end
+
+    it "should check all peer certificates for upcoming expiration", :unless => Puppet::Util::Platform.windows? || RUBY_PLATFORM == 'java' do
+      Puppet[:confdir] = tmpdir('conf')
+      cert = Puppet::TestCa.new.generate('server',
+                                         :subject_alt_names => 'DNS:foo,DNS:bar,DNS:baz,DNS:server')[:cert]
+
+      connection = Puppet::Network::HTTP::Connection.new(
+        host, port,
+        :verify => NoProblemsValidator.new(cert))
+
+      Net::HTTP.any_instance.stubs(:start)
+      Net::HTTP.any_instance.stubs(:request).returns(httpok)
+      Puppet::Network::HTTP::Pool.any_instance.stubs(:setsockopts)
+
+      connection.get('request')
+    end
+  end
+
+  context "when using single use HTTPS connections", :unless => RUBY_PLATFORM == 'java' do
+    it_behaves_like 'ssl verifier' do
+    end
+  end
+
+  context "when using persistent HTTPS connections", :unless => RUBY_PLATFORM == 'java' do
+    around :each do |example|
+      pool = Puppet::Network::HTTP::Pool.new
+      Puppet.override(:http_pool => pool) do
+        example.run
+      end
+      pool.close
+    end
+
+    it_behaves_like 'ssl verifier' do
+    end
+  end
+
   context "when response is a redirect" do
     let (:site)       { Puppet::Network::HTTP::Site.new('http', 'my_server', 8140) }
     let (:other_site) { Puppet::Network::HTTP::Site.new('http', 'redirected', 9292) }
@@ -71,7 +161,7 @@ describe Puppet::Network::HTTP::Connection do
     let (:httpredirection) do
       response = Net::HTTPFound.new('1.1', 302, 'Moved Temporarily')
       response['location'] = "#{other_site.addr}/#{other_path}"
-      allow(response).to receive(:read_body).and_return("This resource has moved")
+      response.stubs(:read_body).returns("This resource has moved")
       response
     end
 
@@ -81,23 +171,24 @@ describe Puppet::Network::HTTP::Connection do
     end
 
     it "should redirect to the final resource location" do
-      http = double('http')
-      allow(http).to receive(:request).and_return(httpredirection, httpok)
+      http = stub('http')
+      http.stubs(:request).returns(httpredirection).then.returns(httpok)
 
+      seq = sequence('redirection')
       pool = Puppet.lookup(:http_pool)
-      expect(pool).to receive(:with_connection).with(site, anything).and_yield(http).ordered
-      expect(pool).to receive(:with_connection).with(other_site, anything).and_yield(http).ordered
+      pool.expects(:with_connection).with(site, anything).yields(http).in_sequence(seq)
+      pool.expects(:with_connection).with(other_site, anything).yields(http).in_sequence(seq)
 
       conn = create_connection(site, :verify => verify)
       conn.get('/foo')
     end
 
     def expects_redirection(conn, &block)
-      http = double('http')
-      allow(http).to receive(:request).and_return(httpredirection)
+      http = stub('http')
+      http.stubs(:request).returns(httpredirection)
 
       pool = Puppet.lookup(:http_pool)
-      expect(pool).to receive(:with_connection).with(site, anything).and_yield(http)
+      pool.expects(:with_connection).with(site, anything).yields(http)
       pool
     end
 
@@ -111,7 +202,7 @@ describe Puppet::Network::HTTP::Connection do
       conn = create_connection(site, :verify => verify, :redirect_limit => 0)
 
       pool = expects_redirection(conn)
-      expect(pool).not_to receive(:with_connection).with(other_site, anything)
+      pool.expects(:with_connection).with(other_site, anything).never
 
       expects_limit_exceeded(conn)
     end
@@ -120,7 +211,7 @@ describe Puppet::Network::HTTP::Connection do
       conn = create_connection(site, :verify => verify, :redirect_limit => 1)
 
       pool = expects_redirection(conn)
-      expect(pool).to receive(:with_connection).with(other_site, anything).once
+      pool.expects(:with_connection).with(other_site, anything).once
 
       expects_limit_exceeded(conn)
     end
@@ -129,14 +220,14 @@ describe Puppet::Network::HTTP::Connection do
       conn = create_connection(site, :verify => verify, :redirect_limit => 3)
 
       pool = expects_redirection(conn)
-      expect(pool).to receive(:with_connection).with(other_site, anything).exactly(3).times
+      pool.expects(:with_connection).with(other_site, anything).times(3)
 
       expects_limit_exceeded(conn)
     end
   end
 
   context "when response indicates an overloaded server" do
-    let(:http) { double('http') }
+    let(:http) { stub('http') }
     let(:site) { Puppet::Network::HTTP::Site.new('http', 'my_server', 8140) }
     let(:verify) { Puppet::SSL::Validator.no_validator }
     let(:httpunavailable) { Net::HTTPServiceUnavailable.new('1.1', 503, 'Service Unavailable') }
@@ -155,10 +246,10 @@ describe Puppet::Network::HTTP::Connection do
     end
 
     it "should return a 503 response if Retry-After is not set" do
-      allow(http).to receive(:request).and_return(httpunavailable)
+      http.stubs(:request).returns(httpunavailable)
 
       pool = Puppet.lookup(:http_pool)
-      expect(pool).to receive(:with_connection).with(site, anything).and_yield(http)
+      pool.expects(:with_connection).with(site, anything).yields(http)
 
       result = subject.get('/foo')
 
@@ -167,10 +258,10 @@ describe Puppet::Network::HTTP::Connection do
 
     it "should return a 503 response if Retry-After is not convertible to an Integer or RFC 2822 Date" do
       httpunavailable['Retry-After'] = 'foo'
-      allow(http).to receive(:request).and_return(httpunavailable)
+      http.stubs(:request).returns(httpunavailable)
 
       pool = Puppet.lookup(:http_pool)
-      expect(pool).to receive(:with_connection).with(site, anything).and_yield(http)
+      pool.expects(:with_connection).with(site, anything).yields(http)
 
       result = subject.get('/foo')
 
@@ -179,12 +270,12 @@ describe Puppet::Network::HTTP::Connection do
 
     it "should sleep and retry if Retry-After is an Integer" do
       httpunavailable['Retry-After'] = '42'
-      allow(http).to receive(:request).and_return(httpunavailable, httpok)
+      http.stubs(:request).returns(httpunavailable).then.returns(httpok)
 
       pool = Puppet.lookup(:http_pool)
-      expect(pool).to receive(:with_connection).with(site, anything).twice.and_yield(http)
+      pool.expects(:with_connection).with(site, anything).twice.yields(http)
 
-      expect(::Kernel).to receive(:sleep).with(42)
+      ::Kernel.expects(:sleep).with(42)
 
       result = subject.get('/foo')
 
@@ -193,15 +284,15 @@ describe Puppet::Network::HTTP::Connection do
 
     it "should sleep and retry if Retry-After is an RFC 2822 Date" do
       httpunavailable['Retry-After'] = 'Wed, 13 Apr 2005 15:18:05 GMT'
-      allow(http).to receive(:request).and_return(httpunavailable, httpok)
+      http.stubs(:request).returns(httpunavailable).then.returns(httpok)
 
       now = DateTime.new(2005, 4, 13, 8, 17, 5, '-07:00')
-      allow(DateTime).to receive(:now).and_return(now)
+      DateTime.stubs(:now).returns(now)
 
       pool = Puppet.lookup(:http_pool)
-      expect(pool).to receive(:with_connection).with(site, anything).twice.and_yield(http)
+      pool.expects(:with_connection).with(site, anything).twice.yields(http)
 
-      expect(::Kernel).to receive(:sleep).with(60)
+      ::Kernel.expects(:sleep).with(60)
 
       result = subject.get('/foo')
 
@@ -210,13 +301,13 @@ describe Puppet::Network::HTTP::Connection do
 
     it "should sleep for no more than the Puppet runinterval" do
       httpunavailable['Retry-After'] = '60'
-      allow(http).to receive(:request).and_return(httpunavailable, httpok)
+      http.stubs(:request).returns(httpunavailable).then.returns(httpok)
       Puppet[:runinterval] = 30
 
       pool = Puppet.lookup(:http_pool)
-      expect(pool).to receive(:with_connection).with(site, anything).twice.and_yield(http)
+      pool.expects(:with_connection).with(site, anything).twice.yields(http)
 
-      expect(::Kernel).to receive(:sleep).with(30)
+      ::Kernel.expects(:sleep).with(30)
 
       subject.get('/foo')
     end
@@ -253,17 +344,17 @@ describe Puppet::Network::HTTP::Connection do
   end
 
   def expect_request_with_basic_auth
-    expect_any_instance_of(Net::HTTP).to receive(:request) do |_, request|
+    Net::HTTP.any_instance.expects(:request).with do |request|
       expect(request['authorization']).to match(/^Basic/)
-    end.and_return(httpok)
+    end.returns(httpok)
   end
 
   it "sets HTTP User-Agent header" do
     puppet_ua = "Puppet/#{Puppet.version} Ruby/#{RUBY_VERSION}-p#{RUBY_PATCHLEVEL} (#{RUBY_PLATFORM})"
 
-    expect_any_instance_of(Net::HTTP).to receive(:request) do |_, request|
+    Net::HTTP.any_instance.expects(:request).with do |request|
       expect(request['User-Agent']).to eq(puppet_ua)
-    end.and_return(httpok)
+    end.returns(httpok)
 
     subject.get('/path')
   end