puppet 6.11.1 → 6.16.0

data/spec/integration/http/client_spec.rb

@@ -0,0 +1,154 @@
+require 'spec_helper'
+require 'puppet_spec/https'
+require 'puppet_spec/files'
+
+describe Puppet::HTTP::Client, unless: Puppet::Util::Platform.jruby? do
+  include PuppetSpec::Files
+  include_context "https client"
+
+  let(:wrong_hostname) { 'localhost' }
+  let(:client) { Puppet::HTTP::Client.new }
+  let(:ssl_provider) { Puppet::SSL::SSLProvider.new }
+  let(:root_context) { ssl_provider.create_root_context(cacerts: [https_server.ca_cert], crls: [https_server.ca_crl]) }
+
+  context "when verifying an HTTPS server" do
+    it "connects over SSL" do
+      https_server.start_server do |port|
+        res = client.get(URI("https://127.0.0.1:#{port}"), options: {ssl_context: root_context})
+        expect(res).to be_success
+      end
+    end
+
+    it "raises connection error if we can't connect" do
+      Puppet[:http_connect_timeout] = '0s'
+
+      # get available port, but don't bind to it
+      tcps = TCPServer.new("127.0.0.1", 0)
+      port = tcps.connect_address.ip_port
+
+      expect {
+        client.get(URI("https://127.0.0.1:#{port}"), options: {ssl_context: root_context})
+      }.to raise_error(Puppet::HTTP::ConnectionError, %r{^Request to https://127.0.0.1:#{port} timed out connect operation after .* seconds})
+    end
+
+    it "raises if the server's cert doesn't match the hostname we connected to" do
+      https_server.start_server do |port|
+        expect {
+          client.get(URI("https://#{wrong_hostname}:#{port}"), options: {ssl_context: root_context})
+        }.to raise_error { |err|
+          expect(err).to be_instance_of(Puppet::SSL::CertMismatchError)
+          expect(err.message).to match(/Server hostname '#{wrong_hostname}' did not match server certificate; expected one of (.+)/)
+
+          md = err.message.match(/expected one of (.+)/)
+          expect(md[1].split(', ')).to contain_exactly('127.0.0.1', 'DNS:127.0.0.1', 'DNS:127.0.0.2')
+        }
+      end
+    end
+
+    it "raises if the server's CA is unknown" do
+      wrong_ca = cert_fixture('netlock-arany-utf8.pem')
+      alt_context = ssl_provider.create_root_context(cacerts: [wrong_ca], revocation: false)
+
+      https_server.start_server do |port|
+        expect {
+          client.get(URI("https://127.0.0.1:#{port}"), options: {ssl_context: alt_context})
+        }.to raise_error(Puppet::SSL::CertVerifyError,
+                         %r{certificate verify failed.* .self signed certificate in certificate chain for CN=Test CA.})
+      end
+    end
+
+    it "prints TLS protocol and ciphersuite in debug" do
+      Puppet[:log_level] = 'debug'
+      https_server.start_server do |port|
+        client.get(URI("https://127.0.0.1:#{port}"), options: {ssl_context: root_context})
+        # TLS version string can be TLSv1 or TLSv1.[1-3], but not TLSv1.0
+        expect(@logs).to include(
+          an_object_having_attributes(level: :debug, message: /Using TLSv1(\.[1-3])? with cipher .*/),
+        )
+      end
+    end
+  end
+
+  context "with client certs" do
+    let(:ctx_proc) {
+      -> ctx {
+        # configures the server to require the client to present a client cert
+        ctx.verify_mode = OpenSSL::SSL::VERIFY_PEER | OpenSSL::SSL::VERIFY_FAIL_IF_NO_PEER_CERT
+      }
+    }
+
+    it "mutually authenticates the connection" do
+      client_context = ssl_provider.create_context(
+        cacerts: [https_server.ca_cert], crls: [https_server.ca_crl],
+        client_cert: https_server.server_cert, private_key: https_server.server_key
+      )
+
+      https_server.start_server(ctx_proc: ctx_proc) do |port|
+        res = client.get(URI("https://127.0.0.1:#{port}"), options: {ssl_context: client_context})
+        expect(res).to be_success
+      end
+    end
+  end
+
+  context "with a system trust store" do
+    it "connects when the client trusts the server's CA" do
+      system_context = ssl_provider.create_system_context(cacerts: [https_server.ca_cert])
+
+      https_server.start_server do |port|
+        res = client.get(URI("https://127.0.0.1:#{port}"), options: {ssl_context: system_context})
+        expect(res).to be_success
+      end
+    end
+
+    it "connects when the server's CA is in the system store" do
+      # create a temp cacert bundle
+      ssl_file = tmpfile('systemstore')
+      File.write(ssl_file, https_server.ca_cert)
+
+      # override path to system cacert bundle, this must be done before
+      # the SSLContext is created and the call to X509::Store.set_default_paths
+      Puppet::Util.withenv("SSL_CERT_FILE" => ssl_file) do
+        system_context = ssl_provider.create_system_context(cacerts: [])
+        https_server.start_server do |port|
+          res = client.get(URI("https://127.0.0.1:#{port}"), options: {ssl_context: system_context})
+          expect(res).to be_success
+        end
+      end
+    end
+
+    it "raises if the server's CA is not in the context or system store" do
+      system_context = ssl_provider.create_system_context(cacerts: [cert_fixture('netlock-arany-utf8.pem')])
+
+      https_server.start_server do |port|
+        expect {
+          client.get(URI("https://127.0.0.1:#{port}"), options: {ssl_context: system_context})
+        }.to raise_error(Puppet::SSL::CertVerifyError,
+                         %r{certificate verify failed.* .self signed certificate in certificate chain for CN=Test CA.})
+      end
+    end
+  end
+
+  context 'persistent connections' do
+    it "detects when the server has closed the connection and reconnects" do
+      Puppet[:http_debug] = true
+
+      # advertise that we support keep-alive, but we don't really
+      response_proc = -> (req, res) {
+        res['Connection'] = 'Keep-Alive'
+      }
+
+      https_server.start_server(response_proc: response_proc) do |port|
+        uri = URI("https://127.0.0.1:#{port}")
+        kwargs = {headers: {'Content-Type' => 'text/plain'}, options: {ssl_context: root_context}}
+
+        expect {
+          expect(client.post(uri, '', **kwargs)).to be_success
+          # the server closes its connection after each request, so posting
+          # again will force ruby to detect that the remote side closed the
+          # connection, and reconnect
+          expect(client.post(uri, '', **kwargs)).to be_success
+        }.to output(/Conn close because of EOF/).to_stderr
+      end
+    end
+  end
+end

data/spec/integration/indirector/facts/facter_spec.rb

@@ -7,6 +7,10 @@ describe Puppet::Node::Facts::Facter do
   include PuppetSpec::Files
   include PuppetSpec::Compiler
 
+  before :each do
+    Puppet::Node::Facts.indirection.terminus_class = :facter
+  end
+
   it "preserves case in fact values" do
     Facter.add(:downcase_test) do
       setcode do

data/spec/integration/indirector/report/yaml.rb

@@ -0,0 +1,83 @@
+require 'spec_helper'
+
+require 'puppet/transaction/report'
+require 'puppet/indirector/report/yaml'
+
+describe Puppet::Transaction::Report::Yaml do
+  describe '#save' do
+    subject(:indirection) { described_class.indirection }
+
+    let(:request) { described_class.new }
+    let(:certname) { 'ziggy' }
+    let(:report) do
+      report = Puppet::Transaction::Report.new
+      report.host = certname
+      report
+    end
+    let(:file) { request.path(:me) }
+
+    before do
+      indirection.terminus_class = :yaml
+    end
+
+    it 'is saves a report' do
+      indirection.save(report)
+    end
+
+    it 'saves the instance of the report as YAML to disk' do
+      indirection.save(report)
+      content = Puppet::Util::Yaml.safe_load_file(
+        Puppet[:lastrunreport], [Puppet::Transaction::Report]
+      )
+      expect(content.host).to eq(certname)
+    end
+
+    it 'allows mode overwrite' do
+      Puppet.settings.setting(:lastrunreport).mode = '0644'
+      indirection.save(report)
+
+      if Puppet::Util::Platform.windows?
+        require 'puppet/util/windows/security'
+        mode = Puppet::Util::Windows::Security.get_mode(file)
+      else
+        mode = Puppet::FileSystem.stat(file).mode
+      end
+
+      expect(mode & 07777).to eq(0644)
+    end
+
+    context 'when mode is invalid' do
+      before do
+        Puppet.settings.setting(:lastrunreport).mode = '9999'
+      end
+
+      after do
+        Puppet.settings.setting(:lastrunreport).mode = '0644'
+      end
+
+      it 'raises Puppet::DevError ' do
+        expect{
+          indirection.save(report)
+        }.to raise_error(Puppet::DevError, "replace_file mode: 9999 is invalid")
+      end
+    end
+
+    context 'when repport is invalid' do
+      it 'logs error' do
+        expect(Puppet).to receive(:send_log).with(:err, /Could not save yaml ziggy: can't dump anonymous class/)
+
+        report.configuration_version = Class.new
+        indirection.save(report)
+      end
+    end
+
+    context 'when report cannot be saved' do
+      it 'raises Errno::EISDIR' do
+        FileUtils.mkdir_p(file)
+        expect {
+          indirection.save(report)
+         }.to raise_error(Errno::EISDIR, /last_run_report.yaml/)
+      end
+    end
+  end
+end

data/spec/integration/module_tool/forge_spec.rb

@@ -0,0 +1,51 @@
+require 'spec_helper'
+require 'puppet/forge'
+require 'puppet_spec/https'
+
+describe Puppet::Forge, unless: Puppet::Util::Platform.jruby? do
+  include PuppetSpec::Files
+  include_context "https client"
+
+  let(:wrong_hostname) { 'localhost' }
+  let(:server) { PuppetSpec::HTTPSServer.new }
+  let(:ssl_provider) { Puppet::SSL::SSLProvider.new }
+
+  let(:http_response) do
+    File.read(fixtures('unit/forge/bacula.json'))
+  end
+
+  let(:release_response) do
+    releases = JSON.parse(http_response)
+    releases['results'] = []
+    JSON.dump(releases)
+  end
+
+  it 'fetching module release entries' do
+    # create a temp cacert bundle
+    ssl_file = tmpfile('systemstore')
+    File.write(ssl_file, server.ca_cert)
+
+    # override path to system cacert bundle, this must be done before
+    # the SSLContext is created and the call to X509::Store.set_default_paths
+    Puppet::Util.withenv("SSL_CERT_FILE" => ssl_file) do
+      response_proc = -> (req, res) {
+        res.status = 200
+        res.body = release_response
+      }
+
+      server.start_server(response_proc: response_proc) do |port|
+        forge = described_class.new("https://127.0.0.1:#{port}")
+        forge.fetch('bacula')
+      end
+    end
+  end
+
+  it 'returns a valid exception when there is an SSL verification problem' do
+    server.start_server do |port|
+      forge = described_class.new("https://#{wrong_hostname}:#{port}")
+      expect {
+        forge.fetch('mymodule')
+      }.to raise_error Puppet::Forge::Errors::SSLVerifyError, %r{^Unable to verify the SSL certificate at https://#{wrong_hostname}}
+    end
+  end
+end

data/spec/integration/network/http_pool_spec.rb

@@ -24,14 +24,6 @@ describe Puppet::Network::HttpPool, unless: Puppet::Util::Platform.jruby? do
   let(:server) { PuppetSpec::HTTPSServer.new }
 
   context "when calling deprecated HttpPool methods" do
-    let(:ssl_host) {
-      # use server's cert/key as the client cert/key
-      host = Puppet::SSL::Host.new
-      host.key = Puppet::SSL::Key.from_instance(server.server_key, host.name)
-      host.certificate = Puppet::SSL::Certificate.from_instance(server.server_cert, host.name)
-      host
-    }
-
     before(:each) do
       ssldir = tmpdir('http_pool')
       Puppet[:ssldir] = ssldir
@@ -43,16 +35,6 @@ describe Puppet::Network::HttpPool, unless: Puppet::Util::Platform.jruby? do
       File.write(Puppet[:hostprivkey], server.server_key.to_pem)
     end
 
-    # Can't use `around(:each)` because it will cause ssl_host to be
-    # created outside of any rspec example, and $confdir won't be set
-    before(:each) do
-      Puppet.push_context(ssl_host: ssl_host)
-    end
-
-    after (:each) do
-      Puppet.pop_context
-    end
-
     def connection(host, port)
       Puppet::Network::HttpPool.http_instance(host, port, use_ssl: true)
     end
@@ -98,8 +80,26 @@ describe Puppet::Network::HttpPool, unless: Puppet::Util::Platform.jruby? do
                            %r{certificate verify failed.* .self signed certificate in certificate chain for CN=Test CA.})
         end
       end
-    end
 
+      it "doesn't generate a Puppet::SSL::Host deprecation warning" do
+        server.start_server do |port|
+          http = connection(hostname, port)
+          res = http.get('/')
+          expect(res.code).to eq('200')
+        end
+
+        expect(@logs).to eq([])
+      end
+
+      it "detects when the server has closed the connection and reconnects" do
+        server.start_server do |port|
+          http = connection(hostname, port)
+
+          expect(http.request_get('/')).to be_a(Net::HTTPSuccess)
+          expect(http.request_get('/')).to be_a(Net::HTTPSuccess)
+        end
+      end
+    end
 
     context "when using single use HTTPS connections" do
       include_examples 'HTTPS client'
@@ -107,7 +107,7 @@ describe Puppet::Network::HttpPool, unless: Puppet::Util::Platform.jruby? do
 
     context "when using persistent HTTPS connections" do
       around :each do |example|
-        pool = Puppet::Network::HTTP::Pool.new
+        pool = Puppet::Network::HTTP::Pool.new(15)
         Puppet.override(:http_pool => pool) do
           example.run
         end
@@ -116,6 +116,62 @@ describe Puppet::Network::HttpPool, unless: Puppet::Util::Platform.jruby? do
 
       include_examples 'HTTPS client'
     end
+
+    shared_examples_for "an HttpPool connection" do |klass, legacy_api|
+      before :each do
+        Puppet::Network::HttpPool.http_client_class = klass
+      end
+
+      it "connects using the scheme, host and port from the http instance" do
+        request_line = nil
+
+        response_proc = -> (req, res) {
+          request_line = req.request_line
+        }
+
+        server.start_server(response_proc: response_proc) do |port|
+          http = Puppet::Network::HttpPool.http_instance(hostname, port, true)
+          path  = "http://bogus.example.com:443/foo"
+          http.get(path)
+
+          if legacy_api
+            # The old API passed the bogus hostname which didn't match
+            # the host we connected to.
+            expect(request_line).to eq("GET http://bogus.example.com:443/foo HTTP/1.1\r\n")
+          else
+            expect(request_line).to eq("GET /foo HTTP/1.1\r\n")
+          end
+        end
+      end
+
+      it "requires the caller to URL encode the path" do
+        request_line = nil
+
+        response_proc = -> (req, res) {
+          request_line = req.request_line
+        }
+
+        server.start_server(response_proc: response_proc) do |port|
+          http = Puppet::Network::HttpPool.http_instance(hostname, port, true)
+          encoded_url = "https://#{hostname}:#{port}/foo%20bar"
+          http.get(encoded_url)
+
+          if legacy_api
+            expect(request_line).to eq("GET #{encoded_url} HTTP/1.1\r\n")
+          else
+            expect(request_line).to eq("GET /foo%20bar HTTP/1.1\r\n")
+          end
+        end
+      end
+    end
+
+    describe Puppet::Network::HTTP::Connection do
+      it_behaves_like "an HttpPool connection", described_class, true
+    end
+
+    describe Puppet::Network::HTTP::ConnectionAdapter do
+      it_behaves_like "an HttpPool connection", described_class, false
+    end
   end
 
   context "when calling HttpPool.connection method" do

data/spec/integration/node/environment_spec.rb

@@ -76,6 +76,21 @@ describe Puppet::Node::Environment do
     expect(mods[0].path).to eq(File.join(base, "dir1", "mod"))
   end
 
+  it "should not yield a module with the same name as a defined Bolt project" do
+    project_path = File.join(tmpfile('project'), 'bolt_project')
+    FileUtils.mkdir_p(project_path)
+    project = Struct.new("Project", :name, :path).new('project', project_path)
+
+    Puppet.override(bolt_project: project) do
+      base = tmpfile("base")
+      FileUtils.mkdir_p([File.join(base, 'project'), File.join(base, 'other')])
+      environment = Puppet::Node::Environment.create(:env, [base])
+      mods = environment.modules
+      expect(mods.length).to eq(2)
+      expect(mods.map(&:path)).to eq([project_path, File.join(base, 'other')])
+    end
+  end
+
   shared_examples_for "the environment's initial import" do |settings|
     it "a manifest referring to a directory invokes parsing of all its files in sorted order" do
       settings.each do |name, value|