puppet 6.11.1 → 6.16.0

data/spec/integration/util/windows/adsi_spec.rb

@@ -82,6 +82,9 @@ describe Puppet::Util::Windows::ADSI::Group,
     it 'should return a list of members resolvable with Puppet::Util::Windows::ADSI::Group.name_sid_hash' do
       temp_groupname = "g#{SecureRandom.uuid}"
       temp_username  = "u#{SecureRandom.uuid}"[0..12]
+      # From https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/password-must-meet-complexity-requirements
+      specials = "~!@#$%^&*_-+=`|\(){}[]:;\"'<>,.?/"
+      temp_password = "p#{SecureRandom.uuid[0..7]}-#{SecureRandom.uuid.upcase[0..7]}-#{specials[rand(specials.length)]}"
 
       # select a virtual account that requires an authority to be able to resolve to SID
       # the Dhcp service is chosen for no particular reason aside from it's a service available on all Windows versions
@@ -110,6 +113,8 @@ describe Puppet::Util::Windows::ADSI::Group,
       begin
         # :SidTypeUser as user on localhost, can be resolved with or without authority prefix
         user = Puppet::Util::Windows::ADSI::User.create(temp_username)
+        # appveyor sometimes requires a password
+        user.password = temp_password
         user.commit()
         users.push({ :sid => user.sid.sid, :name => Puppet::Util::Windows::ADSI.computer_name + '\\' + temp_username })
 
@@ -160,7 +165,7 @@ describe Puppet::Util::Windows::ADSI::Group,
 
       # unresolvable SID
       expect(admins.members[1].sid).to eq('S-1-5-21-3661721861-956923663-2119435483-1112')
-      expect(admins.members[1].account).to eq('S-1-5-21-3661721861-956923663-2119435483-1112 (unresolvable)')
+      expect(admins.members[1].account).to eq('S-1-5-21-3661721861-956923663-2119435483-1112')
       expect(admins.members[1].account_type).to eq(:SidTypeUnknown)
     end
 

data/spec/lib/puppet/test_ca.rb

@@ -21,9 +21,9 @@ module Puppet
       id
     end
 
-    def initialize
+    def initialize(name = 'Test CA')
       @digest = OpenSSL::Digest::SHA256.new
-      info = create_cacert('Test CA')
+      info = create_cacert(name)
       @key = info[:private_key]
       @ca_cert = info[:cert]
       @ca_crl = create_crl(@ca_cert, @key)

data/spec/lib/puppet_spec/https.rb

@@ -6,25 +6,36 @@ class PuppetSpec::HTTPSServer
 
   attr_reader :ca_cert, :ca_crl, :server_cert, :server_key
 
-  def initialize
-    @ca_cert = cert_fixture('ca.pem')
-    @ca_crl = crl_fixture('crl.pem')
-    @server_key = key_fixture('127.0.0.1-key.pem')
-    @server_cert = cert_fixture('127.0.0.1.pem')
+  def initialize(ca_cert: nil, ca_crl: nil, server_key: nil, server_cert: nil)
+    @ca_cert = ca_cert || cert_fixture('ca.pem')
+    @ca_crl = ca_crl || crl_fixture('crl.pem')
+    @server_key = server_key || key_fixture('127.0.0.1-key.pem')
+    @server_cert = server_cert || cert_fixture('127.0.0.1.pem')
     @config = WEBrick::Config::HTTP.dup
   end
 
-  def handle_request(ctx, ssl)
+  def handle_request(ctx, ssl, response_proc)
     req = WEBrick::HTTPRequest.new(@config)
     req.parse(ssl)
 
+    # always drain request body
+    req.body
+
     res = WEBrick::HTTPResponse.new(@config)
     res.status = 200
     res.body = 'OK'
+    # The server explicitly closes the connection after handling it,
+    # so explicitly tell the client we're not going to keep it open.
+    # Without this, ruby will add `Connection: Keep-Alive`, which
+    # confuses the client when it tries to reuse the half-closed
+    # connection.
+    res['Connection'] = 'close'
+    response_proc.call(req, res) if response_proc
+
     res.send_response(ssl)
   end
 
-  def start_server(ctx_proc: nil, &block)
+  def start_server(ctx_proc: nil, response_proc: nil, &block)
     errors = []
 
     IO.pipe {|stop_pipe_r, stop_pipe_w|
@@ -50,11 +61,11 @@ class PuppetSpec::HTTPSServer
 
               loop do
                 readable, = IO.select([ssls, stop_pipe_r])
-                break if readable.include? stop_pipe_r
+                break if readable.include?(stop_pipe_r)
 
                 ssl = ssls.accept
                 begin
-                  handle_request(ctx, ssl)
+                  handle_request(ctx, ssl, response_proc)
                 ensure
                   ssl.close
                 end

data/spec/lib/puppet_spec/puppetserver.rb

@@ -0,0 +1,119 @@
+require 'spec_helper'
+require 'webrick'
+require "webrick/ssl"
+
+class PuppetSpec::Puppetserver
+  include PuppetSpec::Fixtures
+  include PuppetSpec::Files
+
+  attr_reader :ca_cert, :ca_crl, :server_cert, :server_key
+
+  class NodeServlet < WEBrick::HTTPServlet::AbstractServlet
+    def do_GET request, response
+      node = Puppet::Node.new(Puppet[:certname])
+      response.body = node.render(:json)
+      response['Content-Type'] = 'application/json'
+    end
+  end
+
+  class CatalogServlet < WEBrick::HTTPServlet::AbstractServlet
+    def do_POST request, response
+      response['Content-Type'] = 'application/json'
+      catalog = Puppet::Resource::Catalog.new(Puppet[:certname], 'production')
+      response.body = catalog.render(:json)
+    end
+  end
+
+  class FileMetadatasServlet < WEBrick::HTTPServlet::AbstractServlet
+    def do_GET request, response
+      response['Content-Type'] = 'application/json'
+      response.body = "[{\"path\":\"/etc/puppetlabs/code/environments/production/modules\",\"relative_path\":\".\",\"links\":\"follow\",\"owner\":0,\"group\":0,\"mode\":493,\"checksum\":{\"type\":\"ctime\",\"value\":\"{ctime}2020-03-06 20:14:25 UTC\"},\"type\":\"directory\",\"destination\":null}]"
+    end
+  end
+
+  class ReportServlet < WEBrick::HTTPServlet::AbstractServlet
+    def do_PUT request, response
+      response['Content-Type'] = 'application/json'
+      response.body = "[]"
+    end
+  end
+
+  class StaticFileContentServlet < WEBrick::HTTPServlet::AbstractServlet
+    def do_GET request, response
+      response.status = 404
+    end
+  end
+
+  class FilebucketServlet < WEBrick::HTTPServlet::AbstractServlet
+    def do_GET request, response
+    end
+    def do_PUT request, response
+      response['Content-Type'] = 'application/octet-stream'
+    end
+    def do_HEAD request, response
+      response.status = 404
+    end
+  end
+
+  def initialize
+    @ca_cert = cert_fixture('ca.pem')
+    @ca_crl = crl_fixture('crl.pem')
+    @server_key = key_fixture('127.0.0.1-key.pem')
+    @server_cert = cert_fixture('127.0.0.1.pem')
+    @path = tmpfile('webrick')
+
+    @https = WEBrick::HTTPServer.new(
+      BindAddress: "127.0.0.1",
+      Port: 0, # webrick will choose the first available port, and set it in the config
+      SSLEnable: true,
+      SSLStartImmediately: true,
+      SSLCACertificateFile: File.join(PuppetSpec::FIXTURE_DIR, 'ssl', 'ca.pem'),
+      SSLCertificate: @server_cert,
+      SSLPrivateKey: @server_key,
+      Logger: WEBrick::Log.new(@path),
+      AccessLog: [
+        [@path, WEBrick::AccessLog::COMBINED_LOG_FORMAT],
+      ]
+    )
+
+    trap('INT') do
+      @https.shutdown
+    end
+
+    # Enable this line for more detailed webrick logging
+    # @https.logger.level = 5 # DEBUG
+  end
+
+  def start_server(mounts: {}, &block)
+    register_mounts(mounts: mounts)
+
+    Thread.new do
+      @https.start
+    end
+
+    begin
+      yield @https.config[:Port]
+    ensure
+      @https.shutdown
+    end
+  end
+
+  def register_mounts(mounts: {})
+    register_mount('/status/v1/simple/master', proc { |req, res|  }, nil)
+    register_mount('/puppet/v3/node', mounts[:node], NodeServlet)
+    register_mount('/puppet/v3/catalog', mounts[:catalog], CatalogServlet)
+    register_mount('/puppet/v3/file_metadatas', mounts[:file_metadatas], FileMetadatasServlet)
+    register_mount('/puppet/v3/static_file_content', mounts[:static_file_content], StaticFileContentServlet)
+    register_mount('/puppet/v3/report', mounts[:report], ReportServlet)
+    register_mount('/puppet/v3/file_bucket_file', mounts[:filebucket], FilebucketServlet)
+  end
+
+  def register_mount(path, user_proc, default_servlet)
+    handler = if user_proc
+                WEBrick::HTTPServlet::ProcHandler.new(user_proc)
+              else
+                default_servlet
+              end
+    @https.mount(path, handler)
+  end
+end

data/spec/shared_contexts/https.rb

@@ -0,0 +1,29 @@
+require 'spec_helper'
+
+RSpec.shared_context('https client') do
+  before :all do
+    WebMock.disable!
+  end
+
+  after :all do
+    WebMock.enable!
+  end
+
+  before :each do
+    # make sure we don't take too long
+    Puppet[:http_connect_timeout] = '5s'
+    Puppet[:server] = '127.0.0.1'
+    Puppet[:certname] = '127.0.0.1'
+
+    Puppet[:localcacert] = File.join(PuppetSpec::FIXTURE_DIR, 'ssl', 'ca.pem')
+    Puppet[:hostcrl] = File.join(PuppetSpec::FIXTURE_DIR, 'ssl', 'crl.pem')
+    Puppet[:hostprivkey] = File.join(PuppetSpec::FIXTURE_DIR, 'ssl', '127.0.0.1-key.pem')
+    Puppet[:hostcert] = File.join(PuppetSpec::FIXTURE_DIR, 'ssl', '127.0.0.1.pem')
+
+    # set in memory facts since certname is changed above
+    facts = Puppet::Node::Facts.new(Puppet[:certname])
+    Puppet::Node::Facts.indirection.save(facts)
+  end
+
+  let(:https_server) { PuppetSpec::HTTPSServer.new }
+end

data/spec/spec_helper.rb

@@ -159,10 +159,14 @@ RSpec.configure do |config|
     Puppet::Test::TestHelper.before_each_test()
   end
 
+  # Facter 2 uses two versions of the GCE API, so match using regex
+  PUPPET_FACTER_2_GCE_URL = %r{^http://metadata/computeMetadata/v1(beta1)?}.freeze
+  PUPPET_FACTER_3_GCE_URL = "http://metadata.google.internal/computeMetadata/v1/?recursive=true&alt=json".freeze
+
   config.around :each do |example|
     # Ignore requests from Facter GCE fact in Travis
-    stub_request(:get, "http://metadata/computeMetadata/v1beta1/?alt=json&recursive=true") # facter 2
-    stub_request(:get, "http://metadata.google.internal/computeMetadata/v1/?recursive=true&alt=json") # facter 3
+    stub_request(:get, PUPPET_FACTER_2_GCE_URL)
+    stub_request(:get, PUPPET_FACTER_3_GCE_URL)
 
     # Enable VCR if the example is tagged with `:vcr` metadata.
     if example.metadata[:vcr]

data/spec/unit/agent_spec.rb

@@ -179,37 +179,78 @@ describe Puppet::Agent do
       expect(@agent.run).to eq(:result)
     end
 
+    describe "and a puppet agent is already running" do
+      before(:each) do
+        allow_any_instance_of(Object).to receive(:sleep)
+        lockfile = double('lockfile')
+        expect(@agent).to receive(:lockfile).and_return(lockfile).at_least(:once)
+        # so the lock method raises Puppet::LockError
+        allow(lockfile).to receive(:lock).and_return(false)
+      end
+
+      it "should notify that a run is already in progres" do
+        client = AgentTestClient.new
+        expect(AgentTestClient).to receive(:new).and_return(client)
+        expect(Puppet).to receive(:notice).with(/Run of .* already in progress; skipping .* exists/)
+        @agent.run
+      end
+
+      it "should inform that a run is already in progres and try to run every X seconds if waitforlock is used" do
+        # so the locked file exists
+        allow(File).to receive(:file?).and_return(true)
+        # so we don't have to wait again for the run to exit (default maxwaitforcert is 60)
+        # first 0 is to get the time, second 0 is to inform user, then 1000 so the time expires
+        allow(Time).to receive(:now).and_return(0, 0, 1000)
+        allow(Puppet).to receive(:info)
+        client = AgentTestClient.new
+        expect(AgentTestClient).to receive(:new).and_return(client)
+
+        Puppet[:waitforlock] = 1
+        Puppet[:maxwaitforlock] = 2
+        expect(Puppet).to receive(:info).with(/Another puppet instance is already running; --waitforlock flag used, waiting for running instance to finish./)
+        expect(Puppet).to receive(:info).with(/Will try again in #{Puppet[:waitforlock]} seconds./)
+        @agent.run
+      end
+
+      it "should notify that the run is exiting if waitforlock is used and maxwaitforlock is exceeded" do
+        # so we don't have to wait again for the run to exit (default maxwaitforcert is 60)
+        # first 0 is to get the time, then 1000 so that the time expires
+        allow(Time).to receive(:now).and_return(0, 1000)
+        client = AgentTestClient.new
+        expect(AgentTestClient).to receive(:new).and_return(client)
+
+        Puppet[:waitforlock] = 1
+        expect(Puppet).to receive(:notice).with(/Exiting now because the maxwaitforlock timeout has been exceeded./)
+        @agent.run
+      end
+    end
+    
     describe "when should_fork is true", :if => Puppet.features.posix? && RUBY_PLATFORM != 'java' do
       before do
         @agent = Puppet::Agent.new(AgentTestClient, true)
 
         # So we don't actually try to hit the filesystem.
         allow(@agent).to receive(:lock).and_yield
-
-        allow(Kernel).to receive(:fork)
-        allow(Process).to receive(:waitpid2).and_return([123, double('process::status', :exitstatus => 0)])
-        allow(@agent).to receive(:exit)
       end
 
       it "should run the agent in a forked process" do
         client = AgentTestClient.new
         expect(AgentTestClient).to receive(:new).and_return(client)
 
-        expect(client).to receive(:run)
+        expect(client).to receive(:run).and_return(0)
 
         expect(Kernel).to receive(:fork).and_yield
-        @agent.run
+        expect { @agent.run }.to exit_with(0)
       end
 
       it "should exit child process if child exit" do
         client = AgentTestClient.new
         expect(AgentTestClient).to receive(:new).and_return(client)
 
-        expect(client).to receive(:run).and_raise(SystemExit)
+        expect(client).to receive(:run).and_raise(SystemExit.new(-1))
 
         expect(Kernel).to receive(:fork).and_yield
-        expect(@agent).to receive(:exit).with(-1)
-        @agent.run
+        expect { @agent.run }.to exit_with(-1)
       end
 
       it 'should exit with 1 if an exception is raised' do
@@ -219,31 +260,44 @@ describe Puppet::Agent do
         expect(client).to receive(:run).and_raise(StandardError)
 
         expect(Kernel).to receive(:fork).and_yield
-        expect(@agent).to receive(:exit).with(1)
-        @agent.run
+        expect { @agent.run }.to exit_with(1)
       end
 
-      it "should re-raise exit happening in the child" do
-        allow(Process).to receive(:waitpid2).and_return([123, double('process::status', :exitstatus => -1)])
-        expect { @agent.run }.to raise_error(SystemExit)
+      it 'should exit with 254 if NoMemoryError exception is raised' do
+        client = AgentTestClient.new
+        expect(AgentTestClient).to receive(:new).and_return(client)
+
+        expect(client).to receive(:run).and_raise(NoMemoryError)
+
+        expect(Kernel).to receive(:fork).and_yield
+        expect { @agent.run }.to exit_with(254)
       end
 
-      it "should re-raise NoMoreMemory happening in the child" do
-        allow(Process).to receive(:waitpid2).and_return([123, double('process::status', :exitstatus => -2)])
-        expect { @agent.run }.to raise_error(NoMemoryError)
+      it "should return the block exit code as the child exit code" do
+        expect(Kernel).to receive(:fork).and_yield
+        expect {
+          @agent.run_in_fork {
+            777
+          }
+        }.to exit_with(777)
       end
 
-      it "should return the child exit code" do
-        allow(Process).to receive(:waitpid2).and_return([123, double('process::status', :exitstatus => 777)])
-        expect(@agent.run).to eq(777)
+      it "should return `1` exit code if the block returns `nil`" do
+        expect(Kernel).to receive(:fork).and_yield
+        expect {
+          @agent.run_in_fork {
+            nil
+          }
+        }.to exit_with(1)
       end
 
-      it "should return the block exit code as the child exit code" do
+      it "should return `1` exit code if the block returns `false`" do
         expect(Kernel).to receive(:fork).and_yield
-        expect(@agent).to receive(:exit).with(777)
-        @agent.run_in_fork {
-          777
-        }
+        expect {
+          @agent.run_in_fork {
+            false
+          }
+        }.to exit_with(1)
       end
     end
 
@@ -283,7 +337,7 @@ describe Puppet::Agent do
         expect(client).not_to receive(:handling)
         expect(Puppet).to receive(:log_exception).with(be_an_instance_of(Puppet::Agent::RunTimeoutError), anything)
 
-        expect(@agent.run).to eq(1)
+        expect(@agent.run).to eq(nil)
       end
     end
   end

data/spec/unit/application/agent_spec.rb

@@ -12,16 +12,16 @@ describe Puppet::Application::Agent do
   before :each do
     @puppetd = Puppet::Application[:agent]
 
-    @daemon = Puppet::Daemon.new(nil)
+    @agent = double('agent')
+    allow(Puppet::Agent).to receive(:new).and_return(@agent)
+
+    @daemon = Puppet::Daemon.new(@agent, nil)
     allow(@daemon).to receive(:daemonize)
     allow(@daemon).to receive(:start)
     allow(@daemon).to receive(:stop)
     allow(Puppet::Daemon).to receive(:new).and_return(@daemon)
     Puppet[:daemonize] = false
 
-    @agent = double('agent')
-    allow(Puppet::Agent).to receive(:new).and_return(@agent)
-
     @puppetd.preinit
     allow(Puppet::Util::Log).to receive(:newdestination)
 
@@ -122,6 +122,10 @@ describe Puppet::Application::Agent do
       end
     end
 
+    it "should log the agent start time" do
+      expect(@puppetd.options[:start_time]).to be_a(Time)
+    end
+
     it "should set waitforcert to 0 with --onetime and if --waitforcert wasn't given" do
       allow(@agent).to receive(:run).and_return(2)
       Puppet[:onetime] = true
@@ -505,7 +509,7 @@ describe Puppet::Application::Agent do
 
       it "should run the agent with the supplied job_id" do
         @puppetd.options[:job_id] = 'special id'
-        expect(@agent).to receive(:run).with(:job_id => 'special id').and_return(:report)
+        expect(@agent).to receive(:run).with(hash_including(:job_id => 'special id')).and_return(:report)
 
         expect { execute_agent }.to exit_with 0
       end