puppet 6.12.0-universal-darwin → 6.17.0-universal-darwin

data/spec/integration/parser/compiler_spec.rb

@@ -834,6 +834,17 @@ describe Puppet::Parser::Compiler do
           MANIFEST
         end.to raise_error(/Foo\[bar\]:\s+parameter 'a' expects a value for key 'd'\s+parameter 'a' unrecognized key 'c'/m)
       end
+
+      it 'handles Sensitive type in resource array' do
+        catalog = compile_to_catalog(<<-MANIFEST)
+          define foo(Sensitive[String] $password) {
+            notify{ "${title}": message => "${password}" }
+          }
+          foo { ['testA', 'testB']: password =>Sensitive('some password') }
+        MANIFEST
+        expect(catalog).to have_resource("Notify[testA]").with_parameter(:message, 'Sensitive [value redacted]')
+        expect(catalog).to have_resource("Notify[testB]").with_parameter(:message, 'Sensitive [value redacted]')
+      end
     end
 
     context 'when using typed parameters in class' do

data/spec/integration/type/file_spec.rb

@@ -1160,7 +1160,7 @@ describe Puppet::Type.type(:file), :uses_checksums => true do
       source_prefix = Puppet::Util::Platform.windows? ? '/' : ''
 
       # the URI can be round-tripped through unescape
-      expect(URI.unescape(uri_path)).to eq(source_prefix + source)
+      expect(Puppet::Util.uri_unescape(uri_path)).to eq(source_prefix + source)
       # and is properly UTF-8
       expect(uri_path.encoding).to eq (Encoding::UTF_8)
 

data/spec/integration/util/windows/adsi_spec.rb

@@ -82,6 +82,9 @@ describe Puppet::Util::Windows::ADSI::Group,
     it 'should return a list of members resolvable with Puppet::Util::Windows::ADSI::Group.name_sid_hash' do
       temp_groupname = "g#{SecureRandom.uuid}"
       temp_username  = "u#{SecureRandom.uuid}"[0..12]
+      # From https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/password-must-meet-complexity-requirements
+      specials = "~!@#$%^&*_-+=`|\(){}[]:;\"'<>,.?/"
+      temp_password = "p#{SecureRandom.uuid[0..7]}-#{SecureRandom.uuid.upcase[0..7]}-#{specials[rand(specials.length)]}"
 
       # select a virtual account that requires an authority to be able to resolve to SID
       # the Dhcp service is chosen for no particular reason aside from it's a service available on all Windows versions
@@ -110,6 +113,8 @@ describe Puppet::Util::Windows::ADSI::Group,
       begin
         # :SidTypeUser as user on localhost, can be resolved with or without authority prefix
         user = Puppet::Util::Windows::ADSI::User.create(temp_username)
+        # appveyor sometimes requires a password
+        user.password = temp_password
         user.commit()
         users.push({ :sid => user.sid.sid, :name => Puppet::Util::Windows::ADSI.computer_name + '\\' + temp_username })
 
@@ -160,7 +165,7 @@ describe Puppet::Util::Windows::ADSI::Group,
 
       # unresolvable SID
       expect(admins.members[1].sid).to eq('S-1-5-21-3661721861-956923663-2119435483-1112')
-      expect(admins.members[1].account).to eq('S-1-5-21-3661721861-956923663-2119435483-1112 (unresolvable)')
+      expect(admins.members[1].account).to eq('S-1-5-21-3661721861-956923663-2119435483-1112')
       expect(admins.members[1].account_type).to eq(:SidTypeUnknown)
     end
 

data/spec/integration/util/windows/registry_spec.rb

@@ -259,23 +259,23 @@ describe Puppet::Util::Windows::Registry do
         {
           name: 'REG_SZ',
           type: Win32::Registry::REG_SZ,
-          value: "reg sz\u0000 string",
-          expected_value: "reg sz  string"
+          value: "reg sz\u0000\u0000 string",
+          expected_value: "reg sz"
         },
         {
           name: 'REG_SZ_2',
           type: Win32::Registry::REG_SZ,
-          value: "reg sz\x00 string",
-          expected_value: "reg sz  string"
+          value: "reg sz 2\x00\x00 string",
+          expected_value: "reg sz 2"
         },
         {
           name: 'REG_EXPAND_SZ',
           type: Win32::Registry::REG_EXPAND_SZ,
-          value: "\0reg expand string",
-          expected_value: " reg expand string"
+          value: "\0\0\0reg expand string",
+          expected_value: ""
         }
       ].each do |pair|
-        it 'replaces null bytes with spaces' do
+        it 'reads up to the first wide null' do
           hklm.create("#{puppet_key}\\#{subkey_name}", Win32::Registry::KEY_ALL_ACCESS) do |reg|
             reg.write(value_name, pair[:type], pair[:value])
           end

data/spec/integration/util/windows/user_spec.rb

@@ -125,19 +125,16 @@ describe "Puppet::Util::Windows::User", :if => Puppet::Util::Platform.windows? d
       end
 
       it 'should raise error given that logon returns false' do
-
         allow(Puppet::Util::Windows::User).to receive(:logon_user_by_logon_type).with(
-            user, passwd, fLOGON32_LOGON_NETWORK, fLOGON32_PROVIDER_DEFAULT, anything).and_return (0)
+            user, '.', passwd, fLOGON32_LOGON_NETWORK, fLOGON32_PROVIDER_DEFAULT, anything).and_return (0)
         allow(Puppet::Util::Windows::User).to receive(:logon_user_by_logon_type).with(
-            user, passwd, fLOGON32_LOGON_INTERACTIVE, fLOGON32_PROVIDER_DEFAULT, anything).and_return(0)
+            user, '.', passwd, fLOGON32_LOGON_INTERACTIVE, fLOGON32_PROVIDER_DEFAULT, anything).and_return(0)
 
         expect {Puppet::Util::Windows::User.logon_user(user, passwd) {}}
             .to raise_error(Puppet::Util::Windows::Error, /Failed to logon user/)
-
       end
     end
 
-
     describe "password_is?" do
       it "should return false given an incorrect username and password" do
         expect(Puppet::Util::Windows::User.password_is?(username, bad_password)).to be_falsey
@@ -180,5 +177,43 @@ describe "Puppet::Util::Windows::User", :if => Puppet::Util::Platform.windows? d
         expect { Puppet::Util::Windows::User.check_token_membership }.not_to raise_error
       end
     end
+
+    describe "default_system_account?" do
+      it "should succesfully identify 'SYSTEM' user as a default system account" do
+        allow(Puppet::Util::Windows::SID).to receive(:name_to_sid).with('SYSTEM').and_return(Puppet::Util::Windows::SID::LocalSystem)
+        expect(Puppet::Util::Windows::User.default_system_account?('SYSTEM')).to eq(true)
+      end
+
+      it "should succesfully identify 'NETWORK SERVICE' user as a default system account" do
+        allow(Puppet::Util::Windows::SID).to receive(:name_to_sid).with('NETWORK SERVICE').and_return(Puppet::Util::Windows::SID::NtNetwork)
+        expect(Puppet::Util::Windows::User.default_system_account?('NETWORK SERVICE')).to eq(true)
+      end
+
+      it "should succesfully identify 'LOCAL SERVICE' user as a default system account" do
+        allow(Puppet::Util::Windows::SID).to receive(:name_to_sid).with('LOCAL SERVICE').and_return(Puppet::Util::Windows::SID::NtLocal)
+        expect(Puppet::Util::Windows::User.default_system_account?('LOCAL SERVICE')).to eq(true)
+      end
+
+      it "should not identify user with unknown sid as a default system account" do
+        allow(Puppet::Util::Windows::SID).to receive(:name_to_sid).with('UnknownUser').and_return(Puppet::Util::Windows::SID::Null)
+        expect(Puppet::Util::Windows::User.default_system_account?('UnknownUser')).to eq(false)
+      end
+    end
+
+    describe "localsystem?" do
+      before do
+        allow(Puppet::Util::Windows::ADSI).to receive(:computer_name).and_return("myPC")
+      end
+
+      ['LocalSystem', '.\LocalSystem', 'myPC\LocalSystem', 'lOcALsysTem'].each do |input|
+        it "should succesfully identify #{input} as the 'LocalSystem' account" do
+          expect(Puppet::Util::Windows::User.localsystem?(input)).to eq(true)
+        end
+      end
+
+      it "should not identify any other user as the 'LocalSystem' account" do
+        expect(Puppet::Util::Windows::User.localsystem?('OtherUser')).to eq(false)
+      end
+    end
   end
 end

data/spec/lib/puppet/test_ca.rb

@@ -21,9 +21,9 @@ module Puppet
       id
     end
 
-    def initialize
+    def initialize(name = 'Test CA')
       @digest = OpenSSL::Digest::SHA256.new
-      info = create_cacert('Test CA')
+      info = create_cacert(name)
       @key = info[:private_key]
       @ca_cert = info[:cert]
       @ca_crl = create_crl(@ca_cert, @key)

data/spec/lib/puppet_spec/https.rb

@@ -6,11 +6,11 @@ class PuppetSpec::HTTPSServer
 
   attr_reader :ca_cert, :ca_crl, :server_cert, :server_key
 
-  def initialize
-    @ca_cert = cert_fixture('ca.pem')
-    @ca_crl = crl_fixture('crl.pem')
-    @server_key = key_fixture('127.0.0.1-key.pem')
-    @server_cert = cert_fixture('127.0.0.1.pem')
+  def initialize(ca_cert: nil, ca_crl: nil, server_key: nil, server_cert: nil)
+    @ca_cert = ca_cert || cert_fixture('ca.pem')
+    @ca_crl = ca_crl || crl_fixture('crl.pem')
+    @server_key = server_key || key_fixture('127.0.0.1-key.pem')
+    @server_cert = server_cert || cert_fixture('127.0.0.1.pem')
     @config = WEBrick::Config::HTTP.dup
   end
 
@@ -18,10 +18,19 @@ class PuppetSpec::HTTPSServer
     req = WEBrick::HTTPRequest.new(@config)
     req.parse(ssl)
 
+    # always drain request body
+    req.body
+
     res = WEBrick::HTTPResponse.new(@config)
     res.status = 200
     res.body = 'OK'
-    response_proc.call(res) if response_proc
+    # The server explicitly closes the connection after handling it,
+    # so explicitly tell the client we're not going to keep it open.
+    # Without this, ruby will add `Connection: Keep-Alive`, which
+    # confuses the client when it tries to reuse the half-closed
+    # connection.
+    res['Connection'] = 'close'
+    response_proc.call(req, res) if response_proc
 
     res.send_response(ssl)
   end
@@ -52,7 +61,7 @@ class PuppetSpec::HTTPSServer
 
               loop do
                 readable, = IO.select([ssls, stop_pipe_r])
-                break if readable.include? stop_pipe_r
+                break if readable.include?(stop_pipe_r)
 
                 ssl = ssls.accept
                 begin

data/spec/lib/puppet_spec/puppetserver.rb

@@ -0,0 +1,119 @@
+require 'spec_helper'
+require 'webrick'
+require "webrick/ssl"
+
+class PuppetSpec::Puppetserver
+  include PuppetSpec::Fixtures
+  include PuppetSpec::Files
+
+  attr_reader :ca_cert, :ca_crl, :server_cert, :server_key
+
+  class NodeServlet < WEBrick::HTTPServlet::AbstractServlet
+    def do_GET request, response
+      node = Puppet::Node.new(Puppet[:certname])
+      response.body = node.render(:json)
+      response['Content-Type'] = 'application/json'
+    end
+  end
+
+  class CatalogServlet < WEBrick::HTTPServlet::AbstractServlet
+    def do_POST request, response
+      response['Content-Type'] = 'application/json'
+      catalog = Puppet::Resource::Catalog.new(Puppet[:certname], 'production')
+      response.body = catalog.render(:json)
+    end
+  end
+
+  class FileMetadatasServlet < WEBrick::HTTPServlet::AbstractServlet
+    def do_GET request, response
+      response['Content-Type'] = 'application/json'
+      response.body = "[{\"path\":\"/etc/puppetlabs/code/environments/production/modules\",\"relative_path\":\".\",\"links\":\"follow\",\"owner\":0,\"group\":0,\"mode\":493,\"checksum\":{\"type\":\"ctime\",\"value\":\"{ctime}2020-03-06 20:14:25 UTC\"},\"type\":\"directory\",\"destination\":null}]"
+    end
+  end
+
+  class ReportServlet < WEBrick::HTTPServlet::AbstractServlet
+    def do_PUT request, response
+      response['Content-Type'] = 'application/json'
+      response.body = "[]"
+    end
+  end
+
+  class StaticFileContentServlet < WEBrick::HTTPServlet::AbstractServlet
+    def do_GET request, response
+      response.status = 404
+    end
+  end
+
+  class FilebucketServlet < WEBrick::HTTPServlet::AbstractServlet
+    def do_GET request, response
+    end
+    def do_PUT request, response
+      response['Content-Type'] = 'application/octet-stream'
+    end
+    def do_HEAD request, response
+      response.status = 404
+    end
+  end
+
+  def initialize
+    @ca_cert = cert_fixture('ca.pem')
+    @ca_crl = crl_fixture('crl.pem')
+    @server_key = key_fixture('127.0.0.1-key.pem')
+    @server_cert = cert_fixture('127.0.0.1.pem')
+    @path = tmpfile('webrick')
+
+    @https = WEBrick::HTTPServer.new(
+      BindAddress: "127.0.0.1",
+      Port: 0, # webrick will choose the first available port, and set it in the config
+      SSLEnable: true,
+      SSLStartImmediately: true,
+      SSLCACertificateFile: File.join(PuppetSpec::FIXTURE_DIR, 'ssl', 'ca.pem'),
+      SSLCertificate: @server_cert,
+      SSLPrivateKey: @server_key,
+      Logger: WEBrick::Log.new(@path),
+      AccessLog: [
+        [@path, WEBrick::AccessLog::COMBINED_LOG_FORMAT],
+      ]
+    )
+
+    trap('INT') do
+      @https.shutdown
+    end
+
+    # Enable this line for more detailed webrick logging
+    # @https.logger.level = 5 # DEBUG
+  end
+
+  def start_server(mounts: {}, &block)
+    register_mounts(mounts: mounts)
+
+    Thread.new do
+      @https.start
+    end
+
+    begin
+      yield @https.config[:Port]
+    ensure
+      @https.shutdown
+    end
+  end
+
+  def register_mounts(mounts: {})
+    register_mount('/status/v1/simple/master', proc { |req, res|  }, nil)
+    register_mount('/puppet/v3/node', mounts[:node], NodeServlet)
+    register_mount('/puppet/v3/catalog', mounts[:catalog], CatalogServlet)
+    register_mount('/puppet/v3/file_metadatas', mounts[:file_metadatas], FileMetadatasServlet)
+    register_mount('/puppet/v3/static_file_content', mounts[:static_file_content], StaticFileContentServlet)
+    register_mount('/puppet/v3/report', mounts[:report], ReportServlet)
+    register_mount('/puppet/v3/file_bucket_file', mounts[:filebucket], FilebucketServlet)
+  end
+
+  def register_mount(path, user_proc, default_servlet)
+    handler = if user_proc
+                WEBrick::HTTPServlet::ProcHandler.new(user_proc)
+              else
+                default_servlet
+              end
+    @https.mount(path, handler)
+  end
+end

data/spec/shared_contexts/https.rb

@@ -0,0 +1,29 @@
+require 'spec_helper'
+
+RSpec.shared_context('https client') do
+  before :all do
+    WebMock.disable!
+  end
+
+  after :all do
+    WebMock.enable!
+  end
+
+  before :each do
+    # make sure we don't take too long
+    Puppet[:http_connect_timeout] = '5s'
+    Puppet[:server] = '127.0.0.1'
+    Puppet[:certname] = '127.0.0.1'
+
+    Puppet[:localcacert] = File.join(PuppetSpec::FIXTURE_DIR, 'ssl', 'ca.pem')
+    Puppet[:hostcrl] = File.join(PuppetSpec::FIXTURE_DIR, 'ssl', 'crl.pem')
+    Puppet[:hostprivkey] = File.join(PuppetSpec::FIXTURE_DIR, 'ssl', '127.0.0.1-key.pem')
+    Puppet[:hostcert] = File.join(PuppetSpec::FIXTURE_DIR, 'ssl', '127.0.0.1.pem')
+
+    # set in memory facts since certname is changed above
+    facts = Puppet::Node::Facts.new(Puppet[:certname])
+    Puppet::Node::Facts.indirection.save(facts)
+  end
+
+  let(:https_server) { PuppetSpec::HTTPSServer.new }
+end

data/spec/unit/agent_spec.rb

@@ -179,37 +179,78 @@ describe Puppet::Agent do
       expect(@agent.run).to eq(:result)
     end
 
+    describe "and a puppet agent is already running" do
+      before(:each) do
+        allow_any_instance_of(Object).to receive(:sleep)
+        lockfile = double('lockfile')
+        expect(@agent).to receive(:lockfile).and_return(lockfile).at_least(:once)
+        # so the lock method raises Puppet::LockError
+        allow(lockfile).to receive(:lock).and_return(false)
+      end
+
+      it "should notify that a run is already in progres" do
+        client = AgentTestClient.new
+        expect(AgentTestClient).to receive(:new).and_return(client)
+        expect(Puppet).to receive(:notice).with(/Run of .* already in progress; skipping .* exists/)
+        @agent.run
+      end
+
+      it "should inform that a run is already in progres and try to run every X seconds if waitforlock is used" do
+        # so the locked file exists
+        allow(File).to receive(:file?).and_return(true)
+        # so we don't have to wait again for the run to exit (default maxwaitforcert is 60)
+        # first 0 is to get the time, second 0 is to inform user, then 1000 so the time expires
+        allow(Time).to receive(:now).and_return(0, 0, 1000)
+        allow(Puppet).to receive(:info)
+        client = AgentTestClient.new
+        expect(AgentTestClient).to receive(:new).and_return(client)
+
+        Puppet[:waitforlock] = 1
+        Puppet[:maxwaitforlock] = 2
+        expect(Puppet).to receive(:info).with(/Another puppet instance is already running; --waitforlock flag used, waiting for running instance to finish./)
+        expect(Puppet).to receive(:info).with(/Will try again in #{Puppet[:waitforlock]} seconds./)
+        @agent.run
+      end
+
+      it "should notify that the run is exiting if waitforlock is used and maxwaitforlock is exceeded" do
+        # so we don't have to wait again for the run to exit (default maxwaitforcert is 60)
+        # first 0 is to get the time, then 1000 so that the time expires
+        allow(Time).to receive(:now).and_return(0, 1000)
+        client = AgentTestClient.new
+        expect(AgentTestClient).to receive(:new).and_return(client)
+
+        Puppet[:waitforlock] = 1
+        expect(Puppet).to receive(:notice).with(/Exiting now because the maxwaitforlock timeout has been exceeded./)
+        @agent.run
+      end
+    end
+    
     describe "when should_fork is true", :if => Puppet.features.posix? && RUBY_PLATFORM != 'java' do
       before do
         @agent = Puppet::Agent.new(AgentTestClient, true)
 
         # So we don't actually try to hit the filesystem.
         allow(@agent).to receive(:lock).and_yield
-
-        allow(Kernel).to receive(:fork)
-        allow(Process).to receive(:waitpid2).and_return([123, double('process::status', :exitstatus => 0)])
-        allow(@agent).to receive(:exit)
       end
 
       it "should run the agent in a forked process" do
         client = AgentTestClient.new
         expect(AgentTestClient).to receive(:new).and_return(client)
 
-        expect(client).to receive(:run)
+        expect(client).to receive(:run).and_return(0)
 
         expect(Kernel).to receive(:fork).and_yield
-        @agent.run
+        expect { @agent.run }.to exit_with(0)
       end
 
       it "should exit child process if child exit" do
         client = AgentTestClient.new
         expect(AgentTestClient).to receive(:new).and_return(client)
 
-        expect(client).to receive(:run).and_raise(SystemExit)
+        expect(client).to receive(:run).and_raise(SystemExit.new(-1))
 
         expect(Kernel).to receive(:fork).and_yield
-        expect(@agent).to receive(:exit).with(-1)
-        @agent.run
+        expect { @agent.run }.to exit_with(-1)
       end
 
       it 'should exit with 1 if an exception is raised' do
@@ -219,31 +260,44 @@ describe Puppet::Agent do
         expect(client).to receive(:run).and_raise(StandardError)
 
         expect(Kernel).to receive(:fork).and_yield
-        expect(@agent).to receive(:exit).with(1)
-        @agent.run
+        expect { @agent.run }.to exit_with(1)
       end
 
-      it "should re-raise exit happening in the child" do
-        allow(Process).to receive(:waitpid2).and_return([123, double('process::status', :exitstatus => -1)])
-        expect { @agent.run }.to raise_error(SystemExit)
+      it 'should exit with 254 if NoMemoryError exception is raised' do
+        client = AgentTestClient.new
+        expect(AgentTestClient).to receive(:new).and_return(client)
+
+        expect(client).to receive(:run).and_raise(NoMemoryError)
+
+        expect(Kernel).to receive(:fork).and_yield
+        expect { @agent.run }.to exit_with(254)
       end
 
-      it "should re-raise NoMoreMemory happening in the child" do
-        allow(Process).to receive(:waitpid2).and_return([123, double('process::status', :exitstatus => -2)])
-        expect { @agent.run }.to raise_error(NoMemoryError)
+      it "should return the block exit code as the child exit code" do
+        expect(Kernel).to receive(:fork).and_yield
+        expect {
+          @agent.run_in_fork {
+            777
+          }
+        }.to exit_with(777)
       end
 
-      it "should return the child exit code" do
-        allow(Process).to receive(:waitpid2).and_return([123, double('process::status', :exitstatus => 777)])
-        expect(@agent.run).to eq(777)
+      it "should return `1` exit code if the block returns `nil`" do
+        expect(Kernel).to receive(:fork).and_yield
+        expect {
+          @agent.run_in_fork {
+            nil
+          }
+        }.to exit_with(1)
       end
 
-      it "should return the block exit code as the child exit code" do
+      it "should return `1` exit code if the block returns `false`" do
         expect(Kernel).to receive(:fork).and_yield
-        expect(@agent).to receive(:exit).with(777)
-        @agent.run_in_fork {
-          777
-        }
+        expect {
+          @agent.run_in_fork {
+            false
+          }
+        }.to exit_with(1)
       end
     end
 
@@ -283,7 +337,7 @@ describe Puppet::Agent do
         expect(client).not_to receive(:handling)
         expect(Puppet).to receive(:log_exception).with(be_an_instance_of(Puppet::Agent::RunTimeoutError), anything)
 
-        expect(@agent.run).to eq(1)
+        expect(@agent.run).to eq(nil)
       end
     end
   end