puppet 6.13.0-universal-darwin → 6.18.0-universal-darwin

data/spec/unit/file_serving/mount/plugins_spec.rb

@@ -52,13 +52,13 @@ describe Puppet::FileServing::Mount::Plugins do
       expect(@mount.search("foo/bar", @request)).to eq(["/"])
     end
 
-    it "should return nil if no modules can be found that have plugins and modulepath is invalid" do
+    it "should return the default search module path if no modules can be found that have plugins and modulepath is invalid" do
       mod = double('module')
       allow(mod).to receive(:plugins?).and_return(false)
 
       allow(@environment).to receive(:modules).and_return([])
       allow(@environment).to receive(:modulepath).and_return([])
-      expect(@mount.search("foo/bar", @request)).to be_nil
+      expect(@mount.search("foo/bar", @request)).to eq([Puppet[:codedir]])
     end
 
     it "should return the plugin paths for each module that has plugins" do

data/spec/unit/file_serving/terminus_selector_spec.rb

@@ -3,62 +3,81 @@ require 'spec_helper'
 require 'puppet/file_serving/terminus_selector'
 
 describe Puppet::FileServing::TerminusSelector do
-  before do
-    @object = Object.new
-    @object.extend(Puppet::FileServing::TerminusSelector)
+  class TestSelector
+    include Puppet::FileServing::TerminusSelector
+  end
 
-    @request = double('request', :key => "mymod/myfile", :options => {:node => "whatever"}, :server => nil, :protocol => nil)
+  def create_request(key)
+    Puppet::Indirector::Request.new(:indirection_name, :find, key, nil, {node: 'whatever'})
   end
 
+  subject { TestSelector.new }
+
   describe "when being used to select termini" do
     it "should return :file if the request key is fully qualified" do
-      expect(@request).to receive(:key).and_return(File.expand_path('/foo'))
-      expect(@object.select(@request)).to eq(:file)
+      request = create_request(File.expand_path('/foo'))
+
+      expect(subject.select(request)).to eq(:file)
+    end
+
+    it "should return :file_server if the request key is relative" do
+      request = create_request('modules/my_module/path/to_file')
+
+      expect(subject.select(request)).to eq(:file_server)
     end
 
     it "should return :file if the URI protocol is set to 'file'" do
-      expect(@request).to receive(:protocol).and_return("file")
-      expect(@object.select(@request)).to eq(:file)
+      request = create_request(Puppet::Util.path_to_uri(File.expand_path("/foo")).to_s)
+
+      expect(subject.select(request)).to eq(:file)
     end
 
     it "should return :http if the URI protocol is set to 'http'" do
-      expect(@request).to receive(:protocol).and_return("http")
-      expect(@object.select(@request)).to eq :http
+      request = create_request("http://www.example.com")
+
+      expect(subject.select(request)).to eq(:http)
     end
 
     it "should return :http if the URI protocol is set to 'https'" do
-      expect(@request).to receive(:protocol).and_return("https")
-      expect(@object.select(@request)).to eq :http
+      request = create_request("https://www.example.com")
+
+      expect(subject.select(request)).to eq(:http)
+    end
+
+    it "should return :http if the path starts with a double slash" do
+      request = create_request("https://www.example.com//index.html")
+
+      expect(subject.select(request)).to eq(:http)
     end
 
     it "should fail when a protocol other than :puppet, :http(s) or :file is used" do
-      allow(@request).to receive(:protocol).and_return("ftp")
-      expect { @object.select(@request) }.to raise_error(ArgumentError)
+      request = create_request("ftp://ftp.example.com")
+
+      expect {
+        subject.select(request)
+      }.to raise_error(ArgumentError, /URI protocol 'ftp' is not currently supported for file serving/)
     end
 
     describe "and the protocol is 'puppet'" do
-      before do
-        allow(@request).to receive(:protocol).and_return("puppet")
-      end
-
       it "should choose :rest when a server is specified" do
-        allow(@request).to receive(:protocol).and_return("puppet")
-        expect(@request).to receive(:server).and_return("foo")
-        expect(@object.select(@request)).to eq(:rest)
+        request = create_request("puppet://puppetserver.example.com")
+
+        expect(subject.select(request)).to eq(:rest)
       end
 
       # This is so a given file location works when bootstrapping with no server.
       it "should choose :rest when default_file_terminus is rest" do
-        allow(@request).to receive(:protocol).and_return("puppet")
         Puppet[:server] = 'localhost'
-        expect(@object.select(@request)).to eq(:rest)
+        request = create_request("puppet:///plugins")
+
+        expect(subject.select(request)).to eq(:rest)
       end
 
       it "should choose :file_server when default_file_terminus is file_server and no server is specified on the request" do
-        expect(@request).to receive(:protocol).and_return("puppet")
-        expect(@request).to receive(:server).and_return(nil)
         Puppet[:default_file_terminus] = 'file_server'
-        expect(@object.select(@request)).to eq(:file_server)
+        request = create_request("puppet:///plugins")
+
+        expect(subject.select(request)).to eq(:file_server)
       end
     end
   end

data/spec/unit/file_system/uniquefile_spec.rb

@@ -1,6 +1,8 @@
 require 'spec_helper'
 
 describe Puppet::FileSystem::Uniquefile do
+  include PuppetSpec::Files
+
   it "makes the name of the file available" do
     Puppet::FileSystem::Uniquefile.open_tmp('foo') do |file|
       expect(file.path).to match(/foo/)
@@ -73,6 +75,33 @@ describe Puppet::FileSystem::Uniquefile do
     Puppet::FileSystem::Uniquefile.open_tmp('foo') { |tmp| }
   end
 
+  it "reports when a parent directory does not exist" do
+    dir = tmpdir('uniquefile')
+    lock = File.join(dir, 'path', 'to', 'lock')
+
+    expect {
+      Puppet::FileSystem::Uniquefile.open_tmp(lock) { |tmp| }
+    }.to raise_error(Errno::ENOENT, %r{No such file or directory - A directory component in .* does not exist or is a dangling symbolic link})
+  end
+
+  it "should use UTF8 characters in TMP,TEMP,TMPDIR environment variable", :if => Puppet::Util::Platform.windows? do
+    rune_utf8 = "\u16A0\u16C7\u16BB\u16EB\u16D2\u16E6\u16A6\u16EB\u16A0\u16B1\u16A9\u16A0\u16A2\u16B1\u16EB\u16A0\u16C1\u16B1\u16AA\u16EB\u16B7\u16D6\u16BB\u16B9\u16E6\u16DA\u16B3\u16A2\u16D7"
+    temp_rune_utf8 = File.join(Dir.tmpdir, rune_utf8)
+    Puppet::FileSystem.mkpath(temp_rune_utf8)
+
+    # Set the temporary environment variables to the UTF8 temp path
+    Puppet::Util::Windows::Process.set_environment_variable('TMPDIR', temp_rune_utf8)
+    Puppet::Util::Windows::Process.set_environment_variable('TMP', temp_rune_utf8)
+    Puppet::Util::Windows::Process.set_environment_variable('TEMP', temp_rune_utf8)
+
+    # Create a unique file
+    filename = Puppet::FileSystem::Uniquefile.open_tmp('foo') do |file|
+      File.dirname(file.path)
+    end
+
+    expect(filename).to eq(temp_rune_utf8)
+  end
+
   context "Ruby 1.9.3 Tempfile tests" do
     # the remaining tests in this file are ported directly from the ruby 1.9.3 source,
     # since most of this file was ported from there

data/spec/unit/file_system_spec.rb

@@ -970,6 +970,16 @@ describe "Puppet::FileSystem" do
           mode = Puppet::FileSystem.stat(dest).mode
           expect(mode & 07777).to eq(0400)
         end
+
+        it 'preserves file ownership' do
+          allow(Puppet::FileSystem).to receive(:lstat)
+            .with(Puppet::FileSystem.pathname(dest))
+            .and_return(double(uid: 1, gid: 2))
+
+          expect(FileUtils).to receive(:chown).with(1, 2, /#{dest}/)
+
+          Puppet::FileSystem.replace_file(dest, 0644) { |f| f.write(content) }
+        end
       end
 
       context 'on windows', if: Puppet::Util::Platform.windows? do

data/spec/unit/functions/lookup_spec.rb

@@ -3082,6 +3082,19 @@ describe "The lookup function" do
 
       let(:env_data) { data_files }
 
+      context 'with unencryptable eyaml' do
+        let(:data_files) do
+          {
+            'common.eyaml' => <<-YAML.unindent
+              key_with_invalid_eyaml: ENC[PKCS7,INVALID]
+              YAML
+          }
+        end
+
+        it 'fails and reports error with ENC value, key being looked up and filename' do
+          expect { lookup('key_with_invalid_eyaml') }.to raise_error(Puppet::DataBinding::LookupError, /hiera-eyaml backend error decrypting ENC\[PKCS7,INVALID\] when looking up key_with_invalid_eyaml in .*common\.eyaml\. Error was/)
+        end
+      end
       context 'and a module using eyaml with different options' do
 
         let(:private_module_key) do

data/spec/unit/http/client_spec.rb

@@ -1,10 +1,11 @@
 require 'spec_helper'
-require 'webmock/rspec'
 require 'puppet/http'
 
 describe Puppet::HTTP::Client do
   let(:uri) { URI.parse('https://www.example.com') }
-  let(:client) { described_class.new }
+  let(:puppet_context) { Puppet::SSL::SSLContext.new }
+  let(:system_context) { Puppet::SSL::SSLContext.new }
+  let(:client) { described_class.new(ssl_context: puppet_context, system_ssl_context: system_context) }
   let(:credentials) { ['user', 'pass'] }
 
   it 'creates unique sessions' do
@@ -45,6 +46,46 @@ describe Puppet::HTTP::Client do
         client.connect(uri)
       }.to raise_error(Puppet::HTTP::ConnectionError, %r{^Request to https://www.example.com timed out connect operation after .* seconds})
     end
+
+    it 'connects using the default ssl context' do
+      expect(client.pool).to receive(:with_connection) do |_, verifier|
+        expect(verifier.ssl_context).to equal(puppet_context)
+      end
+
+      client.connect(uri)
+    end
+
+    it 'connects using a specified ssl context' do
+      other_context = Puppet::SSL::SSLContext.new
+
+      expect(client.pool).to receive(:with_connection) do |_, verifier|
+        expect(verifier.ssl_context).to equal(other_context)
+      end
+
+      client.connect(uri, options: {ssl_context: other_context})
+    end
+
+    it 'connects using the system store' do
+      expect(client.pool).to receive(:with_connection) do |_, verifier|
+        expect(verifier.ssl_context).to equal(system_context)
+      end
+
+      client.connect(uri, options: {include_system_store: true})
+    end
+
+    it 'does not create a verifier for HTTP connections' do
+      expect(client.pool).to receive(:with_connection) do |_, verifier|
+        expect(verifier).to be_nil
+      end
+
+      client.connect(URI.parse('http://www.example.com'))
+    end
+
+    it 'raises an HTTPError if both are specified' do
+      expect {
+        client.connect(uri, options: {ssl_context: puppet_context, include_system_store: true})
+      }.to raise_error(Puppet::HTTP::HTTPError, /The ssl_context and include_system_store parameters are mutually exclusive/)
+    end
   end
 
   context 'after connecting' do
@@ -75,10 +116,8 @@ describe Puppet::HTTP::Client do
 
   context "when closing" do
     it "closes all connections in the pool" do
-      pool = double('pool')
-      expect(pool).to receive(:close)
+      expect(client.pool).to receive(:close)
 
-      client = described_class.new(pool: pool)
       client.close
     end
   end
@@ -138,6 +177,28 @@ describe Puppet::HTTP::Client do
 
       expect(io.string).to eq("abc")
     end
+
+    context 'when connecting' do
+      it 'uses a specified ssl context' do
+        stub_request(:get, uri).to_return(body: "abc")
+
+        other_context = Puppet::SSL::SSLContext.new
+
+        client.get(uri, options: {ssl_context: other_context})
+      end
+
+      it 'uses the system store' do
+        stub_request(:get, uri).to_return(body: "abc")
+
+        client.get(uri, options: {include_system_store: true})
+      end
+
+      it 'raises an HTTPError if both are specified' do
+        expect {
+          client.get(uri, options: {ssl_context: puppet_context, include_system_store: true})
+        }.to raise_error(Puppet::HTTP::HTTPError, /The ssl_context and include_system_store parameters are mutually exclusive/)
+      end
+    end
   end
 
   context "for HEAD requests" do
@@ -173,6 +234,28 @@ describe Puppet::HTTP::Client do
 
       expect(client.head(uri).body).to eq("abc")
     end
+
+    context 'when connecting' do
+      it 'uses a specified ssl context' do
+        stub_request(:head, uri)
+
+        other_context = Puppet::SSL::SSLContext.new
+
+        client.head(uri, options: {ssl_context: other_context})
+      end
+
+      it 'uses the system store' do
+        stub_request(:head, uri)
+
+        client.head(uri, options: {include_system_store: true})
+      end
+
+      it 'raises an HTTPError if both are specified' do
+        expect {
+          client.head(uri, options: {ssl_context: puppet_context, include_system_store: true})
+        }.to raise_error(Puppet::HTTP::HTTPError, /The ssl_context and include_system_store parameters are mutually exclusive/)
+      end
+    end
   end
 
   context "for PUT requests" do
@@ -182,25 +265,25 @@ describe Puppet::HTTP::Client do
         expect(request.headers).to_not include('X-Puppet-Profiling')
       end
 
-      client.put(uri, content_type: 'text/plain', body: "")
+      client.put(uri, "", headers: {'Content-Type' => 'text/plain'})
     end
 
     it "stringifies keys and encodes values in the query" do
       stub_request(:put, "https://www.example.com").with(query: "foo=bar%3Dbaz")
 
-      client.put(uri, params: {:foo => "bar=baz"}, content_type: 'text/plain', body: "")
+      client.put(uri, "", params: {:foo => "bar=baz"}, headers: {'Content-Type' => 'text/plain'})
     end
 
     it "includes custom headers" do
       stub_request(:put, "https://www.example.com").with(headers: { 'X-Foo' => 'Bar' })
 
-      client.put(uri, headers: {'X-Foo' => 'Bar'}, content_type: 'text/plain', body: "")
+      client.put(uri, "", headers: {'X-Foo' => 'Bar', 'Content-Type' => 'text/plain'})
     end
 
     it "returns the response" do
       stub_request(:put, uri)
 
-      response = client.put(uri, content_type: 'text/plain', body: "")
+      response = client.put(uri, "", headers: {'Content-Type' => 'text/plain'})
       expect(response).to be_an_instance_of(Puppet::HTTP::Response)
       expect(response).to be_success
       expect(response.code).to eq(200)
@@ -209,7 +292,41 @@ describe Puppet::HTTP::Client do
     it "sets content-length and content-type for the body" do
       stub_request(:put, uri).with(headers: {"Content-Length" => "5", "Content-Type" => "text/plain"})
 
-      client.put(uri, content_type: 'text/plain', body: "hello")
+      client.put(uri, "hello", headers: {'Content-Type' => 'text/plain'})
+    end
+
+     it 'raises an ArgumentError if `body` is missing' do
+       expect {
+         client.put(uri, nil, headers: {'Content-Type' => 'text/plain'})
+       }.to raise_error(ArgumentError, /'put' requires a string 'body' argument/)
+     end
+
+     it 'raises an ArgumentError if `content_type` is missing from the headers hash' do
+       expect {
+         client.put(uri, '')
+       }.to raise_error(ArgumentError, /'put' requires a 'content-type' header/)
+     end
+
+    context 'when connecting' do
+      it 'uses a specified ssl context' do
+        stub_request(:put, uri)
+
+        other_context = Puppet::SSL::SSLContext.new
+
+        client.put(uri, "", headers: {'Content-Type' => 'text/plain'}, options: {ssl_context: other_context})
+      end
+
+      it 'uses the system store' do
+        stub_request(:put, uri)
+
+        client.put(uri, "", headers: {'Content-Type' => 'text/plain'}, options: {include_system_store: true})
+      end
+
+      it 'raises an HTTPError if both are specified' do
+        expect {
+          client.put(uri, "", headers: {'Content-Type' => 'text/plain'}, options: {ssl_context: puppet_context, include_system_store: true})
+        }.to raise_error(Puppet::HTTP::HTTPError, /The ssl_context and include_system_store parameters are mutually exclusive/)
+      end
     end
   end
 
@@ -217,25 +334,25 @@ describe Puppet::HTTP::Client do
     it "includes default HTTP headers" do
       stub_request(:post, uri).with(headers: {'X-Puppet-Version' => /./, 'User-Agent' => /./})
 
-      client.post(uri, content_type: 'text/plain', body: "")
+      client.post(uri, "", headers: {'Content-Type' => 'text/plain'})
     end
 
     it "stringifies keys and encodes values in the query" do
       stub_request(:post, "https://www.example.com").with(query: "foo=bar%3Dbaz")
 
-      client.post(uri, params: {:foo => "bar=baz"}, content_type: 'text/plain', body: "")
+      client.post(uri, "", params: {:foo => "bar=baz"}, headers: {'Content-Type' => 'text/plain'})
     end
 
     it "includes custom headers" do
       stub_request(:post, "https://www.example.com").with(headers: { 'X-Foo' => 'Bar' })
 
-      client.post(uri, headers: {'X-Foo' => 'Bar'}, content_type: 'text/plain', body: "")
+      client.post(uri, "", headers: {'X-Foo' => 'Bar', 'Content-Type' => 'text/plain'})
     end
 
     it "returns the response" do
       stub_request(:post, uri)
 
-      response = client.post(uri, content_type: 'text/plain', body: "")
+      response = client.post(uri, "", headers: {'Content-Type' => 'text/plain'})
       expect(response).to be_an_instance_of(Puppet::HTTP::Response)
       expect(response).to be_success
       expect(response.code).to eq(200)
@@ -244,14 +361,14 @@ describe Puppet::HTTP::Client do
     it "sets content-length and content-type for the body" do
       stub_request(:post, uri).with(headers: {"Content-Length" => "5", "Content-Type" => "text/plain"})
 
-      client.post(uri, content_type: 'text/plain', body: "hello")
+      client.post(uri, "hello", headers: {'Content-Type' => 'text/plain'})
     end
 
     it "streams the response body when a block is given" do
       stub_request(:post, uri).to_return(body: "abc")
 
       io = StringIO.new
-      client.post(uri, content_type: 'text/plain', body: "") do |response|
+      client.post(uri, "", headers: {'Content-Type' => 'text/plain'}) do |response|
         response.read_body do |data|
           io.write(data)
         end
@@ -259,6 +376,40 @@ describe Puppet::HTTP::Client do
 
       expect(io.string).to eq("abc")
     end
+
+    it 'raises an ArgumentError if `body` is missing' do
+      expect {
+        client.post(uri, nil, headers: {'Content-Type' => 'text/plain'})
+      }.to raise_error(ArgumentError, /'post' requires a string 'body' argument/)
+    end
+
+    it 'raises an ArgumentError if `content_type` is missing from the headers hash' do
+      expect {
+        client.post(uri, "")
+      }.to raise_error(ArgumentError, /'post' requires a 'content-type' header/)
+    end
+
+    context 'when connecting' do
+      it 'uses a specified ssl context' do
+        stub_request(:post, uri)
+
+        other_context = Puppet::SSL::SSLContext.new
+
+        client.post(uri, "", headers: {'Content-Type' => 'text/plain'}, options: {body: "", ssl_context: other_context})
+      end
+
+      it 'uses the system store' do
+        stub_request(:post, uri)
+
+        client.post(uri, "", headers: {'Content-Type' => 'text/plain'}, options: {include_system_store: true})
+      end
+
+      it 'raises an HTTPError if both are specified' do
+        expect {
+          client.post(uri, "", headers: {'Content-Type' => 'text/plain'}, options: {ssl_context: puppet_context, include_system_store: true})
+        }.to raise_error(Puppet::HTTP::HTTPError, /The ssl_context and include_system_store parameters are mutually exclusive/)
+      end
+    end
   end
 
   context "for DELETE requests" do
@@ -294,44 +445,80 @@ describe Puppet::HTTP::Client do
 
       expect(client.delete(uri).body).to eq("abc")
     end
+
+    context 'when connecting' do
+      it 'uses a specified ssl context' do
+        stub_request(:delete, uri)
+
+        other_context = Puppet::SSL::SSLContext.new
+
+        client.delete(uri, options: {ssl_context: other_context})
+      end
+
+      it 'uses the system store' do
+        stub_request(:delete, uri)
+
+        client.delete(uri, options: {include_system_store: true})
+      end
+
+      it 'raises an HTTPError if both are specified' do
+        expect {
+          client.delete(uri, options: {ssl_context: puppet_context, include_system_store: true})
+        }.to raise_error(Puppet::HTTP::HTTPError, /The ssl_context and include_system_store parameters are mutually exclusive/)
+      end
+    end
   end
 
   context "Basic Auth" do
     it "submits credentials for GET requests" do
       stub_request(:get, uri).with(basic_auth: credentials)
 
-      client.get(uri, user: 'user', password: 'pass')
+      client.get(uri, options: {basic_auth: {user: 'user', password: 'pass'}})
     end
 
     it "submits credentials for PUT requests" do
       stub_request(:put, uri).with(basic_auth: credentials)
 
-      client.put(uri, content_type: 'text/plain', body: "hello", user: 'user', password: 'pass')
+      client.put(uri, "hello", headers: {'Content-Type' => 'text/plain'}, options: {basic_auth: {user: 'user', password: 'pass'}})
     end
 
     it "returns response containing access denied" do
       stub_request(:get, uri).with(basic_auth: credentials).to_return(status: [403, "Ye Shall Not Pass"])
 
-      response = client.get(uri, user: 'user', password: 'pass')
+      response = client.get(uri, options: {basic_auth: {user: 'user', password: 'pass'}})
       expect(response.code).to eq(403)
       expect(response.reason).to eq("Ye Shall Not Pass")
       expect(response).to_not be_success
     end
 
-    it 'omits basic auth if user is nil' do
+    it 'includes basic auth if user is nil' do
       stub_request(:get, uri).with do |req|
-        expect(req.headers).to_not include('Authorization')
+        expect(req.headers).to include('Authorization')
       end
 
-      client.get(uri, user: nil, password: 'pass')
+      client.get(uri, options: {basic_auth: {user: nil, password: 'pass'}})
     end
 
-    it 'omits basic auth if password is nil' do
+    it 'includes basic auth if password is nil' do
       stub_request(:get, uri).with do |req|
-        expect(req.headers).to_not include('Authorization')
+        expect(req.headers).to include('Authorization')
       end
 
-      client.get(uri, user: 'user', password: nil)
+      client.get(uri, options: {basic_auth: {user: 'user', password: nil}})
+    end
+
+    it 'observes userinfo in the URL' do
+      stub_request(:get, uri).with(basic_auth: credentials)
+
+      client.get(URI("https://user:pass@www.example.com"))
+    end
+
+    it 'prefers explicit basic_auth credentials' do
+      uri = URI("https://ignored_user:ignored_pass@www.example.com")
+
+      stub_request(:get, "https://www.example.com").with(basic_auth: credentials)
+
+      client.get(uri, options: {basic_auth: {user: 'user', password: 'pass'}})
     end
   end
 
@@ -357,14 +544,45 @@ describe Puppet::HTTP::Client do
       stub_request(:put, start_url).to_return(redirect_to(url: bar_url))
       stub_request(:put, bar_url).to_return(status: 200)
 
-      response = client.put(start_url, body: "", content_type: 'text/plain')
+      response = client.put(start_url, "", headers: {'Content-Type' => 'text/plain'})
+      expect(response).to be_success
+    end
+
+    it "updates the Host header from the Location host and port" do
+      stub_request(:get, start_url).with(headers: { 'Host' => 'www.example.com:8140' })
+        .to_return(redirect_to(url: other_host))
+      stub_request(:get, other_host).with(headers: { 'Host' => 'other.example.com:8140' })
+        .to_return(status: 200)
+
+      response = client.get(start_url)
+      expect(response).to be_success
+    end
+
+    it "omits the default HTTPS port from the Host header" do
+      stub_request(:get, start_url).with(headers: { 'Host' => 'www.example.com:8140' })
+        .to_return(redirect_to(url: "https://other.example.com/qux"))
+      stub_request(:get, "https://other.example.com/qux").with(headers: { 'Host' => 'other.example.com' })
+        .to_return(status: 200)
+
+      response = client.get(start_url)
+      expect(response).to be_success
+    end
+
+    it "omits the default HTTP port from the Host header" do
+      stub_request(:get, start_url).with(headers: { 'Host' => 'www.example.com:8140' })
+        .to_return(redirect_to(url: "http://other.example.com/qux"))
+      stub_request(:get, "http://other.example.com/qux").with(headers: { 'Host' => 'other.example.com' })
+        .to_return(status: 200)
+
+      response = client.get(start_url)
       expect(response).to be_success
     end
 
-    it "preserves query parameters" do
-      query = { 'debug' => true }
-      stub_request(:get, start_url).with(query: query).to_return(redirect_to(url: bar_url))
-      stub_request(:get, bar_url).with(query: query).to_return(status: 200)
+    it "applies query parameters from the location header" do
+      query = { 'redirected' => false }
+
+      stub_request(:get, start_url).with(query: query).to_return(redirect_to(url: "#{bar_url}?redirected=true"))
+      stub_request(:get, bar_url).with(query: {'redirected' => 'true'}).to_return(status: 200)
 
       response = client.get(start_url, params: query)
       expect(response).to be_success
@@ -383,7 +601,7 @@ describe Puppet::HTTP::Client do
       stub_request(:get, start_url).with(basic_auth: credentials).to_return(redirect_to(url: bar_url))
       stub_request(:get, bar_url).with(basic_auth: credentials).to_return(status: 200)
 
-      client.get(start_url, user: 'user', password: 'pass')
+      client.get(start_url, options: {basic_auth: {user: 'user', password: 'pass'}})
     end
 
     it "redirects given a relative location" do
@@ -395,22 +613,33 @@ describe Puppet::HTTP::Client do
       expect(response).to be_success
     end
 
-    it "preserves query parameters given a relative location" do
+    it "applies query parameters from the location header" do
       relative_url = "/people.html"
-      query = { 'debug' => true }
-      stub_request(:get, start_url).with(query: query).to_return(redirect_to(url: relative_url))
-      stub_request(:get, "https://www.example.com:8140/people.html").with(query: query).to_return(status: 200)
+      query = { 'redirected' => false }
+      stub_request(:get, start_url).with(query: query).to_return(redirect_to(url: "#{relative_url}?redirected=true"))
+      stub_request(:get, "https://www.example.com:8140/people.html").with(query: {'redirected' => 'true'}).to_return(status: 200)
 
       response = client.get(start_url, params: query)
       expect(response).to be_success
     end
 
+    it "removes dot segments from a relative location" do
+      # from https://tools.ietf.org/html/rfc3986#section-5.4.2
+      base_url = URI("http://a/b/c/d;p?q")
+      relative_url = "../../../../g"
+      stub_request(:get, base_url).to_return(redirect_to(url: relative_url))
+      stub_request(:get, "http://a/g").to_return(status: 200)
+
+      response = client.get(base_url)
+      expect(response).to be_success
+    end
+
     it "preserves request body for each request" do
       data = 'some data'
       stub_request(:put, start_url).with(body: data).to_return(redirect_to(url: bar_url))
       stub_request(:put, bar_url).with(body: data).to_return(status: 200)
 
-      response = client.put(start_url, body: data, content_type: 'text/plain')
+      response = client.put(start_url, data, headers: {'Content-Type' => 'text/plain'})
       expect(response).to be_success
     end
 
@@ -539,6 +768,32 @@ describe Puppet::HTTP::Client do
       }.to raise_error(Puppet::HTTP::ProtocolError, /Failed to parse Retry-After header 'foo' as an integer or RFC 2822 date/)
     end
 
+    it "should close the connection before sleeping" do
+      retry_after('42')
+
+      site = Puppet::Network::HTTP::Site.from_uri(uri)
+
+      http1 = Net::HTTP.new(site.host, site.port)
+      http1.use_ssl = true
+      allow(http1).to receive(:started?).and_return(true)
+
+      http2 = Net::HTTP.new(site.host, site.port)
+      http2.use_ssl = true
+      allow(http2).to receive(:started?).and_return(true)
+
+
+      pool = Puppet::Network::HTTP::Pool.new(15)
+      client = Puppet::HTTP::Client.new(pool: pool)
+
+      # The "with_connection" method is required to yield started connections
+      allow(pool).to receive(:with_connection).and_yield(http1).and_yield(http2)
+
+      expect(http1).to receive(:finish).ordered
+      expect(::Kernel).to receive(:sleep).with(42).ordered
+
+      client.get(uri)
+    end
+
     it "should sleep and retry if Retry-After is an Integer" do
       retry_after('42')
 
@@ -575,4 +830,34 @@ describe Puppet::HTTP::Client do
       client.get(uri)
     end
   end
+
+  context "persistent connections" do
+    before :each do
+      stub_request(:get, uri)
+    end
+
+    it 'defaults keepalive to http_keepalive_timeout' do
+      expect(client.pool.keepalive_timeout).to eq(Puppet[:http_keepalive_timeout])
+    end
+
+    it 'reuses a cached connection' do
+      allow(Puppet).to receive(:debug)
+      expect(Puppet).to receive(:debug).with(/^Creating new connection/)
+      expect(Puppet).to receive(:debug).with(/^Using cached connection/)
+
+      client.get(uri)
+      client.get(uri)
+    end
+
+    it 'can be disabled' do
+      Puppet[:http_keepalive_timeout] = 0
+
+      allow(Puppet).to receive(:debug)
+      expect(Puppet).to receive(:debug).with(/^Creating new connection/).twice
+      expect(Puppet).to receive(:debug).with(/^Using cached connection/).never
+
+      client.get(uri)
+      client.get(uri)
+    end
+  end
 end