puppet 6.14.0 → 6.19.0

data/spec/integration/util/windows/registry_spec.rb

@@ -259,23 +259,23 @@ describe Puppet::Util::Windows::Registry do
         {
           name: 'REG_SZ',
           type: Win32::Registry::REG_SZ,
-          value: "reg sz\u0000 string",
-          expected_value: "reg sz  string"
+          value: "reg sz\u0000\u0000 string",
+          expected_value: "reg sz"
         },
         {
           name: 'REG_SZ_2',
           type: Win32::Registry::REG_SZ,
-          value: "reg sz\x00 string",
-          expected_value: "reg sz  string"
+          value: "reg sz 2\x00\x00 string",
+          expected_value: "reg sz 2"
         },
         {
           name: 'REG_EXPAND_SZ',
           type: Win32::Registry::REG_EXPAND_SZ,
-          value: "\0reg expand string",
-          expected_value: " reg expand string"
+          value: "\0\0\0reg expand string",
+          expected_value: ""
         }
       ].each do |pair|
-        it 'replaces null bytes with spaces' do
+        it 'reads up to the first wide null' do
           hklm.create("#{puppet_key}\\#{subkey_name}", Win32::Registry::KEY_ALL_ACCESS) do |reg|
             reg.write(value_name, pair[:type], pair[:value])
           end

data/spec/integration/util/windows/user_spec.rb

@@ -125,19 +125,16 @@ describe "Puppet::Util::Windows::User", :if => Puppet::Util::Platform.windows? d
       end
 
       it 'should raise error given that logon returns false' do
-
         allow(Puppet::Util::Windows::User).to receive(:logon_user_by_logon_type).with(
-            user, passwd, fLOGON32_LOGON_NETWORK, fLOGON32_PROVIDER_DEFAULT, anything).and_return (0)
+            user, '.', passwd, fLOGON32_LOGON_NETWORK, fLOGON32_PROVIDER_DEFAULT, anything).and_return (0)
         allow(Puppet::Util::Windows::User).to receive(:logon_user_by_logon_type).with(
-            user, passwd, fLOGON32_LOGON_INTERACTIVE, fLOGON32_PROVIDER_DEFAULT, anything).and_return(0)
+            user, '.', passwd, fLOGON32_LOGON_INTERACTIVE, fLOGON32_PROVIDER_DEFAULT, anything).and_return(0)
 
         expect {Puppet::Util::Windows::User.logon_user(user, passwd) {}}
             .to raise_error(Puppet::Util::Windows::Error, /Failed to logon user/)
-
       end
     end
 
-
     describe "password_is?" do
       it "should return false given an incorrect username and password" do
         expect(Puppet::Util::Windows::User.password_is?(username, bad_password)).to be_falsey
@@ -180,5 +177,50 @@ describe "Puppet::Util::Windows::User", :if => Puppet::Util::Platform.windows? d
         expect { Puppet::Util::Windows::User.check_token_membership }.not_to raise_error
       end
     end
+
+    describe "default_system_account?" do
+      it "should succesfully identify 'SYSTEM' user as a default system account" do
+        allow(Puppet::Util::Windows::SID).to receive(:name_to_sid).with('SYSTEM').and_return(Puppet::Util::Windows::SID::LocalSystem)
+        expect(Puppet::Util::Windows::User.default_system_account?('SYSTEM')).to eq(true)
+      end
+
+      it "should succesfully identify 'NETWORK SERVICE' user as a default system account" do
+        allow(Puppet::Util::Windows::SID).to receive(:name_to_sid).with('NETWORK SERVICE').and_return(Puppet::Util::Windows::SID::NtNetwork)
+        expect(Puppet::Util::Windows::User.default_system_account?('NETWORK SERVICE')).to eq(true)
+      end
+
+      it "should succesfully identify 'LOCAL SERVICE' user as a default system account" do
+        allow(Puppet::Util::Windows::SID).to receive(:name_to_sid).with('LOCAL SERVICE').and_return(Puppet::Util::Windows::SID::NtLocal)
+        expect(Puppet::Util::Windows::User.default_system_account?('LOCAL SERVICE')).to eq(true)
+      end
+
+      it "should not identify user with unknown sid as a default system account" do
+        allow(Puppet::Util::Windows::SID).to receive(:name_to_sid).with('UnknownUser').and_return(Puppet::Util::Windows::SID::Null)
+        expect(Puppet::Util::Windows::User.default_system_account?('UnknownUser')).to eq(false)
+      end
+    end
+
+    describe "localsystem?" do
+      before do
+        allow(Puppet::Util::Windows::ADSI).to receive(:computer_name).and_return("myPC")
+      end
+
+      ['LocalSystem', '.\LocalSystem', 'myPC\LocalSystem', 'lOcALsysTem'].each do |input|
+        it "should succesfully identify #{input} as the 'LocalSystem' account" do
+          expect(Puppet::Util::Windows::User.localsystem?(input)).to eq(true)
+        end
+      end
+
+      it "should not identify any other user as the 'LocalSystem' account" do
+        expect(Puppet::Util::Windows::User.localsystem?('OtherUser')).to eq(false)
+      end
+    end
+
+    describe "get_rights" do
+      it "should be empty when given user does not exist" do
+        allow(Puppet::Util::Windows::SID).to receive(:name_to_principal).with('NonExistingUser').and_return(nil)
+        expect(Puppet::Util::Windows::User.get_rights('NonExistingUser')).to eq("")
+      end
+    end
   end
 end

data/spec/integration/util_spec.rb

@@ -1,32 +1,9 @@
+# coding: utf-8
 require 'spec_helper'
 
 describe Puppet::Util do
   include PuppetSpec::Files
 
-  describe "#execute", unless: Puppet::Util::Platform.jruby? do
-    it "should properly allow stdout and stderr to share a file" do
-      command = "ruby -e '(1..10).each {|i| (i%2==0) ? $stdout.puts(i) : $stderr.puts(i)}'"
-
-      expect(Puppet::Util::Execution.execute(command, :combine => true).split).to match_array([*'1'..'10'])
-    end
-
-    it "should return output and set $CHILD_STATUS" do
-      command = "ruby -e 'puts \"foo\"; exit 42'"
-
-      output = Puppet::Util::Execution.execute(command, {:failonfail => false})
-
-      expect(output).to eq("foo\n")
-      expect($CHILD_STATUS.exitstatus).to eq(42)
-    end
-
-    it "should raise an error if non-zero exit status is returned" do
-      command = "ruby -e 'exit 43'"
-
-      expect { Puppet::Util::Execution.execute(command) }.to raise_error(Puppet::ExecutionFailure, /Execution of '#{command}' returned 43: /)
-      expect($CHILD_STATUS.exitstatus).to eq(43)
-    end
-  end
-
   describe "#replace_file on Windows", :if => Puppet::Util::Platform.windows? do
     it "replace_file should preserve original ACEs from existing replaced file on Windows" do
 
@@ -110,18 +87,15 @@ describe Puppet::Util do
   describe "#which on Windows", :if => Puppet::Util::Platform.windows? do
     let (:rune_utf8) { "\u16A0\u16C7\u16BB\u16EB\u16D2\u16E6\u16A6\u16EB\u16A0\u16B1\u16A9\u16A0\u16A2\u16B1\u16EB\u16A0\u16C1\u16B1\u16AA\u16EB\u16B7\u16D6\u16BB\u16B9\u16E6\u16DA\u16B3\u16A2\u16D7" }
     let (:filename) { 'foo.exe' }
-    let (:filepath) { File.expand_path('C:\\' + rune_utf8 + '\\' + filename) }
 
-    before :each do
-      allow(FileTest).to receive(:file?).and_return(false)
-      allow(FileTest).to receive(:file?).with(filepath).and_return(true)
+    it "should be able to use UTF8 characters in the path" do
+      utf8 = tmpdir(rune_utf8)
+      Puppet::FileSystem.mkpath(utf8)
 
-      allow(FileTest).to receive(:executable?).and_return(false)
-      allow(FileTest).to receive(:executable?).with(filepath).and_return(true)
-    end
+      filepath = File.join(utf8, filename)
+      Puppet::FileSystem.touch(filepath)
 
-    it "should be able to use UTF8 characters in the path" do
-      path = "C:\\" + rune_utf8 + "#{File::PATH_SEPARATOR}c:\\windows\\system32#{File::PATH_SEPARATOR}c:\\windows"
+      path = [utf8, "c:\\windows\\system32", "c:\\windows"].join(File::PATH_SEPARATOR)
       Puppet::Util.withenv( { "PATH" => path } , :windows) do
         expect(Puppet::Util.which(filename)).to eq(filepath)
       end

data/spec/lib/puppet/test_ca.rb

@@ -21,9 +21,9 @@ module Puppet
       id
     end
 
-    def initialize
+    def initialize(name = 'Test CA')
       @digest = OpenSSL::Digest::SHA256.new
-      info = create_cacert('Test CA')
+      info = create_cacert(name)
       @key = info[:private_key]
       @ca_cert = info[:cert]
       @ca_crl = create_crl(@ca_cert, @key)

data/spec/lib/puppet_spec/https.rb

@@ -6,11 +6,11 @@ class PuppetSpec::HTTPSServer
 
   attr_reader :ca_cert, :ca_crl, :server_cert, :server_key
 
-  def initialize
-    @ca_cert = cert_fixture('ca.pem')
-    @ca_crl = crl_fixture('crl.pem')
-    @server_key = key_fixture('127.0.0.1-key.pem')
-    @server_cert = cert_fixture('127.0.0.1.pem')
+  def initialize(ca_cert: nil, ca_crl: nil, server_key: nil, server_cert: nil)
+    @ca_cert = ca_cert || cert_fixture('ca.pem')
+    @ca_crl = ca_crl || crl_fixture('crl.pem')
+    @server_key = server_key || key_fixture('127.0.0.1-key.pem')
+    @server_cert = server_cert || cert_fixture('127.0.0.1.pem')
     @config = WEBrick::Config::HTTP.dup
   end
 
@@ -18,10 +18,19 @@ class PuppetSpec::HTTPSServer
     req = WEBrick::HTTPRequest.new(@config)
     req.parse(ssl)
 
+    # always drain request body
+    req.body
+
     res = WEBrick::HTTPResponse.new(@config)
     res.status = 200
     res.body = 'OK'
-    response_proc.call(res) if response_proc
+    # The server explicitly closes the connection after handling it,
+    # so explicitly tell the client we're not going to keep it open.
+    # Without this, ruby will add `Connection: Keep-Alive`, which
+    # confuses the client when it tries to reuse the half-closed
+    # connection.
+    res['Connection'] = 'close'
+    response_proc.call(req, res) if response_proc
 
     res.send_response(ssl)
   end
@@ -52,7 +61,7 @@ class PuppetSpec::HTTPSServer
 
               loop do
                 readable, = IO.select([ssls, stop_pipe_r])
-                break if readable.include? stop_pipe_r
+                break if readable.include?(stop_pipe_r)
 
                 ssl = ssls.accept
                 begin

data/spec/lib/puppet_spec/matchers.rb

@@ -41,86 +41,6 @@ RSpec::Matchers.define :exit_with do |expected|
   end
 end
 
-
-RSpec::Matchers.define :have_printed do |expected|
-
-  case expected
-  when String, Regexp, Proc
-    expected = expected
-  else
-    expected = expected.to_s
-  end
-
-  chain :and_exit_with do |code|
-    @expected_exit_code = code
-  end
-
-  define_method :matches_exit_code? do |actual|
-    @expected_exit_code.nil? || @expected_exit_code == actual
-  end
-
-  define_method :matches_output? do |actual|
-    return false unless actual
-    case expected
-      when String
-        actual.include?(expected)
-      when Regexp
-        expected.match(actual)
-      when Proc
-        expected.call(actual)
-      else
-        raise ArgumentError, "No idea how to match a #{actual.class.name}"
-    end
-  end
-
-  match do |block|
-    $stderr = $stdout = StringIO.new
-    $stdout.set_encoding('UTF-8') if $stdout.respond_to?(:set_encoding)
-
-    begin
-      block.call
-    rescue SystemExit => e
-      raise unless @expected_exit_code
-      @actual_exit_code = e.status
-    ensure
-      $stdout.rewind
-      @actual = $stdout.read
-
-      $stdout = STDOUT
-      $stderr = STDERR
-    end
-
-    matches_output?(@actual) && matches_exit_code?(@actual_exit_code)
-  end
-
-  supports_block_expectations
-
-  failure_message do |actual|
-    if actual.nil? then
-      "expected #{expected.inspect}, but nothing was printed"
-    else
-      if !@expected_exit_code.nil? && matches_output?(actual)
-        "expected exit with code #{@expected_exit_code} but " +
-          (@actual_exit_code.nil? ? " exit was not called" : "exited with #{@actual_exit_code} instead")
-      else
-        "expected #{expected.inspect} to be printed; got:\n#{actual}"
-      end
-    end
-  end
-
-  failure_message_when_negated do |actual|
-    if @expected_exit_code && matches_exit_code?(@actual_exit_code)
-      "expected exit code to not be #{@actual_exit_code}"
-    else
-      "expected #{expected.inspect} to not be printed; got:\n#{actual}"
-    end
-  end
-
-  description do
-    "expect #{expected.inspect} to be printed" + (@expected_exit_code.nil ? '' : " with exit code #{@expected_exit_code}")
-  end
-end
-
 RSpec::Matchers.define :equal_attributes_of do |expected|
   match do |actual|
     actual.instance_variables.all? do |attr|

data/spec/lib/puppet_spec/puppetserver.rb

@@ -0,0 +1,127 @@
+require 'spec_helper'
+require 'webrick'
+require "webrick/ssl"
+
+class PuppetSpec::Puppetserver
+  include PuppetSpec::Fixtures
+  include PuppetSpec::Files
+
+  attr_reader :ca_cert, :ca_crl, :server_cert, :server_key
+
+  class NodeServlet < WEBrick::HTTPServlet::AbstractServlet
+    def do_GET request, response
+      node = Puppet::Node.new(Puppet[:certname])
+      response.body = node.render(:json)
+      response['Content-Type'] = 'application/json'
+    end
+  end
+
+  class CatalogServlet < WEBrick::HTTPServlet::AbstractServlet
+    def do_POST request, response
+      response['Content-Type'] = 'application/json'
+      catalog = Puppet::Resource::Catalog.new(Puppet[:certname], 'production')
+      response.body = catalog.render(:json)
+    end
+  end
+
+  class FileMetadatasServlet < WEBrick::HTTPServlet::AbstractServlet
+    def do_GET request, response
+      response['Content-Type'] = 'application/json'
+      response.body = "[{\"path\":\"/etc/puppetlabs/code/environments/production/modules\",\"relative_path\":\".\",\"links\":\"follow\",\"owner\":0,\"group\":0,\"mode\":493,\"checksum\":{\"type\":\"ctime\",\"value\":\"{ctime}2020-03-06 20:14:25 UTC\"},\"type\":\"directory\",\"destination\":null}]"
+    end
+  end
+
+  class ReportServlet < WEBrick::HTTPServlet::AbstractServlet
+    def do_PUT request, response
+      response['Content-Type'] = 'application/json'
+      response.body = "[]"
+    end
+  end
+
+  class StaticFileContentServlet < WEBrick::HTTPServlet::AbstractServlet
+    def do_GET request, response
+      response.status = 404
+    end
+  end
+
+  class FilebucketServlet < WEBrick::HTTPServlet::AbstractServlet
+    def do_GET request, response
+    end
+
+    def do_PUT request, response
+      upload = File.join(@config.config[:TempDir], 'filebucket')
+      File.open(upload, 'wb') { |f| f.write(request.body) }
+      response['Content-Type'] = 'application/octet-stream'
+    end
+
+    def do_HEAD request, response
+      response.status = 404
+    end
+  end
+
+  def initialize
+    @ca_cert = cert_fixture('ca.pem')
+    @ca_crl = crl_fixture('crl.pem')
+    @server_key = key_fixture('127.0.0.1-key.pem')
+    @server_cert = cert_fixture('127.0.0.1.pem')
+    @path = tmpfile('webrick')
+
+    @https = WEBrick::HTTPServer.new(
+      BindAddress: "127.0.0.1",
+      Port: 0, # webrick will choose the first available port, and set it in the config
+      SSLEnable: true,
+      SSLStartImmediately: true,
+      SSLCACertificateFile: File.join(PuppetSpec::FIXTURE_DIR, 'ssl', 'ca.pem'),
+      SSLCertificate: @server_cert,
+      SSLPrivateKey: @server_key,
+      Logger: WEBrick::Log.new(@path),
+      AccessLog: [
+        [@path, WEBrick::AccessLog::COMBINED_LOG_FORMAT],
+      ]
+    )
+
+    trap('INT') do
+      @https.shutdown
+    end
+
+    # Enable this line for more detailed webrick logging
+    # @https.logger.level = 5 # DEBUG
+  end
+
+  def start_server(mounts: {}, &block)
+    register_mounts(mounts: mounts)
+
+    Thread.new do
+      @https.start
+    end
+
+    begin
+      yield @https.config[:Port]
+    ensure
+      @https.shutdown
+    end
+  end
+
+  def register_mounts(mounts: {})
+    register_mount('/status/v1/simple/master', proc { |req, res|  }, nil)
+    register_mount('/puppet/v3/node', mounts[:node], NodeServlet)
+    register_mount('/puppet/v3/catalog', mounts[:catalog], CatalogServlet)
+    register_mount('/puppet/v3/file_metadatas', mounts[:file_metadatas], FileMetadatasServlet)
+    register_mount('/puppet/v3/static_file_content', mounts[:static_file_content], StaticFileContentServlet)
+    register_mount('/puppet/v3/report', mounts[:report], ReportServlet)
+    register_mount('/puppet/v3/file_bucket_file', mounts[:filebucket], FilebucketServlet)
+  end
+
+  def register_mount(path, user_proc, default_servlet)
+    handler = if user_proc
+                WEBrick::HTTPServlet::ProcHandler.new(user_proc)
+              else
+                default_servlet
+              end
+    @https.mount(path, handler)
+  end
+
+  def upload_directory
+    @https.config[:TempDir]
+  end
+end

data/spec/shared_contexts/https.rb

@@ -0,0 +1,29 @@
+require 'spec_helper'
+
+RSpec.shared_context('https client') do
+  before :all do
+    WebMock.disable!
+  end
+
+  after :all do
+    WebMock.enable!
+  end
+
+  before :each do
+    # make sure we don't take too long
+    Puppet[:http_connect_timeout] = '5s'
+    Puppet[:server] = '127.0.0.1'
+    Puppet[:certname] = '127.0.0.1'
+
+    Puppet[:localcacert] = File.join(PuppetSpec::FIXTURE_DIR, 'ssl', 'ca.pem')
+    Puppet[:hostcrl] = File.join(PuppetSpec::FIXTURE_DIR, 'ssl', 'crl.pem')
+    Puppet[:hostprivkey] = File.join(PuppetSpec::FIXTURE_DIR, 'ssl', '127.0.0.1-key.pem')
+    Puppet[:hostcert] = File.join(PuppetSpec::FIXTURE_DIR, 'ssl', '127.0.0.1.pem')
+
+    # set in memory facts since certname is changed above
+    facts = Puppet::Node::Facts.new(Puppet[:certname])
+    Puppet::Node::Facts.indirection.save(facts)
+  end
+
+  let(:https_server) { PuppetSpec::HTTPSServer.new }
+end