puppet 6.20.0-x64-mingw32 → 7.0.0-x64-mingw32
Sign up to get free protection for your applications and to get access to all the features.
Potentially problematic release.
This version of puppet might be problematic. Click here for more details.
- checksums.yaml +4 -4
- data/CODEOWNERS +16 -2
- data/Gemfile +0 -2
- data/Gemfile.lock +18 -24
- data/README.md +1 -1
- data/conf/fileserver.conf +5 -10
- data/ext/build_defaults.yaml +1 -1
- data/ext/osx/file_mapping.yaml +0 -5
- data/ext/project_data.yaml +1 -14
- data/ext/redhat/puppet.spec.erb +0 -1
- data/ext/windows/service/daemon.rb +6 -5
- data/install.rb +21 -17
- data/lib/puppet.rb +11 -20
- data/lib/puppet/application.rb +178 -108
- data/lib/puppet/application/agent.rb +0 -1
- data/lib/puppet/application/apply.rb +2 -3
- data/lib/puppet/application/device.rb +100 -105
- data/lib/puppet/application/filebucket.rb +13 -9
- data/lib/puppet/application/script.rb +0 -1
- data/lib/puppet/application/ssl.rb +1 -1
- data/lib/puppet/application_support.rb +0 -7
- data/lib/puppet/configurer.rb +30 -45
- data/lib/puppet/configurer/plugin_handler.rb +21 -19
- data/lib/puppet/defaults.rb +97 -167
- data/lib/puppet/environments.rb +59 -58
- data/lib/puppet/face/facts.rb +51 -51
- data/lib/puppet/face/help.rb +1 -1
- data/lib/puppet/face/plugin.rb +5 -8
- data/lib/puppet/ffi/windows.rb +12 -0
- data/lib/puppet/ffi/windows/api_types.rb +311 -0
- data/lib/puppet/ffi/windows/constants.rb +404 -0
- data/lib/puppet/ffi/windows/functions.rb +628 -0
- data/lib/puppet/ffi/windows/structs.rb +338 -0
- data/lib/puppet/file_serving/configuration.rb +0 -5
- data/lib/puppet/file_serving/configuration/parser.rb +3 -32
- data/lib/puppet/file_serving/http_metadata.rb +1 -1
- data/lib/puppet/file_serving/mount.rb +1 -2
- data/lib/puppet/forge/repository.rb +0 -1
- data/lib/puppet/generate/models/type/type.rb +4 -1
- data/lib/puppet/http.rb +22 -13
- data/lib/puppet/http/client.rb +164 -114
- data/lib/puppet/{network/resolver.rb → http/dns.rb} +2 -2
- data/lib/puppet/http/errors.rb +16 -0
- data/lib/puppet/http/external_client.rb +5 -7
- data/lib/puppet/{network/http → http}/factory.rb +8 -11
- data/lib/puppet/{network/http → http}/pool.rb +61 -26
- data/lib/puppet/{network/http/session.rb → http/pool_entry.rb} +2 -3
- data/lib/puppet/http/proxy.rb +137 -0
- data/lib/puppet/http/redirector.rb +4 -12
- data/lib/puppet/http/resolver.rb +5 -15
- data/lib/puppet/http/resolver/server_list.rb +6 -10
- data/lib/puppet/http/resolver/settings.rb +4 -7
- data/lib/puppet/http/resolver/srv.rb +7 -11
- data/lib/puppet/http/response.rb +36 -54
- data/lib/puppet/http/response_converter.rb +24 -0
- data/lib/puppet/http/response_net_http.rb +42 -0
- data/lib/puppet/http/retry_after_handler.rb +4 -13
- data/lib/puppet/http/service.rb +12 -26
- data/lib/puppet/http/service/ca.rb +11 -22
- data/lib/puppet/http/service/compiler.rb +22 -69
- data/lib/puppet/http/service/file_server.rb +18 -27
- data/lib/puppet/http/service/puppetserver.rb +26 -12
- data/lib/puppet/http/service/report.rb +8 -10
- data/lib/puppet/http/session.rb +11 -20
- data/lib/puppet/{network/http → http}/site.rb +1 -2
- data/lib/puppet/indirector/catalog/rest.rb +2 -4
- data/lib/puppet/indirector/facts/facter.rb +24 -3
- data/lib/puppet/indirector/facts/rest.rb +3 -22
- data/lib/puppet/indirector/file_bucket_file/rest.rb +3 -9
- data/lib/puppet/indirector/file_content/rest.rb +2 -6
- data/lib/puppet/indirector/file_metadata/rest.rb +3 -9
- data/lib/puppet/indirector/file_server.rb +1 -8
- data/lib/puppet/indirector/generic_http.rb +0 -11
- data/lib/puppet/indirector/node/rest.rb +2 -4
- data/lib/puppet/indirector/report/rest.rb +3 -8
- data/lib/puppet/indirector/request.rb +0 -101
- data/lib/puppet/indirector/rest.rb +12 -263
- data/lib/puppet/module_tool/applications.rb +0 -1
- data/lib/puppet/module_tool/applications/installer.rb +2 -48
- data/lib/puppet/module_tool/errors/shared.rb +2 -17
- data/lib/puppet/network/authconfig.rb +2 -96
- data/lib/puppet/network/authorization.rb +13 -35
- data/lib/puppet/network/http.rb +3 -3
- data/lib/puppet/network/http/api/indirected_routes.rb +2 -20
- data/lib/puppet/network/http/api/master/v3.rb +11 -13
- data/lib/puppet/network/http/connection.rb +247 -316
- data/lib/puppet/network/http/handler.rb +0 -1
- data/lib/puppet/network/http_pool.rb +16 -34
- data/lib/puppet/node.rb +1 -30
- data/lib/puppet/pal/json_catalog_encoder.rb +4 -0
- data/lib/puppet/pal/pal_impl.rb +3 -1
- data/lib/puppet/parser/ast/leaf.rb +2 -3
- data/lib/puppet/parser/ast/pops_bridge.rb +0 -38
- data/lib/puppet/parser/compiler.rb +0 -198
- data/lib/puppet/parser/compiler/catalog_validator/relationship_validator.rb +14 -39
- data/lib/puppet/parser/resource.rb +0 -69
- data/lib/puppet/parser/templatewrapper.rb +1 -1
- data/lib/puppet/pops/evaluator/deferred_resolver.rb +3 -5
- data/lib/puppet/pops/evaluator/evaluator_impl.rb +0 -5
- data/lib/puppet/pops/evaluator/runtime3_resource_support.rb +3 -3
- data/lib/puppet/pops/evaluator/runtime3_support.rb +1 -1
- data/lib/puppet/pops/issues.rb +0 -5
- data/lib/puppet/pops/loader/ruby_legacy_function_instantiator.rb +6 -8
- data/lib/puppet/pops/model/ast.pp +0 -42
- data/lib/puppet/pops/model/ast.rb +0 -290
- data/lib/puppet/pops/model/ast_transformer.rb +1 -1
- data/lib/puppet/pops/model/factory.rb +0 -45
- data/lib/puppet/pops/model/model_label_provider.rb +0 -5
- data/lib/puppet/pops/model/model_tree_dumper.rb +0 -22
- data/lib/puppet/pops/model/pn_transformer.rb +0 -16
- data/lib/puppet/pops/parser/egrammar.ra +0 -56
- data/lib/puppet/pops/parser/eparser.rb +1520 -1712
- data/lib/puppet/pops/parser/lexer2.rb +4 -4
- data/lib/puppet/pops/parser/parser_support.rb +0 -5
- data/lib/puppet/pops/resource/resource_type_impl.rb +2 -24
- data/lib/puppet/pops/types/type_calculator.rb +0 -7
- data/lib/puppet/pops/types/type_parser.rb +0 -4
- data/lib/puppet/pops/types/types.rb +0 -1
- data/lib/puppet/pops/validation/checker4_0.rb +9 -37
- data/lib/puppet/pops/validation/tasks_checker.rb +0 -12
- data/lib/puppet/pops/validation/validator_factory_4_0.rb +1 -2
- data/lib/puppet/provider.rb +0 -13
- data/lib/puppet/provider/nameservice.rb +0 -18
- data/lib/puppet/provider/package/apt.rb +0 -4
- data/lib/puppet/provider/package/dpkg.rb +0 -10
- data/lib/puppet/provider/package/gem.rb +23 -3
- data/lib/puppet/provider/package/pip.rb +0 -1
- data/lib/puppet/provider/package/pkg.rb +0 -4
- data/lib/puppet/provider/package/portage.rb +1 -1
- data/lib/puppet/provider/package/puppet_gem.rb +1 -4
- data/lib/puppet/provider/service/smf.rb +191 -73
- data/lib/puppet/provider/user/aix.rb +2 -2
- data/lib/puppet/provider/user/directoryservice.rb +0 -10
- data/lib/puppet/reference/configuration.rb +7 -6
- data/lib/puppet/reference/indirection.rb +1 -1
- data/lib/puppet/resource.rb +1 -89
- data/lib/puppet/resource/catalog.rb +1 -14
- data/lib/puppet/resource/type.rb +3 -119
- data/lib/puppet/resource/type_collection.rb +3 -48
- data/lib/puppet/runtime.rb +1 -2
- data/lib/puppet/settings.rb +73 -66
- data/lib/puppet/settings/integer_setting.rb +17 -0
- data/lib/puppet/settings/port_setting.rb +15 -0
- data/lib/puppet/settings/priority_setting.rb +5 -4
- data/lib/puppet/ssl.rb +10 -6
- data/lib/puppet/ssl/base.rb +3 -5
- data/lib/puppet/ssl/certificate.rb +0 -6
- data/lib/puppet/ssl/certificate_request.rb +1 -12
- data/lib/puppet/ssl/certificate_signer.rb +6 -0
- data/lib/puppet/ssl/oids.rb +3 -1
- data/lib/puppet/ssl/ssl_provider.rb +17 -0
- data/lib/puppet/ssl/state_machine.rb +3 -1
- data/lib/puppet/ssl/verifier.rb +2 -0
- data/lib/puppet/test/test_helper.rb +1 -3
- data/lib/puppet/transaction.rb +1 -7
- data/lib/puppet/transaction/report.rb +2 -4
- data/lib/puppet/type.rb +0 -76
- data/lib/puppet/type/file.rb +5 -7
- data/lib/puppet/type/file/checksum.rb +1 -1
- data/lib/puppet/type/file/source.rb +1 -1
- data/lib/puppet/type/filebucket.rb +3 -3
- data/lib/puppet/type/package.rb +5 -13
- data/lib/puppet/util/autoload.rb +8 -1
- data/lib/puppet/util/execution.rb +0 -11
- data/lib/puppet/util/http_proxy.rb +2 -215
- data/lib/puppet/util/monkey_patches.rb +0 -46
- data/lib/puppet/util/posix.rb +5 -54
- data/lib/puppet/util/rdoc.rb +0 -7
- data/lib/puppet/util/retry_action.rb +1 -1
- data/lib/puppet/util/run_mode.rb +9 -1
- data/lib/puppet/util/windows.rb +3 -8
- data/lib/puppet/util/windows/daemon.rb +360 -0
- data/lib/puppet/util/windows/error.rb +1 -0
- data/lib/puppet/util/windows/eventlog.rb +4 -9
- data/lib/puppet/util/windows/file.rb +8 -242
- data/lib/puppet/util/windows/monkey_patches/process.rb +414 -0
- data/lib/puppet/util/windows/process.rb +4 -226
- data/lib/puppet/util/windows/service.rb +9 -460
- data/lib/puppet/util/windows/string.rb +12 -13
- data/lib/puppet/util/yaml.rb +0 -22
- data/lib/puppet/vendor/require_vendored.rb +0 -1
- data/lib/puppet/version.rb +1 -1
- data/lib/puppet/x509.rb +5 -1
- data/lib/puppet/x509/cert_provider.rb +29 -1
- data/locales/puppet.pot +587 -1312
- data/man/man5/puppet.conf.5 +39 -99
- data/man/man8/puppet-agent.8 +2 -2
- data/man/man8/puppet-apply.8 +2 -2
- data/man/man8/puppet-catalog.8 +1 -1
- data/man/man8/puppet-config.8 +1 -1
- data/man/man8/puppet-describe.8 +1 -1
- data/man/man8/puppet-device.8 +2 -2
- data/man/man8/puppet-doc.8 +1 -1
- data/man/man8/puppet-epp.8 +1 -1
- data/man/man8/puppet-facts.8 +51 -36
- data/man/man8/puppet-filebucket.8 +4 -4
- data/man/man8/puppet-generate.8 +1 -1
- data/man/man8/puppet-help.8 +1 -1
- data/man/man8/puppet-lookup.8 +1 -1
- data/man/man8/puppet-module.8 +1 -58
- data/man/man8/puppet-node.8 +1 -1
- data/man/man8/puppet-parser.8 +1 -1
- data/man/man8/puppet-plugin.8 +1 -1
- data/man/man8/puppet-report.8 +1 -1
- data/man/man8/puppet-resource.8 +1 -1
- data/man/man8/puppet-script.8 +2 -2
- data/man/man8/puppet-ssl.8 +1 -1
- data/man/man8/puppet.8 +2 -2
- data/spec/fixtures/unit/provider/service/smf/{svcs.out → svcs_instances.out} +0 -0
- data/spec/fixtures/unit/provider/user/aix/aix_passwd_file.out +0 -4
- data/spec/integration/application/agent_spec.rb +27 -138
- data/spec/integration/application/apply_spec.rb +1 -20
- data/spec/integration/application/filebucket_spec.rb +16 -16
- data/spec/integration/application/help_spec.rb +2 -0
- data/spec/integration/application/plugin_spec.rb +23 -1
- data/spec/integration/defaults_spec.rb +14 -3
- data/spec/integration/network/http_pool_spec.rb +3 -21
- data/spec/integration/parser/catalog_spec.rb +0 -38
- data/spec/integration/parser/node_spec.rb +0 -9
- data/spec/integration/parser/pcore_resource_spec.rb +0 -37
- data/spec/integration/resource/type_collection_spec.rb +6 -2
- data/spec/integration/transaction_spec.rb +9 -4
- data/spec/integration/type/file_spec.rb +5 -4
- data/spec/integration/util/windows/adsi_spec.rb +1 -3
- data/spec/integration/util/windows/monkey_patches/process_spec.rb +231 -0
- data/spec/integration/util/windows/registry_spec.rb +10 -0
- data/spec/integration/util/windows/security_spec.rb +1 -1
- data/spec/lib/puppet_spec/puppetserver.rb +1 -1
- data/spec/lib/puppet_spec/settings.rb +1 -0
- data/spec/spec_helper.rb +6 -1
- data/spec/unit/agent_spec.rb +6 -10
- data/spec/unit/application/agent_spec.rb +1 -0
- data/spec/unit/application/facts_spec.rb +35 -0
- data/spec/unit/application/filebucket_spec.rb +43 -39
- data/spec/unit/application/ssl_spec.rb +2 -2
- data/spec/unit/application_spec.rb +9 -51
- data/spec/unit/certificate_factory_spec.rb +1 -1
- data/spec/unit/configurer/downloader_spec.rb +6 -2
- data/spec/unit/configurer/plugin_handler_spec.rb +56 -18
- data/spec/unit/configurer_spec.rb +12 -9
- data/spec/unit/confine/feature_spec.rb +1 -1
- data/spec/unit/confine_spec.rb +2 -8
- data/spec/unit/context/trusted_information_spec.rb +2 -6
- data/spec/unit/defaults_spec.rb +72 -42
- data/spec/unit/environments_spec.rb +19 -99
- data/spec/unit/face/facts_spec.rb +4 -0
- data/spec/unit/face/node_spec.rb +11 -0
- data/spec/unit/face/plugin_spec.rb +73 -33
- data/spec/unit/file_bucket/file_spec.rb +1 -1
- data/spec/unit/file_serving/configuration/parser_spec.rb +15 -18
- data/spec/unit/file_serving/configuration_spec.rb +6 -12
- data/spec/unit/file_serving/metadata_spec.rb +3 -3
- data/spec/unit/file_serving/terminus_helper_spec.rb +4 -11
- data/spec/unit/forge/module_release_spec.rb +7 -2
- data/spec/unit/functions/camelcase_spec.rb +1 -1
- data/spec/unit/functions/capitalize_spec.rb +1 -1
- data/spec/unit/functions/downcase_spec.rb +1 -1
- data/spec/unit/functions/upcase_spec.rb +1 -1
- data/spec/unit/http/client_spec.rb +7 -8
- data/spec/unit/{network/resolver_spec.rb → http/dns_spec.rb} +3 -3
- data/spec/unit/http/external_client_spec.rb +4 -4
- data/spec/unit/{network/http → http}/factory_spec.rb +5 -11
- data/spec/unit/{network/http/session_spec.rb → http/pool_entry_spec.rb} +3 -3
- data/spec/unit/{network/http → http}/pool_spec.rb +12 -17
- data/spec/unit/{util/http_proxy_spec.rb → http/proxy_spec.rb} +2 -69
- data/spec/unit/http/resolver_spec.rb +13 -13
- data/spec/unit/http/service/compiler_spec.rb +0 -62
- data/spec/unit/http/service/file_server_spec.rb +3 -3
- data/spec/unit/http/service/puppetserver_spec.rb +34 -4
- data/spec/unit/http/service_spec.rb +0 -1
- data/spec/unit/http/session_spec.rb +16 -14
- data/spec/unit/{network/http → http}/site_spec.rb +3 -3
- data/spec/unit/indirector/face_spec.rb +1 -0
- data/spec/unit/indirector/facts/facter_spec.rb +98 -0
- data/spec/unit/indirector/file_bucket_file/file_spec.rb +5 -3
- data/spec/unit/indirector/file_bucket_file/selector_spec.rb +8 -26
- data/spec/unit/indirector/file_content/rest_spec.rb +0 -4
- data/spec/unit/indirector/file_metadata/rest_spec.rb +0 -4
- data/spec/unit/indirector/file_server_spec.rb +1 -15
- data/spec/unit/indirector/indirection_spec.rb +12 -8
- data/spec/unit/indirector/report/rest_spec.rb +2 -17
- data/spec/unit/indirector/request_spec.rb +0 -264
- data/spec/unit/indirector/rest_spec.rb +98 -752
- data/spec/unit/indirector_spec.rb +2 -2
- data/spec/unit/module_tool/applications/installer_spec.rb +0 -66
- data/spec/unit/network/authconfig_spec.rb +2 -129
- data/spec/unit/network/authorization_spec.rb +2 -55
- data/spec/unit/network/formats_spec.rb +4 -4
- data/spec/unit/network/http/api/indirected_routes_spec.rb +5 -92
- data/spec/unit/network/http/api/master/v3_spec.rb +28 -7
- data/spec/unit/network/http/api_spec.rb +10 -0
- data/spec/unit/network/http/connection_spec.rb +19 -41
- data/spec/unit/network/http/handler_spec.rb +0 -1
- data/spec/unit/network/http_pool_spec.rb +0 -4
- data/spec/unit/node/environment_spec.rb +33 -21
- data/spec/unit/node_spec.rb +2 -54
- data/spec/unit/parser/compiler_spec.rb +19 -3
- data/spec/unit/parser/functions/create_resources_spec.rb +2 -20
- data/spec/unit/parser/resource_spec.rb +8 -14
- data/spec/unit/parser/templatewrapper_spec.rb +3 -4
- data/spec/unit/pops/evaluator/evaluating_parser_spec.rb +4 -7
- data/spec/unit/pops/loaders/loaders_spec.rb +6 -21
- data/spec/unit/pops/parser/parse_application_spec.rb +4 -22
- data/spec/unit/pops/parser/parse_basic_expressions_spec.rb +0 -1
- data/spec/unit/pops/parser/parse_capabilities_spec.rb +8 -21
- data/spec/unit/pops/parser/parse_site_spec.rb +20 -24
- data/spec/unit/pops/resource/resource_type_impl_spec.rb +0 -71
- data/spec/unit/pops/serialization/to_from_hr_spec.rb +1 -1
- data/spec/unit/pops/types/type_calculator_spec.rb +6 -6
- data/spec/unit/pops/types/type_factory_spec.rb +1 -1
- data/spec/unit/pops/validator/validator_spec.rb +61 -46
- data/spec/unit/pops/visitor_spec.rb +1 -1
- data/spec/unit/property_spec.rb +0 -1
- data/spec/unit/provider/nameservice_spec.rb +64 -122
- data/spec/unit/provider/package/apt_spec.rb +8 -4
- data/spec/unit/provider/package/base_spec.rb +5 -6
- data/spec/unit/provider/package/dpkg_spec.rb +0 -48
- data/spec/unit/provider/package/gem_spec.rb +32 -0
- data/spec/unit/provider/package/pacman_spec.rb +12 -18
- data/spec/unit/provider/package/pip_spec.rb +11 -6
- data/spec/unit/provider/package/pkgdmg_spec.rb +4 -0
- data/spec/unit/provider/package/puppet_gem_spec.rb +3 -2
- data/spec/unit/provider/service/smf_spec.rb +401 -165
- data/spec/unit/provider/service/windows_spec.rb +0 -1
- data/spec/unit/provider/user/aix_spec.rb +0 -5
- data/spec/unit/provider/user/hpux_spec.rb +1 -1
- data/spec/unit/provider/user/pw_spec.rb +0 -2
- data/spec/unit/provider/user/useradd_spec.rb +0 -1
- data/spec/unit/provider_spec.rb +8 -18
- data/spec/unit/resource/type_collection_spec.rb +2 -22
- data/spec/unit/resource/type_spec.rb +1 -1
- data/spec/unit/resource_spec.rb +10 -67
- data/spec/unit/settings/http_extra_headers_spec.rb +2 -4
- data/spec/unit/settings/integer_setting_spec.rb +42 -0
- data/spec/unit/settings/port_setting_spec.rb +31 -0
- data/spec/unit/settings/priority_setting_spec.rb +4 -4
- data/spec/unit/settings_spec.rb +23 -13
- data/spec/unit/ssl/base_spec.rb +37 -3
- data/spec/unit/ssl/certificate_request_spec.rb +15 -45
- data/spec/unit/ssl/certificate_spec.rb +2 -11
- data/spec/unit/ssl/ssl_provider_spec.rb +2 -5
- data/spec/unit/ssl/state_machine_spec.rb +0 -1
- data/spec/unit/ssl/verifier_spec.rb +0 -21
- data/spec/unit/transaction/additional_resource_generator_spec.rb +7 -3
- data/spec/unit/transaction/event_manager_spec.rb +11 -14
- data/spec/unit/transaction/report_spec.rb +0 -2
- data/spec/unit/transaction/resource_harness_spec.rb +2 -2
- data/spec/unit/transaction_spec.rb +48 -91
- data/spec/unit/type/file/checksum_spec.rb +6 -6
- data/spec/unit/type/file/content_spec.rb +2 -1
- data/spec/unit/type/file/ensure_spec.rb +1 -1
- data/spec/unit/type/file/mode_spec.rb +1 -1
- data/spec/unit/type/file/selinux_spec.rb +2 -0
- data/spec/unit/type/file/source_spec.rb +0 -1
- data/spec/unit/type/file_spec.rb +18 -6
- data/spec/unit/type/group_spec.rb +6 -13
- data/spec/unit/type/package_spec.rb +1 -1
- data/spec/unit/type/resources_spec.rb +7 -7
- data/spec/unit/type/service_spec.rb +1 -1
- data/spec/unit/type/tidy_spec.rb +1 -0
- data/spec/unit/type_spec.rb +22 -2
- data/spec/unit/util/at_fork_spec.rb +2 -2
- data/spec/unit/util/autoload_spec.rb +1 -5
- data/spec/unit/util/backups_spec.rb +2 -3
- data/spec/unit/util/execution_spec.rb +11 -44
- data/spec/unit/util/inifile_spec.rb +14 -6
- data/spec/unit/util/log_spec.rb +7 -8
- data/spec/unit/util/logging_spec.rb +3 -3
- data/spec/unit/util/monkey_patches_spec.rb +0 -6
- data/spec/unit/util/posix_spec.rb +15 -363
- data/spec/unit/util/run_mode_spec.rb +21 -121
- data/spec/unit/util/selinux_spec.rb +52 -76
- data/spec/unit/util/storage_spec.rb +1 -3
- data/spec/unit/util/suidmanager_spec.rb +41 -44
- data/spec/unit/util/windows/string_spec.rb +1 -3
- data/spec/unit/util/yaml_spec.rb +0 -54
- data/spec/unit/util_spec.rb +6 -31
- metadata +40 -233
- data/conf/auth.conf +0 -150
- data/lib/puppet/application/cert.rb +0 -76
- data/lib/puppet/application/key.rb +0 -4
- data/lib/puppet/application/man.rb +0 -4
- data/lib/puppet/application/status.rb +0 -4
- data/lib/puppet/face/key.rb +0 -16
- data/lib/puppet/face/man.rb +0 -145
- data/lib/puppet/face/module/build.rb +0 -14
- data/lib/puppet/face/module/generate.rb +0 -14
- data/lib/puppet/face/module/search.rb +0 -103
- data/lib/puppet/face/status.rb +0 -51
- data/lib/puppet/ffi/posix.rb +0 -10
- data/lib/puppet/ffi/posix/constants.rb +0 -14
- data/lib/puppet/ffi/posix/functions.rb +0 -24
- data/lib/puppet/indirector/certificate/file.rb +0 -9
- data/lib/puppet/indirector/certificate/rest.rb +0 -18
- data/lib/puppet/indirector/certificate_request/file.rb +0 -9
- data/lib/puppet/indirector/certificate_request/memory.rb +0 -7
- data/lib/puppet/indirector/certificate_request/rest.rb +0 -11
- data/lib/puppet/indirector/file_content/http.rb +0 -22
- data/lib/puppet/indirector/key/file.rb +0 -46
- data/lib/puppet/indirector/key/memory.rb +0 -7
- data/lib/puppet/indirector/ssl_file.rb +0 -162
- data/lib/puppet/indirector/status.rb +0 -3
- data/lib/puppet/indirector/status/local.rb +0 -12
- data/lib/puppet/indirector/status/rest.rb +0 -27
- data/lib/puppet/module_tool/applications/searcher.rb +0 -29
- data/lib/puppet/network/auth_config_parser.rb +0 -90
- data/lib/puppet/network/authstore.rb +0 -283
- data/lib/puppet/network/http/api/master/v3/authorization.rb +0 -18
- data/lib/puppet/network/http/api/master/v3/environment.rb +0 -88
- data/lib/puppet/network/http/base_pool.rb +0 -36
- data/lib/puppet/network/http/compression.rb +0 -127
- data/lib/puppet/network/http/connection_adapter.rb +0 -184
- data/lib/puppet/network/http/nocache_pool.rb +0 -28
- data/lib/puppet/network/rest_controller.rb +0 -2
- data/lib/puppet/network/rights.rb +0 -210
- data/lib/puppet/parser/compiler/catalog_validator/env_relationship_validator.rb +0 -66
- data/lib/puppet/parser/compiler/catalog_validator/site_validator.rb +0 -22
- data/lib/puppet/parser/environment_compiler.rb +0 -202
- data/lib/puppet/pops/types/enumeration.rb +0 -16
- data/lib/puppet/resource/capability_finder.rb +0 -154
- data/lib/puppet/rest/errors.rb +0 -15
- data/lib/puppet/rest/response.rb +0 -35
- data/lib/puppet/rest/route.rb +0 -85
- data/lib/puppet/rest/routes.rb +0 -135
- data/lib/puppet/settings/alias_setting.rb +0 -37
- data/lib/puppet/ssl/host.rb +0 -505
- data/lib/puppet/ssl/key.rb +0 -61
- data/lib/puppet/ssl/validator.rb +0 -61
- data/lib/puppet/ssl/validator/default_validator.rb +0 -209
- data/lib/puppet/ssl/validator/no_validator.rb +0 -22
- data/lib/puppet/ssl/verifier_adapter.rb +0 -58
- data/lib/puppet/status.rb +0 -40
- data/lib/puppet/util/connection.rb +0 -88
- data/lib/puppet/util/fact_dif.rb +0 -62
- data/lib/puppet/util/ssl.rb +0 -83
- data/lib/puppet/util/windows/api_types.rb +0 -309
- data/lib/puppet/util/windows/monkey_patches/dir.rb +0 -40
- data/lib/puppet/vendor/load_pathspec.rb +0 -1
- data/lib/puppet/vendor/pathspec/CHANGELOG.md +0 -2
- data/lib/puppet/vendor/pathspec/LICENSE +0 -201
- data/lib/puppet/vendor/pathspec/PUPPET_README.md +0 -6
- data/lib/puppet/vendor/pathspec/README.md +0 -53
- data/lib/puppet/vendor/pathspec/lib/pathspec.rb +0 -122
- data/lib/puppet/vendor/pathspec/lib/pathspec/gitignorespec.rb +0 -275
- data/lib/puppet/vendor/pathspec/lib/pathspec/regexspec.rb +0 -17
- data/lib/puppet/vendor/pathspec/lib/pathspec/spec.rb +0 -14
- data/man/man8/puppet-key.8 +0 -126
- data/man/man8/puppet-man.8 +0 -76
- data/man/man8/puppet-status.8 +0 -108
- data/spec/fixtures/integration/application/agent/cached_deferred_catalog.json +0 -91
- data/spec/integration/network/authconfig_spec.rb +0 -256
- data/spec/integration/util/windows/monkey_patches/dir_spec.rb +0 -11
- data/spec/unit/application/man_spec.rb +0 -52
- data/spec/unit/capability_spec.rb +0 -414
- data/spec/unit/face/key_spec.rb +0 -9
- data/spec/unit/face/module/search_spec.rb +0 -231
- data/spec/unit/face/status_spec.rb +0 -9
- data/spec/unit/indirector/certificate/file_spec.rb +0 -14
- data/spec/unit/indirector/certificate/rest_spec.rb +0 -61
- data/spec/unit/indirector/certificate_request/file_spec.rb +0 -14
- data/spec/unit/indirector/certificate_request/rest_spec.rb +0 -25
- data/spec/unit/indirector/key/file_spec.rb +0 -78
- data/spec/unit/indirector/ssl_file_spec.rb +0 -305
- data/spec/unit/indirector/status/local_spec.rb +0 -10
- data/spec/unit/indirector/status/rest_spec.rb +0 -50
- data/spec/unit/module_tool/applications/searcher_spec.rb +0 -38
- data/spec/unit/network/auth_config_parser_spec.rb +0 -115
- data/spec/unit/network/authstore_spec.rb +0 -422
- data/spec/unit/network/http/api/master/v3/authorization_spec.rb +0 -57
- data/spec/unit/network/http/api/master/v3/environment_spec.rb +0 -185
- data/spec/unit/network/http/compression_spec.rb +0 -240
- data/spec/unit/network/http/nocache_pool_spec.rb +0 -64
- data/spec/unit/network/http_spec.rb +0 -9
- data/spec/unit/network/rights_spec.rb +0 -439
- data/spec/unit/parser/environment_compiler_spec.rb +0 -730
- data/spec/unit/pops/evaluator/deferred_resolver_spec.rb +0 -20
- data/spec/unit/pops/types/enumeration_spec.rb +0 -51
- data/spec/unit/resource/capability_finder_spec.rb +0 -148
- data/spec/unit/rest/route_spec.rb +0 -132
- data/spec/unit/ssl/host_spec.rb +0 -645
- data/spec/unit/ssl/key_spec.rb +0 -173
- data/spec/unit/ssl/validator_spec.rb +0 -278
- data/spec/unit/status_spec.rb +0 -45
- data/spec/unit/util/ssl_spec.rb +0 -91
@@ -1,20 +0,0 @@
|
|
1
|
-
require 'spec_helper'
|
2
|
-
require 'puppet_spec/compiler'
|
3
|
-
|
4
|
-
describe Puppet::Pops::Evaluator::DeferredResolver do
|
5
|
-
include PuppetSpec::Compiler
|
6
|
-
|
7
|
-
let(:environment) { Puppet::Node::Environment.create(:testing, []) }
|
8
|
-
let(:facts) { Puppet::Node::Facts.new('node.example.com') }
|
9
|
-
|
10
|
-
it 'resolves deferred values in a catalog' do
|
11
|
-
catalog = compile_to_catalog(<<~END)
|
12
|
-
notify { "deferred":
|
13
|
-
message => Deferred("join", [[1,2,3], ":"])
|
14
|
-
}
|
15
|
-
END
|
16
|
-
described_class.resolve_and_replace(facts, catalog)
|
17
|
-
|
18
|
-
expect(catalog.resource(:notify, 'deferred')[:message]).to eq('1:2:3')
|
19
|
-
end
|
20
|
-
end
|
@@ -1,51 +0,0 @@
|
|
1
|
-
require 'spec_helper'
|
2
|
-
require 'puppet/pops'
|
3
|
-
|
4
|
-
module Puppet::Pops::Types
|
5
|
-
describe 'The enumeration support' do
|
6
|
-
it 'produces an enumerator for Array' do
|
7
|
-
expect(Enumeration.enumerator([1,2,3]).respond_to?(:next)).to eql(true)
|
8
|
-
end
|
9
|
-
|
10
|
-
it 'produces an enumerator for Hash' do
|
11
|
-
expect(Enumeration.enumerator({:a=>1}).respond_to?(:next)).to eql(true)
|
12
|
-
end
|
13
|
-
|
14
|
-
it 'produces a char enumerator for String' do
|
15
|
-
enum = Enumeration.enumerator("abc")
|
16
|
-
expect(enum.respond_to?(:next)).to eql(true)
|
17
|
-
expect(enum.next).to eql('a')
|
18
|
-
end
|
19
|
-
|
20
|
-
it 'produces an enumerator for integer times' do
|
21
|
-
enum = Enumeration.enumerator(2)
|
22
|
-
expect(enum.next).to eql(0)
|
23
|
-
expect(enum.next).to eql(1)
|
24
|
-
expect{enum.next}.to raise_error(StopIteration)
|
25
|
-
end
|
26
|
-
|
27
|
-
it 'produces an enumerator for Integer range' do
|
28
|
-
range = TypeFactory.range(1,2)
|
29
|
-
enum = Enumeration.enumerator(range)
|
30
|
-
expect(enum.next).to eql(1)
|
31
|
-
expect(enum.next).to eql(2)
|
32
|
-
expect{enum.next}.to raise_error(StopIteration)
|
33
|
-
end
|
34
|
-
|
35
|
-
it 'does not produce an enumerator for infinite Integer range' do
|
36
|
-
range = TypeFactory.range(1,:default)
|
37
|
-
enum = Enumeration.enumerator(range)
|
38
|
-
expect(enum).to be_nil
|
39
|
-
range = TypeFactory.range(:default,2)
|
40
|
-
enum = Enumeration.enumerator(range)
|
41
|
-
expect(enum).to be_nil
|
42
|
-
end
|
43
|
-
|
44
|
-
[3.14, /.*/, true, false, nil, :something].each do |x|
|
45
|
-
it "does not produce an enumerator for object of type #{x.class}" do
|
46
|
-
enum = Enumeration.enumerator(x)
|
47
|
-
expect(enum).to be_nil
|
48
|
-
end
|
49
|
-
end
|
50
|
-
end
|
51
|
-
end
|
@@ -1,148 +0,0 @@
|
|
1
|
-
require 'spec_helper'
|
2
|
-
require_relative '../pops/parser/parser_rspec_helper'
|
3
|
-
require 'puppet/resource/capability_finder'
|
4
|
-
|
5
|
-
describe Puppet::Resource::CapabilityFinder do
|
6
|
-
context 'when PuppetDB is not configured' do
|
7
|
-
it 'should error' do
|
8
|
-
expect(Puppet::Util).to receive(:const_defined?).with('Puppetdb').and_return(false)
|
9
|
-
expect { Puppet::Resource::CapabilityFinder.find('production', nil, nil) }.to raise_error(/PuppetDB is not available/)
|
10
|
-
end
|
11
|
-
end
|
12
|
-
|
13
|
-
context 'when PuppetDB is configured' do
|
14
|
-
before(:each) do
|
15
|
-
allow_any_instance_of(Puppet::Parser::Compiler).to receive(:loaders).and_return(loaders)
|
16
|
-
Puppet.push_context({:loaders => loaders, :current_environment => env})
|
17
|
-
if mock_pdb
|
18
|
-
module Puppet::Util::Puppetdb
|
19
|
-
def query_puppetdb(query); end
|
20
|
-
module_function :query_puppetdb
|
21
|
-
|
22
|
-
class Http
|
23
|
-
def self.action(url); end
|
24
|
-
end
|
25
|
-
end
|
26
|
-
end
|
27
|
-
make_cap_type
|
28
|
-
end
|
29
|
-
|
30
|
-
after(:each) do
|
31
|
-
Puppet::Util.send(:remove_const, 'Puppetdb') if mock_pdb
|
32
|
-
Puppet::Type.rmtype(:cap)
|
33
|
-
Puppet.pop_context()
|
34
|
-
end
|
35
|
-
|
36
|
-
let(:mock_pdb) { !Puppet::Util.const_defined?('Puppetdb') }
|
37
|
-
let(:env) { Puppet::Node::Environment.create(:testing, []) }
|
38
|
-
let(:loaders) { Puppet::Pops::Loaders.new(env) }
|
39
|
-
|
40
|
-
let(:response_body) { [{"type"=>"Cap", "title"=>"cap", "parameters"=>{"host"=>"ahost"}}] }
|
41
|
-
let(:response) { double('response', :body => response_body.to_json) }
|
42
|
-
|
43
|
-
def make_cap_type
|
44
|
-
Puppet::Type.newtype :cap, :is_capability => true do
|
45
|
-
newparam :name
|
46
|
-
newparam :host
|
47
|
-
end
|
48
|
-
end
|
49
|
-
|
50
|
-
describe "when query_puppetdb method is available" do
|
51
|
-
it 'should call use the query_puppetdb method if available' do
|
52
|
-
expect(Puppet::Util::Puppetdb).to receive(:query_puppetdb).and_return(response_body)
|
53
|
-
expect(Puppet::Util::Puppetdb::Http).not_to receive(:action)
|
54
|
-
|
55
|
-
result = Puppet::Resource::CapabilityFinder.find('production', nil, Puppet::Resource.new('Cap', 'cap'))
|
56
|
-
expect(result['host']).to eq('ahost')
|
57
|
-
end
|
58
|
-
end
|
59
|
-
|
60
|
-
describe "when query_puppetdb method is unavailable" do
|
61
|
-
before :each do
|
62
|
-
allow(Puppet::Util::Puppetdb).to receive(:respond_to?).with(:query_puppetdb).and_return(false)
|
63
|
-
end
|
64
|
-
|
65
|
-
it 'should call Puppet::Util::PuppetDB::Http.action' do
|
66
|
-
expect(Puppet::Util::Puppetdb::Http).to receive(:action).and_return(response)
|
67
|
-
result = Puppet::Resource::CapabilityFinder.find('production', nil, Puppet::Resource.new('Cap', 'cap'))
|
68
|
-
expect(result['host']).to eq('ahost')
|
69
|
-
end
|
70
|
-
end
|
71
|
-
|
72
|
-
describe '#find' do
|
73
|
-
let(:capability) { Puppet::Resource.new('Cap', 'cap') }
|
74
|
-
let(:code_id) { 'b59e5df0578ef411f773ee6c33d8073c50e7b8fe' }
|
75
|
-
|
76
|
-
it 'should search for the resource without including code_id or environment' do
|
77
|
-
resources = [{"type"=>"Cap", "title"=>"cap", "parameters"=>{"host"=>"ahost"}}]
|
78
|
-
allow(Puppet::Resource::CapabilityFinder).to receive(:search).with(nil, nil, capability).and_return(resources)
|
79
|
-
|
80
|
-
result = Puppet::Resource::CapabilityFinder.find('production', code_id, Puppet::Resource.new('Cap', 'cap'))
|
81
|
-
expect(result['host']).to eq('ahost')
|
82
|
-
end
|
83
|
-
|
84
|
-
it 'should return nil if no resource is found' do
|
85
|
-
allow(Puppet::Resource::CapabilityFinder).to receive(:search).with(nil, nil, capability).and_return([])
|
86
|
-
|
87
|
-
result = Puppet::Resource::CapabilityFinder.find('production', code_id, capability)
|
88
|
-
expect(result).to be_nil
|
89
|
-
end
|
90
|
-
|
91
|
-
describe 'when multiple results are returned for different environments' do
|
92
|
-
let(:resources) do
|
93
|
-
[{"type"=>"Cap", "title"=>"cap", "parameters"=>{"host"=>"ahost"}, "tags"=>["producer:production"]},
|
94
|
-
{"type"=>"Cap", "title"=>"cap", "parameters"=>{"host"=>"bhost"}, "tags"=>["producer:other_env"]}]
|
95
|
-
end
|
96
|
-
|
97
|
-
before :each do
|
98
|
-
allow(Puppet::Resource::CapabilityFinder).to receive(:search).with(nil, nil, capability).and_return(resources)
|
99
|
-
end
|
100
|
-
|
101
|
-
it 'should return the resource matching environment' do
|
102
|
-
result = Puppet::Resource::CapabilityFinder.find('production', code_id, capability)
|
103
|
-
expect(result['host']).to eq('ahost')
|
104
|
-
end
|
105
|
-
|
106
|
-
it 'should return nil if no resource matches environment' do
|
107
|
-
result = Puppet::Resource::CapabilityFinder.find('bad_env', code_id, capability)
|
108
|
-
expect(result).to be_nil
|
109
|
-
end
|
110
|
-
end
|
111
|
-
|
112
|
-
describe 'when multiple results are returned for the same environment' do
|
113
|
-
let(:resources) do
|
114
|
-
[{"type"=>"Cap", "title"=>"cap", "parameters"=>{"host"=>"ahost"}, "tags"=>["producer:production"]},
|
115
|
-
{"type"=>"Cap", "title"=>"cap", "parameters"=>{"host"=>"bhost"}, "tags"=>["producer:production"]}]
|
116
|
-
end
|
117
|
-
|
118
|
-
before :each do
|
119
|
-
allow(Puppet::Resource::CapabilityFinder).to receive(:search).with(nil, nil, capability).and_return(resources)
|
120
|
-
end
|
121
|
-
|
122
|
-
it 'should return the resource matching code_id' do
|
123
|
-
allow(Puppet::Resource::CapabilityFinder).to receive(:search).with('production', code_id, capability).and_return([{"type"=>"Cap", "title"=>"cap", "parameters"=>{"host"=>"chost"}}])
|
124
|
-
|
125
|
-
result = Puppet::Resource::CapabilityFinder.find('production', code_id, capability)
|
126
|
-
expect(result['host']).to eq('chost')
|
127
|
-
end
|
128
|
-
|
129
|
-
it 'should fail if no resource matches code_id' do
|
130
|
-
allow(Puppet::Resource::CapabilityFinder).to receive(:search).with('production', code_id, capability).and_return([])
|
131
|
-
|
132
|
-
expect { Puppet::Resource::CapabilityFinder.find('production', code_id, capability) }.to raise_error(Puppet::Error, /expected exactly one resource but got 2/)
|
133
|
-
end
|
134
|
-
|
135
|
-
it 'should fail if multiple resources match code_id' do
|
136
|
-
allow(Puppet::Resource::CapabilityFinder).to receive(:search).with('production', code_id, capability).and_return(resources)
|
137
|
-
|
138
|
-
expect { Puppet::Resource::CapabilityFinder.find('production', code_id, capability) }.to raise_error(Puppet::DevError, /expected exactly one resource but got 2/)
|
139
|
-
end
|
140
|
-
|
141
|
-
it 'should fail if no code_id was specified' do
|
142
|
-
allow(Puppet::Resource::CapabilityFinder).to receive(:search).with('production', nil, capability).and_return(resources)
|
143
|
-
expect { Puppet::Resource::CapabilityFinder.find('production', nil, capability) }.to raise_error(Puppet::DevError, /expected exactly one resource but got 2/)
|
144
|
-
end
|
145
|
-
end
|
146
|
-
end
|
147
|
-
end
|
148
|
-
end
|
@@ -1,132 +0,0 @@
|
|
1
|
-
require 'spec_helper'
|
2
|
-
|
3
|
-
require 'puppet/rest/route'
|
4
|
-
|
5
|
-
describe Puppet::Rest::Route do
|
6
|
-
describe '#with_base_url'do
|
7
|
-
let(:dns_resolver) { double('dns resolver') }
|
8
|
-
|
9
|
-
context 'when not using SRV records' do
|
10
|
-
before :each do
|
11
|
-
Puppet.settings[:use_srv_records] = false
|
12
|
-
end
|
13
|
-
|
14
|
-
it "yields a base URL with the values from the specified settings" do
|
15
|
-
Puppet[:ca_server] = 'testserver'
|
16
|
-
Puppet[:ca_port] = 555
|
17
|
-
ca_route = Puppet::Rest::Route.new(api: '/fakeapi/v1/',
|
18
|
-
server_setting: :ca_server,
|
19
|
-
port_setting: :ca_port,
|
20
|
-
srv_service: :test_service)
|
21
|
-
count = 0
|
22
|
-
rval = ca_route.with_base_url(dns_resolver) do |url|
|
23
|
-
count += 1
|
24
|
-
expect(url.to_s).to eq('https://testserver:555/fakeapi/v1/')
|
25
|
-
'Block return value'
|
26
|
-
end
|
27
|
-
expect(count).to eq(1)
|
28
|
-
expect(rval).to eq('Block return value')
|
29
|
-
end
|
30
|
-
|
31
|
-
it "yields a base URL with Puppet's configured server and port when no defaults are specified" do
|
32
|
-
Puppet[:server] = 'configured.net'
|
33
|
-
Puppet[:serverport] = 8140
|
34
|
-
fallback_route = Puppet::Rest::Route.new(api: '/fakeapi/v1/')
|
35
|
-
count = 0
|
36
|
-
rval = fallback_route.with_base_url(dns_resolver) do |url|
|
37
|
-
count += 1
|
38
|
-
expect(url.to_s).to eq('https://configured.net:8140/fakeapi/v1/')
|
39
|
-
'Block return value'
|
40
|
-
end
|
41
|
-
expect(count).to eq(1)
|
42
|
-
expect(rval).to eq('Block return value')
|
43
|
-
end
|
44
|
-
|
45
|
-
it 'yields the first entry in the server list when server_list is in use' do
|
46
|
-
Puppet[:server_list] = [['one.net', 111], ['two.net', 222]]
|
47
|
-
fallback_route = Puppet::Rest::Route.new(api: '/fakeapi/v1/')
|
48
|
-
count = 0
|
49
|
-
rval = fallback_route.with_base_url(dns_resolver) do |url|
|
50
|
-
count += 1
|
51
|
-
expect(url.to_s).to eq('https://one.net:111/fakeapi/v1/')
|
52
|
-
'Block return value'
|
53
|
-
end
|
54
|
-
expect(count).to eq(1)
|
55
|
-
expect(rval).to eq('Block return value')
|
56
|
-
end
|
57
|
-
|
58
|
-
it 'falls back to :server and :serverport if nil is passed' do
|
59
|
-
Puppet[:server] = 'one.net'
|
60
|
-
Puppet[:serverport] = 111
|
61
|
-
nil_route = Puppet::Rest::Route.new(api: '/fakeapi/v1/',
|
62
|
-
server_setting: nil,
|
63
|
-
port_setting: nil)
|
64
|
-
count = 0
|
65
|
-
rval = nil_route.with_base_url(dns_resolver) do |url|
|
66
|
-
count += 1
|
67
|
-
expect(url.to_s).to eq('https://one.net:111/fakeapi/v1/')
|
68
|
-
'Block return value'
|
69
|
-
end
|
70
|
-
expect(count).to eq(1)
|
71
|
-
expect(rval).to eq('Block return value')
|
72
|
-
end
|
73
|
-
end
|
74
|
-
|
75
|
-
context 'when using SRV records' do
|
76
|
-
context "when SRV returns servers" do
|
77
|
-
let(:route) { Puppet::Rest::Route.new(api: '/fakeapi/v1/',
|
78
|
-
srv_service: :test_service) }
|
79
|
-
|
80
|
-
before :each do
|
81
|
-
Puppet.settings[:use_srv_records] = true
|
82
|
-
Puppet.settings[:srv_domain] = 'example.com'
|
83
|
-
|
84
|
-
@dns_mock = double('dns')
|
85
|
-
expect(Resolv::DNS).to receive(:new).and_return(@dns_mock)
|
86
|
-
|
87
|
-
@port = 7502
|
88
|
-
@target = 'example.com'
|
89
|
-
record = Resolv::DNS::Resource::IN::SRV.new(0, 0, @port, @target)
|
90
|
-
record.instance_variable_set(:@ttl, 10)
|
91
|
-
@srv_records = [record]
|
92
|
-
|
93
|
-
expect(@dns_mock).to receive(:getresources).
|
94
|
-
with("_x-puppet-test_service._tcp.example.com", Resolv::DNS::Resource::IN::SRV).
|
95
|
-
and_return(@srv_records)
|
96
|
-
end
|
97
|
-
|
98
|
-
it "yields a URL using the server and port from the SRV record" do
|
99
|
-
count = 0
|
100
|
-
rval = route.with_base_url(Puppet::Network::Resolver.new) do |url|
|
101
|
-
count += 1
|
102
|
-
expect(url.to_s).to eq('https://example.com:7502/fakeapi/v1/')
|
103
|
-
'Block return value'
|
104
|
-
end
|
105
|
-
expect(count).to eq(1)
|
106
|
-
|
107
|
-
expect(rval).to eq('Block return value')
|
108
|
-
end
|
109
|
-
|
110
|
-
it "should fall back to the default server when the block raises a SystemCallError" do
|
111
|
-
Puppet[:server] = "testserver"
|
112
|
-
Puppet[:serverport] = 555
|
113
|
-
|
114
|
-
count = 0
|
115
|
-
rval = route.with_base_url(Puppet::Network::Resolver.new) do |url|
|
116
|
-
count += 1
|
117
|
-
if url.to_s =~ /example.com/ then
|
118
|
-
raise SystemCallError, "example failure"
|
119
|
-
else
|
120
|
-
expect(url.to_s).to eq('https://testserver:555/fakeapi/v1/')
|
121
|
-
end
|
122
|
-
|
123
|
-
'Block return value'
|
124
|
-
end
|
125
|
-
|
126
|
-
expect(count).to eq(2)
|
127
|
-
expect(rval).to eq('Block return value')
|
128
|
-
end
|
129
|
-
end
|
130
|
-
end
|
131
|
-
end
|
132
|
-
end
|
data/spec/unit/ssl/host_spec.rb
DELETED
@@ -1,645 +0,0 @@
|
|
1
|
-
require 'spec_helper'
|
2
|
-
require 'puppet/test_ca'
|
3
|
-
|
4
|
-
require 'puppet/ssl/host'
|
5
|
-
require 'matchers/json'
|
6
|
-
require 'puppet_spec/ssl'
|
7
|
-
require 'puppet/rest/routes'
|
8
|
-
|
9
|
-
def base_json_comparison(result, json_hash)
|
10
|
-
expect(result["fingerprint"]).to eq(json_hash["fingerprint"])
|
11
|
-
expect(result["name"]).to eq(json_hash["name"])
|
12
|
-
expect(result["state"]).to eq(json_hash["desired_state"])
|
13
|
-
end
|
14
|
-
|
15
|
-
describe Puppet::SSL::Host, if: !Puppet::Util::Platform.jruby? do
|
16
|
-
include JSONMatchers
|
17
|
-
include PuppetSpec::Files
|
18
|
-
|
19
|
-
before do
|
20
|
-
# Get a safe temporary file
|
21
|
-
dir = tmpdir("ssl_host_testing")
|
22
|
-
Puppet.settings[:confdir] = dir
|
23
|
-
Puppet.settings[:vardir] = dir
|
24
|
-
Puppet.settings.use :main, :ssl
|
25
|
-
|
26
|
-
@host = Puppet::SSL::Host.new("myname")
|
27
|
-
end
|
28
|
-
|
29
|
-
after do
|
30
|
-
# Cleaned out any cached localhost instance.
|
31
|
-
Puppet::SSL::Host.reset
|
32
|
-
end
|
33
|
-
|
34
|
-
it "should use any provided name as its name" do
|
35
|
-
expect(@host.name).to eq("myname")
|
36
|
-
end
|
37
|
-
|
38
|
-
it "should retrieve its public key from its private key" do
|
39
|
-
realkey = double('realkey')
|
40
|
-
key = double('key', :content => realkey)
|
41
|
-
allow(Puppet::SSL::Key.indirection).to receive(:find).and_return(key)
|
42
|
-
pubkey = double('public_key')
|
43
|
-
expect(realkey).to receive(:public_key).and_return(pubkey)
|
44
|
-
|
45
|
-
expect(@host.public_key).to equal(pubkey)
|
46
|
-
end
|
47
|
-
|
48
|
-
describe 'localhost' do
|
49
|
-
before(:each) do
|
50
|
-
allow_any_instance_of(Puppet::SSL::Host).to receive(:certificate).and_return(nil)
|
51
|
-
allow_any_instance_of(Puppet::SSL::Host).to receive(:generate)
|
52
|
-
end
|
53
|
-
|
54
|
-
it "is deprecated" do
|
55
|
-
Puppet::SSL::Host.localhost
|
56
|
-
|
57
|
-
expect(@logs).to include(an_object_having_attributes(message: /Puppet::SSL::Host is deprecated/))
|
58
|
-
end
|
59
|
-
|
60
|
-
it "should allow to reset localhost" do
|
61
|
-
previous_host = Puppet::SSL::Host.localhost
|
62
|
-
Puppet::SSL::Host.reset
|
63
|
-
expect(Puppet::SSL::Host.localhost).not_to eq(previous_host)
|
64
|
-
end
|
65
|
-
|
66
|
-
it "should generate the certificate for the localhost instance if no certificate is available" do
|
67
|
-
host = double('host', :key => nil)
|
68
|
-
expect(Puppet::SSL::Host).to receive(:new).and_return(host)
|
69
|
-
|
70
|
-
expect(host).to receive(:certificate).and_return(nil)
|
71
|
-
expect(host).to receive(:generate)
|
72
|
-
|
73
|
-
expect(Puppet::SSL::Host.localhost).to equal(host)
|
74
|
-
end
|
75
|
-
|
76
|
-
it "should always read the key for the localhost instance in from disk" do
|
77
|
-
host = double('host', :certificate => "eh")
|
78
|
-
expect(host).to receive(:key)
|
79
|
-
expect(Puppet::SSL::Host).to receive(:new).and_return(host)
|
80
|
-
|
81
|
-
Puppet::SSL::Host.localhost
|
82
|
-
end
|
83
|
-
|
84
|
-
it "should cache the localhost instance" do
|
85
|
-
host = double('host', :certificate => "eh", :key => 'foo')
|
86
|
-
expect(Puppet::SSL::Host).to receive(:new).once.and_return(host)
|
87
|
-
expect(Puppet::SSL::Host.localhost).to eq(Puppet::SSL::Host.localhost)
|
88
|
-
end
|
89
|
-
end
|
90
|
-
|
91
|
-
context "with dns_alt_names" do
|
92
|
-
before :each do
|
93
|
-
@key = double('key content')
|
94
|
-
key = double('key', :generate => true, :content => @key)
|
95
|
-
allow(Puppet::SSL::Key).to receive(:new).and_return(key)
|
96
|
-
allow(Puppet::SSL::Key.indirection).to receive(:save).with(key)
|
97
|
-
|
98
|
-
@cr = double('certificate request', :render => "csr pem")
|
99
|
-
allow(Puppet::SSL::CertificateRequest).to receive(:new).and_return(@cr)
|
100
|
-
allow_any_instance_of(Puppet::SSL::Host).to receive(:submit_certificate_request)
|
101
|
-
end
|
102
|
-
|
103
|
-
describe "explicitly specified" do
|
104
|
-
before :each do
|
105
|
-
Puppet[:dns_alt_names] = 'one, two'
|
106
|
-
end
|
107
|
-
|
108
|
-
it "should not include subjectAltName if not the local node" do
|
109
|
-
expect(@cr).to receive(:generate).with(@key, {})
|
110
|
-
|
111
|
-
Puppet::SSL::Host.new('not-the-' + Puppet[:certname]).generate_certificate_request
|
112
|
-
end
|
113
|
-
|
114
|
-
it "should include subjectAltName if the local node" do
|
115
|
-
expect(@cr).to receive(:generate).with(@key, { :dns_alt_names => 'one, two' })
|
116
|
-
|
117
|
-
Puppet::SSL::Host.new(Puppet[:certname]).generate_certificate_request
|
118
|
-
end
|
119
|
-
end
|
120
|
-
end
|
121
|
-
|
122
|
-
it "should be able to verify its certificate matches its key" do
|
123
|
-
expect(Puppet::SSL::Host.new("foo")).to respond_to(:validate_certificate_with_key)
|
124
|
-
end
|
125
|
-
|
126
|
-
it "should consider the certificate invalid if it cannot find a key" do
|
127
|
-
host = Puppet::SSL::Host.new("foo")
|
128
|
-
certificate = double('cert', :fingerprint => 'DEADBEEF')
|
129
|
-
expect(host).to receive(:key).and_return(nil)
|
130
|
-
expect { host.validate_certificate_with_key(certificate) }.to raise_error(Puppet::Error, "No private key with which to validate certificate with fingerprint: DEADBEEF")
|
131
|
-
end
|
132
|
-
|
133
|
-
it "should consider the certificate invalid if it cannot find a certificate" do
|
134
|
-
host = Puppet::SSL::Host.new("foo")
|
135
|
-
expect(host).not_to receive(:key)
|
136
|
-
expect { host.validate_certificate_with_key(nil) }.to raise_error(Puppet::Error, "No certificate to validate.")
|
137
|
-
end
|
138
|
-
|
139
|
-
it "should consider the certificate invalid if the SSL certificate's key verification fails" do
|
140
|
-
host = Puppet::SSL::Host.new("foo")
|
141
|
-
key = double('key', :content => "private_key")
|
142
|
-
sslcert = double('sslcert')
|
143
|
-
certificate = double('cert', {:content => sslcert, :fingerprint => 'DEADBEEF'})
|
144
|
-
allow(host).to receive(:key).and_return(key)
|
145
|
-
expect(sslcert).to receive(:check_private_key).with("private_key").and_return(false)
|
146
|
-
expect { host.validate_certificate_with_key(certificate) }.to raise_error(Puppet::Error, /DEADBEEF/)
|
147
|
-
end
|
148
|
-
|
149
|
-
it "should consider the certificate valid if the SSL certificate's key verification succeeds" do
|
150
|
-
host = Puppet::SSL::Host.new("foo")
|
151
|
-
key = double('key', :content => "private_key")
|
152
|
-
sslcert = double('sslcert')
|
153
|
-
certificate = double('cert', :content => sslcert)
|
154
|
-
allow(host).to receive(:key).and_return(key)
|
155
|
-
expect(sslcert).to receive(:check_private_key).with("private_key").and_return(true)
|
156
|
-
expect{ host.validate_certificate_with_key(certificate) }.not_to raise_error
|
157
|
-
end
|
158
|
-
|
159
|
-
it "should output agent-specific commands when validation fails" do
|
160
|
-
host = Puppet::SSL::Host.new("foo")
|
161
|
-
key = double('key', :content => "private_key")
|
162
|
-
sslcert = double('sslcert')
|
163
|
-
certificate = double('cert', {:content => sslcert, :fingerprint => 'DEADBEEF'})
|
164
|
-
allow(host).to receive(:key).and_return(key)
|
165
|
-
expect(sslcert).to receive(:check_private_key).with("private_key").and_return(false)
|
166
|
-
expect { host.validate_certificate_with_key(certificate) }.to raise_error(Puppet::Error, /puppet ssl clean \n/)
|
167
|
-
end
|
168
|
-
|
169
|
-
it "should output device-specific commands when validation fails" do
|
170
|
-
Puppet[:certname] = "device.example.com"
|
171
|
-
host = Puppet::SSL::Host.new("device.example.com", true)
|
172
|
-
key = double('key', :content => "private_key")
|
173
|
-
sslcert = double('sslcert')
|
174
|
-
certificate = double('cert', {:content => sslcert, :fingerprint => 'DEADBEEF'})
|
175
|
-
allow(host).to receive(:key).and_return(key)
|
176
|
-
expect(sslcert).to receive(:check_private_key).with("private_key").and_return(false)
|
177
|
-
expect { host.validate_certificate_with_key(certificate) }.to raise_error(Puppet::Error, /puppet ssl clean --target device.example.com/)
|
178
|
-
end
|
179
|
-
|
180
|
-
describe "when initializing" do
|
181
|
-
it "should default its name to the :certname setting" do
|
182
|
-
Puppet[:certname] = "myname"
|
183
|
-
|
184
|
-
expect(Puppet::SSL::Host.new.name).to eq("myname")
|
185
|
-
end
|
186
|
-
|
187
|
-
it "should downcase a passed in name" do
|
188
|
-
expect(Puppet::SSL::Host.new("Host.Domain.Com").name).to eq("host.domain.com")
|
189
|
-
end
|
190
|
-
end
|
191
|
-
|
192
|
-
describe "when managing its private key" do
|
193
|
-
before do
|
194
|
-
@realkey = "mykey"
|
195
|
-
@key = Puppet::SSL::Key.new("mykey")
|
196
|
-
@key.content = @realkey
|
197
|
-
end
|
198
|
-
|
199
|
-
it "should return nil if the key is not set and cannot be found" do
|
200
|
-
expect(Puppet::SSL::Key.indirection).to receive(:find).with("myname").and_return(nil)
|
201
|
-
expect(@host.key).to be_nil
|
202
|
-
end
|
203
|
-
|
204
|
-
it "should find the key in the Key class and return the Puppet instance" do
|
205
|
-
expect(Puppet::SSL::Key.indirection).to receive(:find).with("myname").and_return(@key)
|
206
|
-
expect(@host.key).to equal(@key)
|
207
|
-
end
|
208
|
-
|
209
|
-
it "should be able to generate and save a new key" do
|
210
|
-
expect(Puppet::SSL::Key).to receive(:new).with("myname").and_return(@key)
|
211
|
-
|
212
|
-
expect(@key).to receive(:generate)
|
213
|
-
expect(Puppet::SSL::Key.indirection).to receive(:save)
|
214
|
-
|
215
|
-
expect(@host.generate_key).to be_truthy
|
216
|
-
expect(@host.key).to equal(@key)
|
217
|
-
end
|
218
|
-
|
219
|
-
it "should not retain keys that could not be saved" do
|
220
|
-
expect(Puppet::SSL::Key).to receive(:new).with("myname").and_return(@key)
|
221
|
-
|
222
|
-
expect(@key).to receive(:generate)
|
223
|
-
expect(Puppet::SSL::Key.indirection).to receive(:save).and_raise("eh")
|
224
|
-
|
225
|
-
expect { @host.generate_key }.to raise_error(RuntimeError)
|
226
|
-
expect(@host.key).to be_nil
|
227
|
-
end
|
228
|
-
|
229
|
-
it "should return any previously found key without requerying" do
|
230
|
-
expect(Puppet::SSL::Key.indirection).to receive(:find).with("myname").and_return(@key).once
|
231
|
-
expect(@host.key).to equal(@key)
|
232
|
-
expect(@host.key).to equal(@key)
|
233
|
-
end
|
234
|
-
end
|
235
|
-
|
236
|
-
describe "when managing its certificate request" do
|
237
|
-
before(:all) do
|
238
|
-
@pki = PuppetSpec::SSL.create_chained_pki
|
239
|
-
end
|
240
|
-
|
241
|
-
before(:each) do
|
242
|
-
Puppet[:requestdir] = tmpdir('requests')
|
243
|
-
end
|
244
|
-
|
245
|
-
let(:key) { Puppet::SSL::Key.from_s(@pki[:leaf_key].to_s, @host.name) }
|
246
|
-
|
247
|
-
it "should generate a new key when generating the cert request if no key exists" do
|
248
|
-
expect(@host).to receive(:key).exactly(2).times.and_return(nil, key)
|
249
|
-
expect(@host).to receive(:generate_key).and_return(key)
|
250
|
-
|
251
|
-
allow(@host).to receive(:submit_certificate_request)
|
252
|
-
|
253
|
-
@host.generate_certificate_request
|
254
|
-
expect(Puppet::FileSystem.exist?(File.join(Puppet[:requestdir], "#{@host.name}.pem"))).to be true
|
255
|
-
end
|
256
|
-
|
257
|
-
it "should be able to generate and save a new request using the private key" do
|
258
|
-
allow(@host).to receive(:key).and_return(key)
|
259
|
-
allow(@host).to receive(:submit_certificate_request)
|
260
|
-
|
261
|
-
expect(@host.generate_certificate_request).to be_truthy
|
262
|
-
expect(Puppet::FileSystem.exist?(File.join(Puppet[:requestdir], "#{@host.name}.pem"))).to be true
|
263
|
-
end
|
264
|
-
|
265
|
-
it "should send a new request to the CA for signing" do
|
266
|
-
allow(@host).to receive(:ssl_store).and_return(double("ssl store"))
|
267
|
-
allow(@host).to receive(:key).and_return(key)
|
268
|
-
request = double("request")
|
269
|
-
allow(request).to receive(:generate)
|
270
|
-
expect(request).to receive(:render).and_return("my request").twice
|
271
|
-
expect(Puppet::SSL::CertificateRequest).to receive(:new).and_return(request)
|
272
|
-
|
273
|
-
expect(Puppet::Rest::Routes).to receive(:put_certificate_request)
|
274
|
-
.with("my request", @host.name, anything)
|
275
|
-
.and_return(nil)
|
276
|
-
|
277
|
-
expect(@host.generate_certificate_request).to be true
|
278
|
-
end
|
279
|
-
|
280
|
-
it "should return any previously found request without requerying" do
|
281
|
-
request = double("request")
|
282
|
-
expect(@host).to receive(:load_certificate_request_from_file).and_return(request).once
|
283
|
-
|
284
|
-
expect(@host.certificate_request).to equal(request)
|
285
|
-
expect(@host.certificate_request).to equal(request)
|
286
|
-
end
|
287
|
-
|
288
|
-
it "should not keep its certificate request in memory if the request cannot be saved" do
|
289
|
-
allow(@host).to receive(:key).and_return(key)
|
290
|
-
allow(@host).to receive(:submit_certificate_request)
|
291
|
-
expect(Puppet::Util).to receive(:replace_file).and_raise(RuntimeError)
|
292
|
-
|
293
|
-
expect { @host.generate_certificate_request }.to raise_error(RuntimeError)
|
294
|
-
|
295
|
-
expect(@host.instance_eval { @certificate_request }).to be_nil
|
296
|
-
end
|
297
|
-
end
|
298
|
-
|
299
|
-
describe "when managing its certificate" do
|
300
|
-
before(:all) do
|
301
|
-
@pki = PuppetSpec::SSL.create_chained_pki
|
302
|
-
end
|
303
|
-
|
304
|
-
before(:each) do
|
305
|
-
Puppet[:certdir] = tmpdir('certs')
|
306
|
-
allow(@host).to receive(:key).and_return(double("key"))
|
307
|
-
allow(@host).to receive(:validate_certificate_with_key)
|
308
|
-
allow(@host).to receive(:ssl_store).and_return(double("ssl store"))
|
309
|
-
end
|
310
|
-
|
311
|
-
let(:ca_cert_response) { @pki[:ca_bundle] }
|
312
|
-
let(:crl_response) { @pki[:crl_chain] }
|
313
|
-
let(:host_cert_response) { @pki[:unrevoked_leaf_node_cert] }
|
314
|
-
|
315
|
-
it "should find the CA certificate and save it to disk" do
|
316
|
-
stub_request(:get, %r{puppet-ca/v1/certificate/ca}).to_return(status: 200, body: ca_cert_response)
|
317
|
-
stub_request(:get, %r{puppet-ca/v1/certificate_revocation_list/ca}).to_return(status: 200, body: crl_response)
|
318
|
-
stub_request(:get, %r{puppet-ca/v1/certificate/#{@host.name}}).to_return(status: 404)
|
319
|
-
|
320
|
-
@host.certificate
|
321
|
-
actual_ca_bundle = Puppet::FileSystem.read(Puppet[:localcacert])
|
322
|
-
expect(actual_ca_bundle).to match(/BEGIN CERTIFICATE.*END CERTIFICATE.*BEGIN CERTIFICATE/m)
|
323
|
-
end
|
324
|
-
|
325
|
-
it "should raise if it cannot find a CA certificate" do
|
326
|
-
stub_request(:get, %r{puppet-ca/v1/certificate/ca}).to_return(status: 404)
|
327
|
-
|
328
|
-
expect(@host).not_to receive(:get_host_certificate)
|
329
|
-
|
330
|
-
expect {
|
331
|
-
@host.certificate
|
332
|
-
}.to raise_error(Puppet::Error, /CA certificate is missing from the server/)
|
333
|
-
end
|
334
|
-
|
335
|
-
it "should find the key if it does not have one" do
|
336
|
-
stub_request(:get, %r{puppet-ca/v1/certificate/ca}).to_return(status: 200, body: ca_cert_response)
|
337
|
-
stub_request(:get, %r{puppet-ca/v1/certificate_revocation_list/ca}).to_return(status: 200, body: crl_response)
|
338
|
-
|
339
|
-
expect(@host).to receive(:get_host_certificate).and_return(nil)
|
340
|
-
expect(@host).to receive(:key).and_return(double("key"))
|
341
|
-
@host.certificate
|
342
|
-
end
|
343
|
-
|
344
|
-
it "should generate the key if one cannot be found" do
|
345
|
-
stub_request(:get, %r{puppet-ca/v1/certificate/ca}).to_return(status: 200, body: ca_cert_response)
|
346
|
-
stub_request(:get, %r{puppet-ca/v1/certificate_revocation_list/ca}).to_return(status: 200, body: crl_response)
|
347
|
-
|
348
|
-
expect(@host).to receive(:get_host_certificate).and_return(nil)
|
349
|
-
expect(@host).to receive(:key).and_return(nil)
|
350
|
-
expect(@host).to receive(:generate_key)
|
351
|
-
@host.certificate
|
352
|
-
end
|
353
|
-
|
354
|
-
it "should find the host certificate, write it to file, and return the Puppet certificate instance" do
|
355
|
-
stub_request(:get, %r{puppet-ca/v1/certificate/ca}).to_return(status: 200, body: ca_cert_response)
|
356
|
-
stub_request(:get, %r{puppet-ca/v1/certificate_revocation_list/ca}).to_return(status: 200, body: crl_response)
|
357
|
-
stub_request(:get, %r{puppet-ca/v1/certificate/#{@host.name}}).to_return(status: 200, body: host_cert_response.to_pem)
|
358
|
-
|
359
|
-
expected_cert = Puppet::SSL::Certificate.from_s(@pki[:unrevoked_leaf_node_cert])
|
360
|
-
actual_cert = @host.certificate
|
361
|
-
expect(actual_cert).to be_a(Puppet::SSL::Certificate)
|
362
|
-
expect(actual_cert.to_s).to eq(expected_cert.to_s)
|
363
|
-
host_cert_from_file = Puppet::FileSystem.read(File.join(Puppet[:certdir], "#{@host.name}.pem"))
|
364
|
-
expect(host_cert_from_file).to eq(expected_cert.to_s)
|
365
|
-
end
|
366
|
-
|
367
|
-
it "should return any previously found certificate" do
|
368
|
-
cert = double('cert')
|
369
|
-
stub_request(:get, %r{puppet-ca/v1/certificate/ca}).to_return(status: 200, body: ca_cert_response)
|
370
|
-
stub_request(:get, %r{puppet-ca/v1/certificate_revocation_list/ca}).to_return(status: 200, body: crl_response)
|
371
|
-
expect(@host).to receive(:get_host_certificate).and_return(cert).once
|
372
|
-
|
373
|
-
expect(@host.certificate).to equal(cert)
|
374
|
-
expect(@host.certificate).to equal(cert)
|
375
|
-
end
|
376
|
-
|
377
|
-
context 'invalid certificates' do
|
378
|
-
it "should raise if the CA certificate downloaded from CA is invalid" do
|
379
|
-
stub_request(:get, %r{puppet-ca/v1/certificate/ca}).to_return(status: 200, body: 'garbage')
|
380
|
-
|
381
|
-
expect { @host.certificate }.to raise_error(OpenSSL::X509::CertificateError, /Failed to parse CA certificates as PEM/)
|
382
|
-
end
|
383
|
-
|
384
|
-
it "should warn if the host certificate downloaded from CA is invalid" do
|
385
|
-
stub_request(:get, %r{puppet-ca/v1/certificate/ca}).to_return(status: 200, body: ca_cert_response)
|
386
|
-
stub_request(:get, %r{puppet-ca/v1/certificate_revocation_list/ca}).to_return(status: 200, body: crl_response)
|
387
|
-
stub_request(:get, %r{puppet-ca/v1/certificate/#{@host.name}}).to_return(status: 200, body: 'garbage')
|
388
|
-
|
389
|
-
expect { @host.certificate }.to raise_error(Puppet::Error, /did not contain a valid certificate for #{@host.name}/)
|
390
|
-
end
|
391
|
-
|
392
|
-
it 'should warn if the CA certificate loaded from disk is invalid' do
|
393
|
-
Puppet::FileSystem.open(Puppet[:localcacert], nil, "w:ASCII") do |f|
|
394
|
-
f.puts 'garbage'
|
395
|
-
end
|
396
|
-
expect { @host.certificate }.to raise_error(OpenSSL::X509::CertificateError, /Failed to parse CA certificates as PEM/)
|
397
|
-
end
|
398
|
-
|
399
|
-
it 'should warn if the host certificate loaded from disk in invalid' do
|
400
|
-
stub_request(:get, %r{puppet-ca/v1/certificate/ca}).to_return(status: 200, body: ca_cert_response)
|
401
|
-
stub_request(:get, %r{puppet-ca/v1/certificate_revocation_list/ca}).to_return(status: 200, body: crl_response)
|
402
|
-
|
403
|
-
Puppet::FileSystem.open(File.join(Puppet[:certdir], "#{@host.name}.pem"), nil, "w:ASCII") do |f|
|
404
|
-
f.puts 'garbage'
|
405
|
-
end
|
406
|
-
expect { @host.certificate }.to raise_error(Puppet::Error, /The certificate.*invalid/)
|
407
|
-
end
|
408
|
-
end
|
409
|
-
end
|
410
|
-
|
411
|
-
it "should have a method for generating all necessary files" do
|
412
|
-
expect(Puppet::SSL::Host.new("me")).to respond_to(:generate)
|
413
|
-
end
|
414
|
-
|
415
|
-
describe "when generating files" do
|
416
|
-
before do
|
417
|
-
@host = Puppet::SSL::Host.new("me")
|
418
|
-
allow(@host).to receive(:generate_key)
|
419
|
-
allow(@host).to receive(:generate_certificate_request)
|
420
|
-
allow(@host).to receive(:certificate_request)
|
421
|
-
allow(@host).to receive(:certificate)
|
422
|
-
end
|
423
|
-
|
424
|
-
it "should generate a key if one is not present" do
|
425
|
-
allow(@host).to receive(:key).and_return nil
|
426
|
-
expect(@host).to receive(:generate_key)
|
427
|
-
|
428
|
-
@host.generate
|
429
|
-
end
|
430
|
-
|
431
|
-
it "should generate a certificate request if one is not present" do
|
432
|
-
expect(@host).to receive(:certificate_request).and_return nil
|
433
|
-
expect(@host).to receive(:generate_certificate_request)
|
434
|
-
|
435
|
-
@host.generate
|
436
|
-
end
|
437
|
-
end
|
438
|
-
|
439
|
-
it "should have a method for creating an SSL store" do
|
440
|
-
expect(Puppet::SSL::Host.new("me")).to respond_to(:ssl_store)
|
441
|
-
end
|
442
|
-
|
443
|
-
describe "when creating an SSL store" do
|
444
|
-
before do
|
445
|
-
Puppet[:localcacert] = "ssl_host_testing"
|
446
|
-
end
|
447
|
-
|
448
|
-
it "should accept a purpose" do
|
449
|
-
store = double('store', :add_file => nil)
|
450
|
-
expect(OpenSSL::X509::Store).to receive(:new).and_return(store)
|
451
|
-
expect(store).to receive(:purpose=).with(OpenSSL::X509::PURPOSE_SSL_SERVER)
|
452
|
-
host = Puppet::SSL::Host.new("me")
|
453
|
-
host.crl_usage = false
|
454
|
-
|
455
|
-
host.ssl_store(OpenSSL::X509::PURPOSE_SSL_SERVER)
|
456
|
-
end
|
457
|
-
|
458
|
-
context "and the CRL is not on disk" do
|
459
|
-
before do
|
460
|
-
@pki = PuppetSpec::SSL.create_chained_pki
|
461
|
-
@revoked_cert = @pki[:revoked_root_node_cert]
|
462
|
-
localcacert = Puppet.settings[:localcacert]
|
463
|
-
Puppet::Util.replace_file(localcacert, 0644) {|f| f.write @pki[:ca_bundle] }
|
464
|
-
end
|
465
|
-
|
466
|
-
after do
|
467
|
-
Puppet::FileSystem.unlink(Puppet.settings[:localcacert])
|
468
|
-
Puppet::FileSystem.unlink(Puppet.settings[:hostcrl])
|
469
|
-
end
|
470
|
-
|
471
|
-
it "retrieves it from the server" do
|
472
|
-
expect(Puppet::Rest::Routes).to receive(:get_crls)
|
473
|
-
.with(Puppet::SSL::CA_NAME, anything)
|
474
|
-
.and_return(@pki[:crl_chain])
|
475
|
-
|
476
|
-
@host.ssl_store
|
477
|
-
expect(Puppet::FileSystem.read(Puppet.settings[:hostcrl], :encoding => Encoding::UTF_8)).to eq(@pki[:crl_chain])
|
478
|
-
end
|
479
|
-
end
|
480
|
-
|
481
|
-
describe "and a CRL is available" do
|
482
|
-
before do
|
483
|
-
pki = PuppetSpec::SSL.create_chained_pki
|
484
|
-
|
485
|
-
@revoked_cert_from_self_signed_root = pki[:revoked_root_node_cert]
|
486
|
-
@revoked_cert_from_ca_with_untrusted_chain = pki[:revoked_leaf_node_cert]
|
487
|
-
@unrevoked_cert_from_self_signed_root = pki[:unrevoked_root_node_cert]
|
488
|
-
@unrevoked_cert_from_revoked_ca = pki[:unrevoked_int_node_cert]
|
489
|
-
@unrevoked_cert_from_ca_with_untrusted_chain = pki[:unrevoked_leaf_node_cert]
|
490
|
-
|
491
|
-
localcacert = Puppet.settings[:localcacert]
|
492
|
-
hostcrl = Puppet.settings[:hostcrl]
|
493
|
-
|
494
|
-
Puppet::Util.replace_file(localcacert, 0644) {|f| f.write pki[:ca_bundle] }
|
495
|
-
Puppet::Util.replace_file(hostcrl, 0644) {|f| f.write pki[:crl_chain] }
|
496
|
-
end
|
497
|
-
|
498
|
-
after do
|
499
|
-
Puppet::FileSystem.unlink(Puppet.settings[:localcacert])
|
500
|
-
Puppet::FileSystem.unlink(Puppet.settings[:hostcrl])
|
501
|
-
end
|
502
|
-
|
503
|
-
[true, :chain].each do |crl_setting|
|
504
|
-
describe "and 'certificate_revocation' is #{crl_setting}" do
|
505
|
-
before do
|
506
|
-
@host = Puppet::SSL::Host.new(crl_setting.to_s)
|
507
|
-
@host.crl_usage = crl_setting
|
508
|
-
end
|
509
|
-
|
510
|
-
it "should verify unrevoked certs" do
|
511
|
-
expect(
|
512
|
-
@host.ssl_store.verify(@unrevoked_cert_from_self_signed_root)
|
513
|
-
).to be true
|
514
|
-
end
|
515
|
-
|
516
|
-
it "should not verify revoked certs" do
|
517
|
-
[@revoked_cert_from_self_signed_root,
|
518
|
-
@revoked_cert_from_ca_with_untrusted_chain,
|
519
|
-
@unrevoked_cert_from_revoked_ca,
|
520
|
-
@unrevoked_cert_from_ca_with_untrusted_chain].each do |cert|
|
521
|
-
expect(@host.ssl_store.verify(cert)).to be false
|
522
|
-
end
|
523
|
-
end
|
524
|
-
end
|
525
|
-
end
|
526
|
-
|
527
|
-
describe "and 'certificate_revocation' is leaf" do
|
528
|
-
before do
|
529
|
-
@host = Puppet::SSL::Host.new("leaf")
|
530
|
-
@host.crl_usage = :leaf
|
531
|
-
end
|
532
|
-
|
533
|
-
it "should verify unrevoked certs regardless of signing CA's revocation status" do
|
534
|
-
[@unrevoked_cert_from_self_signed_root,
|
535
|
-
@unrevoked_cert_from_revoked_ca,
|
536
|
-
@unrevoked_cert_from_ca_with_untrusted_chain].each do |cert|
|
537
|
-
expect(@host.ssl_store.verify(cert)).to be true
|
538
|
-
end
|
539
|
-
end
|
540
|
-
|
541
|
-
it "should not verify certs revoked by their signing CA" do
|
542
|
-
[@revoked_cert_from_self_signed_root,
|
543
|
-
@revoked_cert_from_ca_with_untrusted_chain].each do |cert|
|
544
|
-
expect(@host.ssl_store.verify(cert)).to be false
|
545
|
-
end
|
546
|
-
end
|
547
|
-
end
|
548
|
-
|
549
|
-
describe "and 'certificate_revocation' is false" do
|
550
|
-
before do
|
551
|
-
@host = Puppet::SSL::Host.new("host")
|
552
|
-
@host.crl_usage = false
|
553
|
-
end
|
554
|
-
|
555
|
-
it "should verify valid certs regardless of revocation status" do
|
556
|
-
[@revoked_cert_from_self_signed_root,
|
557
|
-
@revoked_cert_from_ca_with_untrusted_chain,
|
558
|
-
@unrevoked_cert_from_self_signed_root,
|
559
|
-
@unrevoked_cert_from_revoked_ca,
|
560
|
-
@unrevoked_cert_from_ca_with_untrusted_chain].each do |cert|
|
561
|
-
expect(@host.ssl_store.verify(cert)).to be true
|
562
|
-
end
|
563
|
-
end
|
564
|
-
end
|
565
|
-
end
|
566
|
-
end
|
567
|
-
|
568
|
-
describe "when waiting for a cert" do
|
569
|
-
before do
|
570
|
-
@host = Puppet::SSL::Host.new("me")
|
571
|
-
end
|
572
|
-
|
573
|
-
it "should generate its certificate request and attempt to read the certificate again if no certificate is found" do
|
574
|
-
expect(@host).to receive(:certificate).twice.and_return(nil, "foo")
|
575
|
-
expect(@host).to receive(:generate)
|
576
|
-
@host.wait_for_cert(1)
|
577
|
-
end
|
578
|
-
|
579
|
-
it "should catch and log errors during CSR saving" do
|
580
|
-
expect(@host).to receive(:certificate).twice.and_return(nil, "foo")
|
581
|
-
times_generate_called = 0
|
582
|
-
expect(@host).to receive(:generate) do
|
583
|
-
times_generate_called += 1
|
584
|
-
raise RuntimeError if times_generate_called == 1
|
585
|
-
nil
|
586
|
-
end
|
587
|
-
allow(@host).to receive(:sleep)
|
588
|
-
@host.wait_for_cert(1)
|
589
|
-
end
|
590
|
-
|
591
|
-
it "should sleep and retry after failures saving the CSR if waitforcert is enabled" do
|
592
|
-
expect(@host).to receive(:certificate).twice.and_return(nil, "foo")
|
593
|
-
times_generate_called = 0
|
594
|
-
expect(@host).to receive(:generate) do
|
595
|
-
times_generate_called += 1
|
596
|
-
raise RuntimeError if times_generate_called == 1
|
597
|
-
nil
|
598
|
-
end
|
599
|
-
expect(@host).to receive(:sleep).with(1)
|
600
|
-
@host.wait_for_cert(1)
|
601
|
-
end
|
602
|
-
|
603
|
-
it "should exit after failures saving the CSR of waitforcert is disabled" do
|
604
|
-
expect(@host).to receive(:certificate).and_return(nil)
|
605
|
-
expect(@host).to receive(:generate).and_raise(RuntimeError)
|
606
|
-
expect(@host).to receive(:puts)
|
607
|
-
expect { @host.wait_for_cert(0) }.to exit_with 1
|
608
|
-
end
|
609
|
-
|
610
|
-
it "should exit if the wait time is 0 and it can neither find nor retrieve a certificate" do
|
611
|
-
allow(@host).to receive(:certificate).and_return(nil)
|
612
|
-
expect(@host).to receive(:generate)
|
613
|
-
expect(@host).to receive(:puts)
|
614
|
-
expect { @host.wait_for_cert(0) }.to exit_with 1
|
615
|
-
end
|
616
|
-
|
617
|
-
it "should sleep for the specified amount of time if no certificate is found after generating its certificate request" do
|
618
|
-
expect(@host).to receive(:certificate).exactly(3).times().and_return(nil, nil, "foo")
|
619
|
-
expect(@host).to receive(:generate)
|
620
|
-
|
621
|
-
expect(@host).to receive(:sleep).with(1)
|
622
|
-
|
623
|
-
@host.wait_for_cert(1)
|
624
|
-
end
|
625
|
-
|
626
|
-
it "should catch and log exceptions during certificate retrieval" do
|
627
|
-
times_certificate_called = 0
|
628
|
-
expect(@host).to receive(:certificate) do
|
629
|
-
times_certificate_called += 1
|
630
|
-
if times_certificate_called == 1
|
631
|
-
return nil
|
632
|
-
elsif times_certificate_called == 2
|
633
|
-
raise RuntimeError
|
634
|
-
end
|
635
|
-
"foo"
|
636
|
-
end.exactly(3).times()
|
637
|
-
allow(@host).to receive(:generate)
|
638
|
-
allow(@host).to receive(:sleep)
|
639
|
-
|
640
|
-
expect(Puppet).to receive(:log_exception).at_least(:once)
|
641
|
-
|
642
|
-
@host.wait_for_cert(1)
|
643
|
-
end
|
644
|
-
end
|
645
|
-
end
|