puppet 6.25.1 → 7.0.0

data/spec/unit/network/auth_config_parser_spec.rb

@@ -1,115 +0,0 @@
-require 'spec_helper'
-require 'puppet/network/auth_config_parser'
-require 'puppet/network/authconfig'
-
-describe Puppet::Network::AuthConfigParser do
-  include PuppetSpec::Files
-
-  let(:fake_authconfig) do
-    "path ~ ^/catalog/([^/])\nmethod find\nallow *\n"
-  end
-
-  describe "Basic Parser" do
-    it "should accept a string by default" do
-      expect(described_class.new(fake_authconfig).parse).to be_a_kind_of Puppet::Network::AuthConfig
-    end
-  end
-
-  describe "when parsing rights" do
-    it "skips comments" do
-      expect(described_class.new('  # comment\n').parse_rights).to be_empty
-    end
-
-    it "increments line number even on commented lines" do
-      expect(described_class.new("  # comment\npath /").parse_rights['/'].line).to eq(2)
-    end
-
-    it "skips blank lines" do
-      expect(described_class.new('  ').parse_rights).to be_empty
-    end
-
-    it "increments line number even on blank lines" do
-      expect(described_class.new("  \npath /").parse_rights['/'].line).to eq(2)
-    end
-
-    it "does not throw an error if the same path appears twice" do
-      expect {
-        described_class.new("path /hello\npath /hello").parse_rights
-      }.to_not raise_error
-    end
-
-    it "should create a new right for each found path line" do
-      expect(described_class.new('path /certificates').parse_rights['/certificates']).to be
-    end
-
-    it "should create a new right for each found regex line" do
-      expect(described_class.new('path ~ .rb$').parse_rights['.rb$']).to be
-    end
-
-    it "should strip whitespace around ACE" do
-      expect_any_instance_of(Puppet::Network::Rights::Right).to receive(:allow).with('127.0.0.1')
-      expect_any_instance_of(Puppet::Network::Rights::Right).to receive(:allow).with('172.16.10.0')
-
-      described_class.new("path /\n allow 127.0.0.1 , 172.16.10.0  ").parse_rights
-    end
-
-    it "should allow ACE inline comments" do
-      expect_any_instance_of(Puppet::Network::Rights::Right).to receive(:allow).with('127.0.0.1')
-
-      described_class.new("path /\n allow 127.0.0.1 # will it work?").parse_rights
-    end
-
-    it "should create an allow ACE on each subsequent allow" do
-      expect_any_instance_of(Puppet::Network::Rights::Right).to receive(:allow).with('127.0.0.1')
-
-      described_class.new("path /\nallow 127.0.0.1").parse_rights
-    end
-
-    it "should create a deny ACE on each subsequent deny" do
-      expect_any_instance_of(Puppet::Network::Rights::Right).to receive(:deny).with('127.0.0.1')
-
-      described_class.new("path /\ndeny 127.0.0.1").parse_rights
-    end
-
-    it "should inform the current ACL if we get the 'method' directive" do
-      expect_any_instance_of(Puppet::Network::Rights::Right).to receive(:restrict_method).with('search')
-      expect_any_instance_of(Puppet::Network::Rights::Right).to receive(:restrict_method).with('find')
-
-      described_class.new("path /certificates\nmethod search,find").parse_rights
-    end
-
-    it "should inform the current ACL if we get the 'environment' directive" do
-      expect_any_instance_of(Puppet::Network::Rights::Right).to receive(:restrict_environment).with('production')
-      expect_any_instance_of(Puppet::Network::Rights::Right).to receive(:restrict_environment).with('development')
-
-      described_class.new("path /certificates\nenvironment production,development").parse_rights
-    end
-
-    it "should inform the current ACL if we get the 'auth' directive" do
-      expect_any_instance_of(Puppet::Network::Rights::Right).to receive(:restrict_authenticated).with('yes')
-
-      described_class.new("path /certificates\nauth yes").parse_rights
-    end
-
-    it "should also allow the long form 'authenticated' directive" do
-      expect_any_instance_of(Puppet::Network::Rights::Right).to receive(:restrict_authenticated).with('yes')
-
-      described_class.new("path /certificates\nauthenticated yes").parse_rights
-    end
-  end
-
-  describe "when parsing rights from files" do
-    it "can read UTF-8" do
-      rune_path = "/\u16A0\u16C7\u16BB" # ᚠᛇᚻ
-      config = tmpfile('config')
-
-      File.open(config, 'w', :encoding => 'utf-8') do |file|
-        file.puts <<-EOF
-path #{rune_path}
-      EOF
-    end
-
-      expect(described_class.new_from_file(config).parse_rights[rune_path]).to be
-    end
-  end
-end

data/spec/unit/network/authstore_spec.rb

@@ -1,407 +0,0 @@
-require 'spec_helper'
-require 'rbconfig'
-
-require 'puppet/network/authconfig'
-
-describe Puppet::Network::AuthStore do
-  before :each do
-    @authstore = Puppet::Network::AuthStore.new
-    @authstore.reset_interpolation
-  end
-
-  describe "when checking if the acl has some entries" do
-    it "should be empty if no ACE have been entered" do
-      expect(@authstore).to be_empty
-    end
-
-    it "should not be empty if it is a global allow" do
-      @authstore.allow('*')
-
-      expect(@authstore).not_to be_empty
-    end
-
-    it "should not be empty if at least one allow has been entered" do
-      @authstore.allow_ip('1.1.1.*')
-
-      expect(@authstore).not_to be_empty
-    end
-
-    it "should not be empty if at least one deny has been entered" do
-      @authstore.deny_ip('1.1.1.*')
-
-      expect(@authstore).not_to be_empty
-    end
-  end
-
-  describe "when checking global allow" do
-    it "should not be enabled by default" do
-      expect(@authstore).not_to be_globalallow
-      expect(@authstore).not_to be_allowed('foo.bar.com', '192.168.1.1')
-    end
-
-    it "should always allow when enabled" do
-      @authstore.allow('*')
-
-      expect(@authstore).to be_globalallow
-      expect(@authstore).to be_allowed('foo.bar.com', '192.168.1.1')
-    end
-  end
-
-  describe "when checking a regex type of allow" do
-    before :each do
-      @authstore.allow('/^(test-)?host[0-9]+\.other-domain\.(com|org|net)$|some-domain\.com/')
-      @ip = '192.168.1.1'
-    end
-    ['host5.other-domain.com', 'test-host12.other-domain.net', 'foo.some-domain.com'].each { |name|
-      it "should allow the host #{name}" do
-        expect(@authstore).to be_allowed(name, @ip)
-      end
-    }
-    ['host0.some-other-domain.com',''].each { |name|
-      it "should not allow the host #{name}" do
-        expect(@authstore).not_to be_allowed(name, @ip)
-      end
-    }
-  end
-end
-
-describe Puppet::Network::AuthStore::Declaration do
-
-  ['100.101.99.98','100.100.100.100','1.2.3.4','11.22.33.44'].each { |ip|
-    describe "when the pattern is a simple numeric IP such as #{ip}" do
-      before :each do
-        @declaration = Puppet::Network::AuthStore::Declaration.new(:allow_ip,ip)
-      end
-      it "should match the specified IP" do
-        expect(@declaration).to be_match('www.testsite.org',ip)
-      end
-      it "should not match other IPs" do
-        expect(@declaration).not_to be_match('www.testsite.org','200.101.99.98')
-      end
-    end
-
-    (1..3).each { |n|
-      describe "when the pattern is an IP mask with #{n} numeric segments and a *" do
-        before :each do
-          @ip_pattern = ip.split('.')[0,n].join('.')+'.*'
-          @declaration = Puppet::Network::AuthStore::Declaration.new(:allow_ip,@ip_pattern)
-        end
-        it "should match an IP in the range" do
-          expect(@declaration).to be_match('www.testsite.org',ip)
-        end
-        it "should not match other IPs" do
-          expect(@declaration).not_to be_match('www.testsite.org','200.101.99.98')
-        end
-        it "should not match IPs that differ in the last non-wildcard segment" do
-          other = ip.split('.')
-          other[n-1].succ!
-          expect(@declaration).not_to be_match('www.testsite.org',other.join('.'))
-        end
-      end
-    }
-  }
-
-  [
-    "02001:0000:1234:0000:0000:C1C0:ABCD:0876",
-    "2001:0000:1234:0000:00001:C1C0:ABCD:0876",
-    " 2001:0000:1234:0000:0000:C1C0:ABCD:0876  0",
-    "2001:0000:1234: 0000:0000:C1C0:ABCD:0876",
-    "3ffe:0b00:0000:0001:0000:0000:000a",
-    "FF02:0000:0000:0000:0000:0000:0000:0000:0001",
-    "3ffe:b00::1::a",
-    "1:2:3::4:5::7:8",
-    "12345::6:7:8",
-    "1::5:400.2.3.4",
-    "1::5:260.2.3.4",
-    "1::5:256.2.3.4",
-    "1::5:1.256.3.4",
-    "1::5:1.2.256.4",
-    "1::5:1.2.3.256",
-    "1::5:300.2.3.4",
-    "1::5:1.300.3.4",
-    "1::5:1.2.300.4",
-    "1::5:1.2.3.300",
-    "1::5:900.2.3.4",
-    "1::5:1.900.3.4",
-    "1::5:1.2.900.4",
-    "1::5:1.2.3.900",
-    "1::5:300.300.300.300",
-    "1::5:3000.30.30.30",
-    "1::400.2.3.4",
-    "1::260.2.3.4",
-    "1::256.2.3.4",
-    "1::1.256.3.4",
-    "1::1.2.256.4",
-    "1::1.2.3.256",
-    "1::300.2.3.4",
-    "1::1.300.3.4",
-    "1::1.2.300.4",
-    "1::1.2.3.300",
-    "1::900.2.3.4",
-    "1::1.900.3.4",
-    "1::1.2.900.4",
-    "1::1.2.3.900",
-    "1::300.300.300.300",
-    "1::3000.30.30.30",
-    "::400.2.3.4",
-    "::260.2.3.4",
-    "::256.2.3.4",
-    "::1.256.3.4",
-    "::1.2.256.4",
-    "::1.2.3.256",
-    "::300.2.3.4",
-    "::1.300.3.4",
-    "::1.2.300.4",
-    "::1.2.3.300",
-    "::900.2.3.4",
-    "::1.900.3.4",
-    "::1.2.900.4",
-    "::1.2.3.900",
-    "::300.300.300.300",
-    "::3000.30.30.30",
-    "2001:DB8:0:0:8:800:200C:417A:221", # unicast, full
-    "FF01::101::2" # multicast, compressed
-  ].each { |invalid_ip|
-    describe "when the pattern is an invalid IPv6 address such as #{invalid_ip}" do
-      it "should raise an exception" do
-        expect { Puppet::Network::AuthStore::Declaration.new(:allow,invalid_ip) }.to raise_error(Puppet::AuthStoreError, /Invalid pattern/)
-      end
-    end
-  }
-
-  [
-    "1.2.3.4",
-    "2001:0000:1234:0000:0000:C1C0:ABCD:0876",
-    "3ffe:0b00:0000:0000:0001:0000:0000:000a",
-    "FF02:0000:0000:0000:0000:0000:0000:0001",
-    "0000:0000:0000:0000:0000:0000:0000:0001",
-    "0000:0000:0000:0000:0000:0000:0000:0000",
-    "::ffff:192.168.1.26",
-    "2::10",
-    "ff02::1",
-    "fe80::",
-    "2002::",
-    "2001:db8::",
-    "2001:0db8:1234::",
-    "::ffff:0:0",
-    "::1",
-    "::ffff:192.168.1.1",
-    "1:2:3:4:5:6:7:8",
-    "1:2:3:4:5:6::8",
-    "1:2:3:4:5::8",
-    "1:2:3:4::8",
-    "1:2:3::8",
-    "1:2::8",
-    "1::8",
-    "1::2:3:4:5:6:7",
-    "1::2:3:4:5:6",
-    "1::2:3:4:5",
-    "1::2:3:4",
-    "1::2:3",
-    "1::8",
-    "::2:3:4:5:6:7",
-    "::2:3:4:5:6",
-    "::2:3:4:5",
-    "::2:3:4",
-    "::2:3",
-    "::8",
-    "1:2:3:4:5:6::",
-    "1:2:3:4:5::",
-    "1:2:3:4::",
-    "1:2:3::",
-    "1:2::",
-    "1::",
-    "1:2:3:4:5::7:8",
-    "1:2:3:4::7:8",
-    "1:2:3::7:8",
-    "1:2::7:8",
-    "1::7:8",
-    "1:2:3:4:5:6:1.2.3.4",
-    "1:2:3:4:5::1.2.3.4",
-    "1:2:3:4::1.2.3.4",
-    "1:2:3::1.2.3.4",
-    "1:2::1.2.3.4",
-    "1::1.2.3.4",
-    "1:2:3:4::5:1.2.3.4",
-    "1:2:3::5:1.2.3.4",
-    "1:2::5:1.2.3.4",
-    "1::5:1.2.3.4",
-    "1::5:11.22.33.44",
-    "fe80::217:f2ff:254.7.237.98",
-    "fe80::217:f2ff:fe07:ed62",
-    "2001:DB8:0:0:8:800:200C:417A", # unicast, full
-    "FF01:0:0:0:0:0:0:101", # multicast, full
-    "0:0:0:0:0:0:0:1", # loopback, full
-    "0:0:0:0:0:0:0:0", # unspecified, full
-    "2001:DB8::8:800:200C:417A", # unicast, compressed
-    "FF01::101", # multicast, compressed
-    "::1", # loopback, compressed, non-routable
-    "::", # unspecified, compressed, non-routable
-    "0:0:0:0:0:0:13.1.68.3", # IPv4-compatible IPv6 address, full, deprecated
-    "0:0:0:0:0:FFFF:129.144.52.38", # IPv4-mapped IPv6 address, full
-    "::13.1.68.3", # IPv4-compatible IPv6 address, compressed, deprecated
-    "::FFFF:129.144.52.38", # IPv4-mapped IPv6 address, compressed
-    "2001:0DB8:0000:CD30:0000:0000:0000:0000/60", # full, with prefix
-    "2001:0DB8::CD30:0:0:0:0/60", # compressed, with prefix
-    "2001:0DB8:0:CD30::/60", # compressed, with prefix #2
-    "::/128", # compressed, unspecified address type, non-routable
-    "::1/128", # compressed, loopback address type, non-routable
-    "FF00::/8", # compressed, multicast address type
-    "FE80::/10", # compressed, link-local unicast, non-routable
-    "FEC0::/10", # compressed, site-local unicast, deprecated
-    "127.0.0.1", # standard IPv4, loopback, non-routable
-    "0.0.0.0", # standard IPv4, unspecified, non-routable
-    "255.255.255.255", # standard IPv4
-    "fe80:0000:0000:0000:0204:61ff:fe9d:f156",
-    "fe80:0:0:0:204:61ff:fe9d:f156",
-    "fe80::204:61ff:fe9d:f156",
-    "fe80:0000:0000:0000:0204:61ff:254.157.241.086",
-    "fe80:0:0:0:204:61ff:254.157.241.86",
-    "fe80::204:61ff:254.157.241.86",
-    "::1",
-    "fe80::",
-    "fe80::1"
-  ].each { |ip|
-    describe "when the pattern is a valid IP such as #{ip}" do
-      before :each do
-        @declaration = Puppet::Network::AuthStore::Declaration.new(:allow_ip,ip)
-      end
-      it "should match the specified IP" do
-        expect(@declaration).to be_match('www.testsite.org',ip)
-      end
-      it "should not match other IPs" do
-        expect(@declaration).not_to be_match('www.testsite.org','200.101.99.98')
-      end
-    end unless ip =~ /:.*\./ # Hybrid IPs aren't supported by ruby's ipaddr
-  }
-
-  [
-    "::2:3:4:5:6:7:8",
-  ].each { |ip|
-    describe "when the pattern is a valid IP such as #{ip}" do
-      let(:declaration) do
-        Puppet::Network::AuthStore::Declaration.new(:allow_ip,ip)
-      end
-
-      issue_7477 = !(IPAddr.new(ip) rescue false)
-
-      describe "on rubies with a fix for issue [7477](https://goo.gl/Bb1LU)", :if => issue_7477
-        it "should match the specified IP" do
-          expect(declaration).to be_match('www.testsite.org',ip)
-        end
-        it "should not match other IPs" do
-          expect(declaration).not_to be_match('www.testsite.org','200.101.99.98')
-        end
-    end
-  }
-
-  {
-  'spirit.mars.nasa.gov' => 'a PQDN',
-  'ratchet.2ndsiteinc.com' => 'a PQDN with digits',
-  'a.c.ru' => 'a PQDN with short segments',
-  }.each {|pqdn,desc|
-    describe "when the pattern is #{desc}" do
-      before :each do
-        @host = pqdn
-        @declaration = Puppet::Network::AuthStore::Declaration.new(:allow,@host)
-      end
-      it "should match the specified PQDN" do
-        expect(@declaration).to be_match(@host,'200.101.99.98')
-      end
-      it "should not match a similar FQDN" do
-        pending "FQDN consensus"
-        expect(@declaration).not_to be_match(@host+'.','200.101.99.98')
-      end
-    end
-  }
-
-  ['abc.12seps.edu.phisher.biz','www.google.com','slashdot.org'].each { |host|
-    (1...(host.split('.').length)).each { |n|
-      describe "when the pattern is #{"*."+host.split('.')[-n,n].join('.')}" do
-        before :each do
-          @pattern = "*."+host.split('.')[-n,n].join('.')
-          @declaration = Puppet::Network::AuthStore::Declaration.new(:allow,@pattern)
-        end
-        it "should match #{host}" do
-          expect(@declaration).to be_match(host,'1.2.3.4')
-        end
-        it "should not match www.testsite.gov" do
-          expect(@declaration).not_to be_match('www.testsite.gov','200.101.99.98')
-        end
-        it "should not match hosts that differ in the first non-wildcard segment" do
-          other = host.split('.')
-          other[-n].succ!
-          expect(@declaration).not_to be_match(other.join('.'),'1.2.3.4')
-        end
-      end
-    }
-  }
-
-  describe "when the pattern is a FQDN" do
-    before :each do
-      @host = 'spirit.mars.nasa.gov.'
-      @declaration = Puppet::Network::AuthStore::Declaration.new(:allow,@host)
-    end
-    it "should match the specified FQDN" do
-      pending "FQDN consensus"
-      expect(@declaration).to be_match(@host,'200.101.99.98')
-    end
-    it "should not match a similar PQDN" do
-      expect(@declaration).not_to be_match(@host[0..-2],'200.101.99.98')
-    end
-  end
-
-
-  describe "when the pattern is an opaque string with a back reference" do
-    before :each do
-      @host = 'c216f41a-f902-4bfb-a222-850dd957bebb'
-      @item = "/catalog/#{@host}"
-      @pattern = %{^/catalog/([^/]+)$}
-      @declaration = Puppet::Network::AuthStore::Declaration.new(:allow,'$1')
-    end
-    it "should match an IP with the appropriate interpolation" do
-      expect(@declaration.interpolate(@item.match(@pattern))).to be_match(@host,'10.0.0.5')
-    end
-  end
-
-  describe "when the pattern is an opaque string with a back reference and the matched data contains dots" do
-    before :each do
-      @host = 'admin.mgmt.nym1'
-      @item = "/catalog/#{@host}"
-      @pattern = %{^/catalog/([^/]+)$}
-      @declaration = Puppet::Network::AuthStore::Declaration.new(:allow,'$1')
-    end
-    it "should match a name with the appropriate interpolation" do
-      expect(@declaration.interpolate(@item.match(@pattern))).to be_match(@host,'10.0.0.5')
-    end
-  end
-
-  describe "when the pattern is an opaque string with a back reference and the matched data contains dots with an initial prefix that looks like an IP address" do
-    before :each do
-      @host = '01.admin.mgmt.nym1'
-      @item = "/catalog/#{@host}"
-      @pattern = %{^/catalog/([^/]+)$}
-      @declaration = Puppet::Network::AuthStore::Declaration.new(:allow,'$1')
-    end
-    it "should match a name with the appropriate interpolation" do
-      expect(@declaration.interpolate(@item.match(@pattern))).to be_match(@host,'10.0.0.5')
-    end
-  end
-
-  describe "when comparing patterns" do
-    before :each do
-      @ip        = Puppet::Network::AuthStore::Declaration.new(:allow,'127.0.0.1')
-      @host_name = Puppet::Network::AuthStore::Declaration.new(:allow,'www.hard_knocks.edu')
-      @opaque    = Puppet::Network::AuthStore::Declaration.new(:allow,'hey_dude')
-    end
-    it "should consider ip addresses before host names" do
-      expect(@ip < @host_name).to be_truthy
-    end
-    it "should consider ip addresses before opaque strings" do
-      expect(@ip < @opaque).to be_truthy
-    end
-    it "should consider host_names before opaque strings" do
-      expect(@host_name < @opaque).to be_truthy
-    end
-  end
-end

data/spec/unit/network/http/api/master/v3/authorization_spec.rb

@@ -1,57 +0,0 @@
-require 'spec_helper'
-
-require 'puppet/network/http'
-
-describe Puppet::Network::HTTP::API::Master::V3::Authorization do
-  let(:response) { Puppet::Network::HTTP::MemoryResponse.new }
-  let(:authz) { Puppet::Network::HTTP::API::Master::V3::Authorization.new }
-  let(:noop_handler) {
-    lambda do |request, response|
-    end
-  }
-
-  it "accepts v3 api requests that match allowed authconfig entries" do
-    request = Puppet::Network::HTTP::Request.from_hash({
-      :path => "/v3/environments",
-      :method => "GET",
-      :params => { :authenticated => true, :node => "testing", :ip => "127.0.0.1" }
-    })
-
-    allow(authz).to receive(:authconfig).and_return(Puppet::Network::AuthConfigParser.new(<<-AUTH).parse)
-path /v3/environments
-method find
-allow *
-    AUTH
-
-    handler = authz.wrap do
-      noop_handler
-    end
-
-    expect do
-      handler.call(request, response)
-    end.to_not raise_error
-  end
-
-  it "rejects v3 api requests that are disallowed by authconfig entries" do
-    request = Puppet::Network::HTTP::Request.from_hash({
-      :path => "/v3/environments",
-      :method => "GET",
-      :params => { :authenticated => true, :node => "testing", :ip => "127.0.0.1" }
-    })
-
-    allow(authz).to receive(:authconfig).and_return(Puppet::Network::AuthConfigParser.new(<<-AUTH).parse)
-path /v3/environments
-method find
-auth any
-deny testing
-    AUTH
-
-    handler = authz.wrap do
-      noop_handler
-    end
-
-    expect do
-      handler.call(request, response)
-    end.to raise_error(Puppet::Network::HTTP::Error::HTTPNotAuthorizedError, /Forbidden request/)
-  end
-end