puppet 6.3.0-x86-mingw32 → 6.4.0-x86-mingw32

data/spec/unit/indirector/rest_spec.rb

@@ -335,21 +335,21 @@ describe Puppet::Indirector::REST do
       @request = stub 'request', :key => "foo", :server => nil, :port => nil
       terminus.class.expects(:port).returns 321
       terminus.class.expects(:server).returns "myserver"
-      Puppet::Network::HttpPool.expects(:http_instance).with("myserver", 321).returns "myconn"
+      Puppet::Network::HttpPool.expects(:connection).with('myserver', 321, anything).returns "myconn"
       expect(terminus.network(@request)).to eq("myconn")
     end
 
     it "should use the server from the indirection request if one is present" do
       @request = stub 'request', :key => "foo", :server => "myserver", :port => nil
       terminus.class.stubs(:port).returns 321
-      Puppet::Network::HttpPool.expects(:http_instance).with("myserver", 321).returns "myconn"
+      Puppet::Network::HttpPool.expects(:connection).with('myserver', 321, anything).returns "myconn"
       expect(terminus.network(@request)).to eq("myconn")
     end
 
     it "should use the port from the indirection request if one is present" do
       @request = stub 'request', :key => "foo", :server => nil, :port => 321
       terminus.class.stubs(:server).returns "myserver"
-      Puppet::Network::HttpPool.expects(:http_instance).with("myserver", 321).returns "myconn"
+      Puppet::Network::HttpPool.expects(:connection).with('myserver', 321, anything).returns "myconn"
       expect(terminus.network(@request)).to eq("myconn")
     end
   end

data/spec/unit/network/http/connection_spec.rb

@@ -26,8 +26,8 @@ describe Puppet::Network::HTTP::Connection do
         expect(conn).to be_use_ssl
       end
 
-      it "can disable ssl using an option" do
-        conn = Puppet::Network::HTTP::Connection.new(host, port, :use_ssl => false, :verify => Puppet::SSL::Validator.no_validator)
+      it "can disable ssl using an option and ignore the verify" do
+        conn = Puppet::Network::HTTP::Connection.new(host, port, :use_ssl => false)
 
         expect(conn).to_not be_use_ssl
       end
@@ -38,9 +38,35 @@ describe Puppet::Network::HTTP::Connection do
         expect(conn).to be_use_ssl
       end
 
+      it "ignores the ':verify' option when ssl is disabled" do
+        conn = Puppet::Network::HTTP::Connection.new(host, port, :use_ssl => false, :verify => Puppet::SSL::Validator.no_validator)
+
+        expect(conn.verifier).to be_nil
+      end
+
+      it "wraps the validator in an adapter" do
+        conn = Puppet::Network::HTTP::Connection.new(host, port, :verify => Puppet::SSL::Validator.no_validator)
+
+        expect(conn.verifier).to be_a_kind_of(Puppet::SSL::VerifierAdapter)
+      end
+
       it "should raise Puppet::Error when invalid options are specified" do
         expect { Puppet::Network::HTTP::Connection.new(host, port, :invalid_option => nil) }.to raise_error(Puppet::Error, 'Unrecognized option(s): :invalid_option')
       end
+
+      it "accepts a verifier" do
+        verifier = Puppet::SSL::Verifier.new('fqdn', stub('ssl_context'))
+        conn = Puppet::Network::HTTP::Connection.new(host, port, :use_ssl => true, :verifier => verifier)
+
+        expect(conn.verifier).to eq(verifier)
+      end
+
+      it "raises if the wrong verifier class is specified" do
+        expect {
+          Puppet::Network::HTTP::Connection.new(host, port, :verifier => Puppet::SSL::Validator.default_validator)
+        }.to raise_error(ArgumentError,
+                         "Expected an instance of Puppet::SSL::Verifier but was passed a Puppet::SSL::Validator::DefaultValidator")
+      end
     end
   end
 
@@ -54,6 +80,8 @@ describe Puppet::Network::HTTP::Connection do
       :request_post => "param: value" }.each do |method,body|
       context "##{method}" do
         it "should yield to the block" do
+          Net::HTTP.any_instance.stubs(method).yields.returns(httpok)
+
           block_executed = false
           subject.send(method, "/foo", body) do |response|
             block_executed = true
@@ -64,94 +92,6 @@ describe Puppet::Network::HTTP::Connection do
     end
   end
 
-  shared_examples_for 'ssl verifier' do
-    include PuppetSpec::Files
-
-    let (:host) { "my_server" }
-    let (:port) { 8140 }
-
-    before :all do
-      WebMock.disable!
-    end
-
-    after :all do
-      WebMock.enable!
-    end
-
-    it "should provide a useful error message when one is available and certificate validation fails", :unless => Puppet::Util::Platform.windows? do
-      connection = Puppet::Network::HTTP::Connection.new(
-        host, port,
-        :verify => ConstantErrorValidator.new(:fails_with => 'certificate verify failed',
-                                              :error_string => 'shady looking signature'))
-
-      expect do
-        connection.get('request')
-      end.to raise_error(Puppet::Error, "certificate verify failed: [shady looking signature]")
-    end
-
-    it "should provide a helpful error message when hostname was not match with server certificate", :unless => Puppet::Util::Platform.windows? || RUBY_PLATFORM == 'java' do
-      Puppet[:confdir] = tmpdir('conf')
-
-      connection = Puppet::Network::HTTP::Connection.new(
-      host, port,
-      :verify => ConstantErrorValidator.new(
-        :fails_with => 'hostname was not match with server certificate',
-        :peer_certs => [Puppet::TestCa.new.generate('not_my_server',
-                                                    :subject_alt_names => 'DNS:foo,DNS:bar,DNS:baz,DNS:not_my_server')[:cert]]))
-
-      expect do
-        connection.get('request')
-      end.to raise_error(Puppet::Error) do |error|
-        error.message =~ /\AServer hostname 'my_server' did not match server certificate; expected one of (.+)/
-        expect($1.split(', ')).to match_array(%w[DNS:foo DNS:bar DNS:baz DNS:not_my_server not_my_server])
-      end
-    end
-
-    it "should pass along the error message otherwise" do
-      connection = Puppet::Network::HTTP::Connection.new(
-        host, port,
-        :verify => ConstantErrorValidator.new(:fails_with => 'some other message'))
-
-      expect do
-        connection.get('request')
-      end.to raise_error(/some other message/)
-    end
-
-    it "should check all peer certificates for upcoming expiration", :unless => Puppet::Util::Platform.windows? || RUBY_PLATFORM == 'java' do
-      Puppet[:confdir] = tmpdir('conf')
-      cert = Puppet::TestCa.new.generate('server',
-                                         :subject_alt_names => 'DNS:foo,DNS:bar,DNS:baz,DNS:server')[:cert]
-
-      connection = Puppet::Network::HTTP::Connection.new(
-        host, port,
-        :verify => NoProblemsValidator.new(cert))
-
-      Net::HTTP.any_instance.stubs(:start)
-      Net::HTTP.any_instance.stubs(:request).returns(httpok)
-      Puppet::Network::HTTP::Pool.any_instance.stubs(:setsockopts)
-
-      connection.get('request')
-    end
-  end
-
-  context "when using single use HTTPS connections", :unless => RUBY_PLATFORM == 'java' do
-    it_behaves_like 'ssl verifier' do
-    end
-  end
-
-  context "when using persistent HTTPS connections", :unless => RUBY_PLATFORM == 'java' do
-    around :each do |example|
-      pool = Puppet::Network::HTTP::Pool.new
-      Puppet.override(:http_pool => pool) do
-        example.run
-      end
-      pool.close
-    end
-
-    it_behaves_like 'ssl verifier' do
-    end
-  end
-
   context "when response is a redirect" do
     let (:site)       { Puppet::Network::HTTP::Site.new('http', 'my_server', 8140) }
     let (:other_site) { Puppet::Network::HTTP::Site.new('http', 'redirected', 9292) }

data/spec/unit/network/http/factory_spec.rb

@@ -14,6 +14,7 @@ describe Puppet::Network::HTTP::Factory do
   end
 
   let(:site) { Puppet::Network::HTTP::Site.new('https', 'www.example.com', 443) }
+
   def create_connection(site)
     factory = Puppet::Network::HTTP::Factory.new
 

data/spec/unit/network/http/nocache_pool_spec.rb

@@ -6,34 +6,34 @@ require 'puppet/network/http/connection'
 
 describe Puppet::Network::HTTP::NoCachePool do
   let(:site) { Puppet::Network::HTTP::Site.new('https', 'rubygems.org', 443) }
-  let(:verify) { stub('verify', :setup_connection => nil) }
+  let(:verifier) { stub('verifier', :setup_connection => nil) }
 
-  it 'yields a connection' do
-    http  = stub('http')
+  it 'yields a started connection' do
+    http  = stub('http', start: nil, finish: nil)
 
     factory = Puppet::Network::HTTP::Factory.new
     factory.stubs(:create_connection).returns(http)
     pool = Puppet::Network::HTTP::NoCachePool.new(factory)
 
     expect { |b|
-      pool.with_connection(site, verify, &b)
+      pool.with_connection(site, verifier, &b)
     }.to yield_with_args(http)
   end
 
   it 'yields a new connection each time' do
-    http1  = stub('http1')
-    http2  = stub('http2')
+    http1  = stub('http1', start: nil, finish: nil)
+    http2  = stub('http2', start: nil, finish: nil)
 
     factory = Puppet::Network::HTTP::Factory.new
     factory.stubs(:create_connection).returns(http1).then.returns(http2)
     pool = Puppet::Network::HTTP::NoCachePool.new(factory)
 
     expect { |b|
-      pool.with_connection(site, verify, &b)
+      pool.with_connection(site, verifier, &b)
     }.to yield_with_args(http1)
 
     expect { |b|
-      pool.with_connection(site, verify, &b)
+      pool.with_connection(site, verifier, &b)
     }.to yield_with_args(http2)
   end
 

data/spec/unit/network/http/pool_spec.rb

@@ -19,8 +19,11 @@ describe Puppet::Network::HTTP::Pool do
     Puppet::Network::HTTP::Site.new('https', 'github.com', 443)
   end
 
-  let(:verify) do
-    stub('verify', :setup_connection => nil)
+  let(:ssl_context) { Puppet::SSL::SSLContext.new }
+  let(:verifier) do
+    v = Puppet::SSL::Verifier.new(site.host, ssl_context)
+    v.stubs(:setup_connection => nil)
+    v
   end
 
   def create_pool
@@ -30,7 +33,7 @@ describe Puppet::Network::HTTP::Pool do
   def create_pool_with_connections(site, *connections)
     pool = Puppet::Network::HTTP::Pool.new
     connections.each do |conn|
-      pool.release(site, conn)
+      pool.release(site, verifier, conn)
     end
     pool
   end
@@ -40,7 +43,7 @@ describe Puppet::Network::HTTP::Pool do
     # connections have already expired
     pool = Puppet::Network::HTTP::Pool.new(-1)
     connections.each do |conn|
-      pool.release(site, conn)
+      pool.release(site, verifier, conn)
     end
     pool
   end
@@ -55,16 +58,16 @@ describe Puppet::Network::HTTP::Pool do
       pool = create_pool_with_connections(site, conn)
 
       expect { |b|
-        pool.with_connection(site, verify, &b)
+        pool.with_connection(site, verifier, &b)
       }.to yield_with_args(conn)
     end
 
     it 'returns the connection to the pool' do
       conn = create_connection(site)
       pool = create_pool
-      pool.release(site, conn)
+      pool.release(site, verifier, conn)
 
-      pool.with_connection(site, verify) { |c| }
+      pool.with_connection(site, verifier) { |c| }
 
       expect(pool.pool[site].first.connection).to eq(conn)
     end
@@ -74,10 +77,10 @@ describe Puppet::Network::HTTP::Pool do
       mru_conn = create_connection(site)
       pool = create_pool_with_connections(site, lru_conn, mru_conn)
 
-      pool.with_connection(site, verify) do |a|
+      pool.with_connection(site, verifier) do |a|
         expect(a).to eq(mru_conn)
 
-        pool.with_connection(site, verify) do |b|
+        pool.with_connection(site, verifier) do |b|
           expect(b).to eq(lru_conn)
         end
       end
@@ -86,10 +89,10 @@ describe Puppet::Network::HTTP::Pool do
     it 'propagates exceptions' do
       conn = create_connection(site)
       pool = create_pool
-      pool.release(site, conn)
+      pool.release(site, verifier, conn)
 
       expect {
-        pool.with_connection(site, verify) do |c|
+        pool.with_connection(site, verifier) do |c|
           raise IOError, 'connection reset'
         end
       }.to raise_error(IOError, 'connection reset')
@@ -100,11 +103,11 @@ describe Puppet::Network::HTTP::Pool do
       # suggest we close the socket, and other errors
       conn = create_connection(site)
       pool = create_pool
-      pool.release(site, conn)
+      pool.release(site, verifier, conn)
 
-      pool.expects(:release).with(site, conn).never
+      pool.expects(:release).with(site, verifier, conn).never
 
-      pool.with_connection(site, verify) do |c|
+      pool.with_connection(site, verifier) do |c|
         raise IOError, 'connection reset'
       end rescue nil
     end
@@ -140,9 +143,9 @@ describe Puppet::Network::HTTP::Pool do
         conn.expects(:use_ssl?).returns(false)
 
         pool = create_pool_with_connections(site, conn)
-        pool.expects(:release).with(site, conn)
+        pool.expects(:release).with(site, verifier, conn)
 
-        pool.with_connection(site, verify) {|c| }
+        pool.with_connection(site, verifier) {|c| }
       end
 
       it 'releases secure HTTPS connections' do
@@ -151,9 +154,9 @@ describe Puppet::Network::HTTP::Pool do
         conn.expects(:verify_mode).returns(OpenSSL::SSL::VERIFY_PEER)
 
         pool = create_pool_with_connections(site, conn)
-        pool.expects(:release).with(site, conn)
+        pool.expects(:release).with(site, verifier, conn)
 
-        pool.with_connection(site, verify) {|c| }
+        pool.with_connection(site, verifier) {|c| }
       end
 
       it 'closes insecure HTTPS connections' do
@@ -163,9 +166,9 @@ describe Puppet::Network::HTTP::Pool do
 
         pool = create_pool_with_connections(site, conn)
 
-        pool.expects(:release).with(site, conn).never
+        pool.expects(:release).with(site, verifier, conn).never
 
-        pool.with_connection(site, verify) {|c| }
+        pool.with_connection(site, verifier) {|c| }
       end
     end
   end
@@ -177,7 +180,7 @@ describe Puppet::Network::HTTP::Pool do
       pool.factory.expects(:create_connection).with(site).returns(conn)
       pool.expects(:setsockopts)
 
-      expect(pool.borrow(site, verify)).to eq(conn)
+      expect(pool.borrow(site, verifier)).to eq(conn)
     end
 
     it 'returns a matching connection' do
@@ -186,7 +189,7 @@ describe Puppet::Network::HTTP::Pool do
 
       pool.factory.expects(:create_connection).never
 
-      expect(pool.borrow(site, verify)).to eq(conn)
+      expect(pool.borrow(site, verifier)).to eq(conn)
     end
 
     it 'returns a new connection if there are no matching sites' do
@@ -197,7 +200,34 @@ describe Puppet::Network::HTTP::Pool do
       pool.factory.expects(:create_connection).with(site).returns(conn)
       pool.expects(:setsockopts)
 
-      expect(pool.borrow(site, verify)).to eq(conn)
+      expect(pool.borrow(site, verifier)).to eq(conn)
+    end
+
+    it 'returns a new connection if the ssl contexts are different' do
+      old_conn = create_connection(site)
+      pool = create_pool_with_connections(site, old_conn)
+      pool.stubs(:setsockopts)
+
+      new_conn = create_connection(site)
+      pool.factory.stubs(:create_connection).with(site).returns(new_conn)
+
+      new_verifier = Puppet::SSL::Verifier.new(site.host, Puppet::SSL::SSLContext.new)
+      new_verifier.stubs(:setup_connection)
+
+      # 'equal' tests that it's the same object
+      expect(pool.borrow(site, new_verifier)).to eq(new_conn)
+    end
+
+    it 'returns a cached connection if the ssl contexts are the same' do
+      old_conn = create_connection(site)
+      pool = create_pool_with_connections(site, old_conn)
+      pool.stubs(:setsockopts)
+
+      pool.factory.expects(:create_connection).never
+
+      # 'equal' tests that it's the same object
+      new_verifier = Puppet::SSL::Verifier.new(site.host, ssl_context)
+      expect(pool.borrow(site, new_verifier)).to equal(old_conn)
     end
 
     it 'returns started connections' do
@@ -208,7 +238,7 @@ describe Puppet::Network::HTTP::Pool do
       pool.factory.expects(:create_connection).with(site).returns(conn)
       pool.expects(:setsockopts)
 
-      expect(pool.borrow(site, verify)).to eq(conn)
+      expect(pool.borrow(site, verifier)).to eq(conn)
     end
 
     it "doesn't start a cached connection" do
@@ -216,7 +246,7 @@ describe Puppet::Network::HTTP::Pool do
       conn.expects(:start).never
 
       pool = create_pool_with_connections(site, conn)
-      pool.borrow(site, verify)
+      pool.borrow(site, verifier)
     end
 
     it 'returns the most recently used connection from the pool' do
@@ -224,7 +254,7 @@ describe Puppet::Network::HTTP::Pool do
       most_recently_used = create_connection(site)
 
       pool = create_pool_with_connections(site, least_recently_used, most_recently_used)
-      expect(pool.borrow(site, verify)).to eq(most_recently_used)
+      expect(pool.borrow(site, verifier)).to eq(most_recently_used)
     end
 
     it 'finishes expired connections' do
@@ -235,7 +265,7 @@ describe Puppet::Network::HTTP::Pool do
       pool.factory.expects(:create_connection => stub('conn', :start => nil))
       pool.expects(:setsockopts)
 
-      pool.borrow(site, verify)
+      pool.borrow(site, verifier)
     end
 
     it 'logs an exception if it fails to close an expired connection' do
@@ -248,7 +278,7 @@ describe Puppet::Network::HTTP::Pool do
       pool.factory.expects(:create_connection => stub('open_conn', :start => nil))
       pool.expects(:setsockopts)
 
-      pool.borrow(site, verify)
+      pool.borrow(site, verifier)
     end
   end
 
@@ -257,23 +287,23 @@ describe Puppet::Network::HTTP::Pool do
       conn = create_connection(site)
 
       pool = create_pool
-      pool.release(site, conn)
+      pool.release(site, verifier, conn)
 
       expect(pool.pool[site].first.connection).to eq(conn)
     end
 
     it 'adds the connection to a pool with a connection for the same site' do
       pool = create_pool
-      pool.release(site, create_connection(site))
-      pool.release(site, create_connection(site))
+      pool.release(site, verifier, create_connection(site))
+      pool.release(site, verifier, create_connection(site))
 
       expect(pool.pool[site].count).to eq(2)
     end
 
     it 'adds the connection to a pool with a connection for a different site' do
       pool = create_pool
-      pool.release(site, create_connection(site))
-      pool.release(different_site, create_connection(different_site))
+      pool.release(site, verifier, create_connection(site))
+      pool.release(different_site, verifier, create_connection(different_site))
 
       expect(pool.pool[site].count).to eq(1)
       expect(pool.pool[different_site].count).to eq(1)