puppet 7.27.0-universal-darwin → 7.29.0-universal-darwin

data/spec/unit/ssl/base_spec.rb

@@ -1,125 +0,0 @@
-require 'spec_helper'
-
-require 'puppet/ssl/certificate'
-
-class TestCertificate < Puppet::SSL::Base
-    wraps(Puppet::SSL::Certificate)
-end
-
-describe Puppet::SSL::Certificate do
-  before :each do
-    @base = TestCertificate.new("name")
-    @class = TestCertificate
-  end
-
-  describe "when creating new instances" do
-    it "should fail if given an object that is not an instance of the wrapped class" do
-      obj = double('obj', :is_a? => false)
-      expect { @class.from_instance(obj) }.to raise_error(ArgumentError)
-    end
-
-    it "should fail if a name is not supplied and can't be determined from the object" do
-      obj = double('obj', :is_a? => true)
-      expect { @class.from_instance(obj) }.to raise_error(ArgumentError)
-    end
-
-    it "should determine the name from the object if it has a subject" do
-      obj = double('obj', :is_a? => true, :subject => '/CN=foo')
-
-      inst = double('base')
-      expect(inst).to receive(:content=).with(obj)
-
-      expect(@class).to receive(:new).with('foo').and_return(inst)
-      expect(@class).to receive(:name_from_subject).with('/CN=foo').and_return('foo')
-
-      expect(@class.from_instance(obj)).to eq(inst)
-    end
-  end
-
-  describe "when determining a name from a certificate subject" do
-    it "should extract only the CN and not any other components" do
-      name = OpenSSL::X509::Name.parse('/CN=host.domain.com/L=Portland/ST=Oregon')
-      expect(@class.name_from_subject(name)).to eq('host.domain.com')
-    end
-  end
-
-  describe "when initializing wrapped class from a file with #read" do
-    it "should open the file with ASCII encoding" do
-      path = '/foo/bar/cert'
-      expect(Puppet::FileSystem).to receive(:read).with(path, {:encoding => Encoding::ASCII}).and_return("bar")
-      @base.read(path)
-    end
-  end
-
-  describe "#digest_algorithm" do
-    let(:content) { double('content') }
-    let(:base) {
-      b = Puppet::SSL::Base.new('base')
-      b.content = content
-      b
-    }
-
-    # Some known signature algorithms taken from RFC 3279, 5758, and browsing
-    # objs_dat.h in openssl
-    {
-      'md5WithRSAEncryption' => 'md5',
-      'sha1WithRSAEncryption' => 'sha1',
-      'md4WithRSAEncryption' => 'md4',
-      'sha256WithRSAEncryption' => 'sha256',
-      'ripemd160WithRSA' => 'ripemd160',
-      'ecdsa-with-SHA1' => 'sha1',
-      'ecdsa-with-SHA224' => 'sha224',
-      'ecdsa-with-SHA256' => 'sha256',
-      'ecdsa-with-SHA384' => 'sha384',
-      'ecdsa-with-SHA512' => 'sha512',
-      'dsa_with_SHA224' => 'sha224',
-      'dsaWithSHA1' => 'sha1',
-    }.each do |signature, digest|
-      it "returns '#{digest}' for signature algorithm '#{signature}'" do
-        allow(content).to receive(:signature_algorithm).and_return(signature)
-        expect(base.digest_algorithm).to eq(digest)
-      end
-    end
-
-    it "raises an error on an unknown signature algorithm" do
-      allow(content).to receive(:signature_algorithm).and_return("nonsense")
-      expect {
-        base.digest_algorithm
-      }.to raise_error(Puppet::Error, "Unknown signature algorithm 'nonsense'")
-    end
-  end
-
-  describe "when getting a CN from a subject" do
-    def parse(dn)
-      OpenSSL::X509::Name.parse(dn)
-    end
-
-    def cn_from(subject)
-      @class.name_from_subject(subject)
-    end
-
-    it "should correctly parse a subject containing only a CN" do
-      subj = parse('/CN=foo')
-      expect(cn_from(subj)).to eq('foo')
-    end
-
-    it "should correctly parse a subject containing other components" do
-      subj = parse('/CN=Root CA/OU=Server Operations/O=Example Org')
-      expect(cn_from(subj)).to eq('Root CA')
-    end
-
-    it "should correctly parse a subject containing other components with CN not first" do
-      subj = parse('/emailAddress=foo@bar.com/CN=foo.bar.com/O=Example Org')
-      expect(cn_from(subj)).to eq('foo.bar.com')
-    end
-
-    it "should return nil for a subject with no CN" do
-      subj = parse('/OU=Server Operations/O=Example Org')
-      expect(cn_from(subj)).to eq(nil)
-    end
-
-    it "should return nil for a bare string" do
-      expect(cn_from("/CN=foo")).to eq(nil)
-    end
-  end
-end

data/spec/unit/ssl/certificate_request_attributes_spec.rb

@@ -1,80 +0,0 @@
-require 'spec_helper'
-
-require 'puppet/ssl/certificate_request_attributes'
-
-describe Puppet::SSL::CertificateRequestAttributes do
-  include PuppetSpec::Files
-
-  let(:expected) do
-    {
-      "custom_attributes" => {
-        "1.3.6.1.4.1.34380.2.2"=>[3232235521, 3232235777], # system IPs in hex
-        "1.3.6.1.4.1.34380.2.0"=>"hostname.domain.com",
-        "1.3.6.1.4.1.34380.1.1.3"=>:node_image_name,
-        # different UTF-8 widths
-        # 1-byte A
-        # 2-byte ۿ - http://www.fileformat.info/info/unicode/char/06ff/index.htm - 0xDB 0xBF / 219 191
-        # 3-byte ᚠ - http://www.fileformat.info/info/unicode/char/16A0/index.htm - 0xE1 0x9A 0xA0 / 225 154 160
-        # 4-byte 𠜎 - http://www.fileformat.info/info/unicode/char/2070E/index.htm - 0xF0 0xA0 0x9C 0x8E / 240 160 156 142
-        "1.2.840.113549.1.9.7"=>"utf8passwordA\u06FF\u16A0\u{2070E}"
-      }
-    }
-  end
-  let(:csr_attributes_hash) { expected.dup }
-  let(:csr_attributes_path) { tmpfile('csr_attributes.yaml') }
-  let(:csr_attributes) { Puppet::SSL::CertificateRequestAttributes.new(csr_attributes_path) }
-
-  it "initializes with a path" do
-    expect(csr_attributes.path).to eq(csr_attributes_path)
-  end
-
-  describe "loading" do
-    it "returns nil when loading from a non-existent file" do
-      nonexistent = Puppet::SSL::CertificateRequestAttributes.new('/does/not/exist.yaml')
-      expect(nonexistent.load).to be_falsey
-    end
-
-    context "with an available attributes file" do
-      before do
-        Puppet::Util::Yaml.dump(csr_attributes_hash, csr_attributes_path)
-      end
-
-      it "loads csr attributes from a file when the file is present" do
-        expect(csr_attributes.load).to be_truthy
-      end
-
-      it "exposes custom_attributes" do
-        csr_attributes.load
-        expect(csr_attributes.custom_attributes).to eq(expected['custom_attributes'])
-      end
-
-      it "returns an empty hash if custom_attributes points to nil" do
-        Puppet::Util::Yaml.dump({'custom_attributes' => nil }, csr_attributes_path)
-        csr_attributes.load
-        expect(csr_attributes.custom_attributes).to eq({})
-      end
-
-      it "returns an empty hash if custom_attributes key is not present" do
-        Puppet::Util::Yaml.dump({}, csr_attributes_path)
-        csr_attributes.load
-        expect(csr_attributes.custom_attributes).to eq({})
-      end
-
-      it "raises a Puppet::Error if an unexpected root key is defined" do
-        csr_attributes_hash['unintentional'] = 'data'
-        Puppet::Util::Yaml.dump(csr_attributes_hash, csr_attributes_path)
-        expect {
-          csr_attributes.load
-        }.to raise_error(Puppet::Error, /unexpected attributes.*unintentional/)
-      end
-
-      it "raises a Puppet::Util::Yaml::YamlLoadError if an unexpected ruby object is present" do
-        csr_attributes_hash['custom_attributes']['whoops'] = Object.new
-        Puppet::Util::Yaml.dump(csr_attributes_hash, csr_attributes_path)
-        expect {
-          csr_attributes.load
-        }.to raise_error(Puppet::Util::Yaml::YamlLoadError, /Tried to load unspecified class: Object/)
-      end
-    end
-  end
-end

data/spec/unit/ssl/certificate_request_spec.rb

@@ -1,369 +0,0 @@
-require 'spec_helper'
-
-require 'puppet/ssl/certificate_request'
-
-describe Puppet::SSL::CertificateRequest do
-  let(:request) { described_class.new("myname") }
-  let(:key) { OpenSSL::PKey::RSA.new(Puppet[:keylength]) }
-
-  it "should use any provided name as its name" do
-    expect(described_class.new("myname").name).to eq("myname")
-  end
-
-  it "should only support the text format" do
-    expect(described_class.supported_formats).to eq([:s])
-  end
-
-  describe "when converting from a string" do
-    it "should create a CSR instance with its name set to the CSR subject and its content set to the extracted CSR" do
-      csr = double('csr',
-        :subject => OpenSSL::X509::Name.parse("/CN=Foo.madstop.com"),
-        :is_a? => true)
-      expect(OpenSSL::X509::Request).to receive(:new).with("my csr").and_return(csr)
-
-      mycsr = double('sslcsr')
-      expect(mycsr).to receive(:content=).with(csr)
-
-      expect(described_class).to receive(:new).with("Foo.madstop.com").and_return(mycsr)
-
-      described_class.from_s("my csr")
-    end
-  end
-
-  describe "when managing instances" do
-    it "should have a name attribute" do
-      expect(request.name).to eq("myname")
-    end
-
-    it "should downcase its name" do
-      expect(described_class.new("MyName").name).to eq("myname")
-    end
-
-    it "should have a content attribute" do
-      expect(request).to respond_to(:content)
-    end
-
-    it "should be able to read requests from disk" do
-      path = "/my/path"
-      expect(Puppet::FileSystem).to receive(:read).with(path, {:encoding => Encoding::ASCII}).and_return("my request")
-      my_req = double('request')
-      expect(OpenSSL::X509::Request).to receive(:new).with("my request").and_return(my_req)
-      expect(request.read(path)).to equal(my_req)
-      expect(request.content).to equal(my_req)
-    end
-
-    it "should return an empty string when converted to a string with no request" do
-      expect(request.to_s).to eq("")
-    end
-
-    it "should convert the request to pem format when converted to a string", :unless => RUBY_PLATFORM == 'java' do
-      request.generate(key)
-      expect(request.to_s).to eq(request.content.to_pem)
-    end
-
-    it "should have a :to_text method that it delegates to the actual key" do
-      real_request = double('request')
-      expect(real_request).to receive(:to_text).and_return("requesttext")
-      request.content = real_request
-      expect(request.to_text).to eq("requesttext")
-    end
-  end
-
-  describe "when generating", :unless => RUBY_PLATFORM == 'java' do
-    it "should verify the CSR using the public key associated with the private key" do
-      request.generate(key)
-      expect(request.content.verify(key.public_key)).to be_truthy
-    end
-
-    it "should set the version to 0" do
-      request.generate(key)
-      expect(request.content.version).to eq(0)
-    end
-
-    it "should set the public key to the provided key's public key" do
-      request.generate(key)
-      # The openssl bindings do not define equality on keys so we use to_s
-      expect(request.content.public_key.to_s).to eq(key.public_key.to_s)
-    end
-
-    context "without subjectAltName / dns_alt_names" do
-      before :each do
-        Puppet[:dns_alt_names] = ""
-      end
-
-      ["extreq", "msExtReq"].each do |name|
-        it "should not add any #{name} attribute" do
-          request.generate(key)
-          expect(request.content.attributes.find do |attr|
-            attr.oid == name
-          end).not_to be
-        end
-
-        it "should return no subjectAltNames" do
-          request.generate(key)
-          expect(request.subject_alt_names).to be_empty
-        end
-      end
-    end
-
-    context "with dns_alt_names" do
-      before :each do
-        Puppet[:dns_alt_names] = "one, two, three"
-      end
-
-      ["extreq", "msExtReq"].each do |name|
-        it "should not add any #{name} attribute" do
-          request.generate(key)
-          expect(request.content.attributes.find do |attr|
-            attr.oid == name
-          end).not_to be
-        end
-
-        it "should return no subjectAltNames" do
-          request.generate(key)
-          expect(request.subject_alt_names).to be_empty
-        end
-      end
-    end
-
-    context "with subjectAltName to generate request" do
-      before :each do
-        Puppet[:dns_alt_names] = ""
-      end
-
-      it "should add an extreq attribute" do
-        request.generate(key, :dns_alt_names => 'one, two')
-        extReq = request.content.attributes.find do |attr|
-          attr.oid == 'extReq'
-        end
-
-        expect(extReq).to be
-        extReq.value.value.all? do |x|
-          x.value.all? do |y|
-            expect(y.value[0].value).to eq("subjectAltName")
-          end
-        end
-      end
-
-      it "should return the subjectAltName values" do
-        request.generate(key, :dns_alt_names => 'one,two')
-        expect(request.subject_alt_names).to match_array(["DNS:myname", "DNS:one", "DNS:two"])
-      end
-    end
-
-    context "with DNS and IP SAN specified" do
-      before :each do
-        Puppet[:dns_alt_names] = ""
-      end
-
-      it "should return the subjectAltName values" do
-        request.generate(key, :dns_alt_names => 'DNS:foo, bar, IP:172.16.254.1')
-        expect(request.subject_alt_names).to match_array(["DNS:bar", "DNS:foo", "DNS:myname", "IP Address:172.16.254.1"])
-      end
-    end
-
-    context "with custom CSR attributes" do
-
-      it "adds attributes with single values" do
-        csr_attributes = {
-          '1.3.6.1.4.1.34380.1.2.1' => 'CSR specific info',
-          '1.3.6.1.4.1.34380.1.2.2' => 'more CSR specific info',
-        }
-
-        request.generate(key, :csr_attributes => csr_attributes)
-
-        attrs = request.custom_attributes
-        expect(attrs).to include({'oid' => '1.3.6.1.4.1.34380.1.2.1', 'value' => 'CSR specific info'})
-        expect(attrs).to include({'oid' => '1.3.6.1.4.1.34380.1.2.2', 'value' => 'more CSR specific info'})
-      end
-
-      ['extReq', '1.2.840.113549.1.9.14'].each do |oid|
-        it "doesn't overwrite standard PKCS#9 CSR attribute '#{oid}'" do
-          expect do
-            request.generate(key, :csr_attributes => {oid => 'data'})
-          end.to raise_error ArgumentError, /Cannot specify.*#{oid}/
-        end
-      end
-
-      ['msExtReq', '1.3.6.1.4.1.311.2.1.14'].each do |oid|
-        it "doesn't overwrite Microsoft extension request OID '#{oid}'" do
-          expect do
-            request.generate(key, :csr_attributes => {oid => 'data'})
-          end.to raise_error ArgumentError, /Cannot specify.*#{oid}/
-        end
-      end
-
-      it "raises an error if an attribute cannot be created" do
-        csr_attributes = { "thats.no.moon" => "death star" }
-
-        expect do
-          request.generate(key, :csr_attributes => csr_attributes)
-        end.to raise_error Puppet::Error, /Cannot create CSR with attribute thats\.no\.moon: first num too large/
-      end
-
-      it "should support old non-DER encoded extensions" do
-        csr = OpenSSL::X509::Request.new(File.read(my_fixture("old-style-cert-request.pem")))
-        wrapped_csr = Puppet::SSL::CertificateRequest.from_instance csr
-        exts = wrapped_csr.request_extensions()
-
-        expect(exts.find { |ext| ext['oid'] == 'pp_uuid' }['value']).to eq('I-AM-A-UUID')
-        expect(exts.find { |ext| ext['oid'] == 'pp_instance_id' }['value']).to eq('i_am_an_id')
-        expect(exts.find { |ext| ext['oid'] == 'pp_image_name' }['value']).to eq('i_am_an_image_name')
-      end
-    end
-
-    context "with extension requests" do
-      let(:extension_data) do
-        {
-          '1.3.6.1.4.1.34380.1.1.31415' => 'pi',
-          '1.3.6.1.4.1.34380.1.1.2718'  => 'e',
-        }
-      end
-
-      it "adds an extreq attribute to the CSR" do
-        request.generate(key, :extension_requests => extension_data)
-
-        exts = request.content.attributes.select { |attr| attr.oid = 'extReq' }
-        expect(exts.length).to eq(1)
-      end
-
-      it "adds an extension for each entry in the extension request structure" do
-        request.generate(key, :extension_requests => extension_data)
-
-        exts = request.request_extensions
-
-        expect(exts).to include('oid' => '1.3.6.1.4.1.34380.1.1.31415', 'value' => 'pi')
-        expect(exts).to include('oid' => '1.3.6.1.4.1.34380.1.1.2718', 'value' => 'e')
-      end
-
-      it "defines the extensions as non-critical" do
-        request.generate(key, :extension_requests => extension_data)
-        request.request_extensions.each do |ext|
-          expect(ext['critical']).to be_falsey
-        end
-      end
-
-      it "rejects the subjectAltNames extension" do
-        san_names = ['subjectAltName', '2.5.29.17']
-        san_field = 'DNS:first.tld, DNS:second.tld'
-
-        san_names.each do |name|
-          expect do
-            request.generate(key, :extension_requests => {name => san_field})
-          end.to raise_error Puppet::Error, /conflicts with internally used extension/
-        end
-      end
-
-      it "merges the extReq attribute with the subjectAltNames extension" do
-        request.generate(key,
-                         :dns_alt_names => 'first.tld, second.tld',
-                         :extension_requests => extension_data)
-        exts = request.request_extensions
-
-        expect(exts).to include('oid' => '1.3.6.1.4.1.34380.1.1.31415', 'value' => 'pi')
-        expect(exts).to include('oid' => '1.3.6.1.4.1.34380.1.1.2718', 'value' => 'e')
-        expect(exts).to include('oid' => 'subjectAltName', 'value' => 'DNS:first.tld, DNS:myname, DNS:second.tld')
-
-        expect(request.subject_alt_names).to eq ['DNS:first.tld', 'DNS:myname', 'DNS:second.tld']
-      end
-
-      it "raises an error if the OID could not be created" do
-        exts = {"thats.no.moon" => "death star"}
-        expect do
-          request.generate(key, :extension_requests => exts)
-        end.to raise_error Puppet::Error, /Cannot create CSR with extension request thats\.no\.moon.*: first num too large/
-      end
-    end
-
-    it "should sign the csr with the provided key" do
-      request.generate(key)
-      expect(request.content.verify(key.public_key)).to be_truthy
-    end
-
-    it "should verify the generated request using the public key" do
-      # Stupid keys don't have a competent == method.
-      expect_any_instance_of(OpenSSL::X509::Request).to receive(:verify) do |public_key|
-        public_key.to_s == key.public_key.to_s
-      end.and_return(true)
-      request.generate(key)
-    end
-
-    it "should fail if verification fails" do
-      expect_any_instance_of(OpenSSL::X509::Request).to receive(:verify) do |public_key|
-        public_key.to_s == key.public_key.to_s
-      end.and_return(false)
-
-      expect do
-        request.generate(key)
-      end.to raise_error(Puppet::Error, /CSR sign verification failed/)
-    end
-
-    it "should log the fingerprint" do
-      allow_any_instance_of(Puppet::SSL::Digest).to receive(:to_hex).and_return("FINGERPRINT")
-      allow(Puppet).to receive(:info)
-      expect(Puppet).to receive(:info).with(/FINGERPRINT/)
-      request.generate(key)
-    end
-
-    it "should return the generated request" do
-      generated = request.generate(key)
-      expect(generated).to be_a(OpenSSL::X509::Request)
-      expect(generated).to be(request.content)
-    end
-
-    it "should use SHA1 to sign the csr when SHA256 isn't available" do
-      csr = OpenSSL::X509::Request.new
-      expect(OpenSSL::Digest).to receive(:const_defined?).with("SHA256").and_return(false)
-      expect(OpenSSL::Digest).to receive(:const_defined?).with("SHA1").and_return(true)
-      signer = Puppet::SSL::CertificateSigner.new
-      signer.sign(csr, key)
-      expect(csr.verify(key)).to be_truthy
-    end
-
-    it "should use SHA512 to sign the csr when SHA256 and SHA1 aren't available" do
-      key = OpenSSL::PKey::RSA.new(2048)
-      csr = OpenSSL::X509::Request.new
-      expect(OpenSSL::Digest).to receive(:const_defined?).with("SHA256").and_return(false)
-      expect(OpenSSL::Digest).to receive(:const_defined?).with("SHA1").and_return(false)
-      expect(OpenSSL::Digest).to receive(:const_defined?).with("SHA512").and_return(true)
-      signer = Puppet::SSL::CertificateSigner.new
-      signer.sign(csr, key)
-      expect(csr.verify(key)).to be_truthy
-    end
-
-    it "should use SHA384 to sign the csr when SHA256/SHA1/SHA512 aren't available" do
-      key = OpenSSL::PKey::RSA.new(2048)
-      csr = OpenSSL::X509::Request.new
-      expect(OpenSSL::Digest).to receive(:const_defined?).with("SHA256").and_return(false)
-      expect(OpenSSL::Digest).to receive(:const_defined?).with("SHA1").and_return(false)
-      expect(OpenSSL::Digest).to receive(:const_defined?).with("SHA512").and_return(false)
-      expect(OpenSSL::Digest).to receive(:const_defined?).with("SHA384").and_return(true)
-      signer = Puppet::SSL::CertificateSigner.new
-      signer.sign(csr, key)
-      expect(csr.verify(key)).to be_truthy
-    end
-
-    it "should use SHA224 to sign the csr when SHA256/SHA1/SHA512/SHA384 aren't available" do
-      csr = OpenSSL::X509::Request.new
-      expect(OpenSSL::Digest).to receive(:const_defined?).with("SHA256").and_return(false)
-      expect(OpenSSL::Digest).to receive(:const_defined?).with("SHA1").and_return(false)
-      expect(OpenSSL::Digest).to receive(:const_defined?).with("SHA512").and_return(false)
-      expect(OpenSSL::Digest).to receive(:const_defined?).with("SHA384").and_return(false)
-      expect(OpenSSL::Digest).to receive(:const_defined?).with("SHA224").and_return(true)
-      signer = Puppet::SSL::CertificateSigner.new
-      signer.sign(csr, key)
-      expect(csr.verify(key)).to be_truthy
-    end
-
-    it "should raise an error if neither SHA256/SHA1/SHA512/SHA384/SHA224 are available" do
-      expect(OpenSSL::Digest).to receive(:const_defined?).with("SHA256").and_return(false)
-      expect(OpenSSL::Digest).to receive(:const_defined?).with("SHA1").and_return(false)
-      expect(OpenSSL::Digest).to receive(:const_defined?).with("SHA512").and_return(false)
-      expect(OpenSSL::Digest).to receive(:const_defined?).with("SHA384").and_return(false)
-      expect(OpenSSL::Digest).to receive(:const_defined?).with("SHA224").and_return(false)
-      expect {
-        Puppet::SSL::CertificateSigner.new
-      }.to raise_error(Puppet::Error)
-    end
-  end
-end

data/spec/unit/ssl/certificate_signer_spec.rb

@@ -1,17 +0,0 @@
-require 'spec_helper'
-
-describe Puppet::SSL::CertificateSigner do
-  include PuppetSpec::Files
-
-  let(:wrong_key) { OpenSSL::PKey::RSA.new(512) }
-  let(:client_cert) { cert_fixture('signed.pem') }
-
-  # jruby-openssl >= 0.13.0 (JRuby >= 9.3.5.0) raises an error when signing a
-  # certificate when there is a discrepancy between the certificate and key.
-  it 'raises if client cert signature is invalid', if: Puppet::Util::Platform.jruby? && RUBY_VERSION.to_f >= 2.6 do
-    expect {
-      client_cert.sign(wrong_key, OpenSSL::Digest::SHA256.new)
-    }.to raise_error(OpenSSL::X509::CertificateError,
-                     'invalid public key data')
-  end
-end