puppet 7.33.0 → 8.0.1

data/spec/unit/http/dns_spec.rb

@@ -0,0 +1,281 @@
+require 'spec_helper'
+require 'puppet/http'
+
+describe Puppet::HTTP::DNS do
+  before do
+    @dns_mock_object = double('dns')
+    allow(Resolv::DNS).to receive(:new).and_return(@dns_mock_object)
+
+    @rr_type         = Resolv::DNS::Resource::IN::SRV
+    @test_srv_domain = "domain.com"
+    @test_a_hostname = "puppet.domain.com"
+    @test_port       = 1000
+
+    # The records we should use.
+    @test_records = [
+      #                                  priority,  weight, port, target
+      Resolv::DNS::Resource::IN::SRV.new(0,         20,     8140, "puppet1.domain.com"),
+      Resolv::DNS::Resource::IN::SRV.new(0,         80,     8140, "puppet2.domain.com"),
+      Resolv::DNS::Resource::IN::SRV.new(1,         1,      8140, "puppet3.domain.com"),
+      Resolv::DNS::Resource::IN::SRV.new(4,         1,      8140, "puppet4.domain.com")
+    ]
+
+    @test_records.each do |rec|
+      # Resources do not expose public API for setting the TTL
+      rec.instance_variable_set(:@ttl, 3600)
+    end
+  end
+
+  let(:resolver) { described_class.new }
+
+  describe 'when the domain is not known' do
+    before :each do
+      allow(@dns_mock_object).to receive(:getresources).and_return(@test_records)
+    end
+
+    describe 'because domain is nil' do
+      it 'does not yield' do
+        resolver.each_srv_record(nil) do |_,_,_|
+          raise Exception.new("nil domain caused SRV lookup")
+        end
+      end
+    end
+
+    describe 'because domain is an empty string' do
+      it 'does not yield' do
+        resolver.each_srv_record('') do |_,_,_|
+          raise Exception.new("nil domain caused SRV lookup")
+        end
+      end
+    end
+  end
+
+  describe "when resolving a host without SRV records" do
+
+    it "should not yield anything" do
+      # No records returned for a DNS entry without any SRV records
+      expect(@dns_mock_object).to receive(:getresources).with(
+        "_x-puppet._tcp.#{@test_a_hostname}",
+        @rr_type
+      ).and_return([])
+
+      resolver.each_srv_record(@test_a_hostname) do |hostname, port, remaining|
+        raise Exception.new("host with no records passed block")
+      end
+    end
+  end
+
+  describe "when resolving a host with SRV records" do
+    it "should iterate through records in priority order" do
+      # The order of the records that should be returned,
+      # an array means unordered (for weight)
+      order = {
+        0 => ["puppet1.domain.com", "puppet2.domain.com"],
+        1 => ["puppet3.domain.com"],
+        2 => ["puppet4.domain.com"]
+      }
+
+      expect(@dns_mock_object).to receive(:getresources).with(
+        "_x-puppet._tcp.#{@test_srv_domain}",
+        @rr_type
+      ).and_return(@test_records)
+
+      resolver.each_srv_record(@test_srv_domain) do |hostname, port|
+        expected_priority = order.keys.min
+
+        expect(order[expected_priority]).to include(hostname)
+        expect(port).not_to be(@test_port)
+
+        # Remove the host from our expected hosts
+        order[expected_priority].delete hostname
+
+        # Remove this priority level if we're done with it
+        order.delete expected_priority if order[expected_priority] == []
+      end
+    end
+
+    it "should fall back to the :puppet service if no records are found for a more specific service" do
+      # The order of the records that should be returned,
+      # an array means unordered (for weight)
+      order = {
+        0 => ["puppet1.domain.com", "puppet2.domain.com"],
+        1 => ["puppet3.domain.com"],
+        2 => ["puppet4.domain.com"]
+      }
+
+      expect(@dns_mock_object).to receive(:getresources).with(
+        "_x-puppet-report._tcp.#{@test_srv_domain}",
+        @rr_type
+      ).and_return([])
+
+      expect(@dns_mock_object).to receive(:getresources).with(
+        "_x-puppet._tcp.#{@test_srv_domain}",
+        @rr_type
+      ).and_return(@test_records)
+
+      resolver.each_srv_record(@test_srv_domain, :report) do |hostname, port|
+        expected_priority = order.keys.min
+
+        expect(order[expected_priority]).to include(hostname)
+        expect(port).not_to be(@test_port)
+
+        # Remove the host from our expected hosts
+        order[expected_priority].delete hostname
+
+        # Remove this priority level if we're done with it
+        order.delete expected_priority if order[expected_priority] == []
+      end
+    end
+
+    it "should use SRV records from the specific service if they exist" do
+      # The order of the records that should be returned,
+      # an array means unordered (for weight)
+      order = {
+        0 => ["puppet1.domain.com", "puppet2.domain.com"],
+        1 => ["puppet3.domain.com"],
+        2 => ["puppet4.domain.com"]
+      }
+
+      bad_records = [
+        #                                  priority,  weight, port, hostname
+        Resolv::DNS::Resource::IN::SRV.new(0,         20,     8140, "puppet1.bad.domain.com"),
+        Resolv::DNS::Resource::IN::SRV.new(0,         80,     8140, "puppet2.bad.domain.com"),
+        Resolv::DNS::Resource::IN::SRV.new(1,         1,      8140, "puppet3.bad.domain.com"),
+        Resolv::DNS::Resource::IN::SRV.new(4,         1,      8140, "puppet4.bad.domain.com")
+      ]
+
+      expect(@dns_mock_object).to receive(:getresources).with(
+        "_x-puppet-report._tcp.#{@test_srv_domain}",
+        @rr_type
+      ).and_return(@test_records)
+
+      allow(@dns_mock_object).to receive(:getresources).with(
+        "_x-puppet._tcp.#{@test_srv_domain}",
+        @rr_type
+      ).and_return(bad_records)
+
+      resolver.each_srv_record(@test_srv_domain, :report) do |hostname, port|
+        expected_priority = order.keys.min
+
+        expect(order[expected_priority]).to include(hostname)
+        expect(port).not_to be(@test_port)
+
+        # Remove the host from our expected hosts
+        order[expected_priority].delete hostname
+
+        # Remove this priority level if we're done with it
+        order.delete expected_priority if order[expected_priority] == []
+      end
+    end
+  end
+
+  describe "when finding weighted servers" do
+    it "should return nil when no records were found" do
+      expect(resolver.find_weighted_server([])).to eq(nil)
+    end
+
+    it "should return the first record when one record is passed" do
+      result = resolver.find_weighted_server([@test_records.first])
+      expect(result).to eq(@test_records.first)
+    end
+
+    {
+      "all have weights"  => [1, 3, 2, 4],
+      "some have weights" => [2, 0, 1, 0],
+      "none have weights" => [0, 0, 0, 0],
+    }.each do |name, weights|
+      it "should return correct results when #{name}" do
+        records = []
+        count   = 0
+        weights.each do |w|
+          count += 1
+          #                                             priority, weight, port, server
+          records << Resolv::DNS::Resource::IN::SRV.new(0,        w,      1,    count.to_s)
+        end
+
+        seen  = Hash.new(0)
+        total_weight = records.inject(0) do |sum, record|
+          sum + resolver.weight(record)
+        end
+
+        total_weight.times do |n|
+          expect(Kernel).to receive(:rand).once.with(total_weight).and_return(n)
+          server = resolver.find_weighted_server(records)
+          seen[server] += 1
+        end
+
+        expect(seen.length).to eq(records.length)
+        records.each do |record|
+          expect(seen[record]).to eq(resolver.weight(record))
+        end
+      end
+    end
+  end
+
+  describe "caching records" do
+    it "should query DNS when no cache entry exists, then retrieve the cached value" do
+      expect(@dns_mock_object).to receive(:getresources).with(
+        "_x-puppet._tcp.#{@test_srv_domain}",
+        @rr_type
+      ).and_return(@test_records).once
+
+      fetched_servers = []
+      resolver.each_srv_record(@test_srv_domain) do |server, port|
+        fetched_servers << server
+      end
+
+      cached_servers = []
+      expect(resolver).to receive(:expired?).and_return(false)
+      resolver.each_srv_record(@test_srv_domain) do |server, port|
+        cached_servers << server
+      end
+      expect(fetched_servers).to match_array(cached_servers)
+    end
+
+    context "TTLs" do
+      before(:each) do
+        # The TTL of an SRV record cannot be set via any public API
+        ttl_record1 = Resolv::DNS::Resource::IN::SRV.new(0, 20, 8140, "puppet1.domain.com")
+        ttl_record1.instance_variable_set(:@ttl, 10)
+        ttl_record2 = Resolv::DNS::Resource::IN::SRV.new(0, 20, 8140, "puppet2.domain.com")
+        ttl_record2.instance_variable_set(:@ttl, 20)
+        records = [ttl_record1, ttl_record2]
+
+        expect(@dns_mock_object).to receive(:getresources).with(
+          "_x-puppet._tcp.#{@test_srv_domain}",
+          @rr_type
+        ).and_return(records)
+      end
+
+      it "should save the shortest TTL among records for a service" do
+        resolver.each_srv_record(@test_srv_domain) { |server, port| }
+        expect(resolver.ttl(:puppet)).to eq(10)
+      end
+
+      it "should fetch records again if the TTL has expired" do
+        # Fetch from DNS
+        resolver.each_srv_record(@test_srv_domain) do |server, port|
+          expect(server).to match(/puppet.*domain\.com/)
+        end
+
+        expect(resolver).to receive(:expired?).with(:puppet).and_return(false)
+        # Load from cache
+        resolver.each_srv_record(@test_srv_domain) do |server, port|
+          expect(server).to match(/puppet.*domain\.com/)
+        end
+
+        new_record = Resolv::DNS::Resource::IN::SRV.new(0, 20, 8140, "new.domain.com")
+        new_record.instance_variable_set(:@ttl, 10)
+        expect(@dns_mock_object).to receive(:getresources).with(
+          "_x-puppet._tcp.#{@test_srv_domain}",
+          @rr_type
+        ).and_return([new_record])
+        expect(resolver).to receive(:expired?).with(:puppet).and_return(true)
+        # Refresh from DNS
+        resolver.each_srv_record(@test_srv_domain) do |server, port|
+          expect(server).to eq("new.domain.com")
+        end
+      end
+    end
+  end
+end

data/spec/unit/http/external_client_spec.rb

@@ -0,0 +1,201 @@
+require 'spec_helper'
+require 'puppet/http'
+
+# Simple "external" client to make get & post requests. This is used
+# to test the old HTTP API, such as requiring use_ssl and basic_auth
+# to be passed as options.
+class Puppet::HTTP::TestExternal
+  def initialize(host, port, options = {})
+    @host = host
+    @port = port
+    @options = options
+    @factory = Puppet::HTTP::Factory.new
+  end
+
+  def get(path, headers = {}, options = {})
+    request = Net::HTTP::Get.new(path, headers)
+    do_request(request, options)
+  end
+
+  def post(path, data, headers = nil, options = {})
+    request = Net::HTTP::Post.new(path, headers)
+    do_request(request, options)
+  end
+
+  def do_request(request, options)
+    if options[:basic_auth]
+      request.basic_auth(options[:basic_auth][:user], options[:basic_auth][:password])
+    end
+
+    site = Puppet::HTTP::Site.new(@options[:use_ssl] ? 'https' : 'http', @host, @port)
+    http = @factory.create_connection(site)
+    http.start
+    begin
+      http.request(request)
+    ensure
+      http.finish
+    end
+  end
+end
+
+describe Puppet::HTTP::ExternalClient do
+  let(:uri) { URI.parse('https://www.example.com') }
+  let(:http_client_class) { Puppet::HTTP::TestExternal }
+  let(:client) { described_class.new(http_client_class) }
+  let(:credentials) { ['user', 'pass'] }
+
+  context "for GET requests" do
+    it "stringifies keys and encodes values in the query" do
+      stub_request(:get, uri).with(query: "foo=bar%3Dbaz")
+
+      client.get(uri, params: {:foo => "bar=baz"})
+    end
+
+    it "fails if a user passes in an invalid param type" do
+      environment = Puppet::Node::Environment.create(:testing, [])
+
+      expect{client.get(uri, params: {environment: environment})}.to raise_error(Puppet::HTTP::SerializationError, /HTTP REST queries cannot handle values of type/)
+    end
+
+    it "returns the response" do
+      stub_request(:get, uri)
+
+      response = client.get(uri)
+      expect(response).to be_a(Puppet::HTTP::Response)
+      expect(response).to be_success
+      expect(response.code).to eq(200)
+    end
+
+    it "returns the entire response body" do
+      stub_request(:get, uri).to_return(body: "abc")
+
+      expect(client.get(uri).body).to eq("abc")
+    end
+
+    it "streams the response body when a block is given" do
+      stub_request(:get, uri).to_return(body: "abc")
+
+      io = StringIO.new
+      client.get(uri) do |response|
+        response.read_body do |data|
+          io.write(data)
+        end
+      end
+
+      expect(io.string).to eq("abc")
+    end
+
+    context 'when connecting' do
+      it 'accepts an ssl context' do
+        stub_request(:get, uri).to_return(body: "abc")
+
+        other_context = Puppet::SSL::SSLContext.new
+
+        client.get(uri, options: {ssl_context: other_context})
+      end
+
+      it 'accepts include_system_store' do
+        stub_request(:get, uri).to_return(body: "abc")
+
+        client.get(uri, options: {include_system_store: true})
+      end
+    end
+  end
+
+  context "for POST requests" do
+    it "stringifies keys and encodes values in the query" do
+      stub_request(:post, "https://www.example.com").with(query: "foo=bar%3Dbaz")
+
+      client.post(uri, "", params: {:foo => "bar=baz"}, headers: {'Content-Type' => 'text/plain'})
+    end
+
+    it "returns the response" do
+      stub_request(:post, uri)
+
+      response = client.post(uri, "", headers: {'Content-Type' => 'text/plain'})
+      expect(response).to be_a(Puppet::HTTP::Response)
+      expect(response).to be_success
+      expect(response.code).to eq(200)
+    end
+
+    it "sets content-type for the body" do
+      stub_request(:post, uri).with(headers: {"Content-Type" => "text/plain"})
+
+      client.post(uri, "hello", headers: {'Content-Type' => 'text/plain'})
+    end
+
+    it "streams the response body when a block is given" do
+      stub_request(:post, uri).to_return(body: "abc")
+
+      io = StringIO.new
+      client.post(uri, "", headers: {'Content-Type' => 'text/plain'}) do |response|
+        response.read_body do |data|
+          io.write(data)
+        end
+      end
+
+      expect(io.string).to eq("abc")
+    end
+
+    it 'raises an ArgumentError if `body` is missing' do
+      expect {
+        client.post(uri, nil, headers: {'Content-Type' => 'text/plain'})
+      }.to raise_error(ArgumentError, /'post' requires a string 'body' argument/)
+    end
+
+    context 'when connecting' do
+      it 'accepts an ssl context' do
+        stub_request(:post, uri)
+
+        other_context = Puppet::SSL::SSLContext.new
+
+        client.post(uri, "", headers: {'Content-Type' => 'text/plain'}, options: {ssl_context: other_context})
+      end
+
+      it 'accepts include_system_store' do
+        stub_request(:post, uri)
+
+        client.post(uri, "", headers: {'Content-Type' => 'text/plain'}, options: {include_system_store: true})
+      end
+    end
+  end
+
+  context "Basic Auth" do
+    it "submits credentials for GET requests" do
+      stub_request(:get, uri).with(basic_auth: credentials)
+
+      client.get(uri, options: {basic_auth: {user: 'user', password: 'pass'}})
+    end
+
+    it "submits credentials for POST requests" do
+      stub_request(:post, uri).with(basic_auth: credentials)
+
+      client.post(uri, "", options: {content_type: 'text/plain', basic_auth: {user: 'user', password: 'pass'}})
+    end
+
+    it "returns response containing access denied" do
+      stub_request(:get, uri).with(basic_auth: credentials).to_return(status: [403, "Ye Shall Not Pass"])
+
+      response = client.get(uri, options: { basic_auth: {user: 'user', password: 'pass'}})
+      expect(response.code).to eq(403)
+      expect(response.reason).to eq("Ye Shall Not Pass")
+      expect(response).to_not be_success
+    end
+
+    it 'includes basic auth if user is nil' do
+      stub_request(:get, uri).with do |req|
+        expect(req.headers).to include('Authorization')
+      end
+
+      client.get(uri, options: {basic_auth: {user: nil, password: 'pass'}})
+    end
+
+    it 'includes basic auth if password is nil' do
+      stub_request(:get, uri).with do |req|
+        expect(req.headers).to include('Authorization')
+      end
+
+      client.get(uri, options: {basic_auth: {user: 'user', password: nil}})
+    end
+  end
+end

data/spec/unit/http/factory_spec.rb

@@ -0,0 +1,160 @@
+require 'spec_helper'
+require 'puppet/http'
+
+describe Puppet::HTTP::Factory do
+  before(:all) do
+    ENV['http_proxy'] = nil
+    ENV['HTTP_PROXY'] = nil
+  end
+
+  let(:site) { Puppet::HTTP::Site.new('https', 'www.example.com', 443) }
+
+  def create_connection(site)
+    factory = described_class.new
+    factory.create_connection(site)
+  end
+
+  it 'creates a connection for the site' do
+    conn = create_connection(site)
+
+    expect(conn.use_ssl?).to be_truthy
+    expect(conn.address).to eq(site.host)
+    expect(conn.port).to eq(site.port)
+  end
+
+  it 'creates a connection that has not yet been started' do
+    conn = create_connection(site)
+
+    expect(conn).to_not be_started
+  end
+
+  it 'creates a connection supporting at least HTTP 1.1' do
+    conn = create_connection(site)
+
+    expect(conn.class.version_1_1? || conn.class.version_1_2?).to be_truthy
+  end
+
+  context "proxy settings" do
+    let(:proxy_host) { 'myhost' }
+    let(:proxy_port) { 432 }
+    let(:proxy_user) { 'mo' }
+    let(:proxy_pass) { 'password' }
+
+    it "should not set a proxy if the http_proxy_host setting is 'none'" do
+      Puppet[:http_proxy_host] = 'none'
+      conn = create_connection(site)
+
+      expect(conn.proxy_address).to be_nil
+    end
+
+    it 'should not set a proxy if a no_proxy env var matches the destination' do
+      Puppet[:http_proxy_host] = proxy_host
+      Puppet[:http_proxy_port] = proxy_port
+      Puppet::Util.withenv('NO_PROXY' => site.host) do
+        conn = create_connection(site)
+
+        expect(conn.proxy_address).to be_nil
+        expect(conn.proxy_port).to be_nil
+      end
+    end
+
+    it 'should not set a proxy if the no_proxy setting matches the destination' do
+      Puppet[:http_proxy_host] = proxy_host
+      Puppet[:http_proxy_port] = proxy_port
+      Puppet[:no_proxy] = site.host
+      conn = create_connection(site)
+
+      expect(conn.proxy_address).to be_nil
+      expect(conn.proxy_port).to be_nil
+    end
+
+    it 'sets proxy_address' do
+      Puppet[:http_proxy_host] = proxy_host
+      conn = create_connection(site)
+
+      expect(conn.proxy_address).to eq(proxy_host)
+    end
+
+    it 'sets proxy address and port' do
+      Puppet[:http_proxy_host] = proxy_host
+      Puppet[:http_proxy_port] = proxy_port
+      conn = create_connection(site)
+
+      expect(conn.proxy_port).to eq(proxy_port)
+    end
+
+    it 'sets proxy user and password' do
+      Puppet[:http_proxy_host] = proxy_host
+      Puppet[:http_proxy_port] = proxy_port
+      Puppet[:http_proxy_user] = proxy_user
+      Puppet[:http_proxy_password] = proxy_pass
+
+      conn = create_connection(site)
+
+      expect(conn.proxy_user).to eq(proxy_user)
+      expect(conn.proxy_pass).to eq(proxy_pass)
+    end
+  end
+
+  context 'socket timeouts' do
+    it 'sets open timeout' do
+      Puppet[:http_connect_timeout] = "10s"
+      conn = create_connection(site)
+
+      expect(conn.open_timeout).to eq(10)
+    end
+
+    it 'sets read timeout' do
+      Puppet[:http_read_timeout] = "2m"
+      conn = create_connection(site)
+
+      expect(conn.read_timeout).to eq(120)
+    end
+  end
+
+  it "disables ruby's http_keepalive_timeout" do
+    conn = create_connection(site)
+
+    expect(conn.keep_alive_timeout).to eq(2147483647)
+  end
+
+  it "disables ruby's max retry" do
+    conn = create_connection(site)
+
+    expect(conn.max_retries).to eq(0)
+  end
+
+  context 'source address' do
+    it 'defaults to system-defined' do
+      conn = create_connection(site)
+
+      expect(conn.local_host).to be(nil)
+    end
+
+    it 'sets the local_host address' do
+      Puppet[:sourceaddress] = "127.0.0.1"
+      conn = create_connection(site)
+
+      expect(conn.local_host).to eq('127.0.0.1')
+    end
+  end
+
+  context 'tls' do
+    it "sets the minimum version to TLS 1.0" do
+      conn = create_connection(site)
+      expect(conn.min_version).to eq(OpenSSL::SSL::TLS1_VERSION)
+    end
+
+    it "defaults to ciphersuites providing 128 bits of security or greater" do
+      conn = create_connection(site)
+      expect(conn.ciphers).to eq("ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA256:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256")
+    end
+
+    it "can be restricted to TLSv1.3 ciphers" do
+      tls13_ciphers = "TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256"
+      Puppet[:ciphers] = tls13_ciphers
+      conn = create_connection(site)
+      expect(conn.ciphers).to eq(tls13_ciphers)
+    end
+  end
+end

data/spec/unit/http/pool_entry_spec.rb

@@ -0,0 +1,49 @@
+require 'spec_helper'
+
+require 'puppet/http'
+
+describe Puppet::HTTP::PoolEntry do
+  let(:connection) { double('connection') }
+  let(:verifier) { double('verifier') }
+
+  def create_session(connection, expiration_time = nil)
+    expiration_time ||= Time.now + 60 * 60
+
+    described_class.new(connection, verifier, expiration_time)
+  end
+
+  it 'provides access to its connection' do
+    session = create_session(connection)
+
+    expect(session.connection).to eq(connection)
+  end
+
+  it 'provides access to its verifier' do
+    session = create_session(connection)
+
+    expect(session.verifier).to eq(verifier)
+  end
+
+  it 'expires a connection whose expiration time is in the past' do
+    now = Time.now
+    past = now - 1
+
+    session = create_session(connection, past)
+    expect(session.expired?(now)).to be_truthy
+  end
+
+  it 'expires a connection whose expiration time is now' do
+    now = Time.now
+
+    session = create_session(connection, now)
+    expect(session.expired?(now)).to be_truthy
+  end
+
+  it 'does not expire a connection whose expiration time is in the future' do
+    now = Time.now
+    future = now + 1
+
+    session = create_session(connection, future)
+    expect(session.expired?(now)).to be_falsey
+  end
+end