puppet/spec/unit/ssl, branch master

(PUP-894) Accept CRLs that were "recently" updated

2014-09-10T01:09:59Z

Previously, the agent would reject an SSL connection if the CRL it downloaded from the CA had a `last_update` time that was slightly in the future. The agent reports this as "CRL is not yet valid." This issue can happen when the CA's time is slightly ahead of the agent's time, the CRL is recently updated, and the agent doesn't already have a cached version of the CRL (due to PUP-2103). The CRL not yet valid error sometimes happens during acceptance testing when we delete the agent's ssl directory, revoke a cert on the master (which updates the CRL's last_update field), and run the agent (which downloads the latest CRL). This commit modifies the verify callback to ignore CRL not yet valid errors provided all of the following are true: * current_crl is not nil * current_crl.last_update is not nil * current_crl.last_update is strictly less than 5 minutes from now It also adds specs around unspecified behavior, e.g. ensure the verify callback returns false when errors are detected.

(PUP-894) Add specs for current bebavior

2014-09-10T00:48:51Z

This commit adds specs for current behavior, especially that the verify callback rejects the connection if preverify_ok is false, and we reject CRLs whose last_update time is more than 5 minutes in the future.

(PUP-744) Cleanup puppet/ssl require logic

2014-08-06T00:05:56Z

Previously, validator_spec.rb was requiring 'puppet/ssl/configuration', because puppet/ssl.rb did not require it. Commit 658e4fd34 fixed puppet/ssl.rb, so it is no longer necessary or desired for validator_spec.rb to require puppet/ssl/configuration. Also, the default and no_validators were not consistent in expressing their dependencies on openssl and puppet/ssl.

(maint) Remove unnecessary Puppet.settings.clear calls from specs

2014-07-24T23:45:47Z

I believe most of these predated our clearing the settings before each test in the central puppet/test/test_helper.rb. And since we then set some base settings (such as :environment_timeout) in the test_helper, the effect of a secondary clear in the test itself is to wipe out the baseline setup test_helper just laid down. In particular this is a problem with environment_timeout, as it leads to tests which end up creating environments, getting them cached with the default 180s timeout, which can leak to subsequent tests and create unpleasant spec order issues.

(PUP-2569) Revoke all certificate matching a given name

2014-06-04T18:31:24Z

puppet cert revoke was revoking only the first certificate when the certificate file wasn't present on the system. This patch makes sure all issued certificate matching a given name are now revoked. Signed-off-by: Brice Figureau

(PUP-2584) Make 404 warning on agent specific and an error.

2014-05-19T17:57:13Z

This changes the general 404 warning issued by the indirection rest baseclass into being an error if the option :fail_on_404 is passed as a "query option". This is then used when asking for a ca certificate, when asking for the node, when asking for the initial catalog, and when retrieving a catalog from the master. The :fail_on_404 will raise an exception, and it is up to the caller to determine what this means - when retrieving a catalog, there may be retries etc. By contrast, the request for a ca certificate will fail immediately on an agent run. To try this, contact the master with an unknown environment when using directory environments for the master configuration. This more specific behavior is wanted because: * the rest indirection is used for many different things, one of them being probing through a list of files to use until one is found. * the use cases where it really matters that master does not respond with 404 should error out.

(maint) Provide a namespace around two specs using Memory indirectors

2014-04-28T23:35:11Z

Two specs were using the same constant names to track classes that they were generating Memory indirector classes for. Because specs share the same module namespace, they were overwriting one another on load and causing spec order failures. Guarding the specs within a namespace module should keep them isolated and prevent them for unexpectedly tinkering with one another's test setup.

Merge branch 'pr/2349'

2014-02-27T20:25:09Z

* pr/2349: (PUP-1665) Fix traversal of signed certs when listing signing requests. This closes GH-2349.

(PUP-1665) Fix traversal of signed certs when listing signing requests.

2014-02-27T20:23:08Z

With 'puppet cert list', the output is expected to be the list of hosts with outstanding signing requests. However, the implementation still gets the list of signed certificates and traverses this list in an O(N) fashion for each host being returned. Since we know the list of hosts is limited to only signing requests in this case, this traversal is entirely unnecessary and it impacts performance when there are a large number of signed certificates. The fix is to only traverse the list of signed hosts when --all, --signed, or a list of hosts was given on the command line.

(PUP-1407) Fix specs on 187

2014-02-07T22:47:39Z

In ruby 1.8.7, OpenSSL::X509::Name does not include Comparable, so `==` is not based on the `<=>` operator. As a result, comparing two Name objects that have the same string representation will return false. In ruby 1.9, the class includes the Comparable module. Changed the test to just compare the String representations. The other test was failing for me on ruby 187, and it seemed completely unnecessary to compute 2**158 every time the test runs.