← Back to branch summary

~bkerensa/ubuntu/raring/puppet/new-upstream-release

« back to all changes in this revision

Viewing changes to spec/unit/indirector/certificate_status/file_spec.rb

  • Committer: Bazaar Package Importer
  • Author(s): Chuck Short
  • Date: 2011-07-25 01:00:37 UTC
  • mfrom: (1.1.24 upstream) (3.1.25 sid)
  • Revision ID: james.westby@ubuntu.com-20110725010037-875vuxs10eboqgw3
Tags: 2.7.1-1ubuntu1
https://launchpad.net/bugs/641001
* Merge from debian unstable.  Remaining changes:
  - debian/puppetmaster-passenger.postinst: Use cacrl instead of hostcrl to
    set the location of the CRL in apache2 configuration. Fix apache2
    configuration on upgrade as well (LP: #641001)
  - move all puppet dependencies to puppet-common since all the code
    actually located in puppet-common.
  - move libagueas from a recommend to a dependency.

Show diffs side-by-side

added added

removed removed

Lines of Context:
spec/unit/indirector/certificate_status/file_spec.rb
 
1
#!/usr/bin/env rspec
 
2
require 'spec_helper'
 
3
require 'puppet/ssl/host'
 
4
require 'puppet/indirector/certificate_status'
 
5
require 'tempfile'
 
6
 
 
7
describe "Puppet::Indirector::CertificateStatus::File" do
 
8
  include PuppetSpec::Files
 
9
 
 
10
  before do
 
11
    Puppet::SSL::CertificateAuthority.stubs(:ca?).returns true
 
12
    @terminus = Puppet::SSL::Host.indirection.terminus(:file)
 
13
 
 
14
    @tmpdir = tmpdir("certificate_status_ca_testing")
 
15
    Puppet[:confdir] = @tmpdir
 
16
    Puppet[:vardir] = @tmpdir
 
17
 
 
18
    # localcacert is where each client stores the CA certificate
 
19
    # cacert is where the master stores the CA certificate
 
20
    # Since we need to play the role of both for testing we need them to be the same and exist
 
21
    Puppet[:cacert] = Puppet[:localcacert]
 
22
  end
 
23
 
 
24
  def generate_csr(host)
 
25
    host.generate_key
 
26
    csr = Puppet::SSL::CertificateRequest.new(host.name)
 
27
    csr.generate(host.key.content)
 
28
    Puppet::SSL::CertificateRequest.indirection.save(csr)
 
29
  end
 
30
 
 
31
  def sign_csr(host)
 
32
    host.desired_state = "signed"
 
33
    @terminus.save(Puppet::Indirector::Request.new(:certificate_status, :save, host.name, host))
 
34
  end
 
35
 
 
36
  def generate_signed_cert(host)
 
37
    generate_csr(host)
 
38
    sign_csr(host)
 
39
 
 
40
    @terminus.find(Puppet::Indirector::Request.new(:certificate_status, :find, host.name, host))
 
41
  end
 
42
 
 
43
  def generate_revoked_cert(host)
 
44
    generate_signed_cert(host)
 
45
 
 
46
    host.desired_state = "revoked"
 
47
 
 
48
    @terminus.save(Puppet::Indirector::Request.new(:certificate_status, :save, host.name, host))
 
49
  end
 
50
 
 
51
  it "should be a terminus on SSL::Host" do
 
52
    @terminus.should be_instance_of(Puppet::Indirector::CertificateStatus::File)
 
53
  end
 
54
 
 
55
  it "should create a CA instance if none is present" do
 
56
    @terminus.ca.should be_instance_of(Puppet::SSL::CertificateAuthority)
 
57
  end
 
58
 
 
59
  describe "when creating the CA" do
 
60
    it "should fail if it is not a valid CA" do
 
61
      Puppet::SSL::CertificateAuthority.expects(:ca?).returns false
 
62
      lambda { @terminus.ca }.should raise_error(ArgumentError, "This process is not configured as a certificate authority")
 
63
    end
 
64
  end
 
65
 
 
66
  it "should be indirected with the name 'certificate_status'" do
 
67
    Puppet::SSL::Host.indirection.name.should == :certificate_status
 
68
  end
 
69
 
 
70
  describe "when finding" do
 
71
    before do
 
72
      @host = Puppet::SSL::Host.new("foo")
 
73
      Puppet.settings.use(:main)
 
74
    end
 
75
 
 
76
    it "should return the Puppet::SSL::Host when a CSR exists for the host" do
 
77
      generate_csr(@host)
 
78
      request = Puppet::Indirector::Request.new(:certificate_status, :find, "foo", @host)
 
79
 
 
80
      retrieved_host = @terminus.find(request)
 
81
 
 
82
      retrieved_host.name.should == @host.name
 
83
      retrieved_host.certificate_request.content.to_s.chomp.should == @host.certificate_request.content.to_s.chomp
 
84
    end
 
85
 
 
86
    it "should return the Puppet::SSL::Host when a public key exist for the host" do
 
87
      generate_signed_cert(@host)
 
88
      request = Puppet::Indirector::Request.new(:certificate_status, :find, "foo", @host)
 
89
 
 
90
      retrieved_host = @terminus.find(request)
 
91
 
 
92
      retrieved_host.name.should == @host.name
 
93
      retrieved_host.certificate.content.to_s.chomp.should == @host.certificate.content.to_s.chomp
 
94
    end
 
95
 
 
96
    it "should return nil when neither a CSR nor public key exist for the host" do
 
97
      request = Puppet::Indirector::Request.new(:certificate_status, :find, "foo", @host)
 
98
      @terminus.find(request).should == nil
 
99
    end
 
100
  end
 
101
 
 
102
  describe "when saving" do
 
103
    before do
 
104
      @host = Puppet::SSL::Host.new("foobar")
 
105
      Puppet.settings.use(:main)
 
106
    end
 
107
 
 
108
    describe "when signing a cert" do
 
109
      before do
 
110
        @host.desired_state = "signed"
 
111
        @request = Puppet::Indirector::Request.new(:certificate_status, :save, "foobar", @host)
 
112
      end
 
113
 
 
114
      it "should fail if no CSR is on disk" do
 
115
        lambda { @terminus.save(@request) }.should raise_error(Puppet::Error, /certificate request/)
 
116
      end
 
117
 
 
118
      it "should sign the on-disk CSR when it is present" do
 
119
        signed_host = generate_signed_cert(@host)
 
120
 
 
121
        signed_host.state.should == "signed"
 
122
        Puppet::SSL::Certificate.indirection.find("foobar").should be_instance_of(Puppet::SSL::Certificate)
 
123
      end
 
124
    end
 
125
 
 
126
    describe "when revoking a cert" do
 
127
      before do
 
128
        @request = Puppet::Indirector::Request.new(:certificate_status, :save, "foobar", @host)
 
129
      end
 
130
 
 
131
      it "should fail if no certificate is on disk" do
 
132
        @host.desired_state = "revoked"
 
133
        lambda { @terminus.save(@request) }.should raise_error(Puppet::Error, /Cannot revoke/)
 
134
      end
 
135
 
 
136
      it "should revoke the certificate when it is present" do
 
137
        generate_revoked_cert(@host)
 
138
 
 
139
        @host.state.should == 'revoked'
 
140
      end
 
141
    end
 
142
  end
 
143
 
 
144
  describe "when deleting" do
 
145
    before do
 
146
      Puppet.settings.use(:main)
 
147
    end
 
148
 
 
149
    it "should not delete anything if no certificate, request, or key is on disk" do
 
150
      host = Puppet::SSL::Host.new("clean_me")
 
151
      request = Puppet::Indirector::Request.new(:certificate_status, :delete, "clean_me", host)
 
152
      @terminus.destroy(request).should == "Nothing was deleted"
 
153
    end
 
154
 
 
155
    it "should clean certs, cert requests, keys" do
 
156
      signed_host = Puppet::SSL::Host.new("clean_signed_cert")
 
157
      generate_signed_cert(signed_host)
 
158
      signed_request = Puppet::Indirector::Request.new(:certificate_status, :delete, "clean_signed_cert", signed_host)
 
159
      @terminus.destroy(signed_request).should == "Deleted for clean_signed_cert: Puppet::SSL::Certificate, Puppet::SSL::Key"
 
160
 
 
161
      requested_host = Puppet::SSL::Host.new("clean_csr")
 
162
      generate_csr(requested_host)
 
163
      csr_request = Puppet::Indirector::Request.new(:certificate_status, :delete, "clean_csr", requested_host)
 
164
      @terminus.destroy(csr_request).should == "Deleted for clean_csr: Puppet::SSL::CertificateRequest, Puppet::SSL::Key"
 
165
    end
 
166
  end
 
167
 
 
168
  describe "when searching" do
 
169
    it "should return a list of all hosts with certificate requests, signed certs, or revoked certs" do
 
170
      Puppet.settings.use(:main)
 
171
 
 
172
      signed_host = Puppet::SSL::Host.new("signed_host")
 
173
      generate_signed_cert(signed_host)
 
174
 
 
175
      requested_host = Puppet::SSL::Host.new("requested_host")
 
176
      generate_csr(requested_host)
 
177
 
 
178
      revoked_host = Puppet::SSL::Host.new("revoked_host")
 
179
      generate_revoked_cert(revoked_host)
 
180
 
 
181
      retrieved_hosts = @terminus.search(Puppet::Indirector::Request.new(:certificate_status, :search, "all", signed_host))
 
182
 
 
183
      results = retrieved_hosts.map {|h| [h.name, h.state]}.sort{ |h,i| h[0] <=> i[0] }
 
184
      results.should == [["ca","signed"],["requested_host","requested"],["revoked_host","revoked"],["signed_host","signed"]]
 
185
    end
 
186
  end
 
187
end