← Back to branch summary

~ubuntu-branches/ubuntu/quantal/puppet/quantal-security

« back to all changes in this revision

Viewing changes to .pc/CVE-2011-3872.patch/spec/unit/indirector/certificate_request/ca_spec.rb

  • Committer: Bazaar Package Importer
  • Author(s): Marc Deslauriers
  • Date: 2011-10-24 15:05:12 UTC
  • Revision ID: james.westby@ubuntu.com-20111024150512-yxqwfdp6hcs6of5l
Tags: 2.7.1-1ubuntu3.2
* SECURITY UPDATE: puppet master impersonation via incorrect certificates
  - debian/patches/CVE-2011-3872.patch: refactor certificate handling.
  - Thanks to upstream for providing the patch.
  - CVE-2011-3872

Show diffs side-by-side

added added

removed removed

Lines of Context:
.pc/CVE-2011-3872.patch/spec/unit/indirector/certificate_request/ca_spec.rb
 
1
#!/usr/bin/env rspec
 
2
#
 
3
#  Created by Luke Kanies on 2008-3-7.
 
4
#  Copyright (c) 2007. All rights reserved.
 
5
 
 
6
require 'spec_helper'
 
7
 
 
8
require 'puppet/ssl/host'
 
9
require 'puppet/sslcertificates'
 
10
require 'puppet/sslcertificates/ca'
 
11
require 'puppet/indirector/certificate_request/ca'
 
12
 
 
13
describe Puppet::SSL::CertificateRequest::Ca do
 
14
  include PuppetSpec::Files
 
15
 
 
16
  before :each do
 
17
    Puppet[:ssldir] = tmpdir('ssl')
 
18
 
 
19
    Puppet::SSL::Host.ca_location = :local
 
20
    Puppet[:localcacert] = Puppet[:cacert]
 
21
    Puppet::SSLCertificates::CA.new.mkrootcert
 
22
 
 
23
    @ca = Puppet::SSL::CertificateAuthority.new
 
24
  end
 
25
 
 
26
  after :all do
 
27
    Puppet::SSL::Host.ca_location = :none
 
28
  end
 
29
 
 
30
  it "should have documentation" do
 
31
    Puppet::SSL::CertificateRequest::Ca.doc.should be_instance_of(String)
 
32
  end
 
33
 
 
34
  it "should use the :csrdir as the collection directory" do
 
35
    Puppet.settings.expects(:value).with(:csrdir).returns "/request/dir"
 
36
    Puppet::SSL::CertificateRequest::Ca.collection_directory.should == "/request/dir"
 
37
  end
 
38
 
 
39
  it "should overwrite the previous certificate request if allow_duplicate_certs is true" do
 
40
    Puppet[:allow_duplicate_certs] = true
 
41
    host = Puppet::SSL::Host.new("foo")
 
42
    host.generate_certificate_request
 
43
    @ca.sign(host.name)
 
44
 
 
45
    Puppet::SSL::Host.indirection.find("foo").generate_certificate_request
 
46
 
 
47
    Puppet::SSL::Certificate.indirection.find("foo").name.should == "foo"
 
48
    Puppet::SSL::CertificateRequest.indirection.find("foo").name.should == "foo"
 
49
    Puppet::SSL::Host.indirection.find("foo").state.should == "requested"
 
50
  end
 
51
 
 
52
  it "should reject a new certificate request if allow_duplicate_certs is false" do
 
53
    Puppet[:allow_duplicate_certs] = false
 
54
    host = Puppet::SSL::Host.new("bar")
 
55
    host.generate_certificate_request
 
56
    @ca.sign(host.name)
 
57
 
 
58
    expect { Puppet::SSL::Host.indirection.find("bar").generate_certificate_request }.should raise_error(/ignoring certificate request/)
 
59
 
 
60
    Puppet::SSL::Certificate.indirection.find("bar").name.should == "bar"
 
61
    Puppet::SSL::CertificateRequest.indirection.find("bar").should be_nil
 
62
    Puppet::SSL::Host.indirection.find("bar").state.should == "signed"
 
63
  end
 
64
end