path: root/test/network/handler/ca.rb

#!/usr/bin/env ruby

require File.dirname(__FILE__) + '/../../lib/puppettest'

require 'puppettest'
require 'puppet/network/handler/ca'
require 'mocha'

$short = (ARGV.length > 0 and ARGV[0] == "short")

class TestCA < Test::Unit::TestCase
    include PuppetTest::ServerTest

    def setup
        Puppet::Util::SUIDManager.stubs(:asuser).yields
        super
    end

    # Verify that we're autosigning.  We have to autosign a "different" machine,
    # since we always autosign the CA server's certificate.
    def test_autocertgeneration
        ca = nil

        # create our ca
        assert_nothing_raised {
            ca = Puppet::Network::Handler.ca.new(:autosign => true)
        }

        # create a cert with a fake name
        key = nil
        csr = nil
        cert = nil
        hostname = "test.domain.com"
        assert_nothing_raised {
            cert = Puppet::SSLCertificates::Certificate.new(
                :name => "test.domain.com"
            )
        }

        # make the request
        assert_nothing_raised {
            cert.mkcsr
        }

        # and get it signed
        certtext = nil
        cacerttext = nil
        assert_nothing_raised {
            certtext, cacerttext = ca.getcert(cert.csr.to_s)
        }

        # they should both be strings
        assert_instance_of(String, certtext)
        assert_instance_of(String, cacerttext)

        # and they should both be valid certs
        assert_nothing_raised {
            OpenSSL::X509::Certificate.new(certtext)
        }
        assert_nothing_raised {
            OpenSSL::X509::Certificate.new(cacerttext)
        }

        # and pull it again, just to make sure we're getting the same thing
        newtext = nil
        assert_nothing_raised {
            newtext, cacerttext = ca.getcert(
                cert.csr.to_s, "test.reductivelabs.com", "127.0.0.1"
            )
        }

        assert_equal(certtext,newtext)
    end

    # this time don't use autosign
    def test_storeAndSign
        ca = nil
        caserv = nil

        # make our CA server
        assert_nothing_raised {
            caserv = Puppet::Network::Handler.ca.new(:autosign => false)
        }

        # retrieve the actual ca object
        assert_nothing_raised {
            ca = caserv.ca
        }

        # make our test cert again
        key = nil
        csr = nil
        cert = nil
        hostname = "test.domain.com"
        assert_nothing_raised {
            cert = Puppet::SSLCertificates::Certificate.new(
                :name => "anothertest.domain.com"
            )
        }
        # and the CSR
        assert_nothing_raised {
            cert.mkcsr
        }

        # retrieve them
        certtext = nil
        assert_nothing_raised {
            certtext, cacerttext = caserv.getcert(
                cert.csr.to_s, "test.reductivelabs.com", "127.0.0.1"
            )
        }

        # verify we got nothing back, since autosign is off
        assert_equal("", certtext)

        # now sign it manually, with the CA object
        x509 = nil
        assert_nothing_raised {
            x509, cacert = ca.sign(cert.csr)
        }

        # and write it out
        cert.cert = x509
        assert_nothing_raised {
            cert.write
        }

        assert(File.exists?(cert.certfile))

        # now get them again, and verify that we actually get them
        newtext = nil
        assert_nothing_raised {
            newtext, cacerttext  = caserv.getcert(cert.csr.to_s)
        }

        assert(newtext)
        assert_nothing_raised {
            OpenSSL::X509::Certificate.new(newtext)
        }

        # Now verify that we can clean a given host's certs
        assert_nothing_raised {
            ca.clean("anothertest.domain.com")
        }

        assert(!File.exists?(cert.certfile), "Cert still exists after clean")
    end

    # and now test the autosign file
    def test_autosign
        autosign = File.join(tmpdir, "autosigntesting")
        @@tmpfiles << autosign
        File.open(autosign, "w") { |f|
            f.puts "hostmatch.domain.com"
            f.puts "*.other.com"
        }

        caserv = nil
        assert_nothing_raised {
            caserv = Puppet::Network::Handler.ca.new(:autosign => autosign)
        }

        # make sure we know what's going on
        assert(caserv.autosign?("hostmatch.domain.com"))
        assert(caserv.autosign?("fakehost.other.com"))
        assert(!caserv.autosign?("kirby.reductivelabs.com"))
        assert(!caserv.autosign?("culain.domain.com"))
    end

    # verify that things aren't autosigned by default
    def test_nodefaultautosign
        caserv = nil
        assert_nothing_raised {
            caserv = Puppet::Network::Handler.ca.new()
        }

        # make sure we know what's going on
        assert(!caserv.autosign?("hostmatch.domain.com"))
        assert(!caserv.autosign?("fakehost.other.com"))
        assert(!caserv.autosign?("kirby.reductivelabs.com"))
        assert(!caserv.autosign?("culain.domain.com"))
    end

    # We want the CA to autosign its own certificate, because otherwise
    # the puppetmasterd CA does not autostart.
    def test_caautosign
        server = nil
        Puppet.stubs(:master?).returns true
        assert_nothing_raised {

                        server = Puppet::Network::HTTPServer::WEBrick.new(
                
                :Port => @@port,
        
                :Handlers => {
                    :CA => {}, # so that certs autogenerate
                    :Status => nil
                }
            )
        }
    end

    # Make sure true/false causes the file to be ignored.
    def test_autosign_true_beats_file
        caserv = nil
        assert_nothing_raised {
            caserv = Puppet::Network::Handler.ca.new()
        }

        host = "hostname.domain.com"

        # Create an autosign file
        file = tempfile()
        Puppet[:autosign] = file

        File.open(file, "w") { |f|
            f.puts host
        }

        # Start with "false"
        Puppet[:autosign] = false

        assert(! caserv.autosign?(host), "Host was incorrectly autosigned")

        # Then set it to true
        Puppet[:autosign] = true
        assert(caserv.autosign?(host), "Host was not autosigned")
        # And try a different host
        assert(caserv.autosign?("other.yay.com"), "Host was not autosigned")

        # And lastly the file
        Puppet[:autosign] = file
        assert(caserv.autosign?(host), "Host was not autosigned")

        # And try a different host
        assert(! caserv.autosign?("other.yay.com"), "Host was autosigned")
    end

    # Make sure that a CSR created with keys that don't match the existing
    # cert throws an exception on the server.
    def test_mismatched_public_keys_throws_exception
        ca = Puppet::Network::Handler.ca.new()

        # First initialize the server
        client = Puppet::Network::Client.ca.new :CA => ca
        client.request_cert
        File.unlink(Puppet[:hostcsr])

        # Now use a different cert name
        Puppet[:certname] = "my.host.com"
        client = Puppet::Network::Client.ca.new :CA => ca
        firstcsr = client.csr
        File.unlink(Puppet[:hostcsr]) if FileTest.exists?(Puppet[:hostcsr])

        assert_nothing_raised("Could not get cert") do
            ca.getcert(firstcsr.to_s)
        end

        # Now get rid of the public key, forcing a new csr
        File.unlink(Puppet[:hostprivkey])

        client = Puppet::Network::Client.ca.new :CA => ca

        second_csr = client.csr

        assert(firstcsr.to_s != second_csr.to_s, "CSR did not change")

        assert_raise(Puppet::Error, "CA allowed mismatched keys") do
            ca.getcert(second_csr.to_s)
        end
    end
end