1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
|
require 'spec_helper'
require 'puppet/network/authconfig'
require 'puppet/network/auth_config_parser'
RSpec::Matchers.define :auth_allow do |params|
match do |auth|
begin
auth.check_authorization(*params)
true
rescue Puppet::Network::AuthorizationError
false
end
end
failure_message do |instance|
"expected #{params[2][:node]}/#{params[2][:ip]} to be allowed"
end
failure_message_when_negated do |instance|
"expected #{params[2][:node]}/#{params[2][:ip]} to be forbidden"
end
end
describe Puppet::Network::AuthConfig do
include PuppetSpec::Files
def add_rule(rule)
parser = Puppet::Network::AuthConfigParser.new(
"path /test\n#{rule}\n"
)
@auth = parser.parse
end
def add_regex_rule(regex, rule)
parser = Puppet::Network::AuthConfigParser.new(
"path ~ #{regex}\n#{rule}\n"
)
@auth = parser.parse
end
def add_raw_stanza(stanza)
parser = Puppet::Network::AuthConfigParser.new(
stanza
)
@auth = parser.parse
end
def request(args = {})
args = {
:key => 'key',
:node => 'host.domain.com',
:ip => '10.1.1.1',
:authenticated => true
}.merge(args)
[:find, "/test/#{args[:key]}", args]
end
describe "allow" do
it "should not match IP addresses" do
add_rule("allow 10.1.1.1")
expect(@auth).not_to auth_allow(request)
end
it "should not accept CIDR IPv4 address" do
expect {
add_rule("allow 10.0.0.0/8")
}.to raise_error Puppet::ConfigurationError, /Invalid pattern 10\.0\.0\.0\/8/
end
it "should not match wildcard IPv4 address" do
expect {
add_rule("allow 10.1.1.*")
}.to raise_error Puppet::ConfigurationError, /Invalid pattern 10\.1\.1\.*/
end
it "should not match IPv6 address" do
expect {
add_rule("allow 2001:DB8::8:800:200C:417A")
}.to raise_error Puppet::ConfigurationError, /Invalid pattern 2001/
end
it "should support hostname" do
add_rule("allow host.domain.com")
expect(@auth).to auth_allow(request)
end
it "should support wildcard host" do
add_rule("allow *.domain.com")
expect(@auth).to auth_allow(request)
end
it 'should warn about missing path before allow_ip in stanza' do
expect {
add_raw_stanza("allow_ip 10.0.0.1\n")
}.to raise_error Puppet::ConfigurationError, /Missing or invalid 'path' before right directive at \(line: .*\)/
end
it 'should warn about missing path before allow in stanza' do
expect {
add_raw_stanza("allow host.domain.com\n")
}.to raise_error Puppet::ConfigurationError, /Missing or invalid 'path' before right directive at \(line: .*\)/
end
it "should support hostname backreferences" do
add_regex_rule('^/test/([^/]+)$', "allow $1.domain.com")
expect(@auth).to auth_allow(request(:key => 'host'))
end
it "should support opaque strings" do
add_rule("allow this-is-opaque@or-not")
expect(@auth).to auth_allow(request(:node => 'this-is-opaque@or-not'))
end
it "should support opaque strings and backreferences" do
add_regex_rule('^/test/([^/]+)$', "allow $1")
expect(@auth).to auth_allow(request(:key => 'this-is-opaque@or-not', :node => 'this-is-opaque@or-not'))
end
it "should support hostname ending with '.'" do
pending('bug #7589')
add_rule("allow host.domain.com.")
expect(@auth).to auth_allow(request(:node => 'host.domain.com.'))
end
it "should support hostname ending with '.' and backreferences" do
pending('bug #7589')
add_regex_rule('^/test/([^/]+)$',"allow $1")
expect(@auth).to auth_allow(request(:node => 'host.domain.com.'))
end
it "should support trailing whitespace" do
add_rule('allow host.domain.com ')
expect(@auth).to auth_allow(request)
end
it "should support inlined comments" do
add_rule('allow host.domain.com # will it work?')
expect(@auth).to auth_allow(request)
end
it "should deny non-matching host" do
add_rule("allow inexistent")
expect(@auth).not_to auth_allow(request)
end
end
describe "allow_ip" do
it "should not warn when matches against IP addresses fail" do
add_rule("allow_ip 10.1.1.2")
expect(@auth).not_to auth_allow(request)
expect(@logs).not_to be_any {|log| log.level == :warning and log.message =~ /Authentication based on IP address is deprecated/}
end
it "should support IPv4 address" do
add_rule("allow_ip 10.1.1.1")
expect(@auth).to auth_allow(request)
end
it "should support CIDR IPv4 address" do
add_rule("allow_ip 10.0.0.0/8")
expect(@auth).to auth_allow(request)
end
it "should support wildcard IPv4 address" do
add_rule("allow_ip 10.1.1.*")
expect(@auth).to auth_allow(request)
end
it "should support IPv6 address" do
add_rule("allow_ip 2001:DB8::8:800:200C:417A")
expect(@auth).to auth_allow(request(:ip => '2001:DB8::8:800:200C:417A'))
end
it "should support hostname" do
expect {
add_rule("allow_ip host.domain.com")
}.to raise_error Puppet::ConfigurationError, /Invalid IP pattern host.domain.com/
end
end
describe "deny" do
it "should deny denied hosts" do
add_rule <<-EOALLOWRULE
deny host.domain.com
allow *.domain.com
EOALLOWRULE
expect(@auth).not_to auth_allow(request)
end
it "denies denied hosts after allowing them" do
add_rule <<-EOALLOWRULE
allow *.domain.com
deny host.domain.com
EOALLOWRULE
expect(@auth).not_to auth_allow(request)
end
it "should not deny based on IP" do
add_rule <<-EOALLOWRULE
deny 10.1.1.1
allow host.domain.com
EOALLOWRULE
expect(@auth).to auth_allow(request)
end
it "should not deny based on IP (ordering #2)" do
add_rule <<-EOALLOWRULE
allow host.domain.com
deny 10.1.1.1
EOALLOWRULE
expect(@auth).to auth_allow(request)
end
end
describe "deny_ip" do
it "should deny based on IP" do
add_rule <<-EOALLOWRULE
deny_ip 10.1.1.1
allow host.domain.com
EOALLOWRULE
expect(@auth).not_to auth_allow(request)
end
it "should deny based on IP (ordering #2)" do
add_rule <<-EOALLOWRULE
allow host.domain.com
deny_ip 10.1.1.1
EOALLOWRULE
expect(@auth).not_to auth_allow(request)
end
end
end
|
