chef 10.34.6-x86-mingw32 → 11.6.2-x86-mingw32

data/lib/chef/dsl/registry_helper.rb

@@ -0,0 +1,59 @@
+#
+# Author:: Lamont Granquist (<lamont@opscode.com>)
+# Copyright:: Copyright (c) 2012 Opscode, Inc.
+# License:: Apache License, Version 2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+#
+# Helper functions to access the windows registry from within recipes and
+# the not_if/only_if blocks in resources.  This only exposes the methods
+# in the chef/win32/registry class which are reasonably side-effect-free.
+# The actual modification of the registry should be done via the registry_key
+# resource in a more idempotent way.
+#
+#
+class Chef
+  module DSL
+    module RegistryHelper
+      # the registry instance is cheap to build and throwing it away ensures we
+      # don't carry any state (e.g. magic 32-bit/64-bit settings) between calls
+      def registry_key_exists?(key_path, architecture = :machine)
+        registry = Chef::Win32::Registry.new(run_context, architecture)
+        registry.key_exists?(key_path)
+      end
+      def registry_get_values(key_path, architecture = :machine)
+        registry = Chef::Win32::Registry.new(run_context, architecture)
+        registry.get_values(key_path)
+      end
+      def registry_has_subkeys?(key_path, architecture = :machine)
+        registry = Chef::Win32::Registry.new(run_context, architecture)
+        registry.has_subkeys?(key_path)
+      end
+      def registry_get_subkeys(key_path, architecture = :machine)
+        registry = Chef::Win32::Registry.new(run_context, architecture)
+        registry.get_subkeys(key_path)
+      end
+      def registry_value_exists?(key_path, value, architecture = :machine)
+        registry = Chef::Win32::Registry.new(run_context, architecture)
+        registry.value_exists?(key_path, value)
+      end
+      def registry_data_exists?(key_path, value, architecture = :machine)
+        registry = Chef::Win32::Registry.new(run_context, architecture)
+        registry.data_exists?(key_path, value)
+      end
+    end
+  end
+end
+

data/lib/chef/encrypted_data_bag_item.rb

@@ -20,6 +20,7 @@ require 'base64'
 require 'openssl'
 require 'chef/data_bag_item'
 require 'yaml'
+require 'yajl'
 require 'open-uri'
 
 # An EncryptedDataBagItem represents a read-only data bag item where
@@ -47,9 +48,11 @@ require 'open-uri'
 # such nodes in the infrastructure.
 #
 class Chef::EncryptedDataBagItem
-  DEFAULT_SECRET_FILE = "/etc/chef/encrypted_data_bag_secret"
   ALGORITHM = 'aes-256-cbc'
 
+  class UnacceptableEncryptedDataBagItemFormat < StandardError
+  end
+
   class UnsupportedEncryptedDataBagItemFormat < StandardError
   end
 
@@ -59,6 +62,122 @@ class Chef::EncryptedDataBagItem
   class UnsupportedCipher < StandardError
   end
 
+  # Implementation class for converting plaintext data bag item values to an
+  # encrypted value, including any necessary wrappers and metadata.
+  module Encryptor
+
+    # "factory" method that creates an encryptor object with the proper class
+    # for the desired encrypted data bag format version.
+    #
+    # +Chef::Config[:data_bag_encrypt_version]+ determines which version is used.
+    def self.new(value, secret, iv=nil)
+      format_version = Chef::Config[:data_bag_encrypt_version]
+      case format_version
+      when 1
+        Version1Encryptor.new(value, secret, iv)
+      when 2
+        Version2Encryptor.new(value, secret, iv)
+      else
+        raise UnsupportedEncryptedDataBagItemFormat,
+          "Invalid encrypted data bag format version `#{format_version}'. Supported versions are '1', '2'"
+      end
+    end
+
+    class Version1Encryptor
+      attr_reader :key
+      attr_reader :plaintext_data
+
+      # Create a new Encryptor for +data+, which will be encrypted with the given
+      # +key+.
+      #
+      # === Arguments:
+      # * data: An object of any type that can be serialized to json
+      # * key: A String representing the desired passphrase
+      # * iv: The optional +iv+ parameter is intended for testing use only. When
+      # *not* supplied, Encryptor will use OpenSSL to generate a secure random
+      # IV, which is what you want.
+      def initialize(plaintext_data, key, iv=nil)
+        @plaintext_data = plaintext_data
+        @key = key
+        @iv = iv && Base64.decode64(iv)
+      end
+
+      # Returns a wrapped and encrypted version of +plaintext_data+ suitable for
+      # using as the value in an encrypted data bag item.
+      def for_encrypted_item
+        {
+          "encrypted_data" => encrypted_data,
+          "iv" => Base64.encode64(iv),
+          "version" => 1,
+          "cipher" => ALGORITHM
+        }
+      end
+
+      # Generates or returns the IV.
+      def iv
+        # Generated IV comes from OpenSSL::Cipher::Cipher#random_iv
+        # This gets generated when +openssl_encryptor+ gets created.
+        openssl_encryptor if @iv.nil?
+        @iv
+      end
+
+      # Generates (and memoizes) an OpenSSL::Cipher::Cipher object and configures
+      # it for the specified iv and encryption key.
+      def openssl_encryptor
+        @openssl_encryptor ||= begin
+          encryptor = OpenSSL::Cipher::Cipher.new(ALGORITHM)
+          encryptor.encrypt
+          @iv ||= encryptor.random_iv
+          encryptor.iv = @iv
+          encryptor.key = Digest::SHA256.digest(key)
+          encryptor
+        end
+      end
+
+      # Encrypts and Base64 encodes +serialized_data+
+      def encrypted_data
+        @encrypted_data ||= begin
+          enc_data = openssl_encryptor.update(serialized_data)
+          enc_data << openssl_encryptor.final
+          Base64.encode64(enc_data)
+        end
+      end
+
+      # Wraps the data in a single key Hash (JSON Object) and converts to JSON.
+      # The wrapper is required because we accept values (such as Integers or
+      # Strings) that do not produce valid JSON when serialized without the
+      # wrapper.
+      def serialized_data
+        Yajl::Encoder.encode(:json_wrapper => plaintext_data)
+      end
+    end
+
+    class Version2Encryptor < Version1Encryptor
+
+      # Returns a wrapped and encrypted version of +plaintext_data+ suitable for
+      # using as the value in an encrypted data bag item.
+      def for_encrypted_item
+        {
+          "encrypted_data" => encrypted_data,
+          "hmac" => hmac,
+          "iv" => Base64.encode64(iv),
+          "version" => 2,
+          "cipher" => ALGORITHM
+        }
+      end
+
+      # Generates an HMAC-SHA2-256 of the encrypted data (encrypt-then-mac)
+      def hmac
+        @hmac ||= begin
+          digest = OpenSSL::Digest::Digest.new("sha256")
+          raw_hmac = OpenSSL::HMAC.digest(digest, key, encrypted_data)
+          Base64.encode64(raw_hmac)
+        end
+      end
+
+    end
+  end
+
   #=== Decryptor
   # For backwards compatibility, Chef implements decryption/deserialization for
   # older encrypted data bag item formats in addition to the current version.
@@ -72,7 +191,11 @@ class Chef::EncryptedDataBagItem
     # decryptor object for that version. Call #for_decrypted_item on the
     # resulting object to decrypt and deserialize it.
     def self.for(encrypted_value, key)
-      case format_version_of(encrypted_value)
+      format_version = format_version_of(encrypted_value)
+      assert_format_version_acceptable!(format_version)
+      case format_version
+      when 2
+        Version2Decryptor.new(encrypted_value, key)
       when 1
         Version1Decryptor.new(encrypted_value, key)
       when 0
@@ -91,6 +214,14 @@ class Chef::EncryptedDataBagItem
       end
     end
 
+    def self.assert_format_version_acceptable!(format_version)
+      unless format_version.kind_of?(Integer) and format_version >= Chef::Config[:data_bag_decrypt_minimum_version]
+        raise UnacceptableEncryptedDataBagItemFormat,
+          "The encrypted data bag item has format version `#{format_version}', " +
+          "but the config setting 'data_bag_decrypt_minimum_version' requires version `#{Chef::Config[:data_bag_decrypt_minimum_version]}'"
+      end
+    end
+
     class Version1Decryptor
 
       attr_reader :encrypted_data
@@ -103,9 +234,13 @@ class Chef::EncryptedDataBagItem
 
       def for_decrypted_item
         Yajl::Parser.parse(decrypted_data)["json_wrapper"]
+      rescue Yajl::ParseError
+        # convert to a DecryptionFailure error because the most likely scenario
+        # here is that the decryption step was unsuccessful but returned bad
+        # data rather than raising an error.
+        raise DecryptionFailure, "Error decrypting data bag value. Most likely the provided key is incorrect"
       end
 
-
       def encrypted_bytes
         Base64.decode64(@encrypted_data["encrypted_data"])
       end
@@ -146,6 +281,36 @@ class Chef::EncryptedDataBagItem
 
     end
 
+    class Version2Decryptor < Version1Decryptor
+
+      def decrypted_data
+        validate_hmac! unless @decrypted_data
+        super
+      end
+
+      def validate_hmac!
+        digest = OpenSSL::Digest::Digest.new("sha256")
+        raw_hmac = OpenSSL::HMAC.digest(digest, key, @encrypted_data["encrypted_data"])
+
+        if candidate_hmac_matches?(raw_hmac)
+          true
+        else
+          raise DecryptionFailure, "Error decrypting data bag value: invalid hmac. Most likely the provided key is incorrect"
+        end
+      end
+
+      private
+
+      def candidate_hmac_matches?(expected_hmac)
+        return false unless @encrypted_data["hmac"]
+        expected_bytes = expected_hmac.bytes.to_a
+        candidate_hmac_bytes = Base64.decode64(@encrypted_data["hmac"]).bytes.to_a
+        valid = expected_bytes.size ^ candidate_hmac_bytes.size
+        expected_bytes.zip(candidate_hmac_bytes) { |x, y| valid |= x ^ y.to_i }
+        valid == 0
+      end
+    end
+
     class Version0Decryptor
 
       attr_reader :encrypted_data
@@ -206,14 +371,10 @@ class Chef::EncryptedDataBagItem
     @enc_hash.keys.inject({}) { |hash, key| hash[key] = self[key]; hash }
   end
 
-  def self.from_plain_hash(plain_hash, secret)
-    self.new(self.encrypt_data_bag_item(plain_hash, secret), secret)
-  end
-
   def self.encrypt_data_bag_item(plain_hash, secret)
     plain_hash.inject({}) do |h, (key, val)|
       h[key] = if key != "id"
-                 self.encrypt_value(val, secret)
+                 Encryptor.new(val, secret).for_encrypted_item
                else
                  val
                end
@@ -227,12 +388,8 @@ class Chef::EncryptedDataBagItem
     self.new(raw_hash, secret)
   end
 
-  def self.encrypt_value(value, key)
-    Base64.encode64(self.cipher(:encrypt, value.to_yaml, key))
-  end
-
   def self.load_secret(path=nil)
-    path = path || Chef::Config[:encrypted_data_bag_secret] || DEFAULT_SECRET_FILE
+    path ||= Chef::Config[:encrypted_data_bag_secret]
     secret = case path
              when /^\w+:\/\//
                # We have a remote key
@@ -244,7 +401,7 @@ class Chef::EncryptedDataBagItem
                  raise ArgumentError, "Remote key not found at '#{path}'"
                end
              else
-               if !File.exists?(path)
+               if !File.exist?(path)
                  raise Errno::ENOENT, "file not found '#{path}'"
                end
                IO.read(path).strip
@@ -255,14 +412,4 @@ class Chef::EncryptedDataBagItem
     secret
   end
 
-  protected
-
-  def self.cipher(direction, data, key)
-    cipher = OpenSSL::Cipher::Cipher.new(ALGORITHM)
-    cipher.send(direction)
-    cipher.pkcs5_keyivgen(key)
-    ans = cipher.update(data)
-    ans << cipher.final
-    ans
-  end
 end

data/lib/chef/environment.rb

@@ -2,6 +2,7 @@
 # Author:: Stephen Delano (<stephen@opscode.com>)
 # Author:: Seth Falcon (<seth@opscode.com>)
 # Author:: John Keiser (<jkeiser@ospcode.com>)
+# Author:: Kyle Goodwin (<kgoodwin@primerevenue.com>)
 # Copyright:: Copyright 2010-2011 Opscode, Inc.
 # License:: Apache License, Version 2.0
 #
@@ -22,8 +23,6 @@ require 'chef/config'
 require 'chef/mash'
 require 'chef/mixin/params_validate'
 require 'chef/mixin/from_file'
-require 'chef/couchdb'
-require 'chef/index_queue'
 require 'chef/version_constraint'
 
 class Chef
@@ -33,52 +32,15 @@ class Chef
 
     include Chef::Mixin::ParamsValidate
     include Chef::Mixin::FromFile
-    include Chef::IndexQueue::Indexable
 
     COMBINED_COOKBOOK_CONSTRAINT = /(.+)(?:[\s]+)((?:#{Chef::VersionConstraint::OPS.join('|')})(?:[\s]+).+)$/.freeze
 
-    attr_accessor :couchdb, :couchdb_rev
-    attr_reader :couchdb_id
-
-    DESIGN_DOCUMENT = {
-      "version" => 1,
-      "language" => "javascript",
-      "views" => {
-        "all" => {
-          "map" => <<-EOJS
-          function(doc) {
-            if (doc.chef_type == "environment") {
-              emit(doc.name, doc);
-            }
-          }
-          EOJS
-        },
-        "all_id" => {
-          "map" => <<-EOJS
-          function(doc) {
-            if (doc.chef_type == "environment") {
-              emit(doc.name, doc.name);
-            }
-          }
-          EOJS
-        }
-      }
-    }
-
-    def initialize(couchdb=nil)
+    def initialize
       @name = ''
       @description = ''
       @default_attributes = Mash.new
       @override_attributes = Mash.new
       @cookbook_versions = Hash.new
-      @couchdb_rev = nil
-      @couchdb_id = nil
-      @couchdb = couchdb || Chef::CouchDB.new
-    end
-
-    def couchdb_id=(value)
-      @couchdb_id = value
-      self.index_id = value
     end
 
     def chef_server_rest
@@ -113,6 +75,10 @@ class Chef
       )
     end
 
+    def default_attributes=(attrs)
+      default_attributes(attrs)
+    end
+
     def override_attributes(arg=nil)
       set_or_return(
         :override_attributes,
@@ -121,6 +87,10 @@ class Chef
       )
     end
 
+    def override_attributes=(attrs)
+      override_attributes(attrs)
+    end
+
     def cookbook_versions(arg=nil)
       set_or_return(
         :cookbook_versions,
@@ -155,7 +125,6 @@ class Chef
         "default_attributes" => @default_attributes,
         "override_attributes" => @override_attributes
       }
-      result["_rev"] = couchdb_rev if couchdb_rev
       result
     end
 
@@ -252,17 +221,9 @@ class Chef
       environment.cookbook_versions(o["cookbook_versions"])
       environment.default_attributes(o["default_attributes"])
       environment.override_attributes(o["override_attributes"])
-      environment.couchdb_rev = o["_rev"] if o.has_key?("_rev")
-      environment.couchdb_id = o["_id"] if o.has_key?("_id")
       environment
     end
 
-    def self.cdb_list(inflate=false, couchdb=nil)
-      es = (couchdb || Chef::CouchDB.new).list("environments", inflate)
-      lookup = (inflate ? "value" : "key")
-      es["rows"].collect { |e| e[lookup] }
-    end
-
     def self.list(inflate=false)
       if inflate
         response = Hash.new
@@ -275,34 +236,39 @@ class Chef
       end
     end
 
-    def self.cdb_load(name, couchdb=nil)
-      (couchdb || Chef::CouchDB.new).load("environment", name)
-    end
-
     def self.load(name)
-      chef_server_rest.get_rest("environments/#{name}")
+      if Chef::Config[:solo]
+        load_from_file(name)
+      else
+        chef_server_rest.get_rest("environments/#{name}")
+      end
     end
 
-    def self.exists?(name, couchdb)
-      begin
-        self.cdb_load(name, couchdb)
-      rescue Chef::Exceptions::CouchDBNotFound
-        nil
+    def self.load_from_file(name)
+      unless File.directory?(Chef::Config[:environment_path])
+        raise Chef::Exceptions::InvalidEnvironmentPath, "Environment path '#{Chef::Config[:environment_path]}' is invalid"
       end
-    end
 
-    def cdb_destroy
-      couchdb.delete("environment", @name, couchdb_rev)
+      js_file = File.join(Chef::Config[:environment_path], "#{name}.json")
+      rb_file = File.join(Chef::Config[:environment_path], "#{name}.rb")
+
+      if File.exists?(js_file)
+        # from_json returns object.class => json_class in the JSON.
+        Chef::JSONCompat.from_json(IO.read(js_file))
+      elsif File.exists?(rb_file)
+        environment = Chef::Environment.new
+        environment.name(name)
+        environment.from_file(rb_file)
+        environment
+      else
+        raise Chef::Exceptions::EnvironmentNotFound, "Environment '#{name}' could not be loaded from disk"
+      end
     end
 
     def destroy
       chef_server_rest.delete_rest("environments/#{@name}")
     end
 
-    def cdb_save
-      self.couchdb_rev = couchdb.store("environment", @name, self)["rev"]
-    end
-
     def save
       begin
         chef_server_rest.put_rest("environments/#{@name}", self)
@@ -318,106 +284,6 @@ class Chef
       self
     end
 
-    # Set up our CouchDB design document
-    def self.create_design_document(couchdb=nil)
-      (couchdb || Chef::CouchDB.new).create_design_document("environments", DESIGN_DOCUMENT)
-    end
-
-    # Loads the set of Chef::CookbookVersion objects available to a given environment
-    # === Returns
-    # Hash
-    # i.e.
-    # {
-    #   "cookbook_name" => [ Chef::CookbookVersion ... ] ## the array of CookbookVersions is sorted highest to lowest
-    # }
-    #
-    # There will be a key for every cookbook.  If no CookbookVersions
-    # are available for the specified environment the value will be an
-    # empty list.
-    #
-    def self.cdb_load_filtered_cookbook_versions(name, couchdb=nil)
-      version_constraints = cdb_load(name, couchdb).cookbook_versions.inject({}) {|res, (k,v)| res[k] = Chef::VersionConstraint.new(v); res}
-
-      # inject all cookbooks into the hash while filtering out restricted versions, then sort the individual arrays
-      cookbook_list = Chef::CookbookVersion.cdb_list(true, couchdb)
-
-      filtered_list = cookbook_list.inject({}) do |res, cookbook|
-        # FIXME: should cookbook.version return a Chef::Version?
-        version               = Chef::Version.new(cookbook.version)
-        requirement_satisfied = version_constraints.has_key?(cookbook.name) ? version_constraints[cookbook.name].include?(version) : true
-        # we want a key for every cookbook, even if no versions are available
-        res[cookbook.name] ||= []
-        res[cookbook.name] << cookbook if requirement_satisfied
-        res
-      end
-
-      sorted_list = filtered_list.inject({}) do |res, (cookbook_name, versions)|
-        res[cookbook_name] = versions.sort.reverse
-        res
-      end
-
-      sorted_list
-    end
-
-    # Like +cdb_load_filtered_cookbook_versions+, loads the set of
-    # cookbooks available in a given environment. The difference is that
-    # this method will load Chef::MinimalCookbookVersion objects that
-    # contain only the information necessary for solving a cookbook
-    # collection for a given run list. The user of this method must call
-    # Chef::MinimalCookbookVersion.load_full_versions_of() after solving
-    # the cookbook collection to get the full objects.
-    # === Returns
-    # Hash
-    # i.e.
-    # {
-    #   "cookbook_name" => [ Chef::CookbookVersion ... ] ## the array of CookbookVersions is sorted highest to lowest
-    # }
-    #
-    # There will be a key for every cookbook.  If no CookbookVersions
-    # are available for the specified environment the value will be an
-    # empty list.
-    def self.cdb_minimal_filtered_versions(name, couchdb=nil)
-      version_constraints = cdb_load(name, couchdb).cookbook_versions.inject({}) {|res, (k,v)| res[k] = Chef::VersionConstraint.new(v); res}
-
-      # inject all cookbooks into the hash while filtering out restricted versions, then sort the individual arrays
-      cookbook_list = Chef::MinimalCookbookVersion.load_all(couchdb)
-
-      filtered_list = cookbook_list.inject({}) do |res, cookbook|
-        # FIXME: should cookbook.version return a Chef::Version?
-        version               = Chef::Version.new(cookbook.version)
-        requirement_satisfied = version_constraints.has_key?(cookbook.name) ? version_constraints[cookbook.name].include?(version) : true
-        # we want a key for every cookbook, even if no versions are available
-        res[cookbook.name] ||= []
-        res[cookbook.name] << cookbook if requirement_satisfied
-        res
-      end
-
-      sorted_list = filtered_list.inject({}) do |res, (cookbook_name, versions)|
-        res[cookbook_name] = versions.sort.reverse
-        res
-      end
-
-      sorted_list
-    end
-
-    def self.cdb_load_filtered_recipe_list(name, couchdb=nil)
-      cdb_load_filtered_cookbook_versions(name, couchdb).map do |cb_name, cb|
-        if cb.empty?            # no available versions
-          []                    # empty list elided with flatten
-        else
-          latest_version = cb.first
-          latest_version.recipe_filenames_by_name.keys.map do |recipe|
-            case recipe
-            when DEFAULT
-              cb_name
-            else
-              "#{cb_name}::#{recipe}"
-            end
-          end
-        end
-      end.flatten
-    end
-
     def self.load_filtered_recipe_list(environment)
       chef_server_rest.get_rest("environments/#{environment}/recipes")
     end
@@ -436,23 +302,17 @@ class Chef
 
     def self.validate_cookbook_version(version)
       begin
-        Chef::VersionConstraint.new version
-        true
+        if Chef::Config[:solo]
+          raise Chef::Exceptions::IllegalVersionConstraint,
+                "Environment cookbook version constraints not allowed in chef-solo"
+        else
+          Chef::VersionConstraint.new version
+          true
+        end
       rescue ArgumentError
         false
       end
     end
 
-    def self.create_default_environment(couchdb=nil)
-      couchdb = couchdb || Chef::CouchDB.new
-      begin
-        Chef::Environment.cdb_load('_default', couchdb)
-      rescue Chef::Exceptions::CouchDBNotFound
-        env = Chef::Environment.new(couchdb)
-        env.name '_default'
-        env.description 'The default Chef environment'
-        env.cdb_save
-      end
-    end
   end
 end