chef 11.4.4 → 11.6.0.hotfix.1

data/lib/chef/chef_fs/path_utils.rb

@@ -17,6 +17,7 @@
 #
 
 require 'chef/chef_fs'
+require 'pathname'
 
 class Chef
   module ChefFS
@@ -24,13 +25,13 @@ class Chef
 
       # If you are in 'source', this is what you would have to type to reach 'dest'
       # relative_to('/a/b/c/d/e', '/a/b/x/y') == '../../c/d/e'
-      # relative_to('/a/b', '/a/b') == ''
+      # relative_to('/a/b', '/a/b') == '.'
       def self.relative_to(dest, source)
         # Skip past the common parts
         source_parts = Chef::ChefFS::PathUtils.split(source)
         dest_parts = Chef::ChefFS::PathUtils.split(dest)
         i = 0
-        until i >= source_parts.length || i >= dest_parts.length || source_parts[i] != source_parts[i]
+        until i >= source_parts.length || i >= dest_parts.length || source_parts[i] != dest_parts[i]
           i+=1
         end
         # dot-dot up from 'source' to the common ancestor, then
@@ -56,9 +57,34 @@ class Chef
       end
 
       def self.regexp_path_separator
-        Chef::ChefFS::windows? ? '[/\\]' : '/'
+        Chef::ChefFS::windows? ? '[\/\\\\]' : '/'
       end
 
+      # Given a path which may only be partly real (i.e. /x/y/z when only /x exists,
+      # or /x/y/*/blah when /x/y/z/blah exists), call File.realpath on the biggest
+      # part that actually exists.
+      #
+      # If /x is a symlink to /blarghle, and has no subdirectories, then:
+      # PathUtils.realest_path('/x/y/z') == '/blarghle/y/z'
+      # PathUtils.realest_path('/x/*/z') == '/blarghle/*/z'
+      # PathUtils.realest_path('/*/y/z') == '/*/y/z'
+      def self.realest_path(path)
+        path = Pathname.new(path)
+        begin
+          path.realpath.to_s
+        rescue Errno::ENOENT
+          dirname = path.dirname
+          if dirname
+            PathUtils.join(realest_path(dirname), path.basename.to_s)
+          else
+            path.to_s
+          end
+        end
+      end
+
+      def self.is_absolute?(path)
+        path =~ /^#{regexp_path_separator}/
+      end
     end
   end
 end

data/lib/chef/chef_fs/raw_request.rb

@@ -0,0 +1,79 @@
+class Chef
+  module ChefFS
+    module RawRequest
+      def self.raw_json(chef_rest, api_path)
+        JSON.parse(raw_request(chef_rest, api_path), :create_additions => false)
+      end
+
+      def self.raw_request(chef_rest, api_path)
+        api_request(chef_rest, :GET, chef_rest.create_url(api_path), {}, false)
+      end
+
+      def self.api_request(chef_rest, method, url, headers={}, data=false)
+        json_body = data
+        #        json_body = data ? Chef::JSONCompat.to_json(data) : nil
+        # Force encoding to binary to fix SSL related EOFErrors
+        # cf. http://tickets.opscode.com/browse/CHEF-2363
+        # http://redmine.ruby-lang.org/issues/5233
+        #        json_body.force_encoding(Encoding::BINARY) if json_body.respond_to?(:force_encoding)
+        headers = build_headers(chef_rest, method, url, headers, json_body)
+
+        chef_rest.retriable_rest_request(method, url, json_body, headers) do |rest_request|
+          response = rest_request.call {|r| r.read_body}
+
+          response_body = chef_rest.decompress_body(response)
+
+          if response.kind_of?(Net::HTTPSuccess)
+            response_body
+          elsif redirect_location = redirected_to(response)
+            if [:GET, :HEAD].include?(method)
+              chef_rest.follow_redirect do
+                api_request(chef_rest, method, chef_rest.create_url(redirect_location))
+              end
+            else
+              raise Exceptions::InvalidRedirect, "#{method} request was redirected from #{url} to #{redirect_location}. Only GET and HEAD support redirects."
+            end
+          else
+            # have to decompress the body before making an exception for it. But the body could be nil.
+            response.body.replace(chef_rest.decompress_body(response)) if response.body.respond_to?(:replace)
+
+            if response['content-type'] =~ /json/
+              exception = response_body
+              msg = "HTTP Request Returned #{response.code} #{response.message}: "
+              msg << (exception["error"].respond_to?(:join) ? exception["error"].join(", ") : exception["error"].to_s)
+              Chef::Log.info(msg)
+            end
+            response.error!
+          end
+        end
+      end
+
+      private
+
+      # Copied so that it does not automatically inflate an object
+      # This is also used by knife raw_essentials
+
+      ACCEPT_ENCODING = "Accept-Encoding".freeze
+      ENCODING_GZIP_DEFLATE = "gzip;q=1.0,deflate;q=0.6,identity;q=0.3".freeze
+
+      def self.redirected_to(response)
+        return nil  unless response.kind_of?(Net::HTTPRedirection)
+        # Net::HTTPNotModified is undesired subclass of Net::HTTPRedirection so test for this
+        return nil  if response.kind_of?(Net::HTTPNotModified)
+        response['location']
+      end
+
+      def self.build_headers(chef_rest, method, url, headers={}, json_body=false, raw=false)
+        #        headers                 = @default_headers.merge(headers)
+        #headers['Accept']       = "application/json" unless raw
+        headers['Accept']       = "application/json" unless raw
+        headers["Content-Type"] = 'application/json' if json_body
+        headers['Content-Length'] = json_body.bytesize.to_s if json_body
+        headers[Chef::REST::RESTRequest::ACCEPT_ENCODING] = Chef::REST::RESTRequest::ENCODING_GZIP_DEFLATE
+        headers.merge!(chef_rest.authentication_headers(method, url, json_body)) if chef_rest.sign_requests?
+        headers.merge!(Chef::Config[:custom_http_headers]) if Chef::Config[:custom_http_headers]
+        headers
+      end
+    end
+  end
+end

data/lib/chef/client.rb

@@ -25,7 +25,7 @@ require 'chef/log'
 require 'chef/rest'
 require 'chef/api_client'
 require 'chef/api_client/registration'
-require 'chef/platform'
+require 'chef/platform/query_helpers'
 require 'chef/node'
 require 'chef/role'
 require 'chef/file_cache'
@@ -103,6 +103,7 @@ class Chef
       self.class.run_start_notifications.each do |notification|
         notification.call(run_status)
       end
+      @events.run_started(run_status)
     end
 
     # Callback to fire notifications that the run completed successfully
@@ -131,7 +132,7 @@ class Chef
     attr_reader :json_attribs
     attr_reader :run_status
     attr_reader :events
-    
+
     # Creates a new Chef::Client.
     def initialize(json_attribs=nil, args={})
       @json_attribs = json_attribs
@@ -179,28 +180,52 @@ class Chef
     # Do a full run for this Chef::Client.  Calls:
     # * do_run
     #
-    # This provides a wrapper around #do_run allowing the 
+    # This provides a wrapper around #do_run allowing the
     # run to be optionally forked.
     # === Returns
     # boolean:: Return value from #do_run. Should always returns true.
     def run
-      if(Chef::Config[:client_fork] && Process.respond_to?(:fork))
+      # win32-process gem exposes some form of :fork for Process
+      # class. So we are seperately ensuring that the platform we're
+      # running on is not windows before forking.
+      if(Chef::Config[:client_fork] && Process.respond_to?(:fork) && !Chef::Platform.windows?)
         Chef::Log.info "Forking chef instance to converge..."
         pid = fork do
-          Chef::Log.info "Forked instance now converging"
-          do_run
-          exit
+          [:INT, :TERM].each {|s| trap(s, "EXIT") }
+          client_solo = Chef::Config[:solo] ? "chef-solo" : "chef-client"
+          $0 = "#{client_solo} worker: ppid=#{Process.ppid};start=#{Time.new.strftime("%R:%S")};"
+          begin
+            Chef::Log.debug "Forked instance now converging"
+            do_run
+          rescue Exception
+            exit 1
+          else
+            exit 0
+          end
         end
-        Chef::Log.info "Fork successful. Waiting for new chef pid: #{pid}"
+        Chef::Log.debug "Fork successful. Waiting for new chef pid: #{pid}"
         result = Process.waitpid2(pid)
-        raise "Forked convergence run failed" unless result.last.success?
-        Chef::Log.info "Forked child successfully reaped (pid: #{pid})"
+        handle_child_exit(result)
+        Chef::Log.debug "Forked child successfully reaped (pid: #{pid})"
         true
       else
         do_run
       end
     end
 
+    def handle_child_exit(pid_and_status)
+      status = pid_and_status[1]
+      return true if status.success?
+      message = if status.signaled?
+        "Chef run process terminated by signal #{status.termsig} (#{Signal.list.invert[status.termsig]})"
+      else
+        "Chef run process exited unsuccessfully (exit code #{status.exitstatus})"
+      end
+      raise Exceptions::ChildConvergeError, message
+    end
+
+
+
     # Configures the Chef::Cookbook::FileVendor class to fetch file from the
     # server or disk as appropriate, creates the run context for this run, and
     # sanity checks the cookbook collection.
@@ -444,18 +469,18 @@ class Chef
     def do_run
       runlock = RunLock.new(Chef::Config)
       runlock.acquire
+      # don't add code that may fail before entering this section to be sure to release lock
+      begin
+        run_context = nil
+        @events.run_start(Chef::VERSION)
+        Chef::Log.info("*** Chef #{Chef::VERSION} ***")
+        enforce_path_sanity
+        run_ohai
+        @events.ohai_completed(node)
+        register unless Chef::Config[:solo]
 
-      run_context = nil
-      @events.run_start(Chef::VERSION)
-      Chef::Log.info("*** Chef #{Chef::VERSION} ***")
-      enforce_path_sanity
-      run_ohai
-      @events.ohai_completed(node)
-      register unless Chef::Config[:solo]
-
-      load_node
+        load_node
 
-      begin
         build_node
 
         run_status.start_clock
@@ -484,6 +509,7 @@ class Chef
           run_status.exception = e
           run_failed
         end
+        Chef::Application.debug_stacktrace(e)
         @events.run_failed(e)
         raise
       ensure

data/lib/chef/config.rb

@@ -2,7 +2,8 @@
 # Author:: Adam Jacob (<adam@opscode.com>)
 # Author:: Christopher Brown (<cb@opscode.com>)
 # Author:: AJ Christensen (<aj@opscode.com>)
-# Author:: Mark Mzyk (mmzyk@opscode.com)
+# Author:: Mark Mzyk (<mmzyk@opscode.com>)
+# Author:: Kyle Goodwin (<kgoodwin@primerevenue.com>)
 # Copyright:: Copyright (c) 2008 Opscode, Inc.
 # License:: Apache License, Version 2.0
 #
@@ -19,7 +20,9 @@
 # limitations under the License.
 
 require 'chef/log'
+require 'chef/exceptions'
 require 'mixlib/config'
+require 'chef/util/selinux'
 
 class Chef
   class Config
@@ -74,14 +77,7 @@ class Chef
     config_attr_writer :chef_server_url do |url|
       url = url.strip
       configure do |c|
-        [ :registration_url,
-          :template_url,
-          :remotefile_url,
-          :search_url,
-          :chef_server_url,
-          :role_url ].each do |u|
-            c[u] = url
-        end
+        c[:chef_server_url] = url
       end
       url
     end
@@ -110,32 +106,18 @@ class Chef
           f = File.new(location.to_str, "a")
           f.sync = true
         rescue Errno::ENOENT
-          raise Chef::Exceptions::ConfigurationError("Failed to open or create log file at #{location.to_str}")
+          raise Chef::Exceptions::ConfigurationError, "Failed to open or create log file at #{location.to_str}"
         end
           f
       end
     end
 
-    # Override the config dispatch to set the value of authorized_openid_providers when openid_providers (deprecated) is used
-    #
-    # === Parameters
-    # providers<Array>:: An array of openid providers that are authorized to login to the chef server
-    #
-    config_attr_writer :openid_providers do |providers|
-      configure { |c| c[:authorized_openid_providers] = providers }
-      providers
-    end
-
     # Turn on "path sanity" by default. See also: http://wiki.opscode.com/display/chef/User+Environment+PATH+Sanity
     enforce_path_sanity(true)
 
     # Formatted Chef Client output is a beta feature, disabled by default:
     formatter "null"
 
-    # Used when OpenID authentication is enabled in the Web UI
-    authorized_openid_identifiers nil
-    authorized_openid_providers nil
-
     # The number of times the client should retry when registering with the server
     client_registration_retries 5
 
@@ -147,9 +129,6 @@ class Chef
     # An array of paths to search for knife exec scripts if they aren't in the current directory
     script_path []
 
-    # Where files are stored temporarily during uploads
-    sandbox_path "/var/chef/sandboxes"
-
     # Where cookbook files are stored on the server (by content checksum)
     checksum_path "/var/chef/checksums"
 
@@ -174,7 +153,6 @@ class Chef
     group nil
     umask 0022
 
-
     # Valid log_levels are:
     # * :debug
     # * :info
@@ -202,30 +180,21 @@ class Chef
     # toggle info level log items that can create a lot of output
     verbose_logging true
     node_name nil
-    node_path "/var/chef/node"
-    diff_disable            false
+    diff_disabled           false
     diff_filesize_threshold 10000000
     diff_output_threshold   1000000
 
     pid_file nil
 
-    chef_server_url   "http://localhost:4000"
-    registration_url  "http://localhost:4000"
-    template_url      "http://localhost:4000"
-    role_url          "http://localhost:4000"
-    remotefile_url    "http://localhost:4000"
-    search_url        "http://localhost:4000"
-
-    client_url "http://localhost:4042"
+    chef_server_url   "https://localhost:443"
 
     rest_timeout 300
-    run_command_stderr_timeout 120
-    run_command_stdout_timeout 120
+    yum_timeout 900
     solo  false
     splay nil
     why_run false
     color false
-    client_fork false
+    client_fork true
     enable_reporting true
     enable_reporting_url_fatals false
 
@@ -237,12 +206,13 @@ class Chef
     ssl_ca_path nil
     ssl_ca_file nil
 
-
     # Where should chef-solo look for role files?
     role_path platform_specific_path("/var/chef/roles")
 
     data_bag_path platform_specific_path("/var/chef/data_bags")
 
+    environment_path platform_specific_path("/var/chef/environments")
+
     # Where should chef-solo download recipes from?
     recipe_url nil
 
@@ -270,6 +240,32 @@ class Chef
     # `node_name` of the client.
     client_key platform_specific_path("/etc/chef/client.pem")
 
+    # This secret is used to decrypt encrypted data bag items.
+    encrypted_data_bag_secret platform_specific_path("/etc/chef/encrypted_data_bag_secret")
+
+    # We have to check for the existence of the default file before setting it
+    # since +Chef::Config[:encrypted_data_bag_secret]+ is read by older
+    # bootstrap templates to determine if the local secret should be uploaded to
+    # node being bootstrapped. This should be removed in Chef 12.
+    unless File.exist?(platform_specific_path("/etc/chef/encrypted_data_bag_secret"))
+      encrypted_data_bag_secret(nil)
+    end
+
+    # As of Chef 11.0, version "1" is the default encrypted data bag item
+    # format. Version "2" is available which adds encrypt-then-mac protection.
+    # To maintain compatibility, versions other than 1 must be opt-in.
+    #
+    # Set this to `2` if you have chef-client 11.6.0+ in your infrastructure:
+    data_bag_encrypt_version 1
+
+    # When reading data bag items, any supported version is accepted. However,
+    # if all encrypted data bags have been generated with the version 2 format,
+    # it is recommended to disable support for earlier formats to improve
+    # security. For example, the version 2 format is identical to version 1
+    # except for the addition of an HMAC, so an attacker with MITM capability
+    # could downgrade an encrypted data bag to version 1 as part of an attack.
+    data_bag_decrypt_minimum_version 0
+
     # If there is no file in the location given by `client_key`, chef-client
     # will temporarily use the "validator" identity to generate one. If the
     # `client_key` is not present and the `validation_key` is also not present,
@@ -278,24 +274,12 @@ class Chef
     # The `validation_key` is never used if the `client_key` exists.
     validation_key platform_specific_path("/etc/chef/validation.pem")
     validation_client_name "chef-validator"
-    web_ui_client_name "chef-webui"
-    web_ui_key "/etc/chef/webui.pem"
-    web_ui_admin_user_name  "admin"
-    web_ui_admin_default_password "p@ssw0rd1"
 
-    # Server Signing CA
-    #
-    # In truth, these don't even have to change
-    signing_ca_cert "/var/chef/ca/cert.pem"
-    signing_ca_key "/var/chef/ca/key.pem"
-    signing_ca_user nil
-    signing_ca_group nil
-    signing_ca_country "US"
-    signing_ca_state "Washington"
-    signing_ca_location "Seattle"
-    signing_ca_org "Chef User"
-    signing_ca_domain "opensource.opscode.com"
-    signing_ca_email "opensource-cert@opscode.com"
+    # Zypper package provider gpg checks. Set to true to enable package
+    # gpg signature checking. This will be default in the
+    # future. Setting to false disables the warnings.
+    # Leaving this set to nil or false is a security hazard!
+    zypper_check_gpg nil
 
     # Report Handlers
     report_handlers []
@@ -337,12 +321,26 @@ class Chef
 
       fatal_windows_admin_check false
     else
-      user_valid_regex [ /^([-a-zA-Z0-9_.]+)$/, /^\d+$/ ]
-      group_valid_regex [ /^([-a-zA-Z0-9_.\\ ]+)$/, /^\d+$/ ]
+      user_valid_regex [ /^([-a-zA-Z0-9_.]+[\\@]?[-a-zA-Z0-9_.]+)$/, /^\d+$/ ]
+      group_valid_regex [ /^([-a-zA-Z0-9_.\\@^ ]+)$/, /^\d+$/ ]
     end
 
     # returns a platform specific path to the user home dir
     windows_home_path = ENV['SYSTEMDRIVE'] + ENV['HOMEPATH'] if ENV['SYSTEMDRIVE'] && ENV['HOMEPATH']
     user_home(ENV['HOME'] || windows_home_path || ENV['USERPROFILE'])
+
+    # Enable file permission fixup for selinux. Fixup will be done
+    # only if selinux is enabled in the system.
+    enable_selinux_file_permission_fixup true
+
+    # Use atomic updates (i.e. move operation) while updating contents
+    # of the files resources. When set to false copy operation is
+    # used to update files.
+    file_atomic_update true
+
+    # If false file staging is will be done via tempfiles that are
+    # created under ENV['TMP'] otherwise tempfiles will be created in
+    # the directory that files are going to reside.
+    file_staging_uses_destdir false
   end
 end