chef 13.12.14 → 14.0.190

data/lib/chef/knife/ssl_check.rb

@@ -44,7 +44,7 @@ class Chef
 
       def uri
         @uri ||= begin
-          Chef::Log.debug("Checking SSL cert on #{given_uri}")
+          Chef::Log.trace("Checking SSL cert on #{given_uri}")
           URI.parse(given_uri)
         end
       end
@@ -131,7 +131,7 @@ class Chef
         true
       rescue OpenSSL::SSL::SSLError => e
         ui.error "The SSL certificate of #{host} could not be verified"
-        Chef::Log.debug e.message
+        Chef::Log.trace e.message
         debug_invalid_cert
         false
       end
@@ -141,7 +141,7 @@ class Chef
         true
       rescue OpenSSL::SSL::SSLError => e
         ui.error "The SSL cert is signed by a trusted authority but is not valid for the given hostname"
-        Chef::Log.debug(e)
+        Chef::Log.trace(e)
         debug_invalid_host
         false
       end

data/lib/chef/knife/ssl_fetch.rb

@@ -41,7 +41,7 @@ class Chef
 
       def uri
         @uri ||= begin
-          Chef::Log.debug("Checking SSL cert on #{given_uri}")
+          Chef::Log.trace("Checking SSL cert on #{given_uri}")
           URI.parse(given_uri)
         end
       end

data/lib/chef/knife/user_reregister.rb

@@ -75,7 +75,7 @@ EOF
           run_osc_11_user_reregister
         else # EC / CS 12 case
           user.reregister
-          Chef::Log.debug("Updated user data: #{user.inspect}")
+          Chef::Log.trace("Updated user data: #{user.inspect}")
           key = user.private_key
           if config[:file]
             File.open(config[:file], "w") do |f|

data/lib/chef/knife/xargs.rb

@@ -181,7 +181,7 @@ class Chef
 
       def destroy_tempfiles(tempfiles)
         # Unlink the files now that we're done with them
-        tempfiles.keys.each { |tempfile| tempfile.close! }
+        tempfiles.each_key { |tempfile| tempfile.close! }
       end
 
       def xargs_files(command, tempfiles)

data/lib/chef/mixin/api_version_request_handling.rb

@@ -19,11 +19,9 @@
 class Chef
   module Mixin
     module ApiVersionRequestHandling
-      # Input:
-      # exeception:
-      #   Net::HTTPServerException that may or may not contain the x-ops-server-api-version header
+      # @param exeception [Net::HTTPServerException] may or may not contain the x-ops-server-api-version header
       # supported_client_versions:
-      #  An array of Integers that represent the API versions the client supports.
+      # @param supported_client_versions [Array<Integer>] The API versions the client supports.
       #
       # Output:
       # nil:

data/lib/chef/mixin/create_path.rb

@@ -61,7 +61,7 @@ class Chef
           #                                             File.directory?(create_path) <- false
           #                                             Dir.mkdir(create_path)
           # Dir.mkdir(create_path) <- raises Errno::EEXIST
-        Chef::Log.debug("Creating directory #{path}")
+        Chef::Log.trace("Creating directory #{path}")
         Dir.mkdir(path)
       rescue Errno::EEXIST
       end

data/lib/chef/mixin/deprecation.rb

@@ -23,24 +23,24 @@ class Chef
       @deprecated_constants ||= {}
     end
 
-      # Add a deprecated constant to the Chef::Mixin namespace.
-      # === Arguments
-      # * name: the constant name, as a relative symbol.
-      # * replacement: the constant to return instead.
-      # * message: A message telling the user what to do instead.
-      # === Example:
-      #   deprecate_constant(:RecipeDefinitionDSLCore, Chef::DSL::Recipe, <<-EOM)
-      #     Chef::Mixin::RecipeDefinitionDSLCore is deprecated, use Chef::DSL::Recipe instead.
-      #   EOM
+    # Add a deprecated constant to the Chef::Mixin namespace.
+    #
+    # @param name [Symbol] the constant name, as a relative symbol.
+    # @param replacement [Object] the constant to return instead.
+    # @param message [String] A message telling the user what to do instead.
+    # @example
+    #   deprecate_constant(:RecipeDefinitionDSLCore, Chef::DSL::Recipe, <<-EOM)
+    #     Chef::Mixin::RecipeDefinitionDSLCore is deprecated, use Chef::DSL::Recipe instead.
+    #   EOM
     def self.deprecate_constant(name, replacement, message)
       deprecated_constants[name] = { :replacement => replacement, :message => message }
     end
 
-      # Const missing hook to look up deprecated constants defined with
-      # deprecate_constant. Emits a warning to the logger and returns the
-      # replacement constant. Will call super, most likely causing an exception
-      # for the missing constant, if +name+ is not found in the
-      # deprecated_constants collection.
+    # Const missing hook to look up deprecated constants defined with
+    # deprecate_constant. Emits a warning to the logger and returns the
+    # replacement constant. Will call super, most likely causing an exception
+    # for the missing constant, if +name+ is not found in the
+    # deprecated_constants collection.
     def self.const_missing(name)
       if new_const = deprecated_constants[name]
         Chef::Log.warn(new_const[:message])

data/lib/chef/mixin/from_file.rb

@@ -21,11 +21,15 @@ class Chef
   module Mixin
     module FromFile
 
+      # Source path from which the object was loaded
+      attr_accessor :source_file
+
       # Loads a given ruby file, and runs instance_eval against it in the context of the current
       # object.
       #
       # Raises an IOError if the file cannot be found, or is not readable.
       def from_file(filename)
+        self.source_file = filename
         if File.exists?(filename) && File.readable?(filename)
           instance_eval(IO.read(filename), filename, 1)
         else
@@ -38,6 +42,7 @@ class Chef
       #
       # Raises an IOError if the file cannot be found, or is not readable.
       def class_from_file(filename)
+        self.source_file = filename
         if File.exists?(filename) && File.readable?(filename)
           class_eval(IO.read(filename), filename, 1)
         else

data/lib/chef/mixin/get_source_from_package.rb

@@ -18,7 +18,7 @@
 #
 # mixin to make this syntax work without specifying a source:
 #
-# gem_pacakge "/tmp/foo-x.y.z.gem"
+# gem_package "/tmp/foo-x.y.z.gem"
 # rpm_package "/tmp/foo-x.y-z.rpm"
 # dpkg_package "/tmp/foo-x.y.z.deb"
 #
@@ -38,7 +38,7 @@ class Chef
         # if we're passed something that looks like a filesystem path, with no source, use it
         #  - require at least one '/' in the path to avoid gem_package "foo" breaking if a file named 'foo' exists in the cwd
         if new_resource.source.nil? && new_resource.package_name.match(/#{::File::SEPARATOR}/) && ::File.exist?(new_resource.package_name)
-          Chef::Log.debug("No package source specified, but #{new_resource.package_name} exists on the filesystem, copying to package source")
+          Chef::Log.trace("No package source specified, but #{new_resource.package_name} exists on the filesystem, copying to package source")
           new_resource.source(new_resource.package_name)
         end
       end

data/lib/chef/mixin/homebrew_user.rb

@@ -34,6 +34,8 @@ class Chef
       # This tries to find the user to execute brew as.  If a user is provided, that overrides the brew
       # executable user.  It is an error condition if the brew executable owner is root or we cannot find
       # the brew executable.
+      # @param [String, Integer] provided_user
+      # @return [Integer] UID of the user
       def find_homebrew_uid(provided_user = nil)
         # They could provide us a user name or a UID
         if provided_user
@@ -41,8 +43,17 @@ class Chef
           return Etc.getpwnam(provided_user).uid
         end
 
-        @homebrew_owner ||= calculate_owner
-        @homebrew_owner
+        @homebrew_owner_uid ||= calculate_owner
+        @homebrew_owner_uid
+      end
+
+      # Use find_homebrew_uid to return the UID and then lookup the
+      # name from that UID because sometimes you want the name not the UID
+      # @param [String, Integer] provided_user
+      # @return [String] username
+      def find_homebrew_username(provided_user = nil)
+        @homebrew_owner_username ||= Etc.getpwuid(find_homebrew_uid(provided_user)).name
+        @homebrew_owner_username
       end
 
       private

data/lib/chef/mixin/openssl_helper.rb

@@ -0,0 +1,119 @@
+#
+# Copyright:: Copyright 2013-2018, Chef Software Inc.
+# License:: Apache License, Version 2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+class Chef
+  module Mixin
+    # various helpers for use with openssl. Currently used by the openssl_* resources
+    module OpenSSLHelper
+      def self.included(_base)
+        require "openssl" unless defined?(::OpenSSL)
+      end
+
+      # determine the key filename from the cert filename
+      # @param [String] cert_filename the path to the certfile
+      # @return [String] the path to the keyfile
+      def get_key_filename(cert_filename)
+        cert_file_path, cert_filename = ::File.split(cert_filename)
+        cert_filename = ::File.basename(cert_filename, ::File.extname(cert_filename))
+        cert_file_path + ::File::SEPARATOR + cert_filename + ".key"
+      end
+
+      # is the key length a valid key length
+      # @param [Integer] number
+      # @return [Boolean] is length valid
+      def key_length_valid?(number)
+        number >= 1024 && ( number & (number - 1) == 0 )
+      end
+
+      # validate a dhparam file from path
+      # @param [String] dhparam_pem_path the path to the pem file
+      # @return [Boolean] is the key valid
+      def dhparam_pem_valid?(dhparam_pem_path)
+        # Check if the dhparam.pem file exists
+        # Verify the dhparam.pem file contains a key
+        return false unless ::File.exist?(dhparam_pem_path)
+        dhparam = ::OpenSSL::PKey::DH.new File.read(dhparam_pem_path)
+        dhparam.params_ok?
+      end
+
+      # given either a key file path or key file content see if it's actually
+      # a private key
+      # @param [String] key_file the path to the keyfile or the key contents
+      # @param [String] key_password optional password to the keyfile
+      # @return [Boolean] is the key valid?
+      def priv_key_file_valid?(key_file, key_password = nil)
+        # if the file exists try to read the content
+        # if not assume we were passed the key and set the string to the content
+        key_content = ::File.exist?(key_file) ? File.read(key_file) : key_file
+
+        begin
+          key = ::OpenSSL::PKey::RSA.new key_content, key_password
+        rescue ::OpenSSL::PKey::RSAError
+          return false
+        end
+        key.private?
+      end
+
+      # generate a dhparam file
+      # @param [String] key_length the length of the key
+      # @param [Integer] generator the dhparam generator to use
+      # @return [OpenSSL::PKey::DH]
+      def gen_dhparam(key_length, generator)
+        raise ArgumentError, "Key length must be a power of 2 greater than or equal to 1024" unless key_length_valid?(key_length)
+        raise TypeError, "Generator must be an integer" unless generator.is_a?(Integer)
+
+        ::OpenSSL::PKey::DH.new(key_length, generator)
+      end
+
+      # generate an RSA private key given key length
+      # @param [Integer] key_length the key length of the private key
+      # @return [OpenSSL::PKey::DH]
+      def gen_rsa_priv_key(key_length)
+        raise ArgumentError, "Key length must be a power of 2 greater than or equal to 1024" unless key_length_valid?(key_length)
+
+        ::OpenSSL::PKey::RSA.new(key_length)
+      end
+
+      # generate pem format of the public key given a private key
+      # @param [String] priv_key either the contents of the private key or the path to the file
+      # @param [String] priv_key_password optional password for the private key
+      # @return [String] pem format of the public key
+      def gen_rsa_pub_key(priv_key, priv_key_password = nil)
+        # if the file exists try to read the content
+        # if not assume we were passed the key and set the string to the content
+        key_content = ::File.exist?(priv_key) ? File.read(priv_key) : priv_key
+        key = ::OpenSSL::PKey::RSA.new key_content, priv_key_password
+        key.public_key.to_pem
+      end
+
+      # generate a pem file given a cipher, key, an optional key_password
+      # @param [OpenSSL::PKey::RSA] rsa_key the private key object
+      # @param [String] key_password the password for the private key
+      # @param [String] key_cipher the cipher to use
+      # @return [String] pem contents
+      def encrypt_rsa_key(rsa_key, key_password, key_cipher)
+        raise TypeError, "rsa_key must be a Ruby OpenSSL::PKey::RSA object" unless rsa_key.is_a?(::OpenSSL::PKey::RSA)
+        raise TypeError, "key_password must be a string" unless key_password.is_a?(String)
+        raise TypeError, "key_cipher must be a string" unless key_cipher.is_a?(String)
+        raise ArgumentError, "Specified key_cipher is not available on this system" unless ::OpenSSL::Cipher.ciphers.include?(key_cipher)
+
+        cipher = ::OpenSSL::Cipher.new(key_cipher)
+        rsa_key.to_pem(cipher, key_password)
+      end
+    end
+  end
+end

data/lib/chef/mixin/params_validate.rb

@@ -131,10 +131,6 @@ class Chef
 
       private
 
-      def explicitly_allows_nil?(key, validation)
-        validation.has_key?(:is) && _pv_is({ key => nil }, key, validation[:is], raise_error: false)
-      end
-
       def _validation_message(key, default)
         @validation_message.has_key?(key) ? @validation_message[key] : default
       end
@@ -178,9 +174,7 @@ class Chef
           to_be.each do |tb|
             return true if value == tb
           end
-          # Ruby will print :something as something, which confuses users so make sure to print them as symbols
-          # by inspecting the value instead of just printing it
-          raise Exceptions::ValidationFailed, _validation_message(key, "Option #{key} must be equal to one of: #{to_be.map { |v| v.inspect }.join(", ")}!  You passed #{value.inspect}.")
+          raise Exceptions::ValidationFailed, _validation_message(key, "Option #{key} must be equal to one of: #{to_be.join(", ")}!  You passed #{value.inspect}.")
         end
       end
 
@@ -409,7 +403,7 @@ class Chef
       #   x nil      #=> invalid
       #   ```
       #
-      def _pv_is(opts, key, to_be, raise_error: true)
+      def _pv_is(opts, key, to_be)
         return true if !opts.has_key?(key.to_s) && !opts.has_key?(key.to_sym)
         value = _pv_opts_lookup(opts, key)
         to_be = [ to_be ].flatten(1)

data/lib/chef/mixin/powershell_exec.rb

@@ -0,0 +1,105 @@
+#
+# Author:: Stuart Preston (<stuart@chef.io>)
+# Copyright:: Copyright 2018, Chef Software, Inc.
+# License:: Apache License, Version 2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+require "chef/powershell"
+
+# The powershell_exec mixin provides in-process access to PowerShell engine via
+# a COM interop (installed by the Chef Client installer).
+#
+# powershell_exec returns a Chef::PowerShell object that provides 3 methods:
+#
+# .result - returns a hash representing the results returned by executing the
+#           PowerShell script block
+# .errors - this is an array of string containing any messages written to the
+#           PowerShell error stream during execution
+# .error? - returns true if there were error messages written to the PowerShell
+#           error stream during execution
+#
+# Some examples of usage:
+#
+# > powershell_exec("(Get-Item c:\\windows\\system32\\w32time.dll).VersionInfo"
+#   ).result["FileVersion"]
+#  => "10.0.14393.0 (rs1_release.160715-1616)"
+#
+# > powershell_exec("(get-process ruby).Mainmodule").result["FileName"]
+#  => C:\\opscode\\chef\\embedded\\bin\\ruby.exe"
+#
+# > powershell_exec("$a = $true; $a").result
+#  => true
+#
+# > powershell_exec("not-found").errors
+#  => ["ObjectNotFound: (not-found:String) [], CommandNotFoundException: The
+#  term 'not-found' is not recognized as the name of a cmdlet, function, script
+#  file, or operable program. Check the spelling of the name, or if a path was
+#  included, verify that the path is correct and try again. (at <ScriptBlock>,
+#   <No file>: line 1)"]
+#
+# > powershell_exec("not-found").error?
+#  => true
+#
+# > powershell_exec("get-item c:\\notfound -erroraction stop")
+# WIN32OLERuntimeError: (in OLE method `ExecuteScript': )
+#     OLE error code:80131501 in System.Management.Automation
+#       The running command stopped because the preference variable
+#       "ErrorActionPreference" or common parameter is set to Stop: Cannot find
+#       path 'C:\notfound' because it does not exist.
+#
+# *Why use this and not powershell_out?* Startup time to invoke the PowerShell
+# engine is much faster (over 7X faster in tests) than writing the PowerShell
+# to disk, shelling out to powershell.exe and retrieving the .stdout or .stderr
+# methods afterwards.  Additionally we are able to have a higher fidelity
+# conversation with PowerShell because we are now working with the objects that
+# are returned by the script, rather than having to parse the stdout of
+# powershell.exe to get a result.
+#
+# *How does this work?*  In .NET terms, when you run a PowerShell script block
+# through the engine, behind the scenes you get a Collection<PSObject> returned
+# and simply we are serializing this, adding any errors that were generated to
+# a custom JSON string transferred in memory to Ruby.  The easiest way to
+# develop for this approach is to imagine that the last thing that happens in
+# your PowerShell script block is "ConvertTo-Json".  That's exactly what we are
+# doing here behind the scenes.
+#
+# There are a handful of current limitations with this approach:
+# - Windows UAC elevation is controlled by the token assigned to the account
+#   that Ruby.exe is running under.
+# - Terminating errors will result in a WIN32OLERuntimeError and typically are
+#   handled as an exception.
+# - There are no return/error codes, as we are not shelling out to
+#   powershell.exe but calling a method inline, no errors codes are returned.
+# - There is no settable timeout on powershell_exec method execution.
+# - It is not possible to impersonate another user running powershell, the
+#   credentials of the user running Chef Client are used.
+#
+
+class Chef
+  module Mixin
+    module PowershellExec
+      # Run a command under PowerShell via a managed (.NET) COM interop API.
+      # This implementation requires the managed dll to be registered on the
+      # target machine.
+      #
+      # Requires: .NET Framework 4.0 or higher on the target machine.
+      #
+      # @param script [String] script to run
+      # @return [Chef::PowerShell] output
+      def powershell_exec(script)
+        Chef::PowerShell.new(script)
+      end
+    end
+  end
+end