chef 14.8.12 → 14.9.13

data/lib/chef/resource/ssh_known_hosts_entry.rb

@@ -104,7 +104,7 @@ class Chef
         keys = r.variables[:entries].reject(&:empty?)
 
         if key_exists?(keys, key, comment)
-          Chef::Log.debug "Known hosts key for #{new_resource.name} already exists - skipping"
+          Chef::Log.debug "Known hosts key for #{new_resource.host} already exists - skipping"
         else
           r.variables[:entries].push(key)
         end

data/lib/chef/resource/sysctl.rb

@@ -80,7 +80,7 @@ class Chef
 
           directory new_resource.conf_dir
 
-          file "#{new_resource.conf_dir}/99-chef-#{new_resource.key}.conf" do
+          file "#{new_resource.conf_dir}/99-chef-#{new_resource.key.tr('/', '.')}.conf" do
             content "#{new_resource.key} = #{new_resource.value}"
           end
 
@@ -96,9 +96,9 @@ class Chef
         description "Remove a sysctl value."
 
         # only converge the resource if the file actually exists to delete
-        if ::File.exist?("#{new_resource.conf_dir}/99-chef-#{new_resource.key}.conf")
-          converge_by "removing sysctl config at #{new_resource.conf_dir}/99-chef-#{new_resource.key}.conf" do
-            file "#{new_resource.conf_dir}/99-chef-#{new_resource.key}.conf" do
+        if ::File.exist?("#{new_resource.conf_dir}/99-chef-#{new_resource.key.tr('/', '.')}.conf")
+          converge_by "removing sysctl config at #{new_resource.conf_dir}/99-chef-#{new_resource.key.tr('/', '.')}.conf" do
+            file "#{new_resource.conf_dir}/99-chef-#{new_resource.key.tr('/', '.')}.conf" do
               action :delete
             end
 
@@ -140,8 +140,8 @@ class Chef
       # return the value. Raise in case this conf file needs to be created
       # or updated
       def get_sysctld_value(key)
-        raise unless ::File.exist?("/etc/sysctl.d/99-chef-#{key}.conf")
-        k, v = ::File.read("/etc/sysctl.d/99-chef-#{key}.conf").match(/(.*) = (.*)/).captures
+        raise unless ::File.exist?("/etc/sysctl.d/99-chef-#{key.tr('/', '.')}.conf")
+        k, v = ::File.read("/etc/sysctl.d/99-chef-#{key.tr('/', '.')}.conf").match(/(.*) = (.*)/).captures
         raise "Unknown sysctl key!" if k.nil?
         raise "Unknown sysctl value!" if v.nil?
         v

data/lib/chef/resource/timezone.rb

@@ -25,7 +25,7 @@ class Chef
       preview_resource true
       resource_name :timezone
 
-      description "Use the timezone resource to change the system timezone on Linux and macOS hosts. Timezones are specified in tz database format, with a complete list of available TZ values here https://en.wikipedia.org/wiki/List_of_tz_database_time_zones."
+      description "Use the timezone resource to change the system timezone on Windows, Linux, and macOS hosts. Timezones are specified in tz database format, with a complete list of available TZ values for Linux and macOS here: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones and for Windows here: https://ss64.com/nt/timezones.html."
       introduced "14.6"
 
       property :timezone, String,
@@ -96,6 +96,12 @@ class Chef
                 shell_out!("sudo systemsetup -settimezone #{new_resource.timezone}")
               end
             end
+          when "windows"
+            unless current_windows_tz.casecmp?(new_resource.timezone)
+              converge_by("setting timezone to \"#{new_resource.timezone}\"") do
+                shell_out!("tzutil /s \"#{new_resource.timezone}\"")
+              end
+            end
           end
         end
       end
@@ -113,6 +119,16 @@ class Chef
             /Time Zone: (.*)/.match(tz_shellout.stdout)[1]
           end
         end
+
+        # detect the current timezone on windows hosts
+        #
+        # @since 14.9
+        # @return [String] timezone id
+        def current_windows_tz
+          tz_shellout = shell_out("tzutil /g")
+          raise "There was an error running the tzutil command" if tz_shellout.exitstatus == 1
+          tz_shellout.stdout.strip
+        end
       end
     end
   end

data/lib/chef/resource/windows_ad_join.rb

@@ -73,7 +73,13 @@ class Chef
 
           converge_by("join Active Directory domain #{new_resource.domain_name}") do
             ps_run = powershell_out(cmd)
-            raise "Failed to join the domain #{new_resource.domain_name}: #{ps_run.stderr}}" if ps_run.error?
+            if ps_run.error?
+              if sensitive?
+                raise "Failed to join the domain #{new_resource.domain_name}: *suppressed sensitive resource output*"
+              else
+                raise "Failed to join the domain #{new_resource.domain_name}: #{ps_run.stderr}"
+              end
+            end
 
             unless new_resource.reboot == :never
               reboot "Reboot to join domain #{new_resource.domain_name}" do
@@ -104,6 +110,10 @@ class Chef
             reboot_action
           end
         end
+
+        def sensitive?
+          !!new_resource.sensitive
+        end
       end
     end
   end

data/lib/chef/resource/windows_certificate.rb

@@ -59,7 +59,6 @@ class Chef
 
       action :create do
         description "Creates or updates a certificate."
-
         add_cert(OpenSSL::X509::Certificate.new(raw_source))
       end
 
@@ -91,8 +90,12 @@ class Chef
 
       action :delete do
         description "Deletes a certificate."
-
-        delete_cert
+        cert_obj = fetch_cert
+        if cert_obj
+          converge_by("Deleting certificate #{new_resource.source} from Store #{new_resource.store_name}") do
+            delete_cert
+          end
+        end
       end
 
       action :fetch do
@@ -250,7 +253,7 @@ class Chef
                 when ".cer"
                   powershell_out("openssl x509 -text -inform DER -in #{source} -outform PEM").stdout
                 when ".pfx"
-                  powershell_out("openssl pkcs12 -in #{source} -nodes -passin pass:#{new_resource.pfx_password}").stdout
+                  powershell_out("openssl pkcs12 -in #{source} -nodes -passin pass:'#{new_resource.pfx_password}'").stdout
                 when ".p7b"
                   powershell_out("openssl pkcs7 -print_certs -in #{source} -outform PEM").stdout
                 end

data/lib/chef/resource/windows_printer.rb

@@ -114,7 +114,7 @@ class Chef
 
           port_name = "IP_#{new_resource.ipv4_address}"
 
-          declare_resource(:powershell_script, "Creating printer: #{new_resource.name}") do
+          declare_resource(:powershell_script, "Creating printer: #{new_resource.device_id}") do
             code <<-EOH
 
               Set-WmiInstance -class Win32_Printer `
@@ -133,9 +133,9 @@ class Chef
         end
 
         def delete_printer
-          declare_resource(:powershell_script, "Deleting printer: #{new_resource.name}") do
+          declare_resource(:powershell_script, "Deleting printer: #{new_resource.device_id}") do
             code <<-EOH
-              $printer = Get-WMIObject -class Win32_Printer -EnableAllPrivileges -Filter "name = '#{new_resource.name}'"
+              $printer = Get-WMIObject -class Win32_Printer -EnableAllPrivileges -Filter "name = '#{new_resource.device_id}'"
               $printer.Delete()
             EOH
           end

data/lib/chef/resource/windows_task.rb

@@ -143,7 +143,6 @@ class Chef
         validate_start_time(start_time, frequency)
         validate_start_day(start_day, frequency) if start_day
         validate_user_and_password(user, password)
-        validate_interactive_setting(interactive_enabled, password)
         validate_create_frequency_modifier(frequency, frequency_modifier) if frequency_modifier
         validate_create_day(day, frequency, frequency_modifier) if day
         validate_create_months(months, frequency) if months
@@ -226,20 +225,30 @@ class Chef
         end
       end
 
+      # System users will not require a password
+      # Other users will require a password if the task is non-interactive.
+      #
+      # @param [String] user
+      # @param [String] password
+      #
       def validate_user_and_password(user, password)
-        if password_required?(user) && password.nil?
-          raise ArgumentError, "Cannot specify a user other than the system users without specifying a password!. Valid passwordless users: '#{Chef::ReservedNames::Win32::Security::SID::SYSTEM_USER.join("', '")}'"
+        if non_system_user?(user)
+          if password.nil? && !interactive_enabled
+            raise ArgumentError, "Please provide a password or check if this task needs to be interactive! Valid passwordless users are: '#{Chef::ReservedNames::Win32::Security::SID::SYSTEM_USER.join("', '")}'"
+          end
+        else
+          unless password.nil?
+            raise ArgumentError, "Password is not required for system users."
+          end
         end
       end
 
+      # Password is not required for system user and required for non-system user.
       def password_required?(user)
-        return false if user.nil?
-        @password_required ||= !Chef::ReservedNames::Win32::Security::SID.system_user?(user)
+        @password_required ||= (!user.nil? && !Chef::ReservedNames::Win32::Security::SID.system_user?(user))
       end
 
-      def validate_interactive_setting(interactive_enabled, password)
-        raise ArgumentError, "Please provide the password when attempting to set interactive/non-interactive." if interactive_enabled && password.nil?
-      end
+      alias non_system_user? password_required?
 
       def validate_create_frequency_modifier(frequency, frequency_modifier)
         if ([:on_logon, :onstart, :on_idle, :none].include?(frequency)) && ( frequency_modifier != 1)

data/lib/chef/role.rb

@@ -224,7 +224,7 @@ class Chef
     def save
       begin
         chef_server_rest.put("roles/#{@name}", self)
-      rescue Net::HTTPServerException => e
+      rescue Net::HTTPClientException => e
         raise e unless e.response.code == "404"
         chef_server_rest.post("roles", self)
       end

data/lib/chef/run_list/run_list_expansion.rb

@@ -219,7 +219,7 @@ class Chef
 
       def fetch_role(name, included_by)
         Chef::Role.from_hash(rest.get("roles/#{name}"))
-      rescue Net::HTTPServerException => e
+      rescue Net::HTTPClientException => e
         if e.message == '404 "Not Found"'
           role_not_found(name, included_by)
         else

data/lib/chef/user.rb

@@ -115,7 +115,7 @@ class Chef
 
     def save(new_key = false)
       create
-    rescue Net::HTTPServerException => e
+    rescue Net::HTTPClientException => e
       if e.response.code == "409"
         update(new_key)
       else

data/lib/chef/user_v1.rb

@@ -164,7 +164,7 @@ class Chef
           new_user["public_key"] = new_user["chef_key"]["public_key"]
           new_user.delete("chef_key")
         end
-      rescue Net::HTTPServerException => e
+      rescue Net::HTTPClientException => e
         # rescue API V0 if 406 and the server supports V0
         supported_versions = server_client_api_version_intersection(e, SUPPORTED_API_VERSIONS)
         raise e unless supported_versions && supported_versions.include?(0)
@@ -200,7 +200,7 @@ class Chef
         payload[:private_key] = new_key if new_key
 
         updated_user = chef_root_rest_v1.put("users/#{username}", payload)
-      rescue Net::HTTPServerException => e
+      rescue Net::HTTPClientException => e
         if e.response.code == "400"
           # if a 400 is returned but the error message matches the error related to private / public key fields, try V0
           # else, raise the 400
@@ -220,7 +220,7 @@ class Chef
 
     def save(new_key = false)
       create
-    rescue Net::HTTPServerException => e
+    rescue Net::HTTPClientException => e
       if e.response.code == "409"
         update(new_key)
       else
@@ -235,7 +235,7 @@ class Chef
         reregistered_self = chef_root_rest_v0.put("users/#{username}", payload)
         private_key(reregistered_self["private_key"])
       # only V0 supported for reregister
-      rescue Net::HTTPServerException => e
+      rescue Net::HTTPClientException => e
         # if there was a 406 related to versioning, give error explaining that
         # only API version 0 is supported for reregister command
         if e.response.code == "406" && e.response["x-ops-server-api-version"]

data/lib/chef/util/windows/net_group.rb

@@ -58,6 +58,12 @@ class Chef::Util::Windows::NetGroup
     raise ArgumentError, e
   end
 
+  def local_group_set_info(comment)
+    Chef::ReservedNames::Win32::NetUser.net_local_group_set_info(nil, groupname, comment)
+  rescue Chef::Exceptions::Win32APIError => e
+    raise ArgumentError, e
+  end
+
   def local_delete_members(members)
     Chef::ReservedNames::Win32::NetUser.net_local_group_del_members(nil, groupname, members)
   rescue Chef::Exceptions::Win32APIError => e

data/lib/chef/version.rb

@@ -23,7 +23,7 @@ require "chef/version_string"
 
 class Chef
   CHEF_ROOT = File.expand_path("../..", __FILE__)
-  VERSION = Chef::VersionString.new("14.8.12")
+  VERSION = Chef::VersionString.new("14.9.13")
 end
 
 #

data/lib/chef/win32/api/net.rb

@@ -144,6 +144,11 @@ class Chef
           layout :lgrpi0_name, :LPWSTR
         end
 
+        class LOCALGROUP_INFO_1 < FFI::Struct
+          layout :lgrpi1_name, :LPWSTR,
+                 :lgrpi1_comment, :LPWSTR
+        end
+
         class USE_INFO_2 < FFI::Struct
           include StructHelpers
 
@@ -168,6 +173,17 @@ class Chef
           :LPCWSTR, :DWORD, :LPBYTE, :LPDWORD
         ], :DWORD
 
+        # NET_API_STATUS NetLocalGroupSetInfo(
+        #   _In_ LPCWSTR servername,
+        #   _In_ LPCWSTR groupname,
+        #   _In_ DWORD   level,
+        #   _In_ LPBYTE  buf,
+        #   _Out_ LPDWORD parm_err
+        # );
+        safe_attach_function :NetLocalGroupSetInfo, [
+          :LPCWSTR, :LPCWSTR, :DWORD, :LPBYTE, :LPDWORD
+        ], :DWORD
+
         # NET_API_STATUS NetLocalGroupDel(
         # _In_ LPCWSTR servername,
         # _In_ LPCWSTR groupname

data/lib/chef/win32/net.rb

@@ -180,6 +180,21 @@ class Chef
         end
       end
 
+      def self.net_local_group_set_info(server_name, group_name, comment)
+        server_name = wstring(server_name)
+        group_name = wstring(group_name)
+        comment = wstring(comment)
+
+        buf = LOCALGROUP_INFO_1.new
+        buf[:lgrpi1_name] = FFI::MemoryPointer.from_string(group_name)
+        buf[:lgrpi1_comment] = FFI::MemoryPointer.from_string(comment)
+
+        rc = NetLocalGroupSetInfo(server_name, group_name, 1, buf, nil)
+        if rc != NERR_Success
+          Chef::ReservedNames::Win32::Error.raise!(nil, rc)
+        end
+      end
+
       def self.net_user_del(server_name, user_name)
         server_name = wstring(server_name)
         user_name = wstring(user_name)

data/lib/chef/win32/version.rb

@@ -44,25 +44,25 @@ class Chef
 
       def self.method_name_from_marketing_name(marketing_name)
         "#{marketing_name.gsub(/\s/, '_').tr('.', '_').downcase}?"
-        # "#{marketing_name.gsub(/\s/, '_').gsub(//, '_').downcase}?"
       end
 
       private_class_method :method_name_from_marketing_name
 
       WIN_VERSIONS = {
-        "Windows 10" => { major: 10, minor: 0, callable: lambda { |product_type, suite_mask| product_type == VER_NT_WORKSTATION } },
-        "Windows Server 2016" => { major: 10, minor: 0, callable: lambda { |product_type, suite_mask| product_type != VER_NT_WORKSTATION } },
-        "Windows 8.1" => { major: 6, minor: 3, callable: lambda { |product_type, suite_mask| product_type == VER_NT_WORKSTATION } },
-        "Windows Server 2012 R2" => { major: 6, minor: 3, callable: lambda { |product_type, suite_mask| product_type != VER_NT_WORKSTATION } },
-        "Windows 8" => { major: 6, minor: 2, callable: lambda { |product_type, suite_mask| product_type == VER_NT_WORKSTATION } },
-        "Windows Server 2012" => { major: 6, minor: 2, callable: lambda { |product_type, suite_mask| product_type != VER_NT_WORKSTATION } },
-        "Windows 7" => { major: 6, minor: 1, callable: lambda { |product_type, suite_mask| product_type == VER_NT_WORKSTATION } },
-        "Windows Server 2008 R2" => { major: 6, minor: 1, callable: lambda { |product_type, suite_mask| product_type != VER_NT_WORKSTATION } },
-        "Windows Server 2008" => { major: 6, minor: 0, callable: lambda { |product_type, suite_mask| product_type != VER_NT_WORKSTATION } },
-        "Windows Vista" => { major: 6, minor: 0, callable: lambda { |product_type, suite_mask| product_type == VER_NT_WORKSTATION } },
-        "Windows Server 2003 R2" => { major: 5, minor: 2, callable: lambda { |product_type, suite_mask| get_system_metrics(SM_SERVERR2) != 0 } },
-        "Windows Home Server" => { major: 5, minor: 2, callable: lambda { |product_type, suite_mask| (suite_mask & VER_SUITE_WH_SERVER) == VER_SUITE_WH_SERVER } },
-        "Windows Server 2003" => { major: 5, minor: 2, callable: lambda { |product_type, suite_mask| get_system_metrics(SM_SERVERR2) == 0 } },
+        "Windows Server 2019" => { major: 10, minor: 0, callable: lambda { |product_type, suite_mask, build_number| product_type != VER_NT_WORKSTATION && build_number >= 17763 } },
+        "Windows 10" => { major: 10, minor: 0, callable: lambda { |product_type, suite_mask, build_number| product_type == VER_NT_WORKSTATION } },
+        "Windows Server 2016" => { major: 10, minor: 0, callable: lambda { |product_type, suite_mask, build_number| product_type != VER_NT_WORKSTATION && build_number <= 14393 } },
+        "Windows 8.1" => { major: 6, minor: 3, callable: lambda { |product_type, suite_mask, build_number| product_type == VER_NT_WORKSTATION } },
+        "Windows Server 2012 R2" => { major: 6, minor: 3, callable: lambda { |product_type, suite_mask, build_number| product_type != VER_NT_WORKSTATION } },
+        "Windows 8" => { major: 6, minor: 2, callable: lambda { |product_type, suite_mask, build_number| product_type == VER_NT_WORKSTATION } },
+        "Windows Server 2012" => { major: 6, minor: 2, callable: lambda { |product_type, suite_mask, build_number| product_type != VER_NT_WORKSTATION } },
+        "Windows 7" => { major: 6, minor: 1, callable: lambda { |product_type, suite_mask, build_number| product_type == VER_NT_WORKSTATION } },
+        "Windows Server 2008 R2" => { major: 6, minor: 1, callable: lambda { |product_type, suite_mask, build_number| product_type != VER_NT_WORKSTATION } },
+        "Windows Server 2008" => { major: 6, minor: 0, callable: lambda { |product_type, suite_mask, build_number| product_type != VER_NT_WORKSTATION } },
+        "Windows Vista" => { major: 6, minor: 0, callable: lambda { |product_type, suite_mask, build_number| product_type == VER_NT_WORKSTATION } },
+        "Windows Server 2003 R2" => { major: 5, minor: 2, callable: lambda { |product_type, suite_mask, build_number| get_system_metrics(SM_SERVERR2) != 0 } },
+        "Windows Home Server" => { major: 5, minor: 2, callable: lambda { |product_type, suite_mask, build_number| (suite_mask & VER_SUITE_WH_SERVER) == VER_SUITE_WH_SERVER } },
+        "Windows Server 2003" => { major: 5, minor: 2, callable: lambda { |product_type, suite_mask, build_number| get_system_metrics(SM_SERVERR2) == 0 } },
         "Windows XP" => { major: 5, minor: 1 },
         "Windows 2000" => { major: 5, minor: 0 },
       }.freeze
@@ -88,7 +88,7 @@ class Chef
         define_method(method_name) do
           (@major_version == v[:major]) &&
             (@minor_version == v[:minor]) &&
-            (v[:callable] ? v[:callable].call(@product_type, @suite_mask) : true)
+            (v[:callable] ? v[:callable].call(@product_type, @suite_mask, @build_number) : true)
         end
         marketing_names << [k, method_name]
       end

data/spec/functional/http/simple_spec.rb

@@ -61,27 +61,27 @@ describe Chef::HTTP::Simple do
   end
 
   shared_examples_for "an endpoint that 403s" do
-    it "fails with a Net::HTTPServerException for a streaming request" do
-      expect { http_client.streaming_request(source) }.to raise_error(Net::HTTPServerException)
+    it "fails with a Net::HTTPClientException for a streaming request" do
+      expect { http_client.streaming_request(source) }.to raise_error(Net::HTTPClientException)
     end
 
-    it "fails with a Net::HTTPServerException for a GET request" do
-      expect { http_client.get(source) }.to raise_error(Net::HTTPServerException)
+    it "fails with a Net::HTTPClientException for a GET request" do
+      expect { http_client.get(source) }.to raise_error(Net::HTTPClientException)
     end
   end
 
   # see CHEF-5100
   shared_examples_for "a 403 after a successful request when reusing the request object" do
-    it "fails with a Net::HTTPServerException for a streaming request" do
+    it "fails with a Net::HTTPClientException for a streaming request" do
       tempfile = http_client.streaming_request(source)
       tempfile.close
       expect(Digest::MD5.hexdigest(binread(tempfile.path))).to eq(Digest::MD5.hexdigest(expected_content))
-      expect { http_client.streaming_request(source2) }.to raise_error(Net::HTTPServerException)
+      expect { http_client.streaming_request(source2) }.to raise_error(Net::HTTPClientException)
     end
 
-    it "fails with a Net::HTTPServerException for a GET request" do
+    it "fails with a Net::HTTPClientException for a GET request" do
       expect(Digest::MD5.hexdigest(http_client.get(source))).to eq(Digest::MD5.hexdigest(expected_content))
-      expect { http_client.get(source2) }.to raise_error(Net::HTTPServerException)
+      expect { http_client.get(source2) }.to raise_error(Net::HTTPClientException)
     end
   end
 
@@ -120,7 +120,7 @@ describe Chef::HTTP::Simple do
     it "Logs the request and response and bodies for 400 response" do
       expect do
         http_client.get("http://localhost:9000/bad_request")
-      end.to raise_error(Net::HTTPServerException)
+      end.to raise_error(Net::HTTPClientException)
       expect(@debug_log).to match(/400/)
       expect(@debug_log).to match(/HTTP Request Header Data/)
       expect(@debug_log).to match(/HTTP Status and Header Data/)
@@ -133,7 +133,7 @@ describe Chef::HTTP::Simple do
     it "Logs the request and response and bodies for 400 POST response" do
       expect do
         http_client.post("http://localhost:9000/bad_request", "hithere")
-      end.to raise_error(Net::HTTPServerException)
+      end.to raise_error(Net::HTTPClientException)
       expect(@debug_log).to match(/400/)
       expect(@debug_log).to match(/HTTP Request Header Data/)
       expect(@debug_log).to match(/HTTP Status and Header Data/)