chef 16.1.16 → 16.18.30

data/lib/chef/resource/windows_dfs_folder.rb

@@ -21,6 +21,8 @@ require_relative "../resource"
 class Chef
   class Resource
     class WindowsDfsFolder < Chef::Resource
+      unified_mode true
+
       provides :windows_dfs_folder
 
       description "Use the **windows_dfs_folder** resource to creates a folder within DFS as many levels deep as required."

data/lib/chef/resource/windows_dfs_namespace.rb

@@ -21,6 +21,8 @@ require_relative "../resource"
 class Chef
   class Resource
     class WindowsDfsNamespace < Chef::Resource
+      unified_mode true
+
       provides :windows_dfs_namespace
 
       description "Use the **windows_dfs_namespace** resource to creates a share and DFS namespace on a Windows server."

data/lib/chef/resource/windows_dfs_server.rb

@@ -21,6 +21,8 @@ require_relative "../resource"
 class Chef
   class Resource
     class WindowsDfsServer < Chef::Resource
+      unified_mode true
+
       provides :windows_dfs_server
 
       description "Use the **windows_dfs_server** resource to set system-wide DFS settings."
@@ -47,14 +49,14 @@ class Chef
         default: 3600
 
       load_current_value do
-        ps_results = powershell_out("Get-DfsnServerConfiguration -ComputerName '#{ENV["COMPUTERNAME"]}' | Select LdapTimeoutSec, PreferLogonDC, EnableSiteCostedReferrals, SyncIntervalSec, UseFqdn | ConvertTo-Json")
+        ps_results = powershell_exec("Get-DfsnServerConfiguration -ComputerName '#{ENV["COMPUTERNAME"]}' | Select LdapTimeoutSec, PreferLogonDC, EnableSiteCostedReferrals, SyncIntervalSec, UseFqdn")
 
         if ps_results.error?
           raise "The dfs_server resource failed to fetch the current state via the Get-DfsnServerConfiguration PowerShell cmdlet. Is the DFS Windows feature installed?"
         end
 
-        Chef::Log.debug("The Get-DfsnServerConfiguration results were #{ps_results.stdout}")
-        results = Chef::JSONCompat.from_json(ps_results.stdout)
+        Chef::Log.debug("The Get-DfsnServerConfiguration results were #{ps_results.result}")
+        results = ps_results.result
 
         use_fqdn results["UseFqdn"] || false
         ldap_timeout_secs results["LdapTimeoutSec"]
@@ -67,7 +69,10 @@ class Chef
         description "Configure DFS settings."
 
         converge_if_changed do
-          powershell_out("Set-DfsnServerConfiguration -ComputerName '#{ENV["COMPUTERNAME"]}' EnableSiteCostedReferrals $#{new_resource.enable_site_costed_referrals} -UseFqdn $#{new_resource.use_fqdn} -LdapTimeoutSec #{new_resource.ldap_timeout_secs} -PreferLogonDC $#{new_resource.prefer_login_dc} -SyncIntervalSec #{new_resource.sync_interval_secs}")
+          dfs_cmd = "Set-DfsnServerConfiguration -ComputerName '#{ENV["COMPUTERNAME"]}' -UseFqdn $#{new_resource.use_fqdn} -LdapTimeoutSec #{new_resource.ldap_timeout_secs} -SyncIntervalSec #{new_resource.sync_interval_secs}"
+          dfs_cmd << " -EnableSiteCostedReferrals $#{new_resource.enable_site_costed_referrals}" if new_resource.enable_site_costed_referrals != current_resource.enable_site_costed_referrals
+          dfs_cmd << " -PreferLogonDC $#{new_resource.prefer_login_dc}" if new_resource.prefer_login_dc != current_resource.prefer_login_dc
+          powershell_exec!(dfs_cmd)
         end
       end
     end

data/lib/chef/resource/windows_dns_record.rb

@@ -21,6 +21,8 @@ require_relative "../resource"
 class Chef
   class Resource
     class WindowsDnsRecord < Chef::Resource
+      unified_mode true
+
       provides :windows_dns_record
 
       description "The windows_dns_record resource creates a DNS record for the given domain."
@@ -42,23 +44,40 @@ class Chef
         description: "The type of record to create, can be either ARecord, CNAME or PTR.",
         default: "ARecord", equal_to: %w{ARecord CNAME PTR}
 
+      property :dns_server, String,
+        description: "The name of the DNS server on which to create the record.",
+        default: "localhost",
+        introduced: "16.3"
+
       action :create do
         description "Creates and updates the DNS entry."
 
-        powershell_package "xDnsServer" do
+        windows_feature "RSAT-DNS-Server" do
+          not_if new_resource.dns_server.casecmp?("localhost")
         end
-        do_it "Present"
+
+        powershell_package "xDnsServer"
+
+        run_dsc_resource "Present"
       end
 
       action :delete do
         description "Deletes a DNS entry."
-        powershell_package "xDnsServer" do
+
+        windows_feature "RSAT-DNS-Server" do
+          not_if new_resource.dns_server.casecmp?("localhost")
         end
-        do_it "Absent"
+
+        powershell_package "xDnsServer"
+
+        run_dsc_resource "Absent"
       end
 
       action_class do
-        def do_it(ensure_prop)
+        private
+
+        # @api private
+        def run_dsc_resource(ensure_prop)
           dsc_resource "xDnsRecord #{new_resource.record_name}.#{new_resource.zone} #{ensure_prop}" do
             module_name "xDnsServer"
             resource :xDnsRecord
@@ -67,6 +86,7 @@ class Chef
             property :Zone, new_resource.zone
             property :Type, new_resource.record_type
             property :Target, new_resource.target
+            property :DnsServer, new_resource.dns_server
           end
         end
       end

data/lib/chef/resource/windows_dns_zone.rb

@@ -21,6 +21,8 @@ require_relative "../resource"
 class Chef
   class Resource
     class WindowsDnsZone < Chef::Resource
+      unified_mode true
+
       provides :windows_dns_zone
 
       description "The windows_dns_zone resource creates an Active Directory Integrated DNS Zone on the local server."
@@ -41,21 +43,24 @@ class Chef
       action :create do
         description "Creates and updates a DNS Zone."
 
-        powershell_package "xDnsServer" do
-        end
-        do_it "Present"
+        powershell_package "xDnsServer"
+
+        run_dsc_resource "Present"
       end
 
       action :delete do
         description "Deletes a DNS Zone."
 
-        powershell_package "xDnsServer" do
-        end
-        do_it "Absent"
+        powershell_package "xDnsServer"
+
+        run_dsc_resource "Absent"
       end
 
       action_class do
-        def do_it(ensure_prop)
+        private
+
+        # @api private
+        def run_dsc_resource(ensure_prop)
           if new_resource.server_type == "Domain"
             dsc_resource "xDnsServerADZone #{new_resource.zone_name} #{ensure_prop}" do
               module_name "xDnsServer"

data/lib/chef/resource/windows_env.rb

@@ -18,10 +18,13 @@
 #
 
 require_relative "../resource"
+require_relative "../mixin/windows_env_helper"
 
 class Chef
   class Resource
     class WindowsEnv < Chef::Resource
+      unified_mode true
+
       provides :windows_env
       provides :env # backwards compat with the pre-Chef 14 resource name
 
@@ -52,6 +55,176 @@ class Chef
         desired_state: false
 
       property :user, String, default: "<System>"
+
+      action_class do
+        include Chef::Mixin::WindowsEnvHelper
+
+        def whyrun_supported?
+          false
+        end
+
+        def load_current_resource
+          @current_resource = Chef::Resource::WindowsEnv.new(new_resource.name)
+          current_resource.key_name(new_resource.key_name)
+
+          if key_exists?
+            current_resource.value(env_value(new_resource.key_name))
+          else
+            logger.trace("#{new_resource} key does not exist")
+          end
+
+          current_resource
+        end
+
+        def key_exists?
+          @key_exists ||= !!env_value(new_resource.key_name)
+        end
+
+        def requires_modify_or_create?
+          if new_resource.delim
+            # e.g. check for existing value within PATH
+            new_values.inject(0) do |index, val|
+              next_index = current_values.find_index val
+              return true if next_index.nil? || next_index < index
+
+              next_index
+            end
+            false
+          else
+            new_resource.value != current_resource.value
+          end
+        end
+
+        alias_method :compare_value, :requires_modify_or_create?
+
+        # e.g. delete a PATH element
+        #
+        # ==== Returns
+        # <true>:: If we handled the element case and caller should not delete the key
+        # <false>:: Caller should delete the key, either no :delim was specific or value was empty
+        #           after we removed the element.
+        def delete_element
+          return false unless new_resource.delim # no delim: delete the key
+
+          needs_delete = new_values.any? { |v| current_values.include?(v) }
+          if !needs_delete
+            logger.trace("#{new_resource} element '#{new_resource.value}' does not exist")
+            true # do not delete the key
+          else
+            new_value =
+              current_values.select do |item|
+                not new_values.include?(item)
+              end.join(new_resource.delim)
+
+            if new_value.empty?
+              false # nothing left here, delete the key
+            else
+              old_value = new_resource.value(new_value)
+              create_env
+              logger.trace("#{new_resource} deleted #{old_value} element")
+              new_resource.updated_by_last_action(true)
+              true # we removed the element and updated; do not delete the key
+            end
+          end
+        end
+
+        def create_env
+          obj = env_obj(@new_resource.key_name)
+          unless obj
+            obj = WIN32OLE.connect("winmgmts://").get("Win32_Environment").spawninstance_
+            obj.name = @new_resource.key_name
+            obj.username = new_resource.user
+          end
+          obj.variablevalue = @new_resource.value
+          obj.put_
+          value = @new_resource.value
+          value = expand_path(value) if @new_resource.key_name.casecmp("PATH") == 0
+          ENV[@new_resource.key_name] = value
+          broadcast_env_change
+        end
+
+        def delete_env
+          obj = env_obj(@new_resource.key_name)
+          if obj
+            obj.delete_
+            broadcast_env_change
+          end
+          if ENV[@new_resource.key_name]
+            ENV.delete(@new_resource.key_name)
+          end
+        end
+
+        def modify_env
+          if new_resource.delim
+            new_resource.value((new_values + current_values).uniq.join(new_resource.delim))
+          end
+          create_env
+        end
+
+        # Returns the current values to split by delimiter
+        def current_values
+          @current_values ||= current_resource.value.split(new_resource.delim)
+        end
+
+        # Returns the new values to split by delimiter
+        def new_values
+          @new_values ||= new_resource.value.split(new_resource.delim)
+        end
+
+        def env_value(key_name)
+          obj = env_obj(key_name)
+          obj.variablevalue if obj
+        end
+
+        def env_obj(key_name)
+          return @env_obj if @env_obj
+
+          wmi = WmiLite::Wmi.new
+          # Note that by design this query is case insensitive with regard to key_name
+          environment_variables = wmi.query("select * from Win32_Environment where name = '#{key_name}'")
+          if environment_variables && environment_variables.length > 0
+            environment_variables.each do |env|
+              @env_obj = env.wmi_ole_object
+              return @env_obj if @env_obj.username.split('\\').last.casecmp(new_resource.user) == 0
+            end
+          end
+          @env_obj = nil
+        end
+      end
+
+      action :create do
+        if key_exists?
+          if requires_modify_or_create?
+            modify_env
+            logger.info("#{new_resource} altered")
+            new_resource.updated_by_last_action(true)
+          end
+        else
+          create_env
+          logger.info("#{new_resource} created")
+          new_resource.updated_by_last_action(true)
+        end
+      end
+
+      action :delete do
+        if ( ENV[new_resource.key_name] || key_exists? ) && !delete_element
+          delete_env
+          logger.info("#{new_resource} deleted")
+          new_resource.updated_by_last_action(true)
+        end
+      end
+
+      action :modify do
+        if key_exists?
+          if requires_modify_or_create?
+            modify_env
+            logger.info("#{new_resource} modified")
+            new_resource.updated_by_last_action(true)
+          end
+        else
+          raise Chef::Exceptions::WindowsEnv, "Cannot modify #{new_resource} - key does not exist!"
+        end
+      end
     end
   end
 end

data/lib/chef/resource/windows_feature.rb

@@ -21,6 +21,8 @@ require_relative "../resource"
 class Chef
   class Resource
     class WindowsFeature < Chef::Resource
+      unified_mode true
+
       provides(:windows_feature) { true }
 
       description "Use the **windows_feature** resource to add, remove or entirely delete Windows features and roles. This resource calls the 'windows_feature_dism' or 'windows_feature_powershell' resources depending on the specified installation method, and defaults to DISM, which is available on both Workstation and Server editions of Windows."
@@ -125,6 +127,8 @@ class Chef
       end
 
       action_class do
+        private
+
         # call the appropriate windows_feature resource based on the specified subresource
         # @return [void]
         def run_default_subresource(desired_action)

data/lib/chef/resource/windows_feature_dism.rb

@@ -22,6 +22,8 @@ require_relative "../platform/query_helpers"
 class Chef
   class Resource
     class WindowsFeatureDism < Chef::Resource
+      unified_mode true
+
       provides(:windows_feature_dism) { true }
 
       description "Use the **windows_feature_dism** resource to add, remove, or entirely delete Windows features and roles using DISM."
@@ -125,6 +127,8 @@ class Chef
       end
 
       action_class do
+        private
+
         # @return [Array] features the user has requested to install which need installation
         def features_to_install
           @install ||= begin
@@ -171,6 +175,12 @@ class Chef
           raise "The Windows feature#{"s" if unavailable.count > 1} #{unavailable.join(",")} #{unavailable.count > 1 ? "are" : "is"} not available on this version of Windows. Run 'dism /online /Get-Features' to see the list of available feature names." unless unavailable.empty?
         end
 
+        #
+        # FIXME FIXME FIXME
+        # The node object should not be used for caching state like this and this is not a public API and may break.
+        # FIXME FIXME FIXME
+        #
+
         # run dism.exe to get a list of all available features and their state
         # and save that to the node at node.override level.
         # We do this because getting a list of features in dism takes at least a second

data/lib/chef/resource/windows_feature_powershell.rb

@@ -23,6 +23,8 @@ require_relative "../platform/query_helpers"
 class Chef
   class Resource
     class WindowsFeaturePowershell < Chef::Resource
+      unified_mode true
+
       provides(:windows_feature_powershell) { true }
 
       description "Use the **windows_feature_powershell** resource to add, remove, or entirely delete Windows features and roles using PowerShell. This resource offers significant speed benefits over the windows_feature_dism resource, but requires installation of the Remote Server Administration Tools on non-server releases of Windows."
@@ -141,8 +143,12 @@ class Chef
       action_class do
         # @return [Array] features the user has requested to install which need installation
         def features_to_install
-          # the intersection of the features to install & disabled features are what needs installing
-          @install ||= new_resource.feature_name & node["powershell_features_cache"]["disabled"]
+          # the intersection of the features to install & disabled/removed features are what needs installing
+          @features_to_install ||= begin
+            features = node["powershell_features_cache"]["disabled"]
+            features |= node["powershell_features_cache"]["removed"] if new_resource.source
+            new_resource.feature_name & features
+          end
         end
 
         # @return [Array] features the user has requested to remove which need removing
@@ -182,6 +188,12 @@ class Chef
         # @return [void]
         def reload_cached_powershell_data
           Chef::Log.debug("Caching Windows features available via Get-WindowsFeature.")
+
+          #
+          # FIXME FIXME FIXME
+          # The node object should not be used for caching state like this and this is not a public API and may break.
+          # FIXME FIXME FIXME
+          #
           node.override["powershell_features_cache"] = Mash.new
           node.override["powershell_features_cache"]["enabled"] = []
           node.override["powershell_features_cache"]["disabled"] = []

data/lib/chef/resource/windows_firewall_profile.rb

@@ -0,0 +1,196 @@
+#
+# Author:: John McCrae (<jmccrae@chef.io>)
+# Author:: Davin Taddeo (<davin@chef.io>)
+# Copyright:: Copyright (c) Chef Software Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+class Chef
+  class Resource
+    class WindowsFirewallProfile < Chef::Resource
+      provides :windows_firewall_profile
+      description "Use the **windows_firewall_profile** resource to enable, disable, and configure the Windows firewall."
+      introduced "16.3"
+
+      examples <<~DOC
+      **Enable and Configure the Private Profile of the Windows Profile**:
+
+      ```ruby
+      windows_firewall_profile 'Private' do
+        default_inbound_action 'Block'
+        default_outbound_action 'Allow'
+        allow_inbound_rules true
+        display_notification false
+        action :enable
+      end
+      ```
+
+      **Enable and Configure the Public Profile of the Windows Firewall**:
+
+      ```ruby
+      windows_firewall_profile 'Public' do
+        default_inbound_action 'Block'
+        default_outbound_action 'Allow'
+        allow_inbound_rules false
+        display_notification false
+        action :enable
+      end
+      ```
+
+      **Disable the Domain Profile of the Windows Firewall**:
+
+      ```ruby
+      windows_firewall_profile 'Disable the Domain Profile of the Windows Firewall' do
+        profile 'Domain'
+        action :disable
+      end
+      ```
+      DOC
+
+      unified_mode true
+
+      property :profile, String,
+        name_property: true,
+        equal_to: %w{ Domain Public Private },
+        description: "Set the Windows Profile being configured"
+
+      property :default_inbound_action, [String, nil],
+        equal_to: %w{ Allow Block NotConfigured },
+        description: "Set the default policy for inbound network traffic"
+
+      property :default_outbound_action, [String, nil],
+        equal_to: %w{ Allow Block NotConfigured },
+        description: "Set the default policy for outbound network traffic"
+
+      property :allow_inbound_rules, [true, false, String], equal_to: [true, false, "NotConfigured"], description: "Allow users to set inbound firewall rules"
+      property :allow_local_firewall_rules, [true, false, String], equal_to: [true, false, "NotConfigured"], description: "Merges inbound firewall rules into the policy"
+      property :allow_local_ipsec_rules, [true, false, String], equal_to: [true, false, "NotConfigured"], description: "Allow users to manage local connection security rules"
+      property :allow_user_apps, [true, false, String], equal_to: [true, false, "NotConfigured"], description: "Allow user applications to manage firewall"
+      property :allow_user_ports, [true, false, String], equal_to: [true, false, "NotConfigured"], description: "Allow users to manage firewall port rules"
+      property :allow_unicast_response, [true, false, String], equal_to: [true, false, "NotConfigured"], description: "Allow unicast responses to multicast and broadcast messages"
+      property :display_notification, [true, false, String], equal_to: [true, false, "NotConfigured"], description: "Display a notification when firewall blocks certain activity"
+
+      load_current_value do |desired|
+        ps_get_net_fw_profile = load_firewall_state(desired.profile)
+        output = powershell_exec(ps_get_net_fw_profile)
+        if output.result.empty?
+          current_value_does_not_exist!
+        else
+          state = output.result
+        end
+
+        default_inbound_action state["default_inbound_action"]
+        default_outbound_action state["default_outbound_action"]
+        allow_inbound_rules convert_to_ruby(state["allow_inbound_rules"])
+        allow_local_firewall_rules convert_to_ruby(state["allow_local_firewall_rules"])
+        allow_local_ipsec_rules convert_to_ruby(state["allow_local_ipsec_rules"])
+        allow_user_apps convert_to_ruby(state["allow_user_apps"])
+        allow_user_ports convert_to_ruby(state["allow_user_ports"])
+        allow_unicast_response convert_to_ruby(state["allow_unicast_response"])
+        display_notification convert_to_ruby(state["display_notification"])
+      end
+
+      def convert_to_ruby(obj)
+        if obj.to_s.downcase == "true"
+          true
+        elsif obj.to_s.downcase == "false"
+          false
+        elsif obj.to_s.downcase == "notconfigured"
+          "NotConfigured"
+        end
+      end
+
+      def convert_to_powershell(obj)
+        if obj.to_s.downcase == "true"
+          "True"
+        elsif obj.to_s.downcase == "false"
+          "False"
+        elsif obj.to_s.downcase == "notconfigured"
+          "NotConfigured"
+        end
+      end
+
+      action :enable do
+        converge_if_changed :default_inbound_action, :default_outbound_action, :allow_inbound_rules, :allow_local_firewall_rules,
+          :allow_local_ipsec_rules, :allow_user_apps, :allow_user_ports, :allow_unicast_response, :display_notification do
+            fw_cmd = firewall_command(new_resource.profile)
+            powershell_exec!(fw_cmd)
+          end
+        unless firewall_enabled?(new_resource.profile)
+          converge_by "Enable the #{new_resource.profile} Firewall Profile" do
+            cmd = "Set-NetFirewallProfile -Profile #{new_resource.profile} -Enabled \"True\""
+            powershell_exec!(cmd)
+          end
+        end
+      end
+
+      action :disable do
+        if firewall_enabled?(new_resource.profile)
+          converge_by "Disable the #{new_resource.profile} Firewall Profile" do
+            cmd = "Set-NetFirewallProfile -Profile #{new_resource.profile} -Enabled \"False\""
+            powershell_exec!(cmd)
+          end
+        end
+      end
+
+      action_class do
+        def firewall_command(fw_profile)
+          cmd = "Set-NetFirewallProfile -Profile \"#{fw_profile}\""
+          cmd << " -DefaultInboundAction \"#{new_resource.default_inbound_action}\"" unless new_resource.default_inbound_action.nil?
+          cmd << " -DefaultOutboundAction \"#{new_resource.default_outbound_action}\"" unless new_resource.default_outbound_action.nil?
+          cmd << " -AllowInboundRules \"#{convert_to_powershell(new_resource.allow_inbound_rules)}\"" unless new_resource.allow_inbound_rules.nil?
+          cmd << " -AllowLocalFirewallRules \"#{convert_to_powershell(new_resource.allow_local_firewall_rules)}\"" unless new_resource.allow_local_firewall_rules.nil?
+          cmd << " -AllowLocalIPsecRules \"#{convert_to_powershell(new_resource.allow_local_ipsec_rules)}\"" unless new_resource.allow_local_ipsec_rules.nil?
+          cmd << " -AllowUserApps \"#{convert_to_powershell(new_resource.allow_user_apps)}\"" unless new_resource.allow_user_apps.nil?
+          cmd << " -AllowUserPorts \"#{convert_to_powershell(new_resource.allow_user_ports)}\"" unless new_resource.allow_user_ports.nil?
+          cmd << " -AllowUnicastResponseToMulticast \"#{convert_to_powershell(new_resource.allow_unicast_response)}\"" unless new_resource.allow_unicast_response.nil?
+          cmd << " -NotifyOnListen \"#{convert_to_powershell(new_resource.display_notification)}\"" unless new_resource.display_notification.nil?
+          cmd
+        end
+
+        def firewall_enabled?(profile_name)
+          cmd = <<~CODE
+            $#{profile_name} = Get-NetFirewallProfile -Profile #{profile_name}
+            if ($#{profile_name}.Enabled) {
+                return $true
+            } else {return $false}
+          CODE
+          powershell_exec!(cmd).result
+        end
+      end
+
+      private
+
+      # build the command to load the current resource
+      # @return [String] current firewall state
+      def load_firewall_state(profile_name)
+        <<-EOH
+          Remove-TypeData System.Array # workaround for PS bug here: https://bit.ly/2SRMQ8M
+          $#{profile_name} = Get-NetFirewallProfile -Profile #{profile_name}
+          ([PSCustomObject]@{
+            default_inbound_action = $#{profile_name}.DefaultInboundAction.ToString()
+            default_outbound_action = $#{profile_name}.DefaultOutboundAction.ToString()
+            allow_inbound_rules = $#{profile_name}.AllowInboundRules.ToString()
+            allow_local_firewall_rules = $#{profile_name}.AllowLocalFirewallRules.ToString()
+            allow_local_ipsec_rules = $#{profile_name}.AllowLocalIPsecRules.ToString()
+            allow_user_apps = $#{profile_name}.AllowUserApps.ToString()
+            allow_user_ports = $#{profile_name}.AllowUserPorts.ToString()
+            allow_unicast_response = $#{profile_name}.AllowUnicastResponseToMulticast.ToString()
+            display_notification = $#{profile_name}.NotifyOnListen.ToString()
+          })
+        EOH
+      end
+    end
+  end
+end