chef 16.13.16-universal-mingw32 → 17.3.48-universal-mingw32

data/lib/chef/resource/windows_path.rb

@@ -64,7 +64,7 @@ class Chef
         end
       end
 
-      action :add do
+      action :add, description: "Add an item to the system path." do
         # The windows Env provider does not correctly expand variables in
         # the PATH environment variable. Ruby expects these to be expanded.
         #
@@ -72,11 +72,11 @@ class Chef
         env "path" do
           action :modify
           delim ::File::PATH_SEPARATOR
-          value path.tr("/", '\\')
+          value path.tr("/", "\\")
         end
       end
 
-      action :remove do
+      action :remove, description: "Remove an item from the system path." do
         # The windows Env provider does not correctly expand variables in
         # the PATH environment variable. Ruby expects these to be expanded.
         #
@@ -84,7 +84,7 @@ class Chef
         env "path" do
           action :delete
           delim ::File::PATH_SEPARATOR
-          value path.tr("/", '\\')
+          value path.tr("/", "\\")
         end
       end
     end

data/lib/chef/resource/windows_printer.rb

@@ -1,6 +1,7 @@
 #
 # Author:: Doug Ireton (<doug@1strategy.com>)
 # Copyright:: 2012-2018, Nordstrom, Inc.
+# Copyright:: Chef Software, Inc.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -21,6 +22,10 @@ require_relative "../resource"
 
 class Chef
   class Resource
+    # @todo
+    # 1. Allow updating the printer properties
+    # 2. Fail with a warning if the port can't be found and create_port is false
+    # 3. Fail with helpful messaging if the printer driver can't be installed
     class WindowsPrinter < Chef::Resource
       unified_mode true
 
@@ -28,7 +33,7 @@ class Chef
 
       provides(:windows_printer) { true }
 
-      description "Use the **windows_printer** resource to setup Windows printers. Note that this doesn't currently install a printer driver. You must already have the driver installed on the system."
+      description "Use the **windows_printer** resource to setup Windows printers. This resource will automatically install the driver specified in the `driver_name` property and will automatically create a printer port using either the `ipv4_address` property or the `port_name property."
       introduced "14.0"
       examples <<~DOC
       **Create a printer**:
@@ -49,6 +54,23 @@ class Chef
         action :delete
       end
       ```
+
+      **Create a printer port and a printer that uses that port (new in 17.3)**
+
+      ```ruby
+      windows_printer_port '10.4.64.39' do
+        port_name 'My awesome printer port'
+        snmp_enabled true
+        port_protocol 2
+      end
+
+      windows_printer 'HP LaserJet 5th Floor' do
+        driver_name 'HP LaserJet 4100 Series PCL6'
+        port_name 'My awesome printer port'
+        ipv4_address '10.4.64.38'
+        create_port false
+      end
+      ```
       DOC
 
       property :device_id, String,
@@ -83,82 +105,79 @@ class Chef
             proc { |v| v.match(Resolv::IPv4::Regex) },
         }
 
-      PRINTERS_REG_KEY = 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\\'.freeze unless defined?(PRINTERS_REG_KEY)
+      property :create_port, [TrueClass, FalseClass],
+        description: "Create a printer port for the printer. Set this to false and specify the `port_name` property if using the `windows_printer_port` resource to create the port instead.",
+        introduced: "17.3",
+        default: true, desired_state: false
 
-      # @todo Set @current_resource printer properties from registry
-      load_current_value do |desired|
-        name desired.name
-      end
+      property :port_name, String,
+        description: "The port name.",
+        default: lazy { |x| "IP_#{x.ipv4_address}" },
+        introduced: "17.3",
+        default_description: "The resource block name or the ipv4_address prepended with IP_."
 
-      action :create do
-        description "Create a new printer and a printer port if one doesn't already exist."
+      load_current_value do |new_resource|
+        printer_data = powershell_exec(%Q{Get-WmiObject -Class Win32_Printer -Filter "Name='#{new_resource.device_id}'"}).result
 
-        if printer_exists?
-          Chef::Log.info "#{@new_resource} already exists - nothing to do."
+        if printer_data.empty?
+          current_value_does_not_exist!
         else
-          converge_by("Create #{@new_resource}") do
-            create_printer
+          device_id new_resource.device_id
+          comment printer_data["Comment"]
+          default printer_data["Default"]
+          location printer_data["Location"]
+          shared printer_data["Shared"]
+          share_name printer_data["ShareName"]
+          port_name printer_data["PortName"]
+
+          driver_data = powershell_exec(%Q{Get-PrinterDriver -Name="#{new_resource.driver_name}"}).result
+          unless driver_data.empty?
+            driver_name new_resource.driver_name
           end
         end
       end
 
-      action :delete do
-        description "Delete an existing printer. Note this does not delete the associated printer port."
-
-        if printer_exists?
-          converge_by("Delete #{@new_resource}") do
-            delete_printer
-          end
+      action :create, description: "Create a new printer and printer port, if one doesn't already." do
+        if current_resource
+          Chef::Log.info "#{@new_resource} already exists - nothing to do."
         else
-          Chef::Log.info "#{@current_resource} doesn't exist - can't delete."
-        end
-      end
+          # Create the printer port first unless the property is set to false
+          if new_resource.create_port
+            windows_printer_port new_resource.port_name do
+              ipv4_address new_resource.ipv4_address
+              port_name new_resource.port_name
+            end
+          end
 
-      action_class do
-        private
-
-        # does the printer exist
-        #
-        # @param [String] name the name of the printer
-        # @return [Boolean]
-        def printer_exists?
-          printer_reg_key = PRINTERS_REG_KEY + new_resource.name
-          logger.trace "Checking to see if this reg key exists: '#{printer_reg_key}'"
-          registry_key_exists?(printer_reg_key)
-        end
+          converge_by("install driver #{new_resource.driver_name}") do
+            powershell_exec!("Add-PrinterDriver -Name '#{new_resource.driver_name}'")
+          end
 
-        # creates the printer port and then the printer
-        def create_printer
-          # Create the printer port first
-          windows_printer_port new_resource.ipv4_address
-
-          port_name = "IP_#{new_resource.ipv4_address}"
-
-          declare_resource(:powershell_script, "Creating printer: #{new_resource.device_id}") do
-            code <<-EOH
-
-              Set-WmiInstance -class Win32_Printer `
-                -EnableAllPrivileges `
-                -Argument @{ DeviceID   = "#{new_resource.device_id}";
-                            Comment    = "#{new_resource.comment}";
-                            Default    = "$#{new_resource.default}";
-                            DriverName = "#{new_resource.driver_name}";
-                            Location   = "#{new_resource.location}";
-                            PortName   = "#{port_name}";
-                            Shared     = "$#{new_resource.shared}";
-                            ShareName  = "#{new_resource.share_name}";
-                          }
+          converge_by("create #{@new_resource.device_id}") do
+            powershell_exec! <<-EOH
+            Set-WmiInstance -class Win32_Printer `
+              -EnableAllPrivileges `
+              -Argument @{ DeviceID   = "#{new_resource.device_id}";
+                          Comment    = "#{new_resource.comment}";
+                          Default    = "$#{new_resource.default}";
+                          DriverName = "#{new_resource.driver_name}";
+                          Location   = "#{new_resource.location}";
+                          PortName   = "#{new_resource.port_name}";
+                          Shared     = "$#{new_resource.shared}";
+                          ShareName  = "#{new_resource.share_name}";
+                        }
             EOH
           end
         end
+      end
 
-        def delete_printer
-          declare_resource(:powershell_script, "Deleting printer: #{new_resource.device_id}") do
-            code <<-EOH
-              $printer = Get-WMIObject -class Win32_Printer -EnableAllPrivileges -Filter "name = '#{new_resource.device_id}'"
-              $printer.Delete()
-            EOH
+      action :delete, description: "Delete an existing printer. Note that this resource does not delete the associated printer port." do
+        if current_resource
+          converge_by("Delete #{new_resource.device_id}") do
+            powershell_exec!("Remove-Printer -Name '#{new_resource.device_id}'")
           end
+        else
+          Chef::Log.info "#{new_resource.device_id} doesn't exist - can't delete."
         end
       end
     end

data/lib/chef/resource/windows_printer_port.rb

@@ -1,6 +1,7 @@
 #
 # Author:: Doug Ireton <doug@1strategy.com>
 # Copyright:: 2012-2018, Nordstrom, Inc.
+# Copyright:: Chef Software, Inc.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -68,14 +69,17 @@ class Chef
         }
 
       property :port_name, String,
-        description: "The port name."
+        description: "The port name.",
+        default: lazy { |x| "IP_#{x.ipv4_address}" },
+        default_description: "The resource block name or the ipv4_address prepended with IP_."
 
       property :port_number, Integer,
-        description: "The port number.",
+        description: "The TCP port number.",
         default: 9100
 
       property :port_description, String,
-        description: "The description of the port."
+        desired_state: false,
+        deprecated: true
 
       property :snmp_enabled, [TrueClass, FalseClass],
         description: "Determines if SNMP is enabled on the port.",
@@ -86,79 +90,58 @@ class Chef
         validation_message: "port_protocol must be either 1 for RAW or 2 for LPR!",
         default: 1, equal_to: [1, 2]
 
-      PORTS_REG_KEY = 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Monitors\Standard TCP/IP Port\Ports\\'.freeze unless defined?(PORTS_REG_KEY)
+      load_current_value do |new_resource|
+        port_data = powershell_exec(%Q{Get-WmiObject -Class Win32_TCPIPPrinterPort -Filter "Name='#{new_resource.port_name}'"}).result
 
-      # @todo Set @current_resource port properties from registry
-      load_current_value do |desired|
-        name desired.name
-        ipv4_address desired.ipv4_address
-        port_name desired.port_name || "IP_#{desired.ipv4_address}"
-      end
-
-      action :create do
-        description "Create the new printer port if it does not already exist."
-
-        if port_exists?
-          Chef::Log.info "#{@new_resource} already exists - nothing to do."
-        else
-          converge_by("Create #{@new_resource}") do
-            create_printer_port
-          end
-        end
-      end
-
-      action :delete do
-        description "Delete an existing printer port."
-
-        if port_exists?
-          converge_by("Delete #{@new_resource}") do
-            delete_printer_port
-          end
+        if port_data.empty?
+          current_value_does_not_exist!
         else
-          Chef::Log.info "#{@current_resource} doesn't exist - can't delete."
+          ipv4_address port_data["HostAddress"]
+          port_name port_data["Name"]
+          snmp_enabled port_data["SNMPEnabled"]
+          port_protocol port_data["Protocol"]
+          port_number port_data["PortNumber"]
         end
       end
 
-      action_class do
-        private
-
-        def port_exists?
-          name = new_resource.port_name || "IP_#{new_resource.ipv4_address}"
-          port_reg_key = PORTS_REG_KEY + name
-
-          logger.trace "Checking to see if this reg key exists: '#{port_reg_key}'"
-          registry_key_exists?(port_reg_key)
-        end
-
-        def create_printer_port
-          port_name = new_resource.port_name || "IP_#{new_resource.ipv4_address}"
-
-          # create the printer port using PowerShell
-          declare_resource(:powershell_script, "Creating printer port #{new_resource.port_name}") do
-            code <<-EOH
-
-              Set-WmiInstance -class Win32_TCPIPPrinterPort `
-                -EnableAllPrivileges `
-                -Argument @{ HostAddress = "#{new_resource.ipv4_address}";
-                            Name        = "#{port_name}";
-                            Description = "#{new_resource.port_description}";
-                            PortNumber  = "#{new_resource.port_number}";
-                            Protocol    = "#{new_resource.port_protocol}";
-                            SNMPEnabled = "$#{new_resource.snmp_enabled}";
-                          }
+      action :create, description: "Create or update the printer port." do
+        converge_if_changed do
+          if current_resource
+            # update the printer port using PowerShell
+            powershell_exec! <<-EOH
+            Get-WmiObject Win32_TCPIPPrinterPort -EnableAllPrivileges -filter "Name='#{new_resource.port_name}'" |
+            ForEach-Object{
+                 $_.HostAddress='#{new_resource.ipv4_address}'
+                 $_.PortNumber='#{new_resource.port_number}'
+                 $_.Protocol='#{new_resource.port_protocol}'
+                 $_.SNMPEnabled='$#{new_resource.snmp_enabled}'
+                 $_.Put()
+            }
+            EOH
+          else
+            # create the printer port using PowerShell
+            powershell_exec! <<-EOH
+            Set-WmiInstance -class Win32_TCPIPPrinterPort `
+              -EnableAllPrivileges `
+              -Argument @{ HostAddress = "#{new_resource.ipv4_address}";
+                          Name        = "#{new_resource.port_name}";
+                          PortNumber  = "#{new_resource.port_number}";
+                          Protocol    = "#{new_resource.port_protocol}";
+                          SNMPEnabled = "$#{new_resource.snmp_enabled}";
+                        }
             EOH
           end
-        end
 
-        def delete_printer_port
-          port_name = new_resource.port_name || "IP_#{new_resource.ipv4_address}"
+        end
+      end
 
-          declare_resource(:powershell_script, "Deleting printer port: #{new_resource.port_name}") do
-            code <<-EOH
-              $port = Get-WMIObject -class Win32_TCPIPPrinterPort -EnableAllPrivileges -Filter "name = '#{port_name}'"
-              $port.Delete()
-            EOH
+      action :delete, description: "Delete an existing printer port." do
+        if current_resource
+          converge_by("delete port #{new_resource.port_name}") do
+            powershell_exec!("Remove-PrinterPort -Name #{new_resource.port_name}")
           end
+        else
+          Chef::Log.info "#{new_resource.port_name} doesn't exist - can't delete."
         end
       end
     end

data/lib/chef/resource/windows_security_policy.rb

@@ -17,6 +17,7 @@
 # limitations under the License.
 
 require_relative "../resource"
+require "tempfile" unless defined?(Tempfile)
 
 class Chef
   class Resource
@@ -27,6 +28,7 @@ class Chef
 
       # The valid policy_names options found here
       # https://github.com/ChrisAWalker/cSecurityOptions under 'AccountSettings'
+      # This needs to be revisited - the list at the link above is non-exhaustive and is missing a couple of items
       policy_names = %w{LockoutDuration
                         MaximumPasswordAge
                         MinimumPasswordAge
@@ -35,6 +37,8 @@ class Chef
                         PasswordHistorySize
                         LockoutBadCount
                         ResetLockoutCount
+                        AuditPolicyChange
+                        LockoutDuration
                         RequireLogonToChangePassword
                         ForceLogoffWhenHourExpire
                         NewAdministratorName
@@ -43,7 +47,7 @@ class Chef
                         LSAAnonymousNameLookup
                         EnableAdminAccount
                         EnableGuestAccount
-                       }
+                      }
       description "Use the **windows_security_policy** resource to set a security policy on the Microsoft Windows platform."
       introduced "16.0"
 
@@ -82,7 +86,56 @@ class Chef
       property :secvalue, String, required: true,
       description: "Policy value to be set for policy name."
 
-      load_current_value do |desired|
+      load_current_value do |new_resource|
+        current_state = load_security_options
+
+        if new_resource.secoption == "ResetLockoutCount"
+          if new_resource.secvalue.to_i > current_state["LockoutDuration"].to_i
+            raise Chef::Exceptions::ValidationFailed, "The \"ResetLockoutCount\" value cannot be greater than the value currently set for \"LockoutDuration\""
+          end
+        end
+        if (new_resource.secoption == "ResetLockoutCount" || new_resource.secoption == "LockoutDuration") && current_state["LockoutBadCount"] == "0"
+          raise Chef::Exceptions::ValidationFailed, "#{new_resource.secoption} cannot be set unless the \"LockoutBadCount\" security policy has been set to a non-zero value"
+        end
+
+        secvalue current_state[new_resource.secoption.to_s]
+      end
+
+      action :set, description: "Set the Windows security policy" do
+        converge_if_changed :secvalue do
+          security_option = new_resource.secoption
+          security_value = new_resource.secvalue
+
+          file = Tempfile.new(["#{security_option}", ".inf"])
+          case security_option
+          when "LockoutBadCount"
+            cmd = "net accounts /LockoutThreshold:#{security_value}"
+          when "ResetLockoutCount"
+            cmd = "net accounts /LockoutWindow:#{security_value}"
+          when "LockoutDuration"
+            cmd = "net accounts /LockoutDuration:#{security_value}"
+          when "NewAdministratorName", "NewGuestName"
+            policy_line = "#{security_option} = \"#{security_value}\""
+            file.write("[Unicode]\r\nUnicode=yes\r\n[System Access]\r\n#{policy_line}\r\n[Version]\r\nsignature=\"$CHICAGO$\"\r\nRevision=1\r\n")
+            file.close
+            file_path = file.path.tr("/", "\\")
+            cmd = "C:\\Windows\\System32\\secedit /configure /db C:\\windows\\security\\new.sdb /cfg #{file_path} /areas SECURITYPOLICY"
+          else
+            policy_line = "#{security_option} = #{security_value}"
+            file.write("[Unicode]\r\nUnicode=yes\r\n[System Access]\r\n#{policy_line}\r\n[Version]\r\nsignature=\"$CHICAGO$\"\r\nRevision=1\r\n")
+            file.close
+            file_path = file.path.tr("/", "\\")
+            cmd = "C:\\Windows\\System32\\secedit /configure /db C:\\windows\\security\\new.sdb /cfg #{file_path} /areas SECURITYPOLICY"
+          end
+          shell_out!(cmd)
+          file.unlink
+        end
+      end
+
+      private
+
+      # Loads powershell to get current state on security options
+      def load_security_options
         powershell_code = <<-CODE
           C:\\Windows\\System32\\secedit /export /cfg $env:TEMP\\secopts_export.inf | Out-Null
           # cspell:disable-next-line
@@ -108,44 +161,7 @@ class Chef
             LockoutBadCount = $security_options_hash.LockoutBadCount
           })
         CODE
-        output = powershell_exec(powershell_code)
-        current_value_does_not_exist! if output.result.empty?
-        state = output.result
-
-        if desired.secoption == "ResetLockoutCount" || desired.secoption == "LockoutDuration"
-          if state["LockoutBadCount"] == "0"
-            raise Chef::Exceptions::ValidationFailed.new "#{desired.secoption} cannot be set unless the \"LockoutBadCount\" security policy has been set to a non-zero value"
-          else
-            secvalue state[desired.secoption.to_s]
-          end
-        else
-          secvalue state[desired.secoption.to_s]
-        end
-      end
-
-      action :set do
-        converge_if_changed :secvalue do
-          security_option = new_resource.secoption
-          security_value = new_resource.secvalue
-
-          cmd = <<-EOH
-            $security_option = "#{security_option}"
-            C:\\Windows\\System32\\secedit /export /cfg $env:TEMP\\#{security_option}_Export.inf
-            if ( ($security_option -match "NewGuestName") -Or ($security_option -match "NewAdministratorName") )
-              {
-                $#{security_option}_Remediation = (Get-Content $env:TEMP\\#{security_option}_Export.inf) | Foreach-Object { $_ -replace '#{security_option}\\s*=\\s*\\"\\w*\\"', '#{security_option} = "#{security_value}"' } | Set-Content $env:TEMP\\#{security_option}_Export.inf
-                C:\\Windows\\System32\\secedit /configure /db $env:windir\\security\\new.sdb /cfg $env:TEMP\\#{security_option}_Export.inf /areas SECURITYPOLICY
-              }
-            else
-              {
-                $#{security_option}_Remediation = (Get-Content $env:TEMP\\#{security_option}_Export.inf) | Foreach-Object { $_ -replace "#{security_option}\\s*=\\s*\\d*", "#{security_option} = #{security_value}" } | Set-Content $env:TEMP\\#{security_option}_Export.inf
-                C:\\Windows\\System32\\secedit /configure /db $env:windir\\security\\new.sdb /cfg $env:TEMP\\#{security_option}_Export.inf /areas SECURITYPOLICY
-              }
-            Remove-Item $env:TEMP\\#{security_option}_Export.inf -force
-          EOH
-
-          powershell_exec!(cmd)
-        end
+        powershell_exec(powershell_code).result
       end
     end
   end