chef 18.6.2-universal-mingw-ucrt

data/lib/chef/resource/windows_defender.rb

@@ -0,0 +1,162 @@
+#
+# Copyright:: Chef Software, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+require_relative "../resource"
+
+class Chef
+  class Resource
+    class WindowsDefender < Chef::Resource
+      provides :windows_defender
+
+      description "Use the **windows_defender** resource to enable or disable the Microsoft Windows Defender service."
+      introduced "17.3"
+      examples <<~DOC
+      **Configure Windows Defender AV settings**:
+
+      ```ruby
+      windows_defender 'Configure Defender' do
+        realtime_protection true
+        intrusion_protection_system true
+        lock_ui true
+        scan_archives true
+        scan_scripts true
+        scan_email true
+        scan_removable_drives true
+        scan_network_files false
+        scan_mapped_drives false
+        action :enable
+      end
+      ```
+
+      **Disable Windows Defender AV**:
+
+      ```ruby
+      windows_defender 'Disable Defender' do
+        action :disable
+      end
+      ```
+      DOC
+
+      # DisableIOAVProtection
+      property :realtime_protection, [true, false],
+        default: true,
+        description: "Enable realtime scanning of downloaded files and attachments."
+
+      # DisableIntrusionPreventionSystem
+      property :intrusion_protection_system, [true, false],
+        default: true,
+        description: "Enable network protection against exploitation of known vulnerabilities."
+
+      # UILockdown
+      property :lock_ui, [true, false],
+        description: "Lock the UI to prevent users from changing Windows Defender settings.",
+        default: false
+
+      # DisableArchiveScanning
+      property :scan_archives, [true, false],
+        default: true,
+        description: "Scan file archives such as .zip or .gz archives."
+
+      # DisableScriptScanning
+      property :scan_scripts, [true, false],
+        default: false,
+        description: "Scan scripts in malware scans."
+
+      # DisableEmailScanning
+      property :scan_email, [true, false],
+        default: false,
+        description: "Scan e-mails for malware."
+
+      # DisableRemovableDriveScanning
+      property :scan_removable_drives, [true, false],
+        default: false,
+        description: "Scan content of removable drives."
+
+      # DisableScanningNetworkFiles
+      property :scan_network_files, [true, false],
+        default: false,
+        description: "Scan files on a network."
+
+      # DisableScanningMappedNetworkDrivesForFullScan
+      property :scan_mapped_drives, [true, false],
+        default: true,
+        description: "Scan files on mapped network drives."
+
+      load_current_value do
+        values = powershell_exec!("Get-MPpreference").result
+
+        lock_ui values["UILockdown"]
+        realtime_protection !values["DisableIOAVProtection"]
+        intrusion_protection_system !values["DisableIntrusionPreventionSystem"]
+        scan_archives !values["DisableArchiveScanning"]
+        scan_scripts !values["DisableScriptScanning"]
+        scan_email !values["DisableEmailScanning"]
+        scan_removable_drives !values["DisableRemovableDriveScanning"]
+        scan_network_files !values["DisableScanningNetworkFiles"]
+        scan_mapped_drives !values["DisableScanningMappedNetworkDrivesForFullScan"]
+      end
+
+      action :enable, description: "Enable and configure Windows Defender." do
+        windows_service "Windows Defender" do
+          service_name "WinDefend"
+          action %i{start enable}
+          startup_type :automatic
+        end
+
+        converge_if_changed do
+          powershell_exec!(set_mppreference_cmd)
+        end
+      end
+
+      action :disable, description: "Disable Windows Defender." do
+        windows_service "Windows Defender" do
+          service_name "WinDefend"
+          action %i{disable stop}
+        end
+      end
+
+      action_class do
+        require "chef/mixin/powershell_type_coercions"
+        include Chef::Mixin::PowershellTypeCoercions
+
+        PROPERTY_TO_PS_MAP = {
+          realtime_protection: "DisableIOAVProtection",
+          intrusion_protection_system: "DisableIntrusionPreventionSystem",
+          scan_archives: "DisableArchiveScanning",
+          scan_scripts: "DisableScriptScanning",
+          scan_email: "DisableEmailScanning",
+          scan_removable_drives: "DisableRemovableDriveScanning",
+          scan_network_files: "DisableScanningNetworkFiles",
+          scan_mapped_drives: "DisableScanningMappedNetworkDrivesForFullScan",
+        }.freeze
+
+        def set_mppreference_cmd
+          cmd = "Set-MpPreference -Force"
+          cmd << " -UILockdown #{type_coercion(new_resource.lock_ui)}"
+
+          # the values are the opposite in Set-MpPreference and our properties so we have to iterate
+          # over the list and negate the provided values so it makes sense with the cmdlet flag's expected value
+          PROPERTY_TO_PS_MAP.each do |prop, flag|
+            next if new_resource.send(prop).nil? || current_resource.send(prop) == new_resource.send(prop)
+
+            cmd << " -#{flag} #{type_coercion(!new_resource.send(prop))}"
+          end
+          cmd
+        end
+      end
+    end
+  end
+end

data/lib/chef/resource/windows_defender_exclusion.rb

@@ -0,0 +1,124 @@
+#
+# Copyright:: Chef Software, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+require_relative "../resource"
+
+class Chef
+  class Resource
+    class WindowsDefenderExclusion < Chef::Resource
+
+      provides :windows_defender_exclusion
+
+      description "Use the **windows_defender_exclusion** resource to exclude paths, processes, or file types from Windows Defender realtime protection scanning."
+      introduced "17.3"
+      examples <<~DOC
+      **Add excluded items to Windows Defender scans**:
+
+      ```ruby
+      windows_defender_exclusion 'Add to things to be excluded from scanning' do
+        paths 'c:\\foo\\bar, d:\\bar\\baz'
+        extensions 'png, foo, ppt, doc'
+        process_paths 'c:\\windows\\system32'
+        action :add
+      end
+      ```
+
+      **Remove excluded items from Windows Defender scans**:
+
+      ```ruby
+      windows_defender_exclusion 'Remove things from the list to be excluded' do
+        process_paths 'c:\\windows\\system32'
+        action :remove
+      end
+      ```
+      DOC
+
+      property :paths, [String, Array], default: [],
+        coerce: proc { |x| to_consistent_path_array(x) },
+        description: "File or directory paths to exclude from scanning."
+
+      property :extensions, [String, Array], default: [],
+        coerce: proc { |x| to_consistent_path_array(x) },
+        description: "File extensions to exclude from scanning."
+
+      property :process_paths, [String, Array], default: [],
+        coerce: proc { |x| to_consistent_path_array(x) },
+        description: "Paths to executables to exclude from scanning."
+
+      def to_consistent_path_array(x)
+        fixed = x.dup || []
+        fixed = fixed.split(/\s*,\s*/) if fixed.is_a?(String)
+        fixed.map!(&:downcase)
+        fixed.map! { |v| v.gsub(%r{/}, "\\") }
+        fixed
+      end
+
+      load_current_value do |new_resource|
+        Chef::Log.debug("Running 'Get-MpPreference | Select-Object ExclusionExtension,ExclusionPath,ExclusionProcess' to get Windows Defender State")
+
+        values = powershell_exec!("Get-MPpreference | Select-Object ExclusionExtension,ExclusionPath,ExclusionProcess").result
+
+        values.transform_values! { |x| Array(x) }
+
+        paths new_resource.paths & values["ExclusionPath"]
+        extensions new_resource.extensions & values["ExclusionExtension"]
+        process_paths new_resource.process_paths & values["ExclusionProcess"]
+      end
+
+      action :add, description: "Add an exclusion to Windows Defender." do
+        converge_if_changed do
+          powershell_exec!(add_cmd)
+        end
+      end
+
+      action :remove, description: "Remove an exclusion to Windows Defender." do
+        converge_if_changed do
+          powershell_exec!(remove_cmd)
+        end
+      end
+
+      action_class do
+        MAPPING = {
+          paths: "ExclusionPath",
+          extensions: "ExclusionExtension",
+          process_paths: "ExclusionProcess",
+        }.freeze
+
+        def add_cmd
+          cmd = "Add-MpPreference -Force"
+
+          MAPPING.each do |prop, flag|
+            to_add = new_resource.send(prop) - current_resource.send(prop)
+            cmd << " -#{flag} #{to_add.join(",")}" unless to_add.empty?
+          end
+
+          cmd
+        end
+
+        def remove_cmd
+          cmd = "Remove-MpPreference -Force"
+
+          MAPPING.each do |prop, flag|
+            to_add = new_resource.send(prop) & current_resource.send(prop)
+            cmd << " -#{flag} #{to_add.join(",")}" unless to_add.empty?
+          end
+
+          cmd
+        end
+      end
+    end
+  end
+end

data/lib/chef/resource/windows_dfs_folder.rb

@@ -0,0 +1,72 @@
+#
+# Author:: Jason Field
+#
+# Copyright:: 2018, Calastone Ltd.
+# Copyright:: Copyright (c) Chef Software Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+require_relative "../resource"
+
+class Chef
+  class Resource
+    class WindowsDfsFolder < Chef::Resource
+
+      provides :windows_dfs_folder
+
+      description "Use the **windows_dfs_folder** resource to creates a folder within DFS as many levels deep as required."
+      introduced "15.0"
+
+      property :folder_path, String,
+        description: "An optional property to set the path of the dfs folder if it differs from the resource block's name.",
+        name_property: true
+
+      property :namespace_name, String,
+        description: "The namespace this should be created within.",
+        required: true
+
+      property :target_path, String,
+        description: "The target that this path will connect you to."
+
+      property :description, String,
+        description: "Description for the share."
+
+      action :create, description: "Creates the folder in dfs namespace." do
+        raise "target_path is required for install" unless property_is_set?(:target_path)
+        raise "description is required for install" unless property_is_set?(:description)
+
+        powershell_script "Create or Update DFS Folder" do
+          code <<-EOH
+
+            $needs_creating = (Get-DfsnFolder -Path '\\\\#{ENV["COMPUTERNAME"]}\\#{new_resource.namespace_name}\\#{new_resource.folder_path}' -ErrorAction SilentlyContinue) -eq $null
+            if (!($needs_creating))
+            {
+              Remove-DfsnFolder -Path '\\\\#{ENV["COMPUTERNAME"]}\\#{new_resource.namespace_name}\\#{new_resource.folder_path}' -Force
+            }
+              New-DfsnFolder -Path '\\\\#{ENV["COMPUTERNAME"]}\\#{new_resource.namespace_name}\\#{new_resource.folder_path}' -TargetPath '#{new_resource.target_path}' -Description '#{new_resource.description}'
+          EOH
+          not_if "return ((Get-DfsnFolder -Path '\\\\#{ENV["COMPUTERNAME"]}\\#{new_resource.namespace_name}\\#{new_resource.folder_path}' -ErrorAction SilentlyContinue).Description -eq '#{new_resource.description}' -and  (Get-DfsnFolderTarget -Path '\\\\#{ENV["COMPUTERNAME"]}\\#{new_resource.namespace_name}\\#{new_resource.folder_path}').TargetPath -eq '#{new_resource.target_path}' )"
+        end
+      end
+
+      action :delete, description: "Deletes the folder in the dfs namespace." do
+        powershell_script "Delete DFS Namespace" do
+          code <<-EOH
+            Remove-DfsnFolder -Path '\\\\#{ENV["COMPUTERNAME"]}\\#{new_resource.namespace_name}\\#{new_resource.folder_path}' -Force
+          EOH
+          only_if "return ((Get-DfsnFolder -Path '\\\\#{ENV["COMPUTERNAME"]}\\#{new_resource.namespace_name}\\#{new_resource.folder_path}' ) -ne $null)"
+        end
+      end
+    end
+  end
+end

data/lib/chef/resource/windows_dfs_namespace.rb

@@ -0,0 +1,110 @@
+#
+# Author:: Jason Field
+#
+# Copyright:: 2018, Calastone Ltd.
+# Copyright:: Copyright (c) Chef Software Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+require_relative "../resource"
+
+class Chef
+  class Resource
+    class WindowsDfsNamespace < Chef::Resource
+
+      provides :windows_dfs_namespace
+
+      description "Use the **windows_dfs_namespace** resource to creates a share and DFS namespace on a Windows server."
+      introduced "15.0"
+
+      property :namespace_name, String,
+        description: "An optional property to set the dfs namespace if it differs from the resource block's name.",
+        name_property: true
+
+      property :description, String,
+        description: "Description of the share.",
+        required: true
+
+      property :full_users, Array,
+        description: "Determines which users should have full access to the share.",
+        default: ["BUILTIN\\administrators"]
+
+      property :change_users, Array,
+        description: "Determines which users should have change access to the share.",
+        default: []
+
+      property :read_users, Array,
+        description: "Determines which users should have read access to the share.",
+        default: []
+
+      property :root, String,
+        description: "The root from which to create the DFS tree. Defaults to C:\\DFSRoots.",
+        default: "C:\\DFSRoots"
+
+      action :create, description: "Creates the dfs namespace on the server." do
+        directory file_path do
+          action :create
+          recursive true
+        end
+
+        windows_share new_resource.namespace_name do
+          action :create
+          path file_path
+          full_users new_resource.full_users
+          change_users new_resource.change_users
+          read_users new_resource.read_users
+        end
+
+        powershell_script "Create DFS Namespace" do
+          code <<-EOH
+            $needs_creating = (Get-DfsnRoot -Path '\\\\#{ENV["COMPUTERNAME"]}\\#{new_resource.namespace_name}' -ErrorAction SilentlyContinue) -eq $null
+            if ($needs_creating)
+            {
+                New-DfsnRoot -Path '\\\\#{ENV["COMPUTERNAME"]}\\#{new_resource.namespace_name}' -TargetPath '\\\\#{ENV["COMPUTERNAME"]}\\#{new_resource.namespace_name}' -Type Standalone -Description '#{new_resource.description}'
+            }
+            else
+            {
+                Set-DfsnRoot -Path '\\\\#{ENV["COMPUTERNAME"]}\\#{new_resource.namespace_name}' -Description '#{new_resource.description}'
+            }
+          EOH
+          not_if "return (Get-DfsnRoot -Path '\\\\#{ENV["COMPUTERNAME"]}\\#{new_resource.namespace_name}' -ErrorAction SilentlyContinue).description -eq '#{new_resource.description}'"
+        end
+      end
+
+      action :delete, description: "Deletes a DFS Namespace including the directory on disk." do
+        powershell_script "Delete DFS Namespace" do
+          code <<-EOH
+            Remove-DfsnRoot -Path '\\\\#{ENV["COMPUTERNAME"]}\\#{new_resource.namespace_name}' -Force
+          EOH
+          only_if "return ((Get-DfsnRoot -Path '\\\\#{ENV["COMPUTERNAME"]}\\#{new_resource.namespace_name}') -ne $null)"
+        end
+
+        windows_share new_resource.namespace_name do
+          action :delete
+          path file_path
+        end
+
+        directory file_path do
+          action :delete
+          recursive false # I will remove the top level but not any sub levels.
+        end
+      end
+
+      action_class do
+        def file_path
+          "#{new_resource.root}\\#{new_resource.namespace_name}"
+        end
+      end
+    end
+  end
+end

data/lib/chef/resource/windows_dfs_server.rb

@@ -0,0 +1,77 @@
+#
+# Author:: Jason Field
+#
+# Copyright:: 2018, Calastone Ltd.
+# Copyright:: Copyright (c) Chef Software Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+require_relative "../resource"
+
+class Chef
+  class Resource
+    class WindowsDfsServer < Chef::Resource
+
+      provides :windows_dfs_server
+
+      description "Use the **windows_dfs_server** resource to set system-wide DFS settings."
+      introduced "15.0"
+
+      property :use_fqdn, [TrueClass, FalseClass],
+        description: "Indicates whether a DFS namespace server uses FQDNs in referrals. If this property is set to true, the server uses FQDNs in referrals. If this property is set to false then the server uses NetBIOS names.",
+        default: false
+
+      property :ldap_timeout_secs, Integer,
+        description: "",
+        default: 30
+
+      property :prefer_login_dc, [TrueClass, FalseClass],
+        description: "",
+        default: false
+
+      property :enable_site_costed_referrals, [TrueClass, FalseClass],
+        description: "",
+        default: false
+
+      property :sync_interval_secs, Integer,
+        description: "",
+        default: 3600
+
+      load_current_value do
+        ps_results = powershell_exec("Get-DfsnServerConfiguration -ComputerName '#{ENV["COMPUTERNAME"]}' | Select LdapTimeoutSec, PreferLogonDC, EnableSiteCostedReferrals, SyncIntervalSec, UseFqdn")
+
+        if ps_results.error?
+          raise "The dfs_server resource failed to fetch the current state via the Get-DfsnServerConfiguration PowerShell cmdlet. Is the DFS Windows feature installed?"
+        end
+
+        Chef::Log.debug("The Get-DfsnServerConfiguration results were #{ps_results.result}")
+        results = ps_results.result
+
+        use_fqdn results["UseFqdn"] || false
+        ldap_timeout_secs results["LdapTimeoutSec"]
+        prefer_login_dc results["PreferLogonDC"] || false
+        enable_site_costed_referrals results["EnableSiteCostedReferrals"] || false
+        sync_interval_secs results["SyncIntervalSec"]
+      end
+
+      action :configure, description: "Configure DFS settings" do
+        converge_if_changed do
+          dfs_cmd = "Set-DfsnServerConfiguration -ComputerName '#{ENV["COMPUTERNAME"]}' -UseFqdn $#{new_resource.use_fqdn} -LdapTimeoutSec #{new_resource.ldap_timeout_secs} -SyncIntervalSec #{new_resource.sync_interval_secs}"
+          dfs_cmd << " -EnableSiteCostedReferrals $#{new_resource.enable_site_costed_referrals}" if new_resource.enable_site_costed_referrals != current_resource.enable_site_costed_referrals
+          dfs_cmd << " -PreferLogonDC $#{new_resource.prefer_login_dc}" if new_resource.prefer_login_dc != current_resource.prefer_login_dc
+          powershell_exec!(dfs_cmd)
+        end
+      end
+    end
+  end
+end

data/lib/chef/resource/windows_dns_record.rb

@@ -0,0 +1,90 @@
+#
+# Author:: Jason Field
+#
+# Copyright:: 2018, Calastone Ltd.
+# Copyright:: Copyright (c) Chef Software Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+require_relative "../resource"
+
+class Chef
+  class Resource
+    class WindowsDnsRecord < Chef::Resource
+
+      provides :windows_dns_record
+
+      description "The windows_dns_record resource creates a DNS record for the given domain."
+      introduced "15.0"
+
+      property :record_name, String,
+        description: "An optional property to set the dns record name if it differs from the resource block's name.",
+        name_property: true
+
+      property :zone, String,
+        description: "The zone to create the record in.",
+        required: true
+
+      property :target, String,
+        description: "The target for the record.",
+        required: true
+
+      property :record_type, String,
+        description: "The type of record to create, can be either ARecord, CNAME or PTR.",
+        default: "ARecord", equal_to: %w{ARecord CNAME PTR}
+
+      property :dns_server, String,
+        description: "The name of the DNS server on which to create the record.",
+        default: "localhost",
+        introduced: "16.3"
+
+      action :create, description: "Creates and updates the DNS entry." do
+        windows_feature "RSAT-DNS-Server" do
+          not_if new_resource.dns_server.casecmp?("localhost")
+        end
+
+        powershell_package "xDnsServer"
+
+        run_dsc_resource "Present"
+      end
+
+      action :delete, description: "Deletes a DNS entry." do
+        windows_feature "RSAT-DNS-Server" do
+          not_if new_resource.dns_server.casecmp?("localhost")
+        end
+
+        powershell_package "xDnsServer"
+
+        run_dsc_resource "Absent"
+      end
+
+      action_class do
+        private
+
+        # @api private
+        def run_dsc_resource(ensure_prop)
+          dsc_resource "xDnsRecord #{new_resource.record_name}.#{new_resource.zone} #{ensure_prop}" do
+            module_name "xDnsServer"
+            resource :xDnsRecord
+            property :Ensure, ensure_prop
+            property :Name, new_resource.record_name
+            property :Zone, new_resource.zone
+            property :Type, new_resource.record_type
+            property :Target, new_resource.target
+            property :DnsServer, new_resource.dns_server
+          end
+        end
+      end
+    end
+  end
+end