openvox 8.19.0

data/lib/puppet/type/resources.rb

@@ -0,0 +1,192 @@
+# frozen_string_literal: true
+
+require_relative '../../puppet'
+require_relative '../../puppet/parameter/boolean'
+
+Puppet::Type.newtype(:resources) do
+  @doc = "This is a metatype that can manage other resource types.  Any
+    metaparams specified here will be passed on to any generated resources,
+    so you can purge unmanaged resources but set `noop` to true so the
+    purging is only logged and does not actually happen."
+
+  apply_to_all
+
+  newparam(:name) do
+    desc "The name of the type to be managed."
+
+    validate do |name|
+      raise ArgumentError, _("Could not find resource type '%{name}'") % { name: name } unless Puppet::Type.type(name)
+    end
+
+    munge(&:to_s)
+  end
+
+  newparam(:purge, :boolean => true, :parent => Puppet::Parameter::Boolean) do
+    desc "Whether to purge unmanaged resources.  When set to `true`, this will
+      delete any resource that is not specified in your configuration and is not
+      autorequired by any managed resources. **Note:** The `ssh_authorized_key`
+      resource type can't be purged this way; instead, see the `purge_ssh_keys`
+      attribute of the `user` type."
+
+    defaultto :false
+
+    validate do |value|
+      if munge(value)
+        unless @resource.resource_type.respond_to?(:instances)
+          raise ArgumentError, _("Purging resources of type %{res_type} is not supported, since they cannot be queried from the system") % { res_type: @resource[:name] }
+        end
+        raise ArgumentError, _("Purging is only supported on types that accept 'ensure'") unless @resource.resource_type.validproperty?(:ensure)
+      end
+    end
+  end
+
+  newparam(:unless_system_user) do
+    desc "This keeps system users from being purged.  By default, it
+      does not purge users whose UIDs are less than the minimum UID for the system (typically 500 or 1000), but you can specify
+      a different UID as the inclusive limit."
+
+    newvalues(:true, :false, /^\d+$/)
+
+    munge do |value|
+      case value
+      when /^\d+/
+        Integer(value)
+      when :true, true
+        @resource.class.system_users_max_uid
+      when :false, false
+        false
+      when Integer; value
+      else
+        raise ArgumentError, _("Invalid value %{value}") % { value: value.inspect }
+      end
+    end
+
+    defaultto {
+      if @resource[:name] == "user"
+        @resource.class.system_users_max_uid
+      else
+        nil
+      end
+    }
+  end
+
+  newparam(:unless_uid) do
+    desc 'This keeps specific uids or ranges of uids from being purged when purge is true.
+      Accepts integers, integer strings, and arrays of integers or integer strings.
+      To specify a range of uids, consider using the range() function from stdlib.'
+
+    munge do |value|
+      value = [value] unless value.is_a? Array
+      value.flatten.collect do |v|
+        case v
+        when Integer
+          v
+        when String
+          Integer(v)
+        else
+          raise ArgumentError, _("Invalid value %{value}.") % { value: v.inspect }
+        end
+      end
+    end
+  end
+
+  WINDOWS_SYSTEM_SID_REGEXES =
+    # Administrator, Guest, Domain Admins, Schema Admins, Enterprise Admins.
+    # https://support.microsoft.com/en-us/help/243330/well-known-security-identifiers-in-windows-operating-systems
+    [/S-1-5-21.+-500/, /S-1-5-21.+-501/, /S-1-5-21.+-512/, /S-1-5-21.+-518/,
+     /S-1-5-21.+-519/]
+
+  def check(resource)
+    @checkmethod ||= "#{self[:name]}_check"
+    @hascheck ||= respond_to?(@checkmethod)
+    if @hascheck
+      send(@checkmethod, resource)
+    else
+      true
+    end
+  end
+
+  def able_to_ensure_absent?(resource)
+    resource[:ensure] = :absent
+  rescue ArgumentError, Puppet::Error
+    err _("The 'ensure' attribute on %{name} resources does not accept 'absent' as a value") % { name: self[:name] }
+    false
+  end
+
+  # Generate any new resources we need to manage.  This is pretty hackish
+  # right now, because it only supports purging.
+  def generate
+    return [] unless purge?
+
+    resource_type.instances
+                 .reject { |r| catalog.resource_refs.include? r.ref }
+                 .select { |r| check(r) }
+                 .select { |r| r.class.validproperty?(:ensure) }
+                 .select { |r| able_to_ensure_absent?(r) }
+                 .each { |resource|
+      resource.copy_metaparams(@parameters)
+      resource.purging
+    }
+  end
+
+  def resource_type
+    unless defined?(@resource_type)
+      type = Puppet::Type.type(self[:name])
+      unless type
+        raise Puppet::DevError, _("Could not find resource type")
+      end
+
+      @resource_type = type
+    end
+    @resource_type
+  end
+
+  # Make sure we don't purge users with specific uids
+  def user_check(resource)
+    return true unless self[:name] == "user"
+    return true unless self[:unless_system_user]
+
+    resource[:audit] = :uid
+    current_values = resource.retrieve_resource
+    current_uid = current_values[resource.property(:uid)]
+    unless_uids = self[:unless_uid]
+
+    return false if system_users.include?(resource[:name])
+    return false if unless_uids && unless_uids.include?(current_uid)
+
+    if current_uid.is_a?(String)
+      # Windows user; is a system user if any regex matches.
+      WINDOWS_SYSTEM_SID_REGEXES.none? { |regex| current_uid =~ regex }
+    else
+      current_uid > self[:unless_system_user]
+    end
+  end
+
+  def system_users
+    %w[root nobody bin noaccess daemon sys]
+  end
+
+  def self.system_users_max_uid
+    return @system_users_max_uid if @system_users_max_uid
+
+    # First try to read the minimum user id from login.defs
+    if Puppet::FileSystem.exist?('/etc/login.defs')
+      @system_users_max_uid = Puppet::FileSystem.each_line '/etc/login.defs' do |line|
+        break Regexp.last_match(1).to_i - 1 if line =~ /^\s*UID_MIN\s+(\d+)(\s*#.*)?$/
+      end
+    end
+
+    # Otherwise, use a sensible default based on the OS family
+    @system_users_max_uid ||=
+      case Puppet.runtime[:facter].value('os.family')
+      when 'OpenBSD', 'FreeBSD' then 999
+      else                           499
+      end
+
+    @system_users_max_uid
+  end
+
+  def self.reset_system_users_max_uid!
+    @system_users_max_uid = nil
+  end
+end

data/lib/puppet/type/schedule.rb

@@ -0,0 +1,441 @@
+# frozen_string_literal: true
+
+module Puppet
+  Type.newtype(:schedule) do
+    @doc = <<-'EOT'
+      Define schedules for Puppet. Resources can be limited to a schedule by using the
+      [`schedule`](https://puppet.com/docs/puppet/latest/metaparameter.html#schedule)
+      metaparameter.
+
+      Currently, **schedules can only be used to stop a resource from being
+      applied;** they cannot cause a resource to be applied when it otherwise
+      wouldn't be, and they cannot accurately specify a time when a resource
+      should run.
+
+      Every time Puppet applies its configuration, it will apply the
+      set of resources whose schedule does not eliminate them from
+      running right then, but there is currently no system in place to
+      guarantee that a given resource runs at a given time.  If you
+      specify a very  restrictive schedule and Puppet happens to run at a
+      time within that schedule, then the resources will get applied;
+      otherwise, that work may never get done.
+
+      Thus, it is advisable to use wider scheduling (for example, over a couple
+      of hours) combined with periods and repetitions.  For instance, if you
+      wanted to restrict certain resources to only running once, between
+      the hours of two and 4 AM, then you would use this schedule:
+
+          schedule { 'maint':
+            range  => '2 - 4',
+            period => daily,
+            repeat => 1,
+          }
+
+      With this schedule, the first time that Puppet runs between 2 and 4 AM,
+      all resources with this schedule will get applied, but they won't
+      get applied again between 2 and 4 because they will have already
+      run once that day, and they won't get applied outside that schedule
+      because they will be outside the scheduled range.
+
+      Puppet automatically creates a schedule for each of the valid periods
+      with the same name as that period (such as hourly and daily).
+      Additionally, a schedule named `puppet` is created and used as the
+      default, with the following attributes:
+
+          schedule { 'puppet':
+            period => hourly,
+            repeat => 2,
+          }
+
+      This will cause resources to be applied every 30 minutes by default.
+
+      The `statettl` setting on the agent affects the ability of a schedule to
+      determine if a resource has already been checked. If the `statettl` is
+      set lower than the span of the associated schedule resource, then a
+      resource could be checked & applied multiple times in the schedule as
+      the information about when the resource was last checked will have
+      expired from the cache.
+    EOT
+
+    apply_to_all
+
+    newparam(:name) do
+      desc <<-EOT
+        The name of the schedule.  This name is used when assigning the schedule
+        to a resource with the `schedule` metaparameter:
+
+            schedule { 'everyday':
+              period => daily,
+              range  => '2 - 4',
+            }
+
+            exec { '/usr/bin/apt-get update':
+              schedule => 'everyday',
+            }
+
+      EOT
+      isnamevar
+    end
+
+    newparam(:range) do
+      desc <<-EOT
+        The earliest and latest that a resource can be applied.  This is
+        always a hyphen-separated range within a 24 hour period, and hours
+        must be specified in numbers between 0 and 23, inclusive.  Minutes and
+        seconds can optionally be provided, using the normal colon as a
+        separator. For instance:
+
+            schedule { 'maintenance':
+              range => '1:30 - 4:30',
+            }
+
+        This is mostly useful for restricting certain resources to being
+        applied in maintenance windows or during off-peak hours. Multiple
+        ranges can be applied in array context. As a convenience when specifying
+        ranges, you can cross midnight (for example, `range => "22:00 - 04:00"`).
+      EOT
+
+      # This is lame; properties all use arrays as values, but parameters don't.
+      # That's going to hurt eventually.
+      validate do |values|
+        values = [values] unless values.is_a?(Array)
+        values.each { |value|
+          unless value.is_a?(String) and
+                 value =~ /\d+(:\d+){0,2}\s*-\s*\d+(:\d+){0,2}/
+            self.fail _("Invalid range value '%{value}'") % { value: value }
+          end
+        }
+      end
+
+      munge do |values|
+        values = [values] unless values.is_a?(Array)
+        ret = []
+
+        values.each { |value|
+          range = []
+          # Split each range value into a hour, minute, second triad
+          value.split(/\s*-\s*/).each { |val|
+            # Add the values as an array.
+            range << val.split(":").collect(&:to_i)
+          }
+
+          self.fail _("Invalid range %{value}") % { value: value } if range.length != 2
+
+          # Fill out 0s for unspecified minutes and seconds
+          range.each do |time_array|
+            (3 - time_array.length).times { |_| time_array << 0 }
+          end
+
+          # Make sure the hours are valid
+          [range[0][0], range[1][0]].each do |n|
+            raise ArgumentError, _("Invalid hour '%{n}'") % { n: n } if n < 0 or n > 23
+          end
+
+          [range[0][1], range[1][1]].each do |n|
+            raise ArgumentError, _("Invalid minute '%{n}'") % { n: n } if n and (n < 0 or n > 59)
+          end
+          ret << range
+        }
+
+        # Now our array of arrays
+        ret
+      end
+
+      def weekday_match?(day)
+        if @resource[:weekday]
+          @resource[:weekday].has_key?(day)
+        else
+          true
+        end
+      end
+
+      def match?(previous, now)
+        # The lowest-level array is of the hour, minute, second triad
+        # then it's an array of two of those, to present the limits
+        # then it's an array of those ranges
+        @value = [@value] unless @value[0][0].is_a?(Array)
+        @value.any? do |range|
+          limit_start = Time.local(now.year, now.month, now.day, *range[0])
+          limit_end = Time.local(now.year, now.month, now.day, *range[1])
+
+          if limit_start < limit_end
+            # The whole range is in one day, simple case
+            now.between?(limit_start, limit_end) && weekday_match?(now.wday)
+          else
+            # The range spans days. We have to test against a range starting
+            # today, and a range that started yesterday.
+            today = Date.new(now.year, now.month, now.day)
+            tomorrow = today.next_day
+            yesterday = today.prev_day
+
+            # First check a range starting today
+            if now.between?(limit_start, Time.local(tomorrow.year, tomorrow.month, tomorrow.day, *range[1]))
+              weekday_match?(today.wday)
+            else
+              # Then check a range starting yesterday
+              now.between?(Time.local(yesterday.year, yesterday.month, yesterday.day, *range[0]),
+                           limit_end) &&
+                weekday_match?(yesterday.wday)
+            end
+          end
+        end
+      end
+    end
+
+    newparam(:periodmatch) do
+      desc "Whether periods should be matched by a numeric value (for instance,
+        whether two times are in the same hour) or by their chronological
+        distance apart (whether two times are 60 minutes apart)."
+
+      newvalues(:number, :distance)
+
+      defaultto :distance
+    end
+
+    newparam(:period) do
+      desc <<-EOT
+        The period of repetition for resources on this schedule. The default is
+        for resources to get applied every time Puppet runs.
+
+        Note that the period defines how often a given resource will get
+        applied but not when; if you would like to restrict the hours
+        that a given resource can be applied (for instance, only at night
+        during a maintenance window), then use the `range` attribute.
+
+        If the provided periods are not sufficient, you can provide a
+        value to the *repeat* attribute, which will cause Puppet to
+        schedule the affected resources evenly in the period the
+        specified number of times.  Take this schedule:
+
+            schedule { 'veryoften':
+              period => hourly,
+              repeat => 6,
+            }
+
+        This can cause Puppet to apply that resource up to every 10 minutes.
+
+        At the moment, Puppet cannot guarantee that level of repetition; that
+        is, the resource can applied _up to_ every 10 minutes, but internal
+        factors might prevent it from actually running that often (for instance,
+        if a Puppet run is still in progress when the next run is scheduled to
+        start, that next run will be suppressed).
+
+        See the `periodmatch` attribute for tuning whether to match
+        times by their distance apart or by their specific value.
+
+        > **Tip**: You can use `period => never,` to prevent a resource from being applied
+        in the given `range`. This is useful if you need to create a blackout window to
+        perform sensitive operations without interruption.
+      EOT
+
+      newvalues(:hourly, :daily, :weekly, :monthly, :never)
+
+      ScheduleScales = {
+        :hourly => 3600,
+        :daily => 86_400,
+        :weekly => 604_800,
+        :monthly => 2_592_000
+      }
+      ScheduleMethods = {
+        :hourly => :hour,
+        :daily => :day,
+        :monthly => :month,
+        :weekly => proc do |prev, now|
+          # Run the resource if the previous day was after this weekday (e.g., prev is wed, current is tue)
+          # or if it's been more than a week since we ran
+          prev.wday > now.wday or (now - prev) > (24 * 3600 * 7)
+        end
+      }
+
+      def match?(previous, now)
+        return false if value == :never
+
+        value = self.value
+        case @resource[:periodmatch]
+        when :number
+          method = ScheduleMethods[value]
+          if method.is_a?(Proc)
+            method.call(previous, now)
+          else
+            # We negate it, because if they're equal we don't run
+            now.send(method) != previous.send(method)
+          end
+        when :distance
+          scale = ScheduleScales[value]
+
+          # If the number of seconds between the two times is greater
+          # than the unit of time, we match.  We divide the scale
+          # by the repeat, so that we'll repeat that often within
+          # the scale.
+          (now.to_i - previous.to_i) >= (scale / @resource[:repeat])
+        end
+      end
+    end
+
+    newparam(:repeat) do
+      desc "How often a given resource may be applied in this schedule's `period`.
+        Must be an integer."
+
+      defaultto 1
+
+      validate do |value|
+        unless value.is_a?(Integer) or value =~ /^\d+$/
+          raise Puppet::Error,
+                _("Repeat must be a number")
+        end
+
+        # This implicitly assumes that 'periodmatch' is distance -- that
+        # is, if there's no value, we assume it's a valid value.
+        return unless @resource[:periodmatch]
+
+        if value != 1 and @resource[:periodmatch] != :distance
+          raise Puppet::Error,
+                _("Repeat must be 1 unless periodmatch is 'distance', not '%{period}'") % { period: @resource[:periodmatch] }
+        end
+      end
+
+      munge do |value|
+        value = Integer(value) unless value.is_a?(Integer)
+
+        value
+      end
+
+      def match?(previous, now)
+        true
+      end
+    end
+
+    newparam(:weekday) do
+      desc <<-EOT
+        The days of the week in which the schedule should be valid.
+        You may specify the full day name 'Tuesday', the three character
+        abbreviation 'Tue', or a number (as a string or as an integer) corresponding to the day of the
+        week where 0 is Sunday, 1 is Monday, and so on. Multiple days can be specified
+        as an array. If not specified, the day of the week will not be
+        considered in the schedule.
+
+        If you are also using a range match that spans across midnight
+        then this parameter will match the day that it was at the start
+        of the range, not necessarily the day that it is when it matches.
+        For example, consider this schedule:
+
+            schedule { 'maintenance_window':
+              range   => '22:00 - 04:00',
+              weekday => 'Saturday',
+            }
+
+        This will match at 11 PM on Saturday and 2 AM on Sunday, but not
+        at 2 AM on Saturday.
+      EOT
+
+      validate do |values|
+        values = [values] unless values.is_a?(Array)
+        values.each { |value|
+          if weekday_integer?(value) || weekday_string?(value)
+            value
+          else
+            raise ArgumentError, _("%{value} is not a valid day of the week") % { value: value }
+          end
+        }
+      end
+
+      def weekday_integer?(value)
+        value.is_a?(Integer) && (0..6).cover?(value)
+      end
+
+      def weekday_string?(value)
+        value.is_a?(String) && (value =~ /^[0-6]$/ || value =~ /^(Mon|Tues?|Wed(?:nes)?|Thu(?:rs)?|Fri|Sat(?:ur)?|Sun)(day)?$/i)
+      end
+
+      weekdays = {
+        'sun' => 0,
+        'mon' => 1,
+        'tue' => 2,
+        'wed' => 3,
+        'thu' => 4,
+        'fri' => 5,
+        'sat' => 6,
+      }
+
+      munge do |values|
+        values = [values] unless values.is_a?(Array)
+        ret = {}
+
+        values.each do |value|
+          case value
+          when /^[0-6]$/
+            index = value.to_i
+          when 0..6
+            index = value
+          else
+            index = weekdays[value[0, 3].downcase]
+          end
+          ret[index] = true
+        end
+        ret
+      end
+
+      def match?(previous, now)
+        # Special case weekday matching with ranges to a no-op here.
+        # If the ranges span days then we can't simply match the current
+        # weekday, as we want to match the weekday as it was when the range
+        # started.  As a result, all of that logic is in range, not here.
+        return true if @resource[:range]
+
+        return true if value.has_key?(now.wday)
+
+        false
+      end
+    end
+
+    def self.instances
+      []
+    end
+
+    def self.mkdefaultschedules
+      result = []
+      unless Puppet[:default_schedules]
+        Puppet.debug "Not creating default schedules: default_schedules is false"
+        return result
+      end
+
+      Puppet.debug "Creating default schedules"
+
+      result << new(
+        :name => "puppet",
+        :period => :hourly,
+
+        :repeat => "2"
+      )
+
+      # And then one for every period
+      @parameters.find { |p| p.name == :period }.value_collection.values.each { |value|
+        result << new(
+          :name => value.to_s,
+          :period => value
+        )
+      }
+
+      result
+    end
+
+    def match?(previous = nil, now = nil)
+      # If we've got a value, then convert it to a Time instance
+      previous &&= Time.at(previous)
+
+      now ||= Time.now
+
+      # Pull them in order
+      self.class.allattrs.each { |param|
+        if @parameters.include?(param) and
+           @parameters[param].respond_to?(:match?)
+          return false unless @parameters[param].match?(previous, now)
+        end
+      }
+
+      # If we haven't returned false, then return true; in other words,
+      # any provided schedules need to all match
+      true
+    end
+  end
+end