puppet 3.3.2 → 3.4.0.rc1

data/lib/puppet/util/rdoc/parser/puppet_parser_rdoc1.rb

@@ -0,0 +1,19 @@
+require 'puppet/util/rdoc/parser/puppet_parser_core.rb'
+
+module RDoc
+  PUPPET_RDOC_VERSION = 1
+
+  # @api private
+  class PuppetParserRDoc1
+    extend ParserFactory
+    include PuppetParserCore
+
+    def create_rdoc_preprocess
+      preprocess = SM::PreProcess.new(@input_file_name, @options.rdoc_include)
+    end
+  end
+
+  # For backwards compatibility
+  # @api private
+  Parser = PuppetParserRDoc1
+end

data/lib/puppet/util/rdoc/parser/puppet_parser_rdoc2.rb

@@ -0,0 +1,14 @@
+require 'puppet/util/rdoc/parser/puppet_parser_core.rb'
+
+module RDoc
+  PUPPET_RDOC_VERSION = 2
+
+  # @api private
+  class PuppetParserRDoc2 < Parser
+    include PuppetParserCore
+
+    def create_rdoc_preprocess
+      preprocess = Markup::PreProcess.new(@input_file_name, @options.rdoc_include)
+    end
+  end
+end

data/lib/puppet/util/reference.rb

@@ -46,7 +46,7 @@ class Puppet::Util::Reference
     # There used to be an attempt to use secure_open / replace_file to secure
     # the target, too, but that did nothing: the race was still here.  We can
     # get exactly the same benefit from running this effort:
-    File.unlink('/tmp/puppetdoc.tex') rescue nil
+    Puppet::FileSystem::File.unlink('/tmp/puppetdoc.tex') rescue nil
     output = %x{#{cmd}}
     unless $CHILD_STATUS == 0
       $stderr.puts "rst2latex failed"

data/lib/puppet/util/resource_template.rb

@@ -44,7 +44,7 @@ class Puppet::Util::ResourceTemplate
   end
 
   def initialize(file, resource)
-    raise ArgumentError, "Template #{file} does not exist" unless FileTest.exist?(file)
+    raise ArgumentError, "Template #{file} does not exist" unless Puppet::FileSystem::File.exist?(file)
     @file = file
     @resource = resource
   end

data/lib/puppet/util/selinux.rb

@@ -216,7 +216,7 @@ module Puppet::Util::SELinux
   #
   # @return [File::Stat] File.lstat result
   def file_lstat(path)
-    File.lstat(path)
+    Puppet::FileSystem::File.new(path).lstat
   end
   private :file_lstat
 end

data/lib/puppet/util/storage.rb

@@ -45,7 +45,7 @@ class Puppet::Util::Storage
     Puppet.settings.use(:main) unless FileTest.directory?(Puppet[:statedir])
     filename = Puppet[:statefile]
 
-    unless File.exists?(filename)
+    unless Puppet::FileSystem::File.exist?(filename)
       self.init if @@state.nil?
       return
     end
@@ -80,7 +80,7 @@ class Puppet::Util::Storage
   def self.store
     Puppet.debug "Storing state"
 
-    Puppet.info "Creating state file #{Puppet[:statefile]}" unless FileTest.exist?(Puppet[:statefile])
+    Puppet.info "Creating state file #{Puppet[:statefile]}" unless Puppet::FileSystem::File.exist?(Puppet[:statefile])
 
     Puppet::Util.benchmark(:debug, "Stored state") do
       Puppet::Util::Yaml.dump(@@state, Puppet[:statefile])

data/lib/puppet/util/suidmanager.rb

@@ -178,7 +178,7 @@ module Puppet::Util::SUIDManager
   #   :custom_environment (default {}) -- a hash of key/value pairs to set as environment variables for the duration
   #     of the command
   def run_and_capture(command, new_uid=nil, new_gid=nil, options = {})
-
+    Puppet.deprecation_warning("Puppet::Util::SUIDManager.run_and_capture is deprecated; please use Puppet::Util::Execution.execute instead.")
     # specifying these here rather than in the method signature to allow callers to pass in a partial
     # set of overrides without affecting the default values for options that they don't pass in
     default_options = {

data/lib/puppet/util/tag_set.rb

@@ -0,0 +1,29 @@
+require 'set'
+
+class Puppet::Util::TagSet < Set
+  def self.from_yaml(yaml)
+    self.new(YAML.load(yaml))
+  end
+
+  def to_yaml
+    @hash.keys.to_yaml
+  end
+
+  def self.from_pson(data)
+    self.new(data)
+  end
+
+  def to_pson(*args)
+    to_a.to_pson
+  end
+
+  # this makes puppet serialize it as an array for backwards
+  # compatibility
+  def to_zaml(z)
+    to_a.to_zaml(z)
+  end
+
+  def join(*args)
+    to_a.join(*args)
+  end
+end

data/lib/puppet/util/tagging.rb

@@ -1,30 +1,10 @@
-# Created on 2008-01-19
-# Copyright Luke Kanies
+require 'puppet/util/tag_set'
 
-# A common module to handle tagging.
-#
-# So, do you want the bad news or the good news first?
-#
-# The bad news is that using an array here is hugely costly compared to using
-# a hash.  Like, the same speed empty, 50 percent slower with one item, and
-# 300 percent slower at 6 - one of our common peaks for tagging items.
-#
-# ...and that assumes an efficient implementation, just using include?.  These
-# methods have even more costs hidden in them.
-#
-# The good news is that this module has no API.  Various objects directly
-# interact with their `@tags` member as an array, or dump it directly in YAML,
-# or whatever.
-#
-# So, er, you can't actually change this.  No matter how much you want to be
-# cause it is inefficient in both CPU and object allocation terms.
-#
-# Good luck, my friend. --daniel 2012-07-17
 module Puppet::Util::Tagging
   # Add a tag to our current list.  These tags will be added to all
   # of the objects contained in this scope.
   def tag(*ary)
-    @tags ||= []
+    @tags ||= new_tags
 
     qualified = []
 
@@ -45,12 +25,12 @@ module Puppet::Util::Tagging
   # Return a copy of the tag list, so someone can't ask for our tags
   # and then modify them.
   def tags
-    @tags ||= []
+    @tags ||= new_tags
     @tags.dup
   end
 
   def tags=(tags)
-    @tags = []
+    @tags = new_tags
 
     return if tags.nil? or tags == ""
 
@@ -73,4 +53,8 @@ module Puppet::Util::Tagging
   def valid_tag?(tag)
     tag.is_a?(String) and tag =~ ValidTagRegex
   end
+
+  def new_tags
+    Puppet::Util::TagSet.new
+  end
 end

data/lib/puppet/util/watched_file.rb

@@ -26,7 +26,7 @@ class Puppet::Util::WatchedFile
   end
 
   # Allow this to be used as the name of the file being watched in various
-  # other methods (such as File.exist?)
+  # other methods (such as Puppet::FileSystem::File.exist?)
   def to_str
     @filename
   end

data/lib/puppet/util/watcher.rb

@@ -7,7 +7,7 @@ module Puppet::Util::Watcher
     def self.file_ctime_change_watcher(filename)
       Puppet::Util::Watcher::ChangeWatcher.watch(lambda do
         begin
-          File.stat(filename).ctime
+          Puppet::FileSystem::File.new(filename).stat.ctime
         rescue Errno::ENOENT, Errno::ENOTDIR
           :absent
         end

data/lib/puppet/util/windows.rb

@@ -8,6 +8,9 @@ module Puppet::Util::Windows
     require 'puppet/util/windows/process'
     require 'puppet/util/windows/file'
     require 'puppet/util/windows/root_certs'
+    require 'puppet/util/windows/access_control_entry'
+    require 'puppet/util/windows/access_control_list'
+    require 'puppet/util/windows/security_descriptor'
   end
   require 'puppet/util/windows/registry'
 end

data/lib/puppet/util/windows/access_control_entry.rb

@@ -0,0 +1,84 @@
+# Windows Access Control Entry
+#
+# Represents an access control entry, which grants or denies a subject,
+# identified by a SID, rights to a securable object.
+#
+# @see http://msdn.microsoft.com/en-us/library/windows/desktop/aa374868(v=vs.85).aspx
+# @api private
+class Puppet::Util::Windows::AccessControlEntry
+  require 'puppet/util/windows/security'
+  include Puppet::Util::Windows::SID
+
+  attr_accessor :sid
+  attr_reader :mask, :flags, :type
+
+  OBJECT_INHERIT_ACE                      = 0x1
+  CONTAINER_INHERIT_ACE                   = 0x2
+  NO_PROPAGATE_INHERIT_ACE                = 0x4
+  INHERIT_ONLY_ACE                        = 0x8
+  INHERITED_ACE                           = 0x10
+
+  ACCESS_ALLOWED_ACE_TYPE                 = 0x0
+  ACCESS_DENIED_ACE_TYPE                  = 0x1
+
+  def initialize(sid, mask, flags = 0, type = ACCESS_ALLOWED_ACE_TYPE)
+    @sid = sid
+    @mask = mask
+    @flags = flags
+    @type = type
+  end
+
+  # Returns true if this ACE is inherited from a parent. If false,
+  # then the ACE is set directly on the object to which it refers.
+  #
+  # @return [Boolean] true if the ACE is inherited
+  def inherited?
+    (@flags & INHERITED_ACE) == INHERITED_ACE
+  end
+
+  # Returns true if this ACE only applies to children of the object.
+  # If false, it applies to the object.
+  #
+  # @return [Boolean] true if the ACE only applies to children and
+  # not the object itself.
+  def inherit_only?
+    (@flags & INHERIT_ONLY_ACE) == INHERIT_ONLY_ACE
+  end
+
+  # Returns true if this ACE applies to child directories.
+  #
+  # @return [Boolean] true if the ACE applies to child direcories
+  def container_inherit?
+    (@flags & CONTAINER_INHERIT_ACE) == CONTAINER_INHERIT_ACE
+  end
+
+  # Returns true if this ACE applies to child files.
+  #
+  # @return [Boolean] true if the ACE applies to child files.
+  def object_inherit?
+    (@flags & OBJECT_INHERIT_ACE) == OBJECT_INHERIT_ACE
+  end
+
+  def inspect
+    inheritance = ""
+    inheritance << '(I)' if inherited?
+    inheritance << '(OI)' if object_inherit?
+    inheritance << '(CI)' if container_inherit?
+    inheritance << '(IO)' if inherit_only?
+
+    left = "#{sid_to_name(sid)}:#{inheritance}"
+    left = left.ljust(45)
+    "#{left} 0x#{mask.to_s(16)}"
+  end
+
+  # Returns true if this ACE is equal to +other+
+  def ==(other)
+    self.class == other.class &&
+      sid == other.sid &&
+      mask == other.mask &&
+      flags == other.flags &&
+      type == other.type
+  end
+
+  alias eql? ==
+end

data/lib/puppet/util/windows/access_control_list.rb

@@ -0,0 +1,106 @@
+# Windows Access Control List
+#
+# Represents a list of access control entries (ACEs).
+#
+# @see http://msdn.microsoft.com/en-us/library/windows/desktop/aa374872(v=vs.85).aspx
+# @api private
+class Puppet::Util::Windows::AccessControlList
+  include Enumerable
+
+  ACCESS_ALLOWED_ACE_TYPE                 = 0x0
+  ACCESS_DENIED_ACE_TYPE                  = 0x1
+
+  # Construct an ACL.
+  #
+  # @param acl [Enumerable] A list of aces to copy from.
+  def initialize(acl = nil)
+    if acl
+      @aces = acl.map(&:dup)
+    else
+      @aces = []
+    end
+  end
+
+  # Enumerate each ACE in the list.
+  #
+  # @yieldparam ace [Hash] the ace
+  def each
+    @aces.each {|ace| yield ace}
+  end
+
+  # Allow the +sid+ to access a resource with the specified access +mask+.
+  #
+  # @param sid [String] The SID that the ACE is granting access to
+  # @param mask [int] The access mask granted to the SID
+  # @param flags [int] The flags assigned to the ACE, e.g. +INHERIT_ONLY_ACE+
+  def allow(sid, mask, flags = 0)
+    @aces << Puppet::Util::Windows::AccessControlEntry.new(sid, mask, flags, ACCESS_ALLOWED_ACE_TYPE)
+  end
+
+  # Deny the +sid+ access to a resource with the specified access +mask+.
+  #
+  # @param sid [String] The SID that the ACE is denying access to
+  # @param mask [int] The access mask denied to the SID
+  # @param flags [int] The flags assigned to the ACE, e.g. +INHERIT_ONLY_ACE+
+  def deny(sid, mask, flags = 0)
+    @aces << Puppet::Util::Windows::AccessControlEntry.new(sid, mask, flags, ACCESS_DENIED_ACE_TYPE)
+  end
+
+  # Reassign all ACEs currently assigned to +old_sid+ to +new_sid+ instead.
+  # If an ACE is inherited or is not assigned to +old_sid+, then it will
+  # be copied as-is to the new ACL, preserving its order within the ACL.
+  #
+  # @param old_sid [String] The old SID, e.g. 'S-1-5-18'
+  # @param new_sid [String] The new SID
+  # @return [AccessControlList] The copied ACL.
+  def reassign!(old_sid, new_sid)
+    new_aces = []
+    prepend_needed = false
+    aces_to_prepend = []
+
+    @aces.each do |ace|
+      new_ace = ace.dup
+
+      if ace.sid == old_sid
+        if ace.inherited?
+          # create an explicit ACE granting or denying the
+          # new_sid the rights that the inherited ACE
+          # granted or denied the old_sid. We mask off all
+          # flags except those affecting inheritance of the
+          # ACE we're creating.
+          inherit_mask = Windows::Security::CONTAINER_INHERIT_ACE |
+            Windows::Security::OBJECT_INHERIT_ACE |
+            Windows::Security::INHERIT_ONLY_ACE
+          explicit_ace = Puppet::Util::Windows::AccessControlEntry.new(new_sid, ace.mask, ace.flags & inherit_mask, ace.type)
+          aces_to_prepend << explicit_ace
+        else
+          new_ace.sid = new_sid
+
+          prepend_needed = old_sid == Win32::Security::SID::LocalSystem
+        end
+      end
+      new_aces << new_ace
+    end
+
+    @aces = []
+
+    if prepend_needed
+      mask = Windows::Security::STANDARD_RIGHTS_ALL | Windows::Security::SPECIFIC_RIGHTS_ALL
+      ace = Puppet::Util::Windows::AccessControlEntry.new(
+              Win32::Security::SID::LocalSystem,
+              mask)
+      @aces << ace
+    end
+
+    @aces.concat(aces_to_prepend)
+    @aces.concat(new_aces)
+  end
+
+  def inspect
+    str = ""
+    @aces.each do |ace|
+      str << "  #{ace.inspect}\n"
+    end
+    str
+  end
+end

data/lib/puppet/util/windows/file.rb

@@ -1,6 +1,7 @@
 require 'puppet/util/windows'
 
 module Puppet::Util::Windows::File
+  require 'ffi'
   require 'windows/api'
   require 'windows/wide_string'
 
@@ -24,4 +25,216 @@ module Puppet::Util::Windows::File
       new("MoveFileEx(#{source}, #{target}, #{flags.to_s(8)})")
   end
   module_function :move_file_ex
+
+  module API
+    extend FFI::Library
+    ffi_lib 'kernel32'
+    ffi_convention :stdcall
+
+    # BOOLEAN WINAPI CreateSymbolicLink(
+    #   _In_  LPTSTR lpSymlinkFileName, - symbolic link to be created
+    #   _In_  LPTSTR lpTargetFileName, - name of target for symbolic link
+    #   _In_  DWORD dwFlags - 0x0 target is a file, 0x1 target is a directory
+    # );
+    # rescue on Windows < 6.0 so that code doesn't explode
+    begin
+      attach_function :create_symbolic_link, :CreateSymbolicLinkW,
+        [:buffer_in, :buffer_in, :uint], :bool
+    rescue LoadError
+    end
+
+    # DWORD WINAPI GetFileAttributes(
+    #   _In_  LPCTSTR lpFileName
+    # );
+    attach_function :get_file_attributes, :GetFileAttributesW,
+      [:buffer_in], :uint
+
+    # HANDLE WINAPI CreateFile(
+    #   _In_      LPCTSTR lpFileName,
+    #   _In_      DWORD dwDesiredAccess,
+    #   _In_      DWORD dwShareMode,
+    #   _In_opt_  LPSECURITY_ATTRIBUTES lpSecurityAttributes,
+    #   _In_      DWORD dwCreationDisposition,
+    #   _In_      DWORD dwFlagsAndAttributes,
+    #   _In_opt_  HANDLE hTemplateFile
+    # );
+    attach_function :create_file, :CreateFileW,
+      [:buffer_in, :uint, :uint, :pointer, :uint, :uint, :uint], :uint
+
+    # http://msdn.microsoft.com/en-us/library/windows/desktop/aa363216(v=vs.85).aspx
+    # BOOL WINAPI DeviceIoControl(
+    #   _In_         HANDLE hDevice,
+    #   _In_         DWORD dwIoControlCode,
+    #   _In_opt_     LPVOID lpInBuffer,
+    #   _In_         DWORD nInBufferSize,
+    #   _Out_opt_    LPVOID lpOutBuffer,
+    #   _In_         DWORD nOutBufferSize,
+    #   _Out_opt_    LPDWORD lpBytesReturned,
+    #   _Inout_opt_  LPOVERLAPPED lpOverlapped
+    # );
+    attach_function :device_io_control, :DeviceIoControl,
+      [:uint, :uint, :pointer, :uint, :pointer, :uint, :pointer, :pointer], :bool
+
+    MAXIMUM_REPARSE_DATA_BUFFER_SIZE = 16384
+
+    # REPARSE_DATA_BUFFER
+    # http://msdn.microsoft.com/en-us/library/cc232006.aspx
+    # http://msdn.microsoft.com/en-us/library/windows/hardware/ff552012(v=vs.85).aspx
+    # struct is always MAXIMUM_REPARSE_DATA_BUFFER_SIZE bytes
+    class ReparseDataBuffer < FFI::Struct
+      layout :reparse_tag, :uint,
+             :reparse_data_length, :ushort,
+             :reserved, :ushort,
+             :substitute_name_offset, :ushort,
+             :substitute_name_length, :ushort,
+             :print_name_offset, :ushort,
+             :print_name_length, :ushort,
+             :flags, :uint,
+             # max less above fields dword / uint 4 bytes, ushort 2 bytes
+             :path_buffer, [:uchar, MAXIMUM_REPARSE_DATA_BUFFER_SIZE - 20]
+    end
+
+    # BOOL WINAPI CloseHandle(
+    #   _In_  HANDLE hObject
+    # );
+    attach_function :close_handle, :CloseHandle, [:uint], :bool
+  end
+
+  def symlink(target, symlink)
+    flags = File.directory?(target) ? 0x1 : 0x0
+    result = API.create_symbolic_link(WideString.new(symlink.to_s),
+      WideString.new(target.to_s), flags)
+    return true if result
+    raise Puppet::Util::Windows::Error.new(
+      "CreateSymbolicLink(#{symlink}, #{target}, #{flags.to_s(8)})")
+  end
+  module_function :symlink
+
+  INVALID_FILE_ATTRIBUTES = 0xFFFFFFFF #define INVALID_FILE_ATTRIBUTES (DWORD (-1))
+  def self.get_file_attributes(file_name)
+    result = API.get_file_attributes(WideString.new(file_name.to_s))
+    return result unless result == INVALID_FILE_ATTRIBUTES
+    raise Puppet::Util::Windows::Error.new("GetFileAttributes(#{file_name})")
+  end
+
+  INVALID_HANDLE_VALUE = -1 #define INVALID_HANDLE_VALUE ((HANDLE)(LONG_PTR)-1)
+  def self.create_file(file_name, desired_access, share_mode, security_attributes,
+    creation_disposition, flags_and_attributes, template_file_handle)
+
+    result = API.create_file(WideString.new(file_name.to_s),
+      desired_access, share_mode, security_attributes, creation_disposition,
+      flags_and_attributes, template_file_handle)
+
+    return result unless result == INVALID_HANDLE_VALUE
+    raise Puppet::Util::Windows::Error.new(
+      "CreateFile(#{file_name}, #{desired_access.to_s(8)}, #{share_mode.to_s(8)}, " +
+        "#{security_attributes}, #{creation_disposition.to_s(8)}, " +
+        "#{flags_and_attributes.to_s(8)}, #{template_file_handle})")
+  end
+
+  def self.device_io_control(handle, io_control_code, in_buffer = nil, out_buffer = nil)
+    if out_buffer.nil?
+      raise Puppet::Util::Windows::Error.new("out_buffer is required")
+    end
+
+    result = API.device_io_control(
+      handle,
+      io_control_code,
+      in_buffer, in_buffer.nil? ? 0 : in_buffer.size,
+      out_buffer, out_buffer.size,
+      FFI::MemoryPointer.new(:uint, 1),
+      nil
+    )
+
+    return out_buffer if result
+    raise Puppet::Util::Windows::Error.new(
+      "DeviceIoControl(#{handle}, #{io_control_code}, #{in_buffer}, #{in_buffer.size}, " +
+      "#{out_buffer}, #{out_buffer.size}")
+  end
+
+  FILE_ATTRIBUTE_REPARSE_POINT = 0x400
+  def symlink?(file_name)
+    begin
+      attributes = get_file_attributes(file_name)
+      (attributes & FILE_ATTRIBUTE_REPARSE_POINT) == FILE_ATTRIBUTE_REPARSE_POINT
+    rescue
+      # raised INVALID_FILE_ATTRIBUTES is equivalent to file not found
+      false
+    end
+  end
+  module_function :symlink?
+
+  GENERIC_READ                  = 0x80000000
+  FILE_SHARE_READ               = 1
+  OPEN_EXISTING                 = 3
+  FILE_FLAG_OPEN_REPARSE_POINT  = 0x00200000
+  FILE_FLAG_BACKUP_SEMANTICS    = 0x02000000
+
+  def self.open_symlink(link_name)
+    begin
+      yield handle = create_file(
+      WideString.new(link_name.to_s),
+      GENERIC_READ,
+      FILE_SHARE_READ,
+      nil, # security_attributes
+      OPEN_EXISTING,
+      FILE_FLAG_OPEN_REPARSE_POINT | FILE_FLAG_BACKUP_SEMANTICS,
+      0) # template_file
+    ensure
+      API.close_handle(handle) if handle
+    end
+  end
+
+  def readlink(link_name)
+    open_symlink(link_name) do |handle|
+      resolve_symlink(handle)
+    end
+  end
+  module_function :readlink
+
+  def stat(file_name)
+    file_name = file_name.to_s # accomodate PathName or String
+    stat = File.stat(file_name)
+    if symlink?(file_name)
+      link_ftype = File.stat(readlink(file_name)).ftype
+      # sigh, monkey patch instance method for instance, and close over link_ftype
+      singleton_class = class << stat; self; end
+      singleton_class.send(:define_method, :ftype) do
+        link_ftype
+      end
+    end
+    stat
+  end
+  module_function :stat
+
+  def lstat(file_name)
+    file_name = file_name.to_s # accomodate PathName or String
+    # monkey'ing around!
+    stat = File.lstat(file_name)
+    if symlink?(file_name)
+      def stat.ftype
+        "link"
+      end
+    end
+    stat
+  end
+  module_function :lstat
+
+  private
+
+  # http://msdn.microsoft.com/en-us/library/windows/desktop/aa364571(v=vs.85).aspx
+  FSCTL_GET_REPARSE_POINT = 0x900a8
+
+  def self.resolve_symlink(handle)
+    # must be multiple of 1024, min 10240
+    out_buffer = FFI::MemoryPointer.new(API::ReparseDataBuffer.size)
+    device_io_control(handle, FSCTL_GET_REPARSE_POINT, nil, out_buffer)
+
+    reparse_data = API::ReparseDataBuffer.new(out_buffer)
+    offset = reparse_data[:print_name_offset]
+    length = reparse_data[:print_name_length]
+
+    result = reparse_data[:path_buffer].to_a[offset, length].pack('C*')
+    result.force_encoding('UTF-16LE').encode(Encoding.default_external)
+  end
 end