puppet 4.10.10 → 4.10.11

data/lib/puppet/parser/functions/return.rb

@@ -4,7 +4,8 @@ Puppet::Parser::Functions::newfunction(
   :doc => <<-DOC
 Immediately returns the given optional value from a function, class body or user defined type body.
 If a value is not given, an `undef` value is returned. This function does not return to the immediate caller.
-If called from within a lambda the return will return from the function evaluating the lambda.
+If this function is called from within a lambda, the return action is from the scope of the
+function containing the lambda (top scope), not the function accepting the lambda (local scope).
 
 The signal produced to return a value bubbles up through
 the call stack until reaching a function, class definition or
@@ -63,6 +64,26 @@ The code would notice `'bar'` but not `'foo'`
 
 Note that the returned value is ignored if used in a class or user defined type.
 
+**Example:** Using `return` in a lambda
+
+```puppet
+# Concatenate three strings into a single string formatted as a list.
+function getFruit() {
+  with("apples", "oranges", "bananas") |$x, $y, $z| {
+    return("${x}, ${y}, and ${z}")
+  }
+  notice "not reached"
+}
+$fruit = getFruit()
+notice $fruit
+
+# The output contains "apples, oranges, and bananas".
+# "not reached" is not output because the function returns its value within the
+# calling function's scope, which stops processing the calling function before
+# the `notice "not reached"` statement.
+# Using `return()` outside of a calling function results in an error.
+```
+
 * Also see functions `return` and `break`
 * Since 4.8.0
 DOC

data/lib/puppet/pops/resource/resource_type_impl.rb

@@ -149,7 +149,7 @@ class ResourceTypeImpl
         # Here it is silently ignored.
         nil
       when 1
-        if @title_pattners_hash.nil?
+        if @title_patterns_hash.nil?
           [ [ /(.*)/m, [ [@key_attributes.first] ] ] ]
         else
           # TechDebt: The case of having one namevar and an empty title patterns is unspecified behavior in puppet.

data/lib/puppet/provider/group/windows_adsi.rb

@@ -23,12 +23,9 @@ Puppet::Type.type(:group).provide :windows_adsi do
     # Cannot use munge of the group property to canonicalize @should
     # since the default array_matching comparison is not commutative
 
+    current_sids = current.map(&:sid)
     # dupes automatically weeded out when hashes built
-    current_users = Puppet::Util::Windows::ADSI::Group.name_sid_hash(current)
-    specified_users = Puppet::Util::Windows::ADSI::Group.name_sid_hash(should)
-
-    current_sids = current_users.keys.to_a
-    specified_sids = specified_users.keys.to_a
+    specified_sids = Puppet::Util::Windows::ADSI::Group.name_sid_hash(should).keys.to_a
 
     if @resource[:auth_membership]
       current_sids.sort == specified_sids.sort
@@ -40,7 +37,7 @@ Puppet::Type.type(:group).provide :windows_adsi do
   def members_to_s(users)
     return '' if users.nil? or !users.kind_of?(Array)
     users = users.map do |user_name|
-      sid = Puppet::Util::Windows::SID.name_to_sid_object(user_name)
+      sid = Puppet::Util::Windows::SID.name_to_principal(user_name)
       if !sid
         resource.debug("#{user_name} (unresolvable to SID)")
         next user_name
@@ -58,7 +55,7 @@ Puppet::Type.type(:group).provide :windows_adsi do
   end
 
   def member_valid?(user_name)
-    ! Puppet::Util::Windows::SID.name_to_sid_object(user_name).nil?
+    ! Puppet::Util::Windows::SID.name_to_principal(user_name).nil?
   end
 
   def group

data/lib/puppet/provider/package/dnf.rb

@@ -28,7 +28,7 @@ Puppet::Type.type(:package).provide :dnf, :parent => :yum do
       end
   end
 
-  defaultfor :operatingsystem => :fedora, :operatingsystemmajrelease => ['22', '23', '24', '25']
+  defaultfor :operatingsystem => :fedora, :operatingsystemmajrelease => (22..30).to_a
 
   def self.update_command
     # In DNF, update is deprecated for upgrade

data/lib/puppet/provider/service/systemd.rb

@@ -25,7 +25,7 @@ Puppet::Type.type(:service).provide :systemd, :parent => :base do
   defaultfor :osfamily => :coreos
   defaultfor :operatingsystem => :amazon, :operatingsystemmajrelease => ["2"]
   defaultfor :operatingsystem => :debian, :operatingsystemmajrelease => ["8", "stretch/sid", "9", "buster/sid"]
-  defaultfor :operatingsystem => :ubuntu, :operatingsystemmajrelease => ["15.04","15.10","16.04","16.10"]
+  defaultfor :operatingsystem => :ubuntu, :operatingsystemmajrelease => ["15.04","15.10","16.04","16.10","17.04","17.10"]
   defaultfor :operatingsystem => :cumuluslinux, :operatingsystemmajrelease => ["3"]
 
   def self.instances

data/lib/puppet/provider/user/aix.rb

@@ -268,7 +268,7 @@ Puppet::Type.type(:user).provide :aix, :parent => Puppet::Provider::AixObject do
     # Must receive "user:enc_password" as input
     # command, arguments = {:failonfail => true, :combine => true}
     # Fix for bugs #11200 and #10915
-    cmd = [self.class.command(:chpasswd), get_ia_module_args, '-e', '-c', user].flatten
+    cmd = [self.class.command(:chpasswd), get_ia_module_args, '-e', '-c'].flatten
     begin
       output = execute(cmd, {:failonfail => false, :combine => true, :stdinfile => tmpfile.path })
       # chpasswd can return 1, even on success (at least on AIX 6.1); empty output indicates success

data/lib/puppet/provider/user/windows_adsi.rb

@@ -52,7 +52,7 @@ Puppet::Type.type(:user).provide :windows_adsi do
   def groups_to_s(groups)
     return '' if groups.nil? || !groups.kind_of?(Array)
     groups = groups.map do |group_name|
-      sid = Puppet::Util::Windows::SID.name_to_sid_object(group_name)
+      sid = Puppet::Util::Windows::SID.name_to_principal(group_name)
       if sid.account =~ /\\/
         account, _ = Puppet::Util::Windows::ADSI::Group.parse_name(sid.account)
       else

data/lib/puppet/reference/configuration.rb

@@ -34,6 +34,8 @@ config = Puppet::Util::Reference.newreference(:configuration, :depth => 1, :doc
       val = 'Unix/Linux: /var/log/puppetlabs/puppet -- Windows: C:\ProgramData\PuppetLabs\puppet\var\log -- Non-root user: ~/.puppetlabs/var/log'
     elsif name.to_s == 'hiera_config'
       val = '$confdir/hiera.yaml. However, if a file exists at $codedir/hiera.yaml, Puppet uses that instead.'
+    elsif name.to_s == 'certname'
+      val = "the Host's fully qualified domain name, as determined by facter"
     end
 
     # Leave out the section information; it was apparently confusing people.

data/lib/puppet/type/tidy.rb

@@ -222,7 +222,14 @@ Puppet::Type.newtype(:tidy) do
   # Make a file resource to remove a given file.
   def mkfile(path)
     # Force deletion, so directories actually get deleted.
-    Puppet::Type.type(:file).new :path => path, :backup => self[:backup], :ensure => :absent, :force => true
+    parameters = {
+      :path => path, :backup => self[:backup],
+      :ensure => :absent, :force => true
+    }
+
+    parameters[:noop] = self[:noop] unless self[:noop].nil?
+
+    Puppet::Type.type(:file).new(parameters)
   end
 
   def retrieve

data/lib/puppet/type/user.rb

@@ -212,13 +212,44 @@ module Puppet
         * OS X 10.8 and higher use salted SHA512 PBKDF2 hashes. When managing passwords
           on these systems, the `salt` and `iterations` attributes need to be specified as
           well as the password.
-        * Windows passwords can only be managed in cleartext, as there is no Windows API
-          for setting the password hash.
+        * Windows passwords can be managed only in cleartext, because there is no Windows
+          API for setting the password hash.
 
         [stdlib]: https://github.com/puppetlabs/puppetlabs-stdlib/
 
         Enclose any value that includes a dollar sign ($) in single quotes (') to avoid
-        accidental variable interpolation.}
+        accidental variable interpolation.
+
+        To redact passwords from reports to PuppetDB, use the `Sensitive` data type. For
+        example, this resource protects the password:
+
+        ```puppet
+        user { 'foo':
+          ensure   => present,
+          password => Sensitive("my secret password")
+        }
+        ```
+
+        This results in the password being redacted from the report, as in the
+        `previous_value`, `desired_value`, and `message` fields below.
+
+        ```yaml
+            events:
+            - !ruby/object:Puppet::Transaction::Event
+              audited: false
+              property: password
+              previous_value: "[redacted]"
+              desired_value: "[redacted]"
+              historical_value:
+              message: changed [redacted] to [redacted]
+              name: :password_changed
+              status: success
+              time: 2017-05-17 16:06:02.934398293 -07:00
+              redacted: true
+              corrective_change: false
+            corrective_change: false
+        ```
+        }
 
       validate do |value|
         raise ArgumentError, "Passwords cannot include ':'" if value.is_a?(String) and value.include?(":")

data/lib/puppet/util/reference.rb

@@ -12,11 +12,6 @@ class Puppet::Util::Reference
 
   instance_load(:reference, 'puppet/reference')
 
-  def self.footer
-    #TRANSLATORS message accompanied by date of generation
-    "\n\n----------------\n\n*" + _("This page autogenerated on ") + "#{Time.now}*\n"
-  end
-
   def self.modes
     %w{pdf text}
   end
@@ -112,15 +107,13 @@ class Puppet::Util::Reference
   def to_markdown(withcontents = true)
     # First the header
     text = markdown_header(@title, 1)
-    #TRANSLATORS message accompanied by date of generation
-    text << _("\n\n**This page is autogenerated; any changes will get overwritten** *(last generated on ") + "#{Time.now.to_s})*\n\n"
+
+    text << _("\n\n**This page is autogenerated; any changes will get overwritten**\n\n")
 
     text << @header
 
     text << generate
 
-    text << self.class.footer if withcontents
-
     text
   end
 end

data/lib/puppet/util/windows/adsi.rb

@@ -16,7 +16,7 @@ module Puppet::Util::Windows::ADSI
       begin
         WIN32OLE.connect(uri)
       rescue WIN32OLERuntimeError => e
-        raise Puppet::Error.new( "ADSI connection error: #{e}", e )
+        raise Puppet::Error.new( _("ADSI connection error: %{e}") % { e: e }, e )
       end
     end
 
@@ -39,7 +39,7 @@ module Puppet::Util::Windows::ADSI
             buffer_size.write_dword(max_length) # length in TCHARs
 
             if GetComputerNameW(buffer, buffer_size) == FFI::WIN32_FALSE
-              raise Puppet::Util::Windows::Error.new("Failed to get computer name")
+              raise Puppet::Util::Windows::Error.new(_("Failed to get computer name"))
             end
             @computer_name = buffer.read_wide_string(buffer_size.read_dword)
           end
@@ -66,7 +66,7 @@ module Puppet::Util::Windows::ADSI
       return sid_uri(sid) if sid.kind_of?(Puppet::Util::Windows::SID::Principal)
 
       begin
-        sid = Puppet::Util::Windows::SID.name_to_sid_object(sid)
+        sid = Puppet::Util::Windows::SID.name_to_principal(sid)
         sid_uri(sid)
       rescue Puppet::Util::Windows::Error, Puppet::Error
         nil
@@ -77,7 +77,7 @@ module Puppet::Util::Windows::ADSI
     # used for IAdsGroup::Add / IAdsGroup::Remove.  These URIs are not useable
     # to resolve an account with WIN32OLE.connect
     def sid_uri(sid)
-      raise Puppet::Error.new( "Must use a valid SID::Principal" ) if !sid.kind_of?(Puppet::Util::Windows::SID::Principal)
+      raise Puppet::Error.new( _("Must use a valid SID::Principal") ) if !sid.kind_of?(Puppet::Util::Windows::SID::Principal)
 
       "WinNT://#{sid.sid}"
     end
@@ -114,7 +114,7 @@ module Puppet::Util::Windows::ADSI
         Puppet::Util::Windows::SID.sid_to_name('S-1-5-32').upcase,
         # localized version of NT AUTHORITY (can't use S-1-5)
         # for instance AUTORITE NT on French Windows
-        Puppet::Util::Windows::SID.name_to_sid_object('SYSTEM').domain.upcase
+        Puppet::Util::Windows::SID.name_to_principal('SYSTEM').domain.upcase
       ]
     end
 
@@ -129,7 +129,7 @@ module Puppet::Util::Windows::ADSI
 
     def parse_name(name)
       if name =~ /\//
-        raise Puppet::Error.new( "Value must be in DOMAIN\\user style syntax" )
+        raise Puppet::Error.new( _("Value must be in DOMAIN\\user style syntax") )
       end
 
       matches = name.scan(/((.*)\\)?(.*)/)
@@ -139,10 +139,12 @@ module Puppet::Util::Windows::ADSI
       return account, domain
     end
 
+    # returns Puppet::Util::Windows::SID::Principal[]
+    # may contain objects that represent unresolvable SIDs
     def get_sids(adsi_child_collection)
       sids = []
       adsi_child_collection.each do |m|
-        sids << Puppet::Util::Windows::SID.octet_string_to_sid_object(m.objectSID)
+        sids << Puppet::Util::Windows::SID.ads_to_principal(m)
       end
 
       sids
@@ -152,8 +154,8 @@ module Puppet::Util::Windows::ADSI
       return {} if names.nil? || names.empty?
 
       sids = names.map do |name|
-        sid = Puppet::Util::Windows::SID.name_to_sid_object(name)
-        raise Puppet::Error.new( "Could not resolve name: #{name}" ) if !sid
+        sid = Puppet::Util::Windows::SID.name_to_principal(name)
+        raise Puppet::Error.new( _("Could not resolve name: %{name}") % { name: name } ) if !sid
         [sid.sid, sid]
       end
 
@@ -183,7 +185,7 @@ module Puppet::Util::Windows::ADSI
     end
 
     def sid
-      @sid ||= Puppet::Util::Windows::SID.octet_string_to_sid_object(native_user.objectSID)
+      @sid ||= Puppet::Util::Windows::SID.octet_string_to_principal(native_user.objectSID)
     end
 
     def uri
@@ -211,12 +213,12 @@ module Puppet::Util::Windows::ADSI
         # ERROR_BAD_USERNAME 2202L from winerror.h
         if e.message =~ /8007089A/m
           raise Puppet::Error.new(
-           "Puppet is not able to create/delete domain users with the user resource.",
+           _("Puppet is not able to create/delete domain users with the user resource."),
            e
           )
         end
 
-        raise Puppet::Error.new( "User update failed: #{e}", e )
+        raise Puppet::Error.new( _("User update failed: %{e}") % { e: e }, e )
       end
       self
     end
@@ -311,7 +313,7 @@ module Puppet::Util::Windows::ADSI
 
     def self.create(name)
       # Windows error 1379: The specified local group already exists.
-      raise Puppet::Error.new( "Cannot create user if group '#{name}' exists." ) if Puppet::Util::Windows::ADSI::Group.exists? name
+      raise Puppet::Error.new(_("Cannot create user if group '%{name}' exists.") % { name: name }) if Puppet::Util::Windows::ADSI::Group.exists? name
       new(name, Puppet::Util::Windows::ADSI.create(name, 'user'))
     end
 
@@ -325,7 +327,7 @@ module Puppet::Util::Windows::ADSI
           buffer_size.write_dword(max_length) # length in TCHARs
 
           if GetUserNameW(buffer, buffer_size) == FFI::WIN32_FALSE
-            raise Puppet::Util::Windows::Error.new("Failed to get user name")
+            raise Puppet::Util::Windows::Error.new(_("Failed to get user name"))
           end
           # buffer_size includes trailing NULL
           user_name = buffer.read_wide_string(buffer_size.read_dword - 1)
@@ -336,12 +338,12 @@ module Puppet::Util::Windows::ADSI
     end
 
     def self.current_user_sid
-      Puppet::Util::Windows::SID.name_to_sid_object(current_user_name)
+      Puppet::Util::Windows::SID.name_to_principal(current_user_name)
     end
 
     def self.exists?(name_or_sid)
       well_known = false
-      if (sid = Puppet::Util::Windows::SID.name_to_sid_object(name_or_sid))
+      if (sid = Puppet::Util::Windows::SID.name_to_principal(name_or_sid))
         return true if sid.account_type == :SidTypeUser
 
         # 'well known group' is special as it can be a group like Everyone OR a user like SYSTEM
@@ -403,7 +405,7 @@ module Puppet::Util::Windows::ADSI
         # but warn if we fail
         raise e unless e.message.include?('80041010')
 
-        Puppet.warning "Cannot delete user profile for '#{sid}' prior to Vista SP1"
+        Puppet.warning _("Cannot delete user profile for '%{sid}' prior to Vista SP1") % { sid: sid }
       end
     end
   end
@@ -431,7 +433,7 @@ module Puppet::Util::Windows::ADSI
     end
 
     def sid
-      @sid ||= Puppet::Util::Windows::SID.octet_string_to_sid_object(native_group.objectSID)
+      @sid ||= Puppet::Util::Windows::SID.octet_string_to_principal(native_group.objectSID)
     end
 
     def commit
@@ -441,12 +443,12 @@ module Puppet::Util::Windows::ADSI
         # ERROR_BAD_USERNAME 2202L from winerror.h
         if e.message =~ /8007089A/m
           raise Puppet::Error.new(
-            "Puppet is not able to create/delete domain groups with the group resource.",
+            _("Puppet is not able to create/delete domain groups with the group resource."),
             e
           )
         end
 
-        raise Puppet::Error.new( "Group update failed: #{e}", e )
+        raise Puppet::Error.new( _("Group update failed: %{error}") % { error: e }, e )
       end
       self
     end
@@ -463,18 +465,13 @@ module Puppet::Util::Windows::ADSI
       end
     end
 
+    # returns Puppet::Util::Windows::SID::Principal[]
+    # may contain objects that represent unresolvable SIDs
+    # qualified account names are returned by calling #domain_account
     def members
-      # WIN32OLE objects aren't enumerable, so no map
-      members = []
-      # Setting WIN32OLE.codepage in the microsoft_windows feature ensures
-      # values are returned as UTF-8
-      native_group.Members.each {|m| members << m.Name}
-      members
-    end
-
-    def member_sids
       self.class.get_sids(native_group.Members)
     end
+    alias member_sids members
 
     def set_members(desired_members, inclusive = true)
       return if desired_members.nil?
@@ -502,13 +499,13 @@ module Puppet::Util::Windows::ADSI
 
     def self.create(name)
       # Windows error 2224: The account already exists.
-      raise Puppet::Error.new( "Cannot create group if user '#{name}' exists." ) if Puppet::Util::Windows::ADSI::User.exists? name
+      raise Puppet::Error.new( _("Cannot create group if user '%{name}' exists.") % { name: name } ) if Puppet::Util::Windows::ADSI::User.exists? name
       new(name, Puppet::Util::Windows::ADSI.create(name, 'group'))
     end
 
     def self.exists?(name_or_sid)
       well_known = false
-      if (sid = Puppet::Util::Windows::SID.name_to_sid_object(name_or_sid))
+      if (sid = Puppet::Util::Windows::SID.name_to_principal(name_or_sid))
         return true if sid.account_type == :SidTypeGroup
 
         # 'well known group' is special as it can be a group like Everyone OR a user like SYSTEM

data/lib/puppet/util/windows/file.rb

@@ -111,11 +111,15 @@ module Puppet::Util::Windows::File
 
       # return true if path exists and it's not a symlink
       # Other file attributes are ignored. https://msdn.microsoft.com/en-us/library/windows/desktop/gg258117(v=vs.85).aspx
-      return true if (result & FILE_ATTRIBUTE_REPARSE_POINT) != FILE_ATTRIBUTE_REPARSE_POINT
-
-      # walk the symlink and try again...
-      seen_paths << path.downcase
-      path = readlink(path)
+      reparse_point = (result & FILE_ATTRIBUTE_REPARSE_POINT) == FILE_ATTRIBUTE_REPARSE_POINT
+      if reparse_point && symlink_reparse_point?(path)
+        # walk the symlink and try again...
+        seen_paths << path.downcase
+        path = readlink(path)
+      else
+        # file was found and its not a symlink
+        return true
+      end
     end
 
     false
@@ -177,6 +181,18 @@ module Puppet::Util::Windows::File
         "#{flags_and_attributes.to_s(8)}, #{template_file_handle})")
   end
 
+  IO_REPARSE_TAG_MOUNT_POINT  = 0xA0000003
+  IO_REPARSE_TAG_HSM          = 0xC0000004
+  IO_REPARSE_TAG_HSM2         = 0x80000006
+  IO_REPARSE_TAG_SIS          = 0x80000007
+  IO_REPARSE_TAG_WIM          = 0x80000008
+  IO_REPARSE_TAG_CSV          = 0x80000009
+  IO_REPARSE_TAG_DFS          = 0x8000000A
+  IO_REPARSE_TAG_SYMLINK      = 0xA000000C
+  IO_REPARSE_TAG_DFSR         = 0x80000012
+  IO_REPARSE_TAG_DEDUP        = 0x80000013
+  IO_REPARSE_TAG_NFS          = 0x80000014
+
   def self.get_reparse_point_data(handle, &block)
     # must be multiple of 1024, min 10240
     FFI::MemoryPointer.new(MAXIMUM_REPARSE_DATA_BUFFER_SIZE) do |reparse_data_buffer_ptr|
@@ -184,11 +200,11 @@ module Puppet::Util::Windows::File
 
       reparse_tag = reparse_data_buffer_ptr.read_win32_ulong
       buffer_type = case reparse_tag
-      when 0xA000000C
+      when IO_REPARSE_TAG_SYMLINK
         SYMLINK_REPARSE_DATA_BUFFER
-      when 0xA0000003
+      when IO_REPARSE_TAG_MOUNT_POINT
         MOUNT_POINT_REPARSE_DATA_BUFFER
-      when 0x80000014
+      when IO_REPARSE_TAG_NFS
         raise Puppet::Util::Windows::Error.new("Retrieving NFS reparse point data is unsupported")
       else
         raise Puppet::Util::Windows::Error.new("DeviceIoControl(#{handle}, " +
@@ -202,6 +218,20 @@ module Puppet::Util::Windows::File
     nil
   end
 
+  def self.get_reparse_point_tag(handle)
+    reparse_tag = nil
+
+    # must be multiple of 1024, min 10240
+    FFI::MemoryPointer.new(MAXIMUM_REPARSE_DATA_BUFFER_SIZE) do |reparse_data_buffer_ptr|
+      device_io_control(handle, FSCTL_GET_REPARSE_POINT, nil, reparse_data_buffer_ptr)
+
+      # DWORD ReparseTag is the first member of the struct
+      reparse_tag = reparse_data_buffer_ptr.read_win32_ulong
+    end
+
+    reparse_tag
+  end
+
   def self.device_io_control(handle, io_control_code, in_buffer = nil, out_buffer = nil)
     if out_buffer.nil?
       raise Puppet::Util::Windows::Error.new("out_buffer is required")
@@ -229,12 +259,18 @@ module Puppet::Util::Windows::File
   end
 
   FILE_ATTRIBUTE_REPARSE_POINT = 0x400
-  def symlink?(file_name)
+  def reparse_point?(file_name)
     attributes = get_attributes(file_name, false)
 
     return false if (attributes == INVALID_FILE_ATTRIBUTES)
     (attributes & FILE_ATTRIBUTE_REPARSE_POINT) == FILE_ATTRIBUTE_REPARSE_POINT
   end
+  module_function :reparse_point?
+
+  def symlink?(file_name)
+    # Puppet currently only handles mount point and symlink reparse points, ignores others
+    reparse_point?(file_name) && symlink_reparse_point?(file_name)
+  end
   module_function :symlink?
 
   GENERIC_READ                  = 0x80000000
@@ -375,6 +411,22 @@ module Puppet::Util::Windows::File
     path
   end
 
+  # these reparse point types are the only ones Puppet currently understands
+  # so rather than raising an exception in readlink, prefer to not consider
+  # the path a symlink when stat'ing later
+  def self.symlink_reparse_point?(path)
+    symlink = false
+
+    open_symlink(path) do |handle|
+      symlink = [
+        IO_REPARSE_TAG_SYMLINK,
+        IO_REPARSE_TAG_MOUNT_POINT
+      ].include?(get_reparse_point_tag(handle))
+    end
+
+    symlink
+  end
+
   ffi_convention :stdcall
 
   # https://msdn.microsoft.com/en-us/library/windows/desktop/aa365512(v=vs.85).aspx