puppet 4.3.0 → 4.4.0

data/lib/puppet/util/windows/principal.rb

@@ -0,0 +1,190 @@
+require 'puppet/util/windows'
+
+module Puppet::Util::Windows::SID
+  class Principal
+    extend FFI::Library
+    attr_reader :account, :sid_bytes, :sid, :domain, :domain_account, :account_type
+
+    def initialize(account, sid_bytes, sid, domain, account_type)
+      # This is only ever called from lookup_account_sid which has already
+      # removed the potential for passing in an account like host\user
+      @account = account
+      @sid_bytes = sid_bytes
+      @sid = sid
+      @domain = domain
+      @account_type = account_type
+      # When domain is available and it is a Domain principal, use domain only
+      #   otherwise if domain is available then combine it with parsed account
+      #   otherwise when the domain is not available, use the account value directly
+      # WinNT naming standard https://msdn.microsoft.com/en-us/library/windows/desktop/aa746534(v=vs.85).aspx
+      if (domain && !domain.empty? && @account_type == :SidTypeDomain)
+        @domain_account = @domain
+      elsif (domain && !domain.empty?)
+        @domain_account =  "#{domain}\\#{@account}"
+      else
+        @domain_account = account
+      end
+    end
+
+    # added for backward compatibility
+    def ==(compare)
+      compare.is_a?(Puppet::Util::Windows::SID::Principal) &&
+        @sid_bytes == compare.sid_bytes
+    end
+
+    # added for backward compatibility
+    def to_s
+      @sid
+    end
+
+    # = 8 + max sub identifiers (15) * 4
+    MAXIMUM_SID_BYTE_LENGTH = 68
+
+    ERROR_INSUFFICIENT_BUFFER = 122
+
+    def self.lookup_account_name(system_name = nil, account_name)
+      system_name_ptr = FFI::Pointer::NULL
+      begin
+        if system_name
+          system_name_wide = Puppet::Util::Windows::String.wide_string(system_name)
+          # uchar here is synonymous with byte
+          system_name_ptr = FFI::MemoryPointer.new(:byte, system_name_wide.bytesize)
+          system_name_ptr.put_array_of_uchar(0, system_name_wide.bytes.to_a)
+        end
+
+        FFI::MemoryPointer.from_string_to_wide_string(account_name) do |account_name_ptr|
+          FFI::MemoryPointer.new(:byte, MAXIMUM_SID_BYTE_LENGTH) do |sid_ptr|
+            FFI::MemoryPointer.new(:dword, 1) do |sid_length_ptr|
+              FFI::MemoryPointer.new(:dword, 1) do |domain_length_ptr|
+                FFI::MemoryPointer.new(:uint32, 1) do |name_use_enum_ptr|
+
+                sid_length_ptr.write_dword(MAXIMUM_SID_BYTE_LENGTH)
+                success = LookupAccountNameW(system_name_ptr, account_name_ptr, sid_ptr, sid_length_ptr,
+                  FFI::Pointer::NULL, domain_length_ptr, name_use_enum_ptr)
+                last_error = FFI.errno
+
+                if (success == FFI::WIN32_FALSE && last_error != ERROR_INSUFFICIENT_BUFFER)
+                  raise Puppet::Util::Windows::Error.new('Failed to call LookupAccountNameW', last_error)
+                end
+
+                FFI::MemoryPointer.new(:lpwstr, domain_length_ptr.read_dword) do |domain_ptr|
+                  if LookupAccountNameW(system_name_ptr, account_name_ptr,
+                      sid_ptr, sid_length_ptr,
+                      domain_ptr, domain_length_ptr, name_use_enum_ptr) == FFI::WIN32_FALSE
+                   raise Puppet::Util::Windows::Error.new('Failed to call LookupAccountNameW')
+                  end
+
+                  # with a SID returned, loop back through lookup_account_sid to retrieve official name
+                  # necessary when accounts like . or '' are passed in
+                  return lookup_account_sid(
+                    system_name,
+                    sid_ptr.read_bytes(sid_length_ptr.read_dword).unpack('C*'))
+                  end
+                end
+              end
+            end
+          end
+        end
+      ensure
+        system_name_ptr.free if system_name_ptr != FFI::Pointer::NULL
+      end
+    end
+
+    def self.lookup_account_sid(system_name = nil, sid_bytes)
+      system_name_ptr = FFI::Pointer::NULL
+      if (sid_bytes.nil? || (!sid_bytes.is_a? Array) || (sid_bytes.length == 0))
+        raise Puppet::Util::Windows::Error.new('Byte array for lookup_account_sid must not be nil and must be at least 1 byte long')
+      end
+
+      begin
+        if system_name
+          system_name_wide = Puppet::Util::Windows::String.wide_string(system_name)
+          # uchar here is synonymous with byte
+          system_name_ptr = FFI::MemoryPointer.new(:byte, system_name_wide.bytesize)
+          system_name_ptr.put_array_of_uchar(0, system_name_wide.bytes.to_a)
+        end
+
+        FFI::MemoryPointer.new(:byte, sid_bytes.length) do |sid_ptr|
+          FFI::MemoryPointer.new(:dword, 1) do |name_length_ptr|
+            FFI::MemoryPointer.new(:dword, 1) do |domain_length_ptr|
+              FFI::MemoryPointer.new(:uint32, 1) do |name_use_enum_ptr|
+
+                sid_ptr.write_array_of_uchar(sid_bytes)
+                success = LookupAccountSidW(system_name_ptr, sid_ptr, FFI::Pointer::NULL, name_length_ptr,
+                  FFI::Pointer::NULL, domain_length_ptr, name_use_enum_ptr)
+                last_error = FFI.errno
+
+                if (success == FFI::WIN32_FALSE && last_error != ERROR_INSUFFICIENT_BUFFER)
+                  raise Puppet::Util::Windows::Error.new('Failed to call LookupAccountSidW', last_error)
+                end
+
+                FFI::MemoryPointer.new(:lpwstr, name_length_ptr.read_dword) do |name_ptr|
+                  FFI::MemoryPointer.new(:lpwstr, domain_length_ptr.read_dword) do |domain_ptr|
+                    if LookupAccountSidW(system_name_ptr, sid_ptr, name_ptr, name_length_ptr,
+                        domain_ptr, domain_length_ptr, name_use_enum_ptr) == FFI::WIN32_FALSE
+                     raise Puppet::Util::Windows::Error.new('Failed to call LookupAccountSidW')
+                    end
+
+                    return new(
+                      name_ptr.read_wide_string(name_length_ptr.read_dword),
+                      sid_bytes,
+                      Puppet::Util::Windows::SID.sid_ptr_to_string(sid_ptr),
+                      domain_ptr.read_wide_string(domain_length_ptr.read_dword),
+                      SID_NAME_USE[name_use_enum_ptr.read_uint32])
+                  end
+                end
+              end
+            end
+          end
+        end
+      ensure
+        system_name_ptr.free if system_name_ptr != FFI::Pointer::NULL
+      end
+    end
+
+    ffi_convention :stdcall
+
+    # https://msdn.microsoft.com/en-us/library/windows/desktop/aa379601(v=vs.85).aspx
+    SID_NAME_USE = enum(
+      :SidTypeUser, 1,
+      :SidTypeGroup, 2,
+      :SidTypeDomain, 3,
+      :SidTypeAlias, 4,
+      :SidTypeWellKnownGroup, 5,
+      :SidTypeDeletedAccount, 6,
+      :SidTypeInvalid, 7,
+      :SidTypeUnknown, 8,
+      :SidTypeComputer, 9,
+      :SidTypeLabel, 10
+    )
+
+    # https://msdn.microsoft.com/en-us/library/windows/desktop/aa379159(v=vs.85).aspx
+    # BOOL WINAPI LookupAccountName(
+    #   _In_opt_  LPCTSTR       lpSystemName,
+    #   _In_      LPCTSTR       lpAccountName,
+    #   _Out_opt_ PSID          Sid,
+    #   _Inout_   LPDWORD       cbSid,
+    #   _Out_opt_ LPTSTR        ReferencedDomainName,
+    #   _Inout_   LPDWORD       cchReferencedDomainName,
+    #   _Out_     PSID_NAME_USE peUse
+    # );
+    ffi_lib :advapi32
+    attach_function_private :LookupAccountNameW,
+      [:lpcwstr, :lpcwstr, :pointer, :lpdword, :lpwstr, :lpdword, :pointer], :win32_bool
+
+    # https://msdn.microsoft.com/en-us/library/windows/desktop/aa379166(v=vs.85).aspx
+    # BOOL WINAPI LookupAccountSid(
+    #   _In_opt_  LPCTSTR       lpSystemName,
+    #   _In_      PSID          lpSid,
+    #   _Out_opt_ LPTSTR        lpName,
+    #   _Inout_   LPDWORD       cchName,
+    #   _Out_opt_ LPTSTR        lpReferencedDomainName,
+    #   _Inout_   LPDWORD       cchReferencedDomainName,
+    #   _Out_     PSID_NAME_USE peUse
+    # );
+    ffi_lib :advapi32
+    attach_function_private :LookupAccountSidW,
+      [:lpcwstr, :pointer, :lpwstr, :lpdword, :lpwstr, :lpdword, :pointer], :win32_bool
+  end
+end
+

data/lib/puppet/util/windows/process.rb

@@ -224,6 +224,51 @@ module Puppet::Util::Windows::Process
   end
   module_function :windows_major_version
 
+  # Returns a hash of the current environment variables encoded as UTF-8
+  # The memory block returned from GetEnvironmentStringsW is double-null terminated and the vars are paired as below;
+  # Var1=Value1\0
+  # Var2=Value2\0
+  # VarX=ValueX\0\0
+  # Note - Some env variable names start with '=' and are excluded from the return value
+  # Note - The env_ptr MUST be freed using the FreeEnvironmentStringsW function
+  # Note - There is no technical limitation to the size of the environment block returned.
+  #   However a pracitcal limit of 64K is used as no single environment variable can exceed 32KB
+  def get_environment_strings
+    env_ptr = GetEnvironmentStringsW()
+
+    pairs = env_ptr.read_arbitrary_wide_string_up_to(65534, :double_null)
+      .split(?\x00)
+      .reject { |env_str| env_str.nil? || env_str.empty? || env_str[0] == '=' }
+      .map { |env_pair| env_pair.split('=', 2) }
+    Hash[ pairs ]
+  ensure
+    if env_ptr && ! env_ptr.null?
+      if FreeEnvironmentStringsW(env_ptr) == FFI::WIN32_FALSE
+        Puppet.debug "FreeEnvironmentStringsW memory leak"
+      end
+    end
+  end
+  module_function :get_environment_strings
+
+  def set_environment_variable(name, val)
+    raise Puppet::Util::Windows::Error('environment variable name must not be nil or empty') if ! name || name.empty?
+
+    FFI::MemoryPointer.from_string_to_wide_string(name) do |name_ptr|
+      if (val.nil?)
+        if SetEnvironmentVariableW(name_ptr, FFI::MemoryPointer::NULL) == FFI::WIN32_FALSE
+          raise Puppet::Util::Windows::Error.new("Failed to remove environment variable: #{name}")
+        end
+      else
+        FFI::MemoryPointer.from_string_to_wide_string(val) do |val_ptr|
+          if SetEnvironmentVariableW(name_ptr, val_ptr) == FFI::WIN32_FALSE
+            raise Puppet::Util::Windows::Error.new("Failed to set environment variable: #{name}")
+          end
+        end
+      end
+    end
+  end
+  module_function :set_environment_variable
+
   # Returns whether or not the OS has the ability to set elevated
   # token information.
   #
@@ -243,7 +288,7 @@ module Puppet::Util::Windows::Process
 
   ffi_convention :stdcall
 
-  # http://msdn.microsoft.com/en-us/library/windows/desktop/ms687032(v=vs.85).aspx
+  # https://msdn.microsoft.com/en-us/library/windows/desktop/ms687032(v=vs.85).aspx
   # DWORD WINAPI WaitForSingleObject(
   #   _In_  HANDLE hHandle,
   #   _In_  DWORD dwMilliseconds
@@ -252,7 +297,7 @@ module Puppet::Util::Windows::Process
   attach_function_private :WaitForSingleObject,
     [:handle, :dword], :dword
 
-  # http://msdn.microsoft.com/en-us/library/windows/desktop/ms683189(v=vs.85).aspx
+  # https://msdn.microsoft.com/en-us/library/windows/desktop/ms683189(v=vs.85).aspx
   # BOOL WINAPI GetExitCodeProcess(
   #   _In_   HANDLE hProcess,
   #   _Out_  LPDWORD lpExitCode
@@ -261,12 +306,34 @@ module Puppet::Util::Windows::Process
   attach_function_private :GetExitCodeProcess,
     [:handle, :lpdword], :win32_bool
 
-  # http://msdn.microsoft.com/en-us/library/windows/desktop/ms683179(v=vs.85).aspx
+  # https://msdn.microsoft.com/en-us/library/windows/desktop/ms683179(v=vs.85).aspx
   # HANDLE WINAPI GetCurrentProcess(void);
   ffi_lib :kernel32
   attach_function_private :GetCurrentProcess, [], :handle
 
-  # http://msdn.microsoft.com/en-us/library/windows/desktop/aa379295(v=vs.85).aspx
+  # https://msdn.microsoft.com/en-us/library/windows/desktop/ms683187(v=vs.85).aspx
+  # LPTCH GetEnvironmentStrings(void);
+  ffi_lib :kernel32
+  attach_function_private :GetEnvironmentStringsW, [], :pointer
+
+  # https://msdn.microsoft.com/en-us/library/windows/desktop/ms683151(v=vs.85).aspx
+  # BOOL FreeEnvironmentStrings(
+  #   _In_ LPTCH lpszEnvironmentBlock
+  # );
+  ffi_lib :kernel32
+  attach_function_private :FreeEnvironmentStringsW,
+    [:pointer], :win32_bool
+
+  # https://msdn.microsoft.com/en-us/library/windows/desktop/ms686206(v=vs.85).aspx
+  # BOOL WINAPI SetEnvironmentVariableW(
+  #     _In_     LPCTSTR lpName,
+  #     _In_opt_ LPCTSTR lpValue
+  #   );
+  ffi_lib :kernel32
+  attach_function_private :SetEnvironmentVariableW,
+    [:lpcwstr, :lpcwstr], :win32_bool
+
+  # https://msdn.microsoft.com/en-us/library/windows/desktop/aa379295(v=vs.85).aspx
   # BOOL WINAPI OpenProcessToken(
   #   _In_   HANDLE ProcessHandle,
   #   _In_   DWORD DesiredAccess,
@@ -277,7 +344,7 @@ module Puppet::Util::Windows::Process
     [:handle, :dword, :phandle], :win32_bool
 
 
-  # http://msdn.microsoft.com/en-us/library/windows/desktop/aa379261(v=vs.85).aspx
+  # https://msdn.microsoft.com/en-us/library/windows/desktop/aa379261(v=vs.85).aspx
   # typedef struct _LUID {
   #   DWORD LowPart;
   #   LONG  HighPart;
@@ -287,7 +354,7 @@ module Puppet::Util::Windows::Process
            :HighPart, :win32_long
   end
 
-  # http://msdn.microsoft.com/en-us/library/Windows/desktop/aa379180(v=vs.85).aspx
+  # https://msdn.microsoft.com/en-us/library/Windows/desktop/aa379180(v=vs.85).aspx
   # BOOL WINAPI LookupPrivilegeValue(
   #   _In_opt_  LPCTSTR lpSystemName,
   #   _In_      LPCTSTR lpName,
@@ -297,7 +364,7 @@ module Puppet::Util::Windows::Process
   attach_function_private :LookupPrivilegeValueW,
     [:lpcwstr, :lpcwstr, :pointer], :win32_bool
 
-  # http://msdn.microsoft.com/en-us/library/windows/desktop/aa379626(v=vs.85).aspx
+  # https://msdn.microsoft.com/en-us/library/windows/desktop/aa379626(v=vs.85).aspx
   TOKEN_INFORMATION_CLASS = enum(
       :TokenUser, 1,
       :TokenGroups,
@@ -342,7 +409,7 @@ module Puppet::Util::Windows::Process
       :MaxTokenInfoClass
   )
 
-  # http://msdn.microsoft.com/en-us/library/windows/desktop/aa379263(v=vs.85).aspx
+  # https://msdn.microsoft.com/en-us/library/windows/desktop/aa379263(v=vs.85).aspx
   # typedef struct _LUID_AND_ATTRIBUTES {
   #   LUID  Luid;
   #   DWORD Attributes;
@@ -352,7 +419,7 @@ module Puppet::Util::Windows::Process
            :Attributes, :dword
   end
 
-  # http://msdn.microsoft.com/en-us/library/windows/desktop/aa379630(v=vs.85).aspx
+  # https://msdn.microsoft.com/en-us/library/windows/desktop/aa379630(v=vs.85).aspx
   # typedef struct _TOKEN_PRIVILEGES {
   #   DWORD               PrivilegeCount;
   #   LUID_AND_ATTRIBUTES Privileges[ANYSIZE_ARRAY];
@@ -362,7 +429,7 @@ module Puppet::Util::Windows::Process
            :Privileges, [LUID_AND_ATTRIBUTES, 1]    # placeholder for offset
   end
 
-  # http://msdn.microsoft.com/en-us/library/windows/desktop/bb530717(v=vs.85).aspx
+  # https://msdn.microsoft.com/en-us/library/windows/desktop/bb530717(v=vs.85).aspx
   # typedef struct _TOKEN_ELEVATION {
   #   DWORD TokenIsElevated;
   # } TOKEN_ELEVATION, *PTOKEN_ELEVATION;
@@ -370,7 +437,7 @@ module Puppet::Util::Windows::Process
     layout :TokenIsElevated, :dword
   end
 
-  # http://msdn.microsoft.com/en-us/library/windows/desktop/aa446671(v=vs.85).aspx
+  # https://msdn.microsoft.com/en-us/library/windows/desktop/aa446671(v=vs.85).aspx
   # BOOL WINAPI GetTokenInformation(
   #   _In_       HANDLE TokenHandle,
   #   _In_       TOKEN_INFORMATION_CLASS TokenInformationClass,

data/lib/puppet/util/windows/registry.rb

@@ -5,7 +5,7 @@ module Puppet::Util::Windows
     require 'ffi'
     extend FFI::Library
 
-    # http://msdn.microsoft.com/en-us/library/windows/desktop/aa384129(v=vs.85).aspx
+    # https://msdn.microsoft.com/en-us/library/windows/desktop/aa384129(v=vs.85).aspx
     KEY64 = 0x100
     KEY32 = 0x200
 
@@ -207,21 +207,27 @@ module Puppet::Util::Windows
         # buffer is raw bytes, *not* chars - less a NULL terminator
         string_length = (byte_length / FFI.type_size(:wchar)) - 1 if byte_length > 0
 
-        case type
-        when Win32::Registry::REG_SZ, Win32::Registry::REG_EXPAND_SZ
-          result = [ type, data_ptr.read_wide_string(string_length) ]
-        when Win32::Registry::REG_MULTI_SZ
-          result = [ type, data_ptr.read_wide_string(string_length).split(/\0/) ]
-        when Win32::Registry::REG_BINARY
-          result = [ type, data.read_bytes(0, byte_length) ]
-        when Win32::Registry::REG_DWORD
-          result = [ type, data_ptr.read_dword ]
-        when Win32::Registry::REG_DWORD_BIG_ENDIAN
-          result = [ type, data_ptr.order(:big).read_dword ]
-        when Win32::Registry::REG_QWORD
-          result = [ type, data_ptr.read_qword ]
-        else
-          raise TypeError, "Type #{type} is not supported."
+        begin
+          case type
+            when Win32::Registry::REG_SZ, Win32::Registry::REG_EXPAND_SZ
+              result = [ type, data_ptr.read_wide_string(string_length) ]
+            when Win32::Registry::REG_MULTI_SZ
+              result = [ type, data_ptr.read_wide_string(string_length).split(/\0/) ]
+            when Win32::Registry::REG_BINARY
+              result = [ type, data_ptr.read_bytes(byte_length) ]
+            when Win32::Registry::REG_DWORD
+              result = [ type, data_ptr.read_dword ]
+            when Win32::Registry::REG_DWORD_BIG_ENDIAN
+              result = [ type, data_ptr.order(:big).read_dword ]
+            when Win32::Registry::REG_QWORD
+              result = [ type, data_ptr.read_qword ]
+            else
+              raise TypeError, "Type #{type} is not supported."
+          end
+        rescue IndexError => ex
+          raise if (ex.message !~ /^Memory access .* is out of bounds$/i)
+          parent_key_name = key.parent ? "#{key.parent.keyname}\\" : ""
+          Puppet.warning "A value in the registry key #{parent_key_name}#{key.keyname} is corrupt or invalid"
         end
       end
 

data/lib/puppet/util/windows/root_certs.rb

@@ -34,7 +34,7 @@ class Puppet::Util::Windows::RootCerts
     certs = []
 
     # This is based on a patch submitted to openssl:
-    # http://www.mail-archive.com/openssl-dev@openssl.org/msg26958.html
+    # https://www.mail-archive.com/openssl-dev@openssl.org/msg26958.html
     ptr = FFI::Pointer::NULL
     store = CertOpenSystemStoreA(nil, "ROOT")
     begin
@@ -57,7 +57,7 @@ class Puppet::Util::Windows::RootCerts
   ffi_convention :stdcall
   # typedef void *HCERTSTORE;
 
-  # http://msdn.microsoft.com/en-us/library/windows/desktop/aa377189(v=vs.85).aspx
+  # https://msdn.microsoft.com/en-us/library/windows/desktop/aa377189(v=vs.85).aspx
   # typedef struct _CERT_CONTEXT {
   #   DWORD      dwCertEncodingType;
   #   BYTE       *pbCertEncoded;
@@ -75,7 +75,7 @@ class Puppet::Util::Windows::RootCerts
     )
   end
 
-  # http://msdn.microsoft.com/en-us/library/windows/desktop/aa376560(v=vs.85).aspx
+  # https://msdn.microsoft.com/en-us/library/windows/desktop/aa376560(v=vs.85).aspx
   # HCERTSTORE
   # WINAPI
   # CertOpenSystemStoreA(
@@ -86,7 +86,7 @@ class Puppet::Util::Windows::RootCerts
   ffi_lib :crypt32
   attach_function_private :CertOpenSystemStoreA, [:ulong_ptr, :lpcstr], :handle
 
-  # http://msdn.microsoft.com/en-us/library/windows/desktop/aa376050(v=vs.85).aspx
+  # https://msdn.microsoft.com/en-us/library/windows/desktop/aa376050(v=vs.85).aspx
   # PCCERT_CONTEXT
   # WINAPI
   # CertEnumCertificatesInStore(
@@ -96,7 +96,7 @@ class Puppet::Util::Windows::RootCerts
   ffi_lib :crypt32
   attach_function_private :CertEnumCertificatesInStore, [:handle, :pointer], :pointer
 
-  # http://msdn.microsoft.com/en-us/library/windows/desktop/aa376026(v=vs.85).aspx
+  # https://msdn.microsoft.com/en-us/library/windows/desktop/aa376026(v=vs.85).aspx
   # BOOL
   # WINAPI
   # CertCloseStore(