puppet 4.5.3-x64-mingw32 → 4.6.1-x64-mingw32

data/spec/integration/type/file_spec.rb

@@ -722,11 +722,11 @@ describe Puppet::Type.type(:file), :uses_checksums => true do
 
       FileUtils.mkdir_p(srcdir)
       FileUtils.mkdir_p(dstdir)
-      
+
       srcfile = File.join(srcdir, "file.src")
       cpyfile = File.join(dstdir, "file.src")
       ignfile = File.join(srcdir, "file.ign")
-      
+
       File.open(srcfile, "w") { |f| f.puts "don't ignore me" }
       File.open(ignfile, "w") { |f| f.puts "you better ignore me" }
 
@@ -735,7 +735,7 @@ describe Puppet::Type.type(:file), :uses_checksums => true do
                              :name => srcdir,
                              :ensure => 'directory',
                              :mode => '0755',)
-      
+
       catalog.add_resource described_class.new(
                              :name => dstdir,
                              :ensure => 'directory',
@@ -743,7 +743,7 @@ describe Puppet::Type.type(:file), :uses_checksums => true do
                              :source => srcdir,
                              :recurse => true,
                              :ignore => '*.ign',)
-      
+
       catalog.apply
       expect(Puppet::FileSystem.exist?(srcdir)).to be_truthy
       expect(Puppet::FileSystem.exist?(dstdir)).to be_truthy
@@ -1393,9 +1393,8 @@ describe Puppet::Type.type(:file), :uses_checksums => true do
       describe "when processing SYSTEM ACEs" do
         before do
           @sids = {
-            :current_user => Puppet::Util::Windows::SID.name_to_sid(Puppet::Util::Windows::ADSI::User.current_user_name),
+            :current_user => Puppet::Util::Windows::ADSI::User.current_user_sid.sid,
             :system => Puppet::Util::Windows::SID::LocalSystem,
-            :guest => Puppet::Util::Windows::SID.name_to_sid("Guest"),
             :users => Puppet::Util::Windows::SID::BuiltinUsers,
             :power_users => Puppet::Util::Windows::SID::PowerUsers,
             :none => Puppet::Util::Windows::SID::Nobody
@@ -1415,8 +1414,8 @@ describe Puppet::Type.type(:file), :uses_checksums => true do
 
           describe "when permissions are not insync?" do
             before :each do
-              @file[:owner] = 'None'
-              @file[:group] = 'None'
+              @file[:owner] = @sids[:none]
+              @file[:group] = @sids[:none]
             end
 
             it "preserves the inherited SYSTEM ACE for an existing file" do
@@ -1503,8 +1502,8 @@ describe Puppet::Type.type(:file), :uses_checksums => true do
 
           describe "when permissions are not insync?" do
             before :each do
-              @directory[:owner] = 'None'
-              @directory[:group] = 'None'
+              @directory[:owner] = @sids[:none]
+              @directory[:group] = @sids[:none]
             end
 
             it "preserves the inherited SYSTEM ACEs for an existing directory" do
@@ -1726,7 +1725,7 @@ describe Puppet::Type.type(:file), :uses_checksums => true do
         catalog.apply
         expect(Puppet::FileSystem).to be_directory(copy)
       end
-    
+
       it "should copy the link itself if :links => manage" do
         catalog.add_resource described_class.new(
           :name => target,
@@ -1746,7 +1745,7 @@ describe Puppet::Type.type(:file), :uses_checksums => true do
         expect(Dir.entries(link)).to eq(Dir.entries(copy))
       end
     end
-  
+
     context "and the recurse attribute is true" do
       it "should recursively copy the directory if :links => follow" do
         catalog.add_resource described_class.new(

data/spec/integration/util/windows/adsi_spec.rb

@@ -0,0 +1,99 @@
+#!/usr/bin/env ruby
+require 'spec_helper'
+require 'puppet/util/windows'
+
+describe Puppet::Util::Windows::ADSI::User,
+  :if => Puppet.features.microsoft_windows? do
+
+  describe ".initialize" do
+    it "cannot reference BUILTIN accounts like SYSTEM due to WinNT moniker limitations" do
+      system = Puppet::Util::Windows::ADSI::User.new('SYSTEM')
+      # trying to retrieve COM object should fail to load with a localized version of:
+      # ADSI connection error: failed to parse display name of moniker `WinNT://./SYSTEM,user'
+      #     HRESULT error code:0x800708ad
+      #           The user name could not be found.
+      # Matching on error code alone is sufficient
+      expect { system.native_user }.to raise_error(/0x800708ad/)
+    end
+  end
+
+  describe '.each' do
+    it 'should return a list of users with UTF-8 names' do
+      begin
+        original_codepage = Encoding.default_external
+        Encoding.default_external = Encoding::CP850 # Western Europe
+
+        Puppet::Util::Windows::ADSI::User.each do |user|
+          expect(user.name.encoding).to be(Encoding::UTF_8)
+        end
+      ensure
+        Encoding.default_external = original_codepage
+      end
+    end
+  end
+
+  describe '.[]' do
+    it 'should return string attributes as UTF-8' do
+      administrator = Puppet::Util::Windows::ADSI::User.new('Administrator')
+      expect(administrator['Description'].encoding).to eq(Encoding::UTF_8)
+    end
+  end
+
+  describe '.groups' do
+    it 'should return a list of groups with UTF-8 names' do
+      begin
+        original_codepage = Encoding.default_external
+        Encoding.default_external = Encoding::CP850 # Western Europe
+
+
+        # lookup by English name Administrator is OK on localized Windows
+        administrator = Puppet::Util::Windows::ADSI::User.new('Administrator')
+        administrator.groups.each do |name|
+          expect(name.encoding).to be(Encoding::UTF_8)
+        end
+      ensure
+        Encoding.default_external = original_codepage
+      end
+    end
+  end
+end
+
+describe Puppet::Util::Windows::ADSI::Group,
+  :if => Puppet.features.microsoft_windows? do
+
+  let (:administrator_bytes) { [1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0] }
+  let (:administrators_principal) { Puppet::Util::Windows::SID::Principal.lookup_account_sid(administrator_bytes) }
+
+  describe '.each' do
+    it 'should return a list of groups with UTF-8 names' do
+      begin
+        original_codepage = Encoding.default_external
+        Encoding.default_external = Encoding::CP850 # Western Europe
+
+
+        Puppet::Util::Windows::ADSI::Group.each do |group|
+          expect(group.name.encoding).to be(Encoding::UTF_8)
+        end
+      ensure
+        Encoding.default_external = original_codepage
+      end
+    end
+  end
+
+  describe '.members' do
+    it 'should return a list of members with UTF-8 names' do
+      begin
+        original_codepage = Encoding.default_external
+        Encoding.default_external = Encoding::CP850 # Western Europe
+
+        # lookup by English name Administrators is not OK on localized Windows
+        admins = Puppet::Util::Windows::ADSI::Group.new(administrators_principal.account)
+        admins.members.each do |name|
+          expect(name.encoding).to be(Encoding::UTF_8)
+        end
+      ensure
+        Encoding.default_external = original_codepage
+      end
+    end
+  end
+end

data/spec/integration/util/windows/principal_spec.rb

@@ -4,38 +4,45 @@ require 'puppet/util/windows'
 
 describe Puppet::Util::Windows::SID::Principal, :if => Puppet.features.microsoft_windows? do
 
+  let (:current_user_sid) { Puppet::Util::Windows::ADSI::User.current_user_sid }
   let (:system_bytes) { [1, 1, 0, 0, 0, 0, 0, 5, 18, 0, 0, 0] }
+  let (:null_sid_bytes) { bytes = [1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0] }
   let (:administrator_bytes) { [1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0] }
+  let (:computer_sid) { Puppet::Util::Windows::SID.name_to_sid_object(Socket.gethostname) }
+  # BUILTIN is localized on German Windows, but not French
+  # looking this up like this dilutes the values of the tests as we're comparing two mechanisms
+  # for returning the same values, rather than to a known good
+  let (:builtin_localized) { Puppet::Util::Windows::SID.sid_to_name('S-1-5-32') }
 
   describe ".lookup_account_name" do
     it "should create an instance from a well-known account name" do
-      principal = Puppet::Util::Windows::SID::Principal.lookup_account_name('SYSTEM')
-      expect(principal.account).to eq('SYSTEM')
-      expect(principal.sid_bytes).to eq(system_bytes)
-      expect(principal.sid).to eq('S-1-5-18')
-      expect(principal.domain).to eq('NT AUTHORITY')
-      expect(principal.domain_account).to eq('NT AUTHORITY\\SYSTEM')
-
-      # Windows API LookupAccountSid behaves differently if current user is SYSTEM
-      if Puppet::Util::Windows::ADSI::User.current_user_name != 'SYSTEM'
-        account_type = :SidTypeWellKnownGroup
-      else
-        account_type = :SidTypeUser
-      end
-
-      expect(principal.account_type).to eq(account_type)
+      principal = Puppet::Util::Windows::SID::Principal.lookup_account_name('NULL SID')
+      expect(principal.account).to eq('NULL SID')
+      expect(principal.sid_bytes).to eq(null_sid_bytes)
+      expect(principal.sid).to eq('S-1-0-0')
+      expect(principal.domain).to eq('')
+      expect(principal.domain_account).to eq('NULL SID')
+      expect(principal.account_type).to eq(:SidTypeWellKnownGroup)
     end
 
     it "should create an instance from a well-known account prefixed with NT AUTHORITY" do
+      # a special case that can be used to lookup an account on a localized Windows
       principal = Puppet::Util::Windows::SID::Principal.lookup_account_name('NT AUTHORITY\\SYSTEM')
-      expect(principal.account).to eq('SYSTEM')
       expect(principal.sid_bytes).to eq(system_bytes)
       expect(principal.sid).to eq('S-1-5-18')
-      expect(principal.domain).to eq('NT AUTHORITY')
-      expect(principal.domain_account).to eq('NT AUTHORITY\\SYSTEM')
+
+      # guard these 3 checks on a US Windows with 1033 - primary language id of 9
+      primary_language_id = 9
+      # even though lookup in English, returned values may be localized
+      # French Windows returns AUTORITE NT\\Syst\u00E8me, German Windows returns NT-AUTORIT\u00C4T\\SYSTEM
+      if (Puppet::Util::Windows::Process.get_system_default_ui_language & primary_language_id == primary_language_id)
+        expect(principal.account).to eq('SYSTEM')
+        expect(principal.domain).to eq('NT AUTHORITY')
+        expect(principal.domain_account).to eq('NT AUTHORITY\\SYSTEM')
+      end
 
       # Windows API LookupAccountSid behaves differently if current user is SYSTEM
-      if Puppet::Util::Windows::ADSI::User.current_user_name != 'SYSTEM'
+      if current_user_sid.sid_bytes != system_bytes
         account_type = :SidTypeWellKnownGroup
       else
         account_type = :SidTypeUser
@@ -45,9 +52,11 @@ describe Puppet::Util::Windows::SID::Principal, :if => Puppet.features.microsoft
     end
 
     it "should create an instance from a local account prefixed with hostname" do
-      current_user_name = Puppet::Util::Windows::ADSI::User.current_user_name
-      running_as_system = (current_user_name == 'SYSTEM')
-      username = running_as_system ? 'Administrator' : current_user_name
+      running_as_system = (current_user_sid.sid_bytes == system_bytes)
+      username = running_as_system ?
+        # need to return localized name of Administrator account
+        Puppet::Util::Windows::SID.sid_to_name(computer_sid.sid + '-500').split('\\').last :
+        current_user_sid.account
 
       user_exists = Puppet::Util::Windows::ADSI::User.exists?(".\\#{username}")
 
@@ -65,13 +74,18 @@ describe Puppet::Util::Windows::SID::Principal, :if => Puppet.features.microsoft
       expect(principal.account_type).to eq(:SidTypeUser)
     end
 
-    it "should create an instance from a well-known group alias" do
-      principal = Puppet::Util::Windows::SID::Principal.lookup_account_name('Administrators')
-      expect(principal.account).to eq('Administrators')
+    it "should create an instance from a well-known BUILTIN alias" do
+      # by looking up the localized name of the account, the test value is diluted
+      # this localizes Administrators AND BUILTIN
+      qualified_name = Puppet::Util::Windows::SID.sid_to_name('S-1-5-32-544')
+      domain, name = qualified_name.split('\\')
+      principal = Puppet::Util::Windows::SID::Principal.lookup_account_name(name)
+
+      expect(principal.account).to eq(name)
       expect(principal.sid_bytes).to eq(administrator_bytes)
       expect(principal.sid).to eq('S-1-5-32-544')
-      expect(principal.domain).to eq('BUILTIN')
-      expect(principal.domain_account).to eq('BUILTIN\\Administrators')
+      expect(principal.domain).to eq(domain)
+      expect(principal.domain_account).to eq(qualified_name)
       expect(principal.account_type).to eq(:SidTypeAlias)
     end
 
@@ -79,55 +93,72 @@ describe Puppet::Util::Windows::SID::Principal, :if => Puppet.features.microsoft
       principal = Puppet::Util::Windows::SID::Principal
       expect {
         principal.lookup_account_name('ConanTheBarbarian')
-      }.to raise_error(Puppet::Util::Windows::Error, /Failed to call LookupAccountNameW/)
+      }.to raise_error do |error|
+        expect(error).to be_a(Puppet::Util::Windows::Error)
+        expect(error.code).to eq(1332) # ERROR_NONE_MAPPED
+      end
     end
 
     it "should return a BUILTIN domain principal for empty account names" do
       principal = Puppet::Util::Windows::SID::Principal.lookup_account_name('')
       expect(principal.account_type).to eq(:SidTypeDomain)
       expect(principal.sid).to eq('S-1-5-32')
-      expect(principal.account).to eq('BUILTIN')
-      expect(principal.domain).to eq('BUILTIN')
-      expect(principal.domain_account).to eq('BUILTIN')
+      expect(principal.account).to eq(builtin_localized)
+      expect(principal.domain).to eq(builtin_localized)
+      expect(principal.domain_account).to eq(builtin_localized)
     end
 
     it "should return a BUILTIN domain principal for BUILTIN account names" do
-      principal = Puppet::Util::Windows::SID::Principal.lookup_account_name('BUILTIN')
+      principal = Puppet::Util::Windows::SID::Principal.lookup_account_name(builtin_localized)
       expect(principal.account_type).to eq(:SidTypeDomain)
       expect(principal.sid).to eq('S-1-5-32')
-      expect(principal.account).to eq('BUILTIN')
-      expect(principal.domain).to eq('BUILTIN')
-      expect(principal.domain_account).to eq('BUILTIN')
+      expect(principal.account).to eq(builtin_localized)
+      expect(principal.domain).to eq(builtin_localized)
+      expect(principal.domain_account).to eq(builtin_localized)
     end
 
   end
 
   describe ".lookup_account_sid" do
-    it "should create an instance from a well-known account SID" do
-      principal = Puppet::Util::Windows::SID::Principal.lookup_account_sid(system_bytes)
-      expect(principal.account).to eq('SYSTEM')
-      expect(principal.sid_bytes).to eq(system_bytes)
-      expect(principal.sid).to eq('S-1-5-18')
-      expect(principal.domain).to eq('NT AUTHORITY')
-      expect(principal.domain_account).to eq('NT AUTHORITY\\SYSTEM')
-
-      # Windows API LookupAccountSid behaves differently if current user is SYSTEM
-      if Puppet::Util::Windows::ADSI::User.current_user_name != 'SYSTEM'
-        account_type = :SidTypeWellKnownGroup
-      else
-        account_type = :SidTypeUser
-      end
-
-      expect(principal.account_type).to eq(account_type)
+    it "should create an instance from a user SID" do
+      # take the computer account bytes and append the equivalent of -501 for Guest
+      bytes = (computer_sid.sid_bytes + [245, 1, 0, 0])
+      # computer SID bytes start with [1, 4, ...] but need to be [1, 5, ...]
+      bytes[1] = 5
+      principal = Puppet::Util::Windows::SID::Principal.lookup_account_sid(bytes)
+      # use the returned SID to lookup localized Guest account name in Windows
+      guest_name = Puppet::Util::Windows::SID.sid_to_name(principal.sid)
+
+      expect(principal.sid_bytes).to eq(bytes)
+      expect(principal.sid).to eq(computer_sid.sid + '-501')
+      expect(principal.account).to eq(guest_name.split('\\')[1])
+      expect(principal.domain).to eq(computer_sid.domain)
+      expect(principal.domain_account).to eq(guest_name)
+      expect(principal.account_type).to eq(:SidTypeUser)
     end
 
     it "should create an instance from a well-known group SID" do
+      principal = Puppet::Util::Windows::SID::Principal.lookup_account_sid(null_sid_bytes)
+      expect(principal.sid_bytes).to eq(null_sid_bytes)
+      expect(principal.sid).to eq('S-1-0-0')
+      expect(principal.account).to eq('NULL SID')
+      expect(principal.domain).to eq('')
+      expect(principal.domain_account).to eq('NULL SID')
+      expect(principal.account_type).to eq(:SidTypeWellKnownGroup)
+    end
+
+    it "should create an instance from a well-known BUILTIN Alias SID" do
       principal = Puppet::Util::Windows::SID::Principal.lookup_account_sid(administrator_bytes)
-      expect(principal.account).to eq('Administrators')
+      # by looking up the localized name of the account, the test value is diluted
+      # this localizes Administrators AND BUILTIN
+      qualified_name = Puppet::Util::Windows::SID.sid_to_name('S-1-5-32-544')
+      domain, name = qualified_name.split('\\')
+
+      expect(principal.account).to eq(name)
       expect(principal.sid_bytes).to eq(administrator_bytes)
       expect(principal.sid).to eq('S-1-5-32-544')
-      expect(principal.domain).to eq('BUILTIN')
-      expect(principal.domain_account).to eq('BUILTIN\\Administrators')
+      expect(principal.domain).to eq(domain)
+      expect(principal.domain_account).to eq(qualified_name)
       expect(principal.account_type).to eq(:SidTypeAlias)
     end
 
@@ -159,7 +190,10 @@ describe Puppet::Util::Windows::SID::Principal, :if => Puppet.features.microsoft
       principal = Puppet::Util::Windows::SID::Principal
       expect {
         principal.lookup_account_sid([0])
-      }.to raise_error(Puppet::Util::Windows::Error, /Failed to call LookupAccountSidW:  The parameter is incorrect/)
+      }.to raise_error do |error|
+        expect(error).to be_a(Puppet::Util::Windows::Error)
+        expect(error.code).to eq(87) # ERROR_INVALID_PARAMETER
+      end
     end
 
     it "should raise an error when trying to lookup a valid SID that doesn't have a matching account" do
@@ -167,16 +201,19 @@ describe Puppet::Util::Windows::SID::Principal, :if => Puppet.features.microsoft
       expect {
         # S-1-1-1 which is not a valid account
         principal.lookup_account_sid([1, 1, 0, 0, 0, 0, 0, 1, 1, 0, 0, 0])
-      }.to raise_error(Puppet::Util::Windows::Error, /Failed to call LookupAccountSidW:  No mapping between account names and security IDs was done/)
+      }.to raise_error do |error|
+        expect(error).to be_a(Puppet::Util::Windows::Error)
+        expect(error.code).to eq(1332) # ERROR_NONE_MAPPED
+      end
     end
 
     it "should return a domain principal for BUILTIN SID S-1-5-32" do
       principal = Puppet::Util::Windows::SID::Principal.lookup_account_sid([1, 1, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0])
       expect(principal.account_type).to eq(:SidTypeDomain)
       expect(principal.sid).to eq('S-1-5-32')
-      expect(principal.account).to eq('BUILTIN')
-      expect(principal.domain).to eq('BUILTIN')
-      expect(principal.domain_account).to eq('BUILTIN')
+      expect(principal.account).to eq(builtin_localized)
+      expect(principal.domain).to eq(builtin_localized)
+      expect(principal.domain_account).to eq(builtin_localized)
     end
   end
 
@@ -184,7 +221,7 @@ describe Puppet::Util::Windows::SID::Principal, :if => Puppet.features.microsoft
     let(:builtin_sid) { [1, 1, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0] }
     let(:sid_principal) { Puppet::Util::Windows::SID::Principal.lookup_account_sid(builtin_sid) }
 
-    ['.', 'builtin', ''].each do |name|
+    ['.', ''].each do |name|
       it "when comparing the one looked up via SID S-1-5-32 to one looked up via non-canonical name #{name} for the BUILTIN domain" do
         name_principal = Puppet::Util::Windows::SID::Principal.lookup_account_name(name)
 
@@ -197,5 +234,17 @@ describe Puppet::Util::Windows::SID::Principal, :if => Puppet.features.microsoft
         end
       end
     end
+
+    it "when comparing the one looked up via SID S-1-5-32 to one looked up via non-canonical localized name for the BUILTIN domain" do
+      name_principal = Puppet::Util::Windows::SID::Principal.lookup_account_name(builtin_localized)
+
+      # compares canonical sid
+      expect(sid_principal).to eq(name_principal)
+
+      # compare all properties that have public accessors
+      sid_principal.public_methods(false).reject { |m| m == :== }.each do |method|
+        expect(sid_principal.send(method)).to eq(name_principal.send(method))
+      end
+    end
   end
 end

data/spec/integration/util/windows/process_spec.rb

@@ -27,8 +27,10 @@ describe "Puppet::Util::Windows::Process", :if => Puppet.features.microsoft_wind
     end
 
     it "should raise an error for an unknown privilege name" do
-      fail_msg = /LookupPrivilegeValue\(, foo, .*\):  A specified privilege does not exist/
-      expect { Puppet::Util::Windows::Process.lookup_privilege_value('foo') }.to raise_error(Puppet::Util::Windows::Error, fail_msg)
+      expect { Puppet::Util::Windows::Process.lookup_privilege_value('foo') }.to raise_error do |error|
+        expect(error).to be_a(Puppet::Util::Windows::Error)
+        expect(error.code).to eq(1313) # ERROR_NO_SUCH_PRIVILEGE
+      end
     end
   end