puppet 5.0.0 → 6.0.0

data/lib/puppet/util/windows/adsi.rb

@@ -66,7 +66,7 @@ module Puppet::Util::Windows::ADSI
       return sid_uri(sid) if sid.kind_of?(Puppet::Util::Windows::SID::Principal)
 
       begin
-        sid = Puppet::Util::Windows::SID.name_to_sid_object(sid)
+        sid = Puppet::Util::Windows::SID.name_to_principal(sid)
         sid_uri(sid)
       rescue Puppet::Util::Windows::Error, Puppet::Error
         nil
@@ -106,136 +106,200 @@ module Puppet::Util::Windows::ADSI
       [:lpwstr, :lpdword], :win32_bool
   end
 
-  module Shared
-    def localized_domains
-      @localized_domains ||= [
-        # localized version of BUILTIN
-        # for instance VORDEFINIERT on German Windows
-        Puppet::Util::Windows::SID.sid_to_name('S-1-5-32').upcase,
-        # localized version of NT AUTHORITY (can't use S-1-5)
-        # for instance AUTORITE NT on French Windows
-        Puppet::Util::Windows::SID.name_to_sid_object('SYSTEM').domain.upcase
-      ]
-    end
+  # Common base class shared by the User and Group
+  # classes below.
+  class ADSIObject
+    extend Enumerable
 
-    def uri(name, host = '.')
-      host = '.' if (localized_domains << Socket.gethostname.upcase).include?(host.upcase)
+    # Define some useful class-level methods
+    class << self
+      # Is either 'user' or 'group'
+      attr_reader :object_class
+
+      def localized_domains
+        @localized_domains ||= [
+          # localized version of BUILTIN
+          # for instance VORDEFINIERT on German Windows
+          Puppet::Util::Windows::SID.sid_to_name('S-1-5-32').upcase,
+          # localized version of NT AUTHORITY (can't use S-1-5)
+          # for instance AUTORITE NT on French Windows
+          Puppet::Util::Windows::SID.name_to_principal('SYSTEM').domain.upcase
+        ]
+      end
 
-      # group or user
-      account_type = self.name.split('::').last.downcase
+      def uri(name, host = '.')
+        host = '.' if (localized_domains << Socket.gethostname.upcase).include?(host.upcase)
+        Puppet::Util::Windows::ADSI.uri(name, @object_class, host)
+      end
 
-      Puppet::Util::Windows::ADSI.uri(name, account_type, host)
-    end
+      def parse_name(name)
+        if name =~ /\//
+          raise Puppet::Error.new( _("Value must be in DOMAIN\\user style syntax") )
+        end
 
-    def parse_name(name)
-      if name =~ /\//
-        raise Puppet::Error.new( _("Value must be in DOMAIN\\user style syntax") )
-      end
+        matches = name.scan(/((.*)\\)?(.*)/)
+        domain = matches[0][1] || '.'
+        account = matches[0][2]
 
-      matches = name.scan(/((.*)\\)?(.*)/)
-      domain = matches[0][1] || '.'
-      account = matches[0][2]
+        return account, domain
+      end
 
-      return account, domain
-    end
+      # returns Puppet::Util::Windows::SID::Principal[]
+      # may contain objects that represent unresolvable SIDs
+      def get_sids(adsi_child_collection)
+        sids = []
+        adsi_child_collection.each do |m|
+          sids << Puppet::Util::Windows::SID.ads_to_principal(m)
+        end
 
-    def get_sids(adsi_child_collection)
-      sids = []
-      adsi_child_collection.each do |m|
-        sids << Puppet::Util::Windows::SID.octet_string_to_sid_object(m.objectSID)
+        sids
       end
 
-      sids
-    end
+      def name_sid_hash(names)
+        return {} if names.nil? || names.empty?
 
-    def name_sid_hash(names)
-      return {} if names.nil? || names.empty?
+        sids = names.map do |name|
+          sid = Puppet::Util::Windows::SID.name_to_principal(name)
+          raise Puppet::Error.new( _("Could not resolve name: %{name}") % { name: name } ) if !sid
+          [sid.sid, sid]
+        end
 
-      sids = names.map do |name|
-        sid = Puppet::Util::Windows::SID.name_to_sid_object(name)
-        raise Puppet::Error.new( _("Could not resolve name: %{name}") % { name: name } ) if !sid
-        [sid.sid, sid]
+        Hash[ sids ]
       end
 
-      Hash[ sids ]
-    end
-  end
 
-  class User
-    extend Enumerable
-    extend Puppet::Util::Windows::ADSI::Shared
-    extend FFI::Library
+      def delete(name)
+        Puppet::Util::Windows::ADSI.delete(name, @object_class)
+      end
 
-    # https://msdn.microsoft.com/en-us/library/aa746340.aspx
-    # IADsUser interface
+      def exists?(name_or_sid)
+        well_known = false
+        if (sid = Puppet::Util::Windows::SID.name_to_principal(name_or_sid))
+          # Examples of SidType include SidTypeUser, SidTypeGroup
+          return true if sid.account_type == "SidType#{@object_class.capitalize}".to_sym
+
+          # 'well known group' is special as it can be a group like Everyone OR a user like SYSTEM
+          # so try to resolve it
+          # https://msdn.microsoft.com/en-us/library/cc234477.aspx
+          well_known = sid.account_type == :SidTypeWellKnownGroup
+          return false if sid.account_type != :SidTypeAlias && !well_known
+          name_or_sid = "#{sid.domain}\\#{sid.account}"
+        end
 
-    require 'puppet/util/windows/sid'
+        object = Puppet::Util::Windows::ADSI.connect(uri(*parse_name(name_or_sid)))
+        object.Class.downcase == @object_class
+      rescue
+        # special accounts like SYSTEM or special groups like Authenticated Users cannot
+        # resolve via monikers like WinNT://./SYSTEM,user or WinNT://./Authenticated Users,group
+        # -- they'll fail to connect. thus, given a validly resolved SID, this failure is
+        # ambiguous as it may indicate either a group like Service or an account like SYSTEM
+        well_known
+      end
 
-    attr_accessor :native_user
-    attr_reader :name, :sid
-    def initialize(name, native_user = nil)
-      @name = name
-      @native_user = native_user
+      def list_all
+        raise NotImplementedError, _("Subclass must implement class-level method 'list_all'!")
+      end
+
+      def each(&block)
+        objects = []
+        list_all.each do |o|
+          # Setting WIN32OLE.codepage in the microsoft_windows feature ensures
+          # values are returned as UTF-8
+          objects << new(o.name)
+        end
+
+        objects.each(&block)
+      end
     end
 
-    def native_user
-      @native_user ||= Puppet::Util::Windows::ADSI.connect(self.class.uri(*self.class.parse_name(@name)))
+    attr_reader :name
+    def initialize(name, native_object = nil)
+      @name = name
+      @native_object = native_object
     end
 
-    def sid
-      @sid ||= Puppet::Util::Windows::SID.octet_string_to_sid_object(native_user.objectSID)
+    def object_class
+      self.class.object_class
     end
 
     def uri
       self.class.uri(sid.account, sid.domain)
     end
 
-    def self.logon(name, password)
-      Puppet::Util::Windows::User.password_is?(name, password)
+    def native_object
+      @native_object ||= Puppet::Util::Windows::ADSI.connect(self.class.uri(*self.class.parse_name(name)))
+    end
+
+    def sid
+      @sid ||= Puppet::Util::Windows::SID.octet_string_to_principal(native_object.objectSID)
     end
 
     def [](attribute)
-      # Setting WIN32OLE.codepage in the microsoft_windows feature ensures
-      # values are returned as UTF-8
-      native_user.Get(attribute)
+      # Setting WIN32OLE.codepage ensures values are returned as UTF-8
+      native_object.Get(attribute)
     end
 
     def []=(attribute, value)
-      native_user.Put(attribute, value)
+      native_object.Put(attribute, value)
     end
 
     def commit
       begin
-        native_user.SetInfo unless native_user.nil?
+        native_object.SetInfo
       rescue WIN32OLERuntimeError => e
         # ERROR_BAD_USERNAME 2202L from winerror.h
         if e.message =~ /8007089A/m
           raise Puppet::Error.new(
-           _("Puppet is not able to create/delete domain users with the user resource."),
-           e
+            _("Puppet is not able to create/delete domain %{object_class}s with the %{object_class} resource.") % { object_class: object_class },
           )
         end
 
-        raise Puppet::Error.new( _("User update failed: %{e}") % { e: e }, e )
+        raise Puppet::Error.new( _("%{object_class} update failed: %{error}") % { object_class: object_class.capitalize, error: e }, e )
       end
       self
     end
+  end
+
+  class User < ADSIObject
+    extend FFI::Library
+
+    require 'puppet/util/windows/sid'
+
+    # https://msdn.microsoft.com/en-us/library/aa746340.aspx
+    # IADsUser interface
+    @object_class = 'user'
+
+    class << self
+      def list_all
+        Puppet::Util::Windows::ADSI.execquery('select name from win32_useraccount where localaccount = "TRUE"')
+      end
+
+      def logon(name, password)
+        Puppet::Util::Windows::User.password_is?(name, password)
+      end
+
+      def create(name)
+        # Windows error 1379: The specified local group already exists.
+        raise Puppet::Error.new(_("Cannot create user if group '%{name}' exists.") % { name: name }) if Puppet::Util::Windows::ADSI::Group.exists? name
+        new(name, Puppet::Util::Windows::ADSI.create(name, @object_class))
+      end
+    end
 
     def password_is?(password)
       self.class.logon(name, password)
     end
 
     def add_flag(flag_name, value)
-      flag = native_user.Get(flag_name) rescue 0
+      flag = native_object.Get(flag_name) rescue 0
 
-      native_user.Put(flag_name, flag | value)
+      native_object.Put(flag_name, flag | value)
 
       commit
     end
 
     def password=(password)
       if !password.nil?
-        native_user.SetPassword(password)
+        native_object.SetPassword(password)
         commit
       end
 
@@ -247,9 +311,8 @@ module Puppet::Util::Windows::ADSI
       # https://msdn.microsoft.com/en-us/library/aa746342.aspx
       # WIN32OLE objects aren't enumerable, so no map
       groups = []
-      # Setting WIN32OLE.codepage in the microsoft_windows feature ensures
-      # values are returned as UTF-8
-      native_user.Groups.each {|g| groups << g.Name} rescue nil
+      # Setting WIN32OLE.codepage ensures values are returned as UTF-8
+      native_object.Groups.each {|g| groups << g.Name} rescue nil
       groups
     end
 
@@ -279,9 +342,13 @@ module Puppet::Util::Windows::ADSI
     end
 
     def group_sids
-      self.class.get_sids(native_user.Groups)
+      self.class.get_sids(native_object.Groups)
     end
 
+    # TODO: This code's pretty similar to set_members in the Group class. Would be nice
+    # to refactor them into the ADSIObject class at some point. This was not done originally
+    # because these use different methods to do stuff that are also aliased to other methods,
+    # so the shared code isn't exactly a 1:1 mapping.
     def set_groups(desired_groups, minimum = true)
       return if desired_groups.nil?
 
@@ -309,11 +376,6 @@ module Puppet::Util::Windows::ADSI
       end
     end
 
-    def self.create(name)
-      # Windows error 1379: The specified local group already exists.
-      raise Puppet::Error.new(_("Cannot create user if group '%{name}' exists.") % { name: name }) if Puppet::Util::Windows::ADSI::Group.exists? name
-      new(name, Puppet::Util::Windows::ADSI.create(name, 'user'))
-    end
 
     # UNLEN from lmcons.h - https://stackoverflow.com/a/2155176
     MAX_USERNAME_LENGTH = 256
@@ -336,48 +398,7 @@ module Puppet::Util::Windows::ADSI
     end
 
     def self.current_user_sid
-      Puppet::Util::Windows::SID.name_to_sid_object(current_user_name)
-    end
-
-    def self.exists?(name_or_sid)
-      well_known = false
-      if (sid = Puppet::Util::Windows::SID.name_to_sid_object(name_or_sid))
-        return true if sid.account_type == :SidTypeUser
-
-        # 'well known group' is special as it can be a group like Everyone OR a user like SYSTEM
-        # so try to resolve it
-        # https://msdn.microsoft.com/en-us/library/cc234477.aspx
-        well_known = sid.account_type == :SidTypeWellKnownGroup
-        return false if sid.account_type != :SidTypeAlias && !well_known
-        name_or_sid = "#{sid.domain}\\#{sid.account}"
-      end
-
-      user = Puppet::Util::Windows::ADSI.connect(User.uri(*User.parse_name(name_or_sid)))
-      # otherwise, verify that the account is actually a User account
-      user.Class == 'User'
-    rescue
-      # special accounts like SYSTEM cannot resolve via moniker like WinNT://./SYSTEM,user
-      # and thus fail to connect - so given a validly resolved SID, this failure is ambiguous as it
-      # may indicate either a group like Service or an account like SYSTEM
-      well_known
-    end
-
-
-    def self.delete(name)
-      Puppet::Util::Windows::ADSI.delete(name, 'user')
-    end
-
-    def self.each(&block)
-      wql = Puppet::Util::Windows::ADSI.execquery('select name from win32_useraccount where localaccount = "TRUE"')
-
-      users = []
-      wql.each do |u|
-        # Setting WIN32OLE.codepage in the microsoft_windows feature ensures
-        # values are returned as UTF-8
-        users << new(u.name)
-      end
-
-      users.each(&block)
+      Puppet::Util::Windows::SID.name_to_principal(current_user_name)
     end
 
     ffi_convention :stdcall
@@ -408,73 +429,43 @@ module Puppet::Util::Windows::ADSI
     end
   end
 
-  class Group
-    extend Enumerable
-    extend Puppet::Util::Windows::ADSI::Shared
+  class Group < ADSIObject
 
     # https://msdn.microsoft.com/en-us/library/aa706021.aspx
     # IADsGroup interface
+    @object_class = 'group'
 
-    attr_accessor :native_group
-    attr_reader :name, :sid
-    def initialize(name, native_group = nil)
-      @name = name
-      @native_group = native_group
-    end
-
-    def uri
-      self.class.uri(sid.account, sid.domain)
-    end
-
-    def native_group
-      @native_group ||= Puppet::Util::Windows::ADSI.connect(self.class.uri(*self.class.parse_name(name)))
-    end
-
-    def sid
-      @sid ||= Puppet::Util::Windows::SID.octet_string_to_sid_object(native_group.objectSID)
-    end
-
-    def commit
-      begin
-        native_group.SetInfo unless native_group.nil?
-      rescue WIN32OLERuntimeError => e
-        # ERROR_BAD_USERNAME 2202L from winerror.h
-        if e.message =~ /8007089A/m
-          raise Puppet::Error.new(
-            _("Puppet is not able to create/delete domain groups with the group resource."),
-            e
-          )
-        end
+    class << self
+      def list_all
+        Puppet::Util::Windows::ADSI.execquery('select name from win32_group where localaccount = "TRUE"')
+      end
 
-        raise Puppet::Error.new( _("Group update failed: %{error}") % { error: e }, e )
+      def create(name)
+        # Windows error 2224: The account already exists.
+        raise Puppet::Error.new( _("Cannot create group if user '%{name}' exists.") % { name: name } ) if Puppet::Util::Windows::ADSI::User.exists?(name)
+        new(name, Puppet::Util::Windows::ADSI.create(name, @object_class))
       end
-      self
     end
 
     def add_member_sids(*sids)
       sids.each do |sid|
-        native_group.Add(Puppet::Util::Windows::ADSI.sid_uri(sid))
+        native_object.Add(Puppet::Util::Windows::ADSI.sid_uri(sid))
       end
     end
 
     def remove_member_sids(*sids)
       sids.each do |sid|
-        native_group.Remove(Puppet::Util::Windows::ADSI.sid_uri(sid))
+        native_object.Remove(Puppet::Util::Windows::ADSI.sid_uri(sid))
       end
     end
 
+    # returns Puppet::Util::Windows::SID::Principal[]
+    # may contain objects that represent unresolvable SIDs
+    # qualified account names are returned by calling #domain_account
     def members
-      # WIN32OLE objects aren't enumerable, so no map
-      members = []
-      # Setting WIN32OLE.codepage in the microsoft_windows feature ensures
-      # values are returned as UTF-8
-      native_group.Members.each {|m| members << m.Name}
-      members
-    end
-
-    def member_sids
-      self.class.get_sids(native_group.Members)
+      self.class.get_sids(native_object.Members)
     end
+    alias member_sids members
 
     def set_members(desired_members, inclusive = true)
       return if desired_members.nil?
@@ -499,50 +490,5 @@ module Puppet::Util::Windows::ADSI
         remove_member_sids(*members_to_remove)
       end
     end
-
-    def self.create(name)
-      # Windows error 2224: The account already exists.
-      raise Puppet::Error.new( _("Cannot create group if user '%{name}' exists.") % { name: name } ) if Puppet::Util::Windows::ADSI::User.exists? name
-      new(name, Puppet::Util::Windows::ADSI.create(name, 'group'))
-    end
-
-    def self.exists?(name_or_sid)
-      well_known = false
-      if (sid = Puppet::Util::Windows::SID.name_to_sid_object(name_or_sid))
-        return true if sid.account_type == :SidTypeGroup
-
-        # 'well known group' is special as it can be a group like Everyone OR a user like SYSTEM
-        # so try to resolve it
-        # https://msdn.microsoft.com/en-us/library/cc234477.aspx
-        well_known = sid.account_type == :SidTypeWellKnownGroup
-        return false if sid.account_type != :SidTypeAlias && !well_known
-        name_or_sid = "#{sid.domain}\\#{sid.account}"
-      end
-
-      user = Puppet::Util::Windows::ADSI.connect(Group.uri(*Group.parse_name(name_or_sid)))
-      user.Class == 'Group'
-    rescue
-      # special groups like Authenticated Users cannot resolve via moniker like WinNT://./Authenticated Users,group
-      # and thus fail to connect - so given a validly resolved SID, this failure is ambiguous as it
-      # may indicate either a group like Service or an account like SYSTEM
-      well_known
-    end
-
-    def self.delete(name)
-      Puppet::Util::Windows::ADSI.delete(name, 'group')
-    end
-
-    def self.each(&block)
-      wql = Puppet::Util::Windows::ADSI.execquery('select name from win32_group where localaccount = "TRUE"')
-
-      groups = []
-      wql.each do |g|
-        # Setting WIN32OLE.codepage in the microsoft_windows feature ensures
-        # values are returned as UTF-8
-        groups << new(g.name)
-      end
-
-      groups.each(&block)
-    end
   end
 end

data/lib/puppet/util/windows/api_types.rb

@@ -53,17 +53,21 @@ module Puppet::Util::Windows::APITypes
     alias_method :read_word,  :read_uint16
     alias_method :read_array_of_wchar, :read_array_of_uint16
 
-    def read_wide_string(char_length, dst_encoding = Encoding::UTF_8)
+    def read_wide_string(char_length, dst_encoding = Encoding::UTF_8, encode_options = {})
       # char_length is number of wide chars (typically excluding NULLs), *not* bytes
       str = get_bytes(0, char_length * 2).force_encoding('UTF-16LE')
-      str.encode(dst_encoding)
+      str.encode(dst_encoding, str.encoding, encode_options)
+    rescue Exception => e
+      Puppet.debug "Unable to convert value #{str.dump} to encoding #{dst_encoding} due to #{e.inspect}"
+      raise
     end
 
     # @param max_char_length [Integer] Maximum number of wide chars to return (typically excluding NULLs), *not* bytes
     # @param null_terminator [Symbol] Number of number of null wchar characters, *not* bytes, that determine the end of the string
     #   null_terminator = :single_null, then the terminating sequence is two bytes of zero.   This is UNIT16 = 0
     #   null_terminator = :double_null, then the terminating sequence is four bytes of zero.  This is UNIT32 = 0
-    def read_arbitrary_wide_string_up_to(max_char_length = 512, null_terminator = :single_null)
+    # @param encode_options [Hash] Accepts the same option hash that may be passed to String#encode in Ruby
+    def read_arbitrary_wide_string_up_to(max_char_length = 512, null_terminator = :single_null, encode_options = {})
       if null_terminator != :single_null && null_terminator != :double_null
         raise _("Unable to read wide strings with %{null_terminator} terminal nulls") % { null_terminator: null_terminator }
       end
@@ -73,11 +77,11 @@ module Puppet::Util::Windows::APITypes
 
       # Look for a null terminating characters; if found, read up to that null (exclusive)
       (0...max_char_length - terminator_width).each do |i|
-        return read_wide_string(i) if send(reader_method, (i * 2)) == 0
+        return read_wide_string(i, Encoding::UTF_8, encode_options) if send(reader_method, (i * 2)) == 0
       end
 
       # String is longer than the max; read just to the max
-      read_wide_string(max_char_length)
+      read_wide_string(max_char_length, Encoding::UTF_8, encode_options)
     end
 
     def read_win32_local_pointer(&block)

data/lib/puppet/util/windows/com.rb

@@ -76,8 +76,9 @@ module Puppet::Util::Windows::COM
           vtable_hash = Hash[(ifaces.map { |iface| iface::VTBL::SPEC.to_a } << spec.to_a).flatten(1)]
           const_set(:SPEC, vtable_hash)
 
-          layout \
+          layout(
             *self::SPEC.map { |name, signature| [name, callback(*signature)] }.flatten
+          )
         end
 
         const_set(:VTBL, vtable)

data/lib/puppet/util/windows/eventlog.rb

@@ -31,7 +31,8 @@ class Puppet::Util::Windows::EventLog
   def initialize(source_name = 'Puppet')
     @eventlog_handle = RegisterEventSourceW(FFI::Pointer::NULL, wide_string(source_name))
     if @eventlog_handle == NULL_HANDLE
-      raise EventLogError.new("RegisterEventSourceW failed to open Windows eventlog", FFI.errno)
+      #TRANSLATORS 'Windows' is the operating system and 'RegisterEventSourceW' is a API call and should not be translated
+      raise EventLogError.new(_("RegisterEventSourceW failed to open Windows eventlog"), FFI.errno)
     end
   end
 
@@ -55,7 +56,9 @@ class Puppet::Util::Windows::EventLog
   # @return [void]
   # @api public
   def report_event(args = {})
-    raise ArgumentError, "data must be a string, not #{args[:data].class}" unless args[:data].is_a?(String)
+    unless args[:data].is_a?(String)
+      raise ArgumentError, _("data must be a string, not %{class_name}") % { class_name: args[:data].class }
+    end
     from_string_to_wide_string(args[:data]) do |message_ptr|
       FFI::MemoryPointer.new(:pointer) do |message_array_ptr|
         message_array_ptr.write_pointer(message_ptr)
@@ -69,7 +72,8 @@ class Puppet::Util::Windows::EventLog
           num_strings, raw_data_size, message_array_ptr, raw_data)
 
         if report_result == WIN32_FALSE
-          raise EventLogError.new("ReportEventW failed to report event to Windows eventlog", FFI.errno)
+          #TRANSLATORS 'Windows' is the operating system and 'ReportEventW' is a API call and should not be translated
+          raise EventLogError.new(_("ReportEventW failed to report event to Windows eventlog"), FFI.errno)
         end
       end
     end
@@ -92,7 +96,7 @@ class Puppet::Util::Windows::EventLog
       when :err,:alert,:emerg,:crit
         [EVENTLOG_ERROR_TYPE, 0x03]
       else
-        raise ArgumentError, "Invalid log level #{level}"
+        raise ArgumentError, _("Invalid log level %{level}") % { level: level }
       end
     end
   end
@@ -110,7 +114,8 @@ class Puppet::Util::Windows::EventLog
   else
     class EventLogError < RuntimeError
       def initialize(msg, code)
-        super(msg + " (Win32 error: #{code})")
+        #TRANSLATORS 'Win32' is the Windows API and should not be translated
+        super(msg + ' ' + _("(Win32 error: %{detail})") % { detail: code})
       end
     end
   end