puppet 5.5.16 → 5.5.21

data/lib/puppet/util/metric.rb

@@ -54,11 +54,11 @@ class Puppet::Util::Metric
   end
 
   def values
-    @values.sort { |a, b| a[1] <=> b[1] }
+    @values.sort_by { |a| a[1] }
   end
 
   # Convert a name into a label.
   def self.labelize(name)
-    name.to_s.capitalize.gsub("_", " ")
+    name.to_s.capitalize.tr("_", " ")
   end
 end

data/lib/puppet/util/monkey_patches.rb

@@ -70,7 +70,7 @@ if Puppet::Util::Platform.windows?
           begin
             add_cert(x509)
           rescue OpenSSL::X509::StoreError
-            warn "Failed to add #{x509.subject.to_s}"
+            warn "Failed to add #{x509.subject}"
           end
         end
       end

data/lib/puppet/util/nagios_maker.rb

@@ -65,11 +65,11 @@ module Puppet::Util::NagiosMaker
       end
     end
 
-    target = "/etc/nagios/#{full_name.to_s}.cfg"
+    target = "/etc/nagios/#{full_name}.cfg"
     provider = type.provide(:naginator, :parent => Puppet::Provider::Naginator, :default_target => target) {}
     provider.nagios_type
 
-    type.desc "The Nagios type #{name.to_s}.  This resource type is autogenerated using the
+    type.desc "The Nagios type #{name}.  This resource type is autogenerated using the
       model developed in Naginator, and all of the Nagios types are generated using the
       same code and the same library.
 

data/lib/puppet/util/network_device/cisco/device.rb

@@ -103,7 +103,7 @@ class Puppet::Util::NetworkDevice::Cisco::Device < Puppet::Util::NetworkDevice::
     IF.each do |k,ifnames|
       if found = ifnames.find { |ifname| interface =~ /^#{ifname}\s*\d/i }
         found = /^#{found}(.+)\Z/i.match(interface)
-        return "#{k.to_s}#{found[1]}".gsub(/\s+/,'')
+        return "#{k}#{found[1]}".gsub(/\s+/,'')
       end
     end
     interface

data/lib/puppet/util/network_device/cisco/interface.rb

@@ -27,8 +27,8 @@ class Puppet::Util::NetworkDevice::Cisco::Interface
     :etherchannel  => [9, ["channel-group %s", "port group %s"]],
     :ipaddress     => [10,
       lambda do |prefix,ip,option|
-        ip.ipv6? ? "ipv6 address #{ip.to_s}/#{prefix} #{option}" :
-                   "ip address #{ip.to_s} #{netmask(Socket::AF_INET,prefix)}"
+        ip.ipv6? ? "ipv6 address #{ip}/#{prefix} #{option}" :
+                   "ip address #{ip} #{netmask(Socket::AF_INET,prefix)}"
       end],
     :ensure        => [11, lambda { |value| value == :present ? "no shutdown" : "shutdown" } ]
   }

data/lib/puppet/util/network_device/transport/ssh.rb

@@ -59,7 +59,7 @@ class Puppet::Util::NetworkDevice::Transport::Ssh < Puppet::Util::NetworkDevice:
         # the ssh loop there while still having the ssh connection up
         # otherwise we wouldn't be able to return ssh stdout/stderr
         # for a given call of command.
-        return
+        return # rubocop:disable Lint/NonLocalExitFromIterator
       end
 
     end

data/lib/puppet/util/pidlock.rb

@@ -44,7 +44,9 @@ class Puppet::Util::Pidlock
   end
 
   def clear_if_stale
-    return @lockfile.unlock if lock_pid.nil?
+    pid = lock_pid
+    return @lockfile.unlock if pid == nil
+    return if Process.pid == pid
 
     errors = [Errno::ESRCH]
     # Win32::Process now throws SystemCallError. Since this could be
@@ -52,7 +54,7 @@ class Puppet::Util::Pidlock
     errors << SystemCallError if Puppet::Util::Platform.windows?
 
     begin
-      Process.kill(0, lock_pid)
+      Process.kill(0, pid)
     rescue *errors
       return @lockfile.unlock
     end
@@ -61,14 +63,18 @@ class Puppet::Util::Pidlock
     # not, we can unlock the lockfile. For now this is only done on
     # POSIX and Windows platforms (PUP-9247).
     if Puppet.features.posix?
-      procname = Puppet::Util::Execution.execute(["ps", "-p", lock_pid, "-o", "comm="]).strip
-      args     = Puppet::Util::Execution.execute(["ps", "-p", lock_pid, "-o", "args="]).strip
+      procname = Puppet::Util::Execution.execute(["ps", "-p", pid, "-o", "comm="]).strip
+      args     = Puppet::Util::Execution.execute(["ps", "-p", pid, "-o", "args="]).strip
       @lockfile.unlock unless procname =~ /ruby/ && args =~ /puppet/ || procname =~ /puppet(-.*)?$/
     elsif Puppet.features.microsoft_windows?
       # On Windows, we're checking if the filesystem path name of the running
       # process is our vendored ruby:
-      exe_path = Puppet::Util::Windows::Process::get_process_image_name_by_pid(lock_pid)
-      @lockfile.unlock unless exe_path =~ /\\bin\\ruby.exe$/
+      begin
+        exe_path = Puppet::Util::Windows::Process::get_process_image_name_by_pid(pid)
+        @lockfile.unlock unless exe_path =~ /\\bin\\ruby.exe$/
+      rescue Puppet::Util::Windows::Error => e
+        Puppet.debug("Failed to read pidfile #{file_path}: #{e.message}")
+      end
     end
   end
   private :clear_if_stale

data/lib/puppet/util/plist.rb

@@ -56,6 +56,12 @@ module Puppet::Util::Plist
     # Read plist text using the CFPropertyList gem.
     def parse_plist(plist_data, file_path = '')
       bad_xml_doctype = /^.*<!DOCTYPE plist PUBLIC -\/\/Apple Computer.*$/
+      # Depending on where parse_plist is called from, plist_data can be either XML or binary.
+      # If we get XML, make sure ruby knows it's UTF-8 so we avoid invalid byte sequence errors.
+      if plist_data.include?('encoding="UTF-8"') && plist_data.encoding != Encoding::UTF_8
+        plist_data.force_encoding(Encoding::UTF_8)
+      end
+
       begin
         if plist_data =~ bad_xml_doctype
           plist_data.gsub!( bad_xml_doctype, plist_xml_doctype )

data/lib/puppet/util/provider_features.rb

@@ -81,7 +81,7 @@ module Puppet::Util::ProviderFeatures
     str = ""
     @features ||= {}
     return nil if @features.empty?
-    names = @features.keys.sort { |a,b| a.to_s <=> b.to_s }
+    names = @features.keys.sort_by(&:to_s)
     names.each do |name|
       doc = @features[name].docs.gsub(/\n\s+/, " ")
       str << "- *#{name}*: #{doc}\n"
@@ -130,9 +130,7 @@ module Puppet::Util::ProviderFeatures
       # Create a method that will list all functional features.
       @feature_module.send(:define_method, :features) do
         return false unless defined?(features)
-        features.keys.find_all { |n| feature?(n) }.sort { |a,b|
-          a.to_s <=> b.to_s
-        }
+        features.keys.find_all { |n| feature?(n) }.sort_by(&:to_s)
       end
 
       # Create a method that will determine if a provided list of

data/lib/puppet/util/rdoc.rb

@@ -31,7 +31,7 @@ module Puppet::Util::RDoc
     # uses relative_path_from that will generate errors when the slashes don't
     # properly match.  This is a workaround for that issue.
     if Puppet.features.microsoft_windows? && RDoc::VERSION !~ /^[0-3]\./
-      options += [ "--root", Dir.pwd.gsub(/\\/, '/')]
+      options += [ "--root", Dir.pwd.tr('\\', '/')]
     end
     options += files
 

data/lib/puppet/util/reference.rb

@@ -60,7 +60,7 @@ class Puppet::Util::Reference
 
   def self.references
     instance_loader(:reference).loadall
-    loaded_instances(:reference).sort { |a,b| a.to_s <=> b.to_s }
+    loaded_instances(:reference).sort_by(&:to_s)
   end
 
   attr_accessor :page, :depth, :header, :title, :dynamic

data/lib/puppet/util/resource_template.rb

@@ -53,7 +53,7 @@ class Puppet::Util::ResourceTemplate
 
   def set_resource_variables
     @resource.to_hash.each do |param, value|
-      var = "@#{param.to_s}"
+      var = "@#{param}"
       instance_variable_set(var, value)
     end
   end

data/lib/puppet/util/selinux.rb

@@ -13,7 +13,7 @@ require 'pathname'
 
 module Puppet::Util::SELinux
 
-  def selinux_support?
+  def self.selinux_support?
     return false unless defined?(Selinux)
     if Selinux.is_selinux_enabled == 1
       return true
@@ -21,6 +21,10 @@ module Puppet::Util::SELinux
     false
   end
 
+  def selinux_support?
+    Puppet::Util::SELinux.selinux_support?
+  end
+
   # Retrieve and return the full context of the file.  If we don't have
   # SELinux support or if the SELinux call fails then return nil.
   def get_selinux_current_context(file)
@@ -202,7 +206,9 @@ module Puppet::Util::SELinux
         # If possible we use read_nonblock in a loop rather than read to work-
         # a linux kernel bug.  See ticket #1963 for details.
         mountfh = File.open("/proc/mounts")
-        mounts += mountfh.read_nonblock(1024) while true
+        loop do
+          mounts += mountfh.read_nonblock(1024)
+        end
       else
         # Otherwise we shell out and let cat do it for us
         mountfh = IO.popen("/bin/cat /proc/mounts")

data/lib/puppet/util/windows/adsi.rb

@@ -1,6 +1,23 @@
 module Puppet::Util::Windows::ADSI
   require 'ffi'
 
+  # https://docs.microsoft.com/en-us/windows/win32/api/dsrole/ne-dsrole-dsrole_machine_role
+  STANDALONE_WORKSTATION = 0
+  MEMBER_WORKSTATION = 1
+  STANDALONE_SERVER = 2
+  MEMBER_SERVER = 3
+  BACKUP_DOMAIN_CONTROLLER = 4
+  PRIMARY_DOMAIN_CONTROLLER = 5
+
+  DOMAIN_ROLES = {
+    STANDALONE_WORKSTATION => :STANDALONE_WORKSTATION,
+    MEMBER_WORKSTATION => :MEMBER_WORKSTATION,
+    STANDALONE_SERVER => :STANDALONE_SERVER,
+    MEMBER_SERVER => :MEMBER_SERVER,
+    BACKUP_DOMAIN_CONTROLLER => :BACKUP_DOMAIN_CONTROLLER,
+    PRIMARY_DOMAIN_CONTROLLER => :PRIMARY_DOMAIN_CONTROLLER,
+  }
+
   class << self
     extend FFI::Library
 
@@ -94,6 +111,14 @@ module Puppet::Util::Windows::ADSI
       wmi_connection.execquery(query)
     end
 
+    def domain_role
+      unless @domain_role
+        query_result = Puppet::Util::Windows::ADSI.execquery('select DomainRole from Win32_ComputerSystem').to_enum.first
+        @domain_role = DOMAIN_ROLES[query_result.DomainRole] if query_result
+      end
+      @domain_role
+    end
+
     ffi_convention :stdcall
 
     # https://msdn.microsoft.com/en-us/library/windows/desktop/ms724295(v=vs.85).aspx
@@ -126,24 +151,24 @@ module Puppet::Util::Windows::ADSI
           Puppet::Util::Windows::SID.name_to_principal('SYSTEM').domain.upcase
         ]
       end
-  
+
       def uri(name, host = '.')
         host = '.' if (localized_domains << Socket.gethostname.upcase).include?(host.upcase)
         Puppet::Util::Windows::ADSI.uri(name, @object_class, host)
       end
-  
+
       def parse_name(name)
         if name =~ /\//
           raise Puppet::Error.new( _("Value must be in DOMAIN\\%{object_class} style syntax") % { object_class: @object_class } )
         end
-  
+
         matches = name.scan(/((.*)\\)?(.*)/)
         domain = matches[0][1] || '.'
         account = matches[0][2]
-  
+
         return account, domain
       end
-  
+
       # returns Puppet::Util::Windows::SID::Principal[]
       # may contain objects that represent unresolvable SIDs
       def get_sids(adsi_child_collection)
@@ -151,19 +176,19 @@ module Puppet::Util::Windows::ADSI
         adsi_child_collection.each do |m|
           sids << Puppet::Util::Windows::SID.ads_to_principal(m)
         end
-  
+
         sids
       end
-  
-      def name_sid_hash(names)
+
+      def name_sid_hash(names, allow_unresolved = false)
         return {} if names.nil? || names.empty?
-  
+
         sids = names.map do |name|
-          sid = Puppet::Util::Windows::SID.name_to_principal(name)
+          sid = Puppet::Util::Windows::SID.name_to_principal(name, allow_unresolved)
           raise Puppet::Error.new( _("Could not resolve name: %{name}") % { name: name } ) if !sid
           [sid.sid, sid]
         end
-  
+
         Hash[ sids ]
       end
 
@@ -176,8 +201,13 @@ module Puppet::Util::Windows::ADSI
         well_known = false
         if (sid = Puppet::Util::Windows::SID.name_to_principal(name_or_sid))
           # Examples of SidType include SidTypeUser, SidTypeGroup
-          return true if sid.account_type == "SidType#{@object_class.capitalize}".to_sym
-  
+          if sid.account_type == "SidType#{@object_class.capitalize}".to_sym
+            # Check if we're getting back a local user when domain-joined
+            return true unless [:MEMBER_WORKSTATION, :MEMBER_SERVER].include?(Puppet::Util::Windows::ADSI.domain_role)
+            # The resource domain and the computer name are not always case-matching
+            return sid.domain.casecmp(Puppet::Util::Windows::ADSI.computer_name) == 0
+          end
+
           # 'well known group' is special as it can be a group like Everyone OR a user like SYSTEM
           # so try to resolve it
           # https://msdn.microsoft.com/en-us/library/cc234477.aspx
@@ -388,23 +418,23 @@ module Puppet::Util::Windows::ADSI
       ADS_UF_SCRIPT:                                 0x0001,
       ADS_UF_ACCOUNTDISABLE:                         0x0002,
       ADS_UF_HOMEDIR_REQUIRED:                       0x0008,
-      ADS_UF_LOCKOUT:                                0x0010,                          
-      ADS_UF_PASSWD_NOTREQD:                         0x0020,                   
-      ADS_UF_PASSWD_CANT_CHANGE:                     0x0040,               
-      ADS_UF_ENCRYPTED_TEXT_PASSWORD_ALLOWED:        0x0080,       
-      ADS_UF_TEMP_DUPLICATE_ACCOUNT:                 0x0100,           
-      ADS_UF_NORMAL_ACCOUNT:                         0x0200,                   
-      ADS_UF_INTERDOMAIN_TRUST_ACCOUNT:              0x0800,        
-      ADS_UF_WORKSTATION_TRUST_ACCOUNT:              0x1000,        
-      ADS_UF_SERVER_TRUST_ACCOUNT:                   0x2000,             
-      ADS_UF_DONT_EXPIRE_PASSWD:                     0x10000,            
-      ADS_UF_MNS_LOGON_ACCOUNT:                      0x20000,               
-      ADS_UF_SMARTCARD_REQUIRED:                     0x40000,              
-      ADS_UF_TRUSTED_FOR_DELEGATION:                 0x80000,          
-      ADS_UF_NOT_DELEGATED:                          0x100000,                  
-      ADS_UF_USE_DES_KEY_ONLY:                       0x200000,               
-      ADS_UF_DONT_REQUIRE_PREAUTH:                   0x400000,               
-      ADS_UF_PASSWORD_EXPIRED:                       0x800000,               
+      ADS_UF_LOCKOUT:                                0x0010,
+      ADS_UF_PASSWD_NOTREQD:                         0x0020,
+      ADS_UF_PASSWD_CANT_CHANGE:                     0x0040,
+      ADS_UF_ENCRYPTED_TEXT_PASSWORD_ALLOWED:        0x0080,
+      ADS_UF_TEMP_DUPLICATE_ACCOUNT:                 0x0100,
+      ADS_UF_NORMAL_ACCOUNT:                         0x0200,
+      ADS_UF_INTERDOMAIN_TRUST_ACCOUNT:              0x0800,
+      ADS_UF_WORKSTATION_TRUST_ACCOUNT:              0x1000,
+      ADS_UF_SERVER_TRUST_ACCOUNT:                   0x2000,
+      ADS_UF_DONT_EXPIRE_PASSWD:                     0x10000,
+      ADS_UF_MNS_LOGON_ACCOUNT:                      0x20000,
+      ADS_UF_SMARTCARD_REQUIRED:                     0x40000,
+      ADS_UF_TRUSTED_FOR_DELEGATION:                 0x80000,
+      ADS_UF_NOT_DELEGATED:                          0x100000,
+      ADS_UF_USE_DES_KEY_ONLY:                       0x200000,
+      ADS_UF_DONT_REQUIRE_PREAUTH:                   0x400000,
+      ADS_UF_PASSWORD_EXPIRED:                       0x800000,
       ADS_UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION: 0x1000000
     }
 

data/lib/puppet/util/windows/api_types.rb

@@ -19,15 +19,11 @@ module Puppet::Util::Windows::APITypes
 
   class ::FFI::Pointer
     NULL_HANDLE = 0
+    WCHAR_NULL = "\0\0".encode('UTF-16LE').freeze
 
     def self.from_string_to_wide_string(str, &block)
       str = Puppet::Util::Windows::String.wide_string(str)
-      FFI::MemoryPointer.new(:byte, str.bytesize) do |ptr|
-        # uchar here is synonymous with byte
-        ptr.put_array_of_uchar(0, str.bytes.to_a)
-
-        yield ptr
-      end
+      FFI::MemoryPointer.from_wide_string(str, &block)
 
       # ptr has already had free called, so nothing to return
       nil
@@ -53,11 +49,17 @@ module Puppet::Util::Windows::APITypes
     alias_method :read_word,  :read_uint16
     alias_method :read_array_of_wchar, :read_array_of_uint16
 
-    def read_wide_string(char_length, dst_encoding = Encoding::UTF_8, encode_options = {})
+    def read_wide_string(char_length, dst_encoding = Encoding::UTF_8, strip = false, encode_options = {})
       # char_length is number of wide chars (typically excluding NULLs), *not* bytes
       str = get_bytes(0, char_length * 2).force_encoding('UTF-16LE')
+
+      if strip
+        i = str.index(WCHAR_NULL)
+        str = str[0, i] if i
+      end
+
       str.encode(dst_encoding, str.encoding, encode_options)
-    rescue Exception => e
+    rescue EncodingError => e
       Puppet.debug "Unable to convert value #{str.nil? ? 'nil' : str.dump} to encoding #{dst_encoding} due to #{e.inspect}"
       raise
     end
@@ -68,32 +70,31 @@ module Puppet::Util::Windows::APITypes
     #   null_terminator = :double_null, then the terminating sequence is four bytes of zero.  This is UNIT32 = 0
     # @param encode_options [Hash] Accepts the same option hash that may be passed to String#encode in Ruby
     def read_arbitrary_wide_string_up_to(max_char_length = 512, null_terminator = :single_null, encode_options = {})
-      if null_terminator != :single_null && null_terminator != :double_null
-        raise _("Unable to read wide strings with %{null_terminator} terminal nulls") % { null_terminator: null_terminator }
-      end
-
-      terminator_width = null_terminator == :single_null ? 1 : 2
-      reader_method = null_terminator == :single_null ? :get_uint16 : :get_uint32
-
-      # Look for a null terminating characters; if found, read up to that null (exclusive)
-      (0...max_char_length - terminator_width).each do |i|
-        return read_wide_string(i, Encoding::UTF_8, encode_options) if send(reader_method, (i * 2)) == 0
-      end
-
-      # String is longer than the max; read just to the max
-      read_wide_string(max_char_length, Encoding::UTF_8, encode_options)
+      idx = case null_terminator
+            when :single_null
+              # find index of wide null between 0 and max (exclusive)
+              (0...max_char_length).find do |i|
+                get_uint16(i * 2) == 0
+              end
+            when :double_null
+              # find index of double-wide null between 0 and max - 1 (exclusive)
+              (0...max_char_length - 1).find do |i|
+                get_uint32(i * 2) == 0
+              end
+            else
+              raise _("Unable to read wide strings with %{null_terminator} terminal nulls") % { null_terminator: null_terminator }
+            end
+
+      read_wide_string(idx || max_char_length, Encoding::UTF_8, false, encode_options)
     end
 
     def read_win32_local_pointer(&block)
-      ptr = nil
+      ptr = read_pointer
       begin
-        ptr = read_pointer
         yield ptr
       ensure
-        if ptr && ! ptr.null?
-          if FFI::WIN32::LocalFree(ptr.address) != FFI::Pointer::NULL_HANDLE
-            Puppet.debug "LocalFree memory leak"
-          end
+        if !ptr.null? && FFI::WIN32::LocalFree(ptr.address) != FFI::Pointer::NULL_HANDLE
+          Puppet.debug "LocalFree memory leak"
         end
       end
 
@@ -102,23 +103,35 @@ module Puppet::Util::Windows::APITypes
     end
 
     def read_com_memory_pointer(&block)
-      ptr = nil
+      ptr = read_pointer
       begin
-        ptr = read_pointer
         yield ptr
       ensure
-        FFI::WIN32::CoTaskMemFree(ptr) if ptr && ! ptr.null?
+        FFI::WIN32::CoTaskMemFree(ptr) unless ptr.null?
       end
 
       # ptr has already had CoTaskMemFree called, so nothing to return
       nil
     end
 
-
     alias_method :write_dword, :write_uint32
     alias_method :write_word, :write_uint16
   end
 
+  class FFI::MemoryPointer
+    # Return a MemoryPointer that points to wide string. This is analogous to the
+    # FFI::MemoryPointer.from_string method.
+    def self.from_wide_string(wstr)
+      ptr = FFI::MemoryPointer.new(:uchar, wstr.bytesize + 2)
+      ptr.put_array_of_uchar(0, wstr.bytes.to_a)
+      ptr.put_uint16(wstr.bytesize, 0)
+
+      yield ptr if block_given?
+
+      ptr
+    end
+  end
+
   # FFI Types
   # https://github.com/ffi/ffi/wiki/Types