puppet 5.5.22 → 6.0.0

data/lib/puppet/util/resource_template.rb

@@ -53,7 +53,7 @@ class Puppet::Util::ResourceTemplate
 
   def set_resource_variables
     @resource.to_hash.each do |param, value|
-      var = "@#{param}"
+      var = "@#{param.to_s}"
       instance_variable_set(var, value)
     end
   end

data/lib/puppet/util/rubygems.rb

@@ -21,7 +21,7 @@ module Puppet::Util::RubyGems
       # @api private
       def source
         if has_rubygems?
-          Gem::Specification.respond_to?(:latest_specs) ? Gems18Source : OldGemsSource
+          Gems18Source
         else
           NoGemsSource
         end
@@ -51,18 +51,6 @@ module Puppet::Util::RubyGems
     end
   end
 
-  # RubyGems < 1.8.0
-  # @api private
-  class OldGemsSource < Source
-    def directories
-      @paths ||= Gem.latest_load_paths
-    end
-
-    def clear_paths
-      Gem.clear_paths
-    end
-  end
-
   # @api private
   class NoGemsSource < Source
     def directories

data/lib/puppet/util/run_mode.rb

@@ -11,7 +11,7 @@ module Puppet
 
       def self.[](name)
         @run_modes ||= {}
-        if Puppet.features.microsoft_windows?
+        if Puppet::Util::Platform.windows?
           @run_modes[name] ||= WindowsRunMode.new(name)
         else
           @run_modes[name] ||= UnixRunMode.new(name)

data/lib/puppet/util/selinux.rb

@@ -13,7 +13,7 @@ require 'pathname'
 
 module Puppet::Util::SELinux
 
-  def self.selinux_support?
+  def selinux_support?
     return false unless defined?(Selinux)
     if Selinux.is_selinux_enabled == 1
       return true
@@ -21,10 +21,6 @@ module Puppet::Util::SELinux
     false
   end
 
-  def selinux_support?
-    Puppet::Util::SELinux.selinux_support?
-  end
-
   # Retrieve and return the full context of the file.  If we don't have
   # SELinux support or if the SELinux call fails then return nil.
   def get_selinux_current_context(file)
@@ -194,7 +190,7 @@ module Puppet::Util::SELinux
   def selinux_label_support?(file)
     fstype = find_fs(file)
     return false if fstype.nil?
-    filesystems = ['ext2', 'ext3', 'ext4', 'gfs', 'gfs2', 'xfs', 'jfs', 'btrfs', 'tmpfs']
+    filesystems = ['ext2', 'ext3', 'ext4', 'gfs', 'gfs2', 'xfs', 'jfs', 'btrfs']
     filesystems.include?(fstype)
   end
 
@@ -206,9 +202,7 @@ module Puppet::Util::SELinux
         # If possible we use read_nonblock in a loop rather than read to work-
         # a linux kernel bug.  See ticket #1963 for details.
         mountfh = File.open("/proc/mounts")
-        loop do
-          mounts += mountfh.read_nonblock(1024)
-        end
+        mounts += mountfh.read_nonblock(1024) while true
       else
         # Otherwise we shell out and let cat do it for us
         mountfh = IO.popen("/bin/cat /proc/mounts")

data/lib/puppet/util/ssl.rb

@@ -1,6 +1,8 @@
+require 'openssl'
+
 ##
 # SSL is a private module with class methods that help work with x.509
-# subjects.
+# subjects and errors.
 #
 # @api private
 module Puppet::Util::SSL
@@ -50,4 +52,41 @@ module Puppet::Util::SSL
   def self.is_possibly_valid_dn?(dn)
     dn =~ /=/
   end
+
+  ##
+  # Extract and format meaningful error messages from OpenSSL::OpenSSLErrors
+  # and a Validator. Re-raises the error if unknown.
+  #
+  # @api private
+  #
+  # @param [OpenSSL::OpenSSLError] error An error thrown during creating a
+  #   connection
+  # @param [Puppet::SSL::DefaultValidator] verifier A Validator who may have
+  #   invalidated the connection
+  # @param [String] host The DNS name of the other end of the SSL connection
+  #
+  # @raises [Puppet::Error, OpenSSL::OpenSSLError]
+  def self.handle_connection_error(error, verifier, host)
+    # can be nil
+    peer_cert = verifier.peer_certs.last
+
+    if error.message.include? "certificate verify failed"
+      msg = error.message
+      msg << ": [" + verifier.verify_errors.join('; ') + "]"
+      raise Puppet::Error, msg, error.backtrace
+    elsif peer_cert && !OpenSSL::SSL.verify_certificate_identity(peer_cert, host)
+      valid_certnames = [peer_cert.subject.to_s.sub(/.*=/, ''),
+                         *Puppet::SSL::Certificate.subject_alt_names_for(peer_cert)].uniq
+      if valid_certnames.size > 1
+        expected_certnames = _("expected one of %{certnames}") % { certnames: valid_certnames.join(', ') }
+      else
+        expected_certnames = _("expected %{certname}") % { certname: valid_certnames.first }
+      end
+
+      msg = _("Server hostname '%{host}' did not match server certificate; %{expected_certnames}") % { host: host, expected_certnames: expected_certnames }
+      raise Puppet::Error, msg, error.backtrace
+    else
+      raise error
+    end
+  end
 end

data/lib/puppet/util/storage.rb

@@ -55,7 +55,7 @@ class Puppet::Util::Storage
     end
     Puppet::Util.benchmark(:debug, "Loaded state in %{seconds} seconds") do
       begin
-        @@state = Puppet::Util::Yaml.load_file(filename)
+        @@state = Puppet::Util::Yaml.safe_load_file(filename, [Symbol, Time])
       rescue Puppet::Util::Yaml::YamlLoadError => detail
         Puppet.err _("Checksumfile %{filename} is corrupt (%{detail}); replacing") % { filename: filename, detail: detail }
 
@@ -82,18 +82,6 @@ class Puppet::Util::Storage
 
     Puppet.info _("Creating state file %{file}") % { file: Puppet[:statefile] } unless Puppet::FileSystem.exist?(Puppet[:statefile])
 
-    if Puppet[:statettl] == 0 || Puppet[:statettl] == Float::INFINITY
-      Puppet.debug "Not pruning old state cache entries"
-    else
-      Puppet::Util.benchmark(:debug, "Pruned old state cache entries in %{seconds} seconds") do
-        ttl_cutoff = Time.now - Puppet[:statettl]
-
-        @@state.reject! do |k,v|
-          @@state[k][:checked] && @@state[k][:checked] < ttl_cutoff
-        end
-      end
-    end
-
     Puppet::Util.benchmark(:debug, "Stored state in %{seconds} seconds") do
       Puppet::Util::Yaml.dump(@@state, Puppet[:statefile])
     end

data/lib/puppet/util/suidmanager.rb

@@ -47,10 +47,12 @@ module Puppet::Util::SUIDManager
   module_function :groups=
 
   def self.root?
-    return Process.uid == 0 unless Puppet.features.microsoft_windows?
-
-    require 'puppet/util/windows/user'
-    Puppet::Util::Windows::User.admin?
+    if Puppet::Util::Platform.windows?
+      require 'puppet/util/windows/user'
+      Puppet::Util::Windows::User.admin?
+    else
+      Process.uid == 0
+    end
   end
 
   # Methods to handle changing uid/gid of the running process. In general,
@@ -61,7 +63,7 @@ module Puppet::Util::SUIDManager
   # If running on Windows or without root, the block will be run with the
   # current euid/egid.
   def asuser(new_uid=nil, new_gid=nil)
-    return yield if Puppet.features.microsoft_windows?
+    return yield if Puppet::Util::Platform.windows?
     return yield unless root?
     return yield unless new_uid or new_gid
 

data/lib/puppet/util/tag_set.rb

@@ -5,7 +5,7 @@ class Puppet::Util::TagSet < Set
   include Puppet::Network::FormatSupport
 
   def self.from_yaml(yaml)
-    self.new(YAML.load(yaml))
+    self.new(Puppet::Util::Yaml.safe_load(yaml, [Symbol]))
   end
 
   def to_yaml

data/lib/puppet/util/tagging.rb

@@ -10,7 +10,7 @@ module Puppet::Util::Tagging
   def tag(*ary)
     @tags ||= new_tags
 
-    ary.flatten.each do |tag|
+    ary.flatten.compact.each do |tag|
       name = tag.to_s.downcase
       # Add the tag before testing if it's valid since this means that
       # we never need to test the same valid tag twice. This speeds things

data/lib/puppet/util/windows.rb

@@ -1,3 +1,4 @@
+require 'puppet/util/platform'
 module Puppet::Util::Windows
   module ADSI
     class ADSIObject; end
@@ -14,6 +15,20 @@ module Puppet::Util::Windows
   class EventLog; end
 
   if Puppet::Util::Platform.windows?
+    require 'Win32API' # case matters in this require!
+
+    # Note: Setting codepage here globally ensures all strings returned via
+    # WIN32OLE (Ruby's late-bound COM support) are encoded in Encoding::UTF_8
+    #
+    # Also, this does not modify the value of WIN32OLE.locale - which defaults
+    # to 2048 (at least on US English Windows) and is not listed in the MS
+    # locales table, here: https://msdn.microsoft.com/en-us/library/ms912047(v=winembedded.10).aspx
+    require 'win32ole' ; WIN32OLE.codepage = WIN32OLE::CP_UTF8
+    # gems
+    require 'win32/process'
+    require 'win32/dir'
+    require 'win32/service'
+
     # these reference platform specific gems
     require 'puppet/util/windows/api_types'
     require 'puppet/util/windows/string'

data/lib/puppet/util/windows/adsi.rb

@@ -1,23 +1,6 @@
 module Puppet::Util::Windows::ADSI
   require 'ffi'
 
-  # https://docs.microsoft.com/en-us/windows/win32/api/dsrole/ne-dsrole-dsrole_machine_role
-  STANDALONE_WORKSTATION = 0
-  MEMBER_WORKSTATION = 1
-  STANDALONE_SERVER = 2
-  MEMBER_SERVER = 3
-  BACKUP_DOMAIN_CONTROLLER = 4
-  PRIMARY_DOMAIN_CONTROLLER = 5
-
-  DOMAIN_ROLES = {
-    STANDALONE_WORKSTATION => :STANDALONE_WORKSTATION,
-    MEMBER_WORKSTATION => :MEMBER_WORKSTATION,
-    STANDALONE_SERVER => :STANDALONE_SERVER,
-    MEMBER_SERVER => :MEMBER_SERVER,
-    BACKUP_DOMAIN_CONTROLLER => :BACKUP_DOMAIN_CONTROLLER,
-    PRIMARY_DOMAIN_CONTROLLER => :PRIMARY_DOMAIN_CONTROLLER,
-  }
-
   class << self
     extend FFI::Library
 
@@ -111,14 +94,6 @@ module Puppet::Util::Windows::ADSI
       wmi_connection.execquery(query)
     end
 
-    def domain_role
-      unless @domain_role
-        query_result = Puppet::Util::Windows::ADSI.execquery('select DomainRole from Win32_ComputerSystem').to_enum.first
-        @domain_role = DOMAIN_ROLES[query_result.DomainRole] if query_result
-      end
-      @domain_role
-    end
-
     ffi_convention :stdcall
 
     # https://msdn.microsoft.com/en-us/library/windows/desktop/ms724295(v=vs.85).aspx
@@ -159,7 +134,7 @@ module Puppet::Util::Windows::ADSI
 
       def parse_name(name)
         if name =~ /\//
-          raise Puppet::Error.new( _("Value must be in DOMAIN\\%{object_class} style syntax") % { object_class: @object_class } )
+          raise Puppet::Error.new( _("Value must be in DOMAIN\\user style syntax") )
         end
 
         matches = name.scan(/((.*)\\)?(.*)/)
@@ -180,11 +155,11 @@ module Puppet::Util::Windows::ADSI
         sids
       end
 
-      def name_sid_hash(names, allow_unresolved = false)
+      def name_sid_hash(names)
         return {} if names.nil? || names.empty?
 
         sids = names.map do |name|
-          sid = Puppet::Util::Windows::SID.name_to_principal(name, allow_unresolved)
+          sid = Puppet::Util::Windows::SID.name_to_principal(name)
           raise Puppet::Error.new( _("Could not resolve name: %{name}") % { name: name } ) if !sid
           [sid.sid, sid]
         end
@@ -201,12 +176,7 @@ module Puppet::Util::Windows::ADSI
         well_known = false
         if (sid = Puppet::Util::Windows::SID.name_to_principal(name_or_sid))
           # Examples of SidType include SidTypeUser, SidTypeGroup
-          if sid.account_type == "SidType#{@object_class.capitalize}".to_sym
-            # Check if we're getting back a local user when domain-joined
-            return true unless [:MEMBER_WORKSTATION, :MEMBER_SERVER].include?(Puppet::Util::Windows::ADSI.domain_role)
-            # The resource domain and the computer name are not always case-matching
-            return sid.domain.casecmp(Puppet::Util::Windows::ADSI.computer_name) == 0
-          end
+          return true if sid.account_type == "SidType#{@object_class.capitalize}".to_sym
 
           # 'well known group' is special as it can be a group like Everyone OR a user like SYSTEM
           # so try to resolve it
@@ -265,8 +235,7 @@ module Puppet::Util::Windows::ADSI
     end
 
     def [](attribute)
-      # Setting WIN32OLE.codepage in the microsoft_windows feature ensures
-      # values are returned as UTF-8
+      # Setting WIN32OLE.codepage ensures values are returned as UTF-8
       native_object.Get(attribute)
     end
 
@@ -281,7 +250,7 @@ module Puppet::Util::Windows::ADSI
         # ERROR_BAD_USERNAME 2202L from winerror.h
         if e.message =~ /8007089A/m
           raise Puppet::Error.new(
-            _("Puppet is not able to create/delete domain %{object_class} objects with the %{object_class} resource.") % { object_class: object_class },
+            _("Puppet is not able to create/delete domain %{object_class}s with the %{object_class} resource.") % { object_class: object_class },
           )
         end
 
@@ -342,8 +311,7 @@ module Puppet::Util::Windows::ADSI
       # https://msdn.microsoft.com/en-us/library/aa746342.aspx
       # WIN32OLE objects aren't enumerable, so no map
       groups = []
-      # Setting WIN32OLE.codepage in the microsoft_windows feature ensures
-      # values are returned as UTF-8
+      # Setting WIN32OLE.codepage ensures values are returned as UTF-8
       native_object.Groups.each {|g| groups << g.Name} rescue nil
       groups
     end
@@ -408,83 +376,6 @@ module Puppet::Util::Windows::ADSI
       end
     end
 
-    # Declare all of the available user flags on the system. Note that
-    # ADS_UF is read as ADS_UserFlag
-    #   https://docs.microsoft.com/en-us/windows/desktop/api/iads/ne-iads-ads_user_flag
-    # and
-    #   https://support.microsoft.com/en-us/help/305144/how-to-use-the-useraccountcontrol-flags-to-manipulate-user-account-pro
-    # for the flag values.
-    ADS_USERFLAGS = {
-      ADS_UF_SCRIPT:                                 0x0001,
-      ADS_UF_ACCOUNTDISABLE:                         0x0002,
-      ADS_UF_HOMEDIR_REQUIRED:                       0x0008,
-      ADS_UF_LOCKOUT:                                0x0010,
-      ADS_UF_PASSWD_NOTREQD:                         0x0020,
-      ADS_UF_PASSWD_CANT_CHANGE:                     0x0040,
-      ADS_UF_ENCRYPTED_TEXT_PASSWORD_ALLOWED:        0x0080,
-      ADS_UF_TEMP_DUPLICATE_ACCOUNT:                 0x0100,
-      ADS_UF_NORMAL_ACCOUNT:                         0x0200,
-      ADS_UF_INTERDOMAIN_TRUST_ACCOUNT:              0x0800,
-      ADS_UF_WORKSTATION_TRUST_ACCOUNT:              0x1000,
-      ADS_UF_SERVER_TRUST_ACCOUNT:                   0x2000,
-      ADS_UF_DONT_EXPIRE_PASSWD:                     0x10000,
-      ADS_UF_MNS_LOGON_ACCOUNT:                      0x20000,
-      ADS_UF_SMARTCARD_REQUIRED:                     0x40000,
-      ADS_UF_TRUSTED_FOR_DELEGATION:                 0x80000,
-      ADS_UF_NOT_DELEGATED:                          0x100000,
-      ADS_UF_USE_DES_KEY_ONLY:                       0x200000,
-      ADS_UF_DONT_REQUIRE_PREAUTH:                   0x400000,
-      ADS_UF_PASSWORD_EXPIRED:                       0x800000,
-      ADS_UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION: 0x1000000
-    }
-
-    def userflag_set?(flag)
-      flag_value = ADS_USERFLAGS[flag] || 0
-      ! (self['UserFlags'] & flag_value).zero?
-    end
-
-    # Common helper for set_userflags and unset_userflags.
-    #
-    # @api private
-    def op_userflags(*flags, &block)
-      # Avoid an unnecessary set + commit operation.
-      return if flags.empty?
-
-      unrecognized_flags = flags.reject { |flag| ADS_USERFLAGS.keys.include?(flag) }
-      unless unrecognized_flags.empty?
-        raise ArgumentError, _("Unrecognized ADS UserFlags: %{unrecognized_flags}") % { unrecognized_flags: unrecognized_flags.join(', ') }
-      end
-
-      self['UserFlags'] = flags.inject(self['UserFlags'], &block)
-    end
-
-    def set_userflags(*flags)
-      op_userflags(*flags) { |userflags, flag| userflags | ADS_USERFLAGS[flag] }
-    end
-
-    def unset_userflags(*flags)
-      op_userflags(*flags) { |userflags, flag| userflags & ~ADS_USERFLAGS[flag] }
-    end
-
-    def disabled?
-      userflag_set?(:ADS_UF_ACCOUNTDISABLE)
-    end
-
-    def locked_out?
-      # Note that the LOCKOUT flag is known to be inaccurate when using the
-      # LDAP IADsUser provider, but this class consistently uses the WinNT
-      # provider, which is expected to be accurate.
-      userflag_set?(:ADS_UF_LOCKOUT)
-    end
-
-    def expired?
-      expires = native_object.Get('AccountExpirationDate')
-      expires && expires < Time.now
-    rescue WIN32OLERuntimeError => e
-      # This OLE error code indicates the property can't be found in the cache
-      raise e unless e.message =~ /8000500D/m
-      false
-    end
 
     # UNLEN from lmcons.h - https://stackoverflow.com/a/2155176
     MAX_USERNAME_LENGTH = 256

data/lib/puppet/util/windows/api_types.rb

@@ -19,11 +19,15 @@ module Puppet::Util::Windows::APITypes
 
   class ::FFI::Pointer
     NULL_HANDLE = 0
-    WCHAR_NULL = "\0\0".encode('UTF-16LE').freeze
 
     def self.from_string_to_wide_string(str, &block)
       str = Puppet::Util::Windows::String.wide_string(str)
-      FFI::MemoryPointer.from_wide_string(str, &block)
+      FFI::MemoryPointer.new(:byte, str.bytesize) do |ptr|
+        # uchar here is synonymous with byte
+        ptr.put_array_of_uchar(0, str.bytes.to_a)
+
+        yield ptr
+      end
 
       # ptr has already had free called, so nothing to return
       nil
@@ -49,18 +53,12 @@ module Puppet::Util::Windows::APITypes
     alias_method :read_word,  :read_uint16
     alias_method :read_array_of_wchar, :read_array_of_uint16
 
-    def read_wide_string(char_length, dst_encoding = Encoding::UTF_8, strip = false, encode_options = {})
+    def read_wide_string(char_length, dst_encoding = Encoding::UTF_8, encode_options = {})
       # char_length is number of wide chars (typically excluding NULLs), *not* bytes
       str = get_bytes(0, char_length * 2).force_encoding('UTF-16LE')
-
-      if strip
-        i = str.index(WCHAR_NULL)
-        str = str[0, i] if i
-      end
-
       str.encode(dst_encoding, str.encoding, encode_options)
-    rescue EncodingError => e
-      Puppet.debug "Unable to convert value #{str.nil? ? 'nil' : str.dump} to encoding #{dst_encoding} due to #{e.inspect}"
+    rescue Exception => e
+      Puppet.debug "Unable to convert value #{str.dump} to encoding #{dst_encoding} due to #{e.inspect}"
       raise
     end
 
@@ -70,31 +68,32 @@ module Puppet::Util::Windows::APITypes
     #   null_terminator = :double_null, then the terminating sequence is four bytes of zero.  This is UNIT32 = 0
     # @param encode_options [Hash] Accepts the same option hash that may be passed to String#encode in Ruby
     def read_arbitrary_wide_string_up_to(max_char_length = 512, null_terminator = :single_null, encode_options = {})
-      idx = case null_terminator
-            when :single_null
-              # find index of wide null between 0 and max (exclusive)
-              (0...max_char_length).find do |i|
-                get_uint16(i * 2) == 0
-              end
-            when :double_null
-              # find index of double-wide null between 0 and max - 1 (exclusive)
-              (0...max_char_length - 1).find do |i|
-                get_uint32(i * 2) == 0
-              end
-            else
-              raise _("Unable to read wide strings with %{null_terminator} terminal nulls") % { null_terminator: null_terminator }
-            end
-
-      read_wide_string(idx || max_char_length, Encoding::UTF_8, false, encode_options)
+      if null_terminator != :single_null && null_terminator != :double_null
+        raise _("Unable to read wide strings with %{null_terminator} terminal nulls") % { null_terminator: null_terminator }
+      end
+
+      terminator_width = null_terminator == :single_null ? 1 : 2
+      reader_method = null_terminator == :single_null ? :get_uint16 : :get_uint32
+
+      # Look for a null terminating characters; if found, read up to that null (exclusive)
+      (0...max_char_length - terminator_width).each do |i|
+        return read_wide_string(i, Encoding::UTF_8, encode_options) if send(reader_method, (i * 2)) == 0
+      end
+
+      # String is longer than the max; read just to the max
+      read_wide_string(max_char_length, Encoding::UTF_8, encode_options)
     end
 
     def read_win32_local_pointer(&block)
-      ptr = read_pointer
+      ptr = nil
       begin
+        ptr = read_pointer
         yield ptr
       ensure
-        if !ptr.null? && FFI::WIN32::LocalFree(ptr.address) != FFI::Pointer::NULL_HANDLE
-          Puppet.debug "LocalFree memory leak"
+        if ptr && ! ptr.null?
+          if FFI::WIN32::LocalFree(ptr.address) != FFI::Pointer::NULL_HANDLE
+            Puppet.debug "LocalFree memory leak"
+          end
         end
       end
 
@@ -103,35 +102,23 @@ module Puppet::Util::Windows::APITypes
     end
 
     def read_com_memory_pointer(&block)
-      ptr = read_pointer
+      ptr = nil
       begin
+        ptr = read_pointer
         yield ptr
       ensure
-        FFI::WIN32::CoTaskMemFree(ptr) unless ptr.null?
+        FFI::WIN32::CoTaskMemFree(ptr) if ptr && ! ptr.null?
       end
 
       # ptr has already had CoTaskMemFree called, so nothing to return
       nil
     end
 
+
     alias_method :write_dword, :write_uint32
     alias_method :write_word, :write_uint16
   end
 
-  class FFI::MemoryPointer
-    # Return a MemoryPointer that points to wide string. This is analogous to the
-    # FFI::MemoryPointer.from_string method.
-    def self.from_wide_string(wstr)
-      ptr = FFI::MemoryPointer.new(:uchar, wstr.bytesize + 2)
-      ptr.put_array_of_uchar(0, wstr.bytes.to_a)
-      ptr.put_uint16(wstr.bytesize, 0)
-
-      yield ptr if block_given?
-
-      ptr
-    end
-  end
-
   # FFI Types
   # https://github.com/ffi/ffi/wiki/Types