puppet 6.11.1 → 6.16.0

data/lib/puppet/util/platform.rb

@@ -14,6 +14,11 @@ module Puppet
       end
       module_function :windows?
 
+      def solaris?
+        RUBY_PLATFORM.include?('solaris')
+      end
+      module_function :solaris?
+
       def default_paths
         return [] if windows?
 

data/lib/puppet/util/plist.rb

@@ -56,6 +56,12 @@ module Puppet::Util::Plist
     # Read plist text using the CFPropertyList gem.
     def parse_plist(plist_data, file_path = '')
       bad_xml_doctype = /^.*<!DOCTYPE plist PUBLIC -\/\/Apple Computer.*$/
+      # Depending on where parse_plist is called from, plist_data can be either XML or binary.
+      # If we get XML, make sure ruby knows it's UTF-8 so we avoid invalid byte sequence errors.
+      if plist_data.include?('encoding="UTF-8"') && plist_data.encoding != Encoding::UTF_8
+        plist_data.force_encoding(Encoding::UTF_8)
+      end
+
       begin
         if plist_data =~ bad_xml_doctype
           plist_data.gsub!( bad_xml_doctype, plist_xml_doctype )

data/lib/puppet/util/rpm_compare.rb

@@ -0,0 +1,193 @@
+module Puppet::Util::RpmCompare
+
+  ARCH_LIST = %w(
+    noarch i386 i686 ppc ppc64 armv3l armv4b armv4l armv4tl armv5tel
+    armv5tejl armv6l armv7l m68kmint s390 s390x ia64 x86_64 sh3 sh4
+  ).freeze
+
+  ARCH_REGEX = Regexp.new(ARCH_LIST.join('|\.'))
+
+  # This is an attempt at implementing RPM's
+  # lib/rpmvercmp.c rpmvercmp(a, b) in Ruby.
+  #
+  # Some of the things in here look REALLY
+  # UGLY and/or arbitrary. Our goal is to
+  # match how RPM compares versions, quirks
+  # and all.
+  #
+  # I've kept a lot of C-like string processing
+  # in an effort to keep this as identical to RPM
+  # as possible.
+  #
+  # returns 1 if str1 is newer than str2,
+  #         0 if they are identical
+  #        -1 if str1 is older than str2
+  def rpmvercmp(str1, str2)
+    return 0 if str1 == str2
+
+    front_strip_re = /^[^A-Za-z0-9~]+/
+
+    while str1.length > 0 or str2.length > 0
+      # trim anything that's in front_strip_re and != '~' off the beginning of each string
+      str1 = str1.gsub(front_strip_re, '')
+      str2 = str2.gsub(front_strip_re, '')
+
+      # "handle the tilde separator, it sorts before everything else"
+      if str1 =~ /^~/ && str2 =~ /^~/
+        # if they both have ~, strip it
+        str1 = str1[1..-1]
+        str2 = str2[1..-1]
+        next
+      elsif str1 =~ /^~/
+        return -1
+      elsif str2 =~ /^~/
+        return 1
+      end
+
+      break if str1.length == 0 or str2.length == 0
+
+      # "grab first completely alpha or completely numeric segment"
+      isnum = false
+      # if the first char of str1 is a digit, grab the chunk of continuous digits from each string
+      if str1 =~ /^[0-9]+/
+        if str1 =~ /^[0-9]+/
+          segment1 = $~.to_s
+          str1 = $~.post_match
+        else
+          segment1 = ''
+        end
+        if str2 =~ /^[0-9]+/
+          segment2 = $~.to_s
+          str2 = $~.post_match
+        else
+          segment2 = ''
+        end
+        isnum = true
+      # else grab the chunk of continuous alphas from each string (which may be '')
+      else
+        if str1 =~ /^[A-Za-z]+/
+          segment1 = $~.to_s
+          str1 = $~.post_match
+        else
+          segment1 = ''
+        end
+        if str2 =~ /^[A-Za-z]+/
+          segment2 = $~.to_s
+          str2 = $~.post_match
+        else
+          segment2 = ''
+        end
+      end
+
+      # if the segments we just grabbed from the strings are different types (i.e. one numeric one alpha),
+      # where alpha also includes ''; "numeric segments are always newer than alpha segments"
+      if segment2.length == 0
+        return 1 if isnum
+        return -1
+      end
+
+      if isnum
+        # "throw away any leading zeros - it's a number, right?"
+        segment1 = segment1.gsub(/^0+/, '')
+        segment2 = segment2.gsub(/^0+/, '')
+        # "whichever number has more digits wins"
+        return 1 if segment1.length > segment2.length
+        return -1 if segment1.length < segment2.length
+      end
+
+      # "strcmp will return which one is greater - even if the two segments are alpha
+      # or if they are numeric. don't return if they are equal because there might
+      # be more segments to compare"
+      rc = segment1 <=> segment2
+      return rc if rc != 0
+    end #end while loop
+
+    # if we haven't returned anything yet, "whichever version still has characters left over wins"
+    return 1 if str1.length > str2.length
+    return -1 if str1.length < str2.length
+    0
+  end
+
+  # parse a rpm "version" specification
+  # this re-implements rpm's
+  # rpmUtils.miscutils.stringToVersion() in ruby
+  def rpm_parse_evr(full_version)
+    epoch_index = full_version.index(':')
+    if epoch_index
+      epoch = full_version[0,epoch_index]
+      full_version = full_version[epoch_index+1,full_version.length]
+    else
+      epoch = nil
+    end
+    begin
+      epoch = String(Integer(epoch))
+    rescue
+      # If there are non-digits in the epoch field, default to nil
+      epoch = nil
+    end
+    release_index = full_version.index('-')
+    if release_index
+      version = full_version[0,release_index]
+      release = full_version[release_index+1,full_version.length]
+      arch = release.scan(ARCH_REGEX)[0]
+      if arch
+        architecture = arch.delete('.')
+        release.gsub!(ARCH_REGEX, '')
+      end
+    else
+      version = full_version
+      release = nil
+    end
+    return { :epoch => epoch, :version => version, :release => release, :arch => architecture }
+  end
+
+  # this method is a native implementation of the
+  # compare_values function in rpm's python bindings,
+  # found in python/header-py.c, as used by rpm.
+  def compare_values(s1, s2)
+    return 0 if s1.nil? && s2.nil?
+    return 1 if ( not s1.nil? ) && s2.nil?
+    return -1 if s1.nil? && (not s2.nil?)
+    return rpmvercmp(s1, s2)
+  end
+
+  # how rpm compares two package versions:
+  # rpmUtils.miscutils.compareEVR(), which massages data types and then calls
+  # rpm.labelCompare(), found in rpm.git/python/header-py.c, which
+  # sets epoch to 0 if null, then compares epoch, then ver, then rel
+  # using compare_values() and returns the first non-0 result, else 0.
+  # This function combines the logic of compareEVR() and labelCompare().
+  #
+  # "version_should" can be v, v-r, or e:v-r.
+  # "version_is" will always be at least v-r, can be e:v-r
+  #
+  # return 1: a is newer than b
+  #        0: a and b are the same version
+  #       -1: b is newer than a
+  def rpm_compareEVR(should, is)
+    # pass on to rpm labelCompare
+    should_hash = rpm_parse_evr(should)
+    is_hash = rpm_parse_evr(is)
+
+    if !should_hash[:epoch].nil?
+      rc = compare_values(should_hash[:epoch], is_hash[:epoch])
+      return rc unless rc == 0
+    end
+
+    rc = compare_values(should_hash[:version], is_hash[:version])
+    return rc unless rc == 0
+
+    # here is our special case, PUP-1244.
+    # if should_hash[:release] is nil (not specified by the user),
+    # and comparisons up to here are equal, return equal. We need to
+    # evaluate to whatever level of detail the user specified, so we
+    # don't end up upgrading or *downgrading* when not intended.
+    #
+    # This should NOT be triggered if we're trying to ensure latest.
+    return 0 if should_hash[:release].nil?
+
+    rc = compare_values(should_hash[:release], is_hash[:release])
+
+    return rc
+  end
+end

data/lib/puppet/util/storage.rb

@@ -1,5 +1,4 @@
 require 'yaml'
-require 'sync'
 require 'singleton'
 require 'puppet/util/yaml'
 

data/lib/puppet/util/windows/adsi.rb

@@ -1,6 +1,23 @@
 module Puppet::Util::Windows::ADSI
   require 'ffi'
 
+  # https://docs.microsoft.com/en-us/windows/win32/api/dsrole/ne-dsrole-dsrole_machine_role
+  STANDALONE_WORKSTATION = 0
+  MEMBER_WORKSTATION = 1
+  STANDALONE_SERVER = 2
+  MEMBER_SERVER = 3
+  BACKUP_DOMAIN_CONTROLLER = 4
+  PRIMARY_DOMAIN_CONTROLLER = 5
+
+  DOMAIN_ROLES = {
+    STANDALONE_WORKSTATION => :STANDALONE_WORKSTATION,
+    MEMBER_WORKSTATION => :MEMBER_WORKSTATION,
+    STANDALONE_SERVER => :STANDALONE_SERVER,
+    MEMBER_SERVER => :MEMBER_SERVER,
+    BACKUP_DOMAIN_CONTROLLER => :BACKUP_DOMAIN_CONTROLLER,
+    PRIMARY_DOMAIN_CONTROLLER => :PRIMARY_DOMAIN_CONTROLLER,
+  }
+
   class << self
     extend FFI::Library
 
@@ -94,6 +111,14 @@ module Puppet::Util::Windows::ADSI
       wmi_connection.execquery(query)
     end
 
+    def domain_role
+      unless @domain_role
+        query_result = Puppet::Util::Windows::ADSI.execquery('select DomainRole from Win32_ComputerSystem').to_enum.first
+        @domain_role = DOMAIN_ROLES[query_result.DomainRole] if query_result
+      end
+      @domain_role
+    end
+
     ffi_convention :stdcall
 
     # https://msdn.microsoft.com/en-us/library/windows/desktop/ms724295(v=vs.85).aspx
@@ -155,11 +180,11 @@ module Puppet::Util::Windows::ADSI
         sids
       end
 
-      def name_sid_hash(names)
+      def name_sid_hash(names, allow_unresolved = false)
         return {} if names.nil? || names.empty?
 
         sids = names.map do |name|
-          sid = Puppet::Util::Windows::SID.name_to_principal(name)
+          sid = Puppet::Util::Windows::SID.name_to_principal(name, allow_unresolved)
           raise Puppet::Error.new( _("Could not resolve name: %{name}") % { name: name } ) if !sid
           [sid.sid, sid]
         end
@@ -176,7 +201,12 @@ module Puppet::Util::Windows::ADSI
         well_known = false
         if (sid = Puppet::Util::Windows::SID.name_to_principal(name_or_sid))
           # Examples of SidType include SidTypeUser, SidTypeGroup
-          return true if sid.account_type == "SidType#{@object_class.capitalize}".to_sym
+          if sid.account_type == "SidType#{@object_class.capitalize}".to_sym
+            # Check if we're getting back a local user when domain-joined
+            return true unless [:MEMBER_WORKSTATION, :MEMBER_SERVER].include?(Puppet::Util::Windows::ADSI.domain_role)
+            # The resource domain and the computer name are not always case-matching
+            return sid.domain.casecmp(Puppet::Util::Windows::ADSI.computer_name) == 0
+          end
 
           # 'well known group' is special as it can be a group like Everyone OR a user like SYSTEM
           # so try to resolve it
@@ -386,23 +416,23 @@ module Puppet::Util::Windows::ADSI
       ADS_UF_SCRIPT:                                 0x0001,
       ADS_UF_ACCOUNTDISABLE:                         0x0002,
       ADS_UF_HOMEDIR_REQUIRED:                       0x0008,
-      ADS_UF_LOCKOUT:                                0x0010,                          
-      ADS_UF_PASSWD_NOTREQD:                         0x0020,                   
-      ADS_UF_PASSWD_CANT_CHANGE:                     0x0040,               
-      ADS_UF_ENCRYPTED_TEXT_PASSWORD_ALLOWED:        0x0080,       
-      ADS_UF_TEMP_DUPLICATE_ACCOUNT:                 0x0100,           
-      ADS_UF_NORMAL_ACCOUNT:                         0x0200,                   
-      ADS_UF_INTERDOMAIN_TRUST_ACCOUNT:              0x0800,        
-      ADS_UF_WORKSTATION_TRUST_ACCOUNT:              0x1000,        
-      ADS_UF_SERVER_TRUST_ACCOUNT:                   0x2000,             
-      ADS_UF_DONT_EXPIRE_PASSWD:                     0x10000,            
-      ADS_UF_MNS_LOGON_ACCOUNT:                      0x20000,               
-      ADS_UF_SMARTCARD_REQUIRED:                     0x40000,              
-      ADS_UF_TRUSTED_FOR_DELEGATION:                 0x80000,          
-      ADS_UF_NOT_DELEGATED:                          0x100000,                  
-      ADS_UF_USE_DES_KEY_ONLY:                       0x200000,               
-      ADS_UF_DONT_REQUIRE_PREAUTH:                   0x400000,               
-      ADS_UF_PASSWORD_EXPIRED:                       0x800000,               
+      ADS_UF_LOCKOUT:                                0x0010,
+      ADS_UF_PASSWD_NOTREQD:                         0x0020,
+      ADS_UF_PASSWD_CANT_CHANGE:                     0x0040,
+      ADS_UF_ENCRYPTED_TEXT_PASSWORD_ALLOWED:        0x0080,
+      ADS_UF_TEMP_DUPLICATE_ACCOUNT:                 0x0100,
+      ADS_UF_NORMAL_ACCOUNT:                         0x0200,
+      ADS_UF_INTERDOMAIN_TRUST_ACCOUNT:              0x0800,
+      ADS_UF_WORKSTATION_TRUST_ACCOUNT:              0x1000,
+      ADS_UF_SERVER_TRUST_ACCOUNT:                   0x2000,
+      ADS_UF_DONT_EXPIRE_PASSWD:                     0x10000,
+      ADS_UF_MNS_LOGON_ACCOUNT:                      0x20000,
+      ADS_UF_SMARTCARD_REQUIRED:                     0x40000,
+      ADS_UF_TRUSTED_FOR_DELEGATION:                 0x80000,
+      ADS_UF_NOT_DELEGATED:                          0x100000,
+      ADS_UF_USE_DES_KEY_ONLY:                       0x200000,
+      ADS_UF_DONT_REQUIRE_PREAUTH:                   0x400000,
+      ADS_UF_PASSWORD_EXPIRED:                       0x800000,
       ADS_UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION: 0x1000000
     }
 

data/lib/puppet/util/windows/process.rb

@@ -122,21 +122,22 @@ module Puppet::Util::Windows::Process
   def get_process_image_name_by_pid(pid)
     image_name = ""
 
-     open_process(PROCESS_QUERY_INFORMATION, false, pid) do |phandle|
-
-       FFI::MemoryPointer.new(:dword, 1) do |exe_name_length_ptr|
-        # UTF is 2 bytes/char:
-        max_chars = MAX_PATH_LENGTH + 1
-        exe_name_length_ptr.write_dword(max_chars)
-        FFI::MemoryPointer.new(:wchar, max_chars) do |exe_name_ptr|
-          use_win32_path_format = 0
-          result = QueryFullProcessImageNameW(phandle, use_win32_path_format, exe_name_ptr, exe_name_length_ptr)
-          if result == FFI::WIN32_FALSE
-            raise Puppet::Util::Windows::Error.new(
-              "QueryFullProcessImageNameW(phandle, #{use_win32_path_format}, " +
-              "exe_name_ptr, #{max_chars}")
+    Puppet::Util::Windows::Security.with_privilege(Puppet::Util::Windows::Security::SE_DEBUG_NAME) do
+      open_process(PROCESS_QUERY_INFORMATION, false, pid) do |phandle|
+        FFI::MemoryPointer.new(:dword, 1) do |exe_name_length_ptr|
+          # UTF is 2 bytes/char:
+          max_chars = MAX_PATH_LENGTH + 1
+          exe_name_length_ptr.write_dword(max_chars)
+          FFI::MemoryPointer.new(:wchar, max_chars) do |exe_name_ptr|
+            use_win32_path_format = 0
+            result = QueryFullProcessImageNameW(phandle, use_win32_path_format, exe_name_ptr, exe_name_length_ptr)
+            if result == FFI::WIN32_FALSE
+              raise Puppet::Util::Windows::Error.new(
+                      "QueryFullProcessImageNameW(phandle, #{use_win32_path_format}, " +
+                      "exe_name_ptr, #{max_chars}")
+            end
+            image_name = exe_name_ptr.read_wide_string(exe_name_length_ptr.read_dword)
           end
-          image_name = exe_name_ptr.read_wide_string(exe_name_length_ptr.read_dword)
         end
       end
     end

data/lib/puppet/util/windows/security.rb

@@ -97,6 +97,7 @@ module Puppet::Util::Windows::Security
   FILE = Puppet::Util::Windows::File
 
   SE_BACKUP_NAME              = 'SeBackupPrivilege'
+  SE_DEBUG_NAME               = 'SeDebugPrivilege'
   SE_RESTORE_NAME             = 'SeRestorePrivilege'
 
   DELETE                      = 0x00010000

data/lib/puppet/util/windows/sid.rb

@@ -64,7 +64,7 @@ module Puppet::Util::Windows
     # 'BUILTIN\Administrators', or 'S-1-5-32-544', and will return the
     # SID object. Returns nil if the account doesn't exist.
     # This method returns a SID::Principal with the account, domain, SID, etc
-    def name_to_principal(name)
+    def name_to_principal(name, allow_unresolved = false)
       # Apparently, we accept a symbol..
       name = name.to_s.strip if name
 
@@ -79,7 +79,7 @@ module Puppet::Util::Windows
 
       raw_sid_bytes ? Principal.lookup_account_sid(raw_sid_bytes) : Principal.lookup_account_name(name)
     rescue
-      nil
+      (allow_unresolved && raw_sid_bytes) ? unresolved_principal(name, raw_sid_bytes) : nil
     end
     module_function :name_to_principal
     class << self; alias name_to_sid_object name_to_principal; end
@@ -236,7 +236,7 @@ module Puppet::Util::Windows
     # @api private
     def self.unresolved_principal(name, sid_bytes)
       Principal.new(
-        name + " (unresolvable)", # account
+        name, # account
         sid_bytes, # sid_bytes
         name, # sid string
         nil, #domain

data/lib/puppet/util/yaml.rb

@@ -65,7 +65,7 @@ module Puppet::Util::Yaml
   end
 
   def self.dump(structure, filename)
-    Puppet::Util.replace_file(filename, 0660) do |fh|
+    Puppet::FileSystem.replace_file(filename, 0660) do |fh|
       YAML.dump(structure, fh)
     end
   end

data/lib/puppet/version.rb

@@ -6,7 +6,7 @@
 # Raketasks and such to set the version based on the output of `git describe`
 
 module Puppet
-  PUPPETVERSION = '6.11.1'
+  PUPPETVERSION = '6.16.0'
 
   ##
   # version is a public API method intended to always provide a fast and

data/lib/puppet/x509/cert_provider.rb

@@ -16,12 +16,16 @@ class Puppet::X509::CertProvider
                  crlpath: Puppet[:hostcrl],
                  privatekeydir: Puppet[:privatekeydir],
                  certdir: Puppet[:certdir],
-                 requestdir: Puppet[:requestdir])
+                 requestdir: Puppet[:requestdir],
+                 hostprivkey: Puppet.settings.set_by_config?(:hostprivkey) ? Puppet[:hostprivkey] : nil,
+                 hostcert: Puppet.settings.set_by_config?(:hostcert) ? Puppet[:hostcert] : nil)
     @capath = capath
     @crlpath = crlpath
     @privatekeydir = privatekeydir
     @certdir = certdir
     @requestdir = requestdir
+    @hostprivkey = hostprivkey
+    @hostcert = hostcert
   end
 
   # Save `certs` to the configured `capath`.
@@ -146,7 +150,7 @@ class Puppet::X509::CertProvider
           else
             key.to_pem
           end
-    path = to_path(@privatekeydir, name)
+    path = @hostprivkey || to_path(@privatekeydir, name)
     save_pem(pem, path, **permissions_for_setting(:hostprivkey))
   rescue SystemCallError => e
     raise Puppet::Error.new(_("Failed to save private key for '%{name}'") % {name: name}, e)
@@ -165,7 +169,7 @@ class Puppet::X509::CertProvider
   # @raise [Puppet::Error] if the private key cannot be loaded
   # @api private
   def load_private_key(name, required: false, password: nil)
-    path = to_path(@privatekeydir, name)
+    path = @hostprivkey || to_path(@privatekeydir, name)
     pem = load_pem(path)
     if !pem && required
       raise Puppet::Error, _("The private key is missing from '%{path}'") % { path: path }
@@ -225,7 +229,7 @@ class Puppet::X509::CertProvider
   # @raise [Puppet::Error] if the client cert cannot be saved
   # @api private
   def save_client_cert(name, cert)
-    path = to_path(@certdir, name)
+    path = @hostcert || to_path(@certdir, name)
     save_pem(cert.to_pem, path, **permissions_for_setting(:hostcert))
   rescue SystemCallError => e
     raise Puppet::Error.new(_("Failed to save client certificate for '%{name}'") % {name: name}, e)
@@ -240,7 +244,7 @@ class Puppet::X509::CertProvider
   # @raise [Puppet::Error] if the client cert cannot be loaded
   # @api private
   def load_client_cert(name, required: false)
-    path = to_path(@certdir, name)
+    path = @hostcert || to_path(@certdir, name)
     pem = load_pem(path)
     if !pem && required
       raise Puppet::Error, _("The client certificate is missing from '%{path}'") % { path: path }