puppet 6.14.0-universal-darwin → 6.19.0-universal-darwin

data/lib/puppet/util/run_mode.rb

@@ -18,8 +18,12 @@ module Puppet
         end
       end
 
+      def server?
+        name == :master || name == :server
+      end
+
       def master?
-        name == :master
+        name == :master || name == :server
       end
 
       def agent?

data/lib/puppet/util/windows.rb

@@ -26,6 +26,7 @@ module Puppet::Util::Windows
     require 'win32ole' ; WIN32OLE.codepage = WIN32OLE::CP_UTF8
     # gems
     require 'win32/process'
+    require 'puppet/util/windows/monkey_patches/dir'
     require 'win32/dir'
     require 'win32/service'
 

data/lib/puppet/util/windows/adsi.rb

@@ -180,11 +180,11 @@ module Puppet::Util::Windows::ADSI
         sids
       end
 
-      def name_sid_hash(names)
+      def name_sid_hash(names, allow_unresolved = false)
         return {} if names.nil? || names.empty?
 
         sids = names.map do |name|
-          sid = Puppet::Util::Windows::SID.name_to_principal(name)
+          sid = Puppet::Util::Windows::SID.name_to_principal(name, allow_unresolved)
           raise Puppet::Error.new( _("Could not resolve name: %{name}") % { name: name } ) if !sid
           [sid.sid, sid]
         end

data/lib/puppet/util/windows/api_types.rb

@@ -19,15 +19,11 @@ module Puppet::Util::Windows::APITypes
 
   class ::FFI::Pointer
     NULL_HANDLE = 0
+    WCHAR_NULL = "\0\0".encode('UTF-16LE').freeze
 
     def self.from_string_to_wide_string(str, &block)
       str = Puppet::Util::Windows::String.wide_string(str)
-      FFI::MemoryPointer.new(:byte, str.bytesize) do |ptr|
-        # uchar here is synonymous with byte
-        ptr.put_array_of_uchar(0, str.bytes.to_a)
-
-        yield ptr
-      end
+      FFI::MemoryPointer.from_wide_string(str, &block)
 
       # ptr has already had free called, so nothing to return
       nil
@@ -53,12 +49,18 @@ module Puppet::Util::Windows::APITypes
     alias_method :read_word,  :read_uint16
     alias_method :read_array_of_wchar, :read_array_of_uint16
 
-    def read_wide_string(char_length, dst_encoding = Encoding::UTF_8, encode_options = {})
+    def read_wide_string(char_length, dst_encoding = Encoding::UTF_8, strip = false, encode_options = {})
       # char_length is number of wide chars (typically excluding NULLs), *not* bytes
       str = get_bytes(0, char_length * 2).force_encoding('UTF-16LE')
+
+      if strip
+        i = str.index(WCHAR_NULL)
+        str = str[0, i] if i
+      end
+
       str.encode(dst_encoding, str.encoding, encode_options)
-    rescue Exception => e
-      Puppet.debug "Unable to convert value #{str.nil? ? 'nil' : str.dump} to encoding #{dst_encoding} due to #{e.inspect}"
+    rescue EncodingError => e
+      Puppet.debug { "Unable to convert value #{str.nil? ? 'nil' : str.dump} to encoding #{dst_encoding} due to #{e.inspect}" }
       raise
     end
 
@@ -68,32 +70,31 @@ module Puppet::Util::Windows::APITypes
     #   null_terminator = :double_null, then the terminating sequence is four bytes of zero.  This is UNIT32 = 0
     # @param encode_options [Hash] Accepts the same option hash that may be passed to String#encode in Ruby
     def read_arbitrary_wide_string_up_to(max_char_length = 512, null_terminator = :single_null, encode_options = {})
-      if null_terminator != :single_null && null_terminator != :double_null
-        raise _("Unable to read wide strings with %{null_terminator} terminal nulls") % { null_terminator: null_terminator }
-      end
-
-      terminator_width = null_terminator == :single_null ? 1 : 2
-      reader_method = null_terminator == :single_null ? :get_uint16 : :get_uint32
-
-      # Look for a null terminating characters; if found, read up to that null (exclusive)
-      (0...max_char_length - terminator_width).each do |i|
-        return read_wide_string(i, Encoding::UTF_8, encode_options) if send(reader_method, (i * 2)) == 0
-      end
-
-      # String is longer than the max; read just to the max
-      read_wide_string(max_char_length, Encoding::UTF_8, encode_options)
+      idx = case null_terminator
+            when :single_null
+              # find index of wide null between 0 and max (exclusive)
+              (0...max_char_length).find do |i|
+                get_uint16(i * 2) == 0
+              end
+            when :double_null
+              # find index of double-wide null between 0 and max - 1 (exclusive)
+              (0...max_char_length - 1).find do |i|
+                get_uint32(i * 2) == 0
+              end
+            else
+              raise _("Unable to read wide strings with %{null_terminator} terminal nulls") % { null_terminator: null_terminator }
+            end
+
+      read_wide_string(idx || max_char_length, Encoding::UTF_8, false, encode_options)
     end
 
     def read_win32_local_pointer(&block)
-      ptr = nil
+      ptr = read_pointer
       begin
-        ptr = read_pointer
         yield ptr
       ensure
-        if ptr && ! ptr.null?
-          if FFI::WIN32::LocalFree(ptr.address) != FFI::Pointer::NULL_HANDLE
-            Puppet.debug "LocalFree memory leak"
-          end
+        if !ptr.null? && FFI::WIN32::LocalFree(ptr.address) != FFI::Pointer::NULL_HANDLE
+          Puppet.debug "LocalFree memory leak"
         end
       end
 
@@ -102,23 +103,35 @@ module Puppet::Util::Windows::APITypes
     end
 
     def read_com_memory_pointer(&block)
-      ptr = nil
+      ptr = read_pointer
       begin
-        ptr = read_pointer
         yield ptr
       ensure
-        FFI::WIN32::CoTaskMemFree(ptr) if ptr && ! ptr.null?
+        FFI::WIN32::CoTaskMemFree(ptr) unless ptr.null?
       end
 
       # ptr has already had CoTaskMemFree called, so nothing to return
       nil
     end
 
-
     alias_method :write_dword, :write_uint32
     alias_method :write_word, :write_uint16
   end
 
+  class FFI::MemoryPointer
+    # Return a MemoryPointer that points to wide string. This is analogous to the
+    # FFI::MemoryPointer.from_string method.
+    def self.from_wide_string(wstr)
+      ptr = FFI::MemoryPointer.new(:uchar, wstr.bytesize + 2)
+      ptr.put_array_of_uchar(0, wstr.bytes.to_a)
+      ptr.put_uint16(wstr.bytesize, 0)
+
+      yield ptr if block_given?
+
+      ptr
+    end
+  end
+
   # FFI Types
   # https://github.com/ffi/ffi/wiki/Types
 
@@ -183,6 +196,20 @@ module Puppet::Util::Windows::APITypes
   FFI.typedef :uchar, :byte
   FFI.typedef :uint16, :wchar
 
+  # Definitions for data types used in LSA structures and functions
+  # https://docs.microsoft.com/en-us/windows/win32/api/ntsecapi/
+  # https://docs.microsoft.com/sr-latn-rs/windows/win32/secmgmt/management-data-types
+  FFI.typedef :pointer, :pwstr
+  FFI.typedef :pointer, :pulong
+  FFI.typedef :pointer, :lsa_handle
+  FFI.typedef :pointer, :plsa_handle
+  FFI.typedef :pointer, :psid
+  FFI.typedef :pointer, :pvoid
+  FFI.typedef :pointer, :plsa_unicode_string
+  FFI.typedef :pointer, :plsa_object_attributes
+  FFI.typedef :uint32,  :ntstatus
+  FFI.typedef :dword,   :access_mask
+
   module ::FFI::WIN32
     extend ::FFI::Library
 

data/lib/puppet/util/windows/eventlog.rb

@@ -140,12 +140,7 @@ class Puppet::Util::Windows::EventLog
   # @api private
   def from_string_to_wide_string(str, &block)
     str = wide_string(str)
-    FFI::MemoryPointer.new(:uchar, str.bytesize) do |ptr|
-      # uchar here is synonymous with byte
-      ptr.put_array_of_uchar(0, str.bytes.to_a)
-
-      yield ptr
-    end
+    FFI::MemoryPointer.from_wide_string(str) { |ptr| yield ptr }
 
     # ptr has already had free called, so nothing to return
     nil

data/lib/puppet/util/windows/monkey_patches/dir.rb

@@ -0,0 +1,40 @@
+require 'win32/dir/constants'
+require 'win32/dir/functions'
+require 'win32/dir/structs'
+
+class DirMonkeyPatched
+  include ::Dir::Structs
+  include ::Dir::Constants
+  extend  ::Dir::Functions
+
+  path  = nil
+  key   = :PERSONAL
+  value = 0x0005
+  buf   = 0.chr * 1024
+  buf.encode!(Encoding::UTF_16LE)
+
+  if SHGetFolderPathW(0, value, 0, 0, buf) == 0 # Current path
+    path = buf.strip
+  elsif SHGetFolderPathW(0, value, 0, 1, buf) == 0 # Default path
+    path = buf.strip
+  else
+    FFI::MemoryPointer.new(:long) do |ptr|
+      if SHGetFolderLocation(0, value, 0, 0, ptr) == 0
+        SHFILEINFO.new do |info|
+          flags = SHGFI_DISPLAYNAME | SHGFI_PIDL
+          if SHGetFileInfo(ptr.read_long, 0, info, info.size, flags) != 0
+            path = info[:szDisplayName].to_s
+          end
+        end
+      end
+    end
+  end
+
+  if path.nil?
+    begin
+      Dir.const_set(key, ''.encode(Encoding.default_external))
+    rescue Encoding::UndefinedConversionError
+      Dir.const_set(key, ''.encode(Encoding::UTF_8))
+    end
+  end
+end

data/lib/puppet/util/windows/principal.rb

@@ -41,6 +41,7 @@ module Puppet::Util::Windows::SID
     # = 8 + max sub identifiers (15) * 4
     MAXIMUM_SID_BYTE_LENGTH = 68
 
+    ERROR_INVALID_PARAMETER   = 87
     ERROR_INSUFFICIENT_BUFFER = 122
 
     def self.lookup_account_name(system_name = nil, account_name)
@@ -48,9 +49,7 @@ module Puppet::Util::Windows::SID
       begin
         if system_name
           system_name_wide = Puppet::Util::Windows::String.wide_string(system_name)
-          # uchar here is synonymous with byte
-          system_name_ptr = FFI::MemoryPointer.new(:byte, system_name_wide.bytesize)
-          system_name_ptr.put_array_of_uchar(0, system_name_wide.bytes.to_a)
+          system_name_ptr = FFI::MemoryPointer.from_wide_string(system_name_wide)
         end
 
         FFI::MemoryPointer.from_string_to_wide_string(account_name) do |account_name_ptr|
@@ -101,9 +100,7 @@ module Puppet::Util::Windows::SID
       begin
         if system_name
           system_name_wide = Puppet::Util::Windows::String.wide_string(system_name)
-          # uchar here is synonymous with byte
-          system_name_ptr = FFI::MemoryPointer.new(:byte, system_name_wide.bytesize)
-          system_name_ptr.put_array_of_uchar(0, system_name_wide.bytes.to_a)
+          system_name_ptr = FFI::MemoryPointer.from_wide_string(system_name_wide)
         end
 
         FFI::MemoryPointer.new(:byte, sid_bytes.length) do |sid_ptr|
@@ -112,6 +109,11 @@ module Puppet::Util::Windows::SID
               FFI::MemoryPointer.new(:uint32, 1) do |name_use_enum_ptr|
 
                 sid_ptr.write_array_of_uchar(sid_bytes)
+
+                if Puppet::Util::Windows::SID.IsValidSid(sid_ptr) == FFI::WIN32_FALSE
+                  raise Puppet::Util::Windows::Error.new(_('Byte array for lookup_account_sid is invalid: %{sid_bytes}') % { sid_bytes: sid_bytes }, ERROR_INVALID_PARAMETER)
+                end
+
                 success = LookupAccountSidW(system_name_ptr, sid_ptr, FFI::Pointer::NULL, name_length_ptr,
                   FFI::Pointer::NULL, domain_length_ptr, name_use_enum_ptr)
                 last_error = FFI.errno

data/lib/puppet/util/windows/process.rb

@@ -122,21 +122,22 @@ module Puppet::Util::Windows::Process
   def get_process_image_name_by_pid(pid)
     image_name = ""
 
-     open_process(PROCESS_QUERY_INFORMATION, false, pid) do |phandle|
-
-       FFI::MemoryPointer.new(:dword, 1) do |exe_name_length_ptr|
-        # UTF is 2 bytes/char:
-        max_chars = MAX_PATH_LENGTH + 1
-        exe_name_length_ptr.write_dword(max_chars)
-        FFI::MemoryPointer.new(:wchar, max_chars) do |exe_name_ptr|
-          use_win32_path_format = 0
-          result = QueryFullProcessImageNameW(phandle, use_win32_path_format, exe_name_ptr, exe_name_length_ptr)
-          if result == FFI::WIN32_FALSE
-            raise Puppet::Util::Windows::Error.new(
-              "QueryFullProcessImageNameW(phandle, #{use_win32_path_format}, " +
-              "exe_name_ptr, #{max_chars}")
+    Puppet::Util::Windows::Security.with_privilege(Puppet::Util::Windows::Security::SE_DEBUG_NAME) do
+      open_process(PROCESS_QUERY_INFORMATION, false, pid) do |phandle|
+        FFI::MemoryPointer.new(:dword, 1) do |exe_name_length_ptr|
+          # UTF is 2 bytes/char:
+          max_chars = MAX_PATH_LENGTH + 1
+          exe_name_length_ptr.write_dword(max_chars)
+          FFI::MemoryPointer.new(:wchar, max_chars) do |exe_name_ptr|
+            use_win32_path_format = 0
+            result = QueryFullProcessImageNameW(phandle, use_win32_path_format, exe_name_ptr, exe_name_length_ptr)
+            if result == FFI::WIN32_FALSE
+              raise Puppet::Util::Windows::Error.new(
+                      "QueryFullProcessImageNameW(phandle, #{use_win32_path_format}, " +
+                      "exe_name_ptr, #{max_chars}")
+            end
+            image_name = exe_name_ptr.read_wide_string(exe_name_length_ptr.read_dword)
           end
-          image_name = exe_name_ptr.read_wide_string(exe_name_length_ptr.read_dword)
         end
       end
     end

data/lib/puppet/util/windows/registry.rb

@@ -110,13 +110,16 @@ module Puppet::Util::Windows
 
     private
 
-    def reg_enum_key(key, index, max_key_length = Win32::Registry::Constants::MAX_KEY_LENGTH)
+    # max number of wide characters including NULL terminator
+    MAX_KEY_CHAR_LENGTH = 255 + 1
+
+    def reg_enum_key(key, index, max_key_char_length = MAX_KEY_CHAR_LENGTH)
       subkey, filetime = nil, nil
 
       FFI::MemoryPointer.new(:dword) do |subkey_length_ptr|
         FFI::MemoryPointer.new(FFI::WIN32::FILETIME.size) do |filetime_ptr|
-          FFI::MemoryPointer.new(:wchar, max_key_length) do |subkey_ptr|
-            subkey_length_ptr.write_dword(max_key_length)
+          FFI::MemoryPointer.new(:wchar, max_key_char_length) do |subkey_ptr|
+            subkey_length_ptr.write_dword(max_key_char_length)
 
             # RegEnumKeyEx cannot be called twice to properly size the buffer
             result = RegEnumKeyExW(key.hkey, index,
@@ -141,7 +144,10 @@ module Puppet::Util::Windows
       [subkey, filetime]
     end
 
-    def reg_enum_value(key, index, max_value_length = Win32::Registry::Constants::MAX_VALUE_LENGTH)
+    # max number of wide characters including NULL terminator
+    MAX_VALUE_CHAR_LENGTH = 16383 + 1
+
+    def reg_enum_value(key, index, max_value_length = MAX_VALUE_CHAR_LENGTH)
       subkey, type, data = nil, nil, nil
 
       FFI::MemoryPointer.new(:dword) do |subkey_length_ptr|
@@ -234,7 +240,7 @@ module Puppet::Util::Windows
         begin
           case type
             when Win32::Registry::REG_SZ, Win32::Registry::REG_EXPAND_SZ
-              result = [ type, sanitize(data_ptr.read_wide_string(string_length)) ]
+              result = [ type, data_ptr.read_wide_string(string_length, Encoding::UTF_8, true) ]
             when Win32::Registry::REG_MULTI_SZ
               result = [ type, data_ptr.read_wide_string(string_length).split(/\0/) ]
             when Win32::Registry::REG_BINARY
@@ -314,12 +320,6 @@ module Puppet::Util::Windows
       result
     end
 
-    def sanitize(value)
-      # Replace null bytes with a space
-      value.tr!("\x00", ' ')
-      value
-    end
-
     ffi_convention :stdcall
 
     # https://msdn.microsoft.com/en-us/library/windows/desktop/ms724862(v=vs.85).aspx

data/lib/puppet/util/windows/security.rb

@@ -97,6 +97,7 @@ module Puppet::Util::Windows::Security
   FILE = Puppet::Util::Windows::File
 
   SE_BACKUP_NAME              = 'SeBackupPrivilege'
+  SE_DEBUG_NAME               = 'SeDebugPrivilege'
   SE_RESTORE_NAME             = 'SeRestorePrivilege'
 
   DELETE                      = 0x00010000
@@ -339,10 +340,10 @@ module Puppet::Util::Windows::Security
           Puppet.warning _("Setting control rights for %{path} owner SYSTEM to less than Full Control rights. Setting SYSTEM rights to less than Full Control may have unintented consequences for operations on this file") % { path: path }
         elsif managing_owner && isownergroup
           #TRANSLATORS 'SYSTEM' is a Windows name and should not be translated
-          Puppet.debug _("%{path} owner and group both set to user SYSTEM, but group is not managed directly: SYSTEM user rights will be set to FullControl by group") % { path: path }
+          Puppet.debug { _("%{path} owner and group both set to user SYSTEM, but group is not managed directly: SYSTEM user rights will be set to FullControl by group") % { path: path } }
         else
           #TRANSLATORS 'SYSTEM' is a Windows name and should not be translated
-          Puppet.debug _("An attempt to set mode %{mode} on item %{path} would result in the owner, SYSTEM, to have less than Full Control rights. This attempt has been corrected to Full Control") % { mode: mode.to_s(8), path: path }
+          Puppet.debug { _("An attempt to set mode %{mode} on item %{path} would result in the owner, SYSTEM, to have less than Full Control rights. This attempt has been corrected to Full Control") % { mode: mode.to_s(8), path: path } }
           owner_allow = FILE::FILE_ALL_ACCESS
         end
       end
@@ -355,10 +356,10 @@ module Puppet::Util::Windows::Security
           Puppet.warning _("Setting control rights for %{path} group SYSTEM to less than Full Control rights. Setting SYSTEM rights to less than Full Control may have unintented consequences for operations on this file") % { path: path }
         elsif managing_group && isownergroup
           #TRANSLATORS 'SYSTEM' is a Windows name and should not be translated
-          Puppet.debug _("%{path} owner and group both set to user SYSTEM, but owner is not managed directly: SYSTEM user rights will be set to FullControl by owner") % { path: path }
+          Puppet.debug { _("%{path} owner and group both set to user SYSTEM, but owner is not managed directly: SYSTEM user rights will be set to FullControl by owner") % { path: path } }
         else
           #TRANSLATORS 'SYSTEM' is a Windows name and should not be translated
-          Puppet.debug _("An attempt to set mode %{mode} on item %{path} would result in the group, SYSTEM, to have less than Full Control rights. This attempt has been corrected to Full Control") % { mode: mode.to_s(8), path: path }
+          Puppet.debug { _("An attempt to set mode %{mode} on item %{path} would result in the group, SYSTEM, to have less than Full Control rights. This attempt has been corrected to Full Control") % { mode: mode.to_s(8), path: path } }
           group_allow = FILE::FILE_ALL_ACCESS
         end
       end

data/lib/puppet/util/windows/service.rb

@@ -440,43 +440,60 @@ module Puppet::Util::Windows
     end
     module_function :service_start_type
 
-    # Change the startup mode of a windows service
+    # Query the configuration of a service using QueryServiceConfigW
+    # to find its current logon account
     #
-    # @param [String] service_name the name of the service to modify
-    # @param [Integer] startup_type a code corresponding to a start type for
-    #  windows service, see the "Service start type codes" section in the
-    #  Puppet::Util::Windows::Service file for the list of available codes
-    # @param [Bool] delayed whether the service should be started with a delay
-    def set_startup_mode(service_name, startup_type, delayed=false)
-      startup_code = SERVICE_START_TYPES.key(startup_type)
-      if startup_code.nil?
-        raise Puppet::Error.new(_("Unknown start type %{start_type}") % {startup_type: startup_type.to_s})
+    # @return [String] logon_account account currently set for the service's logon
+    #  in the format "DOMAIN\Account" or ".\Account" if it's a local account
+    def logon_account(service_name)
+      open_service(service_name, SC_MANAGER_CONNECT, SERVICE_QUERY_CONFIG) do |service|
+        query_config(service) do |config|
+          return config[:lpServiceStartName].read_arbitrary_wide_string_up_to(Puppet::Util::Windows::ADSI::User::MAX_USERNAME_LENGTH)
+        end
       end
+    end
+    module_function :logon_account
+
+    # Set the startup configuration of a windows service
+    #
+    # @param [String] service_name the name of the service to modify
+    # @param [Hash] options the configuration to be applied. Expected option keys:
+    #   - [Integer] startup_type a code corresponding to a start type for
+    #       windows service, see the "Service start type codes" section in the
+    #       Puppet::Util::Windows::Service file for the list of available codes
+    #   - [String] logon_account the account to be used by the service for logon
+    #   - [String] logon_password the provided logon_account's password to be used by the service for logon
+    #   - [Bool] delayed whether the service should be started with a delay
+    def set_startup_configuration(service_name, options: {})
+      options[:startup_type] = SERVICE_START_TYPES.key(options[:startup_type]) || SERVICE_NO_CHANGE
+      options[:logon_account] = wide_string(options[:logon_account]) || FFI::Pointer::NULL
+      options[:logon_password] = wide_string(options[:logon_password]) || FFI::Pointer::NULL
+
       open_service(service_name, SC_MANAGER_CONNECT, SERVICE_CHANGE_CONFIG) do |service|
-        # Currently the only thing puppet's API can really manage
-        # in this list is dwStartType (the third param). Thus no
-        # generic function was written to make use of all the params
-        # since the API as-is couldn't use them anyway
         success = ChangeServiceConfigW(
           service,
-          SERVICE_NO_CHANGE,  # dwServiceType
-          startup_code,       # dwStartType
-          SERVICE_NO_CHANGE,  # dwErrorControl
-          FFI::Pointer::NULL, # lpBinaryPathName
-          FFI::Pointer::NULL, # lpLoadOrderGroup
-          FFI::Pointer::NULL, # lpdwTagId
-          FFI::Pointer::NULL, # lpDependencies
-          FFI::Pointer::NULL, # lpServiceStartName
-          FFI::Pointer::NULL, # lpPassword
-          FFI::Pointer::NULL  # lpDisplayName
+          SERVICE_NO_CHANGE,        # dwServiceType
+          options[:startup_type],   # dwStartType
+          SERVICE_NO_CHANGE,        # dwErrorControl
+          FFI::Pointer::NULL,       # lpBinaryPathName
+          FFI::Pointer::NULL,       # lpLoadOrderGroup
+          FFI::Pointer::NULL,       # lpdwTagId
+          FFI::Pointer::NULL,       # lpDependencies
+          options[:logon_account],  # lpServiceStartName
+          options[:logon_password], # lpPassword
+          FFI::Pointer::NULL        # lpDisplayName
         )
         if success == FFI::WIN32_FALSE
           raise Puppet::Util::Windows::Error.new(_("Failed to update service configuration"))
         end
       end
-      set_startup_mode_delayed(service_name, delayed)
+
+      if options[:startup_type]
+        options[:delayed] ||= false
+        set_startup_mode_delayed(service_name, options[:delayed])
+      end
     end
-    module_function :set_startup_mode
+    module_function :set_startup_configuration
 
     # enumerate over all services in all states and return them as a hash
     #