puppet 6.19.1 → 7.0.0

data/lib/puppet/environments.rb

@@ -459,11 +459,7 @@ module Puppet::Environments
       when Float::INFINITY
         Entry.new(env)              # Entry that never expires (avoids syscall to get time)
       else
-        if Puppet[:environment_timeout_mode] == :from_last_used
-          MRUEntry.new(env, ttl)    # Entry that expires in ttl from when it was last touched
-        else
-          TTLEntry.new(env, ttl)    # Entry that expires in ttl from when it was created
-        end
+        MRUEntry.new(env, ttl)      # Entry that expires in ttl from when it was last touched
       end
     end
 
@@ -517,41 +513,30 @@ module Puppet::Environments
       end
     end
 
-    # Policy that expires in ttl_seconds from when it was created
-    class TTLEntry < Entry
+    # Policy that expires if it hasn't been touched within ttl_seconds
+    class MRUEntry < Entry
       def initialize(value, ttl_seconds)
         super(value)
         @ttl = Time.now + ttl_seconds
         @ttl_seconds = ttl_seconds
+
+        touch
       end
 
-      def expired?
-        Time.now > @ttl
+      def touch
+        @ttl = Time.now + @ttl_seconds
       end
 
-      def label
-        "(ttl = #{@ttl_seconds} sec)"
+      def expired?
+        Time.now > @ttl
       end
 
       def expires
         @ttl
       end
-    end
-
-    # Policy that expires if it hasn't been touched within ttl_seconds
-    class MRUEntry < TTLEntry
-      def initialize(value, ttl_seconds)
-        super(value, ttl_seconds)
-
-        touch
-      end
-
-      def touch
-        @ttl = Time.now + @ttl_seconds
-      end
 
       def label
-        "(mru = #{@ttl_seconds} sec)"
+        "(ttl = #{@ttl_seconds} sec)"
       end
     end
   end

data/lib/puppet/face/config.rb

@@ -159,6 +159,16 @@ https://puppet.com/docs/puppet/latest/configuration.html#environment
         report_section_and_environment(options[:section], Puppet.settings[:environment])
       end
 
+      # only validate settings we recognize
+      setting = Puppet.settings.setting(name.to_sym)
+      if setting
+        # set the value, which will call `on_*_and_write` hooks, if any
+        Puppet.settings[setting.name] = value
+
+        # read the value to trigger interpolation and munge validation logic
+        Puppet.settings[setting.name]
+      end
+
       path = Puppet::FileSystem.pathname(Puppet.settings.which_configuration_file)
       Puppet::FileSystem.touch(path)
       Puppet::FileSystem.open(path, nil, 'r+:UTF-8') do |file|

data/lib/puppet/face/epp.rb

@@ -440,7 +440,12 @@ Puppet::Face.define(:epp, '0.0.1') do
 
   def render_inline(epp_source, compiler, options)
     template_args = get_values(compiler, options)
-    Puppet::Pops::Evaluator::EppEvaluator.inline_epp(compiler.topscope, epp_source, template_args)
+    result = Puppet::Pops::Evaluator::EppEvaluator.inline_epp(compiler.topscope, epp_source, template_args)
+    if result.instance_of?(Puppet::Pops::Types::PSensitiveType::Sensitive)
+      result.unwrap
+    else
+      result
+    end
   end
 
   def render_file(epp_template_name, compiler, options, show_filename, file_nbr)
@@ -457,7 +462,12 @@ Puppet::Face.define(:epp, '0.0.1') do
       if template_file.nil? && Puppet::FileSystem.exist?(epp_template_name)
         epp_template_name = File.expand_path(epp_template_name)
       end
-      output << Puppet::Pops::Evaluator::EppEvaluator.epp(compiler.topscope, epp_template_name, compiler.environment, template_args)
+      result = Puppet::Pops::Evaluator::EppEvaluator.epp(compiler.topscope, epp_template_name, compiler.environment, template_args)
+      if result.instance_of?(Puppet::Pops::Types::PSensitiveType::Sensitive)
+        output << result.unwrap
+      else
+        output << result
+      end
     rescue Puppet::ParseError => detail
       Puppet.err("--- #{epp_template_name}") if show_filename
       raise detail

data/lib/puppet/face/facts.rb

@@ -31,7 +31,6 @@ Puppet::Indirector::Face.define(:facts, '0.0.1') do
 
     $ puppet facts find
   EOT
-  find.default = true
 
   deactivate_action(:destroy)
   deactivate_action(:search)
@@ -44,16 +43,12 @@ Puppet::Indirector::Face.define(:facts, '0.0.1') do
     EOT
     returns "Nothing."
     notes <<-'EOT'
-      This action requires that the puppet master's `auth.conf` file
+      This action requires that the Puppet Server's `auth.conf` file
       allow `PUT` or `save` access to the `/puppet/v3/facts` API endpoint.
 
       For details on configuring Puppet Server's `auth.conf`, see:
 
       <https://puppet.com/docs/puppetserver/latest/config_file_auth.html>
-
-      For legacy Rack-based Puppet Masters, see:
-
-      <https://puppet.com/docs/puppet/latest/config_file_auth.html>
     EOT
     examples <<-'EOT'
       Upload facts:
@@ -87,4 +82,69 @@ Puppet::Indirector::Face.define(:facts, '0.0.1') do
       nil
     end
   end
+
+  action(:show) do
+    summary _("Retrieve current node's facts.")
+    arguments _("[<facts>]")
+    description <<-'EOT'
+    Reads facts from the local system using `facter` terminus.
+    A query can be provided to retrieve just a specific fact or a set of facts.
+    EOT
+    returns "The output of facter with added puppet specific facts."
+    notes <<-'EOT'
+
+    EOT
+    examples <<-'EOT'
+    retrieve facts:
+
+    $ puppet facts show os
+    EOT
+    default true
+
+    option("--config-file " + _("<path>")) do
+      default_to { nil }
+      summary _("The location of the config file for Facter.")
+    end
+
+    option("--custom-dir " + _("<path>")) do
+      default_to { nil }
+      summary _("The path to a directory that contains custom facts.")
+    end
+
+    option("--external-dir " + _("<path>")) do
+      default_to { nil }
+      summary _("The path to a directory that contains external facts.")
+    end
+
+    option("--no-block") do
+      summary _("Disable fact blocking mechanism.")
+    end
+
+    option("--no-cache") do
+      summary _("Disable fact caching mechanism.")
+    end
+
+    option("--show-legacy") do
+      summary _("Show legacy facts when querying all facts.")
+    end
+
+    when_invoked do |*args|
+      options = args.pop
+
+      Puppet.settings.preferred_run_mode = :agent
+      Puppet::Node::Facts.indirection.terminus_class = :facter
+
+
+      options[:user_query] = args
+      options[:resolve_options] = true
+      result = Puppet::Node::Facts.indirection.find(Puppet.settings[:certname], options)
+
+      result.values
+    end
+
+    when_rendering :console do |result|
+      Puppet::Util::Json.dump(result, :pretty => true)
+    end
+  end
 end
+

data/lib/puppet/face/help.rb

@@ -222,7 +222,7 @@ Puppet::Face.define(:help, '0.0.1') do
   #private :horribly_extract_summary_from
 
   def exclude_from_docs?(appname)
-    %w{face_base indirection_base cert key man report status}.include? appname
+    %w{face_base indirection_base report status}.include? appname
   end
   # This should absolutely be a private method, but for some reason it appears
   #  that you can't use the 'private' keyword inside of a Face definition.

data/lib/puppet/face/plugin.rb

@@ -41,14 +41,11 @@ Puppet::Face.define(:plugin, '0.0.1') do
     when_invoked do |options|
       remote_environment_for_plugins = Puppet::Node::Environment.remote(Puppet[:environment])
 
-      pool = Puppet.runtime[:http].pool
-      Puppet.override(:http_pool => pool) do
-        begin
-          handler = Puppet::Configurer::PluginHandler.new
-          handler.download_plugins(remote_environment_for_plugins)
-        ensure
-          pool.close
-        end
+      begin
+        handler = Puppet::Configurer::PluginHandler.new
+        handler.download_plugins(remote_environment_for_plugins)
+      ensure
+        Puppet.runtime[:http].close
       end
     end
 

data/lib/puppet/ffi/windows.rb

@@ -0,0 +1,12 @@
+require 'ffi'
+
+module Puppet
+  module FFI
+    module Windows
+      require 'puppet/ffi/windows/api_types'
+      require 'puppet/ffi/windows/constants'
+      require 'puppet/ffi/windows/structs'
+      require 'puppet/ffi/windows/functions'
+    end
+  end
+end

data/lib/puppet/ffi/windows/api_types.rb

@@ -0,0 +1,311 @@
+require 'puppet/ffi/windows'
+require 'puppet/util/windows/string'
+
+module Puppet::FFI::Windows
+  module APITypes
+    module ::FFI
+      WIN32_FALSE = 0
+
+      # standard Win32 error codes
+      ERROR_SUCCESS = 0
+    end
+
+    module ::FFI::Library
+      # Wrapper method for attach_function + private
+      def attach_function_private(*args)
+        attach_function(*args)
+        private args[0]
+      end
+    end
+
+    class ::FFI::Pointer
+      NULL_HANDLE = 0
+      WCHAR_NULL = "\0\0".encode('UTF-16LE').freeze
+
+      def self.from_string_to_wide_string(str, &block)
+        str = Puppet::Util::Windows::String.wide_string(str)
+        FFI::MemoryPointer.from_wide_string(str, &block)
+
+        # ptr has already had free called, so nothing to return
+        nil
+      end
+
+      def read_win32_bool
+        # BOOL is always a 32-bit integer in Win32
+        # some Win32 APIs return 1 for true, while others are non-0
+        read_int32 != FFI::WIN32_FALSE
+      end
+
+      alias_method :read_dword, :read_uint32
+      alias_method :read_win32_ulong, :read_uint32
+      alias_method :read_qword, :read_uint64
+
+      alias_method :read_hresult, :read_int32
+
+      def read_handle
+        type_size == 4 ? read_uint32 : read_uint64
+      end
+
+      alias_method :read_wchar, :read_uint16
+      alias_method :read_word,  :read_uint16
+      alias_method :read_array_of_wchar, :read_array_of_uint16
+
+      def read_wide_string(char_length, dst_encoding = Encoding::UTF_8, strip = false, encode_options = {})
+        # char_length is number of wide chars (typically excluding NULLs), *not* bytes
+        str = get_bytes(0, char_length * 2).force_encoding('UTF-16LE')
+
+        if strip
+          i = str.index(WCHAR_NULL)
+          str = str[0, i] if i
+        end
+
+        str.encode(dst_encoding, str.encoding, **encode_options)
+      rescue EncodingError => e
+        Puppet.debug { "Unable to convert value #{str.nil? ? 'nil' : str.dump} to encoding #{dst_encoding} due to #{e.inspect}" }
+        raise
+      end
+
+      # @param max_char_length [Integer] Maximum number of wide chars to return (typically excluding NULLs), *not* bytes
+      # @param null_terminator [Symbol] Number of number of null wchar characters, *not* bytes, that determine the end of the string
+      #   null_terminator = :single_null, then the terminating sequence is two bytes of zero.   This is UNIT16 = 0
+      #   null_terminator = :double_null, then the terminating sequence is four bytes of zero.  This is UNIT32 = 0
+      # @param encode_options [Hash] Accepts the same option hash that may be passed to String#encode in Ruby
+      def read_arbitrary_wide_string_up_to(max_char_length = 512, null_terminator = :single_null, encode_options = {})
+        idx = case null_terminator
+              when :single_null
+                # find index of wide null between 0 and max (exclusive)
+                (0...max_char_length).find do |i|
+                  get_uint16(i * 2) == 0
+                end
+              when :double_null
+                # find index of double-wide null between 0 and max - 1 (exclusive)
+                (0...max_char_length - 1).find do |i|
+                  get_uint32(i * 2) == 0
+                end
+              else
+                raise _("Unable to read wide strings with %{null_terminator} terminal nulls") % { null_terminator: null_terminator }
+              end
+
+        read_wide_string(idx || max_char_length, Encoding::UTF_8, false, encode_options)
+      end
+
+      def read_win32_local_pointer(&block)
+        ptr = read_pointer
+        begin
+          yield ptr
+        ensure
+          if !ptr.null? && FFI::WIN32::LocalFree(ptr.address) != FFI::Pointer::NULL_HANDLE
+            Puppet.debug "LocalFree memory leak"
+          end
+        end
+
+        # ptr has already had LocalFree called, so nothing to return
+        nil
+      end
+
+      def read_com_memory_pointer(&block)
+        ptr = read_pointer
+        begin
+          yield ptr
+        ensure
+          FFI::WIN32::CoTaskMemFree(ptr) unless ptr.null?
+        end
+
+        # ptr has already had CoTaskMemFree called, so nothing to return
+        nil
+      end
+
+      alias_method :write_dword, :write_uint32
+      alias_method :write_word, :write_uint16
+    end
+
+    class FFI::MemoryPointer
+      # Return a MemoryPointer that points to wide string. This is analogous to the
+      # FFI::MemoryPointer.from_string method.
+      def self.from_wide_string(wstr)
+        ptr = FFI::MemoryPointer.new(:uchar, wstr.bytesize + 2)
+        ptr.put_array_of_uchar(0, wstr.bytes.to_a)
+        ptr.put_uint16(wstr.bytesize, 0)
+
+        yield ptr if block_given?
+
+        ptr
+      end
+    end
+
+    # FFI Types
+    # https://github.com/ffi/ffi/wiki/Types
+
+    # Windows - Common Data Types
+    # https://msdn.microsoft.com/en-us/library/cc230309.aspx
+
+    # Windows Data Types
+    # https://msdn.microsoft.com/en-us/library/windows/desktop/aa383751(v=vs.85).aspx
+
+    FFI.typedef :uint16, :word
+    FFI.typedef :uint32, :dword
+    # uintptr_t is defined in an FFI conf as platform specific, either
+    # ulong_long on x64 or just ulong on x86
+    FFI.typedef :uintptr_t, :handle
+    FFI.typedef :uintptr_t, :hwnd
+
+    # buffer_inout is similar to pointer (platform specific), but optimized for buffers
+    FFI.typedef :buffer_inout, :lpwstr
+    # buffer_in is similar to pointer (platform specific), but optimized for CONST read only buffers
+    FFI.typedef :buffer_in, :lpcwstr
+    FFI.typedef :buffer_in, :lpcolestr
+
+    # string is also similar to pointer, but should be used for const char *
+    # NOTE that this is not wide, useful only for A suffixed functions
+    FFI.typedef :string, :lpcstr
+
+    # pointer in FFI is platform specific
+    # NOTE: for API calls with reserved lpvoid parameters, pass a FFI::Pointer::NULL
+    FFI.typedef :pointer, :lpcvoid
+    FFI.typedef :pointer, :lpvoid
+    FFI.typedef :pointer, :lpword
+    FFI.typedef :pointer, :lpbyte
+    FFI.typedef :pointer, :lpdword
+    FFI.typedef :pointer, :pdword
+    FFI.typedef :pointer, :phandle
+    FFI.typedef :pointer, :ulong_ptr
+    FFI.typedef :pointer, :pbool
+    FFI.typedef :pointer, :lpunknown
+
+    # any time LONG / ULONG is in a win32 API definition DO NOT USE platform specific width
+    # which is what FFI uses by default
+    # instead create new aliases for these very special cases
+    # NOTE: not a good idea to redefine FFI :ulong since other typedefs may rely on it
+    FFI.typedef :uint32, :win32_ulong
+    FFI.typedef :int32, :win32_long
+    # FFI bool can be only 1 byte at times,
+    # Win32 BOOL is a signed int, and is always 4 bytes, even on x64
+    # https://blogs.msdn.com/b/oldnewthing/archive/2011/03/28/10146459.aspx
+    FFI.typedef :int32, :win32_bool
+
+    # BOOLEAN (unlike BOOL) is a BYTE - typedef unsigned char BYTE;
+    FFI.typedef :uchar, :boolean
+
+    # Same as a LONG, a 32-bit signed integer
+    FFI.typedef :int32, :hresult
+
+    # NOTE: FFI already defines (u)short as a 16-bit (un)signed like this:
+    # FFI.typedef :uint16, :ushort
+    # FFI.typedef :int16, :short
+
+    # 8 bits per byte
+    FFI.typedef :uchar, :byte
+    FFI.typedef :uint16, :wchar
+
+    # Definitions for data types used in LSA structures and functions
+    # https://docs.microsoft.com/en-us/windows/win32/api/ntsecapi/
+    # https://docs.microsoft.com/sr-latn-rs/windows/win32/secmgmt/management-data-types
+    FFI.typedef :pointer, :pwstr
+    FFI.typedef :pointer, :pulong
+    FFI.typedef :pointer, :lsa_handle
+    FFI.typedef :pointer, :plsa_handle
+    FFI.typedef :pointer, :psid
+    FFI.typedef :pointer, :pvoid
+    FFI.typedef :pointer, :plsa_unicode_string
+    FFI.typedef :pointer, :plsa_object_attributes
+    FFI.typedef :uint32,  :ntstatus
+    FFI.typedef :dword,   :access_mask
+
+    module ::FFI::WIN32
+      extend ::FFI::Library
+
+      # https://msdn.microsoft.com/en-us/library/windows/desktop/aa373931(v=vs.85).aspx
+      # typedef struct _GUID {
+      #   DWORD Data1;
+      #   WORD  Data2;
+      #   WORD  Data3;
+      #   BYTE  Data4[8];
+      # } GUID;
+      class GUID < FFI::Struct
+        layout :Data1, :dword,
+               :Data2, :word,
+               :Data3, :word,
+               :Data4, [:byte, 8]
+
+        def self.[](s)
+          raise _('Bad GUID format.') unless s =~ /^[0-9a-f]{8}-([0-9a-f]{4}-){3}[0-9a-f]{12}$/i
+
+          new.tap do |guid|
+            guid[:Data1] = s[0, 8].to_i(16)
+            guid[:Data2] = s[9, 4].to_i(16)
+            guid[:Data3] = s[14, 4].to_i(16)
+            guid[:Data4][0] = s[19, 2].to_i(16)
+            guid[:Data4][1] = s[21, 2].to_i(16)
+            s[24, 12].split('').each_slice(2).with_index do |a, i|
+              guid[:Data4][i + 2] = a.join('').to_i(16)
+            end
+          end
+        end
+
+        def ==(other) Windows.memcmp(other, self, size) == 0 end
+      end
+
+      # https://msdn.microsoft.com/en-us/library/windows/desktop/ms724950(v=vs.85).aspx
+      # typedef struct _SYSTEMTIME {
+      #   WORD wYear;
+      #   WORD wMonth;
+      #   WORD wDayOfWeek;
+      #   WORD wDay;
+      #   WORD wHour;
+      #   WORD wMinute;
+      #   WORD wSecond;
+      #   WORD wMilliseconds;
+      # } SYSTEMTIME, *PSYSTEMTIME;
+      class SYSTEMTIME < FFI::Struct
+        layout :wYear, :word,
+               :wMonth, :word,
+               :wDayOfWeek, :word,
+               :wDay, :word,
+               :wHour, :word,
+               :wMinute, :word,
+               :wSecond, :word,
+               :wMilliseconds, :word
+
+        def to_local_time
+          Time.local(self[:wYear], self[:wMonth], self[:wDay],
+                     self[:wHour], self[:wMinute], self[:wSecond], self[:wMilliseconds] * 1000)
+        end
+      end
+
+      # https://msdn.microsoft.com/en-us/library/windows/desktop/ms724284(v=vs.85).aspx
+      # Contains a 64-bit value representing the number of 100-nanosecond
+      # intervals since January 1, 1601 (UTC).
+      # typedef struct _FILETIME {
+      #   DWORD dwLowDateTime;
+      #   DWORD dwHighDateTime;
+      # } FILETIME, *PFILETIME;
+      class FILETIME < FFI::Struct
+        layout :dwLowDateTime, :dword,
+               :dwHighDateTime, :dword
+      end
+
+      ffi_convention :stdcall
+
+      # https://msdn.microsoft.com/en-us/library/windows/desktop/aa366730(v=vs.85).aspx
+      # HLOCAL WINAPI LocalFree(
+      #   _In_  HLOCAL hMem
+      # );
+      ffi_lib :kernel32
+      attach_function :LocalFree, [:handle], :handle
+
+      # https://msdn.microsoft.com/en-us/library/windows/desktop/ms724211(v=vs.85).aspx
+      # BOOL WINAPI CloseHandle(
+      #   _In_  HANDLE hObject
+      # );
+      ffi_lib :kernel32
+      attach_function_private :CloseHandle, [:handle], :win32_bool
+
+      # https://msdn.microsoft.com/en-us/library/windows/desktop/ms680722(v=vs.85).aspx
+      # void CoTaskMemFree(
+      #   _In_opt_  LPVOID pv
+      # );
+      ffi_lib :ole32
+      attach_function :CoTaskMemFree, [:lpvoid], :void
+    end
+  end
+end