puppet 6.23.0 → 7.0.0

data/lib/puppet/ffi/windows/structs.rb

@@ -0,0 +1,338 @@
+# coding: utf-8
+require 'puppet/ffi/windows'
+
+module Puppet::FFI::Windows
+  module Structs
+
+    extend FFI::Library
+    extend Puppet::FFI::Windows::APITypes
+
+    # https://docs.microsoft.com/en-us/previous-versions/windows/desktop/legacy/aa379560(v=vs.85)
+    # typedef struct _SECURITY_ATTRIBUTES {
+    #   DWORD  nLength;
+    #   LPVOID lpSecurityDescriptor;
+    #   BOOL   bInheritHandle;
+    # } SECURITY_ATTRIBUTES, *PSECURITY_ATTRIBUTES, *LPSECURITY_ATTRIBUTES;
+    class SECURITY_ATTRIBUTES < FFI::Struct
+      layout(
+        :nLength, :dword,
+        :lpSecurityDescriptor, :lpvoid,
+        :bInheritHandle, :win32_bool
+      )
+    end
+
+    private_constant :SECURITY_ATTRIBUTES
+
+    # sizeof(STARTUPINFO) == 68
+    # https://docs.microsoft.com/en-us/windows/win32/api/processthreadsapi/ns-processthreadsapi-startupinfoa
+    # typedef struct _STARTUPINFOA {
+    #   DWORD  cb;
+    #   LPSTR  lpReserved;
+    #   LPSTR  lpDesktop;
+    #   LPSTR  lpTitle;
+    #   DWORD  dwX;
+    #   DWORD  dwY;
+    #   DWORD  dwXSize;
+    #   DWORD  dwYSize;
+    #   DWORD  dwXCountChars;
+    #   DWORD  dwYCountChars;
+    #   DWORD  dwFillAttribute;
+    #   DWORD  dwFlags;
+    #   WORD   wShowWindow;
+    #   WORD   cbReserved2;
+    #   LPBYTE lpReserved2;
+    #   HANDLE hStdInput;
+    #   HANDLE hStdOutput;
+    #   HANDLE hStdError;
+    # } STARTUPINFOA, *LPSTARTUPINFOA;
+    class STARTUPINFO < FFI::Struct
+      layout(
+        :cb, :dword,
+        :lpReserved, :lpcstr,
+        :lpDesktop, :lpcstr,
+        :lpTitle, :lpcstr,
+        :dwX, :dword,
+        :dwY, :dword,
+        :dwXSize, :dword,
+        :dwYSize, :dword,
+        :dwXCountChars, :dword,
+        :dwYCountChars, :dword,
+        :dwFillAttribute, :dword,
+        :dwFlags, :dword,
+        :wShowWindow, :word,
+        :cbReserved2, :word,
+        :lpReserved2, :pointer,
+        :hStdInput, :handle,
+        :hStdOutput, :handle,
+        :hStdError, :handle
+      )
+    end
+
+    private_constant :STARTUPINFO
+
+    # https://docs.microsoft.com/en-us/windows/win32/api/processthreadsapi/ns-processthreadsapi-process_information
+    # typedef struct _PROCESS_INFORMATION {
+    #   HANDLE hProcess;
+    #   HANDLE hThread;
+    #   DWORD  dwProcessId;
+    #   DWORD  dwThreadId;
+    # } PROCESS_INFORMATION, *PPROCESS_INFORMATION, *LPPROCESS_INFORMATION;
+    class PROCESS_INFORMATION < FFI::Struct
+      layout(
+        :hProcess, :handle,
+        :hThread, :handle,
+        :dwProcessId, :dword,
+        :dwThreadId, :dword
+      )
+    end
+
+    private_constant :PROCESS_INFORMATION
+
+    # https://msdn.microsoft.com/en-us/library/windows/desktop/aa379261(v=vs.85).aspx
+    # typedef struct _LUID {
+    #   DWORD LowPart;
+    #   LONG  HighPart;
+    # } LUID, *PLUID;
+    class LUID < FFI::Struct
+      layout :LowPart, :dword,
+             :HighPart, :win32_long
+    end
+
+    # https://msdn.microsoft.com/en-us/library/windows/desktop/aa379263(v=vs.85).aspx
+    # typedef struct _LUID_AND_ATTRIBUTES {
+    #   LUID  Luid;
+    #   DWORD Attributes;
+    # } LUID_AND_ATTRIBUTES, *PLUID_AND_ATTRIBUTES;
+    class LUID_AND_ATTRIBUTES < FFI::Struct
+      layout :Luid, LUID,
+             :Attributes, :dword
+    end
+
+    # https://msdn.microsoft.com/en-us/library/windows/desktop/aa379630(v=vs.85).aspx
+    # typedef struct _TOKEN_PRIVILEGES {
+    #   DWORD               PrivilegeCount;
+    #   LUID_AND_ATTRIBUTES Privileges[ANYSIZE_ARRAY];
+    # } TOKEN_PRIVILEGES, *PTOKEN_PRIVILEGES;
+    class TOKEN_PRIVILEGES < FFI::Struct
+      layout :PrivilegeCount, :dword,
+             :Privileges, [LUID_AND_ATTRIBUTES, 1]    # placeholder for offset
+    end
+
+    # https://msdn.microsoft.com/en-us/library/windows/desktop/bb530717(v=vs.85).aspx
+    # typedef struct _TOKEN_ELEVATION {
+    #   DWORD TokenIsElevated;
+    # } TOKEN_ELEVATION, *PTOKEN_ELEVATION;
+    class TOKEN_ELEVATION < FFI::Struct
+      layout :TokenIsElevated, :dword
+    end
+
+    # https://docs.microsoft.com/en-us/windows/desktop/api/winsvc/ns-winsvc-_service_status_process
+    # typedef struct _SERVICE_STATUS_PROCESS {
+    #   DWORD dwServiceType;
+    #   DWORD dwCurrentState;
+    #   DWORD dwControlsAccepted;
+    #   DWORD dwWin32ExitCode;
+    #   DWORD dwServiceSpecificExitCode;
+    #   DWORD dwCheckPoint;
+    #   DWORD dwWaitHint;
+    #   DWORD dwProcessId;
+    #   DWORD dwServiceFlags;
+    # } SERVICE_STATUS_PROCESS, *LPSERVICE_STATUS_PROCESS;
+    class SERVICE_STATUS_PROCESS < FFI::Struct
+      layout(
+        :dwServiceType, :dword,
+        :dwCurrentState, :dword,
+        :dwControlsAccepted, :dword,
+        :dwWin32ExitCode, :dword,
+        :dwServiceSpecificExitCode, :dword,
+        :dwCheckPoint, :dword,
+        :dwWaitHint, :dword,
+        :dwProcessId, :dword,
+        :dwServiceFlags, :dword
+      )
+    end
+
+    # https://docs.microsoft.com/en-us/windows/win32/api/winsvc/ns-winsvc-service_delayed_auto_start_info
+    # typedef struct _SERVICE_DELAYED_AUTO_START_INFO {
+    #   BOOL fDelayedAutostart;
+    # } SERVICE_DELAYED_AUTO_START_INFO, *LPSERVICE_DELAYED_AUTO_START_INFO;
+    class SERVICE_DELAYED_AUTO_START_INFO < FFI::Struct
+      layout(:fDelayedAutostart, :int)
+      alias aset []=
+      # Intercept the accessor so that we can handle either true/false or 1/0.
+      # Since there is only one member, there’s no need to check the key name.
+      def []=(key, value)
+        [0, false].include?(value) ? aset(key, 0) : aset(key, 1)
+      end
+    end
+
+    # https://docs.microsoft.com/en-us/windows/desktop/api/winsvc/ns-winsvc-_enum_service_status_processw
+    # typedef struct _ENUM_SERVICE_STATUS_PROCESSW {
+    #   LPWSTR                 lpServiceName;
+    #   LPWSTR                 lpDisplayName;
+    #   SERVICE_STATUS_PROCESS ServiceStatusProcess;
+    # } ENUM_SERVICE_STATUS_PROCESSW, *LPENUM_SERVICE_STATUS_PROCESSW;
+    class ENUM_SERVICE_STATUS_PROCESSW < FFI::Struct
+      layout(
+        :lpServiceName, :pointer,
+        :lpDisplayName, :pointer,
+        :ServiceStatusProcess, SERVICE_STATUS_PROCESS
+      )
+    end
+
+    # typedef struct _SERVICE_STATUS {
+    #   DWORD dwServiceType;
+    #   DWORD dwCurrentState;
+    #   DWORD dwControlsAccepted;
+    #   DWORD dwWin32ExitCode;
+    #   DWORD dwServiceSpecificExitCode;
+    #   DWORD dwCheckPoint;
+    #   DWORD dwWaitHint;
+    # } SERVICE_STATUS, *LPSERVICE_STATUS;
+    class SERVICE_STATUS < FFI::Struct
+      layout(
+        :dwServiceType, :dword,
+        :dwCurrentState, :dword,
+        :dwControlsAccepted, :dword,
+        :dwWin32ExitCode, :dword,
+        :dwServiceSpecificExitCode, :dword,
+        :dwCheckPoint, :dword,
+        :dwWaitHint, :dword,
+      )
+    end
+
+    # typedef struct _QUERY_SERVICE_CONFIGW {
+    #   DWORD  dwServiceType;
+    #   DWORD  dwStartType;
+    #   DWORD  dwErrorControl;
+    #   LPWSTR lpBinaryPathName;
+    #   LPWSTR lpLoadOrderGroup;
+    #   DWORD  dwTagId;
+    #   LPWSTR lpDependencies;
+    #   LPWSTR lpServiceStartName;
+    #   LPWSTR lpDisplayName;
+    # } QUERY_SERVICE_CONFIGW, *LPQUERY_SERVICE_CONFIGW;
+    class QUERY_SERVICE_CONFIGW < FFI::Struct
+      layout(
+        :dwServiceType, :dword,
+        :dwStartType, :dword,
+        :dwErrorControl, :dword,
+        :lpBinaryPathName, :pointer,
+        :lpLoadOrderGroup, :pointer,
+        :dwTagId, :dword,
+        :lpDependencies, :pointer,
+        :lpServiceStartName, :pointer,
+        :lpDisplayName, :pointer,
+      )
+    end
+
+    # typedef struct _SERVICE_TABLE_ENTRYW {
+    #   LPWSTR                   lpServiceName;
+    #   LPSERVICE_MAIN_FUNCTIONW lpServiceProc;
+    # } SERVICE_TABLE_ENTRYW, *LPSERVICE_TABLE_ENTRYW;
+    class SERVICE_TABLE_ENTRYW < FFI::Struct
+      layout(
+        :lpServiceName, :pointer,
+        :lpServiceProc, :pointer
+      )
+    end
+
+    # https://msdn.microsoft.com/en-us/library/windows/desktop/ms724834%28v=vs.85%29.aspx
+    # typedef struct _OSVERSIONINFO {
+    #   DWORD dwOSVersionInfoSize;
+    #   DWORD dwMajorVersion;
+    #   DWORD dwMinorVersion;
+    #   DWORD dwBuildNumber;
+    #   DWORD dwPlatformId;
+    #   TCHAR szCSDVersion[128];
+    # } OSVERSIONINFO;
+    class OSVERSIONINFO < FFI::Struct
+      layout(
+        :dwOSVersionInfoSize, :dword,
+        :dwMajorVersion, :dword,
+        :dwMinorVersion, :dword,
+        :dwBuildNumber, :dword,
+        :dwPlatformId, :dword,
+        :szCSDVersion, [:wchar, 128]
+      )
+    end
+
+	MAXIMUM_REPARSE_DATA_BUFFER_SIZE = 16384
+
+    # SYMLINK_REPARSE_DATA_BUFFER
+    # https://msdn.microsoft.com/en-us/library/cc232006.aspx
+    # https://msdn.microsoft.com/en-us/library/windows/hardware/ff552012(v=vs.85).aspx
+    # struct is always MAXIMUM_REPARSE_DATA_BUFFER_SIZE bytes
+    class SYMLINK_REPARSE_DATA_BUFFER < FFI::Struct
+      layout :ReparseTag, :win32_ulong,
+             :ReparseDataLength, :ushort,
+             :Reserved, :ushort,
+             :SubstituteNameOffset, :ushort,
+             :SubstituteNameLength, :ushort,
+             :PrintNameOffset, :ushort,
+             :PrintNameLength, :ushort,
+             :Flags, :win32_ulong,
+             # max less above fields dword / uint 4 bytes, ushort 2 bytes
+             # technically a WCHAR buffer, but we care about size in bytes here
+             :PathBuffer, [:byte, MAXIMUM_REPARSE_DATA_BUFFER_SIZE - 20]
+    end
+
+    # MOUNT_POINT_REPARSE_DATA_BUFFER
+    # https://msdn.microsoft.com/en-us/library/cc232007.aspx
+    # https://msdn.microsoft.com/en-us/library/windows/hardware/ff552012(v=vs.85).aspx
+    # struct is always MAXIMUM_REPARSE_DATA_BUFFER_SIZE bytes
+    class MOUNT_POINT_REPARSE_DATA_BUFFER < FFI::Struct
+      layout :ReparseTag, :win32_ulong,
+             :ReparseDataLength, :ushort,
+             :Reserved, :ushort,
+             :SubstituteNameOffset, :ushort,
+             :SubstituteNameLength, :ushort,
+             :PrintNameOffset, :ushort,
+             :PrintNameLength, :ushort,
+             # max less above fields dword / uint 4 bytes, ushort 2 bytes
+             # technically a WCHAR buffer, but we care about size in bytes here
+             :PathBuffer, [:byte, MAXIMUM_REPARSE_DATA_BUFFER_SIZE - 16]
+    end
+
+    # SHFILEINFO
+    # https://docs.microsoft.com/en-us/windows/win32/api/shellapi/ns-shellapi-shfileinfow
+    # typedef struct _SHFILEINFOW {
+    #   HICON hIcon;
+    #   int   iIcon;
+    #   DWORD dwAttributes;
+    #   WCHAR szDisplayName[MAX_PATH];
+    #   WCHAR szTypeName[80];
+    # } SHFILEINFOW;
+    class SHFILEINFO < FFI::Struct
+      layout(
+        :hIcon, :ulong,
+        :iIcon, :int,
+        :dwAttributes, :ulong,
+        :szDisplayName, [:char, 256],
+        :szTypeName, [:char, 80]
+      )
+    end
+
+    # REPARSE_JDATA_BUFFER
+    class REPARSE_JDATA_BUFFER < FFI::Struct
+      layout(
+        :ReparseTag, :ulong,
+        :ReparseDataLength, :ushort,
+        :Reserved, :ushort,
+        :SubstituteNameOffset, :ushort,
+        :SubstituteNameLength, :ushort,
+        :PrintNameOffset, :ushort,
+        :PrintNameLength, :ushort,
+        :PathBuffer, [:char, 1024]
+      )
+
+      # The REPARSE_DATA_BUFFER_HEADER_SIZE which is calculated as:
+      #
+      # sizeof(ReparseTag) + sizeof(ReparseDataLength) + sizeof(Reserved)
+      #
+      def header_size
+        FFI::Type::ULONG.size + FFI::Type::USHORT.size + FFI::Type::USHORT.size
+      end
+    end
+  end
+end

data/lib/puppet/file_serving/configuration.rb

@@ -80,15 +80,10 @@ class Puppet::FileServing::Configuration
 
   def mk_default_mounts
     @mounts["modules"] ||= Mount::Modules.new("modules")
-    @mounts["modules"].allow('*') if @mounts["modules"].empty?
     @mounts["plugins"] ||= Mount::Plugins.new("plugins")
-    @mounts["plugins"].allow('*') if @mounts["plugins"].empty?
     @mounts["locales"] ||= Mount::Locales.new("locales")
-    @mounts["locales"].allow('*') if @mounts["locales"].empty?
     @mounts["pluginfacts"] ||= Mount::PluginFacts.new("pluginfacts")
-    @mounts["pluginfacts"].allow('*') if @mounts["pluginfacts"].empty?
     @mounts["tasks"] ||= Mount::Tasks.new("tasks")
-    @mounts["tasks"].allow('*') if @mounts["tasks"].empty?
   end
 
   # Read the configuration file.

data/lib/puppet/file_serving/configuration/parser.rb

@@ -32,10 +32,9 @@ class Puppet::FileServing::Configuration::Parser
           case var
           when "path"
             path(mount, value)
-          when "allow"
-            allow(mount, value)
-          when "deny"
-            deny(mount, value)
+          when "allow", "deny"
+            error_location_str = Puppet::Util::Errors.error_location(@file.filename, @count)
+            Puppet.err("Entry '#{line.chomp}' is unsupported and will be ignored at #{error_location_str}")
           else
             error_location_str = Puppet::Util::Errors.error_location(@file.filename, @count)
             raise ArgumentError.new(_("Invalid argument '%{var}' at %{error_location}") %
@@ -64,34 +63,6 @@ class Puppet::FileServing::Configuration::Parser
 
   private
 
-  # Allow a given pattern access to a mount.
-  def allow(mount, value)
-    value.split(/\s*,\s*/).each { |val|
-      begin
-        mount.info _("allowing %{val} access") % { val: val }
-        mount.allow(val)
-      rescue Puppet::AuthStoreError => detail
-        error_location_str = Puppet::Util::Errors.error_location(@file, @count)
-        raise ArgumentError.new("%{detail} %{error_location}" %
-                                    { detail: detail.to_s, error_location: error_location_str })
-      end
-    }
-  end
-
-  # Deny a given pattern access to a mount.
-  def deny(mount, value)
-    value.split(/\s*,\s*/).each { |val|
-      begin
-        mount.info _("denying %{val} access") % { val: val }
-        mount.deny(val)
-      rescue Puppet::AuthStoreError => detail
-        error_location_str = Puppet::Util::Errors.error_location(@file, @count)
-        raise ArgumentError.new("%{detail} %{error_location}" %
-                                    { detail: detail.to_s, error_location: error_location_str  })
-      end
-    }
-  end
-
   # Create a new mount.
   def newmount(name)
     if @mounts.include?(name)

data/lib/puppet/file_serving/fileset.rb

@@ -5,7 +5,7 @@ require 'puppet/file_serving/metadata'
 # Operate recursively on a path, returning a set of file paths.
 class Puppet::FileServing::Fileset
   attr_reader :path, :ignore, :links
-  attr_accessor :recurse, :recurselimit, :max_files, :checksum_type
+  attr_accessor :recurse, :recurselimit, :checksum_type
 
   # Produce a hash of files, with merged so that earlier files
   # with the same postfix win.  E.g., /dir1/subfile beats /dir2/subfile.
@@ -40,7 +40,6 @@ class Puppet::FileServing::Fileset
     self.links = :manage
     @recurse = false
     @recurselimit = :infinite
-    @max_files = 0
 
     if options.is_a?(Puppet::Indirector::Request)
       initialize_from_request(options)
@@ -59,17 +58,6 @@ class Puppet::FileServing::Fileset
   # level deep, which Find doesn't do.
   def files
     files = perform_recursion
-    soft_max_files = 1000
-
-    # munged_max_files is needed since puppet http handler is keeping negative numbers as strings
-    # https://github.com/puppetlabs/puppet/blob/main/lib/puppet/network/http/handler.rb#L196-L197
-    munged_max_files = max_files == '-1' ? -1 : max_files
-
-    if munged_max_files > 0 && files.size > munged_max_files
-      raise Puppet::Error.new _("The directory '%{path}' contains %{entries} entries, which exceeds the limit of %{munged_max_files} specified by the max_files parameter for this resource. The limit may be increased, but be aware that large number of file resources can result in excessive resource consumption and degraded performance. Consider using an alternate method to manage large directory trees") % { path: path, entries: files.size, munged_max_files: munged_max_files }
-    elsif munged_max_files == 0 && files.size > soft_max_files
-      Puppet.warning _("The directory '%{path}' contains %{entries} entries, which exceeds the default soft limit %{soft_max_files} and may cause excessive resource consumption and degraded performance. To remove this warning set a value for `max_files` parameter or consider using an alternate method to manage large directory trees") % { path: path, entries: files.size, soft_max_files: soft_max_files }
-    end
 
     # Now strip off the leading path, so each file becomes relative, and remove
     # any slashes that might end up at the beginning of the path.
@@ -108,7 +96,7 @@ class Puppet::FileServing::Fileset
   end
 
   def initialize_from_request(request)
-    [:links, :ignore, :recurse, :recurselimit, :max_files, :checksum_type].each do |param|
+    [:links, :ignore, :recurse, :recurselimit, :checksum_type].each do |param|
       if request.options.include?(param) # use 'include?' so the values can be false
         value = request.options[param]
       elsif request.options.include?(param.to_s)

data/lib/puppet/file_serving/http_metadata.rb

@@ -51,7 +51,7 @@ class Puppet::FileServing::HttpMetadata < Puppet::FileServing::Metadata
   def collect
     # Prefer the checksum_type from the indirector request options
     # but fall back to the alternative otherwise
-    [ @checksum_type, :md5, :sha256, :sha1, :mtime ].each do |type|
+    [ @checksum_type, :sha256, :sha1, :md5, :mtime ].each do |type|
       @checksum_type = type
       @checksum = @checksums[type]
       break if @checksum