puppet 6.4.5-universal-darwin → 6.5.0-universal-darwin

data/lib/puppet/util/windows/process.rb

@@ -122,21 +122,21 @@ module Puppet::Util::Windows::Process
   def get_process_image_name_by_pid(pid)
     image_name = ""
 
-     open_process(PROCESS_QUERY_INFORMATION, false, pid) do |phandle|
+    open_process(PROCESS_QUERY_INFORMATION, false, pid) do |phandle|
 
-       FFI::MemoryPointer.new(:dword, 1) do |exe_name_length_ptr|
-        # UTF is 2 bytes/char:
-        max_chars = MAX_PATH_LENGTH + 1
-        exe_name_length_ptr.write_dword(max_chars)
-        FFI::MemoryPointer.new(:wchar, max_chars) do |exe_name_ptr|
+      FFI::MemoryPointer.new(:dword, 1) do |exe_name_length_ptr|
+        # Add 1 for the null terminator, and UTF is 2 bytes/char:
+        max_path_length = (MAX_PATH_LENGTH + 1) * 2
+        exe_name_length_ptr.write_dword(max_path_length)
+        FFI::MemoryPointer.new(max_path_length) do |exe_name_ptr|
           use_win32_path_format = 0
           result = QueryFullProcessImageNameW(phandle, use_win32_path_format, exe_name_ptr, exe_name_length_ptr)
           if result == FFI::WIN32_FALSE
             raise Puppet::Util::Windows::Error.new(
               "QueryFullProcessImageNameW(phandle, #{use_win32_path_format}, " +
-              "exe_name_ptr, #{max_chars}")
+              "exe_name_ptr, #{max_path_length}")
           end
-          image_name = exe_name_ptr.read_wide_string(exe_name_length_ptr.read_dword)
+          image_name = exe_name_ptr.read_wide_string(MAX_PATH_LENGTH + 1)
         end
       end
     end

data/lib/puppet/util/windows/registry.rb

@@ -46,12 +46,11 @@ module Puppet::Util::Windows
 
       subkey_max_len, _ = reg_query_info_key_max_lengths(key)
 
-      loop do
+      begin
         subkey, filetime = reg_enum_key(key, index, subkey_max_len)
         yield subkey, filetime if !subkey.nil?
         index += 1
-        break if subkey.nil?
-      end
+      end while !subkey.nil?
 
       index
     end
@@ -94,12 +93,11 @@ module Puppet::Util::Windows
 
       _, value_max_len = reg_query_info_key_max_lengths(key)
 
-      loop do
+      begin
         subkey, type, data = reg_enum_value(key, index, value_max_len)
         yield subkey, type, data if !subkey.nil?
         index += 1
-        break if subkey.nil?
-      end
+      end while !subkey.nil?
 
       index
     end
@@ -316,7 +314,7 @@ module Puppet::Util::Windows
 
     def sanitize(value)
       # Replace null bytes with a space
-      value.tr!("\x00", ' ')
+      value.gsub!("\x00", ' ')
       value
     end
 

data/lib/puppet/util/windows/security.rb

@@ -200,7 +200,6 @@ module Puppet::Util::Windows::Security
     well_known_world_sid = Puppet::Util::Windows::SID::Everyone
     well_known_nobody_sid = Puppet::Util::Windows::SID::Nobody
     well_known_system_sid = Puppet::Util::Windows::SID::LocalSystem
-    well_known_app_packages_sid = Puppet::Util::Windows::SID::AllAppPackages
 
     mode = S_ISYSTEM_MISSING
 
@@ -235,7 +234,6 @@ module Puppet::Util::Windows::Security
         if (ace.mask & FILE::FILE_APPEND_DATA).nonzero?
           mode |= S_ISVTX
         end
-      when well_known_app_packages_sid
       when well_known_system_sid
       else
         #puts "Warning, unable to map SID into POSIX mode: #{ace.sid}"

data/lib/puppet/util/windows/service.rb

@@ -1,4 +1,3 @@
-# coding: utf-8
 require 'puppet/util/windows'
 require 'ffi'
 
@@ -181,30 +180,7 @@ module Puppet::Util::Windows
     # // Value to indicate no change to an optional parameter
     # //
     # #define SERVICE_NO_CHANGE              0xffffffff
-    # https://docs.microsoft.com/en-us/windows/win32/api/winsvc/nf-winsvc-changeserviceconfig2w
-    SERVICE_CONFIG_DESCRIPTION              = 0x00000001
-    SERVICE_CONFIG_FAILURE_ACTIONS          = 0x00000002
-    SERVICE_CONFIG_DELAYED_AUTO_START_INFO  = 0x00000003
-    SERVICE_CONFIG_FAILURE_ACTIONS_FLAG     = 0x00000004
-    SERVICE_CONFIG_SERVICE_SID_INFO         = 0x00000005
-    SERVICE_CONFIG_REQUIRED_PRIVILEGES_INFO = 0x00000006
-    SERVICE_CONFIG_PRESHUTDOWN_INFO         = 0x00000007
-    SERVICE_CONFIG_TRIGGER_INFO             = 0x00000008
-    SERVICE_CONFIG_PREFERRED_NODE           = 0x00000009
-    SERVICE_CONFIG_LAUNCH_PROTECTED         = 0x00000012
-    SERVICE_NO_CHANGE                       = 0xffffffff
-    SERVICE_CONFIG_TYPES = {
-      SERVICE_CONFIG_DESCRIPTION => :SERVICE_CONFIG_DESCRIPTION,
-      SERVICE_CONFIG_FAILURE_ACTIONS => :SERVICE_CONFIG_FAILURE_ACTIONS,
-      SERVICE_CONFIG_DELAYED_AUTO_START_INFO => :SERVICE_CONFIG_DELAYED_AUTO_START_INFO,
-      SERVICE_CONFIG_FAILURE_ACTIONS_FLAG => :SERVICE_CONFIG_FAILURE_ACTIONS_FLAG,
-      SERVICE_CONFIG_SERVICE_SID_INFO => :SERVICE_CONFIG_SERVICE_SID_INFO,
-      SERVICE_CONFIG_REQUIRED_PRIVILEGES_INFO => :SERVICE_CONFIG_REQUIRED_PRIVILEGES_INFO,
-      SERVICE_CONFIG_PRESHUTDOWN_INFO => :SERVICE_CONFIG_PRESHUTDOWN_INFO,
-      SERVICE_CONFIG_TRIGGER_INFO => :SERVICE_CONFIG_TRIGGER_INFO,
-      SERVICE_CONFIG_PREFERRED_NODE => :SERVICE_CONFIG_PREFERRED_NODE,
-      SERVICE_CONFIG_LAUNCH_PROTECTED => :SERVICE_CONFIG_LAUNCH_PROTECTED,
-    }
+    SERVICE_NO_CHANGE = 0xffffffff
 
     # Service enum codes
     # https://docs.microsoft.com/en-us/windows/desktop/api/winsvc/nf-winsvc-enumservicesstatusexa
@@ -243,19 +219,6 @@ module Puppet::Util::Windows
       )
     end
 
-    # https://docs.microsoft.com/en-us/windows/win32/api/winsvc/ns-winsvc-service_delayed_auto_start_info
-    # typedef struct _SERVICE_DELAYED_AUTO_START_INFO {
-    #   BOOL fDelayedAutostart;
-    # } SERVICE_DELAYED_AUTO_START_INFO, *LPSERVICE_DELAYED_AUTO_START_INFO;
-    class SERVICE_DELAYED_AUTO_START_INFO < FFI::Struct
-      layout(:fDelayedAutostart, :int)
-      alias aset []=
-      # Intercept the accessor so that we can handle either true/false or 1/0.
-      # Since there is only one member, there’s no need to check the key name.
-      def []=(key, value)
-        [0, false].include?(value) ? aset(key, 0) : aset(key, 1)
-      end
-    end
 
     # https://docs.microsoft.com/en-us/windows/desktop/api/winsvc/ns-winsvc-_enum_service_status_processw
     # typedef struct _ENUM_SERVICE_STATUS_PROCESSW {
@@ -414,7 +377,6 @@ module Puppet::Util::Windows
     module_function :service_state
 
     # Query the configuration of a service using QueryServiceConfigW
-    # or QueryServiceConfig2W
     #
     # @param [String] service_name name of the service to query
     # @return [QUERY_SERVICE_CONFIGW.struct] the configuration of the service
@@ -425,14 +387,6 @@ module Puppet::Util::Windows
           start_type = SERVICE_START_TYPES[config[:dwStartType]]
         end
       end
-      # if the service has type AUTO_START, check if it's a delayed service
-      if start_type == :SERVICE_AUTO_START
-        open_service(service_name, SC_MANAGER_CONNECT, SERVICE_QUERY_CONFIG) do |service|
-          query_config2(service, SERVICE_CONFIG_DELAYED_AUTO_START_INFO) do |config|
-            return :SERVICE_DELAYED_AUTO_START if config[:fDelayedAutostart] == 1
-          end
-        end
-      end
       if start_type.nil?
         raise Puppet::Error.new(_("Unknown start type '%{start_type}' for '%{service_name}'") % { start_type: start_type.to_s, service_name: service_name})
       end
@@ -442,12 +396,11 @@ module Puppet::Util::Windows
 
     # Change the startup mode of a windows service
     #
-    # @param [String] service_name the name of the service to modify
-    # @param [Integer] startup_type a code corresponding to a start type for
+    # @param [string] service_name the name of the service to modify
+    # @param [Int] startup_type a code corresponding to a start type for
     #  windows service, see the "Service start type codes" section in the
     #  Puppet::Util::Windows::Service file for the list of available codes
-    # @param [Bool] delayed whether the service should be started with a delay
-    def set_startup_mode(service_name, startup_type, delayed=false)
+    def set_startup_mode(service_name, startup_type)
       startup_code = SERVICE_START_TYPES.key(startup_type)
       if startup_code.nil?
         raise Puppet::Error.new(_("Unknown start type %{start_type}") % {startup_type: startup_type.to_s})
@@ -474,7 +427,6 @@ module Puppet::Util::Windows
           raise Puppet::Util::Windows::Error.new(_("Failed to update service configuration"))
         end
       end
-      set_startup_mode_delayed(service_name, delayed)
     end
     module_function :set_startup_mode
 
@@ -757,82 +709,6 @@ module Puppet::Util::Windows
       end
       private :query_config
 
-      # @api private
-      # perform QueryServiceConfig2W on a windows service and return the
-      # result
-      #
-      # @param [:handle] service handle of the service to query
-      # @param [Integer] info_level the configuration information to be queried
-      # @return [QUERY_SERVICE_CONFIG2W struct] the result of the query
-      def query_config2(service, info_level, &block)
-        config = nil
-        size_required = nil
-        # Fetch the bytes of memory required to be allocated
-        # for QueryServiceConfig2W to return succesfully. This
-        # is done by sending NULL and 0 for the pointer and size
-        # respectively, letting the command fail, then reading the
-        # value of pcbBytesNeeded
-        FFI::MemoryPointer.new(:lpword) do |bytes_pointer|
-          # return value will be false from this call, since it's designed
-          # to fail. Just ignore it
-          QueryServiceConfig2W(service, info_level, FFI::Pointer::NULL, 0, bytes_pointer)
-          size_required = bytes_pointer.read_dword
-          FFI::MemoryPointer.new(size_required) do |ssp_ptr|
-            # We need to supply the appropriate struct to be created based on
-            # the info_level
-            case info_level
-            when SERVICE_CONFIG_DELAYED_AUTO_START_INFO
-              config = SERVICE_DELAYED_AUTO_START_INFO.new(ssp_ptr)
-            end
-            success = QueryServiceConfig2W(
-              service,
-              info_level,
-              ssp_ptr,
-              size_required,
-              bytes_pointer
-            )
-            if success == FFI::WIN32_FALSE
-              raise Puppet::Util::Windows::Error.new(_("Service query for %{parameter_name} failed") % { parameter_name: SERVICE_CONFIG_TYPES[info_level] } )
-            end
-            yield config
-          end
-        end
-      end
-      private :query_config2
-
-      # @api private
-      # Sets an optional parameter on a service by calling
-      # ChangeServiceConfig2W
-      #
-      # @param [String] service_name name of service
-      # @param [Integer] change parameter to change
-      # @param [struct] value appropriate struct based on the parameter to change
-      def set_optional_parameter(service_name, change, value)
-        open_service(service_name, SC_MANAGER_CONNECT, SERVICE_CHANGE_CONFIG) do |service|
-          success = ChangeServiceConfig2W(
-            service,
-            change, # dwInfoLevel
-            value,  # lpInfo
-          )
-          if success == FFI::WIN32_FALSE
-            raise Puppet::Util::windows::Error.new(_("Failed to update service %{change} configuration") % { change: change } )
-          end
-        end
-      end
-      private :set_optional_parameter
-
-      # @api private
-      # Controls the delayed auto-start setting of a service
-      #
-      # @param [String] service_name name of service
-      # @param [Bool] delayed whether the service should be started with a delay or not
-      def set_startup_mode_delayed(service_name, delayed)
-        delayed_start = SERVICE_DELAYED_AUTO_START_INFO.new
-        delayed_start[:fDelayedAutostart] = delayed
-        set_optional_parameter(service_name, SERVICE_CONFIG_DELAYED_AUTO_START_INFO, delayed_start)
-      end
-      private :set_startup_mode_delayed
-
       # @api private
       # Sends a service control signal to a service
       #
@@ -1029,18 +905,6 @@ module Puppet::Util::Windows
     attach_function_private :QueryServiceConfigW,
       [:handle, :lpbyte, :dword, :lpdword], :win32_bool
 
-    # https://docs.microsoft.com/en-us/windows/win32/api/winsvc/nf-winsvc-queryserviceconfig2w
-    # BOOL QueryServiceConfig2W(
-    #   SC_HANDLE hService,
-    #   DWORD     dwInfoLevel,
-    #   LPBYTE    lpBuffer,
-    #   DWORD     cbBufSize,
-    #   LPDWORD   pcbBytesNeeded
-    # );
-    ffi_lib :advapi32
-    attach_function_private :QueryServiceConfig2W,
-      [:handle, :dword, :lpbyte, :dword, :lpdword], :win32_bool
-
     # https://docs.microsoft.com/en-us/windows/desktop/api/Winsvc/nf-winsvc-startservicew
     # BOOL StartServiceW(
     #   SC_HANDLE hService,
@@ -1091,15 +955,6 @@ module Puppet::Util::Windows
         :lpcwstr
       ], :win32_bool
 
-    # https://docs.microsoft.com/en-us/windows/win32/api/winsvc/nf-winsvc-changeserviceconfig2w
-    # BOOL ChangeServiceConfig2W(
-    #   SC_HANDLE hService,
-    #   DWORD     dwInfoLevel,
-    #   LPVOID    lpInfo
-    # );
-    ffi_lib :advapi32
-    attach_function_private :ChangeServiceConfig2W,
-      [:handle, :dword, :lpvoid], :win32_bool
 
     # https://docs.microsoft.com/en-us/windows/desktop/api/winsvc/nf-winsvc-enumservicesstatusexw
     # BOOL EnumServicesStatusExW(

data/lib/puppet/util/windows/sid.rb

@@ -46,7 +46,6 @@ module Puppet::Util::Windows
     PrintOperators              = 'S-1-5-32-550'
     BackupOperators             = 'S-1-5-32-551'
     Replicators                 = 'S-1-5-32-552'
-    AllAppPackages              = 'S-1-15-2-1'
 
     # Convert an account name, e.g. 'Administrators' into a SID string,
     # e.g. 'S-1-5-32-544'. The name can be specified as 'Administrators',

data/lib/puppet/vendor.rb

@@ -45,7 +45,7 @@ module Puppet
       #
       def load_vendored
         Dir.entries(vendor_dir).each do |entry|
-          if entry =~ /load_(\w+?)\.rb$/
+          if entry.match(/load_(\w+?)\.rb$/)
             load_entry entry
           end
         end

data/lib/puppet/version.rb

@@ -6,7 +6,7 @@
 # Raketasks and such to set the version based on the output of `git describe`
 
 module Puppet
-  PUPPETVERSION = '6.4.5'
+  PUPPETVERSION = '6.5.0'
 
   ##
   # version is a public API method intended to always provide a fast and

data/lib/puppet/x509/cert_provider.rb

@@ -10,21 +10,18 @@ class Puppet::X509::CertProvider
   VALID_CERTNAME = /\A[ -.0-~]+\Z/
   CERT_DELIMITERS = /-----BEGIN CERTIFICATE-----.*?-----END CERTIFICATE-----/m
   CRL_DELIMITERS = /-----BEGIN X509 CRL-----.*?-----END X509 CRL-----/m
+  EC_HEADER = /-----BEGIN EC PRIVATE KEY-----/
 
   def initialize(capath: Puppet[:localcacert],
                  crlpath: Puppet[:hostcrl],
                  privatekeydir: Puppet[:privatekeydir],
                  certdir: Puppet[:certdir],
-                 requestdir: Puppet[:requestdir],
-                 hostprivkey: Puppet.settings.set_by_config?(:hostprivkey) ? Puppet[:hostprivkey] : nil,
-                 hostcert: Puppet.settings.set_by_config?(:hostcert) ? Puppet[:hostcert] : nil)
+                 requestdir: Puppet[:requestdir])
     @capath = capath
     @crlpath = crlpath
     @privatekeydir = privatekeydir
     @certdir = certdir
     @requestdir = requestdir
-    @hostprivkey = hostprivkey
-    @hostcert = hostcert
   end
 
   # Save `certs` to the configured `capath`.
@@ -113,16 +110,44 @@ class Puppet::X509::CertProvider
     end
   end
 
+  # Return the time when the CRL was last updated.
+  #
+  # @return [Time, nil] Time when the CRL was last updated, or nil if we don't
+  #   have a CRL
+  def crl_last_update
+    stat = Puppet::FileSystem.stat(@crlpath)
+    Time.at(stat.mtime)
+  rescue Errno::ENOENT
+    nil
+  end
+
+  # Set the CRL last updated time.
+  #
+  # @param time [Time] The last updated time
+  #
+  def crl_last_update=(time)
+    Puppet::FileSystem.touch(@crlpath, mtime: time)
+  end
+
   # Save named private key in the configured `privatekeydir`. For
   # historical reasons, names are case insensitive.
   #
   # @param name [String] The private key identity
   # @param key [OpenSSL::PKey::RSA] private key
+  # @param password [String, nil] If non-nil, derive an encryption key
+  #   from the password, and use that to encrypt the private key. If nil,
+  #   save the private key unencrypted.
   # @raise [Puppet::Error] if the private key cannot be saved
   # @api private
-  def save_private_key(name, key)
-    path = @hostprivkey || to_path(@privatekeydir, name)
-    save_pem(key.to_pem, path, **permissions_for_setting(:hostprivkey))
+  def save_private_key(name, key, password: nil)
+    pem = if password
+            cipher = OpenSSL::Cipher::AES.new(128, :CBC)
+            key.export(cipher, password)
+          else
+            key.to_pem
+          end
+    path = to_path(@privatekeydir, name)
+    save_pem(pem, path, **permissions_for_setting(:hostprivkey))
   rescue SystemCallError => e
     raise Puppet::Error.new(_("Failed to save private key for '%{name}'") % {name: name}, e)
   end
@@ -132,17 +157,20 @@ class Puppet::X509::CertProvider
   #
   # @param name [String] The private key identity
   # @param required [Boolean] If true, raise if it is missing
+  # @param password [String, nil] If the private key is encrypted, decrypt
+  #   it using the password. If the key is encrypted, but a password is
+  #   not specified, then the key cannot be loaded.
   # @return (see #load_private_key_from_pem)
   # @raise (see #load_private_key_from_pem)
   # @raise [Puppet::Error] if the private key cannot be loaded
   # @api private
-  def load_private_key(name, required: false)
-    path = @hostprivkey || to_path(@privatekeydir, name)
+  def load_private_key(name, required: false, password: nil)
+    path = to_path(@privatekeydir, name)
     pem = load_pem(path)
     if !pem && required
       raise Puppet::Error, _("The private key is missing from '%{path}'") % { path: path }
     end
-    pem ? load_private_key_from_pem(pem) : nil
+    pem ? load_private_key_from_pem(pem, password: password) : nil
   rescue SystemCallError => e
     raise Puppet::Error.new(_("Failed to load private key for '%{name}'") % {name: name}, e)
   end
@@ -150,14 +178,46 @@ class Puppet::X509::CertProvider
   # Load a PEM encoded private key.
   #
   # @param pem [String] PEM encoded private key
-  # @return [OpenSSL::PKey::RSA] The private key
-  # @raise [OpenSSL::PKey::RSAError] The `pem` text does not contain a valid key
+  # @param password [String, nil] If the private key is encrypted, decrypt
+  #   it using the password. If the key is encrypted, but a password is
+  #   not specified, then the key cannot be loaded.
+  # @return [OpenSSL::PKey::RSA, OpenSSL::PKey::EC] The private key
+  # @raise [OpenSSL::PKey::PKeyError] The `pem` text does not contain a valid key
   # @api private
-  def load_private_key_from_pem(pem)
-    # set a non-nil passphrase to ensure openssl doesn't prompt
-    # but ruby 2.4.0 & 2.4.1 require at least 4 bytes, see
-    # https://github.com/ruby/ruby/commit/f012932218fd609f75f9268812df61fb26e2d0f1#diff-40e4270ec386990ac60d7ab5ff8045a4
-    OpenSSL::PKey::RSA.new(pem, '    ')
+  def load_private_key_from_pem(pem, password: nil)
+    # set a non-nil password to ensure openssl doesn't prompt
+    # but ruby 2.4.0 & 2.4.1 require at least 4 bytes due to
+    # https://github.com/ruby/openssl/commit/f38501249f33bff7ca9d208670b8cde695ea8b7b
+    # and corrected in https://github.com/ruby/openssl/commit/a896c3d1dfa090e92dec1abf8ac12843af6af721
+    password ||= '    '
+
+    if Puppet::Util::Platform.jruby?
+      begin
+        if pem =~ EC_HEADER
+          OpenSSL::PKey::EC.new(pem, password)
+        else
+          OpenSSL::PKey::RSA.new(pem, password)
+        end
+      rescue OpenSSL::PKey::PKeyError => e
+        if e.message =~ /Neither PUB key nor PRIV key/
+          raise OpenSSL::PKey::PKeyError, "Could not parse PKey: no start line"
+        else
+          raise e
+        end
+      end
+    else
+      OpenSSL::PKey.read(pem, password)
+    end
+  end
+
+  # Load the private key password.
+  #
+  # @return [String, nil] The private key password as a binary string or nil
+  #   if there is none.
+  def load_private_key_password
+    Puppet::FileSystem.read(Puppet[:passfile], :encoding => Encoding::BINARY)
+  rescue Errno::ENOENT
+    nil
   end
 
   # Save a named client cert to the configured `certdir`.
@@ -167,7 +227,7 @@ class Puppet::X509::CertProvider
   # @raise [Puppet::Error] if the client cert cannot be saved
   # @api private
   def save_client_cert(name, cert)
-    path = @hostcert || to_path(@certdir, name)
+    path = to_path(@certdir, name)
     save_pem(cert.to_pem, path, **permissions_for_setting(:hostcert))
   rescue SystemCallError => e
     raise Puppet::Error.new(_("Failed to save client certificate for '%{name}'") % {name: name}, e)
@@ -182,7 +242,7 @@ class Puppet::X509::CertProvider
   # @raise [Puppet::Error] if the client cert cannot be loaded
   # @api private
   def load_client_cert(name, required: false)
-    path = @hostcert || to_path(@certdir, name)
+    path = to_path(@certdir, name)
     pem = load_pem(path)
     if !pem && required
       raise Puppet::Error, _("The client certificate is missing from '%{path}'") % { path: path }
@@ -284,10 +344,7 @@ class Puppet::X509::CertProvider
   def permissions_for_setting(name)
     setting = Puppet.settings.setting(name)
     perm = { mode: setting.mode.to_i(8) }
-    if Puppet.features.root? && !Puppet::Util::Platform.windows?
-      perm[:owner] = setting.owner
-      perm[:group] = setting.group
-    end
+    perm.merge!(owner: setting.owner, group: setting.group) if Puppet.features.root? && !Puppet::Util::Platform.windows?
     perm
   end
 end