| Age | Commit message (Collapse) | Author | Files | Lines |
|---|
|
- Somehow there were still some remaining constants referencing
Windows:: which is part of windows-pr gem. Most are already
defined locally as of the code being ported to FFI. Ensure that we
use our internal constant definitions rather than those from gem:
Puppet::Util::Windows::AccessControlEntry::CONTAINER_INHERIT_ACE
Puppet::Util::Windows::AccessControlEntry::OBJECT_INHERIT_ACE
Puppet::Util::Windows::AccessControlEntry::INHERIT_ONLY_ACE
Puppet::Util::Windows::File::STANDARD_RIGHTS_ALL
Puppet::Util::Windows::File::SPECIFIC_RIGHTS_ALL
Puppet::Util::Windows::File::FILE_ALL_ACCESS
Puppet::Util::Windows::File::FILE_GENERIC_READ
Puppet::Util::Windows::File::FILE_GENERIC_EXECUTE
- Add new constants to Puppet::Util::Windows::Error
ERROR_FILE_NOT_FOUND
ERROR_ACCESS_DENIED
|
|
Previously, puppet relied on win32-security version 0.1.4, which raised
Win32::Security::SID::Error when it failed to resolve a name into a SID.
Newer FFI versions of win32-security raise SystemCallError instead,
which is a StandardError subclass. When trying to run the puppet agent
against newer versions of the library, puppet reports:
Uninitialized constant Win32::Security::SID::Error
This commit changes the rescue to capture SystemCallError instead. This
exception is defined in ruby 1.8.7 and up.
|
|
- SID methods can really standalone on their own, and
should for the sake of sanity / code maintenance. Adjust all
callsites (including specs) accordingly.
- Make SID methods into static module_functions since they're
already stateless
|
|
- MemoryPointer from_string_to_wide_string previously allocated a
new MemoryPointer instance but didn't force callers to scope / free
it. This allowed the Ruby runtime to clean it up on GC, but we
prefer to force callers to use a block form, to clean up the
unmanaged memory when the variable is no longer needed. Refactor
the method to yield the ptr.
- Since the ptr is no longer valid after the block yields, return nil
from the method
|
|
- FFI GetACP
- Remove requirement on gem windows-pr by removing 'windows/national'
- Moved require for windows/registry into windows platform specific
- Added module definition to satisfy MSI/Windows Package
|
|
- Convert ADSI GetComputerName to FFI
- Add missing error handling for GetComputerName Win32 function
- Add test that verifies GetComputerName returns a non-empty string
- Add FFI MemoryPointer aliases for dwords
Conflicts:
spec/unit/util/windows/adsi_spec.rb
|
|
- Move Windows ADSI code out of puppet/util and into
puppet/util/windows
- Update namespace from Puppet::Util::ADSI to
Puppet::Util::Windows::ADSI
- Add module / class definitions for ADSI to util/windows.rb
to prevent tests from blowing up on non-Windows
- Moving Puppet.features.microsoft_windows? checks to top of
user and group provider tests for ADSI
- Update all dependent code, remove unnecessary references
|
|
- LogonUserW, LoadUserProfile, UnloadUserProfile and PROFILEINFO
have been converted from manually packing params with Win32API.new to
automatically managed with FFI definitions.
- Use MemoryPointer where appropriate.
- Note that wide character LogonUserW is used rather than platform
varying LogonUser as FFI is unable to use that. The pointer
widths of PROFILEINFO vary depending on platform, which is handled
by using :pointer. With LogonUserW the string pointed to is always
wide character, which is properly handled by using wide_string.
- Add FFI::MemoryPointer helper read_handle
- Add FFI::MemoryPointer.from_wide_string and corresponding tests that
ensure that a properly terminated UTF-16LE string is passed in
- Add FFI::MemoryPointer#read_wide_string that reads a wide string buffer
into a Ruby string with Encoding.default_external and corresponding tests
- Add additional tests around User methods that make native Win32 API calls
that will intentionally fail
- Fix wide_string helper to return nil when given nil so that can be passed
directly to Win32 as a null pointer
|
|
Previously, we were appending a NULL to the wide encoded string to work around
a ruby bug fixed in 2.1.
However, we were calling `String#strip`, which makes a copy of the string, and
in the process only preserves the first NULL.
This commit embeds a NULL within the string itself, e.g. "bob\0". Since the
NULL is part of the string data, ruby will preserve it.
Also, `String#+` cannot combine strings with different encodings,
e.g. "a".encode('UTF-16LE') + "\0" results in:
incompatible character encodings: UTF-16LE and US-ASCII
which is why we need to encode the terminator. The actual message depends on
the default encoding, e.g. US-ASCII, UTF-8.
|
|
* pr/2261:
(PUP-1389) Simplify logic for appending extra NULL
(PUP-1389) ReplaceFile to FFI / move wide_string
(PUP-1389) Ensure wide strings have double null terminators
|
|
Puppet::Util::Windows::File.replace_file now calls FFI to
replace files in place on Windows.
Puppet::Util::Windows::File.wide_string has now been moved to
Puppet::Util::Windows::String.wide_string.
This moves wide_string to lib/puppet/ubilt/windows/string.rb,
adds specs concerning different encodings.
In addition, we've removed Windows::API::WideString usages from
everywhere it was found as it is known to cause issues with Windows 2012.
Puppet::Util::Windows::Process.lookup_privilege_value in particular was
changed to use LookupPrivilegeValueA (ANSI) as we control the privilege name
being passed to it.
Paired with Josh Cooper <josh@puppetlabs.com>
|
|
Ruby uses ANSI versions of Win32 APIs to read values from the registry. The
encoding of these strings depends on the active code page. However, ruby
incorrectly sets the string encoding to US-ASCII.[1]
As a result, if you try to perform a regex match on the string, and the string
contains the registered trademark symbol, 0xAE, then ruby will raise an error
saying 'Invalid byte sequence in US-ASCII'
This commit forces the encoding of REG_SZ, REG_EXPAND_SZ, and REG_MULTI_SZ to
the encoding for the active code page. So if the active code page is 1252, the
ruby encoding will be `Encoding::CP1252`.
See https://bugs.ruby-lang.org/issues/8943
|
|
Given a directory owned by Administrators and group None, and with DACL:
NT AUTHORITY\SYSTEM:(I)(OI)(CI) 0x1f01ff
BUILTIN\Administrators:(I)(OI)(CI) 0x1f01ff
WIN-QP47VOHA2P4\albert:(I)(OI)(CI) 0x1f01ff
where the ACE for the owner is inherited (I). If puppet changed the owner to
Users, it would copy all of the inherited ACEs as-is. But the new owner
would not have any privileges, even though the old owner did. The same is
true for group.
This commit ensures that if we see an inherited ACE for the old owner, that
we prepend a new explicit ACE, whose type (allow or deny), flags and mask
grant/deny the same access as the inherited ACE did.
Note that not all flags are valid when setting an ACE, e.g. INHERITED_ACE is
only something you can read, not set.
As a result of this change, when puppet changes the owner from Administrators
to Users the dacl will have the following ACE prepended to the list, with
the existing inherited ACEs copied as-is:
BUILTIN\Users:(OI)(CI) 0x1f01ff
Note that the new ACE has the same mask as the old one, and has the object
and container inherit flags set.
|
|
Creates objects for modeling windows security descriptors, access control
lists, and access control entries.
|
|
|
|
Previously, we made assumptions about the layout of the CERT_CONTEXT
structure, specifically that PCERT_INFO (pointer to CERT_CONTEXT) was an
unsigned 32-bit integer ('L'), and magically accessed the size of the
returned structure as arr[2]. We were also memcpy 40-bytes which was
larger than the size of the CERT_CONTEXT structure in both x86 and x64 and
was the cause of infrequent segmentation faults.
This commit uses FFI to define the layout of the CERT_CONTEXT structure, uses
named fields, e.g. [:cbCertEncoded], to access offsets within the structure,
and uses the FFI::Pointer#null? method to check for NULL pointer.
Note that we use FFI::Pointer and not MemoryPointer, because the
CertEnumCertificatesInStore function is responsible for freeing the
previous CERT_CONTEXT pointer, not us.
Also in the motto of "don't stub what you don't own" it exercises the Win32
APIs to make the tests more meaningful.
|
|
- Simple wrapper around creating new SID instances
- Used to insulate tests from Win32::Security
- Existing name_to_sid now delegates to this method
|
|
- This will allow a WIN32OLE instance returned by the connect method
to convert its objectSID property (an octet stream / array of bytes)
to a standard user friendly SID object
|
|
On Windows calling OpenSSL::X509::Store#set_default_paths does nothing. As
a result, puppet is unable to make authenticated SSL connections to
well-known SSL servers, like forge.puppetlabs.com.
This commit adds a RootCerts class that loads the root certs from the
Windows system cert store, and monkey patches the
OpenSSL::X509::Store#set_default_paths to behave as expected on Windows.
Note the actual semantics for set_default_paths are slightly different,
in that on *nix, it sets the paths that openssl will look for trusted root
certs, whereas this patch loads them into the X509::Store object on
Windows. But the net effect is the same, we're specifying the set of root
certs that we trust when authenticating SSL servers.
This commit monkey patches openssl, because there isn't a central way to
create SSL contexts in ruby. Specifically, open-uri hides the process of
setting up the SSL context, so the caller doesn't have to "worry" about
it. In doing so, it calls set_default_paths expecting that is all that is
needed. But it makes it next to impossible for the caller to add other
root certs.
Specifically, the module tool uses open-uri to download tar.gz content,
but that said the issue is not specific to the module tool.
This commit also adds an SSL acceptance test.
|
|
* upstream/2.7.x:
(#16581) Refactor code for sid validation
(#16581) Deprecate sid_for_account
(#16581) Use native Win32 APIs to resolve SIDs in file provider
(#16581) Use native Win32 APIs to resolve SIDs in providers
(#16581) Documentation changes
(#16581) Use win32-security gem to resolve SIDs
(#16581) Refactor code for converting string and binary sids
Conflicts:
Gemfile.lock
lib/puppet/util/windows.rb
|
|
Previously, the windows file provider knew too much about how to validate
a sid, e.g. catching a specific windows-specific exception.
This commit moves that logic into a `valid_sid?` method and updates the
file provider to call it. In doing so, the logic for `string_to_sid_ptr`
is simplier, in that it always expects a block.
It also removes tests that were refactored into sid_spec.rb in an earlier
commit.
|
|
This commit adds methods for resolving Windows account names into binary
encoded SIDs and back. Account names may be specified with or without the
domain component, or as a SID string. So all of the following are
equivalent names for the LocalSystem account:
NT AUTHORITY\SYSTEM
SYSTEM
S-1-5-18
There is a bug[1] in the `SID.string_to_sid` method in versions of
win32-security prior to 0.1.4, so this commit updates the Gemfile
accordingly.
[1] https://github.com/djberg96/win32-security/pull/1
Conflicts:
spec/unit/util/windows/sid_spec.rb
|
|
This commit moves the methods that were previously part of the security
module into a sid module, and adds tests that only execute on windows due
to its reliance on the `win32/security` gem.
|
|
Without this patch Ruby 1.9 is still complaining loudly about trying to
parse the spec files. The previous attempt to clean up this problem in
edc3ddf works for Ruby 1.8 but not 1.9.
I'd prefer to remove the shebang lines entirely, but doing so will cause
encoding errors in Ruby 1.9. This patch strives for a happy middle
ground of convincing Ruby it is actually working with Ruby while not
confusing it to think it should exec() to rspec.
This patch is the result of the following command run against the source
tree:
find spec -type f -print0 | \
xargs -0 perl -pl -i -e 's,^\#\!\s?/(.*)rspec,\#! /usr/bin/env ruby,'
|
|
Previously, it wasn't clear from the exception message which registry key
we failed to open.
This commit adds the registry key path to the message to debug issues we
are seeing in CI, but is also generally helpful.
|
|
Ruby includes a built-in set of modules and classes for interacting with
the registry, however, it is only present on Windows. This makes it
difficult to write spec tests that can run on non-Windows platforms due to
the `Win32` namespace and related constants.
This commit adds a utility module to wrap the Windows specific code. This
way if you write a module/class that uses the registry, you can just add
expects/stub expectations to the utility module or the class that
includes/extends it.
|
