Add windows_update_settings resource

Copied from the desktop-config cookbook and simplified a little bit to
skip properties we can calculate automatically.

Signed-off-by: Tim Smith <tsmith@chef.io>

4 files changed, 329 insertions, 0 deletions

diff --git a/kitchen-tests/cookbooks/end_to_end/recipes/windows.rb b/kitchen-tests/cookbooks/end_to_end/recipes/windows.rb
index 34e1048074..116e78ce6c 100644
--- a/kitchen-tests/cookbooks/end_to_end/recipes/windows.rb
+++ b/kitchen-tests/cookbooks/end_to_end/recipes/windows.rb
@@ -185,3 +185,8 @@ include_recipe "::_habitat_win_sup"
 include_recipe "::_habitat_win_user_toml"
 include_recipe "::_windows_printer"
 include_recipe "::_windows_defender"
+
+windows_update_settings "Disable Windows Update" do
+  block_windows_update_website true
+  disable_automatic_updates true
+end
diff --git a/lib/chef/resource/windows_update_settings.rb b/lib/chef/resource/windows_update_settings.rb
new file mode 100644
index 0000000000..3f8cf95acb
--- /dev/null
+++ b/lib/chef/resource/windows_update_settings.rb
@@ -0,0 +1,259 @@
+#
+# Author:: Sölvi Páll Ásgeirsson (<solvip@gmail.com>)
+# Author:: Richard Lavey (richard.lavey@calastone.com)
+# Author:: Tim Smith (tsmith@chef.io)
+#
+# Copyright:: 2014-2017, Sölvi Páll Ásgeirsson.
+# Copyright:: Copyright (c) Chef Software Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+require_relative "../resource"
+class Chef
+  class Resource
+    class WindowsUpdateSettings < Chef::Resource
+      unified_mode true
+
+      provides :windows_update_settings
+
+      description "Use the **windows_update_settings** resource to manage the various Windows Update patching options."
+      introduced "17.3"
+      examples <<~DOC
+      **Set Windows Update settings**:
+
+      ```ruby
+      windows_update_settings 'Settings to Configure Windows Nodes to automatically receive updates' do
+        disable_os_upgrades true
+        elevate_non_admins true
+        block_windows_update_website true
+        automatically_install_minor_updates true
+        scheduled_install_day 'Friday'
+        scheduled_install_hour 18
+        update_other_ms_products true
+        action :enable
+      end
+      ```
+      DOC
+
+      # required for the alias to pass validation
+      allowed_actions :set, :enable
+
+      DAYS = %W{Everyday Monday Tuesday Wednesday Thursday Friday Saturday Sunday}.freeze
+      UPDATE_OPTIONS = {
+                        notify: 2,
+                        download_and_notify: 3,
+                        download_and_schedule: 4,
+                        local_admin_decides: 5,
+                      }.freeze
+
+      # HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate
+
+      property :disable_os_upgrades, [true, false], default: false, description: "Disable OS upgrades."
+      # options: 0 - let windows update update the os - false
+      #          1 - don't let windows update update the os - true
+
+      property :elevate_non_admins, [true, false], default: true, description: "Allow normal user accounts to temporarily be elevated to install patches."
+      # options: 0 - do not elevate a user to force an install - false
+      #          1 - do elevate the logged on user to install an update - true
+
+      property :add_to_target_wsus_group, [true, false], deprecated: "As of Chef Infra Client 17.3 the `add_to_target_wsus_group` property is no longer necessary."
+      # we set this registry value now automatically if the group name is set
+
+      property :target_wsus_group_name, String, description: "Add the node to a WSUS Target Group."
+      # options: --- a string representing the name of a target group you defined on your wsus server
+
+      property :wsus_server_url, String, description: "The URL of your WSUS server if you use one."
+      # options: --- a url for your internal update server in the form of https://my.updateserver.tld:4545 or whatever
+
+      property :wsus_status_server_url, String, deprecated: "As of Chef Infra Client 17.3 the `wsus_status_server_url` no longer needs to be set."
+      # this needs to be the same as wsus_server_url so we just set that value in both places now
+
+      # HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
+
+      property :block_windows_update_website, [true, false], default: false, description: "Block accessing the Windows Update website."
+      # options: 0 - allow access to the windows update website - false
+      #          1 - do not allow access to the windows update website - true
+
+      # HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU
+
+      property :automatic_update_option, [Integer, Symbol], equal_to: UPDATE_OPTIONS.keys, coerce: proc { |x| UPDATE_OPTIONS.key(x) || x },
+                default: :download_and_schedule,
+                description: "Control what to do when updates are found. This allows you to notify, automatically download and notify to install, automatically download and schedule the install, or let the local admin decide what action to take."
+      # options: 2 - notify before download
+      #          3 - auto download and notify
+      #          4 - auto download and schedule - must also set day and time (below)
+      #          5 - allow the local admin to decide
+
+      property :automatically_install_minor_updates, [true, false], default: false, description: "Automatically install minor updates."
+      # options: 0 - do not automatically install minor updates - false
+      #          1 - of course, silently install them! - true
+
+      property :enable_detection_frequency, [true, false], default: false, description: "Used to override the OS default of how often to check for updates"
+      # do i want my nodes checking for updates at a time interval i chose?
+      # options: 0 - do not enable the option for a custom interval - false
+      #          1 - yeah, buddy, i want to set my own interval for checking for updates - true
+
+      property :custom_detection_frequency, Integer, default: 22, description: "If you decided to override the OS default detection frequency, specify your choice here. Valid choices are 0 - 22",
+      callbacks: {
+        "should be a valid detection frequency (0-22)" => lambda { |p|
+          p >= 0 && p <= 22
+        },
+      }
+      # a time period of between 0 and 22 hours to check for new updates
+      # this is a hex value - convert it from dec to hex
+
+      property :no_reboot_with_users_logged_on, [true, false], default: true, description: "Prevents the OS from rebooting while someone is on the console."
+      # options: 0 - user is notified of pending reboot in xx minutes - false/off
+      #          1 - user is notified of pending reboot but can defer - true/on
+
+      property :disable_automatic_updates, [true, false], default: false, description: "Disable Windows Update."
+      # options: 0 - enable automatic updates to the local system - false
+      #          1 - disable automatic updates - true
+
+      property :scheduled_install_day, String, equal_to: DAYS, default: DAYS.first, description: "A day of the week to tell Windows when to install updates."
+      # options: Everyday - install every day
+      #          Sunday - Saturday day of the week to install, 1 == sunday
+
+      property :scheduled_install_hour, Integer, description: "If you chose a scheduled day to install, then choose an hour on that day for you installation",
+                callbacks: {
+                  "should be a valid hour in a 24 hour clock" => lambda { |p|
+                    p > 0 && p < 25
+                  },
+                }
+      # options: --- 2-digit number representing an hour of the day, uses a 24-hour clock, 12 == noon, 24 == midnight
+
+      property :update_other_ms_products, [true, false], default: true, description: "Allows for other Microsoft products to get updates too"
+      # options: 0 - do not allow wu to update other apps - remove key from hive - false/off
+      #          1 - please update all my stuff! - true/on
+
+      # \AU\AllowMUUpdateService dword: 1
+
+      property :custom_wsus_server, [true, false], deprecated: "As of Chef Infra Client 17.3 the `custom_wsus_server` no longer needs to be setup when specifying a WSUS endpoint."
+      # not necessary as we set this registry value automatically if a URL is set
+
+      action :set, description: "Set Windows Update settings." do
+        actual_day = convert_day(new_resource.scheduled_install_day)
+
+        registry_key 'HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\WindowsUpdate' do
+          recursive true
+          values [{
+            name: "DisableOSUpgrade",
+            type: :dword,
+            data: new_resource.disable_os_upgrades ? 1 : 0,
+          },
+          {
+            name: "ElevateNonAdmins",
+            type: :dword,
+            data: new_resource.elevate_non_admins ? 1 : 0,
+          },
+          {
+            name: "TargetGroupEnabled",
+            type: :dword,
+            data: new_resource.target_wsus_group_name ? 1 : 0,
+          },
+          {
+            name: "TargetGroup",
+            type: :string,
+            data: new_resource.target_wsus_group_name,
+          },
+          {
+            name: "WUServer",
+            type: :string,
+            data: new_resource.wsus_server_url,
+          },
+          {
+            name: "WUStatusServer",
+            type: :string,
+            data: new_resource.wsus_server_url, # status server and server need to be the same. Why? Ask Microsoft
+          }]
+          action :create
+        end
+
+        registry_key 'HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer' do
+          recursive true
+          values [{
+            name: "NoWindowsUpdate",
+            type: :dword,
+            data: new_resource.block_windows_update_website ? 1 : 0,
+          }]
+          action :create
+        end
+
+        registry_key 'HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU' do
+          recursive true
+          values [{
+            name: "AUOptions",
+            type: :dword,
+            data: UPDATE_OPTIONS[new_resource.automatic_update_option],
+          },
+          {
+            name: "AutoInstallMinorUpdates",
+            type: :dword,
+            data: new_resource.automatically_install_minor_updates ? 1 : 0,
+          },
+          {
+            name: "DetectionFrequencyEnabled",
+            type: :dword,
+            data: new_resource.enable_detection_frequency ? 1 : 0,
+          },
+          {
+            name: "DetectionFrequency",
+            type: :dword,
+            data: new_resource.custom_detection_frequency,
+          },
+          {
+            name: "NoAutoRebootWithLoggedOnUsers",
+            type: :dword,
+            data: new_resource.no_reboot_with_users_logged_on ? 1 : 0,
+          },
+          {
+            name: "NoAutoUpdate",
+            type: :dword,
+            data: new_resource.disable_automatic_updates ? 1 : 0,
+          },
+          {
+            name: "ScheduledInstallDay",
+            type: :dword,
+            data: actual_day,
+          },
+          {
+            name: "ScheduledInstallTime",
+            type: :dword,
+            data: new_resource.scheduled_install_hour,
+          },
+          {
+            name: "AllowMUUpdateService",
+            type: :dword,
+            data: new_resource.update_other_ms_products ? 1 : 0,
+          },
+          {
+            name: "UseWUServer",
+            type: :dword,
+            data: new_resource.wsus_server_url ? 1 : 0, # if we have a URL set then want to turn on WSUS functionality
+          }]
+          action :create
+        end
+      end
+
+      action_class do
+        def convert_day(day)
+          DAYS.index(day)
+        end
+
+        # support the old name as well
+        alias_method :action_enable, :action_set
+      end
+    end
+  end
+end
diff --git a/lib/chef/resources.rb b/lib/chef/resources.rb
index 1bfc52805a..6b30a58aff 100644
--- a/lib/chef/resources.rb
+++ b/lib/chef/resources.rb
@@ -177,6 +177,7 @@ require_relative "resource/windows_share"
 require_relative "resource/windows_shortcut"
 require_relative "resource/windows_task"
 require_relative "resource/windows_uac"
+require_relative "resource/windows_update_settings"
 require_relative "resource/windows_workgroup"
 require_relative "resource/timezone"
 require_relative "resource/windows_user_privilege"
diff --git a/spec/unit/resource/windows_update_settings_spec.rb b/spec/unit/resource/windows_update_settings_spec.rb
new file mode 100644
index 0000000000..a2cae6d84e
--- /dev/null
+++ b/spec/unit/resource/windows_update_settings_spec.rb
@@ -0,0 +1,64 @@
+#
+# Copyright:: Copyright (c) Chef Software Inc.
+# Author:: Tim Smith (tsmith@chef.io)
+# License:: Apache License, Version 2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+require "spec_helper"
+
+describe Chef::Resource::WindowsUpdateSettings do
+  let(:resource) { Chef::Resource::WindowsUpdateSettings.new("foobar") }
+
+  it "sets resource name as :windows_update_settings" do
+    expect(resource.resource_name).to eql(:windows_update_settings)
+  end
+
+  it "sets the default action as :set" do
+    expect(resource.action).to eql([:set])
+  end
+
+  it "supports :set and legacy :enable actions" do
+    expect { resource.action :set }.not_to raise_error
+    expect { resource.action :enable }.not_to raise_error
+  end
+
+  it "raises an error if scheduled_install_day isn't a validate day" do
+    expect { resource.scheduled_install_day "Saturday" }.not_to raise_error
+    expect { resource.scheduled_install_day "Sunday" }.not_to raise_error
+    expect { resource.scheduled_install_day "Extraday" }.to raise_error(ArgumentError)
+  end
+
+  it "raises an error if automatic_update_option isn't a validate option" do
+    expect { resource.automatic_update_option 2 }.not_to raise_error
+    expect { resource.automatic_update_option :notify }.not_to raise_error
+    expect { resource.automatic_update_option :nope }.to raise_error(ArgumentError)
+  end
+
+  it "coerces legacy Integer value in automatic_update_option to friendly symbol" do
+    resource.automatic_update_option 2
+    expect(resource.automatic_update_option).to eql(:notify)
+  end
+
+  it "raises an error if scheduled_install_hour isn't a 24 hour clock hour" do
+    expect { resource.scheduled_install_hour 2 }.not_to raise_error
+    expect { resource.scheduled_install_hour 0 }.to raise_error(ArgumentError)
+    expect { resource.scheduled_install_hour 25 }.to raise_error(ArgumentError)
+  end
+
+  it "raises an error if custom_detection_frequency isn't a valid frequency" do
+    expect { resource.custom_detection_frequency 0 }.not_to raise_error
+    expect { resource.custom_detection_frequency 23 }.to raise_error(ArgumentError)
+  end
+end