Use named pipe to decrease local Windows runtime

lib/train/extras/command_wrapper.rb

@@ -121,43 +121,6 @@ def safe_string(str)
     end
   end
 
-  # this is required if you run locally on windows,
-  # winrm connections provide a PowerShell shell automatically
-  # TODO: only activate in local mode
-  class PowerShellCommand < CommandWrapperBase
-    Train::Options.attach(self)
-
-    def initialize(backend, options)
-      @backend = backend
-      validate_options(options)
-    end
-
-    def run(script)
-      # wrap the script to ensure we always run it via powershell
-      # especially in local mode, we cannot be sure that we get a Powershell
-      # we may just get a `cmd`.
-      # TODO: we may want to opt for powershell.exe -command instead of `encodeCommand`
-      "powershell -NoProfile -encodedCommand #{encoded(safe_script(script))}"
-    end
-
-    # suppress the progress stream from leaking to stderr
-    def safe_script(script)
-      "$ProgressPreference='SilentlyContinue';" + script
-    end
-
-    # Encodes the script so that it can be passed to the PowerShell
-    # --EncodedCommand argument.
-    # @return [String] The UTF-16LE base64 encoded script
-    def encoded(script)
-      encoded_script = safe_script(script).encode('UTF-16LE', 'UTF-8')
-      Base64.strict_encode64(encoded_script)
-    end
-
-    def to_s
-      'PowerShell CommandWrapper'
-    end
-  end
-
   class CommandWrapper
     include_options LinuxCommand
 
@@ -168,10 +131,6 @@ def self.load(transport, options)
         msg = res.verify
         fail Train::UserError, "Sudo failed: #{msg}" unless msg.nil?
         res
-      # only use powershell command for local transport. winrm transport
-      # uses powershell as default
-      elsif transport.os.windows? && transport.class == Train::Transports::Local::Connection
-        PowerShellCommand.new(transport, options)
       end
     end
   end

lib/train/transports/local.rb

@@ -12,15 +12,32 @@ class Local < Train.plugin(1)
 
     include_options Train::Extras::CommandWrapper
 
+    class PipeError < ::StandardError; end
+
     def connection(_ = nil)
       @connection ||= Connection.new(@options)
     end
 
     class Connection < BaseConnection
       def initialize(options)
         super(options)
-        @cmd_wrapper = nil
-        @cmd_wrapper = CommandWrapper.load(self, options)
+
+        # While OS is being discovered, use the GenericRunner
+        @runner = GenericRunner.new
+        @runner.cmd_wrapper = CommandWrapper.load(self, options)
+
+        if os.windows?
+          # Attempt to use a named pipe but fallback to ShellOut if that fails
+          begin
+            @runner = WindowsPipeRunner.new
+          rescue PipeError
+            @runner = WindowsShellRunner.new
+          end
+        end
+      end
+
+      def local?
+        true
       end
 
       def login_command
@@ -31,17 +48,10 @@ def uri
         'local://'
       end
 
-      def local?
-        true
-      end
-
       private
 
       def run_command_via_connection(cmd)
-        cmd = @cmd_wrapper.run(cmd) unless @cmd_wrapper.nil?
-        res = Mixlib::ShellOut.new(cmd)
-        res.run_command
-        CommandResult.new(res.stdout, res.stderr, res.exitstatus)
+        @runner.run_command(cmd)
       rescue Errno::ENOENT => _
         CommandResult.new('', '', 1)
       end
@@ -53,6 +63,147 @@ def file_via_connection(path)
           Train::File::Local::Unix.new(self, path)
         end
       end
+
+      class GenericRunner
+        attr_writer :cmd_wrapper
+
+        def run_command(cmd)
+          if defined?(@cmd_wrapper) && !@cmd_wrapper.nil?
+            cmd = @cmd_wrapper.run(cmd)
+          end
+
+          res = Mixlib::ShellOut.new(cmd)
+          res.run_command
+          Local::CommandResult.new(res.stdout, res.stderr, res.exitstatus)
+        end
+      end
+
+      class WindowsShellRunner
+        require 'json'
+        require 'base64'
+
+        def run_command(script)
+          # Prevent progress stream from leaking into stderr
+          script = "$ProgressPreference='SilentlyContinue';" + script
+
+          # Encode script so PowerShell can use it
+          script = script.encode('UTF-16LE', 'UTF-8')
+          base64_script = Base64.strict_encode64(script)
+
+          cmd = "powershell -NoProfile -EncodedCommand #{base64_script}"
+
+          res = Mixlib::ShellOut.new(cmd)
+          res.run_command
+          Local::CommandResult.new(res.stdout, res.stderr, res.exitstatus)
+        end
+      end
+
+      class WindowsPipeRunner
+        require 'json'
+        require 'base64'
+        require 'securerandom'
+
+        def initialize
+          @pipe = acquire_pipe
+          fail PipeError if @pipe.nil?
+        end
+
+        def run_command(cmd)
+          script = "$ProgressPreference='SilentlyContinue';" + cmd
+          encoded_script = Base64.strict_encode64(script)
+          @pipe.puts(encoded_script)
+          @pipe.flush
+          res = OpenStruct.new(JSON.parse(Base64.decode64(@pipe.readline)))
+          Local::CommandResult.new(res.stdout, res.stderr, res.exitstatus)
+        end
+
+        private
+
+        def acquire_pipe
+          current_pipe = Dir.entries('//./pipe/').find { |f| f =~ /inspec_/ }
+
+          pipe = nil
+          if current_pipe.nil?
+            pipe = create_pipe("inspec_#{SecureRandom.hex}")
+          else
+            begin
+              pipe = open("//./pipe/#{current_pipe}", 'r+')
+            rescue
+              # Pipes are closed when a Train connection ends. When running
+              # multiple independent scans (e.g. Unit tests) the pipe will be
+              # unavailable because the previous process is closing it.
+              # This creates a new pipe in that case
+              pipe = create_pipe("inspec_#{SecureRandom.hex}")
+            end
+          end
+
+          pipe
+        end
+
+        def create_pipe(pipe_name)
+          start_pipe_server(pipe_name)
+
+          pipe = nil
+
+          # PowerShell needs time to create pipe.
+          100.times do
+            begin
+              pipe = open("//./pipe/#{pipe_name}", 'r+')
+              break
+            rescue
+              sleep 0.1
+            end
+          end
+
+          pipe
+        end
+
+        def start_pipe_server(pipe_name)
+          require 'win32/process'
+
+          script = <<-EOF
+            $ErrorActionPreference = 'Stop'
+
+            $pipeServer = New-Object System.IO.Pipes.NamedPipeServerStream('#{pipe_name}')
+            $pipeReader = New-Object System.IO.StreamReader($pipeServer)
+            $pipeWriter = New-Object System.IO.StreamWriter($pipeServer)
+
+            $pipeServer.WaitForConnection()
+
+            # Create loop to receive and process user commands/scripts
+            $clientConnected = $true
+            while($clientConnected) {
+              $input = $pipeReader.ReadLine()
+              $command = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($input))
+
+              # Execute user command/script and convert result to JSON
+              $scriptBlock = $ExecutionContext.InvokeCommand.NewScriptBlock($command)
+              try {
+                $stdout = & $scriptBlock | Out-String
+                $result = @{ 'stdout' = $stdout ; 'stderr' = ''; 'exitstatus' = 0 }
+              } catch {
+                $stderr = $_ | Out-String
+                $result = @{ 'stdout' = ''; 'stderr' = $_; 'exitstatus' = 1 }
+              }
+              $resultJSON = $result | ConvertTo-JSON
+
+              # Encode JSON in Base64 and write to pipe
+              $encodedResult = [System.Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes($resultJSON))
+              $pipeWriter.WriteLine($encodedResult)
+              $pipeWriter.Flush()
+            }
+          EOF
+
+          utf8_script = script.encode('UTF-16LE', 'UTF-8')
+          base64_script = Base64.strict_encode64(utf8_script)
+          cmd = "powershell -NoProfile -ExecutionPolicy bypass -NonInteractive -EncodedCommand #{base64_script}"
+
+          server_pid = Process.create(command_line: cmd).process_id
+
+          # Ensure process is killed when the Train process exits
+          at_exit { Process.kill('KILL', server_pid) }
+        end
+      end
     end
   end
 end

test/windows/local_test.rb

@@ -40,6 +40,33 @@
     cmd.stderr.must_equal ''
   end
 
+  it 'uses a named pipe if available' do
+    # Must call `:conn` early so we can stub `SecureRandom`
+    connection = conn
+
+    SecureRandom.stubs(:hex).returns('with_pipe')
+    cmd = connection.run_command('Get-ChildItem //./pipe/ | Where-Object { $_.Name -Match "inspec_with_pipe" }')
+    cmd.stdout.wont_be_nil
+    cmd.stderr.must_equal ''
+  end
+
+  it 'when named pipe is not available it runs `Mixlib::Shellout`' do
+    # Must call `:conn` early so we can stub `:acquire_pipe`
+    connection = conn
+
+    # Prevent named pipe from being created
+    Train::Transports::Local::Connection::WindowsPipeRunner
+      .any_instance
+      .stubs(:acquire_pipe)
+      .returns(nil)
+
+    # Verify pipe was not created
+    SecureRandom.stubs(:hex).returns('minitest')
+    cmd = connection.run_command('Get-ChildItem //./pipe/ | Where-Object { $_.Name -Match "inspec_minitest" }')
+    cmd.stdout.must_equal ''
+    cmd.stderr.must_equal ''
+  end
+
   describe 'file' do
     before do
       @temp = Tempfile.new('foo')