관리-도구
편집 파일: __init__.cpython-39.pyc
a �)g0� � @ s� d dl mZmZmZ eZd dlZd dlZd dlZd dl Z d dl Z d dl Z d dl Z d dl Z d dlZd dlZd dlmZ d dlmZ d dlmZ dZdZz�e�� �( e�de� d dlmZ W d � n1 s�0 Y d d l m Z d d l m Z m Z d d l!m"Z" d d l#m$Z$ d d l%m&Z'm(Z(m)Z) e � ZdZW n e*�y> Y n0 d dl+m,Z,m-Z- d dl.m/Z0 d dl1m2Z2 d dl3m4Z4m5Z5m6Z6 d dl7m8Z8 d dl9m:Z:m;Z; e8� Z<dZ=e>d�Z?e>d�Z@dZAG dd� de,�ZBG dd� deB�ZCG d d � d e,�ZDd d � ZEdNd!d"�ZFdOd#d$�ZGdPd%d&�ZHdQd'd(�ZId)d*� ZJd+d,� ZKd-d.� ZLdRd/d0�ZMG d1d2� d2�ZNG d3d4� d4eN�ZOd5d6� ZPdSd7d8�ZQG d9d:� d:eN�ZRG d;d<� d<eR�ZSG d=d>� d>eS�ZTd?d@� ZUdAdB� ZVdTdCdD�ZWdUdEdF�ZXG dGdH� dH�ZYG dIdJ� dJ�ZZG dKdL� dL�Z[dMe[iZ\dS )V� )�absolute_import�division�print_functionN)�hexlify)� unhexlify)�ErrorF�ignore)�InvalidSignature)�default_backend)�hashes�padding)�HMAC)� PBKDF2HMAC)�Cipher� algorithms�modesT)� AnsibleError�AnsibleAssertionError)� constants)� binary_type)�to_bytes�to_text� to_native)�Display)� makedirs_safe� unfrackpaths $ANSIBLE_VAULT)�AES256zDansible-vault requires the cryptography library in order to functionc @ s e Zd ZdS )�AnsibleVaultErrorN��__name__� __module__� __qualname__� r" r" �B/usr/lib/python3.9/site-packages/ansible/parsing/vault/__init__.pyr J s r c @ s e Zd ZdS )�AnsibleVaultPasswordErrorNr r" r" r" r# r$ N s r$ c @ s e Zd ZdS )�AnsibleVaultFormatErrorNr r" r" r" r# r% R s r% c C sJ z t t| dddd�ddd�}W n ttfy6 Y dS 0 |�t�rFdS dS )z� Test if this is vault encrypted data blob :arg data: a byte or text string to test whether it is recognized as vault encrypted data :returns: True if it is recognized. Otherwise, False. �ascii�strict)�encoding�errors� nonstring)r( r) FT)r r � UnicodeError� TypeError� startswith�b_HEADER)�data�b_datar" r" r# � is_encryptedV s r1 ���c C s> | � � }z$| �|� t| �|��W | �|� S | �|� 0 dS )a Test if the contents of a file obj are a vault encrypted data blob. :arg file_obj: A file object that will be read from. :kwarg start_pos: A byte offset in the file to start reading the header from. Defaults to 0, the beginning of the file. :kwarg count: Read up to this number of bytes from the file to determine if it looks like encrypted vault data. The default is -1, read to the end of file. :returns: True if the file looks like a vault file. Otherwise, False. N)�tell�seekr1 �read)Zfile_objZ start_pos�countZcurrent_positionr" r" r# �is_encrypted_filel s �r7 c C st | � � }|d �� �d�}|d �� }t|d �� �}|}t|�dkrVt|d �� �}d�|dd � �}||||fS )Nr � ;� � � � � )� splitlines�strip�splitr �len�join)�b_vaulttext_envelope�default_vault_id� b_tmpdataZ b_tmpheader� b_version� cipher_name�vault_id� b_ciphertextr" r" r# �_parse_vaulttext_envelope� s rJ c C sh |pt j}z t| |�W S tyb } z4d}|r:|d| 7 }|d| 7 }t|��W Y d}~n d}~0 0 dS )a� Parse the vaulttext envelope When data is saved, it has a header prepended and is formatted into 80 character lines. This method extracts the information from the header and then removes the header and the inserted newlines. The string returned is suitable for processing by the Cipher classes. :arg b_vaulttext: byte str containing the data from a save file :kwarg default_vault_id: The vault_id name to use if the vaulttext does not provide one. :kwarg filename: The filename that the data came from. This is only used to make better error messages in case the data cannot be decrypted. This is optional. :returns: A tuple of byte str of the vaulttext suitable to pass to parse_vaultext, a byte str of the vault format version, the name of the cipher used, and the vault_id. :raises: AnsibleVaultFormatError: if the vaulttext_envelope format is invalid zVault envelope format error� in %s�: %sN)�CZDEFAULT_VAULT_IDENTITYrJ � Exceptionr% )rC rD �filename�exc�msgr" r" r# �parse_vaulttext_envelope� s rR c s� |s t d��|pd}|r$|dkr$d}t|ddd�}t|ddd�}t|ddd�}t||g}|dkrn|rn|�|� d �|�}|g} | � fd d �td t� �d �D �7 } | dg7 } d�| �} | S )a� Add header and format to 80 columns :arg b_ciphertext: the encrypted and hexlified data as a byte string :arg cipher_name: unicode cipher name (for ex, u'AES256') :arg version: unicode vault version (for ex, '1.2'). Optional ('1.1' is default) :arg vault_id: unicode vault identifier. If provided, the version will be bumped to 1.2. :returns: a byte str that should be dumped into a file. It's formatted to 80 char columns and has the header prepended z-the cipher must be set before adding a headerz1.1�defaultz1.2�utf-8r' �r) � 1.2r8 c s g | ]}� ||d � �qS )�P r" )�.0�i�rI r" r# � <listcomp>� r= z-format_vaulttext_envelope.<locals>.<listcomp>r rW r= � )r r r. �appendrB �rangerA ) rI rG �versionrH rF Z b_vault_idZ b_cipher_nameZ header_parts�header� b_vaulttextr" rZ r# �format_vaulttext_envelope� s( � " rb c C sD z t | �W S ttfy> } ztd| ��W Y d }~n d }~0 0 d S )Nz Vault format unhexlify error: %s)r � BinasciiErrorr, r% )r0 rP r" r" r# � _unhexlify� s rd c C s4 t | �} | �dd�\}}}t |�}t |�}|||fS )Nr\ r: )rd r@ )ra �b_salt�b_crypted_hmacrI r" r" r# �_parse_vaulttext� s rg c C sV z t | �W S ty � Y n4 tyP } z d| }t|��W Y d}~n d}~0 0 dS )aw Parse the vaulttext :arg b_vaulttext: byte str containing the vaulttext (ciphertext, salt, crypted_hmac) :returns: A tuple of byte str of the ciphertext suitable for passing to a Cipher class's decrypt() function, a byte str of the salt, and a byte str of the crypted_hmac :raises: AnsibleVaultFormatError: if the vaulttext format is invalid z Vault vaulttext format error: %sN)rg r% rN )ra rP rQ r" r" r# �parse_vaulttext� s rh c C s |pd}| st |��dS )z�Check the secret against minimal requirements. Raises: AnsibleVaultPasswordError if the password does not meet requirements. Currently, only requirement is that the password is not None or an empty string. z#Invalid vault password was providedN)r$ )�secretrQ r" r" r# �verify_secret_is_not_empty� s rj c @ s. e Zd ZdZd dd�Zedd� �Zdd� ZdS ) � VaultSecretzKOpaque/abstract objects for a single vault secret. ie, a password or a key.Nc C s || _ d S �N��_bytes)�selfrn r" r" r# �__init__ s zVaultSecret.__init__c C s | j S )z�The secret as a bytestring. Sub classes that store text types will need to override to encode the text to bytes. rm �ro r" r" r# �bytes s zVaultSecret.bytesc C s | j S rl rm rq r" r" r# �load s zVaultSecret.load)N)r r r! �__doc__rp �propertyrr rs r" r" r" r# rk s rk c sH e Zd ZdgZd � fdd� Zedd� �Zdd� Zd d � Zd d � Z � Z S )�PromptVaultSecretzVault password (%s): Nc s4 t t| �j|d� || _|d u r*| j| _n|| _d S )Nrm )�superrv rp rH �default_prompt_formats�prompt_formats)ro rn rH ry �� __class__r" r# rp ! s zPromptVaultSecret.__init__c C s | j S rl rm rq r" r" r# rr * s zPromptVaultSecret.bytesc C s | � � | _d S rl )�ask_vault_passwordsrn rq r" r" r# rs . s zPromptVaultSecret.loadc C s� g }| j D ]j}|d| ji }ztj|dd�}W n tyN td| j ��Y n0 t|� t|ddd��� }|� |� q |D ]}| � |d |� qz|r�|d S d S ) NrH T)Zprivatez$EOFError (ctrl-d) on prompt for (%s)r' Z simplerepr)r) r* r ) ry rH �display�prompt�EOFErrorr rj r r? r] �confirm)ro Zb_vault_passwordsZ prompt_formatr~ � vault_passZ b_vault_passZb_vault_passwordr" r" r# r| 1 s z%PromptVaultSecret.ask_vault_passwordsc C s ||krt d��d S )NzPasswords do not match)r )ro Zb_vault_pass_1Zb_vault_pass_2r" r" r# r� I s zPromptVaultSecret.confirm)NNN) r r r! rx rp ru rr rs r| r� � __classcell__r" r" rz r# rv s rv c C s" t j�| �\}}|�d�r dS dS )zWDetermine if a vault secret script is a client script that can be given --vault-id argsz-clientTF)�os�path�splitext�endswith)rO � script_name�dummyr" r" r# �script_is_clientQ s r� c C st t | dd�}tj�|�s$td| ��|�|�rft| �rXt�dt |� � t ||||d�S t |||d�S t |||d�S )zI Get secret from file content or execute file and get secret from stdout F)�followz(The vault password file %s was not foundz.The vault password file %s is a client script.)rO rH r( �loader�rO r( r� ) r r� r� �existsr � is_executabler� r} �vvvvr �ClientScriptVaultSecret�ScriptVaultSecret�FileVaultSecret)rO rH r( r� Z this_pathr" r" r# �get_file_vault_secret_ s r� c sB e Zd Zd � fdd� Zedd� �Zdd� Zdd � Zd d � Z� Z S ) r� Nc s4 t t| ��� || _|| _|p d| _d | _d | _d S )N�utf8)rw r� rp rO r� r( rn �_text)ro rO r( r� rz r" r# rp { s zFileVaultSecret.__init__c C s$ | j r | j S | jr | j�| j�S d S rl )rn r� �encoder( rq r" r" r# rr � s zFileVaultSecret.bytesc C s | � | j�| _d S rl )� _read_filerO rn rq r" r" r# rs � s zFileVaultSecret.loadc C s� z:t |d�� }|�� �� }W d � n1 s.0 Y W n8 ttfyr } z td||f ��W Y d}~n d}~0 0 | j�||�\}}|�d�}t|d| d� |S )z� Read a vault password from a file or if executable, execute the script and retrieve password from STDOUT �rbNz)Could not read vault password file %s: %s� z2Invalid vault password was provided from file (%s)�rQ ) �openr5 r? �OSError�IOErrorr r� Z_decrypt_if_vault_datarj )ro rO �fr� �eZ b_vault_datar� r" r" r# r� � s .& �zFileVaultSecret._read_filec C s$ | j rd| jj| j f S d| jj S )Nz%s(filename='%s')�%s())rO r{ r rq r" r" r# �__repr__� s zFileVaultSecret.__repr__)NNN) r r r! rp ru rr rs r� r� r� r" r" rz r# r� z s r� c @ s, e Zd Zdd� Zdd� Zdd� Zdd� Zd S ) r� c C s` | j �|�std| ��| �� }| �|�\}}}| �|||� |�d�}d| }t||d� |S )Nz/The vault password script %s was not executabler� z4Invalid vault password was provided from script (%s)r� )r� r� r �_build_command�_run�_check_resultsr? rj )ro rO �command�stdout�stderr�pr� Zempty_password_msgr" r" r# r� � s z ScriptVaultSecret._read_filec C sj zt j|t jd�}W n> tyR } z&d}|| j|f }t|��W Y d }~n d }~0 0 |�� \}}|||fS )N)r� zpProblem running vault password script %s (%s). If this is not a script, remove the executable bit from the file.�� subprocess�Popen�PIPEr� rO r Z communicate�ro r� r� r� Z msg_formatrQ r� r� r" r" r# r� � s zScriptVaultSecret._runc C s$ |j dkr td| j|j |f ��d S )Nr z3Vault password script %s returned non-zero (%s): %s)� returncoder rO �ro r� r� �popenr" r" r# r� � s �z ScriptVaultSecret._check_resultsc C s | j gS rl �rO rq r" r" r# r� � s z ScriptVaultSecret._build_commandN)r r r! r� r� r� r� r" r" r" r# r� � s r� c sB e Zd ZdZd � fdd� Zdd� Zdd� Zd d � Zd d � Z� Z S )r� r: Nc s: t t| �j|||d� || _t�dt|�t|�f � d S )Nr� z8Executing vault password client script: %s --vault-id %s)rw r� rp � _vault_idr} r� r )ro rO r( r� rH rz r" r# rp � s �z ClientScriptVaultSecret.__init__c C sn zt j|t jt jd�}W n> tyV } z&d}|| j|f }t|��W Y d }~n d }~0 0 |�� \}}|||fS )N)r� r� zwProblem running vault password client script %s (%s). If this is not a script, remove the executable bit from the file.r� r� r" r" r# r� � s � z ClientScriptVaultSecret._runc C sJ |j | jkr"td| j| j|f ��|j dkrFtd| j|j | j|f ��d S )NzIVault password client script %s did not find a secret for vault-id=%s: %sr z^Vault password client script %s returned non-zero (%s) when getting secret for vault-id=%s: %s)r� �VAULT_ID_UNKNOWN_RCr rO r� r� r" r" r# r� � s � �z&ClientScriptVaultSecret._check_resultsc C s" | j g}| jr |�d| jg� |S )Nz --vault-id)rO r� �extend)ro r� r" r" r# r� � s z&ClientScriptVaultSecret._build_commandc C s( | j r d| jj| j | jf S d| jj S )Nz %s(filename='%s', vault_id='%s')r� )rO r{ r r� rq r" r" r# r� � s �z ClientScriptVaultSecret.__repr__)NNNN) r r r! r� rp r� r� r� r� r� r" r" rz r# r� � s r� c s | sg S � fdd�| D �}|S )zVFind all VaultSecret objects that are mapped to any of the target_vault_ids in secretsc s g | ]\}}|� v r||f�qS r" r" )rX rH ri ��target_vault_idsr" r# r[ r= z!match_secrets.<locals>.<listcomp>r" ��secretsr� �matchesr" r� r# � match_secrets s r� c C s t | |�}|r|d S dS )z�Find the best secret from secrets that matches target_vault_ids Since secrets should be ordered so the early secrets are 'better' than later ones, this just finds all the matches, then returns the first secretr N)r� r� r" r" r# �match_best_secret s r� c C sX t �dt|� � |d u r"td��|g}t| |�}|r:|S td|dd� | D �f ��d S )N�encrypt_vault_id=%szBmatch_encrypt_vault_id_secret requires a non None encrypt_vault_idzHDid not find a match for --encrypt-vault-id=%s in the known vault-ids %sc S s g | ] \}}|�qS r" r" )rX Z_vZ_vsr" r" r# r[ , r= z1match_encrypt_vault_id_secret.<locals>.<listcomp>)r} r� r r r� r )r� �encrypt_vault_idZencrypt_vault_id_matchersZencrypt_secretr" r" r# � match_encrypt_vault_id_secret s �r� c C s> t �dt|� � |r"t| |d�S dd� | D �}t| |�}|S )z@Find the best/first/only secret in secrets to use for encryptingr� )r� c S s g | ] \}}|�qS r" r" )rX r� r� r" r" r# r[ : r= z(match_encrypt_secret.<locals>.<listcomp>)r} r� r r� r� )r� r� Z_vault_id_matchersZ best_secretr" r" r# �match_encrypt_secret/ s � r� c @ s@ e Zd Zd dd�Zedd� �Zd dd�Zddd �Zdd d �ZdS )�VaultLibNc C s |pg | _ d | _d| _d S )NrV )r� rG rF )ro r� r" r" r# rp B s zVaultLib.__init__c C s t | �S rl )r1 )� vaulttextr" r" r# r1 G s zVaultLib.is_encryptedc C s� |du r&| j r t| j �\}}ntd��t|dd�}t|�rBtd��| jrR| jtvrXd| _zt| j � }W n" t y� td� | j���Y n0 |r�t � dt |�t |�f � nt � d t |� � |�|||�}t|| j|d �} | S ) a� Vault encrypt a piece of data. :arg plaintext: a text or byte string to encrypt. :returns: a utf-8 encoded byte str of encrypted data. The string contains a header identifying this as vault encrypted data and formatted to newline terminated lines of 80 characters. This is suitable for dumping as is to a vault file. If the string passed in is a text string, it will be encoded to UTF-8 before encryption. Nz2A vault password must be specified to encrypt data�surrogate_or_strictrU zinput is already encryptedr � {0} cipher could not be foundz1Encrypting with vault_id "%s" and vault secret %sz3Encrypting without a vault_id using vault secret %s�rH )r� r� r r r1 r rG �CIPHER_WRITE_WHITELIST�CIPHER_MAPPING�KeyError�formatr} �vvvvvr �encryptrb ) ro � plaintextri rH �saltr� � b_plaintext� this_cipherrI ra r" r" r# r� K s, �zVaultLib.encryptc C s | j |||d�\}}}|S )a� Decrypt a piece of vault encrypted data. :arg vaulttext: a string to decrypt. Since vault encrypted data is an ascii text format this can be either a byte str or unicode string. :kwarg filename: a filename that the data came from. This is only used to make better error messages in case the data cannot be decrypted. :returns: a byte string containing the decrypted data and the vault-id that was used )rO �obj)�decrypt_and_get_vault_id)ro r� rO r� r� rH � vault_secretr" r" r# �decrypty s zVaultLib.decryptc s� t |ddd�}| jdu r td��t|�sHd}|r@|dt|� 7 }t|��t||d�\}}}� |tv rpt| � }ntd � |���d} | js�td ��g } d} d} � r�t � d t � � � | � � � t| j| �} | r�t � d t � �t |�f � nt � d t � � � tj�s | �� fdd�| jD �� t| j| �}|D �]V\}}t � dt |�t |�t |�f � zvt �dt |�t |�f � |�||�} | du�r�|} |} d}|�r�d| }t � dt |�t |�t |�f � W �q�W n� t�y2 } zL||_d}|�r�|dt |� 7 }|dt |� 7 }t j|dd� � W Y d}~nXd}~0 t�y� } z6t �dt |�t |�|f � W Y d}~�q,W Y d}~n d}~0 0 �q,d}|�r�|d t|� 7 }t|��| du �r�d }|�r�|d t|� 7 }t|��| | | fS ) a� Decrypt a piece of vault encrypted data. :arg vaulttext: a string to decrypt. Since vault encrypted data is an ascii text format this can be either a byte str or unicode string. :kwarg filename: a filename that the data came from. This is only used to make better error messages in case the data cannot be decrypted. :returns: a byte string containing the decrypted data and the vault-id vault-secret that was used r' rT )r) r( Nz2A vault password must be specified to decrypt dataz#input is not vault encrypted data. z %s is not a vault encrypted filer� r� z0Attempting to decrypt but no vault secrets foundz&Found a vault_id (%s) in the vaulttextzMWe have a secret associated with vault id (%s), will try to use to decrypt %sz\Found a vault_id (%s) in the vault text, but we do not have a associated secret (--vault-id)c s g | ]\}}|� kr|�qS r" r" )rX r� �_dummyr� r" r# r[ � r= z5VaultLib.decrypt_and_get_vault_id.<locals>.<listcomp>z3Trying to use vault secret=(%s) id=%s to decrypt %sz Trying secret %s for vault_id=%s� z of "%s"z3Decrypt%s successful with secret=%s and vault_id=%sz There was a vault format errorrK rL T)� formattedzKTried to use the vault secret (%s) to decrypt (%s) but it failed. Error: %szBDecryption failed (no vault secrets were found that could decrypt)z on %szDecryption failed)r r� r r1 r r rR �CIPHER_WHITELISTr� r� r} r� r r] r� rM ZDEFAULT_VAULT_ID_MATCHr� r� r� r% r� �warning)ro r� rO r� ra rQ r� rG r� r� Zvault_id_matchers� vault_id_used�vault_secret_usedZ_matchesZmatched_secretsZvault_secret_idr� Z file_slugrP r� r" r� r# r� � s� � �( z!VaultLib.decrypt_and_get_vault_id)N)NNN)NN)NN) r r r! rp � staticmethodr1 r� r� r� r" r" r" r# r� A s . r� c @ s� e Zd Zd%dd�Zdd� Zdd� Zd&d d �Zd d � Zd'd d�Zd(dd�Z d)dd�Z d*dd�Z dd� Z dd� Z d+dd�Zdd � Zd,d d �Zd!d"� Zd#d$� ZdS )-� VaultEditorNc C s |pt � | _d S rl )r� �vault)ro r� r" r" r# rp � s zVaultEditor.__init__c C s� t j�|�}|dkr�td|�}d}t|d���}t|�D ]z}|�dd� t�|d |�}t � |�}td|| �D ]}|� |� qn|� |d|| � � |� � |kr�t � �t � |� q6W d � n1 s�0 Y dS )ar "Destroy a file, when shred (core-utils) is not available Unix `shred' destroys files "so that they can be recovered only with great difficulty with specialised hardware, if at all". It is based on the method from the paper "Secure Deletion of Data from Magnetic and Solid-State Memory", Proceedings of the Sixth USENIX Security Symposium (San Jose, California, July 22-25, 1996). We do not go to that length to re-implement shred in Python; instead, overwriting with a block of random data should suffice. See https://github.com/ansible/ansible/pull/13700 . r i r< �wbr: N)r� r� �getsize�minr� r^ r4 �randomZrandint�urandom�writer3 r �fsync) ro �tmp_pathZfile_lenZ max_chunk_lenZpasses�fh�_Z chunk_lenr/ r" r" r# �_shred_file_custom� s z VaultEditor._shred_file_customc C s^ t j�|�sdS zt�d|g�}W n ttfy< d}Y n0 |dkrP| �|� t �|� dS )aj Securely destroy a decrypted file Note standard limitations of GNU shred apply (For flash, overwriting would have no effect due to wear leveling; for other storage systems, the async kernel->filesystem->disk calls never guarantee data hits the disk; etc). Furthermore, if your tmp dirs is on tmpfs (ramdisks), it is a non-issue. Nevertheless, some form of overwriting the data (instead of just removing the fs index entry) is a good idea. If shred is not available (e.g. on windows, or no core-utils installed), fall back on a custom shredding method. N�shredr9 r ) r� r� �isfiler� �callr� � ValueErrorr� �remove)ro r� �rr" r" r# � _shred_file# s zVaultEditor._shred_fileFc C sR t j�t j�|��\}}tj|tjd�\}} | �| �} zFz|rN| j ||dd� W n t yn | � | � � Y n0 W t � |� n t � |� 0 zt �| � W nH t y� } z0| � | � tdd�| �t| �f ��W Y d } ~ n d } ~ 0 0 | �| �} |s�|| k�rD| jj| ||d�} | � | | � | �| |� t�dt|�t|�t|�f � | � | � d S )N)�suffix�dirF�r� z&Unable to execute the command "%s": %s� r� z<Saved edited file "%s" encrypted using %s and vault id "%s")r� r� r� �realpath�tempfileZmkstemprM ZDEFAULT_LOCAL_TMP�_editor_shell_command� write_datarN r� �closer� r� r rB r � read_datar� r� � shuffle_filesr} r� r )ro rO ri � existing_data� force_saverH �root�ext�fdr� �cmdr� rE rI r" r" r# �_edit_file_helperD s, 0 z VaultEditor._edit_file_helperc C s |dkr |S t j�|�}|S )N�-)r� r� r� )ro rO Z real_pathr" r" r# � _real_patho s zVaultEditor._real_pathc C s | j j|||d�}|S �Nr� )r� r� )ro r� ri rH rI r" r" r# � encrypt_bytesw s zVaultEditor.encrypt_bytesc C s: | � |�}| �|�}| jj|||d�}| �||p2|� d S r )r r� r� r� r� )ro rO ri rH � output_filer� rI r" r" r# � encrypt_file} s zVaultEditor.encrypt_filec C s~ | � |�}| �|�}z| jj||d�}W n< tyd } z$tdt|�t|�f ��W Y d }~n d }~0 0 | j||pr|dd� d S )Nr� � %s for %sFr� )r r� r� r� r r r� )ro rO r Z ciphertextr� r� r" r" r# � decrypt_file� s .zVaultEditor.decrypt_filec C sb t j�|�}|r6t j�|�s6t�dt|� � t|� t j�|�rNt d| ��| j |||d� dS )z create a new encrypted file z %s does not exist, creating...z$%s exists, please use 'edit' insteadr� N) r� r� �dirnamer� r} r� r r r� r r )ro rO ri rH r r" r" r# � create_file� s zVaultEditor.create_filec C s� d }d }| � |�}| �|�}t|�}z| j�|�\}}}W n< tyv } z$tdt|�t|�f ��W Y d }~n d }~0 0 t||d�\}}} } | tv} | j |||| | d� d S )Nr r� )r� r� rH ) r r� r r� r� r r rR r� r ) ro rO r� r� ra r� r� r� r� rG rH r� r" r" r# � edit_file� s .zVaultEditor.edit_filec C sj | � |�}t|�}z| jj||d�}|W S tyd } z$tdt|�t|�f ��W Y d }~n d }~0 0 d S )Nr� r )r� r r� r� r r r )ro rO ra r� r� r� r" r" r# r� � s zVaultEditor.plaintextc C s | � |�}t�|�}| �|�}t|�}t�dt|�t|�t|�f � z| j�|�\}}} W n< t y� } z$t dt | �t |�f ��W Y d } ~ n d } ~ 0 0 |d u r�t d| ��t i d�} | j |||d�} | � | |� t�||j� t�||j|j� t�dt|�t|�t|�t|�f � d S )Nz@Rekeying file "%s" to with new vault-id "%s" and vault secret %sr z<The value for the new_password to rekey %s with is not valid)r� r� ziRekeyed file "%s" (decrypted with vault id "%s") was encrypted with new vault-id "%s" and vault secret %s)r r� �statr� r r} r� r� r� r r r� r� r� �chmod�st_mode�chown�st_uid�st_gid) ro rO Znew_vault_secretZ new_vault_id�prevra r� r� r� r� r� Z new_vaultZb_new_vaulttextr" r" r# � rekey_file� s* �. �zVaultEditor.rekey_filec C s� zL|dkrt jj�� }n2t|d��}|�� }W d � n1 s@0 Y W nL ty� } z4t|�}|spt|�}tdt|�|f ��W Y d }~n d }~0 0 |S )Nr r� z#Unable to read source file (%s): %s) �sys�stdin�bufferr5 r� rN r �reprr )ro rO r/ r� r� rQ r" r" r# r� � s **zVaultEditor.read_dataT� c C s� t |dd�}d}z t|t�o,t�|tj�dk}W n tyB Y n0 |rdt�|d� t�||� �n^|dkr�t t j dt j �}|�|� �n8tj � |�r�|r�| �|� n t�|� t�d�}z�z&t�|tjtjB tjB tjB |�} W nT t�y6 } z:| jtjk�rtd t| � ��td t| � ��W Y d } ~ n d } ~ 0 0 zbz t�| d� t�| |� W n6 t�y� } z td t| � ��W Y d } ~ n d } ~ 0 0 W t�| � n t�| � 0 W t�|� n t�|� 0 d S ) a) Write the data bytes to given path This is used to write a byte string to a file or stdout. It is used for writing the results of vault encryption or decryption. It is used for saving the ciphertext after encryption and it is also used for saving the plaintext after decrypting a vault. The type of the 'data' arg should be bytes, since in the plaintext case, the original contents can be of any text encoding or arbitrary binary data. When used to write the result of vault encryption, the val of the 'data' arg should be a utf-8 encoded byte string and not a text typ and not a text type.. When used to write the result of vault decryption, the val of the 'data' arg should be a byte string and not a text type. :arg data: the byte string (bytes) data :arg thefile: file descriptor or filename to save 'data' to. :arg shred: if shred==True, make sure that the original data is first shredded so that is cannot be recovered. :returns: None r' rU Fr2 r r r �? z:Vault file got recreated while we were operating on it: %sz)Problem creating temporary vault file: %sNz+Unable to write to temporary vault file: %s) r � isinstance�int�fcntlZF_GETFDrN r� � ftruncater� �getattrr r� r� r� r� r� �umaskr� �O_CREAT�O_EXCL�O_RDWR�O_TRUNCr� �errnoZEEXISTr r r� ) ro r/ �thefiler� �modeZ b_file_dataZis_fd�outputZ current_umaskr� Zoser� r" r" r# r� s> && (zVaultEditor.write_datac C s\ d }t j�|�r$t �|�}t �|� t�||� |d urXt �||j� t � ||j |j � d S rl ) r� r� r� r r� �shutil�mover r r r r )ro �src�destr r" r" r# r� V s zVaultEditor.shuffle_filesc C s& t j�dd�}t�|�}|�|� |S )NZEDITOR�vi)r� �environ�get�shlexr@ r] )ro rO Z env_editorZeditorr" r" r# r� e s z!VaultEditor._editor_shell_command)N)NFN)N)NN)N)N)N)Tr )r r r! rp r� r� r r r r r r r r� r r� r� r� r� r" r" r" r# r� � s %! + ( Mr� c @ sn e Zd ZdZdd� Zedd� �Zedd� �Zedd � �Z edd d ��Z ed d� �Z edd� �Z edd� �Z d S )� VaultAES256zw Vault implementation using AES-CTR with an HMAC-SHA256 authentication code. Keys are derived using PBKDF2 c C s t s tt��d S rl )�HAS_CRYPTOGRAPHYr �NEED_CRYPTO_LIBRARYrq r" r" r# rp | s zVaultAES256.__init__c C s, t t�� d| | |dtd�}|�| �}|S )Nr: i' )� algorithm�lengthr� Z iterationsZbackend)r r �SHA256�CRYPTOGRAPHY_BACKENDZderive)� b_passwordre � key_length� iv_lengthZkdf� b_derivedkeyr" r" r# �_create_key_cryptography� s � z$VaultAES256._create_key_cryptographyc C sp d}t r>tjjd }| �||||�}||d |d | � }n ttd ��|d |� }|||d � }|||fS )N� � r: z(Detected in initctr))r1 r �AES� block_sizer; r r2 ) �clsr7 re r8 r9 r: �b_iv�b_key1�b_key2r" r" r# �_gen_key_initctr� s z VaultAES256._gen_key_initctrc C s� t t�|�t�|�t�}|�� }t�tjj �� � }|� |� | �|� � �}||� � 7 }t |t�� t�}|� |� |� � } tt| �dd�t|�fS )Nr� rU )�C_Cipherr r> r �CTRr6 � encryptorr �PKCS7r? �padder�update�finalizer r r5 r r ) r� rB rC rA �cipherrG rI rI �hmac�b_hmacr" r" r# �_encrypt_cryptography� s z!VaultAES256._encrypt_cryptographyNc C s� |d u rt d��|d u r$t�d�}n|s2t d��nt|�}|j}| �||�\}}}trl| �||||�\} } n tt d ��d� t |�| | g�} t | �} | S )Nz'The secret passed to encrypt() was Noner< z)Empty or invalid salt passed to encrypt()z(Detected in encrypt)r\ ) r r� r� r rr rD r1 rO r r2 rB r ) r@ r� ri r� re r7 rB rC rA rN rI ra r" r" r# r� � s zVaultAES256.encryptc C s� t |t�� t�}|�|� z|�t|�� W n0 ty\ } ztd| ��W Y d }~n d }~0 0 t t � |�t � |�t�}|�� } t�d��� } | �| �|�| �� �| �� } | S )Nz HMAC verification failed: %s� )r r r5 r6 rJ Zverifyrd r r rE r r> r rF � decryptorr rH �unpadderrK ) r@ rI rf rB rC rA rM r� rL rQ rR r� r" r" r# �_decrypt_cryptography� s "��z!VaultAES256._decrypt_cryptographyc C s\ t | t�rt |t�s td��t| �t|�kr0dS d}t| |�D ]\}}|||A O }q>|dkS )z� Comparing 2 byte arrays in constant time to avoid timing attacks. It would be nice if there were a library for this but hey. z6_is_equal can only be used to compare two byte stringsFr )r r r, rA �zip)Zb_aZb_b�result�b_xZb_yr" r" r# � _is_equal� s zVaultAES256._is_equalc C sN t |�\}}}|j}| �||�\}}} tr>| �||||| �} n ttd ��| S )Nz(Detected in decrypt))rh rr rD r1 rS r r2 ) r@ ra ri rI re rf r7 rB rC rA r� r" r" r# r� � s zVaultAES256.decrypt)N)r r r! rt rp r� r; � classmethodrD rO r� rS rW r� r" r" r" r# r0 q s r0 r )r r2 )N)NN)NN)N)NNNN)N)N)]Z __future__r r r �typeZ __metaclass__r$ r r� r� r/ r( r� r r� �warningsZbinasciir r r rc r1 r6 �catch_warnings� simplefilter�DeprecationWarningZcryptography.exceptionsr Z cryptography.hazmat.backendsr Z cryptography.hazmat.primitivesr r Z#cryptography.hazmat.primitives.hmacr Z)cryptography.hazmat.primitives.kdf.pbkdf2r Z&cryptography.hazmat.primitives.ciphersr rE r r � ImportErrorZansible.errorsr r Zansibler rM Zansible.module_utils.sixr Zansible.module_utils._textr r r Zansible.utils.displayr Zansible.utils.pathr r r} r. � frozensetr� r� r2 r r$ r% r1 r7 rJ rR rb rd rg rh rj rk rv r� r� r� r� r� r� r� r� r� r� r� r0 r� r" r" r" r# �<module> s� * ) 3 3)0 7 | �