mirror of
https://github.com/ansible-collections/community.general.git
synced 2025-07-23 21:30:22 -07:00
parent
d5ad3093d6
commit
51b595992b
11 changed files with 75 additions and 78 deletions
|
@ -17,14 +17,17 @@
|
|||
from __future__ import (absolute_import, division, print_function)
|
||||
__metaclass__ = type
|
||||
|
||||
|
||||
import multiprocessing
|
||||
import os
|
||||
import stat
|
||||
import tempfile
|
||||
import multiprocessing
|
||||
import time
|
||||
import warnings
|
||||
|
||||
from ansible import constants as C
|
||||
from ansible.errors import AnsibleError
|
||||
from ansible.module_utils._text import to_text, to_bytes
|
||||
|
||||
PASSLIB_AVAILABLE = False
|
||||
try:
|
||||
import passlib.hash
|
||||
|
@ -38,7 +41,7 @@ except ImportError:
|
|||
from ansible.utils.display import Display
|
||||
display = Display()
|
||||
|
||||
KEYCZAR_AVAILABLE=False
|
||||
KEYCZAR_AVAILABLE = False
|
||||
try:
|
||||
try:
|
||||
# some versions of pycrypto may not have this?
|
||||
|
@ -53,22 +56,18 @@ try:
|
|||
from keyczar.keys import AesKey
|
||||
except PowmInsecureWarning:
|
||||
display.system_warning(
|
||||
"The version of gmp you have installed has a known issue regarding " + \
|
||||
"timing vulnerabilities when used with pycrypto. " + \
|
||||
"The version of gmp you have installed has a known issue regarding "
|
||||
"timing vulnerabilities when used with pycrypto. "
|
||||
"If possible, you should update it (i.e. yum update gmp)."
|
||||
)
|
||||
warnings.resetwarnings()
|
||||
warnings.simplefilter("ignore")
|
||||
import keyczar.errors as key_errors
|
||||
from keyczar.keys import AesKey
|
||||
KEYCZAR_AVAILABLE=True
|
||||
KEYCZAR_AVAILABLE = True
|
||||
except ImportError:
|
||||
pass
|
||||
|
||||
from ansible import constants as C
|
||||
from ansible.errors import AnsibleError
|
||||
from ansible.module_utils._text import to_text, to_bytes
|
||||
|
||||
__all__ = ['do_encrypt']
|
||||
|
||||
_LOCK = multiprocessing.Lock()
|
||||
|
@ -100,6 +99,7 @@ def do_encrypt(result, encrypt, salt_size=None, salt=None):
|
|||
# impact calling code.
|
||||
return to_text(result, errors='strict')
|
||||
|
||||
|
||||
def key_for_hostname(hostname):
|
||||
# fireball mode is an implementation of ansible firing up zeromq via SSH
|
||||
# to use no persistent daemons or key management
|
||||
|
@ -129,11 +129,11 @@ def key_for_hostname(hostname):
|
|||
key_path = os.path.join(key_path, hostname)
|
||||
|
||||
# use new AES keys every 2 hours, which means fireball must not allow running for longer either
|
||||
if not os.path.exists(key_path) or (time.time() - os.path.getmtime(key_path) > 60*60*2):
|
||||
if not os.path.exists(key_path) or (time.time() - os.path.getmtime(key_path) > 60 * 60 * 2):
|
||||
# avoid race with multiple forks trying to create key
|
||||
# but limit when locking is needed to creation only
|
||||
with(_LOCK):
|
||||
if not os.path.exists(key_path) or (time.time() - os.path.getmtime(key_path) > 60*60*2):
|
||||
if not os.path.exists(key_path) or (time.time() - os.path.getmtime(key_path) > 60 * 60 * 2):
|
||||
key = AesKey.Generate()
|
||||
# use temp file to ensure file only appears once it has
|
||||
# desired contents and permissions
|
||||
|
@ -152,12 +152,13 @@ def key_for_hostname(hostname):
|
|||
fh.close()
|
||||
return key
|
||||
|
||||
|
||||
def keyczar_encrypt(key, msg):
|
||||
return key.Encrypt(msg.encode('utf-8'))
|
||||
|
||||
|
||||
def keyczar_decrypt(key, msg):
|
||||
try:
|
||||
return key.Decrypt(msg)
|
||||
except key_errors.InvalidSignatureError:
|
||||
raise AnsibleError("decryption failed")
|
||||
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue