mirror of
https://github.com/ansible-collections/community.general.git
synced 2025-07-24 05:40:23 -07:00
Use vault_id when encrypted via vault-edit (#30772)
* Use vault_id when encrypted via vault-edit On the encryption stage of 'ansible-vault edit --vault-id=someid@passfile somefile', the vault id was not being passed to encrypt() so the files were always saved with the default vault id in the 1.1 version format. When trying to edit that file a second time, also with a --vault-id, the file would be decrypted with the secret associated with the provided vault-id, but since the encrypted file had no vault id in the envelope there would be no match for 'default' secrets. (Only the --vault-id was included in the potential matches, so the vault id actually used to decrypt was not). If that list was empty, there would be an IndexError when trying to encrypted the changed file. This would result in the displayed error: ERROR! Unexpected Exception, this is probably a bug: list index out of range Fix is two parts: 1) use the vault id when encrypting from edit 2) when matching the secret to use for encrypting after edit, include the vault id that was used for decryption and not just the vault id (or lack of vault id) from the envelope. add unit tests for #30575 and intg tests for 'ansible-vault edit' Fixes #30575
This commit is contained in:
parent
4c21563ac6
commit
a14d0f3586
4 changed files with 139 additions and 8 deletions
44
test/integration/targets/vault/faux-editor.py
Executable file
44
test/integration/targets/vault/faux-editor.py
Executable file
|
@ -0,0 +1,44 @@
|
|||
#!/usr/bin/env python
|
||||
#
|
||||
# Ansible is free software: you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation, either version 3 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# Ansible is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with Ansible. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
# ansible-vault is a script that encrypts/decrypts YAML files. See
|
||||
# http://docs.ansible.com/playbooks_vault.html for more details.
|
||||
|
||||
from __future__ import (absolute_import, division, print_function)
|
||||
__metaclass__ = type
|
||||
|
||||
import sys
|
||||
import time
|
||||
import os
|
||||
|
||||
|
||||
def main(args):
|
||||
path = os.path.abspath(args[1])
|
||||
|
||||
fo = open(path, 'r+')
|
||||
|
||||
content = fo.readlines()
|
||||
|
||||
content.append('faux editor added at %s\n' % time.time())
|
||||
|
||||
fo.seek(0)
|
||||
fo.write(''.join(content))
|
||||
fo.close()
|
||||
|
||||
return 0
|
||||
|
||||
|
||||
if __name__ == '__main__':
|
||||
sys.exit(main(sys.argv[:]))
|
|
@ -14,7 +14,14 @@ echo "This is a test file for format 1.2" > "${TEST_FILE_1_2}"
|
|||
|
||||
TEST_FILE_OUTPUT="${MYTMPDIR}/test_file_output"
|
||||
|
||||
TEST_FILE_EDIT="${MYTMPDIR}/test_file_edit"
|
||||
echo "This is a test file for edit" > "${TEST_FILE_EDIT}"
|
||||
|
||||
TEST_FILE_EDIT2="${MYTMPDIR}/test_file_edit2"
|
||||
echo "This is a test file for edit2" > "${TEST_FILE_EDIT2}"
|
||||
|
||||
FORMAT_1_1_HEADER="\$ANSIBLE_VAULT;1.1;AES256"
|
||||
FORMAT_1_2_HEADER="\$ANSIBLE_VAULT;1.2;AES256"
|
||||
|
||||
# old format
|
||||
ansible-vault view "$@" --vault-password-file vault-password-ansible format_1_0_AES.yml
|
||||
|
@ -234,6 +241,27 @@ ansible-vault encrypt_string "$@" --vault-password-file "${NEW_VAULT_PASSWORD}"
|
|||
# write to file
|
||||
ansible-vault encrypt_string "$@" --vault-password-file "${NEW_VAULT_PASSWORD}" --name "blippy" "a test string names blippy" --output "${MYTMPDIR}/enc_string_test_file"
|
||||
|
||||
# test ansible-vault edit with a faux editor
|
||||
ansible-vault encrypt "$@" --vault-password-file vault-password "${TEST_FILE_EDIT}"
|
||||
|
||||
# edit a 1.1 format with no vault-id, should stay 1.1
|
||||
EDITOR=./faux-editor.py ansible-vault edit "$@" --vault-password-file vault-password "${TEST_FILE_EDIT}"
|
||||
head -1 "${TEST_FILE_EDIT}" | grep "${FORMAT_1_1_HEADER}"
|
||||
|
||||
# edit a 1.1 format with vault-id, should stay 1.1
|
||||
EDITOR=./faux-editor.py ansible-vault edit "$@" --vault-id vault_password@vault-password "${TEST_FILE_EDIT}"
|
||||
head -1 "${TEST_FILE_EDIT}" | grep "${FORMAT_1_1_HEADER}"
|
||||
|
||||
ansible-vault encrypt "$@" --vault-id vault_password@vault-password "${TEST_FILE_EDIT2}"
|
||||
|
||||
# edit a 1.2 format with vault id, should keep vault id and 1.2 format
|
||||
EDITOR=./faux-editor.py ansible-vault edit "$@" --vault-id vault_password@vault-password "${TEST_FILE_EDIT2}"
|
||||
head -1 "${TEST_FILE_EDIT2}" | grep "${FORMAT_1_2_HEADER};vault_password"
|
||||
|
||||
# edit a 1.2 file with no vault-id, should keep vault id and 1.2 format
|
||||
EDITOR=./faux-editor.py ansible-vault edit "$@" --vault-password-file vault-password "${TEST_FILE_EDIT2}"
|
||||
head -1 "${TEST_FILE_EDIT2}" | grep "${FORMAT_1_2_HEADER};vault_password"
|
||||
|
||||
|
||||
# test playbooks using vaulted files
|
||||
ansible-playbook test_vault.yml -i ../../inventory -v "$@" --vault-password-file vault-password --list-tasks
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue