mirror of https://github.com/ansible/ansible.git
The very first start of 'fireball mode', which uses ansible in SSH mode to deploy a ephemeral zeromq daemon (entirely optional) that is will die after
it is no longer used. No key signing will be required. At this point, development use only -- NOT complete.pull/1105/head
Michael DeHaan
12 years ago
parent
af8f11e3f7
commit
69612ba16d
@ -0,0 +1,129 @@
|
||||
# (c) 2012, Michael DeHaan <michael.dehaan@gmail.com>
|
||||
#
|
||||
# This file is part of Ansible
|
||||
#
|
||||
# Ansible is free software: you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation, either version 3 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# Ansible is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with Ansible. If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
import json
|
||||
import os
|
||||
from ansible.callbacks import vvv
|
||||
from ansible import utils
|
||||
from ansible import errors
|
||||
from ansible import constants
|
||||
|
||||
HAVE_ZMQ=False
|
||||
|
||||
try:
|
||||
import zmq
|
||||
HAVE_ZMQ=True
|
||||
except ImportError:
|
||||
pass
|
||||
|
||||
class Connection(object):
|
||||
''' SSH based connections with Paramiko '''
|
||||
|
||||
def __init__(self, runner, host, port=None):
|
||||
|
||||
self.runner = runner
|
||||
|
||||
# attempt to work around shared-memory funness
|
||||
if getattr(self.runner, 'aes_keys', None):
|
||||
utils.AES_KEYS = self.runner.aes_keys
|
||||
|
||||
self.host = host
|
||||
self.key = utils.key_for_hostname(host)
|
||||
self.socket = None
|
||||
# port passed in is the SSH port, which we ignore
|
||||
self.port = constants.ZEROMQ_PORT
|
||||
|
||||
def connect(self):
|
||||
''' activates the connection object '''
|
||||
|
||||
if not HAVE_ZMQ:
|
||||
raise errors.AnsibleError("zmq is not installed")
|
||||
|
||||
# this is rough/temporary and will likely be optimized later ...
|
||||
context = zmq.Context()
|
||||
socket = context.socket(zmq.REQ)
|
||||
addr = "tcp://%s:%s" % (self.host, self.port)
|
||||
socket.connect(addr)
|
||||
self.socket = socket
|
||||
|
||||
return self
|
||||
|
||||
def exec_command(self, cmd, tmp_path, sudo_user, sudoable=False):
|
||||
''' run a command on the remote host '''
|
||||
|
||||
vvv("EXEC COMMAND %s" % cmd)
|
||||
|
||||
if self.runner.sudo and sudoable:
|
||||
raise errors.AnsibleError("fireball does not use sudo, but runs as whoever it was initiated as. (That itself is where to use sudo).")
|
||||
|
||||
data = dict(
|
||||
mode='command',
|
||||
cmd=cmd,
|
||||
tmp_path=tmp_path,
|
||||
)
|
||||
data = utils.jsonify(data)
|
||||
data = utils.encrypt(self.key, data)
|
||||
self.socket.send(data)
|
||||
|
||||
response = self.socket.recv()
|
||||
response = utils.decrypt(self.key, response)
|
||||
response = utils.parse_json(response)
|
||||
|
||||
return ('', response.get('stdout',''), response.get('stderr',''))
|
||||
|
||||
def put_file(self, in_path, out_path):
|
||||
|
||||
''' transfer a file from local to remote '''
|
||||
vvv("PUT %s TO %s" % (in_path, out_path), host=self.host)
|
||||
|
||||
if not os.path.exists(in_path):
|
||||
raise errors.AnsibleFileNotFound("file or module does not exist: %s" % in_path)
|
||||
data = file(in_path).read()
|
||||
|
||||
data = dict(mode='put', data=data, out_path=out_path)
|
||||
data = utils.jsonify(data)
|
||||
data = utils.encrypt(self.key, data)
|
||||
self.socket.send(data)
|
||||
|
||||
response = self.socket.recv()
|
||||
response = utils.decrypt(self.key, response)
|
||||
response = utils.parse_json(response)
|
||||
|
||||
# no meaningful response needed for this
|
||||
|
||||
def fetch_file(self, in_path, out_path):
|
||||
''' save a remote file to the specified path '''
|
||||
vvv("FETCH %s TO %s" % (in_path, out_path), host=self.host)
|
||||
|
||||
data = dict(mode='fetch', file=in_path)
|
||||
data = utils.jsonify(data)
|
||||
data = utils.encrypt(self.key, data)
|
||||
self.socket.send(data)
|
||||
|
||||
response = self.socket.recv()
|
||||
response = utils.decrypt(self.key, response)
|
||||
response = utils.parse_json(response)
|
||||
response = response['data']
|
||||
|
||||
fh = open(out_path, "w")
|
||||
fh.write(response)
|
||||
fh.close()
|
||||
|
||||
def close(self):
|
||||
''' terminate the connection '''
|
||||
# no need for this
|
||||
|
||||
@ -0,0 +1,216 @@
|
||||
#!/usr/bin/python
|
||||
# -*- coding: utf-8 -*-
|
||||
|
||||
# (c) 2012, Michael DeHaan <michael.dehaan@gmail.com>
|
||||
#
|
||||
# This file is part of Ansible
|
||||
#
|
||||
# Ansible is free software: you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation, either version 3 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# Ansible is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with Ansible. If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
import os
|
||||
import sys
|
||||
import shutil
|
||||
import time
|
||||
import base64
|
||||
import syslog
|
||||
import signal
|
||||
import subprocess
|
||||
|
||||
syslog.openlog('ansible-%s' % os.path.basename(__file__))
|
||||
PIDFILE = os.path.expanduser("~/.fireball.pid")
|
||||
|
||||
def log(msg):
|
||||
syslog.syslog(syslog.LOG_NOTICE, msg)
|
||||
|
||||
if os.path.exists(PIDFILE):
|
||||
try:
|
||||
data = int(open(PIDFILE).read())
|
||||
try:
|
||||
os.kill(data, signal.SIGKILL)
|
||||
except OSError:
|
||||
pass
|
||||
except ValueError:
|
||||
pass
|
||||
os.unlink(PIDFILE)
|
||||
|
||||
HAS_ZMQ = False
|
||||
try:
|
||||
import zmq
|
||||
HAS_ZMQ = True
|
||||
except ImportError:
|
||||
pass
|
||||
|
||||
HAS_KEYCZAR = False
|
||||
try:
|
||||
from keyczar.keys import AesKey
|
||||
HAS_KEYCZAR = True
|
||||
except ImportError:
|
||||
pass
|
||||
|
||||
# NOTE: this shares a fair amount of code in common with async_wrapper, if async_wrapper were a new module we could move
|
||||
# this into utils.module_common and probably should anyway
|
||||
|
||||
def daemonize_self(module, password, port, minutes):
|
||||
# daemonizing code: http://aspn.activestate.com/ASPN/Cookbook/Python/Recipe/66012
|
||||
try:
|
||||
pid = os.fork()
|
||||
if pid > 0:
|
||||
log("exiting pid %s" % pid)
|
||||
# exit first parent
|
||||
module.exit_json(msg="daemonzed fireball on port %s for %s minutes" % (port, minutes))
|
||||
except OSError, e:
|
||||
log("fork #1 failed: %d (%s)" % (e.errno, e.strerror))
|
||||
sys.exit(1)
|
||||
|
||||
# decouple from parent environment
|
||||
os.chdir("/")
|
||||
os.setsid()
|
||||
os.umask(022)
|
||||
|
||||
# do second fork
|
||||
try:
|
||||
pid = os.fork()
|
||||
if pid > 0:
|
||||
log("daemon pid %s, writing %s" % (pid, PIDFILE))
|
||||
pid_file = open(PIDFILE, "w")
|
||||
pid_file.write("%s" % pid)
|
||||
pid_file.close()
|
||||
log("pidfile written")
|
||||
sys.exit(0)
|
||||
except OSError, e:
|
||||
log("fork #2 failed: %d (%s)" % (e.errno, e.strerror))
|
||||
sys.exit(1)
|
||||
|
||||
dev_null = file('/dev/null','rw')
|
||||
os.dup2(dev_null.fileno(), sys.stdin.fileno())
|
||||
os.dup2(dev_null.fileno(), sys.stdout.fileno())
|
||||
os.dup2(dev_null.fileno(), sys.stderr.fileno())
|
||||
log("daemonizing successful (%s,%s)" % (password, port))
|
||||
|
||||
def command(data):
|
||||
if 'cmd' not in data:
|
||||
return dict(failed=True, msg='internal error: cmd is required')
|
||||
if 'tmp_path' not in data:
|
||||
return dict(failed=True, msg='internal error: tmp_path is required')
|
||||
|
||||
log("executing: %s" % data['cmd'])
|
||||
p = subprocess.Popen(data['cmd'], shell=True, stdout=subprocess.PIPE)
|
||||
(stdout, stderr) = p.communicate()
|
||||
if stdout is None:
|
||||
stdout = ''
|
||||
if stderr is None:
|
||||
stderr = ''
|
||||
log("got stdout: %s" % stdout)
|
||||
|
||||
return dict(stdout=stdout, stderr=stderr)
|
||||
|
||||
def fetch(data):
|
||||
if 'data' not in data:
|
||||
return dict(failed=True, msg='internal error: data is required')
|
||||
if 'in_path' not in data:
|
||||
return dict(failed=True, msg='internal error: out_path is required')
|
||||
|
||||
fh = open(data['in_path'])
|
||||
data = fh.read()
|
||||
return dict(data=data)
|
||||
|
||||
def put(data):
|
||||
|
||||
if 'data' not in data:
|
||||
return dict(failed=True, msg='internal error: data is required')
|
||||
if 'out_path' not in data:
|
||||
return dict(failed=True, msg='internal error: out_path is required')
|
||||
|
||||
fh = open(data['out_path'], 'w')
|
||||
fh.write(data['data'])
|
||||
fh.close()
|
||||
|
||||
return dict()
|
||||
|
||||
def serve(module, password, port, minutes):
|
||||
|
||||
log("serving")
|
||||
context = zmq.Context()
|
||||
socket = context.socket(zmq.REP)
|
||||
addr = "tcp://*:%s" % port
|
||||
log("zmq serving on %s" % addr)
|
||||
socket.bind(addr)
|
||||
|
||||
# password isn't so much a password but a serialized AesKey object that we xferred over SSH
|
||||
# password as a variable in ansible is never logged though, so it serves well
|
||||
|
||||
key = AesKey.Read(password)
|
||||
log("DEBUG KEY=%s" % key) # REALLY NEED TO REMOVE THIS, DEBUG/DEV ONLY!
|
||||
|
||||
while True:
|
||||
|
||||
log("DEBUG: waiting")
|
||||
data = socket.recv()
|
||||
data = key.Decrypt(data)
|
||||
data = json.loads(data)
|
||||
log("DEBUG: got data=%s" % data)
|
||||
|
||||
mode = data['mode']
|
||||
response = {}
|
||||
|
||||
if mode == 'command':
|
||||
response = command(data)
|
||||
elif mode == 'put':
|
||||
response = put(data)
|
||||
elif mode == 'fetch':
|
||||
response = fetch(data)
|
||||
|
||||
# FIXME: send back a useful response here
|
||||
data2 = json.dumps(response)
|
||||
log("DEBUG: returning data=%s" % data2)
|
||||
data2 = key.Encrypt(data2)
|
||||
socket.send(data2)
|
||||
|
||||
def daemonize(module, password, port, minutes):
|
||||
|
||||
# FIXME: actually support the minutes killswitch here
|
||||
# FIXME: /actually/ daemonize here
|
||||
try:
|
||||
daemonize_self(module, password, port, minutes)
|
||||
serve(module, password, port, minutes)
|
||||
except Exception, e:
|
||||
log("exception caught, exiting fireball mode: %s" % e)
|
||||
sys.exit(0)
|
||||
|
||||
def main():
|
||||
|
||||
module = AnsibleModule(
|
||||
argument_spec = dict(
|
||||
port=dict(required=False, default=5099),
|
||||
password=dict(required=True),
|
||||
minutes=dict(required=False, default=30),
|
||||
)
|
||||
)
|
||||
|
||||
password = base64.b64decode(module.params['password'])
|
||||
log("DEBUG pass=%s" % password)
|
||||
port = module.params['port']
|
||||
minutes = module.params['minutes']
|
||||
|
||||
if not HAS_ZMQ:
|
||||
module.fail_json(msg="zmq is not installed")
|
||||
if not HAS_KEYCZAR:
|
||||
module.fail_json(msg="keyczar is not installed")
|
||||
|
||||
daemonize(module, password, port, minutes)
|
||||
|
||||
|
||||
# this is magic, see lib/ansible/module_common.py
|
||||
#<<INCLUDE_ANSIBLE_MODULE_COMMON>>
|
||||
main()
|
||||
Loading…
Reference in New Issue