mirror of https://github.com/ansible/ansible.git
Implement vault encrypted yaml variables. (#16274)
Make !vault-encrypted create a AnsibleVaultUnicode
yaml object that can be used as a regular string object.
This allows a playbook to include a encrypted vault
blob for the value of a yaml variable. A 'secret_password'
variable can have it's value encrypted instead of having
to vault encrypt an entire vars file.
Add __ENCRYPTED__ to the vault yaml types so
template.Template can treat it similar
to __UNSAFE__ flags.
vault.VaultLib api changes:
- Split VaultLib.encrypt to encrypt and encrypt_bytestring
- VaultLib.encrypt() previously accepted the plaintext data
as either a byte string or a unicode string.
Doing the right thing based on the input type would fail
on py3 if given a arg of type 'bytes'. To simplify the
API, vaultlib.encrypt() now assumes input plaintext is a
py2 unicode or py3 str. It will encode to utf-8 then call
the new encrypt_bytestring(). The new methods are less
ambiguous.
- moved VaultLib.is_encrypted logic to vault module scope
and split to is_encrypted() and is_encrypted_file().
Add a test/unit/mock/yaml_helper.py
It has some helpers for testing parsing/yaml
Integration tests added as roles test_vault and test_vault_embedded
pull/17206/head
Adrian Likins
9 years ago
committed by
GitHub
parent
dbf7df4439
commit
e396d5d508
@ -0,0 +1,7 @@
|
||||
|
||||
- assert:
|
||||
that:
|
||||
- 'secret_var == "secret"'
|
||||
|
||||
|
||||
- copy: src=vault-secret.txt dest={{output_dir}}/secret.txt
|
||||
@ -0,0 +1,9 @@
|
||||
$ANSIBLE_VAULT;1.1;AES256
|
||||
31626536666232643662346539623662393436386162643439643434656231343435653936343235
|
||||
6139346364396166336636383734333430373763336434310a303137623539653939336132626234
|
||||
64613232396532313731313935333433353330666466646663303233323331636234326464643166
|
||||
6538653264636166370a613161313064653566323037393962643032353230396536313865326362
|
||||
34396262303130326632623162623230346238633932393938393766313036643835613936356233
|
||||
33323730373331386337353339613165373064323134343930333031623036326164353534646631
|
||||
31313963666234623731316238656233396638643331306231373539643039383434373035306233
|
||||
30386230363730643561
|
||||
@ -0,0 +1,14 @@
|
||||
---
|
||||
- name: Assert that a embedded vault of a string with no newline works
|
||||
assert:
|
||||
that:
|
||||
- '"{{ vault_encrypted_one_line_var }}" == "Setec Astronomy"'
|
||||
|
||||
- name: Assert that a multi line embedded vault works, including new line
|
||||
assert:
|
||||
that:
|
||||
- vault_encrypted_var == "Setec Astronomy\n"
|
||||
|
||||
# TODO: add a expected fail here
|
||||
# - debug: var=vault_encrypted_one_line_var_with_embedded_template
|
||||
|
||||
@ -0,0 +1,17 @@
|
||||
# If you use normal 'ansible-vault create' or edit, files always have at least one new line
|
||||
# so c&p from a vault encrypted that wasn't specifically created sans new line ends up with one.
|
||||
# (specifically created, as in 'echo -n "just one line" > my_secret.yml'
|
||||
vault_encrypted_var: !vault-encrypted |
|
||||
$ANSIBLE_VAULT;1.1;AES256
|
||||
66386439653236336462626566653063336164663966303231363934653561363964363833313662
|
||||
6431626536303530376336343832656537303632313433360a626438346336353331386135323734
|
||||
62656361653630373231613662633962316233633936396165386439616533353965373339616234
|
||||
3430613539666330390a313736323265656432366236633330313963326365653937323833366536
|
||||
34623731376664623134383463316265643436343438623266623965636363326136
|
||||
vault_encrypted_one_line_var: !vault-encrypted |
|
||||
$ANSIBLE_VAULT;1.1;AES256
|
||||
33363965326261303234626463623963633531343539616138316433353830356566396130353436
|
||||
3562643163366231316662386565383735653432386435610a306664636137376132643732393835
|
||||
63383038383730306639353234326630666539346233376330303938323639306661313032396437
|
||||
6233623062366136310a633866373936313238333730653739323461656662303864663666653563
|
||||
3138
|
||||
@ -1,13 +1,4 @@
|
||||
- hosts: testhost
|
||||
vars_files:
|
||||
- vars/test_var_encrypted.yml
|
||||
|
||||
gather_facts: False
|
||||
|
||||
tasks:
|
||||
- assert:
|
||||
that:
|
||||
- 'secret_var == "secret"'
|
||||
|
||||
- copy: src=vault-secret.txt dest={{output_dir}}/secret.txt
|
||||
|
||||
roles:
|
||||
- { role: test_vault, tags: test_vault}
|
||||
|
||||
@ -0,0 +1,4 @@
|
||||
- hosts: testhost
|
||||
gather_facts: False
|
||||
roles:
|
||||
- { role: test_vault_embedded, tags: test_vault_embedded}
|
||||
@ -0,0 +1,120 @@
|
||||
import io
|
||||
import yaml
|
||||
|
||||
from ansible.parsing.yaml.loader import AnsibleLoader
|
||||
from ansible.parsing.yaml.dumper import AnsibleDumper
|
||||
|
||||
from ansible.compat.six import PY3
|
||||
|
||||
class YamlTestUtils(object):
|
||||
"""Mixin class to combine with a unittest.TestCase subclass."""
|
||||
def _loader(self, stream):
|
||||
"""Vault related tests will want to override this.
|
||||
|
||||
Vault cases should setup a AnsibleLoader that has the vault password."""
|
||||
return AnsibleLoader(stream)
|
||||
|
||||
def _dump_stream(self, obj, stream, dumper=None):
|
||||
"""Dump to a py2-unicode or py3-string stream."""
|
||||
if PY3:
|
||||
return yaml.dump(obj, stream, Dumper=dumper)
|
||||
else:
|
||||
return yaml.dump(obj, stream, Dumper=dumper, encoding=None)
|
||||
|
||||
def _dump_string(self, obj, dumper=None):
|
||||
"""Dump to a py2-unicode or py3-string"""
|
||||
if PY3:
|
||||
return yaml.dump(obj, Dumper=dumper)
|
||||
else:
|
||||
return yaml.dump(obj, Dumper=dumper, encoding=None)
|
||||
|
||||
def _dump_load_cycle(self, obj):
|
||||
# Each pass though a dump or load revs the 'generation'
|
||||
# obj to yaml string
|
||||
string_from_object_dump = self._dump_string(obj, dumper=AnsibleDumper)
|
||||
|
||||
# wrap a stream/file like StringIO around that yaml
|
||||
stream_from_object_dump = io.StringIO(string_from_object_dump)
|
||||
loader = self._loader(stream_from_object_dump)
|
||||
# load the yaml stream to create a new instance of the object (gen 2)
|
||||
obj_2 = loader.get_data()
|
||||
|
||||
# dump the gen 2 objects directory to strings
|
||||
string_from_object_dump_2 = self._dump_string(obj_2,
|
||||
dumper=AnsibleDumper)
|
||||
|
||||
# The gen 1 and gen 2 yaml strings
|
||||
self.assertEquals(string_from_object_dump, string_from_object_dump_2)
|
||||
# the gen 1 (orig) and gen 2 py object
|
||||
self.assertEquals(obj, obj_2)
|
||||
|
||||
# again! gen 3... load strings into py objects
|
||||
stream_3 = io.StringIO(string_from_object_dump_2)
|
||||
loader_3 = self._loader(stream_3)
|
||||
obj_3 = loader_3.get_data()
|
||||
|
||||
string_from_object_dump_3 = self._dump_string(obj_3, dumper=AnsibleDumper)
|
||||
|
||||
self.assertEquals(obj, obj_3)
|
||||
# should be transitive, but...
|
||||
self.assertEquals(obj_2, obj_3)
|
||||
self.assertEquals(string_from_object_dump, string_from_object_dump_3)
|
||||
|
||||
def _old_dump_load_cycle(self, obj):
|
||||
'''Dump the passed in object to yaml, load it back up, dump again, compare.'''
|
||||
stream = io.StringIO()
|
||||
|
||||
yaml_string = self._dump_string(obj, dumper=AnsibleDumper)
|
||||
self._dump_stream(obj, stream, dumper=AnsibleDumper)
|
||||
|
||||
yaml_string_from_stream = stream.getvalue()
|
||||
|
||||
# reset stream
|
||||
stream.seek(0)
|
||||
|
||||
loader = self._loader(stream)
|
||||
# loader = AnsibleLoader(stream, vault_password=self.vault_password)
|
||||
obj_from_stream = loader.get_data()
|
||||
|
||||
stream_from_string = io.StringIO(yaml_string)
|
||||
loader2 = self._loader(stream_from_string)
|
||||
# loader2 = AnsibleLoader(stream_from_string, vault_password=self.vault_password)
|
||||
obj_from_string = loader2.get_data()
|
||||
|
||||
stream_obj_from_stream = io.StringIO()
|
||||
stream_obj_from_string = io.StringIO()
|
||||
|
||||
if PY3:
|
||||
yaml.dump(obj_from_stream, stream_obj_from_stream, Dumper=AnsibleDumper)
|
||||
yaml.dump(obj_from_stream, stream_obj_from_string, Dumper=AnsibleDumper)
|
||||
else:
|
||||
yaml.dump(obj_from_stream, stream_obj_from_stream, Dumper=AnsibleDumper, encoding=None)
|
||||
yaml.dump(obj_from_stream, stream_obj_from_string, Dumper=AnsibleDumper, encoding=None)
|
||||
|
||||
yaml_string_stream_obj_from_stream = stream_obj_from_stream.getvalue()
|
||||
yaml_string_stream_obj_from_string = stream_obj_from_string.getvalue()
|
||||
|
||||
stream_obj_from_stream.seek(0)
|
||||
stream_obj_from_string.seek(0)
|
||||
|
||||
if PY3:
|
||||
yaml_string_obj_from_stream = yaml.dump(obj_from_stream, Dumper=AnsibleDumper)
|
||||
yaml_string_obj_from_string = yaml.dump(obj_from_string, Dumper=AnsibleDumper)
|
||||
else:
|
||||
yaml_string_obj_from_stream = yaml.dump(obj_from_stream, Dumper=AnsibleDumper, encoding=None)
|
||||
yaml_string_obj_from_string = yaml.dump(obj_from_string, Dumper=AnsibleDumper, encoding=None)
|
||||
|
||||
assert yaml_string == yaml_string_obj_from_stream
|
||||
assert yaml_string == yaml_string_obj_from_stream == yaml_string_obj_from_string
|
||||
assert yaml_string == yaml_string_obj_from_stream == yaml_string_obj_from_string == yaml_string_stream_obj_from_stream == yaml_string_stream_obj_from_string
|
||||
assert obj == obj_from_stream
|
||||
assert obj == obj_from_string
|
||||
assert obj == yaml_string_obj_from_stream
|
||||
assert obj == yaml_string_obj_from_string
|
||||
assert obj == obj_from_stream == obj_from_string == yaml_string_obj_from_stream == yaml_string_obj_from_string
|
||||
return {'obj': obj,
|
||||
'yaml_string': yaml_string,
|
||||
'yaml_string_from_stream': yaml_string_from_stream,
|
||||
'obj_from_stream': obj_from_stream,
|
||||
'obj_from_string': obj_from_string,
|
||||
'yaml_string_obj_from_string': yaml_string_obj_from_string}
|
||||
@ -0,0 +1,64 @@
|
||||
# coding: utf-8
|
||||
# This file is part of Ansible
|
||||
#
|
||||
# Ansible is free software: you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation, either version 3 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# Ansible is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with Ansible. If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
# Make coding more python3-ish
|
||||
from __future__ import (absolute_import, division, print_function)
|
||||
__metaclass__ = type
|
||||
|
||||
import io
|
||||
import yaml
|
||||
|
||||
try:
|
||||
from _yaml import ParserError
|
||||
except ImportError:
|
||||
from yaml.parser import ParserError
|
||||
|
||||
from ansible.parsing.yaml import dumper
|
||||
from ansible.parsing.yaml.loader import AnsibleLoader
|
||||
|
||||
from ansible.compat.tests import unittest
|
||||
from ansible.parsing.yaml import objects
|
||||
from ansible.parsing import vault
|
||||
|
||||
from units.mock.yaml_helper import YamlTestUtils
|
||||
|
||||
class TestAnsibleDumper(unittest.TestCase, YamlTestUtils):
|
||||
def setUp(self):
|
||||
self.vault_password = "hunter42"
|
||||
self.good_vault = vault.VaultLib(self.vault_password)
|
||||
self.vault = self.good_vault
|
||||
self.stream = self._build_stream()
|
||||
self.dumper = dumper.AnsibleDumper
|
||||
|
||||
def _build_stream(self,yaml_text=None):
|
||||
text = yaml_text or u''
|
||||
stream = io.StringIO(text)
|
||||
return stream
|
||||
|
||||
def _loader(self, stream):
|
||||
return AnsibleLoader(stream, vault_password=self.vault_password)
|
||||
|
||||
def test(self):
|
||||
plaintext = 'This is a string we are going to encrypt.'
|
||||
avu = objects.AnsibleVaultEncryptedUnicode.from_plaintext(plaintext, vault=self.vault)
|
||||
|
||||
yaml_out = self._dump_string(avu, dumper=self.dumper)
|
||||
stream = self._build_stream(yaml_out)
|
||||
loader = self._loader(stream)
|
||||
|
||||
data_from_yaml = loader.get_single_data()
|
||||
|
||||
self.assertEquals(plaintext, data_from_yaml.data)
|
||||
@ -0,0 +1,129 @@
|
||||
# This file is part of Ansible
|
||||
#
|
||||
# Ansible is free software: you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation, either version 3 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# Ansible is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with Ansible. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
# Copyright 2016, Adrian Likins <alikins@redhat.com>
|
||||
|
||||
# Make coding more python3-ish
|
||||
from __future__ import (absolute_import, division, print_function)
|
||||
__metaclass__ = type
|
||||
|
||||
from ansible.compat.tests import unittest
|
||||
|
||||
|
||||
from ansible.parsing import vault
|
||||
from ansible.parsing.yaml.loader import AnsibleLoader
|
||||
|
||||
# module under test
|
||||
from ansible.parsing.yaml import objects
|
||||
|
||||
from units.mock.yaml_helper import YamlTestUtils
|
||||
|
||||
|
||||
class TestAnsibleVaultUnicodeNoVault(unittest.TestCase, YamlTestUtils):
|
||||
def test_empty_init(self):
|
||||
self.assertRaises(TypeError, objects.AnsibleVaultEncryptedUnicode)
|
||||
|
||||
def test_empty_string_init(self):
|
||||
seq = ''.encode('utf8')
|
||||
self.assert_values(seq)
|
||||
|
||||
def test_empty_byte_string_init(self):
|
||||
seq = b''
|
||||
self.assert_values(seq)
|
||||
|
||||
def _assert_values(self, avu, seq):
|
||||
self.assertIsInstance(avu, objects.AnsibleVaultEncryptedUnicode)
|
||||
self.assertTrue(avu.vault is None)
|
||||
# AnsibleVaultEncryptedUnicode without a vault should never == any string
|
||||
self.assertNotEquals(avu, seq)
|
||||
|
||||
def assert_values(self, seq):
|
||||
avu = objects.AnsibleVaultEncryptedUnicode(seq)
|
||||
self._assert_values(avu, seq)
|
||||
|
||||
def test_single_char(self):
|
||||
seq = 'a'.encode('utf8')
|
||||
self.assert_values(seq)
|
||||
|
||||
def test_string(self):
|
||||
seq = 'some letters'
|
||||
self.assert_values(seq)
|
||||
|
||||
def test_byte_string(self):
|
||||
seq = 'some letters'.encode('utf8')
|
||||
self.assert_values(seq)
|
||||
|
||||
|
||||
class TestAnsibleVaultEncryptedUnicode(unittest.TestCase, YamlTestUtils):
|
||||
def setUp(self):
|
||||
self.vault_password = "hunter42"
|
||||
self.good_vault = vault.VaultLib(self.vault_password)
|
||||
|
||||
self.wrong_vault_password = 'not-hunter42'
|
||||
self.wrong_vault = vault.VaultLib(self.wrong_vault_password)
|
||||
|
||||
self.vault = self.good_vault
|
||||
|
||||
def _loader(self, stream):
|
||||
return AnsibleLoader(stream, vault_password=self.vault_password)
|
||||
|
||||
def test_dump_load_cycle(self):
|
||||
aveu = self._from_plaintext('the test string for TestAnsibleVaultEncryptedUnicode.test_dump_load_cycle')
|
||||
self._dump_load_cycle(aveu)
|
||||
|
||||
def assert_values(self, avu, seq):
|
||||
self.assertIsInstance(avu, objects.AnsibleVaultEncryptedUnicode)
|
||||
|
||||
self.assertEquals(avu, seq)
|
||||
self.assertTrue(avu.vault is self.vault)
|
||||
self.assertIsInstance(avu.vault, vault.VaultLib)
|
||||
|
||||
def _from_plaintext(self, seq):
|
||||
return objects.AnsibleVaultEncryptedUnicode.from_plaintext(seq, vault=self.vault)
|
||||
|
||||
def _from_ciphertext(self, ciphertext):
|
||||
avu = objects.AnsibleVaultEncryptedUnicode(ciphertext)
|
||||
avu.vault = self.vault
|
||||
return avu
|
||||
|
||||
def test_empty_init(self):
|
||||
self.assertRaises(TypeError, objects.AnsibleVaultEncryptedUnicode)
|
||||
|
||||
def test_empty_string_init_from_plaintext(self):
|
||||
seq = ''
|
||||
avu = self._from_plaintext(seq)
|
||||
self.assert_values(avu,seq)
|
||||
|
||||
def test_empty_unicode_init_from_plaintext(self):
|
||||
seq = u''
|
||||
avu = self._from_plaintext(seq)
|
||||
self.assert_values(avu,seq)
|
||||
|
||||
def test_string_from_plaintext(self):
|
||||
seq = 'some letters'
|
||||
avu = self._from_plaintext(seq)
|
||||
self.assert_values(avu,seq)
|
||||
|
||||
def test_unicode_from_plaintext(self):
|
||||
seq = u'some letters'
|
||||
avu = self._from_plaintext(seq)
|
||||
self.assert_values(avu,seq)
|
||||
|
||||
# TODO/FIXME: make sure bad password fails differently than 'thats not encrypted'
|
||||
def test_empty_string_wrong_password(self):
|
||||
seq = ''
|
||||
self.vault = self.wrong_vault
|
||||
avu = self._from_plaintext(seq)
|
||||
self.assert_values(avu, seq)
|
||||
Loading…
Reference in New Issue