Merge pull request #3740 from jimi1283/issue_3716

Adding support for hashed known_hosts entries
pull/3743/merge
Michael DeHaan 11 years ago
commit f7723651d3

@ -23,7 +23,9 @@ import pipes
import random
import select
import fcntl
import hmac
import pwd
from hashlib import sha1
import ansible.constants as C
from ansible.callbacks import vvv
from ansible import errors
@ -39,6 +41,7 @@ class Connection(object):
self.user = user
self.password = password
self.private_key_file = private_key_file
self.HASHED_KEY_MAGIC = "|1|"
def connect(self):
''' connect to the remote host '''
@ -105,8 +108,21 @@ class Connection(object):
if line is None or line.find(" ") == -1:
continue
tokens = line.split()
if host in tokens[0]:
return False
if tokens[0].find(self.HASHED_KEY_MAGIC) == 0:
# this is a hashed known host entry
try:
(kn_salt,kn_host) = tokens[0][len(self.HASHED_KEY_MAGIC):].split("|",2)
hash = hmac.new(kn_salt.decode('base64'), digestmod=sha1)
hash.update(host)
if hash.digest() == kn_host.decode('base64'):
return False
except:
# invalid hashed host key, skip it
continue
else:
# standard host file entry
if host in tokens[0]:
return False
return True
def exec_command(self, cmd, tmp_path, sudo_user,sudoable=False, executable='/bin/sh'):

Loading…
Cancel
Save