??????????????
Warning: Cannot modify header information - headers already sent by (output started at /home/mybf1/public_html/mentol.bf1.my/SS1.php:4) in /home/mybf1/public_html/mentol.bf1.my/SS1.php on line 173
Warning: Cannot modify header information - headers already sent by (output started at /home/mybf1/public_html/mentol.bf1.my/SS1.php:4) in /home/mybf1/public_html/mentol.bf1.my/SS1.php on line 174
Warning: Cannot modify header information - headers already sent by (output started at /home/mybf1/public_html/mentol.bf1.my/SS1.php:4) in /home/mybf1/public_html/mentol.bf1.my/SS1.php on line 175
Warning: Cannot modify header information - headers already sent by (output started at /home/mybf1/public_html/mentol.bf1.my/SS1.php:4) in /home/mybf1/public_html/mentol.bf1.my/SS1.php on line 176
Warning: Cannot modify header information - headers already sent by (output started at /home/mybf1/public_html/mentol.bf1.my/SS1.php:4) in /home/mybf1/public_html/mentol.bf1.my/SS1.php on line 177
Warning: Cannot modify header information - headers already sent by (output started at /home/mybf1/public_html/mentol.bf1.my/SS1.php:4) in /home/mybf1/public_html/mentol.bf1.my/SS1.php on line 178
Udac @` s d d l m Z m Z m Z e Z d d l Z d d l Z d d l Z d d l Z d d l
Z
d d l Z d d l Z d d l
Z
d d l Z d d l Z d d l m Z d d l m Z d d l m Z e Z e Z e Z e Z y e j % e j d e d d l m Z Wd QXd d l m! Z! d d l" m# Z# m$ Z$ d d
l% m& Z& d d l' m( Z( d d l) m* Z+ m, Z, m- Z- e! Z e. Z Wn e/ k
rn Xy` d d
l0 m1 Z2 e. Z d d l3 m4 Z5 d d
l3 m& Z6 d d l7 m8 Z9 d d l: m; Z< e. Z Wn e/ k
rn Xd d l= m> Z> m? Z? d d l@ mA ZB d d lC mD ZD mE ZE d d lF mG ZG d d lH mI ZI mJ ZJ mK ZK d d lL mM ZM d d lN mO ZO eM ZP d ZQ eR d f ZS eR d f ZT d ZU e reU d 7ZU n eU d 7ZU d e> f d YZV d eV f d YZW d! e> f d" YZX d# ZY d d$ d% ZZ e d& Z[ e e d' Z\ e e d( Z] d) Z^ d* Z_ d+ Z` e d, Za d- f d. YZb d/ eb f d0 YZc d1 Zd e e e e d2 Ze d3 eb f d4 YZf d5 ef f d6 YZg d7 eg f d8 YZh d9 Zi d: Zj e d; Zk e d< Zl d= f d> YZm d? f d@ YZn dA f dB YZo i eo d 6Zp d S(C i ( t absolute_importt divisiont print_functionN( t hexlify( t unhexlify( t Errort ignore( t InvalidSignature( t default_backend( t hashest padding( t HMAC( t
PBKDF2HMAC( t Ciphert
algorithmst modes( t AES( t SHA256( t Counter( t PBKDF2( t AnsibleErrort AnsibleAssertionError( t constants( t PY3t binary_type( t zip( t to_bytest to_textt to_native( t Display( t
makedirs_safes $ANSIBLE_VAULTu AES256sE ansible-vault requires either the cryptography library (preferred) ors a newer version ofs pycrypto in order to function.t AnsibleVaultErrorc B` s e Z RS( ( t __name__t
__module__( ( ( sB /usr/lib/python2.7/site-packages/ansible/parsing/vault/__init__.pyR c s t AnsibleVaultPasswordErrorc B` s e Z RS( ( R R! ( ( ( sB /usr/lib/python2.7/site-packages/ansible/parsing/vault/__init__.pyR" g s t AnsibleVaultFormatErrorc B` s e Z RS( ( R R! ( ( ( sB /usr/lib/python2.7/site-packages/ansible/parsing/vault/__init__.pyR# k s c C` sf y4 t t | d d d d d d d d d d } Wn t t f k
rN t SX| j t rb t St S( s Test if this is vault encrypted data blob
:arg data: a byte or text string to test whether it is recognized as vault
encrypted data
:returns: True if it is recognized. Otherwise, False.
t encodingt asciit errorst strictt nonstring( R R t UnicodeErrort TypeErrort Falset
startswitht b_HEADERt True( t datat b_data( ( sB /usr/lib/python2.7/site-packages/ansible/parsing/vault/__init__.pyt is_encryptedo s 4ic C` sE | j } z$ | j | t | j | SWd | j | Xd S( s Test if the contents of a file obj are a vault encrypted data blob.
:arg file_obj: A file object that will be read from.
:kwarg start_pos: A byte offset in the file to start reading the header
from. Defaults to 0, the beginning of the file.
:kwarg count: Read up to this number of bytes from the file to determine
if it looks like encrypted vault data. The default is -1, read to the
end of file.
:returns: True if the file looks like a vault file. Otherwise, False.
N( t tellt seekR1 t read( t file_objt start_post countt current_position( ( sB /usr/lib/python2.7/site-packages/ansible/parsing/vault/__init__.pyt is_encrypted_file s
c C` s | j } | d j j d } | d j } t | d j } | } t | d k r| t | d j } n d j | d } | | | | f S( Ni t ;i i i i t ( t
splitlinest stript splitR t lent join( t b_vaulttext_envelopet default_vault_idt b_tmpdatat b_tmpheadert b_versiont cipher_namet vault_idt b_ciphertext( ( sB /usr/lib/python2.7/site-packages/ansible/parsing/vault/__init__.pyt _parse_vaulttext_envelope s c C` sq | p t j } y t | | SWnJ t k
rl } d } | rO | d | 7} n | d | 7} t | n Xd S( s Parse the vaulttext envelope
When data is saved, it has a header prepended and is formatted into 80
character lines. This method extracts the information from the header
and then removes the header and the inserted newlines. The string returned
is suitable for processing by the Cipher classes.
:arg b_vaulttext: byte str containing the data from a save file
:kwarg default_vault_id: The vault_id name to use if the vaulttext does not provide one.
:kwarg filename: The filename that the data came from. This is only
used to make better error messages in case the data cannot be
decrypted. This is optional.
:returns: A tuple of byte str of the vaulttext suitable to pass to parse_vaultext,
a byte str of the vault format version,
the name of the cipher used, and the vault_id.
:raises: AnsibleVaultFormatError: if the vaulttext_envelope format is invalid
s Vault envelope format errors in %ss : %sN( t Ct DEFAULT_VAULT_IDENTITYRI t ExceptionR# ( RA RB t filenamet exct msg( ( sB /usr/lib/python2.7/site-packages/ansible/parsing/vault/__init__.pyt parse_vaulttext_envelope s c
C` s | s t d n | p d } | r< | d k r< d } n t | d d d } t | d d d } t | d d d } t | | g } | d k r | r | j | n d j | } | g } | g t d t | d
D] }
| |
|
d
!^ q 7} | d g 7} d j | } | S(
s Add header and format to 80 columns
:arg b_ciphertext: the encrypted and hexlified data as a byte string
:arg cipher_name: unicode cipher name (for ex, u'AES256')
:arg version: unicode vault version (for ex, '1.2'). Optional ('1.1' is default)
:arg vault_id: unicode vault identifier. If provided, the version will be bumped to 1.2.
:returns: a byte str that should be dumped into a file. It's
formatted to 80 char columns and has the header prepended
s- the cipher must be set before adding a headers 1.1u defaults 1.2s utf-8R& R' R: i iP R; s
( R R R- t appendR@ t rangeR? ( RH RF t versionRG RE t
b_vault_idt
b_cipher_namet header_partst headert b_vaulttextt i( ( sB /usr/lib/python2.7/site-packages/ansible/parsing/vault/__init__.pyt format_vaulttext_envelope s& :
c C` s> y t | SWn) t t f k
r9 } t d | n Xd S( Ns Vault format unhexlify error: %s( R t
BinasciiErrorR* R# ( R0 RN ( ( sB /usr/lib/python2.7/site-packages/ansible/parsing/vault/__init__.pyt
_unhexlify s c C` sL t | } | j d d \ } } } t | } t | } | | | f S( Ns
i ( R\ R> ( RX t b_saltt b_crypted_hmacRH ( ( sB /usr/lib/python2.7/site-packages/ansible/parsing/vault/__init__.pyt _parse_vaulttext s
c C` sQ y t | SWn< t k
r$ n) t k
rL } d | } t | n Xd S( sw Parse the vaulttext
:arg b_vaulttext: byte str containing the vaulttext (ciphertext, salt, crypted_hmac)
:returns: A tuple of byte str of the ciphertext suitable for passing to a
Cipher class's decrypt() function, a byte str of the salt,
and a byte str of the crypted_hmac
:raises: AnsibleVaultFormatError: if the vaulttext format is invalid
s Vault vaulttext format error: %sN( R_ R# RL ( RX RN RO ( ( sB /usr/lib/python2.7/site-packages/ansible/parsing/vault/__init__.pyt parse_vaulttext s
c C` s% | p d } | s! t | n d S( s Check the secret against minimal requirements.
Raises: AnsibleVaultPasswordError if the password does not meet requirements.
Currently, only requirement is that the password is not None or an empty string.
s# Invalid vault password was providedN( R" ( t secretRO ( ( sB /usr/lib/python2.7/site-packages/ansible/parsing/vault/__init__.pyt verify_secret_is_not_empty s t VaultSecretc B` s2 e Z d Z d d Z e d Z d Z RS( sK Opaque/abstract objects for a single vault secret. ie, a password or a key.c C` s
| | _ d S( N( t _bytes( t selfRd ( ( sB /usr/lib/python2.7/site-packages/ansible/parsing/vault/__init__.pyt __init__' s c C` s | j S( s The secret as a bytestring.
Sub classes that store text types will need to override to encode the text to bytes.
( Rd ( Re ( ( sB /usr/lib/python2.7/site-packages/ansible/parsing/vault/__init__.pyt bytes+ s c C` s | j S( N( Rd ( Re ( ( sB /usr/lib/python2.7/site-packages/ansible/parsing/vault/__init__.pyt load3 s N( R R! t __doc__t NoneRf t propertyRg Rh ( ( ( sB /usr/lib/python2.7/site-packages/ansible/parsing/vault/__init__.pyRc $ s t PromptVaultSecretc B` sM e Z d g Z d d d d Z e d Z d Z d Z d Z RS( s Vault password (%s): c C` sJ t t | j d | | | _ | d k r= | j | _ n | | _ d S( NRd ( t superRl Rf RG Rj t default_prompt_formatst prompt_formats( Re Rd RG Ro ( ( sB /usr/lib/python2.7/site-packages/ansible/parsing/vault/__init__.pyRf : s
c C` s | j S( N( Rd ( Re ( ( sB /usr/lib/python2.7/site-packages/ansible/parsing/vault/__init__.pyRg C s c C` s | j | _ d S( N( t ask_vault_passwordsRd ( Re ( ( sB /usr/lib/python2.7/site-packages/ansible/parsing/vault/__init__.pyRh G s c C` s g } x | j D] } | i | j d 6} y t j | d t } Wn$ t k
ri t d | j n Xt | t | d d d d j } | j
| q Wx" | D] } | j | d | q W| r | d Sd S( NRG t privates$ EOFError (ctrl-d) on prompt for (%s)R& R' R( t
simplerepri (
Ro RG t displayt promptR. t EOFErrorR Rb R R= RQ t confirmRj ( Re t b_vault_passwordst
prompt_formatRt t
vault_passt b_vault_passt b_vault_password( ( sB /usr/lib/python2.7/site-packages/ansible/parsing/vault/__init__.pyRp J s
c C` s | | k r t d n d S( Ns Passwords do not match( R ( Re t b_vault_pass_1t b_vault_pass_2( ( sB /usr/lib/python2.7/site-packages/ansible/parsing/vault/__init__.pyRv b s N(
R R! Rn Rj Rf Rk Rg Rh Rp Rv ( ( ( sB /usr/lib/python2.7/site-packages/ansible/parsing/vault/__init__.pyRl 7 s c C` s/ t j j | \ } } | j d r+ t St S( sW Determine if a vault secret script is a client script that can be given --vault-id argss -client( t ost patht splitextt endswithR. R+ ( RM t script_namet dummy( ( sB /usr/lib/python2.7/site-packages/ansible/parsing/vault/__init__.pyt script_is_clientj s c C` s t j j t j j | } t j j | sC t d | n | j | r t | r t j d t
| t d | d | d | d | St d | d | d | St
d | d | d | S( Ns( The vault password file %s was not foundu. The vault password file %s is a client script.RM RG R$ t loader( R~ R t realpatht
expandusert existsR t
is_executableR Rs t vvvvR t ClientScriptVaultSecrett ScriptVaultSecrett FileVaultSecret( RM RG R$ R t this_path( ( sB /usr/lib/python2.7/site-packages/ansible/parsing/vault/__init__.pyt get_file_vault_secretx s
R c B` sD e Z d d d d Z e d Z d Z d Z d Z RS( c C` sJ t t | j | | _ | | _ | p. d | _ d | _ d | _ d S( Nt utf8( Rm R Rf RM R R$ Rj Rd t _text( Re RM R$ R ( ( sB /usr/lib/python2.7/site-packages/ansible/parsing/vault/__init__.pyRf s c C` s0 | j r | j S| j r, | j j | j Sd S( N( Rd R t encodeR$ Rj ( Re ( ( sB /usr/lib/python2.7/site-packages/ansible/parsing/vault/__init__.pyRg s
c C` s | j | j | _ d S( N( t
_read_fileRM Rd ( Re ( ( sB /usr/lib/python2.7/site-packages/ansible/parsing/vault/__init__.pyRh s c C` s y/ t | d } | j j } | j Wn/ t t f k
r` } t d | | f n X| j j | | \ } } | j d } t | d d | | S( s
Read a vault password from a file or if executable, execute the script and
retrieve password from STDOUT
t rbs) Could not read vault password file %s: %ss
RO s2 Invalid vault password was provided from file (%s)(
t openR4 R= t closet OSErrort IOErrorR R t _decrypt_if_vault_dataRb ( Re RM t fRy t et b_vault_dataR ( ( sB /usr/lib/python2.7/site-packages/ansible/parsing/vault/__init__.pyR s c C` s. | j r d | j j | j f Sd | j j S( Ns %s(filename='%s')s %s()( RM t __class__R ( Re ( ( sB /usr/lib/python2.7/site-packages/ansible/parsing/vault/__init__.pyt __repr__ s N( R R! Rj Rf Rk Rg Rh R R ( ( ( sB /usr/lib/python2.7/site-packages/ansible/parsing/vault/__init__.pyR s
R c B` s, e Z d Z d Z d Z d Z RS( c C` s | j j | s% t d | n | j } | j | \ } } } | j | | | | j d } d | } t | d | | S( Ns/ The vault password script %s was not executables
s4 Invalid vault password was provided from script (%s)RO ( R R R t _build_commandt _runt _check_resultsR= Rb ( Re RM t commandt stdoutt stderrt pRy t empty_password_msg( ( sB /usr/lib/python2.7/site-packages/ansible/parsing/vault/__init__.pyR s
c C` sv y t j | d t j } Wn8 t k
rV } d } | | j | f } t | n X| j \ } } | | | f S( NR sp Problem running vault password script %s (%s). If this is not a script, remove the executable bit from the file.( t
subprocesst Popent PIPER RM R t communicate( Re R R R t
msg_formatRO R R ( ( sB /usr/lib/python2.7/site-packages/ansible/parsing/vault/__init__.pyR s c C` s5 | j d k r1 t d | j | j | f n d S( Ni s3 Vault password script %s returned non-zero (%s): %s( t
returncodeR RM ( Re R R t popen( ( sB /usr/lib/python2.7/site-packages/ansible/parsing/vault/__init__.pyR s c C` s
| j g S( N( RM ( Re ( ( sB /usr/lib/python2.7/site-packages/ansible/parsing/vault/__init__.pyR s ( R R! R R R R ( ( ( sB /usr/lib/python2.7/site-packages/ansible/parsing/vault/__init__.pyR s R c B` sG e Z d Z d d d d d Z d Z d Z d Z d Z RS( i c C` sU t t | j d | d | d | | | _ t j d t | t | f d S( NRM R$ R u8 Executing vault password client script: %s --vault-id %s( Rm R Rf t _vault_idRs R R ( Re RM R$ R RG ( ( sB /usr/lib/python2.7/site-packages/ansible/parsing/vault/__init__.pyRf s
c C` s y% t j | d t j d t j } Wn8 t k
r_ } d } | | j | f } t | n X| j \ } } | | | f S( NR R sw Problem running vault password client script %s (%s). If this is not a script, remove the executable bit from the file.( R R R R RM R R ( Re R R R R RO R R ( ( sB /usr/lib/python2.7/site-packages/ansible/parsing/vault/__init__.pyR s c C` so | j | j k r4 t d | j | j | f n | j d k rk t d | j | j | j | f n d S( NsI Vault password client script %s did not find a secret for vault-id=%s: %si s^ Vault password client script %s returned non-zero (%s) when getting secret for vault-id=%s: %s( R t VAULT_ID_UNKNOWN_RCR RM R ( Re R R R ( ( sB /usr/lib/python2.7/site-packages/ansible/parsing/vault/__init__.pyR s c C` s2 | j g } | j r. | j d | j g n | S( Ns
--vault-id( RM R t extend( Re R ( ( sB /usr/lib/python2.7/site-packages/ansible/parsing/vault/__init__.pyR s c C` s4 | j r& d | j j | j | j f Sd | j j S( Ns %s(filename='%s', vault_id='%s')s %s()( RM R R R ( Re ( ( sB /usr/lib/python2.7/site-packages/ansible/parsing/vault/__init__.pyR s N( R R! R Rj Rf R R R R ( ( ( sB /usr/lib/python2.7/site-packages/ansible/parsing/vault/__init__.pyR s c C` s? | s
g Sg | D]$ \ } } | | k r | | f ^ q } | S( sV Find all VaultSecret objects that are mapped to any of the target_vault_ids in secrets( ( t secretst target_vault_idsRG Ra t matches( ( sB /usr/lib/python2.7/site-packages/ansible/parsing/vault/__init__.pyt
match_secrets s 1c C` s! t | | } | r | d Sd S( s Find the best secret from secrets that matches target_vault_ids
Since secrets should be ordered so the early secrets are 'better' than later ones, this
just finds all the matches, then returns the first secreti N( R Rj ( R R R ( ( sB /usr/lib/python2.7/site-packages/ansible/parsing/vault/__init__.pyt match_best_secret" s c C` s t j d t | | d k r2 t d n | g } t | | } | rT | St d | g | D] \ } } | ^ qd f d S( Nu encrypt_vault_id=%ssB match_encrypt_vault_id_secret requires a non None encrypt_vault_idsH Did not find a match for --encrypt-vault-id=%s in the known vault-ids %s( Rs R R Rj R R R ( R t encrypt_vault_idt encrypt_vault_id_matcherst encrypt_secrett _vt _vs( ( sB /usr/lib/python2.7/site-packages/ansible/parsing/vault/__init__.pyt match_encrypt_vault_id_secret. s c C` s_ t j d t | | r- t | d | Sg | D] \ } } | ^ q4 } t | | } | S( s@ Find the best/first/only secret in secrets to use for encryptingu encrypt_vault_id=%sR ( Rs R R R R ( R R R R t _vault_id_matcherst best_secret( ( sB /usr/lib/python2.7/site-packages/ansible/parsing/vault/__init__.pyt match_encrypt_secretB s t VaultLibc B` s; e Z d d Z d d d Z d d Z d d Z RS( c C` s% | p g | _ d | _ d | _ d S( Ns 1.2( R Rj RF RE ( Re R ( ( sB /usr/lib/python2.7/site-packages/ansible/parsing/vault/__init__.pyRf U s c C` s? | d
k r< | j r- t | j \ } } q< t d n t | d d } t | ri t d n | j s | j t k r d | _ n y t | j } Wn) t
k
r t d j | j n X| r t j
d t | t | f n t j
d t | | j | | } t | | j d | } | S( s Vault encrypt a piece of data.
:arg plaintext: a text or byte string to encrypt.
:returns: a utf-8 encoded byte str of encrypted data. The string
contains a header identifying this as vault encrypted data and
formatted to newline terminated lines of 80 characters. This is
suitable for dumping as is to a vault file.
If the string passed in is a text string, it will be encoded to UTF-8
before encryption.
s2 A vault password must be specified to encrypt dataR& t surrogate_or_stricts input is already encryptedu AES256u {0} cipher could not be foundu1 Encrypting with vault_id "%s" and vault secret %su3 Encrypting without a vault_id using vault secret %sRG N( Rj R R R R R1 R RF t CIPHER_WRITE_WHITELISTt CIPHER_MAPPINGt KeyErrort formatRs t vvvvvR t encryptRZ ( Re t plaintextRa RG R t b_plaintextt this_cipherRH RX ( ( sB /usr/lib/python2.7/site-packages/ansible/parsing/vault/__init__.pyR Z s*
& c C` s" | j | d | \ } } } | S( s Decrypt a piece of vault encrypted data.
:arg vaulttext: a string to decrypt. Since vault encrypted data is an
ascii text format this can be either a byte str or unicode string.
:kwarg filename: a filename that the data came from. This is only
used to make better error messages in case the data cannot be
decrypted.
:returns: a byte string containing the decrypted data and the vault-id that was used
RM ( t decrypt_and_get_vault_id( Re t vaulttextRM R RG t vault_secret( ( sB /usr/lib/python2.7/site-packages/ansible/parsing/vault/__init__.pyt decrypt s c C` s t | d d d d } | j d k r6 t d n t | st d } | re | d t | 7} n t | n t | d | \ } } } } | t k r t | } n t d j
| d } | j s t d
n g }
d } d } | rut j d t
| |
j | t | j |
}
|
r[t j d t
| t
| f qut j d
t
| n t j s|
j g | j D] \ } } | | k r| ^ q n t | j |
} x| D]d\ } } t j d t
| t
| t
| f y t j d t
| t
| f | j | | } | d k r| } | } d } | rpd | } n t j d t
| t
| t
| f Pn Wqt k
r} d } | r| d t
| 7} n | d | 7} t j | qt k
r2} t j d t
| t
| | f qqXqWd } | rZ| d t | 7} n t | | d k rd } | r| d t | 7} n t | n | | | f S( s Decrypt a piece of vault encrypted data.
:arg vaulttext: a string to decrypt. Since vault encrypted data is an
ascii text format this can be either a byte str or unicode string.
:kwarg filename: a filename that the data came from. This is only
used to make better error messages in case the data cannot be
decrypted.
:returns: a byte string containing the decrypted data and the vault-id vault-secret that was used
R& R' R$ s utf-8s2 A vault password must be specified to decrypt datas! input is not vault encrypted datas %s is not a vault encrypted fileRM s {0} cipher could not be founds0 Attempting to decrypt but no vault secrets foundu& Found a vault_id (%s) in the vaulttextuM We have a secret associated with vault id (%s), will try to use to decrypt %su\ Found a vault_id (%s) in the vault text, but we do not have a associated secret (--vault-id)u3 Trying to use vault secret=(%s) id=%s to decrypt %su Trying secret %s for vault_id=%sR; s of "%s"u3 Decrypt%s successful with secret=%s and vault_id=%su There was a vault format erroru in %su : %suK Tried to use the vault secret (%s) to decrypt (%s) but it failed. Error: %ssB Decryption failed (no vault secrets were found that could decrypt)s on %ss Decryption failedN( R R Rj R R1 R R RP t CIPHER_WHITELISTR R Rs R R RQ R RJ t DEFAULT_VAULT_ID_MATCHR R R R# t warning( Re R RM RX RO R RF RG R R t vault_id_matcherst
vault_id_usedt vault_secret_usedt _matchesR t _dummyt matched_secretst vault_secret_idR t file_slugRN R ( ( sB /usr/lib/python2.7/site-packages/ansible/parsing/vault/__init__.pyR s
& 8,#
&
N( R R! Rj Rf R R R ( ( ( sB /usr/lib/python2.7/site-packages/ansible/parsing/vault/__init__.pyR T s . t VaultEditorc B` s e Z d d Z d Z d Z d e d d Z d Z d d Z d d d Z
d d Z d d Z d Z
d
Z d d Z d Z e d
d Z d Z d Z RS( c C` s | p t | _ d S( N( R t vault( Re R ( ( sB /usr/lib/python2.7/site-packages/ansible/parsing/vault/__init__.pyRf s c C` s t j j | } | d k rt d | } d } t | d } x t | D] } | j d d t j | d | } t j | } x( t d | | D] } | j
| q W| j
| | | | j | k r t n t j
| qR WWd QXn d S( sr "Destroy a file, when shred (core-utils) is not available
Unix `shred' destroys files "so that they can be recovered only with great difficulty with
specialised hardware, if at all". It is based on the method from the paper
"Secure Deletion of Data from Magnetic and Solid-State Memory",
Proceedings of the Sixth USENIX Security Symposium (San Jose, California, July 22-25, 1996).
We do not go to that length to re-implement shred in Python; instead, overwriting with a block
of random data should suffice.
See https://github.com/ansible/ansible/pull/13700 .
i i i i t wbNi i ( R~ R t getsizet minR RR R3 t randomt randintt urandomt writeR2 R t fsync( Re t tmp_patht file_lent
max_chunk_lent passest fht _t chunk_lenR/ ( ( sB /usr/lib/python2.7/site-packages/ansible/parsing/vault/__init__.pyt _shred_file_custom
s c C` s| t j j | s d Sy t j d | g } Wn t t f k
rN d } n X| d k rk | j | n t j | d S( sj Securely destroy a decrypted file
Note standard limitations of GNU shred apply (For flash, overwriting would have no effect
due to wear leveling; for other storage systems, the async kernel->filesystem->disk calls never
guarantee data hits the disk; etc). Furthermore, if your tmp dirs is on tmpfs (ramdisks),
it is a non-issue.
Nevertheless, some form of overwriting the data (instead of just removing the fs index entry) is
a good idea. If shred is not available (e.g. on windows, or no core-utils installed), fall back on
a custom shredding method.
Nt shredi i ( R~ R t isfileR t callR t
ValueErrorR t remove( Re R t r( ( sB /usr/lib/python2.7/site-packages/ansible/parsing/vault/__init__.pyt _shred_file2 s
c C` s t j j t j j | \ } } t j d | d t j \ } } | j | }
zK y# | ry | j | | d t
n Wn! t k
r | j | n XWd t j
| Xy t j |
WnE t k
r} | j | t d d j |
t | f n X| j | } | s*| | k r| j j | | d | }
| j |
| | j | | t j d t | t | t | f n | j | d S( Nt suffixt dirR s& Unable to execute the command "%s": %st RG u< Saved edited file "%s" encrypted using %s and vault id "%s"( R~ R R R t tempfilet mkstempRJ t DEFAULT_LOCAL_TMPt _editor_shell_commandt
write_dataR+ RL R R R R R R@ R t read_dataR R t
shuffle_filesRs R R ( Re RM Ra t
existing_datat
force_saveRG t roott extt fdR t cmdR RC RH ( ( sB /usr/lib/python2.7/site-packages/ansible/parsing/vault/__init__.pyt _edit_file_helperS s. $!
)/c C` s& | d k r | St j j | } | S( Nt -( R~ R R ( Re RM t real_path( ( sB /usr/lib/python2.7/site-packages/ansible/parsing/vault/__init__.pyt
_real_path~ s c C` s | j j | | d | } | S( NRG ( R R ( Re R Ra RG RH ( ( sB /usr/lib/python2.7/site-packages/ansible/parsing/vault/__init__.pyt
encrypt_bytes s c C` sS | j | } | j | } | j j | | d | } | j | | pK | d S( NRG ( R R R R R ( Re RM Ra RG t output_fileR RH ( ( sB /usr/lib/python2.7/site-packages/ansible/parsing/vault/__init__.pyt encrypt_file s c C` s | j | } | j | } y | j j | d | } Wn5 t k
rq } t d t | t | f n X| j | | p | d t d S( NRM s %s for %sR ( R R R R R R R R+ ( Re RM R t
ciphertextR R ( ( sB /usr/lib/python2.7/site-packages/ansible/parsing/vault/__init__.pyt decrypt_file s &c C` s t j j | } | rO t j j | rO t j d t | t | n t j j | rt t d | n | j
| | d | d S( s create a new encrypted file u %s does not exist, creating...s$ %s exists, please use 'edit' insteadRG N( R~ R t dirnameR Rs R R R R R R ( Re RM Ra RG R ( ( sB /usr/lib/python2.7/site-packages/ansible/parsing/vault/__init__.pyt create_file s
c C` s d } d } | j | } | j | } t | } y | j j | \ } } } Wn5 t k
r } t d t | t | f n Xt | d | \ } } } }
| t k } | j
| | d | d | d |
d S( Ns %s for %sRM R R RG ( Rj R R R R R R R RP R R ( Re RM R R RX R R R R RF RG R ( ( sB /usr/lib/python2.7/site-packages/ansible/parsing/vault/__init__.pyt edit_file s & c C` sw | j | } t | } y | j j | d | } | SWn5 t k
rr } t d t | t | f n Xd S( NRM s %s for %s( R R R R R R R ( Re RM RX R R R ( ( sB /usr/lib/python2.7/site-packages/ansible/parsing/vault/__init__.pyR s c
C` sw | j | } t j | } | j | } t | } t j d t | t | t | f y | j j | \ } } } Wn5 t k
r }
t d t
|
t
| f n X| d k r t d | n t d i } | j
| | d | } | j | | t j | | j t j | | j | j t j d t | t | t | t | f d S( Nu@ Rekeying file "%s" to with new vault-id "%s" and vault secret %ss %s for %ss< The value for the new_password to rekey %s with is not validR RG ui Rekeyed file "%s" (decrypted with vault id "%s") was encrypted with new vault-id "%s" and vault secret %s( R R~ t statR R Rs R R R R R Rj R R R t chmodt st_modet chownt st_uidt st_gid(
Re RM t new_vault_secrett new_vault_idt prevRX R R R R R t new_vaultt b_new_vaulttext( ( sB /usr/lib/python2.7/site-packages/ansible/parsing/vault/__init__.pyt
rekey_file s& # &
c C` s yF | d k r! t j j } n$ t | d } | j } Wd QXWnP t k
r } t | } | sy t | } n t d t | | f n X| S( NR R s# Unable to read source file (%s): %s( t syst stdinR4 R RL R t reprR ( Re RM R/ R R RO ( ( sB /usr/lib/python2.7/site-packages/ansible/parsing/vault/__init__.pyR s i c C` s t | d d } t } y. t | t oB t j | t j d k } Wn t k
rY n X| r t j | d t j | | n}| d k r t
t j d t j } | j | nIt j
j | r | r | j | q t j | n t j d } z y1 t j | t j t j Bt j Bt j B| } WnT t k
r}
|
j t j k rot d t |
n t d t |
n XzT y$ t j | d t j | | Wn) t k
r} t d
t | n XWd t j | XWd t j | Xd S( s) Write the data bytes to given path
This is used to write a byte string to a file or stdout. It is used for
writing the results of vault encryption or decryption. It is used for
saving the ciphertext after encryption and it is also used for saving the
plaintext after decrypting a vault. The type of the 'data' arg should be bytes,
since in the plaintext case, the original contents can be of any text encoding
or arbitrary binary data.
When used to write the result of vault encryption, the val of the 'data' arg
should be a utf-8 encoded byte string and not a text typ and not a text type..
When used to write the result of vault decryption, the val of the 'data' arg
should be a byte string and not a text type.
:arg data: the byte string (bytes) data
:arg thefile: file descriptor or filename to save 'data' to.
:arg shred: if shred==True, make sure that the original data is first shredded so that is cannot be recovered.
:returns: None
R& R' ii R t bufferi? s: Vault file got recreated while we were operating on it: %ss) Problem creating temporary vault file: %ss+ Unable to write to temporary vault file: %sN( R R+ t
isinstancet intt fcntlt F_GETFDRL R~ t ftruncateR t getattrR R R R R R t umaskR t O_CREATt O_EXCLt O_RDWRt O_TRUNCR t errnot EEXISTR R R ( Re R/ t thefileR t modet b_file_datat is_fdt outputt
current_umaskR t oseR ( ( sB /usr/lib/python2.7/site-packages/ansible/parsing/vault/__init__.pyR s@ .
1 c C` s d } t j j | r7 t j | } t j | n t j | | | d k r t j | | j t j
| | j | j n d S( N(
Rj R~ R R R R t shutilt moveR R R R R ( Re t srct destR ( ( sB /usr/lib/python2.7/site-packages/ansible/parsing/vault/__init__.pyR e s c C` s5 t j j d d } t j | } | j | | S( Nt EDITORt vi( R~ t environt gett shlexR> RQ ( Re RM t
env_editort editor( ( sB /usr/lib/python2.7/site-packages/ansible/parsing/vault/__init__.pyR t s
N( R R! Rj Rf R R R+ R R R R R
R R
R R R R. R R R ( ( ( sB /usr/lib/python2.7/site-packages/ansible/parsing/vault/__init__.pyR s % !+
( M t VaultAES256c B` s e Z d Z d Z e d Z e d Z e d Z e d Z e d Z
e d Z e d Z e d Z
e d
Z e d Z e d Z RS(
sw
Vault implementation using AES-CTR with an HMAC-SHA256 authentication code.
Keys are derived using PBKDF2
c C` s! t r t r t t n d S( N( t HAS_CRYPTOGRAPHYt HAS_PYCRYPTOR t NEED_CRYPTO_LIBRARY( Re ( ( sB /usr/lib/python2.7/site-packages/ansible/parsing/vault/__init__.pyRf s c C` sH t d t j d d | | d | d d d t } | j | } | S( Nt algorithmt lengthi t saltt
iterationsi' t backend( R R R t CRYPTOGRAPHY_BACKENDt derive( t
b_passwordR] t
key_lengtht iv_lengtht kdft b_derivedkey( ( sB /usr/lib/python2.7/site-packages/ansible/parsing/vault/__init__.pyt _create_key_cryptography s c C` s t } t j | | | j S( N( t SHA256_pycryptot
HMAC_pycryptot newt digest( R t st
hash_function( ( sB /usr/lib/python2.7/site-packages/ansible/parsing/vault/__init__.pyt _pbkdf2_prf s c C` s0 t | | d d | | d d d | j } | S( Nt dkLeni R7 i' t prf( t PBKDF2_pycryptoRT ( t clsRH R] RI RJ RL ( ( sB /usr/lib/python2.7/site-packages/ansible/parsing/vault/__init__.pyt _create_key_pycrypto s c C` s d } t rP t j j d } | j | | | | } | | d | d | !} nV t r d } | j | | | | } t | | d | d | ! } n t t d | | } | | | d !} | | | f S( Ni i i i s (Detected in initctr)(
R> R R t
block_sizeRM R? RY R R R@ ( RX RH R] RI RJ RL t b_ivt b_key1t b_key2( ( sB /usr/lib/python2.7/site-packages/ansible/parsing/vault/__init__.pyt _gen_key_initctr s "
c
C` s t t j | t j | t } | j } t j t j j j
} | j | j | | j } | | j 7} t
| t j t } | j | | j } t t | d d t | f S( NR& R ( t C_CipherR R R t CTRRF t encryptorR
t PKCS7RZ t paddert updatet finalizeR R R R R (
R R\ R] R[ t cipherRa Rc RH t hmact b_hmac( ( sB /usr/lib/python2.7/site-packages/ansible/parsing/vault/__init__.pyt _encrypt_cryptography s $ "
c
C` s t j } | t | | p | } | t | t | d d d d 7} t j d d t | d } t j | t j d | } | j | } t
j | | t } t | j d d t
| f S(
NR$ R% R& R' i t
initial_valuei t counterR ( t AES_pycryptoRZ R? R t chrt Counter_pycryptoRP R t MODE_CTRR RO RN t hexdigestR (
R R\ R] R[ t bst padding_lengtht ctrRf RH Rg ( ( sB /usr/lib/python2.7/site-packages/ansible/parsing/vault/__init__.pyt _encrypt_pycrypto s & c C` s | d k r t d n t j d } | j } | j | | \ } } } t ru | j | | | | \ } } n7 t r | j | | | | \ } } n t
t d d j t
| | | g }
t
|
}
|
S( Ns' The secret passed to encrypt() was Nonei s (Detected in encrypt)s
( Rj R R~ R Rg R^ R> Ri R? Rt R R@ R@ R ( RX R Ra R] RH R\ R] R[ Rh RH RX ( ( sB /usr/lib/python2.7/site-packages/ansible/parsing/vault/__init__.pyR s !! c C` s t | t j t } | j | y | j t | Wn# t k
ra } t d | n Xt t
j | t j
| t } | j } t j d j }
|
j | j | | j |
j } | S( Ns HMAC verification failed: %si ( R R R RF Rd t verifyR\ R R R_ R R R R` t decryptorR
Rb t unpadderRe ( RX RH R^ R\ R] R[ Rg R Rf Rv Rw R ( ( sB /usr/lib/python2.7/site-packages/ansible/parsing/vault/__init__.pyt _decrypt_cryptography s
$
c C` s t | t o t | t s- t d n t | t | k rI t Sd } xN t | | D]= \ } } t r | | | AO} q_ | t | t | AO} q_ W| d k S( s
Comparing 2 byte arrrays in constant time
to avoid timing attacks.
It would be nice if there was a library for this but
hey.
s6 _is_equal can only be used to compare two byte stringsi ( R R R* R? R+ R R t ord( t b_at b_bt resultt b_xt b_y( ( sB /usr/lib/python2.7/site-packages/ansible/parsing/vault/__init__.pyt _is_equal s c C` s t j | | t } | j | t | j s7 d St j d d t | d } t j | t j
d | } | j | } t r | d }
n t
| d }
| |
} | S( Ni Rj i Rk i( RO RP RN R R Rp Rj Rn R Rl Ro R R Ry ( RX RH R^ R\ R] R[ t hmac_decryptRs Rf R Rr ( ( sB /usr/lib/python2.7/site-packages/ansible/parsing/vault/__init__.pyt _decrypt_pycrypto. s
c C` s t | \ } } } | j } | j | | \ } } } t r] | j | | | | | }
n4 t r | j | | | | | }
n t t d |
S( Ns (Detected in decrypt)( R` Rg R^ R> Rx R? R R R@ ( RX RX Ra RH R] R^ RH R\ R] R[ R ( ( sB /usr/lib/python2.7/site-packages/ansible/parsing/vault/__init__.pyR E s ( R R! Ri Rf t staticmethodRM RT t classmethodRY R^ Ri Rt R Rx R R R ( ( ( sB /usr/lib/python2.7/site-packages/ansible/parsing/vault/__init__.pyR= s (q t
__future__R R R t typet
__metaclass__R) R R~ R R: R2 R R R t warningst binasciiR R R R[ R+ R> R? t HAS_SOME_PYCRYPTORj RF t catch_warningst simplefiltert DeprecationWarningt cryptography.exceptionsR t cryptography.hazmat.backendsR t cryptography.hazmat.primitivesR R
t# cryptography.hazmat.primitives.hmacR t) cryptography.hazmat.primitives.kdf.pbkdf2R t& cryptography.hazmat.primitives.ciphersR
R_ R R R. t ImportErrort
Crypto.CipherR Rl t Crypto.HashR RN RO t Crypto.UtilR Rn t Crypto.Protocol.KDFR RW t ansible.errorsR R t ansibleR RJ t ansible.module_utils.sixR R t ansible.module_utils.six.movesR t ansible.module_utils._textR R R t ansible.utils.displayR t ansible.utils.pathR Rs R- t frozensetR R R@ R R" R# R1 R9 RI RP RZ R\ R_ R` Rb Rc Rl R R R R R R R R R R R R= R ( ( ( sB /usr/lib/python2.7/site-packages/ansible/parsing/vault/__init__.pyt s
) 3 4*0 {