o nnhNZ@sddlmZddlmZddlZddlZddlmZddlm Z ddl m Z ddl mZddlmZmZdd lmZdd lmZmZmZdd lmZeZGd d d eZdddZedkrcedSdS)) annotations)CLIN) constants)context)option_helpers)AnsibleOptionsError)to_textto_bytes) DataLoader) VaultEditorVaultLibmatch_encrypt_secret)DisplaycseZdZdZdZdZdZdZfddZfdd Z fd d Z fd d Z ddZ e d!ddZddZd"ddZddZddZddZddZdd ZZS)#VaultCLIa9 can encrypt any structured data file used by Ansible. This can include *group_vars/* or *host_vars/* inventory variables, variables loaded by *include_vars* or *vars_files*, or variable files passed on the ansible-playbook command line with *-e @file.yml* or *-e @file.json*. Role variables and defaults are also included! Because Ansible tasks, handlers, and other objects are data, these can also be encrypted with vault. If you'd like to not expose what variables you are using, you can keep an individual task file entirely encrypted. z ansible-vaultstdinzthe command line argszthe interactive promptcs>d|_d|_d|_d|_d|_d|_d|_tt| |dS)NF) b_vault_passb_new_vault_passencrypt_string_read_stdinencrypt_secretencrypt_vault_idnew_encrypt_secretnew_encrypt_vault_idsuperr__init__)selfargs __class__|jd?d@||gd} | j|jd| } | jdAddBdCtd | jdDddEtdFdG| jddddddS)HNz4encryption/decryption utility for Ansible data fileszH See '%s --help' for more information on a specific command. r)descepilogF)add_helpaction)destTz--output output_filez9output file name for encrypt or decrypt; use - for stdout)defaultr$helptypez--encrypt-vault-idrstorezMthe vault id used to encrypt (required if more than one vault-id is provided))r&r$r#r(r'createzCreate new vault encrypted file)r'parents)funcrFilename file_name*)r'metavarnargsz--skip-tty-checkz/allows editor to be opened when no tty attachedskip_tty_check store_true)r&r'r$r#decryptzDecrypt vault encrypted fileeditzEdit vault encrypted fileviewzView vault encrypted fileencryptzEncrypt YAML fileencrypt_stringzEncrypt a stringzString to encryptstring_to_encryptz-pz--promptencrypt_string_promptz Prompt for the string to encrypt)r$r#r'z --show-inputshow_string_inputz9Do not hide input when prompted for the string to encrypt)r$r&r#r'z-nz--nameencrypt_string_namesappendzSpecify the variable namez --stdin-nameencrypt_string_stdin_namez#Specify the variable name for stdin)r$r&r'rekeyzRe-key a vault encrypted filez--new-vault-password-filenew_vault_password_filez!new vault password file for rekeyz--new-vault-id new_vault_idz'the new vault identity to use for rekey)r&r$r(r')rr init_parserospathbasenamesysargvopt_helpArgumentParseradd_vault_optionsadd_verbosity_optionsparseradd_subparsersrequired add_argument unfrack_pathstr add_parser set_defaultsexecute_createexecute_decrypt execute_edit execute_viewexecute_encryptexecute_encrypt_string execute_rekeyadd_mutually_exclusive_group) rcommon subparsersoutputvault_id create_parserdecrypt_parser edit_parser view_parserencrypt_parserenc_str_parser rekey_parserrekey_new_grouprrrrB9s              zVaultCLI.init_parsercstt||}|jt_|jr|jD] }d|vrtd|qt|ddr0t|j dkr0td|j dkrPd|j vsC|j sC|j sF|j sFd|_ |j rP|j rPtd |S) N;zK'%s' is not a valid vault id. The character ';' is not allowed in vault idsr%z;At most one input file may be used with the --output optionr8-TzEThe --prompt option is not supported if also reading input from stdin)rrpost_process_args verbositydisplay vault_idsrgetattrlenrr#r>r:r)roptionsr_rrrrks    zVaultCLI.post_process_argscstt|t}td}ttjd}t j }||}tjd}|dvr=|j ||ttjdtjdd}|s=t d|d vrd}|d vrOtjd pNt j }d}|j ||ttjdtjdd d }t|dkry|syt dddd|D|st dt||d}|d|_|d|_|dvrtjd pt j }g} |r|} tjdr| tjdg} tjdr| tjd|j || | tjdd d } | st dt| |d} | d|_| d|_||t|} t| |_tjdt|dS)N?rnr#)r4r6r?r5vault_password_filesask_vault_pass)rnrsrtz3A vault password is required to use Ansible's Vault)r7r8r*)r5rT)rnrsrtcreate_new_passwordrizbThe vault-ids %s are available to encrypt. Specify the vault-id to encrypt with --encrypt-vault-id,cSsg|]}|dqS)rr.0xrrr z VaultCLI.run..)rr)r?rAr@z=A new vault password is required to use Ansible's Vault rekeyr,)rrrunr rCumasklistrCLIARGSCDEFAULT_VAULT_IDENTITY_LISTsetup_vault_secretsrDEFAULT_VAULT_ENCRYPT_IDENTITYrpjoinr rrr=rrset_vault_secretsr r editor)rloader old_umaskrndefault_vault_idsr# vault_secretsrr new_vault_idsnew_vault_password_filesnew_vault_secretsrvaultrrrr|s             z VaultCLI.runcCsvtjdstjrtjdddtjdpdgD]}|jj||j|j tjddqtj r9tjdddd Sd S) z; encrypt the supplied file using the provided vault secret rz"Reading plaintext input from stdinTstderrrjr%)r_r%Encryption successfulN) rrrFrisattyrmr encrypt_filerrstdoutrfrrrrXs  zVaultCLI.execute_encryptNc Csh|pd}d}|r d|}d|}g}t|}|||D] }|dd||fqd|}|S)N z%s: z %s!vault |z%s%s  )rr= splitlinesr) b_ciphertextindentnameblock_format_var_nameblock_format_headerlinesvault_ciphertextlineyaml_ciphertextrrrformat_ciphertext_yamls   zVaultCLI.format_ciphertext_yamlcCs~d}g}ddtjdD}tjdrKd}d}td}|dkr"|}tjd  }|r-d }nd }tj||d }|dkr>td t|}|||j|f|jrt j rZtjdddt j } | dkrgtdt j rv| dsvtdt| }tjd}|||j|ftjddrtttjd|} t|t| krtjdddtjdtjdddd|t| dD] } | d| fqndd|D} | D]} | \}} | dkrtdt| }|||j|fq|j||jd}g}|D]}|dd}|dd}|rt j||t|q|d|jd|tjd p,d!t j r=tjd"dddSdS)#z= encrypt the supplied string using the provided vault secret NcSsg|]}|dkr|qS)rjrrwrrrrz*sz3VaultCLI.execute_encrypt_string..rr:zString to encrypt: z#Variable name (enter for no name): rr;zString to encrypt (hidden): zString to encrypt:)privatez@The plaintext provided from the prompt was empty, not encryptingzpReading plaintext input from stdin. (ctrl-d to end input, twice if your content does not already have a newline)Trzstdin was empty, not encryptingrr>r<Fz=The number of --name options do not match the number of args.zCThe last named variable will be "%s". The rest will not have names.cSsg|]}d|fqSNrrwrrrrzmr{zKThe plaintext provided from the command line args was empty, not encryptingr_errout r%rjr)rrrmpromptrr r= FROM_PROMPTrrFrrrreadendswith FROM_STDINgetr~ziprp FROM_ARGS_format_output_vault_stringsrrwriter write_datar)r b_plaintextb_plaintext_listrmsgrname_prompt_response hide_inputprompt_response stdin_textname_and_text_list extra_arg name_and_text plaintextoutputsb_outsr^rrrrrrY!s~              zVaultCLI.execute_encrypt_stringcCsd}t|dkr d}g}t|D]:\}}|\}}} |jj||j|d} |j| | d} d} |rB|d} | rs*         M