Commit Graph

70 Commits (94b74f14194d3afd08fdf40b761b56399233f8ad)

Author SHA1 Message Date
Matt Davis 8c1f701e6e
split PS wrapper and payload (CVE-2018-16859) (#49142)
* prevent scriptblock logging from logging payload contents
* added tests to verify no payload contents in PS Operational event log
* fix script action to send split-aware wrapper
* fix CLIXML error parser (return to -EncodedCommand exposed problems with it)
2018-11-26 15:28:21 -08:00
Jordan Borean e972287c35 win_exec: refactor PS exec runner (#45334)
* win_exec: refactor PS exec runner

* more changes for PSCore compatibility

* made some changes based on the recent review

* split up module exec scripts for smaller payload

* removed C# module support to focus on just error msg improvement

* cleaned up c# test classifier code
2018-10-02 15:55:53 -07:00
Jordan Borean 23c94295dc
Revert "powershell - fix for ANSIBLE_KEEP_REMOTE_FILES on older Pythons (#45942)" (#46238)
This reverts commit ce515a626c.
2018-09-28 09:04:03 +10:00
Jordan Borean 198423d6fb
powershell: do not quote join_path result to reflect ShellBase join_path (#45944) 2018-09-21 15:31:12 +10:00
Jordan Borean ce515a626c
powershell - fix for ANSIBLE_KEEP_REMOTE_FILES on older Pythons (#45942) 2018-09-21 10:03:57 +10:00
Jordan Borean 5c73d4f4bd
async: use async_dir for the async results file directory (#45461)
* win async: use async_dir for the async results file directory

* tried to unify POSIX and PowerShell async implementations of async_dir

* fix sanity issue
2018-09-20 19:37:54 +10:00
Jordan Borean d81249994e
win_script: add support for become and centralise exec wrapper builder (#45582)
* win_script: add support for become and centralise exec wrapper builder

* satisfying the pep8 gods

* do not scan for module dependencies when running as a script
2018-09-13 08:50:13 +10:00
Jordan Borean 559599842a windows async: return pipeline output in case of a failure (#44807) 2018-08-29 16:13:31 +02:00
Jordan Borean 6982dfc756 psrp: Added new Windows connection plugin (#41729)
* psrp: Added new Windows connection plugin

* Tweaks to connection options from review
2018-08-21 16:43:13 -07:00
Jordan Borean 22b921d47f
win-async: fix race condition in async run (#43691) 2018-08-06 09:21:53 +10:00
Jordan Borean 9259f31fee Add Ansible.ModuleUtils.PrivilegeUtil and converted code to use it (#43179)
* Add Ansible.ModuleUtils.PrivilegeUtil and converted code to use it

* Changed namespace and class to be a better standard and fixed some typos

* Changes from review

* changes to avoid out of bound mem of server 2008

* changes to detect failure when setting a privileged not allowed
2018-07-30 14:48:54 -07:00
Jordan Borean 2af36412f9
runas + async - get working on older hosts (#41772)
* runas + async - get working on older hosts

* fixed up sanity issues

* Moved first task to end of test for CI race issues

* Minor change to async test to be more stable, change to runas become to not touch the disk

* moved async test back to normal spot
2018-06-26 14:40:49 +10:00
Jordan Borean f84f3de7c2
powershell: Respect remote_tmp path set by the user (#40210)
* powershell: Respect remote_tmp path set by the user

* Fixed up linting error and typo

* Added changelog
2018-05-23 07:12:32 +10:00
Jordan Borean e0813d7d47
become win: better error messages and docs update (#39936)
* become win: better error messages and docs update

* Fix syntax error and added changelog fragment
2018-05-15 09:33:36 +10:00
Jordan Borean 25dea1f72c Change except Error when trying to get a missing option 2018-04-27 09:47:18 -04:00
Jordan Borean 71e8527d7c powershell: display non-ascii characters in command outputs (#37229) 2018-04-05 14:59:51 -07:00
Jordan Borean 708869edd6
win: handle non string as an environment value (#37215)
* win: handle non string as an environment value

* Changed powershell environment handler to use .net function instead for special chars
2018-03-09 08:02:54 +10:00
Toshio Kuratomi 06f73ad578
Normalize usage of temp and tmp on tmp (#36221)
* Normalize usage of temp and tmp on tmp
* Rename system_tmps system_tmpdirs
* Add ANSIBLE_REMOTE_TMP spelling of environment variables
2018-02-15 09:01:02 -08:00
Toshio Kuratomi a612137098 Final fix for #35666 Previous PR (#36143) was merged prematurely. 2018-02-14 18:46:13 -08:00
Toshio Kuratomi 15fe59ef0c * Fix for setting remote_tmp as a subdirectory of a system temp dir (#36143)
Fixes #35666

* Check that system_temps is all absolute paths
2018-02-14 20:34:14 -05:00
Jordan Borean d0e6889f93 win_become: another option to support become flags for runas (#34551)
* win_become: another option to support become flags for runas

* removed uneeded entries

* fixed up whitespace issue

* Copy edit
2018-01-19 13:58:10 -08:00
Jordan Borean 8edd1cf182
changed to enable windows temp path override (#34967) 2018-01-18 05:54:10 +10:00
Brian Coca bbd6b8bb42 Temporary (#31677)
* allow shells to have per host options, remote_tmp

added language to shell
removed module lang setting from general as  plugins have it now
use get to avoid bad powershell plugin
more resilient tmp discovery, fall back to `pwd`
add shell to docs
fixed options for when frags are only options
added shell set ops in t_e and fixed option frags
normalize tmp dir usag4e

- pass tmpdir/tmp/temp options as env var to commands, making it default for tempfile
- adjusted ansiballz tmpdir
- default local tempfile usage to the configured local tmp
- set env temp in action

add options to powershell
shift temporary to internal envvar/params
ensure tempdir is set if we pass var
ensure basic and url use expected tempdir
ensure localhost uses local tmp
give /var/tmp priority, less perms issues
more consistent tempfile mgmt for ansiballz
made async_dir configurable
better action handling, allow for finally rm tmp
fixed tmp issue and no more tempdir in ballz
hostvarize world readable and admin users
always set shell tempdir
added comment to discourage use of exception/flow control

* Mostly revert expand_user as it's not quite working.

This was an additional feature anyhow.

Kept the use of pwd as a fallback but moved it to a second ssh
connection.  This is not optimal but getting that to work in a single
ssh connection was part of the problem holding this up.

(cherry picked from commit 395b714120522f15e4c90a346f5e8e8d79213aca)

* fixed script and other action plugins

ensure tmpdir deletion
allow for connections that don't support new options (legacy, 3rd party)
fixed tests
2018-01-15 21:15:04 -08:00
Matt Davis 8ecc7bc4a1
minor become/runas cleanup (#32564)
* removed/blobified unused PInvoke stuff
* added try/finally around impersonation to ensure RevertToSelf is called in all cases
* added a few explanatory comments
2017-11-06 11:24:04 -08:00
Jordan Borean 15b492ca57 win_become: get admin token and fix async (#32485)
* win_become: make it easier to become with an admin token

* Fixed up pep8 whitespace

* fix for Server 2008

* Added support for async and become on newer hosts and fix warnings
2017-11-03 16:14:48 -07:00
Jordan Borean b004a6373a windows: add #AnsibleRequires for Windows modules (#31683)
* windows: add #AnsibleRequires to set whether a module requires module or a specific version

* fix up pep8 issues

* changed psversion to use the actual ps Requires -Version syntax

* missed the check on #Requires -Version

* fix #Requires module extensions
2017-10-23 14:21:30 -07:00
Jordan Borean 7fce636c2b windows: removed #Requires from PS pipelines as it causes STDERR false positives (#31558) 2017-10-11 14:16:58 -07:00
Matt Davis a4ceb4c35f improve become/runas error messaging on bogus/missing username (#31551) 2017-10-10 16:53:21 -07:00
Jordan Borean 82fa922491 win_become: Added support to become a service user (#30407)
* win_become: Added support to become a service user

* fixes for linting

* changes to get local and network service working

* fixed linting issues again

* pleasing pepe
2017-10-09 17:58:29 -07:00
Jordan Borean e61c2799ff win_become: move error handling to Ansible outside of shell (#31227)
* win_become: move error handling to Ansible outside of shell

* trimmed the output so double newlines don't get set

* added test for non-zero exit code

* missed issue URL on test

* changed exit to SetShouldExit
2017-10-03 21:42:27 -04:00
Jordan Borean 77b2aca5a2 fixed become to show the stdout and stderr streams instead of the StreamReader (#30254) 2017-09-13 17:35:12 +10:00
Matt Davis 9b383403ce switch become/runas to LogonUser/CreateProcessWithTokenW (#28253)
* non-uac works

* switch become/runas to LogonUser/CreateProcessWithTokenW

* fixes #22218
* provides consistent behavior across authtypes
* auto-elevates on UAC if target user has SE_TCB_NAME ("Act as part of the operating system") privilege
* sets us up for much more granular capabilities later (eg, network/service/batch logons)
2017-08-15 18:55:17 -07:00
Jordan Borean 1517db06c5 fix to alllow the winrm plugin to send input with Python 3 (#27474) 2017-07-31 18:35:05 -07:00
Matt Davis 0ee46cb0df converted become runas to explicit CreateProcessWithLogonW (#26378)
* fixes become_method: runas for unprivileged users
* sets permissions on tempdir appropriately
* allows automatic system environment generation for new token (old Process.Start way prevents this)
* add basic become runas tests
2017-07-03 17:46:27 -07:00
Matt Davis 36ad934156 re-enable non-pipelined mode for Powershell (#25012)
* fixes #23986
* fixes 3rd-party Windows connection plugins that don't support pipelining (eg awsrun)
2017-06-26 22:58:09 -07:00
Dag Wieers 5553b20828 Collated PEP8 fixes (#25293)
- Make PEP8 compliant
2017-06-02 12:14:11 +01:00
Matt Davis 8d291f91ee improve become_method: runas error handling (#23328)
Prescriptive errors for username/password issues and NTLM/Kerb auth failures, cleans up exception noise.
2017-04-06 01:34:30 -07:00
Matt Davis e084e8809e force Windows to always use preamble-free UTF8 input encoding (#22934)
* fixes #15770
* When running under the UTF-8 codepage, Powershell subprocesses will fail (eg, Start-Job, others) if the input encoding is using the default BOM preamble. This fix forces it to use no preamble in leaf_exec and win_shell, and includes tests to verify that Start-Job works.
2017-03-24 00:02:39 -07:00
Matt Davis 73f50b4f9f fix Windows env handling (#22927)
* fixes #22441
* fixes #22655
* moves all env handling into the exec wrapper; this should work for everything but raw, which is consistent with non-Windows.
2017-03-23 17:48:15 -07:00
Matt Davis ffa4f0c427 Suppress Windows Add-Type debug noise (#22722) 2017-03-16 15:44:42 -07:00
Matt Davis ce56da69b2 make windows async ... async (#22624)
Fixes #22575 - issue under new exec wrapper where unconstrained handle inheritance (for stdin) caused WinRM to block on breakaway processes. Uses explicit handle inheritance to ensure that only stdin read handle gets inherited. Adds test to ensure that async is actually async.
2017-03-14 16:37:55 -07:00
Matt Davis 07674a8446 prevent winrm Add-Type debug noise from polluting stderr (#22583) 2017-03-13 14:47:06 -07:00
Matt Davis 8265860f07 suppress PS "unapproved verb" warning (#22018) 2017-02-27 14:29:43 -08:00
Matt Davis 8527013fbe Complete rewrite of Windows exec wrapper (#21510)
* supports pipelining for faster execution
* supports become (runas), creates interactive subsession under WinRM batch logon
* supports usage of arbitrary module_utils files
* modular exec wrapper payload supports easier extension
* integrates async wrapper behavior for pipelined/become'd async
* module_utils are loaded as true Powershell modules, no more runtime modifications to module code
2017-02-17 00:09:56 -08:00
Brian Coca 9e0fd313d7 fix powershell mkdtemp 2017-01-25 13:19:10 -05:00
Matt Davis b773ae4291 Preserve exit code in winrm exec (#20166)
Raw winrm exec discards the exit code from external processes- this change preserves the exit code if present.
2017-01-16 11:21:48 -08:00
Toshio Kuratomi 4ed88512e4 Move uses of to_bytes, to_text, to_native to use the module_utils version (#17423)
We couldn't copy to_unicode, to_bytes, to_str into module_utils because
of licensing.  So once created it we had two sets of functions that did
the same things but had different implementations.  To remedy that, this
change removes the ansible.utils.unicode versions of those functions.
2016-09-06 22:54:17 -07:00
Matt Davis b860b2d258 windows environment support (#17402) 2016-09-06 13:00:21 -07:00
Matt Clay 72cca01cd4 Use file list, not recursion, in _fixup_perms. (#16924)
Run setfacl/chown/chmod on each temp dir and file.

This fixes temp file permissions handling on platforms such as FreeBSD
which always return success when using find -exec. This is done by
eliminating the use of find when setting up temp files and directories.

Additionally, tests that now pass on FreeBSD have been enabled for CI.
2016-08-05 18:40:28 -07:00
Matt Martz 0faddfa168 Move binary module detection into executor/module_common.py 2016-05-12 12:25:09 -05:00