VhzddlmZdZddlZddlZddlZddlZddlZddl m Z ddl m Z mZddl mZddlmZddlmZmZmZdd lmZdd lmZdd lmZdd lmZdd lmZdZ dZ! ddl"m#Z#m$Z$m%Z%ddl&m'Z'm(Z(ddl)m*Z*m+Z+ddl,m-Z-m.Z.ddl/m0Z0ddl1m2Z2m3Z3eZ6GddeZ7y#e4$rZ5dZ e5Z!YdZ5[5!dZ5[5wwxYw)) annotationsa$ author: Ansible Core Team name: psrp short_description: Run tasks over Microsoft PowerShell Remoting Protocol description: - Run commands or put/fetch on a target via PSRP (WinRM plugin) - This is similar to the P(ansible.builtin.winrm#connection) connection plugin which uses the same underlying transport but instead runs in a PowerShell interpreter. version_added: "2.7" requirements: - pypsrp>=0.4.0, <1.0.0 (Python library) extends_documentation_fragment: - connection_pipelining options: # transport options remote_addr: description: - The hostname or IP address of the remote host. default: inventory_hostname type: str vars: - name: inventory_hostname - name: ansible_host - name: ansible_psrp_host remote_user: description: - The user to log in as. type: str vars: - name: ansible_user - name: ansible_psrp_user keyword: - name: remote_user remote_password: description: Authentication password for the O(remote_user). Can be supplied as CLI option. type: str vars: - name: ansible_password - name: ansible_winrm_pass - name: ansible_winrm_password aliases: - password # Needed for --ask-pass to come through on delegation port: description: - The port for PSRP to connect on the remote target. - Default is V(5986) if O(protocol) is not defined or is V(https), otherwise the port is V(5985). type: int vars: - name: ansible_port - name: ansible_psrp_port keyword: - name: port protocol: description: - Set the protocol to use for the connection. - Default is V(https) if O(port) is not defined or O(port) is not V(5985). choices: - http - https type: str vars: - name: ansible_psrp_protocol path: description: - The URI path to connect to. type: str vars: - name: ansible_psrp_path default: 'wsman' auth: description: - The authentication protocol to use when authenticating the remote user. - The default, V(negotiate), will attempt to use Kerberos (V(kerberos)) if it is available and fall back to NTLM (V(ntlm)) if it isn't. type: str vars: - name: ansible_psrp_auth choices: - basic - certificate - negotiate - kerberos - ntlm - credssp default: negotiate cert_validation: description: - Whether to validate the remote server's certificate or not. - Set to V(ignore) to not validate any certificates. - O(ca_cert) can be set to the path of a PEM certificate chain to use in the validation. choices: - validate - ignore default: validate type: str vars: - name: ansible_psrp_cert_validation ca_cert: description: - The path to a PEM certificate chain to use when validating the server's certificate. - This value is ignored if O(cert_validation) is set to V(ignore). type: path vars: - name: ansible_psrp_cert_trust_path - name: ansible_psrp_ca_cert aliases: [ cert_trust_path ] connection_timeout: description: - The connection timeout for making the request to the remote host. - This is measured in seconds. type: int vars: - name: ansible_psrp_connection_timeout default: 30 read_timeout: description: - The read timeout for receiving data from the remote host. - This value must always be greater than O(operation_timeout). - This option requires pypsrp >= 0.3. - This is measured in seconds. type: int vars: - name: ansible_psrp_read_timeout default: 30 version_added: '2.8' reconnection_retries: description: - The number of retries on connection errors. type: int vars: - name: ansible_psrp_reconnection_retries default: 0 version_added: '2.8' reconnection_backoff: description: - The backoff time to use in between reconnection attempts. (First sleeps X, then sleeps 2*X, then sleeps 4*X, ...) - This is measured in seconds. - The C(ansible_psrp_reconnection_backoff) variable was added in Ansible 2.9. type: int vars: - name: ansible_psrp_connection_backoff - name: ansible_psrp_reconnection_backoff default: 2 version_added: '2.8' message_encryption: description: - Controls the message encryption settings, this is different from TLS encryption when O(protocol) is V(https). - Only the auth protocols V(negotiate), V(kerberos), V(ntlm), and V(credssp) can do message encryption. The other authentication protocols only support encryption when V(protocol) is set to V(https). - V(auto) means means message encryption is only used when not using TLS/HTTPS. - V(always) is the same as V(auto) but message encryption is always used even when running over TLS/HTTPS. - V(never) disables any encryption checks that are in place when running over HTTP and disables any authentication encryption processes. type: str vars: - name: ansible_psrp_message_encryption choices: - auto - always - never default: auto proxy: description: - Set the proxy URL to use when connecting to the remote host. vars: - name: ansible_psrp_proxy type: str ignore_proxy: description: - Will disable any environment proxy settings and connect directly to the remote host. - This option is ignored if O(proxy) is set. vars: - name: ansible_psrp_ignore_proxy type: bool default: false # auth options certificate_key_pem: description: - The local path to an X509 certificate key to use with certificate auth. type: path vars: - name: ansible_psrp_certificate_key_pem certificate_pem: description: - The local path to an X509 certificate to use with certificate auth. type: path vars: - name: ansible_psrp_certificate_pem credssp_auth_mechanism: description: - The sub authentication mechanism to use with CredSSP auth. - When V(auto), both Kerberos and NTLM is attempted with kerberos being preferred. type: str choices: - auto - kerberos - ntlm default: auto vars: - name: ansible_psrp_credssp_auth_mechanism credssp_disable_tlsv1_2: description: - Disables the use of TLSv1.2 on the CredSSP authentication channel. - This should not be set to V(yes) unless dealing with a host that does not have TLSv1.2. default: false type: bool vars: - name: ansible_psrp_credssp_disable_tlsv1_2 credssp_minimum_version: description: - The minimum CredSSP server authentication version that will be accepted. - Set to V(5) to ensure the server has been patched and is not vulnerable to CVE 2018-0886. default: 2 type: int vars: - name: ansible_psrp_credssp_minimum_version negotiate_delegate: description: - Allow the remote user the ability to delegate it's credentials to another server, i.e. credential delegation. - Only valid when Kerberos was the negotiated auth or was explicitly set as the authentication. - Ignored when NTLM was the negotiated auth. type: bool vars: - name: ansible_psrp_negotiate_delegate negotiate_hostname_override: description: - Override the remote hostname when searching for the host in the Kerberos lookup. - This allows Ansible to connect over IP but authenticate with the remote server using it's DNS name. - Only valid when Kerberos was the negotiated auth or was explicitly set as the authentication. - Ignored when NTLM was the negotiated auth. type: str vars: - name: ansible_psrp_negotiate_hostname_override negotiate_send_cbt: description: - Send the Channel Binding Token (CBT) structure when authenticating. - CBT is used to provide extra protection against Man in the Middle C(MitM) attacks by binding the outer transport channel to the auth channel. - CBT is not used when using just C(HTTP), only C(HTTPS). default: true type: bool vars: - name: ansible_psrp_negotiate_send_cbt negotiate_service: description: - Override the service part of the SPN used during Kerberos authentication. - Only valid when Kerberos was the negotiated auth or was explicitly set as the authentication. - Ignored when NTLM was the negotiated auth. default: WSMAN type: str vars: - name: ansible_psrp_negotiate_service # protocol options operation_timeout: description: - Sets the WSMan timeout for each operation. - This is measured in seconds. - This should not exceed the value for O(connection_timeout). type: int vars: - name: ansible_psrp_operation_timeout default: 20 max_envelope_size: description: - Sets the maximum size of each WSMan message sent to the remote host. - This is measured in bytes. - Defaults to C(150KiB) for compatibility with older hosts. type: int vars: - name: ansible_psrp_max_envelope_size default: 153600 configuration_name: description: - The name of the PowerShell configuration endpoint to connect to. type: str vars: - name: ansible_psrp_configuration_name default: Microsoft.PowerShell N) constants)AnsibleConnectionFailure AnsibleError)AnsibleFileNotFound)boolean)to_bytes to_nativeto_text)ConnectionBase) ShellModule) _common_args)Display)sha1T)GenericComplexObjectPSInvocationStateRunspacePoolState)AuthenticationError WinRMError)PSHostPSHostUserInterface) PowerShell RunspacePool)WSMan)ConnectionErrorConnectTimeoutFceZdZUdZdZdZdZded<dfd Zdfd Z dd Z ddfd Z dfd Z dfd Z dd ZddZ d ddZddZxZS) Connectionpsrp)z.ps1z.exeFTPowerShellPlugin_shellcd|_d|_d|_d|_d|_d|_t t|"|i|tjstjdjtjtjdjtjtjdjtjyy)NT powershellpypsrprequests_credsspurllib3)always_pipeline_moduleshas_native_asyncrunspacehost_last_pipeline _shell_typesuperr__init__C DEFAULT_DEBUGlogging getLoggersetLevelWARNINGINFO)selfargskwargs __class__s O/home/dcms/DCMS/lib/python3.12/site-packages/ansible/plugins/connection/psrp.pyr/zConnection.__init__^s'+$ $-1 #' 15' j$($9&9   h ' 0 0 A   0 1 : :7<< H   i ( 1 1',, ?c tstdttztt ||jtjd|jd|jd|j|j|jstdi|j}t!}t#ddddd|d|_t'||j$|j(|_ tj+d |j,d |j(d |j.j0|j |jj3d|_d|_ |S#t4$r}t7d t|zd}~wt8$r}t7d t|zd}~wt:t<f$r}t7dt|zd}~wwxYw)Nz,pypsrp or dependencies are not installed: %sz$ESTABLISH PSRP CONNECTION FOR USER: z ON PORT  TO r+FzAnsible PSRP Host)r+configuration_namezPSRP OPEN RUNSPACE: auth=z configuration=z endpoint=z*failed to authenticate with the server: %sz0psrp connection failure during runspace open: %sz*Failed to connect to the host via PSRP: %sT)! HAS_PYPSRPrr PYPSRP_IMP_ERRr.r_connect _build_kwargsdisplayvvv _psrp_user _psrp_port _psrp_hostr*r_psrp_conn_kwargsrrr+r_psrp_configuration_namevvvvv _psrp_auth transportendpointopenrrrrr _connectedr,)r7 connectionhost_uier:s r;rDzConnection._connectnsM!*>!: ;< < j$(*  __dootH  *}}8!7!78J*+GtT52Et&.DI)#'#@#@DM MM$"?"?%%..06:oo     ""$#DO"&D  !' P.0@BKA,0OPP .Fl#$^4 .@l# s0E22 G#;F G#F55G#GG#c,|jsd|_y |jtjd|jd|_|jy#t$r+}tj dt |zYd}~hd}~wwxYw)Nz*PSRP reset - failed to closed runspace: %szPSRP: Reset Connectionr?) rRr*close ExceptionrFdebugr rMrJrD)r7rUs r;resetzConnection.resetsw DM  U JJL  .T__ E    U MMFQRS T T UsA B(!BBctt| |||d}|jdj t dzrt j|jdd}t|d}t|dd}|rNt|tr>|jd r-t|jd d d}td |z|jj!d d d }||k(rt"j%dnYt"j%d|z|j&n4td|z}|}t"j%d|z|j&|j)||\} } } | | | fS)N)in_datasudoable z -EncodedCommandz utf-16-lesurrogate_or_strictpassthru)errors nonstringz#!rz=cannot run the interpreter '%s' on the psrp connection pluginr z!PSRP: EXEC (via pipeline wrapper)z PSRP: EXEC %sr?z%s exit $LASTEXITCODE)r.r exec_command startswithjoinrbase64 b64decodesplitr isinstancestrr splitlinesrr"build_module_commandrFrGrJ_exec_psrp_script) r7cmdr\r] pwsh_in_data b_commandscript interpreterbootstrap_wrapperrcstdoutstderrr:s r;rezConnection.exec_commandst j$,S'6> - @,0 >>#((<03EE F((3);r?a begin { $ErrorActionPreference = "Stop" $WarningPreference = "Continue" $path = $MyInvocation.UnboundArguments[0] $fd = [System.IO.File]::Create($path) $algo = [System.Security.Cryptography.SHA1CryptoServiceProvider]::Create() $bytes = @() $bindingFlags = [System.Reflection.BindingFlags]'NonPublic, Instance' Function Get-Property { <# .SYNOPSIS Gets the private/internal property specified of the object passed in. #> Param ( [Parameter(Mandatory=$true, ValueFromPipeline=$true)] [System.Object] $Object, [Parameter(Mandatory=$true, Position=1)] [System.String] $Name ) $Object.GetType().GetProperty($Name, $bindingFlags).GetValue($Object, $null) } Function Set-Property { <# .SYNOPSIS Sets the private/internal property specified on the object passed in. #> Param ( [Parameter(Mandatory=$true, ValueFromPipeline=$true)] [System.Object] $Object, [Parameter(Mandatory=$true, Position=1)] [System.String] $Name, [Parameter(Mandatory=$true, Position=2)] [AllowNull()] [System.Object] $Value ) $Object.GetType().GetProperty($Name, $bindingFlags).SetValue($Object, $Value, $null) } Function Get-Field { <# .SYNOPSIS Gets the private/internal field specified of the object passed in. #> Param ( [Parameter(Mandatory=$true, ValueFromPipeline=$true)] [System.Object] $Object, [Parameter(Mandatory=$true, Position=1)] [System.String] $Name ) $Object.GetType().GetField($Name, $bindingFlags).GetValue($Object) } # MaximumAllowedMemory is required to be set to so we can send input data that exceeds the limit on a PS # Runspace. We use reflection to access/set this property as it is not accessible publicly. This is not ideal # but works on all PowerShell versions I've tested with. We originally used WinRS to send the raw bytes to the # host but this falls flat if someone is using a custom PS configuration name so this is a workaround. This # isn't required for smaller files so if it fails we ignore the error and hope it wasn't needed. # https://github.com/PowerShell/PowerShell/blob/c8e72d1e664b1ee04a14f226adf655cced24e5f0/src/System.Management.Automation/engine/serialization.cs#L325 try { $Host | Get-Property 'ExternalHost' | ` Get-Field '_transportManager' | ` Get-Property 'Fragmentor' | ` Get-Property 'DeserializationContext' | ` Set-Property 'MaximumAllowedMemory' $null } catch {} } process { $bytes = [System.Convert]::FromBase64String($input) $algo.TransformBlock($bytes, 0, $bytes.Length, $bytes, 0) > $null $fd.Write($bytes, 0, $bytes.Length) } end { $fd.Close() $algo.TransformFinalBlock($bytes, 0, 0) > $null $hash = [System.BitConverter]::ToString($algo.Hash).Replace('-', '').ToLowerInvariant() Write-Output -InputObject "{`"sha1`":`"$hash`"}" } Rr`rbz#file or module does not exist: "%s"c 3lKd}td5tfddD]n}t|}||z } j|tj d||fz j tj|}t|gp|dk(rdgdddy#1swYyxYww)Nrrbc&jS)N)read) buffer_sizesrc_fdsr;z7Connection.put_file..read_gen..JsFKK ,Dr<r<z%PSRP PUT %s to %s (offset=%d, size=%dr?r ) rQiterlenupdaterFrMrJrh b64encoder ) offsetb_datadata_lenb64_datar b_in_pathrin_pathout_pathr7 sha1_hashs @r;read_genz%Connection.put_file..read_genFsFi& &"$DsK .F"6{Hh&F$$V,MM"IWV^`fhpLq"q'+"8%//7H"8,-- .Q;$J   sB4B B( B4(B1-B4 argumentsrrz'Remote sha1 was not returned, stdout: 'z ', stderr: ''zRemote sha1 hash z does not match local hash )r.rput_filer"_unquoterFrGrJintr*rSmax_payload_sizerr ospathexistsrr rorjsonloadsr hexdigestget)r7rr copy_scriptrrvrwrx put_output local_sha1 remote_sha1rrrr:s``` @@@r;rzConnection.put_files j$((;;;''1 gx8t O^ D4==33DDrIQNQRRS F W-BC ww~~i(%&KiX_N`&`a a  &"33KX`Wa3bFF 7y01 1ZZ0 ((*  nnV, "+F"3Yv5F HI Ij("+K"8)J:O QR R)r<c ftt| ||tj d|d||j |j j|}|jdd}t|jjj|jjjdz dzz }||dzz }d }d }|j|d |g \}}} |d k7rtd|dt| |j!dk(ryt#|d} d } t%| d5} tj'd||| fz|j |j|| |g\}}} |d k7rtd|dt| t)j*|j!} | j-| t/| |krn| t/| z } |jd\}}} |d k7r$tj1d|dt| dddy#1swYyxYw)NzFETCH r>r?\/r{r|iaparam([string]$Path) $ErrorActionPreference = "Stop" if (Test-Path -LiteralPath $path -PathType Leaf) { $fs = New-Object -TypeName System.IO.FileStream -ArgumentList @( $path, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read, [System.IO.FileShare]::Read ) } elseif (Test-Path -Path $path -PathType Container) { Write-Output -InputObject "[DIR]" } else { Write-Error -Message "$path does not exist" $host.SetShouldExit(1) }a;param([int64]$Offset, [int]$BufferSize) $ErrorActionPreference = "Stop" $fs.Seek($Offset, [System.IO.SeekOrigin]::Begin) > $null $buffer = New-Object -TypeName byte[] -ArgumentList $BufferSize $read = $fs.Read($buffer, 0, $buffer.Length) if ($read -gt 0) { [System.Convert]::ToBase64String($buffer, 0, $read) }F)use_local_scoperrz'failed to setup file stream for fetch 'z': z[DIR]r`r}wbzPSRP FETCH %s to %s (offset=%drzfailed to transfer file to 'z $fs.Close()z,failed to close remote file stream of file ')r.r fetch_filerFrGrJr"rreplacerr*rSrrorr stripr rQrMrhriwriterwarning)r7rr max_b64_sizer setup_script read_scriptrvrwrx b_out_pathrout_filedatar:s r;rzConnection.fetch_filejsR j$*7H= :  *++&&w/##D#.4==33DD MM44EEIAMOP "lT&9:  $ "33 !i4 FF 7"*If,= ?@ @ \\^w & h/DE  *d # Kx >&&9:@DQ%)%;%;%{3&<&"FF7&*2If4E(GHH'' 7t$t9{*#d)#""&!7!7 !F BQw.5y7H!JK) K K Ks -C1H''H0c8|jry|jjtjk(rRtj d|jj z|j|jjd|_d|_ d|_ y)NzPSRP CLOSE RUNSPACE: %sr?F) r*staterOPENEDrFrMidrJrWrRr,)r7s r;rWzConnection.closesq ==T]]004E4L4LL MM3t}}7G7GH#  0 MM   ! "r<c V|jd|_|jd|_|jd}|jd}||d}d}n |t|dk7rdnd}n | |dk(rdnd}t||_|jd |_|jd |_|jd }|jd }|d k(rd}n||}nd}td*id|jd|jd|jd|jdd|dk(d|jdd |j d |d|jdd|jdd|jddt|jdd|jdd|jdd|jdd|jdd t|jd d!|jd!d"|jd"d#|jd#d$|jd$d%|jd%d&|jd&d'|jd'd(|jd(d)|jd)|_ y)+N remote_addr remote_userprotocolporthttpsibiahttpauthr@cert_validationca_certignoreFTserverusernamepasswordremote_passwordsslrconnection_timeout encryptionmessage_encryptionproxyno_proxy ignore_proxymax_envelope_sizeoperation_timeout read_timeoutreconnection_retriesreconnection_backoffcertificate_key_pemcertificate_pemcredssp_auth_mechanismcredssp_disable_tlsv1_2credssp_minimum_versionnegotiate_send_cbtnegotiate_delegatenegotiate_hostname_overridenegotiate_servicerA) get_optionrJrHrrIrNrLdictrfloatrK)r7rrrcert_trust_pathpsrp_cert_validations r;rEzConnection._build_kwargss//-8//-8??:.v&   HD  "%d)t"3wH \#w.4DDd)//&1(,8L(M%//*;<//)4 h &#(  (#2 #' !%" ??" " __" __%67 " G# " ( " " 1"  $/CD" ';<" //'*" T__^<=" #oo.AB" #oo.AB" 8" "&1G!H!" ""'t7M'N!O#" $!%0E F%" &!OO,=>'" ($(??3K#L)" *%)OO4M$N+" ,%)OO4M$N-" . $/CD/" 0 $/CD1" 2)-8U(V3" 4#oo.AB5" r<c|jr@tj|j_|jj d|_t |j }|j|||r|D]}|j||j||j|\}}} ||_||| fS)N)r)input) r,rRUNNINGrstoprr* add_script add_argumentinvoke_parse_pipeline_result) r7rs input_datarrpsargrvrwrxs r;rozConnection._exec_psrp_scripts   ):(A(AD   %    $ $ &"&D   & fo >   %$ % #!88<FF !66!!r<c |jjxs|jrdnd}g}|jD]}t |t r|j |j}|jjD]\}}|j|d||jjD]\}}|j|d|dj|}n t|d}|j|t|jjj dkDr#||jjj z }dj|} g} |j"j$D]} | j&rd| j&znd } | j(rd | j(znd } | t+| d| d | j,d | j.}| j0}t2j4d k\r ||d|zz }| j|t|jjj6dkDr#| |jjj6z } dj| Dcgc] }t|c}}t2j9d|z|j:t2j9d| z|j:t2j9d|z|j:d|j_g|jj_g|jj_|t=| dt=|dfScc}w)a} PSRP doesn't have the same concept as other protocols with its output. We need some extra logic to convert the pipeline streams and host output into the format that Ansible understands. :param pipeline: The finished PowerShell pipeline that invoked our commands :return: rc, stdout, stderr based on the pipeline output rz:  simplerepr)rcz z%s : r z%s z + CategoryInfo : z + FullyQualifiedErrorId : r|z StackTrace: %sz PSRP RC: %dr?zPSRP STDOUT: %szPSRP STDERR: %szutf-8)encoding)r+rv had_errorsoutputrkr to_string property_setsadapted_propertiesitemsappendextended_propertiesrgr ruirwstreamserror command_nameinvocation_position_messagerlmessagefq_errorscript_stacktracerF verbosityrxrMrJr )r7pipelinerv stdout_listr obj_lineskeyvalue output_msgrw stderr_listrrposition error_msg stacktraceorxs r;rz!Connection._parse_pipeline_resultsYY\\ >8#6#6aA oo +F&"67F?"("<"<"B"B"D?JC$$#u%=>?"ZZ 2 $V|D   z * + tyy||"" #a ' 499<<.. .Kk* %%++ *Er.s#k Z   "A.=TT5L9)&   aaA7:"C )NZNZJNs$0B''B:,B55B: