ansible-core 2.17.5rc1__py3-none-any.whl → 2.18.0rc1__py3-none-any.whl

ansible/module_utils/common/text/formatters.py

@@ -20,6 +20,18 @@ SIZE_RANGES = {
     'B': 1,
 }
 
+VALID_UNITS = {
+    'B': (('byte', 'B'), ('bit', 'b')),
+    'K': (('kilobyte', 'KB'), ('kilobit', 'Kb')),
+    'M': (('megabyte', 'MB'), ('megabit', 'Mb')),
+    'G': (('gigabyte', 'GB'), ('gigabit', 'Gb')),
+    'T': (('terabyte', 'TB'), ('terabit', 'Tb')),
+    'P': (('petabyte', 'PB'), ('petabit', 'Pb')),
+    'E': (('exabyte', 'EB'), ('exabit', 'Eb')),
+    'Z': (('zetabyte', 'ZB'), ('zetabit', 'Zb')),
+    'Y': (('yottabyte', 'YB'), ('yottabit', 'Yb')),
+}
+
 
 def lenient_lowercase(lst):
     """Lowercase elements of a list.
@@ -53,7 +65,8 @@ def human_to_bytes(number, default_unit=None, isbits=False):
         The function expects 'b' (lowercase) as a bit identifier, e.g. 'Mb'/'Kb'/etc.
         if 'MB'/'KB'/... is passed, the ValueError will be rased.
     """
-    m = re.search(r'^\s*(\d*\.?\d*)\s*([A-Za-z]+)?', str(number), flags=re.IGNORECASE)
+    m = re.search(r'^([0-9]*\.?[0-9]+)(?:\s*([A-Za-z]+))?\s*$', str(number))
+
     if m is None:
         raise ValueError("human_to_bytes() can't interpret following string: %s" % str(number))
     try:
@@ -86,10 +99,13 @@ def human_to_bytes(number, default_unit=None, isbits=False):
         expect_message = 'expect %s%s or %s' % (range_key, unit_class, range_key)
         if range_key == 'B':
             expect_message = 'expect %s or %s' % (unit_class, unit_class_name)
-
-        if unit_class_name in unit.lower():
+        unit_group = VALID_UNITS.get(range_key, None)
+        if unit_group is None:
+            raise ValueError(f"human_to_bytes() can't interpret a valid unit for {range_key}")
+        isbits_flag = 1 if isbits else 0
+        if unit.lower() == unit_group[isbits_flag][0]:
             pass
-        elif unit[1] != unit_class:
+        elif unit != unit_group[isbits_flag][1]:
             raise ValueError("human_to_bytes() failed to convert %s. Value is not a valid string (%s)" % (number, expect_message))
 
     return int(round(num * limit))

ansible/module_utils/common/validation.py

@@ -4,6 +4,7 @@
 
 from __future__ import annotations
 
+import decimal
 import json
 import os
 import re
@@ -13,10 +14,10 @@ from ansible.module_utils.common.text.converters import to_native
 from ansible.module_utils.common.collections import is_iterable
 from ansible.module_utils.common.text.converters import jsonify
 from ansible.module_utils.common.text.formatters import human_to_bytes
+from ansible.module_utils.common.warnings import deprecate
 from ansible.module_utils.parsing.convert_bool import boolean
 from ansible.module_utils.six import (
     binary_type,
-    integer_types,
     string_types,
     text_type,
 )
@@ -39,6 +40,10 @@ def count_terms(terms, parameters):
 
 
 def safe_eval(value, locals=None, include_exceptions=False):
+    deprecate(
+        "The safe_eval function should not be used.",
+        version="2.21",
+    )
     # do not allow method calls to modules
     if not isinstance(value, string_types):
         # already templated to a datavaluestructure, perhaps?
@@ -415,7 +420,7 @@ def check_type_dict(value):
 
     Raises :class:`TypeError` if unable to convert to a dict
 
-    :arg value: Dict or string to convert to a dict. Accepts ``k1=v2, k2=v2``.
+    :arg value: Dict or string to convert to a dict. Accepts ``k1=v2, k2=v2`` or ``k1=v2 k2=v2``.
 
     :returns: value converted to a dictionary
     """
@@ -427,10 +432,14 @@ def check_type_dict(value):
             try:
                 return json.loads(value)
             except Exception:
-                (result, exc) = safe_eval(value, dict(), include_exceptions=True)
-                if exc is not None:
-                    raise TypeError('unable to evaluate string as dictionary')
-                return result
+                try:
+                    result = literal_eval(value)
+                except Exception:
+                    pass
+                else:
+                    if isinstance(result, dict):
+                        return result
+                raise TypeError('unable to evaluate string as dictionary')
         elif '=' in value:
             fields = []
             field_buffer = []
@@ -457,7 +466,11 @@ def check_type_dict(value):
             field = ''.join(field_buffer)
             if field:
                 fields.append(field)
-            return dict(x.split("=", 1) for x in fields)
+            try:
+                return dict(x.split("=", 1) for x in fields)
+            except ValueError:
+                # no "=" to split on: "k1=v1, k2"
+                raise TypeError('unable to evaluate string in the "key=value" format as dictionary')
         else:
             raise TypeError("dictionary requested, could not parse JSON or key=value")
 
@@ -493,16 +506,15 @@ def check_type_int(value):
 
     :return: int of given value
     """
-    if isinstance(value, integer_types):
-        return value
-
-    if isinstance(value, string_types):
+    if not isinstance(value, int):
         try:
-            return int(value)
-        except ValueError:
-            pass
-
-    raise TypeError('%s cannot be converted to an int' % type(value))
+            if (decimal_value := decimal.Decimal(value)) != (int_value := int(decimal_value)):
+                raise ValueError("Significant decimal part found")
+            else:
+                value = int_value
+        except (decimal.DecimalException, TypeError, ValueError) as e:
+            raise TypeError(f'"{value!r}" cannot be converted to an int') from e
+    return value
 
 
 def check_type_float(value):
@@ -514,16 +526,12 @@ def check_type_float(value):
 
     :returns: float of given value.
     """
-    if isinstance(value, float):
-        return value
-
-    if isinstance(value, (binary_type, text_type, int)):
+    if not isinstance(value, float):
         try:
-            return float(value)
-        except ValueError:
-            pass
-
-    raise TypeError('%s cannot be converted to a float' % type(value))
+            value = float(value)
+        except (TypeError, ValueError) as e:
+            raise TypeError(f'{type(value)} cannot be converted to a float')
+    return value
 
 
 def check_type_path(value,):

ansible/module_utils/compat/paramiko.py

@@ -11,7 +11,12 @@ PARAMIKO_IMPORT_ERR = None
 
 try:
     with warnings.catch_warnings():
-        warnings.filterwarnings('ignore', message='Blowfish has been deprecated', category=UserWarning)
+        # Blowfish has been moved, but the deprecated import is used by paramiko versions older than 2.9.5.
+        # See: https://github.com/paramiko/paramiko/pull/2039
+        warnings.filterwarnings('ignore', message='Blowfish has been ', category=UserWarning)
+        # TripleDES has been moved, but the deprecated import is used by paramiko versions older than 3.3.2 and 3.4.1.
+        # See: https://github.com/paramiko/paramiko/pull/2421
+        warnings.filterwarnings('ignore', message='TripleDES has been ', category=UserWarning)
         import paramiko  # pylint: disable=unused-import
 # paramiko and gssapi are incompatible and raise AttributeError not ImportError
 # When running in FIPS mode, cryptography raises InternalError

ansible/module_utils/compat/selinux.py

@@ -11,8 +11,8 @@ from ctypes import CDLL, c_char_p, c_int, byref, POINTER, get_errno
 
 try:
     _selinux_lib = CDLL('libselinux.so.1', use_errno=True)
-except OSError:
-    raise ImportError('unable to load libselinux.so')
+except OSError as ex:
+    raise ImportError('unable to load libselinux.so') from ex
 
 
 def _module_setup():

ansible/module_utils/connection.py

@@ -29,8 +29,8 @@
 from __future__ import annotations
 
 import os
-import hashlib
 import json
+import pickle
 import socket
 import struct
 import traceback
@@ -40,30 +40,14 @@ from functools import partial
 from ansible.module_utils.common.text.converters import to_bytes, to_text
 from ansible.module_utils.common.json import AnsibleJSONEncoder
 from ansible.module_utils.six import iteritems
-from ansible.module_utils.six.moves import cPickle
 
 
-def write_to_file_descriptor(fd, obj):
-    """Handles making sure all data is properly written to file descriptor fd.
+def write_to_stream(stream, obj):
+    """Write a length+newline-prefixed pickled object to a stream."""
+    src = pickle.dumps(obj)
 
-    In particular, that data is encoded in a character stream-friendly way and
-    that all data gets written before returning.
-    """
-    # Need to force a protocol that is compatible with both py2 and py3.
-    # That would be protocol=2 or less.
-    # Also need to force a protocol that excludes certain control chars as
-    # stdin in this case is a pty and control chars will cause problems.
-    # that means only protocol=0 will work.
-    src = cPickle.dumps(obj, protocol=0)
-
-    # raw \r characters will not survive pty round-trip
-    # They should be rehydrated on the receiving end
-    src = src.replace(b'\r', br'\r')
-    data_hash = to_bytes(hashlib.sha1(src).hexdigest())
-
-    os.write(fd, b'%d\n' % len(src))
-    os.write(fd, src)
-    os.write(fd, b'%s\n' % data_hash)
+    stream.write(b'%d\n' % len(src))
+    stream.write(src)
 
 
 def send_data(s, data):
@@ -146,7 +130,7 @@ class Connection(object):
             data = json.dumps(req, cls=AnsibleJSONEncoder, vault_to_text=True)
         except TypeError as exc:
             raise ConnectionError(
-                "Failed to encode some variables as JSON for communication with ansible-connection. "
+                "Failed to encode some variables as JSON for communication with the persistent connection helper. "
                 "The original exception was: %s" % to_text(exc)
             )
 
@@ -176,7 +160,7 @@ class Connection(object):
         if response['id'] != reqid:
             raise ConnectionError('invalid json-rpc id received')
         if "result_type" in response:
-            response["result"] = cPickle.loads(to_bytes(response["result"]))
+            response["result"] = pickle.loads(to_bytes(response["result"], errors="surrogateescape"))
 
         return response
 

ansible/module_utils/csharp/Ansible.Become.cs

@@ -333,13 +333,12 @@ namespace Ansible.Become
                 // Grant access to the current Windows Station and Desktop to the become user
                 GrantAccessToWindowStationAndDesktop(account);
 
-                // Try and impersonate a SYSTEM token, we need a SYSTEM token to either become a well known service
-                // account or have administrative rights on the become access token.
-                // If we ultimately are becoming the SYSTEM account we want the token with the most privileges available.
-                // https://github.com/ansible/ansible/issues/71453
-                bool mostPrivileges = becomeSid == "S-1-5-18";
+                // Try and impersonate a SYSTEM token. We need the SeTcbPrivilege for
+                //  - LogonUser for a service SID
+                //  - S4U logon
+                //  - Token elevation
                 systemToken = GetPrimaryTokenForUser(new SecurityIdentifier("S-1-5-18"),
-                    new List<string>() { "SeTcbPrivilege" }, mostPrivileges);
+                    new List<string>() { "SeTcbPrivilege" });
                 if (systemToken != null)
                 {
                     try
@@ -357,11 +356,9 @@ namespace Ansible.Become
 
             try
             {
-                if (becomeSid == "S-1-5-18")
-                    userTokens.Add(systemToken);
                 // Cannot use String.IsEmptyOrNull() as an empty string is an account that doesn't have a pass.
                 // We only use S4U if no password was defined or it was null
-                else if (!SERVICE_SIDS.Contains(becomeSid) && password == null && logonType != LogonType.NewCredentials)
+                if (!SERVICE_SIDS.Contains(becomeSid) && password == null && logonType != LogonType.NewCredentials)
                 {
                     // If no password was specified, try and duplicate an existing token for that user or use S4U to
                     // generate one without network credentials
@@ -384,6 +381,11 @@ namespace Ansible.Become
                     string domain = null;
                     switch (becomeSid)
                     {
+                        case "S-1-5-18":
+                            logonType = LogonType.Service;
+                            domain = "NT AUTHORITY";
+                            username = "SYSTEM";
+                            break;
                         case "S-1-5-19":
                             logonType = LogonType.Service;
                             domain = "NT AUTHORITY";
@@ -426,7 +428,7 @@ namespace Ansible.Become
         }
 
         private static SafeNativeHandle GetPrimaryTokenForUser(SecurityIdentifier sid,
-            List<string> requiredPrivileges = null, bool mostPrivileges = false)
+            List<string> requiredPrivileges = null)
         {
             // According to CreateProcessWithTokenW we require a token with
             //  TOKEN_QUERY, TOKEN_DUPLICATE and TOKEN_ASSIGN_PRIMARY
@@ -436,9 +438,6 @@ namespace Ansible.Become
                 TokenAccessLevels.AssignPrimary |
                 TokenAccessLevels.Impersonate;
 
-            SafeNativeHandle userToken = null;
-            int privilegeCount = 0;
-
             foreach (SafeNativeHandle hToken in TokenUtil.EnumerateUserTokens(sid, dwAccess))
             {
                 // Filter out any Network logon tokens, using become with that is useless when S4U
@@ -449,10 +448,6 @@ namespace Ansible.Become
 
                 List<string> actualPrivileges = TokenUtil.GetTokenPrivileges(hToken).Select(x => x.Name).ToList();
 
-                // If the token has less or the same number of privileges than the current token, skip it.
-                if (mostPrivileges && privilegeCount >= actualPrivileges.Count)
-                    continue;
-
                 // Check that the required privileges are on the token
                 if (requiredPrivileges != null)
                 {
@@ -464,22 +459,16 @@ namespace Ansible.Become
                 // Duplicate the token to convert it to a primary token with the access level required.
                 try
                 {
-                    userToken = TokenUtil.DuplicateToken(hToken, TokenAccessLevels.MaximumAllowed,
+                    return TokenUtil.DuplicateToken(hToken, TokenAccessLevels.MaximumAllowed,
                         SecurityImpersonationLevel.Anonymous, TokenType.Primary);
-                    privilegeCount = actualPrivileges.Count;
                 }
                 catch (Process.Win32Exception)
                 {
                     continue;
                 }
-
-                // If we don't care about getting the token with the most privileges, escape the loop as we already
-                // have a token.
-                if (!mostPrivileges)
-                    break;
             }
 
-            return userToken;
+            return null;
         }
 
         private static SafeNativeHandle GetS4UTokenForUser(SecurityIdentifier sid, LogonType logonType)

ansible/module_utils/csharp/Ansible.Process.cs

@@ -397,7 +397,7 @@ namespace Ansible.Process
         internal static Result WaitProcess(SafeFileHandle stdoutRead, SafeFileHandle stdoutWrite, SafeFileHandle stderrRead,
             SafeFileHandle stderrWrite, FileStream stdinStream, byte[] stdin, IntPtr hProcess, string outputEncoding = null)
         {
-            // Default to using UTF-8 as the output encoding, this should be a sane default for most scenarios.
+            // Default to using UTF-8 as the output encoding, this should be a logical default for most scenarios.
             outputEncoding = String.IsNullOrEmpty(outputEncoding) ? "utf-8" : outputEncoding;
             Encoding encodingInstance = Encoding.GetEncoding(outputEncoding);
 

ansible/module_utils/distro/__init__.py

@@ -22,7 +22,7 @@ Compat distro library.
 from __future__ import annotations
 
 # The following makes it easier for us to script updates of the bundled code
-_BUNDLED_METADATA = {"pypi_name": "distro", "version": "1.8.0"}
+_BUNDLED_METADATA = {"pypi_name": "distro", "version": "1.9.0"}
 
 # The following additional changes have been made:
 # * Remove optparse since it is not needed for our use.

ansible/module_utils/distro/_distro.py

@@ -1,4 +1,4 @@
-# Copyright 2015,2016,2017 Nir Cohen
+# Copyright 2015-2021 Nir Cohen
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -59,7 +59,7 @@ except ImportError:
     # Python 3.7
     TypedDict = dict
 
-__version__ = "1.8.0"
+__version__ = "1.9.0"
 
 
 class VersionDict(TypedDict):
@@ -129,6 +129,7 @@ _DISTRO_RELEASE_BASENAME_PATTERN = re.compile(r"(\w+)[-_](release|version)$")
 # Base file names to be looked up for if _UNIXCONFDIR is not readable.
 _DISTRO_RELEASE_BASENAMES = [
     "SuSE-release",
+    "altlinux-release",
     "arch-release",
     "base-release",
     "centos-release",
@@ -155,6 +156,8 @@ _DISTRO_RELEASE_IGNORE_BASENAMES = (
     "system-release",
     "plesk-release",
     "iredmail-release",
+    "board-release",
+    "ec2_version",
 )
 
 
@@ -247,6 +250,7 @@ def id() -> str:
     "rocky"         Rocky Linux
     "aix"           AIX
     "guix"          Guix System
+    "altlinux"      ALT Linux
     ==============  =========================================
 
     If you have a need to get distros for reliable IDs added into this set,
@@ -995,10 +999,10 @@ class LinuxDistribution:
 
         For details, see :func:`distro.info`.
         """
-        return dict(
+        return InfoDict(
             id=self.id(),
             version=self.version(pretty, best),
-            version_parts=dict(
+            version_parts=VersionDict(
                 major=self.major_version(best),
                 minor=self.minor_version(best),
                 build_number=self.build_number(best),

ansible/module_utils/facts/collector.py

@@ -90,6 +90,8 @@ class BaseFactCollector:
     def _transform_dict_keys(self, fact_dict):
         '''update a dicts keys to use new names as transformed by self._transform_name'''
 
+        if fact_dict is None:
+            return {}
         for old_key in list(fact_dict.keys()):
             new_key = self._transform_name(old_key)
             # pop the item by old_key and replace it using new_key

ansible/module_utils/facts/default_collectors.py

@@ -53,6 +53,7 @@ from ansible.module_utils.facts.system.python import PythonFactCollector
 from ansible.module_utils.facts.system.selinux import SelinuxFactCollector
 from ansible.module_utils.facts.system.service_mgr import ServiceMgrFactCollector
 from ansible.module_utils.facts.system.ssh_pub_keys import SshPubKeyFactCollector
+from ansible.module_utils.facts.system.systemd import SystemdFactCollector
 from ansible.module_utils.facts.system.user import UserFactCollector
 
 from ansible.module_utils.facts.hardware.base import HardwareCollector
@@ -118,7 +119,8 @@ _general = [
     EnvFactCollector,
     LoadAvgFactCollector,
     SshPubKeyFactCollector,
-    UserFactCollector
+    UserFactCollector,
+    SystemdFactCollector
 ]  # type: t.List[t.Type[BaseFactCollector]]
 
 # virtual, this might also limit hardware/networking

ansible/module_utils/facts/hardware/aix.py

@@ -195,34 +195,35 @@ class AIXHardware(Hardware):
         # AIX does not have mtab but mount command is only source of info (or to use
         # api calls to get same info)
         mount_path = self.module.get_bin_path('mount')
-        rc, mount_out, err = self.module.run_command(mount_path)
-        if mount_out:
-            for line in mount_out.split('\n'):
-                fields = line.split()
-                if len(fields) != 0 and fields[0] != 'node' and fields[0][0] != '-' and re.match('^/.*|^[a-zA-Z].*|^[0-9].*', fields[0]):
-                    if re.match('^/', fields[0]):
-                        # normal mount
-                        mount = fields[1]
-                        mount_info = {'mount': mount,
-                                      'device': fields[0],
-                                      'fstype': fields[2],
-                                      'options': fields[6],
-                                      'time': '%s %s %s' % (fields[3], fields[4], fields[5])}
-                        mount_info.update(get_mount_size(mount))
-                    else:
-                        # nfs or cifs based mount
-                        # in case of nfs if no mount options are provided on command line
-                        # add into fields empty string...
-                        if len(fields) < 8:
-                            fields.append("")
-
-                        mount_info = {'mount': fields[2],
-                                      'device': '%s:%s' % (fields[0], fields[1]),
-                                      'fstype': fields[3],
-                                      'options': fields[7],
-                                      'time': '%s %s %s' % (fields[4], fields[5], fields[6])}
-
-                    mounts.append(mount_info)
+        if mount_path:
+            rc, mount_out, err = self.module.run_command(mount_path)
+            if mount_out:
+                for line in mount_out.split('\n'):
+                    fields = line.split()
+                    if len(fields) != 0 and fields[0] != 'node' and fields[0][0] != '-' and re.match('^/.*|^[a-zA-Z].*|^[0-9].*', fields[0]):
+                        if re.match('^/', fields[0]):
+                            # normal mount
+                            mount = fields[1]
+                            mount_info = {'mount': mount,
+                                          'device': fields[0],
+                                          'fstype': fields[2],
+                                          'options': fields[6],
+                                          'time': '%s %s %s' % (fields[3], fields[4], fields[5])}
+                            mount_info.update(get_mount_size(mount))
+                        else:
+                            # nfs or cifs based mount
+                            # in case of nfs if no mount options are provided on command line
+                            # add into fields empty string...
+                            if len(fields) < 8:
+                                fields.append("")
+
+                            mount_info = {'mount': fields[2],
+                                          'device': '%s:%s' % (fields[0], fields[1]),
+                                          'fstype': fields[3],
+                                          'options': fields[7],
+                                          'time': '%s %s %s' % (fields[4], fields[5], fields[6])}
+
+                        mounts.append(mount_info)
 
         mount_facts['mounts'] = mounts
 
@@ -232,30 +233,31 @@ class AIXHardware(Hardware):
         device_facts = {}
         device_facts['devices'] = {}
 
-        lsdev_cmd = self.module.get_bin_path('lsdev', True)
-        lsattr_cmd = self.module.get_bin_path('lsattr', True)
-        rc, out_lsdev, err = self.module.run_command(lsdev_cmd)
-
-        for line in out_lsdev.splitlines():
-            field = line.split()
-
-            device_attrs = {}
-            device_name = field[0]
-            device_state = field[1]
-            device_type = field[2:]
-            lsattr_cmd_args = [lsattr_cmd, '-E', '-l', device_name]
-            rc, out_lsattr, err = self.module.run_command(lsattr_cmd_args)
-            for attr in out_lsattr.splitlines():
-                attr_fields = attr.split()
-                attr_name = attr_fields[0]
-                attr_parameter = attr_fields[1]
-                device_attrs[attr_name] = attr_parameter
-
-            device_facts['devices'][device_name] = {
-                'state': device_state,
-                'type': ' '.join(device_type),
-                'attributes': device_attrs
-            }
+        lsdev_cmd = self.module.get_bin_path('lsdev')
+        lsattr_cmd = self.module.get_bin_path('lsattr')
+        if lsdev_cmd and lsattr_cmd:
+            rc, out_lsdev, err = self.module.run_command(lsdev_cmd)
+
+            for line in out_lsdev.splitlines():
+                field = line.split()
+
+                device_attrs = {}
+                device_name = field[0]
+                device_state = field[1]
+                device_type = field[2:]
+                lsattr_cmd_args = [lsattr_cmd, '-E', '-l', device_name]
+                rc, out_lsattr, err = self.module.run_command(lsattr_cmd_args)
+                for attr in out_lsattr.splitlines():
+                    attr_fields = attr.split()
+                    attr_name = attr_fields[0]
+                    attr_parameter = attr_fields[1]
+                    device_attrs[attr_name] = attr_parameter
+
+                device_facts['devices'][device_name] = {
+                    'state': device_state,
+                    'type': ' '.join(device_type),
+                    'attributes': device_attrs
+                }
 
         return device_facts