cmueller/ansible
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

ensure ssh retry respects no log (#49569) (#49724)

Browse source 
* ensure ssh retry respects no log (#49569)


(cherry picked from commit ba4c2ebeac)
This commit is contained in:
Brian Coca 2018-12-10 14:49:16 -05:00 committed by Toshio Kuratomi
parent 961382bf5e
commit 0954942dfd
2 changed files with 13 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
changelogs/fragments/avoid_ssh_retry_discolsures.yml Normal file
View file

@ -0,0 +1,2 @@
bugfixes:
- Respect no_log on retry and high verbosity (CVE-2018-16876)

13
lib/ansible/plugins/connection/ssh.py
View file

@ -335,11 +335,14 @@ def _ssh_retry(func):
try:
try:
return_tuple = func(self, *args, **kwargs)
if self._play_context.no_log:
display.vvv('rc=%s, stdout & stderr censored due to no log' % return_tuple[0], host=self.host)
else:
display.vvv(return_tuple, host=self.host)
# 0 = success
# 1-254 = remote command return code
# 255 could be a failure from the ssh command itself
except (AnsibleControlPersistBrokenPipeError) as e:
except (AnsibleControlPersistBrokenPipeError):
# Retry one more time because of the ControlPersist broken pipe (see #16731)
cmd = args[0]
if self._play_context.password and isinstance(cmd, list):
@ -357,8 +360,12 @@ def _ssh_retry(func):
break
if SSH_ERROR:
raise AnsibleConnectionFailure("Failed to connect to the host via ssh: %s"
% to_native(return_tuple[2]))
msg = "Failed to connect to the host via ssh: "
if self._play_context.no_log:
msg += '<error censored due to no log>'
else:
msg += to_native(return_tuple[2])
raise AnsibleConnectionFailure(msg)
break