From b8fd95776ce894006163b2bb5e34682e5844ca1e Mon Sep 17 00:00:00 2001 From: Matthew Burket Date: Thu, 21 Oct 2021 14:43:51 -0500 Subject: [PATCH 1/5] Always esacpe parameter in ansible_set_config_file --- .../ansible/shared.yml | 5 +++-- .../ansible/shared.yml | 5 +++-- .../ansible/shared.yml | 5 +++-- shared/macros-ansible.jinja | 17 ++++++++++------- 4 files changed, 19 insertions(+), 13 deletions(-) diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/ansible/shared.yml b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/ansible/shared.yml index 637f90003b2..ca5a405f877 100644 --- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/ansible/shared.yml +++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/ansible/shared.yml @@ -5,5 +5,6 @@ # disruption = low {{{ ansible_set_config_file_dir(msg, "/etc/rsyslog.conf", "/etc/rsyslog.d", "/etc/rsyslog.conf", - "$ActionSendStreamDriverAuthMode", separator=' ', separator_regex='\s', - value="x509/name", create='yes') }}} + "$ActionSendStreamDriverAuthMode", separator=' ', separator_regex='\s', + value="x509/name", create='yes') +}}} diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/ansible/shared.yml b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/ansible/shared.yml index 5d11103fc0f..1f001f47e07 100644 --- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/ansible/shared.yml +++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/ansible/shared.yml @@ -4,6 +4,7 @@ # complexity = low # disruption = low -{{{ ansible_set_config_file(file="/etc/rsyslog.d/encrypt.conf", - parameter="$ActionSendStreamDriverMode", value="1", create=true, separator=" ", separator_regex=" ") +{{{ ansible_set_config_file_dir(msg, "/etc/rsyslog.conf", "/etc/rsyslog.d", "/etc/rsyslog.conf", + parameter="$ActionSendStreamDriverMode", value="1", create=true, separator=" ", + separator_regex=" ") }}} diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/ansible/shared.yml b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/ansible/shared.yml index 035ab152876..4016a08721e 100644 --- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/ansible/shared.yml +++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/ansible/shared.yml @@ -4,6 +4,7 @@ # complexity = low # disruption = low -{{{ ansible_set_config_file(file="/etc/rsyslog.d/encrypt.conf", - parameter="$DefaultNetstreamDriver", value="gtls", create=true, separator=" ", separator_regex=" ") +{{{ ansible_set_config_file_dir(msg, "/etc/rsyslog.conf", "/etc/rsyslog.d", "/etc/rsyslog.conf", + parameter="$DefaultNetstreamDriver", value="gtls", create=true, separator=" " + , separator_regex=" ") }}} diff --git a/shared/macros-ansible.jinja b/shared/macros-ansible.jinja index 563350743fe..0f8dba56dab 100644 --- a/shared/macros-ansible.jinja +++ b/shared/macros-ansible.jinja @@ -25,14 +25,17 @@ value: "Setting={{ varname1 }}" Note that all string-like parameters are single quoted in the YAML. #}} -{{%- macro ansible_lineinfile(msg='', path='', regex='', new_line='', create='no', state='present', with_items='', register='', when='', validate='', insert_after='', insert_before='', check_mode=False) -%}} +{{%- macro ansible_lineinfile(msg='', path='', regex='', new_line='', create='no', state='present', with_items='', register='', when='', validate='', insert_after='', insert_before='', check_mode=False, escape_regex=False) -%}} - name: "{{{ msg or rule_title }}}" lineinfile: path: '{{{ path }}}' create: {{{ create }}} - {{%- if regex %}} + {{%- if regex and not escape_regex %}} regexp: '{{{ regex }}}' {{%- endif %}} + {{%- if regex and escape_regex %}} + regexp: '{{ {{{ regex }}} | regex_escape }}' + {{%- endif %}} {{%- if state == 'present' %}} line: '{{{ new_line }}}' state: present @@ -121,7 +124,7 @@ value: "Setting={{ varname1 }}" ini configuration files are best served with the ini Ansible module instead of lineinfile-based solutions. #}} -{{%- macro ansible_set_config_file(msg, file, parameter, separator=' ', separator_regex='\s+', value='', prefix_regex='^\s*', create='no', validate='', insert_after='', insert_before='') %}} +{{%- macro ansible_set_config_file(msg, file, parameter, separator=' ', separator_regex='\s+', value='', prefix_regex='^\s*', create='no', validate='', insert_after='', insert_before='', escape_regex=False) %}} {{{ ansible_only_lineinfile(msg, file, prefix_regex + parameter + separator_regex, parameter + separator + value, create=create, block=True, validate=validate, insert_after=insert_after, insert_before=insert_before) }}} {{%- endmacro %}} @@ -143,12 +146,12 @@ value: "Setting={{ varname1 }}" {{%- set new_line = parameter + separator + value -%}} - name: '{{{ msg or rule_title }}}' block: - {{{ ansible_lineinfile("Check for duplicate values", config_file, regex=line_regex, create='no', state='absent', register='dupes', check_mode=True)|indent }}} - {{{ ansible_lineinfile("Deduplicate values from " + config_file, config_file, regex=line_regex, create='no', state='absent', when='dupes.found is defined and dupes.found > 1')|indent }}} + {{{ ansible_lineinfile("Check for duplicate values", config_file, regex=line_regex, create='no', state='absent', register='dupes', check_mode=True, escape_regex=True)|indent }}} + {{{ ansible_lineinfile("Deduplicate values from " + config_file, config_file, regex=line_regex, create='no', state='absent', when='dupes.found is defined and dupes.found > 1', escape_regex=True)|indent }}} {{{ ansible_stat("Check if " + config_dir + " exists", path=config_dir, register=dir_exists)|indent }}} {{{ ansible_find("Check if the parameter " + parameter + " is present in " + config_dir, paths=config_dir, contains=line_regex, register=dir_parameter, when=find_when)|indent }}} - {{{ ansible_lineinfile("Remove parameter from files in " + config_dir, path="{{ item.path }}", regex=line_regex, state="absent", with_items=lineinfile_items, when=lineinfile_when)|indent }}} - {{{ ansible_lineinfile("Insert correct line to " + set_file, set_file, regex=line_regex, new_line=new_line, create=create, state='present', validate=validate, insert_after=insert_after, insert_before=insert_before)|indent }}} + {{{ ansible_lineinfile("Remove parameter from files in " + config_dir, path="{{ item.path }}", regex=line_regex, state="absent", with_items=lineinfile_items, when=lineinfile_when, escape_regex=True)|indent }}} + {{{ ansible_lineinfile("Insert correct line to " + set_file, set_file, regex=line_regex, new_line=new_line, create=create, state='present', validate=validate, insert_after=insert_after, insert_before=insert_before, escape_regex=True)|indent }}} {{%- endmacro %}} {{# From 5635bf94c9274511e3d63feb8d4082c4ec9144f3 Mon Sep 17 00:00:00 2001 From: Matthew Burket Date: Tue, 26 Oct 2021 13:01:27 -0500 Subject: [PATCH 2/5] Fix a couple items from reviewers on ansible_lineinfile escaping --- .../ansible/shared.yml | 4 ++-- shared/macros-ansible.jinja | 3 +-- 2 files changed, 3 insertions(+), 4 deletions(-) diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/ansible/shared.yml b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/ansible/shared.yml index 4016a08721e..3cc18d4476e 100644 --- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/ansible/shared.yml +++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/ansible/shared.yml @@ -5,6 +5,6 @@ # disruption = low {{{ ansible_set_config_file_dir(msg, "/etc/rsyslog.conf", "/etc/rsyslog.d", "/etc/rsyslog.conf", - parameter="$DefaultNetstreamDriver", value="gtls", create=true, separator=" " - , separator_regex=" ") + parameter="$DefaultNetstreamDriver", value="gtls", create=true, + separator=" ", separator_regex=" ") }}} diff --git a/shared/macros-ansible.jinja b/shared/macros-ansible.jinja index 0f8dba56dab..752d220bbfc 100644 --- a/shared/macros-ansible.jinja +++ b/shared/macros-ansible.jinja @@ -32,8 +32,7 @@ value: "Setting={{ varname1 }}" create: {{{ create }}} {{%- if regex and not escape_regex %}} regexp: '{{{ regex }}}' - {{%- endif %}} - {{%- if regex and escape_regex %}} + {{%- elif regex and escape_regex %}} regexp: '{{ {{{ regex }}} | regex_escape }}' {{%- endif %}} {{%- if state == 'present' %}} From f6541126a4d19bfef8752028467659ab9d9f74ed Mon Sep 17 00:00:00 2001 From: Matthew Burket Date: Tue, 2 Nov 2021 08:32:18 -0500 Subject: [PATCH 3/5] Fix escaping in ansible_lineinfile macro --- shared/macros-ansible.jinja | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/shared/macros-ansible.jinja b/shared/macros-ansible.jinja index 752d220bbfc..1e0ba6260bb 100644 --- a/shared/macros-ansible.jinja +++ b/shared/macros-ansible.jinja @@ -33,7 +33,7 @@ value: "Setting={{ varname1 }}" {{%- if regex and not escape_regex %}} regexp: '{{{ regex }}}' {{%- elif regex and escape_regex %}} - regexp: '{{ {{{ regex }}} | regex_escape }}' + regexp: {{{ regex }}} | regex_escape {{%- endif %}} {{%- if state == 'present' %}} line: '{{{ new_line }}}' From ef6d300a707dc272eaa9442ece135009287bfdf5 Mon Sep 17 00:00:00 2001 From: Matthew Burket Date: Wed, 3 Nov 2021 11:15:11 -0500 Subject: [PATCH 4/5] Move regex_escape to ansible_set_config_file_dir --- shared/macros-ansible.jinja | 16 +++++++--------- 1 file changed, 7 insertions(+), 9 deletions(-) diff --git a/shared/macros-ansible.jinja b/shared/macros-ansible.jinja index 1e0ba6260bb..8e7ce1a1206 100644 --- a/shared/macros-ansible.jinja +++ b/shared/macros-ansible.jinja @@ -25,15 +25,13 @@ value: "Setting={{ varname1 }}" Note that all string-like parameters are single quoted in the YAML. #}} -{{%- macro ansible_lineinfile(msg='', path='', regex='', new_line='', create='no', state='present', with_items='', register='', when='', validate='', insert_after='', insert_before='', check_mode=False, escape_regex=False) -%}} +{{%- macro ansible_lineinfile(msg='', path='', regex='', new_line='', create='no', state='present', with_items='', register='', when='', validate='', insert_after='', insert_before='', check_mode=False) -%}} - name: "{{{ msg or rule_title }}}" lineinfile: path: '{{{ path }}}' create: {{{ create }}} - {{%- if regex and not escape_regex %}} + {{%- if regex %}} regexp: '{{{ regex }}}' - {{%- elif regex and escape_regex %}} - regexp: {{{ regex }}} | regex_escape {{%- endif %}} {{%- if state == 'present' %}} line: '{{{ new_line }}}' @@ -138,19 +136,19 @@ value: "Setting={{ varname1 }}" {{%- set var_dir = config_dir | replace("/", "_") | replace("-", "_") | replace(".", "_") -%}} {{%- set dir_exists = var_dir + "_exists" -%}} {{%- set dir_parameter = var_dir + "_has_parameter" -%}} -{{%- set line_regex = prefix_regex + parameter + separator_regex -%}} +{{%- set line_regex = prefix_regex + "{{\"" + parameter + "\"| regex_escape }}" + separator_regex -%}} {{%- set find_when = dir_exists + ".stat.isdir is defined and " + dir_exists + ".stat.isdir" -%}} {{%- set lineinfile_items = "{{ " + dir_parameter + ".files }}" -%}} {{%- set lineinfile_when = dir_parameter + ".matched" -%}} {{%- set new_line = parameter + separator + value -%}} - name: '{{{ msg or rule_title }}}' block: - {{{ ansible_lineinfile("Check for duplicate values", config_file, regex=line_regex, create='no', state='absent', register='dupes', check_mode=True, escape_regex=True)|indent }}} - {{{ ansible_lineinfile("Deduplicate values from " + config_file, config_file, regex=line_regex, create='no', state='absent', when='dupes.found is defined and dupes.found > 1', escape_regex=True)|indent }}} + {{{ ansible_lineinfile("Check for duplicate values", config_file, regex=line_regex, create='no', state='absent', register='dupes', check_mode=True)|indent }}} + {{{ ansible_lineinfile("Deduplicate values from " + config_file, config_file, regex=line_regex, create='no', state='absent', when='dupes.found is defined and dupes.found > 1')|indent }}} {{{ ansible_stat("Check if " + config_dir + " exists", path=config_dir, register=dir_exists)|indent }}} {{{ ansible_find("Check if the parameter " + parameter + " is present in " + config_dir, paths=config_dir, contains=line_regex, register=dir_parameter, when=find_when)|indent }}} - {{{ ansible_lineinfile("Remove parameter from files in " + config_dir, path="{{ item.path }}", regex=line_regex, state="absent", with_items=lineinfile_items, when=lineinfile_when, escape_regex=True)|indent }}} - {{{ ansible_lineinfile("Insert correct line to " + set_file, set_file, regex=line_regex, new_line=new_line, create=create, state='present', validate=validate, insert_after=insert_after, insert_before=insert_before, escape_regex=True)|indent }}} + {{{ ansible_lineinfile("Remove parameter from files in " + config_dir, path="{{ item.path }}", regex=line_regex, state="absent", with_items=lineinfile_items, when=lineinfile_when)|indent }}} + {{{ ansible_lineinfile("Insert correct line to " + set_file, set_file, regex=line_regex, new_line=new_line, create=create, state='present', validate=validate, insert_after=insert_after, insert_before=insert_before)|indent }}} {{%- endmacro %}} {{# From c29550ef26fc283ce5e72038fddf70aa716f4d1c Mon Sep 17 00:00:00 2001 From: Matthew Burket Date: Thu, 4 Nov 2021 08:53:42 -0500 Subject: [PATCH 5/5] Fix ansible-lint lint issues --- shared/macros-ansible.jinja | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/shared/macros-ansible.jinja b/shared/macros-ansible.jinja index 8e7ce1a1206..76f05e76b88 100644 --- a/shared/macros-ansible.jinja +++ b/shared/macros-ansible.jinja @@ -136,7 +136,7 @@ value: "Setting={{ varname1 }}" {{%- set var_dir = config_dir | replace("/", "_") | replace("-", "_") | replace(".", "_") -%}} {{%- set dir_exists = var_dir + "_exists" -%}} {{%- set dir_parameter = var_dir + "_has_parameter" -%}} -{{%- set line_regex = prefix_regex + "{{\"" + parameter + "\"| regex_escape }}" + separator_regex -%}} +{{%- set line_regex = prefix_regex + "{{ \"" + parameter + "\"| regex_escape }}" + separator_regex -%}} {{%- set find_when = dir_exists + ".stat.isdir is defined and " + dir_exists + ".stat.isdir" -%}} {{%- set lineinfile_items = "{{ " + dir_parameter + ".files }}" -%}} {{%- set lineinfile_when = dir_parameter + ".matched" -%}}