Class: ManageIQ::Password

Inherits:
Object
  • Object
show all
Defined in:
lib/manageiq/password.rb,
lib/manageiq/password/version.rb,
lib/manageiq/password/password_mixin.rb

Defined Under Namespace

Modules: PasswordMixin Classes: Key, PasswordError

Constant Summary collapse

REGEXP = 
/v2:\{([^}]*)\}/
REGEXP_PASSWORD =

for “v2:…” or its URL encoded string

/v2(:\{[^}]*\}|%3A%7B.*?%7D)/
REGEXP_START_LINE = 
/^#{REGEXP}/
MASK = 
'********'.freeze
VERSION = 
"1.0.0".freeze

Instance Attribute Summary collapse

Class Method Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(str = nil) ⇒ Password

Returns a new instance of Password.



19
20
21
22
23
 
# File 'lib/manageiq/password.rb', line 19

def initialize(str = nil)
  return unless str

  @encStr = encrypt(str)
end

Instance Attribute Details

#encStr ⇒ Object (readonly)

Returns the value of attribute encStr.



17
18
19
 
# File 'lib/manageiq/password.rb', line 17

def encStr
  @encStr
end

Class Method Details

.decrypt(*args) ⇒ Object 



55
56
57
 
# File 'lib/manageiq/password.rb', line 55

def self.decrypt(*args)
  new.decrypt(*args)
end

.encrypt(*args) ⇒ Object 



51
52
53
 
# File 'lib/manageiq/password.rb', line 51

def self.encrypt(*args)
  new.encrypt(*args)
end

.encrypted?(str) ⇒ Boolean

Returns:

  • (Boolean) 


63
64
65
66
 
# File 'lib/manageiq/password.rb', line 63

def self.encrypted?(str)
  return false if str.nil? || str.empty?
  !!unwrap(str)
end

.generate_symmetric(filename = nil) ⇒ Object 



123
124
125
 
# File 'lib/manageiq/password.rb', line 123

def self.generate_symmetric(filename = nil)
  Key.new.tap { |key| store_key_file(filename, key) if filename }
end

.key ⇒ Object 



106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
 
# File 'lib/manageiq/password.rb', line 106

def self.key
  @@key ||= load_key_file("v2_key") || begin
    key_file = File.expand_path("v2_key", key_root)
    msg = <<-EOS
  #{key_file} doesn't exist!
  On an appliance, it should be generated on boot by evmserverd.

  If you're a developer, you can copy the #{key_file}.dev to #{key_file}.

  Caution, using the developer key will allow anyone with the public developer key to decrypt the two-way
  passwords in your database.
  EOS
    Kernel.warn msg
    nil
  end
end

.key=(key) ⇒ Object 



102
103
104
 
# File 'lib/manageiq/password.rb', line 102

def self.key=(key)
  @@key = key
end

.key_root ⇒ Object 



93
94
95
 
# File 'lib/manageiq/password.rb', line 93

def self.key_root
  @@key_root ||= ENV["KEY_ROOT"]
end

.key_root=(key_root) ⇒ Object 



97
98
99
100
 
# File 'lib/manageiq/password.rb', line 97

def self.key_root=(key_root)
  @@key = nil
  @@key_root = key_root
end

.md5crypt(str) ⇒ Object 



68
69
70
71
 
# File 'lib/manageiq/password.rb', line 68

def self.md5crypt(str)
  cmd = "openssl passwd -1 -salt \"miq\" \"#{try_decrypt(str)}\""
  `#{cmd}`.split("\n").first
end

.recrypt(*args) ⇒ Object 



59
60
61
 
# File 'lib/manageiq/password.rb', line 59

def self.recrypt(*args)
  new.recrypt(*args)
end

.sanitize_string(s) ⇒ Object 



77
78
79
 
# File 'lib/manageiq/password.rb', line 77

def self.sanitize_string(s)
  s.gsub(REGEXP_PASSWORD, MASK)
end

.sanitize_string!(s) ⇒ Object 



81
82
83
 
# File 'lib/manageiq/password.rb', line 81

def self.sanitize_string!(s)
  s.gsub!(REGEXP_PASSWORD, MASK)
end

.sysprep_crypt(str) ⇒ Object 



73
74
75
 
# File 'lib/manageiq/password.rb', line 73

def self.sysprep_crypt(str)
  Base64.encode64("#{try_decrypt(str)}AdministratorPassword".encode("UTF-16LE")).delete("\n")
end

.try_decrypt(str) ⇒ Object 



85
86
87
 
# File 'lib/manageiq/password.rb', line 85

def self.try_decrypt(str)
  encrypted?(str) ? decrypt(str) : str
end

.try_encrypt(str) ⇒ Object 



89
90
91
 
# File 'lib/manageiq/password.rb', line 89

def self.try_encrypt(str)
  encrypted?(str) ? str : encrypt(str)
end

Instance Method Details

#decrypt(str, key = self.class.key) ⇒ Object 



32
33
34
35
36
37
38
39
40
41
 
# File 'lib/manageiq/password.rb', line 32

def decrypt(str, key = self.class.key)
  enc = self.class.unwrap(str)
  return enc if enc.nil? || enc.empty?

  begin
    key.decrypt64(enc).force_encoding('UTF-8')
  rescue
    raise PasswordError, "cannot decrypt encrypted string"
  end
end

#encrypt(str, key = self.class.key) ⇒ Object 



25
26
27
28
29
30
 
# File 'lib/manageiq/password.rb', line 25

def encrypt(str, key = self.class.key)
  return str if str.nil?

  enc = key.encrypt64(str).delete("\n") unless str.empty?
  self.class.wrap(enc)
end

#recrypt(str, prior_key = nil) ⇒ Object 



43
44
45
46
47
48
49
 
# File 'lib/manageiq/password.rb', line 43

def recrypt(str, prior_key = nil)
  return str if str.nil?

  decrypted_str   = decrypt(str, prior_key) if prior_key rescue nil
  decrypted_str ||= decrypt(str)
  encrypt(decrypted_str)
end