github.com/emate/packer@v0.8.1-0.20150625195101-fe0fde195dc6/builder/amazon/common/step_get_password.go (about)

     1  package common
     2  
     3  import (
     4  	"crypto/rsa"
     5  	"crypto/x509"
     6  	"encoding/base64"
     7  	"encoding/pem"
     8  	"errors"
     9  	"fmt"
    10  	"log"
    11  	"time"
    12  
    13  	"github.com/aws/aws-sdk-go/service/ec2"
    14  	"github.com/mitchellh/multistep"
    15  	"github.com/mitchellh/packer/helper/communicator"
    16  	"github.com/mitchellh/packer/packer"
    17  )
    18  
    19  // StepGetPassword reads the password from a Windows server and sets it
    20  // on the WinRM config.
    21  type StepGetPassword struct {
    22  	Comm    *communicator.Config
    23  	Timeout time.Duration
    24  }
    25  
    26  func (s *StepGetPassword) Run(state multistep.StateBag) multistep.StepAction {
    27  	ui := state.Get("ui").(packer.Ui)
    28  	image := state.Get("source_image").(*ec2.Image)
    29  
    30  	// Skip if we're not Windows...
    31  	if image.Platform == nil || *image.Platform != "windows" {
    32  		log.Printf("[INFO] Not Windows, skipping get password...")
    33  		return multistep.ActionContinue
    34  	}
    35  
    36  	// If we already have a password, skip it
    37  	if s.Comm.WinRMPassword != "" {
    38  		ui.Say("Skipping waiting for password since WinRM password set...")
    39  		return multistep.ActionContinue
    40  	}
    41  
    42  	// Get the password
    43  	var password string
    44  	var err error
    45  	cancel := make(chan struct{})
    46  	waitDone := make(chan bool, 1)
    47  	go func() {
    48  		ui.Say("Waiting for auto-generated password for instance...")
    49  		ui.Message(
    50  			"It is normal for this process to take up to 15 minutes,\n" +
    51  				"but it usually takes around 5. Please wait.")
    52  		password, err = s.waitForPassword(state, cancel)
    53  		waitDone <- true
    54  	}()
    55  
    56  	timeout := time.After(s.Timeout)
    57  WaitLoop:
    58  	for {
    59  		// Wait for either SSH to become available, a timeout to occur,
    60  		// or an interrupt to come through.
    61  		select {
    62  		case <-waitDone:
    63  			if err != nil {
    64  				ui.Error(fmt.Sprintf("Error waiting for password: %s", err))
    65  				state.Put("error", err)
    66  				return multistep.ActionHalt
    67  			}
    68  
    69  			ui.Message(fmt.Sprintf(" \nPassword retrieved!"))
    70  			s.Comm.WinRMPassword = password
    71  			break WaitLoop
    72  		case <-timeout:
    73  			err := fmt.Errorf("Timeout waiting for password.")
    74  			state.Put("error", err)
    75  			ui.Error(err.Error())
    76  			close(cancel)
    77  			return multistep.ActionHalt
    78  		case <-time.After(1 * time.Second):
    79  			if _, ok := state.GetOk(multistep.StateCancelled); ok {
    80  				// The step sequence was cancelled, so cancel waiting for password
    81  				// and just start the halting process.
    82  				close(cancel)
    83  				log.Println("[WARN] Interrupt detected, quitting waiting for password.")
    84  				return multistep.ActionHalt
    85  			}
    86  		}
    87  	}
    88  	return multistep.ActionContinue
    89  }
    90  
    91  func (s *StepGetPassword) Cleanup(multistep.StateBag) {}
    92  
    93  func (s *StepGetPassword) waitForPassword(state multistep.StateBag, cancel <-chan struct{}) (string, error) {
    94  	ec2conn := state.Get("ec2").(*ec2.EC2)
    95  	instance := state.Get("instance").(*ec2.Instance)
    96  	privateKey := state.Get("privateKey").(string)
    97  
    98  	for {
    99  		select {
   100  		case <-cancel:
   101  			log.Println("[INFO] Retrieve password wait cancelled. Exiting loop.")
   102  			return "", errors.New("Retrieve password wait cancelled")
   103  		case <-time.After(5 * time.Second):
   104  		}
   105  
   106  		resp, err := ec2conn.GetPasswordData(&ec2.GetPasswordDataInput{
   107  			InstanceID: instance.InstanceID,
   108  		})
   109  		if err != nil {
   110  			err := fmt.Errorf("Error retrieving auto-generated instance password: %s", err)
   111  			return "", err
   112  		}
   113  
   114  		if resp.PasswordData != nil && *resp.PasswordData != "" {
   115  			decryptedPassword, err := decryptPasswordDataWithPrivateKey(
   116  				*resp.PasswordData, []byte(privateKey))
   117  			if err != nil {
   118  				err := fmt.Errorf("Error decrypting auto-generated instance password: %s", err)
   119  				return "", err
   120  			}
   121  
   122  			return decryptedPassword, nil
   123  		}
   124  
   125  		log.Printf("[DEBUG] Password is blank, will retry...")
   126  	}
   127  }
   128  
   129  func decryptPasswordDataWithPrivateKey(passwordData string, pemBytes []byte) (string, error) {
   130  	encryptedPasswd, err := base64.StdEncoding.DecodeString(passwordData)
   131  	if err != nil {
   132  		return "", err
   133  	}
   134  
   135  	block, _ := pem.Decode(pemBytes)
   136  	var asn1Bytes []byte
   137  	if _, ok := block.Headers["DEK-Info"]; ok {
   138  		return "", errors.New("encrypted private key isn't yet supported")
   139  		/*
   140  			asn1Bytes, err = x509.DecryptPEMBlock(block, password)
   141  			if err != nil {
   142  				return "", err
   143  			}
   144  		*/
   145  	} else {
   146  		asn1Bytes = block.Bytes
   147  	}
   148  
   149  	key, err := x509.ParsePKCS1PrivateKey(asn1Bytes)
   150  	if err != nil {
   151  		return "", err
   152  	}
   153  
   154  	out, err := rsa.DecryptPKCS1v15(nil, key, encryptedPasswd)
   155  	if err != nil {
   156  		return "", err
   157  	}
   158  
   159  	return string(out), nil
   160  }