Who triggers the wrapper script generation on a Windows node ?

[Prasoon Karunan‏]

Hi Folks,

I am now trying to understand how ansible module execution happens on a Windows node. I've understood about the wrapper scripts and the json file which contains everything, but cannot find the starting point of the below code

begin {

$path = 'C:\Users\Administrator\AppData\Local\Temp\ansible-tmp-1565881753.1183164-174629035055307\AnsiballZ_<module>.ps1'

$DebugPreference = "Continue"

$ErrorActionPreference = "Stop"

Set-StrictMode -Version 2

$fd = [System.IO.File]::Create($path)

$sha1 = [System.Security.Cryptography.SHA1CryptoServiceProvider]::Create()

$bytes = @() #initialize for empty file case

}

process {

$bytes = [System.Convert]::FromBase64String($input)

$sha1.TransformBlock($bytes, 0, $bytes.Length, $bytes, 0) | Out-Null

$fd.Write($bytes, 0, $bytes.Length)

}

end {

$sha1.TransformFinalBlock($bytes, 0, 0) | Out-Null

$hash = [System.BitConverter]::ToString($sha1.Hash).Replace("-", "").ToLowerInvariant()

$fd.Close()

Write-Output "{""sha1"":""$hash""}"

}

I am searching for the trigger point which give the automatic variable $input the encoded code.

[Jordan Borean‏]

Hi

This particular script is part of the put_file operation for winrm [1] which is executed like "PowerShell.exe .... -EncodedCommand ScriptB64". Part of the put_file method is to read the bytes of the file to transfer across and send it over the stdin pipe of the process under the WSMan Send operation. There is an automatic trigger in PowerShell where the begin block runs then the process block will run for each input that is sent until we tell it there is no more until finally the end block runs. The '$input' variable is an automatic variable which contains the input from the stdin pipe for that process (each byte fragment of the file).

In saying all this, the put_file operation should not be running at all for standard module execution. We use pipelining in pretty much all cases to execute a module and the only times put_file is used are;

• An action plugin on the controller needs to put a file for a module to use, e.g. win_copy, win_template, script
• The ANSIBLE_KEEP_REMOTE_FILES=1 env var is set when running Ansible, this should only be used for debugging purposes and is not the standard operation
  

What normally happens in the pipelining scenario is that we run the bootstrap_wrapper.ps1 [2] which takes in data from the stdin pipe to execute. This data is a string split by null chars where the first part is the exec_wrapper and the second part is the module manifest info which drives the wrapper. This way no data touches the disk (unless we need to copy a file) making things a lot faster than before.

[1] - https://github.com/ansible/ansible/blob/491a47c7c5be8ba5b4cca4e1a5171c15d669a47f/lib/ansible/plugins/connection/winrm.py#L565

[2] - https://github.com/ansible/ansible/blob/devel/lib/ansible/executor/powershell/bootstrap_wrapper.ps1

Thanks

Jordan

[Prasoon Karunan‏]

Awesome, thanks for the brief explanation. So correct me if I'm wrong, func exec_command is the one which does the pipeliinig execution , which is then accepted by $input via and then call execwrapper scriptblock ?

[Jordan Borean‏]

Yep that's correct, the exec_command function doesn't no or care about what it is executing, it just has the command to run passed in as cmd and option input data to send over the stdin pipe. It's up to the caller of exec_command to make sure the command that it wants to run accepts input data and the correct input data is sent in. The _execute_module [1] function in the action plugin base is where all the logic happens to build that script and input data to be run.

[1] - https://github.com/ansible/ansible/blob/11862782fff0ef530d44523676b82dfdf596dfea/lib/ansible/plugins/action/__init__.py#L750

Thanks

Jordan

[Prasoon Karunan‏]

Cool, that helped a lot. But now into another confusion. 

There is an array list getting created which is used to create complex_args in module_powershell_wrapper and there is a condition in Parse-Args/GetParam() to use complex_args if $args doesn't have any value. Since $complex_args variable is always created in module_wrapper , when will the $args be used ? is it used when pipelining is not used ?

Thanks,

Prasoon

[Jordan Borean‏]

complex_args is actually a hashtable where the key is the module option and the value is the raw value for that option. You might be confusing the ArrayList with the generic list we use to store variable definitions, that include complex_args, that are passed to the module_wrapper process.

Anything that uses our exec_wrapper process will use $complex_args even in non-pipelined scenarios as pipelining just changes how the payload is delivered.

The only reason why we still read from $args is purely for legacy reasons and for people manually running the modules outside of our wrapper process, i.e. not Ansible.

Thanks

Jordan