Current File : //lib/python2.7/site-packages/salt/crypt.pyc
�
���^c @@ s� d Z d d l m Z m Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l
Z
d d l Z d d l Z d d l
Z
d d l Z d d l Z d d l Z d d l Z d d l Z d d l m Z d d l m Z y& d d l m Z m Z m Z e Z Wn e k
r/e Z n Xe r�y\ d d l m! Z! m" Z" d d l# m$ Z$ d d l% m Z d d
l& m' Z' d d l( Z) e Z* Wn e k
r�e Z* n Xn e o�e* r+yV d d l+ m! Z! m" Z" d d l, m$ Z$ d d l- m Z d d
l. m' Z' d d l/ Z0 Wn e k
r'n Xn d d l1 Z2 d d l3 Z2 d d l4 Z2 d d l5 Z2 d d l6 Z2 d d l7 Z2 d d l8 Z2 d d l9 Z2 d d l: Z2 d d l; Z2 d d l< Z2 d d l= Z2 d d l> Z2 d d l? Z2 d d l@ mA ZA mB ZB mC ZC mD ZD e jE eF � ZG eH d � ZI eH eH d
� ZJ e2 jK jL jM d � � ZN d � ZO d � ZP eH d � ZQ d � ZR eH d � ZS d � ZT d � ZU d eV f d � � YZW d eX f d � � YZY d eY f d � � YZZ d eX f d � � YZ[ d S( s�
The crypt module manages all of the cryptography functions for minions and
masters, encrypting and decrypting payloads, preparing messages, and
authenticating peers
i ( t absolute_importt print_functionN( t zip( t six( t RSAt EVPt BIO( t AESt
PKCS1_OAEP( t SHA( R ( t
PKCS1_v1_5( t AuthenticationErrort SaltClientErrort SaltReqTimeoutErrort
MasterExitc C@ sI t j j | d � } t j j j d � �t j d � t j j | � r[ t j d � d St j j | � r� t j
| t j � r� t j | t
j t
j B� n t j j j | d � � } | j d � Wd QXt j | t
j � | r?y5 d d l } | j | � j } t j | | d � Wq?t t t t f k
r;q?Xn Wd QXd S(
sR
Set an AES dropfile to request the master update the publish session key
s .dfni� s Rotating AES keys" AES key rotation already requestedNs wb+t i i����( t ost patht joint saltt utilst filest set_umaskt logt infot isfilet accesst W_OKt chmodt statt S_IRUSRt S_IWUSRt fopent writet pwdt getpwnamt pw_uidt chownt KeyErrort ImportErrort OSErrort IOError( t cachedirt usert dfnt fp_R" t uid( ( s. /usr/lib/python2.7/site-packages/salt/crypt.pyt dropfileR s$
( c @ sF t j j | | � } d j | � } d j | � } t rT t j | d d � � } n( t j j j
� t j d | d d � } t j j | � r� | St j
| t j � s� t d j t j j | � t j � � � � n t j j j d � �� t r1� s | j | d d �qk| j | d d
d � f d � �n: t j j j | d
� � } | j | j d � � � Wd QXWd QXt r�| j | � n= t j j j | d
� �# } | j | j � j d � � Wd QXt j | d � | rByH d d l }
|
j | � j } t j | | d � t j | | d � WqBt! t" t# f k
r>qBXn | S( s
Generate a RSA public keypair for use with salt
:param str keydir: The directory to write the keypair to
:param str keyname: The type of salt server for whom this key should be written. (i.e. 'master' or 'minion')
:param int keysize: The number of bits in the key
:param str user: The user on the system who should own this keypair
:param str passphrase: The passphrase which should be used to encrypt the private key
:rtype: str
:return: Path on the filesystem to the RSA private key
s {0}.pems {0}.pubi c S@ s d S( N( t None( ( ( s. /usr/lib/python2.7/site-packages/salt/crypt.pyt <lambda>~ s t bitst es, Write access denied to "{0}" for user "{1}".i� t ciphert des_ede3_cbct callbackc @ s t j j j � � S( N( R R t stringutilst to_bytes( t x( t
passphrase( s. /usr/lib/python2.7/site-packages/salt/crypt.pyR1 � s s wb+t PEMNi i i����($ R R R t formatt HAS_M2R t gen_keyR R t cryptt
reinit_cryptot generateR R R R) t abspatht getpasst getuserR R t save_pemR0 R R! t exportKeyt save_pub_keyt publickeyR R" R# R$ R% R& R' R( ( t keydirt keynamet keysizeR+ R: t baset privt pubt gent fR" R. ( ( R: s. /usr/lib/python2.7/site-packages/salt/crypt.pyt gen_keysl sF
-%" c @ sk t j d � t r1 t j | � f d � � } n6 t j j j | � � } t j | j
� � � } Wd QX| S( s�
Load a private key from disk. `timestamp` above is intended to be the
timestamp of the file's last modification. This fn is memoized so if it is
called with the same path and timestamp (the file's last modified time) the
second time the result is returned from the memoiziation. If the file gets
modified then the params are different and the key is loaded from disk.
s3 salt.crypt._get_key_with_evict: Loading private keyc @ s
t j � � S( N( R t b( R9 ( R: ( s. /usr/lib/python2.7/site-packages/salt/crypt.pyR1 � s N( R t debugR= R t load_keyR R R R t importKeyt read( R t timestampR: t keyRP ( ( R: s. /usr/lib/python2.7/site-packages/salt/crypt.pyt _get_key_with_evict� s
c C@ s2 t j d � t | t j t j j | � � | � S( s=
Read a private key off the disk. Poor man's simple cache in effect here,
we memoize the result of calling _get_rsa_with_evict. This means the first
time _get_key_with_evict is called with a path and a timestamp the result
is cached. If the file (the private key) does not change then its
timestamp will not change and the next time the result is returned from the
cache. If the key DOES change the next time _get_rsa_with_evict is called
it is called with different parameters and the fn is run fully to retrieve
the key from disk.
s+ salt.crypt.get_rsa_key: Loading private key( R RS RY R t text_typeR R t getmtime( R R: ( ( s. /usr/lib/python2.7/site-packages/salt/crypt.pyt get_rsa_key� s
c C@ s� t j d � t rm t j j j | d � � } | j � j d d � } Wd QXt j
| � } t j | � } n3 t j j j | � � } t j
| j � � } Wd QX| S( s)
Read a public key off the disk.
s. salt.crypt.get_rsa_pub_key: Loading public keyt rbs RSA R N( R RS R= R R R R RV t replaceR t MemoryBufferR t load_pub_key_bioRU ( R RP t datat bioRX ( ( s. /usr/lib/python2.7/site-packages/salt/crypt.pyt get_rsa_pub_key� s
c C@ s� t | | � } t j d � t rf t j d � } | j t j j j
| � � | j � } | j | � St
j | � } | j t j t j j j
| � � � Sd S( sS
Use Crypto.Signature.PKCS1_v1_5 to sign a message. Returns the signature.
s) salt.crypt.sign_message: Signing message.t sha1N( R\ R RS R= R t
MessageDigestt updateR R R7 R8 t finalt signR
t newR ( t privkey_patht messageR: RX t mdt digestt signer( ( s. /usr/lib/python2.7/site-packages/salt/crypt.pyt sign_message� s
c C@ s� t j d � t | � } t j d � t rs t j d � } | j t j j j
| � � | j � } | j | | � St
j | � } | j t j t j j j
| � � | � Sd S( su
Use Crypto.Signature.PKCS1_v1_5 to verify the signature on a message.
Returns True for valid signature.
s/ salt.crypt.verify_signature: Loading public keys0 salt.crypt.verify_signature: Verifying signatureRd N( R RS Rc R= R Re Rf R R R7 R8 Rg t verifyR
Ri R ( t pubkey_pathRk t signaturet pubkeyRl Rm t verifier( ( s. /usr/lib/python2.7/site-packages/salt/crypt.pyt verify_signature� s
c C@ s t j j j | � � } | j � } Wd QXt | | | � } t j | � } t j j
| � ra t St j
d t j j | � t j j | � � t j j
| � r� t j
d | � nM t j j j | d � �# } | j t j j j | � � Wd QXt j
d | � t S( sp
creates a signature for the given public-key with
the given private key and writes it to sign_path
Ns$ Calculating signature for %s with %ssF Signature file %s already exists, please remove it first and try agains wb+s Wrote signature to %s( R R R R RV Ro t binasciit
b2a_base64R R R t FalseR t tracet basenameR! R7 R8 t True( t priv_patht pub_patht sign_pathR: R- t mpub_64t mpub_sigt mpub_sig_64t sig_f( ( s. /usr/lib/python2.7/site-packages/salt/crypt.pyt
gen_signature� s" "
"c C@ sN t r | j | t j j j � St j j j | j d � � } | j | � Sd S( s
Generate an M2Crypto-compatible signature
:param Crypto.PublicKey.RSA._RSAobj key: The RSA key object
:param str message: The message to sign
:rtype: str
:return: The signature, or an empty string if the signature operation failed
R; N( R= t private_encryptR R t rsax931t RSA_X931_PADDINGt
RSAX931SignerRF Rh ( RX Rk Rn ( ( s. /usr/lib/python2.7/site-packages/salt/crypt.pyR� s c C@ sN t r | j | t j j j � St j j j | j d � � } | j | � Sd S( s7
Verify an M2Crypto-compatible signature
:param Crypto.PublicKey.RSA._RSAobj key: The RSA public key object
:param str message: The signed message to verify
:rtype: str
:return: The message (or digest) recovered from the signature, or an
empty string if the verification failed
R; N( R= t public_decryptR R R� R� t RSAX931VerifierRF Rp ( RN Rk Rt ( ( s. /usr/lib/python2.7/site-packages/salt/crypt.pyR� , s
t
MasterKeysc B@ s_ e Z d Z d � Z d � Z d � Z d d
d � Z d d � Z d � Z d � Z
d � Z RS( s�
The Master Keys class is used to manage the RSA public key pair used for
authentication by the master.
It also generates a signing key-pair if enabled with master_sign_key_name.
c C@ s t t | � j � | | _ t j j | j d d � | _ t j j | j d d � | _ t j
j j | j d | j � } | j
d | � | _ d | _ | d r�| d rrt j j | j d | d � | _ t j j | j � rBt j
j j | j � � } | j � | _ Wd QXt j d t j j | j � | j d � q�t j d
| j � t j d � t j d � q�t j
j j | j d
| j � } t j j | j d | d d � | _ t j j | j d | d d � | _ | j
d | d � | _ n d S( Nt pki_dirs
master.pubs
master.pemt key_passR: t master_sign_pubkeyt master_use_pubkey_signaturet master_pubkey_signatures Read %s's signature from %ssm Signing the master.pub key with a signature is enabled but no signature file found at the defined location %ssg The signature-file may be either named differently or has to be created with 'salt-key --gen-signature'i t signing_key_passt master_sign_key_names .pubs .pemt name( t superR� t __init__t optsR R R R} t rsa_pathR R t sdbt sdb_gett _MasterKeys__get_keysRX R0 t
pub_signaturet sig_pathR R R RV R R Rz t errort syst exitt
pub_sign_patht
rsa_sign_patht sign_key( t selfR� R� R- ( ( s. /usr/lib/python2.7/site-packages/salt/crypt.pyR� D s< "
"c C@ s | j | d � d S( NR� ( R� ( R� t state( ( s. /usr/lib/python2.7/site-packages/salt/crypt.pyt __setstate__y s c C@ s i | j d 6S( NR� ( R� ( R� ( ( s. /usr/lib/python2.7/site-packages/salt/crypt.pyt __getstate__| s t masterc C@ s� t j j | j d | d � } t j j | � s t j d | | j d � t | j d | | j d | j j d � | � n t r� t
j } n t } y t
| | � } Wn; | k
r� } d j | � } t j | � t | � � n Xt j d | | � | S( s?
Returns a key object for a key in the pki-dir
R� s .pems Generating %s keys: %sRK R+ s4 Unable to read key: {0}; passphrase may be incorrects Loaded %s key: %s( R R R R� t existsR R RQ t getR= R t RSAErrort
ValueErrorR\ R< R� R RS ( R� R� R: R t key_errorRX R3 Rk ( ( s. /usr/lib/python2.7/site-packages/salt/crypt.pyt
__get_keys s(
c C@ s� t j j | j d | d � } t j j | � s� | j � } t rT | j | � q� t j j
j | d � �# } | j | j
� j d � � Wd QXn t j j
j | � � } | j � SWd QXd S( s_
Return the string representation of a public key
in the pki-directory
R� s .pubs wb+R; N( R R R R� R R� R= RG R R R R R! RH RF RV ( R� R� R RX t wfht rfh( ( s. /usr/lib/python2.7/site-packages/salt/crypt.pyt get_pub_str� s
%c C@ s | j | j f S( N( R} R� ( R� ( ( s. /usr/lib/python2.7/site-packages/salt/crypt.pyt get_mkey_paths� s c C@ s | j | j f S( N( R� R� ( R� ( ( s. /usr/lib/python2.7/site-packages/salt/crypt.pyt get_sign_paths� s c C@ s | j S( s�
returns the base64 encoded signature from the signature file
or None if the master has its own signing keys
( R� ( R� ( ( s. /usr/lib/python2.7/site-packages/salt/crypt.pyt pubkey_signature� s N( t __name__t
__module__t __doc__R� R� R� R0 R� R� R� R� R� ( ( ( s. /usr/lib/python2.7/site-packages/salt/crypt.pyR� = s 5 t AsyncAuthc B@ s: e Z d Z e j � Z i Z d d � Z e d d � � Z
d d � Z d d � Z d � Z
e d � � Z e d � � Z e d � � Z d � Z d d
� Z e j j d � � Z e j j d e d
d d � � Z d � Z d � Z d � Z e d � Z d � Z d � Z d � Z e d � Z! e d � Z" d � Z# RS( sP
Set up an Async object to maintain authentication with the salt master
c C@ s� | p t j j j � } | t j k r= t j � t j | <n t j | } | j | � } | j | � } | d k r� t j d | � t
j | � } | j | d | �| | | <n t j d | � | S( sC
Only create one instance of AsyncAuth per __key()
s! Initializing new AsyncAuth for %st io_loops Re-using AsyncAuth for %sN( t tornadot ioloopt IOLoopt currentR� t instance_mapt weakreft WeakValueDictionaryt _AsyncAuth__keyR� R0 R RS t objectt __new__t __singleton_init__( t clsR� R� t loop_instance_mapRX t auth( ( s. /usr/lib/python2.7/site-packages/salt/crypt.pyR� � s
c C@ s | d | d | d f S( NR� t idt
master_uri( ( R� R� R� ( ( s. /usr/lib/python2.7/site-packages/salt/crypt.pyt __key� s c C@ s d S( N( ( R� R� R� ( ( s. /usr/lib/python2.7/site-packages/salt/crypt.pyR� � s c C@ s� | | _ t j r$ t j � | _ n t j j j t j � � | _ t j
j | j � | _ t
j j | j d d � | _ t
j j | j d d � | _ | j d d k r� d | _ n d | _ t
j j | j � s� | j � n | p� t j j j � | _ t j j j � | j | j � } | t j k r�t j | } | | _ t | j | d � | _ t j! j" � | _# | j# j$ t% � n
| j& � d S(
s�
Init an Auth instance
:param dict opts: Options for this server
:return: Auth instance
:rtype: Auth
R� s
minion.pubs
minion.pemt __rolet syndics syndic_master.pubs minion_master.pubt aesN(' R� R t PY2t Crypticlet generate_key_stringt tokenR R R7 R8 t payloadt Serialt serialR R R R} R� t mpubR t get_keysR� R� R� R� R� R? R@ R� R� t creds_mapt _credst
_crypticlet
concurrentt Futuret _authenticate_futuret
set_resultR{ t authenticate( R� R� R� RX t creds( ( s. /usr/lib/python2.7/site-packages/salt/crypt.pyR� � s,
c C@ s� | j } | j | t j | j | � d d �} | | t | � <xF | j D]; } | d k rb qJ n t | | t j | j | | � � qJ W| S( NR� ( R� ( t __class__R� t copyt deepcopyR� R0 R� t __dict__t setattr( R� t memoR� t resultRX ( ( s. /usr/lib/python2.7/site-packages/salt/crypt.pyt __deepcopy__ s ' 'c C@ s | j S( N( R� ( R� ( ( s. /usr/lib/python2.7/site-packages/salt/crypt.pyR� s c C@ s | j S( N( R� ( R� ( ( s. /usr/lib/python2.7/site-packages/salt/crypt.pyt crypticle s c C@ s1 t | d � o0 | j j � o0 | j j � d k S( NR� ( t hasattrR� t donet exceptionR0 ( R� ( ( s. /usr/lib/python2.7/site-packages/salt/crypt.pyt
authenticated! s c C@ sD | j r@ | ` | j | j � } | t j k r@ t j | =q@ n d S( N( R� R� R� R� R� R� ( R� RX ( ( s. /usr/lib/python2.7/site-packages/salt/crypt.pyt
invalidate' s
c @ s� t � d � r+ � j j � r+ � j } n+ t j j � } | � _ � j j � j � � d k r� � � f d � } | j
| � n | S( s�
Ask for this client to reconnect to the origin
This function will de-dupe all calls here and return a *single* future
for the sign-in-- whis way callers can all assume there aren't others
R� c @ s# | j � } � j j � | � d S( N( R� R� t add_callback( t futuret response( R6 R� ( s. /usr/lib/python2.7/site-packages/salt/crypt.pyt
handle_future> s N( R� R� R� R� R� R� R� R� t
_authenticateR0 t add_done_callback( R� R6 R� R� ( ( R6 R� s. /usr/lib/python2.7/site-packages/salt/crypt.pyR� . s c c@ s | j d } | j d } | s) | } n d } t j j j j | j d d d | j �} z�d } x t r�y | j d | � V} Wn t
k
r� } | } Pn X| d k r}| j j d � t k r� t
d � } Pn | j j d
� r$| j j d d � r
t
d � } Pq$t d � t
j d
� n | rNt j d | � t j j | � Vn | | k re | | 7} t j d | � qe qe n Pqe Wt | t � s�d | k r| j j d � t k r�t
d � } n y t j | j | j � =Wn t k
r�n X| st
d � } n | j j | � n� | j | j � } | t j | <| | _ t | j | d � | _ | j j t � | j j d � t k r�t j! j" j# | j j d � d | j d t$ �} | j% i | d 6| d 6t j! j" j& d d d d � � n Wd | j' � Xd S( s]
Authenticate with the master, this method breaks the functional
paradigm, it will update the master information from a fresh sign
in, signing in can occur as often as needed to keep up with the
revolving master AES key.
:rtype: Crypticle
:returns: A crypticle used for encryption operations
t acceptance_wait_timet acceptance_wait_time_maxR? t clearR� t channelt retryt detect_modes Detect mode is ont callert
local_masterssP Minion failed to authenticate with the master, has the minion key been accepted?i s Waiting %s seconds before retry.s Authentication wait time is %sR� s -|RETRY|-s3 Attempt to authenticate with the salt master failedt auth_eventsR� R� t listenRX R� t prefixR� t suffixN(( R� R0 R t transportt clientt AsyncReqChannelt factoryR� R{ t sign_inR R� t printR� R� R R R� RO t sleepRS t
isinstancet dictR� R� R� R& R� t
set_exceptionR� R� R� R� R t eventt get_eventRx t
fire_eventt tagifyt close( R� R� R� R� R� R� t excRX R ( ( s. /usr/lib/python2.7/site-packages/salt/crypt.pyR� E sr
0&i< i c c@ s. i } | j j d d � } | d k r0 | } n | j j d d � } | d k rZ | } n | j j d d � } | d k r� | } n t j j | j d | j � } | j d | d <t }
| s� t }
t j
j j j
| j d d d | j �} n | j � } z� y | j | d | d
| �V} Wnw t k
r�}
| r_t j d |
� t j j d � � n | j j d
� t k r�t j j d � � q�t d � � n XWd |
r�| j � n Xt | t � s�t j d | � t j j t � � n d | k r�d | d k r�| d d s�| j d rAt j d � t j j d � � q�t j d � t j t j d d � � t! j" t j# j$ j% � q�| d d d k r�t j j d � � q�t j d | j d � t j j d � � q�n | j& | d d | k �| d <| d s)t j d t j' j( | � t d � � n | j j d t � r�| j j d! | j j d" t � � } | r
t j) j* j+ | d# | j d$ �| k r�| j, | | � q�q
na | j j d" t � r
t j) j* j+ | d# | j d$ �| j d" k r
| j, | j d" | � q
n | d% | d% <t j j | � � d S(& s�
Send a sign in request to the master, sets the key information and
returns a dict containing the master publish interface to bind to
and the decrypted aes key for transport decryption.
:param int timeout: Number of seconds to wait before timing out the sign-in request
:param bool safe: If True, do not raise an exception on timeout. Retry instead.
:param int tries: The number of times to try to authenticate before giving up.
:raises SaltReqTimeoutError: If the sign-in request has timed out and :param safe: is not set
:return: Return a string on failure indicating the reason for failure. On success, return a dictionary
with the publication port and the shared AES key.
t auth_timeoutt
auth_safemodet
auth_triesR� R� R? R� R� t triest timeouts SaltReqTimeoutError: %sR� R� sF Attempt to authenticate with the salt master failed with timeout errorNs Sign-in attempt failed: %st loadt rett rejected_retrys� The Salt Master has rejected this minion's public key.
To repair this issue, delete the public key for this minion on the Salt Master.
The Salt Minion will attempt to to re-authenicate.s� The Salt Master has rejected this minion's public key!
To repair this issue, delete the public key for this minion on the Salt Master and restart this minion.
Or restart the Salt Master in open mode to clean out the keys. The Salt Minion will now exit.i
i t fulls� The Salt Master has cached the public key for this node, this salt minion will wait for %s seconds before attempting to re-authenticateR� t
master_pubR� R� s6 The Salt Master server's public key did not authenticate!
The master may need to be updated if it is a version of Salt lower than %s, or
If you are confident that you are connecting to a valid Salt Master, then remove the master public key and restart the Salt Minion.
The master public key can be found at:
%ss Invalid master keyt
syndic_mastert
syndic_fingert
master_fingert sum_typet hash_typet publish_port(- R� R� R0 R R R R� Rx R{ R R� R� R R R� t minion_sign_in_payloadt sendR
R t warningR� RO t ReturnR R R R R� t criticalt timeR t randomt randintR� R� t defaultst exitcodest EX_NOPERMt
verify_mastert versiont __version__R R? t
pem_fingert _finger_fail( R� R t safeR R� R� R R R t m_pub_fnt
close_channelt sign_in_payloadR� R3 R ( ( s. /usr/lib/python2.7/site-packages/salt/crypt.pyR � s�
$(/ c C@ s� | j j d d � } t j j j | j d | � t j j | j � s� t
j d | j d � t | j d d | j d | j j d � � n t
| j d � } t
j d | j � | S( s�
Return keypair object for the minion.
:rtype: Crypto.PublicKey.RSA._RSAobj
:return: The RSA keypair
R+ t rootR� s Generating keys: %st minionRK s Loaded minion key: %sN( R� R� R R Rp t check_path_traversalR R R� R� R R RQ R\ R0 RS ( R� R+ RX ( ( s. /usr/lib/python2.7/site-packages/salt/crypt.pyR� s
c C@ s t | j � | � S( s�
Encrypt a string with the minion private key to verify identity
with the master.
:param str clear_tok: A plaintext token to encrypt
:return: Encrypted token
:rtype: str
( R� R� ( R� t clear_tok( ( s. /usr/lib/python2.7/site-packages/salt/crypt.pyt gen_token% s c C@ s: i } d | d <| j d | d <d | j k rx i } x2 | j d D]# } | j d j | d � | | <qD W| | d <n yy t j j | j d | j � } t | � } t r� | j | j
t j � | d <n% t
j | � } | j | j
� | d <Wn t k
rn Xt j j j | j � � } | j � | d <Wd QX| S(
s
Generates the payload used to authenticate with the master
server. This payload consists of the passed in id_ and the ssh
public key to encrypt the AES key sent back from the master.
:return: Payload dictionary
:rtype: dict
t _autht cmdR� t autosign_grainst grainsR� R� RN N( R� R� R0 R R R R� Rc R= t public_encryptR� R t pkcs1_oaep_paddingR Ri t encryptt ExceptionR R R R R} RV ( R� R� R9 t grainRq RN R4 RP ( ( s. /usr/lib/python2.7/site-packages/salt/crypt.pyR 0 s(
!
c C@ s | j j d t � r7 t j d d j t j � � � n
t j d � | j � } t
rr | j | d t j
� } n" t j | � } | j | d � } d | k rwt j j | j d | j � } t j j | � r{y t | � } Wn t k
r� d
SXt j | � j � } t j r,t j j j | � } n t
rHt | | d � } n t | j! � | d � } | | k rtd Sq{n d St j r�t j j j" | � } n d | k r�| j# d � Sd | k r t
r�| j | d t j
� }
n | j | d � }
| |
f S| s| d f Sd
S( sf
This function is used to decrypt the AES seed phrase returned from
the master server. The seed phrase is decrypted with the SSH RSA
host key.
Pass in the encrypted AES key.
Returns the decrypted AES seed key, a string
:param dict payload: The incoming payload. This is a dictionary which may have the following keys:
'aes': The shared AES key
'enc': The format of the message. ('clear', 'pub', etc)
'sig': The message signature
'publish_port': The TCP port which published the message
'token': The encrypted token used to verify the message.
'pub_key': The public key of the sender.
:rtype: str
:return: The decrypted token that was provided, with padding.
:rtype: str
:return: The decrypted AES seed key
t auth_trbs Auth Called: %sR s% Decrypting the current master AES keyR� t sigR� s _|-R� ( R R ( R R ( R R ( R R ($ R� R� Rx R R R t tracebackt format_stackRS R� R= t private_decryptR R< R Ri t decryptR R R� R� Rc R> t hashlibt sha256t hexdigestR t PY3R R R7 R8 R� RH t to_strt split( R� R� R RX t key_strR4 t m_patht mkeyRm t m_digestR� ( ( s. /usr/lib/python2.7/site-packages/salt/crypt.pyt decrypt_aesO sL "
c C@ s� | j d r� t j j | j d | j d d � } t j j | � rd t | | t j | � � } n t j d t j j
| � � t S| r� t j d | j d d � t
St j d � t Sn t j d � t Sd S( s�
Wraps the verify_signature method so we have
additional checks.
:rtype: bool
:return: Success or failure of public key verification
R� R� s .pubsk Verification public key %s does not exist. You need to copy it from the master to the minions pki directorysT Successfully verified signature of master public key with verification public key %ss( Failed to verify signature of public keys� Failed to verify the signature of the message because the verification key-pairs name is not defined. Please make sure that master_sign_key_name is defined.N( R� R R R R Ru Rv t
a2b_base64R R� Rz Rx RS R{ ( R� Rk RA R t res( ( s. /usr/lib/python2.7/site-packages/salt/crypt.pyt verify_pubkey_sig� s*
c C@ s y� | j | d | d � r� t j d | j d � t j j | j d | j � } t j j
j | j j d d � � } t j j j | d d | ��' } | j t j j j | d � � Wd QXt St j d | j d � t SWn, t k
r } t j d
� t | � � n Xd S( Nt pub_keyt pub_sigs9 Received signed and verified master pubkey from master %sR� R� R+ s wb+R. sL Received signed public-key from master %s but signature verification failed!sC There was an error while verifying the masters public-key signature( RS R R R� R R R R� R R R+ t get_uidR� R0 R t fpopenR! R7 R8 R{ R� Rx R> ( R� R� R/ R. R� t sign_exc( ( s. /usr/lib/python2.7/site-packages/salt/crypt.pyt verify_signing_master� s&
$!&c C@ s� d | k r | j d r t Sd | k r; | j d r; t Sd | k rf | j d rf t j d � t Sd | k r� | j d r� t j d � t Sd S( s%
Checks if both master and minion either sign (master) and
verify (minion). If one side does not, it should fail.
:param dict payload: The incoming payload. This is a dictionary which may have the following keys:
'aes': The shared AES key
'enc': The format of the message. ('clear', 'pub', 'aes')
'publish_port': The TCP port which published the message
'token': The encrypted token used to verify the message.
'pub_key': The RSA public key of the sender.
RU t verify_master_pubkey_signs� The masters sent its public-key signature, but signature verification is not enabled on the minion. Either enable signature verification on the minion or disable signing the public key on the master!s� The master did not send its public-key signature, but signature verification is enabled on the minion. Either disable signature verification on the minion or enable signing the public on the master!N( R� R{ R R� Rx ( R� R� ( ( s. /usr/lib/python2.7/site-packages/salt/crypt.pyt check_auth_deps� s
c C@ s� | rh y< | j | | � \ } } | | j k rA t j d � d SWn t k
rc t j d � d SX| S| j | | � \ } } | Sd S( sg
Return the AES key received from the master after the minion has been
successfully authenticated.
:param dict payload: The incoming payload. This is a dictionary which may have the following keys:
'aes': The shared AES key
'enc': The format of the message. ('clear', 'pub', etc)
'publish_port': The TCP port which published the message
'token': The encrypted token used to verify the message.
'pub_key': The RSA public key of the sender.
:rtype: str
:return: The shared AES key received from the master.
s4 The master failed to decrypt the random minion tokenR N( RP R� R R� R> ( R� R� R R� R� ( ( s. /usr/lib/python2.7/site-packages/salt/crypt.pyt extract_aes� s
c
C@ s* t j j | j d | j � } t j j | � } | r�| r�| j d r�t j j j | � � } | j
� } Wd QX| d j d d � j d d � | j d d � j d d � k r| j | � s� d S| j d r� | j
| � r� | j | d t �Sd Sq}t j d
� d Sq&| j | � s%d S| j d rp| j
| � rN| j | � St j d | j d
d � d Sq&| j | � Sn� | j | � s�d S| j d r�| j
| � r�| j | d t �Sd Sn] | st j j j | d � �' } | j t j j j | d � � Wd QXn | j | d t �Sd S( s
Verify that the master is the same one that was previously accepted.
:param dict payload: The incoming payload. This is a dictionary which may have the following keys:
'aes': The shared AES key
'enc': The format of the message. ('clear', 'pub', etc)
'publish_port': The TCP port which published the message
'token': The encrypted token used to verify the message.
'pub_key': The RSA public key of the sender.
:param bool master_pub: Operate as if minion had no master pubkey when it sent auth request, i.e. don't verify
the minion signature
:rtype: str
:return: An empty string on verification failure. On success, the decrypted AES message in the payload.
R� t open_modeNRT s
R s
RZ R sf The master key has changed, the salt master could have been subverted, verify salt master's public keyt always_verify_signaturesS The masters public could not be verified. Is the verification pubkey %s up to date?R� s .pubs wb+( R R R R� R� R R R R R RV R^ R[ RY R\ Rx R R� R! R7 R8 ( R� R� R R/ t m_pub_existsR- t local_master_pub( ( s. /usr/lib/python2.7/site-packages/salt/crypt.pyR) sH !
)c C@ s@ t j d | t j j j | d | j d �� t j d � d S( Ns The specified fingerprint in the master configuration file:
%s
Does not match the authenticating master's key:
%s
Verify that the configured fingerprint matches the fingerprint of the correct master and that this minion is not subject to a man-in-the-middle attack.R R i* ( R R" R R R? R, R� R� R� ( R� t fingert
master_key( ( s. /usr/lib/python2.7/site-packages/salt/crypt.pyR- i s
#N($ R� R� R� R� t WeakKeyDictionaryR� R� R0 R� t classmethodR� R� R� R� t propertyR� R� R� R� R� R� RO t coroutineR� R{ R R� R6 R RP RS RY R[ R\ R) R- ( ( ( s. /usr/lib/python2.7/site-packages/salt/crypt.pyR� � s6 %
R x F ) " ! Nt SAuthc B@ s� e Z d Z e j � Z d d � Z e d d � � Z d d � Z
d d � Z e d � � Z
e d � � Z d d � Z d e d d d
� Z RS( sJ
Set up an object to maintain authentication with the salt master
c C@ s} | j | � } t j j | � } | d k ri t j d | � t j | � } | j | � | t j | <n t j d | � | S( s?
Only create one instance of SAuth per __key()
s Initializing new SAuth for %ss Re-using SAuth for %sN(
t _SAuth__keyRg t instancesR� R0 R RS R� R� R� ( R� R� R� RX R� ( ( s. /usr/lib/python2.7/site-packages/salt/crypt.pyR� ~ s
c C@ s | d | d | d f S( NR� R� R� ( ( R� R� R� ( ( s. /usr/lib/python2.7/site-packages/salt/crypt.pyR� � s c C@ s t t | � j | d | �d S( NR� ( R� Rg R� ( R� R� R� ( ( s. /usr/lib/python2.7/site-packages/salt/crypt.pyR� � s c C@ s� | | _ t j r$ t j � | _ n t j j j t j � � | _ t j
j | j � | _ t
j j | j d d � | _ t
j j | j d d � | _ d | j k r� d | _ n$ d | j k r� d | _ n d | _ t
j j | j � s� | j � n d S(
s�
Init an Auth instance
:param dict opts: Options for this server
:return: Auth instance
:rtype: Auth
R� s
minion.pubs
minion.pemR s syndic_master.pubt alert_masters monitor_master.pubs minion_master.pubN( R� R R� R� R� R� R R R7 R8 R� R� R� R R R R} R� R� R R� ( R� R� R� ( ( s. /usr/lib/python2.7/site-packages/salt/crypt.pyR� � s c C@ s# t | d � s | j � n | j S( NR� ( R� R� R� ( R� ( ( s. /usr/lib/python2.7/site-packages/salt/crypt.pyR� � s
c C@ s# t | d � s | j � n | j S( NR� ( R� R� R� ( R� ( ( s. /usr/lib/python2.7/site-packages/salt/crypt.pyR� � s
c C@ sT | j d } | j d } t j j j j | j d d �} | sJ | } n z� x� t r | j d | � } | d k r| j j d � r� | j j d d � r� t
d � } Pq� t d � t j
d
� n | r� t j d | � t j | � n | | k rP | | 7} t j d | � qP qP n PqP W| | _ t | j | d
� | _ Wd | j � Xd S( s]
Authenticate with the master, this method breaks the functional
paradigm, it will update the master information from a fresh sign
in, signing in can occur as often as needed to keep up with the
revolving master AES key.
:rtype: Crypticle
:returns: A crypticle used for encryption operations
R� R� R? R� R� R� R� R� sP Minion failed to authenticate with the master, has the minion key been accepted?i s Waiting %s seconds before retry.s Authentication wait time is %sR� N( R� R R� R� t
ReqChannelR R{ R R� R0 R R R� R� R R R# R RS R� R� R� R ( R� t _R� R� R� R� R� ( ( s. /usr/lib/python2.7/site-packages/salt/crypt.pyR� � s4
!
i< i c C@ sb i } | j j d d
� } | d
k r0 | } n | j j d d
� } | d
k rZ | } n | j j d d
� } | d
k r� | } n t j j | j d | j � } | j d | d <t }
| s� t }
t j
j j j
| j d d �} n | j � } z_ y | j | d | d | �} Wn9 t k
rS}
| rDt j d
|
� d St d � � n XWd
|
rk| j � n Xd | k r d | d k r | d d s�| j d r�t j d � d St j d � t j t j j j � q| d d d k r�d St j d | j d | j d � d Sq n | j | d d | k �| d <| d sot j d t j j | � t j d � n | j j d t � r�| j j d | j j d t � � } | rPt j j j! | d | j d �| k r�| j" | | � q�qPna | j j d t � rPt j j j! | d | j d �| j d k rP| j" | j d | � qPn | d! | d! <| S(" s�
Send a sign in request to the master, sets the key information and
returns a dict containing the master publish interface to bind to
and the decrypted aes key for transport decryption.
:param int timeout: Number of seconds to wait before timing out the sign-in request
:param bool safe: If True, do not raise an exception on timeout. Retry instead.
:param int tries: The number of times to try to authenticate before giving up.
:raises SaltReqTimeoutError: If the sign-in request has timed out and :param safe: is not set
:return: Return a string on failure indicating the reason for failure. On success, return a dictionary
with the publication port and the shared AES key.
R R R R� R� R? R� R R s SaltReqTimeoutError: %sR� sF Attempt to authenticate with the salt master failed with timeout errorNR R R s� The Salt Master has rejected this minion's public key.
To repair this issue, delete the public key for this minion on the Salt Master.
The Salt Minion will attempt to to re-authenicate.s� The Salt Master has rejected this minion's public key!
To repair this issue, delete the public key for this minion on the Salt Master and restart this minion.
Or restart the Salt Master in open mode to clean out the keys. The Salt Minion will now exit.R s
The Salt Master has cached the public key for this node. If this is the first time connecting to this master then this key may need to be accepted using 'salt-key -a %s' on the salt master. This salt minion will wait for %s seconds before attempting to re-authenticate.R� R� R R� R� s6 The Salt Master server's public key did not authenticate!
The master may need to be updated if it is a version of Salt lower than %s, or
If you are confident that you are connecting to a valid Salt Master, then remove the master public key and restart the Salt Minion.
The master public key can be found at:
%si* R R R R R R (# R� R� R0 R R R R� Rx R{ R R� R� Rk R R R R
R R R R R� R" R� R� R& R' R( R) R* R+ R R? R, R- ( R� R R. R R� R� R R R R/ R0 R1 R� R3 R ( ( s. /usr/lib/python2.7/site-packages/salt/crypt.pyR � s| $
$(/ N( R� R� R� R� R� Ri R0 R� Rd Rh R� R� Re R� R� R� R{ R ( ( ( s. /usr/lib/python2.7/site-packages/salt/crypt.pyRg w s ,R� c B@ s} e Z d Z d Z d Z e j � j Z d d � Z e
d d � � Z e
d � � Z d � Z
d � Z d � Z e d
� Z RS( sn
Authenticated encryption class
Encryption algorithm: AES-CBC
Signing algorithm: HMAC-SHA256
s pickle::i i� c C@ sC | | _ | j | j | � | _ | | _ t j j | � | _ d S( N( t
key_stringt extract_keyst keyst key_sizeR R� R� R� ( R� R� Rm Rp ( ( s. /usr/lib/python2.7/site-packages/salt/crypt.pyR� f s c C@ sT t j | d | j � } t j | � } t j rD | j d � } n | j d d � S( Ni s utf-8s
R ( R t urandomt SIG_SIZEt base64t b64encodeR RI t decodeR^ ( R� Rp RX t b64key( ( s. /usr/lib/python2.7/site-packages/salt/crypt.pyR� l s
c C@ s| t j r | j d � } n t j j j t j | � � } t | � | d | j
k sb t d � � | | j
| | j
f S( NRs i s invalid key( R R� Ru R R R7 R8 Rs t b64decodet lenRr t AssertionError( R� Rm Rp RX ( ( s. /usr/lib/python2.7/site-packages/salt/crypt.pyRn u s
)c C@ s' | j \ } } | j t | � | j } t j rI | | t | � } n# | t j j j | t | � � } t
j | j � } t r� t
j d d d | d | d d d t � } | j | � } | | j � 7} n' t j | t j | � } | j | � } | | } t j | | t j � j � } | | S( sH
encrypt data with AES-CBC and sign it with HMAC-SHA256
t algt aes_192_cbcRX t ivt opi t padding( Ro t AES_BLOCK_SIZERx R R� t chrR R R7 R8 R Rq R= R t CipherRx Rf Rg R Ri t MODE_CBCR= t hmacRF RG Rm ( R� Ra t aes_keyt hmac_keyt padt iv_bytest cyphert encrRA ( ( s. /usr/lib/python2.7/site-packages/salt/crypt.pyR= ~ s #*
c C@ s | j \ } } | | j } | | j } t j r\ t | t � r\ t j j j | � } n t
j | | t j
� j � } t | � t | � k r� t j d � t d � � n d } t j r� xh t | | � D]& \ } } | t | � t | � AO} q� Wn. x+ t | | � D] \ } } | | | AO} q
W| d k rPt j d � t d � � n | | j } | | j } t r�t j d d d | d | d d d t � }
|
j | � } | |
j � } n' t j | t j | � }
|
j | � } t j r�| t | d
� S| | d
Sd S( sL
verify HMAC-SHA256 signature and decrypt data with AES-CBC
s Failed to authenticate messages message authentication failedi Rz R{ RX R| R} R~ i����N( Ro Rr R RI R t bytesR R R7 R8 R� Ri RF RG Rm Rx R RS R R� R t ordR R= R R� Rx Rf Rg R R� RE ( R� Ra R� R� RA t mac_bytesR� t zipped_xt zipped_yR� R� R� ( ( s. /usr/lib/python2.7/site-packages/salt/crypt.pyRE � s:
!
* c C@ s | j | j | j j | � � S( s7
Serialize and encrypt a python object
( R= t
PICKLE_PADR� t dumps( R� t obj( ( s. /usr/lib/python2.7/site-packages/salt/crypt.pyR� � s c C@ sN | j | � } | j | j � s% i S| j j | t | j � d | �} | S( s:
Decrypt and un-serialize a python object
t raw( RE t
startswithR� R� t loadsRx ( R� Ra R� R ( ( s. /usr/lib/python2.7/site-packages/salt/crypt.pyR� � s
%( R� R� R� R� R RF RG t digest_sizeRr R� Rd R� Rn R= RE R� Rx R� ( ( ( s. /usr/lib/python2.7/site-packages/salt/crypt.pyR� Z s & (\ R� t
__future__R R R R$ R� R� R# R� Rs RF t loggingR RB Rv R� RC t tornado.genR� t salt.ext.six.movesR t salt.extR t M2CryptoR R R R{ R= R' Rx t Cryptodome.CipherR R t Cryptodome.HashR t Cryptodome.PublicKeyt Cryptodome.SignatureR
t Cryptodome.Randomt
Cryptodomet HAS_CDOMEt
Crypto.Ciphert Crypto.Hasht Crypto.PublicKeyt Crypto.Signaturet
Crypto.Randomt Cryptot salt.defaults.exitcodesR t salt.payloadt salt.transport.clientt salt.transport.framet salt.utils.cryptt salt.utils.decoratorst salt.utils.eventt salt.utils.filest salt.utils.rsax931t salt.utils.sdbt salt.utils.stringutilst salt.utils.usert salt.utils.verifyt salt.versiont salt.exceptionsR R R
R t getLoggerR� R R0 R/ RQ R t
decoratorst memoizeRY R\ Rc Ro Ru R� R� R� R R� R� R� Rg R� ( ( ( s. /usr/lib/python2.7/site-packages/salt/crypt.pyt <module> s�
" ? {� � ��
Mini Shell