Current File : //lib/python2.7/site-packages/salt/key.pyc
�
���^c @@ s d Z d d l m Z m Z m Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l
Z
d d l Z d d l Z
d d l Z
d d l Z
d d l Z
d d l Z
d d l Z
d d l Z
d d l Z
d d l Z
d d l Z
d d l Z
d d l Z
d d l Z
d d l Z
d d l Z
d d l Z
d d l Z
d d l m Z d d l m! Z! m" Z" y d d l# Z# Wn e$ k
r�n Xe j% e& � Z' d � Z( d e) f d � � YZ* d e* f d
� � YZ+ d e) f d � � YZ, d
e, f d � � YZ- d S( u�
The Salt Key backend API and interface used by the CLI. The Key class can be
used to manage salt keys directly without interfacing with the CLI.
i ( t absolute_importt print_functiont unicode_literalsN( t six( t inputt zip_longestc C@ s( | d d k r t | � St | � Sd S( Nu transportu zeromqu tcp( u zeromqu tcp( t Keyt RaetKey( t opts( ( s, /usr/lib/python2.7/site-packages/salt/key.pyt get_key2 s
t KeyCLIc B@ s~ e Z d Z i d d 6d d 6d d 6d d 6Z d � Z d
� Z d � Z d d � Z d d
� Z d � Z
d � Z d � Z RS( u#
Manage key CLI operations
u list_statusu listu
delete_keyu deleteu gen_keys_signatureu
gen_signatureu key_stru printc C@ sw | | _ t j j | � | _ | j d d k r= t | _ n t | _ | j d � sj | j | � | _ n d | _
d S( Nu transportu zeromqu tcpu eauth( u zeromqu tcp( R t saltt wheelt WheelClientt clientR t keyR t gett Nonet auth( t selfR ( ( s, /usr/lib/python2.7/site-packages/salt/key.pyt __init__C s c C@ sW x d D] } | j | r Pq q W| j d � s| d k rM d | j d <n3 | j d � rl d | j d <n | j | | j d <| j d � r� | j d p� | j d | j d <t | j d <q:| j d � r:| j d p� | j d | j d <t | j d <q:n7 | d k r:| j d | j d <| j d | j d <n | j d d � | j d <d S( Nu gen_keysu
gen_signatureu listu list_allu printu print_allu acceptu
accept_allu rejectu
reject_allu deleteu
delete_allu fingeru
finger_allu gen_u allu matchu _allu *u include_allu include_rejectedu include_acceptedu gen_keys_diru keydiru keynameu u fun( u gen_keysu
gen_signatureu listu list_allu printu print_allu acceptu
accept_allu rejectu
reject_allu deleteu
delete_allu fingeru
finger_allu list_all( R t
startswitht endswitht Falset replace( R t cmd( ( s, /usr/lib/python2.7/site-packages/salt/key.pyt _update_optsO sB
!! c C@ s� | j r
d Si } | j d d k } | j d r�d | j k r� yZ t j j j t j j | j d d � d � �& } t j j j
| j � � | d <Wd QXWq� t k
r� | j d | d <q� Xn d | k r�d | k r�| j d r�t j j
| j � } | j | j d � } | j d rb| rb| j | j d | � } | rb| j d d � | d <qbn | syt j d � i S| j | � | j d | d <q�n< t j j j � | d
<t j j j | d
| j | � | d <| | _ d S( Nu eauthu u tokenu cachediru .root_keyu ru keyu mktokenu Authentication failedu user( R R R t utilst filest fopent ost patht joint stringutilst
to_unicodet readlinet IOErrort Resolvert clit token_cliR t logt errort updatet usert get_specific_usert mastert get_master_key( R t lowt skip_perm_errorst fp_t resolvert rest tok( ( s, /usr/lib/python2.7/site-packages/salt/key.pyt
_init_authv s8
1)
%
&c C@ s� t j j j | � } | d k r� g } | j r� xT t t | j � t | j pQ d � � D]( \ } } | j | j j
| | � � qX Wn | d d d � } n | j d k r� i } n t j j
| | � \ } } | | f S( Ni����( ( R R t argst get_function_argspecR R t reversedt defaultst appendR R t keywordst miniont load_args_and_kwargs( R t funR6 t argspect argt defaultt kwargs( ( s, /usr/lib/python2.7/site-packages/salt/key.pyt _get_args_kwargs� s "# c C@ sh | j j d � s� | j j | | � } t | j | � } | j | | � \ } } | | | � } t | t � r� d | k r� | d k r� | j d d � n | Sd j
| � } | j j | } | j | | � \ } } i | d 6| d 6| d 6} | j
� | j | j � | j j | � } | d d
} t | t � rdd | k rd| d k rd| j d d � n | S(
Nu eauthu localu fingeru
finger_allu key.{0}u funu argu kwargu datau return( u fingeru
finger_all( u fingeru
finger_all( R R t CLI_KEY_MAPt getattrR RC t
isinstancet dictt popR t formatR t functionsR5 R* R t cmd_sync( R R R6 R> RB t rett fstrR/ ( ( s, /usr/lib/python2.7/site-packages/salt/key.pyt _run_cmd� s0
c C@ s | j d � r | Si } | j j | k rH | | j j | | j j <n | j d r� t | j | j j � � r� | | j j | | j j <n | j d r� t | j | j j � � r� | | j j | | j j <n | j d rt | j | j j � � r| | j j | | j j <n | S( Nu deleteu include_acceptedu include_rejectedu include_denied( R R t PENDR t boolR t ACCt REJt DEN( R R RL t keys( ( s, /usr/lib/python2.7/site-packages/salt/key.pyt _filter_ret� s ( ( ( c C@ s� d g } | j d r& | j d � n | j d rC | j d � n | j d r` | j d � n t | � d k r | d } n# d
j d j | d � | d � } d
j | | � } t | � d S( Nu
unacceptedu include_acceptedu acceptedu include_rejectedu rejectedu include_deniedu deniedi i u
{0} or {1}u , i����u/ The key glob '{0}' does not match any {1} keys.( R R: t lenRI R t print( R R t matcht statusest stat_strt msg( ( s, /usr/lib/python2.7/site-packages/salt/key.pyt _print_no_match� s
#c C@ s� | j � | j d } d } d } yU| d k r�| j d � } t | t � sp t j j | d d | j �| S| j | | � } | s� | j
| | j d � d St d
j | j
d � � � t j j | d d | j �| j j d t � s_yL | j d � r t d
� } | s;d } q;n t d � } | s;d } n Wq_t k
r[t d � � q_Xn | | j d <| j j d d � | } n | d k s�| j � j d � rw| j | � } | d k r#| d k r�| } n x� | j � D]6 } x- | D]% } t d j | | j
d � � � q�Wq�Wqwt | t � rQt j j | d d | j �qwt j j i | d 6d d | j �n WnY t j j k
r�} d j | � } | j j d t � s�t j j | d | j � q�n X| S( u+
Run the logic for saltkey
u funu acceptu rejectu deleteu
name_matchu keyR u matchNu) The following keys are going to be {0}ed:u eu yesu Proceed? [N/y] u nu Proceed? [n/Y] u yu
Exiting on CTRL-cu
match_dictu Key for minion {0} {1}ed.u returnu {0}u quietu nested( u acceptu rejectu delete( u acceptu rejectu delete( R R R RN RF RG R t outputt display_outputRU R\ RW RI t rstripR R R R t KeyboardInterruptt
SystemExitRH t lowert valuest
exceptionst
SaltException( R R t veriRL t list_rett minionsR< t exc( ( s, /usr/lib/python2.7/site-packages/salt/key.pyt run� s^
!
* N(
t __name__t
__module__t __doc__RD R R R5 R RC RN RU R\ Rj ( ( ( s, /usr/lib/python2.7/site-packages/salt/key.pyR
9 s
' ( " t MultiKeyCLIc B@ s� e Z d Z d � Z d � Z d � Z d � Z e e d � Z e e d � Z d � Z
d � Z e e d � Z e e d
� Z
d � Z d � Z d
� Z d � Z d � Z RS( u3
Manage multiple key backends from the CLI
c C@ s� t | d <t t | � j | � t | d � t j | � } t j | � } i | _ d | d <t | � | j d <d | d <t | � | j d <d S( Nu __multi_keyu keyu zeromqu transportu ZMQ Keysu raetu RAET Keys( t Truet superRn R t delattrt copyRT R
( R R t zoptst ropts( ( s, /usr/lib/python2.7/site-packages/salt/key.pyR 2 s
c G@ s< x5 | j D]* } t | � t | j | | � | � q
Wd S( u=
Call the given function on all backend keys
N( RT RW RE ( R R> R6 t kback( ( s, /usr/lib/python2.7/site-packages/salt/key.pyt _call_all? s
c C@ s | j d | � d S( Nu list_status( Rv ( R t status( ( s, /usr/lib/python2.7/site-packages/salt/key.pyt list_statusG s c C@ s | j d � d S( Nu list_all( Rv ( R ( ( s, /usr/lib/python2.7/site-packages/salt/key.pyt list_allJ s c C@ s | j d | | | � d S( Nu accept( Rv ( R RX t include_rejectedt include_denied( ( s, /usr/lib/python2.7/site-packages/salt/key.pyt acceptM s c C@ s | j d | | � d S( Nu
accept_all( Rv ( R Rz R{ ( ( s, /usr/lib/python2.7/site-packages/salt/key.pyt
accept_allP s c C@ s | j d | � d S( Nu delete( Rv ( R RX ( ( s, /usr/lib/python2.7/site-packages/salt/key.pyt deleteS s c C@ s | j d � d S( Nu
delete_all( Rv ( R ( ( s, /usr/lib/python2.7/site-packages/salt/key.pyt
delete_allV s c C@ s | j d | | | � d S( Nu reject( Rv ( R RX t include_acceptedR{ ( ( s, /usr/lib/python2.7/site-packages/salt/key.pyt rejectY s c C@ s | j d | | � d S( Nu
reject_all( Rv ( R R� R{ ( ( s, /usr/lib/python2.7/site-packages/salt/key.pyt
reject_all\ s c C@ s | j d | � d S( Nu print_key( Rv ( R RX ( ( s, /usr/lib/python2.7/site-packages/salt/key.pyt print_key_ s c C@ s | j d � d S( Nu print_all( Rv ( R ( ( s, /usr/lib/python2.7/site-packages/salt/key.pyt print_allb s c C@ s | j d | | � d S( Nu finger( Rv ( R RX t hash_type( ( s, /usr/lib/python2.7/site-packages/salt/key.pyt fingere s c C@ s | j d | � d S( Nu
finger_all( Rv ( R R� ( ( s, /usr/lib/python2.7/site-packages/salt/key.pyt
finger_allh s c C@ s | j d � d S( Nu prep_signature( Rv ( R ( ( s, /usr/lib/python2.7/site-packages/salt/key.pyt prep_signaturek s ( Rk Rl Rm R Rv Rx Ry R R| R} R~ R R� R� R� R� R� R� R� ( ( ( s, /usr/lib/python2.7/site-packages/salt/key.pyRn . s
R c B@ sL e Z d Z d Z d Z d Z d Z d d � Z d � Z d � Z
d d d d d � Z d � Z e
d d
� Z d d � Z d � Z e
d
� Z d � Z d � Z d � Z d � Z d � Z d � Z d � Z d d e
e
d � Z d � Z d d d e
d � Z d � Z d � Z d d e
e
d � Z d � Z d d � Z d d � Z! RS( u6
The object that encapsulates saltkey actions
u minionsu minions_preu minions_rejectedu minions_deniedc
C@ s� | | _ | j j d d � } | t j j j k r^ d j | � } t j | � t | � � n t j j
j | | d | d d | d t d | �| _
t j j
j | j j d � | j � | _ d S(
Nu __roleu u! Invalid application kind = '{0}'.u sock_diru transportR t listent io_loopu signing_key_pass( R R R R t kindst
APPL_KINDSRI R( R) t
ValueErrort eventt get_eventR t sdbt sdb_gett
passphrase( R R R� t kindt emsg( ( s, /usr/lib/python2.7/site-packages/salt/key.pyR x s
c C@ s� t j j | j d | j � } t j j | j d | j � } t j j | j d | j � } t j j | j d | j � } | | | | f S( u8
Return the minion keys directory paths
u pki_dir( R R R R RQ RO RR RS ( R t minions_acceptedt minions_pret minions_rejectedt minions_denied( ( s, /usr/lib/python2.7/site-packages/salt/key.pyt _check_minions_directories� s c C@ s� | s5 d | j k r% | j d } q5 | j d } n | sc d | j k rZ | j d } qc d } n | sy | j d } n | | | | f S( Nu gen_keys_diru pki_diru gen_keysu minionu keysize( R ( R t keydirt keynamet keysizeR+ ( ( s, /usr/lib/python2.7/site-packages/salt/key.pyt _get_key_attrs� s c C@ si | j | | | | � \ } } } } t j j | | | | | j � t j j j t j j | | d � � S( u4
Generate minion RSA public keypair
u .pub(
R� R t cryptt gen_keysR� R t
pem_fingerR R R ( R R� R� R� R+ ( ( s, /usr/lib/python2.7/site-packages/salt/key.pyR� � s c C@ s t j j | | | | j � S( u6
Generate master public-key-signature
( R R� t
gen_signatureR� ( R t privkeyt pubkeyt sig_path( ( s, /usr/lib/python2.7/site-packages/salt/key.pyR� � s c
C@ s� | r( t j j | � sX d j | � Sn0 | j d d d } t j j | � rX | } n | r� t j j | � s� d j | � Sn0 | j d d d } t j j | � r� | } n | sM| rFt j d | j d | j d � t j j | j d | j d | p
| j d | j j
d
� | j � | j d d | j d d } qMd Sn | sWd
St j d | � t j d | � | r�t j j | � s�t j d | � q�n
| j d } | d | j d } t
| j � } | j | | | � S( u6
Generate master public-key-signature
u Public-key {0} does not existu pki_diru /u
master.pubu Private-key {0} does not existu master_sign.pemu+ Generating new signing key-pair .%s.* in %su master_sign_key_nameu keysizeu useru .pemu No usable private-key foundu No usable public-key foundu Using public-key %su Using private-key %su" target directory %s does not existu master_pubkey_signature( R R t isfileRI R R( t debugR R� R� R R� t isdirR R� (
R t privt pubt signature_patht auto_createR� t mpubt mprivt sign_patht skey( ( s, /usr/lib/python2.7/site-packages/salt/key.pyt gen_keys_signature� sF
#
c C@ s� | d k r g } n | j � } g } x* t j | � D] \ } } | j | � q7 W| j j d t � s�t j j
| j d | j � } t j j | � r$x� t j
| � D]s } | | k r� | | k r� y t j t j j
| | � � Wq t t f k
r} t j d | | � q� q Xq� q� Wn t j j | j � } | j | j � }
|
r�xH |
D]= } | | k rX| | k rX| j d j | j | � � qXqXWq�n d S( u�
Check the minion cache to make sure that old minion data is cleared
Optionally, pass in a list of minions which should have their caches
preserved. To preserve all caches, set __opts__['preserve_minion_cache']
u preserve_minion_cacheu cachediru2 Key: Delete cache for %s got OSError/IOError: %s
u {0}/{1}N( R t list_keysR t iteritemst extendR R R R R R RQ R� t listdirt shutilt rmtreet OSErrorR$ R( t warningR t cachet factoryt listt flushRI ( R t preserve_minionsRT Rh R t valt m_cacheR< t exR� t clist( ( s, /usr/lib/python2.7/site-packages/salt/key.pyt check_minion_cache� s0
c C@ s0 t j j t j j | j d d � � s, t St S( u~
Log if the master is not running
:rtype: bool
:return: Whether or not the master is running
u sock_diru publish_pull.ipc( R R t existsR R R Ro ( R ( ( s, /usr/lib/python2.7/site-packages/salt/key.pyt check_master s
c C@ s< | r | j � } n | j � } i } d | k rW t | t j � rW | j d � } n x� t j | � D]� \ } } x� t j j j
| � D]� } t | t � r� x� | D]E } t j | | � r� | | k r� g | | <n | | j
| � q� q� Wq� t j | | � r� | | k r g | | <n | | j
| � q� q� Wqg W| S( uY
Accept a glob which to match the of a key and return the key's location
u ,( t all_keysR� RF R t string_typest splitR� R R t datat sorted_ignorecaseR� t fnmatchR: ( R RX t fullt matchesRL Rw RT R t
match_item( ( s, /usr/lib/python2.7/site-packages/salt/key.pyt
name_match" s&
c C@ s� i } | j � } x� t j | � D]� \ } } x� t j j j | � D]o } xf | j | j | j | j
f D]F } | ri t j | j
| g � | � ri | j | g � j | � qi qi WqD Wq" W| S( uh
Accept a dictionary of keys and return the current state of the
specified keys
( R� R R� R R R� R� RQ RO RR RS R� t filterR t
setdefaultR: ( R t
match_dictRL t cur_keysRw RT R R� ( ( s, /usr/lib/python2.7/site-packages/salt/key.pyt
dict_match< s %$(c C@ s� i g d 6} x� t j j j t j | j d � � D]i } | j d � sW | j d � r3 t j j | j d | � } t j j
| � r� | d j | � q� q3 q3 W| S( u-
Return a dict of local keys
u localu pki_diru .pubu .pem( R R R� R� R R� R R R R R� R: ( R RL t fn_R ( ( s, /usr/lib/python2.7/site-packages/salt/key.pyt
local_keysJ s
, c C@ s g } | j � } i } x� | D]� } | d k r7 q n g | t j j | � <y� x� t j j j t j | � � D]h } | j
d � so t j j t j j | | � � r� | t j j | � j
t j j j | � � q� qo qo WWq t t f k
r� q q Xq W| S( uK
Return a dict of managed keys and what the key status are
u .N( R� R R R t basenameR R R� R� R� R R� R R: R! R" R� R$ ( R t key_dirsRL t dir_R� ( ( s, /usr/lib/python2.7/site-packages/salt/key.pyR� V s
%!$ c C@ s# | j � } | j | j � � | S( u4
Merge managed keys with local keys
( R� R* R� ( R RT ( ( s, /usr/lib/python2.7/site-packages/salt/key.pyR� t s c C@ s� | j � \ } } } } i } | j d � r� g | t j j | � <x�t j j j t j | � � D]Y } | j d � sb t j j
t j j | | � � r� | t j j | � j | � q� qb qb Wn | j d � s� | j d � rug | t j j | � <x�t j j j t j | � � D]Y } | j d � st j j
t j j | | � � rn| t j j | � j | � qnqqWnm| j d � rg | t j j | � <xEt j j j t j | � � D]Y } | j d � s�t j j
t j j | | � � r| t j j | � j | � qq�q�Wn� | j d � r�| d k r�g | t j j | � <x� t j j j t j | � � D]Y } | j d � sit j j
t j j | | � � r�| t j j | � j | � q�qiqiWn | j d � r�| j � S| S( uD
Return a dict of managed keys under a named status
u accu .u preu unu reju denu allN( R� R R R R� R R R� R� R� R� R R: R R� ( R RX t acct pret rejt denRL R� ( ( s, /usr/lib/python2.7/site-packages/salt/key.pyRx | s: %!* %!*%!*%!*
c C@ s� i } x� t j | j | � � D]� \ } } i | | <x� t j j j | � D]i } t j j | j
d | | � } t j j j | d � �* } t j j
j | j � � | | | <Wd QXqK Wq W| S( uI
Return the specified public key or keys based on a glob
u pki_diru rN( R R� R� R R R� R� R R R R R R R! R" t read( R RX RL Rw RT R R R1 ( ( s, /usr/lib/python2.7/site-packages/salt/key.pyt key_str� s %
1c C@ s� i } x� t j | j � � D]� \ } } i | | <x� t j j j | � D]i } t j j | j
d | | � } t j j j | d � �* } t j j
j | j � � | | | <Wd QXqH Wq W| S( u0
Return all managed key strings
u pki_diru rN( R R� R� R R R� R� R R R R R R R! R" R� ( R RL Rw RT R R R1 ( ( s, /usr/lib/python2.7/site-packages/salt/key.pyt key_str_all� s "
1c
C@ s} | d k r | j | � } n* | d k rB t | t � rB | } n i } | j g } | rm | j | j � n | r� | j | j � n x� | D]� } x� | j | g � D]� } y� t j
t j j
| j d | | � t j j
| j d | j | � � i t d 6d d 6| d 6} | j j | t j j j d d � � Wq� t t f k
rNq� Xq� Wq� W| d k rp| j | � S| j | � S( u�
Accept public keys. If "match" is passed, it is evaluated as a glob.
Pre-gathered matches can also be passed via "match_dict".
u pki_diru resultu acceptu actu idt prefixu keyN( R R� RF RG RO R: RR RS R R� t moveR R R R RQ Ro R� t
fire_eventR R t tagifyR$ R� R� (
R RX R� Rz R{ R� t keydirsR� R t eload( ( s, /usr/lib/python2.7/site-packages/salt/key.pyR| � s>
c C@ s� | j � } x� | | j D]� } y� t j t j j | j d | j | � t j j | j d | j | � � i t d 6d d 6| d 6} | j
j | t j
j
j d d � � Wq t t f k
r� q Xq W| j � S( u(
Accept all keys in pre
u pki_diru resultu acceptu actu idR� u key( R� RO R� R� R R R R RQ Ro R� R� R R R� R$ R� ( R RT R R� ( ( s, /usr/lib/python2.7/site-packages/salt/key.pyR} � s(
c C@ s! | d k r | j | � } n* | d k rB t | t � rB | } n i } x9t j | � D](\ } } x| D]} y� | r� | j j d � t k r� t d � q� y, t
j j d | j � } | j
| d � Wq� t
j j k
r� t d j | � � q� Xn t j t j j | j d | | � � i t d 6d d 6| d
6}
| j j |
t
j j j d d � � Wqk t t f k
r{qk Xqk WqX W| j j d
� t k r�| j d | j d g � � n
| j � | j j d � r�t
j j | j d | j d � n | d k r| j | � S| j | � S( u�
Delete public keys. If "match" is passed, it is evaluated as a glob.
Pre-gathered matches can also be passed via "match_dict".
To preserve the master caches of minions who are matched, set preserve_minions
u rotate_aes_keyu� Immediate auth revocation specified but AES key rotation not allowed. Minion will not be disconnected until the master AES key is rotated.t moptsu saltutil.revoke_authu� Cannot contact Salt master. Connection for {0} will remain up until master AES key is rotated or auth is revoked with 'saltutil.revoke_auth'.u pki_diru resultu deleteu actu idR� u keyu preserve_minionsR� u minionsu cachediru userN( R R� RF RG R R� R R R RW R R t get_local_clientt cmd_asyncRd t SaltClientErrorRI R t removeR R Ro R� R� R R� R� R$ R� R� t dropfileR� ( R RX R� R� t revoke_authR� Rw RT R R R� ( ( s, /usr/lib/python2.7/site-packages/salt/key.pyt
delete_key� s@
&
$c C@ s� | j � } x� t j | j � � D]� \ } } x� | | j D]� } yj t j t j j | j d | | � � i t d 6d d 6| d 6} | j
j | t j
j
j d d � � Wq< t t f k
r� q< Xq< Wq" W| j � | j � S( u(
Delete all denied keys
u pki_diru resultu deleteu actu idR� u key( R� R R� RS R R� R R R Ro R� R� R R R� R� R$ R� ( R RT Rw R R� ( ( s, /usr/lib/python2.7/site-packages/salt/key.pyt
delete_den1 s "&
c C@ s x� t j | j � � D]� \ } } x� | D]� } yj t j t j j | j d | | � � i t d 6d d 6| d 6} | j j
| t j j j
d d � � Wq) t t f k
r� q) Xq) Wq W| j � | j j d � r� t j j | j d | j d
� n | j � S( u!
Delete all keys
u pki_diru resultu deleteu actu idR� u keyu rotate_aes_keyu cachediru user( R R� R� R R� R R R Ro R� R� R R R� R� R$ R� R R� R� ( R Rw RT R R� ( ( s, /usr/lib/python2.7/site-packages/salt/key.pyR D s "
&
$c
C@ s� | d k r | j | � } n* | d k rB t | t � rB | } n i } | j g } | rm | j | j � n | r� | j | j � n x� | D]� } x� | j | g � D]� } y� t j
t j j
| j d | | � t j j
| j d | j | � � i t d 6d d 6| d 6} | j j | t j j j d d � � Wq� t t f k
rNq� Xq� Wq� W| j � | j j d � r�t j j | j d | j d
� n | d k r�| j | � S| j | � S( u�
Reject public keys. If "match" is passed, it is evaluated as a glob.
Pre-gathered matches can also be passed via "match_dict".
u pki_diru resultu rejectu actu idR� u keyu rotate_aes_keyu cachediru userN( R R� RF RG RO R: RQ RS R R� R� R R R R RR Ro R� R� R R R� R$ R� R� R� R� R� (
R RX R� R� R{ R� R� R� R R� ( ( s, /usr/lib/python2.7/site-packages/salt/key.pyR� X sD
$c C@ s | j � } x� | | j D]� } y� t j t j j | j d | j | � t j j | j d | j | � � i t d 6d d 6| d 6} | j
j | t j
j
j d d � � Wq t t f k
r� q Xq W| j � | j j d � r
t j j | j d | j d
� n | j � S( u(
Reject all keys in pre
u pki_diru resultu rejectu actu idR� u keyu rotate_aes_keyu cachediru user( R� RO R� R� R R R R RR Ro R� R� R R R� R$ R� R� R R� R� ( R RT R R� ( ( s, /usr/lib/python2.7/site-packages/salt/key.pyR� � s.
$c C@ s� | d k r t d } n | j | t � } i } x� t j | � D]� \ } } i | | <x{ | D]s } | d k r� t j j | j d | � } n t j j | j d | | � } t
j j j
| d | �| | | <q^ WqA W| S( u<
Return the fingerprint for a specified key
u hash_typeu localu pki_dirt sum_typeN( R t __opts__R� Ro R R� R R R R R R R� R� ( R RX R� R� RL Rw RT R R ( ( s, /usr/lib/python2.7/site-packages/salt/key.pyR� � s
+c C@ s� | d k r t d } n i } x� t j | j � � D]� \ } } i | | <x{ | D]s } | d k r� t j j | j d | � } n t j j | j d | | � } t j
j j | d | �| | | <qR Wq5 W| S( u2
Return fingerprints for all keys
u hash_typeu localu pki_dirR� N(
R R� R R� R� R R R R R R R� R� ( R R� RL Rw RT R R ( ( s, /usr/lib/python2.7/site-packages/salt/key.pyR� � s
"
+N(" Rk Rl Rm RQ RO RR RS R R R� R� R� R� R R� R� R� R� R� R� R� R� Rx R� R� R| R} R� R� R R� R� R� R� ( ( ( s, /usr/lib/python2.7/site-packages/salt/key.pyR o sB
9 " ) 0 , R c B@ sC e Z d Z d Z d Z d Z d Z d � Z d � Z e
d � Z d d d d d � Z d � Z
d � Z d
� Z d � Z d � Z d
� Z d � Z d d e
e
d � Z d � Z d d d e
d � Z d � Z d d e
e
d � Z d � Z d d � Z d d � Z d � Z e d � Z d � Z d � Z d � Z d � Z! RS( u+
Manage keys from the raet backend
u acceptedu pendingu rejectedc C@ sG t j | | � t j j j | j � | _ t j j | j � | _
d S( N( R R R t daemonst masterapit AutoKeyR t auto_keyt payloadt Serialt serial( R R ( ( s, /usr/lib/python2.7/site-packages/salt/key.pyR � s c C@ sm t j j | j d | j � } t j j | j d | j � } t j j | j d | j � } | | | d f S( u8
Return the minion keys directory paths
u pki_dirN( R R R R RQ RO RR R ( R t acceptedR� t rejected( ( s, /usr/lib/python2.7/site-packages/salt/key.pyR� � s c C@ s� | j � } g } x* t j | � D] \ } } | j | � q" Wt j j | j d d � } | j j d t � s�t j j
| � r�x� t j | � D]s } | | k r� | | k r� y t j
t j j | | � � Wqt t f k
r} t j d | | � q� qXq� q� Wt j j | j � } | j | j � }
|
r�xH |
D]= } | | k r=| | k r=| j d j | j | � � q=q=Wq�q�n | j j d d � } | t j j j k r�d j | � } t j | d � t | � � n | j j d
d � }
|
s!d } t j | d � t | � � n d j |
| � } t j j | j d d
| d � } t j j
| � r�x"t j | � D]} t j j | � \ } } | d k r�qwn | j d � \ } } } | sw| d k r�qwn t j j | | � } t j j j! | d � �~ } | d k r,t j j" j# | � } n | d k rJt$ j# | � } n t j j% j& | d � }
|
| k rt j' | � n Wd QXqwWn d S( uU
Check the minion cache to make sure that old minion data is cleared
u cachediru minionsu preserve_minion_cacheu6 RaetKey: Delete cache for %s got OSError/IOError: %s
u {0}/{1}u __roleu u! Invalid application kind = '{0}'.u
u idu Invalid id.u {0}_{1}u raetu remoteu .jsonu .msgpacku .u estateu rbu roleN( u .jsonu .msgpack(( R� R R� R� R R R R R R R� R� R� R� R� R$ R( R� R R� R� R� RQ R� RI R R� R� R) R� t splitextt partitionR R t jsont loadt msgpackR! R" R� ( R R� RT Rh R R� R� R< R� R� R� R� R� t rolet namet
road_cachet roadt roott extR� t sepR R1 R� ( ( s, /usr/lib/python2.7/site-packages/salt/key.pyR� � sl
, c C@ sq d d l } | j j � } | j | | | | � \ } } } } d j t j j | | � � } | j | d � d S( uG
Use libnacl to generate and safely save a private key
i Nu {0}.keyu msgpack( t libnacl.dualt dualt
DualSecretR� RI R R R t save( R R� R� R� R+ t libnaclt d_keyt _R ( ( s, /usr/lib/python2.7/site-packages/salt/key.pyR� s c C@ s t S( uN
Log if the master is not running
NOT YET IMPLEMENTED
( Ro ( R ( ( s, /usr/lib/python2.7/site-packages/salt/key.pyR� ) s c C@ sS i g d 6} t j j | j d d � } t j j | � rO | d j | � n | S( u-
Return a dict of local keys
u localu pki_diru local.key( R R R R R� R: ( R RL R� ( ( s, /usr/lib/python2.7/site-packages/salt/key.pyR� 0 s
c
C@ s[ | j � \ } } } } t j j | | � } t j j | | � } t j j | | � }
t j j j | � } t j j j | � } i | d 6| d 6| d 6} | j d r� t j j j
| d � �' } | j | j j
| � � | j SWd QXn t j j |
� rt j d � | j St j j | � r�t j j j
| d � � } | j j | j � � } Wd QX| d | k r�| d | k r�| j St j d � | j Sn� t j j | � r�| j j | � }
| j j | � } t j j j
| d � � } | j j | j � � } Wd QX| d | k rs| d | k rs|
rR| j | � t j d
� | j S| rl| j | � | j S| j St j d � | j Sn | j j | � }
| j j | � } | j d r�| } | j } nL | r�| } | j } n4 |
r
|
} t j d
� | j } n | } | j } t j j j
| d � �$ } | j | j j
| � � | SWd QXd S( u
Accepts the minion id, device id, curve public and verify keys.
If the key is not present, put it in pending and return "pending",
If the key has been accepted return "accepted"
if the key should be rejected, return "rejected"
u minion_idu pubu verifyu open_modeu w+bNu) Rejection Reason: Keys already rejected.
u rbu1 Rejection Reason: Keys not match prior accepted.
u& Rejection Reason: Auto reject pended.
u/ Rejection Reason: Keys not match prior pended.
u auto_acceptu# Rejection Reason: Auto reject new.
( R� R R R R R R! t to_strR R R t writeR� t dumpsRQ R� R( R� RR t loadsR� R� t check_autorejectt check_autosignR� R| RO ( R t minion_idR� t verifyR� R� R� R t acc_patht pre_patht rej_patht keydataR1 t auto_rejectt auto_signt w_pathRL ( ( s, /usr/lib/python2.7/site-packages/salt/key.pyRw : sr
c C@ st t j j | j d | | � } t j j j | d � �7 } | j j | j
� � } d j | d | d � SWd QXd S( ud
Return the key string in the form of:
pub: <pub>
verify: <verify>
u pki_diru rbu pub: {0}
verify: {1}u pubu verifyN( R R R R R R R R R� R R� RI ( R R Rw R R1 R ( ( s, /usr/lib/python2.7/site-packages/salt/key.pyt _get_key_str� s c C@ sf t j j j | d � �9 } | j j | j � � } d j | d | d � } Wd QXt j | � j
� S( u9
Return a sha256 kingerprint for the key
u rbu pub: {0}
verify: {1}u pubu verifyN( R R R R R� R R� RI t hashlibt sha256t hexdigest( R R R1 R R ( ( s, /usr/lib/python2.7/site-packages/salt/key.pyt _get_key_finger� s c C@ sw i } xj t j | j | � � D]P \ } } i | | <x7 t j j j | � D] } | j | | � | | | <qK Wq W| S( uI
Return the specified public key or keys based on a glob
( R R� R� R R R� R� R ( R RX RL Rw RT R ( ( s, /usr/lib/python2.7/site-packages/salt/key.pyR� � s %
"c C@ st i } xg t j | j � � D]P \ } } i | | <x7 t j j j | � D] } | j | | � | | | <qH Wq W| S( u0
Return all managed key strings
( R R� R� R R R� R� R ( R RL Rw RT R ( ( s, /usr/lib/python2.7/site-packages/salt/key.pyR� � s "
"c C@ s= | d k r | j | � } n* | d k rB t | t � rB | } n i } | j g } | rm | j | j � n | r� | j | j � n x� | D]� } x} | j | g � D]i } yI t j
t j j
| j d | | � t j j
| j d | j | � � Wq� t t f k
rq� Xq� Wq� W| d k r0| j | � S| j | � S( u�
Accept public keys. If "match" is passed, it is evaluated as a glob.
Pre-gathered matches can also be passed via "match_dict".
u pki_dirN( R R� RF RG RO R: RR RS R R� R� R R R R RQ R$ R� R� ( R RX R� Rz R{ R� R� R� R ( ( s, /usr/lib/python2.7/site-packages/salt/key.pyR| � s4
c C@ s� | j � } x{ | | j D]l } yL t j t j j | j d | j | � t j j | j d | j | � � Wq t t
f k
r� q Xq W| j � S( u(
Accept all keys in pre
u pki_dir( R� RO R� R� R R R R RQ R$ R� ( R RT R ( ( s, /usr/lib/python2.7/site-packages/salt/key.pyR} � s
c
C@ s� | d
k r | j | � } n* | d
k rB t | t � rB | } n i } x� t j | � D]� \ } } x� | D]� } | r� | j j d � t k r� t d � q� y, t
j j d | j � } | j
| d � Wq� t
j j k
r� t d j | � � q� Xn y* t j t j j | j d | | � � Wqk t t f k
r;qk Xqk WqX W| j j d � t k r{| j d | j d g � � n
| j � | d
k r�| j | � S| j | � S( u�
Delete public keys. If "match" is passed, it is evaluated as a glob.
Pre-gathered matches can also be passed via "match_dict".
u rotate_aes_keyu� Immediate auth revocation specified but AES key rotation not allowed. Minion will not be disconnected until the master AES key is rotated.R� u saltutil.revoke_authu� Cannot contact Salt master. Connection for {0} will remain up until master AES key is rotated or auth is revoked with 'saltutil.revoke_auth'.u pki_diru preserve_minionsR� u minionsN( R R� RF RG R R� R R R RW R R R� R� Rd R� RI R R� R R R� R$ Ro R� R� (
R RX R� R� R� R� Rw RT R R ( ( s, /usr/lib/python2.7/site-packages/salt/key.pyR� � s2
*
c C@ s� xx t j | j � � D]a \ } } xR | D]J } y* t j t j j | j d | | � � Wq) t t f k
rr q) Xq) Wq W| j
� | j � S( u!
Delete all keys
u pki_dir( R R� R� R R� R R R R� R$ R� ( R Rw RT R ( ( s, /usr/lib/python2.7/site-packages/salt/key.pyR s "
*
c C@ sG | d k r | j | � } n* | d k rB t | t � rB | } n i } | j g } | rm | j | j � n | r� | j | j � n x� | D]� } x} | j | g � D]i } yI t j
t j j
| j d | | � t j j
| j d | j | � � Wq� t t f k
rq� Xq� Wq� W| j � | d k r:| j | � S| j | � S( u�
Reject public keys. If "match" is passed, it is evaluated as a glob.
Pre-gathered matches can also be passed via "match_dict".
u pki_dirN( R R� RF RG RO R: RQ RS R R� R� R R R R RR R$ R� R� R� ( R RX R� R� R{ R� R� R� R ( ( s, /usr/lib/python2.7/site-packages/salt/key.pyR� " s6
c C@ s� | j � } x{ | | j D]l } yL t j t j j | j d | j | � t j j | j d | j | � � Wq t t
f k
r� q Xq W| j � | j � S( u(
Reject all keys in pre
u pki_dir( R� RO R� R� R R R R RR R$ R� R� ( R RT R ( ( s, /usr/lib/python2.7/site-packages/salt/key.pyR� G s
c C@ s� | d k r t d } n | j | t � } i } x� t j | � D]� \ } } i | | <xo | D]g } | d k r� t j j | j d | � } n t j j | j d | | � } | j
| � | | | <q^ WqA W| S( u<
Return the fingerprint for a specified key
u hash_typeu localu pki_dirN( R R� R� Ro R R� R R R R R ( R RX R� R� RL Rw RT R R ( ( s, /usr/lib/python2.7/site-packages/salt/key.pyR� ] s
c C@ s� | d k r t d } n i } x� t j | j � � D]� \ } } i | | <xo | D]g } | d k r� t j j | j d | � } n t j j | j d | | � } | j | � | | | <qR Wq5 W| S( u2
Return fingerprints for all keys
u hash_typeu localu pki_dirN(
R R� R R� R� R R R R R ( R R� RL Rw RT R R ( ( s, /usr/lib/python2.7/site-packages/salt/key.pyR� p s
"
c C@ sp i } xc t j | j � � D]L \ } } x= | D]5 } | j | | � } | r/ | | d <| | | <q/ q/ Wq W| S( u6
Return a dict of all remote key data
u
acceptance( R R� R� t read_remote( R R� Rw t midst midR ( ( s, /usr/lib/python2.7/site-packages/salt/key.pyt read_all_remote� s "
c C@ sp t j j | j d | | � } t j j | � s5 i St j j j | d � � } | j j
| j � � SWd QXd S( u0
Read in a remote key of status
u pki_diru rbN( R R R R R� R R R R R� R R� ( R R Rw R R1 ( ( s, /usr/lib/python2.7/site-packages/salt/key.pyR! � s
c C@ sm t j j | j d d � } t j j | � s2 i St j j j | d � � } | j j
| j � � SWd QXd S( uf
Read in the local private keys, return an empy dict if the keys do not
exist
u pki_diru local.keyu rbN( R R R R R� R R R R R� R R� ( R R R1 ( ( s, /usr/lib/python2.7/site-packages/salt/key.pyt
read_local� s
c C@ s� i | d 6| d 6} t j j | j d d � } t j j j d � �� t j j | � ru t j | t
j t
j B� n t j j j
| d � �3 } | j | j j | � � t j | t
j � Wd QXWd QXd S( uM
Write the private key and the signing key to a file on disk
u privu signu pki_diru local.keyi� u w+N( R R R R R R R t set_umaskR� t chmodt statt S_IWUSRt S_IRUSRR R R� R ( R R� t signR R R1 ( ( s, /usr/lib/python2.7/site-packages/salt/key.pyt write_local� s
c C@ sB t j j | j d d � } t j j | � r> t j | � n d S( u3
Delete the local private key file
u pki_diru local.keyN( R R R R R� R� ( R R ( ( s, /usr/lib/python2.7/site-packages/salt/key.pyt delete_local� s c C@ s3 | j d } t j j | � r/ t j | � n d S( u2
Delete the private key directory
u pki_dirN( R R R R� R� R� ( R R ( ( s, /usr/lib/python2.7/site-packages/salt/key.pyt delete_pki_dir� s
N(" Rk Rl Rm RQ RO RR R RS R R� R R� R� R� R� Rw R R R� R� R| R} R� R R� R� R� R� R$ R! R% R, R- R. ( ( ( s, /usr/lib/python2.7/site-packages/salt/key.pyR � sB >
H $ '
%
(. Rm t
__future__R R R R Rr R( R� R� R t loggingt
salt.cacheR t salt.clientt
salt.cryptt salt.daemons.masterapit salt.exceptionst salt.miniont salt.utils.argst salt.utils.cryptt salt.utils.datat salt.utils.eventt salt.utils.filest salt.utils.jsont salt.utils.kindst salt.utils.mastert salt.utils.sdbt salt.utils.stringutilst salt.utils.usert salt.extR t salt.ext.six.movesR R R� t ImportErrort getLoggerRk R( R t objectR
Rn R R ( ( ( s, /usr/lib/python2.7/site-packages/salt/key.pyt <module> sN
�A� � Z
Mini Shell