Current File : //lib/python2.7/site-packages/salt/transport/mixins/auth.pyc
�
���^c @@ s� d d l m Z m Z m Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l
Z
d d l Z d d l
Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l m Z d d l m Z d d l Z y d d l m Z e Z WnO e k
rse Z y d d l! m" Z" Wqte k
rod d l# m" Z" qtXn Xe j$ e% � Z& d e' f d � � YZ( d e' f d
� � YZ) d S( i ( t absolute_importt print_functiont unicode_literalsN( t CacheCli( t six( t RSA( t
PKCS1_OAEPt AESPubClientMixinc B@ s& e Z d � Z e j j d � � Z RS( c C@ s� | j j d � r� | j d t � s9 t j j d � � n t j j | j d d � } t j j | | d | j d � � s� t j j d � � q� n d S( Nu sign_pub_messagesu sigu< Message signing is enabled but the payload has no signature.u pki_diru minion_master.pubu loadu% Message signature failed to validate.(
t optst gett Falset saltt cryptt AuthenticationErrort ost patht joint verify_signature( t selft payloadt master_pubkey_path( ( s> /usr/lib/python2.7/site-packages/salt/transport/mixins/auth.pyt _verify_master_signature, s %c c@ s� t j d | � | d d k r� | j | � y! | j j j | d � | d <Wq� t j j k
r� | j j � V| j j j | d � | d <q� Xn t
j j | � � d S( Nu Decoding payload: %su encu aesu load(
t logt traceR t autht crypticlet loadsR R R
t authenticatet tornadot gent Return( R R ( ( s> /usr/lib/python2.7/site-packages/salt/transport/mixins/auth.pyt _decode_payload6 s
!$( t __name__t
__module__R R R t coroutineR ( ( ( s> /usr/lib/python2.7/site-packages/salt/transport/mixins/auth.pyR + s
t AESReqServerMixinc B@ sD e Z d Z d � Z d � Z d � Z d � Z d � Z d � Z RS( u;
Mixin to house all of the master-side auth crypto
c C@ sp d t j j j k rl i t j t j t j j j
t j j j
� � � d 6t j j j
d 6t j j j d <n d S( uB
Pre-fork we need to create the zmq router device
u aesu secretu reloadN( R t mastert SMastert secretst multiprocessingt Arrayt ctypest c_chart utilst stringutilst to_bytesR t Crypticlet generate_key_string( R t _( ( s> /usr/lib/python2.7/site-packages/salt/transport/mixins/auth.pyt pre_forkK s %c C@ s� t j j | j � | _ t j j | j t j j j d d j
� | _ t j j
j | j | j d d t �| _
t j j j | j � | _ | j d r� t | j � | _ n$ t | _ t j j j | j � | _ t j j | j � | _ d S( Nu aesu secretu sock_dirt listenu con_cache( R R t SerialR t serialR R. R$ R% R& t valueR R+ t eventt get_master_eventR
t daemonst masterapit AutoKeyt auto_keyR t cache_clit minionst CkMinionst ckminionst
MasterKeyst
master_key( R R0 t __( ( s> /usr/lib/python2.7/site-packages/salt/transport/mixins/auth.pyt post_fork[ s /+
c
C@ sB t j j | j d d | � } t j j j � } t j j | j | � } y t j j | � } WnL t t
t f k
r� | j j
i � St k
r� t j d � i d d 6SXi } t j s� t j j j | � } n t r� | j | t j � | d <n" t j | � } | j | � | d <| j
| t k r1| n i � | | <| S( uW
The server equivalent of ReqChannel.crypted_transfer_decode_dictentry
u pki_diru minionsu AES key not foundu erroru key( R R R R R R R. R/ t get_rsa_pub_keyt
ValueErrort
IndexErrort TypeErrorR t dumpst IOErrorR t errorR t PY2R+ R, R- t HAS_M2t public_encryptR t pkcs1_oaep_paddingR t newt encryptR
(
R t rett dictkeyt targett pubfnt keyt pcryptt pubt prett cipher( ( s> /usr/lib/python2.7/site-packages/salt/transport/mixins/auth.pyt _encrypt_privaten s0
c C@ s] t j j j d d j | j j k rY t j j | j t j j j d d j � | _ t
St S( un
Check to see if a fresh AES key is available and update the components
of the worker
u aesu secret( R R$ R% R& R5 R t
key_stringR R. R t TrueR
( R ( ( s> /usr/lib/python2.7/site-packages/salt/transport/mixins/auth.pyt _update_aes� s &/c C@ s{ | d d k rw y | j j | d � | d <Wqw t j j k
rs | j � sV � n | j j | d � | d <qw Xn | S( Nu encu aesu load( R R R R R
R] ( R R ( ( s> /usr/lib/python2.7/site-packages/salt/transport/mixins/auth.pyR � s !c
C@ s� t j j j | j | d � sL t j d | d � i d d 6i t d 6d 6St j d | d � | j d d k r�| j r� | j j � } n1 | j
j � } t | � d
k r� t j d � n t | � | j d k s�| d | k r�d j
| j d | d � } t j | � i t d
6d d 6| d d 6| d d 6} | j j d � t k r|| j j | t j j j d d � � n i d d 6i d d 6d 6Sq�n | j j | d � } | j j | d | j d d � � } t j j | j d d | d � } t j j | j d d | d � } t j j | j d d | d � } t j j | j d d | d � }
| j d rrn�t j j | � rt j d | d � i t d
6| d d 6| d d 6} | j j d � t k r�| j j | t j j j d d � � n i d d 6i t d 6d 6St j j | � r5t j j j | d � �� } | j � j � | d j � k r,t j d | d � t j j j |
d � � } | j | d � Wd QXi t d
6| d d 6d d 6| d d 6} | j j d � t k r| j j | t j j j d d � � n i d d 6i t d 6d 6SWd QXn�t j j | � st j j! | � r�t j d! | d � i t d
6| d d 6| d d 6} | j j d � t k r�| j j | t j j j d d � � n i d d 6i t d 6d 6S| r| }
t j d" | d � d# } t } n5 | sG| }
t j d$ | d � d% } t } n d }
|
d k r3
t j j j |
d � � } | j | d � Wd QXi d d 6i | d 6d 6} i | d
6| d 6| d d 6| d d 6} | j j d � t k r| j j | t j j j d d � � n | Sn t j j | � r� | r�y t" j# | | � Wn t$ t% f k
r\n Xt j d& | d � i d d 6i t d 6d 6} i t d
6d# d 6| d d 6| d d 6} | j j d � t k r�| j j | t j j j d d � � n | S| s�t j j j | d � ��} | j � | d k r�t j d' | d � t j j j |
d � � } | j | d � Wd QXi t d
6| d d 6d d 6| d d 6} | j j d � t k r�| j j | t j j j d d � � n i d d 6i t d 6d 6St j d( | d | d � i t d
6d% d 6| d d 6| d d 6} | j j d � t k r| j j | t j j j d d � � n i d d 6i t d 6d 6SWd QXq3
t j j j | d � �� } | j � | d k r� t j d) | d � t j j j |
d � � } | j | d � Wd QXi t d
6| d d 6| d d 6} | j j d � t k r{ | j j | t j j j d d � � n i d d 6i t d 6d 6St j& | � Wd QXn� t j' d* � i t d
6| d d 6| d d 6} | j j d � t k r
| j j | t j j j d d � � n i d d 6i t d 6d 6St j d+ | d � t j j | � r�
| j d r�
t j j j | d � � } | j | d � Wd QXn� | j d r� d, } t j j | � r�
t j j j | d � � } | j � } Wd QXn | d rN | d | k rN t j( d- � t j j j | d � � } | j | d � Wd QXq� | d s� t j d. j
| d � � i d d 6i t d 6d 6Sn d } | j r� | j j) | d g � n y t j* j+ | � } WnE t, t- t. f k
r } t j d/ | | � i d d 6i t d 6d 6SXt/ s- t0 j1 | � } n i d d 6| j2 j3 � d0 6| j d1 d1 6} | j d2 r/
| j2 j4 � r� t j( d3 � t j( | j2 j4 � � | j5 i | j2 j4 � d4 6� q/
t j j6 j7 | j d5 | j � } t j( d6 � t j* j8 | j2 j9 � d7 | d0 | � } | j5 i t: j; | � d4 6� n t/ sM
t0 j1 | j2 j< � } n | j d8 d9 k r:d: | k r�
ye t/ r�
| j2 j< j= | d: t> j? � } n | j@ | d: � } d; j
t jA jB jC d< d= jD | � } WqtE k
r�
qXn t jA jB jC d< d= jD } t/ r$| jF | t> j? � | d< <q| jG | � | d< <n� d: | k r�yk t/ r�| j2 j< j= | d: t> j? � } | jF | t> j? � | d: <n& | j@ | d: � } | jG | � | d: <Wq�tE k
r�q�Xn t jA jB jC d< d= jD } t/ r| jF | t> j? � | d< <n | jG | � | d< <t j jH jI tJ jK | � jL � � } t j* jM | j2 j< | � | d> <i t d
6d? d 6| d d 6| d d 6} | j j d � t k r�| j j | t j j j d d � � n | S(@ u,
Authenticate the client, use the sent public key to encrypt the AES key
which was generated at start up.
This method fires an event over the master event manager. The event is
tagged "auth" and returns a dict with information about the auth
event
# Verify that the key we are receiving matches the stored key
# Store the key if it is not there
# Make an RSA key with the pub key
# Encrypt the AES key as an encrypted salt.payload
# Package the return and return it
u idu) Authentication request from invalid id %su clearu encu retu loadu Authentication request from %su max_minionsi i� u| With large numbers of minions it is advised to enable the ConCache with 'con_cache: True' in the masters configuration file.uN Too many minions connected (max_minions={0}). Rejecting connection from id {1}u resultu fullu actu pubu auth_eventst prefixu authu autosign_grainsu pki_diru minionsu minions_preu minions_rejectedu minions_deniedu open_modeu@ Public key rejected for %s. Key is present in rejection key dir.u ru| Authentication attempt from %s failed, the public keys did not match. This may be an attempt to compromise the Salt cluster.u w+Nu deniedu New public key %s is a directoryu2 New public key for %s rejected via autoreject_fileu rejectu' New public key for %s placed in pendingu pendu6 Pending public key for %s rejected via autoreject_fileu� Authentication attempt from %s failed, the public key in pending did not match. This may be an attempt to compromise the Salt cluster.uf Authentication failed from host %s, the key is in pending and needs to be accepted with salt-key -a %su� Authentication attempt from %s failed, the public keys in pending did not match. This may be an attempt to compromise the Salt cluster.u& Unaccounted for authentication failureu Authentication accepted from %su u& Host key change detected in open mode.u Public key is empty: {0}u Corrupt public key "%s": %su pub_keyu publish_portu master_sign_pubkeyu% Adding pubkey signature to auth-replyu pub_sigu signing_key_passu( Signing master public key before sendingi u auth_modei u tokenu {0}_|-{1}u aesu secretu sigu accept(N R R+ t verifyt valid_idR R t infoR
R< t
get_cachedR? t
connected_idst lent formatR R\ R6 t
fire_eventt tagifyR; t check_autorejectt check_autosignt NoneR R R t isfilet filest fopent readt stripRJ t writet isdirt shutilt moveRI t OSErrort removet warningt debugt put_cacheR RD RE RF RG RL R RO RA t get_pub_strt pubkey_signaturet updatet sdbt sdb_gett sign_messaget get_sign_pathst binasciit
b2a_base64RU t private_decryptR RN t decryptR$ R% R& R5 t ExceptionRM RP R, R- t hashlibt sha256t hexdigestt private_encrypt( R t loadR= t msgt eloadt auto_rejectt auto_signRT t
pubfn_pendt pubfn_rejectedt pubfn_deniedt pubfn_handlet fp_t key_patht key_actt
key_resultRQ t disk_keyRW t errRY t key_passt pub_signt mciphert mtokent aest digest( ( s> /usr/lib/python2.7/site-packages/salt/transport/mixins/auth.pyt _auth� s�
(
%
(
"
(
(
(
(
(
(
(
(
!
"
*
$
(( R R! t __doc__R1 RC RZ R] R R� ( ( ( s> /usr/lib/python2.7/site-packages/salt/transport/mixins/auth.pyR# F s !
(* t
__future__R R R R' R) t loggingR R� Rr R� t
salt.cryptR t salt.payloadt salt.mastert salt.transport.framet salt.utils.eventt salt.utils.filest salt.utils.minionst salt.utils.stringutilst salt.utils.verifyt salt.utils.cacheR t salt.extR t tornado.genR t M2CryptoR R\ RL t ImportErrorR
t Cryptodome.CipherR t
Crypto.Ciphert getLoggerR R t objectR R# ( ( ( s> /usr/lib/python2.7/site-packages/salt/transport/mixins/auth.pyt <module> s>
Mini Shell