Current File : //lib/python2.7/site-packages/salt/wheel/key.pyo
�
���^c @@ s� d Z d d l m Z m Z m Z d d l Z d d l Z d d l Z d d l m Z d d l
Z d d l Z d d l
Z d d l Z d d l m Z i d d 6d d 6Z e j e � Z d
� Z d � Z d � Z e e d
� Z e e d � Z d � Z d � Z e e d � Z e e d � Z d � Z d d � Z! d d � Z" d d d � Z# d e d � Z$ d d d d d � Z% e d d � Z& d S( u?
Wheel system wrapper for the Salt key system to be used in interactions with
the Salt Master programmatically.
The key module for the wheel system is meant to provide an internal interface
for other Salt systems to interact with the Salt Master. The following usage
examples assume that a WheelClient is available:
.. code-block:: python
import salt.config
import salt.wheel
opts = salt.config.master_config('/etc/salt/master')
wheel = salt.wheel.WheelClient(opts)
Note that importing and using the ``WheelClient`` must be performed on the same
machine as the Salt Master and as the same user that runs the Salt Master,
unless :conf_master:`external_auth` is configured and the user is authorized
to execute wheel functions.
The function documentation starts with the ``wheel`` reference from the code
sample above and use the :py:class:`WheelClient` functions to show how they can
be called from a Python interpreter.
The wheel key functions can also be called via a ``salt`` command at the CLI
using the :mod:`saltutil execution module <salt.modules.saltutil>`.
i ( t absolute_importt print_functiont unicode_literalsN( t get_key( t cleanu listu list_u printu key_strc C@ s t t � } | j | � S( u�
List all the keys under a named status. Returns a dictionary.
match
The type of keys to list. The ``pre``, ``un``, and ``unaccepted``
options will list unaccepted/unsigned keys. ``acc`` or ``accepted`` will
list accepted/signed keys. ``rej`` or ``rejected`` will list rejected keys.
Finally, ``all`` will list all keys.
.. code-block:: python
>>> wheel.cmd('key.list', ['accepted'])
{'minions': ['minion1', 'minion2', 'minion3']}
( R t __opts__t list_status( t matcht skey( ( s2 /usr/lib/python2.7/site-packages/salt/wheel/key.pyt list_5 s c C@ s t t � } | j � S( u�
List all the keys. Returns a dictionary containing lists of the minions in
each salt-key category, including ``minions``, ``minions_rejected``,
``minions_denied``, etc. Returns a dictionary.
.. code-block:: python
>>> wheel.cmd('key.list_all')
{'local': ['master.pem', 'master.pub'], 'minions_rejected': [],
'minions_denied': [], 'minions_pre': [],
'minions': ['minion1', 'minion2', 'minion3']}
( R R t all_keys( R ( ( s2 /usr/lib/python2.7/site-packages/salt/wheel/key.pyt list_allH s
c C@ s t t � } | j | � S( u1
List all the keys based on a glob match
( R R t
name_match( R R ( ( s2 /usr/lib/python2.7/site-packages/salt/wheel/key.pyR Y s c C@ s% t t � } | j | d | d | �S( u
Accept keys based on a glob match. Returns a dictionary.
match
The glob match of keys to accept.
include_rejected
To include rejected keys in the match along with pending keys, set this
to ``True``. Defaults to ``False``.
include_denied
To include denied keys in the match along with pending keys, set this
to ``True``. Defaults to ``False``.
.. code-block:: python
>>> wheel.cmd('key.accept', ['minion1'])
{'minions': ['minion1']}
t include_rejectedt include_denied( R R t accept( R R
R R ( ( s2 /usr/lib/python2.7/site-packages/salt/wheel/key.pyR a s c C@ s( t t � } | j d | d | d | � S( u`
Accept keys based on a dict of keys. Returns a dictionary.
match
The dictionary of keys to accept.
include_rejected
To include rejected keys in the match along with pending keys, set this
to ``True``. Defaults to ``False``.
.. versionadded:: 2016.3.4
include_denied
To include denied keys in the match along with pending keys, set this
to ``True``. Defaults to ``False``.
.. versionadded:: 2016.3.4
Example to move a list of keys from the ``minions_pre`` (pending) directory
to the ``minions`` (accepted) directory:
.. code-block:: python
>>> wheel.cmd('key.accept_dict',
{
'minions_pre': [
'jerry',
'stuart',
'bob',
],
})
{'minions': ['jerry', 'stuart', 'bob']}
t
match_dictR
R ( R R R ( R R
R R ( ( s2 /usr/lib/python2.7/site-packages/salt/wheel/key.pyt accept_dicty s " c C@ s t t � } | j | � S( u-
Delete keys based on a glob match. Returns a dictionary.
match
The glob match of keys to delete.
.. code-block:: python
>>> wheel.cmd_async({'fun': 'key.delete', 'match': 'minion1'})
{'jid': '20160826201244808521', 'tag': 'salt/wheel/20160826201244808521'}
( R R t
delete_key( R R ( ( s2 /usr/lib/python2.7/site-packages/salt/wheel/key.pyt delete� s c C@ s t t � } | j d | � S( u�
Delete keys based on a dict of keys. Returns a dictionary.
match
The dictionary of keys to delete.
.. code-block:: python
>>> wheel.cmd_async({'fun': 'key.delete_dict',
'match': {
'minions': [
'jerry',
'stuart',
'bob',
],
})
{'jid': '20160826201244808521', 'tag': 'salt/wheel/20160826201244808521'}
R ( R R R ( R R ( ( s2 /usr/lib/python2.7/site-packages/salt/wheel/key.pyt delete_dict� s c C@ s% t t � } | j | d | d | �S( uM
Reject keys based on a glob match. Returns a dictionary.
match
The glob match of keys to reject.
include_accepted
To include accepted keys in the match along with pending keys, set this
to ``True``. Defaults to ``False``.
include_denied
To include denied keys in the match along with pending keys, set this
to ``True``. Defaults to ``False``.
.. code-block:: python
>>> wheel.cmd_async({'fun': 'key.reject', 'match': 'minion1'})
{'jid': '20160826201244808521', 'tag': 'salt/wheel/20160826201244808521'}
t include_acceptedR ( R R t reject( R R R R ( ( s2 /usr/lib/python2.7/site-packages/salt/wheel/key.pyR � s c C@ s( t t � } | j d | d | d | � S( u
Reject keys based on a dict of keys. Returns a dictionary.
match
The dictionary of keys to reject.
include_accepted
To include accepted keys in the match along with pending keys, set this
to ``True``. Defaults to ``False``.
.. versionadded:: 2016.3.4
include_denied
To include denied keys in the match along with pending keys, set this
to ``True``. Defaults to ``False``.
.. versionadded:: 2016.3.4
.. code-block:: python
>>> wheel.cmd_async({'fun': 'key.reject_dict',
'match': {
'minions': [
'jerry',
'stuart',
'bob',
],
})
{'jid': '20160826201244808521', 'tag': 'salt/wheel/20160826201244808521'}
R R R ( R R R ( R R R R ( ( s2 /usr/lib/python2.7/site-packages/salt/wheel/key.pyt reject_dict� s c C@ s t t � } | j | � S( u_
Return information about the key. Returns a dictionary.
match
The key to return information about.
.. code-block:: python
>>> wheel.cmd('key.key_str', ['minion1'])
{'minions': {'minion1': '-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0B
...
TWugEQpPt\niQIDAQAB\n-----END PUBLIC KEY-----'}}
( R R t key_str( R R ( ( s2 /usr/lib/python2.7/site-packages/salt/wheel/key.pyR s c C@ s5 | d k r t d } n t t � } | j | | � S( uu
Return the matching key fingerprints. Returns a dictionary.
match
The key for with to retrieve the fingerprint.
hash_type
The hash algorithm used to calculate the fingerprint
.. code-block:: python
>>> wheel.cmd('key.finger', ['minion1'])
{'minions': {'minion1': '5d:f6:79:43:5e:d4:42:3f:57:b8:45:a8:7e:a4:6e:ca'}}
u hash_typeN( t NoneR R t finger( R t hash_typeR ( ( s2 /usr/lib/python2.7/site-packages/salt/wheel/key.pyR s
c C@ s_ d } | d k r t d } n t j j j t j j t d | � d | �} i i | | 6d 6S( u$
Return the fingerprint of the master's public key
hash_type
The hash algorithm used to calculate the fingerprint
.. code-block:: python
>>> wheel.cmd('key.finger_master')
{'local': {'master.pub': '5d:f6:79:43:5e:d4:42:3f:57:b8:45:a8:7e:a4:6e:ca'}}
u
master.pubu hash_typeu pki_dirt sum_typeu localN( R R t saltt utilst cryptt
pem_fingert ost patht join( R t keynamet fingerprint( ( s2 /usr/lib/python2.7/site-packages/salt/wheel/key.pyt
finger_master. s
"i c C@ sE | d k r- t j t j d � � j � } n t j | � } i d d 6d d 6} t j j
t d | | � } d j | | j
d � � } t j j j | � �& } t j j j | j � � | d <Wd QXt j j j | � �& } t j j j | j � � | d <Wd QXt j j j � r't j | d � n t j | � t j | � | S(
u
Generate a key pair. No keys are stored on the master. A key pair is
returned as a dict containing pub and priv keys. Returns a dictionary
containing the the ``pub`` and ``priv`` keys with their generated values.
id\_
Set a name to generate a key pair for use with salt. If not specified,
a random name will be specified.
keysize
The size of the key pair to generate. The size must be ``2048``, which
is the default, or greater. If set to a value less than ``2048``, the
key size will be rounded up to ``2048``.
.. code-block:: python
>>> wheel.cmd('key.gen')
{'pub': '-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBC
...
BBPfamX9gGPQTpN9e8HwcZjXQnmg8OrcUl10WHw09SDWLOlnW+ueTWugEQpPt\niQIDAQAB\n
-----END PUBLIC KEY-----',
'priv': '-----BEGIN RSA PRIVATE KEY-----\nMIIEpAIBAAKCAQEA42Kf+w9XeZWgguzv
...
QH3/W74X1+WTBlx4R2KGLYBiH+bCCFEQ/Zvcu4Xp4bIOPtRKozEQ==\n
-----END RSA PRIVATE KEY-----'}
i u u privu pubu pki_diru {0}.pubu .Ni� ( R t hashlibt sha512R! t urandomt hexdigestR t filenameR R t gen_keysR t formatt rindexR t filest fopent stringutilst
to_unicodet readt platformt
is_windowst chmodt remove( t id_t keysizet rett privt pubt fp_( ( s2 /usr/lib/python2.7/site-packages/salt/wheel/key.pyt genC s !
%%
c C@ s� t j | � } t | | � } t j j t d d | � } t j j | � rW | rW i St j j
j | d � �' } | j t j j
j | d � � Wd QX| S( u�
Generate a key pair then accept the public key. This function returns the
key pair in a dict, only the public key is preserved on the master. Returns
a dictionary.
id\_
The name of the minion for which to generate a key pair.
keysize
The size of the key pair to generate. The size must be ``2048``, which
is the default, or greater. If set to a value less than ``2048``, the
key size will be rounded up to ``2048``.
force
If a public key has already been accepted for the given minion on the
master, then the gen_accept function will return an empty dictionary
and not create a new key. This is the default behavior. If ``force``
is set to ``True``, then the minion's previously accepted key will be
overwritten.
.. code-block:: python
>>> wheel.cmd('key.gen_accept', ['foo'])
{'pub': '-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBC
...
BBPfamX9gGPQTpN9e8HwcZjXQnmg8OrcUl10WHw09SDWLOlnW+ueTWugEQpPt\niQIDAQAB\n
-----END PUBLIC KEY-----',
'priv': '-----BEGIN RSA PRIVATE KEY-----\nMIIEpAIBAAKCAQEA42Kf+w9XeZWgguzv
...
QH3/W74X1+WTBlx4R2KGLYBiH+bCCFEQ/Zvcu4Xp4bIOPtRKozEQ==\n
-----END RSA PRIVATE KEY-----'}
We can now see that the ``foo`` minion's key has been accepted by the master:
.. code-block:: python
>>> wheel.cmd('key.list', ['accepted'])
{'minions': ['foo', 'minion1', 'minion2', 'minion3']}
u pki_diru minionsu w+u pubN( R t idR> R! R" R# R t isfileR R R/ R0 t writeR1 t to_str( R8 R9 t forceR: t acc_pathR= ( ( s2 /usr/lib/python2.7/site-packages/salt/wheel/key.pyt
gen_acceptv s ( &c C@ s" t t � } | j | | | | � S( u,
Generate minion RSA public keypair
( R R R, ( t keydirR$ R9 t userR ( ( s2 /usr/lib/python2.7/site-packages/salt/wheel/key.pyR, � s c C@ s% t t � } | j | | | | | � S( u.
Generate master public-key-signature
( R R t gen_keys_signature( R; R< t signature_patht auto_createR9 R ( ( s2 /usr/lib/python2.7/site-packages/salt/wheel/key.pyt
gen_signature� s (' t __doc__t
__future__R R R R! R' t loggingt salt.keyR t
salt.cryptR t salt.utils.cryptt salt.utils.filest salt.utils.platformt salt.utils.sanitizersR t __func_alias__t getLoggert __name__t logR R R t FalseR R R R R R R R R R& R> RE R, RK ( ( ( s2 /usr/lib/python2.7/site-packages/salt/wheel/key.pyt <module> s<
( % 32
Mini Shell