Current File : //lib64/python2.7/site-packages/zmq/auth/base.pyc
�
+�{Wc @ s� d Z d d l Z d d l Z d d l m Z d d l m Z m Z m Z m Z d d l
m Z d d l m
Z
d Z d Z d
e f d � � YZ d
d g Z d S(
s* Base implementation of 0MQ authentication.i����N( t z85( t bytest unicodet bt u( t _check_versioni ( t load_certificatest *s 1.0t
Authenticatorc B s� e Z d Z d d d d � Z d � Z d � Z d � Z d � Z d d d � Z d d d � Z
d d d
� Z d � Z d � Z
d
� Z d � Z d d � Z RS( s� Implementation of ZAP authentication for zmq connections.
Note:
- libzmq provides four levels of security: default NULL (which the Authenticator does
not see), and authenticated NULL, PLAIN, CURVE, and GSSAPI, which the Authenticator can see.
- until you add policies, all incoming NULL connections are allowed.
(classic ZeroMQ behavior), and all PLAIN and CURVE connections are denied.
- GSSAPI requires no configuration.
s utf-8c C s� t d d � | p t j j � | _ | | _ t | _ d | _ t
� | _ t
� | _ i | _
i | _ | p| t j d � | _ d S( Ni i t securitys zmq.auth( i i ( R t zmqt Contextt instancet contextt encodingt Falset allow_anyt Nonet
zap_sockett sett whitelistt blacklistt passwordst certst loggingt getLoggert log( t selfR
R R ( ( s3 /usr/lib64/python2.7/site-packages/zmq/auth/base.pyt __init__ s
c C sH | j j t j � | _ d | j _ | j j d � | j j d � d S( s Create and bind the ZAP socketi s inproc://zeromq.zap.01t StartingN( R
t socketR
t REPR t lingert bindR t debug( R ( ( s3 /usr/lib64/python2.7/site-packages/zmq/auth/base.pyt start/ s c C s& | j r | j j � n d | _ d S( s Close the ZAP socketN( R t closeR ( R ( ( s3 /usr/lib64/python2.7/site-packages/zmq/auth/base.pyt stop6 s c G sH | j r t d � � n | j j d d j | � � | j j | � d S( sa Allow (whitelist) IP address(es).
Connections from addresses not in the whitelist will be rejected.
- For NULL, all clients from this address will be accepted.
- For real auth setups, they will be allowed to continue with authentication.
whitelist is mutually exclusive with blacklist.
s- Only use a whitelist or a blacklist, not boths Allowing %st ,N( R t
ValueErrorR R" t joinR t update( R t addresses( ( s3 /usr/lib64/python2.7/site-packages/zmq/auth/base.pyt allow< s
c G sH | j r t d � � n | j j d d j | � � | j j | � d S( s� Deny (blacklist) IP address(es).
Addresses not in the blacklist will be allowed to continue with authentication.
Blacklist is mutually exclusive with whitelist.
s- Only use a whitelist or a blacklist, not boths
Denying %sR& N( R R' R R" R( R R) ( R R* ( ( s3 /usr/lib64/python2.7/site-packages/zmq/auth/base.pyt denyK s R c C s- | r | | j | <n | j j d | � d S( s� Configure PLAIN authentication for a given domain.
PLAIN authentication uses a plain-text password file.
To cover all domains, use "*".
You can modify the password file at any time; it is reloaded automatically.
s Configure plain: %sN( R R R" ( R t domainR ( ( s3 /usr/lib64/python2.7/site-packages/zmq/auth/base.pyt configure_plainW s c C s~ | j j d | | � | t k r. t | _ nL t | _ y t | � | j | <Wn) t k
ry } | j j d | | � n Xd S( s� Configure CURVE authentication for a given domain.
CURVE authentication uses a directory that holds all public client certificates,
i.e. their public keys.
To cover all domains, use "*".
You can add and remove certificates in that directory at any time.
To allow all client keys without checking, specify CURVE_ALLOW_ANY for the location.
s Configure curve: %s[%s]s& Failed to load CURVE certs from %s: %sN(
R R" t CURVE_ALLOW_ANYt TrueR R R R t Exceptiont error( R R- t locationt e( ( s3 /usr/lib64/python2.7/site-packages/zmq/auth/base.pyt configure_curveb s c C s d S( s� Configure GSSAPI authentication
Currently this is a no-op because there is nothing to configure with GSSAPI.
N( ( R R- R3 ( ( s3 /usr/lib64/python2.7/site-packages/zmq/auth/base.pyt configure_gssapiz s c C s� t | � d k re | j j d | � t | � d k rJ | j j d � n | j | d d d � d S| d \ } } } } } } | d } t | | j d � } t | | j d � } | t k r� | j j d
| � | j | d d � d S| j j d | | | | | | � t } t }
d
} | j ru| | j k rSt
} | j j d | � q�t
}
d } | j j d | � nV | j r�| | j k r�t
}
d } | j j d | � q�t
} | j j d | � n t d � } |
s�| d k r | r | j j d � t
} q�| d k r�t | � d k rQ| j j d | � | j | d d � d Sg | D] }
t |
| j d � ^ qX\ } } | j | | | � \ } } q�| d k r
t | � d k r�| j j d | � | j | d d � d S| d } | j
| | � \ } } q�| d k r�t | � d k rR| j j d | � | j | d d � d St | d d � } | j | | � \ } } q�n | r�| j | d d | � n | j | d | � d S(! s Perform ZAP authenticationi s* Invalid ZAP message, not enough frames: %ri s Not enough information to replyi t 400s Not enough framesNt replaces Invalid ZAP version: %rs Invalid versionsQ version: %r, request_id: %r, domain: %r, address: %r, identity: %r, mechanism: %rs NO ACCESSs PASSED (whitelist) address=%ss Address not in whitelists$ DENIED (not in whitelist) address=%ss Address is blacklisteds DENIED (blacklist) address=%ss$ PASSED (not in blacklist) address=%st usert NULLs ALLOWED (NULL)t PLAINs Invalid PLAIN credentials: %rs Invalid credentialst CURVEs Invalid CURVE credentials: %ri t GSSAPIs Invalid GSSAPI credentials: %rt 200t OK( t lenR R2 t _send_zap_replyR R t VERSIONR" R R R0 R t _authenticate_plaint _authenticate_curvet _authenticate_gssapi( R t msgt versiont
request_idR- t addresst identityt mechanismt credentialst allowedt deniedt reasont usernamet ct passwordt keyt principal( ( s3 /usr/lib64/python2.7/site-packages/zmq/auth/base.pyt handle_zap_message� s~
.
c C s� t } d } | j r� | s$ d } n | | j k rx | | j | k ro | | j | | k rf t } qu d } q~ d } n d } | r� | j j d | | | � q� | j j d | � n d } | j j d | � | | f S(
s PLAIN ZAP authenticationt R s Invalid passwords Invalid usernames Invalid domains1 ALLOWED (PLAIN) domain=%s username=%s password=%ss DENIED %ss No passwords defineds DENIED (PLAIN) %s( R R R0 R R" ( R R- RP RR RM RO ( ( s3 /usr/lib64/python2.7/site-packages/zmq/auth/base.pyRC � s& c C s� t } d } | j r4 t } d } | j j d � n� | sC d } n | | j k r� t j | � } | j | j | � r� t } d } n d } | r� d n d } | j j d | | | � n d } | | f S(
s CURVE ZAP authenticationRV R? s ALLOWED (CURVE allow any client)R s Unknown keyt ALLOWEDt DENIEDs" %s (CURVE) domain=%s client_key=%ss Unknown domain( R R R0 R R" R R t encodet get( R R- t
client_keyRM RO t z85_client_keyt status( ( s3 /usr/lib64/python2.7/site-packages/zmq/auth/base.pyRD � s& c C s | j j d | | � t d f S( sP Nothing to do for GSSAPI, which has already been handled by an external service.s' ALLOWED (GSSAPI) domain=%s principal=%sR? ( R R" R0 ( R R- RT ( ( s3 /usr/lib64/python2.7/site-packages/zmq/auth/base.pyRE s R9 c C s� | d k r | n d } t | t � r? | j | j d � } n d } | j j d | | � t | | | | | g } | j j | � d S( s. Send a ZAP reply to finish the authentication.R> RV R8 s ZAP reply code=%s text=%sN( t
isinstanceR RY R R R" RB R t send_multipart( R RH t status_codet status_textt user_idt metadatat reply( ( s3 /usr/lib64/python2.7/site-packages/zmq/auth/base.pyRA ! s N( t __name__t
__module__t __doc__R R R# R% R+ R, R. R5 R6 RU RC RD RE RA ( ( ( s3 /usr/lib64/python2.7/site-packages/zmq/auth/base.pyR s
[ ! R/ ( Rg R R
t zmq.utilsR t zmq.utils.strtypesR R R R t zmq.errorR R R R/ RB t objectR t __all__( ( ( s3 /usr/lib64/python2.7/site-packages/zmq/auth/base.pyt <module> s "�
Mini Shell