Current File : //usr/lib/python2.7/site-packages/salt/netapi/rest_cherrypy/app.pyo
�
���^c @@ s� d Z d d l m Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l
m Z m Z e j
e � Z d d l Z y d d l m Z WnG e k
r� d Z e j d � n$ e k
r� d Z e j d � n Xd d l Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l m Z d d l! m" Z" d d l# Z y* d
d l$ m% Z% d
d l& m' Z' e( Z) Wn3 e k
r�e* d
e+ f i d d 6� Z% e, Z) n Xd � Z- d � Z. d � Z/ d � Z0 d � Z1 d � Z2 d e j3 j4 j5 f d e j6 e j3 j7 j8 d e, �f f Z9 d � Z: d � Z; d � Z< d � Z= e< d � � Z> e< d � � Z? e< d � � Z@ d � ZA d � ZB i d! e- f d" e. f g d# 6d$ e2 f d% e1 f d& eA f g d' 6d( eB f d) e; f d* e0 f g d+ 6ZC xl eC jD � D]^ \ ZE ZF xO eG eF � D]A \ ZH ZI eI \ ZJ ZK eL e j$ eJ e jM eE eK d, d- eH �� q@Wq'Wd. e+ f d/ � � YZN d0 eN f d1 � � YZO d2 eN f d3 � � YZP d4 eN f d5 � � YZQ d6 eN f d7 � � YZR d8 eN f d9 � � YZS d: eN f d; � � YZT d< eN f d= � � YZU d> e+ f d? � � YZV d@ e+ f dA � � YZW dB e+ f dC � � YZX dD e+ f dE � � YZY dF e+ f dG � � YZZ dH e+ f dI � � YZ[ dJ � Z\ d S(K s�Q
A REST API for Salt
===================
.. py:currentmodule:: salt.netapi.rest_cherrypy.app
:depends:
- CherryPy Python module.
Note: there is a `known SSL traceback for CherryPy versions 3.2.5 through
3.7.x <https://github.com/cherrypy/cherrypy/issues/1298>`_. Please use
version 3.2.3 or the latest 10.x version instead.
:optdepends: - ws4py Python module for websockets support.
:client_libraries:
- Java: https://github.com/SUSE/salt-netapi-client
- Python: https://github.com/saltstack/pepper
:setup:
All steps below are performed on the machine running the Salt Master
daemon. Configuration goes into the Master configuration file.
1. Install ``salt-api``. (This step varies between OS and Linux distros.
Some package systems have a split package, others include salt-api in
the main Salt package. Ensure the ``salt-api --version`` output matches
the ``salt --version`` output.)
2. Install CherryPy. (Read the version caveat in the section above.)
3. Optional: generate self-signed SSL certificates.
Using a secure HTTPS connection is strongly recommended since Salt
eauth authentication credentials will be sent over the wire.
1. Install the PyOpenSSL package.
2. Generate a self-signed certificate using the
:py:func:`~salt.modules.tls.create_self_signed_cert` execution
function.
.. code-block:: bash
salt-call --local tls.create_self_signed_cert
4. Edit the master config to create at least one external auth user or
group following the :ref:`full external auth instructions <acl-eauth>`.
5. Edit the master config with the following production-ready example to
enable the ``rest_cherrypy`` module. (Adjust cert paths as needed, or
disable SSL (not recommended!).)
.. code-block:: yaml
rest_cherrypy:
port: 8000
ssl_crt: /etc/pki/tls/certs/localhost.crt
ssl_key: /etc/pki/tls/certs/localhost.key
6. Restart the ``salt-master`` daemon.
7. Start the ``salt-api`` daemon.
:configuration:
All available configuration options are detailed below. These settings
configure the CherryPy HTTP server and do not apply when using an external
server such as Apache or Nginx.
port
**Required**
The port for the webserver to listen on.
host : ``0.0.0.0``
The socket interface for the HTTP server to listen on.
debug : ``False``
Starts the web server in development mode. It will reload itself when
the underlying code is changed and will output more debugging info.
log_access_file
Path to a file to write HTTP access logs.
.. versionadded:: 2016.11.0
log_error_file
Path to a file to write HTTP error logs.
.. versionadded:: 2016.11.0
ssl_crt
The path to a SSL certificate. (See below)
ssl_key
The path to the private key for your SSL certificate. (See below)
ssl_chain
(Optional when using PyOpenSSL) the certificate chain to pass to
``Context.load_verify_locations``.
disable_ssl
A flag to disable SSL. Warning: your Salt authentication credentials
will be sent in the clear!
webhook_disable_auth : False
The :py:class:`Webhook` URL requires authentication by default but
external services cannot always be configured to send authentication.
See the Webhook documentation for suggestions on securing this
interface.
webhook_url : /hook
Configure the URL endpoint for the :py:class:`Webhook` entry point.
thread_pool : ``100``
The number of worker threads to start up in the pool.
socket_queue_size : ``30``
Specify the maximum number of HTTP connections to queue.
expire_responses : True
Whether to check for and kill HTTP responses that have exceeded the
default timeout.
.. deprecated:: 2016.11.9,2017.7.3,2018.3.0
The "expire_responses" configuration setting, which corresponds
to the ``timeout_monitor`` setting in CherryPy, is no longer
supported in CherryPy versions >= 12.0.0.
max_request_body_size : ``1048576``
Maximum size for the HTTP request body.
collect_stats : False
Collect and report statistics about the CherryPy server
Reports are available via the :py:class:`Stats` URL.
stats_disable_auth : False
Do not require authentication to access the ``/stats`` endpoint.
.. versionadded:: 2018.3.0
static
A filesystem path to static HTML/JavaScript/CSS/image assets.
static_path : ``/static``
The URL prefix to use when serving static assets out of the directory
specified in the ``static`` setting.
enable_sessions : ``True``
Enable or disable all endpoints that rely on session cookies. This can
be useful to enforce only header-based authentication.
.. versionadded:: 2017.7.0
app : ``index.html``
A filesystem path to an HTML file that will be served as a static file.
This is useful for bootstrapping a single-page JavaScript app.
Warning! If you set this option to a custom web application, anything
that uses cookie-based authentication is vulnerable to XSRF attacks.
Send the custom ``X-Auth-Token`` header instead and consider disabling
the ``enable_sessions`` setting.
.. versionchanged:: 2017.7.0
Add a proof-of-concept JavaScript single-page app.
app_path : ``/app``
The URL prefix to use for serving the HTML file specified in the ``app``
setting. This should be a simple name containing no slashes.
Any path information after the specified path is ignored; this is
useful for apps that utilize the HTML5 history API.
root_prefix : ``/``
A URL path to the main entry point for the application. This is useful
for serving multiple applications from the same URL.
.. _rest_cherrypy-auth:
Authentication
--------------
Authentication is performed by passing a session token with each request.
Tokens are generated via the :py:class:`Login` URL.
The token may be sent in one of two ways: as a custom header or as a session
cookie. The latter is far more convenient for clients that support cookies.
* Include a custom header named :mailheader:`X-Auth-Token`.
For example, using curl:
.. code-block:: bash
curl -sSk https://localhost:8000/login \
-H 'Accept: application/x-yaml' \
-d username=saltdev \
-d password=saltdev \
-d eauth=pam
Copy the ``token`` value from the output and include it in subsequent requests:
.. code-block:: bash
curl -sSk https://localhost:8000 \
-H 'Accept: application/x-yaml' \
-H 'X-Auth-Token: 697adbdc8fe971d09ae4c2a3add7248859c87079'\
-d client=local \
-d tgt='*' \
-d fun=test.ping
* Sent via a cookie. This option is a convenience for HTTP clients that
automatically handle cookie support (such as browsers).
For example, using curl:
.. code-block:: bash
# Write the cookie file:
curl -sSk https://localhost:8000/login \
-c ~/cookies.txt \
-H 'Accept: application/x-yaml' \
-d username=saltdev \
-d password=saltdev \
-d eauth=auto
# Read the cookie file:
curl -sSk https://localhost:8000 \
-b ~/cookies.txt \
-H 'Accept: application/x-yaml' \
-d client=local \
-d tgt='*' \
-d fun=test.ping
Another example using the :program:`requests` library in Python:
.. code-block:: python
>>> import requests
>>> session = requests.Session()
>>> session.post('http://localhost:8000/login', json={
'username': 'saltdev',
'password': 'saltdev',
'eauth': 'auto',
})
<Response [200]>
>>> resp = session.post('http://localhost:8000', json=[{
'client': 'local',
'tgt': '*',
'fun': 'test.arg',
'arg': ['foo', 'bar'],
'kwarg': {'baz': 'Baz!'},
}])
>>> resp.json()
{u'return': [{
...snip...
}]}
.. seealso:: You can bypass the session handling via the :py:class:`Run` URL.
Usage
-----
This interface directly exposes Salt's :ref:`Python API <python-api>`.
Everything possible at the CLI is possible through the Python API. Commands are
executed on the Salt Master.
The root URL (``/``) is RPC-like in that it accepts instructions in the request
body for what Salt functions to execute, and the response contains the result
of those function calls.
For example:
.. code-block:: text
% curl -sSi https://localhost:8000 -H 'Content-type: application/json' -d '[{
"client": "local",
"tgt": "*",
"fun": "test.ping"
}]'
HTTP/1.1 200 OK
Content-Type: application/json
[...snip...]
{"return": [{"jerry": true}]}
The request body must be an array of commands. Use this workflow to build a
command:
1. Choose a client interface.
2. Choose a function.
3. Fill out the remaining parameters needed for the chosen client.
The ``client`` field is a reference to the main Python classes used in Salt's
Python API. Read the full :ref:`Client APIs <client-apis>` documentation, but
in short:
* "local" uses :py:class:`LocalClient <salt.client.LocalClient>` which sends
commands to Minions. Equivalent to the ``salt`` CLI command.
* "runner" uses :py:class:`RunnerClient <salt.runner.RunnerClient>` which
invokes runner modules on the Master. Equivalent to the ``salt-run`` CLI
command.
* "wheel" uses :py:class:`WheelClient <salt.wheel.WheelClient>` which invokes
wheel modules on the Master. Wheel modules do not have a direct CLI
equivalent but they typically manage Master-side resources such as state
files, pillar files, the Salt config files, and the :py:mod:`key wheel module
<salt.wheel.key>` exposes similar functionality as the ``salt-key`` CLI
command.
Most clients have variants like synchronous or asynchronous execution as well as
others like batch execution. See the :ref:`full list of client interfaces
<client-interfaces>`.
Each client requires different arguments and sometimes has different syntax.
For example, ``LocalClient`` requires the ``tgt`` argument because it forwards
the command to Minions and the other client interfaces do not. ``LocalClient``
also takes ``arg`` (array) and ``kwarg`` (dictionary) arguments because these
values are sent to the Minions and used to execute the requested function
there. ``RunnerClient`` and ``WheelClient`` are executed directly on the Master
and thus do not need or accept those arguments.
Read the method signatures in the client documentation linked above, but
hopefully an example will help illustrate the concept. This example causes Salt
to execute two functions -- the :py:func:`test.arg execution function
<salt.modules.test.arg>` using ``LocalClient`` and the :py:func:`test.arg
runner function <salt.runners.test.arg>` using ``RunnerClient``; note the
different structure for each command. The results for both are combined and
returned as one response.
.. code-block:: text
% curl -b ~/cookies.txt -sSi localhost:8000 -H 'Content-type: application/json' -d '
[
{
"client": "local",
"tgt": "*",
"fun": "test.arg",
"arg": ["positional arg one", "positional arg two"],
"kwarg": {
"keyword arg one": "Hello from a minion",
"keyword arg two": "Hello again from a minion"
}
},
{
"client": "runner",
"fun": "test.arg",
"keyword arg one": "Hello from a master",
"keyword arg two": "Runners do not support positional args"
}
]
'
HTTP/1.1 200 OK
[...snip...]
{
"return": [
{
"jerry": {
"args": [
"positional arg one",
"positional arg two"
],
"kwargs": {
"keyword arg one": "Hello from a minion",
"keyword arg two": "Hello again from a minion",
[...snip...]
}
},
[...snip; other minion returns here...]
},
{
"args": [],
"kwargs": {
"keyword arg two": "Runners do not support positional args",
"keyword arg one": "Hello from a master"
}
}
]
}
One more example, this time with more commonly used functions:
.. code-block:: text
curl -b /tmp/cookies.txt -sSi localhost:8000 -H 'Content-type: application/json' -d '
[
{
"client": "local",
"tgt": "*",
"fun": "state.sls",
"kwarg": {
"mods": "apache",
"pillar": {
"lookup": {
"wwwdir": "/srv/httpd/htdocs"
}
}
}
},
{
"client": "runner",
"fun": "cloud.create",
"provider": "my-ec2-provider",
"instances": "my-centos-6",
"image": "ami-1624987f",
"delvol_on_destroy", true
}
]
'
HTTP/1.1 200 OK
[...snip...]
{
"return": [
{
"jerry": {
"pkg_|-install_apache_|-httpd_|-installed": {
[...snip full state return here...]
}
}
[...snip other minion returns here...]
},
{
[...snip full salt-cloud output here...]
}
]
}
Content negotiation
-------------------
This REST interface is flexible in what data formats it will accept as well
as what formats it will return (e.g., JSON, YAML, urlencoded).
* Specify the format of data in the request body by including the
:mailheader:`Content-Type` header.
* Specify the desired data format for the response body with the
:mailheader:`Accept` header.
We recommend the JSON format for most HTTP requests. urlencoded data is simple
and cannot express complex data structures -- and that is often required for
some Salt commands, such as starting a state run that uses Pillar data. Salt's
CLI tool can reformat strings passed in at the CLI into complex data
structures, and that behavior also works via salt-api, but that can be brittle
and since salt-api can accept JSON it is best just to send JSON.
Here is an example of sending urlencoded data:
.. code-block:: bash
curl -sSik https://localhost:8000 \
-b ~/cookies.txt \
-d client=runner \
-d fun='jobs.lookup_jid' \
-d jid='20150129182456704682'
.. admonition:: urlencoded data caveats
* Only a single command may be sent per HTTP request.
* Repeating the ``arg`` parameter multiple times will cause those
parameters to be combined into a single list.
Note, some popular frameworks and languages (notably jQuery, PHP, and
Ruby on Rails) will automatically append empty brackets onto repeated
query string parameters. E.g., ``?foo[]=fooone&foo[]=footwo``. This is
**not** supported; send ``?foo=fooone&foo=footwo`` instead, or send JSON
or YAML.
A note about ``curl``
The ``-d`` flag to curl does *not* automatically urlencode data which can
affect passwords and other data that contains characters that must be
encoded. Use the ``--data-urlencode`` flag instead. E.g.:
.. code-block:: bash
curl -ksi http://localhost:8000/login \
-H "Accept: application/json" \
-d username='myapiuser' \
--data-urlencode password='1234+' \
-d eauth='pam'
Performance Expectations and Recommended Usage
==============================================
This module provides a thin wrapper around :ref:`Salt's Python API
<python-api>`. Executing a Salt command via rest_cherrypy is directly analogous
to executing a Salt command via Salt's CLI (which also uses the Python API) --
they share the same semantics, performance characteristics, and 98% of the same
code. As a rule-of-thumb: if you wouldn't do it at the CLI don't do it via this
API.
Long-Running HTTP Connections
-----------------------------
The CherryPy server is a production-ready, threading HTTP server written in
Python. Because it makes use of a thread pool to process HTTP requests it is
not ideally suited to maintaining large numbers of concurrent, synchronous
connections. On moderate hardware with default settings it should top-out at
around 30 to 50 concurrent connections.
That number of long-running, synchronous Salt processes is also not ideal. Like
at the CLI, each Salt command run will start a process that instantiates its
own ``LocalClient``, which instantiates its own listener to the Salt event bus,
and sends out its own periodic ``saltutil.find_job`` queries to determine if a
Minion is still running the command. Not exactly a lightweight operation.
Timeouts
--------
In addition to the above resource overhead for long-running connections, there
are the usual HTTP timeout semantics for the CherryPy server, any HTTP client
being used, as well as any hardware in between such as proxies, gateways, or
load balancers. rest_cherrypy can be configured not to time-out long responses
via the ``expire_responses`` setting, and both :py:class:`LocalClient
<salt.client.LocalClient>` and :py:class:`RunnerClient
<salt.runner.RunnerClient>` have their own timeout parameters that may be
passed as top-level keywords:
.. code-block:: bash
curl -b /tmp/cookies.txt -sSi localhost:8000 -H 'Content-type: application/json' -d '
[
{
"client": "local",
"tgt": "*",
"fun": "test.sleep",
"kwarg": {"length": 30},
"timeout": 60
},
{
"client": "runner",
"fun": "test.sleep",
"kwarg": {"s_time": 30},
"timeout": 60
}
]
'
Best Practices
--------------
Given the performance overhead and HTTP timeouts for long-running operations
described above, the most effective and most scalable way to use both Salt and
salt-api is to run commands asynchronously using the ``local_async``,
``runner_async``, and ``wheel_async`` clients.
Running asynchronous jobs results in being able to process 3x more commands per second
for ``LocalClient`` and 17x more commands per second for ``RunnerClient``, in
addition to much less network traffic and memory requirements. Job returns can
be fetched from Salt's job cache via the ``/jobs/<jid>`` endpoint, or they can
be collected into a data store using Salt's :ref:`Returner system <returners>`.
The ``/events`` endpoint is specifically designed to handle long-running HTTP
connections and it exposes Salt's event bus which includes job returns.
Watching this endpoint first, then executing asynchronous Salt commands second,
is the most lightweight and scalable way to use ``rest_cherrypy`` while still
receiving job returns in real-time. But this requires clients that can properly
handle the inherent asynchronicity of that workflow.
Performance Tuning
------------------
The ``thread_pool`` and ``socket_queue_size`` settings can be used to increase
the capacity of rest_cherrypy to handle incoming requests. Keep an eye on RAM
usage as well as available file handles while testing changes to these
settings. As salt-api is a thin wrapper around Salt's Python API, also keep an
eye on the performance of Salt when testing.
Future Plans
------------
Now that Salt uses the Tornado concurrency library internally, we plan to
improve performance in the API by taking advantage of existing processes and
event listeners and to use lightweight coroutines to facilitate more
simultaneous HTTP connections and better support for synchronous operations.
That effort can be tracked in `issue 26505`__, but until that issue is closed
rest_cherrypy will remain the officially recommended REST API.
.. __: https://github.com/saltstack/salt/issues/26505
.. |req_token| replace:: a session token from :py:class:`~Login`.
.. |req_accept| replace:: the desired response format.
.. |req_ct| replace:: the format of the request body.
.. |res_ct| replace:: the format of the response body; depends on the
:mailheader:`Accept` request header.
.. |200| replace:: success
.. |400| replace:: bad or malformed request
.. |401| replace:: authentication required
.. |406| replace:: requested Content-Type not available
i ( t absolute_importN( t Processt Pipe( t cpstatssj Import of cherrypy.cpstats failed. Possible upstream bug: https://github.com/cherrypy/cherrypy/issues/1444s" Import of cherrypy.cpstats failed.( t six( t BytesIOi ( t
websockets( t event_processorR t SynchronizingWebsocketc C@ s� t j d } t j } | j d d � | j d d � f } d t j d k rQ d S| j j | � rg d S| j j d � d k r� d Sy t j j j d
� } Wn t j
k
r� d SX| d
k r� d St j | j d d � � � d S( s�
Bypass the normal handler and serve HTML for all URLs
The ``app_path`` setting must be non-empty and the request must ask for
``text/html`` in the ``Accept`` header.
t apioptst app_paths /appt static_paths /statict appNt Accepts */*s text/html( t cherrypyt configt requestt gett path_infot
startswitht headerst libt cptoolst acceptt HTTPErrort InternalRedirect( R R t
url_blacklistt
wants_html( ( sA /usr/lib/python2.7/site-packages/salt/netapi/rest_cherrypy/app.pyt html_override_tool� s"
c C@ s5 t j j j d d � } | r1 | t j j d <n d S( s�
If the custom authentication header is supplied, put it in the cookie dict
so the rest of the session-based auth works as intended
s X-Auth-Tokent
session_idN( R R R R t Nonet cookie( t x_auth( ( sA /usr/lib/python2.7/site-packages/salt/netapi/rest_cherrypy/app.pyt salt_token_tool� s c
C@ s� d } d } d } d } t j j d d � } | rc | j d d � } | rc | j d d � } qc n | j j } | r�| j d i � } | r�| | k r� | | | k s� d | | k r� t j | j | | � � t St j | j | | � � t
Sq�| | k rkd | k rk| | d k s.d | d k rKt j | j | | � � t St j | j | | � � t
Sq�t j | j | | � � t
Sq�n t j | j | | � � t Sd S(
s�
..versionadded:: 2016.3.0
Verifies user requests against the API whitelist. (User/IP pair)
in order to provide whitelisting for the API similar to the
master, but over the API.
..code-block:: yaml
rest_cherrypy:
api_acl:
users:
'*':
- 1.1.1.1
- 1.1.1.2
foo:
- 8.8.4.4
bar:
- '*'
:param username: Username to check against the API.
:type username: str
:param request: Cherrypy request to check against the API.
:type request: cherrypy.request
s8 [api_acl] Authentication failed for user {0} from IP {1}s; [api_acl] Authentication sucessful for user {0} from IP {1}s= [api_acl] Authentication not checked for user {0} from IP {1}t saltoptst
rest_cherrypyt api_aclt userst *N( R R R R t remotet ipt loggert infot formatt Truet False(
t usernameR t failure_strt success_strt pass_strt aclt salt_configt
cherrypy_confR( R% ( ( sA /usr/lib/python2.7/site-packages/salt/netapi/rest_cherrypy/app.pyt salt_api_acl_tool� s:
c C@ s� t j j d d
� } | r� | j d d
� } | r� | j d d
� } | r� t j d j | � � t j j j d d
� } t j d j | � � | | k r� t j d j | � � t j
d d � � q� q� q� n d
S( sj
If there is a list of restricted IPs, verify current
client is coming from one of those IPs.
R" R# t authorized_ipss Found IP list: {0}s Remote-Addrs Request from IP: {0}s Blocked IP: {0}i� s Bad IPN( R R R R R) t debugR+ R R t errorR ( R3 R4 t auth_ip_listt rem_ip( ( sA /usr/lib/python2.7/site-packages/salt/netapi/rest_cherrypy/app.pyt salt_ip_verify_tool� s c C@ s5 d t j k r! t j d � � n d t j j d <d S( sA
Redirect all unauthenticated requests to the login page
t tokeni� t privates
Cache-ControlN( R t sessionR t responseR ( ( ( sA /usr/lib/python2.7/site-packages/salt/netapi/rest_cherrypy/app.pyt salt_auth_tool s c C@ s' t j j } t j j } | j d d � | d <d | d <d | d <t j j d k r#| j d d � } d
d g } d d
d g } | r� | | k r� d j | � | d <d j | � | d <d | d <d | d <n d t j _ d t j _ d t j
j _ t j j j d t
� r t t j d <n t Sd S( s
Handle both simple and complex CORS requests
Add CORS headers to each response. If the request is a CORS preflight
request swap out the default handler with a simple, single-purpose handler
that verifies the request and provides a valid CORS response.
t OriginR& s Access-Control-Allow-Origins GET, POSTs Access-Control-Expose-Headerst trues Access-Control-Allow-Credentialst OPTIONSs Access-Control-Request-Methodt GETt POSTs Content-Types X-Auth-Tokens X-Requested-Withs , s Access-Control-Allow-Methodss Access-Control-Allow-Headerss
keep-alivet
Connectiont 1400s Access-Control-Max-Aget i� s tools.sessions.onR< N( R R R R? R t methodR t joint bodyt statust servingt handlerR R- R, R> ( t req_headt resp_headt ac_methodt allowed_methodst allowed_headers( ( sA /usr/lib/python2.7/site-packages/salt/netapi/rest_cherrypy/app.pyt cors_tool s,
s application/jsons application/x-yamlt default_flow_stylec O@ s� y. t t � t j _ t j j j | | � } Wn�t j j
t j j t j j t j j
f k
rt t j d � � nRt j j k
r� t j d � � n-t j j t j j f k
r� } t j d | j � � n� t j j k
r� t j d � � n� t j k
r
� n� t k
r�} t t d � rOt | t j � rOt j d � � n d d l } t j d t j j d t �d
t j _ i t j j d 6t j d r�d
j | j! | � � n d d 6} n Xt j" j# j$ g t D] \ } } | ^ q�� } | t j j% d <t j j | } y5 | | � } t& j' rDt j( j) j* | � } n | SWn< t k
r�d }
t j |
d t �t j d
|
� � n Xd S( s,
Determine the best output format based on the Accept header, execute the
regular handler, and transform the output to the request content type (even
if it's an error).
:param args: Pass args through to the main handler
:param kwargs: Pass kwargs through to the main handler
i� i� i� i� t TimeoutErrori Ns& Error while processing request for: %st exc_infoi� RL R7 s {0}s An unexpected error occurredt returns Content-Types. Could not serialize the return data from Salt.(+ t dictt
ct_out_mapR R? t
processorsRM R t _hypermedia_inner_handlert saltt
exceptionst AuthenticationErrort AuthorizationErrort EauthAuthenticationErrort TokenAuthenticationErrorR t SaltInvocationErrort SaltDaemonNotRunningt SaltReqTimeoutErrort strerrort SaltClientTimeoutt CherryPyExceptiont Exceptiont hasattrt
isinstanceRV t tracebackR) R7 R R, RL R R+ t
format_excR R R R R t PY3t utilst stringutilst to_bytes( t argst kwargst rett excRl t it _t bestt outR? t msg( ( sA /usr/lib/python2.7/site-packages/salt/netapi/rest_cherrypy/app.pyt hypermedia_handlerL sR
!
%.
c C@ s7 t j j } | j | _ | j d k r3 t | _ n d S( s�
Determine the best handler for the requested content type
Wrap the normal handler and transform the output from that handler into the
requested content type
N( R RM R RN R\ R R{ ( R ( ( sA /usr/lib/python2.7/site-packages/salt/netapi/rest_cherrypy/app.pyt hypermedia_out� s c @ s" t j � � � f d � � } | S( sS
A decorator to skip a processor function if process_request_body is False
c @ s& t j j t k r" � | | � n d S( N( R R t process_request_bodyR- ( Rr Rs ( t fn( sA /usr/lib/python2.7/site-packages/salt/netapi/rest_cherrypy/app.pyt wrapped� s ( t functoolst wraps( R~ R ( ( R~ sA /usr/lib/python2.7/site-packages/salt/netapi/rest_cherrypy/app.pyR} � s c C@ sE t j j | � t j j | � | j t j j _ d t j j _ d S( s
Accept x-www-form-urlencoded data (run through CherryPy's formatter)
and reformat it into a Low State data structure.
Since we can't easily represent complicated data structures with
key-value pairs, any more complicated requirements (e.g. compound
commands) must instead be delivered via JSON or YAML.
For example::
.. code-block:: bash
curl -si localhost:8000 -d client=local -d tgt='*' \
-d fun='test.kwarg' -d arg='one=1' -d arg='two=2'
:param entity: raw POST data
RH N( R t
_cpreqbodyt process_urlencodedt paramsRM R t unserialized_datat raw_body( t entity( ( sA /usr/lib/python2.7/site-packages/salt/netapi/rest_cherrypy/app.pyt urlencoded_processor� s c C@ s� t j r | j j � } nI t � } | j j d | � } | j d � t j j j | j � � } ~ y" t j j
j | � t j
j _ Wn# t k
r� t j d d � � n X| t j
j _ d S( sp
Unserialize raw POST data in JSON format to a Python data structure.
:param entity: raw POST data
t fp_outi i� s Invalid JSON documentN( R t PY2t fpt readR t seekR] Ro Rp t
to_unicodet jsont loadsR RM R R� t
ValueErrorR R� ( R� RK t contents( ( sA /usr/lib/python2.7/site-packages/salt/netapi/rest_cherrypy/app.pyt json_processor� s
"
c C@ s� t j r | j j � } nF t � } | j j d | � } | j d � t j j j | j � � } y" t j j
j | � t j
j _ Wn# t k
r� t j d d � � n X| t j
j _ d S( sp
Unserialize raw POST data in YAML format to a Python data structure.
:param entity: raw POST data
R� i i� s Invalid YAML documentN( R R� R� R� R R� R] Ro Rp R� t yamlt safe_loadR RM R R� R� R R� ( R� RK R� ( ( sA /usr/lib/python2.7/site-packages/salt/netapi/rest_cherrypy/app.pyt yaml_processor� s
"
c C@ s� t j r | j j � } nF t � } | j j d | � } | j d � t j j j | j � � } y" t j j
j | � t j
j _ Wn t k
r� | t j
j _ n X| t j
j _ d S( s�
Attempt to unserialize plain text as JSON
Some large services still send JSON with a text/plain Content-Type. Those
services are bad and should feel bad.
:param entity: raw POST data
R� i N( R R� R� R� R R� R] Ro Rp R� R� R� R RM R R� R� R� ( R� RK R� ( ( sA /usr/lib/python2.7/site-packages/salt/netapi/rest_cherrypy/app.pyt text_processor� s
"
c C@ s� i t d 6t d 6t d 6t d 6t d 6} t j j j � d k rz t j j j d d � d k rz t
t j _ d t j _
n t j j j j � t j d d
� t j j _ | t j j _ d S( s:
Unserialize POST/PUT data of a specified Content-Type.
The following custom processors all are intended to format Low State data
and will place that data structure into the request object.
:raises HTTPError: if the request contains a Content-Type that we do not
have a processor for
s! application/x-www-form-urlencodeds application/jsons application/x-yamls text/yamls
text/plainRE s Content-Lengtht 0i� s Content type not supportedN( R� R� R� R� R R RI t upperR R R- R} R R� RK R[ t clearR t default_proc( t ct_in_map( ( sA /usr/lib/python2.7/site-packages/salt/netapi/rest_cherrypy/app.pyt
hypermedia_in s
c C@ s� t j j j � d k r d St j j } | r� t | t j � r� d | k rt t | d t � rt | d g | d <n | g t j _ n | t j
j _ d S( s�
Validate and format lowdata from incoming unserialized request data
This tool requires that the hypermedia_in tool has already been run.
RE Nt arg( R R RI R� R� Rk t collectionst Mappingt listt lowstateRM ( t data( ( sA /usr/lib/python2.7/site-packages/salt/netapi/rest_cherrypy/app.pyt lowdata_fmt, s t
html_overridet
salt_tokent on_start_resourceRT t salt_authR� t before_request_bodyR� R| t salt_ip_verifyt before_handlert priorityi2 t LowDataAdapterc B@ s� e Z d Z e Z i e d 6e d 6d d 6e d 6e d 6e d 6e d 6Z d
� Z d d d � Z e j
i e d 6� d � � Z e j
j � e j
j � d
� � � Z RS( s5
The primary entry point to Salt's REST API
s tools.salt_token.ons tools.sessions.oni< i
s tools.sessions.timeouts tools.hypermedia_out.ons tools.hypermedia_in.ons tools.lowdata_fmt.ons tools.salt_ip_verify.onc C@ s< t j d | _ t j d | _ t j j | j � | _ d S( NR" R ( R R t optsR R] t netapit NetapiClientt api( t self( ( sA /usr/lib/python2.7/site-packages/salt/netapi/rest_cherrypy/app.pyt __init__u s c c@ s� t j j } t j j j d t � r4 t j j � n t | t � sX t j
d d � � n xJ| D]B} | rx | | d <n d | k r� y t | d d � Wq� t t
f k
r� t j
d d � � q� Xn d | k ry t | d d � Wqt t
f k
rt j
d d � � qXn | r+| | d <n d | k r_t | d t � r_| d g | d <n | j j | � } t | t j � r�x | D] } | Vq�Wq_ | Vq_ Wd
S( s�
Pull a Low State data structure from request and execute the low-data
chunks through Salt. The low-data chunks will be updated to include the
authorization token for the current session.
s tools.sessions.oni� s Lowstates must be a listR< i i� s
Invalid tokent clientR� N( R R R� R R R- R> t release_lockRk R� R t intt TypeErrorR� R� t runR� t Iterator( R� R� R< R� t chunkRt Rv ( ( sA /usr/lib/python2.7/site-packages/salt/netapi/rest_cherrypy/app.pyt
exec_lowstatez s6
c C@ s$ d d l } i d d 6t j j d 6S( sS
An explanation of the API with links of where to go next
.. http:get:: /
:reqheader Accept: |req_accept|
:status 200: |200|
:status 401: |401|
:status 406: |406|
**Example request:**
.. code-block:: bash
curl -i localhost:8000
.. code-block:: text
GET / HTTP/1.1
Host: localhost:8000
Accept: application/json
**Example response:**
.. code-block:: text
HTTP/1.1 200 OK
Content-Type: application/json
i Nt WelcomeRX t clients( t inspectR] R� t CLIENTS( R� R� ( ( sA /usr/lib/python2.7/site-packages/salt/netapi/rest_cherrypy/app.pyRD � s c K@ s) i t | j d t j j d � � � d 6S( s�
Send one or more Salt commands in the request body
.. http:post:: /
:reqheader X-Auth-Token: |req_token|
:reqheader Accept: |req_accept|
:reqheader Content-Type: |req_ct|
:resheader Content-Type: |res_ct|
:status 200: |200|
:status 400: |400|
:status 401: |401|
:status 406: |406|
:term:`lowstate` data describing Salt commands must be sent in the
request body.
**Example request:**
.. code-block:: bash
curl -sSik https://localhost:8000 \
-b ~/cookies.txt \
-H "Accept: application/x-yaml" \
-H "Content-type: application/json" \
-d '[{"client": "local", "tgt": "*", "fun": "test.ping"}]'
.. code-block:: text
POST / HTTP/1.1
Host: localhost:8000
Accept: application/x-yaml
X-Auth-Token: d40d1e1e
Content-Type: application/json
[{"client": "local", "tgt": "*", "fun": "test.ping"}]
**Example response:**
.. code-block:: text
HTTP/1.1 200 OK
Content-Length: 200
Allow: GET, HEAD, POST
Content-Type: application/x-yaml
return:
- ms-0: true
ms-1: true
ms-2: true
ms-3: true
ms-4: true
R< RX ( R� R� R R> R ( R� Rs ( ( sA /usr/lib/python2.7/site-packages/salt/netapi/rest_cherrypy/app.pyRE � s : iX N( t __name__t
__module__t __doc__R, t exposedt
_cp_configR� R R� R R R- RD t toolsR� R� RE ( ( ( sA /usr/lib/python2.7/site-packages/salt/netapi/rest_cherrypy/app.pyR� a s
7 ' t Minionsc B@ s< e Z d Z e e j i e d 6� Z d d � Z d � Z RS( s3
Convenience URLs for working with minions
s tools.salt_auth.onc C@ sS i d d 6| p d d 6d d 6g t j _ i t | j d t j j d � � � d 6S( sH
A convenience URL for getting lists of minions or getting minion
details
.. http:get:: /minions/(mid)
:reqheader X-Auth-Token: |req_token|
:reqheader Accept: |req_accept|
:status 200: |200|
:status 401: |401|
:status 406: |406|
**Example request:**
.. code-block:: bash
curl -i localhost:8000/minions/ms-3
.. code-block:: text
GET /minions/ms-3 HTTP/1.1
Host: localhost:8000
Accept: application/x-yaml
**Example response:**
.. code-block:: text
HTTP/1.1 200 OK
Content-Length: 129005
Content-Type: application/x-yaml
return:
- ms-3:
grains.items:
...
t localR� R& t tgts grains.itemst funR< RX ( R R R� R� R� R> R ( R� t mid( ( sA /usr/lib/python2.7/site-packages/salt/netapi/rest_cherrypy/app.pyRD s
'' c K@ s| t | j d d d t j j d � � � } d t j _ i | d 6i g | D]& } | rJ i d j | d � d 6^ qJ d 6d
6S( s�
Start an execution command and immediately return the job id
.. http:post:: /minions
:reqheader X-Auth-Token: |req_token|
:reqheader Accept: |req_accept|
:reqheader Content-Type: |req_ct|
:resheader Content-Type: |res_ct|
:status 200: |200|
:status 400: |400|
:status 401: |401|
:status 406: |406|
Lowstate data describing Salt commands must be sent in the request
body. The ``client`` option will be set to
:py:meth:`~salt.client.LocalClient.local_async`.
**Example request:**
.. code-block:: bash
curl -sSi localhost:8000/minions \
-b ~/cookies.txt \
-H "Accept: application/x-yaml" \
-d '[{"tgt": "*", "fun": "status.diskusage"}]'
.. code-block:: text
POST /minions HTTP/1.1
Host: localhost:8000
Accept: application/x-yaml
Content-Type: application/json
tgt=*&fun=status.diskusage
**Example response:**
.. code-block:: text
HTTP/1.1 202 Accepted
Content-Length: 86
Content-Type: application/x-yaml
return:
- jid: '20130603122505459265'
minions: [ms-4, ms-3, ms-2, ms-1, ms-0]
_links:
jobs:
- href: /jobs/20130603122505459265
R� t local_asyncR< i� RX s /jobs/{0}t jidt hreft jobst _links( R� R� R R> R R? RL R+ ( R� Rs t job_dataRv ( ( sA /usr/lib/python2.7/site-packages/salt/netapi/rest_cherrypy/app.pyRE O s 6 N(
R� R� R� RY R� R� R, R RD RE ( ( ( sA /usr/lib/python2.7/site-packages/salt/netapi/rest_cherrypy/app.pyR� s
/t Jobsc B@ s0 e Z e e j i e d 6� Z d d d � Z RS( s tools.salt_auth.onRH c C@ s% i d d 6} | r1 | j i d d 6| d 6� n | j i d d 6� | g t j _ t | j d t j j d � � � } i } | r| d g | d <i } | d j d
� } xO | D]G } d | | k r� | | j d � | | <q� | | j d � | | <q� W| g | d <n | d g | d <| S(
s�
A convenience URL for getting lists of previously run jobs or getting
the return from a single job
.. http:get:: /jobs/(jid)
List jobs or show a single job from the job cache.
:reqheader X-Auth-Token: |req_token|
:reqheader Accept: |req_accept|
:status 200: |200|
:status 401: |401|
:status 406: |406|
**Example request:**
.. code-block:: bash
curl -i localhost:8000/jobs
.. code-block:: text
GET /jobs HTTP/1.1
Host: localhost:8000
Accept: application/x-yaml
**Example response:**
.. code-block:: text
HTTP/1.1 200 OK
Content-Length: 165
Content-Type: application/x-yaml
return:
- '20121130104633606931':
Arguments:
- '3'
Function: test.fib
Start Time: 2012, Nov 30 10:46:33.606931
Target: jerry
Target-type: glob
**Example request:**
.. code-block:: bash
curl -i localhost:8000/jobs/20121130104633606931
.. code-block:: text
GET /jobs/20121130104633606931 HTTP/1.1
Host: localhost:8000
Accept: application/x-yaml
**Example response:**
.. code-block:: text
HTTP/1.1 200 OK
Content-Length: 73
Content-Type: application/x-yaml
info:
- Arguments:
- '3'
Function: test.fib
Minions:
- jerry
Start Time: 2012, Nov 30 10:46:33.606931
Target: '*'
Target-type: glob
User: saltdev
jid: '20121130104633606931'
return:
- jerry:
- - 0
- 1
- 1
- 2
- 6.9141387939453125e-06
t runnerR� s
jobs.list_jobR� R� s jobs.list_jobsR< i R* t Resultu returnRX ( t updateR R R� R� R� R> R ( R� R� t timeoutR� t job_ret_infoRt t
minion_rett returnst minion( ( sA /usr/lib/python2.7/site-packages/salt/netapi/rest_cherrypy/app.pyRD � s& T
N( R� R� RY R� R� R, R RD ( ( ( sA /usr/lib/python2.7/site-packages/salt/netapi/rest_cherrypy/app.pyR� � s
t Keysc B@ s@ e Z d Z d d � Z e j i e d 6e d 6� d � � Z RS( s�
Convenience URLs for working with minion keys
.. versionadded:: 2014.7.0
These URLs wrap the functionality provided by the :py:mod:`key wheel
module <salt.wheel.key>` functions.
c C@ s� | r' i d d 6d d 6| d 6g } n i d d 6d d 6g } | t j _ | j d t j j d � � } i t | i � j d i � j d i � d 6S(
s�
Show the list of minion keys or detail on a specific key
.. versionadded:: 2014.7.0
.. http:get:: /keys/(mid)
List all keys or show a specific key
:reqheader X-Auth-Token: |req_token|
:reqheader Accept: |req_accept|
:status 200: |200|
:status 401: |401|
:status 406: |406|
**Example request:**
.. code-block:: bash
curl -i localhost:8000/keys
.. code-block:: text
GET /keys HTTP/1.1
Host: localhost:8000
Accept: application/x-yaml
**Example response:**
.. code-block:: text
HTTP/1.1 200 OK
Content-Length: 165
Content-Type: application/x-yaml
return:
local:
- master.pem
- master.pub
minions:
- jerry
minions_pre: []
minions_rejected: []
**Example request:**
.. code-block:: bash
curl -i localhost:8000/keys/jerry
.. code-block:: text
GET /keys/jerry HTTP/1.1
Host: localhost:8000
Accept: application/x-yaml
**Example response:**
.. code-block:: text
HTTP/1.1 200 OK
Content-Length: 73
Content-Type: application/x-yaml
return:
minions:
jerry: 51:93:b3:d0:9f:3a:6d:e5:28:67:c2:4b:27:d6:cd:2b
t wheelR� s
key.fingerR� t matchs key.list_allR< R� RX ( R R R� R� R> R t next( R� R� R� t result( ( sA /usr/lib/python2.7/site-packages/salt/netapi/rest_cherrypy/app.pyRD s F
s tools.hypermedia_out.ons tools.sessions.onc K@ s� t j j } | d j i d d 6d d 6� d | d k rY | d j d � | d d <n | j � } t | i � j d i � j d i � } | j d
d � } t j d � } t
| � | _ | j d
d � } t j d � } t
| � | _ t � } t j
d | d d � }
t j r7| j t � } | j t � } n |
j | t | � � |
j | t | � � |
j � t j j } d j | d d � | d <d | d <t
| j � � | d <d | d <| j d � | S( s�
Easily generate keys for a minion and auto-accept the new key
Accepts all the same parameters as the :py:func:`key.gen_accept
<salt.wheel.key.gen_accept>`.
.. note:: A note about ``curl``
Avoid using the ``-i`` flag or HTTP headers will be written and
produce an invalid tar file.
Example partial kickstart script to bootstrap a new minion:
.. code-block:: text
%post
mkdir -p /etc/salt/pki/minion
curl -sSk https://localhost:8000/keys \
-d mid=jerry \
-d username=kickstart \
-d password=kickstart \
-d eauth=pam \
| tar -C /etc/salt/pki/minion -xf -
mkdir -p /etc/salt/minion.d
printf 'master: 10.0.0.5\nid: jerry' > /etc/salt/minion.d/id.conf
%end
.. http:post:: /keys
Generate a public and private key and return both as a tarball
Authentication credentials must be passed in the request.
:status 200: |200|
:status 401: |401|
:status 406: |406|
**Example request:**
.. code-block:: bash
curl -sSk https://localhost:8000/keys \
-d mid=jerry \
-d username=kickstart \
-d password=kickstart \
-d eauth=pam \
-o jerry-salt-keys.tar
.. code-block:: text
POST /keys HTTP/1.1
Host: localhost:8000
**Example response:**
.. code-block:: text
HTTP/1.1 200 OK
Content-Length: 10240
Content-Disposition: attachment; filename="saltkeys-jerry.tar"
Content-Type: application/x-tar
jerry.pub0000644000000000000000000000070300000000000010730 0ustar 00000000000000
i R� R� s key.gen_acceptR� R� t id_R� RX t pubRH s
minion.pubt privs
minion.pemt fileobjt modet ws' attachment; filename="saltkeys-{0}.tar"s Content-Dispositions application/x-tars Content-Types Content-Lengths no-caches
Cache-Control( R R R� R� t popR� R� R t tarfilet TarInfot lent sizeR t openR Rn t encodet __salt_system_encoding__t addfilet closeR? R R+ t getvalueR� ( R� Rs R� R� Rt t pub_keyt pub_key_filet priv_keyt
priv_key_fileR� t tarballR ( ( sA /usr/lib/python2.7/site-packages/salt/netapi/rest_cherrypy/app.pyRE g s: B
'
N( R� R� R� R RD R R R- RE ( ( ( sA /usr/lib/python2.7/site-packages/salt/netapi/rest_cherrypy/app.pyR� s Wt Loginc B@ s) e Z d Z d � Z d � Z d � Z RS( sh
Log in to receive a session token
:ref:`Authentication information <rest_cherrypy-auth>`.
c O@ s5 t t | � j | | � t j j | j � | _ d S( N( t superR� R� R] t autht ResolverR� ( R� Rr Rs ( ( sA /usr/lib/python2.7/site-packages/salt/netapi/rest_cherrypy/app.pyR� � s c C@ s( d t j j d <i t j j d 6d d 6S( s9
Present the login interface
.. http:get:: /login
An explanation of how to log in.
:status 200: |200|
:status 401: |401|
:status 406: |406|
**Example request:**
.. code-block:: bash
curl -i localhost:8000/login
.. code-block:: text
GET /login HTTP/1.1
Host: localhost:8000
Accept: text/html
**Example response:**
.. code-block:: text
HTTP/1.1 200 OK
Content-Type: text/html
t Sessions WWW-AuthenticateRL s
Please log inRX ( R R? R RL ( R� ( ( sA /usr/lib/python2.7/site-packages/salt/netapi/rest_cherrypy/app.pyRD � s
c K@ s� | j j � s$ t j j d � � n t t j j j t
� rR t j j j d } n t j j j } | j d d � } t
| t j � s� t j d � � n | j j | � } d | k r� t j d d � � n t j j t j j d <| d t j d <| d | d d
t j d <y,| j j d i � j | d
i � } | d
d k r_d | k r_| d } n� | j | d g � } | j | j d g � � d | k r#| d r#t | d � } t g | j � D]$ } | j d � r�| j d � ^ q�� } x/ | | @D] }
| j | d j |
� � q�Wn | s9t j d � n WnH t k
r�t j d j | j d
� | j d � � d t �d } n Xi i t j j d 6| d d 6| d d 6| d d 6| d
d
6| p�i d 6g d 6S( sU
:ref:`Authenticate <rest_cherrypy-auth>` against Salt's eauth system
.. http:post:: /login
:reqheader X-Auth-Token: |req_token|
:reqheader Accept: |req_accept|
:reqheader Content-Type: |req_ct|
:form eauth: the eauth backend configured for the user
:form username: username
:form password: password
:status 200: |200|
:status 401: |401|
:status 406: |406|
**Example request:**
.. code-block:: bash
curl -si localhost:8000/login \
-c ~/cookies.txt \
-H "Accept: application/json" \
-H "Content-type: application/json" \
-d '{
"username": "saltuser",
"password": "saltuser",
"eauth": "auto"
}'
.. code-block:: text
POST / HTTP/1.1
Host: localhost:8000
Content-Length: 42
Content-Type: application/json
Accept: application/json
{"username": "saltuser", "password": "saltuser", "eauth": "auto"}
**Example response:**
.. code-block:: text
HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 206
X-Auth-Token: 6d1b722e
Set-Cookie: session_id=6d1b722e; expires=Sat, 17 Nov 2012 03:23:52 GMT; Path=/
{"return": {
"token": "6d1b722e",
"start": 1363805943.776223,
"expire": 1363849143.776224,
"user": "saltuser",
"eauth": "pam",
"perms": [
"grains.*",
"status.*",
"sys.*",
"test.*"
]
}}
s Salt Master is not available.i R. i� R< s1 Could not authenticate using provided credentialss X-Auth-Tokent expiret starti< R� t
external_autht eautht djangos ^modelt auth_listt nameR& t groupst %s {0}%s Eauth permission list not found.sJ Configuration for external_auth malformed for eauth '{0}', and user '{1}'.RW t usert permsRX N( R� t _is_master_runningR] R^ Rd Rk R RM R R� R� R R R5 R R� t mk_tokenR> t idR? R R� t extendt sett keyst endswitht rstripR+ R) R7 Ri R, ( R� Rs t credsR. R< R� R t user_groupsRv t eauth_groupst group( ( sA /usr/lib/python2.7/site-packages/salt/netapi/rest_cherrypy/app.pyRE sP C %
=!
%
( R� R� R� R� RD RE ( ( ( sA /usr/lib/python2.7/site-packages/salt/netapi/rest_cherrypy/app.pyR� � s &t Logoutc B@ s7 e Z d Z e e j i e d 6e d 6� Z d � Z RS( s0
Class to remove or invalidate sessions
s tools.salt_auth.ons tools.lowdata_fmt.onc C@ s( t j j j � t j j � i d d 6S( sT
Destroy the currently active session and expire the session cookie
s Your token has been clearedRX ( R R t sessionsR� R> t
regenerate( R� ( ( sA /usr/lib/python2.7/site-packages/salt/netapi/rest_cherrypy/app.pyRE � s
( R� R� R� RY R� R� R, R- RE ( ( ( sA /usr/lib/python2.7/site-packages/salt/netapi/rest_cherrypy/app.pyR � s
t Tokenc B@ s- e Z d Z e j i e d 6� d � � Z RS( s�
Generate a Salt token from eauth credentials
Wraps functionality in the :py:mod:`auth Runner <salt.runners.auth>`.
.. versionadded:: 2017.7.0
s tools.sessions.onc K@ s� x� t j j D]s } yG | j i d d 6d d 6i | d d 6| d d 6| d d 6d 6� Wq
t k
r t j d d
� � q
Xq
Wt | j � � S( se
.. http:post:: /token
Generate a Salt eauth token
:status 200: |200|
:status 400: |400|
:status 401: |401|
**Example request:**
.. code-block:: bash
curl -sSk https://localhost:8000/token \
-H 'Content-type: application/json' \
-d '{
"username": "saltdev",
"password": "saltdev",
"eauth": "auto"
}'
**Example response:**
.. code-block:: text
HTTP/1.1 200 OK
Content-Type: application/json
[{
"start": 1494987445.528182,
"token": "e72ca1655d05...",
"expire": 1495030645.528183,
"name": "saltdev",
"eauth": "auto"
}]
R� R� s
auth.mk_tokenR� R. t passwordR� t kwargi� s2 Require "username", "password", and "eauth" params( R R R� R� t KeyErrorR R� R� ( R� Rs R
( ( sA /usr/lib/python2.7/site-packages/salt/netapi/rest_cherrypy/app.pyRE � s &
( R� R� R� R R R- RE ( ( ( sA /usr/lib/python2.7/site-packages/salt/netapi/rest_cherrypy/app.pyR � s t Runc B@ s0 e Z d Z e e j i e d 6� Z d � Z RS( s7
Run commands bypassing the :ref:`normal session handling
<rest_cherrypy-auth>`
salt-api does not enforce authorization, Salt's eauth system does that.
Local/Runner/WheelClient all accept ``username``/``password``/``eauth``
**or** ``token`` kwargs that are then checked by the eauth system. The
session mechanism in ``rest_cherrypy`` simply pairs a session with a Salt
eauth token and then passes the ``token`` kwarg in automatically.
If you already have a Salt eauth token, perhaps generated by the
:py:func:`mk_token <salt.runners.auth.mk_token>` function in the Auth
Runner module, then there is no reason to use sessions.
This endpoint accepts either a ``username``, ``password``, ``eauth`` trio,
**or** a ``token`` kwarg and does not make use of sessions at all.
s tools.sessions.onc K@ s i t | j � � d 6S( s9
Run commands bypassing the :ref:`normal session handling
<rest_cherrypy-auth>` Other than that this URL is identical to the
:py:meth:`root URL (/) <LowDataAdapter.POST>`.
.. http:post:: /run
An array of lowstate data describing Salt commands must be sent in
the request body.
:status 200: |200|
:status 400: |400|
:status 401: |401|
:status 406: |406|
**Example request:**
.. code-block:: bash
curl -sS localhost:8000/run \
-H 'Accept: application/x-yaml' \
-H 'Content-type: application/json' \
-d '[{
"client": "local",
"tgt": "*",
"fun": "test.ping",
"username": "saltdev",
"password": "saltdev",
"eauth": "auto"
}]'
**Or** using a Salt Eauth token:
.. code-block:: bash
curl -sS localhost:8000/run \
-H 'Accept: application/x-yaml' \
-H 'Content-type: application/json' \
-d '[{
"client": "local",
"tgt": "*",
"fun": "test.ping",
"token": "<salt eauth token here>"
}]'
.. code-block:: text
POST /run HTTP/1.1
Host: localhost:8000
Accept: application/x-yaml
Content-Length: 75
Content-Type: application/json
[{"client": "local", "tgt": "*", "fun": "test.ping", "username": "saltdev", "password": "saltdev", "eauth": "auto"}]
**Example response:**
.. code-block:: text
HTTP/1.1 200 OK
Content-Length: 73
Content-Type: application/x-yaml
return:
- ms-0: true
ms-1: true
ms-2: true
ms-3: true
ms-4: true
The /run enpoint can also be used to issue commands using the salt-ssh
subsystem.
When using salt-ssh, eauth credentials should not be supplied. Instead,
authentication should be handled by the SSH layer itself. The use of
the salt-ssh client does not require a salt master to be running.
Instead, only a roster file must be present in the salt configuration
directory.
All SSH client requests are synchronous.
**Example SSH client request:**
.. code-block:: bash
curl -sS localhost:8000/run \
-H 'Accept: application/x-yaml' \
-d client='ssh' \
-d tgt='*' \
-d fun='test.ping'
.. code-block:: text
POST /run HTTP/1.1
Host: localhost:8000
Accept: application/x-yaml
Content-Length: 75
Content-Type: application/x-www-form-urlencoded
client=ssh&tgt=*&fun=test.ping
**Example SSH response:**
.. code-block:: text
return:
- silver:
fun: test.ping
fun_args: []
id: silver
jid: '20141203103525666185'
retcode: 0
return: true
success: true
RX ( R� R� ( R� Rs ( ( sA /usr/lib/python2.7/site-packages/salt/netapi/rest_cherrypy/app.pyRE � s t( R� R� R� RY R� R� R- RE ( ( ( sA /usr/lib/python2.7/site-packages/salt/netapi/rest_cherrypy/app.pyR � s
t Eventsc B@ sj e Z d Z e Z e e j i e d 6d d 6e d 6e d 6e d 6� Z d � Z d � Z
d
d
d � Z RS( sK
Expose the Salt event bus
The event bus on the Salt master exposes a large variety of things, notably
when executions are started on the master and also when minions ultimately
return their results. This URL provides a real-time window into a running
Salt infrastructure.
.. seealso:: :ref:`events`
s response.streams utf-8s tools.encode.encodings tools.salt_auth.ons tools.hypermedia_in.ons tools.hypermedia_out.onc C@ s, t j d | _ t j j | j � | _ d S( NR" ( R R R� R] R� R� t resolver( R� ( ( sA /usr/lib/python2.7/site-packages/salt/netapi/rest_cherrypy/app.pyR� � s c C@ s� y t | d � Wn t t f k
r+ t SXt j j j | i d f � \ } } | j d | � } | r~ | j j
| � r~ t St S( s
Check if this is a valid salt-api token or valid Salt token
salt-api tokens are regular session tokens that tie back to a real Salt
token. Salt tokens are tokens generated by Salt's eauth system.
:return bool: True if valid, False if not valid.
i R< N( R� R� R� R- R R> t cacheR R R t get_tokenR, ( R� t
auth_tokent orig_sessionRw R� ( ( sA /usr/lib/python2.7/site-packages/salt/netapi/rest_cherrypy/app.pyt _is_valid_token� s $c @ s� t j j } | p4 | p4 d | k r1 | d j n d
} � j | � sX t j d � � n t j j � d t j j
d <d t j j
d <d t j j
d <� f d � } | � S( sI
An HTTP stream of the Salt master event bus
This stream is formatted per the Server Sent Events (SSE) spec. Each
event is formatted as JSON.
.. http:get:: /events
:status 200: |200|
:status 401: |401|
:status 406: |406|
:query token: **optional** parameter containing the token
ordinarily supplied via the X-Auth-Token header in order to
allow cross-domain requests in browsers that do not include
CORS support in the EventSource API. E.g.,
``curl -NsS localhost:8000/events?token=308650d``
:query salt_token: **optional** parameter containing a raw Salt
*eauth token* (not to be confused with the token returned from
the /login URL). E.g.,
``curl -NsS localhost:8000/events?salt_token=30742765``
**Example request:**
.. code-block:: bash
curl -NsS localhost:8000/events
.. code-block:: text
GET /events HTTP/1.1
Host: localhost:8000
**Example response:**
Note, the ``tag`` field is not part of the spec. SSE compliant clients
should ignore unknown fields. This addition allows non-compliant
clients to only watch for certain tags without having to deserialze the
JSON object each time.
.. code-block:: text
HTTP/1.1 200 OK
Connection: keep-alive
Cache-Control: no-cache
Content-Type: text/event-stream;charset=utf-8
retry: 400
tag: salt/job/20130802115730568475/new
data: {'tag': 'salt/job/20130802115730568475/new', 'data': {'minions': ['ms-4', 'ms-3', 'ms-2', 'ms-1', 'ms-0']}}
tag: salt/job/20130802115730568475/ret/jerry
data: {'tag': 'salt/job/20130802115730568475/ret/jerry', 'data': {'jid': '20130802115730568475', 'return': True, 'retcode': 0, 'success': True, 'cmd': '_return', 'fun': 'test.ping', 'id': 'ms-1'}}
The event stream can be easily consumed via JavaScript:
.. code-block:: javascript
var source = new EventSource('/events');
source.onopen = function() { console.info('Listening ...') };
source.onerror = function(err) { console.error(err) };
source.onmessage = function(message) {
var saltEvent = JSON.parse(message.data);
console.log(saltEvent.tag, saltEvent.data);
};
Note, the SSE stream is fast and completely asynchronous and Salt is
very fast. If a job is created using a regular POST request, it is
possible that the job return will be available on the SSE stream before
the response for the POST request arrives. It is important to take that
asynchronicity into account when designing an application. Below are
some general guidelines.
* Subscribe to the SSE stream _before_ creating any events.
* Process SSE events directly as they arrive and don't wait for any
other process to "complete" first (like an ajax request).
* Keep a buffer of events if the event stream must be used for
synchronous lookups.
* Be cautious in writing Salt's event stream directly to the DOM. It is
very busy and can quickly overwhelm the memory allocated to a
browser tab.
A full, working proof-of-concept JavaScript application is available
:blob:`adjacent to this file <salt/netapi/rest_cherrypy/index.html>`.
It can be viewed by pointing a browser at the ``/app`` endpoint in a
running ``rest_cherrypy`` instance.
Or using CORS:
.. code-block:: javascript
var source = new EventSource('/events?token=ecd589e4e01912cf3c4035afad73426dbb8dba75', {withCredentials: true});
It is also possible to consume the stream via the shell.
Records are separated by blank lines; the ``data:`` and ``tag:``
prefixes will need to be removed manually before attempting to
unserialize the JSON.
curl's ``-N`` flag turns off input buffering which is required to
process the stream incrementally.
Here is a basic example of printing each event as it comes in:
.. code-block:: bash
curl -NsS localhost:8000/events |\
while IFS= read -r line ; do
echo $line
done
Here is an example of using awk to filter events based on tag:
.. code-block:: bash
curl -NsS localhost:8000/events |\
awk '
BEGIN { RS=""; FS="\\n" }
$1 ~ /^tag: salt\/job\/[0-9]+\/new$/ { print $0 }
'
tag: salt/job/20140112010149808995/new
data: {"tag": "salt/job/20140112010149808995/new", "data": {"tgt_type": "glob", "jid": "20140112010149808995", "tgt": "jerry", "_stamp": "2014-01-12_01:01:49.809617", "user": "shouse", "arg": [], "fun": "test.ping", "minions": ["jerry"]}}
tag: 20140112010149808995
data: {"tag": "20140112010149808995", "data": {"fun_args": [], "jid": "20140112010149808995", "return": true, "retcode": 0, "success": true, "cmd": "_return", "_stamp": "2014-01-12_01:01:49.819316", "fun": "test.ping", "id": "jerry"}}
R i� s text/event-streams Content-Types no-caches
Cache-Controls
keep-aliveRF c
3@ s� t j j j d d � j d d � j d d � j d t �} | j d t d t � } t d � VxY t r� t | � } t d � j | j
d
d � � Vt d � j t j j j | � � Vqd Wd
S( s:
An iterator to yield Salt events
t mastert sock_dirt transportR� t listent fullt auto_reconnects retry: 400
s tag: {0}
t tagRH s data: {0}
N(
R] Ro t eventt get_eventR� R, t iter_eventst strR� R+ R R� t dumps( R' t streamR� ( R� ( sA /usr/lib/python2.7/site-packages/salt/netapi/rest_cherrypy/app.pyR# . s
N( R R R t valueR R R R> R� R? R ( R� R< R� t cookiesR R# ( ( R� sA /usr/lib/python2.7/site-packages/salt/netapi/rest_cherrypy/app.pyRD � s ~
N(
R� R� R� R, R� RY R� R� R- R� R R RD ( ( ( sA /usr/lib/python2.7/site-packages/salt/netapi/rest_cherrypy/app.pyR g s
t WebsocketEndpointc B@ so e Z d Z e Z e e j i e d 6d d 6e d 6e d 6e d 6e d 6e j
d 6� Z d � Z d d
� Z
RS( s�
Open a WebSocket connection to Salt's event bus
The event bus on the Salt master exposes a large variety of things, notably
when executions are started on the master and also when minions ultimately
return their results. This URL provides a real-time window into a running
Salt infrastructure. Uses websocket as the transport mechanism.
.. seealso:: :ref:`events`
s response.streams utf-8s tools.encode.encodings tools.salt_auth.ons tools.hypermedia_in.ons tools.hypermedia_out.ons tools.websocket.ons tools.websocket.handler_clsc C@ s, t j d | _ t j j | j � | _ d S( NR" ( R R R� R] R� t LoadAuth( R� ( ( sA /usr/lib/python2.7/site-packages/salt/netapi/rest_cherrypy/app.pyR� ^ s c
@ s� | r< t j j j | i d f � \ } } | j d � � n t j j d � � � sh � j j � � rz t j d � � n t j j � t j j
} � � � f d � } t � \ } } | | _ � j
| _
t d | d | | f � } | j � d S( s�
Return a websocket connection of Salt's event stream
.. http:get:: /ws/(token)
:query format_events: The event stream will undergo server-side
formatting if the ``format_events`` URL parameter is included
in the request. This can be useful to avoid formatting on the
client-side:
.. code-block:: bash
curl -NsS <...snip...> localhost:8000/ws?format_events
:reqheader X-Auth-Token: an authentication token from
:py:class:`~Login`.
:status 101: switching to the websockets protocol
:status 401: |401|
:status 406: |406|
**Example request:** ::
curl -NsSk \
-H 'X-Auth-Token: ffedf49d' \
-H 'Host: localhost:8000' \
-H 'Connection: Upgrade' \
-H 'Upgrade: websocket' \
-H 'Origin: https://localhost:8000' \
-H 'Sec-WebSocket-Version: 13' \
-H 'Sec-WebSocket-Key: '"$(echo -n $RANDOM | base64)" \
localhost:8000/ws
.. code-block:: text
GET /ws HTTP/1.1
Connection: Upgrade
Upgrade: websocket
Host: localhost:8000
Origin: https://localhost:8000
Sec-WebSocket-Version: 13
Sec-WebSocket-Key: s65VsgHigh7v/Jcf4nXHnA==
X-Auth-Token: ffedf49d
**Example response**:
.. code-block:: text
HTTP/1.1 101 Switching Protocols
Upgrade: websocket
Connection: Upgrade
Sec-WebSocket-Accept: mWZjBV9FCglzn1rIKJAxrTFlnJE=
Sec-WebSocket-Version: 13
An authentication token **may optionally** be passed as part of the URL
for browsers that cannot be configured to send the authentication
header or cookie:
.. code-block:: bash
curl -NsS <...snip...> localhost:8000/ws/ffedf49d
The event stream can be easily consumed via JavaScript:
.. code-block:: javascript
// Note, you must be authenticated!
var source = new Websocket('ws://localhost:8000/ws/d0ce6c1a');
source.onerror = function(e) { console.debug('error!', e); };
source.onmessage = function(e) { console.debug(e.data); };
source.send('websocket client ready')
source.close();
Or via Python, using the Python module `websocket-client
<https://pypi.python.org/pypi/websocket-client/>`_ for example.
.. code-block:: python
# Note, you must be authenticated!
from websocket import create_connection
ws = create_connection('ws://localhost:8000/ws/d0ce6c1a')
ws.send('websocket client ready')
# Look at https://pypi.python.org/pypi/websocket-client/ for more
# examples.
while listening_to_events:
print ws.recv()
ws.close()
Above examples show how to establish a websocket connection to Salt and
activating real time updates from Salt's event stream by signaling
``websocket client ready``.
R< i� c
@ s2 | j � t j j j d d � j d d � j d d � j d t �} | j d t d t � } t j | � } d � } t
j
t
j | � x� t r-t | � } | r� yW d � k r� | j
| � � j � n. | j t d
� j t j j j | � � t � Wq*t k
r&t j d j | � � q*Xq� q� Wd S(
sX
An iterator to return Salt events (and optionally format them)
R R! R" R� R# R$ R% c S@ s t j d � d S( Ni ( t ost _exit( t signalt frame( ( sA /usr/lib/python2.7/site-packages/salt/netapi/rest_cherrypy/app.pyt signal_handler� s t
format_eventss data: {0}
s) Error: Salt event has non UTF-8 data:
{0}N( t recvR] Ro R' R( R� R, R) R t SaltInfoR3 t SIGTERMR� t processt sendR* R+ R� R+ R- t UnicodeDecodeErrorR) R8 ( RN t pipeR' R, R8 R5 R� ( Rs R� R� ( sA /usr/lib/python2.7/site-packages/salt/netapi/rest_cherrypy/app.pyt event_stream� s0
!
t targetRr N( R R> R R R R� t get_tokR R� R t
ws_handlerR R= R� R R� (
R� R< Rs R Rw RN R> t parent_pipet
child_pipet proc( ( Rs R� R� sA /usr/lib/python2.7/site-packages/salt/netapi/rest_cherrypy/app.pyRD b s e$
% N( R� R� R� R, R� RY R� R� R- R R R� R RD ( ( ( sA /usr/lib/python2.7/site-packages/salt/netapi/rest_cherrypy/app.pyR/ D s
t Webhookc B@ sU e Z d Z e Z d d d g Z e e j i e d 6e d 6� Z d � Z d � Z
RS( s�
A generic web hook entry point that fires an event on Salt's event bus
External services can POST data to this URL to trigger an event in Salt.
For example, Amazon SNS, Jenkins-CI or Travis-CI, or GitHub web hooks.
.. note:: Be mindful of security
Salt's Reactor can run any code. A Reactor SLS that responds to a hook
event is responsible for validating that the event came from a trusted
source and contains valid data.
**This is a generic interface and securing it is up to you!**
This URL requires authentication however not all external services can
be configured to authenticate. For this reason authentication can be
selectively disabled for this URL. Follow best practices -- always use
SSL, pass a secret key, configure the firewall to only allow traffic
from a known source, etc.
The event data is taken from the request body. The
:mailheader:`Content-Type` header is respected for the payload.
The event tag is prefixed with ``salt/netapi/hook`` and the URL path is
appended to the end. For example, a ``POST`` request sent to
``/hook/mycompany/myapp/mydata`` will produce a Salt event with the tag
``salt/netapi/hook/mycompany/myapp/mydata``.
The following is an example ``.travis.yml`` file to send notifications to
Salt of successful test runs:
.. code-block:: yaml
language: python
script: python -m unittest tests
after_success:
- |
curl -sSk https://saltapi-url.example.com:8000/hook/travis/build/success -d branch="${TRAVIS_BRANCH}" -d commit="${TRAVIS_COMMIT}"
.. seealso:: :ref:`events`, :ref:`reactor <reactor>`
R] R� t hooks tools.lowdata_fmt.ons tools.salt_auth.onc
C@ s{ t j d | _ t j j j d d | j d d | j d d | j d t �| _ t j d j d � rw t | j d <n d S(
NR" R R! R" R� R# R t webhook_disable_auths tools.salt_auth.on(
R R R� R] Ro R' R( R- R R� ( R� ( ( sA /usr/lib/python2.7/site-packages/salt/netapi/rest_cherrypy/app.pyR� =
s
c O@ s� d j t j | j | � � } t j j j } | s< i } n t t j j d d � } t t j j
� } | j j i | d 6| d 6| d 6| � } i | d 6S( sC
Fire an event in Salt with a custom event tag and data
.. http:post:: /hook
:status 200: |200|
:status 401: |401|
:status 406: |406|
:status 413: request body is too large
**Example request:**
.. code-block:: bash
curl -sS localhost:8000/hook \
-H 'Content-type: application/json' \
-d '{"foo": "Foo!", "bar": "Bar!"}'
.. code-block:: text
POST /hook HTTP/1.1
Host: localhost:8000
Content-Length: 16
Content-Type: application/json
{"foo": "Foo!", "bar": "Bar!"}
**Example response**:
.. code-block:: text
HTTP/1.1 200 OK
Content-Length: 14
Content-Type: application/json
{"success": true}
As a practical example, an internal continuous-integration build
server could send an HTTP POST request to the URL
``https://localhost:8000/hook/mycompany/build/success`` which contains
the result of a build and the SHA of the version that was built as
JSON. That would then produce the following event in Salt that could be
used to kick off a deployment via Salt's Reactor::
Event fired at Fri Feb 14 17:40:11 2014
*************************
Tag: salt/netapi/hook/mycompany/build/success
Data:
{'_stamp': '2014-02-14_17:40:11.440996',
'headers': {
'X-My-Secret-Key': 'F0fAgoQjIT@W',
'Content-Length': '37',
'Content-Type': 'application/json',
'Host': 'localhost:8000',
'Remote-Addr': '127.0.0.1'},
'post': {'revision': 'aa22a3c4b2e7', 'result': True}}
Salt's Reactor could listen for the event:
.. code-block:: yaml
reactor:
- 'salt/netapi/hook/mycompany/build/*':
- /srv/reactor/react_ci_builds.sls
And finally deploy the new build:
.. code-block:: jinja
{% set secret_key = data.get('headers', {}).get('X-My-Secret-Key') %}
{% set build = data.get('post', {}) %}
{% if secret_key == 'F0fAgoQjIT@W' and build.result == True %}
deploy_my_app:
cmd.state.sls:
- tgt: 'application*'
- arg:
- myapp.deploy
- kwarg:
pillar:
revision: {{ revision }}
{% endif %}
t /R� RH RK t postR t success(
RJ t itertoolst chaint tag_baseR RM R R� t getattrRY R R' t
fire_event( R� Rr Rs R& R� R� R Rt ( ( sA /usr/lib/python2.7/site-packages/salt/netapi/rest_cherrypy/app.pyRE I
s T ( R� R� R� R, R� RM RY R� R� R� RE ( ( ( sA /usr/lib/python2.7/site-packages/salt/netapi/rest_cherrypy/app.pyRE
s +
t Statsc B@ s? e Z d Z e Z e e j i e d 6� Z d � Z d � Z RS( s:
Expose statistics on the running CherryPy server
s tools.salt_auth.onc C@ s* t j d j d � r& t | j d <n d S( NR t stats_disable_auths tools.salt_auth.on( R R R R- R� ( R� ( ( sA /usr/lib/python2.7/site-packages/salt/netapi/rest_cherrypy/app.pyR� �
s c C@ s# t t d � r t j t j � Si S( sY
Return a dump of statistics collected from the CherryPy server
.. http:get:: /stats
:reqheader X-Auth-Token: |req_token|
:reqheader Accept: |req_accept|
:resheader Content-Type: |res_ct|
:status 200: |200|
:status 401: |401|
:status 406: |406|
t
statistics( Rj t loggingR t extrapolate_statisticsRR ( R� ( ( sA /usr/lib/python2.7/site-packages/salt/netapi/rest_cherrypy/app.pyRD �
s (
R� R� R� R, R� RY R� R� R� RD ( ( ( sA /usr/lib/python2.7/site-packages/salt/netapi/rest_cherrypy/app.pyRP �
s
t Appc B@ s e Z d Z e Z d � Z RS( s#
Class to serve HTML5 apps
c G@ sY t j d } t j j t j j t j j t � d � � } t j j j
| j d | � � S( s;
Serve a single static file ignoring the remaining path
This is useful in combination with a browser-based app using the HTML5
history API.
.. http::get:: /app
:reqheader X-Auth-Token: |req_token|
:status 200: |200|
:status 401: |401|
R s
index.htmlR ( R R R1 t patht abspathRJ t dirnamet __file__R t statict
serve_fileR ( R� Rr R t
default_index( ( sA /usr/lib/python2.7/site-packages/salt/netapi/rest_cherrypy/app.pyRD �
s
( R� R� R� R, R� RD ( ( ( sA /usr/lib/python2.7/site-packages/salt/netapi/rest_cherrypy/app.pyRU �
s t APIc B@ s~ e Z d Z i
e d 6e d 6e d 6e d 6e d 6e d 6e d 6e
d 6e d 6e d
6Z
d � Z d � Z d
� Z d � Z RS( sI
Collect configuration and URL map for building the CherryPy app
t indext logint logoutR< t minionsR� R� R
t eventst statsc @ s� | j j d t � t k r0 d d d d g � n g � � f d � t j | j � D� } x' | D] \ } } t | | | � � q_ Wd S( s�
Set an attribute on the local instance for each key/val in url_map
CherryPy uses class attributes to resolve URLs.
t enable_sessionsR_ R` Ra R� c 3@ s- | ]# \ } } | � k r | | f Vq d S( N( ( t .0t urlt cls( R ( sA /usr/lib/python2.7/site-packages/salt/netapi/rest_cherrypy/app.pys <genexpr> s N( R R R, R- R t iteritemst url_mapt setattr( R� t urlsRf Rg ( ( R sA /usr/lib/python2.7/site-packages/salt/netapi/rest_cherrypy/app.pyt _setattr_url_map�
s "c C@ s� t r | j j i t d 6� n | j j i t | j j d d � j d � 6� | j j i t | j j d d � j d � 6� d S( s;
Assemble any dynamic or configurable URLs
t wst webhook_urlRF RH R
R N( t HAS_WEBSOCKETSRi R� R/ RE R R t lstripRU ( R� ( ( sA /usr/lib/python2.7/site-packages/salt/netapi/rest_cherrypy/app.pyt _update_url_map s # c C@ s8 t j d | _ t j d | _ | j � | j � d S( NR" R ( R R R� R Rq Rl ( R� ( ( sA /usr/lib/python2.7/site-packages/salt/netapi/rest_cherrypy/app.pyR� ! s
c C@ s i i | j j d d � d 6| j j d d � d 6| j j d d � d 6| j j d
d � d 6| j j d
d � d
6| j j d t � d 6| j j d d � d 6| j j d d � d 6d 6i t j j � d 6t d 6t d 6t d 6t d 6d 6} t j j j
t j d � d k r1| j j d t � | d d <n t r]| j j d t � r]t | d d! <n d" | j k r�i t d# 6| j d" d$ 6| d% <n | j j d t � t k r�d& | d d' <n d( | j k r�i t d) 6| j d( d* 6| | j j d+ d, � <n t j
j | d � | S(- s�
Combine the CherryPy configuration with the rest_cherrypy config values
pulled from the master config and return the CherryPy configuration
t hosts 0.0.0.0s server.socket_hostt porti@ s server.socket_portt thread_poolid s server.thread_poolt
queue_sizei s server.socket_queue_sizet max_request_body_sizei R7 t log_access_fileRH s log.access_filet log_error_files log.error_filet globals request.dispatchs tools.trailing_slash.ons
tools.gzip.ons tools.html_override.ons tools.cors_tool.onRH s 12.0.0i t expire_responsess engine.timeout_monitor.ont
collect_statss tools.cpstats.ont favicons tools.staticfile.ons tools.staticfile.filenames /favicon.icot
productiont environmentRZ s tools.staticdir.ons tools.staticdir.dirR s /static( R R R- R t dispatcht MethodDispatcherR, R] Ro t versionst version_cmpt __version__R R R� ( R� t conf( ( sA /usr/lib/python2.7/site-packages/salt/netapi/rest_cherrypy/app.pyt get_conf( sD
! '( R� R� R� R� R� R R R� R R� R� R RP Ri Rl Rq R� R� ( ( ( sA /usr/lib/python2.7/site-packages/salt/netapi/rest_cherrypy/app.pyR] �
s
c C@ s^ | j t j d d � d i � } | t j d <| t j d <t � } | j � } | | | f S( s;
Returns a WSGI app and a configuration dictionary
t .i i����R" R ( R R� t rsplitR R R] R� ( R� R t roott cpyopts( ( sA /usr/lib/python2.7/site-packages/salt/netapi/rest_cherrypy/app.pyt get_appe s "
(] R� t
__future__R R� RK R� RS R1 R3 R� t multiprocessingR R t getLoggerR� R) R t cherrypy.libR t AttributeErrorR t warnt ImportErrorR] t salt.autht salt.exceptionst salt.utils.eventt salt.utils.jsont salt.utils.stringutilst salt.utils.versionst salt.utils.yamlt salt.extR t salt.ext.sixR t salt.netapiR� R RH R R, Ro t typet objectR- R R! R5 R; R@ RT Ro R� R+ t partialR� t safe_dumpRZ R{ R| R} R� R� R� R� R� R� t tools_configt itemsRF t tool_listt enumeratet idxt tool_configt tool_namet tool_fnRj t ToolR� R� R� R� R� R R R R R/ RE RP RU R] R� ( ( ( sA /usr/lib/python2.7/site-packages/salt/netapi/rest_cherrypy/app.pyt <module>B s�
# E 1 D �zt��@����# y
Mini Shell