File manager - Edit - /opt/saltstack/salt/lib/python3.10/site-packages/zmq/auth/__pycache__/base.cpython-310.pyc
Back
o ;j�? � @ s� d Z ddlZddlZddlmZmZmZmZmZm Z m Z m Z ddl Z ddl mZ ddlmZ ddlmZ dZd ZG d d � d �Zd d gZdS ) z*Base implementation of 0MQ authentication.� N)�Any� Awaitable�Dict�List�Optional�Set�Tuple�Union)�_check_version)�z85� )�load_certificates�*s 1.0c @ s e Zd ZU dZded< eed< eed< eeef ed< ded< e e ed < e e ed < eeeeef f ed < eeee ef f ed < eed < d@de d ded efdd�Z dAdd�Z dAdd�Zdeddfdd�Zdeddfdd�Z dBd ed e eeef ddfd d �Z dCd ed!eeejf ddfd"d#�Z dBd ed$eddfd%d&�Zd'e defd(d)�Z dBd ed!e e ddfd*d+�Zd,ee fd-d.�Zd ed/ed0edeee f fd1d2�Z d ed3e deee f fd4d5�Z d ed6e deee f fd7d8�Z 9dDd:e d;e d<e d=eddf d>d?�Z dS )E� Authenticatora� Implementation of ZAP authentication for zmq connections. This authenticator class does not register with an event loop. As a result, you will need to manually call `handle_zap_message`:: auth = zmq.Authenticator() auth.allow("127.0.0.1") auth.start() while True: await auth.handle_zap_msg(auth.zap_socket.recv_multipart()) Alternatively, you can register `auth.zap_socket` with a poller. Since many users will want to run ZAP in a way that does not block the main thread, other authentication classes (such as :mod:`zmq.auth.thread`) are provided. Note: - libzmq provides four levels of security: default NULL (which the Authenticator does not see), and authenticated NULL, PLAIN, CURVE, and GSSAPI, which the Authenticator can see. - until you add policies, all incoming NULL connections are allowed. (classic ZeroMQ behavior), and all PLAIN and CURVE connections are denied. - GSSAPI requires no configuration. z zmq.Context�context�encoding� allow_any�credentials_providersz zmq.Socket� zap_socket�_allowed�_denied� passwords�certs�logN�utf-8c C sb t dd� |p tj�� | _|| _d| _i | _d | _t � | _ t � | _ i | _ i | _ |p-t�d�| _d S )N)� r ZsecurityFzzmq.auth)r �zmqZContext�instancer r r r r �setr r r r �logging� getLoggerr )�selfr r r � r" �A/opt/saltstack/salt/lib/python3.10/site-packages/zmq/auth/base.py�__init__: s zAuthenticator.__init__�returnc C s: | j jtjtjd�| _d| j_| j�d� | j� d� dS )z Create and bind the ZAP socket)Z socket_classr zinproc://zeromq.zap.01ZStartingN) r �socketr ZREPZSocketr Zlinger�bindr �debug�r! r" r" r# �startP s zAuthenticator.startc C s | j r| j �� d| _ dS )zClose the ZAP socketN)r �closer) r" r" r# �stopW s zAuthenticator.stop� addressesc G �2 | j rtd��| j�dd�|�� | j�|� dS )a6 Allow IP address(es). Connections from addresses not explicitly allowed will be rejected. - For NULL, all clients from this address will be accepted. - For real auth setups, they will be allowed to continue with authentication. allow is mutually exclusive with deny. z Only use allow or deny, not bothz Allowing %s�,N)r � ValueErrorr r( �joinr �update�r! r- r" r" r# �allow] s zAuthenticator.allowc G r. )z�Deny IP address(es). Addresses not explicitly denied will be allowed to continue with authentication. deny is mutually exclusive with allow. z"Only use a allow or deny, not bothz Denying %sr/ N)r r0 r r( r1 r r2 r3 r" r" r# �denyl s zAuthenticator.denyr �domainc C s |r|| j |< | j�d|� dS )z�Configure PLAIN authentication for a given domain. PLAIN authentication uses a plain-text password file. To cover all domains, use "*". You can modify the password file at any time; it is reloaded automatically. zConfigure plain: %sN�r r r( )r! r6 r r" r" r# �configure_plainx s z Authenticator.configure_plain�.�locationc C st | j �d||� |tkrd| _dS d| _z t|�| j|< W dS ty9 } z| j �d||� W Y d}~dS d}~ww )a Configure CURVE authentication for a given domain. CURVE authentication uses a directory that holds all public client certificates, i.e. their public keys. To cover all domains, use "*". You can add and remove certificates in that directory at any time. configure_curve must be called every time certificates are added or removed, in order to update the Authenticator's state To allow all client keys without checking, specify CURVE_ALLOW_ANY for the location. zConfigure curve: %s[%s]TFz&Failed to load CURVE certs from %s: %sN)r r( �CURVE_ALLOW_ANYr r r � Exception�error)r! r6 r: �er" r" r# �configure_curve� s ��z Authenticator.configure_curve�credentials_providerc C s. d| _ |dur|| j|< dS | j�d|� dS )a� Configure CURVE authentication for a given domain. CURVE authentication using a callback function validating the client public key according to a custom mechanism, e.g. checking the key against records in a db. credentials_provider is an object of a class which implements a callback method accepting two parameters (domain and key), e.g.:: class CredentialsProvider(object): def __init__(self): ...e.g. db connection def callback(self, domain, key): valid = ...lookup key and/or domain in db if valid: logging.info('Authorizing: {0}, {1}'.format(domain, key)) return True else: logging.warning('NOT Authorizing: {0}, {1}'.format(domain, key)) return False To cover all domains, use "*". FNz0None credentials_provider provided for domain:%s)r r r r= )r! r6 r@ r" r" r# �configure_curve_callback� s z&Authenticator.configure_curve_callback�client_public_keyc C s t �|��d�S )a� Return the User-Id corresponding to a CURVE client's public key Default implementation uses the z85-encoding of the public key. Override to define a custom mapping of public key : user-id This is only called on successful authentication. Parameters ---------- client_public_key: bytes The client public key used for the given message Returns ------- user_id: unicode The user ID as text �ascii)r �encode�decode)r! rB r" r" r# � curve_user_id� s zAuthenticator.curve_user_idc C s dS )z~Configure GSSAPI authentication Currently this is a no-op because there is nothing to configure with GSSAPI. Nr" )r! r6 r: r" r" r# �configure_gssapi� s z Authenticator.configure_gssapi�msgc � s� �t |�dk r'� j�d|� t |�dk r � j�d� dS � �|d dd� dS |dd� \}}}}}}|dd� }|�� jd �}|�� jd �}|tkr[� j�d |� � �|dd � dS � j�d ||||||� d } d } d} � jr�|� jv rd} � j�d|� n)d} d} � j�d|� n � j r�|� j v r�d} d} � j�d|� n d} � j�d|� d} | �sL|dkr�| s�� j�d� d} n�|dkr�t |�dkrֈ j�d|� � �|dd� dS � fd d �|D �\} } � � || | �\} } na|d k�r t |�dk�r� j�d |� � �|dd� dS |d }� � ||�I dH \} } | �r � � |�} n-|d!k�rLt |�dk�r;� j�d"|� � �|dd� dS |d }|�d#�} � � ||�\} } | �rY� �|d$d%| � dS � �|d| � dS )&zPerform ZAP authentication� z*Invalid ZAP message, not enough frames: %r� z Not enough information to replyr s 400s Not enough framesN�replacezInvalid ZAP version: %rs Invalid versionzQversion: %r, request_id: %r, domain: %r, address: %r, identity: %r, mechanism: %rFs NO ACCESSTzPASSED (allowed) address=%ss Address not allowedz DENIED (not allowed) address=%ss Address deniedzDENIED (denied) address=%sz PASSED (not denied) address=%s� anonymouss NULLzALLOWED (NULL)s PLAINz Invalid PLAIN credentials: %rs Invalid credentialsc 3 s � | ] }|� � jd �V qdS )rK N)rE r )�.0�cr) r" r# � <genexpr>$ s � �z3Authenticator.handle_zap_message.<locals>.<genexpr>s CURVEz Invalid CURVE credentials: %rr s GSSAPIz Invalid GSSAPI credentials: %r�utf8� 200� OK)�lenr r= �_send_zap_replyrE r �VERSIONr( r r �_authenticate_plain�_authenticate_curverF �_authenticate_gssapi)r! rH �version� request_idr6 �address�identityZ mechanismZ credentials�allowedZdenied�reason�username�password�key� principalr" r) r# �handle_zap_message� s� � � � � � z Authenticator.handle_zap_messager_ r` c C s� d}d}| j rE|s d}|| j v r)|| j | v r&|| j | | kr#d}nd}nd}nd}|r:| j�d|||� ||fS | j�d |� ||fS d }| j�d |� ||fS ) zPLAIN ZAP authenticationF� r Ts Invalid passwords Invalid usernames Invalid domainz1ALLOWED (PLAIN) domain=%s username=%s password=%sz DENIED %ss No passwords definedzDENIED (PLAIN) %sr7 )r! r6 r_ r` r] r^ r" r" r# rV C s2 � ��z!Authenticator._authenticate_plain� client_keyc � s( �d}d}| j rd}d}| j�d� ||fS | ji kr^|s d}|| jv rXt�|�}| j| �||�}t|t�r<|I dH }|rCd}d}nd}|rId nd }| j�d |||� ||fS d }||fS |sbd}|| j v r�t�|�}| j | � |�ryd}d}nd}|rd nd }| j�d |||� ||fS d }||fS )zCURVE ZAP authenticationFrd TrR z ALLOWED (CURVE allow any client)r Ns Unknown keyZALLOWEDZDENIEDz0%s (CURVE auth_callback) domain=%s client_key=%ss Unknown domainz"%s (CURVE) domain=%s client_key=%s) r r r( r r rD �callback� isinstancer r �get)r! r6 re r] r^ Zz85_client_key�r�statusr" r" r# rW i s` � 3 � � �� � �z!Authenticator._authenticate_curverb c C s | j �d||� dS )zPNothing to do for GSSAPI, which has already been handled by an external service.z'ALLOWED (GSSAPI) domain=%s principal=%s)TrR )r r( )r! r6 rb r" r" r# rX � s z"Authenticator._authenticate_gssapirL rZ � status_code� status_text�user_idc C s\ |dkr|nd}t |t�r|�| jd�}d}| j�d||� t|||||g}| j�|� dS )z.Send a ZAP reply to finish the authentication.rQ rd rK zZAP reply code=%s text=%sN) rg �strrD r r r( rU r Zsend_multipart)r! rZ rk rl rm �metadataZreplyr" r" r# rT � s z Authenticator._send_zap_reply)Nr N)r% N)r N)r r9 )rL ) �__name__� __module__� __qualname__�__doc__�__annotations__rn �boolr r r �bytesr r$ r* r, r4 r5 r8 r �os�PathLiker? rA rF rG r rc r rV rW rX rT r" r" r" r# r s� ��� � ��� ��� � � ��� �"��� �d��� �&�� � > ������r r; )rs r rw �typingr r r r r r r r r Z zmq.errorr Z zmq.utilsr r r r; rU r �__all__r" r" r" r# �<module> s ( ,
| ver. 1.4 |
Github
|
.
| PHP 8.2.30 | Generation time: 0 |
proxy
|
phpinfo
|
Settings