File manager - Edit - /opt/saltstack/salt/lib/python3.10/site-packages/salt/__pycache__/crypt.cpython-310.pyc
Back
o ;j/ � @ s� d Z ddlZddlZddlZddlZddlZddlZddlZddlZddl Z ddl Z ddl Z ddl Z ddl Z ddlZddlZddlZddlZddlZddlZddlZddlZddlZddlZddlZddlZddlZddl Zddl Zddl Zddl Zddl Zddl!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z' z"ddl(Z)ddl*m+Z+m,Z, ddl-m.Z.m/Z/ ddl0m1Z1m2Z2m3Z3 dZ4W n e5y� dZ4Y nw e�6e7�Z8d Z9d Z:d Z;d Z<e9� d e;� �Z=e9� d e<� �Z>e:� d e;� �Z?e:� d e<� �Z@e;e<fZAe:fZBe9fZCe=e>fZDe?e@fZEdd� ZFdd� ZGd5dd�ZHd6dd�ZIG dd� d�ZJG dd� deJ�ZKG dd � d eJ�ZLejMjNjOd d � �ZPd d � ZQd!d"� ZRde?fd#d$�ZSe?fd%d&�ZTd5d'd(�ZUd)d*� ZVd+d,� ZWG d-d.� d.eX�ZYG d/d0� d0�ZZG d1d2� d2eZ�Z[G d3d4� d4�Z\dS )7z� The crypt module manages all of the cryptography functions for minions and masters, encrypting and decrypting payloads, preparing messages, and authenticating peers � N)�AuthenticationError�InvalidKeyError� MasterExit�SaltClientError�SaltReqTimeoutError�UnsupportedAlgorithm)�hashes� serialization)�padding�rsa)�Cipher� algorithms�modesTF�OAEP�PKCS1v15�SHA1�SHA224�-c C s t r dd l} | jjjjjS dS )Nr F)�HAS_CRYPTOGRAPHYZ,cryptography.hazmat.backends.openssl.backendZhazmatZbackends�opensslZbackendZ _fips_enabled)� cryptography� r �>/opt/saltstack/salt/lib/python3.10/site-packages/salt/crypt.py� fips_enabled[ s r c C s d� | �� �� �S )zH Clean the key so that it only has unix style line endings (\n) � )�join�strip� splitlines)�keyr r r � clean_keyc � r c C sN t j�| d�}tjj�d��� t�d� t j� |�r(t�d� W d � dS t j� |�r?t � |t j �s?t � |t jt jB � tjj�|d�� }|�d� W d � n1 sWw Y t � |t j� |r�zddl}|�|�j}t �||d � W n tttfy� Y nw W d � dS W d � dS W d � dS 1 s�w Y dS ) zR Set an AES dropfile to request the master update the publish session key z.dfn� zRotating AES keyz"AES key rotation already requestedN�wb+� r ���)�os�pathr �salt�utils�files� set_umask�log�info�isfile�access�W_OK�chmod�stat�S_IRUSR�S_IWUSR�fopen�write�pwd�getpwnam�pw_uid�chown�KeyError� ImportError�OSError)Zcachedir�userZdfn�fp_r6 �uidr r r �dropfilej s6 � � ����"�r@ � c C s� t j�| |�}|� d�}|� d�}t�||�} t j�|�r |S t �| t j�s4td� t j� | �t � � ���t jj�d��L t jj�|d��4} |rZt�|�� �} tjj} t� rYtjj} nt�� } tjj} | jtjj | | d�} | � | � W d � n1 s{w Y W d � n1 s�w Y | � � }t jj�|d��} |j tjj tj j!d�} | � | � W d � n1 s�w Y t �"|d � |r�zd dl#}|�$|�j%}t �&||d � t �&||d � W |S t't(tfy� Y |S w |S ) a Generate a RSA public keypair for use with salt :param str keydir: The directory to write the keypair to :param str keyname: The type of salt server for whom this key should be written. (i.e. 'master' or 'minion') :param int keysize: The number of bits in the key :param str user: The user on the system who should own this keypair :param str passphrase: The passphrase which should be used to encrypt the private key :rtype: str :return: Path on the filesystem to the RSA private key �.pem�.pubz*Write access denied to "{}" for user "{}".r! r" ��encoding�format�encryption_algorithmN�rE rF � r r$ ))r% r& r r Zgenerate_private_keyr- r. r/ r< rF �abspath�getpassZgetuserr' r( r) r* r4 r ZBestAvailableEncryption�encode� PrivateFormat�TraditionalOpenSSLr ZPKCS8� NoEncryption� private_bytes�Encoding�PEMr5 � public_key� public_bytes� PublicFormat�SubjectPublicKeyInfor0 r6 r7 r8 r9 r: r; )ZkeydirZkeyname�keysizer= � passphrase�e�baseZpriv�pub�gen�f�enc�_format�pem�pubkeyr6 r? r r r �gen_keys� sh ���� �� �� � ��rb c @ s< e Zd Zedd� �Zedd� �Zedd� �Zedd� �Zd S ) �BaseKeyc C �F | t vr td| � ���| �dd�\}}|tvr td|� ���tt|�S )NzInvalid signing algorithm: r � �Invalid padding algorithm: )�VALID_SIGNING_ALGORITHMSr �split�VALID_PADDING_FOR_SIGNING�getattrr �� algorithmZ_pad�_hashr r r �parse_padding_for_signing� � z!BaseKey.parse_padding_for_signingc C rd )N� Invalid encryption algorithm: r re rf )�VALID_ENCRYPTION_ALGORITHMSr rh � VALID_PADDING_FOR_ENCRYPTIONrj r rk r r r � parse_padding_for_encryption� ro z$BaseKey.parse_padding_for_encryptionc C s@ d| vr t d| � ���| �dd�\}}|tvrtd��tt|�S )Nr rp re zInvalid hashing algorithm)r rh � VALID_HASHES� Exceptionrj r rk r r r � parse_hash� s zBaseKey.parse_hashc C s& t | v rt� rtd| � d���d S d S )Nz Algorithm z, uses SHA1 which is not allowed in FIPS mode)r r r �rl r r r � _enforce_fips� s ��zBaseKey._enforce_fipsN)�__name__� __module__� __qualname__� staticmethodrn rs rv rx r r r r rc � s rc c @ s6 e Zd Zd dd�Zdd� Zefdd�Zefdd �ZdS ) � PrivateKeyNc C s t ||�| _d S �N)� get_rsa_keyr )�selfr& rX r r r �__init__� s zPrivateKey.__init__c C s2 | j jtjjtjjt�� d�}tj j � |�� |�S )NrD ) r rP r rQ rR rM rN rO r' r( �rsax931Z RSAX931Signer�sign)r� �datar` r r r �encrypt� s �zPrivateKey.encryptc C s` | � |�}| �|�}| �|� z| j�tjj�|�|� |� �W S t j j y/ t d|� ���w )N�Unsupported algorithm: ) rn rv rx r r� r' r( � stringutils�to_bytesr � exceptionsr �r� r� rl �_paddingrm r r r r� s ��zPrivateKey.signc C sf | � |�}| �|�}| �|� z| j�||tj|� d�|� d d��W S tjj y2 t d|� ���w �Nrw )Zmgfrl Zlabelr� ) rs rv rx r �decryptr �MGF1r r� r r� r r r r� s ���zPrivateKey.decryptr~ ) ry rz r{ r� r� � PKCS1v15_SHA1r� � OAEP_SHA1r� r r r r r} � s r} c @ s4 e Zd Zdd� Zefdd�Zefdd�Zdd� Zd S ) � PublicKeyc C sl t jj�|d��$}z t�|�� �| _W n ty# } zt d��d }~ww W d � d S 1 s/w Y d S )N�rbz Invalid key) r' r( r) r4 r �load_pem_public_key�readr � ValueErrorr )r� r& �fp�excr r r r� s ���"�zPublicKey.__init__c C st | � |�}| �|�}| �|� tjj�|�}z| j�||t j |� d�|� d d��W S t j j y9 t d|� ���w r� )rs rv rx r' r( r� r� r r� r r� r r� r )r� r� rl r� rm Zbdatar r r r� ' s ���zPublicKey.encryptc C s� | � |�}| �|�}t|v rt� rdS z| j�tjj� |�tjj� |�|� |� � W dS t j j y7 Y dS t j j yB Y dS w )NFT)rn rv r r r �verifyr' r( r� r� r r� ZInvalidSignaturer )r� r� � signaturerl r� rm r r r r� 8 s" � ��zPublicKey.verifyc C s0 | j jtjjtjjd�}tjj � |�}|� |�S )NrH ) r rT r rQ rR rU rV r' r( r� ZRSAX931Verifierr� )r� r� r` Zverifierr r r r� M s � zPublicKey.decryptN) ry rz r{ r� r� r� r� r� r� r r r r r� s r� c C s� t �d� |r |�� }nd}tjj�| d��*}ztj|� � |d�W W d � S t y3 t d�� t j jy? t d��w 1 sCw Y dS )a� Load a private key from disk. `timestamp` above is intended to be the timestamp of the file's last modification. This fn is memoized so if it is called with the same path and timestamp (the file's last modified time) the second time the result is returned from the memoization. If the file gets modified then the params are different and the key is loaded from disk. z3salt.crypt._get_key_with_evict: Loading private keyNr� ��password� Encountered bad RSA public key�Unsupported key algorithm)r+ �debugrL r' r( r) r4 r �load_pem_private_keyr� r� r r r� r )r& � timestamprX r� r] r r r �_get_key_with_evictV s" �� ��r� c C s" t �d� t| ttj�| ��|�S )a= Read a private key off the disk. Poor man's simple cache in effect here, we memoize the result of calling _get_rsa_with_evict. This means the first time _get_key_with_evict is called with a path and a timestamp the result is cached. If the file (the private key) does not change then its timestamp will not change and the next time the result is returned from the cache. If the key DOES change the next time _get_rsa_with_evict is called it is called with different parameters and the fn is run fully to retrieve the key from disk. z+salt.crypt.get_rsa_key: Loading private key)r+ r� r� �strr% r& �getmtime)r& rX r r r r p s r c C s� t �d� z#tjj�| d��}t�|�� �W d � W S 1 s!w Y W dS t y3 t d�� t j j y? t d��w )z) Read a public key off the disk. z.salt.crypt.get_rsa_pub_key: Loading public keyr� Nr� r� )r+ r� r' r( r) r4 r r� r� r� r r r� r )r& r� r r r �get_rsa_pub_key s (� �r� c C s t | |��||�S )zS Use Crypto.Signature.PKCS1_v1_5 to sign a message. Returns the signature. )r} r� )Z privkey_path�messagerX rl r r r � sign_message� r r� c C s t �d� t| ��|||�S )zu Use Crypto.Signature.PKCS1_v1_5 to verify the signature on a message. Returns True for valid signature. z/salt.crypt.verify_signature: Loading public key)r+ r� r� r� )� pubkey_pathr� r� rl r r r �verify_signature� s r� c C s� t jj�|��}t|�� �}W d � n1 sw Y t| ||�}t�|�}t j � |�r0dS t � dt j �|�t j �| �� t j � |�rMt � d|� dS t jj�|d��}|�t jj�|�� W d � n1 sjw Y t � d|� dS )zp creates a signature for the given public-key with the given private key and writes it to sign_path NFz$Calculating signature for %s with %szFSignature file %s already exists, please remove it first and try againr" zWrote signature to %sT)r' r( r) r4 r r� r� �binascii� b2a_base64r% r& r- r+ Ztrace�basenamer5 r� r� ) Z priv_path�pub_pathZ sign_pathrX r> Zmpub_64Zmpub_sigZ mpub_sig_64Zsig_fr r r � gen_signature� s. � � �� � r� c C s | � |�S )a Generate an M2Crypto-compatible signature :param Crypto.PublicKey.RSA._RSAobj key: The RSA key object :param str message: The message to sign :rtype: str :return: The signature, or an empty string if the signature operation failed )r� )r r� r r r �private_encrypt� s r� c C s0 t j| �� d d�}|�|t�� �}tjj� |�S )Nr� ) r r� rL r� r r r' r( r� Z to_unicode)Zrsa_keyZpwdatar r� r r r �pwdata_decrypt� s �r� c s\ e Zd ZdZ� fdd�Zdd� Zdd� Zdd d �Zdd d �Zdd� Z dd� Z dd� Z � Z S )� MasterKeysz� The Master Keys class is used to manage the RSA public key pair used for authentication by the master. It also generates a signing key-pair if enabled with master_sign_key_name. c s� t � �� || _tj�| jd d�| _tj�| jd d�| _tj j � | jd | j�}| j |d�| _ d | _|d r�|d r�tj�| jd |d �| _tj�| j�r�tj j�| j��}t|�� �| _W d � n1 sjw Y t�d tj�| j�| jd � d S t�d | j� t�d � t�d � d S tj j � | jd | j�}tj�| jd |d d �| _tj�| jd |d d �| _ | j |d d�| _ d S d S )N�pki_dirz master.pubz master.pem�key_pass)rX Zmaster_sign_pubkeyZmaster_use_pubkey_signatureZmaster_pubkey_signaturezRead %s's signature from %szmSigning the master.pub key with a signature is enabled but no signature file found at the defined location %szgThe signature-file may be either named differently or has to be created with 'salt-key --gen-signature're Zsigning_key_pass�master_sign_key_namerC rB )�name) �superr� �optsr% r& r r� �rsa_pathr' r( ZsdbZsdb_get�_MasterKeys__get_keysr � pub_signatureZsig_pathr- r) r4 r r� r+ r, r� �error�sys�exit� pub_sign_path� rsa_sign_pathZsign_key)r� r� r� r> �� __class__r r r� � sP � � ��� ����zMasterKeys.__init__c C s | � |d � d S �Nr� )r� )r� �stater r r � __setstate__ s zMasterKeys.__setstate__c C s d| j iS r� )r� �r� r r r � __getstate__ s zMasterKeys.__getstate__�masterNc C sN t j�| jd |d �}t j�|�s.t�d|| jd � t| jd || jd | j�d�|� zt ||�}W n_ t yM } z d|� d�}W Y d}~nUd}~w t yd } z d|� d �}W Y d}~n>d}~w t y{ } z d|� d �}W Y d}~n'd}~w t jjy� } z d|� d�}W Y d}~nd}~ww t�d ||� |S t�|� t|��) z? Returns a key object for a key in the pki-dir r� rB zGenerating %s keys: %srW r= zUnable to read key: z$; key contains unsupported algorithmNz; file may be corruptz ; passphrase may be incorrectzLoaded %s key: %s)r% r& r r� �existsr+ r, rb �getr} r r� � TypeErrorr r� r r� r� r )r� r� rX r& r rY r� r r r Z __get_keys s: ������ zMasterKeys.__get_keysc C s� t j�| jd |d �}t j�|�s=| j�� }tjj � |d��}|� |j t jjt jjd�� W d � n1 s8w Y tjj � |��}t|�� �W d � S 1 sUw Y dS )z_ Return the string representation of a public key in the pki-directory r� rC r" rH N)r% r& r r� r- r rS r' r( r) r4 r5 rT r rQ rR rU rV r r� )r� r� r& ra r] Zrfhr r r � get_pub_str8 s �� � $�zMasterKeys.get_pub_strc C � | j | jfS r~ )r� r� r� r r r �get_mkey_pathsJ � zMasterKeys.get_mkey_pathsc C r� r~ )r� r� r� r r r �get_sign_pathsM r� zMasterKeys.get_sign_pathsc C � | j S )z� returns the base64 encoded signature from the signature file or None if the master has its own signing keys )r� r� r r r �pubkey_signatureP s zMasterKeys.pubkey_signature)r� N)r� ) ry rz r{ �__doc__r� r� r� r� r� r� r� r� � __classcell__r r r� r r� � s ; r� c @ sH e Zd ZdZe�� Zi ZdZe dd� �Z e dd� �Z d=dd �Z e d=d d ��Z d=d d �Zd=dd�Zdd� Zedd� �Zedd� �Zedd� �Zedd� �Zdd� Zd=d d �Zejjjj d d � �Z ejjjj d>d#d$��Z d%d&� Z d'd(� Z ej!j"j#d)d*� �Z$d+d,� Z%d-d.� Z&d?d/d0�Z'd1d2� Z(d3d4� Z)d5d6� Z*d?d7d8�Z+d?d9d:�Z,d;d<� Z-dS )@� AsyncAuthzP Set up an Async object to maintain authentication with the salt master Fc C s, | j sttd�s d S tj| jd� d| _ d S )N�register_at_fork)�after_in_childT)�_atfork_registered�hasattrr% r� �_after_fork_in_child��clsr r r �_register_atforkf s zAsyncAuth._register_atforkc C �& zt �� | _W d S ty Y d S w r~ )�weakref�WeakKeyDictionary� instance_mapru r� r r r r� t s �z AsyncAuth._after_fork_in_childNc C s� | � � |p tjjjj�� }|tjvrt � � tj|< tj| }| � |�}|� |�}|du rEt �d|� t�| �}|j||d� |||< |S t �d|� |S )zC Only create one instance of AsyncAuth per __key() Nz!Initializing new AsyncAuth for %s��io_loopzRe-using AsyncAuth for %s)r� r' �ext�tornado�ioloop�IOLoop�currentr� r� r� �WeakValueDictionary�_AsyncAuth__keyr� r+ r� �object�__new__�__singleton_init__)r� r� r� Zloop_instance_mapr �authr r r r� | s �zAsyncAuth.__new__c C sJ t j�|d d�}d}t j�|�rtt j�|��}|d |d |d |fS )Nr� � minion.pem�0�id� master_uri)r% r& r r� r� r� )r� r� r� ZkeypathZkeytimer r r �__key� s �zAsyncAuth.__keyc C s d S r~ r �r� r� r� r r r r� � s zAsyncAuth.__init__c C s || _ tjj�t�� �| _tj � | j d d�| _ tj � | j d d�| _ d| _ | j d dkr1d| _nd| _tj �| j �s?| �� |pHtjjjj�� | _| �| j �}|tjv rtj| }|| _t| j |d �| _t| j |d �| _ tjjj � � | _ | j � d � dS | �!� dS ) �� Init an Auth instance :param dict opts: Options for this server :return: Auth instance :rtype: Auth r� � minion.pubr� N�__roleZsyndic�syndic_master.pub�minion_master.pub�aes�sessionT)"r� r' r( r� r� � Crypticle�generate_key_string�tokenr% r& r r� r� � _private_key�mpubr- �get_keysr� r� r� r� r� r� r� r� � creds_map�_creds� _crypticle�_session_crypticle� concurrent�Future�_authenticate_future� set_result� authenticate)r� r� r� r �credsr r r r� � s( z AsyncAuth.__singleton_init__c C s\ | j }|�|t�| j|��}||t| �< | jD ]}|dv r qt||t�| j| |�� q|S �Nr� )r� r� �copy�deepcopyr� r� �__dict__�setattr)r� �memor� �resultr r r r � __deepcopy__� s zAsyncAuth.__deepcopy__c C r� r~ )r r� r r r �session_crypticle� � zAsyncAuth.session_crypticlec C r� r~ )r r� r r r r � r zAsyncAuth.credsc C r� r~ )r r� r r r � crypticle� r zAsyncAuth.crypticlec C s" t | d�o| j�� o| j�� d u S )Nr )r� r �done� exceptionr� r r r � authenticated� s � �zAsyncAuth.authenticatedc C s4 | j r| `| �| j�}|tjv rtj|= d S d S d S r~ )r r r� r� r� r )r� r r r r � invalidate� s �zAsyncAuth.invalidatec sb t �d�r�j�� s�j}ntjjj�� }|�_�j� �j � � dur/� �fdd�}|� |� |S )z� Ask for this client to reconnect to the origin This function will de-dupe all calls here and return a *single* future for the sign-in-- whis way callers can all assume there aren't others r Nc s | � � }�j�� |� d S r~ )r r� � add_callback)�future�response��callbackr� r r � handle_future s z-AsyncAuth.authenticate.<locals>.handle_future) r� r r r' r� r� r r r� r � _authenticateZadd_done_callback)r� r r r r r r r � s �� zAsyncAuth.authenticatec c s� � | j d }| j d }|s|}d}tjjjj| j d| jd����}d} z | j|d�V }W n ty@ } z|}W Y d}~nfd}~ww |dkr�| j � d �du rRtd �}nP| j � d �rm| j � d d�rdtd �}n>t d � t � d� |r~t �d|� tjjj�|�V ||k r�||7 }t �d|� q"|dkr�t �d� n |dkr�t �d� n t|t�r�d|vr�| j � d �du r�td�}z tj| �| j �= W n ty� Y nw |s�td�}| j� |� n�| �| j �}d\}} } |tjvr�d}t �d| � n$| j d |d k�rd} t �d| � | j d |d k�rd} t �d | � |�s | �s | �r8|tj|< || _ t | j |d �| _ t | j |d �| _ | j�!d� | j � d �du �r�tj"j#j$| j � d �| j d | jd ��5} z| �%||d!�tj"j#j&d"d#d$��V W n t'�y� } z t �d%|� W Y d}~nd}~ww W d � n!1 �s�w Y W d � dS W d � dS W d � dS W d � dS 1 �s�w Y dS )&�] Authenticate with the master, this method breaks the functional paradigm, it will update the master information from a fresh sign in, signing in can occur as often as needed to keep up with the revolving master AES key. :rtype: Crypticle :returns: A crypticle used for encryption operations �acceptance_wait_time�acceptance_wait_time_maxN�clear��cryptr� T��channel�retry� detect_modezDetect mode is on�caller� local_masters�PMinion failed to authenticate with the master, has the minion key been accepted?� � Waiting %s seconds before retry.� Authentication wait time is %s� bad enc algozyThis minion is using a encryption algorithm that is not supported by it's Master. Please check your minion configutation.� bad sig algozvThis minion is using a signing algorithm that is not supported by it's Master. Please check your minion configutation.r� z -|RETRY|-z3Attempt to authenticate with the salt master failed�FFF�%s Got new master aes key.�$%s The master's aes key has changed.r� �(%s The master's session key has changed.Z auth_eventsr� F)r� �listenr� )r r r� r )�prefix�suffixz!Error firing auth creds event: %s)(r� r' r' �client�AsyncReqChannel�factoryr� �sign_inr r� �printr� r� r+ r, r� r� r\ �sleepr� r� � isinstance�dictr� r r� r: r Z set_exceptionr r� r r r r( �eventZ get_eventZfire_event_asyncZtagifyru ) r� r! r" r r' r� r� r �new_aes� changed_aes�changed_sessionrA r r r r s� � � �� �� ���� �� � � ���� ��A�Y�Z$�zAsyncAuth._authenticate�< Tre c c s4 � | j �dd�}|dur|}| j �dd�}|dur|}| j �dd�}|dur(|}d}|s;d}tjjjj| j d| jd�}| �� } zDz |j | ||d �V } W n0 t y{ } z$|rct � d | � tj jj�d ��| j �d �du rstj jj�d ��td ��d} ~ ww W |r�|�� n|r�|�� w w | �| | �} tj jj�| ��)� Send a sign in request to the master, sets the key information and returns a dict containing the master publish interface to bind to and the decrypted aes key for transport decryption. :param int timeout: Number of seconds to wait before timing out the sign-in request :param bool safe: If True, do not raise an exception on timeout. Retry instead. :param int tries: The number of times to try to authenticate before giving up. :raises SaltReqTimeoutError: If the sign-in request has timed out and :param safe: is not set :return: Return a string on failure indicating the reason for failure. On success, return a dictionary with the publication port and the shared AES key. � auth_timeoutN� auth_safemode� auth_triesFTr# r$ ��tries�timeout�SaltReqTimeoutError: %sr( r) �FAttempt to authenticate with the salt master failed with timeout error)r� r� r' r' r9 r: r; r� �minion_sign_in_payload�sendr r+ �warningr� r� r\ ZReturnr �close�handle_signin_response) r� rL �saferK r' rG rH rI � close_channel�sign_in_payload�payloadrY �retr r r r< � sN � � ���� �� � zAsyncAuth.sign_inc C s� i }t j�| jd | j�}| jd |d< t|t�r d|vr%t�d|� dS t|d t�rRd|d v rR|d d dkrBt�d|� dS |d d dkrRt�d|� dS |d }|d }t j � |�}d |v r�| j |d |v d �|d < |d s�t� dt jj|� td��| �� }|�|d | jd �|d< t j�| jd | j�}t j�|�r�t|||| jd d�s�t� d� td��|d |d kr�t� d� td��d|v �r|d s�| jd r�t�d� dS t� d � t�t�d d �� t�t jj j � n|d d kr�d S t�d | jd! � dS | j� d"d��r3| j� d#| j� d$d��} | �r2t j j j!|| jd% d&�| k�r2| �"| |� n#| j� d$d��rVt j j j!|| jd% d&�| jd$ k�rV| �"| jd$ |� |d' |d'< |S )(Nr� r� �loadzSign-in attempt failed: %sFrX r0 r1 �sig�pub_keyr� �� master_pubr� a6 The Salt Master server's public key did not authenticate! The master may need to be updated if it is a version of Salt lower than %s, or If you are confident that you are connecting to a valid Salt Master, then remove the master public key and restart the Salt Minion. The master public key can be found at: %szInvalid master keyr� rG �signing_algorithmrw z'The payload signature did not validate.zInvalid signature�noncez#The payload nonce did not validate.z Invalid nonceZrejected_retryz�The Salt Master has rejected this minion's public key. To repair this issue, delete the public key for this minion on the Salt Master. The Salt Minion will attempt to re-authenicate.r( z�The Salt Master has rejected this minion's public key! To repair this issue, delete the public key for this minion on the Salt Master and restart this minion. Or restart the Salt Master in open mode to clean out the keys. The Salt Minion will now exit.� � �fullz�The Salt Master has cached the public key for this node, this salt minion will wait for %s seconds before attempting to re-authenticater! � syndic_master� syndic_fingerZ master_finger� hash_type�Zsum_typeZ publish_port)#r% r& r r� r� r? r@ r+ r� r' rW �loads� verify_master�critical�version� __version__r r� r� r� r� �timer> �random�randintr� r� �defaultsZ exitcodes� EX_NOPERMr� r( r% � pem_finger� _finger_fail) r� rV rW r� �m_pub_fnZclear_signed_dataZclear_signaturer Zmaster_pubkey_pathrd r r r rS � s� �� �� �� �� �� � �� z AsyncAuth.handle_signin_responsec C s� | j du r?| j�dd�}tjj�| jd |� tj� | j �s8t � d| jd � t | jd d| jd | j�d�� t| j d�| _ | j S )z� Return keypair object for the minion. :rtype: Crypto.PublicKey.RSA._RSAobj :return: The RSA keypair Nr= �rootr� zGenerating keys: %sZminionrW )r� r� r� r' r( r� Zcheck_path_traversalr% r& r� r� r+ r, rb r} )r� r= r r r r� . s �zAsyncAuth.get_keysc C s t ||�S r~ )r� )r� r r� r r r � _gen_tokenE s zAsyncAuth._gen_tokenc C s | � | �� |�S )z� Encrypt a string with the minion private key to verify identity with the master. :param str clear_tok: A plaintext token to encrypt :return: Encrypted token :rtype: str )ru r� )r� Z clear_tokr r r � gen_tokenI s zAsyncAuth.gen_tokenc C sL i }d|d< | j d |d< t�� j|d< | j d |d< | j d |d< d | j v r@i }| j d D ] }| j d �|d �||< q.||d < z tj�| j d | j�}t |�}|� | j | j d �|d < W n% t yk t �d� Y n ty� } z t �d|� W Y d }~nd }~ww tjj�| j��}t|�� �|d< W d � |S 1 s�w Y |S )a Generates the payload used to authenticate with the master server. This payload consists of the passed in id_ and the ssh public key to encrypt the AES key sent back from the master. :return: Payload dictionary :rtype: dict Z_auth�cmdr� r_ rG Zenc_algor^ Zsig_algo�autosign_grainsZgrainsNr� r� zMaster public key not foundz#Exception while encrypting token %sr[ )r� �uuidZuuid4�hexr� r% r& r r� r� r� r� �FileNotFoundErrorr+ r� ru r' r( r) r4 r� r r� )r� rW rx Zgrainr� r[ r� r] r r r rO T s: � �� ��z AsyncAuth.minion_sign_in_payloadc C s, | j �dd�rt�dd�t�� �� nt�d� | �� }|� |d | j d �}d|v rit j �| j d | j �}t j � |�rhzt|�}W n tyL Y d S w t�|��� }tjj�|�}|� |d �}||krhd S nd S tjj�|�}d |v r{|�d �S d |v r�|� |d | j d �} || fS |s�|dfS d S ) af This function is used to decrypt the AES seed phrase returned from the master server. The seed phrase is decrypted with the SSH RSA host key. Pass in the encrypted AES key. Returns the decrypted AES seed key, a string :param dict payload: The incoming payload. This is a dictionary which may have the following keys: 'aes': The shared AES key 'enc': The format of the message. ('clear', 'pub', etc) 'sig': The message signature 'publish_port': The TCP port which published the message 'token': The encrypted token used to verify the message. 'pub_key': The public key of the sender. :rtype: str :return: The decrypted token that was provided, with padding. :rtype: str :return: The decrypted AES seed key Zauth_trbFzAuth Called: %s� z%Decrypting the current master AES keyr� rG rZ r� )r| r| z_|-r� )r� r� r+ rQ r � traceback� format_stackr� r� r� r% r& r� r� r� ru �hashlib�sha256� hexdigestr' r( r� r� Zto_strrh ) r� rW r] r Zkey_strZm_pathZmkey�digestZm_digestr� r r r � decrypt_aesv s: �� zAsyncAuth.decrypt_aesc C s� | j d rKtj�| j d | j d d �}tj�|�r)t||t�|�| j d d�}n t� dtj� |�� dS |rDt� d| j d d � d S t� d � dS t� d � dS ) z� Wraps the verify_signature method so we have additional checks. :rtype: bool :return: Success or failure of public key verification r� r� rC r^ rw zkVerification public key %s does not exist. You need to copy it from the master to the minions pki directoryFzTSuccessfully verified signature of master public key with verification public key %sTz(Failed to verify signature of public keyz�Failed to verify the signature of the message because the verification key-pairs name is not defined. Please make sure that master_sign_key_name is defined.) r� r% r& r r- r� r� � a2b_base64r+ r� r� r� )r� r� rZ r& �resr r r �verify_pubkey_sig� s8 � � � � �zAsyncAuth.verify_pubkey_sigc C s� za| � |d |d �rVt�d| jd � tj�| jd | j�}tj j � | j� dd ��}tj j j|d|d��}|�tj j�|d �� W d � W d S 1 sNw Y W d S t�d | jd � W d S tyv } z t�d � t|��d }~ww ) Nr[ �pub_sigz9Received signed and verified master pubkey from master %sr� r� r= r" )r? TzLReceived signed public-key from master %s but signature verification failed!FzCThere was an error while verifying the masters public-key signature)r� r+ r, r� r% r& r r� r' r( r= Zget_uidr� r) Zfpopenr5 r� r� r� ru )r� rW rs r? ZwfhZsign_excr r r �verify_signing_master� s4 � ������z AsyncAuth.verify_signing_masterc C st d|v r | j d r dS d|vr| j d sdS d|v r&| j d s&t�d� dS d|vr6| j d r8t�d� dS dS dS )a% Checks if both master and minion either sign (master) and verify (minion). If one side does not, it should fail. :param dict payload: The incoming payload. This is a dictionary which may have the following keys: 'aes': The shared AES key 'enc': The format of the message. ('clear', 'pub', 'aes') 'publish_port': The TCP port which published the message 'token': The encrypted token used to verify the message. 'pub_key': The RSA public key of the sender. r� �verify_master_pubkey_signTz�The masters sent its public-key signature, but signature verification is not enabled on the minion. Either enable signature verification on the minion or disable signing the public key on the master!Fz�The master did not send its public-key signature, but signature verification is enabled on the minion. Either disable signature verification on the minion or enable signing the public on the master!N)r� r+ r� )r� rW r r r �check_auth_deps� s ���zAsyncAuth.check_auth_depsc C sh |r*z| � ||�\}}|| jkrt�d� W dS W |S ty) t�d� Y dS w | � ||�\}}|S )ag Return the AES key received from the master after the minion has been successfully authenticated. :param dict payload: The incoming payload. This is a dictionary which may have the following keys: 'aes': The shared AES key 'enc': The format of the message. ('clear', 'pub', etc) 'publish_port': The TCP port which published the message 'token': The encrypted token used to verify the message. 'pub_key': The RSA public key of the sender. :rtype: str :return: The shared AES key received from the master. z4The master failed to decrypt the random minion tokenr| )r� r� r+ r� ru )r� rW r] r� r� r r r � extract_aes s � � �zAsyncAuth.extract_aesc C s� t j�| jd | j�}t j�|�}t|d �}|r�|r�| jd s�tjj � |��}t|� � �}W d � n1 s8w Y ||krb| � |�sHdS | jd r[| � |�rY| j|dd�S dS t�d � dS | � |�sidS | jd r�| � |�rx| �|�S t�d | jd d � dS | �|�S | � |�s�dS | jd r�| � |�r�| j|dd�S dS |s�tjj � |d��}|�tjj�|�� W d � n1 s�w Y | j|dd�S )a Verify that the master is the same one that was previously accepted. :param dict payload: The incoming payload. This is a dictionary which may have the following keys: 'aes': The shared AES key 'enc': The format of the message. ('clear', 'pub', etc) 'publish_port': The TCP port which published the message 'token': The encrypted token used to verify the message. 'pub_key': The RSA public key of the sender. :param bool master_pub: Operate as if minion had no master pubkey when it sent auth request, i.e. don't verify the minion signature :rtype: str :return: An empty string on verification failure. On success, the decrypted AES message in the payload. r� r[ Z open_modeNr| r� Fr\ zfThe master key has changed, the salt master could have been subverted, verify salt master's public keyZalways_verify_signaturezSThe masters public could not be verified. Is the verification pubkey %s up to date?r� rC r" )r% r& r r� r� r- r r' r( r) r4 r� r� r� r� r+ r� r5 r� r� )r� rW r] rs Z m_pub_existsZpayload_pub_keyr> Zlocal_master_pubr r r rh 8 sP � � � �zAsyncAuth.verify_masterc C s0 t �d|tjjj|| jd d�� t�d� d S )Na The specified fingerprint in the master configuration file: %s Does not match the authenticating master's key: %s Verify that the configured fingerprint matches the fingerprint of the correct master and that this minion is not subject to a man-in-the-middle attack.re rf �* ) r+ ri r' r( r% rq r� r� r� )r� ZfingerZ master_keyr r r rr � s � zAsyncAuth._finger_failr~ �rE Tre N)T).ry rz r{ r� r� r� r� r r� � classmethodr� r� r� r� r� r� r �propertyr r r r r r r' r� r� r\ � coroutiner r< rS r� r( � decorators�memoizeru rv rO r� r� r� r� r� rh rr r r r r r� X sT ! x 5s "9- & Vr� c s� e Zd ZdZe�� ZdZedd� �Z ddd�Z eddd ��Z d� fd d � Z dd d �Z edd� �Zedd� �Zddd�Zddd�Z� ZS )�SAuthzJ Set up an object to maintain authentication with the salt master Fc C r� r~ )r� r� � instancesru r� r r r r� � s �zSAuth._after_fork_in_childNc C sd | � � | �|�}tj�|�}|du r*t�d|� t�| �}|� |� |tj|< |S t�d|� |S )z? Only create one instance of SAuth per __key() Nz Initializing new SAuth for %szRe-using SAuth for %s) r� � _SAuth__keyr� r� r� r+ r� r� r� r� )r� r� r� r r� r r r r� � s �z SAuth.__new__c C s |d |d |d fS )Nr� r� r� r )r� r� r� r r r r� � s �z SAuth.__keyc s t � j||d� d S r )r� r� r� r� r r r� � s zSAuth.__init__c C s� || _ tjj�t�� �| _tj � | j d d�| _ tj � | j d d�| _ d| _ d| _d| j v r2d| _n d| j v r;d| _nd | _tj �| j �sK| �� dS dS ) r� r� r� r� Nrc r� Z alert_masterzmonitor_master.pubr� )r� r' r( r� r� r� r� r� r% r& r r� r� r� r r� r- r� r� r r r r� � s �zSAuth.__singleton_init__c C � t | d�s | �� | jS )Nr )r� r r r� r r r r � � z SAuth.credsc C r� )Nr )r� r r r� r r r r � r� zSAuth.crypticlec C s� | j d }| j d }|s|}tjjjj| j dd���} | j|d�}|dkr\| j �d�r@| j �d d �r7td �}n&t d � t � d � |rMt � d |� t�|� ||k r[||7 }t �d|� q d\}}} | jd u rpd}t �d| � n"| jd |d kr�d}t �d| � | jd |d kr�d} t �d| � |s�|s�| r�|| _t| j |d �| _t| j |d �| _W d � d S W d � d S 1 s�w Y d S )r r! r" r# �r% Tr& r( r* r+ Nr, r- r. r/ r2 r3 r� r4 r� r5 )r� r' r' r9 � ReqChannelr; r< r� r r= r� r� r+ r, rl r> r� r r� r� r r ) r� �_r! r" r' r r� rB rC rD r r r r � sd � �� � � �-"�zSAuth.authenticaterE Tre c C s4 i }| j �dd�}|dur|}| j �dd�}|dur |}| j �dd�}|dur)|}tj�| j d | j�} | j d |d< d} |sLd} tjjj j | j d d �}| � � } z;z |j | ||d �} W n( t y� } z |r{t�d | � W Y d} ~ W | ry|�� d S d S td��d} ~ ww W | r�|�� n| r�|�� w w | �| | �S )rF rG NrH rI r� r� FTr# r� rJ rM r( rN )r� r� r% r& r r� r' r' r9 r� r; rO rP r r+ rQ rR r rS )r� rL rT rK r' r� rG rH rI rs rU rV rW rY r r r r< / sN ������ �� � z SAuth.sign_inr~ r� )ry rz r{ r� r� r� r� r� r� r� r� r� r� r� r� r r r r< r� r r r� r r� � s" @r� c @ s� e Zd ZdZdZdZe�� jZ ddd�Z e ddd ��Z e dd d ��Z e d d � �Ze dd� �Zdd� Zdd� Zd dd�Zd dd�ZdS ) r� zn Authenticated encryption class Encryption algorithm: AES-CBC Signing algorithm: HMAC-SHA256 s pickle::� � r c C s& || _ | �| j |�| _|| _|| _d S r~ )� key_string� extract_keys�keys�key_size�serial)r� r� r� r� r� r r r r� q s zCrypticle.__init__c C s4 t �|d | j �}t�|�}|�d�}|�dd�S )N� zutf-8r r| )r% �urandom�SIG_SIZE�base64� b64encode�decode�replace)r� r� r Zb64keyr r r r� w s z Crypticle.generate_key_stringc C s� t �|�j}tjj�d��= tj|dd�\}}t � |� tjj� |d��}|� | � |�� W d � n1 s7w Y t �||� W d � d S 1 sMw Y d S )N� r� )�dirr7 �w)�pathlib�Path�parentr' r( r) r* �tempfileZmkstempr% rR r4 r5 r� �rename)r� r& r� � directory�fd�tmpr� r r r � write_key s �"�zCrypticle.write_keyc C sV z t jj�|d�� }|�� W d � W S 1 sw Y W d S ty* Y d S w )N�r)r' r( r) r4 r� r{ )r� r& r� r r r �read_key� s (� �zCrypticle.read_keyc C sR t jj�t�|��}t|�|d | j ksJ d��|d | j � || j d � fS )Nr� z invalid key)r' r( r� r� r� � b64decode�lenr� )r� r� r� r r r r r� � s zCrypticle.extract_keysc C s� | j \}}| jt|�| j }|tjj�|t|� � }t� | j�}t t � |�t �|��}|�� }|�|�}||�� 7 }|| }t�||tj��� } || S )zH encrypt data with AES-CBC and sign it with HMAC-SHA256 )r� �AES_BLOCK_SIZEr� r' r( r� r� �chrr% r� r r �AESr �CBC� encryptor�update�finalize�hmac�newr r� r� ) r� r� �aes_key�hmac_key�pad�iv_bytes�cipherr� ZencrrZ r r r r� � s zCrypticle.encryptc C s | j \}}|| j d� }|d| j � }t|t�s!tjj�|�}t� ||t j �� � }t |�t |�kr<t�d� td��d}t||�D ] \}}|||A O }qC|dkr[t�d� td��|d| j� } || jd� }tt�|�t�| ��} | �� } | �|�| �� }|d|d � S )zL verify HMAC-SHA256 signature and decrypt data with AES-CBC Nz Failed to authenticate messagez message authentication failedr r$ )r� r� r? �bytesr' r( r� r� r� r� r r� r� r� r+ r� r �zipr� r r r� r r� � decryptorr� r� ) r� r� r� r� rZ Z mac_bytesr Zzipped_xZzipped_yr� r� r� r r r r� � s* zCrypticle.decryptNc C s< |r| j |�� tj�|� }n | j tj�|� }| �|�S )z7 Serialize and encrypt a python object )� PICKLE_PADrL r' rW �dumpsr� )r� �objr_ Z toencryptr r r r� � s zCrypticle.dumpsFc C s� | � |�}|�| j�s i S |t| j�d� }|r.|dd� �� }|dd� }||kr.td��tjj||d�}t |t �rVd|v rV|� d�}|| j krSt �d|| j � i S || _ |S )z: Decrypt and un-serialize a python object N� zNonce verification error)�rawr� zvA message with an invalid serial was received. this serial: %d last serial: %d The minion will not honor this request.)r� � startswithr� r� r� r r' rW rg r? r@ �popr� r+ ri )r� r� r� r_ Z ret_noncerW r� r r r rg � s, �zCrypticle.loads)r� r )r� r~ )FN)ry rz r{ r� r� r� r r� � digest_sizer� r� r� r� r� r� r� r� r� r� rg r r r r r� e s$ r� r~ )NNrA )]r� r� r� r rK r r� �loggingr% r� rm r1 r� r� rl r} ry r� Zsalt.channel.clientr' Zsalt.defaults.exitcodesZsalt.ext.tornado.genZ salt.payloadZsalt.utils.cryptZsalt.utils.decoratorsZsalt.utils.eventZsalt.utils.filesZsalt.utils.rsax931Zsalt.utils.sdbZsalt.utils.stringutilsZsalt.utils.userZsalt.utils.verifyZ salt.versionZsalt.exceptionsr r r r r r Zcryptography.exceptionsr Z cryptography.hazmat.primitivesr r Z)cryptography.hazmat.primitives.asymmetricr r Z&cryptography.hazmat.primitives.ciphersr r r r r; � getLoggerry r+ r r r r r� Z OAEP_SHA224r� ZPKCS1v15_SHA224rt ri rr rq rg r r r@ rb rc r} r� r( r� r� r� r r� r� r� r� r� r� r@ r� r� r� r� r r r r �<module> s� � ��� H))7 J J
| ver. 1.4 |
Github
|
.
| PHP 8.2.30 | Generation time: 0 |
proxy
|
phpinfo
|
Settings