File manager - Edit - /opt/saltstack/salt/lib/python3.10/site-packages/salt/channel/__pycache__/server.cpython-310.pyc
Back
o ;jZ� � @ s� d Z ddlZddlZddlZddlZddlZddlZddlZddlZ ddl Z ddl Z ddl Z ddl Z ddlZ ddlZ ddlZ ddlZ ddlZ ddlZ ddlZ ddlmZmZ ddlmZ e�e�Z G dd� d�Z G dd� d�Z dS ) z� Encapsulate the different transports available to Salt. This includes server side transport, for the ReqServer and the Publisher � N)�SaltDeserializationError�UnsupportedAlgorithm)�CacheClic @ s� e Zd ZdZedd� �Zedd� �Zdd� Zdd � Zd d � Z d d � Z e j j jjdd� �Zdde jje jjfdd�Zdd� Zdd� Zdd� Zd"dd�Zd#d d �Zd d!� ZdS )$�ReqServerChannelzK ReqServerChannel handles request/reply messages from ReqChannels. c K s: d|vrd|v r|d |d< t jj|fi |��}| ||�S )N� master_uri)�salt� transportZrequest_server)�cls�opts�kwargsr � r �G/opt/saltstack/salt/lib/python3.10/site-packages/salt/channel/server.py�factory& s zReqServerChannel.factoryc C s t j�|�t j�|�kS )z� Normalize and compare two keys Returns: bool: ``True`` if the keys match, otherwise ``False`` )r �cryptZ clean_key)r Zkey1Zkey2r r r � compare_keys- s z ReqServerChannel.compare_keysc C s> || _ || _d | _d | _t�| j d �d jdd� i | _d S )N�cachedir�sessionsT)�exist_ok)r r �event� master_key�pathlib�Path�mkdirr )�selfr r r r r �__init__7 s zReqServerChannel.__init__c C s� t � � }|| jv r || j| d | jd k r | j| d S t�| jd �d | }z||�� j | jd kr>tjj � |� W n t yO tjj � |� Y nw |�� jtjj � |�f| j|< | j| d S )z@ Returns a session key for the given minion id. r Zpublish_session� r r ) �timer r r r �stat�st_mtimer r � CrypticleZ write_key�FileNotFoundErrorZread_key)r Zminion�now�pathr r r � session_key@ s � � �z ReqServerChannel.session_keyc C s t | jd�r| j�|� dS dS )z� Do anything necessary pre-fork. Since this is on the master side this will primarily be bind and listen (or the equivalent for your network library) �pre_forkN)�hasattrr r$ )r �process_managerr r r r$ V s �zReqServerChannel.pre_forkc C s ddl }| jd r |jj�� s t�d| jd � t�| jd � || _ |j � | j|j j jd d j�| _|jjj| j| jd d|d �| _|jj�| j�| _| jd rYt| j�| _n d| _|jj�| j�| _|j � | j�| _ || _ t | j d �r�| j �!| j"|� dS dS ) z� Do anything you need post-fork. This should handle all incoming payloads and call payload_handler. You will also be passed io_loop, for all of your asynchronous needs r N�pub_server_niceness�%setting Publish daemon niceness to %i�aes�secretZsock_dirF)�listen�io_loopZ con_cache� post_fork)#� salt.masterr �utils�platform� is_windows�log�info�os�nicer, r r �master�SMaster�secrets�value� crypticler Zget_master_eventZdaemonsZ masterapiZAutoKey�auto_keyr � cache_cli�minions� CkMinions� ckminions� MasterKeysr �payload_handlerr% r r- �handle_message)r rA r, r r r r r- ^ s0 ��� �zReqServerChannel.post_forkc c s� � t |t�rd|vsd|vrt�d� tjjj�d��z t |� dd��}W n t y0 d}Y nw | j � dd�}|dkrO||k rOt� d||� tjjj�d��z| �||�}W n* ty� } z t|�j}|d krnt�d � nt�d ||� tjjj�d��d }~ww t |t�r�t |� d�t�s�t�d ||� d�� tjjj�d ��z |d � dd�}d|v r�t�d|� tjjj�d��W n ty� t�d|� tjjj�d|� d���w d}|dkr�d}|d dkr�|� di �� d�dkr�tjjj�| �|d ||���|d d k�r�d }|dk�r|d �d d �}|d k�r�| j d dk�rKt�� |d d } | | j d k�rKt� d!|d d | | j d � tjjj�d��|d |d d k�rkt� d"|d d |d � tjjj�d��tjj�| j |d d ��s�t� d#|d d � tjjj�d��| j|dd$��s�tjjj�d��n| j|dd$��s�tjjj�d��z | � |�V \} } W n t�y� } ztjd%dd&� tjjj�d'��d } ~ ww | � d(d)�} | d*k�r�tjjj�| ��| d)k�r|d k�rtjjj�tj � | j | � |��� | |���tjjj�| j!� | |���| d+k�r8tjjj�| �"| | d, | d- |||� d.tj j#�|� d/tj j$����t�d0| � tjjj�d1��)2N�enc�loadzbad load received on socket�bad load�versionr Zminimum_auth_versionzPRejected authentication attempt using protocol version %d (minimum required: %d)�AuthenticationErrorz�Minion failed to auth to master. Since the payload is encrypted, it is not known which minion failed to authenticate. It is likely that this is a transient failure due to the master rotating its public key.z Bad load from minion: %s: %sz@payload and load must be a dict. Payload was: %s and load was %sz payload and load must be a dict�id� � z+Payload contains an id with a null byte: %sz!bad load: id contains a null bytez"Payload contains non-string id: %sz bad load: id z is not a stringFr T�clear�cmd�_authr) �nonce� Zrequest_server_ttl�tsz2Received request from %s with expired ttl: %d > %dz1Request id mismatch. Found '%s' but expected '%s'z'Request contains invalid minion id '%s')�requiredz-Some exception handling a payload from minion)�exc_infoz&Some exception handling minion payloadZfun�sendZ send_clearZ send_private�key�tgt�enc_algo�sig_algozUnknown req_fun %sz&Server-side exception handling payload)%� isinstance�dictr2 �warnr �ext�tornado�gen�Return�int�get� ValueErrorr �warning�_decode_payload� Exception�type�__name__�debug�error� TypeErrorrM �popr r/ �verify�valid_id�validate_tokenrA r r r# �dumpsr: �_encrypt_private� OAEP_SHA1� PKCS1v15_SHA1)r �payloadrF �minimum_version�exc�exc_type�id_� sign_messagesrN Zttl�retZreq_opts�eZreq_funr r r rB � s� �� �� ���� � �" � � � ���� �� �� z ReqServerChannel.handle_messageNTc C s: t j�| jd d|�}tjj�� } tj�| j| �} ztj�|�} W n& t t t fy6 t � d� ddi Y S tyG t � d� ddi Y S w i } | �tjj�| �|�| d< |du r]i }|r�|d u rgdd iS tj�| d ||d ��} t j�| jd d �}| tj�|�j| |d �d�}| �|�| |< | S | �|�| |< | S )zW The server equivalent of ReqChannel.crypted_transfer_decode_dictentry �pki_dirr= zBad load from minionrh rE zAES key not foundrT FNz Nonce not included in request)rT ZpillarrN � master.pem�� algorithm)�data�sig)r4 r" �joinr r r r Zgenerate_key_string� PublicKeyra � IndexErrorri r2 rh �OSError�encryptr/ � stringutils�to_bytesrr rn � PrivateKey�sign)r rx Zdictkey�targetrN rw Zencryption_algorithmZsigning_algorithm�pubfnrT Zpcrypt�pubZpret�tosign�master_pem_pathZ signed_msgr r r ro sD ��� ���z!ReqServerChannel._encrypt_privatec C sn z t j�| jd d�}tj�|�}d|tj�|�j ||d�d�W S t y6 t � d|� dddid � Y S w ) Nrz r{ rK r| )rC rD r zCMinion tried to authenticate with unsupported signing algorithm: %srx z bad sig algo�rC rD ) r4 r" r� r r rr rn r r� r� r r2 r3 )r rD r} r� r� r r r � _clear_signedC s �� ��z ReqServerChannel._clear_signedc C sN ddl }|jjjd d j| jjkr%|j�| j |jjjd d j�| _dS dS )zn Check to see if a fresh AES key is available and update the components of the worker r Nr) r* TF) r. r6 r7 r8 r9 r: Z key_stringr r r )r r r r r � _update_aesU s ��z ReqServerChannel._update_aesc C s� |d dkrX|dkr/t jj�| j|d �r+t j�| j| �|d ���|d �|d< |S t d��z | j �|d �|d< W |S t jj yW | � � sJ� | j �|d �|d< Y |S w |S )NrC r) rO rH rD zEncountered invalid id) r r/ rk rl r r r r# �loadsr r: rG r� )r rr rF r r r rc f s* � � ���z ReqServerChannel._decode_payloadc C s2 |d � dd�}|d �dd�}|dur�|dur�d| jv r(| jd r(| jd }n| j�dd�}z tjj�|d |�}W n tjjyL t � d |� Y d S w ztj � |�}W n t ye t � d |� Y d S w z|�|�d krwt �d|� W d S W dS ty� } z t �d|� W Y d}~d S d}~ww |r�d S dS )a� Validate the token (tok) and minion id (id) in the payload. If the payload and token exist they will be validated even if required is False. When required is False and either the tok or id is not found in the load, this check will pass. This method has a side effect of removing the 'tok' key from the load so that it is not passed along to request handlers. rD �tokNrH Z cluster_idZcluster_pki_dirrz rI r= zInvalid minion id: %sFzzSalt minion claiming to be %s attempted to communicate with master, but key could not be read and verification was denied.s saltz!Minion token did not validate: %szUnable to decrypt token: %sT)rj r` r r r/ rk Z clean_join� exceptionsZSaltValidationErrorr2 rb r r� r� �decryptrh ra ) r rr rQ r� rv rz Zpub_pathr� �errr r r rm z sF � �� �� ��z ReqServerChannel.validate_tokenFr c C s� ddl }|�d|jj�}|�d|jj�}|jj�| j|d �s;t � d|d � |r4| � d|d d �|�S d d did �S t � d |d � | jd dkr�| j rS| j � � }n| j�� }t|�dkrct � d� t|�| jd ks�|d |vr�t � d| jd |d � dd|d |d d�}| j�d�du r�| j�||jjjdd�� |r�| � d|d d �|�S d d did �S | j�|d �} | j�|d |�dd��} tj�| jd d|d �} tj�| jd d |d �} tj�| jd d |d �} tj�| jd d |d �}| jd �r�n�tj�| ��rGt � d |d � d|d |d d!�}| j�d�du �r2| j�||jjjdd�� |�r@| � d|d d �|�S d d did �S tj�| ��r�|jj� | d"��}| � |� � |d ��s�t � d#|d � |jj� |d$��}|� |d � W d � n 1 �s�w Y d|d d%|d d&�}| j�d�du �r�| j�||jjjdd�� |�r�| � d|d d �|�W d � S d d did �W d � S W d � n 1 �s�w Y �n�tj�| ��s�tj�!| ��r+t � d'|d � d|d |d d!�}| j�d�du �r| j�||jjjdd�� |�r$| � d|d d �|�S d d did �S | �r=| }t � d(|d � d)}d}n| �sO| }t � d*|d � d+}d}nd}|du�r�|jj� |d$��}|� |d � W d � n 1 �sqw Y |||d |d d�}| j�d�du �r�| j�||jjjdd�� |�r�| � ||d d �|�S d d |id �S �ntj�| ��rz| �r zt"�#| | � W n t$�y� Y nw t � d,|d � dd)|d |d d�}| j�d�du �r�| j�||jjjdd�� |�r| � d|d d �|�S d d did �S | �s�|jj� | d"���}| � |� � |d ��s�t � d-|d � |jj� |d$��}|� |d � W d � n 1 �sCw Y d|d d%|d d&�}| j�d�du �ri| j�||jjjdd�� |�r~| � d|d d �|�W d � S d d did �W d � S t � d.|d |d � dd+|d |d d�}| j�d�du �r�| j�||jjjdd�� |�r�| � d|d d �|�W d � S d d did �W d � S 1 �s�w Y n�|jj� | d"���}| � |� � |d ��sdt � d/|d � |jj� |d$��}|� |d � W d � n 1 �s w Y d|d |d d!�}| j�d�du �rA| j�||jjjdd�� |�rV| � d|d d �|�W d � S d d did �W d � S t�%| � W d � n 1 �stw Y n:t �&d0� d|d |d d!�}| j�d�du �r�| j�||jjjdd�� |�r�| � d|d d �|�S d d did �S t � d1|d � tj�| ��s�| jd �s�|jj� | d$��}|� |d � W d � n 1 �s�w Y n�| jd �rjd2}tj�| ��r|jj� | d"�� }|� � }W d � n 1 �sw Y |d �rH|d |k�rHt �'d3� |jj� | d$��}|� |d � W d � n 1 �sBw Y n"|d �sjt � d4|d � |�rc| � d|d d �|�S d d did �S d}| j �ry| j �(|d g� z|j�)| �}W n7 |jj*�y� } z(t � d5| |� |�r�| � d|d d �|�W Y d}~S d d did �W Y d}~S d}~ww d| j+�,� | jd6 d7�}| jd8 �r| j+�-� �r�t �'d9� t �'| j+�-� � |�.d:| j+�-� i� n,|jj/�0| jd; | j�}t �'d<� |jj1| j+�2� d= |d> ||d?�}|�.d:t3�4|�i� | jd@ dAk�r�dB|v �rxz| j+j5�6|dB |�}dC�7|j8j9j:dD dE j;|�}W nE t<�y_ } zt � dF|d |� d d dGid �W Y d} ~ S d} ~ w t=�yw } z t �&dH| � W Y d} ~ nd} ~ ww |j8j9j:dD dE j;}|�>||�|dD< |�>| �?|d �|�|dI< ntdB|v �r�z| j+j5�6|dB |�}|�>||�|dB< W n; t<�y� } zt � dF|d |� d d dGid �W Y d} ~ S d} ~ w t=�y� } z t �&dJ| � W Y d} ~ nd} ~ ww |j8j9j:dD dE j;}|�>||�|dD< |�>| �?|d �|�|dI< |dKk �rt �&dL|d � |jj@�AtB�C|��D� �} |j�E| j+j5| �|dM< ddN|d |d d�}| j�d�du �rQ| j�||jjjdd�� |�r`|d |d< | � ||�S |S )Oa@ Authenticate the client, use the sent public key to encrypt the AES key which was generated at start up. This method fires an event over the master event manager. The event is tagged "auth" and returns a dict with information about the auth event - Verify that the key we are receiving matches the stored key - Store the key if it is not there - Make an RSA key with the pub key - Encrypt the AES key as an encrypted salt.payload - Package the return and return it r NrV rW rH z)Authentication request from invalid id %sFrN )rx rN rK rx r� z Authentication request from %sZ max_minionsi� z|With large numbers of minions it is advised to enable the ConCache with 'con_cache: True' in the masters configuration file.zLToo many minions connected (max_minions=%s). Rejecting connection from id %s�fullr� )�result�actrH r� Z auth_eventsTZauth)�prefixZautosign_grainsrz r= Z minions_preZminions_rejectedZminions_deniedZ open_modez@Public key rejected for %s. Key is present in rejection key dir.)r� rH r� �rz|Authentication attempt from %s failed, the public keys did not match. This may be an attempt to compromise the Salt cluster.zw+Zdenied)r� rH r� r� z New public key %s is a directoryz2New public key for %s rejected via autoreject_fileZrejectz'New public key for %s placed in pendingZpendz6Pending public key for %s rejected via autoreject_filez�Authentication attempt from %s failed, the public key in pending did not match. This may be an attempt to compromise the Salt cluster.zfAuthentication failed from host %s, the key is in pending and needs to be accepted with salt-key -a %sz�Authentication attempt from %s failed, the public keys in pending did not match. This may be an attempt to compromise the Salt cluster.z&Unaccounted for authentication failurez Authentication accepted from %srI z&Host key change detected in open mode.zPublic key is empty: %szCorrupt public key "%s": %s� publish_port)rC �pub_keyr� Zmaster_sign_pubkeyz%Adding pubkey signature to auth-replyZpub_sigZsigning_key_passz(Signing master public key before sendingr r� r| Z auth_moderO �tokenz{}_|-{}r) r* zIMinion %s tried to authenticate with unsupported encryption algorithm: %sz bad enc algozToken failed to decrypt %s�sessionzToken failed to decrypt: %r� z>Minion using legacy request server protocol, please upgrade %sr �accept)Fr. r` r rp rq r/ rk rl r r2 r3 r� r< Z get_cachedr? Z connected_ids�lenr � fire_event�tagifyr; Zcheck_autorejectZcheck_autosignr4 r" r� �isfile�filesZfopenr �readrh �write�isdir�shutil�mover� �removerb rg Z put_cacher� ZInvalidKeyErrorr Z get_pub_strZpubkey_signature�updateZsdbZsdb_getZ sign_messageZget_sign_paths�binascii� b2a_base64rT r� �formatr6 r7 r8 r9 r rd r� r# r� r� �hashlib�sha256� hexdigestZprivate_encrypt) r rD rw rF r rV rW r= ZeloadZ auto_rejectZ auto_signr� Z pubfn_pendZpubfn_rejectedZ pubfn_deniedZ pubfn_handleZfp_Zkey_pathZkey_actZ key_resultZdisk_keyr� r� rx Zkey_passZpub_signZmtokenr) rt �digestr r r rM � s� � � ������ ��� ����� � �� �� �� ������� ����� � ����� 2$�8� ���� � �� � �� � �� ���� � � � ����� ���� � zReqServerChannel._authc C s~ | j �� | jd ur| j�� t| d�r;| jd ur=t| jd�r6| jjd ur6t| jjd�r2| jj�� d | j_d | _d S d S d S �Nr? �cache�destroy)r �closer r� r% r? r� �r r r r r� f s �zReqServerChannel.close)T)Fr )rf � __module__� __qualname__�__doc__� classmethodr r r r# r$ r- r r[ r\ r] � coroutinerB r rp rq ro r� r� rc rm rM r� r r r r r ! s6 $ �1 , Cr c @ s� e Zd ZdZedd� �Zd dd�Zdd� Zd d � Zd d � Z d!dd�Z dd� Z dd� Z dd� Z dd� Zdd� Zejjjjdd� �Zd d � Zd d � Zd S )"�PubServerChannelzQ Factory class to create subscription channels to the master's Publisher c K s~ d|vrd|v r|d |d< d}|� dd�r.d}tjj�|�D ] \}}|dkr)d}q |r.d}tjj|fi |��}| |||d�S )Nr F�presence_eventsTZtcp)r� )r` r r/ ZchannelZiter_transport_optsr Zpublish_server)r r r r� Ztcp_onlyr �_r r r r w s �zPubServerChannel.factoryFc C sV || _ tjj�| j �| _|| _tj�| j �| _ i | _ || _ tjj j d| j dd�| _ d S )Nr6 F�r r+ )r r r/ r= r> r? r r6 ZAESFuncs� aes_funcs�presentr� r � get_event)r r r r� r r r r � s zPubServerChannel.__init__c C s | j | j| jd�S )N�r r r� r� r� r r r � __getstate__� s �z PubServerChannel.__getstate__c C sR |d | _ |d | _|d | _tjjjd| j dd�| _tjj�| j �| _ i | _ d S )Nr r� r r6 Fr� ) r �stater r r/ r r� r= r> r? r� )r r� r r r � __setstate__� s z PubServerChannel.__setstate__c C s� | j �� | jd ur| j�� d | _| jd ur | j�� d | _t| d�rK| jd urMt| jd�rF| jjd urFt| jjd�rB| jj�� d | j_d | _d S d S d S r� )r r� r r� r� r% r? r� r� r r r r� � s �zPubServerChannel.closeNc C s$ t | jd�r|j| j|d� dS dS )a. Do anything necessary pre-fork. Since this is on the master side this will primarily be used to create IPC channels and create our daemon process to do the actual publishing :param func process_manager: A ProcessManager, from salt.utils.process.ProcessManager �publish_daemon)r N)r% r Z add_process�_publish_daemon)r r& r r r r r$ � s �zPubServerChannel.pre_forkc K s� | j d r tjj�� s t�d| j d � t�| j d � |� dd �}|d ur+|tj j _ tj �| j �| _| j�| j| j| j� d S )Nr' r( r8 )r r r/ r0 r1 r2 r3 r4 r5 r` r6 r7 r8 r r@ r r r� �publish_payload�presence_callback�remove_presence_callback)r r r8 r r r r� � s � �z PubServerChannel._publish_daemonc C s~ |d dkrd S t j�| jt jjjd d j�}|�|d �}t j j � |�}| j � |d |d �s3d S |d |_| �|� d S )NrC r) r* rD rH r� )r r r r r6 r7 r8 r9 r� r �frameZdecode_embedded_strsr� Z verify_minionrv �_add_client_present)r � subscriber�msgr: rD r r r r� � s � z"PubServerChannel.presence_callbackc C s | � |� d S �N)�_remove_client_present)r r� r r r r� � s z)PubServerChannel.remove_presence_callbackc C s� |j }|| jv r| j| }|�|� d S |h| j|< | jrH|gg d�}| j�|tjj�dd�� dt | j� � �i}| j�|tjj�dd�� d S d S )N��newZlost�change�presencer� ) rv r� �addr� r r� r r/ r� �list�keys�r �clientrv Zclientsr~ r r r r� � s ���z$PubServerChannel._add_client_presentc C s� |j }|d u s || jvrd S | j| }||vrd S |�|� t|�dkrV| j|= | jrXg |gd�}| j�|tjj� dd�� dt | j� � �i}| j�|tjj� dd�� d S d S d S )Nr r� r� r� r� ) rv r� r� r� r� r r� r r/ r� r� r� r� r r r r� � s( ���z'PubServerChannel._remove_client_presentc g s~ � | � |�}z tj�|d �}W n ty t�d|� � w d|v r0|d }| j�||�V }n| j�|�V }tj j j � |��)Nrr zInvalid package %r� topic_lst) � wrap_payloadr rr r� �KeyErrorr2 rh r r� r[ r\ r] r^ )r rD �argsZunpacked_packagerr Z topic_listrx r r r r� s � �z PubServerChannel.publish_payloadc C s< ddi}t jj�� |d< t j�| jt jjjd d j�}|� |�|d< | jd rQt j � | jd d�}t �d � | jd |d < t j�| jj��|d | jd �|d < d t j� |�i}g d�}| jjr�|d |v r�|d dkrs|d |d< t|d t�r�| jj|d |d d�}|d }t �d|� ||d< |S |d |d< |S )NrC r) �serialr* rD Zsign_pub_messagesrz r{ zSigning data packetZpublish_signing_algorithmrW r rr )Zpcre�globr� �tgt_typer� rU r� )r� r= zPublish Side Match: %s)r r6 r7 Z get_serialr r r r8 r9 rn r4 r" r� r2 rg r� r Zrsa_pathr� rr r Z topic_supportrX �strr? Z check_minions) r rD rr r: r� Z int_payloadZ match_targetsZ_resZ match_idsr r r r� s< � �� � �z PubServerChannel.wrap_payloadc C s2 t �d|�dd�t|�dd� � | j�|� dS )z+ Publish "load" to minions z1Sending payload to publish daemon. jid=%s load=%sZjidN�( )r2 rg r` �reprr �publish)r rD r r r r� < s �zPubServerChannel.publish)Fr� )rf r� r� r� r� r r r� r� r� r$ r� r� r� r� r� r r[ r\ r] r� r� r� r� r r r r r� r s$ %r� ) r� r� r� �loggingr4 r r� r Z salt.cryptr Zsalt.ext.tornado.genr. Z salt.payloadZsalt.transport.frameZsalt.utils.channelZsalt.utils.eventZsalt.utils.filesZsalt.utils.minionsZsalt.utils.platformZsalt.utils.stringutilsZsalt.utils.verifyZsalt.exceptionsr r Zsalt.utils.cacher � getLoggerrf r2 r r� r r r r �<module> s> W
| ver. 1.4 |
Github
|
.
| PHP 8.2.30 | Generation time: 0 |
proxy
|
phpinfo
|
Settings