golden hour
/opt/saltstack/salt/lib/python3.10/site-packages/salt/channel/__pycache__
⬆️ Go Up
Upload
File/Folder
Size
Actions
__init__.cpython-310.pyc
166 B
Del
OK
client.cpython-310.pyc
16.46 KB
Del
OK
server.cpython-310.pyc
20.28 KB
Del
OK
Edit: server.cpython-310.pyc
o �xec� � @ s* d Z ddlZddlZddlZddlZddlZddlZddlZddl Zddl Zddl Zddl Zddl ZddlZddlZddlZddlZddlZddlmZ ddlmZ z ddlmZ dZW n# ey dZzddlm Z W n ey| ddl m Z Y nw Y nw e� e �Z G d d � d �Z!G d d � d �Z"dS ) z� Encapsulate the different transports available to Salt. This includes server side transport, for the ReqServer and the Publisher � N)�SaltDeserializationError)�CacheCli)�RSATF)� PKCS1_OAEPc @ s| e Zd ZdZedd� �Zdd� Zdd� Zdd � Ze j j j j d d � �Zddd�Zdd� Zdd� Zdd� Zd dd�Zdd� Zd S ) �ReqServerChannelzK ReqServerChannel handles request/reply messages from ReqChannels. c K s: d|vrd|v r|d |d< t jj|fi |��}| ||�S )N� master_uri)�salt� transportZrequest_server)�cls�opts�kwargsr � r �G/opt/saltstack/salt/lib/python3.10/site-packages/salt/channel/server.py�factory0 s zReqServerChannel.factoryc C s || _ || _d | _d S �N)r r �event)�selfr r r r r �__init__7 s zReqServerChannel.__init__c C s t | jd�r| j�|� dS dS )z� Do anything necessary pre-fork. Since this is on the master side this will primarily be bind and listen (or the equivalent for your network library) �pre_forkN)�hasattrr r )r �process_managerr r r r < s �zReqServerChannel.pre_forkc C s ddl }| jd r |jj�� s t�d| jd � t�| jd � || _ |j � | j|j j jd d j�| _|jjj| j| jd dd �| _|jj�| j�| _| jd rXt| j�| _n d| _|jj�| j�| _|j � | j�| _ || _ t | j d �r| j �!| j"|� dS dS ) z� Do anything you need post-fork. This should handle all incoming payloads and call payload_handler. You will also be passed io_loop, for all of your asynchronous needs r N�pub_server_niceness�%setting Publish daemon niceness to %i�aes�secretZsock_dirF)�listenZ con_cache� post_fork)#� salt.masterr �utils�platform� is_windows�log�info�os�nice�io_loop�crypt� Crypticle�master�SMaster�secrets�value� crypticler Zget_master_eventZdaemonsZ masterapiZAutoKey�auto_keyr � cache_cli�minions� CkMinions� ckminionsZ MasterKeys� master_key�payload_handlerr r r �handle_message)r r3 r% r r r r r D s0 ��� �zReqServerChannel.post_forkc c sl � z| � |�}W n* ty2 } z t|�j}|dkr t�d� nt�d||� tjj j � d��d }~ww t |t �r@t |�d�t �sRt�d||�d�� tjj j � d��z |d �dd �}d |v rmt�d |� tjj j � d ��W n ty� t�d |� tjj j � d�|���w d}d|v r�|d }d}|dkr�d}|d dkr�|�di ��d�dkr�tjj j � | �|d |���d }|dkr�|d �dd �}z | �|�V \}} W n ty� } ztjddd� tjj j � d��d } ~ ww | �d d �} | d kr�tjj j � |��| d k�rtjj j � | j�||���| d k�r(tjj j � | �|| d | d! ||���t�d"| � tjj j � d#��)$N�AuthenticationErrorz�Minion failed to auth to master. Since the payload is encrypted, it is not known which minion failed to authenticate. It is likely that this is a transient failure due to the master rotating its public key.z Bad load from minion: %s: %szbad load�loadz@payload and load must be a dict. Payload was: %s and load was %sz payload and load must be a dict�id� � z+Payload contains an id with a null byte: %sz!bad load: id contains a null bytez"Payload contains non-string id: %sz bad load: id {} is not a stringr �versionF� T�enc�clear�cmd�_auth�noncez-Some exception handling a payload from minion)�exc_infoz&Some exception handling minion payloadZfun�sendZ send_clearZ send_private�key�tgtzUnknown req_fun %sz&Server-side exception handling payload)�_decode_payload� Exception�type�__name__r! �debug�errorr �ext�tornado�gen�Return� isinstance�dict�get� TypeError�formatr? �popr3 r, �dumps�_encrypt_private) r �payload�exc�exc_type�id_r: � sign_messagesr@ �retZreq_opts�eZreq_funr r r r4 h s� � ���� � ��" ��� �� z ReqServerChannel.handle_messageNTc C sP t j�| jd d|�}tjj�� }tj�| j|�}ztj�|�} W n# t t t fy3 | j � i � Y S tyD t�d� ddi Y S w i } tjj�|�}trZ| �|tj�| d< n t�| �} | �|�| d< |du rli }|r�|du rvddiS tj� | d ||d ��} t j�| jd d �} | tj� | | �d �}|� |�| |< | S |� |�| |< | S ) zW The server equivalent of ReqChannel.crypted_transfer_decode_dictentry �pki_dirr/ zAES key not foundrJ rC FNz Nonce not included in request)rC Zpillarr@ � master.pem)�data�sig) r# �path�joinr r r& r' Zgenerate_key_string�get_rsa_pub_key� ValueError� IndexErrorrR r, rU �OSErrorr! rJ r � stringutils�to_bytes�HAS_M2�public_encryptr �pkcs1_oaep_paddingr �new�encryptrW � sign_message)r r\ Zdictkey�targetr@ r[ �pubfnrC Zpcrypt�pubZpret�cipher�tosign�master_pem_pathZ signed_msgr r r rV � sB � � ��z!ReqServerChannel._encrypt_privatec C s6 t j�| jd d�}tj�|�}d|tj�||�d�S )Nr^ r_ r= )r< r6 ra ) r# rb rc r r rW rU r& ro )r r6 ru rt r r r � _clear_signed� s �z ReqServerChannel._clear_signedc C sN ddl }|jjjd d j| jjkr%|j�| j |jjjd d j�| _dS dS )zn Check to see if a fresh AES key is available and update the components of the worker r Nr r TF) r r( r) r* r+ r, Z key_stringr& r' r )r r r r r � _update_aes� s ��z ReqServerChannel._update_aesc C s� t |t�r d|vs d|vrtd��|d dkr@z | j�|d �|d< W |S tjjy? | �� s2� | j�|d �|d< Y |S w |S )Nr< r6 z bad load received on socket!r ) rO rP r r, �loadsr r& r5 rw )r rW r r r rE � s � ��z ReqServerChannel._decode_payloadFc C s ddl }|jj�| j|d �s*t�d|d � |r#| �d|d d��S dd did �S t�d |d � | jd dkr�| jrB| j� � }n| j � � }t |�d krRt�d� t |�| jd ks�|d |vr�t�d| jd |d � dd|d |d d�}| j� d�du r�| j�||jjjdd�� |r�| �d|d d��S dd did �S | j�|d �}| j�|d |� dd��}tj�| jd d|d �}tj�| jd d|d �} tj�| jd d|d �} tj�| jd d |d �} | jd r�n�tj�| ��r3t�d |d � d|d |d d �}| j� d�du �r | j�||jjjdd�� |�r,| �d|d d��S dd did �S tj�|��r�|jj�|d ���} | �� �� |d �� k�r�t� d!|d � |jj�| d"��} | � |d � W d � n 1 �ssw Y d|d d#|d d$�}| j� d�du �r�| j�||jjjdd�� |�r�| �d|d d��W d � S dd did �W d � S W d � n 1 �s�w Y �n�tj�| ��s�tj� | ��rt�d%|d � d|d |d d �}| j� d�du �r| j�||jjjdd�� |�r| �d|d d��S dd did �S |�r)| }t�d&|d � d'}d}n|�s;| }t�d(|d � d)}d}nd}|du�r�|jj�|d"��} | � |d � W d � n 1 �s]w Y |||d |d d�}| j� d�du �r�| j�||jjjdd�� |�r�| �||d d��S dd |id �S �n�tj�| ��r]|�r�zt � | | � W n t!�y� Y nw t�d*|d � dd'|d |d d�}| j� d�du �r�| j�||jjjdd�� |�r�| �d|d d��S dd did �S |�s�|jj�| d ���} | �� |d k�rst� d+|d � |jj�| d"��} | � |d � W d � n 1 �s+w Y d|d d#|d d$�}| j� d�du �rQ| j�||jjjdd�� |�re| �d|d d��W d � S dd did �W d � S t�d,|d |d � dd)|d |d d�}| j� d�du �r�| j�||jjjdd�� |�r�| �d|d d��W d � S dd did �W d � S 1 �s�w Y n�|jj�| d ���} | �� |d k�rGt� d-|d � |jj�| d"��} | � |d � W d � n 1 �s w Y d|d |d d �}| j� d�du �r%| j�||jjjdd�� |�r9| �d|d d��W d � S dd did �W d � S t�"| � W d � n 1 �sWw Y n9t�#d.� d|d |d d �}| j� d�du �r�| j�||jjjdd�� |�r�| �d|d d��S dd did �S t�d/|d � tj�|��s�| jd �s�|jj�|d"��} | � |d � W d � n 1 �s�w Y n| jd �rKd0}tj�|��r�|jj�|d �� } | �� }W d � n 1 �s�w Y |d �r*|d |k�r*t�$d1� |jj�|d"��} | � |d � W d � n 1 �s$w Y n!|d �sKt� d2|d � |�rD| �d|d d��S dd did �S d}| j�rZ| j�%|d g� z|j&�'|�}W n6 |j&j(�y� } z't� d3||� |�r�| �d|d d��W Y d}~S dd did �W Y d}~S d}~ww t)�s�t*�+|�}d| j,�-� | jd4 d5�}| jd6 �r�| j,�.� �r�t�$d7� t�$| j,�.� � |�/d8| j,�.� i� n*|jj0�1| jd9 | j�}t�$d:� |j&�2| j,�3� d; |d< |�}|�/d8t4�5|�i� t)�st*�+| j,j6�}| jd= d>k�rbd?|v �rCz&t)�r"| j,j6�7|d? t8j9�}n|�:|d? �}d@�;|j<j=j>dA dB j?|�}W n t@�yB Y n w |j<j=j>dA dB j?}t)�rZ|�A|t8j9�|dA< n^|�B|�|dA< nVd?|v �r�z(t)�r�| j,j6�7|d? t8j9�}|�A|t8j9�|d?< n|�:|d? �}|�B|�|d?< W n t@�y� Y nw |j<j=j>dA dB j?}t)�r�|�A|t8j9�|dA< n|�B|�|dA< |jjC�DtE�F|��G� �}|j&�H| j,j6|�|dC< ddD|d |d d�}| j� d�du �r�| j�||jjjdd�� |�r�|d |d< | �|�S |S )Ea@ Authenticate the client, use the sent public key to encrypt the AES key which was generated at start up. This method fires an event over the master event manager. The event is tagged "auth" and returns a dict with information about the auth event - Verify that the key we are receiving matches the stored key - Store the key if it is not there - Make an RSA key with the pub key - Encrypt the AES key as an encrypted salt.payload - Package the return and return it r Nr7 z)Authentication request from invalid id %sFr@ )r\ r@ r= r\ )r< r6 z Authentication request from %sZ max_minionsi� z|With large numbers of minions it is advised to enable the ConCache with 'con_cache: True' in the masters configuration file.zLToo many minions connected (max_minions=%s). Rejecting connection from id %sZfullrr )�result�actr7 rr Z auth_eventsTZauth)�prefixZautosign_grainsr^ r/ Z minions_preZminions_rejectedZminions_deniedZ open_modez@Public key rejected for %s. Key is present in rejection key dir.)ry r7 rr �rz|Authentication attempt from %s failed, the public keys did not match. This may be an attempt to compromise the Salt cluster.zw+Zdenied)ry r7 rz rr z New public key %s is a directoryz2New public key for %s rejected via autoreject_fileZrejectz'New public key for %s placed in pendingZpendz6Pending public key for %s rejected via autoreject_filez�Authentication attempt from %s failed, the public key in pending did not match. This may be an attempt to compromise the Salt cluster.zfAuthentication failed from host %s, the key is in pending and needs to be accepted with salt-key -a %sz�Authentication attempt from %s failed, the public keys in pending did not match. This may be an attempt to compromise the Salt cluster.z&Unaccounted for authentication failurez Authentication accepted from %sr8 z&Host key change detected in open mode.zPublic key is empty: %szCorrupt public key "%s": %s� publish_port)r< �pub_keyr} Zmaster_sign_pubkeyz%Adding pubkey signature to auth-replyZpub_sigZsigning_key_passz(Signing master public key before sendingr; r~ Z auth_mode� �tokenz{}_|-{}r r ra �accept)Ir r ZverifyZvalid_idr r! r" rv r. Z get_cachedr1 Z connected_ids�lenrQ r � fire_event�tagifyr- Zcheck_autorejectZcheck_autosignr# rb rc �isfile�filesZfopen�read�striprJ �write�isdir�shutil�moverg �remove�warningrI Z put_cacher& rd ZInvalidKeyErrorrj r rm r2 Z get_pub_strZpubkey_signature�updateZsdbZsdb_getro Zget_sign_paths�binascii� b2a_base64rC Zprivate_decryptr rl ZdecryptrS r( r) r* r+ rF rk rn rh ri �hashlib�sha256� hexdigestZprivate_encrypt) r r6 r[ r r/ ZeloadZ auto_rejectZ auto_signrq Z pubfn_pendZpubfn_rejectedZ pubfn_deniedZ pubfn_handleZfp_Zkey_pathZkey_actZ key_resultZdisk_keyrr �errrs r\ Zkey_passZpub_signZmcipherZmtokenr �digestr r r r? s� � ��� ��� �� ��� �� � �� � �� ������ ��� �� � ��� �� 2$�8� �� �� � �� �� � �� �� � � � ��� � ��� zReqServerChannel._authc C s& | j �� | jd ur| j�� d S d S r )r �closer �destroy�r r r r r� � s �zReqServerChannel.close)NT�F)rH � __module__� __qualname__�__doc__� classmethodr r r r r rK rL rM � coroutiner4 rV rv rw rE r? r� r r r r r + s$ $ T( 0r c @ s� e Zd ZdZedd� �Zd dd�Zdd� Zd d � Zd d � Z d!dd�Z dd� Z dd� Z dd� Z dd� Zdd� Zejjjjdd� �Zd d � Zd d � Zd S )"�PubServerChannelzQ Factory class to create subscription channels to the master's Publisher c K s~ d|vrd|v r|d |d< d}|� dd�r.d}tjj�|�D ] \}}|dkr)d}q |r.d}tjj|fi |��}| |||d�S )Nr F�presence_eventsTZtcp)r� )rQ r r ZchannelZiter_transport_optsr Zpublish_server)r r r r� Ztcp_onlyr �_r r r r � s �zPubServerChannel.factoryFc C sV || _ tjj�| j �| _|| _tj�| j �| _ i | _ || _ tjj j d| j dd�| _ d S )Nr( F�r r )r r r r/ r0 r1 r r( ZAESFuncs� aes_funcs�presentr� r � get_event)r r r r� r r r r � s zPubServerChannel.__init__c C s | j | j| jd�S )N�r r r� r� r� r r r � __getstate__� s �z PubServerChannel.__getstate__c C sR |d | _ |d | _|d | _tjjjd| j dd�| _tjj�| j �| _ i | _ d S )Nr r� r r( Fr� ) r �stater r r r r� r/ r0 r1 r� )r r� r r r � __setstate__� s z PubServerChannel.__setstate__c C sF | j �� | jd ur| j�� d | _| jd ur!| j�� d | _d S d S r )r r� r r� r� r� r r r r� � s �zPubServerChannel.closeNc C s$ t | jd�r|j| j|d� dS dS )a. Do anything necessary pre-fork. Since this is on the master side this will primarily be used to create IPC channels and create our daemon process to do the actual publishing :param func process_manager: A ProcessManager, from salt.utils.process.ProcessManager �publish_daemon)r N)r r Z add_process�_publish_daemon)r r r r r r r � s �zPubServerChannel.pre_forkc K sp | j d r tjj�� s t�d| j d � t�| j d � |� dd �}|d ur+|tj j _ | j �| j| j| j� d S )Nr r r* )r r r r r r! r" r# r$ rQ r( r) r* r r� �publish_payload�presence_callback�remove_presence_callback)r r r* r r r r� s � �z PubServerChannel._publish_daemonc C s~ |d dkrd S t j�| jt jjjd d j�}|�|d �}t j j � |�}| j � |d |d �s3d S |d |_| �|� d S )Nr< r r r6 r7 �tok)r r& r' r r( r) r* r+ rx r �frameZdecode_embedded_strsr� Z verify_minionrZ �_add_client_present)r � subscriber�msgr, r6 r r r r� s � z"PubServerChannel.presence_callbackc C s | � |� d S r )�_remove_client_present)r r� r r r r� % s z)PubServerChannel.remove_presence_callbackc C s� |j }|| jv r| j| }|�|� d S |h| j|< | jrH|gg d�}| j�|tjj�dd�� dt | j� � �i}| j�|tjj�dd�� d S d S )N�rm Zlost�change�presencer� ) rZ r� �addr� r r� r r r� �list�keys�r �clientrZ Zclientsr` r r r r� ( s ���z$PubServerChannel._add_client_presentc C s� |j }|d u s || jvrd S | j| }||vrd S |�|� t|�dkrV| j|= | jrXg |gd�}| j�|tjj� dd�� dt | j� � �i}| j�|tjj� dd�� d S d S d S )Nr r� r� r� r� ) rZ r� r� r� r� r r� r r r� r� r� r� r r r r� 9 s( ���z'PubServerChannel._remove_client_presentc g s~ � | � |�}z tj�|d �}W n ty t�d|� � w d|v r0|d }| j�||�V }n| j�|�V }tj j j � |��)NrW zInvalid package %r� topic_lst) � wrap_payloadr rW rx �KeyErrorr! rJ r r� rK rL rM rN )r r6 �argsZunpacked_packagerW Z topic_listr\ r r r r� U s � �z PubServerChannel.publish_payloadc C s ddi}t jj�� |d< t j�| jt jjjd d j�}|� |�|d< | jd rBt j � | jd d�}t �d � t j�||d �|d < d t j� |�i}g d �}| jjr�|d |v r�|d dkrd|d |d< t|d t�r�| jj|d |d d�}|d }t �d|� ||d< |S |d |d< |S )Nr< r �serialr r6 Zsign_pub_messagesr^ r_ zSigning data packetra rW )Zpcre�globr� �tgt_typer� rD r� )r� r/ zPublish Side Match: %s)r r( r) Z get_serialr& r' r r* r+ rU r# rb rc r! rI ro rW r Z topic_supportrO �strr1 Z check_minions) r r6 rW r, ru Z int_payloadZ match_targetsZ_resZ match_idsr r r r� d s2 � � �z PubServerChannel.wrap_payloadc C s2 t �d|�dd�t|�dd� � | j�|� dS )z+ Publish "load" to minions z1Sending payload to publish daemon. jid=%s load=%sZjidN�( )r! rI rQ �reprr �publish)r r6 r r r r� � s �zPubServerChannel.publishr� r )rH r� r� r� r� r r r� r� r� r r� r� r� r� r� r rK rL rM r� r� r� r� r r r r r� � s$ !r� )#r� r� r� Zloggingr# r� Z salt.cryptr Zsalt.ext.tornado.genr Z salt.payloadZsalt.transport.frameZsalt.utils.channelZsalt.utils.eventZsalt.utils.filesZsalt.utils.minionsZsalt.utils.platformZsalt.utils.stringutilsZsalt.utils.verifyZsalt.exceptionsr Zsalt.utils.cacher ZM2Cryptor rj � ImportErrorZCryptodome.Cipherr Z Crypto.CipherZ getLoggerrH r! r r� r r r r �<module> sP ���
Save