File: //opt/saltstack/salt/lib/python3.10/site-packages/salt/channel/__pycache__/server.cpython-310.pyc
o
�N�g|� � @ s� d Z ddlZddlZddlZddlZddlZddlZddlZddl Zddl
Zddl Zddl Zddl
ZddlZddlZddlZddlZddlZddlmZmZ ddlmZ e�e�ZG dd� d�ZG dd� d�Z dS ) z�
Encapsulate the different transports available to Salt.
This includes server side transport, for the ReqServer and the Publisher
� N)�SaltDeserializationError�UnsupportedAlgorithm)�CacheClic @ s� e Zd ZdZedd� �Zedd� �Zdd� Zdd � Zd
d � Z e
j j j
jd d
� �Zdde
jje
jjfdd�Zdd� Zdd� Zdd� Zd dd�Zdd � ZdS ) �ReqServerChannelzK
ReqServerChannel handles request/reply messages from ReqChannels.
c K s: d|vrd|v r|d |d< t jj|fi |��}| ||�S )N�
master_uri)�salt� transportZrequest_server)�cls�opts�kwargsr � r �G/opt/saltstack/salt/lib/python3.10/site-packages/salt/channel/server.py�factory$ s
zReqServerChannel.factoryc C s t j�|�t j�|�kS )z�
Normalize and compare two keys
Returns:
bool: ``True`` if the keys match, otherwise ``False``
)r �cryptZ clean_key)r Zkey1Zkey2r r r
� compare_keys+ s z ReqServerChannel.compare_keysc C s || _ || _d | _d | _d S �N)r
r �event�
master_key)�selfr
r r r r
�__init__5 s
zReqServerChannel.__init__c C s t | jd�r| j�|� dS dS )z�
Do anything necessary pre-fork. Since this is on the master side this will
primarily be bind and listen (or the equivalent for your network library)
�pre_forkN)�hasattrr r )r �process_managerr r r
r < s �zReqServerChannel.pre_forkc C s ddl }| jd r |jj�� s t�d| jd � t�| jd � || _ |j
� | j|j j
jd d j�| _|jjj| j| jd d|d �| _|jj�| j�| _| jd
rYt| j�| _n d| _|jj�| j�| _|j
� | j�| _ || _ t | j d �r�| j �!| j"|� dS dS ) z�
Do anything you need post-fork. This should handle all incoming payloads
and call payload_handler. You will also be passed io_loop, for all of your
asynchronous needs
r N�pub_server_niceness�%setting Publish daemon niceness to %i�aes�secretZsock_dirF)�listen�io_loopZ con_cache� post_fork)#� salt.masterr
�utils�platform�
is_windows�log�info�os�nicer r � Crypticle�master�SMaster�secrets�value� crypticler Zget_master_eventZdaemonsZ masterapiZAutoKey�auto_keyr � cache_cli�minions� CkMinions� ckminions�
MasterKeysr �payload_handlerr r r �handle_message)r r4 r r r r r
r D s0 ���
�zReqServerChannel.post_forkc c s� � z| � |�}W n* ty2 } z t|�j}|dkr t�d� nt�d||� tjj j
� d��d }~ww t |t
�r@t |�d�t
�sRt�d||�d�� tjj j
� d��z |d �dd �}d
|v rmt�d |� tjj j
� d ��W n ty� t�d
|� tjj j
� d|� d���w d}d|v r�|d }d}|dkr�d}|d dkr�|�di ��d�dkr�tjj j
� | �|d |���d }|dkr�|d �dd �}z
| �|�V \}} W n ty� }
ztjddd� tjj j
� d ��d }
~
ww | �d d �} | d kr�tjj j
� |��| d k�rtjj j
� | j�||���| d k�r7tjj j
� | �|| d! | d" |||�d#tjj�|�d$tjj����t�d%| � tjj j
� d&��)'N�AuthenticationErrorz�Minion failed to auth to master. Since the payload is encrypted, it is not known which minion failed to authenticate. It is likely that this is a transient failure due to the master rotating its public key.z Bad load from minion: %s: %szbad load�loadz@payload and load must be a dict. Payload was: %s and load was %sz payload and load must be a dict�id� � z+Payload contains an id with a null byte: %sz!bad load: id contains a null bytez"Payload contains non-string id: %sz
bad load: id z is not a stringr �versionF� T�enc�clear�cmd�_auth�noncez-Some exception handling a payload from minion)�exc_infoz&Some exception handling minion payloadZfun�sendZ
send_clearZ send_private�key�tgt�enc_algo�sig_algozUnknown req_fun %sz&Server-side exception handling payload)�_decode_payload� Exception�type�__name__r$ �debug�errorr �ext�tornado�gen�Return�
isinstance�dict�get� TypeErrorr@ �popr4 r- �dumps�_encrypt_privater � OAEP_SHA1�
PKCS1v15_SHA1) r �payload�exc�exc_type�id_r; �
sign_messagesrA �retZreq_opts�eZreq_funr r r
r5 h s� �
���� � �"
���
�� z ReqServerChannel.handle_messageNTc
C s4 t j�| jd d|�}tjj�� } tj�| j| �}
ztj�|�} W n# t t
t fy3 | j �
i � Y S tyD t�d� ddi Y S w i } | �tjj�| �|�| d< |du rZi }|r�|du rdddiS tj�
| d ||d ��}
t j�| jd d
�}|
tj�|�j|
|d �d �}|
�
|�| |< | S |
�
|�| |< | S )
zW
The server equivalent of ReqChannel.crypted_transfer_decode_dictentry
�pki_dirr0 zAES key not foundrM rD FNz Nonce not included in request)rD ZpillarrA �
master.pem�� algorithm)�data�sig)r& �path�joinr
r r r( Zgenerate_key_string� PublicKey�
ValueError�
IndexErrorrU r- rW �OSErrorr$ rM �encryptr! � stringutils�to_bytesr[ �
PrivateKey�sign)r r` Zdictkey�targetrA r_ Zencryption_algorithmZsigning_algorithm�pubfnrD Zpcrypt�pubZpret�tosign�master_pem_pathZ
signed_msgr r r
rX � sB
��� ���z!ReqServerChannel._encrypt_privatec C sn z t j�| jd d�}tj�|�}d|tj�|�j ||d�d�W S t
y6 t � d|� dddid � Y S w )
Nrb rc r> rd )r= r7 rg zCMinion tried to authenticate with unsupported signing algorithm: %sr` z bad sig algo�r= r7 )
r& rh ri r
r r[ rW r rq rr r r$ r% )r r7 re rw rv r r r
�
_clear_signed� s �� ��z ReqServerChannel._clear_signedc C sN ddl }|jjjd d j| jjkr%|j�| j |jjjd d j�| _dS dS )zn
Check to see if a fresh AES key is available and update the components
of the worker
r Nr r TF)
r r) r* r+ r, r- Z
key_stringr r( r
)r r r r r
� _update_aes� s ��z ReqServerChannel._update_aesc C s� t |t�r
d|vs
d|vrtd��|d dkr@z
| j�|d �|d< W |S tjjy? | �� s2� | j�|d �|d< Y |S w |S )Nr= r7 z bad load received on socket!r ) rR rS r r- �loadsr r r6 rz )r r[ r r r
rH s � ��z ReqServerChannel._decode_payloadFc
C sv ddl }|�d|jj�}|�d|jj�}|jj�| j|d �s;t �
d|d � |r4| � d|d d �|�S d
d did �S t �
d
|d � | jd dkr�| j rS| j �
� }n| j�� }t|�dkrct �
d� t|�| jd ks�|d |vr�t �
d| jd |d � dd|d |d d�}| j�d�du r�| j�||jjjdd�� |r�| � d|d d �|�S d
d did �S | j�|d �}| j�|d |�dd��} tj�| jd d|d �}
tj�| jd d |d �} tj�| jd d |d �} tj�| jd d |d �}
| jd �r�n�tj�| ��rGt �
d |d � d|d |d d!�}| j�d�du �r2| j�||jjjdd�� |�r@| � d|d d �|�S d
d did �S tj�|
��r�|jj� |
d"��}| � |� � |d ��s�t � d#|d � |jj� |
d$��}|� |d � W d � n 1 �s�w Y d|d d%|d d&�}| j�d�du �r�| j�||jjjdd�� |�r�| � d|d d �|�W d � S d
d did �W d � S W d � n 1 �s�w Y �n�tj�| ��s�tj�!| ��r+t �
d'|d � d|d |d d!�}| j�d�du �r| j�||jjjdd�� |�r$| � d|d d �|�S d
d did �S |�r=| }t �
d(|d � d)}d}n| �sO| }t �
d*|d � d+}d}nd}|du�r�|jj� |d$��}|� |d � W d � n 1 �sqw Y |||d |d d�}| j�d�du �r�| j�||jjjdd�� |�r�| � ||d d �|�S d
d |id �S �ntj�| ��rz|�r zt"�#| | � W n
t$�y� Y nw t �
d,|d � dd)|d |d d�}| j�d�du �r�| j�||jjjdd�� |�r| � d|d d �|�S d
d did �S | �s�|jj� | d"���}| � |� � |d ��s�t � d-|d � |jj� |
d$��}|� |d � W d � n 1 �sCw Y d|d d%|d d&�}| j�d�du �ri| j�||jjjdd�� |�r~| � d|d d �|�W d � S d
d did �W d � S t �
d.|d |d � dd+|d |d d�}| j�d�du �r�| j�||jjjdd�� |�r�| � d|d d �|�W d � S d
d did �W d � S 1 �s�w Y n�|jj� | d"���}| � |� � |d ��sdt � d/|d � |jj� |
d$��}|� |d � W d � n 1 �s w Y d|d |d d!�}| j�d�du �rA| j�||jjjdd�� |�rV| � d|d d �|�W d � S d
d did �W d � S t�%| � W d � n 1 �stw Y n:t �&d0� d|d |d d!�}| j�d�du �r�| j�||jjjdd�� |�r�| � d|d d �|�S d
d did �S t �
d1|d � tj�|
��s�| jd �s�|jj� |
d$��}|� |d � W d � n 1 �s�w Y n�| jd �rjd2}tj�|
��r|jj� |
d"�� }|� � }W d � n 1 �sw Y |d �rH|d |k�rHt �'d3� |jj� |
d$��}|� |d � W d � n 1 �sBw Y n"|d �sjt � d4|d � |�rc| � d|d d �|�S d
d did �S d}| j �ry| j �(|d g� z|j�)|
�}W n7 |jj*�y� } z(t � d5|
|� |�r�| � d|d d �|�W Y d}~S d
d did �W Y d}~S d}~ww d| j+�,� | jd6 d7�}| jd8 �r| j+�-� �r�t �'d9� t �'| j+�-� � |�.d:| j+�-� i� n,|jj/�0| jd; | j�}t �'d<� |jj1| j+�2� d= |d> ||d?�}|�.d:t3�4|�i� | jd@ dAk�r�dB|v �rxz| j+j5�6|dB |�}dC�7|j8j9j:dD dE j;|�}W nE t<�y_ } zt �
dF|d |� d
d dGid �W Y d}~S d}~w t=�yw } z t �&dH|� W Y d}~nd}~ww |j8j9j:dD dE j;}|�>||�|dD< ngdB|v �r�z| j+j5�6|dB |�}|�>||�|dB< W n; t<�y� } zt �
dF|d |� d
d dGid �W Y d}~S d}~w t=�y� } z t �&dI|� W Y d}~nd}~ww |j8j9j:dD dE j;}|�>||�|dD< |jj?�@tA�B|��C� �} |j�D| j+j5| �|dJ< ddK|d |d d�}| j�d�du �r*| j�||jjjdd�� |�r9|d |d< | � ||�S |S )La@
Authenticate the client, use the sent public key to encrypt the AES key
which was generated at start up.
This method fires an event over the master event manager. The event is
tagged "auth" and returns a dict with information about the auth
event
- Verify that the key we are receiving matches the stored key
- Store the key if it is not there
- Make an RSA key with the pub key
- Encrypt the AES key as an encrypted salt.payload
- Package the return and return it
r NrF rG r8 z)Authentication request from invalid id %sFrA )r` rA r> r` rx z Authentication request from %sZ max_minionsi� z|With large numbers of minions it is advised to enable the ConCache with 'con_cache: True' in the masters configuration file.zLToo many minions connected (max_minions=%s). Rejecting connection from id %s�fullru )�result�actr8 ru Z auth_eventsTZauth)�prefixZautosign_grainsrb r0 Z minions_preZminions_rejectedZminions_deniedZ open_modez@Public key rejected for %s. Key is present in rejection key dir.)r} r8 ru �rz|Authentication attempt from %s failed, the public keys did not match. This may be an attempt to compromise the Salt cluster.zw+Zdenied)r} r8 r~ ru z New public key %s is a directoryz2New public key for %s rejected via autoreject_fileZrejectz'New public key for %s placed in pendingZpendz6Pending public key for %s rejected via autoreject_filez�Authentication attempt from %s failed, the public key in pending did not match. This may be an attempt to compromise the Salt cluster.zfAuthentication failed from host %s, the key is in pending and needs to be accepted with salt-key -a %sz�Authentication attempt from %s failed, the public keys in pending did not match. This may be an attempt to compromise the Salt cluster.z&Unaccounted for authentication failurez Authentication accepted from %sr9 z&Host key change detected in open mode.zPublic key is empty: %szCorrupt public key "%s": %s� publish_port)r= �pub_keyr� Zmaster_sign_pubkeyz%Adding pubkey signature to auth-replyZpub_sigZsigning_key_passz(Signing master public key before sendingr< r� rd Z auth_mode� �tokenz{}_|-{}r r zIMinion %s tried to authenticate with unsupported encryption algorithm: %sz bad enc algozToken failed to decrypt %szToken failed to decrypt: %rrg �accept)Er rT r rY rZ r! ZverifyZvalid_idr
r$ r% ry r/ Z
get_cachedr2 Z
connected_ids�lenr �
fire_event�tagifyr. Zcheck_autorejectZcheck_autosignr& rh ri �isfile�filesZfopenr �readrM �write�isdir�shutil�moverm �remove�warningrL Z put_cacherj ZInvalidKeyErrorr Z get_pub_strZpubkey_signature�updateZsdbZsdb_getZ sign_messageZget_sign_paths�binascii�
b2a_base64rD Zdecrypt�formatr) r* r+ r, r rI rn ro rp �hashlib�sha256� hexdigestZprivate_encrypt) r r7 r_ r rF rG r0 ZeloadZ auto_rejectZ auto_signrt Z
pubfn_pendZpubfn_rejectedZ pubfn_deniedZ pubfn_handleZfp_Zkey_pathZkey_actZ
key_resultZdisk_keyru �errr` Zkey_passZpub_signZmtokenr r\ �digestr r r
r@ $ s� �
� ������ ��� ����� � �� ��
�� ������� ����� � ����� 2$�8� ���� � ��
� ��
�
��
����
�
�
�
�����
���� zReqServerChannel._authc C s& | j �� | jd ur| j�� d S d S r )r �closer �destroy�r r r r
r� � s
�zReqServerChannel.close�F)rK �
__module__� __qualname__�__doc__� classmethodr r r r r r rN rO rP � coroutiner5 r rY rZ rX ry rz rH r@ r� r r r r
r s0
$
Y
�0
;r c @ s� e Zd ZdZedd� �Zd dd�Zdd� Zd d
� Zd d � Z d!dd�Z
dd� Z dd� Z dd� Z
dd� Zdd� Zejjjjdd� �Zd d � Zd d � Zd
S )"�PubServerChannelzQ
Factory class to create subscription channels to the master's Publisher
c K s~ d|vrd|v r|d |d< d}|� dd�r.d}tjj�|�D ]
\}}|dkr)d}q |r.d}tjj|fi |��}| |||d�S )Nr F�presence_eventsTZtcp)r� )rT r r! ZchannelZiter_transport_optsr Zpublish_server)r r
r r� Ztcp_onlyr �_r r r
r � s �zPubServerChannel.factoryFc C sV || _ tjj�| j �| _|| _tj�| j �| _ i | _
|| _ tjj j
d| j dd�| _ d S )Nr) F�r
r )r
r r! r0 r1 r2 r r) ZAESFuncs� aes_funcs�presentr� r � get_event)r r
r r� r r r
r � s zPubServerChannel.__init__c C s | j | j| jd�S )N�r
r r� r� r� r r r
� __getstate__ s �z PubServerChannel.__getstate__c C sR |d | _ |d | _|d | _tjjjd| j dd�| _tjj�| j �| _ i | _
d S )Nr
r� r r) Fr� ) r
�stater r r! r r� r0 r1 r2 r� )r r� r r r
� __setstate__ s
z PubServerChannel.__setstate__c C sF | j �� | jd ur| j�� d | _| jd ur!| j�� d | _d S d S r )r r� r r� r� r� r r r
r� s
�zPubServerChannel.closeNc C s$ t | jd�r|j| j|d� dS dS )a.
Do anything necessary pre-fork. Since this is on the master side this will
primarily be used to create IPC channels and create our daemon process to
do the actual publishing
:param func process_manager: A ProcessManager, from salt.utils.process.ProcessManager
�publish_daemon)r N)r r Z add_process�_publish_daemon)r r r r r r
r s �zPubServerChannel.pre_forkc K s� | j d r tjj�� s t�d| j d � t�| j d � |� dd �}|d ur+|tj
j _ tj
�| j �| _| j�| j| j| j� d S )Nr r r+ )r
r r! r" r# r$ r% r& r' rT r) r* r+ r r3 r r r� �publish_payload�presence_callback�remove_presence_callback)r r r+ r r r
r� % s �
�z PubServerChannel._publish_daemonc C s~ |d dkrd S t j�| jt jjjd d j�}|�|d �}t j j
� |�}| j �
|d |d �s3d S |d |_| �|� d S )Nr= r r r7 r8 �tok)r r r( r
r) r* r+ r, r{ r �frameZdecode_embedded_strsr� Z
verify_minionr^ �_add_client_present)r �
subscriber�msgr- r7 r r r
r� 4 s �
z"PubServerChannel.presence_callbackc C s | � |� d S r )�_remove_client_present)r r� r r r
r� B s z)PubServerChannel.remove_presence_callbackc C s� |j }|| jv r| j| }|�|� d S |h| j|< | jrH|gg d�}| j�|tjj�dd�� dt | j�
� �i}| j�|tjj�dd�� d S d S )N��newZlost�change�presencer� ) r^ r� �addr� r r� r r! r� �list�keys�r �clientr^ Zclientsrf r r r
r� E s
���z$PubServerChannel._add_client_presentc C s� |j }|d u s || jvrd S | j| }||vrd S |�|� t|�dkrV| j|= | jrXg |gd�}| j�|tjj� dd�� dt
| j� � �i}| j�|tjj� dd�� d S d S d S )Nr r� r� r� r� ) r^ r� r� r� r� r r� r r! r� r� r� r� r r r
r� V s(
���z'PubServerChannel._remove_client_presentc g s~ � | � |�}z
tj�|d �}W n ty t�d|� � w d|v r0|d }| j�||�V }n| j�|�V }tj j
j � |��)Nr[ zInvalid package %r� topic_lst)
� wrap_payloadr r[ r{ �KeyErrorr$ rM r r� rN rO rP rQ )r r7 �argsZunpacked_packager[ Z
topic_listr` r r r
r� r s �
�z PubServerChannel.publish_payloadc C s< ddi}t jj�� |d< t j�| jt jjjd d j�}|� |�|d< | jd rQt
j � | jd d�}t
�d � | jd
|d < t j�| jj��|d | jd
�|d < d
t j� |�i}g d�}| jjr�|d |v r�|d dkrs|d |d< t|d t�r�| jj|d |d d�}|d }t
�d|� ||d< |S |d |d< |S )Nr= r �serialr r7 Zsign_pub_messagesrb rc zSigning data packetZpublish_signing_algorithmrG rg r[ )Zpcre�globr� �tgt_typer� rE r� )r� r0 zPublish Side Match: %s)r r) r* Z
get_serialr r( r
r+ r, rW r& rh ri r$ rL rq r Zrsa_pathrr r[ r Z
topic_supportrR �strr2 Z
check_minions) r r7 r[ r- rw Z int_payloadZ
match_targetsZ_resZ match_idsr r r
r� � s< �
�� � �z PubServerChannel.wrap_payloadc C s2 t �d|�dd�t|�dd� � | j�|� dS )z+
Publish "load" to minions
z1Sending payload to publish daemon. jid=%s load=%sZjidN�( )r$ rL rT �reprr �publish)r r7 r r r
r� � s
�zPubServerChannel.publishr� r )rK r� r� r� r� r r r� r� r� r r� r� r� r� r� r rN rO rP r� r� r� r� r r r r
r� � s$
%r� ) r� r� r� �loggingr& r� Z
salt.cryptr Zsalt.ext.tornado.genr Z salt.payloadZsalt.transport.frameZsalt.utils.channelZsalt.utils.eventZsalt.utils.filesZsalt.utils.minionsZsalt.utils.platformZsalt.utils.stringutilsZsalt.utils.verifyZsalt.exceptionsr r Zsalt.utils.cacher � getLoggerrK r$ r r� r r r r
�<module> s8
H