File: //opt/saltstack/salt/lib/python3.10/site-packages/salt/utils/__pycache__/verify.cpython-310.pyc
o
�N�g�e � @ s� d Z ddlZddlZddlZddlZddlZddlZddlZddlZddl Z
ddl Z
ddl Z
ddl
Z
ddlZ
ddlmZ ddlmZmZmZ z
ddlZddlZ
W n
ey] ddlZY nw e�e�Ze
j j � � rkdndZ g d�Z dd � Z!d
d � Z"d d
� Z#dd� Z$dd� Z%dd� Z&dd� Z'ddde fdd�Z(dd� Z)d d � Z*d6d d �Z+d!d"� Z,d#d$� Z-d%d&� Z.d'd(� Z/d7d*d+�Z0d,d-� Z1d.d/� Z2d0d1� Z3d2d3� Z4d8d4d5�Z5dS )9z3
A few checks to make sure the environment is sane
� N)�
LOG_LEVELS)�CommandExecutionError�SaltClientError�SaltSystemExitzc:\salt�/)ztcp://zudp://zfile://c C s zddl } W n
ty Y dS w | j}t�d|�}|s$t�d|� dS |�� \}}}|�� r3t |�}|�� r;t |�}|rE|�� rEt |�}|dkrc|dkrcd|v rZ|sZt�d � dS |rb|d
krbdS n|dkso|dkrq|dkrqdS t�
d � d t j d v r�t�
d
� dS )z6
ZeroMQ python bindings >= 2.1.9 are required
r NTz^(\d+)\.(\d+)(?:\.(\d+))?z0Using untested zmq python bindings version: '%s'� � �devz6Using dev zmq module, please report unexpected results� z,ZeroMQ python bindings >= 2.1.9 are requiredz salt-masterz�The Salt Master is unstable using a ZeroMQ version lower than 2.1.11 and requires this fix: http://lists.zeromq.org/pipermail/zeromq-dev/2011-June/012094.htmlF)
�zmq� Exception� __version__�re�match�log�warning�groups�isdigit�int�critical�sys�argv)r �verr �major�minorZpoint� r �E/opt/saltstack/salt/lib/python3.10/site-packages/salt/utils/verify.py� zmq_version& s@ �
�
�r c C sT t j}zt �| p ddt jt j�}|s|W S |d }|d W S t jy) | Y S w )z�
Lookup a hostname and determine its address family. The first address returned
will be AF_INET6 if the system is IPv6-enabled, and AF_INET otherwise.
Nr )�socket�AF_INET� getaddrinfo� AF_UNSPEC� SOCK_STREAM�gaierror)�hostname�fallbackZ hostnames�hr r r �
lookup_familyY s �
�r' c C s� t | �}||fD ]e}t�|tj�}zWz|�tjtjd� |�| t|�f� W n< tyb } z0d| � d|� �}|j rC|� dt
|�� �}n|� d�}|d7 }t � |� W Y d}~W |�
� dS d}~ww W |�
� q|�
� w d S )
zJ
Attempt to bind to the sockets to verify that they are available
r zUnable to bind socket �:z , error: z , this might not be a problem.z'; Is there another salt-master running?NFT)r' r r" �
setsockopt�
SOL_SOCKET� SO_REUSEADDR�bindr r �args�strr r �close)Z interfaceZpub_portZret_portZ addr_family�port�sock�exc�msgr r r �
verify_socketl s(
��� r4 c C s@ g }| D ]}d}t D ] }|�|�rd} nq
|r |�|� q|S )z!
Filter files to verify.
TF)�DEFAULT_SCHEMES�
startswith�append)�filesZ to_verify�filenameZ verify_file�schemer r r �verify_logs_filter� s
�
�r; c C s t t| �|�S )z�
Verify the log files exist and are owned by the named user. Filenames that
begin with tcp:// and udp:// will be filtered out. Filenames that begin
with file:// are handled correctly
)� verify_filesr; )r8 �userr r r �verify_log_files� s r> c C s` t jj�� rdS ddl}z|�| �W S ty/ td�| �t j
dd� t � t j j
j� Y dS w )z.
Get the user from passwords database
Tr NzNFailed to prepare the Salt environment for user {}. The user is not available.)�file�flush)�salt�utils�platform�
is_windows�pwd�getpwnam�KeyError�print�formatr �stderr�exit�defaultsZ exitcodes� EX_NOUSER)r= rE r r r �
_get_pwnam� s ��rN c C s� t jj�� rdS t|�}|d }| D ]�}tj�|�}zC|r>zt�|� W n t y= } z
|j
t
j kr3� W Y d}~nd}~ww tj� |�s\t jj
�|d�� W d � n1 sWw Y W nI t y� } z%tj� |�ryd|� d|� d�}t|d��|j
t
jkr�� d �|�}t|d��d}~w t y� } z
d
|� d |� �}t|d��d}~ww t�|�}||jkr�z t�||d � W q t y� Y qw qdS )
zK
Verify that the named files exist and are owned by the named user
Tr N�wzFailed to create path z, is z a file?)r3 zCNo permissions to access "{}", are you running as the correct user?zFailed to create path "z" - ���)rA rB rC rD rN �os�path�dirname�makedirs�OSError�errnoZEEXIST�isfiler8 Zfopenr ZEACCESrI �stat�st_uid�chown) r8 r= �pwnam�uidZfn_rS �errr3 Zstatsr r r r< � s\ ��� ��
�
�
��
��r< F� c C s� t jj�� rt|| ||d�S t|�}|d }|d }t jjj|dd�} | D �] }
|
s+q%tj �
|
�s�z+t jj � d��
t�
|
� W d � n1 sIw Y t�� dkr[t�|
||� W n$ ty� } zd } tj�| �|
| �� t�| j� W Y d} ~ nd} ~ ww t�|
�}
t�� dk�rt�|
�}|j|ks�|j|kr�|r�|j| v r�nt�|
||� d
d � t�|
�D �D ]c}tj �|
|�}tj j � d �|v r�q�t jj � |�D ]H\}} }t � || �D ]<}|� d
�r�q�tj �||�}z#t�|�}|j|ks�|j|k�r |�r|j| v �rnt�|||� W q� t�y Y q�w q�q�|
|k�rCt�!|
j"�}|dk�rC|dk�rCt�#|
tj$��r=t�%|
d� q%t&�'d|
� q%|du �rNt(� dS dS )�h
Verify that the named directories are in place and that the environment
can shake the salt
)�
permissive�
skip_extrar � F��include_default� Nr �,Failed to create directory path "{0}" - {1}
c S s g | ]}d |vr|�qS )�jobsr )�.0�ar r r �
<listcomp> s z verify_env.<locals>.<listcomp>rg �.i� i� z/Unable to securely set the permissions of "%s".))rA rB rC rD �win_verify_envrN r= � get_gid_listrQ rR �isdirr8 Z set_umaskrT �getuidrZ rU r rJ �writerI rK rV rX rY �st_gid�listdir�join�sepZos_walk� itertools�chainr6 �S_IMODE�st_mode�access�W_OK�chmodr r r )�dirsr= r` �pki_dirra �root_dirr[ r\ �gidr �dir_r] r3 �modeZfmode�subdirZfsubdir�rootr8 �namerR Zsmoder r r �
verify_env� s� �
� ���
����
��
�r� c C s� t jj�� rdS | t jj�� krdS t| �}zNttd�r$t� | |j
� n t� t jjj | dd�� t�
|j
� t�|j� dtjv rG|jtjd< dtjv rR|jtjd< dD ]
}|tjv ra|jtj|< qTW dS tyt t�d| � Y dS w ) z0
Check user and assign process uid/gid.
T�
initgroupsFrc �HOMEZSHELL)ZUSERZLOGNAMEz9Salt configured to run as user "%s" but unable to switch.)rA rB rC rD r= �get_userrN �hasattrrQ r� �pw_gid� setgroupsrm �setgid�setuid�pw_uid�environ�pw_dir�pw_shell�pw_namerU r r )r= ZpwuserZenvvarr r r �
check_user< s2
�� � �r� c C sl | g}t j�| �\}}|dkr|g}t j�|�\}}||d kr4|�d|� t j�|�\}}||d ks |S )a�
Returns a full list of directories leading up to, and including, a path.
So list_path_traversal('/path/to/salt') would return:
['/', '/path', '/path/to', '/path/to/salt']
in that order.
This routine has been tested on Windows systems as well.
list_path_traversal('c:\path\to\salt') on Windows would return:
['c:\', 'c:\path', 'c:\path\to', 'c:\path\to\salt']
r^ r )rQ rR �split�insert)rR �out�head�tailr r r �list_path_traversalb s �r� r� c C s� t | �D ]>}t�|tj�sBd|� d�}tj�|�s |d7 }ntjj� � }||kr1|d|� d�7 }n|d|� d�7 }|r> dS t
|��qdS )a
Walk from the root up to a directory and verify that the current
user has access to read each directory. This is used for making
sure a user can read all parent directories of the minion's key
before trying to go and generate a new key and raising an IOError
zCould not access rk z Path does not exist.z Try running as user z
Please give z read permissions.N) r� rQ ry �R_OKrR �existsrA rB r= r� r )rR r= Zskip_perm_errorsZtpathr3 � current_userr r r �check_path_traversal{ s
��r� c C s | � dd�}tj�d�rt�� }}nt�tj�\}}t j
� | � d�d�}t t �
|��}t�d|� tj}|d |kr=dS d �||�}||krO|d
7 }tj}n |d |krYtj}n|d |krctj}n |d |krltj}||k ry|d
�|| �7 }|d7 }tj||d� dS )zI
Check the number of max allowed open files and adjust if needed
Zmax_open_filesi�� �winr} Zminionsz6This salt-master instance has accepted %s minion keys.� NzhThe number of accepted minion keys({}) should be lower than 1/4 of the max open files soft setting({}). z$salt-master will crash pretty soon! r rb zoAccording to the system's hard limit, there's still a margin of {} to raise the salt's max_open_files setting. z#Please consider raising this value.)�levelr3 )�getr rC r6 � win32fileZ _getmaxstdio�resourceZ getrlimitZ
RLIMIT_NOFILErQ rR rs �lenrr r �debug�logging�INFOrI �CRITICAL�WARNING)�optsZmof_cZmof_sZmof_hZaccepted_keys_dirZaccepted_countr� r3 r r r �check_max_open_files� s> � �
�r� c C s� d}| � tjj�dd � D ];}|dkr;tj�tjj�||g��r-t�tjj�||g��}q
tj�tjj�||g��}q
tj�tjj�||g��}q
|S )Nr^ r )r� rQ rR rt �islinkrs �readlink�abspath�rR �base�partr r r �_realpath_darwin� s r� c
C s� d}| � tjj�D ]5}|dkr<ztjj�tjj�||g��}tj�|�}W q t y; tj�tjj�||g��}Y q w |}q |�
d�rJ|dd � }|S )Nr^ z\\?\r� ) r� rQ rR rt rA rB r� rs r� rU r6 r� r r r �_realpath_windows� s �
r� c C s4 t jj�� r
t| �S t jj�� rt| �S tj� | �S )z�
Cross platform realpath method. On Windows when python 3, this method
uses the os.readlink method to resolve any filesystem links.
All other platforms and version use ``os.path.realpath``.
)
rA rB rC Z is_darwinr� rD r� rQ rR �realpath)rR r r r � _realpath� s
r� Tc C s� t j�| �st j�t �� | �} t j�| �} t j�|�s"t j�| |�}t j�|�}|r2t| �} t|�}|rBt j�|| g�| kr@|S dS t j�|�| krL|S dS )a+
Accepts the root the path needs to be under and verifies that the path is
under said root. Pass in subdir=True if the path can result in a
subdirectory of the root instead of having to reside directly in the root.
Pass realpath=False if filesystem links should not be resolved.
r^ ) rQ rR �isabsrs �getcwd�normpathr� �
commonpathrS )r� rR r� r� r r r �
clean_path s �r� c sN zt � fdd�dD ��rW dS tt| d � ��W S ttttfy& Y dS w )z+
Returns if the passed id is valid
c 3 s � | ]}|� v V qd S )Nr )rh �x��id_r r � <genexpr>" s � zvalid_id.<locals>.<genexpr>)r �\� Fr} )�any�boolr� �AttributeErrorrG � TypeError�UnicodeDecodeError)r� r� r r� r �valid_id s �r� c C s" d}|D ]
}| � |�r dS qdS )z�
Check a string to see if it has any potentially unsafe routines which
could be executed via python, this routine is used to improve the
safety of modules suct as virtualenv
)�import�;�
subprocess�eval�openr? �exec�inputFT)�count)�codeZbadsZbadr r r � safe_py_code) s
�r� c C s4 g } t �� D ]\}}|t �dd�k r| �|� q| S )z(
Return the insecure logs types
�info� )r �itemsr� r7 )Zinsecurer� �valuer r r � insecure_log6 s
�r� c C s8 t �t| �d���� tj�}|tjk rt�d� dS dS )zF
If an insecre logging configuration is found, show a warning
Z log_levelzFInsecure logging configuration detected! Sensitive data may be logged.N) r r� r. �lowerr� �NOTSETr� r r )r� r� r r r �
verify_logA s
��r� c C sJ ddl }ddl}ddl}tj�dd�}d�|dg�}|jjj | |d�s*t
d| � ���tj� | �s5t� | � |jj
�� }|jj
�|�r�d } |jjjd
d d �sV|jjjd
d d � z |jjj| d
dd� W n t
yq t�d| � Y nw z,|jjjdd�}
|
jd
dddd� |
jddddd� |
jddddd� |
j| dd� W n t
y� t�d| � Y nw |jj
�|��rz |jjj| d
d� W n t
y� t�d | � Y nw |�sz*|jj�� }
|
jd
ddd d� |
jdddd d� |
jdddd d� |
j| dd� W n t
�y t�d | � Y nw |D ]�} | �s�qtj� | ��sLzt� | � W n% t�yK } zd }
tj � |
� | | �� t� | j � W Y d} ~ nd} ~ ww | |k�r�z4|jjj| d
d� |jj�� }
|
jd
ddd d� |
jdddd d� |
jdddd d� |
j| dd� W �q t
�y� t�d| � Y �qw �q|d u �r�t!� dS dS )!r_ r NZ
SystemRootz
C:\Windowsr� ZTEMP)rR �
allow_pathz0`file_roots` set to a possibly unsafe location: z HKLM\SOFTWARE\Salt Project\saltZHKLMzSOFTWARE\Salt Project\salt)Zhive�keyz S-1-5-32-544�registry)�obj_name� principal�obj_typez)Unable to securely set the owner of '%s'.)r� ZgrantZ full_controlZthis_key_subkeys)r� Z access_modeZ permissionsZ
applies_tozS-1-5-18zS-1-3-4T)r� Z protectedz/Unable to securely set the permissions of '%s'.)r� r� z)Unable to securely set the owner of "%s".Z this_folder_subfolders_filesz.Unable to securely set the permissions of '%s'rf F)"�salt.utils.pathZsalt.utils.win_daclZsalt.utils.win_functionsrQ r� r� rs rB rR Z safe_pathr rn rT Z
win_functionsZget_current_userZis_adminZwin_regZ
key_existsZ set_valueZwin_daclZ set_ownerr r �daclZadd_aceZsaverU r rJ rp rI rK rV r )rR r| r` r} ra rA Z system_rootr� r� Zreg_pathr� r� r] r3 r r r rl M s� �
��
� ���� � � ������
�����
&
�rl )r� F)FT)Fr^ F)6�__doc__rV ru r� rQ r r rX r Zsalt.defaults.exitcodesrA Zsalt.utils.filesr� Zsalt.utils.platformZsalt.utils.userZ
salt._loggingr Zsalt.exceptionsr r r r� Zsalt.utils.win_reg� ImportErrorr� � getLogger�__name__r rB rC rD ZROOT_DIRr5 r r' r4 r; r> rN r< r� r� r� r� r� r� r� r� r� r� r� r� r� rl r r r r �<module> s^ �
3 1
�Y&
<