File: //opt/saltstack/salt/lib/python3.10/site-packages/zmq/auth/__pycache__/base.cpython-310.pyc
o
�N�g�? � @ s� d Z ddlZddlZddlmZmZmZmZmZm Z m
Z
ddl Z ddl m
Z
ddlmZ ddlmZ dZd ZG d
d � d �Zd d gZdS )
z*Base implementation of 0MQ authentication.� N)�Any�Dict�List�Optional�Set�Tuple�Union)�_check_version)�z85� )�load_certificates�*s 1.0c @ s e Zd ZU dZded< eed< eed< eeef ed< ded< e e ed < e e ed
< eeeeef f ed < eeee
ef f ed < eed
< d@de d ded
efdd�Z dAdd�Z
dAdd�Zdeddfdd�Zdeddfdd�Z dBd ed eeef ddfd d �Z dCd ed!eeejf ddfd"d#�Z dBd ed$eddfd%d&�Zd'e
defd(d)�Z dBd ed!e e ddfd*d+�Zd,ee
fd-d.�Zd ed/ed0edeee
f fd1d2�Z d ed3e
deee
f fd4d5�Z d ed6e
deee
f fd7d8�Z 9dDd:e
d;e
d<e
d=eddf
d>d?�Z dS )E�
Authenticatora� Implementation of ZAP authentication for zmq connections.
This authenticator class does not register with an event loop. As a result,
you will need to manually call `handle_zap_message`::
auth = zmq.Authenticator()
auth.allow("127.0.0.1")
auth.start()
while True:
auth.handle_zap_msg(auth.zap_socket.recv_multipart()
Alternatively, you can register `auth.zap_socket` with a poller.
Since many users will want to run ZAP in a way that does not block the
main thread, other authentication classes (such as :mod:`zmq.auth.thread`)
are provided.
Note:
- libzmq provides four levels of security: default NULL (which the Authenticator does
not see), and authenticated NULL, PLAIN, CURVE, and GSSAPI, which the Authenticator can see.
- until you add policies, all incoming NULL connections are allowed.
(classic ZeroMQ behavior), and all PLAIN and CURVE connections are denied.
- GSSAPI requires no configuration.
z zmq.Context�context�encoding� allow_any�credentials_providersz
zmq.Socket�
zap_socket� whitelist� blacklist� passwords�certs�logN�utf-8c C sb t dd� |p tj�� | _|| _d| _i | _d | _t � | _
t � | _ i | _ i | _
|p-t�d�| _d S )N)� r ZsecurityFzzmq.auth)r �zmqZContext�instancer r r r r �setr r r r �logging� getLoggerr )�selfr r r � r! �A/opt/saltstack/salt/lib/python3.10/site-packages/zmq/auth/base.py�__init__: s
zAuthenticator.__init__�returnc C s4 | j �tj�| _d| j_| j�d� | j�d� dS )z Create and bind the ZAP socketr zinproc://zeromq.zap.01ZStartingN) r �socketr ZREPr Zlinger�bindr �debug�r r! r! r" �startP s zAuthenticator.startc C s | j r| j �� d| _ dS )zClose the ZAP socketN)r �closer( r! r! r" �stopW s
zAuthenticator.stop� addressesc G �2 | j rtd��| j�dd�|�� | j�|� dS )aI Allow (whitelist) IP address(es).
Connections from addresses not in the whitelist will be rejected.
- For NULL, all clients from this address will be accepted.
- For real auth setups, they will be allowed to continue with authentication.
whitelist is mutually exclusive with blacklist.
�-Only use a whitelist or a blacklist, not bothz Allowing %s�,N)r �
ValueErrorr r' �joinr �update�r r, r! r! r" �allow] s
zAuthenticator.allowc G r- )z�Deny (blacklist) IP address(es).
Addresses not in the blacklist will be allowed to continue with authentication.
Blacklist is mutually exclusive with whitelist.
r. z
Denying %sr/ N)r r0 r r' r1 r r2 r3 r! r! r" �denyl s zAuthenticator.denyr
�domainc C s |r|| j |< | j�d|� dS )z�Configure PLAIN authentication for a given domain.
PLAIN authentication uses a plain-text password file.
To cover all domains, use "*".
You can modify the password file at any time; it is reloaded automatically.
zConfigure plain: %sN�r r r' )r r6 r r! r! r" �configure_plainx s
z Authenticator.configure_plain�.�locationc
C st | j �d||� |tkrd| _dS d| _z
t|�| j|< W dS ty9 } z| j �d||� W Y d}~dS d}~ww )a Configure CURVE authentication for a given domain.
CURVE authentication uses a directory that holds all public client certificates,
i.e. their public keys.
To cover all domains, use "*".
You can add and remove certificates in that directory at any time. configure_curve must be called
every time certificates are added or removed, in order to update the Authenticator's state
To allow all client keys without checking, specify CURVE_ALLOW_ANY for the location.
zConfigure curve: %s[%s]TFz&Failed to load CURVE certs from %s: %sN)r r' �CURVE_ALLOW_ANYr r r � Exception�error)r r6 r: �er! r! r" �configure_curve� s
��z Authenticator.configure_curve�credentials_providerc C s. d| _ |dur|| j|< dS | j�d|� dS )a Configure CURVE authentication for a given domain.
CURVE authentication using a callback function validating
the client public key according to a custom mechanism, e.g. checking the
key against records in a db. credentials_provider is an object of a class which
implements a callback method accepting two parameters (domain and key), e.g.::
class CredentialsProvider(object):
def __init__(self):
...e.g. db connection
def callback(self, domain, key):
valid = ...lookup key and/or domain in db
if valid:
logging.info('Authorizing: {0}, {1}'.format(domain, key))
return True
else:
logging.warning('NOT Authorizing: {0}, {1}'.format(domain, key))
return False
To cover all domains, use "*".
To allow all client keys without checking, specify CURVE_ALLOW_ANY for the location.
FNz0None credentials_provider provided for domain:%s)r r r r= )r r6 r@ r! r! r" �configure_curve_callback� s z&Authenticator.configure_curve_callback�client_public_keyc C s t �|��d�S )a� Return the User-Id corresponding to a CURVE client's public key
Default implementation uses the z85-encoding of the public key.
Override to define a custom mapping of public key : user-id
This is only called on successful authentication.
Parameters
----------
client_public_key: bytes
The client public key used for the given message
Returns
-------
user_id: unicode
The user ID as text
�ascii)r
�encode�decode)r rB r! r! r" �
curve_user_id� s zAuthenticator.curve_user_idc C s dS )z~Configure GSSAPI authentication
Currently this is a no-op because there is nothing to configure with GSSAPI.
Nr! )r r6 r: r! r! r" �configure_gssapi� s z Authenticator.configure_gssapi�msgc s� t |�dk r&� j�d|� t |�dk r� j�d� dS � �|d dd� dS |dd� \}}}}}}|dd� }|�� jd �}|�� jd �}|tkrZ� j�d
|� � �|dd � dS � j�d ||||||� d
} d
}
d} � jr�|� jv r~d} � j�d|� n)d}
d} � j�d|� n � j r�|� j v r�d}
d} � j�d|� n d} � j�d|� d} |
�sH|dkr�| s�� j�d� d} n�|dkr�t |�dkrՈ j�d|� � �|dd� dS � fd d �|D �\} }
� �
|| |
�\} } n^|d k�rt |�dk�r� j�d |� � �|dd� dS |d }� � ||�\} } | �r� � |�} n-|d!k�rHt |�dk�r7� j�d"|� � �|dd� dS |d }|�d#�} � �
||�\} } | �rU� �|d$d%| � dS � �|d| � dS )&zPerform ZAP authentication� z*Invalid ZAP message, not enough frames: %r� z Not enough information to replyr s 400s Not enough framesN�replacezInvalid ZAP version: %rs Invalid versionzQversion: %r, request_id: %r, domain: %r, address: %r, identity: %r, mechanism: %rFs NO ACCESSTz PASSED (whitelist) address=%ss Address not in whitelistz$DENIED (not in whitelist) address=%ss Address is blacklistedz DENIED (blacklist) address=%sz$PASSED (not in blacklist) address=%s� anonymouss NULLzALLOWED (NULL)s PLAINz Invalid PLAIN credentials: %rs Invalid credentialsc 3 s � | ]
}|� � jd �V qdS )rK N)rE r )�.0�cr( r! r" � <genexpr>' s �
�z3Authenticator.handle_zap_message.<locals>.<genexpr>s CURVEz Invalid CURVE credentials: %rr s GSSAPIz Invalid GSSAPI credentials: %r�utf8� 200� OK)�lenr r= �_send_zap_replyrE r �VERSIONr' r r �_authenticate_plain�_authenticate_curverF �_authenticate_gssapi)r rH �version�
request_idr6 �address�identityZ mechanismZ credentials�allowedZdenied�reason�username�password�key� principalr! r( r" �handle_zap_message� s� � �
�
�
z Authenticator.handle_zap_messager_ r` c C s� d}d}| j rE|s d}|| j v r)|| j | v r&|| j | | kr#d}nd}nd}nd}|r:| j�d|||� ||fS | j�d |� ||fS d
}| j�d |� ||fS ) zPLAIN ZAP authenticationF� r
Ts Invalid passwords Invalid usernames Invalid domainz1ALLOWED (PLAIN) domain=%s username=%s password=%sz DENIED %ss No passwords definedzDENIED (PLAIN) %sr7 )r r6 r_ r` r] r^ r! r! r" rV F s2
�
��z!Authenticator._authenticate_plain�
client_keyc C s d}d}| j rd}d}| j�d� ||fS | ji krQ|s d}|| jv rKt�|�}| j| �||�r6d}d}nd}|r<dnd }| j�d
|||� ||fS d }||fS |sUd}|| jv r�t�|�}| j| �|�rld}d}nd}|rrdnd }| j�d |||� ||fS d }||fS )
zCURVE ZAP authenticationFrd TrR z ALLOWED (CURVE allow any client)r
s Unknown keyZALLOWEDZDENIEDz0%s (CURVE auth_callback) domain=%s client_key=%ss Unknown domainz"%s (CURVE) domain=%s client_key=%s) r r r' r r
rD �callbackr �get)r r6 re r] r^ Zz85_client_key�statusr! r! r" rW l sX 0
�
� ��
� �z!Authenticator._authenticate_curverb c C s | j �d||� dS )zPNothing to do for GSSAPI, which has already been handled by an external service.z'ALLOWED (GSSAPI) domain=%s principal=%s)TrR )r r' )r r6 rb r! r! r" rX � s z"Authenticator._authenticate_gssapirL rZ � status_code� status_text�user_idc C s\ |dkr|nd}t |t�r|�| jd�}d}| j�d||� t|||||g}| j�|� dS )z.Send a ZAP reply to finish the authentication.rQ rd rK zZAP reply code=%s text=%sN) �
isinstance�strrD r r r' rU r Zsend_multipart)r rZ ri rj rk �metadataZreplyr! r! r" rT � s
z Authenticator._send_zap_reply)Nr N)r$ N)r
N)r
r9 )rL ) �__name__�
__module__� __qualname__�__doc__�__annotations__rm �boolr r r �bytesr r# r) r+ r4 r5 r8 r �os�PathLiker? rA rF rG r rc r rV rW rX rT r! r! r! r" r s�
���
�
��
�
��� �
� ���
�$���
�e���
� & 9
������r r; )rr r rv �typingr r r r r r r r Z zmq.errorr Z zmq.utilsr
r r r; rU r �__all__r! r! r! r" �<module> s $ *