HEX
Server: Apache
System: Linux server2.voipitup.com.au 4.18.0-553.109.1.lve.el8.x86_64 #1 SMP Thu Mar 5 20:23:46 UTC 2026 x86_64
User: posscale (1027)
PHP: 8.2.30
Disabled: exec,passthru,shell_exec,system
Upload Files
File: //opt/saltstack/salt/lib/python3.10/site-packages/zmq/auth/__pycache__/base.cpython-310.pyc
o

�N�g�?�@s�dZddlZddlZddlmZmZmZmZmZm	Z	m
Z
ddlZddlm
Z
ddlmZddlmZdZd	ZGd
d�d�ZddgZdS)
z*Base implementation of 0MQ authentication.�N)�Any�Dict�List�Optional�Set�Tuple�Union)�_check_version)�z85�)�load_certificates�*s1.0c@seZdZUdZded<eed<eed<eeefed<ded<e	eed	<e	eed
<eeeeeffed<eeee
effed<eed
<			d@dedded
efdd�ZdAdd�Z
dAdd�Zdeddfdd�Zdeddfdd�Z	dBdedeeefddfdd�Z	 dCded!eeejfddfd"d#�Z	dBded$eddfd%d&�Zd'e
defd(d)�Z	dBded!eeddfd*d+�Zd,ee
fd-d.�Zded/ed0edeee
ffd1d2�Zded3e
deee
ffd4d5�Zded6e
deee
ffd7d8�Z	9dDd:e
d;e
d<e
d=eddf
d>d?�ZdS)E�
Authenticatora�Implementation of ZAP authentication for zmq connections.

    This authenticator class does not register with an event loop. As a result,
    you will need to manually call `handle_zap_message`::

        auth = zmq.Authenticator()
        auth.allow("127.0.0.1")
        auth.start()
        while True:
            auth.handle_zap_msg(auth.zap_socket.recv_multipart()

    Alternatively, you can register `auth.zap_socket` with a poller.

    Since many users will want to run ZAP in a way that does not block the
    main thread, other authentication classes (such as :mod:`zmq.auth.thread`)
    are provided.

    Note:

    - libzmq provides four levels of security: default NULL (which the Authenticator does
      not see), and authenticated NULL, PLAIN, CURVE, and GSSAPI, which the Authenticator can see.
    - until you add policies, all incoming NULL connections are allowed.
      (classic ZeroMQ behavior), and all PLAIN and CURVE connections are denied.
    - GSSAPI requires no configuration.
    zzmq.Context�context�encoding�	allow_any�credentials_providersz
zmq.Socket�
zap_socket�	whitelist�	blacklist�	passwords�certs�logN�utf-8cCsbtdd�|ptj��|_||_d|_i|_d|_t	�|_
t	�|_i|_i|_
|p-t�d�|_dS)N)�rZsecurityFzzmq.auth)r	�zmqZContext�instancerrrrr�setrrrr�logging�	getLoggerr)�selfrrr�r!�A/opt/saltstack/salt/lib/python3.10/site-packages/zmq/auth/base.py�__init__:s
zAuthenticator.__init__�returncCs4|j�tj�|_d|j_|j�d�|j�d�dS)zCreate and bind the ZAP socketrzinproc://zeromq.zap.01ZStartingN)	r�socketrZREPrZlinger�bindr�debug�r r!r!r"�startPszAuthenticator.startcCs|jr|j��d|_dS)zClose the ZAP socketN)r�closer(r!r!r"�stopWs

zAuthenticator.stop�	addressescG�2|jrtd��|j�dd�|��|j�|�dS)aIAllow (whitelist) IP address(es).

        Connections from addresses not in the whitelist will be rejected.

        - For NULL, all clients from this address will be accepted.
        - For real auth setups, they will be allowed to continue with authentication.

        whitelist is mutually exclusive with blacklist.
        �-Only use a whitelist or a blacklist, not bothzAllowing %s�,N)r�
ValueErrorrr'�joinr�update�r r,r!r!r"�allow]s
zAuthenticator.allowcGr-)z�Deny (blacklist) IP address(es).

        Addresses not in the blacklist will be allowed to continue with authentication.

        Blacklist is mutually exclusive with whitelist.
        r.z
Denying %sr/N)rr0rr'r1rr2r3r!r!r"�denylszAuthenticator.denyr
�domaincCs |r||j|<|j�d|�dS)z�Configure PLAIN authentication for a given domain.

        PLAIN authentication uses a plain-text password file.
        To cover all domains, use "*".
        You can modify the password file at any time; it is reloaded automatically.
        zConfigure plain: %sN�rrr')r r6rr!r!r"�configure_plainxs	
zAuthenticator.configure_plain�.�locationc
Cst|j�d||�|tkrd|_dSd|_z
t|�|j|<WdSty9}z|j�d||�WYd}~dSd}~ww)a	Configure CURVE authentication for a given domain.

        CURVE authentication uses a directory that holds all public client certificates,
        i.e. their public keys.

        To cover all domains, use "*".

        You can add and remove certificates in that directory at any time. configure_curve must be called
        every time certificates are added or removed, in order to update the Authenticator's state

        To allow all client keys without checking, specify CURVE_ALLOW_ANY for the location.
        zConfigure curve: %s[%s]TFz&Failed to load CURVE certs from %s: %sN)rr'�CURVE_ALLOW_ANYrrr�	Exception�error)r r6r:�er!r!r"�configure_curve�s
��zAuthenticator.configure_curve�credentials_providercCs.d|_|dur||j|<dS|j�d|�dS)aConfigure CURVE authentication for a given domain.

        CURVE authentication using a callback function validating
        the client public key according to a custom mechanism, e.g. checking the
        key against records in a db. credentials_provider is an object of a class which
        implements a callback method accepting two parameters (domain and key), e.g.::

            class CredentialsProvider(object):

                def __init__(self):
                    ...e.g. db connection

                def callback(self, domain, key):
                    valid = ...lookup key and/or domain in db
                    if valid:
                        logging.info('Authorizing: {0}, {1}'.format(domain, key))
                        return True
                    else:
                        logging.warning('NOT Authorizing: {0}, {1}'.format(domain, key))
                        return False

        To cover all domains, use "*".

        To allow all client keys without checking, specify CURVE_ALLOW_ANY for the location.
        FNz0None credentials_provider provided for domain:%s)rrrr=)r r6r@r!r!r"�configure_curve_callback�sz&Authenticator.configure_curve_callback�client_public_keycCst�|��d�S)a�Return the User-Id corresponding to a CURVE client's public key

        Default implementation uses the z85-encoding of the public key.

        Override to define a custom mapping of public key : user-id

        This is only called on successful authentication.

        Parameters
        ----------
        client_public_key: bytes
            The client public key used for the given message

        Returns
        -------
        user_id: unicode
            The user ID as text
        �ascii)r
�encode�decode)r rBr!r!r"�
curve_user_id�szAuthenticator.curve_user_idcCsdS)z~Configure GSSAPI authentication

        Currently this is a no-op because there is nothing to configure with GSSAPI.
        Nr!)r r6r:r!r!r"�configure_gssapi�szAuthenticator.configure_gssapi�msgc	s�t|�dkr&�j�d|�t|�dkr�j�d�dS��|ddd�dS|dd�\}}}}}}|dd�}|��jd	�}|��jd	�}|tkrZ�j�d
|���|dd�dS�j�d||||||�d
}	d
}
d}�jr�|�jvr~d}	�j�d|�n)d}
d}�j�d|�n�j	r�|�j	vr�d}
d}�j�d|�n	d}	�j�d|�d}|
�sH|dkr�|	s��j�d�d}	n�|dkr�t|�dkrՈj�d|���|dd�dS�fdd�|D�\}}
��
|||
�\}	}n^|dk�rt|�dk�r�j�d|���|dd�dS|d }��||�\}	}|	�r��|�}n-|d!k�rHt|�dk�r7�j�d"|���|dd�dS|d }|�d#�}��
||�\}	}|	�rU��|d$d%|�dS��|d|�dS)&zPerform ZAP authentication�z*Invalid ZAP message, not enough frames: %r�zNot enough information to replyrs400sNot enough framesN�replacezInvalid ZAP version: %rsInvalid versionzQversion: %r, request_id: %r, domain: %r, address: %r, identity: %r, mechanism: %rFs	NO ACCESSTzPASSED (whitelist) address=%ssAddress not in whitelistz$DENIED (not in whitelist) address=%ssAddress is blacklistedzDENIED (blacklist) address=%sz$PASSED (not in blacklist) address=%s�	anonymoussNULLzALLOWED (NULL)sPLAINzInvalid PLAIN credentials: %rsInvalid credentialsc3s�|]
}|��jd�VqdS)rKN)rEr)�.0�cr(r!r"�	<genexpr>'s�
�z3Authenticator.handle_zap_message.<locals>.<genexpr>sCURVEzInvalid CURVE credentials: %rrsGSSAPIzInvalid GSSAPI credentials: %r�utf8�200�OK)�lenrr=�_send_zap_replyrEr�VERSIONr'rr�_authenticate_plain�_authenticate_curverF�_authenticate_gssapi)r rH�version�
request_idr6�address�identityZ	mechanismZcredentials�allowedZdenied�reason�username�password�key�	principalr!r(r"�handle_zap_message�s���



�

�

z Authenticator.handle_zap_messager_r`cCs�d}d}|jrE|sd}||jvr)||j|vr&||j||kr#d}nd}nd}nd}|r:|j�d|||�||fS|j�d	|�||fSd
}|j�d|�||fS)zPLAIN ZAP authenticationF�r
TsInvalid passwordsInvalid usernamesInvalid domainz1ALLOWED (PLAIN) domain=%s username=%s password=%sz	DENIED %ssNo passwords definedzDENIED (PLAIN) %sr7)r r6r_r`r]r^r!r!r"rVFs2
�
��z!Authenticator._authenticate_plain�
client_keycCsd}d}|jrd}d}|j�d�||fS|jikrQ|sd}||jvrKt�|�}|j|�||�r6d}d}nd}|r<dnd	}|j�d
|||�||fSd}||fS|sUd}||jvr�t�|�}|j|�|�rld}d}nd}|rrdnd	}|j�d|||�||fSd}||fS)
zCURVE ZAP authenticationFrdTrRz ALLOWED (CURVE allow any client)r
sUnknown keyZALLOWEDZDENIEDz0%s (CURVE auth_callback) domain=%s client_key=%ssUnknown domainz"%s (CURVE) domain=%s client_key=%s)	rrr'rr
rD�callbackr�get)r r6rer]r^Zz85_client_key�statusr!r!r"rWlsX0
�

� ��

�	�z!Authenticator._authenticate_curverbcCs|j�d||�dS)zPNothing to do for GSSAPI, which has already been handled by an external service.z'ALLOWED (GSSAPI) domain=%s principal=%s)TrR)rr')r r6rbr!r!r"rX�sz"Authenticator._authenticate_gssapirLrZ�status_code�status_text�user_idcCs\|dkr|nd}t|t�r|�|jd�}d}|j�d||�t|||||g}|j�|�dS)z.Send a ZAP reply to finish the authentication.rQrdrKzZAP reply code=%s text=%sN)	�
isinstance�strrDrrr'rUrZsend_multipart)r rZrirjrk�metadataZreplyr!r!r"rT�s
zAuthenticator._send_zap_reply)NrN)r$N)r
N)r
r9)rL) �__name__�
__module__�__qualname__�__doc__�__annotations__rm�boolrrr�bytesrr#r)r+r4r5r8r�os�PathLiker?rArFrGrrcrrVrWrXrTr!r!r!r"rs�
���
�


��
�
����
����
�$���
�e���

�&9
������rr;)rrrrv�typingrrrrrrrrZ	zmq.errorr	Z	zmq.utilsr
rrr;rUr�__all__r!r!r!r"�<module>s$*