File: //lib64/python3.6/site-packages/zmq/auth/__pycache__/base.cpython-36.pyc
3
VS�_�9 � @ st d Z ddlZddlZddlmZ ddlmZmZmZm Z ddl
m Z ddl m
Z
dZd ZG d
d � d e�Zd d gZdS )
z*Base implementation of 0MQ authentication.� N)�z85)�bytes�unicode�b�u)�_check_version� )�load_certificates�*s 1.0c @ s� e Zd ZdZd$dd�Zdd� Zdd � Zd
d � Zd d
� Zd%dd�Z d&dd�Z
d'dd�Z dd� Z d(dd�Z
dd� Zdd � Zd d � Zd d � Zd)d"d#�ZdS )*�
Authenticatora� Implementation of ZAP authentication for zmq connections.
Note:
- libzmq provides four levels of security: default NULL (which the Authenticator does
not see), and authenticated NULL, PLAIN, CURVE, and GSSAPI, which the Authenticator can see.
- until you add policies, all incoming NULL connections are allowed.
(classic ZeroMQ behavior), and all PLAIN and CURVE connections are denied.
- GSSAPI requires no configuration.
N�utf-8c C sb t dd� |ptjj� | _|| _d| _i | _d | _t � | _
t � | _ i | _ i | _
|pZtjd�| _d S )N� r ZsecurityFzzmq.auth)r
r )r �zmqZContext�instance�context�encoding� allow_any�credentials_providers�
zap_socket�set� whitelist� blacklist� passwords�certs�loggingZ getLogger�log)�selfr r r � r � /usr/lib64/python3.6/base.py�__init__ s
zAuthenticator.__init__c C s4 | j jtj�| _d| j_| jjd� | jjd� dS )z Create and bind the ZAP socketr zinproc://zeromq.zap.01ZStartingN) r Zsocketr ZREPr ZlingerZbindr �debug)r r r r �start0 s zAuthenticator.startc C s | j r| j j� d| _ dS )zClose the ZAP socketN)r �close)r r r r �stop7 s
zAuthenticator.stopc G s2 | j rtd��| jjddj|�� | jj|� dS )aa Allow (whitelist) IP address(es).
Connections from addresses not in the whitelist will be rejected.
- For NULL, all clients from this address will be accepted.
- For real auth setups, they will be allowed to continue with authentication.
whitelist is mutually exclusive with blacklist.
z-Only use a whitelist or a blacklist, not bothz Allowing %s�,N)r �
ValueErrorr r �joinr �update)r � addressesr r r �allow= s
zAuthenticator.allowc G s2 | j rtd��| jjddj|�� | jj|� dS )z�Deny (blacklist) IP address(es).
Addresses not in the blacklist will be allowed to continue with authentication.
Blacklist is mutually exclusive with whitelist.
z-Only use a whitelist or a blacklist, not bothz
Denying %sr$ N)r r% r r r& r r' )r r( r r r �denyL s zAuthenticator.denyr
c C s |r|| j |< | jjd|� dS )z�Configure PLAIN authentication for a given domain.
PLAIN authentication uses a plain-text password file.
To cover all domains, use "*".
You can modify the password file at any time; it is reloaded automatically.
zConfigure plain: %sN)r r r )r �domainr r r r �configure_plainX s
z Authenticator.configure_plainc C sp | j jd||� |tkr d| _nLd| _yt|�| j|< W n2 tk
rj } z| j jd||� W Y dd}~X nX dS )a+ Configure CURVE authentication for a given domain.
CURVE authentication uses a directory that holds all public client certificates,
i.e. their public keys.
To cover all domains, use "*".
You can add and remove certificates in that directory at any time. configure_curve must be called
every time certificates are added or removed, in order to update the Authenticator's state
To allow all client keys without checking, specify CURVE_ALLOW_ANY for the location.
zConfigure curve: %s[%s]TFz&Failed to load CURVE certs from %s: %sN)r r �CURVE_ALLOW_ANYr r r � Exception�error)r r+ �location�er r r �configure_curvec s z Authenticator.configure_curvec C s, d| _ |dk r|| j|< n| jjd|� dS )a Configure CURVE authentication for a given domain.
CURVE authentication using a callback function validating
the client public key according to a custom mechanism, e.g. checking the
key against records in a db. credentials_provider is an object of a class which
implements a callback method accepting two parameters (domain and key), e.g.::
class CredentialsProvider(object):
def __init__(self):
...e.g. db connection
def callback(self, domain, key):
valid = ...lookup key and/or domain in db
if valid:
logging.info('Authorizing: {0}, {1}'.format(domain, key))
return True
else:
logging.warning('NOT Authorizing: {0}, {1}'.format(domain, key))
return False
To cover all domains, use "*".
To allow all client keys without checking, specify CURVE_ALLOW_ANY for the location.
FNz0None credentials_provider provided for domain:%s)r r r r/ )r r+ Zcredentials_providerr r r �configure_curve_callback| s z&Authenticator.configure_curve_callbackc C s t j|�jd�S )a Return the User-Id corresponding to a CURVE client's public key
Default implementation uses the z85-encoding of the public key.
Override to define a custom mapping of public key : user-id
This is only called on successful authentication.
Parameters
----------
client_public_key: bytes
The client public key used for the given message
Returns
-------
user_id: unicode
The user ID as text
�ascii)r �encode�decode)r Zclient_public_keyr r r �
curve_user_id� s zAuthenticator.curve_user_idc C s dS )z�Configure GSSAPI authentication
Currently this is a no-op because there is nothing to configure with GSSAPI.
Nr )r r+ r0 r r r �configure_gssapi� s z Authenticator.configure_gssapic s� t |�dk rJ� jjd|� t |�dk r4� jjd� n� j|d dd� dS |dd� \}}}}}}|dd� }t|� jd �}t|� jd �}|tkr�� jjd
|� � j|dd � dS � jjd ||||||� d
} d
}
d} � j�r|� jkr�d} � jjd|� nd}
d} � jjd|� n>� j �rR|� j k�r@d}
d} � jjd|� nd} � jjd|� td�} |
�s�|dk�r�| �r�� jjd� d} �n|dk�r�t |�dk�r�� jjd|� � j|dd� dS � fd d �|D �\} }
� j
|| |
�\} } n�|d k�rJt |�dk�r � jjd |� � j|dd� dS |d }� j ||�\} } | �r�� j |�} nT|d!k�r�t |�dk�r�� jjd"|� � j|dd� dS |d }} � j
||�\} } | �r�� j|d#d$| � n� j|d| � dS )%zPerform ZAP authentication� z*Invalid ZAP message, not enough frames: %r� z Not enough information to replyr s 400s Not enough framesN�replacezInvalid ZAP version: %rs Invalid versionzQversion: %r, request_id: %r, domain: %r, address: %r, identity: %r, mechanism: %rFs NO ACCESSTz PASSED (whitelist) address=%ss Address not in whitelistz$DENIED (not in whitelist) address=%ss Address is blacklistedz DENIED (blacklist) address=%sz$PASSED (not in blacklist) address=%s� anonymouss NULLzALLOWED (NULL)s PLAINz Invalid PLAIN credentials: %rs Invalid credentialsc s g | ]}t |� jd ��qS )r; )r r )�.0�c)r r r �
<listcomp>� s z4Authenticator.handle_zap_message.<locals>.<listcomp>s CURVEz Invalid CURVE credentials: %rr s GSSAPIz Invalid GSSAPI credentials: %rs 200s OK)�lenr r/ �_send_zap_replyr r �VERSIONr r r �_authenticate_plain�_authenticate_curver7 �_authenticate_gssapi)r �msg�version�
request_idr+ ZaddressZidentityZ mechanismZ credentials�allowedZdenied�reason�username�password�key� principalr )r r �handle_zap_message� s�
z Authenticator.handle_zap_messagec C s� d}d}| j r~|sd}|| j krR|| j | krL|| j | | krFd}qPd}qVd}nd}|rn| jjd|||� q�| jjd |� nd
}| jjd |� ||fS ) zPLAIN ZAP authenticationF� r
Ts Invalid passwords Invalid usernames Invalid domainz1ALLOWED (PLAIN) domain=%s username=%s password=%sz DENIED %ss No passwords definedzDENIED (PLAIN) %s)r r r )r r+ rK rL rI rJ r r r rC s&
z!Authenticator._authenticate_plainc C s� d}d}| j r$d}d}| jjd� n�| ji kr�|s6d}|| jkr�tj|�}| j| j||�rfd}d}nd}|rrdnd }| jjd
|||� q�d }n^|s�d}|| jkr�tj|�}| j| j|�r�d}d}nd}|r�dnd }| jjd |||� nd }||fS )
zCURVE ZAP authenticationFrP Ts OKz ALLOWED (CURVE allow any client)r
s Unknown keyZALLOWEDZDENIEDz0%s (CURVE auth_callback) domain=%s client_key=%ss Unknown domainz"%s (CURVE) domain=%s client_key=%s) r r r r r r5 �callbackr �get)r r+ Z
client_keyrI rJ Zz85_client_keyZstatusr r r rD 9 s@
z!Authenticator._authenticate_curvec C s | j jd||� dS )zPNothing to do for GSSAPI, which has already been handled by an external service.z'ALLOWED (GSSAPI) domain=%s principal=%sT� OK)TrS )r r )r r+ rN r r r rE l s z"Authenticator._authenticate_gssapir< c C s\ |dkr |nd}t |t�r(|j| jd�}d}| jjd||� t|||||g}| jj|� dS )z.Send a ZAP reply to finish the authentication.s 200rP r; zZAP reply code=%s text=%sN) �
isinstancer r5 r r r rB r Zsend_multipart)r rH Z status_codeZ status_textZuser_idZmetadataZreplyr r r rA q s
z Authenticator._send_zap_reply)Nr N)r
N)r
N)r
N)r
N)r< )�__name__�
__module__� __qualname__�__doc__r r! r# r) r* r, r2 r3 r7 r8 rO rC rD rE rA r r r r r s
"
^!3r r- )rX r r Z zmq.utilsr Zzmq.utils.strtypesr r r r Z zmq.errorr r r r- rB �objectr �__all__r r r r �<module> s j