File: //opt/saltstack/salt/lib/python3.10/site-packages/salt/__pycache__/key.cpython-310.pyc
o
�N�g8} � @ s� d Z ddlZddlZddlZddlZddlZddlZddlZddl Zddl
Zddl Zddl Zddl
ZddlZddlZddlZddlZddlZddlZddlZddlZddlZddlZddlZe�e�Zdd� Z G dd� d�Z G dd� d�Z dS ) z�
The Salt Key backend API and interface used by the CLI. The Key class can be
used to manage salt keys directly without interfacing with the CLI.
� Nc C s t | �S �N)�Key��opts� r �</opt/saltstack/salt/lib/python3.10/site-packages/salt/key.py�get_key" s r c @ sb e Zd ZdZddddd�Zdd� Zd d
� Zd d � Zddd�Zddd�Z dd� Z
dd� Z dd� Z d
S )�KeyCLIz#
Manage key CLI operations
� list_status�
delete_key�gen_keys_signature�key_str)�list�delete�
gen_signature�printc C s: || _ tj�|�| _t| _|�d�s| �|�| _d | _d S )N�eauth) r �saltZwheelZ WheelClient�clientr �key�get�auth)�selfr r r r �__init__2 s
zKeyCLI.__init__c C s� dD ] }| j | r nq|�d�s^|dkrd| j d< n|�d�r&d| j d< n| j | | j d< |�d�rF| j d p<| j d
| j d
< d | j d < n,|�d
�r]| j d pT| j d | j d < d | j d
< n|dkrr| j d | j d< | j d | j d< |�dd�| j d< d S )N)�gen_keysr r �list_allr Z print_all�accept�
accept_all�reject�
reject_allr �
delete_all�finger�
finger_allr Zgen_r �all�matchZ_all�*r Z include_all�include_rejectedF�include_acceptedr r � gen_keys_dir�keydir�keyname� �fun)r �
startswith�endswith�replace)r �cmdr r r � _update_opts; s.
�
�
�
�zKeyCLI._update_optsc C sz | j rd S i }| jd dk}| jd r�d| jv rVz-tjj�tj�| jd d�d��}tjj �
|� � �|d< W d � n1 s?w Y W n t yU | jd |d< Y nw d|vr�d|vr�| jd r�tj �
| j�}|�| jd �}| jd r�|r�|�| jd |�}|r�|�dd�|d< |s�t�d � i S |�|� | jd |d< ntjj�� |d
< tjj�|d
| j|�|d< || _ d S ) Nr r+ �token�cachedirz .root_key�rr ZmktokenzAuthentication failed�user)r r r �utils�files�fopen�os�path�join� stringutils�
to_unicode�readline�OSErrorZResolverZcliZ token_clir �log�error�updater5 Zget_specific_userZmasterZget_master_key)r �lowZskip_perm_errors�fp_Zresolver�res�tokr r r �
_init_authh sF
� �� �
� �
zKeyCLI._init_authNc C s� t jj�|�}|d u r4g }|jr-t�t|j�t|jpd��D ]\}}|�| j �
||�� q |d d d� }|j d u r?i }||fS t j �
||�\}}||fS )Nr ���)r r6 �argsZget_function_argspec� itertools� zip_longest�reversed�defaults�appendr r �keywords�minionZload_args_and_kwargs)r r, rI Zargspec�arg�default�kwargsr r r �_get_args_kwargs� s �
�zKeyCLI._get_args_kwargsc C s | j �d�s7| j�||�}t| j|�}| �||�\}}||i |��}t|t�r5d|v r5|dvr5|�dd � |S |dv rI|d u rI| j �di ��d�}d|� �}| j j
| }| �||�\}}|||d�}| � � |� | j
� | j �|�}|d d
}t|t�r�d|v r�|dvr�|�dd � |S ) Nr �local)r! r" �r r r �
match_dict�minionszkey.)r, rQ �kwarg�data�return)r r � CLI_KEY_MAP�getattrr rT �
isinstance�dict�popr Z functionsrG rB r Zcmd_sync)r r0 rI r, rS �retZfstrrC r r r �_run_cmd� s< �
� � zKeyCLI._run_cmdc C s� |� d�r|S i }| jj|v r|| jj || jj< | jd r1t|�| jj��r1|| jj || jj< | jd rIt|�| jj��rI|| jj || jj< | jd rat|�| jj��ra|| jj || jj< |S )Nr r' r& �include_denied) r- r �PENDr �boolr �ACC�REJ�DEN)r r0 ra �keysr r r � _filter_ret� s
zKeyCLI._filter_retc C s� dg}| j d r
|�d� | j d r|�d� | j d r!|�d� t|�dkr,|d }nd
�d �|d d � �|d �}d
|� d|� d�}t|� d S )NZ
unacceptedr' Zacceptedr& Zrejectedrc Zdenied� r z{} or {}z, rH zThe key glob 'z' does not match any z keys.)r rN �len�formatr; r )r r0 r$ ZstatusesZstat_str�msgr r r �_print_no_match� s
zKeyCLI._print_no_matchc
C s& | � � | jd }d}d}z�|dv r�| �d�}t|t�s)tjj|d| jd� |W S | �||�}|s=| � || jd � W dS t
d� |� d ��� tjj|d| jd� | j�
d
d �s|z|�d �rgtd
�}|sfd}ntd�}|sod}W n ty{ td��w || jd< | j�dd� |}|du s�|�� �d�r�| �|�}|dv r�|d kr�|}|�� D ]}|D ]
}t
d� ||� d ��� q�q�W |S t|t�r�tjj|d| jd� W |S tjjd|id| jd� W |S W |S tjj�y } z"|� }| j�
dd ��stj�|d| j� W Y d}~|S W Y d}~|S d}~ww )z+
Run the logic for saltkey
r, NrV �
name_matchr r r$ z(The following keys are going to be {}ed:�eZyesFr zProceed? [N/y] �nzProceed? [n/Y] �yz
Exiting on CTRL-crW zKey for minion {} {}ed.r[ �quiet�nested)r1 r rb r^ r_ r �outputZdisplay_outputrj ro r rm �rstripr r- �input�KeyboardInterrupt�
SystemExitr` �lower�values�
exceptionsZ
SaltException)r r0 Zverira Zlist_retrX rP �excr r r �run� s�
�
�� �
����
����
���z
KeyCLI.runr )
�__name__�
__module__� __qualname__�__doc__r\ r r1 rG rT rb rj ro r r r r r r & s � -
(
* r c @ s e Zd ZdZdZdZdZdZd>dd�Zd d
� Z d d � Z
d?d
d�Z dd� Z d@dd�Z
d>dd�Zdd� ZdAdd�Zdd� Zd d � Zd d � Zd d!� Zd"d#� Zd$d%� Zd&d'� Z dBd(d)�Zd*d+� Z dCd,d-�Zd.d/� Zd0d1� Z dBd2d3�Z d4d5� Z d>d6d7�Z d>d8d9�Z d:d;� Z!d<d=� Z"dS )Dr z6
The object that encapsulates saltkey actions
rX � minions_pre�minions_rejected�minions_deniedNc C s~ || _ | j �dd�}|tjjjvr d|� d�}t�|� t|��tjj j
||d |d|d�| _ tjj � | j �d�| j �| _
d S ) NZ__roler+ z Invalid application kind = 'z'.�sock_dirF)r �listen�io_loopZsigning_key_pass)r r r r6 ZkindsZ
APPL_KINDSr@ rA �
ValueError�eventZ get_eventZsdbZsdb_get�
passphrase)r r r� �kindZemsgr r r r 6 s
�
�z Key.__init__c C sd t j�| jd | j�}t j�| jd | j�}t j�| jd | j�}t j�| jd | j�}||||fS )z8
Return the minion keys directory paths
�pki_dir)r9 r: r; r rf rd rg rh )r Zminions_acceptedr� r� r� r r r �_check_minions_directoriesI s
z Key._check_minions_directoriesc C s\ |sd| j v r
| j d }n| j d }|s!d| j v r | j d }nd}|s(| j d }||||fS )Nr( r� r rP �keysizer �r r) r* r� r5 r r r �_get_key_attrsT s
zKey._get_key_attrsc C sJ | � ||||�\}}}}tj�||||| j� tjj�tj� ||d ��S )z4
Generate minion RSA public keypair
�.pub)
r� r �cryptr r� r6 �
pem_fingerr9 r: r; r� r r r r c s
� z Key.gen_keysc C s t j�|||| j�S )�6
Generate master public-key-signature
)r r� r r� )r ZprivkeyZpubkeyZsig_pathr r r r m s zKey.gen_signatureFc
C sj |rt j�|�sd|� d�S n| jd d d }t j�|�r |}|r/t j�|�s.d|� d�S n| jd d d }t j�|�r@|}|s||rzt�d| jd | jd � tj�| jd | jd |pb| jd
| j� d �| j
� | jd d | jd d }nd
S |s�dS t�d|� t�d|� |r�t j� |�s�t�d|� n| jd }|d | jd }t | j�} | �
|||�S )r� z Public-key z does not existr� �/z
master.pubz Private-key zmaster_sign.pemz+Generating new signing key-pair .%s.* in %sZmaster_sign_key_namer� r5 �.pemzNo usable private-key foundzNo usable public-key foundzUsing public-key %szUsing private-key %sz"target directory %s does not existZmaster_pubkey_signature)r9 r: �isfiler r@ �debugr r� r r r� �isdirr r )
r ZprivZpubZsignature_pathZ auto_creater� ZmpubZmprivZ sign_pathZskeyr r r r s sb � � �
� ���� �
zKey.gen_keys_signaturec C s* |du rg }| � � }g }|�� D ] \}}|�|� q| j�dd�s�tj�| jd | j�}tj� |�rht�
|�D ]0}||vrg||vrgz t � tj�||�� W q7 t
yf } z
t�d||� W Y d}~q7d}~ww q7tj�| j�} | �| j�}
|
r�|
D ]}||vr�||vr�| �| j� d|� �� qydS dS dS )z�
Check the minion cache to make sure that old minion data is cleared
Optionally, pass in a list of minions which should have their caches
preserved. To preserve all caches, set __opts__['preserve_minion_cache']
NZpreserve_minion_cacheFr3 z2Key: Delete cache for %s got OSError/IOError: %s
r� )� list_keys�items�extendr r r9 r: r; rf r� �listdir�shutil�rmtreer? r@ �warningr �cache�factoryr �flush) r �preserve_minionsri rX r �valZm_cacherP �exr� Zclistr r r �check_minion_cache� sB � ��� ��zKey.check_minion_cachec C s$ t j�t j�| jd d��sdS dS )z~
Log if the master is not running
:rtype: bool
:return: Whether or not the master is running
r� zpublish_pull.ipcFT)r9 r: �existsr; r �r r r r � check_master� s zKey.check_masterc C s� |r| � � }n| �� }i }d|v rt|t�r|�d�}|�� D ]C\}}tjj� |�D ]7}t|t
�rL|D ]}t � ||�rJ||vrCg ||< || � |� q3q*t � ||�ra||vrZg ||< || � |� q*q |S )zY
Accept a glob which to match the of a key and return the key's location
�,)
�all_keysr� r^ �str�splitr� r r6 rZ �sorted_ignorecaser �fnmatchrN ) r r$ �full�matchesra �statusri r Z
match_itemr r r rp � s.
�� �� zKey.name_matchc C sz i }| � � }|�� D ]0\}}tjj�|�D ]$}| j| j| j| j fD ]}|r8t
� |� |g �|�r8|�
|g ��|� q!qq
|S )zh
Accept a dictionary of keys and return the current state of the
specified keys
)r� r� r r6 rZ r� rf rd rg rh r� �filterr �
setdefaultrN )r rW ra Zcur_keysr� ri r r) r r r �
dict_match� s ���zKey.dict_matchc C sn dg i}t jj�t�| jd ��D ]#}|�d�s |�d�r4tj� | jd |�}tj�
|�r4|d � |� q|S )z-
Return a dict of local keys
rU r� r� r� ) r r6 rZ r� r9 r� r r. r: r; r� rN )r ra �fn_r: r r r �
local_keys s �zKey.local_keysc C s� | � � }i }|D ]G}|du rqg |tj�|�< z/tjj�t�|��D ]"}|� d�sDtj�
tj� ||��rD|tj�|� � tjj
�|�� q"W q tyO Y qw |S )zK
Return a dict of managed keys and what the key status are
N�.)r� r9 r: �basenamer r6 rZ r� r� r- r� r; rN r< r= r? )r Zkey_dirsra Zdir_r� r r r r� s&
��� �z
Key.list_keysc C s | � � }|�| �� � |S )z4
Merge managed keys with local keys
)r� rB r� )r ri r r r r� / s z Key.all_keysc C s� | � � \}}}}i }|�d�rAg |tj�|�< tjj�t� |��D ] }|�d�s>tj�
tj� ||��r>|tj�|� � |� q!|S |�d�sK|�d�r}g |tj�|�< tjj�t� |��D ] }|�d�sztj�
tj� ||��rz|tj�|� � |� q]|S |�d�r�g |tj�|�< tjj�t� |��D ] }|�d�s�tj�
tj� ||��r�|tj�|� � |� q�|S |�d�r�|dur�g |tj�|�< tjj�t� |��D ] }|�d�s�tj�
tj� ||��r�|tj�|� � |� q�|S |�d�r�| �
� S |S ) zD
Return a dict of managed keys under a named status
�accr� �preZun�rej�denNr# )r� r- r9 r: r� r r6 rZ r� r� r� r; rN r� )r r$ r� r� r� r� ra r� r r r r
7 sJ
��
�
�
� �
�
�zKey.list_statusc
C s� i }| � |��� D ]B\}}i ||< tjj�|�D ]2}tj�| j d ||�}tjj
� |d��}tjj �
|�� �|| |< W d � n1 sEw Y qq |S )zI
Return the specified public key or keys based on a glob
r� r4 N)rp r� r r6 rZ r� r9 r: r; r r7 r8 r< r= �read)r r$ ra r� ri r r: rD r r r r
Y s ���z Key.key_strc
C s� i }| � � �� D ]B\}}i ||< tjj�|�D ]2}tj�| j d ||�}tjj
� |d��}tjj �
|�� �|| |< W d � n1 sDw Y qq|S )z0
Return all managed key strings
r� r4 N)r� r� r r6 rZ r� r9 r: r; r r7 r8 r< r= r� )r ra r� ri r r: rD r r r � key_str_allf s ���zKey.key_str_allc
C sx |dur
| � |�}n|durt|t�r|}ni }| jg}|r$|�| j� |r,|�| j� g }|D ]e}|�|g �D ]\} tj �
| j d || �}
zt j
�|
� W n t jjye t�d| � |�|| f� Y q8w z%t�|
tj �
| j d | j| �� dd| d�} | j�| t jjjdd�� W q8 ty� Y q8w q0|D ]\}} || �| � t j � d | � d
�� q�|dur�| � |�S | � |�S ) z�
Accept public keys. If "match" is passed, it is evaluated as a glob.
Pre-gathered matches can also be passed via "match_dict".
Nr� zInvalid RSA public key: %sTr ��resultZact�idr ��prefixz!Unable to accept invalid key for z.
) rp r^ r_ rd rN rg rh r r9 r: r; r r r� Zget_rsa_pub_keyr} ZInvalidKeyErrorr@ rA r� �moverf r� �
fire_eventr6 �tagifyr? �remove�sys�stderr�writer� ) r r$ rW r& rc r� �keydirsZ invalid_keysr) r Zkey_path�eloadr r r r s sH �� �� z
Key.acceptc C s� | � � }|| j D ]:}z/t�tj�| jd | j|�tj�| jd | j|�� dd|d�}| j �
|t j j j
dd�� W q tyC Y q w | � � S )z(
Accept all keys in pre
r� Tr r� r r� )r� rd r� r� r9 r: r; r rf r� r� r r6 r� r? �r ri r r� r r r r � s � �zKey.accept_allc C s� |dur
| � |�}n|durt|t�r|}ni }tjj| jd��l}|�� D ]_\}}|D ]X} zM|rX| j�d�du r=t d� nz|�
| d� W n tj j yW t d�
| �� Y nw t�tj�| jd || �� d d
| d �}
| j�|
tjjjd d
�� W q+ ty� Y q+w q%W d � n1 s�w Y | j�d�d u r�| j|�dg �d� n| �� | j�d�r�tj�| jd | jd � |dur�| � |�S | �|�S )z�
Delete public keys. If "match" is passed, it is evaluated as a glob.
Pre-gathered matches can also be passed via "match_dict".
To preserve the master caches of minions who are matched, set preserve_minions
N)Zmopts�rotate_aes_keyFz�Immediate auth revocation specified but AES key rotation not allowed. Minion will not be disconnected until the master AES key is rotated.zsaltutil.revoke_authz�Cannot contact Salt master. Connection for {} will remain up until master AES key is rotated or auth is revoked with 'saltutil.revoke_auth'.r� Tr r� r r� r� rX )r� r3 r5 )rp r^ r_ r r Zget_local_clientr r� r r Z cmd_asyncr} ZSaltClientErrorrm r9 r� r: r; r� r� r6 r� r? r� r� �dropfiler� ) r r$ rW r� Z revoke_authr� r r� ri r r� r r r r � sN ��� � ��� � zKey.delete_keyc
C s� | � � }| � � �� D ]8\}}|| j D ].}z#t�tj�| jd ||�� dd|d�}| j� |t
j jj dd�� W q t
yA Y qw q
| �� | � � S )z(
Delete all denied keys
r� Tr r� r r� )r� r� rh r9 r� r: r; r r� r� r r6 r� r? r� )r ri r� r r� r r r �
delete_den� s ��zKey.delete_denc
C s� | � � �� D ]5\}}|D ].}z#t�tj�| jd ||�� dd|d�}| j�|t j
jj dd�� W q t y: Y q w q| �
� | j�d�rSt j�| jd | jd � | � � S )
z!
Delete all keys
r� Tr r� r r� r� r3 r5 )r� r� r9 r� r: r; r r� r� r r6 r� r? r� r r� r� )r r� ri r r� r r r r � s �� zKey.delete_allc
C s, |dur
| � |�}n|durt|t�r|}ni }| jg}|r$|�| j� |r,|�| j� |D ]B}|�|g �D ]9}z.t� t
j � | j
d ||�t
j � | j
d | j|�� dd|d�} | j�| tjjjdd�� W q6 tyo Y q6w q.| �� | j
�d�r�tj�| j
d | j
d
� |dur�| � |�S | �|�S ) z�
Reject public keys. If "match" is passed, it is evaluated as a glob.
Pre-gathered matches can also be passed via "match_dict".
Nr� Tr r� r r� r� r3 r5 )rp r^ r_ rd rN rf rh r r� r� r9 r: r; r rg r� r� r r6 r� r? r� r� r� r� )
r r$ rW r' rc r� r� r) r r� r r r r s6 � ��
z
Key.rejectc C s� | � � }|| j D ]:}z/t�tj�| jd | j|�tj�| jd | j|�� dd|d�}| j �
|t j j j
dd�� W q tyC Y q w | �� | j�d�r[t j�| jd | jd � | � � S )
z(
Reject all keys in pre
r� Tr r� r r� r� r3 r5 )r� rd r� r� r9 r: r; r rg r� r� r r6 r� r? r� r r� r� r� r r r r $ s � � zKey.reject_allc C s� |du rt d }| �|d�}i }|�� D ]4\}}i ||< |D ])}|dkr/tj�| jd |�}n tj�| jd ||�}tjj j
||d�|| |< q q|S )z<
Return the fingerprint for a specified key
N� hash_typeTrU r� �Zsum_type) �__opts__rp r� r9 r: r; r r r6 r� r� ) r r$ r� r� ra r� ri r r: r r r r! 8 s �z
Key.fingerc C s� |du rt d }i }| �� �� D ]4\}}i ||< |D ])}|dkr+tj�| jd |�}n tj�| jd ||�}tjj j
||d�|| |< qq|S )z2
Return fingerprints for all keys
Nr� rU r� r� ) r� r� r� r9 r: r; r r r6 r� r� )r r� ra r� ri r r: r r r r" K s �zKey.finger_allc C s | S r r r� r r r � __enter__] s z
Key.__enter__c G s | j �� d S r )r� Zdestroy)r rI r r r �__exit__` s z Key.__exit__r )NNNN)FN)F)NNFF)NNNF)#r� r� r� r� rf rd rg rh r r� r� r r r r� r� rp r� r� r� r� r
r
r� r r r r� r r r r! r" r� r� r r r r r , sJ
�
C"
"
�*
�3
�"
r ) r� r� rJ �loggingr9 r� r� Z
salt.cacher Z salt.clientZ
salt.cryptZsalt.daemons.masterapiZsalt.exceptionsZ salt.minionZsalt.utils.argsZsalt.utils.cryptZsalt.utils.dataZsalt.utils.eventZsalt.utils.filesZsalt.utils.jsonZsalt.utils.kindsZsalt.utils.masterZsalt.utils.sdbZsalt.utils.stringutilsZsalt.utils.user� getLoggerr� r@ r r r r r r r �<module> s<