| Server IP : 198.38.94.13 / Your IP : 216.73.217.33 Web Server : Apache System : Linux d4744.dxb1.stableserver.net 5.14.0-611.49.1.el9_7.x86_64 #1 SMP PREEMPT_DYNAMIC Tue Apr 21 16:39:08 EDT 2026 x86_64 User : revivere ( 1140) PHP Version : 8.2.33 Disable Function : NONE MySQL : OFF | cURL : ON | WGET : ON | Perl : ON | Python : OFF | Sudo : OFF | Pkexec : OFF Directory : /opt/saltstack/salt/lib/python3.10/site-packages/salt/utils/__pycache__/ |
Upload File : |
o
;j>k � @ s� d Z ddlZddlZddlZddlZddlZddlZddlZddlZddl Z
ddl Z ddl
Z ddlZ ddlZ ddlZ ddlmZ ddlmZmZmZmZ z
ddlZddlZ W n
eyc ddlZY nw e� e �Z e j j �!� rqdndZ"g d�Z#dd � Z$d
d � Z%d d
� Z&dd� Z'dd� Z(dd� Z)dd� Z*ddde"fdd�Z+dd� Z,d d � Z-d<d d �Z.d!d"� Z/d#d$� Z0d%d&� Z1d'd(� Z2d=d*d+�Z3dd)d,�d-d.�Z4d/d0� Z5d1d2� Z6d3d4� Z7d5d6� Z8d>d7d8�Z9d9Z:G d:d;� d;�Z;e;� Z<dS )?z3
A few checks to make sure the environment is sane
� N)�
LOG_LEVELS)�CommandExecutionError�SaltClientError�SaltSystemExit�SaltValidationErrorzc:\salt�/)ztcp://zudp://zfile://c C s zddl } W n
ty Y dS w | j}t�d|�}|s$t�d|� dS |�� \}}}|�� r3t |�}|�� r;t |�}|rE|�� rEt |�}|dkrc|dkrcd|v rZ|sZt�d � dS |rb|d
krbdS n|dkso|dkrq|dkrqdS t�
d � d t j d v r�t�
d
� dS )z6
ZeroMQ python bindings >= 2.1.9 are required
r NTz^(\d+)\.(\d+)(?:\.(\d+))?z0Using untested zmq python bindings version: '%s'� � �devz6Using dev zmq module, please report unexpected results� z,ZeroMQ python bindings >= 2.1.9 are requiredz salt-masterz�The Salt Master is unstable using a ZeroMQ version lower than 2.1.11 and requires this fix: http://lists.zeromq.org/pipermail/zeromq-dev/2011-June/012094.htmlF)
�zmq� Exception� __version__�re�match�log�warning�groups�isdigit�int�critical�sys�argv)r �verr �major�minorZpoint� r �E/opt/saltstack/salt/lib/python3.10/site-packages/salt/utils/verify.py� zmq_version, s@ �
�
�r c C sT t j}zt �| p ddt jt j�}|s|W S |d }|d W S t jy) | Y S w )z�
Lookup a hostname and determine its address family. The first address returned
will be AF_INET6 if the system is IPv6-enabled, and AF_INET otherwise.
Nr )�socket�AF_INET� getaddrinfo� AF_UNSPEC� SOCK_STREAM�gaierror)�hostname�fallbackZ hostnames�hr r r �
lookup_family_ s �
�r( c C s� t | �}||fD ]e}t�|tj�}zWz|�tjtjd� |�| t|�f� W n< tyb } z0d| � d|� �}|j rC|� dt
|�� �}n|� d�}|d7 }t � |� W Y d}~W |�
� dS d}~ww W |�
� q|�
� w d S )
zJ
Attempt to bind to the sockets to verify that they are available
r zUnable to bind socket �:z , error: z , this might not be a problem.z'; Is there another salt-master running?NFT)r( r r# �
setsockopt�
SOL_SOCKET� SO_REUSEADDR�bindr r
�args�strr r �close)Z interfaceZpub_portZret_portZ addr_family�port�sock�exc�msgr r r �
verify_socketr s(
��� r5 c C s@ g }| D ]}d}t D ] }|�|�rd} nq
|r |�|� q|S )z!
Filter files to verify.
TF)�DEFAULT_SCHEMES�
startswith�append)�filesZ to_verify�filenameZ verify_file�schemer r r �verify_logs_filter� s
�
�r< c C s t t| �|�S )z�
Verify the log files exist and are owned by the named user. Filenames that
begin with tcp:// and udp:// will be filtered out. Filenames that begin
with file:// are handled correctly
)� verify_filesr< )r9 �userr r r �verify_log_files� s r? c C s` t jj�� rdS ddl}z|�| �W S ty/ td�| �t j
dd� t � t j j
j� Y dS w )z.
Get the user from passwords database
Tr NzNFailed to prepare the Salt environment for user {}. The user is not available.)�file�flush)�salt�utils�platform�
is_windows�pwd�getpwnam�KeyError�print�formatr �stderr�exit�defaultsZ exitcodes� EX_NOUSER)r> rF r r r �
_get_pwnam� s ��rO c C s� t jj�� rdS t|�}|d }| D ]�}tj�|�}zC|r>zt�|� W n t y= } z
|j
t
j kr3� W Y d}~nd}~ww tj� |�s\t jj
�|d�� W d � n1 sWw Y W nI t y� } z%tj� |�ryd|� d|� d�}t|d��|j
t
jkr�� d �|�}t|d��d}~w t y� } z
d
|� d |� �}t|d��d}~ww t�|�}||jkr�z t�||d � W q t y� Y qw qdS )
zK
Verify that the named files exist and are owned by the named user
Tr N�wzFailed to create path z, is z a file?)r4 zCNo permissions to access "{}", are you running as the correct user?zFailed to create path "z" - ���)rB rC rD rE rO �os�path�dirname�makedirs�OSError�errnoZEEXIST�isfiler9 Zfopenr ZEACCESrJ �stat�st_uid�chown) r9 r> �pwnam�uidZfn_rT �errr4 Zstatsr r r r= � s\ ��� ��
�
�
��
��r= F� c C s� t jj�� rt|| ||d�S t|�}|d }|d }t jjj|dd�} | D �] }
|
s+q%tj �
|
�s�z+t jj � d��
t�
|
� W d � n1 sIw Y t�� dkr[t�|
||� W n$ ty� } zd } tj�| �|
| �� t�| j� W Y d} ~ nd} ~ ww t�|
�}
t�� dk�rt�|
�}|j|ks�|j|kr�|r�|j| v r�nt�|
||� d
d � t�|
�D �D ]c}tj �|
|�}tj j � d �|v r�q�t jj � |�D ]H\}} }t � || �D ]<}|� d
�r�q�tj �||�}z#t�|�}|j|ks�|j|k�r |�r|j| v �rnt�|||� W q� t�y Y q�w q�q�|
|k�rCt�!|
j"�}|dk�rC|dk�rCt�#|
tj$��r=t�%|
d� q%t&�'d|
� q%|du �rNt(� dS dS )�h
Verify that the named directories are in place and that the environment
can shake the salt
)�
permissive�
skip_extrar � F��include_default� Nr �,Failed to create directory path "{0}" - {1}
c S s g | ]}d |vr|�qS )�jobsr )�.0�ar r r �
<listcomp> s z verify_env.<locals>.<listcomp>rh �.i� i� z/Unable to securely set the permissions of "%s".))rB rC rD rE �win_verify_envrO r> � get_gid_listrR rS �isdirr9 Z set_umaskrU �getuidr[ rV r rK �writerJ rL rW rY rZ �st_gid�listdir�join�sepZos_walk� itertools�chainr7 �S_IMODE�st_mode�access�W_OK�chmodr r r )�dirsr> ra �pki_dirrb �root_dirr\ r] �gidr �dir_r^ r4 �modeZfmode�subdirZfsubdir�rootr9 �namerS Zsmoder r r �
verify_env� s� �
� ���
����
��
�r� c C s� t jj�� rdS | t jj�� krdS t| �}zNttd�r$t� | |j
� n t� t jjj | dd�� t�
|j
� t�|j� dtjv rG|jtjd< dtjv rR|jtjd< dD ]
}|tjv ra|jtj|< qTW dS tyt t�d| � Y dS w ) z0
Check user and assign process uid/gid.
T�
initgroupsFrd �HOMEZSHELL)ZUSERZLOGNAMEz9Salt configured to run as user "%s" but unable to switch.)rB rC rD rE r> �get_userrO �hasattrrR r� �pw_gid� setgroupsrn �setgid�setuid�pw_uid�environ�pw_dir�pw_shell�pw_namerV r r )r> ZpwuserZenvvarr r r �
check_userB s2
�� � �r� c C sl | g}t j�| �\}}|dkr|g}t j�|�\}}||d kr4|�d|� t j�|�\}}||d ks |S )a�
Returns a full list of directories leading up to, and including, a path.
So list_path_traversal('/path/to/salt') would return:
['/', '/path', '/path/to', '/path/to/salt']
in that order.
This routine has been tested on Windows systems as well.
list_path_traversal('c:\path\to\salt') on Windows would return:
['c:\', 'c:\path', 'c:\path\to', 'c:\path\to\salt']
r_ r )rR rS �split�insert)rS �out�head�tailr r r �list_path_traversalh s �r� r� c C s� t | �D ]>}t�|tj�sBd|� d�}tj�|�s |d7 }ntjj� � }||kr1|d|� d�7 }n|d|� d�7 }|r> dS t
|��qdS )a
Walk from the root up to a directory and verify that the current
user has access to read each directory. This is used for making
sure a user can read all parent directories of the minion's key
before trying to go and generate a new key and raising an IOError
zCould not access rl z Path does not exist.z Try running as user z
Please give z read permissions.N) r� rR rz �R_OKrS �existsrB rC r> r� r )rS r> Zskip_perm_errorsZtpathr4 � current_userr r r �check_path_traversal� s
��r� c C s | � dd�}tj�d�rt�� }}nt�tj�\}}t j
� | � d�d�}t t �
|��}t�d|� tj}|d |kr=dS d �||�}||krO|d
7 }tj}n |d |krYtj}n|d |krctj}n |d |krltj}||k ry|d
�|| �7 }|d7 }tj||d� dS )zI
Check the number of max allowed open files and adjust if needed
Zmax_open_filesi�� �winr~ Zminionsz6This salt-master instance has accepted %s minion keys.� NzhThe number of accepted minion keys({}) should be lower than 1/4 of the max open files soft setting({}). z$salt-master will crash pretty soon! r rc zoAccording to the system's hard limit, there's still a margin of {} to raise the salt's max_open_files setting. z#Please consider raising this value.)�levelr4 )�getr rD r7 � win32fileZ _getmaxstdio�resourceZ getrlimitZ
RLIMIT_NOFILErR rS rt �lenrs r �debug�logging�INFOrJ �CRITICAL�WARNING)�optsZmof_cZmof_sZmof_hZaccepted_keys_dirZaccepted_countr� r4 r r r �check_max_open_files� s> � �
�r� c C s� d}| � tjj�dd � D ];}|dkr;tj�tjj�||g��r-t�tjj�||g��}q
tj�tjj�||g��}q
tj�tjj�||g��}q
|S )Nr_ r )r� rR rS ru �islinkrt �readlink�abspath�rS �base�partr r r �_realpath_darwin� s r� c
C s� d}| � tjj�D ]5}|dkr<ztjj�tjj�||g��}tj�|�}W q t y; tj�tjj�||g��}Y q w |}q |�
d�rJ|dd � }|S )Nr_ z\\?\r� ) r� rR rS ru rB rC r� rt r� rV r7 r� r r r �_realpath_windows� s �
r� c C s4 t jj�� r
t| �S t jj�� rt| �S tj� | �S )z�
Cross platform realpath method. On Windows when python 3, this method
uses the os.readlink method to resolve any filesystem links.
All other platforms and version use ``os.path.realpath``.
)
rB rC rD Z is_darwinr� rE r� rR rS �realpath)rS r r r � _realpath� s
r� Tc C s� t j�| �st j�t �� | �} t j�| �}t j�|�s"t j�||�}t j�|�}|r2t|�}t|�}|rBt j�||g�|kr@|S dS t j�|�|krL|S dS )a+
Accepts the root the path needs to be under and verifies that the path is
under said root. Pass in subdir=True if the path can result in a
subdirectory of the root instead of having to reside directly in the root.
Pass realpath=False if filesystem links should not be resolved.
r_ ) rR rS �isabsrt �getcwd�normpathr� �
commonpathrT )r� rS r� r� Znormrootr� r r r �
clean_path
s �r� )r� r� c G s@ | }|D ]}t j�||�}t||||�std|����|}q|S )z�
Performa a join and then check the result against the clean_path method. If
clean_path fails a SaltValidationError is raised.
zInvalid path: )rR rS rt r� r )r� r� r� �paths�parentrS �childr r r �
clean_join# s r� c sN zt � fdd�dD ��rW dS tt| d � ��W S ttttfy& Y dS w )z+
Returns if the passed id is valid
c 3 s � | ]}|� v V qd S �Nr �ri �x��id_r r � <genexpr>6 s � zvalid_id.<locals>.<genexpr>)r �\� Fr~ )�any�boolr� �AttributeErrorrH � TypeError�UnicodeDecodeError)r� r� r r� r �valid_id1 s �r� c C s" d}|D ]
}| � |�r dS qdS )z�
Check a string to see if it has any potentially unsafe routines which
could be executed via python, this routine is used to improve the
safety of modules suct as virtualenv
)�import�;�
subprocess�eval�openr@ �exec�inputFT)�count)�codeZbadsZbadr r r � safe_py_code= s
�r� c C s4 g } t �� D ]\}}|t �dd�k r| �|� q| S )z(
Return the insecure logs types
�info� )r �itemsr� r8 )Zinsecurer� �valuer r r � insecure_logJ s
�r� c C s8 t �t| �d���� tj�}|tjk rt�d� dS dS )zF
If an insecre logging configuration is found, show a warning
Z log_levelzFInsecure logging configuration detected! Sensitive data may be logged.N) r r� r/ �lowerr� �NOTSETr� r r )r� r� r r r �
verify_logU s
��r� c C sJ ddl }ddl}ddl}tj�dd�}d�|dg�}|jjj | |d�s*t
d| � ���tj� | �s5t� | � |jj
�� }|jj
�|�r�d } |jjjd
d d �sV|jjjd
d d � z |jjj| d
dd� W n t
yq t�d| � Y nw z,|jjjdd�}
|
jd
dddd� |
jddddd� |
jddddd� |
j| dd� W n t
y� t�d| � Y nw |jj
�|��rz |jjj| d
d� W n t
y� t�d | � Y nw |�sz*|jj�� }
|
jd
ddd d� |
jdddd d� |
jdddd d� |
j| dd� W n t
�y t�d | � Y nw |D ]�} | �s�qtj� | ��sLzt� | � W n% t�yK } zd }
tj � |
� | | �� t� | j � W Y d} ~ nd} ~ ww | |k�r�z4|jjj| d
d� |jj�� }
|
jd
ddd d� |
jdddd d� |
jdddd d� |
j| dd� W �q t
�y� t�d| � Y �qw �q|d u �r�t!� dS dS )!r` r NZ
SystemRootz
C:\Windowsr� ZTEMP)rS �
allow_pathz0`file_roots` set to a possibly unsafe location: z HKLM\SOFTWARE\Salt Project\saltZHKLMzSOFTWARE\Salt Project\salt)Zhive�keyz S-1-5-32-544�registry)�obj_name� principal�obj_typez)Unable to securely set the owner of '%s'.)r� ZgrantZ full_controlZthis_key_subkeys)r� Z access_modeZ permissionsZ
applies_tozS-1-5-18zS-1-3-4T)r� Z protectedz/Unable to securely set the permissions of '%s'.)r� r� z)Unable to securely set the owner of "%s".Z this_folder_subfolders_filesz.Unable to securely set the permissions of '%s'rg F)"�salt.utils.pathZsalt.utils.win_daclZsalt.utils.win_functionsrR r� r� rt rC rS Z safe_pathr ro rU Z
win_functionsZget_current_userZis_adminZwin_regZ
key_existsZ set_valueZwin_daclZ set_ownerr r �daclZadd_aceZsaverV r rK rq rJ rL rW r )rS r} ra r~ rb rB Z system_rootr� r� Zreg_pathr� r� r^ r4 r r r rm a s� �
��
� ���� � � ������
�����
&
�rm )�http�httpsZssh�ftp�sftpr@ c @ s4 e Zd ZdZdZedd� �Zefdd�Zdd� Z d S )
� URLValidatorz#^([a-z0-9\-._~!$&'();=:@,]|%\d\d)+$zTABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~:/?#[]@!$&'()*+,;=c C s t �| jt j�S r� )r �compile�PCHAR�
IGNORECASE)�clsr r r �
pchar_matcher" s zURLValidator.pchar_matcherc C s
|| _ d S r� )�schemes)�selfr� r r r �__init__& s
zURLValidator.__init__c sh t � fdd�|D ��r
dS tj�|�}|j� jvrdS � �� }|j�d�D ] }|r1|� |�s1 dS q%dS )Nc s g | ]}|� j v�qS r )� ALL_VALIDr� �r� r r rk * s z)URLValidator.__call__.<locals>.<listcomp>Fr T)
r� �urllib�parse�urlparser; r� r� rS r� r )r� �data�parsed�matcherr� r r� r �__call__) s �zURLValidator.__call__N)
�__name__�
__module__� __qualname__r� r� � classmethodr� �SCHEMESr� r� r r r r r� s
r� )r� F)FT)Fr_ F)=�__doc__rW rv r� rR r r rY r � urllib.parser� Zsalt.defaults.exitcodesrB Zsalt.utils.filesr� Zsalt.utils.platformZsalt.utils.userZ
salt._loggingr Zsalt.exceptionsr r r r r� Zsalt.utils.win_reg� ImportErrorr� � getLoggerr� r rC rD rE ZROOT_DIRr6 r r( r5 r< r? rO r= r� r� r� r� r� r� r� r� r� r� r� r� r� r� rm r r� �urlr r r r �<module> sj
�
3 1
�Y&
<
3