asm
This commit is contained in:
Sven Riwoldt
445
asm/venv/lib/python3.11/site-packages/zmq/auth/base.py
Normal file
445
asm/venv/lib/python3.11/site-packages/zmq/auth/base.py
Normal file
@@ -0,0 +1,445 @@
|
||||
"""Base implementation of 0MQ authentication."""
|
||||
|
||||
# Copyright (C) PyZMQ Developers
|
||||
# Distributed under the terms of the Modified BSD License.
|
||||
|
||||
import logging
|
||||
import os
|
||||
from typing import Any, Awaitable, Dict, List, Optional, Set, Tuple, Union
|
||||
|
||||
import zmq
|
||||
from zmq.error import _check_version
|
||||
from zmq.utils import z85
|
||||
|
||||
from .certs import load_certificates
|
||||
|
||||
CURVE_ALLOW_ANY = '*'
|
||||
VERSION = b'1.0'
|
||||
|
||||
|
||||
class Authenticator:
|
||||
"""Implementation of ZAP authentication for zmq connections.
|
||||
|
||||
This authenticator class does not register with an event loop. As a result,
|
||||
you will need to manually call `handle_zap_message`::
|
||||
|
||||
auth = zmq.Authenticator()
|
||||
auth.allow("127.0.0.1")
|
||||
auth.start()
|
||||
while True:
|
||||
await auth.handle_zap_msg(auth.zap_socket.recv_multipart())
|
||||
|
||||
Alternatively, you can register `auth.zap_socket` with a poller.
|
||||
|
||||
Since many users will want to run ZAP in a way that does not block the
|
||||
main thread, other authentication classes (such as :mod:`zmq.auth.thread`)
|
||||
are provided.
|
||||
|
||||
Note:
|
||||
|
||||
- libzmq provides four levels of security: default NULL (which the Authenticator does
|
||||
not see), and authenticated NULL, PLAIN, CURVE, and GSSAPI, which the Authenticator can see.
|
||||
- until you add policies, all incoming NULL connections are allowed.
|
||||
(classic ZeroMQ behavior), and all PLAIN and CURVE connections are denied.
|
||||
- GSSAPI requires no configuration.
|
||||
"""
|
||||
|
||||
context: "zmq.Context"
|
||||
encoding: str
|
||||
allow_any: bool
|
||||
credentials_providers: Dict[str, Any]
|
||||
zap_socket: "zmq.Socket"
|
||||
_allowed: Set[str]
|
||||
_denied: Set[str]
|
||||
passwords: Dict[str, Dict[str, str]]
|
||||
certs: Dict[str, Dict[bytes, Any]]
|
||||
log: Any
|
||||
|
||||
def __init__(
|
||||
self,
|
||||
context: Optional["zmq.Context"] = None,
|
||||
encoding: str = 'utf-8',
|
||||
log: Any = None,
|
||||
):
|
||||
_check_version((4, 0), "security")
|
||||
self.context = context or zmq.Context.instance()
|
||||
self.encoding = encoding
|
||||
self.allow_any = False
|
||||
self.credentials_providers = {}
|
||||
self.zap_socket = None # type: ignore
|
||||
self._allowed = set()
|
||||
self._denied = set()
|
||||
# passwords is a dict keyed by domain and contains values
|
||||
# of dicts with username:password pairs.
|
||||
self.passwords = {}
|
||||
# certs is dict keyed by domain and contains values
|
||||
# of dicts keyed by the public keys from the specified location.
|
||||
self.certs = {}
|
||||
self.log = log or logging.getLogger('zmq.auth')
|
||||
|
||||
def start(self) -> None:
|
||||
"""Create and bind the ZAP socket"""
|
||||
self.zap_socket = self.context.socket(zmq.REP, socket_class=zmq.Socket)
|
||||
self.zap_socket.linger = 1
|
||||
self.zap_socket.bind("inproc://zeromq.zap.01")
|
||||
self.log.debug("Starting")
|
||||
|
||||
def stop(self) -> None:
|
||||
"""Close the ZAP socket"""
|
||||
if self.zap_socket:
|
||||
self.zap_socket.close()
|
||||
self.zap_socket = None # type: ignore
|
||||
|
||||
def allow(self, *addresses: str) -> None:
|
||||
"""Allow IP address(es).
|
||||
|
||||
Connections from addresses not explicitly allowed will be rejected.
|
||||
|
||||
- For NULL, all clients from this address will be accepted.
|
||||
- For real auth setups, they will be allowed to continue with authentication.
|
||||
|
||||
allow is mutually exclusive with deny.
|
||||
"""
|
||||
if self._denied:
|
||||
raise ValueError("Only use allow or deny, not both")
|
||||
self.log.debug("Allowing %s", ','.join(addresses))
|
||||
self._allowed.update(addresses)
|
||||
|
||||
def deny(self, *addresses: str) -> None:
|
||||
"""Deny IP address(es).
|
||||
|
||||
Addresses not explicitly denied will be allowed to continue with authentication.
|
||||
|
||||
deny is mutually exclusive with allow.
|
||||
"""
|
||||
if self._allowed:
|
||||
raise ValueError("Only use a allow or deny, not both")
|
||||
self.log.debug("Denying %s", ','.join(addresses))
|
||||
self._denied.update(addresses)
|
||||
|
||||
def configure_plain(
|
||||
self, domain: str = '*', passwords: Optional[Dict[str, str]] = None
|
||||
) -> None:
|
||||
"""Configure PLAIN authentication for a given domain.
|
||||
|
||||
PLAIN authentication uses a plain-text password file.
|
||||
To cover all domains, use "*".
|
||||
You can modify the password file at any time; it is reloaded automatically.
|
||||
"""
|
||||
if passwords:
|
||||
self.passwords[domain] = passwords
|
||||
self.log.debug("Configure plain: %s", domain)
|
||||
|
||||
def configure_curve(
|
||||
self, domain: str = '*', location: Union[str, os.PathLike] = "."
|
||||
) -> None:
|
||||
"""Configure CURVE authentication for a given domain.
|
||||
|
||||
CURVE authentication uses a directory that holds all public client certificates,
|
||||
i.e. their public keys.
|
||||
|
||||
To cover all domains, use "*".
|
||||
|
||||
You can add and remove certificates in that directory at any time. configure_curve must be called
|
||||
every time certificates are added or removed, in order to update the Authenticator's state
|
||||
|
||||
To allow all client keys without checking, specify CURVE_ALLOW_ANY for the location.
|
||||
"""
|
||||
# If location is CURVE_ALLOW_ANY then allow all clients. Otherwise
|
||||
# treat location as a directory that holds the certificates.
|
||||
self.log.debug("Configure curve: %s[%s]", domain, location)
|
||||
if location == CURVE_ALLOW_ANY:
|
||||
self.allow_any = True
|
||||
else:
|
||||
self.allow_any = False
|
||||
try:
|
||||
self.certs[domain] = load_certificates(location)
|
||||
except Exception as e:
|
||||
self.log.error("Failed to load CURVE certs from %s: %s", location, e)
|
||||
|
||||
def configure_curve_callback(
|
||||
self, domain: str = '*', credentials_provider: Any = None
|
||||
) -> None:
|
||||
"""Configure CURVE authentication for a given domain.
|
||||
|
||||
CURVE authentication using a callback function validating
|
||||
the client public key according to a custom mechanism, e.g. checking the
|
||||
key against records in a db. credentials_provider is an object of a class which
|
||||
implements a callback method accepting two parameters (domain and key), e.g.::
|
||||
|
||||
class CredentialsProvider(object):
|
||||
|
||||
def __init__(self):
|
||||
...e.g. db connection
|
||||
|
||||
def callback(self, domain, key):
|
||||
valid = ...lookup key and/or domain in db
|
||||
if valid:
|
||||
logging.info('Authorizing: {0}, {1}'.format(domain, key))
|
||||
return True
|
||||
else:
|
||||
logging.warning('NOT Authorizing: {0}, {1}'.format(domain, key))
|
||||
return False
|
||||
|
||||
To cover all domains, use "*".
|
||||
"""
|
||||
|
||||
self.allow_any = False
|
||||
|
||||
if credentials_provider is not None:
|
||||
self.credentials_providers[domain] = credentials_provider
|
||||
else:
|
||||
self.log.error("None credentials_provider provided for domain:%s", domain)
|
||||
|
||||
def curve_user_id(self, client_public_key: bytes) -> str:
|
||||
"""Return the User-Id corresponding to a CURVE client's public key
|
||||
|
||||
Default implementation uses the z85-encoding of the public key.
|
||||
|
||||
Override to define a custom mapping of public key : user-id
|
||||
|
||||
This is only called on successful authentication.
|
||||
|
||||
Parameters
|
||||
----------
|
||||
client_public_key: bytes
|
||||
The client public key used for the given message
|
||||
|
||||
Returns
|
||||
-------
|
||||
user_id: unicode
|
||||
The user ID as text
|
||||
"""
|
||||
return z85.encode(client_public_key).decode('ascii')
|
||||
|
||||
def configure_gssapi(
|
||||
self, domain: str = '*', location: Optional[str] = None
|
||||
) -> None:
|
||||
"""Configure GSSAPI authentication
|
||||
|
||||
Currently this is a no-op because there is nothing to configure with GSSAPI.
|
||||
"""
|
||||
|
||||
async def handle_zap_message(self, msg: List[bytes]):
|
||||
"""Perform ZAP authentication"""
|
||||
if len(msg) < 6:
|
||||
self.log.error("Invalid ZAP message, not enough frames: %r", msg)
|
||||
if len(msg) < 2:
|
||||
self.log.error("Not enough information to reply")
|
||||
else:
|
||||
self._send_zap_reply(msg[1], b"400", b"Not enough frames")
|
||||
return
|
||||
|
||||
version, request_id, domain, address, identity, mechanism = msg[:6]
|
||||
credentials = msg[6:]
|
||||
|
||||
domain = domain.decode(self.encoding, 'replace')
|
||||
address = address.decode(self.encoding, 'replace')
|
||||
|
||||
if version != VERSION:
|
||||
self.log.error("Invalid ZAP version: %r", msg)
|
||||
self._send_zap_reply(request_id, b"400", b"Invalid version")
|
||||
return
|
||||
|
||||
self.log.debug(
|
||||
"version: %r, request_id: %r, domain: %r,"
|
||||
" address: %r, identity: %r, mechanism: %r",
|
||||
version,
|
||||
request_id,
|
||||
domain,
|
||||
address,
|
||||
identity,
|
||||
mechanism,
|
||||
)
|
||||
|
||||
# Is address is explicitly allowed or _denied?
|
||||
allowed = False
|
||||
denied = False
|
||||
reason = b"NO ACCESS"
|
||||
|
||||
if self._allowed:
|
||||
if address in self._allowed:
|
||||
allowed = True
|
||||
self.log.debug("PASSED (allowed) address=%s", address)
|
||||
else:
|
||||
denied = True
|
||||
reason = b"Address not allowed"
|
||||
self.log.debug("DENIED (not allowed) address=%s", address)
|
||||
|
||||
elif self._denied:
|
||||
if address in self._denied:
|
||||
denied = True
|
||||
reason = b"Address denied"
|
||||
self.log.debug("DENIED (denied) address=%s", address)
|
||||
else:
|
||||
allowed = True
|
||||
self.log.debug("PASSED (not denied) address=%s", address)
|
||||
|
||||
# Perform authentication mechanism-specific checks if necessary
|
||||
username = "anonymous"
|
||||
if not denied:
|
||||
if mechanism == b'NULL' and not allowed:
|
||||
# For NULL, we allow if the address wasn't denied
|
||||
self.log.debug("ALLOWED (NULL)")
|
||||
allowed = True
|
||||
|
||||
elif mechanism == b'PLAIN':
|
||||
# For PLAIN, even a _alloweded address must authenticate
|
||||
if len(credentials) != 2:
|
||||
self.log.error("Invalid PLAIN credentials: %r", credentials)
|
||||
self._send_zap_reply(request_id, b"400", b"Invalid credentials")
|
||||
return
|
||||
username, password = (
|
||||
c.decode(self.encoding, 'replace') for c in credentials
|
||||
)
|
||||
allowed, reason = self._authenticate_plain(domain, username, password)
|
||||
|
||||
elif mechanism == b'CURVE':
|
||||
# For CURVE, even a _alloweded address must authenticate
|
||||
if len(credentials) != 1:
|
||||
self.log.error("Invalid CURVE credentials: %r", credentials)
|
||||
self._send_zap_reply(request_id, b"400", b"Invalid credentials")
|
||||
return
|
||||
key = credentials[0]
|
||||
allowed, reason = await self._authenticate_curve(domain, key)
|
||||
if allowed:
|
||||
username = self.curve_user_id(key)
|
||||
|
||||
elif mechanism == b'GSSAPI':
|
||||
if len(credentials) != 1:
|
||||
self.log.error("Invalid GSSAPI credentials: %r", credentials)
|
||||
self._send_zap_reply(request_id, b"400", b"Invalid credentials")
|
||||
return
|
||||
# use principal as user-id for now
|
||||
principal = credentials[0]
|
||||
username = principal.decode("utf8")
|
||||
allowed, reason = self._authenticate_gssapi(domain, principal)
|
||||
|
||||
if allowed:
|
||||
self._send_zap_reply(request_id, b"200", b"OK", username)
|
||||
else:
|
||||
self._send_zap_reply(request_id, b"400", reason)
|
||||
|
||||
def _authenticate_plain(
|
||||
self, domain: str, username: str, password: str
|
||||
) -> Tuple[bool, bytes]:
|
||||
"""PLAIN ZAP authentication"""
|
||||
allowed = False
|
||||
reason = b""
|
||||
if self.passwords:
|
||||
# If no domain is not specified then use the default domain
|
||||
if not domain:
|
||||
domain = '*'
|
||||
|
||||
if domain in self.passwords:
|
||||
if username in self.passwords[domain]:
|
||||
if password == self.passwords[domain][username]:
|
||||
allowed = True
|
||||
else:
|
||||
reason = b"Invalid password"
|
||||
else:
|
||||
reason = b"Invalid username"
|
||||
else:
|
||||
reason = b"Invalid domain"
|
||||
|
||||
if allowed:
|
||||
self.log.debug(
|
||||
"ALLOWED (PLAIN) domain=%s username=%s password=%s",
|
||||
domain,
|
||||
username,
|
||||
password,
|
||||
)
|
||||
else:
|
||||
self.log.debug("DENIED %s", reason)
|
||||
|
||||
else:
|
||||
reason = b"No passwords defined"
|
||||
self.log.debug("DENIED (PLAIN) %s", reason)
|
||||
|
||||
return allowed, reason
|
||||
|
||||
async def _authenticate_curve(
|
||||
self, domain: str, client_key: bytes
|
||||
) -> Tuple[bool, bytes]:
|
||||
"""CURVE ZAP authentication"""
|
||||
allowed = False
|
||||
reason = b""
|
||||
if self.allow_any:
|
||||
allowed = True
|
||||
reason = b"OK"
|
||||
self.log.debug("ALLOWED (CURVE allow any client)")
|
||||
elif self.credentials_providers != {}:
|
||||
# If no explicit domain is specified then use the default domain
|
||||
if not domain:
|
||||
domain = '*'
|
||||
|
||||
if domain in self.credentials_providers:
|
||||
z85_client_key = z85.encode(client_key)
|
||||
# Callback to check if key is Allowed
|
||||
r = self.credentials_providers[domain].callback(domain, z85_client_key)
|
||||
if isinstance(r, Awaitable):
|
||||
r = await r
|
||||
if r:
|
||||
allowed = True
|
||||
reason = b"OK"
|
||||
else:
|
||||
reason = b"Unknown key"
|
||||
|
||||
status = "ALLOWED" if allowed else "DENIED"
|
||||
self.log.debug(
|
||||
"%s (CURVE auth_callback) domain=%s client_key=%s",
|
||||
status,
|
||||
domain,
|
||||
z85_client_key,
|
||||
)
|
||||
else:
|
||||
reason = b"Unknown domain"
|
||||
else:
|
||||
# If no explicit domain is specified then use the default domain
|
||||
if not domain:
|
||||
domain = '*'
|
||||
|
||||
if domain in self.certs:
|
||||
# The certs dict stores keys in z85 format, convert binary key to z85 bytes
|
||||
z85_client_key = z85.encode(client_key)
|
||||
if self.certs[domain].get(z85_client_key):
|
||||
allowed = True
|
||||
reason = b"OK"
|
||||
else:
|
||||
reason = b"Unknown key"
|
||||
|
||||
status = "ALLOWED" if allowed else "DENIED"
|
||||
self.log.debug(
|
||||
"%s (CURVE) domain=%s client_key=%s",
|
||||
status,
|
||||
domain,
|
||||
z85_client_key,
|
||||
)
|
||||
else:
|
||||
reason = b"Unknown domain"
|
||||
|
||||
return allowed, reason
|
||||
|
||||
def _authenticate_gssapi(self, domain: str, principal: bytes) -> Tuple[bool, bytes]:
|
||||
"""Nothing to do for GSSAPI, which has already been handled by an external service."""
|
||||
self.log.debug("ALLOWED (GSSAPI) domain=%s principal=%s", domain, principal)
|
||||
return True, b'OK'
|
||||
|
||||
def _send_zap_reply(
|
||||
self,
|
||||
request_id: bytes,
|
||||
status_code: bytes,
|
||||
status_text: bytes,
|
||||
user_id: str = 'anonymous',
|
||||
) -> None:
|
||||
"""Send a ZAP reply to finish the authentication."""
|
||||
user_id = user_id if status_code == b'200' else b''
|
||||
if isinstance(user_id, str):
|
||||
user_id = user_id.encode(self.encoding, 'replace')
|
||||
metadata = b'' # not currently used
|
||||
self.log.debug("ZAP reply code=%s text=%s", status_code, status_text)
|
||||
reply = [VERSION, request_id, status_code, status_text, user_id, metadata]
|
||||
self.zap_socket.send_multipart(reply)
|
||||
|
||||
|
||||
__all__ = ['Authenticator', 'CURVE_ALLOW_ANY']
|
||||
Reference in New Issue
Block a user