D7net
Home
Console
Upload
information
Create File
Create Folder
About
Tools
:
/
lib
/
python3.9
/
site-packages
/
ipapython
/
__pycache__
/
Filename :
certdb.cpython-39.pyc
back
Copy
a � �i�� � @ s� d dl mZ d dlZd dlZd dlZd dlZd dlZd dlZd dlZd dl Z d dl Z d dl Z d dl Z d dl mZ d dl mZ d dlZd dlmZ d dlmZ d dlmZ d dlmZ d d lmZ d d l m Z e� e �Z d Z!d Z"d Z#e"e# d Z$e�%dd�Z&e&dddd�Z'e&ddde(e j)e j*e j+e j,e j-e j.h��Z/e&ddde(e j)h��Z0e&ddde(e j)h��Z1dd� Z2e!fdd�Z3d)dd�Z4dd� Z5dd � Z6d d � Z7e �8d �Z9e �8d �Z:G d!d"� d"e;�Z<G d#d$� d$e;�Z=G d%d&� d&e;�Z>G d'd(� d(�Z?dS )*� )�absolute_importN)� find_library)�NamedTemporaryFile)�paths)�tasks)�DN)� Principal)�ipautil)�x509z %s IPA CA)�cert8.db�key3.db� secmod.db)�cert9.db�key4.db� pkcs11.txt)� pwdfile.txt� TrustFlagszhas_key trusted ca usagesFTc C s t td��S )NZnssdbm3)�boolr � r r �4/usr/lib/python3.9/site-packages/ipapython/certdb.py�nss_supports_dbmM s r c C s || S �Nr )�realm�formatr r r �get_ca_nicknameQ s r c C s` | � d|�}| � d|�}|dkr(|d }|dk s8|dk r@td��t�| ||� �d��} | |fS )z� Given a cert blob (str) which may or may not contian leading and trailing text, pull out just the certificate part. This will return the FIRST cert in a stream of data. :returns: a tuple (IPACertificate, last position in cert) z-----BEGIN CERTIFICATE-----z-----END CERTIFICATE-----r � zUnable to find certificatezutf-8)�find� RuntimeErrorr �load_pem_x509_certificate�encode)�cert�start�s�er r r �find_cert_from_txtU s r$ c C s� d| v }d| v r4d| v s(d| v s(d| v r0t d��dS d| v sDd| v rZd| v rTt d��d }n d| v rhd }nt|d d t� �S | �d �} t� }ttjtjtj f�D ]*\}}d| | v s�d| | v r�|� |� q�d| d v r�|� tj � t|d |t|��S )z< Convert certutil trust flags to TrustFlags object. �u�p�C�P�Tz&cannot be both trusted and not trusted)FNNz cannot be both CA and not CATFN�,r ) � ValueErrorr � frozenset�split�set� enumerater �EKU_SERVER_AUTH�EKU_EMAIL_PROTECTION�EKU_CODE_SIGNING�add�EKU_CLIENT_AUTH)� trust_flags�has_key�ca� ext_key_usage�i�kpr r r �parse_trust_flagsi s. � r; c C s� | \}}}}|du r"|r dS dS nD|du s2|du r@|r:dS dS n&|du rf|rZ|rTdS dS n |rbd S d S g d �} t tjtjtjf�D ](\}}||v r�| | |r�d nd 7 < q�|r�tj|v r�| d d7 < |r�td�D ]}| | d7 < q�d�| �} | S )z< Convert TrustFlags object to certutil trust flags. Fzpu,pu,puzp,p,pNzu,u,uz,,z CTu,Cu,CuzCT,C,CzPu,Pu,PuzP,P,P)� r< r< r' r( r r) � r% r* )r/ r r0 r1 r2 r4 �range�join)r5 r6 Ztrustedr7 r8 r9 r: r r r �unparse_trust_flags� s> � r@ c C s� t � ��h}t � ��>}|�| �tjj�� |�� t�||j� |�� z"t j t j dd|j|jgdd� W n0 t j y� } zt|j��W Y d}~n d}~0 0 z.| j�tjj�}t|j��tj�tj�� W n" tjjtfy� td��Y n0 ttd|g|��}t� | j �}|D ]&} t | tj ��r| j|k�r �qB�qtd| ��W d � n1 �sX0 Y W d � n1 �sx0 Y dS ) z� Verifies the validity of a kdc_cert, ensuring it is trusted by the ca_certs chain, has a PKINIT_KDC extended key usage support, and verify it applies to the given realm. Zverifyz-CAfileT��capture_outputNzinvalid for a KDCZkrbtgtzinvalid for realm %s) r �write� public_bytesr �Encoding�PEM�flushZwrite_certificate_list�namer �runr �OPENSSL�CalledProcessErrorr+ �output� extensions�get_extension_for_class� cryptographyZExtendedKeyUsage�list�value�indexZObjectIdentifier�EKU_PKINIT_KDC�ExtensionNotFound�strr Zprocess_othernamesZsan_general_names� isinstanceZKRB5PrincipalName) Zkdc_certZca_certsr Zkdc_fileZca_filer# ZekuZ principalZgnsZgnr r r �verify_kdc_cert_validity� s> �� � �� rW z+^(?P<nick>.+?)\s+(?P<flags>\w*,\w*,\w*)\s*$zN^<\s*(?P<slot>\d+)>\s+(?P<algo>\w+)\s+(?P<keyid>[0-9a-z]+)\s+(?P<nick>.*?)\s*$c @ s e Zd ZdZdS )�"Pkcs12ImportIncorrectPasswordErrorzB Raised when import_pkcs12 fails because of a wrong password. N��__name__� __module__� __qualname__�__doc__r r r r rX � s rX c @ s e Zd ZdZdS )�Pkcs12ImportOpenErrorz> Raised when import_pkcs12 fails trying to open the file. NrY r r r r r^ � s r^ c @ s e Zd ZdZdS )�Pkcs12ImportUnknownErrorzB Raised when import_pkcs12 fails because of an unknown error. NrY r r r r r_ � s r_ c @ s: e Zd ZdZdJdd�Zdd� Zdd � Zd d � Zd d � Zdd� Z dd� Z dKdd�Z dLdd�Z dd� Z dMdd�ZdNd d �Zd d � Zd d!� Zd"d#� Zd$d%� Zd&d'� ZdOd(d)�ZdPd*d+�Zdddefd,d-�Zd.d/� Zd0d1� Zd2d3� Zd4d5� Z d6d7� Z d8d9� Z d:d;� Z d<d=� Z d>d?� Z!d@dA� Z"dBdC� Z#dDdE� Z$dQdFdG�Z%dHdI� Z&dS )R� NSSDatabaseaI A general-purpose wrapper around a NSS cert database For permanent NSS databases, pass the cert DB directory to __init__ For temporary databases, do not pass nssdir, and call close() when done to remove the DB. Alternatively, a NSSDatabase can be used as a context manager that calls close() automatically. N�autoc C s� |d ur$|| _ d| _|dkr$| �� }|dkrBt� sBtd|� d���|d u rZt�� | _ d| _|d u rvtj� | j d�| _ n|| _ d | _ d | _ | _ | _|| _d| _d| _| �|� d S ) NFra �dbmzDNSS is built without support of the legacy database(DBM) directory '�'Tr r )�secdir� _is_temporary�_detect_dbtyper r+ �tempfileZmkdtemp�os�pathr? �pwd_file�dbtype�certdb�keydb�secmod�token� filenames�backup_filenames�_set_filenames)�selfZnssdirrk ro rj r r r �__init__ s. �� zNSSDatabase.__init__c C s@ t j�t j�| jd��r dS t j�t j�| jd��r8dS dS d S )Nr �sqlr rb ra )rh ri �isfiler? rd �rs r r r rf ! s zNSSDatabase._detect_dbtypec C s� || _ tj�| jd�tj�| jd�tj�| jd�f}tj�| jd�tj�| jd�tj�| jd�f}|dkr�|\| _| _| _|| jf | _ nR|dkr�|\| _| _| _|| jf | _ n*|d kr�d | _ | _| _d | _ nt |��| jf| | | _ d S ) Nr r r r r r rb ru ra ) rk rh ri r? rd rl rm rn rj rp r+ rq )rs rk ZdbmfilesZsqlfilesr r r rr ) s2 �����zNSSDatabase._set_filenamesc C s | j rt�| j� d S r )re �shutil�rmtreerd rw r r r �closeD s zNSSDatabase.closec C s | S r r rw r r r � __enter__H s zNSSDatabase.__enter__c C s | � � d S r )rz )rs �typerQ �tbr r r �__exit__K s zNSSDatabase.__exit__c C s | j d u rtd�| j���d S )NzNSSDB '{}' not initialized.)rp r r rd rw r r r � _check_dbN s �zNSSDatabase._check_dbc K sj | � � tjdd�| j| j�g}|�|� | jr@|�d| jg� |�d| jg� t j ||fd| ji|��S )N�-d�{}:{}z-h�-f�cwd) r r �CERTUTILr rk rd �extendro rj r rI �rs �args�stdin�kwargs�new_argsr r r � run_certutilT s � zNSSDatabase.run_certutilc K s> | � � tjdd�| j| j�g}|�|� tj||fi |��S )Nr� r� ) r r ZPK12UTILr rk rd r� r rI r� r r r � run_pk12utilb s � zNSSDatabase.run_pk12utilc C s" | j du rdS tdd� | j D ��S )z0Check DB exists (all files are present) NFc s s | ]}t j�|�V qd S r )rh ri rv )�.0�filenamer r r � <genexpr>p � z%NSSDatabase.exists.<locals>.<genexpr>)rp �allrw r r r �existsk s zNSSDatabase.existsFc C s |dur |}|d@ }|d@ }n d}d}d}d}d} |durFt �|�j}|durZt�|�j} |rt| jD ]} t�| � qdt j � | j �s�t � | j |� t j � | j��stjt �| jt jt jB |�ddd ��4} | �t�� � | �� t �| �� � W d � n1 s�0 Y | jd k�r | j } nd �| j| j �} tjd | d d| jd| jg} tj | d| j d� | � | � � � | j du �r�t d�| j ���t �!| j || � t �"| j |� t#j$| j dd� | j D ]R} t j � | ��r�t �!| || � | | jk�r�|}n|}t �"| |� t#j$| dd� �q�dS )z�Create cert DB :param user: User owner the secdir :param group: Group owner of the secdir :param mode: Mode of the secdir :param backup: Backup the sedir files Ni� i� i� i� ����wT)�closefdra r� r� �-Nr� �-@�r� r� z Failed to create NSSDB at '{}'��force)%�pwd�getpwnam�pw_uid�grp�getgrnam�gr_gidrq r Z backup_filerh ri r� rd �makedirsrj �io�open�O_CREAT�O_WRONLYrC �ipa_generate_passwordrG �fsync�filenork r r r� rI rr rf rp r+ �chown�chmodr �restore_context)rs �user�group�modeZbackupZdirmode�filemodeZ pwdfilemode�uid�gidr� �fZdbdirr� Znew_moder r r � create_dbr sn ��, � � zNSSDatabase.create_dbTc C s | j dks"tj�tj�| jd��r2td�| j���tj dd�| j�dd| j d| j g}t j |d | jd � d }|D ]f\}}tj�| j|�}tj�| j|�}t� |�}t�|t �|j�� t�||j|j� tj|d d � qn| �d� | �� |�r |D ](\}}tj�| j|�}t�||d � q�d S )a� Convert DBM database format to SQL database format **WARNING** **WARNING** **WARNING** **WARNING** **WARNING** The caller must ensure that no other process or service is accessing the NSSDB during migration. The DBM format does not support multiple processes. If more than one process opens a DBM NSSDB for writing, the database will become **irreparably corrupted**. **WARNING** **WARNING** **WARNING** **WARNING** **WARNING** ru r z$NSS DB {} has been migrated already.r� zsql:{}r� r� r� Nr� ))r r )r r )r r Tr� z .migrated)rk rh ri rv r? rd r+ r r r� rj r rI �statr� �S_IMODE�st_moder� �st_uid�st_gidr r� rr � list_certs�rename)rs Z rename_oldr� Z migrationZoldnameZnewnameZoldstat�_r r r � convert_db� s2 � � � zNSSDatabase.convert_dbc C s� | j D ]z}|d }|d }z4tj�|�r4t�||� tj�|�rLt�||� W q ty~ } zt�d|� W Y d }~qd }~0 0 qd S )Nz.origz.ipasavez%s)rq rh ri r� r� �OSError�logger�debug)rs r� Z backup_pathZ save_pathr# r r r �restore� s zNSSDatabase.restorec C sh dg}| j |dd�}|j�� }g }|D ]8}t�|�}|r&|�d�}t|�d��}|�||f� q&t|�S )z{Return nicknames and cert flags for all certs in the database :return: List of (name, trust_flags) tuples �-LTrA �nick�flags) r� rL � splitlines�CERT_RE�matchr� r; �append�tuple) rs r� �result�certs�certlistr r� �nicknamer5 r r r r� � s zNSSDatabase.list_certsc C s| | j dgddd�}|jdkr dS g }|j�� D ]D}t�|�}|d ur.|�t|�d��|�d�|�d �|�d �f� q.t |�S ) Nz-KFT)Z raiseonerrrB � r ZslotZalgo�keyidr� ) r� � returncoderL r� �KEY_REr� r� �intr� r� )rs r� Zkeylist�line�mor r r � list_keys s � �zNSSDatabase.list_keysc C s. g }| � � D ] \}}|jr |�||f� q |S )z�Return nicknames and cert flags for server certs in the database Server certs have an "u" character in the trust flags. :return: List of (name, trust_flags) tuples )r� r6 r� )rs � server_certsrH r� r r r �find_server_certs# s z NSSDatabase.find_server_certsc C sT g }| j ddd|gdd�}|j�� }|D ]&}t�d|�}|r(|�|�� d � q(|S )z�Return names of certs in a given cert's trust chain The list starts with root ca, then first intermediate CA, second intermediate, and so on. :param nickname: Name of the cert :return: List of certificate names z-Oz--simple-self-signed�-nTrA z\s*"(.*)" \[.*r )r� rL r� �rer� r� �groups)rs r� Zroot_nicknamesr� �chain�c�mr r r �get_trust_chain1 s � zNSSDatabase.get_trust_chainc C s� d|d|d| j g}d }|d ur<t�|d �}|�d|jg� z�z| �|� W nb tjy� } zH|jdkrvtd| ��n$|jdkr�td | ��n td | ��W Y d }~n d }~0 0 W |d ur�|� � n|d ur�|� � 0 d S ) Nz-or� �-k� �-w� �&incorrect password for pkcs#12 file %s� �Failed to open %sz'unknown error exporting pkcs#12 file %s) rj r �write_tmp_filer� rH r� rK r� r rz )rs r� �pkcs12_filename� pkcs12_passwdr� �pkcs12_password_filer# r r r � export_pkcs12G s0 � � � �zNSSDatabase.export_pkcs12c C s� d|d| j dg}d }|d ur:t�|d �}|�d|jg� z�z| �|� W nb tjy� } zH|jdv rttd| ��n$|jdkr�t d | ��n t d | ��W Y d }~n d }~0 0 W |d ur�|� � n|d ur�|� � 0 d S ) Nz-ir� z-vr� r� )r� � r� r� r� z$unknown error import pkcs#12 file %s) rj r r� r� rH r� rK r� rX r^ r_ rz )rs r� r� r� r� r# r r r � import_pkcs12` s8 � � ��� �zNSSDatabase.import_pkcs12c C sr d}d}g }|D �]�} z6t | d��} | �� } W d � n1 s@0 Y W n6 ty� } z td| | jf ��W Y d} ~ n d} ~ 0 0 tt�d| tj��} | �r�d}| D �]&}|� � }|� d�}t | d|� � d � � � �}|dv �r`zt �|�}W n\ t�yN } zB|dk�r*t�d | || � W Y d} ~ q�t�d | || � W Y d} ~ nd} ~ 0 0 |�|� d }q�|d v �r�zt �|�}W n` tj�y� } zD|dk�r�t�d | || � nt�d | || � W Y d} ~ q�W Y d} ~ nd} ~ 0 0 |�|� d }q�|dv r�|�s�q�|�rtd|| f ��tjdddddddd| j g }|dk�r>|�sH|dk�rdt�|�}|dd|j g7 }ztj ||d d�}W nD tj�y� } z(t�d | || � W Y d} ~ q�W Y d} ~ q�d} ~ 0 0 |j }| }d }q�q�|�r�qtd | ��zt � | �}W n t�y Y n0 |�|� q|�r�z| � | |� W nL t!�y> Y n� t�yv } z td | t"| �f ��W Y d} ~ n�d} ~ 0 0 |�r�td|| f ��| }| �#� }|�r�|D ]\}}||k�r� �q�q�td || f ��qt |�dkrtd t |�| f ��qtd!| ��q|�r |�s td"d#�$|� ��|D ]"}t"t%|j&��}| �'|||� �q$|�rnt(�)� ��}t(�)� ��} |D ]}|�*|�+t j,j-�� �qh|�*|� |�.� t�/� } t�| �} tjd$d%d&|j d'| j dd| j dd| j d(d)d*d)g}zt� |� W n4 tj�y } ztd+| ��W Y d} ~ n d} ~ 0 0 | � | j | � W d � n1 �sD0 Y W d � n1 �sd0 Y dS ),a� Import certificates and a single private key from multiple files The files may be in PEM and DER certificate, PKCS#7 certificate chain, PKCS#8 and raw private key and PKCS#12 formats. :param files: Names of files to import :param import_keys: Whether to import private keys :param key_password: Password to decrypt private keys :param key_nickname: Nickname of the private key to import from PKCS#12 files N�rb�Failed to open %s: %ss* -----BEGIN (.+?)-----(.*?)-----END \1-----F� )� CERTIFICATEs X509 CERTIFICATEs X.509 CERTIFICATEr� z)Skipping certificate in %s at line %s: %sz/Failed to load certificate in %s at line %s: %sT)s PKCS7s PKCS #7 SIGNED DATAr� z$Skipping PKCS#7 in %s at line %s: %s)� PRIVATE KEY� ENCRYPTED PRIVATE KEYs RSA PRIVATE KEYs DSA PRIVATE KEYs EC PRIVATE KEYz*Can't load private key from both %s and %sZpkcs8z-topk8z-v2Zaes256z-v2prfZhmacWithSHA256z-passoutzfile:r� r� z-passin)r� rB z)Skipping private key in %s at line %s: %szFailed to load %szFailed to load %s: %sz'Server certificate "%s" not found in %sz6%s server certificates found in %s, expecting only onez&Failed to load %s: unrecognized formatz"No server certificates found in %sz, Zpkcs12z-exportz-inz-outz-certpbez aes-128-cbcz-keypbez5No matching certificate found for private key from %s)0r� �read�IOErrorr �strerrorrP r� �finditer�DOTALLr� �lenr! r� r r r+ r� Zwarning�errorr� Zpkcs7_to_certsr rK r� r rJ rj r� rH rI Z raw_outputZload_der_x509_certificater� r_ rU r� r? r �subject�add_certrg r rC rD rE rF rG r� ) rs �filesZ import_keysZ key_passwordZ key_nicknamer5 Zkey_fileZ extracted_keyZextracted_certsr� r� �datar# �matchesZloadedr� �bodyZlabelr� r r� r� Z key_pwdfiler� r� r� Z _trust_flagsZin_fileZout_fileZ out_passwordZ out_pwdfiler r r � import_files{ sX * ��� � � ��" �� �� �� �" � �� �� ��� � � � ��zNSSDatabase.import_filesc C sd |d d� dkr t �d|� nBt|�}z| �dd|d|g� W n tjy^ td| ��Y n0 d S )N� ZBuiltinz7No need to add trust for built-in root CAs, skipping %sz-Mr� �-tzSetting trust on %s failed)r� r� r@ r� r rK r )rs Z root_nicknamer5 r r r �trust_root_certJ s � � �zNSSDatabase.trust_root_certc C sV dd|dg}z| j |dd�}W n tjy> td| ��Y n0 t|jdd�\}}|S ) z� :param nickname: nickname of the certificate in the NSS database :returns: string in Python2 bytes in Python3 r� r� �-aTrA �Failed to get %sr �r! )r� r rK r r$ rL )rs r� r� r� r Z_startr r r �get_certX s zNSSDatabase.get_certc C s� dd|dg}z| j |dd�}W n tjy> td| ��Y n0 g }d}zt|j|d�\}}W n tyt Y q�Y n0 |�|� qH|S ) z� :param nickname: nickname of the certificate in the NSS database :returns: list of bytes of all certificates for the nickname r� r� r TrA r r r )r� r rK r r$ rL r� )rs r� r� r� r� �str r r r � get_all_certsf s zNSSDatabase.get_all_certsc C s, z| � |� W n ty" Y dS 0 dS d S )NFT)r r )rs r� r r r � has_nickname{ s zNSSDatabase.has_nicknamec C sX | � |�}t|d��$}|�|�tjj�� W d � n1 s>0 Y t�|d� dS )z7Export the given cert to PEM file in the given location�wbNi$ ) r r� rC rD r rE rF rh r� )rs r� �locationr �fdr r r �export_pem_cert� s 2zNSSDatabase.export_pem_certc C s� z4t |��}|�� }W d � n1 s(0 Y W n6 tyj } z td||jf ��W Y d}~n d}~0 0 t|�\}}| �|||� zt||� W n ty� Y n0 td| ��dS )zgImport a cert form the given PEM file. The file must contain exactly one certificate. Nr� z%%s contains more than one certificate)r� r� r� r r� r$ r� r+ ) rs r� r� r r r� r# r r r r r �import_pem_cert� s * � �zNSSDatabase.import_pem_certc C s4 t |�}dd|d|dg}| j||�tjj�d� d S )Nz-Ar� r r )r� )r@ r� rD r rE rF )rs r r� r� r� r r r r� � s zNSSDatabase.add_certc C s | � dd|g� d S )Nz-Dr� )r� )rs r� r r r � delete_cert� s zNSSDatabase.delete_certc C s: | � � }|D ](\}}}}||kr | �dd|g� q6q dS )zpDelete the key with provided nick This commands removes the key but leaves the cert in the DB. �-Fr� N)r� r� )rs r� �keysZ_slotZ_algor� r� r r r �delete_key_only� s zNSSDatabase.delete_key_onlyc C s\ z| � dd|g� W n tjy2 | �|� Y n0 | �� D ]\}}||kr<| �|� q<dS )z%Delete a cert and its key from the DBr r� N)r� r rK r r� r )rs r� ZcertnameZ_flagsr r r �delete_key_and_cert� s z NSSDatabase.delete_key_and_certc C sv t j jt jjd�}|j|kr.td|j� d���|j|k rJtd|j� d���|jt jdd� |k rrtd|j� d ���d S ) z(Common checks for cert validity )Ztzznot valid before z UTC is in the future.z has expired z UTCr� )Zhoursz expires in less than one hour (z UTC)N)�datetimeZnow�timezoneZutcZnot_valid_before_utcr+ Znot_valid_after_utcZ timedelta)rs r Zutcnowr r r �_verify_cert_validity� s � � �z!NSSDatabase._verify_cert_validityc C s� | � |�}| �|� z | jdd|dddgdd� W n0 tjyb } zt|j��W Y d}~n d}~0 0 z|�|� W n ty� td | ��Y n0 dS ) z�Verify a certificate is valid for a SSL server with given hostname Raises a ValueError if the certificate is invalid. �-Vr� �-u�V�-eTrA Nzinvalid for server %s)r r r� r rK r+ rL Zmatch_hostname)rs r� �hostnamer r# r r r �verify_server_cert_validity� s" �� z'NSSDatabase.verify_server_cert_validityc s0 � fdd�}� � |�}|D ]}||||� qd S )Nc s. � � | � | jstd��z| j�tjj�}W n tjjyJ td��Y n0 |j j s\td��|d ur�|j j }|d ur�||k r�td� ||���z| j�tjj �}W n tjjy� td��Y n0 t|j j�dkr�td��z � jdd |d d d gd d� W n2 tj�y( } zt|j��W Y d }~n d }~0 0 d S )Nzhas empty subjectzmissing basic constraintsznot a CA certificatez/basic contraint pathlen {}, must be at least {}z(missing subject key identifier extensionr z(subject key identifier must not be emptyr r� r �Lr TrA )r r� r+ rM rN rO r ZBasicConstraintsrT rQ r7 Z path_lengthr ZSubjectKeyIdentifierr� Zdigestr� r rK rL )r r� � minpathlenZbc�plZskir# rw r r �verify_ca_cert� sL ������ z;NSSDatabase.verify_ca_cert_validity.<locals>.verify_ca_cert)r )rs r� r r r� r r rw r �verify_ca_cert_validity� s 1 z#NSSDatabase.verify_ca_cert_validityc s8 � � |�}� fdd�|D �}t|d |d d� |� d S )Nc s g | ]}� � |��qS r )r )r� r� rw r r � <listcomp>- r� z8NSSDatabase.verify_kdc_cert_validity.<locals>.<listcomp>r� )r� rW )rs r� r Z nicknamesr� r rw r rW + s z$NSSDatabase.verify_kdc_cert_validity)Nra NN)N)N)NNNF)T)N)N)N)'rZ r[ r\ r] rt rf rr rz r{ r~ r r� r� r� r� r� r� r� r� r� r� r� r� �EMPTY_TRUST_FLAGSr� r r r r r r r� r r r r r r! rW r r r r r` � sL M 2 � P 6r` )r )@Z __future__r � collectionsr Zloggingrh r� r� r� r� rx r� rg Z ctypes.utilr r Zcryptography.x509rO Zipaplatform.pathsr Zipaplatform.tasksr Z ipapython.dnr Zipapython.kerberosr Z ipapythonr Zipalibr Z getLoggerrZ r� ZCA_NICKNAME_FMTZ NSS_DBM_FILESZ NSS_SQL_FILESZ NSS_FILES� namedtupler r# r, r0 r4 r2 r1 ZEKU_PKINIT_CLIENT_AUTHrS ZIPA_CA_TRUST_FLAGSZEXTERNAL_CA_TRUST_FLAGSZTRUSTED_PEER_TRUST_FLAGSr r r$ r; r@ rW �compiler� r� r rX r^ r_ r` r r r r �<module> sv �� �� ,&��