D7net
Home
Console
Upload
information
Create File
Create Folder
About
Tools
:
/
usr
/
lib
/
python3.9
/
site-packages
/
ipaclient
/
install
/
__pycache__
/
Filename :
ipa_certupdate.cpython-39.opt-1.pyc
back
Copy
a �jix+ � @ s d dl mZ d dlZd dlZd dlmZ d dlmZmZ d dl m Z d dl m Z m Z mZmZ d dlmZ d dlmZ d d lmZ d d lmZmZmZ d d lmZm Z m Z d d l m Z e� e!�Z"G d d� de j#�Z$d dd�Z%dd� Z&dd� Z'dd� Z(d dd�Z)dd� Z*dS ) � )�absolute_importN)�urlsplit)� certmonger� certstore)�is_ipa_configured)� admintool�certdb�ipaldap�ipautil)�services)�paths)�tasks)�api�errors�x509)�FQDN�IPA_CA_NICKNAME�RENEWAL_CA_NAME)�check_client_configurationc sD e Zd ZdZdZdZed � fdd� �Zd � fdd � Zd d � Z � Z S )� CertUpdatezipa-certupdatez%prog [options]zIUpdate local IPA certificate databases with certificates from the server.Fc s* t t| ��|� |jddtd ddd� d S )Nz--force-server� forced_serverzipa.server.fqdnz6Force the use of the specified server for the update. )�dest�type�default�metavar�help)�superr � add_optionsZ add_option�str)�cls�parserZ debug_option�� __class__� �D/usr/lib/python3.9/site-packages/ipaclient/install/ipa_certupdate.pyr 0 s �zCertUpdate.add_optionsTc s t � �|� d S )N)r �validate_options)�selfZ needs_rootr! r# r$ r% < s zCertUpdate.validate_optionsc C s� t � tj�d�}dtjd< dtjd< z�zddtjd�}| jjd urN| jj|d< tj f i |�� t� � tj j � � tt| j� tj j �� W n" tjy� t�dt� � Y n0 W |d u r�tj�dd � q�|tjd< n$|d u r�tj�dd � n |tjd< 0 d S ) NZ KRB5CCNAMEz/etc/krb5.keytabZKRB5_CLIENT_KTNAMEzMEMORY:Z cli_installer)�contextZconfdirr z9Unable to obtain credentials for %s from /etc/krb5.keytab)r �os�environ�getr ZETC_IPA�optionsr r Z bootstrap�finalizeZBackendZ rpcclientZconnect� run_with_argsZ disconnectr Z CCacheError�logger�errorr �pop)r& Zold_krb5ccnameZ bootstrap_kwr# r# r$ �run? s6 � � �zCertUpdate.run)F)T) �__name__� __module__� __qualname__Z command_name�usage� description� classmethodr r% r1 � __classcell__r# r# r! r$ r ( s r c C s� |du st |dd�du r(t| jj�j}n|j}t�d|� tj � |�}z| j j dd�}|d }W n6 t jt jfy� | j jddd �}|d d }Y n0 |�� t�|| jj| jj|�}|r�| j �� d }ng }t|� t� �r�| j jd d d �}dd� |d D �} t|� ddlm} m } | � � � � �rVz| � |� W n t �yT t�!d� Y n0 z t"| | | jj#| jj$| � W n t �y� t�!d� Y n0 t%j&j'�(� �r�t%j&j'�)� t%j&j*�(� �r�t%j&j*�)� dS )z� Run the certupdate procedure with the given API object. :param api: API object with ldap2/rpcclient backend connected (such that Commands can be invoked) Nr z$Updating certificates from server %sz2.107)�version�resultTz2.0)�serverr9 � enable_raz CA serverZenabled)Z role_servrole�statusc S s g | ] }|d �qS )Z server_serverr# )�.0r; r# r# r$ � <listcomp>� � z!run_with_args.<locals>.<listcomp>r )� cainstance�custodiainstancez.Failed to add lightweight CA tracking requestszFailed to update RA config)+�getattrr �envZ jsonrpc_uri�hostnamer r. �infor Z LDAPClientZfrom_hostname_secureZCommandZ ca_is_enabledr Z CommandErrorZ NetworkErrorZ gssapi_bindr Z get_ca_certsZbasedn�realmZca_find� update_clientr Zserver_role_find� update_serverZipaserver.installrA rB � CAInstanceZ is_configuredZ$add_lightweight_ca_tracking_requests� Exception� exception�update_server_ra_configr< �ca_hostr � knownservicesZhttpd� is_running�restartZkrb5kdc) r r+ r; Zldapr: Z ca_enabled�certsZlwcasZresp� ca_serversrA rB r# r# r$ r- c sZ ��� � r- c C s� t tj| � t tj| � t tj| � t�tjj �}dD ]d}|� |�r6z|� |� W q: t j y� } z*t�d||j|� W Y d }~q6W Y d }~q:d }~0 0 q:q6t|j| � t�� t�| � d S )N)zIPA CAzExternal CA certz Failed to remove %s from %s: %s)� update_filer Z IPA_CA_CRTZKDC_CA_BUNDLE_PEMZ CA_BUNDLE_PEMr � NSSDatabaser rD Znss_dirZ has_nickname� delete_certr �CalledProcessErrorr. r/ Zsecdir� update_dbr Z(remove_ca_certs_from_systemwide_ca_storeZ(insert_ca_certs_into_systemwide_ca_store)rR Zipa_db�nickname�er# r# r$ rH � s" �& rH c C s d� tjj�d��}ttj| | � tj j � � r>tj j � |� tj ttd�}t�|�}|d ur�tjjd }t�d|� tj|dd� zt�||�}W n ty� t�d| ��Y n0 t�|d �}|d ks�|r�t�d | ��t�d |� tj|d d� t tj | � t tj | � d S )N�-�.)z cert-databasez cert-nicknamezca-name�< z$resubmitting certmonger request '%s'z dogtag-ipa-ca-renew-agent-reuse)�cazQResubmitting certmonger request '%s' timed out, please check the request manuallyzca-errorZ MONITORINGzMError resubmitting certmonger request '%s', please check the request manuallyz!modifying certmonger request '%s'zdogtag-ipa-ca-renew-agent) �joinr rD rG �splitrX r Z"ETC_DIRSRV_SLAPD_INSTANCE_TEMPLATEr rO ZdirsrvrP rQ ZPKI_TOMCAT_ALIAS_DIRr r r Zget_request_idZstartup_timeoutr. �debugZresubmit_requestZwait_for_request� RuntimeErrorr Z ScriptErrorZget_request_valueZmodifyrT ZCA_CRTZ CACERT_PEM)rR �instanceZcriteriaZ request_id�timeout�stateZca_errorr# r# r$ rI � sD � � �� �� rI c C sj t |�dkrdS |d }|sT| j�� |jtjjtjj|d�}| �|� | � |� n||vrf| � |� dS )z� After promoting a CA-less deployment to CA-ful, or after removal of a CA server from the topology, it may be necessary to update the default.conf ca_host setting on non-CA replicas. r N)Z host_namerG Z custodia_peer) �lenrJ Z$configure_certmonger_renewal_helpersZCustodiaInstancer rD �hostrG Z import_ra_keyZupdate_ipa_conf)rA rB r< rN rS Z new_ca_hostZcustodiar# r# r$ rM � s � rM � c C sZ dd� |D �}zt j|| |d� W n2 tyT } zt�d| |� W Y d }~n d }~0 0 d S )Nc s s" | ]}|d dur|d V qdS )� Fr Nr# )r> �cr# r# r$ � <genexpr>" r@ z update_file.<locals>.<genexpr>)�modezfailed to update %s: %s)r Zwrite_certificate_listrK r. r/ )�filenamerR rl rZ r# r# r$ rT ! s rT c C s� t �| �}|�� D ]\}}|jr|�|� q|D ]f\}}}}} t�|d|�} z|�||| � W q0 tj y� } z t � d|| | � W Y d} ~ q0d} ~ 0 0 q0dS )z�Drop all CA certs from db then add certs from list provided This may result in some churn as existing certs are dropped and re-added but this also provides the ability to change the trust flags. Tz failed to update %s in %s: %sN) r rU Z list_certsr^ rV r Zkey_policy_to_trust_flagsZadd_certr rW r. r/ ) �pathrR Zdb�name�flagsZcertrY ZtrustedZekuZ_serialZ trust_flagsrZ r# r# r$ rX ) s rX )N)rh )+Z __future__r Zloggingr( � urllib.parser Zipalib.installr r Z ipalib.factsr Z ipapythonr r r r Z ipaplatformr Zipaplatform.pathsr Zipaplatform.tasksr Zipalibr r r Zipalib.constantsr r r Z ipalib.utilr Z getLoggerr2 r. Z AdminToolr r- rH rI rM rT rX r# r# r# r$ �<module> s( ; Q0%