D7net
Home
Console
Upload
information
Create File
Create Folder
About
Tools
:
/
usr
/
lib
/
python3.9
/
site-packages
/
ipalib
/
install
/
__pycache__
/
Filename :
certstore.cpython-39.opt-1.pyc
back
Copy
a � �il= � @ s� d Z ddlmZ ddlmZ ddlmZmZ ddlm Z m Z ddl m Z dd� Z d d � Zd d � Zd d� Zd'dd�Zd(dd�Zdd� Zd)dd�Zdd� Zd*dd �Zd d � Zd d � Zd+d!d"�Zd,d#d$�Zd%d&� ZdS )-z LDAP shared certificate store. � )� PyAsn1Error)�DN)�get_ca_nickname� TrustFlags)�errors�x509)� IPA_CA_CNc C s� z$t | j�}t | j�}| j}| j}W n4 ttfyX } ztd| ��W Y d }~n d }~0 0 t|��dd�}t|��dd�}d||f }|||fS )N� failed to decode certificate: %s�\;�\3bz%s;%s) r �subject�issuer� serial_numberZpublic_key_info_bytes� ValueErrorr �str�replace)�certr r r Zpublic_key_info�e� issuer_serial� r �</usr/lib/python3.9/site-packages/ipalib/install/certstore.py� _parse_cert! s " r c C s t |�\}}}|dur�z |j}W n0 tyP } ztd| ��W Y d} ~ n d} ~ 0 0 |dur�|tjtjtjtjtjtj h8 }||B }g d�| d< |g| d< |g| d< |g| d< |g| d< |g| d < |dur�|r�d nd g| d < |du�rt |�}|s�|� tj � || d < dS )zB Initialize certificate store entry for a CA certificate. Nr )ZipaCertificate�pkiCAZ ipaKeyPolicy� objectClass�cn�ipaCertSubject�ipaCertIssuerSerial� ipaPublicKey�cACertificate;binary�trusted� distrusted� ipaKeyTrust�ipaKeyExtUsage) r Zextended_key_usager r �EKU_SERVER_AUTH�EKU_CLIENT_AUTH�EKU_EMAIL_PROTECTION�EKU_CODE_SIGNINGZEKU_ANY�EKU_PLACEHOLDER�list�append) �entryr �nicknamer � ext_key_usager r � public_keyZcert_ekur r r r � init_ca_entry1 s2 " � r. c C s� t ddd|�}z(| j|dgd�}||jd< | �|� W nZ tjy~ | �|�}ddg|d< d |jd < ||jd< | �|� Y n tjy� Y n0 d S ) zF Update the CA certificate in cn=CAcert,cn=ipa,cn=etc,SUFFIX. �r �CAcert�r Zipa�r �etcr )� attrs_listZ nsContainerr r r0 r N) r � get_entry� single_value� update_entryr �NotFound� make_entry� add_entry� EmptyModlist)�ldap�base_dnr �dnr* r r r �update_compat_caS s r? c C s� |s |s dS z$| j tddd|�ddgd�\}}W n tjyF Y dS 0 |D ]�}|j|kr\qLt|d �D ]B}|�� dkr�|r�|d �|� qh|�� d krh|rh|d �|� qhz| �|� W qL tj y� Y qL0 qLdS ) zG Remove ipaCA and compatCA flags from their previous carriers. N�r Z certificatesr1 r2 z4(|(ipaConfigString=ipaCA)(ipaConfigString=compatCA))�ipaConfigString�r= �filterr4 �ipaca�compatca) � find_entriesr r r8 r> r( �lower�remover7 r; ) r< r= r> � config_ipa� config_compat�result� _truncatedr* �configr r r �clean_old_configf s0 �� rN NFc C s� t ddd|�}t d|f|�} | �| �} t| ||||� |rL| �dg ��d� |rb| �dg ��d� |rrt| ||� | �| � t| || ||� dS ) zF Add new entry for a CA certificate to the certificate store. r@ r1 r2 r rA �ipaCA�compatCAN)r r9 r. � setdefaultr) r? r: rN ) r< r= r r+ r r, rI rJ � container_dnr> r* r r r � add_ca_cert� s � rS c C s t |�\}}} | �d|i�} | jtddd|�| g d�d�\} } | d } | j}| d D ]}||krT q�qT| jd �� |�� kr�td ��| d �|� | d �|� | d �| � |d ur�| j� d �}|r�dnd}|d ur�|�� |kr�td��|| jd < |du�rL|d u�rXt | � dg ��}|� t j � ||B }|�s>|�t j � t|�| d< n | �dd � d}d}| � dg �D ],}|�� dk�r�d}n|�� dk�rld}�ql|�r�|�s�| �dg ��d� |�r�|�s�| �dg ��d� |�s�|�r�t| ||� | �| � t| ||||� d S )zN Update existing entry for a CA certificate in the certificate store. r r@ r1 r2 �r r r r r! r" rA r rB r r zsubject name mismatchr r Nr! r r zinconsistent trustFr" rA rD TrE rO rP )r � make_filterrF r r> r6 rG r r) �get�set�discardr r' �addr( �poprQ r? r7 rN )r< r= r r r, rI rJ r r r- rC rK rL r* r> �old_certZ old_trustZ new_trustZold_ekuZnew_ekuZis_ipaZ is_compatrM r r r �update_ca_cert� sb �� r\ c C s� t |�\}}}| �d|i�}| jtddd|�|g d�d�\}}|d } | d D ]} | |krN qhqNtd ��| d �|� | d �|� t| d �dkr�| �| j� n | � | � d S ) z; Remove a CA certificate in the certificate store. r r@ r1 r2 rT rB r r zcertificate not foundr N) r rU rF r r rH �lenZ delete_entryr> r7 ) r< r= r r r Z _public_keyrC rK rL r* r[ r r r �delete_ca_cert� s& �� r^ c C s^ zt | ||||||d� W n> tjyF t| |||||||d� Y n tjyX Y n0 dS )�m Add or update entry for a CA certificate in the certificate store. :param cert: IPACertificate )rI rJ N)r\ r r8 rS r; )r< r= r r+ r r, rI rJ r r r � put_ca_cert s � � r` c C s| g }| D ]n}t |�\}}}t|�}|durT|t|�krTt|�}tjtjtjtjh} nt|�}tjh} |� ||d| f� q|S )zO Make CA certificates and associated key policy from DER certificates. NT) r r r r r# r$ r% r& r r) ) �certsZrealmZipa_ca_subjectrK r r �_issuer_serial�_public_key_infor+ r, r r r �make_compat_ca_certs s �rd c C sN |dur&t |t�s|g}dd� |D �}g }tdd|�}td|�}�z(ddg}|rh| �d |i�} |�| � | j|| �|| j�g d �d �\} } | D ]�} | jd } | j� d d�� � }|dkr�d}n|dkr�d}nd}| � d�}|dur�t dd� |D ��}|� t j� | � dg �D ]Z}zt|�\}}}W n t�y> g }Y q�Y n0 |�d�d }|�|| |||f� �q q�W n� tj�y2 z| �|dg� W n� tj�y, td|�}| �|dg�} | jd }zt|�\}}}W n t�y� Y n@0 |du�r ||v�r tjdd ��|�r|}nd}t|g||�}Y n0 Y n0 |�r>|S tjd d ��dS ) zS Get CA certificates and associated key policy from the certificate store. Nc S s g | ]}t |��d d��qS )r r )r r )�.0Zsubjr r r � <listcomp>4 s �z get_ca_certs.<locals>.<listcomp>r1 r2 r@ z (objectClass=ipaCertificate)z(objectClass=pkiCA)r )r r r r r! r" r rB r r! �unknownr Tr Fr" c s s | ]}t |�V qd S )N)r )re �pr r r � <genexpr>R � z get_ca_certs.<locals>.<genexpr>r �;� � r/ zno matching entry found)�reasonz no such entry)� isinstancer( r rU r) rF Zcombine_filtersZ MATCH_ALLr6 rV rG rW rX r r' r r �splitr r8 r5 rd )r< r= � compat_realm� compat_ipa_ca�filter_subjectra Z config_dnrR �filtersrC rK rL r* r+ r r, r Z_subjectr Z_pkinfor r> r rb rc Z ca_subjectr r r � get_ca_certs, sz � � � ru c C s | dd� S )zG Convert certutil trust flags to certificate store key policy. rl Nr )� trust_flagsr r r �trust_flags_to_key_policy| s rw c C s t d| ||�S )zG Convert certificate store key policy to certutil trust flags. F)r )r �car, r r r �key_policy_to_trust_flags� s ry c C s8 t |�\}}} |du r td��t| ||||| ||� dS )r_ Fzmust be CA certificateN)rw r r` ) r< r= r r+ rv rI rJ r rx r, r r r �put_ca_cert_nss� s �rz c C sL g }t | ||||d�}|D ],\}}} } } t| d| �} |�||| | f� q|S )zT Get CA certificates and associated trust flags from the certificate store. )rs T)ru ry r) ) r< r= rq rr rs Z nss_certsra r r+ r r, Z_serial_numberrv r r r �get_ca_certs_nss� s � r{ c C s` t dtf||�}z| �|�d d }W n4 tjyZ | �� }|�d�d }t d|�}Y n0 |S )z2 Look for the IPA CA certificate subject. r Zipacasubjectdnr Zipacertificatesubjectbase)ZCNzCertificate Authority)r r r5 r r8 Zget_ipa_configrV )r< Z container_car= r> Zcacert_subject�attrsZ subject_baser r r �get_ca_subject� s r} )NNFF)NNFF)NNFF)N)FF)N) �__doc__Z pyasn1.errorr Z ipapython.dnr Zipapython.certdbr r Zipalibr r Zipalib.constantsr r r. r? rN rS r\ r^ r` rd ru rw ry rz r{ r} r r r r �<module> s: " � � F � � P � �