File: //lib/python3.9/site-packages/ipapython/__pycache__/certdb.cpython-39.opt-1.pyc
a
�N(i�� � @ s� d dl mZ d dlZd dlZd dlZd dlZd dlZd dlZd dlZd dl Z d dl
Z
d dl Z d dl Z d dl
mZ d dl mZ d dlZd dlmZ d dlmZ d dlmZ d dlmZ d d lmZ d d
l m Z e� e �Z d Z!d Z"d
Z#e"e# d Z$e�%dd�Z&e&dddd�Z'e&ddde(e j)e j*e j+e j,e j-e j.h��Z/e&ddde(e j)h��Z0e&ddde(e j)h��Z1dd� Z2e!fdd�Z3d)dd�Z4dd� Z5dd � Z6d d � Z7e �8d �Z9e �8d �Z:G d!d"� d"e;�Z<G d#d$� d$e;�Z=G d%d&� d&e;�Z>G d'd(� d(�Z?dS )*� )�absolute_importN)� find_library)�NamedTemporaryFile)�paths)�tasks)�DN)� Principal)�ipautil)�x509z %s IPA CA)�cert8.db�key3.db� secmod.db)�cert9.db�key4.db�
pkcs11.txt)� pwdfile.txt�
TrustFlagszhas_key trusted ca usagesFTc C s t td��S )NZnssdbm3)�boolr � r r �4/usr/lib/python3.9/site-packages/ipapython/certdb.py�nss_supports_dbmM s r c C s || S �Nr )�realm�formatr r r �get_ca_nicknameQ s r c C s` | � d|�}| � d|�}|dkr(|d }|dk s8|dk r@td��t�| ||� �d��} | |fS )z�
Given a cert blob (str) which may or may not contian leading and
trailing text, pull out just the certificate part. This will return
the FIRST cert in a stream of data.
:returns: a tuple (IPACertificate, last position in cert)
z-----BEGIN CERTIFICATE-----z-----END CERTIFICATE-----r � zUnable to find certificatezutf-8)�find� RuntimeErrorr
�load_pem_x509_certificate�encode)�cert�start�s�er r r �find_cert_from_txtU s r$ c C s� d| v }d| v r4d| v s(d| v s(d| v r0t d��dS d| v sDd| v rZd| v rTt d��d }n d| v rhd
}nt|d d t� �S | �d �} t� }ttjtjtj f�D ]*\}}d| | v s�d| | v r�|�
|� q�d| d
v r�|�
tj � t|d |t|��S )z<
Convert certutil trust flags to TrustFlags object.
�u�p�C�P�Tz&cannot be both trusted and not trusted)FNNz cannot be both CA and not CATFN�,r ) �
ValueErrorr � frozenset�split�set� enumerater
�EKU_SERVER_AUTH�EKU_EMAIL_PROTECTION�EKU_CODE_SIGNING�add�EKU_CLIENT_AUTH)� trust_flags�has_key�ca�
ext_key_usage�i�kpr r r �parse_trust_flagsi s.
� r; c C s� | \}}}}|du r"|r dS dS nD|du s2|du r@|r:dS dS n&|du rf|rZ|rTdS dS n |rbd S d
S g d �} t tjtjtjf�D ](\}}||v r�| | |r�d nd
7 < q�|r�tj|v r�| d d7 < |r�td�D ]}| | d7 < q�d�| �} | S )z<
Convert TrustFlags object to certutil trust flags.
Fzpu,pu,puzp,p,pNzu,u,uz,,z CTu,Cu,CuzCT,C,CzPu,Pu,PuzP,P,P)� r< r< r' r( r r) � r% r* )r/ r
r0 r1 r2 r4 �range�join)r5 r6 Ztrustedr7 r8 r9 r: r r r �unparse_trust_flags� s> �
r@ c
C s� t � ��h}t � ��>}|�| �tjj�� |�� t�||j� |�� z"t j
t j dd|j|jgdd� W n0 t j
y� } zt|j��W Y d}~n
d}~0 0 z.| j�tjj�}t|j��tj�tj�� W n" tjjtfy� td��Y n0 ttd|g|��}t� | j �}|D ]&} t | tj ��r| j|k�r �qB�qtd| ��W d � n1 �sX0 Y W d � n1 �sx0 Y dS ) z�
Verifies the validity of a kdc_cert, ensuring it is trusted by
the ca_certs chain, has a PKINIT_KDC extended key usage support,
and verify it applies to the given realm.
Zverifyz-CAfileT��capture_outputNzinvalid for a KDCZkrbtgtzinvalid for realm %s) r �write� public_bytesr
�Encoding�PEM�flushZwrite_certificate_list�namer �runr �OPENSSL�CalledProcessErrorr+ �output�
extensions�get_extension_for_class� cryptographyZExtendedKeyUsage�list�value�indexZObjectIdentifier�EKU_PKINIT_KDC�ExtensionNotFound�strr Zprocess_othernamesZsan_general_names�
isinstanceZKRB5PrincipalName)
Zkdc_certZca_certsr Zkdc_fileZca_filer# ZekuZ principalZgnsZgnr r r �verify_kdc_cert_validity� s> ��
�
��
rW z+^(?P<nick>.+?)\s+(?P<flags>\w*,\w*,\w*)\s*$zN^<\s*(?P<slot>\d+)>\s+(?P<algo>\w+)\s+(?P<keyid>[0-9a-z]+)\s+(?P<nick>.*?)\s*$c @ s e Zd ZdZdS )�"Pkcs12ImportIncorrectPasswordErrorzB Raised when import_pkcs12 fails because of a wrong password.
N��__name__�
__module__� __qualname__�__doc__r r r r rX � s rX c @ s e Zd ZdZdS )�Pkcs12ImportOpenErrorz> Raised when import_pkcs12 fails trying to open the file.
NrY r r r r r^ � s r^ c @ s e Zd ZdZdS )�Pkcs12ImportUnknownErrorzB Raised when import_pkcs12 fails because of an unknown error.
NrY r r r r r_ � s r_ c @ s: e Zd ZdZdJdd�Zdd� Zdd � Zd
d � Zd d
� Zdd� Z dd� Z
dKdd�Z dLdd�Z dd� Z
dMdd�ZdNd d �Zd d � Zd d!� Zd"d#� Zd$d%� Zd&d'� ZdOd(d)�ZdPd*d+�Zdddefd,d-�Zd.d/� Zd0d1� Zd2d3� Zd4d5� Z d6d7� Z d8d9� Z d:d;� Z d<d=� Z d>d?� Z!d@dA� Z"dBdC� Z#dDdE� Z$dQdFdG�Z%dHdI� Z&dS )R� NSSDatabaseaI A general-purpose wrapper around a NSS cert database
For permanent NSS databases, pass the cert DB directory to __init__
For temporary databases, do not pass nssdir, and call close() when done
to remove the DB. Alternatively, a NSSDatabase can be used as a
context manager that calls close() automatically.
N�autoc C s� |d ur$|| _ d| _|dkr$| �� }|dkrBt� sBtd|� d���|d u rZt�� | _ d| _|d u rvtj� | j d�| _
n|| _
d | _ d | _ | _
| _|| _d| _d| _| �|� d S ) NFra �dbmzDNSS is built without support of the legacy database(DBM) directory '�'Tr r )�secdir�
_is_temporary�_detect_dbtyper r+ �tempfileZmkdtemp�os�pathr? �pwd_file�dbtype�certdb�keydb�secmod�token� filenames�backup_filenames�_set_filenames)�selfZnssdirrk ro rj r r r �__init__ s. ��
zNSSDatabase.__init__c C s@ t j�t j�| jd��r dS t j�t j�| jd��r8dS dS d S )Nr �sqlr rb ra )rh ri �isfiler? rd �rs r r r rf ! s
zNSSDatabase._detect_dbtypec C s� || _ tj�| jd�tj�| jd�tj�| jd�f}tj�| jd�tj�| jd�tj�| jd�f}|dkr�|\| _| _| _|| jf | _ nR|dkr�|\| _| _| _|| jf | _ n*|d kr�d | _ | _| _d | _ nt
|��| jf| | | _ d S )
Nr r r
r r r rb ru ra ) rk rh ri r? rd rl rm rn rj rp r+ rq )rs rk ZdbmfilesZsqlfilesr r r rr ) s2 �����zNSSDatabase._set_filenamesc C s | j rt�| j� d S r )re �shutil�rmtreerd rw r r r �closeD s zNSSDatabase.closec C s | S r r rw r r r � __enter__H s zNSSDatabase.__enter__c C s | � � d S r )rz )rs �typerQ �tbr r r �__exit__K s zNSSDatabase.__exit__c C s | j d u rtd�| j���d S )NzNSSDB '{}' not initialized.)rp r r rd rw r r r � _check_dbN s
�zNSSDatabase._check_dbc K sj | � � tjdd�| j| j�g}|�|� | jr@|�d| jg� |�d| jg� t j
||fd| ji|��S )N�-d�{}:{}z-h�-f�cwd) r r �CERTUTILr rk rd �extendro rj r rI �rs �args�stdin�kwargs�new_argsr r r � run_certutilT s �
zNSSDatabase.run_certutilc K s> | � � tjdd�| j| j�g}|�|� tj||fi |��S )Nr� r� ) r r ZPK12UTILr rk rd r� r rI r� r r r � run_pk12utilb s �
zNSSDatabase.run_pk12utilc C s" | j du rdS tdd� | j D ��S )z0Check DB exists (all files are present)
NFc s s | ]}t j�|�V qd S r )rh ri rv )�.0�filenamer r r � <genexpr>p � z%NSSDatabase.exists.<locals>.<genexpr>)rp �allrw r r r �existsk s
zNSSDatabase.existsFc C s |dur |}|d@ }|d@ }n d}d}d}d}d} |durFt �|�j}|durZt�|�j} |rt| jD ]}
t�|
� qdt j
� | j �s�t �
| j |� t j
� | j��stjt �| jt jt jB |�ddd ��4} | �t�� � | �� t �| �� � W d � n1 s�0 Y | jd
k�r | j } nd �| j| j �} tjd | d
d| jd| jg}
tj |
d| j d� | � | � � � | j du �r�t d�| j ���t �!| j || � t �"| j |� t#j$| j dd� | j D ]R}
t j
� |
��r�t �!|
|| � |
| jk�r�|}n|}t �"|
|� t#j$|
dd� �q�dS )z�Create cert DB
:param user: User owner the secdir
:param group: Group owner of the secdir
:param mode: Mode of the secdir
:param backup: Backup the sedir files
Ni� i� i� i� ����wT)�closefdra r� r� �-Nr� �-@�r� r� z Failed to create NSSDB at '{}'��force)%�pwd�getpwnam�pw_uid�grp�getgrnam�gr_gidrq r Z backup_filerh ri r� rd �makedirsrj �io�open�O_CREAT�O_WRONLYrC �ipa_generate_passwordrG �fsync�filenork r r r� rI rr rf rp r+ �chown�chmodr �restore_context)rs �user�group�modeZbackupZdirmode�filemodeZ pwdfilemode�uid�gidr� �fZdbdirr� Znew_moder r r � create_dbr sn
��, �
�
zNSSDatabase.create_dbTc C s | j dks"tj�tj�| jd��r2td�| j���tj dd�| j�dd| j
d| j
g}t j |d | jd
� d }|D ]f\}}tj�| j|�}tj�| j|�}t�
|�}t�|t
�|j�� t�||j|j� tj|d d
� qn| �d� | �� |�r |D ](\}}tj�| j|�}t�||d � q�d S )a� Convert DBM database format to SQL database format
**WARNING** **WARNING** **WARNING** **WARNING** **WARNING**
The caller must ensure that no other process or service is
accessing the NSSDB during migration. The DBM format does not support
multiple processes. If more than one process opens a DBM NSSDB for
writing, the database will become **irreparably corrupted**.
**WARNING** **WARNING** **WARNING** **WARNING** **WARNING**
ru r z$NSS DB {} has been migrated already.r� zsql:{}r� r� r� Nr� ))r r )r r )r
r Tr� z .migrated)rk rh ri rv r? rd r+ r r r� rj r rI �statr� �S_IMODE�st_moder� �st_uid�st_gidr r� rr �
list_certs�rename)rs Z
rename_oldr� Z migrationZoldnameZnewnameZoldstat�_r r r �
convert_db� s2
�
� �
zNSSDatabase.convert_dbc C s� | j D ]z}|d }|d }z4tj�|�r4t�||� tj�|�rLt�||� W q ty~ } zt�d|� W Y d }~qd }~0 0 qd S )Nz.origz.ipasavez%s)rq rh ri r� r� �OSError�logger�debug)rs r� Z backup_pathZ save_pathr# r r r �restore� s
zNSSDatabase.restorec C sh dg}| j |dd�}|j�� }g }|D ]8}t�|�}|r&|�d�}t|�d��}|�||f� q&t|�S )z{Return nicknames and cert flags for all certs in the database
:return: List of (name, trust_flags) tuples
�-LTrA �nick�flags) r� rL �
splitlines�CERT_RE�matchr� r; �append�tuple) rs r� �result�certs�certlistr r� �nicknamer5 r r r r� � s
zNSSDatabase.list_certsc C s| | j dgddd�}|jdkr dS g }|j�� D ]D}t�|�}|d ur.|�t|�d��|�d�|�d �|�d
�f� q.t |�S ) Nz-KFT)Z
raiseonerrrB � r ZslotZalgo�keyidr� )
r� �
returncoderL r� �KEY_REr� r� �intr� r� )rs r� Zkeylist�line�mor r r � list_keys s �
�zNSSDatabase.list_keysc C s. g }| � � D ] \}}|jr |�||f� q |S )z�Return nicknames and cert flags for server certs in the database
Server certs have an "u" character in the trust flags.
:return: List of (name, trust_flags) tuples
)r� r6 r� )rs � server_certsrH r� r r r �find_server_certs# s
z NSSDatabase.find_server_certsc C sT g }| j ddd|gdd�}|j�� }|D ]&}t�d|�}|r(|�|�� d � q(|S )z�Return names of certs in a given cert's trust chain
The list starts with root ca, then first intermediate CA, second
intermediate, and so on.
:param nickname: Name of the cert
:return: List of certificate names
z-Oz--simple-self-signed�-nTrA z\s*"(.*)" \[.*r )r� rL r� �rer� r� �groups)rs r� Zroot_nicknamesr� �chain�c�mr r r �get_trust_chain1 s
�
zNSSDatabase.get_trust_chainc
C s� d|d|d| j g}d }|d ur<t�|d �}|�d|jg� z�z| �|� W nb tjy� } zH|jdkrvtd| ��n$|jdkr�td | ��n td
| ��W Y d }~n
d }~0 0 W |d ur�|� � n|d ur�|� � 0 d S ) Nz-or� �-k�
�-w� �&incorrect password for pkcs#12 file %s�
�Failed to open %sz'unknown error exporting pkcs#12 file %s)
rj r �write_tmp_filer� rH r� rK r� r rz )rs r� �pkcs12_filename�
pkcs12_passwdr� �pkcs12_password_filer# r r r �
export_pkcs12G s0 �
�
�
�zNSSDatabase.export_pkcs12c
C s� d|d| j dg}d }|d ur:t�|d �}|�d|jg� z�z| �|� W nb tjy� } zH|jdv rttd| ��n$|jdkr�t d | ��n t
d
| ��W Y d }~n
d }~0 0 W |d ur�|� � n|d ur�|� � 0 d S ) Nz-ir� z-vr� r� )r� � r� r� r� z$unknown error import pkcs#12 file %s) rj r r� r� rH r� rK r� rX r^ r_ rz )rs r� r� r� r� r# r r r �
import_pkcs12` s8 �
�
���
�zNSSDatabase.import_pkcs12c C sr d}d}g }|D �]�} z6t | d��}
|
�� } W d � n1 s@0 Y W n6 ty� } z td| | jf ��W Y d} ~ n
d} ~ 0 0 tt�d| tj��}
|
�r�d}|
D �]&}|� � }|� d�}t
| d|� � d � � � �}|dv �r`zt
�|�}W n\ t�yN } zB|dk�r*t�d | || � W Y d} ~ q�t�d
| || � W Y d} ~ nd} ~ 0 0 |�|� d }q�|d v �r�zt
�|�}W n` tj�y� } zD|dk�r�t�d | || � nt�d
| || � W Y d} ~ q�W Y d} ~ nd} ~ 0 0 |�|� d }q�|dv r�|�s�q�|�rtd|| f ��tjdddddddd| j g }|dk�r>|�sH|dk�rdt�|�}|dd|j g7 }ztj ||d d�}W nD tj�y� } z(t�d | || � W Y d} ~ q�W Y d} ~ q�d} ~ 0 0 |j }| }d }q�q�|�r�qtd | ��zt
� | �}W n t�y Y n0 |�|� q|�r�z| � | |� W nL t!�y> Y n� t�yv } z td | t"| �f ��W Y d} ~ n�d} ~ 0 0 |�r�td|| f ��| }| �#� }|�r�|D ]\}}||k�r� �q�q�td || f ��qt
|�dkrtd t
|�| f ��qtd!| ��q|�r |�s td"d#�$|� ��|D ]"}t"t%|j&��}| �'|||� �q$|�rnt(�)� ��}t(�)� ��} |D ]}|�*|�+t
j,j-�� �qh|�*|� |�.� t�/� } t�| �} tjd$d%d&|j d'| j dd| j dd| j d(d)d*d)g}zt� |� W n4 tj�y } ztd+| ��W Y d} ~ n
d} ~ 0 0 | � | j | � W d � n1 �sD0 Y W d � n1 �sd0 Y dS ),a�
Import certificates and a single private key from multiple files
The files may be in PEM and DER certificate, PKCS#7 certificate chain,
PKCS#8 and raw private key and PKCS#12 formats.
:param files: Names of files to import
:param import_keys: Whether to import private keys
:param key_password: Password to decrypt private keys
:param key_nickname: Nickname of the private key to import from PKCS#12
files
N�rb�Failed to open %s: %ss* -----BEGIN (.+?)-----(.*?)-----END \1-----F� )� CERTIFICATEs X509 CERTIFICATEs X.509 CERTIFICATEr� z)Skipping certificate in %s at line %s: %sz/Failed to load certificate in %s at line %s: %sT)s PKCS7s PKCS #7 SIGNED DATAr� z$Skipping PKCS#7 in %s at line %s: %s)� PRIVATE KEY� ENCRYPTED PRIVATE KEYs RSA PRIVATE KEYs DSA PRIVATE KEYs EC PRIVATE KEYz*Can't load private key from both %s and %sZpkcs8z-topk8z-v2Zaes256z-v2prfZhmacWithSHA256z-passoutzfile:r� r� z-passin)r� rB z)Skipping private key in %s at line %s: %szFailed to load %szFailed to load %s: %sz'Server certificate "%s" not found in %sz6%s server certificates found in %s, expecting only onez&Failed to load %s: unrecognized formatz"No server certificates found in %sz, Zpkcs12z-exportz-inz-outz-certpbez aes-128-cbcz-keypbez5No matching certificate found for private key from %s)0r� �read�IOErrorr �strerrorrP r� �finditer�DOTALLr� �lenr! r� r
r r+ r� Zwarning�errorr� Zpkcs7_to_certsr rK r� r rJ rj r� rH rI Z
raw_outputZload_der_x509_certificater� r_ rU r� r? r �subject�add_certrg r rC rD rE rF rG r� ) rs �filesZ import_keysZ key_passwordZ key_nicknamer5 Zkey_fileZ
extracted_keyZextracted_certsr� r� �datar# �matchesZloadedr� �bodyZlabelr� r r� r� Z key_pwdfiler� r� r� Z _trust_flagsZin_fileZout_fileZ out_passwordZ out_pwdfiler r r � import_files{ sX
* ���
� �
��"
��
��
��
�"
� ��
��
��� � �
�
��zNSSDatabase.import_filesc C sd |d d� dkr t �d|� nBt|�}z| �dd|d|g� W n tjy^ td| ��Y n0 d S )N� ZBuiltinz7No need to add trust for built-in root CAs, skipping %sz-Mr� �-tzSetting trust on %s failed)r� r� r@ r� r rK r )rs Z
root_nicknamer5 r r r �trust_root_certJ s �
�
�zNSSDatabase.trust_root_certc C sV dd|dg}z| j |dd�}W n tjy> td| ��Y n0 t|jdd�\}}|S ) z�
:param nickname: nickname of the certificate in the NSS database
:returns: string in Python2
bytes in Python3
r� r� �-aTrA �Failed to get %sr �r! )r� r rK r r$ rL )rs r� r� r� r Z_startr r r �get_certX s zNSSDatabase.get_certc C s� dd|dg}z| j |dd�}W n tjy> td| ��Y n0 g }d}zt|j|d�\}}W n tyt Y q�Y n0 |�|� qH|S ) z�
:param nickname: nickname of the certificate in the NSS database
:returns: list of bytes of all certificates for the nickname
r� r� r TrA r r r )r� r rK r r$ rL r� )rs r� r� r� r� �str r r r �
get_all_certsf s
zNSSDatabase.get_all_certsc C s, z| � |� W n ty" Y dS 0 dS d S )NFT)r r )rs r� r r r � has_nickname{ s
zNSSDatabase.has_nicknamec C sX | � |�}t|d��$}|�|�tjj�� W d � n1 s>0 Y t�|d� dS )z7Export the given cert to PEM file in the given location�wbNi$ ) r r� rC rD r
rE rF rh r� )rs r� �locationr �fdr r r �export_pem_cert� s
2zNSSDatabase.export_pem_certc
C s� z4t |��}|�� }W d � n1 s(0 Y W n6 tyj } z td||jf ��W Y d}~n
d}~0 0 t|�\}}| �|||� zt||� W n ty� Y n0 td| ��dS )zgImport a cert form the given PEM file.
The file must contain exactly one certificate.
Nr� z%%s contains more than one certificate)r� r� r� r r� r$ r� r+ ) rs r� r� r r r� r# r r r r r �import_pem_cert� s
* � �zNSSDatabase.import_pem_certc C s4 t |�}dd|d|dg}| j||�tjj�d� d S )Nz-Ar� r r )r� )r@ r� rD r
rE rF )rs r r� r� r� r r r r� � s zNSSDatabase.add_certc C s | � dd|g� d S )Nz-Dr� )r� )rs r� r r r � delete_cert� s zNSSDatabase.delete_certc C s: | � � }|D ](\}}}}||kr | �dd|g� q6q dS )zpDelete the key with provided nick
This commands removes the key but leaves the cert in the DB.
�-Fr� N)r� r� )rs r� �keysZ_slotZ_algor� r� r r r �delete_key_only� s
zNSSDatabase.delete_key_onlyc C s\ z| � dd|g� W n tjy2 | �|� Y n0 | �� D ]\}}||kr<| �|� q<dS )z%Delete a cert and its key from the DBr r� N)r� r rK r r� r )rs r� ZcertnameZ_flagsr r r �delete_key_and_cert� s z NSSDatabase.delete_key_and_certc C sv t j jt jjd�}|j|kr.td|j� d���|j|k rJtd|j� d���|jt jdd� |k rrtd|j� d ���d
S ) z(Common checks for cert validity
)Ztzznot valid before z UTC is in the future.z has expired z UTCr� )Zhoursz expires in less than one hour (z UTC)N)�datetimeZnow�timezoneZutcZnot_valid_before_utcr+ Znot_valid_after_utcZ timedelta)rs r Zutcnowr r r �_verify_cert_validity� s
�
� �z!NSSDatabase._verify_cert_validityc
C s� | � |�}| �|� z | jdd|dddgdd� W n0 tjyb } zt|j��W Y d}~n
d}~0 0 z|�|� W n ty� td | ��Y n0 dS )
z�Verify a certificate is valid for a SSL server with given hostname
Raises a ValueError if the certificate is invalid.
�-Vr� �-u�V�-eTrA Nzinvalid for server %s)r r r� r rK r+ rL Zmatch_hostname)rs r� �hostnamer r# r r r �verify_server_cert_validity� s"
��
z'NSSDatabase.verify_server_cert_validityc s0 � fdd�}� � |�}|D ]}||||� qd S )Nc
s. � � | � | jstd��z| j�tjj�}W n tjjyJ td��Y n0 |j j
s\td��|d ur�|j j }|d ur�||k r�td� ||���z| j�tjj
�}W n tjjy� td��Y n0 t|j j�dkr�td��z � jdd |d
d d gd
d� W n2 tj�y( } zt|j��W Y d }~n
d }~0 0 d S )Nzhas empty subjectzmissing basic constraintsznot a CA certificatez/basic contraint pathlen {}, must be at least {}z(missing subject key identifier extensionr z(subject key identifier must not be emptyr r� r �Lr TrA )r r� r+ rM rN rO r
ZBasicConstraintsrT rQ r7 Z path_lengthr ZSubjectKeyIdentifierr� Zdigestr� r rK rL )r r� �
minpathlenZbc�plZskir# rw r r �verify_ca_cert� sL
������
z;NSSDatabase.verify_ca_cert_validity.<locals>.verify_ca_cert)r )rs r� r r r� r r rw r �verify_ca_cert_validity� s 1
z#NSSDatabase.verify_ca_cert_validityc s8 � � |�}� fdd�|D �}t|d |d d� |� d S )Nc s g | ]}� � |��qS r )r )r� r� rw r r �
<listcomp>- r� z8NSSDatabase.verify_kdc_cert_validity.<locals>.<listcomp>r� )r� rW )rs r� r Z nicknamesr� r rw r rW + s
z$NSSDatabase.verify_kdc_cert_validity)Nra NN)N)N)NNNF)T)N)N)N)'rZ r[ r\ r] rt rf rr rz r{ r~ r r� r� r� r� r� r� r� r� r� r� r� r� �EMPTY_TRUST_FLAGSr� r r r r r
r r� r r r r r r! rW r r r r r` � sL
M
2
�
P
6r` )r )@Z
__future__r � collectionsr Zloggingrh r� r� r� r� rx r� rg Z ctypes.utilr r Zcryptography.x509rO Zipaplatform.pathsr Zipaplatform.tasksr Z ipapython.dnr Zipapython.kerberosr Z ipapythonr Zipalibr
Z getLoggerrZ r� ZCA_NICKNAME_FMTZ
NSS_DBM_FILESZ
NSS_SQL_FILESZ NSS_FILES�
namedtupler r# r, r0 r4 r2 r1 ZEKU_PKINIT_CLIENT_AUTHrS ZIPA_CA_TRUST_FLAGSZEXTERNAL_CA_TRUST_FLAGSZTRUSTED_PEER_TRUST_FLAGSr r r$ r; r@ rW �compiler� r� r rX r^ r_ r` r r r r �<module> sv
�� ��
,&��