File: //usr/lib/python3.9/site-packages/ipaclient/install/__pycache__/ipa_certupdate.cpython-39.opt-1.pyc
a
�N(i~' � @ s d dl mZ d dlZd dlZd dlmZ d dlmZmZ d dl m
Z
d dl m Z m
Z
mZmZ d dlmZ d dlmZ d d lmZ d d
lmZmZmZ d d lmZm Z m Z d d l m Z e� e!�Z"G d
d� de j#�Z$dd� Z%dd� Z&dd� Z'dd� Z(d dd�Z)dd� Z*dS ) � )�absolute_importN)�urlsplit)�
certmonger� certstore)�is_ipa_configured)� admintool�certdb�ipaldap�ipautil)�services)�paths)�tasks)�api�errors�x509)�FQDN�IPA_CA_NICKNAME�RENEWAL_CA_NAME)�check_client_configurationc s0 e Zd ZdZdZdZ� fdd�Zdd� Z� ZS )�
CertUpdatezipa-certupdatez%prog [options]zIUpdate local IPA certificate databases with certificates from the server.c s t t| �jdd� d S )NT)Z
needs_root)�superr �validate_options)�self�� __class__� �D/usr/lib/python3.9/site-packages/ipaclient/install/ipa_certupdate.pyr 0 s zCertUpdate.validate_optionsc C s� t � tj�d�}dtjd< dtjd< z�z<tjdtjd� t�� tj j
� � t t� tj j
�
� W n" tjy� t�dt� � Y n0 W |d u r�tjd= q�|tjd< n |d u r�tjd= n
|tjd< 0 d S )NZ
KRB5CCNAMEz/etc/krb5.keytabZKRB5_CLIENT_KTNAMEzMEMORY:Z
cli_installer)�contextZconfdirz9Unable to obtain credentials for %s from /etc/krb5.keytab)r �os�environ�getr Z bootstrapr ZETC_IPA�finalizeZBackendZ rpcclientZconnect�
run_with_argsZ
disconnectr Z CCacheError�logger�errorr )r Zold_krb5ccnamer r r �run3 s,
�
�
zCertUpdate.run) �__name__�
__module__� __qualname__Z command_name�usage� descriptionr r% �
__classcell__r r r r r ( s
r c C s� t | jj�j}tj�|�}z| jjdd�}|d }W n6 t j
t j fyj | jjddd�}|d d }Y n0 |� � t
�|| jj| jj|�}|r�| j�� d }ng }t|� t� �r�| jjdd d
�}d d � |d D �}t|� d
dlm} m}
| �� �� �r*z| �|� W n t �y( t � d� Y n0 z t | |
| jj | jj!|� W n t �yd t � d� Y n0 t"j#j$�%� �r�t"j#j$�&� t"j#j'�%� �r�t"j#j'�&� dS )z�
Run the certupdate procedure with the given API object.
:param api: API object with ldap2/rpcclient backend connected
(such that Commands can be invoked)
z2.107)�version�resultTz2.0)�serverr, � enable_raz CA serverZenabled)Z
role_servrole�statusc S s g | ] }|d �qS )Z
server_serverr )�.0r. r r r �
<listcomp>s � z!run_with_args.<locals>.<listcomp>r )�
cainstance�custodiainstancez.Failed to add lightweight CA tracking requestszFailed to update RA configN)(r �envZ jsonrpc_uri�hostnamer Z
LDAPClientZfrom_hostname_secureZCommandZ
ca_is_enabledr Z CommandErrorZ NetworkErrorZ gssapi_bindr Z get_ca_certsZbasedn�realmZca_find�
update_clientr Zserver_role_find�
update_serverZipaserver.installr4 r5 �
CAInstanceZ
is_configuredZ$add_lightweight_ca_tracking_requests� Exceptionr# � exception�update_server_ra_configr/ �ca_hostr �
knownservicesZhttpd�
is_running�restartZkrb5kdc) r r. Zldapr- Z
ca_enabled�certsZlwcasZresp�
ca_serversr4 r5 r r r r" N sT ���
� r" c C s� t tj| � t tj| � t tj| � t�tjj �}dD ]d}|�
|�r6z|� |� W q: t j
y� } z*t�d||j|� W Y d }~q6W Y d }~q:d }~0 0 q:q6t|j| � t�� t�| � d S )N)zIPA CAzExternal CA certz Failed to remove %s from %s: %s)� update_filer Z
IPA_CA_CRTZKDC_CA_BUNDLE_PEMZ
CA_BUNDLE_PEMr � NSSDatabaser r6 Znss_dirZ has_nickname� delete_certr
�CalledProcessErrorr# r$ Zsecdir� update_dbr
Z(remove_ca_certs_from_systemwide_ca_storeZ(insert_ca_certs_into_systemwide_ca_store)rC Zipa_db�nickname�er r r r9 � s"
�& r9 c C s d� tjj�d��}ttj| | � tj j
� � r>tj j
� |� tj
ttd�}t�|�}|d ur�tjjd }t�d|� tj|dd� zt�||�}W n ty� t�d| ��Y n0 t�|d �}|d
ks�|r�t�d | ��t�d |� tj|d
d� t tj | � t tj | � d S )N�-�.)z
cert-databasez
cert-nicknamezca-name�< z$resubmitting certmonger request '%s'z dogtag-ipa-ca-renew-agent-reuse)�cazQResubmitting certmonger request '%s' timed out, please check the request manuallyzca-errorZ
MONITORINGzMError resubmitting certmonger request '%s', please check the request manuallyz!modifying certmonger request '%s'zdogtag-ipa-ca-renew-agent) �joinr r6 r8 �splitrI r Z"ETC_DIRSRV_SLAPD_INSTANCE_TEMPLATEr r@ ZdirsrvrA rB ZPKI_TOMCAT_ALIAS_DIRr r r Zget_request_idZstartup_timeoutr# �debugZresubmit_requestZwait_for_request� RuntimeErrorr Z ScriptErrorZget_request_valueZmodifyrE ZCA_CRTZ
CACERT_PEM)rC �instanceZcriteriaZ
request_id�timeout�stateZca_errorr r r r: � sD �
� ��
�� r: c C sj t |�dkrdS |d }|sT| j�� |jtjjtjj|d�}| �|� | � |� n||vrf| � |� dS )z�
After promoting a CA-less deployment to CA-ful, or after removal
of a CA server from the topology, it may be necessary to update
the default.conf ca_host setting on non-CA replicas.
r N)Z host_namer8 Z
custodia_peer)
�lenr; Z$configure_certmonger_renewal_helpersZCustodiaInstancer r6 �hostr8 Z
import_ra_keyZupdate_ipa_conf)r4 r5 r/ r? rD Z new_ca_hostZcustodiar r r r> � s
�
r> � c
C sZ dd� |D �}zt j|| |d� W n2 tyT } zt�d| |� W Y d }~n
d }~0 0 d S )Nc s s" | ]}|d dur|d V qdS )� Fr Nr )r1 �cr r r � <genexpr> r3 z update_file.<locals>.<genexpr>)�modezfailed to update %s: %s)r Zwrite_certificate_listr< r# r$ )�filenamerC r] rK r r r rE s
rE c C s� t �| �}|�� D ]\}}|jr|�|� q|D ]f\}}}}} t�|d|�}
z|�|||
� W q0 tj y� } z t
� d|| | � W Y d} ~ q0d} ~ 0 0 q0dS )z�Drop all CA certs from db then add certs from list provided
This may result in some churn as existing certs are dropped
and re-added but this also provides the ability to change
the trust flags.
Tz failed to update %s in %s: %sN) r rF Z
list_certsrO rG r Zkey_policy_to_trust_flagsZadd_certr
rH r# r$ ) �pathrC Zdb�name�flagsZcertrJ ZtrustedZekuZ_serialZ trust_flagsrK r r r rI s
rI )rY )+Z
__future__r Zloggingr � urllib.parser Zipalib.installr r Z ipalib.factsr Z ipapythonr r r r
Z ipaplatformr Zipaplatform.pathsr Zipaplatform.tasksr
Zipalibr r r Zipalib.constantsr r r Z ipalib.utilr Z getLoggerr& r# Z AdminToolr r" r9 r: r> rE rI r r r r �<module> s(
&I0%