File: //usr/lib/python3.9/site-packages/ipalib/install/__pycache__/certmonger.cpython-39.pyc
a
�N(ip � @ s� d dl mZmZ d dlZd dlZd dlZd dlZd dlZd dlZd dl Z d dl
m Z d dl m
Z
d dlmZ d dlmZ d dlmZ d dlmZ e�e�Zd Zd
Zd
Zd Z d Z d
Z dgZ G dd� d�Z G dd� de �Z!dd� Z"dd� Z#dd� Z$dd� Z%dd � Z&d d � Z'd d � Z(d!d"� Z)dBd&d'�Z*dCd(d)�Z+dDd*d+�Z,dEd,d-�Z-dFd.d/�Z.dGd0d1�Z/d2d3� Z0d4d5� Z1d6d7� Z2d8d9� Z3dHd;d<�Z4d=d>� Z5dId@dA�Z6dS )J� )�print_function�absolute_importN)�api)�CA_DBUS_TIMEOUT)�DN)�Sleeper)�paths)�services� /org/fedorahosted/certmonger�org.fedorahosted.certmongerz#org.fedorahosted.certmonger.request� org.fedorahosted.certmonger.ca� org.freedesktop.DBus.Propertiesztemplate-hostnamec @ s e Zd ZdZddd�ZdS )�_cm_dbus_objectz>
Auxiliary class for convenient DBus object handling.
NFc C s� |du s|du s|du r t d��|du r,|}|| _|| _|| _|| _|| _|�||�| _t� | j|�| _
|r|t� | jt �| _ dS )aY
bus - DBus bus object, result of dbus.SystemBus() or dbus.SessionBus()
Object is accesible over this DBus bus instance.
object_path - path to requested object on DBus bus
object_dbus_interface
parent_dbus_interface
property_interface - create DBus property interface? True or False
Nz5bus, object_path and dbus_interface must not be None.)
� RuntimeError�bus�parent�pathZ obj_dbus_ifZparent_dbus_if�
get_object�obj�dbus� Interface�obj_if�DBUS_PROPERTY_IF�prop_if)�selfr r Z object_pathZobject_dbus_interfaceZparent_dbus_interfaceZproperty_interface� r �=/usr/lib/python3.9/site-packages/ipalib/install/certmonger.py�__init__V s
�z_cm_dbus_object.__init__)NF)�__name__�
__module__� __qualname__�__doc__r r r r r r R s �r c s< e Zd ZdZdZdd� Zdd� Zdd� Z� fd d
�Z� Z S ) � _certmongera
Create a connection to certmonger.
By default use SystemBus. When not available use private connection
over Unix socket.
This solution is really ugly and should be removed as soon as DBus
SystemBus is available at system install time.
i, c C st t j�t�� d�}t�tjddd|g�| _ t
d| j d�D ]&}t j� |�rTd| S t
�d� q8| �� td��d S ) N�
certmongerz-nz-Lz-Pr � z unix:path=%sz%Failed to start certmonger: Timed out)�osr �join�tempfileZmkdtemp�
subprocess�Popenr Z
CERTMONGER�_proc�range�timeout�exists�time�sleep�_stop_private_connr )r Z
sock_filename�_tr r r �_start_private_connz s � z _certmonger._start_private_connc C sj | j rf| j �� }|d ur d S | j �� td| jd�D ]&}| j �� }|d urP d S t�d� q4t�d� d S )Nr r$ zFailed to stop certmonger.) r* ZpollZ terminater+ r, r. r/ �logger�error)r Zretcoder1 r r r r0 � s
z _certmonger._stop_private_connc C s | � � d S )N)r0 )r r r r �__del__� s z_certmonger.__del__c
s� d | _ d | _zt�� | _W n� tjy� } z~|�� }|dvrJt�d|� � z | �� | _ tj
� | j �| _W n4 tjy� } zt�d|� � W Y d }~n
d }~0 0 W Y d }~n�d }~0 0 z| j� t
� W n� tj�yx ztjj�� W n4 t�y } zt�d|� � W Y d }~n
d }~0 0 td| jd�D ]H}z| j� t
� W �qtW n tj�y\ Y n0 t�d� td���q*Y n0 tt| ��| jd tt � d S )N)z#org.freedesktop.DBus.Error.NoServerz'org.freedesktop.DBus.Error.FileNotFoundz2Failed to connect to certmonger over SystemBus: %sz7Failed to connect to certmonger over private socket: %sz Failed to start certmonger: %sr r$ zFailed to start certmonger) r* Z_busr � SystemBus�
DBusExceptionZ
get_dbus_namer3 r4 r2 Z
_private_sockZ
connectionZ
ConnectionZget_name_owner� DBUS_CM_NAMEr Z
knownservicesr# �start� Exceptionr+ r, r. r/ r �superr" r � DBUS_CM_PATH�
DBUS_CM_IF)r �eZerr_namer1 �� __class__r r r � sL �
�.
�z_certmonger.__init__)
r r r r! r, r2 r0 r5 r �
__classcell__r r r? r r" p s
r" c C s* t | t�std��t� }g }g }d| v rD|j�| d �}|rN|g}n
|j�� }|D ]�}t|j||t t
d�}| D ]�}|dkr�|j� � }|du r�t d| �
d� ��t|j||tt
�}| | |j�� kr� qRqn|tv r�t| | �} |j�t |�}
| �|
�s� qRqn|j�t |�} | | | krn qRqn|�|� qR|S )z�
Get all requests that matches the provided criteria.
:param criteria: dict of criteria; see module doc for details
z"criteria" must be dict.�nicknameT�ca-nameNz!certmonger CA '%s' is not defined)�
isinstance�dict� TypeErrorr" r Zfind_request_by_nicknameZ get_requestsr r �DBUS_CM_REQUEST_IFr= �get_car �get�
DBUS_CM_CA_IF� get_nickname�ARRAY_PROPERTIES�setr �Get�issubset�append) �criteria�cm�requestsZrequests_pathsZ request_path�requestZ criterion�ca_path�ca�expectZgot�valuer r r �
_get_requests� sH
�
� �
rY c C s@ t | �}t|�dkrdS t|�dkr,|d S tdt|� ��dS )z�
Find request that matches criteria. Return ``None`` if no match.
Raise ``RuntimeError`` if there is more than one matching request.
:param criteria: dict of criteria; see module doc for details
r N� z1Criteria expected to be met by 1 request, got %s.)rY �lenr )rQ rS r r r � _get_request� s �r\ c
C s� zt t| d��}W n2 tyD } zt�d|� � W Y d}~n
d}~0 0 |r�|dkrx|j�� }t|j||t t
�}|j� � S |j �
t|�S ndS dS )z"
Get property of request.
)rB �Failed to get request: %sNrC )r\ rE r r3 r4 r rH r r rJ r= rK r rN rG )�
request_id� directiverT r> rU rV r r r �get_request_value s
�
r` c
C sZ z t | �}W n2 ty> } zt�d|� � W Y d}~n
d}~0 0 |rR|j�td�S dS dS )a
If you don't know the certmonger request_id then try to find it by looking
through all the requests.
Return ``None`` if no match. Raise ``RuntimeError`` if there is
more than one matching request.
:param criteria: dict of criteria; see module doc for details
r] NrB )r\ r r3 r4 r rN rG )rQ rT r> r r r �get_request_id s ra c C s< g }dd| | d�}t |�}|D ]}|�|j�td�� q |S )zZ
Return a list containing the request ids for a given NSS database
directory.
�NSSDB)z cert-storagez key-storage�
cert-databasez key-databaserB )rY rP r rN rG )�dirZreqidrQ rS rT r r r �get_requests_for_dir- s �re c
C s\ zt d| i�}W n2 tyB } zt�d|� � W Y d}~n
d}~0 0 |rX|j�||i� dS )z;
Add a new directive to a certmonger request file.
rB r] N)r\ r r3 r4 r �modify)r^ r_ rX rT r> r r r �add_request_value< s rg c C s t | d|g� dS )z�
In order for a certmonger request to be renewable it needs a principal.
When an existing certificate is added via start-tracking it won't have
a principal.
ztemplate-principalN�rg )r^ � principalr r r �
add_principalI s rj c C s t | d|� dS )z�
In order for a certmonger request to be renwable it needs the subject
set in the request file.
When an existing certificate is added via start-tracking it won't have
a subject_template set.
ztemplate-subjectNrh )r^ �subjectr r r � add_subjectS s rl �IPArb Fc C sd t | ||||||||| |
| |�
}tjj}| r8| |k r8| }t�� | }zt||�}W n4 ty� } z t�d|� d}W Y d}~n
d}~0 0 t |d�}|dkr�|du r�t�d|� |S t�d|||� |dv r�t�d |� �q@| s�q@t�� |kr�t�d
|� �q@|dk�r t�d |� t�
d � qDt�d
|� t�
d � t |� qD|
�rPt |d� td�
||���dS )a Request certificate, wait and possibly resubmit failing requests
Submit a cert request to certmonger and wait until the request has
finished.
With timeout, a failed request is resubmitted. During parallel replica
installation, a request sometimes fails with CA_REJECTED or
CA_UNREACHABLE. The error occurs when the master is either busy or some
information haven't been replicated yet. Even a stuck request can be
recovered, e.g. when permission and group information have been
replicated.
zwait_for_request raised %sZTIMEOUTNzca-error�
MONITORINGz Cert request %s was successfulz Cert request %s failed: %s (%s)> � CA_REJECTED�CA_UNREACHABLEz Giving up on cert request %sz$Request %s reached resubmit deadlinez'%s not in final state, continue waiting�
z"Sleep and resubmit cert request %s)r^ z$Certificate issuance failed ({}: {}))� request_certr �env�certmonger_wait_timeoutr. �wait_for_requestr r3 �debugr` r/ �resubmit_request�
stop_tracking�format)�certpathrk ri rB � passwd_fname�dnsrV �profile� pre_command� post_command�storage�permsZresubmit_timeoutZstop_tracking_on_error�nss_userZreq_idZcertmonger_timeoutZdeadline�stater> Zca_errorr r r �request_and_wait_for_cert^ sN �
�
�r� c
C s� |
dkr&| \}
}t ttt|��� �}n| }
| }t� }|j�|�}|sRtd�|���t|
|
|
|||d�}|rz||d< ||d< |r�|g|d< |r�t |t
t f�s�t |��||d< |r�||d< |r�||d < | r�| |d
< t
j}|r�tj�|�s�|| }||d < | �rtj�| ��s|| } | |d < | �r6| d
|d< | d |d< |jj|tjjd�}z0|d
�rpt|j||d ttd�}ntd��W n4 t�y� } zt� d|� � W Y d}~n
d}~0 0 |j� � S )z�
Execute certmonger to request a server certificate.
``dns``
A sequence of DNS names to appear in SAN request extension.
``perms``
A tuple of (cert, key) permissions in e.g., (0644,0660)
�FILE�{} CA not found)� KEY_STORAGE� CERT_STORAGE�
CERT_LOCATION� KEY_LOCATIONZSUBJECT�CA�
CERT_NICKNAME� KEY_NICKNAMEZ PRINCIPAL�DNS� KEY_PIN_FILE�
ca-profile�nss-user�cert-presave-command�cert-postsave-commandr z
cert-permsrZ z key-perms�r, T� add_request() returned Falsez"Failed to create a new request: %sN) �strr �reversedr" r �find_ca_by_nicknamer ry rE rD �list�tuplerF r �CERTMONGER_COMMAND_TEMPLATEr% r �isabs� add_requestr rs rt r r rG r= r: r3 r4 rK )rz rk ri rB r{ r| rV r} r~ r r� r� r� �certfile�keyfilerR rU Zrequest_parameters�certmonger_cmd_template�resultrT r> r r r rr � sj
�
�
� rr c
C s� |dkr| \} }
n| } | }
t � }tj}|j�|�}|sDtd�|���d||| |
|d�}|rj||d< ||d< |rv||d< |r�tj� |�|d< |r�tj�
|�s�|| }||d < |r�tj�
|�s�|| }||d
< |r�||d < | d vr�| |d
< | |d< |
du�rt |
�dk�r|
|d< | �r | |d< t �
d|� |jj|tjjd�}z0|d �rbt|j||d ttd�}ntd��W n4 t�y� } zt �d|� � W Y d}~n
d}~0 0 |j�td�S )a�
Tell certmonger to track the given certificate in either a file or an NSS
database. The certificate access can be protected by a password_file.
This uses the generic certmonger command getcert so we can specify
a different helper.
:param certpath:
The path to an NSS database or a tuple (PEM certificate, private key).
:param ca:
Nickanme of the CA for which the given certificate should be tracked.
:param nickname:
Nickname of the NSS certificate in ``certpath`` to be tracked.
:param pin:
The passphrase for either NSS database containing ``nickname`` or
for the encrypted key in the ``certpath`` tuple.
:param pinfile:
Similar to ``pin`` parameter except this is a path to a file containing
the required passphrase.
:param pre_command:
Specifies a command for certmonger to run before it renews a
certificate. This command must reside in /usr/lib/ipa/certmonger
to work with SELinux.
:param post_command:
Specifies a command for certmonger to run after it has renewed a
certificate. This command must reside in /usr/lib/ipa/certmonger
to work with SELinux.
:param storage:
One of "NSSDB" or "FILE", describes whether certmonger should use
NSS or OpenSSL backend to track the certificate in ``certpath``
:param profile:
Which certificate profile should be used.
:param token_name:
Hardware token name for HSM support
:param dns:
List of DNS names
:param nss_user:
login of the private key owner
:returns: certificate tracking nickname.
r� r� T)ZTRACKr� r� r� r� r� r� r� ZKEY_PINr� r� r� r� > N�internalz key-tokenz
cert-tokenNr r� r� zstart tracking %sr� rZ r� z Failed to add new request: %srB )r" r r� r r� r ry r% r �abspathr� r[ r3 rv r� r rs rt r r rG r= r: r4 r rN )rz rV rB �pinZpinfiler~ r r} r� Z
token_namer| r� r� r� rR r� rU �paramsr� rT r> r r r �start_tracking� sl ,
� �
� r� c
C s� |du r |du r |du r t d��| dur8|dur8t d��t� }| rJ| |d< |rV||d< |rb||d< |rn||d< z t|�}W n2 t y� } zt�d|� � W Y d}~n
d}~0 0 |r�|jj�|j� dS ) zo
Stop tracking the current request using either the request_id or nickname.
Returns True or False
Nz5One of request_id, nickname and certfile is required.z'Can't specify both secdir and certfile.rc rB z
cert-nicknamez cert-filer] ) r rE r\ r3 r4 r r Zremove_requestr )Zsecdirr^ rB r� rQ rT r> r r r rx X s( rx c C sj i }|d ur"t � }|j�|�|d< |d ur2||d< |d urB||d< t|�dkrftd| i�}|j�|� d S )Nr� �template-profile� template-ms-certificate-templater rB )r" r r� r[ r\ rf )r^ rV r} � template_v2�updaterR rT r r r rf v s rf c C s� t d| i�}|r�i }|dur2t� }|j�|�|d< |durB||d< |durR||d< |rfd|d< d|d < d
tfd tffD ]D\}} z|j�t|�}
W n t j
y� Y qvY qv0 |
rv| |
�||< qvt |�d kr�|j� |� |j�
� dS )
a�
:param request_id: the certmonger numeric request ID
:param ca: the nickname for the certmonger CA, e.g. IPA or SelfSign
:param profile: the profile to use, e.g. SubCA. For requests using the
Dogtag CA, this is the profile to use. This also causes
the Microsoft certificate tempalte name extension to the
CSR (for telling AD CS what template to use).
:param template_v2: Microsoft V2 template specifier extension value.
Format: <oid>:<major-version>[:<minor-version>]
:param is_ca: boolean that if True adds the CA basic constraint
rB Nr� r� r� Tztemplate-is-ca���ztemplate-ca-path-lengthzkey-sizezkey-typer )r\ r" r r� �intr� r rN rG r r7 r[ rf Zresubmit) r^ rV r} r� Zis_carT r� rR �keyZconvertrX r r r rw � s.
rw c C s& t � } | j�d�}t| j| |ttd�S )z�
Look through all the certmonger CA files to find the one that
has id=IPA
We can use find_request_value because the ca files have the
same file format.
rm T)r" r r� r r rJ r= )rR rU r r r � _find_IPA_ca� s r� c C sN t � }|rJ|j�td�}|rJdt�|�vrJd|�� | f }|j�td|� dS )a
If the hostname we were passed to use in ipa-client-install doesn't
match the value of gethostname() then we need to append
-k host/HOSTNAME@REALM to the ca helper defined for
/usr/libexec/certmonger/ipa-submit.
We also need to restore this on uninstall.
�external-helper�-kz%s -k %sN)r� r rN rJ �shlex�split�strip�Set)ri rV �
ext_helperr r r �add_principal_to_cas� s r� c C sL t � } | rH| j�td�}|rHdt�|�v rHt�|�d }| j�td|� dS )zE
Remove any -k principal options from the ipa_submit helper.
r� r� r N)r� r rN rJ r� r� r� )rV r� r r r �remove_principal_from_cas� s r� c C s| t �� }|�dd�}t �|d�}|�| �}|s>td�| ���n:|�d|�}t �|d�}|�dd�}|jdd|t d� |S dS ) zi
Modify certmonger CA helper.
Applies the new helper and return the previous configuration.
r r
z{} is not configuredr
r r� r� N)
r r6 r r r� r ry rN r� r ) Zca_name�helperr r Zifacer Zca_objZca_ifaceZ
old_helperr r r �modify_ca_helper� s( �
���r� r� c C s� | r| dkrd| } t tjd��L}|D ]6}|�dd�\}}| |kr&|�� W d � S q&W d � n1 sr0 Y dS )z�
Dogtag stores its NSS pin in a file formatted as token:PIN.
The caller is expected to handle any exceptions raised.
r� z hardware-�r�=rZ N)�openr ZPKI_TOMCAT_PASSWORD_CONFr� r� )�token�f�line�tokr� r r r �get_pin� s :r� c C s g }| D ]}|� t|�� q|S )a
Given a set of directories and nicknames verify that we are no longer
tracking certificates.
dirs is a list of directories to test for. We will return a tuple
of nicknames for any tracked certificates found.
This can only check for NSS-based certificates.
)�extendre )�dirsZreqidsrd r r r � check_state s
r� �x c C sR t d|td�d�}d }tt| d��}||kr8t�d|� |dv rBqN|}|� q|S )Ng �?zrequest timed out)r/ r, Zraises�statusz!certmonger request is in state %r> ZNEED_CArp ZCA_UNCONFIGUREDZ
NEED_GUIDANCErn ro )r r r� r` r3 rv )r^ r, r/ Z
last_stater� r r r ru s � ru ) NNNrm NNNrb Nr FN)
NNNrm NNNrb NN) rm NNNNNNrb NNN)NNNN)NNN)NNNF)r� )r� )7Z
__future__r r Zloggingr% r. r r� r( r' Zipalibr Zipalib.constantsr Z ipapython.dnr Zipapython.ipautilr Zipaplatform.pathsr Z ipaplatformr Z getLoggerr r3 r< r= r8 rG rJ r rL r r" rY r\ r` ra re rg rj rl r� rr r� rx rf rw r� r� r� r� r� r� ru r r r r �<module> sx
O1
�
G �
K �
j
�
0