File: //usr/lib/python3.9/site-packages/ipalib/install/__pycache__/certstore.cpython-39.pyc
a
�N(il= � @ s� d Z ddlmZ ddlmZ ddlmZmZ ddlm Z m
Z
ddl m Z dd� Z
d d
� Zd d � Zd
d� Zd'dd�Zd(dd�Zdd� Zd)dd�Zdd� Zd*dd �Zd d � Zd d � Zd+d!d"�Zd,d#d$�Zd%d&� ZdS )-z
LDAP shared certificate store.
� )� PyAsn1Error)�DN)�get_ca_nickname�
TrustFlags)�errors�x509)� IPA_CA_CNc
C s� z$t | j�}t | j�}| j}| j}W n4 ttfyX } ztd| ��W Y d }~n
d }~0 0 t|��dd�}t|��dd�}d||f }|||fS )N� failed to decode certificate: %s�\;�\3bz%s;%s) r �subject�issuer�
serial_numberZpublic_key_info_bytes�
ValueErrorr �str�replace)�certr r
r Zpublic_key_info�e�
issuer_serial� r �</usr/lib/python3.9/site-packages/ipalib/install/certstore.py� _parse_cert! s
" r c
C s t |�\}}}|dur�z
|j}W n0 tyP } ztd| ��W Y d} ~ n
d} ~ 0 0 |dur�|tjtjtjtjtjtj h8 }||B }g d�| d< |g| d< |g| d< |g| d< |g| d< |g| d < |dur�|r�d
nd g| d < |du�rt
|�}|s�|� tj � || d
< dS )zB
Initialize certificate store entry for a CA certificate.
Nr )ZipaCertificate�pkiCAZ ipaKeyPolicy� objectClass�cn�ipaCertSubject�ipaCertIssuerSerial� ipaPublicKey�cACertificate;binary�trusted�
distrusted� ipaKeyTrust�ipaKeyExtUsage) r Zextended_key_usager r �EKU_SERVER_AUTH�EKU_CLIENT_AUTH�EKU_EMAIL_PROTECTION�EKU_CODE_SIGNINGZEKU_ANY�EKU_PLACEHOLDER�list�append)
�entryr �nicknamer �
ext_key_usager r �
public_keyZcert_ekur r r r �
init_ca_entry1 s2
"
�
r. c C s� t ddd|�}z(| j|dgd�}||jd< | �|� W nZ tjy~ | �|�}ddg|d< d |jd
< ||jd< | �|� Y n tjy� Y n0 d S ) zF
Update the CA certificate in cn=CAcert,cn=ipa,cn=etc,SUFFIX.
�r �CAcert�r Zipa�r �etcr )�
attrs_listZ nsContainerr r r0 r N) r � get_entry� single_value� update_entryr �NotFound�
make_entry� add_entry� EmptyModlist)�ldap�base_dnr �dnr* r r r �update_compat_caS s
r? c C s� |s |s dS z$| j tddd|�ddgd�\}}W n tjyF Y dS 0 |D ]�}|j|kr\qLt|d �D ]B}|�� dkr�|r�|d �|� qh|�� d krh|rh|d �|� qhz| �|� W qL tj y� Y qL0 qLdS )
zG
Remove ipaCA and compatCA flags from their previous carriers.
N�r Z certificatesr1 r2 z4(|(ipaConfigString=ipaCA)(ipaConfigString=compatCA))�ipaConfigString�r= �filterr4 �ipaca�compatca)
� find_entriesr r r8 r> r( �lower�remover7 r; ) r< r= r> �
config_ipa�
config_compat�result�
_truncatedr* �configr r r �clean_old_configf s0 ��
rN NFc C s� t ddd|�}t d|f|�} | �| �}
t|
||||� |rL|
�dg ��d� |rb|
�dg ��d� |rrt| ||� | �|
� t| || ||� dS ) zF
Add new entry for a CA certificate to the certificate store.
r@ r1 r2 r rA �ipaCA�compatCAN)r r9 r. �
setdefaultr) r? r: rN ) r< r= r r+ r r, rI rJ � container_dnr> r* r r r � add_ca_cert� s �
rS c C s t |�\}}} | �d|i�}
| jtddd|�|
g d�d�\} } | d }
|
j}|
d D ]}||krT q�qT|
jd �� |�� kr�td ��|
d
�|� |
d �|� |
d �| � |d ur�|
j� d
�}|r�dnd}|d ur�|�� |kr�td��||
jd
< |du�rL|d u�rXt
|
� dg ��}|� t j
� ||B }|�s>|�t j
� t|�|
d< n |
�dd � d}d}|
� dg �D ],}|�� dk�r�d}n|�� dk�rld}�ql|�r�|�s�|
�dg ��d� |�r�|�s�|
�dg ��d� |�s�|�r�t| ||� | �|
� t| ||||� d S )zN
Update existing entry for a CA certificate in the certificate store.
r r@ r1 r2 �r r r r r! r" rA r rB r r zsubject name mismatchr r Nr! r r zinconsistent trustFr" rA rD TrE rO rP )r � make_filterrF r r> r6 rG r r) �get�set�discardr r' �addr( �poprQ r? r7 rN )r< r= r r r, rI rJ r r r- rC rK rL r* r> �old_certZ old_trustZ new_trustZold_ekuZnew_ekuZis_ipaZ is_compatrM r r r �update_ca_cert� sb ��
r\ c C s� t |�\}}}| �d|i�}| jtddd|�|g d�d�\}}|d } | d D ]}
|
|krN qhqNtd ��| d
�|� | d �|� t| d
�dkr�| �| j� n
| � | � d S ) z;
Remove a CA certificate in the certificate store.
r r@ r1 r2 rT rB r r zcertificate not foundr N)
r rU rF r r rH �lenZ delete_entryr> r7 ) r< r= r r r Z _public_keyrC rK rL r* r[ r r r �delete_ca_cert� s& ��
r^ c
C s^ zt | ||||||d� W n> tjyF t| |||||||d� Y n tjyX Y n0 dS )�m
Add or update entry for a CA certificate in the certificate store.
:param cert: IPACertificate
)rI rJ N)r\ r r8 rS r; )r< r= r r+ r r, rI rJ r r r � put_ca_cert s �
�
r` c
C s| g }| D ]n}t |�\}}}t|�}|durT|t|�krTt|�}tjtjtjtjh} nt|�}tjh} |� ||d| f� q|S )zO
Make CA certificates and associated key policy from DER certificates.
NT)
r r r r r# r$ r% r& r r) )
�certsZrealmZipa_ca_subjectrK r r �_issuer_serial�_public_key_infor+ r, r r r �make_compat_ca_certs s �rd c C sN |dur&t |t�s|g}dd� |D �}g }tdd|�}td|�}�z(ddg}|rh| �d |i�} |�| � | j|| �|| j�g d
�d �\}
} |
D ]�} | jd }
| j� d
d��
� }|dkr�d}n|dkr�d}nd}| � d�}|dur�t dd� |D ��}|� t
j� | � dg �D ]Z}zt|�\}}}W n t�y> g }Y q�Y n0 |�d�d }|�||
|||f� �q
q�W n� tj�y2 z| �|dg� W n� tj�y, td|�}| �|dg�} | jd }zt|�\}}}W n t�y� Y n@0 |du�r
||v�r
tjdd ��|�r|}nd}t|g||�}Y n0 Y n0 |�r>|S tjd d ��dS ) zS
Get CA certificates and associated key policy from the certificate store.
Nc S s g | ]}t |��d d��qS )r
r )r r )�.0Zsubjr r r �
<listcomp>4 s �z get_ca_certs.<locals>.<listcomp>r1 r2 r@ z (objectClass=ipaCertificate)z(objectClass=pkiCA)r )r r r r r! r" r rB r r! �unknownr Tr Fr" c s s | ]}t |�V qd S )N)r )re �pr r r � <genexpr>R � z get_ca_certs.<locals>.<genexpr>r �;� � r/ zno matching entry found)�reasonz
no such entry)�
isinstancer( r rU r) rF Zcombine_filtersZ MATCH_ALLr6 rV rG rW rX r r' r r �splitr r8 r5 rd )r< r= � compat_realm�
compat_ipa_ca�filter_subjectra Z config_dnrR �filtersrC rK rL r* r+ r r, r Z_subjectr Z_pkinfor r> r rb rc Z
ca_subjectr r r � get_ca_certs, sz
�
�
�
ru c C s | dd� S )zG
Convert certutil trust flags to certificate store key policy.
rl Nr )� trust_flagsr r r �trust_flags_to_key_policy| s rw c C s t d| ||�S )zG
Convert certificate store key policy to certutil trust flags.
F)r )r �car, r r r �key_policy_to_trust_flags� s ry c
C s8 t |�\}}} |du r td��t| ||||| ||� dS )r_ Fzmust be CA certificateN)rw r r` )
r< r= r r+ rv rI rJ r rx r, r r r �put_ca_cert_nss� s �rz c
C sL g }t | ||||d�}|D ],\}}} }
} t| d|
�} |�||| | f� q|S )zT
Get CA certificates and associated trust flags from the certificate store.
)rs T)ru ry r) )
r< r= rq rr rs Z nss_certsra r r+ r r, Z_serial_numberrv r r r �get_ca_certs_nss� s
� r{ c C s` t dtf||�}z| �|�d d }W n4 tjyZ | �� }|�d�d }t d|�}Y n0 |S )z2
Look for the IPA CA certificate subject.
r Zipacasubjectdnr Zipacertificatesubjectbase)ZCNzCertificate Authority)r r r5 r r8 Zget_ipa_configrV )r< Z container_car= r> Zcacert_subject�attrsZ subject_baser r r �get_ca_subject� s r} )NNFF)NNFF)NNFF)N)FF)N) �__doc__Z pyasn1.errorr Z ipapython.dnr Zipapython.certdbr r Zipalibr r Zipalib.constantsr r r. r? rN rS r\ r^ r` rd ru rw ry rz r{ r} r r r r �<module> s: " �
�
F �
�
P �
�