File manager - Edit - /opt/saltstack/salt/lib/python3.10/site-packages/salt/runners/__pycache__/digicertapi.cpython-310.pyc
Back
o ;j V � @ s� d Z ddlZddlZddlZddlZddlZddlmZ ddlZ ddl Z ddl Z ddl Z ddl mZmZ z ddlmZ dZW n# eya dZzddlmZ W n ey^ ddlmZ Y nw Y nw dZe�e�Zd d � Zd d � Zd d� Z dd� Z d2dd�Z d2dd�Z d2dd�Z d3dd�Z!d4dd�Z" d5d d �Z#d6d d �Z$d!d"� Z% # d7d$d%�Z&d&d'� Z'd(d)� Z(d*d+� Z)d,d-� Z*d.d/� Z+d0d1� Z,dS )8a< Support for Digicert. Heavily based on the Venafi runner by Joseph Hall (jphall@saltstack.com). Before using this module you need to register an account with Digicert's CertCentral. Login to CertCentral, ensure you have a payment method configured and/or there are adequate funds attached to your account. Click the ``Account`` item in the left sidebar, and select ``Account Access``. The right hand pane should show "Account Access" and a link to create an API key. Create a new API key and assign it to the user that should be attached to requests coming from Salt. NOTE CertCentral will not show the API key again after revealing it the first time. Make sure you copy it right away or you will have to revoke it and generate a new one. Now open ``/etc/salt/master`` and add the API key as shown below. .. code-block:: yaml digicert: api_key: ABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABC Restart your Salt Master. You can also include default values of the following variables to help with creating CSRs: .. code-block:: yaml digicert: api_key: ABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABC shatype: sha256 This API currently only supports RSA key types. Support for other key types will be added if interest warrants. � N)�Sequence)�CommandExecutionError�SaltRunnerError)�RSATF�digicertc C s t �di ��d�r tS dS )zE Only load the module if digicert has configuration in place r �api_keyF)�__opts__�get�__virtualname__� r r �L/opt/saltstack/salt/lib/python3.10/site-packages/salt/runners/digicertapi.py� __virtual__B s r c C � t �di ��dd�S )z Return the base_url r Zbase_urlz%https://www.digicert.com/services/v2/�r r r r r r � _base_urlK s �r c C r )z Return the API key r r � r r r r r �_api_keyT s r c O s� t jjj| fi |��}d|d v r|d S t|d d d �}t|d d d �}|dkr/i S || d }|dkr?|d | S |d | }|d } td|�D ] } | d || d � � } t jj�| |�} || �| d | � qN|S ) zN Wrapper to assist with paginated responses from Digicert's REST API. �errors�dictZpage�limit�totalr � � z?offset=)�salt�utils�http�query�int�range�extend) �urlZtopkey�args�kwargs�retZlimr ZnumpagesZ aggregate_ret�pZ param_urlZnext_retr r r � _paginate[ s" r% c C sJ | r t � � d| � �}nt � � d�}t|ddddt� dd�d �}d|i}|S ) z� List domains that CertCentral knows about. You can filter by container_id (also known as "Division") by passing a container_id. CLI Example: .. code-block:: bash salt-run digicert.list_domains z/domain?z/domain�domains�GETT�json�application/json�� X-DC-DEVKEY� Content-Type��method�decode� decode_type� header_dict�r r% r )� container_idr �orgsr# r r r � list_domainsz s � r5 c C sL | r t � � d| � �}nt � � d�}t|dddddt� dd �d �}d|i}|S ) z� List certificate requests made to CertCentral. You can filter by status: ``pending``, ``approved``, ``rejected`` CLI Example: .. code-block:: bash salt-run digicert.list_requests pending z/request?status=z/request�requestsr' Tr( Fr) r* �r. r/ r0 � raise_errorr1 r2 ��statusr Zreqsr# r r r � list_requests� s � r; c C s6 t � � d�}t|dddddt� dd�d �}d|i}|S ) z� List certificate orders made to CertCentral. CLI Example: .. code-block:: bash salt-run digicert.list_orders z/order/certificateZordersr' Tr( Fr) r* r7 r2 r9 r r r � list_orders� s � r< �pem_allc C sp | rKt jjjt� � d| � �ddddt� dd�d�}|d �d �d kr(d |d iS |d �d d�r6d |d iS |d �d ��dd�}|d �d ��d�}|sVd d ddd�iiS |rqt jjjd�t� ||�dddd|ddt� id�}nt jjjd�t� ||�dddddt� id�}d |v r�d |iS d|vr�d |i}|} t|t �r�|d }|} n|}|} d} |s�t � � \} } | }t � | | � t �| � dddd d d d |g} t�| �} d}| �� D ]}t�d |�}|r�|�d!�} nq�| r�t �| � |�rd"}t j�tt�d#��}z|�||�}W n t�y d | i}Y nw |�|||� d$|v �r4d ||d$ �d%d&�|d$ �d'd&�d(�iS d | iS ))a� Retrieve a certificate by order_id or certificate_id and write it to stdout or a filename. A list of permissible cert_formats is here: https://www.digicert.com/services/v2/documentation/appendix-certificate-formats CLI Example: .. code-block:: bash salt-run digicert.get_certificate order_id=48929454 cert_format=apache Including a 'filename' will write the certificate to the desired file. Note that some cert formats are zipped files, and some are binary. If the certificate has not been issued, this function will return the order details inside of which will be a status (one of pending, rejected, processing, issued, revoked, canceled, needs_csr, and needs_approval) If for some reason you want to pipe the output of this command to a file or other command you will want to leave off the ``filename`` argument and make sure to include ``--no-color`` so there will be no terminal ANSI escape sequences. z/order/certificate/r' FTr( r) r* )r. r8 r/ r0 r1 r r: Zissued� certificater �idN� common_name�unknownzTUnknown error, no certificate ID passed on command line or in body returned from API)�code�messagez${}/certificate/{}/download/format/{}r+ )r. r/ �text�headersZtext_outr8 r1 )r. rD r/ r8 r1 �body�opensslZx509z-nooutz-subjectz-nameoptZ multilinez-inz *commonName *= *(.*)r �digicert/domains�cachedirrE zContent-Dispositionz Not providedr, )�filenameZoriginal_filenamer, ) r r r r r r r �format� isinstancer �tempfileZmkstemp�os�write�close� subprocess� check_output� splitlines�re�search�group�unlink�cache�Cacher �fetch� TypeError�store)�order_idZcertificate_id� minion_idZ cert_formatrJ Z order_certr@ Zret_certr# �certZ tmpfilename�fd�cmd�out�lZcommon_name_match�bankrX �datar r r �get_certificate� s� �� ��� �� �� � � � ��� rf c C s0 t t� � d�ddddt� dd�d�}d|i}|S ) a` List organizations that CertCentral knows about. You can filter by container_id (also known as "Division") by passing a container_id. This function returns validation information by default; pass ``include_validation=False`` to turn it off. CLI Example: .. code-block:: bash salt-run digicert.list_organizations z /organizationZ organizationsr' Tr( r) r* r- )r% r r )r3 Zinclude_validationr4 r# r r r �list_organizationsh s � rg � c C s |r t |t�r |g}|rt |t�std��d|i}||d< |r$||d< n t�di ��dd�|d< i }|r<t |t�r<|g}|rGt |t�sGtd��|rM||d < |r_t| |||d |d ||d �}n t| |||d ||d �}||d < | rw| |d d< d|i|d< | r�| |d< |r�||d< | r�| |d< | |d< | r�d| i|d< |r�||d< ||d< tjj � |�}tjj j t � � d�d|dd t� d d �d d �}d!|d" vr�d#}tj�tt�d$��}|�||�}|d%u r�i }|�| |d" d& d d |d'�� |�|||� t| |� d(|d" iS ))a� Order a certificate. Requires that an Organization has been created inside Digicert's CertCentral. See here for API documentation: https://www.digicert.com/services/v2/documentation/order/order-ssl-determinator CLI Example: .. code-block:: bash salt-run digicert.order_certificate my_minionid my.domain.com 10 3 signature_hash=sha256 dns_names=['this.domain.com', 'that.domain.com'] organization_units='My Domain Org Unit' comments='Comment goes here for the approver' This runner can also be used to renew a certificate by passing `renewal_of_order_id`. Previous order details can be retrieved with digicertapi.list_orders. zDorder_certificate needs a single dns_name, or an array of dns_names.r@ � dns_names�signature_hashr �shatype�sha256z,Organization_units is not a valid data type.�organization_unitsr )�ou_namerk �key_len�password)rk ro rp �csr�server_platformr? Z organization�custom_expiration_date�validity_years�comments� disable_renewal_notificationsZ type_hint�product�renewal_of_order_idr> z/order/certificate/ssl�POSTTr( r) r* F)r. re r/ r0 r1 r8 r r rH rI Nr6 )r^ r] rq �order)rL �strr r r r �gen_csrr r r( �dumpsr r r r rX rY rZ �updater\ �_id_map)r^ r@ �organization_idrt Zcert_key_passphraserj ro ri rm rr rs ru rv Zproduct_type_hintrx r> rF rq � encoded_body�qdatard rX re r r r �order_certificate� s� %� �� � � �� r� c s� d}|dkr\t rt�|d�}|jd� fdd�d�}n tj|d�}|�d� �}|d ur\d }tj�t t � d ��}z|� ||�} || d < | | d < W n t yT || d�} Y nw |� ||| � |S )z� Generate and return a private_key. If a ``dns_name`` is passed in, the private_key will be cached under that name. CLI Example: .. code-block:: bash salt-run digicert.gen_key <minion_id> [dns_name] [password] r i Z des_ede3_cbcc s t � �S �N)�bytes)�x�rp r r �<lambda> s zgen_key.<locals>.<lambda>)�cipher�callback)�bitsZPEMNrH rI � private_keyr^ )r� r^ )�HAS_M2r �gen_keyZas_pemZgenerateZ exportKeyr rX rY r r rZ r[ r\ ) r^ �dns_namerp ro Z keygen_type�genr� rd rX re r r� r r� s* � �r� c C s0 t jjjt� � d| � �dddt� dd�d�}|S )z� Return the details for an organization CLI Example: .. code-block:: bash salt-run digicert.get_org_details 34 Returns a dictionary with the org details, or with 'error' and 'status' keys. z/organization/r' Tr( r) r* r- )r r r r r r )r� r� r r r �get_org_details0 s �r� rl c C s� t |�}d|v rtd�||d ���|d �dd�dkr#td�|���t�� }t�|d� d } tj � t t �d ��} | � | |�} | d u rEi } d | vrSt | |||d �| d < |� d�} |� d�} tjj�| d��}|�tjj�| d �� W d � n1 s|w Y d�|d d |d d |d d |d d �}|r�|d|� � }|d|� � }d�|| | |�}td d|�}d|v r�td ��tjj�| d ��}tjj�|�� �}W d � n1 s�w Y | | d < || d < | �| || � |S ) zk CLI Example: .. code-block:: bash salt-run digicert.gen_csr <minion_id> <dns_name> �errorz@Problem getting organization details for organization_id={} ({})r r: ZactiveZinactivez7Organization with organization_id={} is marked inactivei� rH rI Nr� )ro z/privz/csr�wz/C={}/ST={}/L={}/O={}Zcountry�stateZcityZ display_namez/OU=z/CN=z/openssl req -new -{} -key {} -out {} -subj '{}'zsalt.cmdzcmd.runz#problems making Certificate RequestzwThere was a problem generating the CSR. Please ensure that you have a valid Organization established inside CertCentral�rr^ rq )r� r rK r rM ZmkdtemprN �chmodr rX rY r rZ r� r �filesZfopenrO Z stringutilsZto_strZ__salt__r Z to_unicode�readr\ )r^ r� r� rn ro rk rp Z org_detailsZtmpdirrd rX re ZtmpprivZtmpcsrZif_�subjectra �outputZof_rq r r r r| G sf ���� � ��� �r| c C sV d}t j�tt�d��}|�|| �}t|t�sg }||vr"|�|� |� || |� dS )zA Maintain a relationship between a minion and a dns name zdigicert/minionsrI N) r rX rY r r rZ rL �list�appendr\ )r^ r� rd rX ri r r r r � s r c C sl t jjjt� � d| � �ddddt� id�}|d }t|��d�s't|��d�r0td � |d ���|� d i �S ) z� Show organization information, especially the company id CLI Example: .. code-block:: bash salt-run digicert.show_company example.com z/companies/domain/Tr( � tppl-api-key�r: r/ r0 r1 r: �4�5�There was an API error: {}r� r � r r r r r r r{ � startswithr rK r )�domainre r: r r r �show_organization� s � r� c C sh t jjjt� � d�ddddt� id�} | d }t|��d�s%t|��d�r.td � | d ���| � d i �S ) z� Show certificate requests for this API key CLI Example: .. code-block:: bash salt-run digicert.show_csrs z/certificaterequestsTr( r� r� r: r� r� r� r� r r� )re r: r r r � show_csrs� s � r� c C s, t j�tt�d��}d}|�||�}|d S )z� Show a private RSA key CLI Example: .. code-block:: bash salt-run digicert.show_rsa myminion domain.example.com rI rH r� )r rX rY r r rZ )r^ r� rX rd re r r r �show_rsa� s r� c C s t j�tt�d��} | �d�S )z� List domains that have been cached CLI Example: .. code-block:: bash salt-run digicert.list_domain_cache rI rH )r rX rY r r r� )rX r r r �list_domain_cache� s r� c C s� t j�tt�d��}t| t�r| �d�} t| t�s t d��g }g }| D ] }z |� d|� |� |� W q# t y@ |� |� Y q#w ||d�S )z� Delete cached domains from the master CLI Example: .. code-block:: bash salt-run digicert.del_cached_domain domain1.example.com,domain2.example.com rI �,zwYou must pass in either a string containing one or more domains separated by commas, or a list of single domain stringsrH )Z SucceededZFailed) r rX rY r r rL r{ �splitr� r �flushr� )r& rX �successZfailedr� r r r �del_cached_domain� s" � � r� r� )NNNr= N)NT) NNrh NNNNNFNN)NNrh )Nrh rl N)-�__doc__�loggingrN rT rQ rM �collections.abcr Z salt.cacher Zsalt.utils.filesZsalt.utils.httpZsalt.utils.jsonZsalt.exceptionsr r ZM2Cryptor r� � ImportErrorZCryptodome.PublicKeyZCrypto.PublicKeyr � getLogger�__name__�logr r r r% r5 r; r< rf rg r� r� r� r| r r� r� r� r� r� r r r r �<module> s� % ��� � � # �T
| ver. 1.4 |
Github
|
.
| PHP 8.2.30 | Generation time: 0 |
proxy
|
phpinfo
|
Settings