File manager - Edit - /opt/saltstack/salt/lib/python3.10/site-packages/salt/modules/__pycache__/tls.cpython-310.pyc
Back
o ;j� � @ s� d Z ddlZddlZddlZddlZddlZddlZddlZddlmZm Z ddl Z ddl Z ddl Z ddlmZ ddlmZ dZdadZzddlZdZeej�dd ��ZW n ey^ Y nw zdd lmZ dd l m Z m Z dd l m Z dZW n ey� Y nw e�!e"�Z#d Z$dZ%dd� Z&dd� Z'dd� Z(d`dd�Z)d`dd�Z*dd� Z+dd � Z,d d � Z-d`d d �Z.dad"d#�Z/dbd$d%�Z0dbd&d'�Z1d`d(d)�Z2dcd*d+�Z3 ddd-d.�Z4 ddd/d0�Z5d1d2� Z6d3d4� Z7d5d6� Z8ded8d9�Z9d:d;� Z: < = , > ? @ A B dfdCdD�Z;dEdF� Z< < , > ? @ A B G dgdHdI�Z= J < = , > ? @ A B dhdKdL�Z> = B didMdN�Z?djdPdQ�Z@dkdRdS�ZA BdldTdU�ZB BdmdVdW�ZCe"dXk�rue=dYdZd>d?d[dAdd\d]� e?dYdZ� e@dYdZd^d_� dS dS )naX A salt module for SSL/TLS. Can create a Certificate Authority (CA) or use Self-Signed certificates. :depends: PyOpenSSL Python module (0.10 or later, 0.14 or later for X509 extension support) :configuration: Add the following values in /etc/salt/minion for the CA module to function properly: .. code-block:: yaml ca.cert_base_path: '/etc/pki' CLI Example #1: Creating a CA, a server request and its signed certificate: .. code-block:: bash # salt-call tls.create_ca my_little \ days=5 \ CN='My Little CA' \ C=US \ ST=Utah \ L=Salt Lake City \ O=Saltstack \ emailAddress=pleasedontemail@example.com Created Private Key: "/etc/pki/my_little/my_little_ca_cert.key" Created CA "my_little_ca": "/etc/pki/my_little_ca/my_little_ca_cert.crt" # salt-call tls.create_csr my_little CN=www.example.com Created Private Key: "/etc/pki/my_little/certs/www.example.com.key Created CSR for "www.example.com": "/etc/pki/my_little/certs/www.example.com.csr" # salt-call tls.create_ca_signed_cert my_little CN=www.example.com Created Certificate for "www.example.com": /etc/pki/my_little/certs/www.example.com.crt" CLI Example #2: Creating a client request and its signed certificate .. code-block:: bash # salt-call tls.create_csr my_little CN=DBReplica_No.1 cert_type=client Created Private Key: "/etc/pki/my_little/certs//DBReplica_No.1.key" Created CSR for "DBReplica_No.1": "/etc/pki/my_little/certs/DBReplica_No.1.csr" # salt-call tls.create_ca_signed_cert my_little CN=DBReplica_No.1 Created Certificate for "DBReplica_No.1": "/etc/pki/my_little/certs/DBReplica_No.1.crt" CLI Example #3: Creating both a server and client req + cert for the same CN .. code-block:: bash # salt-call tls.create_csr my_little CN=MasterDBReplica_No.2 \ cert_type=client Created Private Key: "/etc/pki/my_little/certs/MasterDBReplica_No.2.key" Created CSR for "DBReplica_No.1": "/etc/pki/my_little/certs/MasterDBReplica_No.2.csr" # salt-call tls.create_ca_signed_cert my_little CN=MasterDBReplica_No.2 Created Certificate for "DBReplica_No.1": "/etc/pki/my_little/certs/DBReplica_No.1.crt" # salt-call tls.create_csr my_little CN=MasterDBReplica_No.2 \ cert_type=server Certificate "MasterDBReplica_No.2" already exists (doh!) # salt-call tls.create_csr my_little CN=MasterDBReplica_No.2 \ cert_type=server type_ext=True Created Private Key: "/etc/pki/my_little/certs/DBReplica_No.1_client.key" Created CSR for "DBReplica_No.1": "/etc/pki/my_little/certs/DBReplica_No.1_client.csr" # salt-call tls.create_ca_signed_cert my_little CN=MasterDBReplica_No.2 Certificate "MasterDBReplica_No.2" already exists (DOH!) # salt-call tls.create_ca_signed_cert my_little CN=MasterDBReplica_No.2 \ cert_type=server type_ext=True Created Certificate for "MasterDBReplica_No.2": "/etc/pki/my_little/certs/MasterDBReplica_No.2_server.crt" CLI Example #4: Create a server req + cert with non-CN filename for the cert .. code-block:: bash # salt-call tls.create_csr my_little CN=www.anothersometh.ing \ cert_type=server type_ext=True Created Private Key: "/etc/pki/my_little/certs/www.anothersometh.ing_server.key" Created CSR for "DBReplica_No.1": "/etc/pki/my_little/certs/www.anothersometh.ing_server.csr" # salt-call tls_create_ca_signed_cert my_little CN=www.anothersometh.ing \ cert_type=server cert_filename="something_completely_different" Created Certificate for "www.anothersometh.ing": /etc/pki/my_little/certs/something_completely_different.crt � N)�datetime� timedelta)�CommandExecutionError)�VersionFT� __version__z0.0)�x509)�hashes� serialization)�pkcs12z %y%m%d%H%M%SZ� %Y%m%d%H%M%SZc C sP t r$ttd�kr$ttd�k rdat�d� dS ttd�kr"t�d� dS dadS ) z@ Only load this module if the ca config options are set z0.10z0.14FzfYou should upgrade pyOpenSSL to at least 0.14.1 to enable the use of X509 extensions in the tls modulez0.15zkYou should upgrade pyOpenSSL to at least 0.15.1 to enable the full use of X509 extensions in the tls moduleT)FzQPyOpenSSL version 0.10 or later must be installed before this module can be used.)�HAS_SSL�OpenSSL_versionr �X509_EXT_ENABLED�log�debug� r r �D/opt/saltstack/salt/lib/python3.10/site-packages/salt/modules/tls.py� __virtual__� s � ��r c C s( t �t�� �\} }t|�}| d�|� �S )zD Return a Unix timestamp as a string of digits :return: �f)�math�modf�time�int)�val1Zval2r r r � _microtime� s r c C s t �| td | ��S )zt Return the value corresponding to the key in __context__ or if not present, fallback to config.option. z config.option)� __context__�get�__salt__)�keyr r r �_context_or_config� s r c C s | p t d�p t d�S )z� Return the base path for certs from CLI or from options cacert_path absolute path to ca certificates root directory CLI Example: .. code-block:: bash salt '*' tls.cert_base_path � ca.contextual_cert_base_pathzca.cert_base_path)r �� cacert_pathr r r �cert_base_path� s ��r# c C s t | �S )z! Retrocompatible wrapper )r# r! r r r �_cert_base_path� s r$ c C s | r| t d< t� S )z� If wanted, store the aforementioned cacert_path in context to be used as the basepath for further operations CLI Example: .. code-block:: bash salt '*' tls.set_ca_path /etc/certs r )r r# r! r r r � set_ca_path� s r% c C s� t t�d�tjj�t� �t � d�f��d�}t � d|� t d }t � d|� |� d| � d�}t j�|�s9t �|� t j�|�sBd }nd }tjj�||��}|�t|�� W d � |S 1 s_w Y |S ) z� Return a serial number in hex using os.urandom() and a Unix timestamp in microseconds. ca_name name of the CA CN common name in the request � _� � z Hashnum: %s�cachedirz cachedir: %s�/z.serial�w�a+N)r �binascii�hexlify�join�salt�utils� stringutils�to_bytesr �os�urandomr r Z__opts__�path�exists�makedirs�files�fopen�write�str)�ca_nameZhashnumr) Z serial_file�mode�ofiler r r � _new_serial� s2 ���� ��r@ c C s | � t�S �N)�strftime�two_digit_year_fmt)Z datetimeObjr r r � _four_digit_year_to_two_digit s rD c C s| |du r t � � d| � �}|� d�}t|�}tt|��}t|�� d�}d}|d�dd� |�� �� D ��7 }|d7 }||||fS )z6 Get basic info to write out to the index.txt Nr* � /index.txt�Xc S s g | ] \}}|� d |� ��qS )�=r )�.0�x�yr r r � <listcomp>( s z#_get_basic_info.<locals>.<listcomp>� ) r$ � _read_certrD �_get_expiration_date�format�get_serial_numberr/ � get_subject�get_components)r= �cert�ca_dir� index_file� expire_date� serial_number�subjectr r r �_get_basic_info s rY �Vc C s� t |� t� � d| � �}t| ||�\}}}}d�||||�} tjj�|d��} | �tjj � | �� W d � dS 1 s<w Y dS )z� write out the index.txt database file in the appropriate directory to track certificates ca_name name of the CA cert certificate to be recorded r* z{} {} {} unknown {}r, N) r% r# rY rO r0 r1 r9 r: r; r2 �to_str) r= rS r" �statusrT rU rV rW rX Z index_datar? r r r �_write_cert_to_database. s ��"�r] c C s� t |� |s | � d�}t� � d| � d|� d�}t� � d| � d|� d�}tjj�|���}tj�tjj |� � �}|� � dkr�t � d|� tjj�|��\}ztj�tjj |� � �}|�� } W n tyf d} Y nw zt�|�� d�t�� j} W n ttfy� d } Y nw |�� } t| | | | j| j| j | j | j | j | j d d � W d � n1 s�w Y W d � d S W d � d S W d � d S 1 s�w Y d S ) a� Check that the X509 version is correct (was incorrectly set in previous salt versions). This will fix the version if needed. ca_name ca authority name cacert_path absolute path to ca certificates root directory ca_filename alternative filename for the CA .. versionadded:: 2015.5.3 CLI Example: .. code-block:: bash salt '*' tls.maybe_fix_ssl_version test_ca /etc/certs �_ca_certr* �.crt�.key� z2Regenerating wrong x509 version for certificate %s� r �m T) �bits�days�CN�C�ST�L�O�OU� emailAddress�fixmodeN)!r% r# r0 r1 r9 r: �OpenSSL�crypto�load_certificate� FILETYPE_PEM�readZ get_versionr �info�load_privatekeyrd � Exceptionr �strptime� get_notAfter�utcnowre � ValueError� TypeErrorrQ � create_carf rg rh ri rj rk rl ) r= r" � ca_filename�certp�ca_keyp�ficrS �fic2r rd re Zsubjr r r �maybe_fix_ssl_versionF s^ � ����� ���"�r� c C sP t |� |s | � d�}t� � d| � d|� d�}tj�|�r&t| ||d� dS dS )ak Verify whether a Certificate Authority (CA) already exists ca_name name of the CA cacert_path absolute path to ca certificates root directory ca_filename alternative filename for the CA .. versionadded:: 2015.5.3 CLI Example: .. code-block:: bash salt '*' tls.ca_exists test_ca /etc/certs r^ r* r_ �r" r| TF)r% r# r4 r6 r7 r� )r= r" r| r} r r r � ca_exists� s r� c C s t | |�S )zRetrocompatible wrapper)r� )r= r" r r r � _ca_exists� s r� c C sz t |� d�t� | �}tj�|�std| � ���|r;tjj � |��}tjj � |� � �}W d � |S 1 s6w Y |S )a_ Get the certificate path or content ca_name name of the CA as_text if true, return the certificate content instead of the path cacert_path absolute path to ca certificates root directory CLI Example: .. code-block:: bash salt '*' tls.get_ca test_ca as_text=False cacert_path=/etc/certs �{0}/{1}/{1}_ca_cert.crtz Certificate does not exist for N)r% rO r# r4 r6 r7 ry r0 r1 r9 r: r2 � to_unicoderr )r= �as_textr" r} r r r r �get_ca� s ��r� � localhostc C � t |� |s|}t� � d| � d|� d�}tj�|�s!td|� ���|rDtjj� |��}tjj � |� � �}W d � |S 1 s?w Y |S )a: Get the certificate path or content ca_name name of the CA CN common name of the certificate as_text if true, return the certificate content instead of the path cacert_path absolute path to certificates root directory cert_filename alternative filename for the certificate, useful when using special characters in the CN .. versionadded:: 2015.5.3 CLI Example: .. code-block:: bash salt '*' tls.get_ca_signed_cert test_ca CN=localhost as_text=False cacert_path=/etc/certs r* �/certs/r_ � Certificate does not exists for N� r% r# r4 r6 r7 ry r0 r1 r9 r: r2 r� rr )r= rf r� r" � cert_filenamer} r r r r �get_ca_signed_cert� s ��r� c C r� )ai Get the certificate path or content ca_name name of the CA CN common name of the certificate as_text if true, return the certificate content instead of the path cacert_path absolute path to certificates root directory key_filename alternative filename for the key, useful when using special characters .. versionadded:: 2015.5.3 in the CN CLI Example: .. code-block:: bash salt '*' tls.get_ca_signed_key test_ca CN=localhost as_text=False cacert_path=/etc/certs r* r� r` r� Nr� )r= rf r� r" Z key_filenameZkeypr r r r �get_ca_signed_key� s ��r� c C s� t | t�r<z&tjj�| ��}tj�tjj |� � �W d � W S 1 s$w Y W d S t y; t � d| � Y d S w t| d�sIt �d| � d S | S )Nz Failed to read cert from path %srw z"%s is not a valid cert path/object)� isinstancer< r0 r1 r9 r: rn ro rp rq rr ru r � exception�hasattr�error)rS Zrfhr r r rM s �(� � rM c C s� t j�� }t| �}|du rtd| � d���t� � d|� �}t|� d|� d��}|�|� t jj}|�|j |j B � |du �r/t �r)|� d|� d�}z�t j j�|d��} tj| �� dd�} W d � n1 sfw Y t�t j�t jj|��} t�� } | �| j�} | �t� � �} | � t� � t d d � �} |� d �} t j �!| �r�t j j�| ��P}|D ]E}t j j"�#|�}|�$d �r�|�%d �}t&|d d�}|�'� dkr�|dd> d @ }t�(|d t)�}t�*� }|�+|�}|�,|�}| �-|�.� �} q�W d � n1 s�w Y | j/| t0�1� d�}W nm t2t3f�y( } zt4�5d|� ddd�W Y d}~S d}~ww t j�6� }nGt �rSt j j�|d��} t�7| �� �}W d � n 1 �sMw Y n#t j j�|��} t j�8t jj| �� �}W d � n 1 �sqw Y |�9|� t �r�t�t j�t jj|��}|j+}|�'� dk�r�|dd> d @ }|�:|��r�dd|d�S t j�;||�}i }z |�<� d|d < W |S t jj=�y� } zt>|�|d < |j?|d < d|d < W Y d}~|S d}~ww ) z� .. versionadded:: 3000 Validate a certificate against a given CA/CRL. cert path to the certifiate PEM file or string ca_name name of the CA crl_file full path to the CRL file N�Failed to read cert from �, see log for detailsr* z _ca_cert.crtz _ca_cert.key�rb��password锎 �re rE �R� ra r( � � � � �Z private_key� algorithmz Could not create empty CRL: %sFz1Empty CRL requested but CA key missing or invalid)�validr� zcertificate revoked)r� r� � error_certTr� r� r� )@rn ro Z X509StorerM r r# Zadd_cert�X509StoreFlagsZ set_flagsZ CRL_CHECKZ CRL_CHECK_ALL�HAS_CRYPTOGRAPHYr0 r1 r9 r: r �load_pem_private_keyrr r �load_pem_x509_certificate�dump_certificaterq � CertificateRevocationListBuilder� issuer_namerX � last_updater rx � next_updater r4 r6 r7 r2 r� � startswith�splitr � bit_lengthrv rC �RevokedCertificateBuilderrW �revocation_date�add_revoked_certificate�build�signr �SHA256�OSErrorry r �warning�CRLZload_pem_x509_crlZload_crlZadd_crlZ(get_revoked_certificate_by_serial_numberZX509StoreContextZverify_certificateZX509StoreContextErrorr< Z certificate)rS r= �crl_file�store�cert_objrT �ca_certr� r~ �fhr�ca_key�ca_x509�builderrU �fp_�line�fields�serialr� �revoked_builder�crl�eZ cert_x509Zserial_to_check�context�retr r r �validate' s� � � ��� � ���� � ��� �� � � � � ��r� c C s: t | �}|du rtd| � d���t�tjj�|�� �t �S )z, Returns a datetime.datetime object Nr� r� ) rM r r rv r0 r1 r2 r[ rw �four_digit_year_fmt)rS r� r r r rN � s ��rN �%Y-%m-%dc C s t | ��|�S )a .. versionadded:: 2019.2.0 Get a certificate's expiration date cert Full path to the certificate date_format By default this will return the expiration date in YYYY-MM-DD format, use this to specify a different strftime format string. Note that the expiration time will be in UTC. CLI Examples: .. code-block:: bash salt '*' tls.get_expiration_date /path/to/foo.crt salt '*' tls.get_expiration_date /path/to/foo.crt date_format='%d/%m/%Y' )rN rB )rS Z date_formatr r r �get_expiration_date� s r� c C s� d }t d }| d ur,t| t�s| sddd�}nt| t�r,|| �dkr,ddd�}t�d� |d urSt|t�s>|r<ddd�}|S t|t�rS||�dkrSddd�}t�d� |S )Nz cmd.retcodezonlyif condition is falseT)�comment�resultr zunless condition is true)r r� r< r r )�onlyif�unlessr� �retcoder r r �_check_onlyif_unless� s* � � r� rb rc �US�Utah�Salt Lake City� SaltStack�sha256c " C s� t ||�}|dur dS t| � | s| � d�} t� � d| � d| � d�}t� � d| � d| � d�}|s>| s>t| | d�r>d| � d�S | rMtj�|�sMt|� d ���tj�t� � d| � ��sdt�t� � d| � �� d}tj�|�r�t j j � |��H}z t j�t jj|�� �}W n2 t jjy� } z$t�d ||� d �|t�� �d ��}t�d |� t�||� W Y d}~nd}~ww W d � n1 s�w Y |s�t j�� }|� t jj |� t j� � }|� d� |� t!| �� ||�"� _#||�"� _$||�"� _%||�"� _&|r�||�"� _'||�"� _(| �r | |�"� _)|�*d� |�+t,|�d d d � |�-|�"� � |�.|� t/�rV|�0t j�1ddd�t j�1ddd�t jj1ddd|d�g� |�0t jj1ddd |d �g� |�2|t j j3�4| �� t j�5t jj|�}d}tj�|��r�d �|t�� �d ��}t j j � |��N}t j j3�6|�� ��7� } | �7� |�7� k�r�d}n/t�d |� t�8|tj9tj:B d �} t j j � | d!�� } | �;| � W d � n 1 �s�w Y W d � n 1 �s�w Y |�r t�8|tj9tj:B d �} t j j � | d"��} | �;t j j3�<|�� W d � n 1 �sw Y t�8|tj9tj:B d#�} t j j � | d"��} | �;t j j3�<t j�=t jj|��� W d � n 1 �s=w Y t>| |� d$�t� | | �}!|!d%�| t� | �7 }!|!S )&a} Create a Certificate Authority (CA) ca_name name of the CA bits number of RSA key bits, default is 2048 days number of days the CA will be valid, default is 365 CN common name in the request, default is "localhost" C country, default is "US" ST state, default is "Utah" L locality, default is "Centerville", the city where SaltStack originated O organization, default is "SaltStack" OU organizational unit, default is None emailAddress email address for the CA owner, default is None cacert_path absolute path to ca certificates root directory ca_filename alternative filename for the CA .. versionadded:: 2015.5.3 digest The message digest algorithm. Must be a string describing a digest algorithm supported by OpenSSL (by EVP_get_digestbyname, specifically). For example, "md5" or "sha1". Default: 'sha256' replace Replace this certificate even if it exists .. versionadded:: 2015.5.1 Writes out a CA certificate based upon defined config values. If the file already exists, the function just returns assuming the CA certificate already exists. If the following values were set:: ca.cert_base_path='/etc/pki' ca_name='koji' the resulting CA, and corresponding key, would be written in the following location with appropriate permissions:: /etc/pki/koji/koji_ca_cert.crt /etc/pki/koji/koji_ca_cert.key CLI Example: .. code-block:: bash salt '*' tls.create_ca test_ca Nr^ r* r_ r` �r| zCertificate for CA named "�" already existsz does not exists, can't fixz?Error loading existing private key %s, generating a new key: %sz{}.unloadable.{}z %Y%m%d%H%M%Sz"Saving unloadable CA ssl key in %sr� r � �< s basicConstraintsTs CA:TRUE, pathlen:0s keyUsages keyCertSign, cRLSigns subjectKeyIdentifierFs hash)rX s authorityKeyIdentifiers issuer:always,keyid:always)�issuerz{}.{}zSaving old CA ssl key in %s� r+ �wb� z$Created Private Key: "{}/{}/{}.key" z#Created CA "{0}": "{1}/{0}/{2}.crt")?r� r% r# r� r4 r6 r7 ry r8 r0 r1 r9 r: rn ro rt rq rr �Errorr r� rO r rx rB rs �rename�PKey� generate_key�TYPE_RSA�X509� set_version�set_serial_numberr@ rQ rg rh ri rj rk rf rl �gmtime_adj_notBefore�gmtime_adj_notAfterr � set_issuer� set_pubkeyr �add_extensions� X509Extensionr� r2 r[ �dump_privatekeyr� �strip�open�O_CREAT�O_RDWRr; r3 r� r] )"r= rd re rf rg rh ri rj rk rl rm r" r| �digestr� r� �replacer\ r} r~ r r� �errZbck�caZ keycontentZ write_keyr Zold_key�fpZbckfr� Zca_crtr� r r r r{ � s� O ��� ��� � �������� �� � ��� � ��r{ c C s� t s J d�t���i }| dkrt�d� d} z td dd�|d< W n ty8 } z t�|� W Y d }~nd }~ww |d rC|d dkrOd d id d d�d�|d< z td dd�|d< W n tyq } z t�|� W Y d }~nd }~ww |d r||d dkr�ddd�i d�|d< z td dd�|d< W n ty� } z t�|� W Y d }~nd }~ww |d r�|d dkr�ddd�i d�|d< | |vr�z td d| � ��|| < W n ty� } z t�d| |� W Y d }~nd }~ww |d }|D ] }|| �|| | � q�|S )aO Fetch X509 and CSR extension definitions from tls:extensions: (common|server|client) or set them to standard defaults. .. versionadded:: 2015.8.0 cert_type: The type of certificate such as ``server`` or ``client``. CLI Example: .. code-block:: bash salt '*' tls.get_extensions client zXX509 extensions are not supported in pyOpenSSL prior to version 0.15.1. Your version: {}� zKcert_type set to empty in tls_ca.get_extensions(); defaulting to ``server``�serverz pillar.getztls.extensions:commonF�commonNZbasicConstraintszCA:FALSEzkeyid,issuer:always�hash)ZauthorityKeyIdentifierZsubjectKeyIdentifier)�csrrS ztls.extensions:serverZ serverAuthz!digitalSignature, keyEncipherment)ZextendedKeyUsageZkeyUsageztls.extensions:client�clientZ clientAuthz1nonRepudiation, digitalSignature, keyEnciphermentztls.extensions:zMpillar, tls:extensions:%s not available or not operating in a salt context %s) r rO r r r� r � NameErrorr �update)� cert_type�extr� r� �retvalZUser r r �get_extensions� sz ����� ���� ���� � ���r r� c C sF t | � | s | � d�} t| | d�sd�| �S | s!t� � d| � d�} tj�| �s,t�| � |r3d|� �nd}| s=|� |� �} | � d| � d�}|sStj�|�rSd |� d �S tj � � }|� tj j |� tj � � }||�� _||�� _||�� _||�� _|r�||�� _||�� _|r�||�� _z/t|�d }g }|�� D ] \}}t|t�r�tjj � |�}|� tj � tjj � |�d |�� q�W n t y� } z t!�"|� g }W Y d }~nd }~ww | r�t#r�t| t�r�| g} |� tj � dd d�$tjj%�&| ���� nt'd�t(���t#�r|�)|� |�*|� |�+|tjj �,|�� | � d| � d�}t�-|tj.tj/B d�} tjj0�1| d��} | �2tjj � tj �3tj j4|��� W d � n 1 �sLw Y t�-|tj.tj/B d�} tjj0�1| d��} | �2tjj � tj �5tj j4|��� W d � n 1 �s�w Y dtj�$| | �� d�} | d|� dtj�$| | �� d�7 } | S )aI Create a Certificate Signing Request (CSR) for a particular Certificate Authority (CA) ca_name name of the CA bits number of RSA key bits, default is 2048 CN common name in the request, default is "localhost" C country, default is "US" ST state, default is "Utah" L locality, default is "Centerville", the city where SaltStack originated O organization, default is "SaltStack" NOTE: Must the same as CA certificate or an error will be raised OU organizational unit, default is None emailAddress email address for the request, default is None subjectAltName valid subjectAltNames in full form, e.g. to add DNS entry you would call this function with this value: examples: ['DNS:somednsname.com', 'DNS:1.2.3.4', 'IP:1.2.3.4', 'IP:2001:4801:7821:77:be76:4eff:fe11:e51', 'email:me@i.like.pie.com'] .. note:: some libraries do not properly query IP: prefixes, instead looking for the given req. source with a DNS: prefix. To be thorough, you may want to include both DNS: and IP: entries if you are using subjectAltNames for destinations for your TLS connections. e.g.: requests to https://1.2.3.4 will fail from python's requests library w/out the second entry in the above list .. versionadded:: 2015.8.0 cert_type Specify the general certificate type. Can be either `server` or `client`. Indicates the set of common extensions added to the CSR. .. code-block:: cfg server: { 'basicConstraints': 'CA:FALSE', 'extendedKeyUsage': 'serverAuth', 'keyUsage': 'digitalSignature, keyEncipherment' } client: { 'basicConstraints': 'CA:FALSE', 'extendedKeyUsage': 'clientAuth', 'keyUsage': 'nonRepudiation, digitalSignature, keyEncipherment' } type_ext boolean. Whether or not to extend the filename with CN_[cert_type] This can be useful if a server and client certificate are needed for the same CN. Defaults to False to avoid introducing an unexpected file naming pattern The files normally named some_subject_CN.csr and some_subject_CN.key will then be saved replace Replace this signing request even if it exists .. versionadded:: 2015.5.1 Writes out a Certificate Signing Request (CSR) If the file already exists, the function just returns assuming the CSR already exists. If the following values were set:: ca.cert_base_path='/etc/pki' ca_name='koji' CN='test.egavas.org' the resulting CSR, and corresponding key, would be written in the following location with appropriate permissions:: /etc/pki/koji/certs/test.egavas.org.csr /etc/pki/koji/certs/test.egavas.org.key CLI Example: .. code-block:: bash salt '*' tls.create_csr test r^ r� zECertificate for CA named "{}" does not exist, please create it first.r* r� �_r� �.csrzCertificate Request "r� r� FNs subjectAltNames , zysubjectAltName cannot be set as X509 extensions are not supported in pyOpenSSL prior to version 0.15.1. Your version: {}.r` r� �wb+r� zCreated Private Key: "z.key" zCreated CSR for "z": "z.csr")6r% r� rO r# r4 r6 r7 r8 rn ro r� r� r� ZX509ReqrQ rg rh ri rj rk rf rl r �itemsr� r< r0 r1 r2 r3 �appendr� �AssertionErrorr r� r r/ �data�encodery r r� r� r� r[ r� r� r� r9 r: r; r� rq Zdump_certificate_request) r= rd rf rg rh ri rj rk rl �subjectAltNamer" r| �csr_path� csr_filenamer� �type_extr r� �CN_extZcsr_fr �req� extensionsZextension_addsr �valuer� Z priv_keypr� �priv_keyr� r� r r r � create_csr s� u � ��� �� ��� �� ���� � r �tlsc C sz t | � tj�t� � d| � d��s t�t� � d| � d�� | s!|} | s9tj�t� � d| � d| � d��r9d| � d�S tj�� }|� tjj |� tj� � }|� d� |� d� |�t|�d d d � ||�� _||�� _||�� _||�� _|r}||�� _||�� _| r�| |�� _|�t| �� |�|�� � |�|� |� |t j j � | �� d �!t� | | �}t�"|tj#tj$B d �}t j j%�&|d ��}|�'t j j �(tj�)tjj*|��� W d � n1 s�w Y t� � d| � d| � d�}t�"|tj#tj$B d�}t j j%�&|d ��}|�'t j j �(tj�+tjj*|��� W d � n 1 �s w Y t,| |� d�!t� | | �}|d�!t� | | �7 }|S )a� Create a Self-Signed Certificate (CERT) tls_dir location appended to the ca.cert_base_path, default is 'tls' bits number of RSA key bits, default is 2048 CN common name in the request, default is "localhost" C country, default is "US" ST state, default is "Utah" L locality, default is "Centerville", the city where SaltStack originated O organization, default is "SaltStack" NOTE: Must the same as CA certificate or an error will be raised OU organizational unit, default is None emailAddress email address for the request, default is None cacert_path absolute path to ca certificates root directory digest The message digest algorithm. Must be a string describing a digest algorithm supported by OpenSSL (by EVP_get_digestbyname, specifically). For example, "md5" or "sha1". Default: 'sha256' replace Replace this certificate even if it exists .. versionadded:: 2015.5.1 Writes out a Self-Signed Certificate (CERT). If the file already exists, the function just returns. If the following values were set:: ca.cert_base_path='/etc/pki' tls_dir='koji' CN='test.egavas.org' the resulting CERT, and corresponding key, would be written in the following location with appropriate permissions:: /etc/pki/koji/certs/test.egavas.org.crt /etc/pki/koji/certs/test.egavas.org.key CLI Example: .. code-block:: bash salt '*' tls.create_self_signed_cert Passing options from the command line: .. code-block:: bash salt 'minion' tls.create_self_signed_cert CN='test.mysite.org' r* r� r_ � Certificate "r� r� r r� r� z{}/{}/certs/{}.keyr� r Nr� z*Created Private Key: "{}/{}/certs/{}.key" z)Created Certificate: "{}/{}/certs/{}.crt")-r% r4 r6 r7 r# r8 rn ro r� r� r� r� r� r� r� r rQ rg rh ri rj rk rf rl r� r@ r� r� r� r0 r1 r2 r[ rO r� r� r� r9 r: r; r3 r� rq r� r] )Ztls_dirrd re rf rg rh ri rj rk rl r" r� r� r� r rS Z priv_key_pathr� r Zcrt_path�crtr� r r r �create_self_signed_cert� sp L � ��� ��� � ��r c C s i } t |� |s | � d�}|st� � d| � d�}| r+|s#t�d� | S |r*d|� �} nd} |� | � �} |s;|� | � �}| s[tj�tj�tjj�d� t� | |�� d����r[d|� d �S zat | ||d � t j j�t� � d| � d|� d ���}tj�tjj|�� �}W d � n1 s�w Y t j j�t� � d| � d|� d ���}tj�tjj|�� �}W d � n1 s�w Y W n ty� d| d< d| � d�| d< | Y S w z,|� d| � d�}t j j�|��}tj�tjj|�� �}W d � n1 s�w Y W n t�y d| d< d� |�| d< | Y S w g }z |�|�� � W nO t�yr z4t�dt � tj j � |j �}t!tj j �"|��D ]}tjj#�$tjj#�}tj j �%||�|_&|�'|� �qCW n t(�yo t�dt � Y nw Y nw tj�)� }|�*d� |�+|�,� � |�-d� |�.t/|�d d d � |�0t1| �� |�2|�,� � |�3|�4� � |�5|� |�6|t j j7�8|�� |� d|� d �}t�9|tj:tj;B d�}t j j�|d ��}|�<t j j7�=tj�>tjj|��� W d � n 1 �s�w Y t?| |� d � |||�S ) a Create a Certificate (CERT) signed by a named Certificate Authority (CA) If the certificate file already exists, the function just returns assuming the CERT already exists. The CN *must* match an existing CSR generated by create_csr. If it does not, this method does nothing. ca_name name of the CA CN common name matching the certificate signing request days number of days certificate is valid, default is 365 (1 year) cacert_path absolute path to ca certificates root directory ca_filename alternative filename for the CA .. versionadded:: 2015.5.3 cert_path full path to the certificates directory cert_filename alternative filename for the certificate, useful when using special characters in the CN. If this option is set it will override the certificate filename output effects of ``cert_type``. ``type_ext`` will be completely overridden. .. versionadded:: 2015.5.3 digest The message digest algorithm. Must be a string describing a digest algorithm supported by OpenSSL (by EVP_get_digestbyname, specifically). For example, "md5" or "sha1". Default: 'sha256' replace Replace this certificate even if it exists .. versionadded:: 2015.5.1 cert_type string. Either 'server' or 'client' (see create_csr() for details). If create_csr(type_ext=True) this function **must** be called with the same cert_type so it can find the CSR file. .. note:: create_csr() defaults to cert_type='server'; therefore, if it was also called with type_ext, cert_type becomes a required argument for create_ca_signed_cert() type_ext bool. If set True, use ``cert_type`` as an extension to the CN when formatting the filename. e.g.: some_subject_CN_server.crt or some_subject_CN_client.crt This facilitates the context where both types are required for the same subject If ``cert_filename`` is `not None`, setting ``type_ext`` has no effect If the following values were set: .. code-block:: text ca.cert_base_path='/etc/pki' ca_name='koji' CN='test.egavas.org' the resulting signed certificate would be written in the following location: .. code-block:: text /etc/pki/koji/certs/test.egavas.org.crt CLI Example: .. code-block:: bash salt '*' tls.create_ca_signed_cert test localhost r^ r* �/certsz@type_ext = True but cert_type is unset. Certificate not written.r r� z{}/{}/certs/{}.crtr r� r� r_ Nr` r� r� �There is no CA named "�"r� r z(There is no CSR that matches the CN "{}"zzreq.get_extensions() not supported in pyOpenSSL versions prior to 0.15. Processing extensions internally. Your version: %sz|X509 extensions are unsupported in pyOpenSSL versions prior to 0.14. Upgrade required to use extensions. Current version: %sr� r r� r� r� r z)Created Certificate for "{}": "{}/{}.crt")@r% r# r r� r4 r6 r7 r/ �seprO r� r� r0 r1 r9 r: rn ro rp rq rr rt r� Zload_certificate_request�extendr �AttributeErrorrs r Z_util�libZX509_REQ_get_extensionsZ_req�rangeZsk_X509_EXTENSION_numr� �__new__Zsk_X509_EXTENSION_valueZ _extensionr ru r� r� Z set_subjectrQ r� r� r r� r@ r� r� Z get_pubkeyr� r� r2 r[ r� r� r� r; r3 r� r] )r= rf re r" r| � cert_pathr� r� r r r� r� r r r� r� r� r r ZextsZnative_exts_obj�ir rS Zcert_full_pathr� r r r r �create_ca_signed_cert� s� g � � ���� � � �� � �� � � ����������� �� � �r( r� c C s& t |� |s tj�t� � d| � d|� d��r d|� d�S z)tjj�d� t� | ���}t j � t j j |�� �}W d � n1 s?w Y W n tyT d| � d � Y S w zZtjj�t� � d| � d|� d ���}t j � t j j |�� �}W d � n1 s}w Y tjj�t� � d| � d|� d ���}t j �t j j |�� �}W d � n1 s�w Y W n ty� d |� d � Y S w tjtjj�|�|�� |�� |�� g|r�t�tjj�|��nt�� d �} tjj�t� � d| � d|� d�d�� } | �| � W d � n 1 �sw Y d� |t� | �S )a' Create a PKCS#12 browser certificate for a particular Certificate (CN) ca_name name of the CA CN common name matching the certificate signing request passphrase used to unlock the PKCS#12 certificate when loaded into the browser cacert_path absolute path to ca certificates root directory replace Replace this certificate even if it exists .. versionadded:: 2015.5.1 If the following values were set:: ca.cert_base_path='/etc/pki' ca_name='koji' CN='test.egavas.org' the resulting signed certificate would be written in the following location:: /etc/pki/koji/certs/test.egavas.org.p12 CLI Example: .. code-block:: bash salt '*' tls.create_pkcs12 test localhost r* r� z.p12r r� r� Nr r r_ r` z-There is no certificate that matches the CN ")�namer rS ZcasZencryption_algorithmr� z>Created PKCS#12 Certificate for "{0}": "{1}/{2}/certs/{0}.p12")r% r4 r6 r7 r# r0 r1 r9 r: rO rn ro rp rq rr r� rt r Z serialize_key_and_certificatesr2 r3 Zto_cryptography_keyZto_cryptographyr ZBestAvailableEncryptionZ NoEncryptionr; ) r= rf � passphraser" r� r� r� rS r Zp12_datar? r r r � create_pkcs12j sv "$ � � �� �� � �� � �� � � ��� ��r+ c C s� d}d| vr!t jj�| �� }|�� } W d � n1 s w Y tj�tjj| �} i }| � � � � D ] \}}t |t �rBt jj �|�}t |t �rNt jj �|�}|||< q2i }| �� � � D ] \}}t |t �rkt jj �|�}t |t �rwt jj �|�}|||< q[t jj �| �t jj �|���||| �� t�t�t| �� �t��|��t�t�| �� �t�|��d�}t | d�r�i |d< t | � � �D ]%} z| � | �} t jj �| � � �}t| ��!� |d |< W q� t"y� Y q�w d|�#di �v �r%d} t$� } t|d d ��%d �D ]"} | �%d d �\}} || v�rt&�'d |d | d�(| �� q�| �)| � q�t*| �|d< t | d��rOz| �+� }t |t ��r=t jj �|�}||d< W |S t"�yN Y |S w |S )a: Return information for a particular certificate cert path to the certifiate PEM file or string .. versionchanged:: 2018.3.4 digest what digest to use for fingerprinting CLI Example: .. code-block:: bash salt '*' tls.cert_info /dir/for/certs/cert.pem r z -----BEGINN)Z fingerprintrX r� rW Z not_beforeZ not_after�get_extension_countr r )�DNSz IP Addressz, �:r� z6Cert %s has an entry (%s) which does not start with %srX r* Zsubject_alt_names�get_signature_algorithmZsignature_algorithm),r0 r1 r9 r: rr rn ro rp rq Z get_issuerrR r� �bytesr2 r� rQ r� r[ rP �calendar�timegmr rv r< Z get_notBefore�decodeZ__salt_system_encoding__rw r� r$ r, Z get_extensionZget_short_namer� r" r �setr� r r� r/ �add�listr/ )rS r� Zdate_fmt� cert_filer� r r rX r� r' r Z valid_entriesZ valid_namesr) �entryr r r � cert_info� s� � ������ � � ��r9 c C s� t |� |s | � d�}|st� � d| � d�}tj�|� �r#d|� d�S zZtjj�t � � d| � d|� d���}t j � t j j |�� �}W d � n1 sKw Y tjj�t � � d| � d|� d���}t j �t j j |�� �}W d � n1 sww Y W n ty� d | � d � Y S w t�rtjj�t � � d| � d|� d�d ��}t�|�� �}W d � n1 s�w Y tjj�t � � d| � d|� d�d ��}tj|�� dd �}W d � n1 s�w Y t�� } | �|j�} | �t�� �} | � t�� t d d� �} t t |� � t j!�� } | j"|| d�} | �#tj$j%�} nt j �&� } | j'||tjj(�)|�d�} tjj�|d��}|�*tjj(�+| �� W d � n 1 �sJw Y d|� d �S )a� Create an empty Certificate Revocation List. .. versionadded:: 2015.8.0 ca_name name of the CA cacert_path absolute path to ca certificates root directory ca_filename alternative filename for the CA .. versionadded:: 2015.5.3 crl_file full path to the CRL file digest The message digest algorithm. Must be a string describing a digest algorithm supported by OpenSSL (by EVP_get_digestbyname, specifically). For example, "md5" or "sha1". Default: 'sha256' CLI Example: .. code-block:: bash salt '*' tls.create_empty_crl ca_name='koji' ca_filename='ca' crl_file='/etc/openvpn/team1/crl.pem' r^ r* �/crl.pemzCRL "r� r_ Nr` r r r� r� r� r� r� �r� r+ zCreated an empty CRL: "),r% r$ r4 r6 r7 r0 r1 r9 r: r# rn ro rp rq rr rt r� r� r r� r r� r� r� rX r� r rx r� r �getattrr �upperr� r� � public_bytes�Encoding�PEMr� �exportr2 r3 r; r[ )r= r" r| r� r� r� r� r� r� r� � hash_algo�crl_obj�crl_textr� r r r r �create_empty_crl* st " � � �� � �� �� �� � � � rE c $ C s t |� t� � d| � �}|du r| � d�}|du r"t� � d| � d�}|du r)|� }zZtjj�t� � d| � d|� d���} tj� tjj | � � �} W d � n1 sQw Y tjj�t� � d| � d|� d���} tj� tjj | � � �} W d � n1 s}w Y W n t y� d| � d� Y S w t|� d|� d��} | du r�d |� d�S t| | |�\} }}}|� d |� �}d |� d |� �}t�d | d t�|� �}d�|tt�� �|�}i }tjj�| ��k} | D ]`}tjj�|�}|�|��r4|�d�d }zt�|t � d�|||�W W d � S t �y3 d|d< d�|t �|d< | Y W d � S w ||v �rEt d | ||dd� nq�W d � n 1 �sQw Y t �rHtjj�t� � d| � d|� d�d��} t �!| � � �}W d � n 1 �s~w Y tjj�t� � d| � d|� d�d��} t"j#| � � dd�} W d � n 1 �s�w Y t �$� }|�%|j&�}|�'t�� �}|�(t�� t)d d � �}tjj�| ��S} | D ]H}tjj�|�}|�*d ��r |�d�}t+|d d �}|�,� d!k�r |dd"> d @ }t�|d t �} t �-� } | �.|�} | �/| �} |�0| �1� �}�q�W d � n 1 �s*w Y t2t3|�4� t3j5�� } |j6| | d#�} | �7t"j8j9�} nmtj�:� }!tjj�| ��K} | D ]@}tjj�|�}|�*d ��r�|�d�}tj�;� }"|"�<tjj�=|d �� t�|d t �}#|"�>tjj�=|#�?t@��� |!�A|"� �qWW d � n 1 �s�w Y |!jB| | tjj�=|�d$�} |du �r�t� � d| � d%�}tCjD�E|��r�d|d< d&|� d'�|d< |S tjj�|d(��} | �Ftjj�G| �� W d � n 1 �s�w Y d)�|||�S )*a� Revoke a certificate. .. versionadded:: 2015.8.0 ca_name Name of the CA. CN Common name matching the certificate signing request. cacert_path Absolute path to ca certificates root directory. ca_filename Alternative filename for the CA. cert_path Path to the cert file. cert_filename Alternative filename for the certificate, useful when using special characters in the CN. crl_file Full path to the CRL file. digest The message digest algorithm. Must be a string describing a digest algorithm supported by OpenSSL (by EVP_get_digestbyname, specifically). For example, "md5" or "sha1". Default: 'sha256' CLI Example: .. code-block:: bash salt '*' tls.revoke_cert ca_name='koji' ca_filename='ca' crl_file='/etc/openvpn/team1/crl.pem' r* Nr^ r r_ r` r r z&There is no client certificate named "z unknown zV z zR\tz \t\d{12}Z\tz R {} {} {}r� r� z2"{}/{}.crt" was already revoked, serial number: {}r� r� z.Revocation date '{}' does not matchformat '{}'r� z file.replaceF)Zbackupr� r� r� r� r� ra r( r� r� r� r; r: z crl_file "z" is an existing directoryr+ z3Revoked Certificate: "{}/{}.crt", serial number: {})Hr% r# r$ r0 r1 r9 r: rn ro rp rq rr rt r� rM rY �re�compile�escaperO rD r rx r2 r� �matchr� rv rC ry r r� r r� r r� r� r� rX r� r� r r� r r� r� rW r� r� r� r< r r= r� r� r> r? r@ r� ZRevokedZ set_serialr3 Z set_rev_daterB r� Z add_revokedrA r4 r6 �isdirr; r[ )$r= rf r" r| r& r� r� r� rT r� r� r� Z client_certrU rV rW rX Zindex_serial_subjectZ index_v_dataZindex_r_data_patternZ index_r_datar� r� Z revoke_dater� r� r� r� r� r� rB rC rD r� ZrevokedZrevoke_date_2_digitr r r � revoke_cert� s" 4 � � �� � �� � �� � �� �� � ��� �� �� � �� � ��� �� �� ��rK �__main__ZkojiZ test_systemZ Centervilleztest_system@saltproject.io)rf rg rh ri rj rk rl �test)r* rA )NrZ )NN)FN)r� FNN)r� )rb rc r� r� r� r� r� NNFNNr� NNF)rb r� r� r� r� r� NNNNNNNr� Fr� F)r rb rc r� r� r� r� r� NNNNr� F) rc NNNNr� NFF)r� NF)r� )NNNr� )NNNNNr� )D�__doc__r- r1 �loggingr r4 rF r r r Zsalt.utils.datar0 Zsalt.utils.filesZsalt.utils.stringutilsZsalt.exceptionsr Zsalt.utils.versionsr r r r� rn �__dict__r r � ImportErrorZ cryptographyr Z cryptography.hazmat.primitivesr r Z,cryptography.hazmat.primitives.serializationr � getLogger�__name__r rC r� r r r r# r$ r% r@ rD rY r] r� r� r� r� r� r� rM r� rN r� r� r{ r r r r( r+ r9 rE rK r r r r �<module> s* d � � ' > �( �,x � Q` � e � � j Zg �b � I� �
| ver. 1.4 |
Github
|
.
| PHP 8.2.30 | Generation time: 0 |
proxy
|
phpinfo
|
Settings