File manager - Edit - /opt/saltstack/salt/lib/python3.10/site-packages/salt/modules/__pycache__/win_pki.cpython-310.pyc
Back
o ;j?D � @ s� d Z ddlZddlZddlZddlZddlZddlZddlZddl m Z m Z dZ dZ dZe�e�ZdZdd � Zd"d d �Zd d� Zdd� Zdd� Ze efdd�Ze dfdd�Ze e edddfdd�Ze e edfd d �Ze ed ddfd d �Z e efd d!�Z dS )#a� Microsoft certificate management via the PKI Client PowerShell module. https://technet.microsoft.com/en-us/itpro/powershell/windows/pkiclient/pkiclient The PKI Client PowerShell module is only available on Windows 8+ and Windows Server 2012+. https://technet.microsoft.com/en-us/library/hh848636(v=wps.620).aspx :platform: Windows :depends: - PowerShell 4 - PKI Client Module (Windows 8+ / Windows Server 2012+) .. versionadded:: 2016.11.0 � N)�CommandExecutionError�SaltInvocationErrorZ LocalMachine�cerZMyZwin_pkic C sV t jj�� sdS t jj�td d�dkrdS td d�d s d S t jj� d �s)d S t S ) z� Requires Windows Requires Windows 8+ / Windows Server 2012+ Requires PowerShell Requires PKI Client PowerShell module installed. )Fz!Only available on Windows SystemsZ osversionz6.2.9200���)Fz4Only available on Windows 8+ / Windows Server 2012 +zcmd.shell_info� powershellZ installed)FzPowershell not availableZPKI)Fz#PowerShell PKI module not available) �salt�utils�platformZ is_windowsZversionsZ version_cmpZ __grains__�__salt__r Z module_exists�__virtualname__� r r �H/opt/saltstack/salt/lib/python3.10/site-packages/salt/modules/win_pki.py� __virtual__% s r Fc C s� dg}|r|� d�| �� n|� | � td d�|�ddd�}|d r-td �| |d ���|rNztjjj|d d d �}|W S t yM td �|d ���w |d S )zh Ensure that the Pki module is loaded, and convert to and extract data from Json as needed. zImport-Module -Name PKI; z4ConvertTo-Json -Compress -Depth 4 -InputObject @({})z cmd.run_all� r T)�shellZ python_shell�stderrz'Unable to execute command: {} Error: {}�stdoutF)�strictz'Unable to parse return data as JSON: {}) �append�formatr �joinr r r �json�loads� ValueError)�cmd�as_jsonZcmd_fullZcmd_ret�itemsr r r �_cmd_run; s. � �� ��r c C s. d| � d�}t �t|d��std| � ���dS )zS Ensure that the certificate path, as determind from user input, is valid. zTest-Path -Path '�'�r zInvalid path specified: N)�ast� literal_evalr r )�namer r r r �_validate_cert_path] s �r# c C s$ ddg}| |vrt d�| |���dS )zU Ensure that the certificate format, as determind from user input, is valid. r �pfxz<Invalid certificate format '{}' specified. Valid formats: {}N)r r )r" Z cert_formatsr r r �_validate_cert_formatg s ���r% c C sR t � } d}t|dd�}|D ]}t� | |d < |d D ] }| |d �|� qq | S )z� Get the certificate location contexts and their corresponding stores. :return: A dictionary of the certificate location contexts and stores. :rtype: dict CLI Example: .. code-block:: bash salt '*' win_pki.get_stores zEGet-ChildItem -Path 'Cert:\' | Select-Object LocationName, StoreNamesT�r r Z LocationNameZ StoreNames)�dictr �listr )�retr r �item�storer r r � get_storesu s �r, c C s� t � }t� }dg}d| � d|� �}t|d� |�d|� d�� |�d� td�|�d d �}|D ]5}t � }|D ]} | |vrD|| || �� < q6|�dd �} t| t�rZd d � | D �|d< ng |d< |||d < q/|S )a� Get the available certificates in the given store. Args: context (:obj:`str`, optional): The name of the certificate store location context. Default is "LocalMachine" store (:obj:`str`, optional): The name of the certificate store. Default is "My" Returns: dict: A dictionary of the certificate thumbprints and properties. CLI Example: .. code-block:: bash salt '*' win_pki.get_certs � DnsNameList�Cert:\�\�r" zGet-ChildItem -Path 'z' | Select-Objectz8 DnsNameList, SerialNumber, Subject, Thumbprint, Versionr Tr& Nc S s g | ]}|� d ��qS �ZUnicode)�get��.0r" r r r � <listcomp>� s z get_certs.<locals>.<listcomp>�dnsnamesZ Thumbprint) r' r( r# r r r �lowerr2 � isinstance) �contextr+ r) r �blacklist_keys� store_pathr r* Z cert_info�key�namesr r r � get_certs� s( � r> r c C sd t � }t� }dg}|�� }t|d� | rtj�| �s"t�d| � |S |dkr^|rO|� d� |� d� |� d| � d�� |� d |� d�� |� d � |� d � n'|� d | � d�� |� d � n|� d� |� d� |� d| � d �� |� d � t d� |�dd�}|D ] }|D ]}||vr�|| ||�� < q�dd� |d D �|d< q�|r�t� d| � |S t�d| � |S )a: Get the details of the certificate file. Args: name (str): The filesystem path of the certificate file. cert_format (:obj:`str`, optional): The certificate format. Specify 'cer' for X.509, or 'pfx' for PKCS #12. Default is "cer" password (:obj:`str`, optional): The password of the certificate. Only applicable to pfx format. Note that if used interactively, the password will be seen by all minions. To protect the password, use a state and get the password from pillar. Default is "". Returns: dict: A dictionary of the certificate thumbprints and properties. CLI Example: .. code-block:: bash salt '*' win_pki.get_cert_file name='C:\certs\example.cer' r- r0 zPath is not present: %sr$ z$CertObject = New-Objectz@ System.Security.Cryptography.X509Certificates.X509Certificate2;z $CertObject.Import('r z,'z ,'DefaultKeySet') ; $CertObjectzH | Select-Object DnsNameList, SerialNumber, Subject, Thumbprint, Versionz Get-PfxCertificate -FilePath 'z'); $CertObjectr Tr& c S s g | ]}|d �qS r1 r r3 r r r r5 s z!get_cert_file.<locals>.<listcomp>r6 z0Certificate thumbprint obtained successfully: %sz+Unable to obtain certificate thumbprint: %s) r' r( r7 r% �os�path�isfile�_LOG�errorr r r �debug) r" � cert_format�passwordr) r r: r r* r< r r r � get_cert_file� sT � �� �� �rG T�basec C s� t � }d}d|� d|� �} |�� }t|d� td | |�} | s't�d| � dS |r1t| ||d�} nt| |d �} t||d �} | d | v rNt�d | d | � d S |dkr�|rb|� d� |�� |� d� n|� d� |� d� | �� |� d| � d�� |� d� |r�|� d� n|� d� | �� |� d| � d�� t d� |�d� t||d �} | D ]}|| vr�|}q�|r�t�d| � d S t�d| � dS ) a3 Import the certificate file into the given certificate store. Args: name (str): The path of the certificate file to import. cert_format (:obj:`str`, optional): The certificate format. Specify 'cer' for X.509, or 'pfx' for PKCS #12. Default is "cer" context (:obj:`str`, optional): The name of the certificate store location context. Default is "LocalMachine" store (str): The name of the certificate store. Default is "My" exportable (:obj:`bool`, optional): Mark the certificate as exportable. Only applicable to pfx format. Default is ``True``. password (:obj:`str`, optional): The password of the certificate. Only applicable to pfx format. Note that if used interactively, the password will be seen by all minions. To protect the password, use a state and get the password from pillar. Default is "". saltenv (:obj:`str`, optional): The environment the file resides in. Default is "base". Returns: bool: A boolean representing whether all changes succeeded. CLI Example: .. code-block:: bash salt '*' win_pki.import_cert name='salt://cert.cer' Nr. r/ r0 z cp.cache_filez%Unable to get cached copy of file: %sF)r" rE rF )r" rE �r9 r+ � thumbprintz8Certificate thumbprint '%s' already present in store: %sTr$ �/$Password = ConvertTo-SecureString -String '{}'� -AsPlainText -Force; �5$Password = New-Object System.Security.SecureString; z$Import-PfxCertificate -FilePath '{}'z -CertStoreLocation 'r � -Password $Passwordz -Exportablez!Import-Certificate -FilePath '{}'r r z%Certificate imported successfully: %sz Unable to import certificate: %s) r( r7 r% r rB rC rG r> rD r r r r )r" rE r9 r+ Z exportablerF Zsaltenvr rJ r; Zcached_source_pathZ cert_props� current_certs� new_certsZnew_certr r r � import_cert sd 9 � �� � � � rQ c C s� t � }|�� }d|� d|� d|� �}|�� }t|d� t|d� |dkrH|r4|�d�|�� |�d� n|�d� |�d�|| �� |�d � n |�d �|| �� |�d | � d �� t�t d � |�d��}|rot � d| � |S t � d| � |S )a� Export the certificate to a file from the given certificate store. Args: name (str): The destination path for the exported certificate file. thumbprint (str): The thumbprint value of the target certificate. cert_format (:obj:`str`, optional): The certificate format. Specify 'cer' for X.509, or 'pfx' for PKCS #12. Default is "cer" context (:obj:`str`, optional): The name of the certificate store location context. Default is "LocalMachine" store (:obj:`str`, optional): The name of the certificate store. Default is "My" password (:obj:`str`, optional): The password of the certificate. Only applicable to pfx format. Note that if used interactively, the password will be seen by all minions. To protect the password, use a state and get the password from pillar. Default is "". Returns: bool: A boolean representing whether all changes succeeded. CLI Example: .. code-block:: bash salt '*' win_pki.export_cert name='C:\certs\example.cer' thumbprint='AAA000' r. r/ r0 r$ rK rL rM z/Export-PfxCertificate -Cert '{}' -FilePath '{}'rN z,Export-Certificate -Cert '{}' -FilePath '{}'z | Out-Null; Test-Path -Path 'r r r z%Certificate exported successfully: %sz Unable to export certificate: %s)r( �upperr7 r# r% r r r r! r r rB rD rC ) r" rJ rE r9 r+ rF r � cert_pathr) r r r � export_cert� s8 2 � � � �rT c C s� t � }| �� } d|� d|� d| � �}|�d|� d�� t|d� |r'|�d� |r2|�d|� d�� |r=|�d|� d�� |�d � t�td �|�d ��S ) aH Check the certificate for validity. Args: thumbprint (str): The thumbprint value of the target certificate. context (:obj:`str`, optional): The name of the certificate store location context. Default is "LocalMachine" store (:obj:`str`, optional): The name of the certificate store. Default is "My" untrusted_root (:obj:`bool`, optional): Whether the root certificate is required to be trusted in chain building. Default is ``False``. dns_name (:obj:`str`, optional): The DNS name to verify as valid for the certificate. Default is "". eku (:obj:`str`, optional): The enhanced key usage object identifiers to verify for the certificate chain. Default is "". Returns: bool: A boolean representing whether the certificate was considered valid. CLI Example: .. code-block:: bash salt '*' win_pki.test_cert thumbprint='AAA000' dns_name='example.test' r. r/ zTest-Certificate -Cert 'r r0 z -AllowUntrustedRootz -DnsName 'z -EKU 'z -ErrorAction SilentlyContinuer r )r( rR r r# r r! r r )rJ r9 r+ Zuntrusted_rootZdns_nameZekur rS r r r � test_cert� s 3 rU c C s� | � � } d|� d|� �}|� d| � �}d|� d�}t||d�}| |vr,t�d| |� dS t|d� t|d � t||d�}| |v rHt�d |� d S t�d |� dS ) aH Remove the certificate from the given certificate store. Args: thumbprint (str): The thumbprint value of the target certificate. context (:obj:`str`, optional): The name of the certificate store location context. Default is "LocalMachine". store (:obj:`str`, optional): The name of the certificate store. Default is "My" Returns: bool: A boolean representing whether all changes succeeded. CLI Example: .. code-block:: bash salt '*' win_pki.remove_cert thumbprint='AAA000' r. r/ zRemove-Item -Path 'r rI z,Certificate '%s' already absent in store: %sTr0 r z Unable to remove certificate: %sFz$Certificate removed successfully: %s)rR r> rB rD r# r rC )rJ r9 r+ r; rS r rO rP r r r � remove_cert7 s$ � rV )F) �__doc__r �loggingr? Zsalt.utils.jsonr Zsalt.utils.platformZsalt.utils.powershellZsalt.utils.versionsZsalt.exceptionsr r Z_DEFAULT_CONTEXTZ_DEFAULT_FORMATZ_DEFAULT_STORE� getLogger�__name__rB r r r r# r% r, r> rG rQ rT rU rV r r r r �<module> sR " 4W � �] �F
| ver. 1.4 |
Github
|
.
| PHP 8.2.30 | Generation time: 0 |
proxy
|
phpinfo
|
Settings