File manager - Edit - /opt/saltstack/salt/lib/python3.10/site-packages/salt/modules/__pycache__/x509.cpython-310.pyc
Back
o ;j� � @ s� d Z ddlZddlZddlZddlZddlZddlZddlZddlZddl Z ddl Z ddl Z ddl m Z ddlZddlZddlZddlZddlZddlZddlZddlmZ zddlZddlmZmZm Z m Z m Z m Z dZ W n e!yy dZ Y nw zddl"Z"dZ#W n e!y� dZ#Y nw dZ$e�%e&�Z'e g d ��Z(d d d d d�Z)dd� Z*G dd� dej+�Z,dhdd�Z-didd�Z.dd� Z/dd� Z0d d � Z1d d � Z2d d!� Z3d"d#� Z4d$d%� Z5d&d'� Z6d(d)� Z7d*d+� Z8dhd,d-�Z9d.d/� Z:d0d1� Z;d2d3� Z<d4d5� Z=d6d7� Z>dhd8d9�Z?d:d;� Z@dhd<d=�ZAd>d?� ZBd@dA� ZCdBdC� ZDdDdE� ZEdFdG� ZFdjdHdI�ZGdhdJdK�ZHdkdLdM�ZI N O dldPdQ�ZJ R SdmdTdU�ZKdVdW� ZLdXdY� ZMdndZd[�ZNdjd\d]�ZOdhd^d_�ZP dod`da�ZQdbdc� ZRddde� ZSdfdg� ZTdS )paF Manage X509 certificates .. versionadded:: 2015.8.0 :depends: M2Crypto .. deprecated:: 3006.0 .. warning:: This module has been deprecated and will be removed in Salt 3009 (Potassium). Please migrate to the replacement modules. For breaking changes between both versions, you can refer to the :ref:`x509_v2 execution module docs <x509-setup>`. They will become the default ``x509`` modules in Salt 3008 (Argon). You can explicitly switch to the new modules before that release by setting ``features: {x509_v2: true}`` in your minion configuration. � N)� OrderedDict)�STATE_INTERNAL_KEYWORDS)�ASN1�BIO�EVP�RSA�X509�m2TF�x509))ZbasicConstraintszX509v3 Basic Constraints)ZkeyUsagezX509v3 Key Usage)ZextendedKeyUsagezX509v3 Extended Key Usage)�subjectKeyIdentifierz X509v3 Subject Key Identifier)�authorityKeyIdentifierz X509v3 Authority Key Identifier)ZissuserAltNamez X509v3 Issuer Alternative Name)ZauthorityInfoAccessz X509v3 Authority Info Access)�subjectAltNamez X509v3 Subject Alternative Name)ZcrlDistributionPointsz X509v3 CRL Distribution Points)ZissuingDistributionPointz!X509v3 Issuing Distribution Point)ZcertificatePolicieszX509v3 Certificate Policies)ZpolicyConstraintszX509v3 Policy Constraints)ZinhibitAnyPolicyzX509v3 Inhibit Any Policy)ZnameConstraintszX509v3 Name Constraints)ZnoCheckzX509v3 OCSP No Check)Z nsCommentzNetscape Comment)Z nsCertTypezNetscape Certificate Typeim � �@ �sha256)� days_valid�version� serial_bits� algorithmc C s2 t �di ��d�r dS trtjj�dd� tS dS )z8 only load this module if m2crypto is available ZfeaturesZx509_v2)FzSuperseded, using x509_v2Z Potassiumz�The x509 modules are deprecated. Please migrate to the replacement modules (x509_v2). They are the default from Salt 3008 (Argon) onwards.)Fz0Could not load x509 module, m2crypto unavailable)�__opts__�get�HAS_M2�salt�utilsZversionsZ warn_until�__virtualname__� r r �E/opt/saltstack/salt/lib/python3.10/site-packages/salt/modules/x509.py� __virtual__^ s �r c @ sL e Zd ZdZdejfdejfdejfdejfdejfdejfdejfgZd S ) �_Ctx�� This is part of an ugly hack to fix an ancient bug in M2Crypto https://bugzilla.osafoundation.org/show_bug.cgi?id=7530#c13 �flags� issuer_cert� subject_cert� subject_req�crlZdb_methZdbN)�__name__� __module__� __qualname__�__doc__�ctypes�c_int�c_void_p�_fields_r r r r r p s �r c C sH t �t| ��}d|_d|_d|_d|_|du r d|_dS t|j�|_dS )r r N) r � from_address�intr r" r# r$ r! r )Zm2_ctx�issuer�ctxr r r �_fix_ctx� s r1 � c C s� | dkr|� d�dkrtj�d��tjj�| �} tjj�|�}z tj� � }t ||� |du r2t d��tj� d|| |�}d}W n" t y` tj�� }tj�|�}t ||� tj� ||| |�}Y nw |du rotj�d�| |���tj�||�}|�|� |S )z� Create new X509_Extension, this is required because M2Crypto doesn't support getting the publickeyidentifier from the issuer to create the authoritykeyidentifier extension. r z0123456789abcdefABCDEF:� z value must be precomputed hashNz4Not enough memory when creating a new X509 extensionz:Cannot create X509_Extension with name '{}' and value '{}')�stripr � exceptions�SaltInvocationErrorr � stringutils�to_str�M2Cryptor Zx509v3_set_nconfr1 � MemoryErrorZx509v3_ext_conf�AttributeErrorZ x509v3_lhashZx509v3_set_conf_lhashr Z X509Error�formatZX509_ExtensionZ set_critical) �name�value�criticalr/ Z_pyfreer0 Z x509_ext_ptrZlhash�x509_extr r r �_new_extension� s4 ��� rA c C sd t jj�d�s t j�d��d| � �}td |�}t�dd|�}t�dd|�}t jj � t jj � |��S ) �} Parses openssl command line output, this is a workaround for M2Crypto's inability to get them from CSR objects. �openssl� openssl binary not found in pathz openssl req -text -noout -in �cmd.run_stdoutz: rsaEncryption�:z [0-9a-f]{2}:r3 ) r r �path�whichr5 r6 �__salt__�re�sub�data�decode�yaml� safe_load)Z csr_filename�cmd�outputr r r �_parse_openssl_req� s rR c C s� t � }tjdd�}|�| �� � |�� t|j�}|�� |rHd|d d v rH|d d d }|s3|S t � � D ]\}}|rG||v rG|| ||< q7|S )z Returns a list of dicts containing the name, value and critical value of any extension contained in a csr object. T��deletezRequested ExtensionszCertificate RequestZData) r �tempfile�NamedTemporaryFile�write�as_pem�flushrR r= �close�EXT_NAME_MAPPINGS�items)�csr�retZ csrtempfileZcsryaml�csrextsZ short_nameZ long_namer r r �_get_csr_extensions� s �r` c C s< t jj�d�s t j�d��d| � �}td |�}i }|�d�D ]�}|�� }|� d�r2|� dd�|d< |� d �r?|� d d�|d < |� d �ri|� d d�}i }|�d �D ]}d |v rd|�d �}|d ||d < qQ||d< |� d�r�|� dd�|d< t j � |d d�}|� d�|d< |� d�r�|� dd�|d< t j � |d d�}|� d�|d< |� d�r� nq d|v r�g |d< |S |�d�d }|�d�d }g } |�d�D ]M} | �� s�q�| �d�d �� } | d d�| �d�dd � � } t jj�t jj�| ��} | �� D ]} d | v �rt j � | d d�}|� d�| d < q�| �| � q�| |d< |S ) rB rC rD z openssl crl -text -noout -in rE � zVersion r3 �VersionzSignature Algorithm: zSignature AlgorithmzIssuer: �/�=r2 r �Issuerz Last Update: z Last Updatez%b %d %H:%M:%S %Y %Z�%Y-%m-%d %H:%M:%Sz Next Update: z Next UpdatezRevoked Certificates:zNo Revoked Certificates.zRevoked CertificateszSignature Algorithm:zSerial Number: z: NzRevocation Date)r r rG rH r5 r6 rI �splitr4 � startswith�replace�datetime�strptime�strftime�joinrL rM rN rO �values�append)Z crl_filenamerP rQ r$ �line�subjectZ sub_entryZ last_updateZ next_update�rev�revokedZrev_snZrev_yamlZ rev_values�rev_dater r r �_parse_openssl_crl� sr � � � � �� ru c C s8 t d dd �}|r|�| �}|r|S t d di ��| �S )Nz pillar.getZx509_signing_policiesz config.get�rI r )r= Zpolicies�signing_policyr r r �_get_signing_policy- s rx c s@ t � �d dkr d� � d�� fdd�tdt � �d�D ���� S )z$ Nicely formats hex strings � r �0rF c s g | ] }� ||d � �qS )ry r )�.0�i��hex_strr r � <listcomp>< s z _pretty_hex.<locals>.<listcomp>)�lenrm �range�upperr} r r} r � _pretty_hex6 s (r� c C s t | d��S )zA Converts decimal values to nicely formatted hex strings �X)r� )Zdecvalr r r �_dec2hex? s r� c C s$ zt j�| �W S ty Y dS w )z� A wrapper around os.path.isfile that ignores ValueError exceptions which can be raised if the input to isfile is too long. F)�osrG �isfile� ValueError)rG r r r �_isfileF s �r� c C sZ t | �r&tjj�| ��}tjj�|�� �W d � S 1 s w Y dS tjj�| �S )za Determines if input is a path to a file, or a string with the content to be parsed. N)r� r r �files�fopenr7 r8 �read)Zinput_Zfp_r r r � _text_or_fileR s $�r� c C s� t � }g }g }| j�� D ]8\}}||v rq zt| |�}|r*|�|||f� |�|� W q tyD } z t�d||� W Y d}~q d}~ww t|�D ] \}}}|||< qI|S )zA Returns a dict containing all values in an X509 Subject z!Missing attribute '%s'. Error: %sN) r �nidr\ �getattrro � TypeError�log�trace�sorted)rq r^ ZnidsZret_listZnid_nameZnid_num�val�errr r r �_parse_subject^ s& ��� r� c C s2 t | tjj�r | S t| �}t|dd�}tj�|�S )z9 Returns a certificate object based on PEM text. � CERTIFICATE��pem_type)� isinstancer9 r r� � get_pem_entry�load_cert_string)�cert�textr r r �_get_certificate_objt s r� c C s@ t | �} t| dd�} tjj| t|�d�}tj�� }|�|� |S )z9 Returns a private key object based on PEM text. �(?:RSA )?PRIVATE KEYr� ��callback) r� r� r9 r �load_key_string�_passphrase_callbackr �PKey� assign_rsa)� private_key� passphraseZ rsaprivkeyZ evpprivkeyr r r �_get_private_key_obj s � r� c s � fdd�}|S )zR Returns a callback function used to supply a passphrase for private keys c s t jj�� �S �N)r r r7 �to_bytes)�args�r� r r �f� s z _passphrase_callback.<locals>.fr )r� r� r r� r r� � s r� c C s t | �}t|dd�}tj�|�S )z1 Returns a CSR object based on PEM text. �CERTIFICATE REQUESTr� )r� r� r9 r �load_request_string)r] r� r r r �_get_request_obj� s r� c C s t �| �� �� ��� }t|�S )zx Returns the sha1 hash of the modulus of a public key in a cert Used for generating subject key identifiers )�hashlib�sha1� get_pubkey� get_modulus� hexdigestr� )r� Zsha_hashr r r �_get_pubkey_hash� s r� c C s dS )zz Replacement keygen callback function which silences the output sent to stdout by the default keygen function Nr r r r r �_keygen_callback� s r� c C s t �d�| �t j�S )z8 Dynamically generate a regex to match pem_type z�\s*(?P<pem_header>-----BEGIN {0}-----)\s+(?:(?P<proc_type>Proc-Type: 4,ENCRYPTED)\s*)?(?:(?P<dek_info>DEK-Info: (?:DES-[3A-Z\-]+,[0-9A-F]{{16}}|[0-9A-Z\-]+,[0-9A-F]{{32}}))\s*)?(?P<pem_body>.+?)\s+(?P<pem_footer>-----END {0}-----)\s*)rJ �compiler< �DOTALLr� r r r � _make_regex� s �r� c C s8 |d u rdn|}t |�}|�| �D ]}|r| S qd S )Nz [0-9A-Z ]+)r� �finditer)Zpemr� Z_dregex�_matchr r r � _valid_pem� s �r� c C s4 d| v rt d |d| d�}|�|d�S t d | |�S )N�@�publish.publishzmatch.compound)�tgt�fun�argFz match.globrv )�testZminion�matchr r r �_match_minions� s r� c C s� t | �} | �dd�} t| �� �dkrz| �d�rz| �d�rzg }| }|ru|�d�rC|�|d|�dd�d � � ||�dd�d d� }n0|dd� �d�d kr^|�|dd� � |dd� }n|�|d|�d�� � ||�d�d� }|s"d� |�} d | � �}|r�d � || �}t | |�}|s�t j �|��|�� }|d }|d }|d } |d } |d } d� | �� �} |d } |r�| |d 7 } | r�| | d d 7 } td t| �d�D ]} | | | | d � d 7 } q�| | d 7 } t jjj| dd�S )a' Returns a properly formatted PEM string from the input text fixing any whitespace or line-break issues text: Text containing the X509 PEM entry to be returned or path to a file containing the text. pem_type: If specified, this function will only return a pem of a certain type, for example 'CERTIFICATE' or 'CERTIFICATE REQUEST'. CLI Example: .. code-block:: bash salt '*' x509.get_pem_entry "-----BEGIN CERTIFICATE REQUEST-----MIICyzCC Ar8CAQI...-----END CERTIFICATE REQUEST" z\nra r2 z-----N� r �-r zPEM text not valid: z2PEM does not contain a single entry of type {}: {}� pem_header� proc_type�dek_info� pem_footer�pem_bodyr3 �ascii��encoding)r� ri r� � splitlinesrh �endswithro �index�countrm r< r� r r5 r6 � groupdictrg r� r r7 r� )r� r� Z pem_fixedZpem_temp�errmsgr� Z _match_dictr� r� r� r� r� r^ r| r r r r� � sX �� � � r� c C �J i }t � | �D ]}tj�|�r"z t|d�||< W q ty! Y qw q|S )z� Returns a dict containing PEM entries in files matching a glob glob_path: A path to certificates to be read and returned. CLI Example: .. code-block:: bash salt '*' x509.get_pem_entries "/etc/pki/*.crt" )r� )�globr� rG r� r� r� �Z glob_pathr^ rG r r r �get_pem_entries! � ��r� c C s t | �}|�� d |�� �� d t|�� �t|jdd��t|jdd��t|� � �t|� � � � �t|� � �t|� � � � �|� � � � �d�|�� � � �d�t|�d� }td d u rat|jd d��|d < t� }td |�� �D ]}|�|�}|�� }|�� }|�� r�d | }|||< qk|r�||d< |S )av Returns a dict containing details of a certificate. Input can be a PEM string or file path. certificate: The certificate to be read. Can be a path to a certificate file, or a string containing the PEM formatted text of the certificate. CLI Example: .. code-block:: bash salt '*' x509.read_certificate /etc/pki/mycert.crt r2 � r )Zmdr� rf ) rb zKey Size� Serial NumberzSHA-256 Finger PrintzSHA1 Finger Print�Subject� Subject Hashre z Issuer Hashz Not Before� Not Afterz Public KeyZ fips_modeF�md5zMD5 Finger Printr � critical �X509v3 Extensions)r� � get_versionr� �sizer� Zget_serial_numberr� Zget_fingerprintr� � get_subject�as_hashZ get_issuerZget_not_before� get_datetimerl � get_not_after�get_public_keyr r r� Z get_ext_countZ get_ext_at�get_name� get_valueZ get_critical)� certificater� r^ ZextsZ ext_index�extr= r� r r r �read_certificate: s: � r� c C r� )z� Returns a dict containing details of all certificates matching a glob glob_path: A path to certificates to be read and returned. CLI Example: .. code-block:: bash salt '*' x509.read_certificates "/etc/pki/*.crt" )r� )r� r� rG r� r� r� r� r r r �read_certificatesp r� r� c C sT t | �} | �� d t| �� �t| �� �� �t�| �� � � �� � d�}t | �|d< |S )a Returns a dict containing details of a certificate request. :depends: - OpenSSL command line tool csr: A path or PEM encoded string containing the CSR to read. CLI Example: .. code-block:: bash salt '*' x509.read_csr /etc/pki/mycert.csr r2 )rb r� r� zPublic Key Hashr� ) r� r� r� r� r� r� r� r� r� r� r� r` )r] r^ r r r �read_csr� s � r� c C sV t | �}t|dd�}tjdd�}|�tjjj|dd�� |� � t |j �}|� � |S )aP Returns a dict containing details of a certificate revocation list. Input can be a PEM string or file path. :depends: - OpenSSL command line tool crl: A path or PEM encoded string containing the CRL to read. CLI Example: .. code-block:: bash salt '*' x509.read_crl /etc/pki/mycrl.crl �X509 CRLr� TrS r� r� ) r� r� rU rV rW r r r7 r� rY ru r= rZ )r$ r� � crltempfileZ crlparsedr r r �read_crl� s r� c C s t | tjj�r| �� �� }d}nt| �}t|�}|�d�r1|s!|S tj� � }|� |� tj � |�}tj� � }|�d�rGtj� |�}|�� �� }|�d�rXtj�|�}|�� �� }|�d�sb|�d�rltj j|t|�d�}|rztj�� }|�|� |S |�|� |�� S )a7 Returns a string containing the public key in PEM format. key: A path or PEM encoded string containing a CSR, Certificate or Private Key from which a public key can be retrieved. CLI Example: .. code-block:: bash salt '*' x509.get_public_key /etc/pki/mycert.cer � s -----BEGIN PUBLIC KEY-----s -----BEGIN CERTIFICATE-----s# -----BEGIN CERTIFICATE REQUEST-----s -----BEGIN PRIVATE KEY-----s -----BEGIN RSA PRIVATE KEY-----r� )r� r9 r r� Zget_rsar� r� rh r � MemoryBufferrW r Zload_pub_key_bior� r� r� r� r r� r� Zsave_pub_key_bio�read_all) �keyr� �asObj�rsar� �bior� r] Z evppubkeyr r r r� � s< �� r� c C s t | |��� d S )z� Returns the bit length of a private key in PEM format. private_key: A path or PEM encoded string containing a private key. CLI Example: .. code-block:: bash salt '*' x509.get_private_key_size /etc/pki/mycert.key r� )r� r� )r� r� r r r �get_private_key_size� s r� c C s� t | |d�} tjj�d��� d}d}|rv|dkrvtj�|�rv|svt|�}zt |d�}W n! tj j yL } zt � d|� t j ||d� W Y d}~nd}~ww zt |d �}W n! tj j yu } zt � d |� t j ||d� W Y d}~nd}~ww tjj�|d ��6}|r�|dkr�|r�|�tjj�|�� |�tjj�| �� |r�|dkr�|r�|�tjj�|�� W d � n1 s�w Y W d � n1 s�w Y d |� �S ) a� Writes out a PEM string fixing any formatting or whitespace issues before writing. text: PEM string input to be written out. path: Path of the file to write the PEM out to. overwrite: If ``True`` (default), write_pem will overwrite the entire PEM file. Set False to preserve existing private keys and dh params that may exist in the PEM file. pem_type: The PEM type to be saved, for example ``CERTIFICATE`` or ``PUBLIC KEY``. Adding this will allow the function to take input that may contain multiple PEM types. CLI Example: .. code-block:: bash salt '*' x509.write_pem "-----BEGIN CERTIFICATE-----MIIGMzCCBBugA..." path=/etc/pki/mycert.crt r� �? r3 r� z DH PARAMETERSz$Error when getting DH PARAMETERS: %s)�exc_infoNr� z"Error when getting PRIVATE KEY: %s�wzPEM written to )r� r r r� Z set_umaskr� rG r� r� r5 r6 r� �debugr� r� rW r7 r8 ) r� rG � overwriter� Z _dhparamsZ _private_keyZ _filecontentsr� �_fpr r r � write_pem sJ � �� �� ��� �� � r � � aes_128_cbcc C s� | s |s t j�d��| r|rt j�d��|rtjj}nt}tj�|tjj |�}tj � � }|du r2d}|j ||t |�d� | rGt|�� | dd�S t jj�|�� �S )a� Creates a private key in PEM format. path: The path to write the file to, either ``path`` or ``text`` are required. text: If ``True``, return the PEM text without writing to a file. Default ``False``. bits: Length of the private key in bits. Default 2048 passphrase: Passphrase for encrypting the private key cipher: Cipher for encrypting the private key. Has no effect if passphrase is None. verbose: Provide visual feedback on stdout. Default True .. versionadded:: 2016.11.0 CLI Example: .. code-block:: bash salt '*' x509.create_private_key path=/etc/pki/mykey.key �&Either path or text must be specified.�0Either path or text must be specified, not both.N)�cipherr� r� �r� rG r� )r r5 r6 r9 r Zkeygen_callbackr� Zgen_keyr ZRSA_F4r r� Z save_key_bior� r r� r r7 r8 ) rG r� �bitsr� r �verboseZ_callback_funcr� r� r r r �create_private_keyB s* '�� �r �d r3 c C s: t stj�d��tj�� } |du rg }|D ]�} d| v r-t| d �} | d | d< | d | d< | d �dd �} tj j � | �} d| v rS|sSt j � | d d �} t j �� | krSqd | vrat j �� �d �| d < t j � | d d �}|�d �}tj j � |�}tj�� }|�tj j � | �� |�tj j � |�� d | v r�tj j � | d �}|�|� | �|� qt|�}tj�tjjt|dd��}t||d�jdd�}tj�tjjt|��}||tjj|d�}|r�tj j � |�|d< nt � d� z | j di |��}W n t t f�y t � d� |�!dd� | j di |��}Y nw |�r|S t"|| dd�S )aD Create a CRL :depends: - PyOpenSSL Python module path: Path to write the CRL to. text: If ``True``, return the PEM text without writing to a file. Default ``False``. signing_private_key: A path or string of the private key in PEM format that will be used to sign the CRL. This is required. signing_private_key_passphrase: Passphrase to decrypt the private key. signing_cert: A certificate matching the private key that will be used to sign the CRL. This is required. revoked: A list of dicts containing all the certificates to revoke. Each dict represents one certificate. A dict must contain either the key ``serial_number`` with the value of the serial number to revoke, or ``certificate`` with either the PEM encoded text of the certificate, or a path to the certificate to revoke. The dict can optionally contain the ``revocation_date`` key. If this key is omitted the revocation date will be set to now. If should be a string in the format "%Y-%m-%d %H:%M:%S". The dict can also optionally contain the ``not_after`` key. This is redundant if the ``certificate`` key is included. If the ``Certificate`` key is not included, this can be used for the logic behind the ``include_expired`` parameter. If should be a string in the format "%Y-%m-%d %H:%M:%S". The dict can also optionally contain the ``reason`` key. This is the reason code for the revocation. Available choices are ``unspecified``, ``keyCompromise``, ``CACompromise``, ``affiliationChanged``, ``superseded``, ``cessationOfOperation`` and ``certificateHold``. include_expired: Include expired certificates in the CRL. Default is ``False``. days_valid: The number of days that the CRL should be valid. This sets the Next Update field in the CRL. digest: The digest to use for signing the CRL. This has no effect on versions of pyOpenSSL less than 0.14 .. note At this time the pyOpenSSL library does not allow choosing a signing algorithm for CRLs See https://github.com/pyca/pyopenssl/issues/159 CLI Example: .. code-block:: bash salt '*' x509.create_crl path=/etc/pki/mykey.key \ signing_private_key=/etc/pki/ca.key \ signing_cert=/etc/pki/ca.crt \ revoked="{'compromized-web-key': {'certificate': '/etc/pki/certs/www1.crt', 'revocation_date': '2015-03-01 00:00:00'}}" z2Could not load OpenSSL module, OpenSSL unavailableNr� r� � serial_numberr� � not_afterrF r3 rf Zrevocation_datez %Y%m%d%H%M%SZ�reasonr� r� r� )r )r� r� �type�days�digestz9No digest specified. The default md5 digest will be used.ztError signing crl with specified digest. Are you using pyopenssl 0.15 or newer? The default md5 digest will be used.r� r r )#� HAS_OPENSSLr r5 r6 �OpenSSLZcryptoZCRLr� ri r r7 r� rj rk �nowrl ZRevokedZ set_serialZ set_rev_dateZ set_reasonZ add_revokedr� Zload_certificateZ FILETYPE_PEMr� r� rX Zload_privatekeyr� �warningZexportr� r� �popr )rG r� �signing_private_key� signing_private_key_passphrase� signing_certrs Zinclude_expiredr r r$ Zrev_itemZrev_certr r rt rr r r� r� Z export_kwargs�crltextr r r � create_crl� s� V� � �� ��� �� � �r c K s� d| vrdS t | t�st�| �} i }d| v r8t| d �}|s%d�| d �S t |t�r8i }|D ]}|�|� q.|}d|v rUd|vrBdS t|d |d �sUd�|d | d �S z t d dd d �| ��W S t yv } z t |�W Y d}~S d}~ww ) a� Request a certificate to be remotely signed according to a signing policy. argdic: A dict containing all the arguments to be passed into the create_certificate function. This will become kwargs when passed to create_certificate. kwargs: kwargs delivered from publish.publish CLI Example: .. code-block:: bash salt '*' x509.sign_remote_certificate argdic="{'public_key': '/etc/pki/www.key', 'signing_policy': 'www'}" __pub_id='www1' rw z signing_policy must be specifiedz!Signing policy {} does not exist.ZminionsZ__pub_idz3minion sending this request could not be identifiedz){} not permitted to use signing policy {}NT)rG r� r ) r� �dict�astZ literal_evalrx r< �list�updater� �create_certificate� Exception�str)Zargdic�kwargsrw �dict_�itemZexcept_r r r �sign_remote_certificate1 s6 ���r( c C s� t | �}|s d| � d�S t|t�r i }|D ]}|�|� q|}z|d= W n ty- Y nw z t|d d�|d< W |S tyD Y |S w )z� Returns the details of a names signing policy, including the text of the public key that will be used to sign it. Does not return the private key. CLI Example: .. code-block:: bash salt '*' x509.get_signing_policy www zSigning policy z does not exist.r r r� )rx r� r r! �KeyErrorr� )Zsigning_policy_namerw r& r' r r r �get_signing_policyc s, � � ��r* c $ K s | s|sd|vs|d du rt j�d��| r |r t j�d��d|vr&d|d< |r�d|vr5t j�d�|���d |v rLt jj�t|d d d ���d d �|d < d|v ret jj�t |d |d d���d d �|d< t t �g d� D ]}|� |d� qmt d |dt jjj|dd�dd�}t|�s�t j�d��|| }t|t�r�t|d�s�t j�|��| r�t||| dd�S |S i }d|v r�t|d �}t|t �r�i } |D ]} | �| � q�| }|�|� t�� D ] \} } | |vr�| || < q�tj�� } | �|d d � d |v�rt t � |d ��|d < t |d �d d �d �}t jj �!� �r(d }||k�r'|t || �| 8 }n|t"j#k�r:|t |t"j# �t"j# 8 }| �$|� d!}d"|v �rxz t%j%�&|d" |�}W n t j�d#�|d" |���|jtj'j(d$�}tj'�)� }|�*|� | �+|� d%|v �r�z t%j%�&|d% |�}W n t j�d&�|d% |���|jtj'j(d$�}tj'�)� }|�*|� | �,|� tj-�.| j/�}tj-�0| j/�}d"|v�r�tj-�1|d'� d%|v�r�d(|d) }tj-�1||� d|v�r�d |v�r�|d* |d< d+|v �r�|d+ |d< i }d |v �r|d |d< t2|d �}| �3|�4� � t5|d �d, }| �6t |d |d dd-�� | �4� }t7|j8�D ]}||v �r>t9|||| � �q/d.|v �rLt:|d. �}n| }| �;|�4� � t<�� D ]�\} } | |v �po| |v �po| |v �po| |v du �ru�qY|�=| ��p�|�=| ��p�|�=| ��p�|�=| �} d} | �>d/��r�d} | d0d� } | d1k�r�d2| v �r�| �d2t?| ��} d} | d3k�r�|} | d4k�r�| �d5d6�} t@| | | | d7�}!|!jA�s�tB�Cd8| | � �qY| �D|!� �qYd+|v�r�d|d+< tE|d* |d+ |d9��st j�d:�|d* |�=d.d ����| �FtG|d* |d+ d�|d; � tH| |d<��s t j�d=��d|v �r>|d du �r>tI| �}"t |d* |d+ d�|"d>< |"S d?|v �rpd@|v �rX|d@ du �rXt|dA �dB }#nd }#t| �J� tKjL�M|d? |#|d dC �ddD� | �r}t| �J� || dd�S t jj�| �J� �S )Ea�" Create an X509 certificate. path: Path to write the certificate to. text: If ``True``, return the PEM text without writing to a file. Default ``False``. overwrite: If ``True`` (default), create_certificate will overwrite the entire PEM file. Set False to preserve existing private keys and dh params that may exist in the PEM file. kwargs: Any of the properties below can be included as additional keyword arguments. ca_server: Request a remotely signed certificate from ca_server. For this to work, a ``signing_policy`` must be specified, and that same policy must be configured on the ca_server. See ``signing_policy`` for details. Also, the salt master must permit peers to call the ``sign_remote_certificate`` function. Example: /etc/salt/master.d/peer.conf .. code-block:: yaml peer: .*: - x509.sign_remote_certificate subject properties: Any of the values below can be included to set subject properties Any other subject properties supported by OpenSSL should also work. C: 2 letter Country code CN: Certificate common name, typically the FQDN. Email: Email address GN: Given Name L: Locality O: Organization OU: Organization Unit SN: SurName ST: State or Province signing_private_key: A path or string of the private key in PEM format that will be used to sign this certificate. If neither ``signing_cert``, ``public_key``, or ``csr`` are included, it will be assumed that this is a self-signed certificate, and the public key matching ``signing_private_key`` will be used to create the certificate. signing_private_key_passphrase: Passphrase used to decrypt the signing_private_key. signing_cert: A certificate matching the private key that will be used to sign this certificate. This is used to populate the issuer values in the resulting certificate. Do not include this value for self-signed certificates. public_key: The public key to be included in this certificate. This can be sourced from a public key, certificate, CSR or private key. If a private key is used, the matching public key from the private key will be generated before any processing is done. This means you can request a certificate from a remote CA using a private key file as your public_key and only the public key will be sent across the network to the CA. If neither ``public_key`` or ``csr`` are specified, it will be assumed that this is a self-signed certificate, and the public key derived from ``signing_private_key`` will be used. Specify either ``public_key`` or ``csr``, not both. Because you can input a CSR as a public key or as a CSR, it is important to understand the difference. If you import a CSR as a public key, only the public key will be added to the certificate, subject or extension information in the CSR will be lost. public_key_passphrase: If the public key is supplied as a private key, this is the passphrase used to decrypt it. csr: A file or PEM string containing a certificate signing request. This will be used to supply the subject, extensions and public key of a certificate. Any subject or extensions specified explicitly will overwrite any in the CSR. basicConstraints: X509v3 Basic Constraints extension. extensions: The following arguments set X509v3 Extension values. If the value starts with ``critical``, the extension will be marked as critical. Some special extensions are ``subjectKeyIdentifier`` and ``authorityKeyIdentifier``. ``subjectKeyIdentifier`` can be an explicit value or it can be the special string ``hash``. ``hash`` will set the subjectKeyIdentifier equal to the SHA1 hash of the modulus of the public key in this certificate. Note that this is not the exact same hashing method used by OpenSSL when using the hash value. ``authorityKeyIdentifier`` Use values acceptable to the openssl CLI tools. This will automatically populate ``authorityKeyIdentifier`` with the ``subjectKeyIdentifier`` of ``signing_cert``. If this is a self-signed cert these values will be the same. basicConstraints: X509v3 Basic Constraints keyUsage: X509v3 Key Usage extendedKeyUsage: X509v3 Extended Key Usage subjectKeyIdentifier: X509v3 Subject Key Identifier issuerAltName: X509v3 Issuer Alternative Name subjectAltName: X509v3 Subject Alternative Name crlDistributionPoints: X509v3 CRL Distribution Points issuingDistributionPoint: X509v3 Issuing Distribution Point certificatePolicies: X509v3 Certificate Policies policyConstraints: X509v3 Policy Constraints inhibitAnyPolicy: X509v3 Inhibit Any Policy nameConstraints: X509v3 Name Constraints noCheck: X509v3 OCSP No Check nsComment: Netscape Comment nsCertType: Netscape Certificate Type days_valid: The number of days this certificate should be valid. This sets the ``notAfter`` property of the certificate. Defaults to 365. version: The version of the X509 certificate. Defaults to 3. This is automatically converted to the version value, so ``version=3`` sets the certificate version field to 0x2. serial_number: The serial number to assign to this certificate. If omitted a random serial number of size ``serial_bits`` is generated. serial_bits: The number of bits to use when randomly generating a serial number. Defaults to 64. algorithm: The hashing algorithm to be used for signing this certificate. Defaults to sha256. copypath: An additional path to copy the resulting certificate to. Can be used to maintain a copy of all certificates issued for revocation purposes. prepend_cn: If set to True, the CN and a dash will be prepended to the copypath's filename. Example: /etc/pki/issued_certs/www.example.com-DE:CA:FB:AD:00:00:00:00.crt signing_policy: A signing policy that should be used to create this certificate. Signing policies should be defined in the minion configuration, or in a minion pillar. It should be a YAML formatted list of arguments which will override any arguments passed to this function. If the ``minions`` key is included in the signing policy, only minions matching that pattern (see match.glob and match.compound) will be permitted to remotely request certificates from that policy. In order to ``match.compound`` to work salt master must peers permit peers to call it. Example: /etc/salt/master.d/peer.conf .. code-block:: yaml peer: .*: - match.compound Example: .. code-block:: yaml x509_signing_policies: www: - minions: 'www*' - signing_private_key: /etc/pki/ca.key - signing_cert: /etc/pki/ca.crt - C: US - ST: Utah - L: Salt Lake City - basicConstraints: "critical CA:false" - keyUsage: "critical cRLSign, keyCertSign" - subjectKeyIdentifier: hash - authorityKeyIdentifier: keyid,issuer:always - days_valid: 90 - copypath: /etc/pki/issued_certs/ The above signing policy can be invoked with ``signing_policy=www`` not_before: Initial validity date for the certificate. This date must be specified in the format '%Y-%m-%d %H:%M:%S'. .. versionadded:: 3001 not_after: Final validity date for the certificate. This date must be specified in the format '%Y-%m-%d %H:%M:%S'. .. versionadded:: 3001 CLI Example: .. code-block:: bash salt '*' x509.create_certificate path=/etc/pki/myca.crt signing_private_key='/etc/pki/myca.key' csr='/etc/pki/myca.csr'} ZtestrunFr r �public_key_passphraseNrw zSsigning_policy must be specifiedif requesting remote certificate from ca_server {}.r] r� r� ra r3 � public_keyr� )Z listen_inZ prerequiredZ__prerequired__r� z x509.sign_remote_certificateT)r8 � )r� r� r� �timeoutzeca_server did not respond salt master must permit peers to call the sign_remote_certificate function.r� )r� r rG r� r r2 r r rF � i���rf � not_beforez+not_before: {} is not in required format {})�tzinfor z*not_after: {} is not in required format {}r i�Q r r r r� �r� r� r r� � r �hashr r � IP Address�IP�r= r> r? r/ � Invalid X509v3 Extension. %s: %s)r� r� r, z6signing_private_key: {} does no match signing_cert: {}r )�signing_pub_keyz&failed to verify certificate signaturezIssuer Public KeyZcopypathZ prepend_cn�CNr� z.crtr )Nr r5 r6 r< r r7 r8 r� ri r� r �_STATE_INTERNAL_KEYWORDSr rI rL Z decode_dict�anyr� r$ r� r rx r! � CERT_DEFAULTSr\ r9 r � set_versionr� �random� getrandbitsr. �platformZ is_windows�sys�maxsizeZset_serial_numberrj rk r �UTCZ ASN1_UTCTIMEZ set_datetimeZset_not_beforeZ set_not_afterr Zx509_get_not_beforer Zx509_get_not_afterZx509_gmtime_adjr� Z set_subjectr� r� � set_pubkeyr� r� �setattrr� Z set_issuerr[ r rh r� rA r@ r� �infoZadd_ext�verify_private_key�signr� �verify_signaturer� rX r� rG rm )$rG r� r Z ca_serverr% �ignore�certsZcert_txtrw r& r' �prop�defaultr� r ZINT_MAX�fmt�timeZasn1_not_beforeZasn1_not_afterr0 r Z valid_secondsr_ r] rq �entryr �extname� extlongname�extvalr? r/ r� Z cert_propsZprependr r r r" � s� ������� ��� �� � � � �� �� �� � ��� ��� � ������ � �� �r" c K sr | s |s t j�d��| r|rt j�d��tj�� }|�� }t�� D ] \}}||vr-|||< q!|� |d d � d|vrJd|v rJ|d |d< t � d� d|vrTt j�d��d|vr^|d |d< d |vrfd |d < d |vrnd |d < |d r||d s||d |d < |d r�|d s�|d |d < |� t |d |d d d �� t|j�D ]}||v r�t|||| � q�tj�� }t�� D ]^\} } | |vr�| |vr�q�|| p�|| } d} | �d�r�d } | dd � } | dkr�d| v r�| �dt|��} | dkr�| �dd�} | dkr�q�d } t| | | | d�}|j�st �d| | � q�|�|� q�|�|� |�t |d |d d�|d � | �r5t |� � | dd �S |� � S ) ap Create a certificate signing request. path: Path to write the certificate to. text: If ``True``, return the PEM text without writing to a file. Default ``False``. algorithm: The hashing algorithm to be used for signing this request. Defaults to sha256. kwargs: The subject, extension and version arguments from :mod:`x509.create_certificate <salt.modules.x509.create_certificate>` can be used. CLI Example: .. code-block:: bash salt '*' x509.create_csr path=/etc/pki/myca.csr public_key='/etc/pki/myca.key' CN='My Cert' r r r r2 r� r, z�OpenSSL no longer allows working with non-signed CSRs. A private_key must be specified. Attempting to use public_key as private_keyzprivate_key is requiredZprivate_key_passphraseNr+ Tr2 Fr� r3 r r4 r r5 r6 r r7 r8 r� r r� r ) r r5 r6 r9 r �Requestr� r= r\ r> r� r rE r� r� r� rF ZX509_Extension_Stackr[ rh ri r� rA r@ rG �pushZadd_extensionsrI r� r rX )rG r� r% r] rq rM rN rQ ZextstackrR rS rT r? r/ r� r r r � create_csr� s� �� � � ��� � ��rW c C s t t| |�t|�k�S )a Verify that 'private_key' matches 'public_key' private_key: The private key to verify, can be a string or path to a private key in PEM format. public_key: The public key to verify, can be a string or path to a PEM formatted certificate, CSR, or another private key. passphrase: Passphrase to decrypt the private key. CLI Example: .. code-block:: bash salt '*' x509.verify_private_key private_key=/etc/pki/myca.key \ public_key=/etc/pki/myca.crt )�boolr� )r� r, r� r r r rH / s rH c C s. t | �}|r t||dd�}t|j|d�dk�S )a` Verify that ``certificate`` has been signed by ``signing_pub_key`` certificate: The certificate to verify. Can be a path or string containing a PEM formatted certificate. signing_pub_key: The public key to verify, can be a string or path to a PEM formatted certificate, CSR, or private key. signing_pub_key_passphrase: Passphrase to the signing_pub_key if it is an encrypted private key. CLI Example: .. code-block:: bash salt '*' x509.verify_signature /etc/pki/mycert.pem \ signing_pub_key=/etc/pki/myca.crt Tr2 )Zpkeyr2 )r� r� rX Zverify)r� r9 Zsigning_pub_key_passphraser� r r r rJ H s �rJ c C s� t jj�d�s t j�d��t| �}t|dd�}tj dd�}|� t jj j |dd�� |� � t|�}t|d d�}tj dd�}|� t jj j |dd�� |� � d �|j|j�}td |�}|�� |�� d |v S ) a� Validate a CRL against a certificate. Parses openssl command line output, this is a workaround for M2Crypto's inability to get them from CSR objects. crl: The CRL to verify cert: The certificate to verify the CRL against CLI Example: .. code-block:: bash salt '*' x509.verify_crl crl=/etc/pki/myca.crl cert=/etc/pki/myca.crt rC rD r� r� TrS r� r� r� z$openssl crl -noout -in {} -CAfile {}zcmd.run_stderrz verify OK)r r rG rH r5 r6 r� r� rU rV rW r7 r� rY r< r= rI rZ )r$ r� r r� ZcerttextZ certtempfilerP rQ r r r � verify_crlj s& � rY c C s� i }t j�| �rHz5| |d< t| �}tj�� }|�� �� }t|� � �d |d< |� d�|� d�kr7d|d< W |S d|d< W |S t yG Y |S w |S )a� Returns a dict containing limited details of a certificate and whether the certificate has expired. .. versionadded:: 2016.11.0 certificate: The certificate to be read. Can be a path to a certificate file, or a string containing the PEM formatted text of the certificate. CLI Example: .. code-block:: bash salt '*' x509.expired "/etc/pki/mycert.crt" rG r: �cnrf T�expiredF) r� rG r� r� rj �utcnowr� r� r� r� rl r� )r� r^ r� Z_now�_expiration_dater r r r[ � s( � � ��r[ c C s� i }t j�| �rRz?| |d< ||d< t| �}tj�� tj|d� }|�� �� }t |� � �d |d< |� d�|� d�krAd|d< W |S d |d< W |S t yQ Y |S w |S ) a� Returns a dict containing details of a certificate and whether the certificate will expire in the specified number of days. Input can be a PEM string or file path. .. versionadded:: 2016.11.0 certificate: The certificate to be read. Can be a path to a certificate file, or a string containing the PEM formatted text of the certificate. CLI Example: .. code-block:: bash salt '*' x509.will_expire "/etc/pki/mycert.crt" days=30 rG Z check_days)r r: rZ rf T� will_expireF) r� rG r� r� rj r\ � timedeltar� r� r� r� rl r� )r� r r^ r� Z _check_timer] r r r r^ � s* � � ��r^ r� )r Nr2 )NF)TN)NFr Nr T) NFNNNNFr r3 )NFTN)NN)Ur( r r) rj r� r� �loggingr� r? rJ rB rU � collectionsr Zsalt.exceptionsr Zsalt.utils.dataZsalt.utils.filesZsalt.utils.pathZsalt.utils.platformZsalt.utils.stringutilsZsalt.utils.versionsZ salt.stater r; r9 r r r r r r r � ImportErrorr r r � getLoggerr% r� r[ r= r � Structurer r1 rA rR r` ru rx r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r r r r( r* r" rW rH rJ rY r[ r^ r r r r �<module> s� � � �� *F O6 4 : �D � -2 $ 1 { �", )
| ver. 1.4 |
Github
|
.
| PHP 8.2.30 | Generation time: 0 |
proxy
|
phpinfo
|
Settings