File manager - Edit - /opt/saltstack/salt/lib/python3.10/site-packages/salt/states/__pycache__/x509.cpython-310.pyc
Back
o ;j*o � @ s� d Z ddlZddlZddlZddlZddlZddlZddlZzddl m Z W n e y/ Y nw e� e �Zdd� Zdd� Zdd � Zd&d d �Z d'dd�Zdd� Zd(dd�Zdd� Zdd� Zdd� Zd)d d �Z ! d*d"d#�Zd(d$d%�ZdS )+a" Manage X509 Certificates .. versionadded:: 2015.8.0 :depends: M2Crypto .. deprecated:: 3006.0 .. warning:: This module has been deprecated and will be removed in Salt 3009 (Potassium). Please migrate to the replacement modules. For breaking changes between both versions, you can refer to the :ref:`x509_v2 execution module docs <x509-setup>`. They will become the default ``x509`` modules in Salt 3008 (Argon). You can explicitly switch to the new modules before that release by setting ``features: {x509_v2: true}`` in your minion configuration. This module can enable managing a complete PKI infrastructure including creating private keys, CAs, certificates and CRLs. It includes the ability to generate a private key on a server, and have the corresponding public key sent to a remote CA to create a CA signed certificate. This can be done in a secure manner, where private keys are always generated locally and never moved across the network. Here is a simple example scenario. In this example ``ca`` is the ca server, and ``www`` is a web server that needs a certificate signed by ``ca``. For remote signing, peers must be permitted to remotely call the :mod:`sign_remote_certificate <salt.modules.x509.sign_remote_certificate>` function. /etc/salt/master.d/peer.conf .. code-block:: yaml peer: .*: - x509.sign_remote_certificate /srv/salt/top.sls .. code-block:: yaml base: '*': - cert 'ca': - ca 'www': - www This state creates the CA key, certificate and signing policy. It also publishes the certificate to the mine where it can be easily retrieved by other minions. /srv/salt/ca.sls .. code-block:: yaml /etc/salt/minion.d/x509.conf: file.managed: - source: salt://x509.conf restart-salt-minion: cmd.run: - name: 'salt-call service.restart salt-minion' - bg: True - onchanges: - file: /etc/salt/minion.d/x509.conf /etc/pki: file.directory /etc/pki/issued_certs: file.directory /etc/pki/ca.key: x509.private_key_managed: - bits: 4096 - backup: True /etc/pki/ca.crt: x509.certificate_managed: - signing_private_key: /etc/pki/ca.key - CN: ca.example.com - C: US - ST: Utah - L: Salt Lake City - basicConstraints: "critical CA:true" - keyUsage: "critical cRLSign, keyCertSign" - subjectKeyIdentifier: hash - authorityKeyIdentifier: keyid,issuer:always - days_valid: 3650 - days_remaining: 0 - backup: True - require: - file: /etc/pki The signing policy defines properties that override any property requested or included in a CRL. It also can define a restricted list of minions which are allowed to remotely invoke this signing policy. /srv/salt/x509.conf .. code-block:: yaml mine_functions: x509.get_pem_entries: [/etc/pki/ca.crt] x509_signing_policies: www: - minions: 'www' - signing_private_key: /etc/pki/ca.key - signing_cert: /etc/pki/ca.crt - C: US - ST: Utah - L: Salt Lake City - basicConstraints: "critical CA:false" - keyUsage: "critical keyEncipherment" - subjectKeyIdentifier: hash - authorityKeyIdentifier: keyid,issuer:always - days_valid: 90 - copypath: /etc/pki/issued_certs/ This state will instruct all minions to trust certificates signed by our new CA. Using Jinja to strip newlines from the text avoids dealing with newlines in the rendered YAML, and the :mod:`sign_remote_certificate <salt.states.x509.sign_remote_certificate>` state will handle properly formatting the text before writing the output. /srv/salt/cert.sls .. code-block:: jinja /usr/local/share/ca-certificates: file.directory /usr/local/share/ca-certificates/intca.crt: x509.pem_managed: - text: {{ salt['mine.get']('ca', 'x509.get_pem_entries')['ca']['/etc/pki/ca.crt']|replace('\n', '') }} This state creates a private key then requests a certificate signed by ca according to the www policy. /srv/salt/www.sls .. code-block:: yaml /etc/pki/www.crt: x509.private_key_managed: - name: /etc/pki/www.key - bits: 4096 - backup: True /etc/pki/www.crt: x509.certificate_managed: - ca_server: ca - signing_policy: www - public_key: /etc/pki/www.key - CN: www.example.com - days_remaining: 30 - backup: True This other state creates a private key then requests a certificate signed by ca according to the www policy but adds a strict date range for the certificate to be considered valid. /srv/salt/www-time-limited.sls .. code-block:: yaml /etc/pki/www-time-limited.crt: x509.certificate_managed: - ca_server: ca - signing_policy: www - public_key: /etc/pki/www-time-limited.key - CN: www.example.com - not_before: 2019-05-05 00:00:00 - not_after: 2020-05-05 14:30:00 - backup: True � N)�RSAErrorc C s2 t d �d�r dS dtv rtjj�dd� dS dS ) zO only load this module if the corresponding execution module is loaded ZfeaturesZx509_v2)FzSuperseded, using x509_v2�x509.get_pem_entryZ Potassiumz�The x509 modules are deprecated. Please migrate to the replacement modules (x509_v2). They are the default from Salt 3008 (Argon) onwards.Zx509)Fz/Could not load x509 state: m2crypto unavailable)�__opts__�get�__salt__�salt�utilsZversionsZ warn_until� r r �D/opt/saltstack/salt/lib/python3.10/site-packages/salt/states/x509.py� __virtual__� s �r c C sh g }| D ]-}|� � D ]&}i }|D ]}|�� D ]\}}t|tj�r%|�d�}|||< qq|�|� q q|S )ze Turn the mess of OrderedDicts and Lists into a list of dicts for use in the CRL module. �%Y-%m-%d %H:%M:%S)�values�items� isinstance�datetime�strftime�append)ZrevsZlist_ZrevZpropsZdict_ZpropZpropname�valr r r �_revoked_to_list� s � � r c K sL g d�}i }i }|� � D ]\}}||v r|||< q |||< q | |d< ||fS )N) �user�group�mode�makedirsZdir_mode�backup�create�follow_symlinksZ check_cmd�name)r )r �kwargsZvalid_file_args� file_args� extra_args�k�vr r r �_get_file_args� s r" � Fc C sj d}t j�| �r.z td | |d�}W n tjjy Y n ty- |s+tj�d��Y nw ||ko4| S )Nr zx509.get_private_key_size)Z private_key� passphrasez7The provided passphrase cannot decrypt the private key.) �os�path�isfiler r � exceptions�SaltInvocationErrorr ZCommandExecutionError)r �bitsr$ �new� overwriteZ current_bitsr r r �_check_private_key s � ���r- � aes_128_cbcTc K s� t | fi |��\}}d} t| ||||d�r td | dd�|d< nd} td d||||d �|d< tjj�|d �|d< td di |��} | d rO| rOd d i| d < | S )a! Manage a private key's existence. name: Path to the private key bits: Key length in bits. Default 2048. passphrase: Passphrase for encrypting the private key. cipher: Cipher for encrypting the private key. new: Always create a new key. Defaults to ``False``. Combining new with :mod:`prereq <salt.states.requsities.preqreq>` can allow key rotation whenever a new certificate is generated. overwrite: Overwrite an existing private key if the provided passphrase cannot decrypt it. verbose: Provide visual feedback on stdout, dots while key is generated. Default is True. .. versionadded:: 2016.11.0 kwargs: Any kwargs supported by file.managed are supported. Example: The JINJA templating in this example ensures a private key is generated if the file doesn't exist and that a new private key is generated whenever the certificate that uses it is to be renewed. .. code-block:: jinja /etc/pki/www.key: x509.private_key_managed: - bits: 4096 - new: True {% if salt['file.file_exists']('/etc/pki/www.key') -%} - prereq: - x509: /etc/pki/www.crt {%- endif %} F)r* r$ r+ r, r z(?:RSA )?PRIVATE KEY�Zpem_type�contentsTzx509.create_private_key)�textr* r$ �cipher�verbose� file.managed�changesr+ zNew private key generatedNr )r" r- r r r � stringutilsZto_str� __states__) r r* r$ r2 r+ r, r3 r r Znew_key�retr r r �private_key_managed s" : � � � r9 c K s� zt d | �}W n tjjy | � d�}Y nw t| fi |��\}}t d d ddi|��|d< td d i |��}|d rPt d |d �}||krP||d �|d< |S ) a� Manage a Certificate Signing Request name: Path to the CSR properties: The properties to be added to the certificate request, including items like subject, extensions and public key. See above for valid properties. kwargs: Any arguments supported by :py:func:`file.managed <salt.states.file.managed>` are supported. Example: .. code-block:: yaml /etc/pki/mycert.csr: x509.csr_managed: - private_key: /etc/pki/mycert.key - CN: www.example.com - C: US - ST: Utah - L: Salt Lake City - keyUsage: 'critical dataEncipherment' z x509.read_csrz is not a valid csr.zx509.create_csrr1 Tr0 r4 r5 �ZOldZNewNr )r r r( r) r" r7 )r r �oldr r8 r+ r r r � csr_managedk s �r< c C s� t �| �} t �|�}g d�}td du r|�d� |D ]}| �|d� |�|d� q|sb| �dd� |�dd� z t�dd| d d �| d d < t�dd|d d �|d d < W n tya Y nw g }|�� D ]�\}}t |t �rxt j j �|�}zk|| | kr�|d kr�|d | d kr�|�|� nQ|d kr�|d | d kr�|�|� n?|d kr�|� � }| | � � } zt�dd|d �|d < t�dd| d �| d < W n ty� Y nw || kr�|�|� n|�|� W qh ty� |�|� Y qhw t|�dk|fS )af Return true if the provided certificate information matches the required certificate information, i.e. it has the required common name, subject alt name, organization, etc. cert_info should be a dict as returned by x509.read_certificate. required_cert_info should be a dict as returned by x509.create_certificate with testrun=True. )z Not Before� Not AfterzSHA1 Finger PrintzSHA-256 Finger Print�Issuer Public KeyZ fips_modeFzMD5 Finger PrintNz Serial Numberz!serial:([0-9A-F]{2}:)*[0-9A-F]{2}z serial:--zX509v3 ExtensionsZauthorityKeyIdentifierz Subject HashZSubjectz Issuer HashZIssuerzDirName:([^\n]+)z Dirname:--r )�copy�deepcopyr r �pop�re�sub�KeyErrorr r �strr r r6 �to_bytes�len) � cert_info�required_cert_info� check_serialZ ignored_keys�key�diffr r! Zv_extZ cert_info_extr r r �_certificate_info_matches� s� � � � � � � � � � � �rM c C s: z| d }t j �|d�t j �� jW S ty Y dS w )zV Get the days remaining on a certificate, defaulting to 0 if an error occurs. r= r r )r �strptime�now�daysrD )rH Zexpiryr r r �_certificate_days_remaining� s �� �rQ c K s` t j�| �sd| � d�i fS z�td | d�}td dddi|��}t|t�s/tj�d� |���z |d }td | |�sJd |v rAd nd }d||fW W S W n t yZ dd|f Y W S w t ||d|v d�\}} |stdd� d� | ��|fW S t |�} |dkr�| |k r�dd� | |�|fW S dd|fW S tjjy� } zd| � dt| �� �i fW Y d} ~ S d} ~ ww )z� Return True if the given certificate file exists, is a certificate, matches the given specification, and has the required days remaining. If False, also provide a message explaining why. Fz does not exist�x509.read_certificate�Z certificate�x509.create_certificateZtestrunTz7Unable to create new certificate: x509 module error: {}r> zx509.verify_signature�signing_private_keyz0Certificate is not signed by private_signing_keyz1Certificate is not signed by the requested issuerz4New certificate does not include signing informationZ serial_number)rJ z(Certificate properties are different: {}z, r zKCertificate needs renewal: {} days remaining but it needs to be at least {}� z is not a valid certificate: Nr )r% r& r' r r �dictr r( r) �formatrD rM �joinrQ rE ) r �days_remaining� append_certsZ cert_specrH rI Zissuer_public_key�errmsg�matchesrL Zactual_days_remaining�er r r �_certificate_is_valid sd �� ����� �� ��� $��r_ c C sb t d d i |��}|d | d< | d r d�| d �| d< n|d | d< |d r/d|d i| d< | S ) z� Run file.managed and merge the result with an existing return dict. The overall True/False result will be the result of the file.managed call. r4 �resultz&Certificate {} is valid and up to dater �commentr5 ZFileNr )r7 rX )r8 r Zfile_retr r r �_certificate_file_managed? s rb �Z c K sF d|v r |� d�} d|v rd|vrtj�d��d|vr)d|vr)d|vr)tj�d��| d i d d �}t| ||fi |��\}}}|rNt| fi |��\}} t||�S td r|t| fi |��\}} d |d < t||�}d|d< d| � d�|d< |dd�|d d< |S td d#ddi|��} ztd | � W n$ tjjy� } zd |d< d� | t | ��|d< |W Y d} ~ S d} ~ ww |s�g }|D ]7} ztd | d d �} | | 7 } W q� tjjy� } zd |d< d � | | t | ��|d< |W Y d} ~ S d} ~ ww t| fi |��\}} | |d < t||�}|d �r!|td | d �d�|d d!< |d"d�|d d< |S )$a� Manage a Certificate name Path to the certificate days_remaining : 90 Recreate the certificate if the number of days remaining on it are less than this number. The value should be less than ``days_valid``, otherwise the certificate will be recreated every time the state is run. A value of 0 disables automatic renewal. append_certs: A list of certificates to be appended to the managed file. They must be valid PEM files, otherwise an error will be thrown. kwargs: Any arguments supported by :py:func:`x509.create_certificate <salt.modules.x509.create_certificate>` or :py:func:`file.managed <salt.states.file.managed>` are supported. not_before: Initial validity date for the certificate. This date must be specified in the format '%Y-%m-%d %H:%M:%S'. .. versionadded:: 3001 not_after: Final validity date for the certificate. This date must be specified in the format '%Y-%m-%d %H:%M:%S'. .. versionadded:: 3001 Examples: .. code-block:: yaml /etc/pki/ca.crt: x509.certificate_managed: - signing_private_key: /etc/pki/ca.key - CN: ca.example.com - C: US - ST: Utah - L: Salt Lake City - basicConstraints: "critical CA:true" - keyUsage: "critical cRLSign, keyCertSign" - subjectKeyIdentifier: hash - authorityKeyIdentifier: keyid,issuer:always - days_valid: 3650 - days_remaining: 0 - backup: True .. code-block:: yaml /etc/ssl/www.crt: x509.certificate_managed: - ca_server: pki - signing_policy: www - public_key: /etc/ssl/www.key - CN: www.example.com - days_valid: 90 - days_remaining: 30 - backup: True r& Z ca_serverZsigning_policyz1signing_policy must be specified if ca_server is.Z public_keyrU Zcsrz:public_key, signing_private_key, or csr must be specified.FrV )r r` r5 ra �testr0 Nr` z Certificate z will be createdra z(Certificate will be valid and up to dater: r5 ZStatusrT r1 TrR z{An error occurred creating the certificate {}. The result returned from x509.create_certificate is not a valid PEM file: {}r � CERTIFICATEr/ zy{} is not a valid certificate file, cannot append it to the certificate {}. The error returned by the x509 module was: {}rS � Certificatez#Certificate is valid and up to dater ) rA r r( r) r_ r" rb r r rX rE )r rZ r[ r r8 Zis_validZinvalid_reasonZcurrent_cert_infor r r0 r^ Z append_fileZappend_file_contentsr r r �certificate_managedR s� C ��� � � ���� ���� ��rg �d rV � c K s| |du rg }t |�}d} i } tj�| �rQz,td | d�} | �� } | �d� | �d�} tj�| d�tj� � j } |dkr?| d }W n t j j yP | � d �} Y nw | � d �} td d |||||||d �}td |d�}|�� }|�d� |�d� t| fi | ��\}} d}| |kr�| |kr�td | |�r�td | dd�|d< nd }||d< td di |��}|r�| td |d�d�|d< |S )a� Manage a Certificate Revocation List name Path to the certificate signing_private_key The private key that will be used to sign the CRL. This is usually your CA's private key. signing_private_key_passphrase Passphrase to decrypt the private key. signing_cert The certificate of the authority that will be used to sign the CRL. This is usually your CA's certificate. revoked A list of certificates to revoke. Must include either a serial number or a the certificate itself. Can optionally include the revocation date and notAfter date from the certificate. See example below for details. days_valid : 100 The number of days the certificate should be valid for. digest The digest to use for signing the CRL. This has no effect on versions of pyOpenSSL less than 0.14. days_remaining : 30 The CRL should be automatically recreated if there are less than ``days_remaining`` days until the CRL expires. Set to 0 to disable automatic renewal. include_expired : False If ``True``, include expired certificates in the CRL. kwargs Any arguments supported by :py:func:`file.managed <salt.states.file.managed>` are supported. Example: .. code-block:: yaml /etc/pki/ca.crl: x509.crl_managed: - signing_private_key: /etc/pki/myca.key - signing_cert: /etc/pki/myca.crt - revoked: - compromized_Web_key: - certificate: /etc/pki/certs/badweb.crt - revocation_date: 2015-03-01 00:00:00 - reason: keyCompromise - terminated_vpn_user: - serial_number: D6:D2:DC:D8:4D:5C:C0:F4 - not_after: 2016-01-01 00:00:00 - revocation_date: 2015-02-25 00:00:00 - reason: cessationOfOperation Nr z x509.read_crl)Zcrlz Last Updatez Next Updater � z is not a valid CRL.z does not exist.zx509.create_crlT)r1 rU � signing_private_key_passphrase� signing_cert�revoked� days_valid�digest�include_expiredFzx509.verify_crlr zX509 CRLr/ r0 r4 r: r5 r )r r% r& r' r r? rA r rN rO rP r r( r) r" r7 )r rU rk rl rm rn ro rZ rp r Zcurrent_days_remainingZ current_comp�currentZcurrent_notafterZnew_crlr+ Znew_compr Znew_crl_createdr8 r r r � crl_managed� sh G ���� � � �rr c K s8 t | fi |��\}}td |d�|d< td di |��S )aC Manage the contents of a PEM file directly with the content in text, ensuring correct formatting. name: The path to the file to manage text: The PEM formatted text to write. kwargs: Any arguments supported by :py:func:`file.managed <salt.states.file.managed>` are supported. r )r1 r0 r4 Nr )r" r r7 )r r1 r r r r r r � pem_managedx s rs )r# NFF)r# Nr. FFT)F)rc N)NNNrh rV ri F) �__doc__r? r �loggingr% rB Zsalt.exceptionsr Zsalt.utils.versionsZ M2Crypto.RSAr � ImportError� getLogger�__name__�logr r r" r- r9 r< rM rQ r_ rb rg rr rs r r r r �<module> sV : � �R ,[? & �
| ver. 1.4 |
Github
|
.
| PHP 8.2.30 | Generation time: 0 |
proxy
|
phpinfo
|
Settings