File manager - Edit - /opt/saltstack/salt/lib/python3.10/site-packages/salt/states/__pycache__/x509_v2.cpython-310.pyc
Back
o ;j� � @ s� d Z ddlZddlZddlZddlZddlmZmZmZ ddl Z ddl Z ddl m Z mZ ddlmZ z ddlmZ ddlmZ ddlmZ ddlm mZ dZ W n e y\ d Z Y nw e� e �Z d Z!d d � Z" d6dd�Z# d7dd�Z$ d8dd�Z%dd� Z& d9dd�Z'dd� Z(d d � Z)d d � Z*d:d d!�Z+d"d#� Z, d;d$d%�Z-d&d'� Z.d(d)� Z/d*d+� Z0d,d-� Z1d.d/� Z2d0d1� Z3d2d3� Z4d4d5� Z5dS )<a/ Manage X.509 certificates ========================= .. versionadded:: 3006.0 This module represents a complete rewrite of the original ``x509`` modules and is named ``x509_v2`` since it introduces breaking changes. :depends: cryptography .. note:: All parameters that take a public key, private key, certificate, CSR or CRL can be specified either as a PEM/hex/base64 string or a path to a local file encoded in all supported formats for the type. Configuration instructions and general remarks are documented in the :ref:`execution module docs <x509-setup>`. For the list of breaking changes versus the previous ``x509`` modules, please also refer to the :ref:`execution module docs <x509-setup>`. About ----- This module can enable managing a complete PKI infrastructure, including creating private keys, CAs, certificates and CRLs. It includes the ability to generate a private key on a server, and have the corresponding public key sent to a remote CA to create a CA signed certificate. This can be done in a secure manner, where private keys are always generated locally and never moved across the network. Example ------- Here is a simple example scenario. In this example ``ca`` is the ca server, and ``www`` is a web server that needs a certificate signed by ``ca``. .. note:: Remote signing requires the setup of :term:`Peer Communication` and signing policies. Please see the :ref:`execution module docs <x509-setup>`. /srv/salt/top.sls .. code-block:: yaml base: '*': - cert 'ca': - ca 'www': - www This state creates the CA key, certificate and signing policy. It also publishes the certificate to the mine, where it can be easily retrieved by other minions. .. code-block:: yaml # /srv/salt/ca.sls Configure the x509 module: file.managed: - name: /etc/salt/minion.d/x509.conf - source: salt://x509.conf Restart Salt minion: cmd.run: - name: 'salt-call service.restart salt-minion' - bg: true - onchanges: - file: /etc/salt/minion.d/x509.conf Ensure PKI directories exist: file.directory: - name: /etc/pki/issued_certs - makedirs: true Create CA private key: x509.private_key_managed: - name: /etc/pki/ca.key - keysize: 4096 - backup: true - require: - file: /etc/pki/issued_certs Create self-signed CA certificate: x509.certificate_managed: - name: /etc/pki/ca.crt - signing_private_key: /etc/pki/ca.key - CN: ca.example.com - C: US - ST: Utah - L: Salt Lake City - basicConstraints: "critical, CA:true" - keyUsage: "critical, cRLSign, keyCertSign" - subjectKeyIdentifier: hash - authorityKeyIdentifier: keyid:always,issuer - days_valid: 3650 - days_remaining: 0 - backup: true - require: - x509: /etc/pki/ca.key .. code-block:: yaml # /srv/salt/x509.conf # enable x509_v2 features: x509_v2: true # publish the CA certificate to the mine mine_functions: x509.get_pem_entries: [/etc/pki/ca.crt] # define at least one signing policy for remote signing x509_signing_policies: www: - minions: 'www' - signing_private_key: /etc/pki/ca.key - signing_cert: /etc/pki/ca.crt - C: US - ST: Utah - L: Salt Lake City - basicConstraints: "critical CA:false" - keyUsage: "critical keyEncipherment" - subjectKeyIdentifier: hash - authorityKeyIdentifier: keyid:always,issuer - days_valid: 30 - copypath: /etc/pki/issued_certs/ This example state will instruct all minions to trust certificates signed by our new CA. Mind that this example works for Debian-based OS only. Also note the Jinja call to encode the string to JSON, which will avoid YAML issues with newline characters. .. code-block:: jinja # /srv/salt/cert.sls Ensure the CA trust bundle exists: file.directory: - name: /usr/local/share/ca-certificates Ensure our self-signed CA certificate is included: x509.pem_managed: - name: /usr/local/share/ca-certificates/myca.crt - text: {{ salt["mine.get"]("ca", "x509.get_pem_entries")["ca"]["/etc/pki/ca.crt"] | json }} This state creates a private key, then requests a certificate signed by our CA according to the www policy. .. code-block:: yaml # /srv/salt/www.sls Ensure PKI directory exists: file.directory: - name: /etc/pki Create private key for the certificate: x509.private_key_managed: - name: /etc/pki/www.key - keysize: 4096 - backup: true - require: - file: /etc/pki Request certificate: x509.certificate_managed: - name: /etc/pki/www.crt - ca_server: ca - signing_policy: www - private_key: /etc/pki/www.key - CN: www.example.com - days_remaining: 7 - backup: true - require: - x509: /etc/pki/www.key � N)�datetime� timedelta�timezone)�CommandExecutionError�SaltInvocationError)�STATE_INTERNAL_KEYWORDS)�UnsupportedAlgorithm)�hashesTF�x509c C s t sdS td �d�s dS tS )N)FzCould not load cryptographyZfeaturesZx509_v2)Fz�x509_v2 needs to be explicitly enabled by setting `x509_v2: true` in the minion configuration value `features` until Salt 3008 (Argon).)�HAS_CRYPTOGRAPHY�__opts__�get�__virtualname__� r r �G/opt/saltstack/salt/lib/python3.10/site-packages/salt/states/x509_v2.py� __virtual__� s r �pem�sha256c - K s� |du r |du r z t jj�dd� d}W n ty d}Y nw |du r<z t jj�dd� d}W n ty; d}Y nw d |v rMt jj�dd � |�d �}t�|�}| i d d d �}d }}i }d}tt |��\} } |plg }t |t �su|g}�z_t | fd dd�| ��} | d du r�d|d< d|d< t || � |W S d| d v r�t || � |W S | } d} td | �r�| �dd �r�tj�| �} ntd | � d } td | ��r�ztj| |d d�\}}}!}"W n tjy� d |d< Y n� tjy� d } Y n�w ||kr�||d< n|d k�r|"jj|�rt jj�|�ndk�r||d < z|j}#W n t�y. |j j t j d �}#Y nw |#t j!t j d �t"|d � k �rBd |d!< |!�pFg }!d"d#� |D �}$t#|!|$��sXd |d$< t$dK|||||| | | | | |||||d%�| ��\}%}&}'}(z|j%du�r�t |j%t&t�'|(d& ����s�||d&< W n t(�y� t)�*d'| � Y nw |�+t,||%|'|||d(�� n| |d)< | �r�| |d*< |�s�| d �r�| d+ �s�t || � |W S ||d+< |�r�|�r�d,}t-d- �r�|�r�dnd |d< |�r�d.|� d/�n|d |d< t || � |W S |�r�t.|�h d0� �s&|d k�r td1 ||||&|||d2�})nOtd1 |||d3�})nEtd4 dKi d5|�d6|�d|�d7|�d|�d8|�d |�d&|�d9|�d:|�d;| �d<| �d=| �d>| �d?| �d@|�dA|�dB|�dC|�dD|�| ��})dE|� d/�|d< |dFv�r�t | fdGdi| ��}*t ||*� t/|*||��s�|W S t0| t1�2|)�| �dHdI�� |�r�|dFv �r�t3|dFv �o�|�} | �r�|)nd}+t | f|+| dJ�| ��}*t ||*� t/|*||��s�|W S W |S W |S t4t5f�y� }, zd|d< t6|,�|d< i |d+< W Y d},~,|S d},~,ww )La� Ensure an X.509 certificate is present as specified. This function accepts the same arguments as :py:func:`x509.create_certificate <salt.modules.x509_v2.create_certificate>`, as well as most ones for :py:func:`file.managed <salt.states.file.managed>`. name The path the certificate should be present at. days_remaining The certificate will be recreated once the remaining certificate validity period is less than this number of days. Defaults to ``90`` (until v3009) or ``7`` (from v3009 onwards). ca_server Request a remotely signed certificate from ca_server. For this to work, a ``signing_policy`` must be specified, and that same policy must be configured on the ca_server. Also, the Salt master must permit peers to call the ``x509.sign_remote_certificate`` function. See the :ref:`execution module docs <x509-setup>` for details. signing_policy The name of a configured signing policy. Parameters specified in there are hardcoded and cannot be overridden. This is required for remote signing, otherwise optional. encoding Specify the encoding of the resulting certificate. It can be serialized as a ``pem`` (or ``pkcs7_pem``) text file or in several binary formats (``der``, ``pkcs7_der``, ``pkcs12``). Defaults to ``pem``. append_certs A list of additional certificates to append to the new one, e.g. to create a CA chain. .. note:: Mind that when ``der`` encoding is in use, appending certificatees is prohibited. copypath Create a copy of the issued certificate in PEM format in this directory. The file will be named ``<serial_number>.crt`` if prepend_cn is false. prepend_cn When ``copypath`` is set, prepend the common name of the certificate to the file name like so: ``<CN>-<serial_number>.crt``. Defaults to false. digest The hashing algorithm to use for the signature. Valid values are: sha1, sha224, sha256, sha384, sha512, sha512_224, sha512_256, sha3_224, sha3_256, sha3_384, sha3_512. Defaults to ``sha256``. Ignored for ``ed25519`` and ``ed448`` key types. signing_cert The CA certificate to be used for signing the issued certificate. Leave empty to create a self-signed certificate. signing_private_key The private key to be used for signing the new certificate. Required. Usually, this is the private key corresponding to the public key in ``signing_cert``. When creating self-signed certificates (missing ``signing_cert``), derives the new certificate's embedded public key from this private key. signing_private_key_passphrase If ``signing_private_key`` is encrypted, the passphrase to decrypt it. private_key A **private key**, which is used to derive the public key the certificate is issued for. If this is unset, checks ``public_key`` or ``csr`` to derive it. Ignored when creating self-signed certificates (missing ``signing_cert``). .. hint:: When ``encoding`` is ``pkcs12``, this private key is embedded into the resulting container. private_key_passphrase If ``private_key`` is specified and encrypted, the passphrase to decrypt it. public_key A **public key**, which is used as the public key the certificate is issued for, but only if ``private_key`` is **not** specified. If this is unset, checks ``csr`` to derive it. Ignored when creating self-signed certificates (missing ``signing_cert``). csr A **certificate signing request** to use as a base for generating the certificate: - Extensions not otherwise specified (arguments, signing_policy) are copied. - If ``private_key`` and ``public_key`` are both unspecified, copies the embedded public key into the certificate. This step is skipped when creating self-signed certificates (missing ``signing_cert``). subject The subject's distinguished name embedded in the certificate. This is one way of passing this information (see ``kwargs`` below for the other). This argument will be preferred and allows to control the order of RDNs in the DN as well as to embed RDNs with multiple attributes. This can be specified as a RFC4514-encoded string (``CN=example.com,O=Example Inc,C=US``, mind that the rendered order is reversed from what is embedded), a list of RDNs encoded as in RFC4514 (``["C=US", "O=Example Inc", "CN=example.com"]``) or a dictionary (``{"CN": "example.com", "C": "US", "O": "Example Inc"}``, default ordering). Multiple name attributes per RDN are concatenated with a ``+``. .. note:: Parsing of RFC4514 strings requires at least cryptography release 37. serial_number A serial number to be embedded in the certificate. If unspecified, will autogenerate one. This should be an integer, either in decimal or hexadecimal notation. not_before Set a specific date the certificate should not be valid before. The format should follow ``%Y-%m-%d %H:%M:%S`` and will be interpreted as GMT/UTC. Defaults to the time of issuance. not_after Set a specific date the certificate should not be valid after. The format should follow ``%Y-%m-%d %H:%M:%S`` and will be interpreted as GMT/UTC. If unspecified, defaults to the current time plus ``days_valid`` days. days_valid If ``not_after`` is unspecified, the number of days from the time of issuance the certificate should be valid for. Defaults to ``365`` (until v3009) or ``30`` (from v3009 onwards). pkcs12_passphrase When encoding a certificate as ``pkcs12``, encrypt it with this passphrase. .. note:: PKCS12 encryption is very weak and `should not be relied on for security <https://cryptography.io/en/stable/hazmat/primitives/asymmetric/serialization/#cryptography.hazmat.primitives.serialization.pkcs12.serialize_key_and_certificates>`_. pkcs12_encryption_compat OpenSSL 3 and cryptography v37 switched to a much more secure default encryption for PKCS12, which might be incompatible with some systems. This forces the legacy encryption. Defaults to False. pkcs12_friendlyname When encoding a certificate as ``pkcs12``, a name for the certificate can be included. kwargs Embedded X.509v3 extensions and the subject's distinguished name can be controlled via supplemental keyword arguments. See :py:func:`x509.create_certificate <salt.modules.x509_v2.create_certificate>` for an overview. N� PotassiumzYThe default value for `days_valid` will change to 30. Please adapt your code accordingly.im � z\The default value for `days_remaining` will change to 7. Please adapt your code accordingly.�Z � � algorithm�B`algorithm` has been renamed to `digest`. Please update your code.Tz'The certificate is in the correct state��name�changes�result�comment�createF��test�replacer �:Problem while testing file.managed changes, see its outputr �*is not present and is not set for creation� file.is_link�follow_symlinks� file.remove�file.file_exists�� passphrase� get_encoding�pkcs12_passphrase�encodingZpkcs12�pkcs12_friendlyname��tzinfo��tz��days� expirationc S s g | ]}t �|��qS r )�x509util� load_cert��.0�xr r r � <listcomp>� s z'certificate_managed.<locals>.<listcomp>�additional_certs)� ca_server�signing_policy�digest�signing_private_key� signing_private_key_passphrase� signing_cert� public_key� private_key�private_key_passphrase�csr�subject� serial_number� not_before� not_after� days_validr? �HCould not determine signature hash algorithm of '%s'. Continuing anyways)rB rH rI rJ �created�replacedr �recreater! z The certificate would have been �d> r< r. r- zx509.encode_certificate)� append_certsr- rD r, �pkcs12_encryption_compatr. )r- rQ zx509.create_certificater= r> rQ rR r@ rA rB rC rD rE rF rG rH rI rJ rK zThe certificate has been )r Z pkcs7_pemr" �backup� ��contentsr" r )7�salt�utils�versions� warn_until� RuntimeError�popr6 �ensure_cert_kwargs_compat�_split_file_kwargs� _filter_state_internal_kwargs� isinstance�list� _file_managed�_add_sub_state_run�__salt__r �os�path�realpathr7 �InvalidPasswordZCertDeserializationError�certZ friendly_nameZ stringutils�to_bytesZnot_valid_after_utc�AttributeErrorZnot_valid_afterr" r �utcr �nowr �_compare_ca_chain� _build_cert�signature_hash_algorithm�type�get_hashing_algorithmr �log�warning�update� _compare_certr �set�_check_file_ret�_safe_atomic_write�base64� b64decode�boolr r �str)-r �days_remainingr= r> r- rQ r? r@ rA rB rC rD rE rF rG rH rI rJ rK r, rR r. �kwargs�ret�current�current_encodingr �verb� file_argsZ cert_args�file_managed_test� real_namer" Z current_chainZ current_extraZcurr_not_afterZca_chain�builder�private_key_loadedZsigning_cert_loaded� final_kwargsri �file_managed_retrV �errr r r �certificate_managed� s� 2� �� �� � � �� � �� �� � ��������� ��� �� � � �������� � � � � �������� ���� ��� ��r� c " K s* d| v rt jj�dgd� | �d� |du r.z t jj�dd� d}W n ty- d}Y nw |du rJz t jj�dd� d}W n tyI d }Y nw g } |D ]R} i }t| �d kr{t| t t | �� t �r{t jj�dd � | t t | �� D ]}|� |� qsd |p| v r�t jj�dd � t jj �|p�| d|p�| �d �� | �|p�| � qN| }| i ddd�}d }}i }d}tt| ��\}}| p�i } |r�tdt |�� ����z&t| fddd�|��}|d du r�d|d< d|d< t||� |W S d|d v r�t||� |W S | }d}td | ��r|�dd��rtj�| �}ntd | � d}td |��r�z tj|dd �\}}W n tj �y: d}Y n�w z|j du�rRt|j t t� |����sR||d < W n t �yc t!�"d | � Y nw | |k�rm| |d!< z|j#}W n t$�y� |j%j&t'j(d"�}Y nw |�r�|t)j*t'j(d#�t+|d$� k �r�d|d%< | �d&�d'k}|�r�| �d&� tj,||||||| d(�\} } |� t-|| | �.� �� |�r�d'| d&< |d) d* �|d) d* �/d&�� t0|d) �1� ��s�|�d)� n| |d+< |�r�| |d,< |�s |d �r |d- �s t||� |W S ||d-< |�r|�rd.}t2d/ �r:|�r dnd|d< |�r,d0|� d1�n|d |d< t||� |W S |�r�t3|�d!h �sNtd2 || d3�} n8| �d&�d'k�rwz|j4�5t6j7�j8j9d | d&< W n t$t6j:f�yv d | d&< Y nw td4 |||||||| | d5� } d6|� d1�|d< | d7k�r�t| fd8di|��} t|| � t;| ||��s�|W S t<|t=�>| �|�d9d:�� |�r�| d;k�r�t?| d;k�o�|�}|�r�| nd} t| f| |d<�|��} t|| � t;| ||��s�|W S W |S W |S t@tf�y }! zd|d< tA|!�|d< i |d-< W Y d}!~!|S d}!~!ww )=a� Ensure a certificate revocation list is present as specified. This function accepts the same arguments as :py:func:`x509.create_crl <salt.modules.x509_v2.create_crl>`, as well as most ones for `:py:func:`file.managed <salt.states.file.managed>`. name The path the certificate revocation list should be present at. signing_private_key Your certificate authority's private key. It will be used to sign the CRL. Required. revoked A list of dicts containing all the certificates to revoke. Each dict represents one certificate. A dict must contain either the key ``serial_number`` with the value of the serial number to revoke, or ``certificate`` with some reference to the certificate to revoke. The dict can optionally contain the ``revocation_date`` key. If this key is omitted, the revocation date will be set to now. It should be a string in the format ``%Y-%m-%d %H:%M:%S``. The dict can also optionally contain the ``not_after`` key. This is redundant if the ``certificate`` key is included. If the ``certificate`` key is not included, this can be used for the logic behind the ``include_expired`` parameter. It should be a string in the format ``%Y-%m-%d %H:%M:%S``. The dict can also optionally contain the ``extensions`` key, which allows to set CRL entry-specific extensions. The following extensions are supported: certificateIssuer Identifies the certificate issuer associated with an entry in an indirect CRL. The format is the same as for subjectAltName. CRLReason Identifies the reason for certificate revocation. Available choices are ``unspecified``, ``keyCompromise``, ``CACompromise``, ``affiliationChanged``, ``superseded``, ``cessationOfOperation``, ``certificateHold``, ``privilegeWithdrawn``, ``aACompromise`` and ``removeFromCRL``. invalidityDate Provides the date on which the certificate became invalid. The value should be a string in the same format as ``revocation_date``. days_remaining The certificate revocation list will be recreated once the remaining CRL validity period is less than this number of days. Defaults to ``30`` (until v3009) or ``3`` (from v3009 onwards). Set to 0 to disable automatic renewal without anything changing. signing_cert The CA certificate to be used for signing the issued certificate. signing_private_key_passphrase If ``signing_private_key`` is encrypted, the passphrase to decrypt it. include_expired Also include already expired certificates in the CRL. Defaults to false. days_valid The number of days that the CRL should be valid for. This sets the ``Next Update`` field in the CRL. Defaults to ``100`` (until v3009) or ``7`` (from v3009 onwards). digest The hashing algorithm to use for the signature. Valid values are: sha1, sha224, sha256, sha384, sha512, sha512_224, sha512_256, sha3_224, sha3_256, sha3_384, sha3_512. Defaults to ``sha256``. Ignored for ``ed25519`` and ``ed448`` key types. encoding Specify the encoding of the resulting certificate revocation list. It can be serialized as a ``pem`` text or binary ``der`` file. Defaults to ``pem``. extensions Add CRL extensions. See :py:func:`x509.create_crl <salt.modules.x509_v2.create_crl>` for details. .. note:: For ``cRLNumber``, in addition the value ``auto`` is supported, which automatically increases the counter every time a new CRL is issued. Example: .. code-block:: yaml Manage CRL: x509.crl_managed: - name: /etc/pki/ca.crl - signing_private_key: /etc/pki/myca.key - signing_cert: /etc/pki/myca.crt - revoked: - certificate: /etc/pki/certs/badweb.crt revocation_date: 2022-11-01 00:00:00 extensions: CRLReason: keyCompromise - serial_number: D6:D2:DC:D8:4D:5C:C0:F4 not_after: 2023-03-14 00:00:00 revocation_date: 2022-10-25 00:00:00 extensions: CRLReason: cessationOfOperation - extensions: cRLNumber: auto �textr NzXThe default value for `days_valid` will change to 7. Please adapt your code accordingly.�d r z\The default value for `days_remaining` will change to 3. Please adapt your code accordingly.r � � zCRevoked certificates should be specified as a simple list of dicts.�reasonz\The `reason` parameter for revoked certificates should be specified in extensions:CRLReason.zextensions:CRLReasonTz7The certificate revocation list is in the correct stater r � Unrecognized keyword arguments: Fr r r# r r$ r% r& r' r( �r+ r? rL r- r/ r1 r3 r5 Z cRLNumber�auto)rB rA �include_expiredrK � extensionsr� �removedrM rN r rO r! z0The certificate revocation list would have been rP zx509.encode_crl�r- zx509.create_crl)rB rA r� rK r? r- r� z)The certificate revocation list has been �derr" rS rT r rU )BrW rX rY �kwargs_warn_untilr\ rZ r[ �lenr` �next�iterra ru Z dictupdateZset_dict_key_value�appendr^ r_ r rb rc rd r re rf rg r6 Zload_crlZCRLDeserializationErrorrp rq rr r rs rt Znext_update_utcrk Z next_updater" r rl r rm r Z build_crl� _compare_crlrC �index�any�valuesr rw r� Zget_extension_for_class�cx509Z CRLNumber�valueZ crl_number�ExtensionNotFoundrx ry rz r{ r| r r} )"r r@ �revokedr~ rB rA r� rK r? r- r� r Zrevoked_parsed�rev�parsed�valr� r� r� r r� r� � extra_argsr� r� r" Zcurr_next_updateZcrl_autor� Z sig_privkeyZcrlr� rV r� r r r � crl_managed� s� { � �� �"� ��� � �� ���� �� � � ���� �� �� � �� ���� � �� ��r� c K s� d|v rt jj�dd� |�d�}t�|�}| i ddd�}d }} i } d} tt|��\} } �z�t | fdd d �| ��}|d d u rPd |d < d |d < t ||� |W S d|d v r^t ||� |W S | }d }t d | �r}| � dd�rut j�| �}nt d | � d}t d |�r�z tj|dd�\}} W n tjy� d}Y ne tjy� d| d< d}Y nVw z|jdur�t|jtt�|���s�|| d< W n ty� t�d| � Y nw || kr�|| d< tj|f||d�| ��\}}t� |� � |�s�d| d< | � t ||�� n| | d< |�r| | d< | �s|d �r|d �st ||� |W S | |d < |�r'| �r'd } t d �rL| �r1dnd|d < | �r>d | � d �n|d |d < t ||� |W S | �r�t!| �dh �s`t d! ||d"�}nt d# |f||||d$�| ��}d%| � d �|d < |d&k�r�t | fd'd i| ��}t ||� t"|||��s�|W S t#|t$�%|�| � d(d)�� | �r�|d*k�r�t&|d*k�o�| �}|�r�|nd}t | f||d+�| ��}t ||� t"|||��s�|W S W |S W |S t't(f�y� } zd |d < t)|�|d < i |d < W Y d}~|S d}~ww ),a� Ensure a certificate signing request is present as specified. This function accepts the same arguments as :py:func:`x509.create_csr <salt.modules.x509_v2.create_csr>`, as well as most ones for :py:func:`file.managed <salt.states.file.managed>`. name The path the certificate signing request should be present at. private_key The private key corresponding to the public key the certificate should be issued for. The CSR will be signed by it. Required. private_key_passphrase If ``private_key`` is encrypted, the passphrase to decrypt it. digest The hashing algorithm to use for the signature. Valid values are: sha1, sha224, sha256, sha384, sha512, sha512_224, sha512_256, sha3_224, sha3_256, sha3_384, sha3_512. Defaults to ``sha256``. Ignored for ``ed25519`` and ``ed448`` key types. encoding Specify the encoding of the resulting certificate revocation list. It can be serialized as a ``pem`` text or binary ``der`` file. Defaults to ``pem``. kwargs Embedded X.509v3 extensions and the subject's distinguished name can be controlled via supplemental keyword arguments. See :py:func:`x509.create_certificate <salt.modules.x509_v2.create_certificate>` for an overview. Mind that some extensions are not available for CSR (``authorityInfoAccess``, ``authorityKeyIdentifier``, ``issuerAltName``, ``crlDistributionPoints``). r r r Tz7The certificate signing request is in the correct stater Nr Fr r r# r r$ r% r& r' r( r� Zinvalid_versionr? rL r- )rE rG rD rM rN r rO r! z0The certificate signing request would have been rP zx509.encode_csrr� zx509.create_csr)rE r? r- rG z)The certificate signing request has been r� r" rS rT r rU )*rW rX rY rZ r\ r6 r] r^ r_ rb rc rd r re rf rg Zload_csrZCSRDeserializationErrorr� ZInvalidVersionrp r` rq rr r rs rt Z build_csrZis_pairrC ru � _compare_csrr rw rx ry rz r{ r| r r r} )r rD rE r? r- rG r r� r� r� r r� r� Zcsr_argsr� r� r" r� ZprivkeyrF r� rV r� r r r � csr_managed� s -� � � �� �� ���� ���� �� ��� ���� ��� ��r� c K s� t |�\}}|rtdt|�� ���z td |d�|d< W n ttfy9 } z| dt|�i d�W Y d}~S d}~ww t| fi |��S )aK Manage the contents of a PEM file directly with the content in text, ensuring correct formatting. name The path to the file to manage. text The PEM-formatted text to write. kwargs Most arguments supported by :py:func:`file.managed <salt.states.file.managed>` are passed through. r� zx509.get_pem_entry)r� rV F)r r r r N)r^ r ra rd r r} rb )r r� r r� r� r� r r r � pem_managed� s ��r� �rsac K sv d|v rt jj�dd� |�d�}h d��|�} | r,t jj�| d� | D ]} |�| � q$| i ddd�} d } } i }d }t|�\}}|rLtd t |�� ���|� d �s[t jj � � s[d |d < �z:|rj|d v rjtd|� ���t | fddd�|��}|d du r�d| d< d| d< t| |� | W S d|d v r�t| |� | W S | }d}td | �r�|� dd�r�tj�| �}ntd | � d}td |�}|�rE|�sEz tj||dd�\} } }W ns tjy� d|d< tj|ddd�\} } }Y n[ tj�y } z|s�td�|�d|d< W Y d}~nAd}~w tj�y' } z|�std �|�d|d< W Y d}~n"d}~w tj�yD } z|�s8td �|�d}W Y d}~nd}~ww | �r�t�| �}|}|du �rc|d k�r\d }n|d k�rcd!}t|d k�oo|tj j k |d k�oz|tj j k |d"k�o�|tj j k |d#k�o�|tj j k f��r�||d$< d$|v�r�|d%v �r�| j!|k�r�||d&< || k�r�||d'< n|�r�|�r�| |d(< n| |d)< |�s�|d �r�|d* �s�t| |� | W S || d*< |�r�|�r�d+}t"d, �r |�r�dnd| d< |�r�d-|� d.�n| d | d< t| |� | W S |�r_t#|�d'dh �s!td/ | ||d0�}n td1 |||||d2�}d3|� d.�| d< |d4k�r_t | fd5di|��}t| |� t$|| | ��sR| W S t%|t&�'|�|� d6d7�� |�rg|d4k�r�t(|d4k�on|�}|�ru|nd} t | f| |d8�|��}t| |� t$|| | ��s�| W S W | S W | S ttf�y� } zd| d< t)|�| d< i | d*< W Y d}~| S d}~ww )9a Ensure a private key is present as specified. This function accepts the same arguments as :py:func:`x509.create_private_key <salt.modules.x509_v2.create_private_key>`, as well as most ones for :py:func:`file.managed <salt.states.file.managed>`. .. note:: If ``mode`` is unspecified, it will default to ``0400``. name The path the private key should be present at. algo The digital signature scheme the private key should be based on. Available: ``rsa``, ``ec``, ``ed25519``, ``ed448``. Defaults to ``rsa``. keysize For ``rsa``, specifies the bitlength of the private key (2048, 3072, 4096). For ``ec``, specifies the NIST curve to use (256, 384, 521). Irrelevant for Edwards-curve schemes (``ed25519``, ``ed448``). Defaults to 2048 for RSA and 256 for EC. passphrase If this is specified, the private key will be encrypted using this passphrase. The encryption algorithm cannot be selected, it will be determined automatically as the best available one. encoding Specify the encoding of the resulting private key. It can be serialized as a ``pem`` text, binary ``der`` or ``pkcs12`` file. Defaults to ``pem``. new Always create a new key. Defaults to false. Combining new with :mod:`prereq <salt.states.requisites.prereq>` can allow key rotation whenever a new certificate is generated. overwrite Overwrite an existing private key if the provided passphrase cannot decrypt it. Defaults to false. pkcs12_encryption_compat Some operating systems are incompatible with the encryption defaults for PKCS12 used since OpenSSL v3. This switch triggers a fallback to ``PBESv1SHA1And3KeyTripleDESCBC``. Please consider the `notes on PKCS12 encryption <https://cryptography.io/en/stable/hazmat/primitives/asymmetric/serialization/#cryptography.hazmat.primitives.serialization.pkcs12.serialize_key_and_certificates>`_. Example: The Jinja templating in this example ensures a new private key is generated if the file does not exist and whenever the associated certificate is to be renewed. .. code-block:: jinja Manage www private key: x509.private_key_managed: - name: /etc/pki/www.key - keysize: 4096 - new: true {%- if salt["file.file_exists"]("/etc/pki/www.key") %} - prereq: - x509: /etc/pki/www.crt {%- endif %} �bitsr z>`bits` has been renamed to `keysize`. Please update your code.> �verboser� �cipherTz'The private key is in the correct stater Nr r� �modeZ0400)�ed25519�ed448z$keysize is an invalid parameter for Fr r r# r r$ r% r& r' r( r) r* zbThe provided passphrase cannot decrypt the private key. Pass overwrite: true to force regenerationz]The existing file is encrypted. Pass overwrite: true to force regeneration without passphrasez�The existing file does not seem to be a private key formatted as DER, PEM or embedded in PKCS12. Pass overwrite: true to force regenerationr� i �ec� r� r� �algo)r� r� �keysizer- rN rM r rO r! z The private key would have been rP zx509.encode_private_key)r* r- zx509.create_private_key)r� r� r* r- rR zThe private key has been r r" rS rT rU )*rW rX rY rZ r\ � intersectionr� r^ r ra r �platformZ is_windowsrb rc rd re rf rg r6 Z load_privkeyZSuperfluousPasswordrh r ZMissingPasswordZPrivDeserializationErrorZ get_key_typer� ZKEY_TYPEZRSAZECZED25519ZED448Zkey_sizer rw rx ry rz r{ r| r} ) r r� r� r* r- �newZ overwriterR r Zignored_paramsr: r� r� r� r r� r� r� r� r� r" Z file_exists�_r� Zkey_typeZ check_keysize�pkr� rV r r r �private_key_managed� s^ N� � � � ������������ �� � ��� �� �� ���� � �� ��r� c s$ t t�dh � � fdd�| �� D �S )N� check_cmdc s i | ] \}}|� vr||�qS r r )r9 �k�v��ignorer r � <dictcomp>� s z1_filter_state_internal_kwargs.<locals>.<dictcomp>)rw �_STATE_INTERNAL_KEYWORDS�items)r r r� r r_ � s r_ c C sH g d�}ddi}i }| � � D ]\}}||v r|||< q|||< q||fS )N)�user�groupr� �attrs�makedirsZdir_moderS r r& r� Ztmp_dirZtmp_extZselinuxr- Zencoding_errorsZ win_ownerZ win_permsZwin_deny_permsZwin_inheritanceZwin_perms_resetZ show_changesF)r� )r Zvalid_file_argsr� r� r� r� r r r r^ � s r^ c C s< | d dt d dd�|d< d| vrg | d< | d �|� d S )Nr �file�__id__Zmanaged)r �stater� Zfun�lowZ sub_state_run)Z__low__r� )r� �subr r r rc s �rc c K s` |dvrt d��|p td }td d| f|dd�|��}t|t�s(td|� ���|tt|�� S ) N)NTz#test param can only be None or Truer! z state.singlez file.managedT)r! Z concurrentz.Failed running file.managed in x509_v2 state: )r r rd r` �dictr r� r� )r r! r �resr r r rb s ��� �rb c C s< | d du r d|d< d|sdnd� d�|d< i |d< dS d S ) Nr Fz Could not r ru z file, see file.managed outputr r Tr )Zfretr� r� r r r rx * s �rx c K sb t �|�}||d< t�td || d�|� |�d�}tj|fd| d ui|��\}}}}||||fS )Nr@ zx509.get_signing_policy)r= Z skip_load_signing_private_key)�copy�deepcopyr6 Zmerge_signing_policyrd r\ Z build_crt) r= r> r@ r r� r� r� r� rB r r r ro 5 s � ��� ro c C s� i }|d urt |d�| jkr||d< t�t |d�| �� �s!d|d< |r/t�| |�� �s/d|d< t |d�| jkr@t |d��� |d< t |d �| jkrQt |d ��� |d < t | |�}t |� � �r`||d < |S ) NZ_serial_numberrH Z _public_keyTrD r@ � _subject_name� subject_name� _issuer_name� issuer_namer� ) � _getattr_saferH r6 Z match_pubkeyrC Zverify_signaturerG �rfc4514_string�issuer� _compare_extsr� r� )r� r� rB rH rI rJ r � ext_changesr r r rv H s0 ���� rv c C sF i }t |d| j�st|d��� |d< t| |�}t|�� �r!||d< |S )Nr� r� r� )�_compareattr_saferG r� r� r� r� r� )r� r� r r� r r r r� i s �� r� c C s� dd� }dd� }i }t |d�| jkrt |d��� |d< | �|�s$d|d< g g g d �}t |d �}|D ][}| �|j�} | d u rI|d �t�|j�� q1|j D ]%} || j | j �} t | d u | j | j k| j | j kf�rq|d �t�|j�� qL| j D ]} ||j | j �d u r�|d �t�|j�� quq1| D ]}|||j�d u r�|d �t�|j�� q�t |�� �r�||d< t| |�} t | �� �r�| |d< |S )Nc �. z � fdd�| D �d W S t y Y d S w )Nc � g | ] }|j � kr|�qS r )rH r8 ��serialr r r; | � zS_compare_crl.<locals>._get_revoked_certificate_by_serial_number.<locals>.<listcomp>r �� IndexError)r� r� r r� r �)_get_revoked_certificate_by_serial_numberz � �z?_compare_crl.<locals>._get_revoked_certificate_by_serial_numberc r� )Nc r� r ��oidr8 r� r r r; � r� z@_compare_crl.<locals>._get_extension_for_oid.<locals>.<listcomp>r r� )r� r� r r� r �_get_extension_for_oid� r� z,_compare_crl.<locals>._get_extension_for_oidr� r� TrC ��added�changedr� Z_revoked_certificatesr� r� r� Z revocationsr� )r� r� r� Zis_signature_validZ(get_revoked_certificate_by_serial_numberrH r� r6 Zdec2hexr� r� r� �criticalr� r� r� ) r� r� Z sig_pubkeyr� r� r Z rev_changesr� r� Zcur�ext�cur_extr� r r r r� x sR ��� �� �� r� c C s� dd� }g }g }g }t �t|d��}t|�D ]0}z | j�|jj�}|j|jks-|j|jkr4|� ||�� W q t j yF |� ||�� Y qw | jD ] }z |�|jj� W qJ t j yf |� ||�� Y qJw |||d�S )Nc S s& z| j jW S ty | j j Y S w �N)r� �_namerk Z dotted_string)r� r r r � getextname� s �z!_compare_exts.<locals>.getextnameZ _extensionsr� ) r� Z Extensionsr� r� r� Zget_extension_for_oidr� r� r� r� r� ) r� r� r� r� r� r� Zbuilder_extensionsr� r� r r r r� � s* �� � r� c C sP t | �t |�ks dS t|�D ]\}}|�t�� �| | �t�� �kr% dS qdS )NFT)r� � enumerateZ fingerprintr �SHA256)r� r� �iZnew_certr r r rn � s ��rn c C sB zt | |�W S ty } ztd|� d| jj� d��|�d }~ww )NzCould not get attribute z from z.. Did the internal API of cryptography change?)�getattrrk r � __class__�__name__)�obj�attrr� r r r r� � s ����r� c C s& zt | |�|kW S ty Y dS w )NF)r� rk )r� r� �compr r r r� � s �r� c C s� t jjjt jjjd�}t jj�|d�� }|�|� W d � n1 s#w Y t jj�|| td |�t d � t jj� |� dS )z~ Create a temporary file with only user r/w perms and atomically copy it to the destination, honoring ``backup``. )�prefix�wbNzconfig.backup_modeZcachedir) rW rX �filesZmkstempZTEMPFILE_PREFIXZfopen�write�copyfilerd r Zsafe_rm)�dst�datarS �tmpZtmp_r r r ry � s ��ry )NNNr Nr NNNNNNNNNNNNNFN)NNNFNr r N)Nr r N)r� NNr FFFr� )NNN)6�__doc__rz r� �loggingZos.pathre r r r Zsalt.utils.filesrW Zsalt.utils.platformZsalt.exceptionsr r Z salt.stater r� Zcryptography.x509r r� Zcryptography.exceptionsr Z cryptography.hazmat.primitivesr Zsalt.utils.x509rX r6 r � ImportError� getLoggerr� rs r r r� r� r� r� r� r_ r^ rc rb rx ro rv r� r� r� rn r� r� ry r r r r �<module> s� 8 � � > � f � J � ! �!@
| ver. 1.4 |
Github
|
.
| PHP 8.2.30 | Generation time: 0 |
proxy
|
phpinfo
|
Settings