File: //lib/python3.6/site-packages/ipaclient/install/__pycache__/ipa_certupdate.cpython-36.pyc
3
�d[eu' � @ s d dl mZ d dlZd dlZd dlmZ d dlmZmZ d dl m
Z
d dl m Z m
Z
mZmZ d dlmZ d dlmZ d d lmZ d d
lmZmZmZ d d lmZm Z m Z d d l m Z ej e!�Z"G d
d� de j#�Z$dd� Z%dd� Z&dd� Z'dd� Z(d dd�Z)dd� Z*dS ) � )�absolute_importN)�urlsplit)�
certmonger� certstore)�is_ipa_configured)� admintool�certdb�ipaldap�ipautil)�services)�paths)�tasks)�api�errors�x509)�FQDN�IPA_CA_NICKNAME�RENEWAL_CA_NAME)�check_client_configurationc s0 e Zd ZdZdZdZ� fdd�Zdd� Z� ZS )�
CertUpdatezipa-certupdatez%prog [options]zIUpdate local IPA certificate databases with certificates from the server.c s t t| �jdd� d S )NT)Z
needs_root)�superr �validate_options)�self)� __class__� �$/usr/lib/python3.6/ipa_certupdate.pyr 0 s zCertUpdate.validate_optionsc C s� t � tjjd�}dtjd< dtjd< zfy<tjdtjd� tj� tj j
j � t t� tj j
j
� W n$ tjk
r� tjdt� � Y nX W d |d kr�tjd= n
|tjd< X d S )NZ
KRB5CCNAMEz/etc/krb5.keytabZKRB5_CLIENT_KTNAMEzMEMORY:Z
cli_installer)�contextZconfdirz9Unable to obtain credentials for %s from /etc/krb5.keytab)r �os�environ�getr Z bootstrapr ZETC_IPA�finalizeZBackendZ rpcclientZconnect�
run_with_argsZ
disconnectr Z CCacheError�logger�errorr )r Zold_krb5ccnamer r r �run3 s$
zCertUpdate.run) �__name__�
__module__� __qualname__Z command_nameZusage� descriptionr r$ �
__classcell__r r )r r r ( s
r c C s� t | jj�j}tjj|�}y| jjdd�}|d }W n8 t j
t j fk
rl | jjddd�}|d d }Y nX |j � t
j|| jj| jj|�}|r�| jj� d }ng }t|� t� �r�| jjdd d
�}d d � |d D �}t|� d
dlm} m}
| j� j� �r.y| j|� W n t k
�r, t j d� Y nX y t | |
| jj | jj!|� W n t k
�rj t j d� Y nX t"j#j$j%� �r�t"j#j$j&� t"j#j'j%� �r�t"j#j'j&� dS )z�
Run the certupdate procedure with the given API object.
:param api: API object with ldap2/rpcclient backend connected
(such that Commands can be invoked)
z2.107)�version�resultTz2.0)�serverr* � enable_raz CA serverZenabled)Z
role_servroleZstatusc S s g | ] }|d �qS )Z
server_serverr )�.0r, r r r �
<listcomp>s s z!run_with_args.<locals>.<listcomp>r )�
cainstance�custodiainstancez.Failed to add lightweight CA tracking requestszFailed to update RA configN)(r �envZ jsonrpc_uriZhostnamer Z
LDAPClientZfrom_hostname_secureZCommandZ
ca_is_enabledr Z CommandErrorZ NetworkErrorZ gssapi_bindr Z get_ca_certsZbasedn�realmZca_find�
update_clientr Zserver_role_find�
update_serverZipaserver.installr0 r1 �
CAInstanceZ
is_configuredZ$add_lightweight_ca_tracking_requests� Exceptionr" Z exception�update_server_ra_configr- �ca_hostr �
knownservicesZhttpd�
is_running�restartZkrb5kdc) r r, Zldapr+ Z
ca_enabled�certsZlwcasZresp�
ca_serversr0 r1 r r r r! N sL r! c C s� t tj| � t tj| � t tj| � tjtjj �}xddD ]\}xV|j
|�r�y|j |� W q> t j
k
r� } ztjd||j|� P W Y d d }~X q>X q>W q8W t|j| � tj� tj| � d S )N�IPA CA�External CA certz Failed to remove %s from %s: %s)r? r@ )� update_filer Z
IPA_CA_CRTZKDC_CA_BUNDLE_PEMZ
CA_BUNDLE_PEMr � NSSDatabaser r2 Znss_dirZ has_nickname� delete_certr
�CalledProcessErrorr" r# Zsecdir� update_dbr
Z(remove_ca_certs_from_systemwide_ca_storeZ(insert_ca_certs_into_systemwide_ca_store)r= Zipa_db�nickname�er r r r4 � s
r4 c C s dj tjjjd��}ttj| | � tj j
j � r>tj j
j |� tj
ttd�}tj|�}|d k r�tjjd }tjd|� tj|dd� ytj||�}W n" tk
r� tjd| ��Y nX tj|d �}|d
ks�|r�tjd | ��tjd |� tj|d
d� t tj | � t tj | � d S )N�-�.)z
cert-databasez
cert-nicknamezca-name�< z$resubmitting certmonger request '%s'z dogtag-ipa-ca-renew-agent-reuse)�cazQResubmitting certmonger request '%s' timed out, please check the request manuallyzca-errorZ
MONITORINGzMError resubmitting certmonger request '%s', please check the request manuallyz!modifying certmonger request '%s'zdogtag-ipa-ca-renew-agent) �joinr r2 r3 �splitrE r Z"ETC_DIRSRV_SLAPD_INSTANCE_TEMPLATEr r: Zdirsrvr; r< ZPKI_TOMCAT_ALIAS_DIRr r r Zget_request_idZstartup_timeoutr" �debugZresubmit_requestZwait_for_request� RuntimeErrorr Z ScriptErrorZget_request_valueZmodifyrA ZCA_CRTZ
CACERT_PEM)r= �instanceZcriteriaZ
request_idZtimeout�stateZca_errorr r r r5 � s8
r5 c C sj t |�dkrdS |d }|sT| jj� |jtjjtjj|d�}| j|� | j |� n||krf| j |� dS )z�
After promoting a CA-less deployment to CA-ful, or after removal
of a CA server from the topology, it may be necessary to update
the default.conf ca_host setting on non-CA replicas.
r N)Z host_namer3 Z
custodia_peer)
�lenr6 Z$configure_certmonger_renewal_helpersZCustodiaInstancer r2 �hostr3 Z
import_ra_keyZupdate_ipa_conf)r0 r1 r- r9 r> Z new_ca_hostZcustodiar r r r8 � s
r8 � c C sX dd� |D �}yt j|| |d� W n0 tk
rR } ztjd| |� W Y d d }~X nX d S )Nc s s" | ]}|d dk r|d V qdS )� Fr Nr )r. �cr r r � <genexpr> s z update_file.<locals>.<genexpr>)�modezfailed to update %s: %s)r Zwrite_certificate_listr7 r" r# )�filenamer= rX rG r r r rA s
rA c C s� t j| �}x$|j� D ]\}}|jr|j|� qW xj|D ]b\}}}}tj|d|�} y|j||| � W q6 tj k
r� }
zt
j d|| |
� W Y dd}
~
X q6X q6W dS )z�Drop all CA certs from db then add certs from list provided
This may result in some churn as existing certs are dropped
and re-added but this also provides the ability to change
the trust flags.
Tz failed to update %s in %s: %sN) r rB Z
list_certsrK rC r Zkey_policy_to_trust_flagsZadd_certr
rD r" r# ) �pathr= Zdb�name�flagsZcertrF ZtrustedZekuZ trust_flagsrG r r r rE s
rE )rT )+Z
__future__r Zloggingr Z urllib.parser Zipalib.installr r Z ipalib.factsr Z ipapythonr r r r
Z ipaplatformr Zipaplatform.pathsr Zipaplatform.tasksr
Zipalibr r r Zipalib.constantsr r r Z ipalib.utilr Z getLoggerr% r" Z AdminToolr r! r4 r5 r8 rA rE r r r r �<module> s(
&I0%