File: //usr/lib/python3.6/site-packages/ipalib/install/__pycache__/certstore.cpython-36.opt-1.pyc
3
�d[e�8 � @ s� d Z ddlmZ ddlmZ ddlmZmZ ddlm Z m
Z
ddl m Z dd� Z
d d
� Zd d � Zd
d� Zd%dd�Zd&dd�Zd'dd�Zdd� Zd(dd�Zdd � Zd d � Zd)d d �Zd*d!d"�Zd#d$� ZdS )+z
LDAP shared certificate store.
� )� PyAsn1Error)�DN)�get_ca_nickname�
TrustFlags)�errors�x509)� IPA_CA_CNc C s� y$t | j�}t | j�}| j}| j}W n2 ttfk
rV } ztd| ��W Y d d }~X nX t|�jdd�}t|�jdd�}d||f }|||fS )Nz failed to decode certificate: %sz\;z\3bz%s;%s) r �subject�issuer�
serial_numberZpublic_key_info_bytes�
ValueErrorr �str�replace)�certr r
r Zpublic_key_info�e�
issuer_serial� r � /usr/lib/python3.6/certstore.py� _parse_cert! s
r c
C s t |�\}}}|dk r�y
|j}W n. tk
rN } ztd| ��W Y dd} ~ X nX |dk r�|tjtjtjtjtjtj h8 }||B }dddg| d< |g| d< |g| d< |g| d < |g| d
< |g| d < |dk r�|r�d nd
g| d< |dk �rt
|�}|s�|j tj � || d< dS )zB
Initialize certificate store entry for a CA certificate.
Nz failed to decode certificate: %sZipaCertificate�pkiCAZ ipaKeyPolicy� objectClass�cn�ipaCertSubject�ipaCertIssuerSerial� ipaPublicKeyzcACertificate;binary�trusted�
distrusted� ipaKeyTrust�ipaKeyExtUsage) r Zextended_key_usager r �EKU_SERVER_AUTH�EKU_CLIENT_AUTH�EKU_EMAIL_PROTECTION�EKU_CODE_SIGNINGZEKU_ANY�EKU_PLACEHOLDER�list�append)
�entryr �nicknamer �
ext_key_usager r �
public_keyZcert_ekur r r r �
init_ca_entry1 s0
r* c C s� t d d d
|�}y(| j|dgd�}||jd< | j|� W n^ tjk
r� | j|�}ddg|d < d|jd< ||jd< | j|� Y n tjk
r� Y nX d
S )zF
Update the CA certificate in cn=CAcert,cn=ipa,cn=etc,SUFFIX.
r �CAcert�ipa�etczcACertificate;binary)�
attrs_listZ nsContainerr r N)r r+ )r r, )r r- ) r � get_entry� single_value� update_entryr �NotFound�
make_entry� add_entry� EmptyModlist)�ldap�base_dnr �dnr& r r r �update_compat_caS s
r9 c C s� | r| rdS y$| j td d d
|�ddgd�\}}W n tjk
rJ dS X x�|D ]�}|j|krbqRxRt|d �D ]B}|j� d kr�|r�|d j|� qp|j� d
krp|rp|d j|� qpW y| j|� W qR tj k
r� Y qRX qRW dS )zG
Remove ipaCA and compatCA flags from their previous carriers.
Nr � certificatesr, r- z4(|(ipaConfigString=ipaCA)(ipaConfigString=compatCA))�ipaConfigString)r7 �filterr. �ipaca�compatca)r r: )r r, )r r- )
� find_entriesr r r2 r8 r$ �lower�remover1 r5 ) r6 r7 r8 �
config_ipa�
config_compat�result�
_truncatedr& �configr r r �clean_old_configf s,
rG NFc C s� t d d
d |�}t d|f|�} | j| �}
t|
||||� |rL|
jdg �jd� |rb|
jdg �jd� |rrt| ||� | j|
� t| || ||� dS ) zF
Add new entry for a CA certificate to the certificate store.
r r: r, r- r; �ipaCA�compatCAN)r r: )r r, )r r- )r r3 r* �
setdefaultr% r9 r4 rG ) r6 r7 r r' r r( rB rC � container_dnr8 r& r r r � add_ca_cert� s
rL c C s0 t |�\}}} | jd|i�}
| jtddd |�|
dddddd d
d gd �\} } | d
}
|
j}xj|
d D ]}||krbP qbW |
jd j� |j� kr�td��|
jd | kr�td��|
d j|� |
d j|� |dk �r|
jj d�}|r�dnd}|dk �r|j� |k�rtd��||
jd< |dk �rh|dk �rtt
|
j d g ��}|j t j
� ||B }|�sZ|jt j
� t|�|
d < n |
jd d� d}d}x<|
j d
g �D ],}|j� dk�r�d}n|j� dk�r�d}�q�W |�r�| �r�|
jd
g �jd� |�r�| �r�|
jd
g �jd� |�s|�rt| ||� | j|
� t| ||||� dS ) zN
Update existing entry for a CA certificate in the certificate store.
r r r: r, r- r r r r r; zcACertificate;binary)r7 r< r. r zsubject name mismatchz subject public key info mismatchNr r zinconsistent trustFr= Tr> rH rI )r r: )r r, )r r- )r � make_filterr? r r8 r0 r@ r r% �get�set�discardr r# �addr$ �poprJ r9 r1 rG )r6 r7 r r r( rB rC r r r) r< rD rE r& r8 Zold_certZ old_trustZ new_trustZold_ekuZnew_ekuZis_ipaZ is_compatrF r r r �update_ca_cert� sd
rS c C sb yt | ||||||d� W nB tjk
rH t| |||||||d� Y n tjk
r\ Y nX dS )zm
Add or update entry for a CA certificate in the certificate store.
:param cert: IPACertificate
)rB rC N)rS r r2 rL r5 )r6 r7 r r' r r( rB rC r r r � put_ca_cert� s rT c
C s� g }xv| D ]n}t |�\}}}t|�}|dk rV|t|�krVt|�}tjtjtjtjh} nt|�}tjh} |j ||d| f� q
W |S )zO
Make CA certificates and associated key policy from DER certificates.
NT)
r r r r r r r! r" r
r% )
�certsZrealmZipa_ca_subjectrD r r �_issuer_serial�_public_key_infor' r( r r r �make_compat_ca_certs� s
rX c C sP |dk r&t |t�s|g}dd� |D �}g }td d |�}td |�}�y$dd g}|rh| jd
|i�} |j| � | j|| j|| j�dd
d d d
ddgd�\}
} x�|
D ]�} | jd }
| jj d
d�j
� }|dkr�d}n|dkr�d}nd}| j d�}|dk �r t dd� |D ��}|j t
j� xR| j dg �D ]B}y t|� W n tk
�rF g }P Y nX |j||
||f� �qW q�W W n� tjk
�r4 y| j|dg� W n� tjk
�r. td |�}| j|dg�} | jd }yt|�\}}}W n tk
�r� Y n@X |dk �r ||k�r tjdd��|�r|}nd}t|g||�}Y nX Y nX |�r@|S tjd d��dS )!zS
Get CA certificates and associated key policy from the certificate store.
Nc S s g | ]}t |�jd d��qS )z\;z\3b)r
r )�.0Zsubjr r r �
<listcomp> s z get_ca_certs.<locals>.<listcomp>r r, r- r: z (objectClass=ipaCertificate)z(objectClass=pkiCA)r r r r r zcACertificate;binary)r7 r< r. �unknownr Tr Fc s s | ]}t |�V qd S )N)r
)rY �pr r r � <genexpr>3 s z get_ca_certs.<locals>.<genexpr>� r+ zno matching entry found)�reasonz
no such entry)r r, )r r- )r r: )r r+ )�
isinstancer$ r rM r% r? Zcombine_filtersZ MATCH_ALLr0 rN r@ rO rP r r# r r r r2 r/ rX )r6 r7 � compat_realm�
compat_ipa_ca�filter_subjectrU Z config_dnrK �filtersr< rD rE r& r' r r( r r8 r rV rW Z
ca_subjectr r r � get_ca_certs
st
re c C s | dd� S )zG
Convert certutil trust flags to certificate store key policy.
� Nr )� trust_flagsr r r �trust_flags_to_key_policyZ s rh c C s t d| ||�S )zG
Convert certificate store key policy to certutil trust flags.
F)r )r �car( r r r �key_policy_to_trust_flagsa s rj c
C s8 t |�\}}} |dkr td��t| ||||| ||� dS )zm
Add or update entry for a CA certificate in the certificate store.
:param cert: IPACertificate
Fzmust be CA certificateN)rh r rT )
r6 r7 r r' rg rB rC r ri r( r r r �put_ca_cert_nssh s
rk c C sL g }t | ||||d�}x0|D ](\}}} }
t| d|
�} |j||| f� q W |S )zT
Get CA certificates and associated trust flags from the certificate store.
)rc T)re rj r% ) r6 r7 ra rb rc Z nss_certsrU r r' r r( rg r r r �get_ca_certs_nssw s
rl c C sb t dtf||�}y| j|�d d }W n6 tjk
r\ | j� }|jd�d }t d|�}Y nX |S )z2
Look for the IPA CA certificate subject.
r Zipacasubjectdnr Zipacertificatesubjectbase�CN�Certificate Authority)rm rn )r r r/ r r2 Zget_ipa_configrN )r6 Z container_car7 r8 Zcacert_subjectZattrsZ subject_baser r r �get_ca_subject� s ro )NNFF)NNFF)NNFF)N)FF)N)�__doc__Z pyasn1.errorr Z ipapython.dnr Zipapython.certdbr r Zipalibr r Zipalib.constantsr r r* r9 rG rL rS rT rX re rh rj rk rl ro r r r r �<module> s, "
F
L