Current File : //lib/python2.7/site-packages/salt/runners/venafiapi.pyc
�
���^c @@ s d Z d d l m Z m Z m Z d d l Z d d l Z d d l Z y d d l m Z e
Z WnO e k
r� e
Z y d d l m Z Wq� e k
r� d d l m Z q� Xn Xd d l Z d d l j Z d d l Z d d l Z d d l Z d d l m Z d d l m Z d Z e j e � Z d � Z d � Z d
� Z! d d d d � Z# d d d d d d d d
� Z$ d d d d d d d d d d d �
Z% e% Z& d � Z' d � Z( d � Z) d � Z* d � Z+ d � Z, d � Z- d � Z. e. Z/ d � Z0 d � Z1 d � Z2 d � Z3 d S( u@
Support for Venafi
Before using this module you need to register an account with Venafi, and
configure it in your ``master`` configuration file.
First, you need to add a placeholder to the ``master`` file. This is because
the module will not load unless it finds an ``api_key`` setting, valid or not.
Open up ``/etc/salt/master`` and add:
.. code-block:: yaml
venafi:
api_key: None
Then register your email address with Venafi using the following command:
.. code-block:: bash
salt-run venafi.register <youremail@yourdomain.com>
This command will not return an ``api_key`` to you; that will be sent to you
via email from Venafi. Once you have received that key, open up your ``master``
file and set the ``api_key`` to it:
.. code-block:: yaml
venafi:
api_key: abcdef01-2345-6789-abcd-ef0123456789
i ( t absolute_importt print_functiont unicode_literalsN( t RSA( t CommandExecutionError( t sixu venafic C@ s# t j d i � j d � r t St S( u5
Only load the module if venafi is installed
u venafiu api_key( t __opts__t gett __virtualname__t False( ( ( s: /usr/lib/python2.7/site-packages/salt/runners/venafiapi.pyt __virtual__> s c C@ s t j d i � j d d � S( u
Return the base_url
u venafiu base_urlu https://api.venafi.cloud/v1( R R ( ( ( s: /usr/lib/python2.7/site-packages/salt/runners/venafiapi.pyt _base_urlG s c C@ s t j d i � j d d � S( u
Return the API key
u venafiu api_keyu ( R R ( ( ( s: /usr/lib/python2.7/site-packages/salt/runners/venafiapi.pyt _api_keyP s u defaultc @ s t d d j t � | � d d d t d d d i t � d 6d
d 6�} | d d
} t d d j t � | � d d d t d d d i t � d 6d
d 6�} | d d } xK | D]C } | d d k r� | d } | d d } | d d d }
q� q� Wt |
� d k rd }
n | d k rt r]t j |
d � } | j d d d � f d � � } n$ t j
d |
� } | j d � � } | d" k rd }
t
j j t t j � } y* | j |
| � } | | d <| | d! <Wn% t k
r�i | d 6| d! 6} n X| j |
| | � qn | S(# u�
Generate and return an private_key. If a ``dns_name`` is passed in, the
private_key will be cached under that name. The type of key and the
parameters used to generate the key are based on the default certificate
use policy associated with the specified zone.
CLI Example:
.. code-block:: bash
salt-run venafi.gen_key <minion_id> [dns_name] [zone] [password]
u
http.queryu {0}/zones/tag/{1}t methodu GETt decodet decode_typeu jsont header_dictu tppl-api-keyu application/jsonu Content-Typeu dictu idu" {0}/certificatepolicies?zoneId={1}u certificatePoliciesu certificatePolicyTypeu CERTIFICATE_USEu keyTypesi u keyTypeu
keyLengthsi u RSAi t cipheru des_ede3_cbct callbackc @ s
t j � � S( N( R t b( t x( t password( s: /usr/lib/python2.7/site-packages/salt/runners/venafiapi.pyt <lambda>� s t bitsu PEMu venafi/domainsu private_keyu minion_idN( t __utils__t formatR t TrueR t intt HAS_M2R t gen_keyt as_pemt generatet exportKeyt Nonet saltt cachet CacheR t syspathst CACHE_DIRt fetcht TypeErrort store( t minion_idt dns_namet zoneR t qdatat zone_idt policiest policyt keyTypest keygen_typet key_lent gent private_keyt bankR# t data( ( R s: /usr/lib/python2.7/site-packages/salt/runners/venafiapi.pyR W sV
$
c C@ s� t j � } t j | d � d }
t j j t t j � } | j
|
| � } | d k ra i } n d | k r� t | | | | � | d <n d j
| � }
d j
| � } t j j j |
d � �' } | j t j j j | d � � Wd QX| d k rt j d i � j d � } n | d k r<t j d i � j d
� } n | d k rft j d i � j d � } n | d k r�t j d i � j d � } n | d k r�t j d i � j d
� } n d j
| | | | | | � } d j
|
| | � } | d k r| d j
| � 7} n t d d | � } d | k r=t d � � n t j j j | d � �" } t j j j | j � � } Wd QX| | d <| | d <| j |
| | � | S( uE
Generate a csr using the host's private_key.
Analogous to:
.. code-block:: bash
VCert gencsr -cn [CN Value] -o "Beta Organization" -ou "Beta Group" -l "Palo Alto" -st "California" -c US
CLI Example:
.. code-block:: bash
salt-run venafi.gen_csr <minion_id> <dns_name>
i� u venafi/domainsu private_keyu {0}/privu {0}/csru wNu venafiu countryu stateu locu orgu org_unitu' /C={0}/ST={1}/L={2}/O={3}/OU={4}/CN={5}u6 openssl req -new -sha256 -key {0} -out {1} -subj '{2}'u -passin pass:{0}u salt.cmdu cmd.runu# problems making Certificate Requestu� There was a problem generating the CSR. Please ensure that you have the following variables set either on the command line, or in the venafi section of your master configuration file: country, state, loc, org, org_unitu ru minion_idu csr( t tempfilet mkdtempt ost chmodR" R# R$ R R% R& R' R! R R t utilst filest fopent writet stringutilst to_strR t __salt__R t
to_unicodet readR) ( R* R+ R, t countryt statet loct orgt org_unitR t tmpdirR6 R# R7 t tmpprivt tmpcsrt if_t subjectt cmdt outputt of_t csr( ( s: /usr/lib/python2.7/site-packages/salt/runners/venafiapi.pyt gen_csr� s\ & !
u USu
Californiau Palo Altou Beta Organizationu
Beta Groupc C@ s* | d% k r1 | j d � r1 t d | � } q1 n |
d% k r[ t j d i � j d � }
n |
d% k r� | d% k r� t | � }
n |
d% k r� t d � � n t | | | | � } t | | d | d | d | d | d
| d | d | �} t j
j j i |
d
6| d 6� }
t
d d j t � � d d d |
d t d d d i t � d 6d d 6�} | d d d d } i | d 6| d 6| d! 6| d" 6} d# } t j j t t j � } | j | | � } | d% k r�i } n | j i | d$ 6| d 6| d 6| d" 6| d! 6� | j | | | � t | | � | S(& u
Request a new certificate
Uses the following command:
.. code-block:: bash
VCert enroll -z <zone> -k <api key> -cn <domain name>
CLI Example:
.. code-block:: bash
salt-run venafi.request <minion_id> <dns_name>
u sdb://u sdb.getu venafiu zone_idu� Either a zone or a zone_id must be passed in or configured in the master file. This id can be retreived using venafi.show_company <domain>R, RE RF RG RH RI R u zoneIdu certificateSigningRequestu
http.queryu {0}/certificaterequestsR
u POSTR7 R R u jsonR u tppl-api-keyu application/jsonu Content-Typeu dictu certificateRequestsi u idu
request_idu private_keyu csru zoneu venafi/domainsu minion_idN( R! t
startswithRB R R t get_zone_idR R RS R" R< t jsont dumpsR R R R R R# R$ R% R& R' t updateR) t _id_map( R* R+ R, t
request_idRE RF RG RH RI R R. R5 RR t pdataR- t retR6 R# R7 ( ( s: /usr/lib/python2.7/site-packages/salt/runners/venafiapi.pyt request sj
c C@ s{ d } t j j t t j � } | j | | � } t | t � sH g } n | | k rd | j | � n | j
| | | � d S( uA
Maintain a relationship between a minion and a dns name
u venafi/minionsN( R" R# R$ R R% R& R' t
isinstancet listt appendR) ( R* R+ R6 R# t dns_names( ( s: /usr/lib/python2.7/site-packages/salt/runners/venafiapi.pyRY p s c C@ s� t d d j t � � d d d t j j j i | d 6d d 6� d t d
t d d d
i d d 6�} | d } t j | � j
d � s� t j | � j
d � r� t d j | d � � � n | j d i � S( u�
Register a new user account
CLI Example:
.. code-block:: bash
salt-run venafi.register email@example.com
u
http.queryu {0}/useraccountsR
u POSTR7 u usernameu APIu userAccountTypet statusR R u jsonR u application/jsonu Content-Typeu statusu 4u 5u There was an API error: {0}u erroru dict(
R R R R" R< RV RW R R t text_typeRT R R ( t emailR7 Rb ( ( s: /usr/lib/python2.7/site-packages/salt/runners/venafiapi.pyt register~ s
0c C@ s� t d d j t � | � d t d t d d d i t � d 6�} | d } t j | � j d
� s{ t j | � j d � r� t d j | d
� � � n | j d i � S( u�
Show company information, especially the company id
CLI Example:
.. code-block:: bash
salt-run venafi.show_company example.com
u
http.queryu {0}/companies/domain/{1}Rb R R u jsonR u tppl-api-keyu statusu 4u 5u There was an API error: {0}u erroru dict(
R R R R R R Rc RT R R ( t domainR7 Rb ( ( s: /usr/lib/python2.7/site-packages/salt/runners/venafiapi.pyt show_company� s
0c C@ s� t d d j t � � d t d t d d d i t � d 6�} | d } t j | � j d
� sx t j | � j d � r� t d j | d
� � � n | j d i � S( u�
Show certificate requests for this API key
CLI Example:
.. code-block:: bash
salt-run venafi.show_csrs
u
http.queryu {0}/certificaterequestsRb R R u jsonR u tppl-api-keyu statusu 4u 5u There was an API error: {0}u erroru dict(
R R R R R R Rc RT R R ( R7 Rb ( ( s: /usr/lib/python2.7/site-packages/salt/runners/venafiapi.pyt show_csrs� s
0c C@ s� t d d j t � | � d t d t d d d i t � d 6�} | d } t j | � j d
� s{ t j | � j d � r� t d j | d
� � � n | d d S( u�
Get the zone ID for the given zone name
CLI Example:
.. code-block:: bash
salt-run venafi.get_zone_id default
u
http.queryu {0}/zones/tag/{1}Rb R R u jsonR u tppl-api-keyu statusu 4u 5u There was an API error: {0}u erroru dictu id( R R R R R R Rc RT R ( t zone_nameR7 Rb ( ( s: /usr/lib/python2.7/site-packages/salt/runners/venafiapi.pyRU � s
0c C@ s� t d d j t � � d t d t d d d i t � d 6�} | d } t j | � j d
� sx t j | � j d � r� t d j | d
� � � n | d S( u�
Show zone details for the API key owner's company
CLI Example:
.. code-block:: bash
salt-run venafi.show_zones
u
http.queryu {0}/certificatepoliciesRb R R u jsonR u tppl-api-keyu statusu 4u 5u There was an API error: {0}u erroru dict( R R R R R R Rc RT R ( R7 Rb ( ( s: /usr/lib/python2.7/site-packages/salt/runners/venafiapi.pyt
show_policies� s
0c C@ s� t d d j t � � d t d t d d d i t � d 6�} | d } t j | � j d
� sx t j | � j d � r� t d j | d
� � � n | d S( u�
Show zone details for the API key owner's company
CLI Example:
.. code-block:: bash
salt-run venafi.show_zones
u
http.queryu {0}/zonesRb R R u jsonR u tppl-api-keyu statusu 4u 5u There was an API error: {0}u erroru dict( R R R R R R Rc RT R ( R7 Rb ( ( s: /usr/lib/python2.7/site-packages/salt/runners/venafiapi.pyt
show_zones s
0c
C@ s5 t d d j t � | � d i d d 6d d 6d t d t d
i t � d 6�} | d } t j | � j d
� s� t j | � j d � r� t d j | d � � � n | j d d � } t d d j t � | � d t d t d d d
i t � d 6�} | d } t j | � j d
� s2t j | � j d � rNt d j | d � � � n | j d i � } t
| � } d } x@ | d j d � D]+ } | j d � r�| j d � d } q�q�Wt j
j t t j � } | j d | � } | d k r�i } n | j d � | d <| j | � | j d | | � | | d <| S(! u�
Show certificate requests for this API key
CLI Example:
.. code-block:: bash
salt-run venafi.show_cert 01234567-89ab-cdef-0123-456789abcdef
u
http.queryu' {0}/certificaterequests/{1}/certificatet paramsu PEMu formatu
ROOT_FIRSTu
chainOrderRb t textR u tppl-api-keyu statusu 4u 5u There was an API error: {0}u erroru bodyu u {0}/certificaterequests/{1}R R u jsonu dictu certificateNameu ,u cn=u =i u venafi/domainsu private_keyu
request_idN( R R R R R R Rc RT R R t _parse_certst splitR" R# R$ R R% R& R' R! RX R) ( t id_R7 Rb t csr_datat certsR+ t itemR# t domain_data( ( s: /usr/lib/python2.7/site-packages/salt/runners/venafiapi.pyt show_cert& sL
0
0
c C@ s8 t j j t t j � } d } | j | | � } | d S( u�
Show a private RSA key
CLI Example:
.. code-block:: bash
salt-run venafi.show_rsa myminion domain.example.com
u venafi/domainsu private_key( R" R# R$ R R% R& R' ( R* R+ R# R6 R7 ( ( s: /usr/lib/python2.7/site-packages/salt/runners/venafiapi.pyt show_rsac s
c C@ s% t j j t t j � } | j d � S( u�
List domains that have been cached
CLI Example:
.. code-block:: bash
salt-run venafi.list_domain_cache
u venafi/domains( R" R# R$ R R% R& R_ ( R# ( ( s: /usr/lib/python2.7/site-packages/salt/runners/venafiapi.pyt list_domain_cacheu s
c C@ s� t j j t t j � } t | t j � r< | j d � } n t | t
� sZ t d � � n g } g } xP | D]H } y! | j d | � | j
| � Wqm t k
r� | j
| � qm Xqm Wi | d 6| d 6S( u�
Delete cached domains from the master
CLI Example:
.. code-block:: bash
salt-run venafi.del_cached_domain domain1.example.com,domain2.example.com
u ,uw You must pass in either a string containing one or more domains separated by commas, or a list of single domain stringsu venafi/domainsu Succeededu Failed( R" R# R$ R R% R& R^ R t string_typesRo R_ R t flushR` ( t domainsR# t successt failedRf ( ( s: /usr/lib/python2.7/site-packages/salt/runners/venafiapi.pyt del_cached_domain� s
c C@ sq t } d } g } d } x| j � D]} | j � s= q% n d | k rn | j d � } | d j � } q% n d | k s� d | k r� d | k r� | | } n
| | } | j | � t } q% n d | k s� d | k r d | k r� | d
} n
| d
} t } q% n | t k r% | | d
} q% q% q% W| j d � } | j d � } i | d 6| d
6| d 6| d 6}
|
S( Nu u Successfully posted requestu for i����u END CERTIFICATEu END RSA private_keyu RSAu BEGIN CERTIFICATEu BEGIN RSA private_keyu
i u end_entity_certificateu private_keyu root_certificateu intermediate_certificates( R t
splitlinest stripRo R` R t pop( R7 t cert_modet certRr t rsa_keyt linet compsRZ t rcertt eecertR\ ( ( s: /usr/lib/python2.7/site-packages/salt/runners/venafiapi.pyRn � sF
(4 t __doc__t
__future__R R R t loggingR: R8 t M2CryptoR R R t ImportErrorR t Cryptodome.PublicKeyt Crypto.PublicKeyt
salt.cacheR" t
salt.syspathsR% t salt.utils.filest salt.utils.jsont salt.utils.stringutilst salt.exceptionsR t salt.extR R t getLoggert __name__t logR
R R R! R RS R] t renewRY Re Rg Rh RU Rj Rk Ru t pickupRv Rw R} Rn ( ( ( s: /usr/lib/python2.7/site-packages/salt/runners/venafiapi.pyt <module> sr
V U \ :
Mini Shell