Current File : //usr/lib/python2.7/site-packages/salt/modules/win_pki.pyc
�
���^c @@ sf d Z d d l m Z m Z m Z d d l Z d d l Z d d l Z d d l Z d d l
Z d d l Z d d l Z d d l
m Z d d l m Z d Z d Z d Z e j e � Z d Z d
� Z e d � Z d � Z d
� Z d � Z e e d � Z e d d � Z e e e e d d d � Z! e e e d d � Z" e e e d d d � Z# e e d � Z$ d S( u�
Microsoft certificate management via the PKI Client PowerShell module.
https://technet.microsoft.com/en-us/itpro/powershell/windows/pkiclient/pkiclient
The PKI Client PowerShell module is only available on Windows 8+ and Windows
Server 2012+.
https://technet.microsoft.com/en-us/library/hh848636(v=wps.620).aspx
:platform: Windows
:depends:
- PowerShell 4
- PKI Client Module (Windows 8+ / Windows Server 2012+)
.. versionadded:: 2016.11.0
i ( t absolute_importt unicode_literalst print_functionN( t SaltInvocationError( t sixu LocalMachineu ceru Myu win_pkic C@ s� t j j j � s t d f St j j j t d d � d k rH t d f St d d � d sf t d f St j j j
d
� s� t d f St S( u�
Requires Windows
Requires Windows 8+ / Windows Server 2012+
Requires PowerShell
Requires PKI Client PowerShell module installed.
u! Only available on Windows Systemsu osversionu 6.2.9200i����u4 Only available on Windows 8+ / Windows Server 2012 +u cmd.shell_infou
powershellu installedu Powershell not availableu PKIu# PowerShell PKI module not available( t saltt utilst platformt
is_windowst Falset versionst version_cmpt
__grains__t __salt__t
powershellt
module_existst __virtualname__( ( ( s8 /usr/lib/python2.7/site-packages/salt/modules/win_pki.pyt __virtual__+ s
"
c C@ s� d g } | r( | j d j | � � n
| j | � t d t j � j | � d d d t �} | d d k r� t j d | | d
� n | r� y' t j
j j | d d t
�} | SWq� t k
r� t j d
� q� Xn | d S( uh
Ensure that the Pki module is loaded, and convert to and extract data from
Json as needed.
u Import-Module -Name PKI; u5 ConvertTo-Json -Compress -Depth 4 -InputObject @({0})u cmd.run_allt shellu
powershellt python_shellu retcodei u' Unable to execute command: %s
Error: %su stderru stdoutt strictu$ Unable to parse return data as Json.( t appendt formatR
R t text_typet joint Truet _LOGt errorR R t jsont loadsR t
ValueError( t cmdt as_jsont cmd_fullt cmd_rett items( ( s8 /usr/lib/python2.7/site-packages/salt/modules/win_pki.pyt _cmd_runA s"
$
c C@ sC d j | � } t j t d | � � s? t d j | � � � n d S( uS
Ensure that the certificate path, as determind from user input, is valid.
u Test-Path -Path '{0}'R u Invalid path specified: {0}N( R t astt literal_evalR$ R ( t nameR ( ( s8 /usr/lib/python2.7/site-packages/salt/modules/win_pki.pyt _validate_cert_path^ s c C@ s= d d g } | | k r9 d j | | � } t | � � n d S( uU
Ensure that the certificate format, as determind from user input, is valid.
u ceru pfxu> Invalid certificate format '{0}' specified. Valid formats: {1}N( R R ( R' t cert_formatst message( ( s8 /usr/lib/python2.7/site-packages/salt/modules/win_pki.pyt _validate_cert_formath s
c C@ st t � } d } t d | d t � } xI | D]A } t � | | d <x' | d D] } | | d j | � qM Wq+ W| S( u�
Get the certificate location contexts and their corresponding stores.
:return: A dictionary of the certificate location contexts and stores.
:rtype: dict
CLI Example:
.. code-block:: bash
salt '*' win_pki.get_stores
uE Get-ChildItem -Path 'Cert:\' | Select-Object LocationName, StoreNamesR R u LocationNameu
StoreNames( t dictR$ R t listR ( t retR R# t itemt store( ( s8 /usr/lib/python2.7/site-packages/salt/modules/win_pki.pyt
get_storest s
c C@ s5 t � } t � } d g } d j | | � } t d | � | j d j | � � | j d � t d t j � j | � d t � } x� | D]� } t � } x1 | D]) } | | k r� | | | | j
� <q� q� W| j d d � }
t
|
t � rg |
D] } | j d � ^ q� | d <n
g | d <| | | d
<q� W| S( um
Get the available certificates in the given store.
:param str context: The name of the certificate store location context.
:param str store: The name of the certificate store.
:return: A dictionary of the certificate thumbprints and properties.
:rtype: dict
CLI Example:
.. code-block:: bash
salt '*' win_pki.get_certs
u DnsNameListu
Cert:\{0}\{1}R' u) Get-ChildItem -Path '{0}' | Select-Objectu8 DnsNameList, SerialNumber, Subject, Thumbprint, VersionR R u Unicodeu dnsnamesu
ThumbprintN( R, R- R R( R R$ R R R R t lowert gett Nonet
isinstance( t contextR0 R. R t blacklist_keyst
store_pathR# R/ t cert_infot keyt namesR' ( ( s8 /usr/lib/python2.7/site-packages/salt/modules/win_pki.pyt get_certs� s&
$
)
u c C@ s� t � } t � } d g } | j � } t d | � | sN t j j | � rb t j d | � | S| d k r� | r� | j d � | j d � | j d j
| � � | j d j
| � � | j d � | j d
� q:| j d j
| � � | j d
� n= | j d � | j d � | j d j
| � � | j d
� t d
t j
� j | � d t � } xg | D]_ } x1 | D]) } | | k rr| | | | j � <qrqrWg | d D] } | d ^ q�| d <qeW| r�t j d | � n t j d | � | S( u�
Get the details of the certificate file.
:param str name: The filesystem path of the certificate file.
:param str cert_format: The certificate format. Specify 'cer' for X.509, or
'pfx' for PKCS #12.
:param str password: The password of the certificate. Only applicable to pfx
format. Note that if used interactively, the password will be seen by all minions.
To protect the password, use a state and get the password from pillar.
:return: A dictionary of the certificate thumbprints and properties.
:rtype: dict
CLI Example:
.. code-block:: bash
salt '*' win_pki.get_cert_file name='C:\certs\example.cer'
u DnsNameListR' u Path is not present: %su pfxu $CertObject = New-Objectu@ System.Security.Cryptography.X509Certificates.X509Certificate2;u $CertObject.Import('{0}'u ,'{0}'u ,'DefaultKeySet') ; $CertObjectuH | Select-Object DnsNameList, SerialNumber, Subject, Thumbprint, Versionu" Get-PfxCertificate -FilePath '{0}'u' $CertObject.Import('{0}'); $CertObjectR R u Unicodeu dnsnamesu0 Certificate thumbprint obtained successfully: %su+ Unable to obtain certificate thumbprint: %s( R, R- R2 R+ t ost patht isfileR R R R R$ R R R R t debug( R' t cert_formatt passwordR. R R7 R# R/ R: ( ( s8 /usr/lib/python2.7/site-packages/salt/modules/win_pki.pyt
get_cert_file� s@
$
)u basec C@ s( t � } d } d j | | � } | j � } t d | � t d | | � }
|
sg t j d | � t S| r� t d |
d | d | � } n t d |
d | � } t
d | d | � } | d | k r� t j d
| d | � t S| d k rw| r| j
d j | � � | j
d
� n
| j
d � | j
d j |
� � | j
d j | � � | j
d � | r�| j
d � q�n, | j
d j |
� � | j
d j | � � t d t j � j | � � t
d | d | � }
x# |
D] } | | k r�| } q�q�W| rt j d | � t St j d | � t S( u�
Import the certificate file into the given certificate store.
:param str name: The path of the certificate file to import.
:param str cert_format: The certificate format. Specify 'cer' for X.509, or
'pfx' for PKCS #12.
:param str context: The name of the certificate store location context.
:param str store: The name of the certificate store.
:param bool exportable: Mark the certificate as exportable. Only applicable
to pfx format.
:param str password: The password of the certificate. Only applicable to pfx
format. Note that if used interactively, the password will be seen by all minions.
To protect the password, use a state and get the password from pillar.
:param str saltenv: The environment the file resides in.
:return: A boolean representing whether all changes succeeded.
:rtype: bool
CLI Example:
.. code-block:: bash
salt '*' win_pki.import_cert name='salt://cert.cer'
u
Cert:\{0}\{1}R' u
cp.cache_fileu% Unable to get cached copy of file: %sRA RB R6 R0 u
thumbprintu8 Certificate thumbprint '%s' already present in store: %su pfxu0 $Password = ConvertTo-SecureString -String '{0}'u -AsPlainText -Force; u5 $Password = New-Object System.Security.SecureString; u% Import-PfxCertificate -FilePath '{0}'u -CertStoreLocation '{0}'u -Password $Passwordu -Exportableu" Import-Certificate -FilePath '{0}'R u% Certificate imported successfully: %su Unable to import certificate: %sN( R- R4 R R2 R+ R
R R R RC R< R@ R R R$ R R R ( R' RA R6 R0 t
exportableRB t saltenvR t
thumbprintR8 t cached_source_patht
cert_propst
current_certst new_certst new_cert( ( s8 /usr/lib/python2.7/site-packages/salt/modules/win_pki.pyt import_cert� sT
c C@ sA t � } | j � } d j | | | � } | j � } t d | � t d | � | d k r� | r� | j d j | � � | j d � n
| j d � | j d j | | � � | j d � n | j d j | | � � | j d
j | � � t j t d t
j � j | � � � } | r-t
j d | � n t
j d
| � | S( u�
Export the certificate to a file from the given certificate store.
:param str name: The destination path for the exported certificate file.
:param str thumbprint: The thumbprint value of the target certificate.
:param str cert_format: The certificate format. Specify 'cer' for X.509, or
'pfx' for PKCS #12.
:param str context: The name of the certificate store location context.
:param str store: The name of the certificate store.
:param str password: The password of the certificate. Only applicable to pfx
format. Note that if used interactively, the password will be seen by all minions.
To protect the password, use a state and get the password from pillar.
:return: A boolean representing whether all changes succeeded.
:rtype: bool
CLI Example:
.. code-block:: bash
salt '*' win_pki.export_cert name='C:\certs\example.cer' thumbprint='AAA000'
u Cert:\{0}\{1}\{2}R' u pfxu0 $Password = ConvertTo-SecureString -String '{0}'u -AsPlainText -Force; u5 $Password = New-Object System.Security.SecureString; u1 Export-PfxCertificate -Cert '{0}' -FilePath '{1}'u -Password $Passwordu. Export-Certificate -Cert '{0}' -FilePath '{1}'u" | Out-Null; Test-Path -Path '{0}'R u% Certificate exported successfully: %su Unable to export certificate: %s( R- t upperR R2 R( R+ R R% R& R$ R R R R R@ R ( R' RF RA R6 R0 RB R t cert_pathR. ( ( s8 /usr/lib/python2.7/site-packages/salt/modules/win_pki.pyt export_cert[ s.
'c C@ s� t � } | j � } d j | | | � } | j d j | � � t d | � | rc | j d � n | r� | j d j | � � n | r� | j d j | � � n | j d � t j t d t j � j
| � � � S( u
Check the certificate for validity.
:param str thumbprint: The thumbprint value of the target certificate.
:param str context: The name of the certificate store location context.
:param str store: The name of the certificate store.
:param bool untrusted_root: Whether the root certificate is required to be
trusted in chain building.
:param str dns_name: The DNS name to verify as valid for the certificate.
:param str eku: The enhanced key usage object identifiers to verify for the
certificate chain.
:return: A boolean representing whether the certificate was considered
valid.
:rtype: bool
CLI Example:
.. code-block:: bash
salt '*' win_pki.test_cert thumbprint='AAA000' dns_name='example.test'
u Cert:\{0}\{1}\{2}u Test-Certificate -Cert '{0}'R' u -AllowUntrustedRootu -DnsName '{0}'u -EKU '{0}'u -ErrorAction SilentlyContinueR ( R- RM R R R( R% R& R$ R R R ( RF R6 R0 t untrusted_roott dns_namet ekuR RN ( ( s8 /usr/lib/python2.7/site-packages/salt/modules/win_pki.pyt test_cert� s
c C@ s� | j � } d j | | � } d j | | � } d j | � } t d | d | � } | | k rw t j d | | � t St d | � t d | � t d | d | � } | | k r� t j d | � t St j d
| � t S( u�
Remove the certificate from the given certificate store.
:param str thumbprint: The thumbprint value of the target certificate.
:param str context: The name of the certificate store location context.
:param str store: The name of the certificate store.
:return: A boolean representing whether all changes succeeded.
:rtype: bool
CLI Example:
.. code-block:: bash
salt '*' win_pki.remove_cert thumbprint='AAA000'
u
Cert:\{0}\{1}u {0}\{1}u Remove-Item -Path '{0}'R6 R0 u, Certificate '%s' already absent in store: %sR' R u Unable to remove certificate: %su$ Certificate removed successfully: %s(
RM R R< R R@ R R( R$ R R ( RF R6 R0 R8 RN R RI RJ ( ( s8 /usr/lib/python2.7/site-packages/salt/modules/win_pki.pyt remove_cert� s"
(% t __doc__t
__future__R R R R% t loggingR= t salt.utils.jsonR t salt.utils.platformt salt.utils.powershellt salt.utils.versionst salt.exceptionsR t salt.extR t _DEFAULT_CONTEXTt _DEFAULT_FORMATt _DEFAULT_STOREt getLoggert __name__R R R R R$ R( R+ R1 R< RC R RL RO RS RT ( ( ( s8 /usr/lib/python2.7/site-packages/salt/modules/win_pki.pyt <module> sL
+D Z = *
Mini Shell