Current File : //usr/lib/python2.7/site-packages/salt/modules/x509.pyc
�
���^c @@ sO d Z d d l m Z m Z m Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l
Z
d d l Z d d l Z d d l
Z
d d l Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l m Z d d l m Z d d l m Z d d l m Z y d d l Z e! Z" Wn e# k
r]e$ Z" n Xy d d l% Z% e! Z& Wn e# k
r�e$ Z& n Xd Z' e j( e) � Z* e d d
f d d f d
d f d d f d d f d d f d d f d d f d d f d d f d d f d d f d! d" f d# d$ f d% d& f d' d( f d) d* f g � Z+ i d+ d, 6d- d. 6d/ d0 6d1 d2 6Z, d3 � Z- d4 e
j. f d5 � � YZ/ e0 d6 � Z1 d e0 d7 d8 � Z2 d9 � Z3 d: � Z4 d; � Z5 d< � Z6 d= � Z7 d> � Z8 d? � Z9 d@ � Z: dA � Z; dB � Z< e0 dC � Z= dD � Z> dE � Z? dF � Z@ dG � ZA dH � ZB e0 dI � ZC dJ � ZD dK � ZE dL � ZF dM � ZG dN � ZH e0 e$ dO � ZI e0 dP � ZJ e! e0 dQ � ZK e0 e$ dR e0 dS e! dT � ZL e0 e$ e0 e0 e0 e0 e$ dU dV dW � ZM dX � ZN dY � ZO e0 e$ e! e0 dZ � ZP e0 e$ d[ � ZQ e0 d\ � ZR e0 e0 d] � ZS d^ � ZT d_ � ZU d` � ZV d S(a uK
Manage X509 certificates
.. versionadded:: 2015.8.0
:depends: M2Crypto
i ( t absolute_importt unicode_literalst print_functionN( t six( t OrderedDict( t range( t STATE_INTERNAL_KEYWORDSu x509u basicConstraintsu X509v3 Basic Constraintsu keyUsageu X509v3 Key Usageu extendedKeyUsageu X509v3 Extended Key Usageu subjectKeyIdentifieru X509v3 Subject Key Identifieru authorityKeyIdentifieru X509v3 Authority Key Identifieru issuserAltNameu X509v3 Issuer Alternative Nameu authorityInfoAccessu X509v3 Authority Info Accessu subjectAltNameu X509v3 Subject Alternative Nameu crlDistributionPointsu X509v3 CRL Distribution Pointsu issuingDistributionPointu! X509v3 Issuing Distribution Pointu certificatePoliciesu X509v3 Certificate Policiesu policyConstraintsu X509v3 Policy Constraintsu inhibitAnyPolicyu X509v3 Inhibit Any Policyu nameConstraintsu X509v3 Name Constraintsu noChecku X509v3 OCSP No Checku nsCommentu Netscape Commentu
nsCertTypeu Netscape Certificate Typeim u
days_validi u versioni@ u serial_bitsu sha256u algorithmc C@ s t r
t St d f Sd S( u8
only load this module if m2crypto is available
u0 Could not load x509 module, m2crypto unavailableN( t HAS_M2t __virtualname__t False( ( ( s5 /usr/lib/python2.7/site-packages/salt/modules/x509.pyt __virtual__S s t _Ctxc B@ sh e Z d Z d e j f d e j f d e j f d e j f d e j f d e j f d e j f g Z RS( u�
This is part of an ugly hack to fix an ancient bug in M2Crypto
https://bugzilla.osafoundation.org/show_bug.cgi?id=7530#c13
u flagsu issuer_certu subject_certu subject_requ crlu db_methu db( t __name__t
__module__t __doc__t ctypest c_intt c_void_pt _fields_( ( ( s5 /usr/lib/python2.7/site-packages/salt/modules/x509.pyR ] s c C@ sg t j t | � � } d | _ d | _ d | _ d | _ | d k rQ d | _ n t | j � | _ d S( u�
This is part of an ugly hack to fix an ancient bug in M2Crypto
https://bugzilla.osafoundation.org/show_bug.cgi?id=7530#c13
i N(
R t from_addresst intt flagst Nonet subject_certt subject_reqt crlt issuer_certt x509( t m2_ctxt issuert ctx( ( s5 /usr/lib/python2.7/site-packages/salt/modules/x509.pyt _fix_ctxn s i c C@ sl | d k r6 | j d � d k r6 t j j d � � n t j j j | � } t j j j | � } y\ t j j � } t
| | � | d k r� t d � � n t j j
d | | | � } d } WnZ t k
rt j j � } t j j | � } t
| | � t j j
| | | | � } n X| d k rFt j j d j | | � � � n t j j | | � } | j | � | S( u�
Create new X509_Extension, This is required because M2Crypto
doesn't support getting the publickeyidentifier from the issuer
to create the authoritykeyidentifier extension.
u subjectKeyIdentifieru 0123456789abcdefABCDEF:u u value must be precomputed hashu4 Not enough memory when creating a new X509 extensionu< Cannot create X509_Extension with name '{0}' and value '{1}'N( t stript saltt
exceptionst SaltInvocationErrort utilst stringutilst to_strt M2Cryptot m2t x509v3_set_nconfR R t MemoryErrort x509v3_ext_conft AttributeErrort x509v3_lhasht x509v3_set_conf_lhasht X509t X509Errort formatt X509_Extensiont set_critical( t namet valuet criticalR t _pyfreeR t x509_ext_ptrt lhasht x509_ext( ( s5 /usr/lib/python2.7/site-packages/salt/modules/x509.pyt _new_extension s6
c C@ s� t j j j d � s* t j j d � � n d j | � } t d | � } t j d d | � } t j d d | � } t j j
j t j j j
| � � S( u}
Parses openssl command line output, this is a workaround for M2Crypto's
inability to get them from CSR objects.
u opensslu openssl binary not found in pathu openssl req -text -noout -in {0}u cmd.run_stdoutu : rsaEncryptionu :u [0-9a-f]{2}:u ( R! R$ t patht whichR" R# R1 t __salt__t ret subt datat decodet yamlt safe_load( t csr_filenamet cmdt output( ( s5 /usr/lib/python2.7/site-packages/salt/modules/x509.pyt _parse_openssl_req� s c C@ s� t � } t j � } | j | j � � | j � t | j � } | j � | r� d | d d k r� | d d d } | s� | SxC t j
t � D]/ \ } } | r� | | k r� | | | | <q� q� Wn | S( u
Returns a list of dicts containing the name, value and critical value of
any extension contained in a csr object.
u Requested Extensionsu Certificate Requestu Data( R t tempfilet NamedTemporaryFilet writet as_pemt flushRH R4 t closeR t iteritemst EXT_NAME_MAPPINGS( t csrt rett csrtempfilet csryamlt csrextst
short_namet long_name( ( s5 /usr/lib/python2.7/site-packages/salt/modules/x509.pyt _get_csr_extensions� s
c C@ sG t j j j d � s* t j j d � � n d j | � } t d | � } i } x�| j d � D]�} | j � } | j
d � r� | j d d � | d <n | j
d � r� | j d d � | d
<n | j
d � r?| j d d � } i } xG | j d � D]6 } d
| k r� | j d
� } | d | | d <q� q� W| | d <n | j
d � r�| j d d � | d <t j j
| d d � } | j d � | d <n | j
d � r�| j d d � | d <t j j
| d d � } | j d � | d <n | j
d � r_ Pq_ q_ Wd | k rg | d <| S| j d � d } | j d � d } g } x� | j d � D]� }
|
j � slqTn |
j d � d j � } | d d j |
j d � d � }
t j j j t j j j |
� � } xX t j | � D]G \ }
} d | k r�t j j
| d d � } | j d � | d <q�q�W| j | � qTW| | d <| S( u}
Parses openssl command line output, this is a workaround for M2Crypto's
inability to get them from CSR objects.
u opensslu openssl binary not found in pathu openssl crl -text -noout -in {0}u cmd.run_stdoutu
u Version u u Versionu Signature Algorithm: u Signature Algorithmu Issuer: u /u =i i u Issueru
Last Update: u Last Updateu %b %d %H:%M:%S %Y %Zu %Y-%m-%d %H:%M:%Su
Next Update: u Next Updateu Revoked Certificates:u No Revoked Certificates.u Revoked Certificatesu Signature Algorithm:u Serial Number: u :
u Revocation Date( R! R$ R< R= R" R# R1 R> t splitR t
startswitht replacet datetimet strptimet strftimet joinRA RB RC RD R RO t append( t crl_filenameRF RG R t linet subjectt sub_entryt last_updatet next_updatet revt revokedt rev_snt rev_yamlt rev_itemt
rev_valuest rev_date( ( s5 /usr/lib/python2.7/site-packages/salt/modules/x509.pyt _parse_openssl_crl� sl
$$
c C@ sO t d d d � } | r5 | j | � } | r5 | Sn t d d i � j | � S( Nu
pillar.getu x509_signing_policiesu
config.get( R> R t get( R4 t policiest signing_policy( ( s5 /usr/lib/python2.7/site-packages/salt/modules/x509.pyt _get_signing_policy& s c C@ sf t | � d d k r# d | } n d j g t d t | � d � D] } | | | d !^ qB � j � S( u$
Nicely formats hex strings
i i u 0u :( t lenR_ R t upper( t hex_strt i( ( s5 /usr/lib/python2.7/site-packages/salt/modules/x509.pyt _pretty_hex/ s
c C@ s t d j | � � S( uA
Converts decimal values to nicely formatted hex strings
u {0:X}( Rw R1 ( t decval( ( s5 /usr/lib/python2.7/site-packages/salt/modules/x509.pyt _dec2hex9 s c C@ s, y t j j | � SWn t k
r' n Xt S( u�
A wrapper around os.path.isfile that ignores ValueError exceptions which
can be raised if the input to isfile is too long.
( t osR< t isfilet
ValueErrorR ( R< ( ( s5 /usr/lib/python2.7/site-packages/salt/modules/x509.pyt _isfile@ s
c C@ s] t | � rF t j j j | � � } t j j j | j � � SWd QXn t j j j | � Sd S( ua
Determines if input is a path to a file, or a string with the
content to be parsed.
N( R} R! R$ t filest fopenR% R& t read( t input_t fp_( ( s5 /usr/lib/python2.7/site-packages/salt/modules/x509.pyt
_text_or_fileL s "c C@ s� i } g } x� t j | j � D]z \ } } | | k r= q n y3 t | | � } | ro | | | <| j | � n Wq t k
r� } t j d | | � q Xq W| S( uA
Returns a dict containing all values in an X509 Subject
u! Missing attribute '%s'. Error: %s( R RO t nidt getattrR` t TypeErrort logt trace( Rc RR t nidst nid_namet nid_numt valt err( ( s5 /usr/lib/python2.7/site-packages/salt/modules/x509.pyt _parse_subjectX s
c C@ sG t | t j j � r | St | � } t | d d �} t j j | � S( u9
Returns a certificate object based on PEM text.
t pem_typeu CERTIFICATE( t
isinstanceR' R/ R� t
get_pem_entryt load_cert_string( t certt text( ( s5 /usr/lib/python2.7/site-packages/salt/modules/x509.pyt _get_certificate_objl s
c C@ s\ t | � } t | d d �} t j j | d t | � �} t j j � } | j | � | S( u9
Returns a private key object based on PEM text.
R� u (?:RSA )?PRIVATE KEYt callback( R� R� R' t RSAt load_key_stringt _passphrase_callbackt EVPt PKeyt
assign_rsa( t private_keyt
passphraset
rsaprivkeyt
evpprivkey( ( s5 /usr/lib/python2.7/site-packages/salt/modules/x509.pyt _get_private_key_objw s
c @ s � f d � } | S( uR
Returns a callback function used to supply a passphrase for private keys
c @ s t j j j � � S( N( R! R$ R% t to_bytes( t args( R� ( s5 /usr/lib/python2.7/site-packages/salt/modules/x509.pyt f� s ( ( R� R� ( ( R� s5 /usr/lib/python2.7/site-packages/salt/modules/x509.pyR� � s c C@ s. t | � } t | d d �} t j j | � S( u1
Returns a CSR object based on PEM text.
R� u CERTIFICATE REQUEST( R� R� R' R/ t load_request_string( RQ R� ( ( s5 /usr/lib/python2.7/site-packages/salt/modules/x509.pyt _get_request_obj� s c C@ s+ t j | j � j � � j � } t | � S( ux
Returns the sha1 hash of the modulus of a public key in a cert
Used for generating subject key identifiers
( t hashlibt sha1t
get_pubkeyt get_modulust hexdigestRw ( R� t sha_hash( ( s5 /usr/lib/python2.7/site-packages/salt/modules/x509.pyt _get_pubkey_hash� s !c C@ s d S( uz
Replacement keygen callback function which silences the output
sent to stdout by the default keygen function
N( ( ( ( s5 /usr/lib/python2.7/site-packages/salt/modules/x509.pyt _keygen_callback� s c C@ s t j d j | | � t j � S( u8
Dynamically generate a regex to match pem_type
u� \s*(?P<pem_header>-----BEGIN {0}-----)\s+(?:(?P<proc_type>Proc-Type: 4,ENCRYPTED)\s*)?(?:(?P<dek_info>DEK-Info: (?:DES-[3A-Z\-]+,[0-9A-F]{{16}}|[0-9A-Z\-]+,[0-9A-F]{{32}}))\s*)?(?P<pem_body>.+?)\s+(?P<pem_footer>-----END {1}-----)\s*( R? t compileR1 t DOTALL( R� ( ( s5 /usr/lib/python2.7/site-packages/salt/modules/x509.pyt _make_regex� s c C@ s� t | � } | j d d � } d } t | j � � d k rB| j d � rB| j d � rBg } | } x� t | � d k r/| j d � r� | j | | j d d � d � | | j d d � d } qi | d j d � d k r� | j | d � | d } qi | j | | j d � � | | j d � } qi Wd j
| � } n t d � } d
j | � } | r�t | � } d j | | � } n x! | j
| � D] } | r�Pq�q�W| s�t j j | � � n | j � } | d } | d
} | d }
| d } | d } d j
| j � � } | d }
| r7|
| d 7}
n |
rR|
|
d d 7}
n x9 t d t | � d � D] } |
| | | d !d 7}
qkW|
| d 7}
t j j j |
d d �S( u'
Returns a properly formatted PEM string from the input text fixing
any whitespace or line-break issues
text:
Text containing the X509 PEM entry to be returned or path to
a file containing the text.
pem_type:
If specified, this function will only return a pem of a certain type,
for example 'CERTIFICATE' or 'CERTIFICATE REQUEST'.
CLI Example:
.. code-block:: bash
salt '*' x509.get_pem_entry "-----BEGIN CERTIFICATE REQUEST-----MIICyzCC Ar8CAQI...-----END CERTIFICATE REQUEST"
u \nu
i u -----i i i@ u -u
[0-9A-Z ]+u PEM text not valid:
{0}u4 PEM does not contain a single entry of type {0}:
{1}u
pem_headeru proc_typeu dek_infou
pem_footeru pem_bodyu t encodingu asciiN( R� R[ R Rs t
splitlinesRZ t endswithR` t indext countR_ R� R1 t finditerR! R" R# t groupdictRY R R$ R% R� ( R� R� t _matcht pem_fixedt pem_tempt _dregext errmsgt _match_dictt
pem_headert proc_typet dek_infot
pem_footert pem_bodyRR Rv ( ( s5 /usr/lib/python2.7/site-packages/salt/modules/x509.pyR� � sX !
c C@ sd i } xW t j | � D]F } t j j | � r y t d | � | | <Wq\ t k
rX q\ Xq q W| S( u�
Returns a dict containing PEM entries in files matching a glob
glob_path:
A path to certificates to be read and returned.
CLI Example:
.. code-block:: bash
salt '*' x509.get_pem_entries "/etc/pki/*.crt"
R� ( t globRz R< R{ R� R| ( t glob_pathRR R< ( ( s5 /usr/lib/python2.7/site-packages/salt/modules/x509.pyt get_pem_entries s
c C@ s� t | � } i
| j � d d 6| j � j � d d 6t | j � � d 6t | j d d � � d 6t | j d d � � d
6t | j d d � � d 6t | j � � d
6t | j � j
� � d 6t | j � � d 6t | j � j
� � d 6| j � j
� j d � d 6| j � j
� j d � d 6t | � d 6} t � } xg t d | j � � D]P } | j | � } | j � } | j � } | j � r�d | } n | | | <qTW| r�| | d <n | S( uv
Returns a dict containing details of a certificate. Input can be a PEM
string or file path.
certificate:
The certificate to be read. Can be a path to a certificate file, or
a string containing the PEM formatted text of the certificate.
CLI Example:
.. code-block:: bash
salt '*' x509.read_certificate /etc/pki/mycert.crt
i u Versioni u Key Sizeu
Serial Numbert mdu sha256u SHA-256 Finger Printu md5u MD5 Finger Printu sha1u SHA1 Finger Printu Subjectu Subject Hashu Issueru Issuer Hashu %Y-%m-%d %H:%M:%Su
Not Beforeu Not Afteru
Public Keyi u critical u X509v3 Extensions( R� t get_versionR� t sizeRy t get_serial_numberRw t get_fingerprintR� t get_subjectt as_hasht
get_issuert get_not_beforet get_datetimeR^ t
get_not_aftert get_public_keyR R t
get_ext_countt
get_ext_att get_namet get_valuet get_critical( t certificateR� RR t extst ext_indext extR4 R� ( ( s5 /usr/lib/python2.7/site-packages/salt/modules/x509.pyt read_certificate s4
c C@ sd i } xW t j | � D]F } t j j | � r y t d | � | | <Wq\ t k
rX q\ Xq q W| S( u�
Returns a dict containing details of a all certificates matching a glob
glob_path:
A path to certificates to be read and returned.
CLI Example:
.. code-block:: bash
salt '*' x509.read_certificates "/etc/pki/*.crt"
R� ( R� Rz R< R{ R� R| ( R� RR R< ( ( s5 /usr/lib/python2.7/site-packages/salt/modules/x509.pyt read_certificatesT s
c C@ s� t | � } i | j � d d 6t | j � � d 6t | j � j � � d 6t j | j � j � � j
� d 6} t | � | d <| S( u
Returns a dict containing details of a certificate request.
:depends: - OpenSSL command line tool
csr:
A path or PEM encoded string containing the CSR to read.
CLI Example:
.. code-block:: bash
salt '*' x509.read_csr /etc/pki/mycert.csr
i u Versionu Subjectu Subject Hashu Public Key Hashu X509v3 Extensions( R� R� R� R� Ry R� R� R� R� R� R� RX ( RQ RR ( ( s5 /usr/lib/python2.7/site-packages/salt/modules/x509.pyt read_csrm s %c C@ sm t | � } t | d d �} t j � } | j t j j j | � � | j � t
| j � } | j � | S( uP
Returns a dict containing details of a certificate revocation list.
Input can be a PEM string or file path.
:depends: - OpenSSL command line tool
csl:
A path or PEM encoded string containing the CSL to read.
CLI Example:
.. code-block:: bash
salt '*' x509.read_crl /etc/pki/mycrl.crl
R� u X509 CRL(
R� R� RI RJ RK R! R$ R% R& RM Rn R4 RN ( R R� t crltempfilet crlparsed( ( s5 /usr/lib/python2.7/site-packages/salt/modules/x509.pyt read_crl� s
c C@ s� t | t j j � r0 | j � j � } d } n t | � } t | � } | j d � r� | sa | St j j � } | j
| � t j j | � } n t j j � } | j d � r� t j j
| � } | j � j � } n | j d � r
t j j | � } | j � j � } n | j d � s+| j d � rLt j j | d t | � �} n | rrt j j � } | j | � | S| j | � | j � S( u7
Returns a string containing the public key in PEM format.
key:
A path or PEM encoded string containing a CSR, Certificate or
Private Key from which a public key can be retrieved.
CLI Example:
.. code-block:: bash
salt '*' x509.get_public_key /etc/pki/mycert.cer
t s -----BEGIN PUBLIC KEY-----s -----BEGIN CERTIFICATE-----s# -----BEGIN CERTIFICATE REQUEST-----s -----BEGIN PRIVATE KEY-----s -----BEGIN RSA PRIVATE KEY-----R� ( R� R' R/ R� t get_rsaR� R� RZ t BIOt MemoryBufferRK R� t load_pub_key_bioR� R� R� R� R� R� R� t save_pub_key_biot read_all( t keyR� t asObjt rsaR� t bioR� RQ t evppubkey( ( s5 /usr/lib/python2.7/site-packages/salt/modules/x509.pyR� � s8
c C@ s t | | � j � d S( u�
Returns the bit length of a private key in PEM format.
private_key:
A path or PEM encoded string containing a private key.
CLI Example:
.. code-block:: bash
salt '*' x509.get_private_key_size /etc/pki/mycert.key
i ( R� R� ( R� R� ( ( s5 /usr/lib/python2.7/site-packages/salt/modules/x509.pyt get_private_key_size� s
c C@ s� t j j j d � ��t | d | �} d } d } | r| d k rt j j | � r| rt | � } y t | d � } Wn< t j j
k
r� } t j d | � t j
| d | �n Xy t | d � } Wqt j j
k
r} t j d | � t j
| d | �qXn t j j j | d
� �� } | rd| d k rd| rd| j t j j j | � � n | j t j j j | � � | r�| d k r�| r�| j t j j j | � � n Wd QXWd QXd j | � S(
u�
Writes out a PEM string fixing any formatting or whitespace
issues before writing.
text:
PEM string input to be written out.
path:
Path of the file to write the pem out to.
overwrite:
If True(default), write_pem will overwrite the entire pem file.
Set False to preserve existing private keys and dh params that may
exist in the pem file.
pem_type:
The PEM type to be saved, for example ``CERTIFICATE`` or
``PUBLIC KEY``. Adding this will allow the function to take
input that may contain multiple pem types.
CLI Example:
.. code-block:: bash
salt '*' x509.write_pem "-----BEGIN CERTIFICATE-----MIIGMzCCBBugA..." path=/etc/pki/mycert.crt
i? R� u u CERTIFICATEu
DH PARAMETERSu$ Error when getting DH PARAMETERS: %st exc_infou (?:RSA )?PRIVATE KEYu" Error when getting PRIVATE KEY: %su wNu PEM written to {0}( R! R$ R~ t set_umaskR� Rz R< R{ R� R" R# R� t debugR� R RK R% R& R1 ( R� R< t overwriteR� t _dhparamst _private_keyt
_filecontentsR� t _fp( ( s5 /usr/lib/python2.7/site-packages/salt/modules/x509.pyt write_pem� s. + +i u aes_128_cbcc C@ s | r# | r# t j j d � � n | rD | rD t j j d � � n | rY t j j } n t } t j j | t j j | � } t j
j � } | d k r� d } n | j
| d | d t | � �| r� t d | j � d | d d � St j j j | j � � Sd S(
u�
Creates a private key in PEM format.
path:
The path to write the file to, either ``path`` or ``text``
are required.
text:
If ``True``, return the PEM text without writing to a file.
Default ``False``.
bits:
Length of the private key in bits. Default 2048
passphrase:
Passphrase for encryting the private key
cipher:
Cipher for encrypting the private key. Has no effect if passhprase is None.
verbose:
Provide visual feedback on stdout. Default True
.. versionadded:: 2016.11.0
CLI Example:
.. code-block:: bash
salt '*' x509.create_private_key path=/etc/pki/mykey.key
u& Either path or text must be specified.u0 Either path or text must be specified, not both.t cipherR� R� R< R� u (?:RSA )?PRIVATE KEYN( R! R" R# R' R� t keygen_callbackR� t gen_keyR( t RSA_F4R� R� R t save_key_bioR� R� R� R$ R% R& ( R< R� t bitsR� R� t verboset _callback_funcR� R� ( ( s5 /usr/lib/python2.7/site-packages/salt/modules/x509.pyt create_private_key s. %
id u c C@ s6 t s t j j d � � n t j j � } | d k r? g } n x�| D]�}
d |
k r� t |
d � } | d |
d <| d |
d <n |
d j d d � } t j
j j | � } d |
k r� | r� t
j
j |
d d � }
t
j
j � |
k r� qF q� n d
|
k r't
j
j � j d � |
d
<n t
j
j |
d
d � } | j d � } t j
j j | � } t j j � } | j t j
j j | � � | j t j
j j | � � d |
k r�t j
j j |
d � } | j | � n | j | � qF Wt | � } t j j t j j t | d
d �� } t | d | �j d d � } t j j t j j t | � � } i | d 6| d 6t j j d 6| d 6} | r�t j
j j | � | d <n
t j d � y | j | � } WnC t! t" f k
rt j d � | j# d d � | j | � } n X| r | St$ d | d | d
d � S( u
Create a CRL
:depends: - PyOpenSSL Python module
path:
Path to write the crl to.
text:
If ``True``, return the PEM text without writing to a file.
Default ``False``.
signing_private_key:
A path or string of the private key in PEM format that will be used
to sign this crl. This is required.
signing_private_key_passphrase:
Passphrase to decrypt the private key.
signing_cert:
A certificate matching the private key that will be used to sign
this crl. This is required.
revoked:
A list of dicts containing all the certificates to revoke. Each dict
represents one certificate. A dict must contain either the key
``serial_number`` with the value of the serial number to revoke, or
``certificate`` with either the PEM encoded text of the certificate,
or a path to the certificate to revoke.
The dict can optionally contain the ``revocation_date`` key. If this
key is omitted the revocation date will be set to now. If should be a
string in the format "%Y-%m-%d %H:%M:%S".
The dict can also optionally contain the ``not_after`` key. This is
redundant if the ``certificate`` key is included. If the
``Certificate`` key is not included, this can be used for the logic
behind the ``include_expired`` parameter. If should be a string in
the format "%Y-%m-%d %H:%M:%S".
The dict can also optionally contain the ``reason`` key. This is the
reason code for the revocation. Available choices are ``unspecified``,
``keyCompromise``, ``CACompromise``, ``affiliationChanged``,
``superseded``, ``cessationOfOperation`` and ``certificateHold``.
include_expired:
Include expired certificates in the CRL. Default is ``False``.
days_valid:
The number of days that the CRL should be valid. This sets the Next
Update field in the CRL.
digest:
The digest to use for signing the CRL.
This has no effect on versions of pyOpenSSL less than 0.14
.. note
At this time the pyOpenSSL library does not allow choosing a signing
algorithm for CRLs See https://github.com/pyca/pyopenssl/issues/159
CLI Example:
.. code-block:: bash
salt '*' x509.create_crl path=/etc/pki/mykey.key signing_private_key=/etc/pki/ca.key signing_cert=/etc/pki/ca.crt revoked="{'compromized-web-key': {'certificate': '/etc/pki/certs/www1.crt', 'revocation_date': '2015-03-01 00:00:00'}}"
u2 Could not load OpenSSL module, OpenSSL unavailableu certificateu
Serial Numberu
serial_numberu Not Afteru not_afteru :u u %Y-%m-%d %H:%M:%Su revocation_dateu
%Y%m%d%H%M%SZu reasonR� u CERTIFICATER� R� u certu keyu typeu daysu digestu9 No digest specified. The default md5 digest will be used.ut Error signing crl with specified digest. Are you using pyopenssl 0.15 or newer? The default md5 digest will be used.R� R< u X509 CRLN(% t HAS_OPENSSLR! R" R# t OpenSSLt cryptot CRLR R� R[ R$ R% R� R\ R] t nowR^ t Revokedt
set_serialt set_rev_dateR& t
set_reasont add_revokedR� t load_certificatet FILETYPE_PEMR� R� RL t load_privatekeyR� t warningt exportR� R| t popR� ( R< R� t signing_private_keyt signing_private_key_passphraset signing_certRh t include_expiredt
days_validt digestR Rk t rev_certt
serial_numbert not_afterRm Rg t reasonR� R� t
export_kwargst crltext( ( s5 /usr/lib/python2.7/site-packages/salt/modules/x509.pyt
create_crlf sv M
c K@ sX d | k r d St | t � s1 t j | � } n i } d | k r� t | d � } | sj d j | d � St | t � r� i } x | D] } | j | � q� W| } q� n d | k rd | k r� d Sd } d | d k r� d } n t | | d | d � sd
j | d | d � Sn y t d d
d t | � SWn t k
rS} t
j | � SXd
S( u�
Request a certificate to be remotely signed according to a signing policy.
argdic:
A dict containing all the arguments to be passed into the
create_certificate function. This will become kwargs when passed
to create_certificate.
kwargs:
kwargs delivered from publish.publish
CLI Example:
.. code-block:: bash
salt '*' x509.sign_remote_certificate argdic="{'public_key': '/etc/pki/www.key', 'signing_policy': 'www'}" __pub_id='www1'
u signing_policyu signing_policy must be specifiedu" Signing policy {0} does not exist.u minionsu __pub_idu3 minion sending this request could not be identifiedu
match.globu @u match.compoundu+ {0} not permitted to use signing policy {1}R< R� N( R� t dictt astt literal_evalRr R1 t listt updateR> t create_certificateR t Truet ExceptionR t text_type( t argdict kwargsRq t dict_t itemt matchert except_( ( s5 /usr/lib/python2.7/site-packages/salt/modules/x509.pyt sign_remote_certificate s:
c C@ s� t | � } | s d j | � St | t � r[ i } x | D] } | j | � q; W| } n y | d =Wn t k
ry n Xy t | d d � | d <Wn t k
r� n X| S( u�
Returns the details of a names signing policy, including the text of
the public key that will be used to sign it. Does not return the
private key.
CLI Example:
.. code-block:: bash
salt '*' x509.get_signing_policy www
u" Signing policy {0} does not exist.u signing_private_keyu signing_certu CERTIFICATE( Rr R1 R� R! R" t KeyErrorR� ( t signing_policy_nameRq R) R* ( ( s5 /usr/lib/python2.7/site-packages/salt/modules/x509.pyt get_signing_policy9 s$
c K@ s� | r? | r? d | k s* | d t k r? t j j d � � n | r` | r` t j j d � � n d | k ry dG | d <n | r�d | k r� t j j d j | � � � n d | k r� t | d d d �j d
d � | d <n d | k r&t j j j
t | d d
| d �� j d
d � | d <n x1 t t
� d d d g D] } | j | dG � q@Wt d d | d d d t j j j | d t �d d � } t | � s�t j j d � � n | | } | r�t d | d | d | d d � S| Sn i } d | k rLt | d � } t | t � rLi } x | D] }
| j |
� q)W| } qLn | j | � x6 t j t � D]% \ } } | | k ri| | | <qiqiWt j j � }
|
j | d d � d | k r�t t j | d! � � | d <n t! | d j d" d � d# � } t j" rt j j# j$ � rLd$ } | | k r|| t! | | � | 8} q|q| t% j& k r| t! | t% j& � t% j& 8} qn |
j' | � t j( j) |
j* � } t j( j+ |
j* � } t j( j, | d% � t j( j, | dI | d( � d | k r*d | k r*| d) | d <d* | k r*| d* | d <q*n i } d | k r�| d | d <t- | d � } |
j. | j/ � � t0 | d � d+ } n |
j1 t | d d
| d d, t �� |
j/ � } xC t j | j2 � D]/ \ } } | | k r�t3 | | | | � q�q�Wd- | k r t4 | d- � } n |
} |
j5 | j/ � � x�t j t6 � D]q\ } } | | k p~| | k p~| | k p~| | k t k r�qEn | j7 | � p�| j7 | � p�| j7 | � p�| j7 | � } t } | j8 d. � r�t } | d/ } n | d0 k r$d1 | k r$| j d1 t9 |
� � } n dG } | d2 k r?| } n | d3 k r`| j d4 d5 � } n t: d6 | d7 | d8 | d9 | � } | j; s�t< j= d: j | | � � qEn |
j> | � qEWd* | k r�dG | d* <n d | k r | d t k r t? |
� } t | d) d
| d* �| d; <| St@ d< | d) d
| d* d= | � sqt j j d> j | d) | j7 d- d � � � � n |
jA tB | d) d
| d* �| d? � tC |
d@ | �s�t j j dA � � n dB | k rIdC | k r| dC t k rt jD | dD � dE } n d } t d |
jE � d tF jG jH | dB | | d dF � d d � n | rtt d |
jE � d | d | d d � St j j j
|
jE � � SdG S(J u%
Create an X509 certificate.
path:
Path to write the certificate to.
text:
If ``True``, return the PEM text without writing to a file.
Default ``False``.
overwrite:
If True(default), create_certificate will overwrite the entire pem
file. Set False to preserve existing private keys and dh params that
may exist in the pem file.
kwargs:
Any of the properties below can be included as additional
keyword arguments.
ca_server:
Request a remotely signed certificate from ca_server. For this to
work, a ``signing_policy`` must be specified, and that same policy
must be configured on the ca_server. See ``signing_policy`` for
details. Also the salt master must permit peers to call the
``sign_remote_certificate`` function.
Example:
/etc/salt/master.d/peer.conf
.. code-block:: yaml
peer:
.*:
- x509.sign_remote_certificate
subject properties:
Any of the values below can be included to set subject properties
Any other subject properties supported by OpenSSL should also work.
C:
2 letter Country code
CN:
Certificate common name, typically the FQDN.
Email:
Email address
GN:
Given Name
L:
Locality
O:
Organization
OU:
Organization Unit
SN:
SurName
ST:
State or Province
signing_private_key:
A path or string of the private key in PEM format that will be used
to sign this certificate. If neither ``signing_cert``, ``public_key``,
or ``csr`` are included, it will be assumed that this is a self-signed
certificate, and the public key matching ``signing_private_key`` will
be used to create the certificate.
signing_private_key_passphrase:
Passphrase used to decrypt the signing_private_key.
signing_cert:
A certificate matching the private key that will be used to sign this
certificate. This is used to populate the issuer values in the
resulting certificate. Do not include this value for
self-signed certificates.
public_key:
The public key to be included in this certificate. This can be sourced
from a public key, certificate, csr or private key. If a private key
is used, the matching public key from the private key will be
generated before any processing is done. This means you can request a
certificate from a remote CA using a private key file as your
public_key and only the public key will be sent across the network to
the CA. If neither ``public_key`` or ``csr`` are specified, it will be
assumed that this is a self-signed certificate, and the public key
derived from ``signing_private_key`` will be used. Specify either
``public_key`` or ``csr``, not both. Because you can input a CSR as a
public key or as a CSR, it is important to understand the difference.
If you import a CSR as a public key, only the public key will be added
to the certificate, subject or extension information in the CSR will
be lost.
public_key_passphrase:
If the public key is supplied as a private key, this is the passphrase
used to decrypt it.
csr:
A file or PEM string containing a certificate signing request. This
will be used to supply the subject, extensions and public key of a
certificate. Any subject or extensions specified explicitly will
overwrite any in the CSR.
basicConstraints:
X509v3 Basic Constraints extension.
extensions:
The following arguments set X509v3 Extension values. If the value
starts with ``critical``, the extension will be marked as critical.
Some special extensions are ``subjectKeyIdentifier`` and
``authorityKeyIdentifier``.
``subjectKeyIdentifier`` can be an explicit value or it can be the
special string ``hash``. ``hash`` will set the subjectKeyIdentifier
equal to the SHA1 hash of the modulus of the public key in this
certificate. Note that this is not the exact same hashing method used
by OpenSSL when using the hash value.
``authorityKeyIdentifier`` Use values acceptable to the openssl CLI
tools. This will automatically populate ``authorityKeyIdentifier``
with the ``subjectKeyIdentifier`` of ``signing_cert``. If this is a
self-signed cert these values will be the same.
basicConstraints:
X509v3 Basic Constraints
keyUsage:
X509v3 Key Usage
extendedKeyUsage:
X509v3 Extended Key Usage
subjectKeyIdentifier:
X509v3 Subject Key Identifier
issuerAltName:
X509v3 Issuer Alternative Name
subjectAltName:
X509v3 Subject Alternative Name
crlDistributionPoints:
X509v3 CRL distribution points
issuingDistributionPoint:
X509v3 Issuing Distribution Point
certificatePolicies:
X509v3 Certificate Policies
policyConstraints:
X509v3 Policy Constraints
inhibitAnyPolicy:
X509v3 Inhibit Any Policy
nameConstraints:
X509v3 Name Constraints
noCheck:
X509v3 OCSP No Check
nsComment:
Netscape Comment
nsCertType:
Netscape Certificate Type
days_valid:
The number of days this certificate should be valid. This sets the
``notAfter`` property of the certificate. Defaults to 365.
version:
The version of the X509 certificate. Defaults to 3. This is
automatically converted to the version value, so ``version=3``
sets the certificate version field to 0x2.
serial_number:
The serial number to assign to this certificate. If omitted a random
serial number of size ``serial_bits`` is generated.
serial_bits:
The number of bits to use when randomly generating a serial number.
Defaults to 64.
algorithm:
The hashing algorithm to be used for signing this certificate.
Defaults to sha256.
copypath:
An additional path to copy the resulting certificate to. Can be used
to maintain a copy of all certificates issued for revocation purposes.
prepend_cn:
If set to True, the CN and a dash will be prepended to the copypath's filename.
Example:
/etc/pki/issued_certs/www.example.com-DE:CA:FB:AD:00:00:00:00.crt
signing_policy:
A signing policy that should be used to create this certificate.
Signing policies should be defined in the minion configuration, or in
a minion pillar. It should be a yaml formatted list of arguments
which will override any arguments passed to this function. If the
``minions`` key is included in the signing policy, only minions
matching that pattern (see match.glob and match.compound) will be
permitted to remotely request certificates from that policy.
Example:
.. code-block:: yaml
x509_signing_policies:
www:
- minions: 'www*'
- signing_private_key: /etc/pki/ca.key
- signing_cert: /etc/pki/ca.crt
- C: US
- ST: Utah
- L: Salt Lake City
- basicConstraints: "critical CA:false"
- keyUsage: "critical cRLSign, keyCertSign"
- subjectKeyIdentifier: hash
- authorityKeyIdentifier: keyid,issuer:always
- days_valid: 90
- copypath: /etc/pki/issued_certs/
The above signing policy can be invoked with ``signing_policy=www``
CLI Example:
.. code-block:: bash
salt '*' x509.create_certificate path=/etc/pki/myca.crt signing_private_key='/etc/pki/myca.key' csr='/etc/pki/myca.csr'}
u testrunu& Either path or text must be specified.u0 Either path or text must be specified, not both.u public_key_passphraseu signing_policyuT signing_policy must be specifiedif requesting remote certificate from ca_server {0}.u csrR� u CERTIFICATE REQUESTu
u u
public_keyR� u listen_inu preqrequiredu __prerequired__u publish.publisht tgtt funu x509.sign_remote_certificatet argR& t timeouti ue ca_server did not respond salt master must permit peers to call the sign_remote_certificate function.R� R� R< u CERTIFICATEu versioni u
serial_numberu serial_bitsu :i i���i i< i u
days_validu signing_private_keyu signing_private_key_passphraseu X509v3 ExtensionsR� u signing_certu critical i u subjectKeyIdentifieru hashu authorityKeyIdentifieru subjectAltNameu
IP Addressu IPR4 R5 R6 R u" Invalid X509v3 Extension. {0}: {1}u Issuer Public KeyR� t
public_keyu8 signing_private_key: {0} does no match signing_cert: {1}u algorithmt signing_pub_keyu& failed to verify certificate signatureu copypathu
prepend_cnu CNu -u .crtNi i�Q (I R R! R" R# R R1 R� R[ R$ R% R& R� R! t _STATE_INTERNAL_KEYWORDSR R> RA t decode_dictR$ t anyR� Rr R� R" R RO t
CERT_DEFAULTSR' R/ t set_versionRy t randomt getrandbitsR t PY3t platformt
is_windowst syst maxsizet set_serial_numberR( t x509_get_not_beforeR t x509_get_not_aftert x509_gmtime_adjR� t set_subjectR� R� t
set_pubkeyR� t setattrR� t
set_issuerRP Ro RZ R� R; R: R� t infot add_extR� t verify_private_keyt signR� t verify_signatureR& RL Rz R< R_ ( R< R� R� t ca_serverR( t ignoret certst cert_txtRq R) R* t propt defaultR� R t INT_MAXt
not_beforeR RU RQ Rc t entryt numR t extnamet extlongnamet extvalR6 R R� t
cert_propst prepend( ( s5 /usr/lib/python2.7/site-packages/salt/modules/x509.pyR# ] s2 �
#
$
"
c K@ s� | r# | r# t j j d � � n | rD | rD t j j d � � n t j j � } | j � } x6 t j t � D]% \ } } | | k ro | | | <qo qo W| j
| d d � d | k r� d | k r� | d | d <t j d � n d | k rt j j d � � n d | k r!| d | d <n d | k r:d | d <n d
| k rSd | d
<n | d
ry| d ry| d
| d <n | d r�| d
r�| d | d
<n | j t | d d | d
d t �� xC t j | j � D]/ \ } } | | k r�t | | | | � q�q�Wt j j � } x9t j t � D](\ }
} |
| k rU| | k rUq+n | |
pf| | } t }
| j d
� r�t }
| d } n |
d k r�d | k r�| j d t | � � } n |
d k r�| j d d � } n |
d k r�q+n d } t d |
d | d |
d | � } | j sFt j d j |
| � � q+n | j | � q+W| j | � | j t | d d | d �| d � | r�t! d | j" � d | d d � S| j" � Sd S( up
Create a certificate signing request.
path:
Path to write the certificate to.
text:
If ``True``, return the PEM text without writing to a file.
Default ``False``.
algorithm:
The hashing algorithm to be used for signing this request. Defaults to sha256.
kwargs:
The subject, extension and version arguments from
:mod:`x509.create_certificate <salt.modules.x509.create_certificate>`
can be used.
CLI Example:
.. code-block:: bash
salt '*' x509.create_csr path=/etc/pki/myca.csr public_key='/etc/pki/myca.key' CN='My Cert'
u& Either path or text must be specified.u0 Either path or text must be specified, not both.u versioni u private_keyu
public_keyu� OpenSSL no longer allows working with non-signed CSRs. A private_key must be specified. Attempting to use public_key as private_keyu private_key is requiredu private_key_passphraseu public_key_passphraseR� R� u critical i u subjectKeyIdentifieru hashu subjectAltNameu
IP Addressu IPu authorityKeyIdentifierR4 R5 R6 R u" Invalid X509v3 Extension. {0}: {1}u algorithmR� R< R� u CERTIFICATE REQUESTN(# R! R" R# R' R/ t RequestR� R RO R: R; R� R R RH R� R$ R� RI t X509_Extension_StackRP R RZ R[ R� R; R: RK R1 t pusht add_extensionsRN R� R� RL ( R< R� R( RQ Rc RT RU RX RY t extstackRZ R[ R\ R6 R R� ( ( s5 /usr/lib/python2.7/site-packages/salt/modules/x509.pyt
create_csr2 s�
c C@ s t t | | � t | � k � S( u
Verify that 'private_key' matches 'public_key'
private_key:
The private key to verify, can be a string or path to a private
key in PEM format.
public_key:
The public key to verify, can be a string or path to a PEM formatted
certificate, csr, or another private key.
passphrase:
Passphrase to decrypt the private key.
CLI Example:
.. code-block:: bash
salt '*' x509.verify_private_key private_key=/etc/pki/myca.key \
public_key=/etc/pki/myca.crt
( t boolR� ( R� R5 R� ( ( s5 /usr/lib/python2.7/site-packages/salt/modules/x509.pyRM � s c C@ sI t | � } | r- t | d | d t �} n t | j d | � d k � S( u`
Verify that ``certificate`` has been signed by ``signing_pub_key``
certificate:
The certificate to verify. Can be a path or string containing a
PEM formatted certificate.
signing_pub_key:
The public key to verify, can be a string or path to a PEM formatted
certificate, csr, or private key.
signing_pub_key_passphrase:
Passphrase to the signing_pub_key if it is an encrypted private key.
CLI Example:
.. code-block:: bash
salt '*' x509.verify_signature /etc/pki/mycert.pem \
signing_pub_key=/etc/pki/myca.crt
R� R� t pkeyi ( R� R� R$ Re t verify( R� R6 t signing_pub_key_passphraseR� ( ( s5 /usr/lib/python2.7/site-packages/salt/modules/x509.pyRO � s
c C@ s t j j j d � s* t j j d � � n t | � } t | d d �} t j � } | j
t j j j | � � | j
� t | � } t | d d �} t j � } | j
t j j j | � � | j
� d j | j | j � } t d | � } | j � | j � d | k rt St Sd S(
u�
Validate a CRL against a certificate.
Parses openssl command line output, this is a workaround for M2Crypto's
inability to get them from CSR objects.
crl:
The CRL to verify
cert:
The certificate to verify the CRL against
CLI Example:
.. code-block:: bash
salt '*' x509.verify_crl crl=/etc/pki/myca.crl cert=/etc/pki/myca.crt
u opensslu openssl binary not found in pathR� u X509 CRLu CERTIFICATEu& openssl crl -noout -in {0} -CAfile {1}u cmd.run_stderru verify OKN( R! R$ R< R= R" R# R� R� RI RJ RK R% R& RM R1 R4 R> RN R$ R ( R R� R R� t certtextt certtempfileRF RG ( ( s5 /usr/lib/python2.7/site-packages/salt/modules/x509.pyt
verify_crl� s*
c C@ s� i } t j j | � r� y� | | d <t | � } t j j � } | j � j � } t | j � � d | d <| j
d � | j
d � k r� t | d <n
t | d <Wq� t
k
r� q� Xn | S( u�
Returns a dict containing limited details of a
certificate and whether the certificate has expired.
.. versionadded:: 2016.11.0
certificate:
The certificate to be read. Can be a path to a certificate file,
or a string containing the PEM formatted text of the certificate.
CLI Example:
.. code-block:: bash
salt '*' x509.expired "/etc/pki/mycert.crt"
u pathu CNu cnu %Y-%m-%d %H:%M:%Su expired( Rz R< R{ R� R\ t utcnowR� R� R� R� R^ R$ R R| ( R� RR R� t _nowt _expiration_date( ( s5 /usr/lib/python2.7/site-packages/salt/modules/x509.pyt expired s
c C@ s� i } t j j | � r� y� | | d <| | d <t | � } t j j � t j d | � } | j � j � } t | j
� � d | d <| j d � | j d � k r� t | d <n
t
| d <Wq� t k
r� q� Xn | S( u�
Returns a dict containing details of a certificate and whether
the certificate will expire in the specified number of days.
Input can be a PEM string or file path.
.. versionadded:: 2016.11.0
certificate:
The certificate to be read. Can be a path to a certificate file,
or a string containing the PEM formatted text of the certificate.
CLI Example:
.. code-block:: bash
salt '*' x509.will_expire "/etc/pki/mycert.crt" days=30
u pathu
check_dayst daysu CNu cnu %Y-%m-%d %H:%M:%Su will_expire( Rz R< R{ R� R\ Rl t timedeltaR� R� R� R� R^ R$ R R| ( R� Rp RR R� t _check_timeRn ( ( s5 /usr/lib/python2.7/site-packages/salt/modules/x509.pyt will_expire; s"
(W R t
__future__R R R Rz t loggingR� R� R< R RI R? R\ R RA t salt.utils.filesR! t salt.utils.patht salt.utils.stringutilst salt.utils.datat salt.utils.platformt salt.exceptionst salt.extR t salt.utils.odictR t salt.ext.six.movesR t
salt.stateR R7 R' R$ R t ImportErrorR R R R t getLoggerR R� RP R: R
t StructureR R R R; RH RX Rn Rr Rw Ry R} R� R� R� R� R� R� R� R� R� R� R� R� R� R� R� R� R� R� R R R- R0 R# Rd RM RO Rk Ro Rs ( ( ( s5 /usr/lib/python2.7/site-packages/salt/modules/x509.pyt <module> s�
, J
P 6 ! 2 4 B � 6 %� �w 0 (
Mini Shell