Ñò
ìÿÒXc @ sR d d k Z d d k Z d d k Z d d k Z d d k l Z d d k l Z d Z d Z d Z d „ Z
d „ Z d „ Z d
„ Z
d „ Z d „ Z d
„ Z d d „ Z d „ Z d d d „ Z d d d „ Z d „ Z d „ Z d „ Z d „ Z d „ Z d „ Z e d j o7 e d d d d ƒ Z e e d ƒ Z e GHe e ƒ n d S( iÿÿÿÿN( t ipautil( t dogtags /var/lib/certmonger/requests/s /var/lib/certmonger/cas/i c C så d } d } t } xÌ | d j o¾ | d j o± | d } t i d ƒ t | d ƒ } | i ƒ } | i ƒ xn | D]f } | o' | i d ƒ p | S| | d } qr | i | d ƒ o t } | t | ƒ d } qr qr Wq W| S( s4
Return a value from a certmonger request file for the requested directive
It tries to do this a number of times because sometimes there is a delay
when ipa-getcert returns and the file is fully updated, particularly
when doing a request. Generating a CSR is fast but not instantaneous.
i i t rt t =N(
t Nonet Falset timet sleept opent readlinest closet
startswitht Truet len( t filenamet directivet triest valuet foundt fpt linest line( ( s8 /usr/lib/python2.6/site-packages/ipapython/certmonger.pyt find_request_value% s(
!c C su t i t ƒ } x_ | D]W } t d t | f d ƒ } | d j o+ | i ƒ | j o t d t | f | ƒ Sq Wd S( s¢
There is no guarantee that the request_id will match the filename
in the certmonger requests directory, so open each one to find the
request_id.
s %s/%st idN( t ost listdirt REQUEST_DIRR R t rstrip( t
request_idR t fileListt fileR ( ( s8 /usr/lib/python2.6/site-packages/ipapython/certmonger.pyt get_request_valueG s c C s t | ƒ t j p t ‚ d } t i t ƒ } xê | D]â } t } x… | D]} \ } } } t d t | f | ƒ } | o# | t j o t i
i | ƒ } n | d j p | i ƒ | j o t
} PqI qI W| o | d j o t d ƒ ‚ n | o# t d t | f d ƒ i ƒ } q6 q6 W| S( s´
If you don't know the certmonger request_id then try to find it by looking
through all the request files. An alternative would be to parse the
ipa-getcert list output but this seems cleaner.
criteria is a tuple of key/value/type to search for. The more specific
the better. An error is raised if multiple request_ids are returned for
the same criteria.
None is returned if none of the criteria match.
s %s/%ss/ multiple certmonger requests match the criteriaR N( t typet tuplet AssertionErrorR R R R R
R t NPATHt patht abspathR R t RuntimeError( t criteriat reqidR R t matcht keyR t valtypet rv( ( s8 /usr/lib/python2.6/site-packages/ipapython/certmonger.pyt get_request_idU s& 'c C sÊ g } t i t ƒ } x® | D]¦ } t t i i t | ƒ d ƒ } | d j o q n t i i | ƒ i ƒ } | | j o q n t t i i t | ƒ d ƒ } | d j o | i | i ƒ ƒ q q W| S( sZ
Return a list containing the request ids for a given NSS database
directory.
t cert_storage_locationR N(
R R R R R% t joinR R& R t append( t dirR) R R R- R ( ( s8 /usr/lib/python2.6/site-packages/ipapython/certmonger.pyt get_requests_for_diru s
c C s¿ t i t ƒ } x© | D]¡ } t d t | f d ƒ } | d j ou | i ƒ | j ob t d t | f | ƒ } | p> t d t | f d ƒ } | i d | | f ƒ | i ƒ q· q q Wd S( s‚
Add a new directive to a certmonger request file.
The certmonger service MUST be stopped in order for this to work.
s %s/%sR t as %s=%s
N( R R R R R R R t writeR ( R R R R R R t
current_valueR ( ( s8 /usr/lib/python2.6/site-packages/ipapython/certmonger.pyt add_request_valueŠ s c C s t | d | ƒ S( s®
In order for a certmonger request to be renewable it needs a principal.
When an existing certificate is added via start-tracking it won't have
a principal.
t template_principal( R7 ( R t principal( ( s8 /usr/lib/python2.6/site-packages/ipapython/certmonger.pyt
add_principalœ s c C s t | d | ƒ S( sÔ
In order for a certmonger request to be renwable it needs the subject
set in the request file.
When an existing certificate is added via start-tracking it won't have
a subject_template set.
t template_subject( R7 ( R t subject( ( s8 /usr/lib/python2.6/site-packages/ipapython/certmonger.pyt add_subject¥ s c
C s’ d d d | d | d | d | g
} | o* | i d ƒ | i t i i | ƒ ƒ n t i | ƒ \ } } } t i d | ƒ } | i d ƒ }
|
S(
s<
Execute certmonger to request a server certificate
s /usr/bin/ipa-getcertt requests -ds -ns -Ns -Ks -ps! New signing request "(\d+)" addedi ( R1 R R% R& R t runt reR* t group( t nssdbt nicknameR< R9 t passwd_fnamet argst stdoutt stderrt
returncodet mR ( ( s8 /usr/lib/python2.6/site-packages/ipapython/certmonger.pyt request_cert¯ s
c C s\ d d d t i i | ƒ d | g } t i | d t ƒ\ } } } | d j o t St Sd S( s÷
See if a nickname exists in an NSS database.
Returns True/False
This isn't very sophisticated in that it doesn't differentiate between
a database that doesn't exist and a nickname that doesn't exist within
the database.
s /usr/bin/certutils -Ls -ds -nt
raiseonerri N( R R% R& R R? R R
( RC t secdirRE RF RG t rc( ( s8 /usr/lib/python2.6/site-packages/ipapython/certmonger.pyt cert_existsà s
c C sÕ t | t i i | ƒ ƒ p t d | | f ƒ ‚ n d d d t i i | ƒ d | g } | o* | i d ƒ | i t i i | ƒ ƒ n | o | i d ƒ | i | ƒ n t i | ƒ \ } } } | | | f S( sÖ
Tell certmonger to track the given certificate nickname in NSS
database in secdir protected by optional password file password_file.
command is an optional parameter which specifies a command for
certmonger to run when it renews a certificate. This command must
reside in /usr/lib/ipa/certmonger to work with SELinux.
Returns the stdout, stderr and returncode from running ipa-getcert
This assumes that certmonger is already running.
s0 Nickname "%s" doesn't exist in NSS database "%s"s /usr/bin/ipa-getcerts start-trackings -ds -ns -ps -C( RN R R% R& R' R1 R R? ( RC RL t
password_filet commandRE RF RG RH ( ( s8 /usr/lib/python2.6/site-packages/ipapython/certmonger.pyt start_tracking× s
c C s- | d j o | d j o t d ƒ ‚ n | of d t i i | ƒ t f d | d f f } y" t | ƒ } | d j o d SWq— t j
o q— Xn d d g } | o | i d ƒ | i | ƒ nA | i d ƒ | i | ƒ | i d
ƒ | i t i i | ƒ ƒ t i | ƒ \ } } } | | | f S(
sŽ
Stop tracking the current request using either the request_id or nickname.
This assumes that the certmonger service is running.
s) Both request_id and nickname are missing.R/ t
cert_nicknamet i s /usr/bin/getcerts
stop-trackings -is -ns -dN( RS RS i (
R R' R R% R& R$ R. R1 R R? ( RL R RC R( RE RF RG RH ( ( s8 /usr/lib/python2.6/site-packages/ipapython/certmonger.pyt
stop_trackingô s* *
c C sl t i t ƒ } xV | D]N } t d t | f d ƒ } | d j o" | i ƒ d j o d t | f Sq Wd S( s
Look through all the certmonger CA files to find the one that
has id=IPA
We can use find_request_value because the ca files have the
same file format.
s %s/%sR t IPAN( R R t CA_DIRR R t strip( R R R ( ( s8 /usr/lib/python2.6/site-packages/ipapython/certmonger.pyt _find_IPA_ca s c C sÿ t ƒ } | d j o d St } t | d ƒ } | i ƒ } | i ƒ xp t t | ƒ ƒ D]\ } | | i d ƒ oB | | i d ƒ d j o( d | | i
ƒ | f | | | D]6 } | i d d ƒ \ } } | | j o | i ƒ Sq6 WWd QXd S( s‚
Dogtag stores its NSS pin in a file formatted as token:PIN.
The caller is expected to handle any exceptions raised.
R R i N( R R t configured_constantst PASSWORD_CONF_PATHt __exit__t __enter__Ra RW R ( t tokent _[1]t fR t tokt pin( ( s8 /usr/lib/python2.6/site-packages/ipapython/certmonger.pyt get_pind s /
c C sÓ t | t i i | ƒ ƒ p t d | | f ƒ ‚ n d d d t i i | ƒ d | d | g } | d j oe t i i | ƒ p4 t i d j o
d } n d
} d | | f } n | i d ƒ | i | ƒ n | d j oe t i i | ƒ p4 t i d j o
d } n d
} d | | f } n | i d
ƒ | i | ƒ n | o | i d ƒ | i | ƒ n | i d ƒ | i | ƒ | d j o | i d ƒ | i | ƒ n t
i | d | g ƒ\ } }
} d S( s0
Tell certmonger to start tracking a dogtag CA certificate. These
are handled differently because their renewal must be done directly
and not through IPA.
This uses the generic certmonger command getcert so we can specify
a different helper.
pre_command is the script to execute before a renewal is done.
post_command is the script to execute after a renewal is done.
Both commands can be None.
Returns the stdout, stderr and returncode from running ipa-getcert
This assumes that certmonger is already running.
s0 Nickname "%s" doesn't exist in NSS database "%s"s /usr/bin/getcerts start-trackings -ds -ns -ci i t lib64t libs /usr/%s/ipa/certmonger/%ss -Bs -Cs -ps -Ps dogtag-ipa-retrieve-agent-submits -Tt nologNI I ( RN R R% R& R' R t isabst syst maxsizeR1 R R? ( t caRC Rk t pinfileRL t pre_commandt post_commandRE t libpathRF RG RH ( ( s8 /usr/lib/python2.6/site-packages/ipapython/certmonger.pyt dogtag_start_trackingq s>
c C s. g } x! | D] } | i t | ƒ ƒ q
W| S( s
Given a set of directories and nicknames verify that we are no longer
tracking certificates.
dirs is a list of directories to test for. We will return a tuple
of nicknames for any tracked certificates found.
This can only check for NSS-based certificates.
( t extendR3 ( t dirst reqidsR2 ( ( s8 /usr/lib/python2.6/site-packages/ipapython/certmonger.pyt check_state± s
t __main__s /etc/httpd/aliast Tests cn=tiger.example.com,O=IPAs" HTTP/tiger.example.com@EXAMPLE.COMt csr( R Rq R@ R t ipapythonR R R RV R$ R R R. R3 R7 R: R= R RJ RN RQ RT RX R` Rb Rl Rx R| t __name__R R ( ( ( s8 /usr/lib/python2.6/site-packages/ipapython/certmonger.pyt s< "
$
@