Why Gemfury?
Push, build, and install
RubyGems
npm packages
Python packages
Maven artifacts
PHP packages
Go Modules
Debian packages
RPM packages
NuGet packages
Repository URL to install this package:
|
Version:
5.2.8-5.2 ▾
|
python3-dmapi-el9
/
usr
/
lib
/
python3.9
/
site-packages
/
dmapi
/
__pycache__
/
crypto.cpython-39.pyc
|
|---|
a
[r`e«0 ã @ sè d Z ddlmZ ddlZddlZddlZddlmZ ddlm Z ddl
m Z ddl m
Z
ddl mZ dd lmZ dd
lmZ dd lmZ dd lmZ dd
lmZ ddlZddlZddlZddlm Z ddlm Z ddlm Z ddl m Z m!Z! ddlm"Z" e #e$¡Z%ej&j'Z'dFddZ(dGddZ)dHddZ*dIddZ+dJdd Z,d d Z-d d Z.d!d" Z/dKd$d%Z0d&d' Z1d(d) Z2d*d+ Z3d,d- Z4d.d/ Z5d0d1 Z6d2d3 Z7d4d5 Z8d6d7 Z9dLd8d9Z:dMd:d;Z;d<d= Z<d>d? Z=d@dA Z>dNdBdCZ?dDdE Z@dS )OzzWrappers around standard crypto data elements.
Includes root and intermediate CAs, SSH key_pairs and x509 certificates.
é )Úabsolute_importN)Ú
exceptions)Úbackends)Úpadding)Úhashes)Ú
serialization)Úx509)Ú processutils)Úlog)Úexcutils)Ú fileutils)Úcontext)Údb)Ú exception)Ú_Ú_LE)Úutilsc C s( t jjr | r tj t jjd| ¡S t jjS )NZprojects)ÚCONFÚcryptoÚuse_project_caÚosÚpathÚjoinÚca_path©Ú
project_id© r ú0/usr/lib/python3.9/site-packages/dmapi/crypto.pyÚ ca_folder* s r c C s t j t| tjj¡S ©N)r r r r r r Zca_filer r r r r 0 s r c C s t j t| tjj¡S r )r r r r r r Zkey_filer r r r Úkey_path4 s r c C s t j t| tjj¡S r )r r r r r r Úcrl_filer r r r Úcrl_path8 s r" c C sb t jjs d } t| }tj |¡s,tj| dt |d}|
¡ W d S 1 sT0 Y d S )N©ZprojectÚr) r r r r r r Úexistsr ZCryptoCAFileNotFoundÚopenÚread)r Z ca_file_pathZcafiler r r Úfetch_ca< s r( c C sR t } tj t ¡sNtj tj tj t¡dd¡¡}t
| ¡ t j d|| d dS )z Ensure the CA filesystem exists.ÚCAz genrootca.shÚsh©ÚcwdN)
r r r r% r Úabspathr ÚdirnameÚ__file__r Ú ensure_treer Úexecute)Zca_dirZgenrootca_sh_pathr r r Úensure_ca_filesystemF s ÿ
r2 c C sÆ z| d¡}t |t ¡ ¡ t | d¡d ¡}t t
¡ t ¡ ¡}| |¡ | ¡ }t
|¡}tjrp| d¡}d dd t|d d d
|dd d
D ¡W S tyÀ tjtd d
Y n0 d S ) Núutf-8ú é Úasciiú:c s s | ]\}}|| V qd S r r ©Ú.0ÚaÚbr r r Ú <genexpr>` ó z'generate_fingerprint.<locals>.<genexpr>é z failed to generate fingerprint©Úreason)Úencoder Úload_ssh_public_keyr Údefault_backendÚbase64Z b64decodeÚsplitr ZHashZMD5ÚupdateÚfinalizeÚbinasciiÚhexlifyÚsixÚPY3Údecoder ÚzipÚ Exceptionr ÚInvalidKeypairr )Ú
public_keyÚ pub_bytesZpub_dataÚdigestZmd5hashÚraw_fpr r r Úgenerate_fingerprintQ s"
ÿ
0 ÿrT c
C sÀ zzt | tjr| d¡} t | t ¡ ¡}t |
t ¡ ¡¡}tj
rL| d¡}d dd t|d d d
|dd d
D ¡W S tttjfyº } z tjtd| d W Y d }~n
d }~0 0 d S )
Nr3 r6 r7 c s s | ]\}}|| V qd S r r r8 r r r r< o r= z,generate_x509_fingerprint.<locals>.<genexpr>r> r5 z6failed to generate X509 fingerprint. Error message: %sr? )Ú
isinstancerJ Ú text_typerA r Zload_pem_x509_certificater rC rH rI Ú fingerprintr ZSHA1rK rL r rM Ú
ValueErrorÚ TypeErrorÚErrorr rO r )Zpem_keyÚcertrS Úexr r r Úgenerate_x509_fingerprintf s
ÿ
0ÿÿr] é c C sL t j | ¡}t ¡ }| |¡ | ¡ }d| ¡ | ¡ f }t |}|||fS )Nz%s %s Generated-by-Nova)
ÚparamikoZRSAKeyZgeneraterJ ÚStringIOZwrite_private_keyÚgetvalueZget_nameZ
get_base64rT )ÚbitsÚkeyZkeyoutÚ private_keyrP rW r r r Úgenerate_key_pairv s
re c C sb t jjs d} t| }tj |¡s,tj| dt |d}|
¡ W d S 1 sT0 Y dS )zGet crl file for project.Nr# r$ ) r r r r" r r r% r ZCryptoCRLFileNotFoundr& r' )r Z
crl_file_pathZcrlfiler r r Ú fetch_crl s rf c
C sº t | }tj |¡s tj| dt|d}| ¡ }W d n1 sH0 Y z$t |d t
¡ ¡}| |t
¡ ¡W S tttjfy´ } z tjt |¡dW Y d }~n
d }~0 0 d S )Nr Úrbr? )r r r r% r ÚProjectNotFoundr& r' r Zload_pem_private_keyr rC Zdecryptr ÚPKCS1v15rX rY r ZUnsupportedAlgorithmZDecryptionFailurerJ rV )r ÚtextZprivate_key_fileÚfÚdataZpriv_keyÚexcr r r Ú decrypt_text s &
ÿrn c
C s~ t |tjr| d¡}z,| d¡}t |t ¡ ¡}| |t
¡ ¡W S t yx } z t j
t |¡dW Y d}~n
d}~0 0 dS )z_Encrypt text with an ssh public key.
If text is a Unicode string, encode it to UTF-8.
r3 r? N)rU rJ rV rA r rB r rC Zencryptr ri rN r ZEncryptionFailure)Zssh_public_keyrj rQ Zpub_keyrm r r r Ússh_encrypt_text s
ÿro c
C s zBt jddddd|t| d t jddddddtjjt| d W n< ty` tj| d Y n t j
y~ tj | d Y n0 d
S ) zRevoke a cert by file name.ÚopensslÚcaú-configú
./openssl.cnfz-revoker+ z-gencrlú-outr N) r r1 r r r r! ÚOSErrorr rh r ZProcessExecutionErrorZRevokeCertFailure)r Ú file_namer r r Ú revoke_cert© s ÿÿ
rw c C s0 t ¡ }t || ¡D ]}t|d |d qdS )zRevoke all user certs.r rv N)r
Úget_admin_contextr Zcertificate_get_all_by_userrw )Úuser_idÚadminr[ r r r Úrevoke_certs_by_user· s r{ c C s0 t ¡ }t || ¡D ]}t|d |d qdS )zRevoke all project certs.r rv N)r
rx r Z certificate_get_all_by_projectrw )r rz r[ r r r Úrevoke_certs_by_project¾ s r| c C s2 t ¡ }t || |¡D ]}t|d |d qdS )z!Revoke certs for user in project.r rv N)r
rx r Z'certificate_get_all_by_user_and_projectrw )ry r rz r[ r r r Ú revoke_certs_by_user_and_projectÇ s
ÿr} c C s t jj| t ¡ f S ©z%Helper to generate user cert subject.)r r Zproject_cert_subjectr Úisotimer r r r Ú_project_cert_subjectÏ s r c C s t jj|| t ¡ f S r~ )r r Zuser_cert_subjectr r )ry r r r r Ú_user_cert_subjectÔ s
ÿr c
C s8 t | |}t ¡ Î}tj tj |d¡¡}tj tj |d¡¡}t ddd|t|¡ t dddd|d|d d
|¡
t |}|
¡ }W d n1 s0 Y t |}|
¡ } W d n1 sÈ0 Y W d n1 sæ0 Y t | |\}
} tj t |d |
¡} | || d
}
t
t ¡ |
¡ || fS )z-Generate and sign a cert for user in project.útemp.keyztemp.csrrp Zgenrsart Úreqz-newz-keyú-batchú-subjNznewcerts/%s.pem)ry r rv )r r Útempdirr r r- r r1 Ústrr& r' Úsign_csrr r Zcertificate_creater
rx )ry r rb ÚsubjectÚtmpdirÚkeyfileÚcsrfilerk rd ÚcsrÚserialZ
signed_csrÚfnamer[ r r r Úgenerate_x509_certÚ s(
ÿ
&
Dþr c C sü d| }d| }t ¡ Ê}tj tj |d¡¡}tj tj |d¡¡}t|| t jddddd d
d |d d
| ddd|d|dddd\}}t jdddd|dd|dd \} }t | ¡}
t
|} t j rÔ|
d ¡}
|
d ¡}W d n1 sè0 Y |
|| fS ) z:Generate a cert for passwordless auth for user in project.z/CN=%sz %s@localhostr z temp.confrp r z-x509z-nodesz-daysZ3650rr z-newkeyzrsa:%sz-outformZPEMz-keyoutr
z -extensionsZ
v3_req_clientT)ÚbinaryZpkcs12z-exportz-inkeyz -passwordzpass:)Z
process_inputr r6 r3 N)r r r r r- r Ú_create_x509_openssl_configr1 rD Z b64encoder] rJ rK rL ) ry rb r Úupnr r ÚconffileZ certificateÚ_errÚoutrd rW r r r Úgenerate_winrm_x509_certò s0
û
ý
(r c C s@ d}t | d }| || ¡ W d n1 s20 Y d S )Nz®distinguished_name = req_distinguished_name
[req_distinguished_name]
[v3_req_client]
extendedKeyUsage = clientAuth
subjectAltName = otherName:1.3.6.1.4.1.311.20.2.3;UTF8:%s
Úw)r& Úwrite)r r ZcontentÚfiler r r r s r c C sN t j t| ¡sJt j t j t j t¡dd¡¡}tj d|| t
| t d d S )Nr) z geninter.shr* r+ ) r r r% r r- r r. r/ r r1 r r )r Zgeninter_sh_pathr r r Ú_ensure_project_folder s ÿ
ÿr c C s° t | }tj |d¡}tj |d¡}tj |¡r4d S td| d\}}t|d}| |¡ W d n1 sn0 Y t|d}| |¡ W d n1 s¢0 Y d S )Nz
server.keyz
server.crtz project-vpnr^ r )r r r r r% r r& r )r Zproject_folderZkey_fnZcrt_fnrc r r Úcrtfiler r r Úgenerate_vpn_files% s ( r c C s2 t jjs d }|s t| t S t| t| t|S r )r r r Ú _sign_csrr r )Úcsr_textr r r r r 8 s r c
C sv t ¡ V}tj |d¡}tj |d¡}z8t|d}| | ¡ W d n1 sT0 Y W nH ty¨ t ¡ t
t d¡ W d n1 s0 Y Y n0 t
d|¡ t |¡ t jdddd |d
d d ||d
t jddd|dd|d
\}}| d¡d ¡ }t|d*} || ¡ fW d W d S 1 sH0 Y W d n1 sh0 Y d S )Nz inbound.csrz outbound.csrr zFailed to write inbound.csrzFlags path: %srp rq r rt rr rs z-infilesr+ r z-inz-serialz-nooutú=r> r$ )r r r r r r& r ÚIOErrorr Zsave_and_reraise_exceptionÚLOGr r Údebugr r0 r1 Ú
rpartitionÚstripr' )
r r r ZinboundZoutboundr r r r r r r r r A s( ,
2
ÿ ÿ
r )N)N)N)N)N)r^ )r^ )r^ )N)AÚ__doc__Z
__future__r rD rH r Z cryptographyr Zcryptography.hazmatr Z)cryptography.hazmat.primitives.asymmetricr Z cryptography.hazmat.primitivesr r r Zoslo_concurrencyr Zoslo_logr
ZloggingZ
oslo_utilsr r r_ rJ Z
dmapi.confZdmapir
r r Z
dmapi.i18nr r r Z getLoggerÚ__name__r¢ Zconfr r r r r" r( r2 rT r] re rf rn ro rw r{ r| r} r r r r r r r r r r r r r Ú<module> sb