Why Gemfury?
Push, build, and install
RubyGems
npm packages
Python packages
Maven artifacts
PHP packages
Go Modules
Debian packages
RPM packages
NuGet packages
triliodata-3-3 / python3-dmapi deb
Repository URL to install this package:
|
Version:
3.3.35 ▾
|
çáþ\«0 ã @ sº d Z d d l m Z d d l Z d d l Z d d l Z d d l m Z d d l m Z d d l
m Z d d l m
Z
d d l m Z d d l m Z d d
l m Z d d l m Z d d l m Z d d
l m Z d d l Z d d l Z d d l Z d d l m Z d d l m Z d d l m Z d d l m Z m! Z! d d l m" Z" e j# e$ Z% e j& j' Z' d d d Z( d d d Z) d d d Z* d d d Z+ d d d Z, d d Z- d d Z. d! d" Z/ d# d$ d% Z0 d& d' Z1 d( d) Z2 d* d+ Z3 d, d- Z4 d. d/ Z5 d0 d1 Z6 d2 d3 Z7 d4 d5 Z8 d6 d7 Z9 d# d8 d9 Z: d# d: d; Z; d< d= Z< d> d? Z= d@ dA Z> d dB dC Z? dD dE Z@ d S)FzzWrappers around standard crypto data elements.
Includes root and intermediate CAs, SSH key_pairs and x509 certificates.
é )Úabsolute_importN)Ú
exceptions)Úbackends)Úpadding)Úhashes)Ú
serialization)Úx509)Ú processutils)Úlog)Úexcutils)Ú fileutils)Úcontext)Údb)Ú exception)Ú_Ú_LE)Úutilsc C s8 t j j r. | r. t j j t j j d | St j j S)NZprojects)ÚCONFÚcryptoÚuse_project_caÚosÚpathÚjoinÚca_path)Ú
project_id© r ú./usr/lib/python3/dist-packages/dmapi/crypto.pyÚ ca_folder* s r c C s t j j t | t j j S)N)r r r r r r Zca_file)r r r r r 0 s r c C s t j j t | t j j S)N)r r r r r r Úkey_file)r r r r Úkey_path4 s r c C s t j j t | t j j S)N)r r r r r r Úcrl_file)r r r r Úcrl_path8 s r! c C si t j j s d } t | } t j j | sB t j d | t | d } | j
SWd QRXd S)NÚprojectÚr) r r r r r r Úexistsr ZCryptoCAFileNotFoundÚopenÚread)r Z ca_file_pathÚcafiler r r Úfetch_ca< s r( c C su t } t j j t sq t j j t j j t j j t d d } t j
| t j d | d | d S)z Ensure the CA filesystem exists.ÚCAz genrootca.shÚshÚcwdN)
r r r r$ r Úabspathr ÚdirnameÚ__file__r Ú ensure_treer Úexecute)Zca_dirZgenrootca_sh_pathr r r Úensure_ca_filesystemF s '
r1 c C s yà | j d } t j | t j t j | j d d } t j t j
t j } | j | | j } t
j | } t j r¢ | j d } d j d d t | d d d
| d d d
D SWn* t k
r t j d t d
Yn Xd S) Nzutf-8ú é Úasciiú:c s s | ] \ } } | | Vq d S)Nr )Ú.0ÚaÚbr r r ú <genexpr>` s z'generate_fingerprint.<locals>.<genexpr>é Úreasonz failed to generate fingerprint)Úencoder Úload_ssh_public_keyr Údefault_backendÚbase64Ú b64decodeÚsplitr ZHashÚMD5ÚupdateÚfinalizeÚbinasciiÚhexlifyÚsixÚPY3Údecoder ÚzipÚ Exceptionr ÚInvalidKeypairr )Ú
public_keyÚ pub_bytesZpub_dataÚdigestZmd5hashÚraw_fpr r r Úgenerate_fingerprintQ s
A
rQ c C s y° t | t j r$ | j d } t j | t j } t j | j
t j } t j
rr | j d } d j d d t | d d d
| d d d
D SWnM t t t j f k
rÿ } z! t j d t d | WYd d } ~ Xn Xd S)
Nzutf-8r4 r5 c s s | ] \ } } | | Vq d S)Nr )r6 r7 r8 r r r r9 o s z,generate_x509_fingerprint.<locals>.<genexpr>r: r3 r; z6failed to generate X509 fingerprint. Error message: %s)Ú
isinstancerG Ú text_typer< r Zload_pem_x509_certificater r> rE rF Ú fingerprintr ÚSHA1rH rI r rJ Ú
ValueErrorÚ TypeErrorÚErrorr rL r )Zpem_keyÚcertrP Úexr r r Úgenerate_x509_fingerprintf s A r[ i c C sl t j j | } t j } | j | | j } d | j | j f } t | } | | | f S)Nz%s %s Generated-by-Nova)
ÚparamikoZRSAKeyZgeneraterG ÚStringIOZwrite_private_keyÚgetvalueÚget_nameZ
get_base64rQ )ÚbitsÚkeyZkeyoutÚ private_keyrM rT r r r Úgenerate_key_pairv s
rc c C si t j j s d } t | } t j j | sB t j d | t | d } | j
SWd QRXd S)zGet crl file for project.Nr" r# ) r r r r! r r r$ r ZCryptoCRLFileNotFoundr% r& )r Z
crl_file_pathZcrlfiler r r Ú fetch_crl s rd c C sÝ t | } t j j | s0 t j d | t | d } | j } Wd QRXy5 t j | d t
j } | j | t
j SWnL t t t j f k
rØ } z t j d t j | WYd d } ~ Xn Xd S)Nr Úrbr; )r r r r$ r ÚProjectNotFoundr% r& r Zload_pem_private_keyr r> Zdecryptr ÚPKCS1v15rV rW r ZUnsupportedAlgorithmZDecryptionFailurerG rS )r ÚtextZprivate_key_fileÚfÚdataZpriv_keyÚexcr r r Ú decrypt_text s rl c C s© t | t j r! | j d } yA | j d } t j | t j } | j | t j
SWn@ t k
r¤ } z t j
d t j | WYd d } ~ Xn Xd S)z_Encrypt text with an ssh public key.
If text is a Unicode string, encode it to UTF-8.
zutf-8r; N)rR rG rS r< r r= r r> Zencryptr rg rK r ZEncryptionFailure)Zssh_public_keyrh rN Zpub_keyrk r r r Ússh_encrypt_text s rm c C s® y] t j d d d d d | d t | t j d d d d d d t j j d t | WnJ t k
r t j d | Yn' t j
k
r© t j d | Yn Xd
S) zRevoke a cert by file name.ÚopensslÚcaz-configz
./openssl.cnfz-revoker+ z-gencrlz-outr N) r r0 r r r r ÚOSErrorr rf r ZProcessExecutionErrorZRevokeCertFailure)r Ú file_namer r r Ú revoke_cert© s
rr c C sB t j } x/ t j | | D] } t | d | d q Wd S)zRevoke all user certs.r rq N)r
Úget_admin_contextr Zcertificate_get_all_by_userrr )Úuser_idÚadminrY r r r Úrevoke_certs_by_user· s rv c C sB t j } x/ t j | | D] } t | d | d q Wd S)zRevoke all project certs.r rq N)r
rs r Z certificate_get_all_by_projectrr )r ru rY r r r Úrevoke_certs_by_project¾ s rw c C sE t j } x2 t j | | | D] } t | d | d q" Wd S)z!Revoke certs for user in project.r rq N)r
rs r Z'certificate_get_all_by_user_and_projectrr )rt r ru rY r r r Ú revoke_certs_by_user_and_projectÇ s rx c C s t j j | t j f S)z%Helper to generate user cert subject.)r r Zproject_cert_subjectr Úisotime)r r r r Ú_project_cert_subjectÏ s rz c C s t j j | | t j f S)z%Helper to generate user cert subject.)r r Zuser_cert_subjectr ry )rt r r r r Ú_user_cert_subjectÔ s r{ c C s^ t | | } t j Ô } t j j t j j | d } t j j t j j | d } t j d d d | t | t j d d d d | d | d d
|
t | } | j
} Wd QRXt | } | j
} Wd QRXWd QRXt | | \ }
} t j j t | d |
} d
| d | d | i }
t
j t j |
| | f S)z-Generate and sign a cert for user in project.ztemp.keyztemp.csrrn Zgenrsaz-outÚreqz-newz-keyz-batchz-subjNznewcerts/%s.pemrt r rq )r{ r Útempdirr r r, r r0 Ústrr% r& Úsign_csrr r Zcertificate_creater
rs )rt r r` ÚsubjectÚtmpdirÚkeyfileÚcsrfileri rb ÚcsrÚserialZ
signed_csrÚfnamerY r r r Úgenerate_x509_certÚ s$ !! r c C sM d | } d | } t j } t j j t j j | d } t j j t j j | d } t | | t j d d d d d d
d | d d
| d d d | d | d d d d \ } } t j d d d d | d d d | d d \ } } t j | }
t
| } t j r9|
j
d }
| j
d } Wd QRX|
| | f S) z:Generate a cert for passwordless auth for user in project.z/CN=%sz %s@localhostztemp.keyz temp.confrn r| z-x509z-nodesz-daysZ3650z-configz-newkeyzrsa:%sz-outformZPEMz-keyoutz-subjz -extensionsZ
v3_req_clientÚbinaryTZpkcs12z-exportz-inkeyz -passwordzpass:Z
process_inputr4 zutf-8N)r r} r r r, r Ú_create_x509_openssl_configr0 r? Ú b64encoder[ rG rH rI ) rt r` r Úupnr r ÚconffileZ certificateÚ_errÚoutrb rT r r r Úgenerate_winrm_x509_certò s,
!!
r c
C s4 d } t | d } | j | | Wd QRXd S)Nz®distinguished_name = req_distinguished_name
[req_distinguished_name]
[v3_req_client]
extendedKeyUsage = clientAuth
subjectAltName = otherName:1.3.6.1.4.1.311.20.2.3;UTF8:%s
Úw)r% Úwrite)r r ÚcontentÚfiler r r r s r c C sq t j j t | sm t j j t j j t j j t d d } t j d | | t
| d t d S)Nr) z geninter.shr* r+ ) r r r$ r r, r r- r. r r0 rz r )r Zgeninter_sh_pathr r r Ú_ensure_project_folder s
'r c C s´ t | } t j j | d } t j j | d } t j j | rL d St d | d \ } } t | d } | j | Wd QRXt | d } | j | Wd QRXd S)Nz
server.keyz
server.crtz project-vpni r )r r r r r$ r r% r )r Zproject_folderZkey_fnZcrt_fnra r r Úcrtfiler r r Úgenerate_vpn_files% s r c C sE t j j s d } | s( t | t St | t | t | S)N)r r r Ú _sign_csrr r )Úcsr_textr r r r r 8 s
r c
C s^ t j K} t j j | d } t j j | d } y* t | d } | j | Wd QRXWn9 t k
r t j t
j t d Wd QRXYn Xt
j
d | t j | t j d d d d | d
d d | d
| t j d d d | d d d
| \ } } | j d d j } t | d } | | j f SWd QRXWd QRXd S)Nz inbound.csrz outbound.csrr zFailed to write inbound.csrzFlags path: %srn ro z-batchz-outz-configz
./openssl.cnfz-infilesr+ r z-inz-serialz-nooutú=r: r# )r r} r r r r% r ÚIOErrorr Zsave_and_reraise_exceptionÚLOGr r Údebugr r/ r0 Ú
rpartitionÚstripr& )
r r r ZinboundZoutboundr r r r
r r r r r A s$
r )AÚ__doc__Ú
__future__r r? rE r Z cryptographyr Zcryptography.hazmatr Z)cryptography.hazmat.primitives.asymmetricr Z cryptography.hazmat.primitivesr r r Zoslo_concurrencyr Zoslo_logr
ÚloggingZ
oslo_utilsr r r\ rG Z
dmapi.confÚdmapir
r r Z
dmapi.i18nr r r Ú getLoggerÚ__name__r Úconfr r r r r! r( r1 rQ r[ rc rd rl rm rr rv rw rx rz r{ r r r r r r r r r r r Ú<module> sb