Why Gemfury?
Push, build, and install
RubyGems
npm packages
Python packages
Maven artifacts
PHP packages
Go Modules
Debian packages
RPM packages
NuGet packages
Repository URL to install this package:
|
Version:
4.2.64.1.dev4-4.2 ▾
|
ó
mcc @@ so d Z d d l m Z d d l Z d d l Z d d l Z d d l m Z d d l m Z d d l
m Z d d l m
Z
d d l m Z d d l m Z d d
l m Z d d l m Z d d l m Z d d
l m Z d d l Z d d l Z d d l Z d d l m Z d d l m Z d d l m Z d d l m Z m! Z! d d l m" Z" e j# e$ Z% e j& j' Z' d d Z) d d Z* d d Z+ d d Z, d d Z- d Z. d Z/ d Z0 d d Z1 d Z2 d Z3 d Z4 d Z5 d! Z6 d" Z7 d# Z8 d$ Z9 d% Z: d d& Z; d d' Z< d( Z= d) Z> d* Z? d d+ Z@ d, ZA d S(- sz Wrappers around standard crypto data elements.
Includes root and intermediate CAs, SSH key_pairs and x509 certificates.
i ( t absolute_importN( t
exceptions( t backends( t padding( t hashes( t
serialization( t x509( t processutils( t log( t excutils( t fileutils( t context( t db( t exception( t _t _LE( t utilsc C@ s8 t j j r. | r. t j j t j j d | St j j S( Nt projects( t CONFt cryptot use_project_cat ost patht joint ca_path( t
project_id( ( s0 /usr/lib/python2.7/site-packages/dmapi/crypto.pyt ca_folder* s c C@ s t j j t | t j j S( N( R R R R R R t ca_file( R ( ( s0 /usr/lib/python2.7/site-packages/dmapi/crypto.pyR 0 s c C@ s t j j t | t j j S( N( R R R R R R t key_file( R ( ( s0 /usr/lib/python2.7/site-packages/dmapi/crypto.pyt key_path4 s c C@ s t j j t | t j j S( N( R R R R R R t crl_file( R ( ( s0 /usr/lib/python2.7/site-packages/dmapi/crypto.pyt crl_path8 s c C@ sn t j j s d } n t | } t j j | sH t j d | n t
| d } | j SWd QXd S( Nt projectt r( R R R t NoneR R R t existsR
t CryptoCAFileNotFoundt opent read( R t ca_file_patht cafile( ( s0 /usr/lib/python2.7/site-packages/dmapi/crypto.pyt fetch_ca< s c C@ sx t } t j j t st t j j t j j t j j t d d } t j
| t j d | d | n d S( s Ensure the CA filesystem exists.t CAs genrootca.sht sht cwdN(
R R R R# R t abspathR t dirnamet __file__R
t ensure_treeR t execute( t ca_dirt genrootca_sh_path( ( s0 /usr/lib/python2.7/site-packages/dmapi/crypto.pyt ensure_ca_filesystemF s '
c C@ s yà | j d } t j | t j t j | j d d } t j t j
t j } | j | | j } t
j | } t j r¥ | j d } n d j d t | d d d
| d d d
D SWn) t k
r t j d t d n Xd S(
Ns utf-8t i t asciit :c s@ s | ] \ } } | | Vq d S( N( ( t .0t at b( ( s0 /usr/lib/python2.7/site-packages/dmapi/crypto.pys <genexpr>` s i t reasons failed to generate fingerprint( t encodeR t load_ssh_public_keyR t default_backendt base64t b64decodet splitR t Hasht MD5t updatet finalizet binasciit hexlifyt sixt PY3t decodeR t zipt ExceptionR
t InvalidKeypairR ( t
public_keyt pub_bytest pub_datat digestt md5hasht raw_fp( ( s0 /usr/lib/python2.7/site-packages/dmapi/crypto.pyt generate_fingerprintQ s
>
c C@ sõ y³ t | t j r' | j d } n t j | t j } t j | j
t j } t j
rx | j d } n d j d t | d d d
| d d d
D SWn; t t t j f k
rð } t j d t d | n Xd S( Ns utf-8R6 R7 c s@ s | ] \ } } | | Vq d S( N( ( R8 R9 R: ( ( s0 /usr/lib/python2.7/site-packages/dmapi/crypto.pys <genexpr>o s i i R; s6 failed to generate X509 fingerprint. Error message: %s( t
isinstanceRH t text_typeR< R t load_pem_x509_certificateR R> RF RG t fingerprintR t SHA1RI RJ R RK t
ValueErrort TypeErrort ErrorR
RM R ( t pem_keyt certRS t ex( ( s0 /usr/lib/python2.7/site-packages/dmapi/crypto.pyt generate_x509_fingerprintf s > i c C@ sl t j j | } t j } | j | | j } d | j | j f } t | } | | | f S( Ns %s %s Generated-by-Nova(
t paramikot RSAKeyt generateRH t StringIOt write_private_keyt getvaluet get_namet
get_base64RT ( t bitst keyt keyoutt private_keyRN RX ( ( s0 /usr/lib/python2.7/site-packages/dmapi/crypto.pyt generate_key_pairv s
c C@ sn t j j s d } n t | } t j j | sH t j d | n t
| d } | j SWd QXd S( s Get crl file for project.R R! N( R R R R" R R R R# R
t CryptoCRLFileNotFoundR% R& ( R t
crl_file_patht crlfile( ( s0 /usr/lib/python2.7/site-packages/dmapi/crypto.pyt fetch_crl s c C@ sÍ t | } t j j | s3 t j d | n t | d } | j } Wd QXy5 t j | d t j } | j
| t j SWn: t t t j f k
rÈ } t j d t j | n Xd S( NR t rbR; ( R R R R# R
t ProjectNotFoundR% R& R t load_pem_private_keyR" R R> t decryptR t PKCS1v15RZ R[ R t UnsupportedAlgorithmt DecryptionFailureRH RV ( R t textt private_key_filet ft datat priv_keyt exc( ( s0 /usr/lib/python2.7/site-packages/dmapi/crypto.pyt decrypt_text s c C@ s t | t j r$ | j d } n yA | j d } t j | t j } | j | t j
SWn. t k
r } t j
d t j | n Xd S( s_ Encrypt text with an ssh public key.
If text is a Unicode string, encode it to UTF-8.
s utf-8R; N( RU RH RV R< R R= R R> t encryptR Rv RL R
t EncryptionFailure( t ssh_public_keyRy RO t pub_keyR~ ( ( s0 /usr/lib/python2.7/site-packages/dmapi/crypto.pyt ssh_encrypt_text s c C@ s¬ y] t j d d d d d | d t | t j d d d d d d t j j d t | WnH t k
r t j d | n& t j
k
r§ t j d | n Xd
S( s Revoke a cert by file name.t opensslt cas -configs
./openssl.cnfs -revokeR, s -gencrls -outR N( R R1 R R R R t OSErrorR
Rs R t ProcessExecutionErrort RevokeCertFailure( R t file_name( ( s0 /usr/lib/python2.7/site-packages/dmapi/crypto.pyt revoke_cert© s
c C@ sB t j } x/ t j | | D] } t | d | d q Wd S( s Revoke all user certs.R R N( R t get_admin_contextR t certificate_get_all_by_userR ( t user_idt adminR^ ( ( s0 /usr/lib/python2.7/site-packages/dmapi/crypto.pyt revoke_certs_by_user· s c C@ sB t j } x/ t j | | D] } t | d | d q Wd S( s Revoke all project certs.R R N( R R R t certificate_get_all_by_projectR ( R R R^ ( ( s0 /usr/lib/python2.7/site-packages/dmapi/crypto.pyt revoke_certs_by_project¾ s c C@ sE t j } x2 t j | | | D] } t | d | d q" Wd S( s! Revoke certs for user in project.R R N( R R R t' certificate_get_all_by_user_and_projectR ( R R R R^ ( ( s0 /usr/lib/python2.7/site-packages/dmapi/crypto.pyt revoke_certs_by_user_and_projectÇ s c C@ s t j j | t j f S( s% Helper to generate user cert subject.( R R t project_cert_subjectR t isotime( R ( ( s0 /usr/lib/python2.7/site-packages/dmapi/crypto.pyt _project_cert_subjectÏ s c C@ s t j j | | t j f S( s% Helper to generate user cert subject.( R R t user_cert_subjectR R ( R R ( ( s0 /usr/lib/python2.7/site-packages/dmapi/crypto.pyt _user_cert_subjectÔ s c C@ s^ t | | } t j Ò } t j j t j j | d } t j j t j j | d } t j d d d | t | t j d d d d | d | d d
|
t | } | j
} Wd QXt | } | j
} Wd QXWd QXt | | \ }
} t j j t | d |
} i | d
6| d 6| d 6}
t
j t j |
| | f S( s- Generate and sign a cert for user in project.s temp.keys temp.csrR
t genrsas -outt reqs -news -keys -batchs -subjNs newcerts/%s.pemR R R ( R R t tempdirR R R- R R1 t strR% R& t sign_csrR R t certificate_createR R ( R R Ri t subjectt tmpdirt keyfilet csrfileR{ Rl t csrt serialt
signed_csrt fnameR^ ( ( s0 /usr/lib/python2.7/site-packages/dmapi/crypto.pyt generate_x509_certÚ s$ !!
c C@ sO d | } d | } t j } t j j t j j | d } t j j t j j | d } t | | t j d d d d d d
d | d d
| d d d | d | d d d t \ } } t j d d d d | d d d | d t \ } } t j
| }
t | } t j
r<|
j d }
| j d } n Wd QX|
| | f S( s: Generate a cert for passwordless auth for user in project.s /CN=%ss %s@localhosts temp.keys temp.confR
R s -x509s -nodess -dayst 3650s -configs -newkeys rsa:%ss -outformt PEMs -keyouts -subjs -extensionst
v3_req_clientt binaryt pkcs12s -exports -inkeys -passwords pass:t
process_inputR6 s utf-8N( R R R R R- R t _create_x509_openssl_configR1 t TrueR? t b64encodeR` RH RI RJ ( R Ri R t upnR¡ R¢ t conffilet certificatet _errt outRl RX ( ( s0 /usr/lib/python2.7/site-packages/dmapi/crypto.pyt generate_winrm_x509_certò s,
!!
c C@ s3 d } t | d } | j | | Wd QXd S( Ns® distinguished_name = req_distinguished_name
[req_distinguished_name]
[v3_req_client]
extendedKeyUsage = clientAuth
subjectAltName = otherName:1.3.6.1.4.1.311.20.2.3;UTF8:%s
t w( R% t write( R³ R² t contentt file( ( s0 /usr/lib/python2.7/site-packages/dmapi/crypto.pyR¯ s c C@ st t j j t | sp t j j t j j t j j t d d } t j d | | t
| d t n d S( NR* s geninter.shR+ R, ( R R R# R R- R R. R/ R R1 R R ( R t geninter_sh_path( ( s0 /usr/lib/python2.7/site-packages/dmapi/crypto.pyt _ensure_project_folder s
'c C@ s² t | } t j j | d } t j j | d } t j j | rL d St d | d \ } } t | d } | j | Wd QXt | d } | j | Wd QXd S( Ns
server.keys
server.crts project-vpni R¸ ( R R R R R# R¨ R% R¹ ( R t project_foldert key_fnt crt_fnRj R¤ R¢ t crtfile( ( s0 /usr/lib/python2.7/site-packages/dmapi/crypto.pyt generate_vpn_files% s c C@ sH t j j s d } n | s+ t | t St | t | t | S( N( R R R R" t _sign_csrR R½ ( t csr_textR ( ( s0 /usr/lib/python2.7/site-packages/dmapi/crypto.pyR 8 s
c
C@ sY t j G} t j j | d } t j j | d } y) t | d } | j | Wd QXWn7 t k
r t j t
j t d Wd QXn Xt
j
d | t j | t j d d d d | d
d d | d
| t j d d d | d d d
| \ } } | j d d j } t | d } | | j f SWd QXWd QXd S( Ns inbound.csrs outbound.csrR¸ s Failed to write inbound.csrs Flags path: %sR
R s -batchs -outs -configs
./openssl.cnfs -infilesR, R s -ins -serials -nooutt =i R! ( R R R R R R% R¹ t IOErrorR t save_and_reraise_exceptiont LOGR
R t debugR
R0 R1 t
rpartitiont stripR& (
RÄ R R¡ t inboundt outboundR£ R¶ Rµ R¥ RÁ ( ( s0 /usr/lib/python2.7/site-packages/dmapi/crypto.pyRÃ A s$
(B t __doc__t
__future__R R? RF R t cryptographyR t cryptography.hazmatR t) cryptography.hazmat.primitives.asymmetricR t cryptography.hazmat.primitivesR R R t oslo_concurrencyR t oslo_logR t loggingt
oslo_utilsR R
Ra RH t
dmapi.conft dmapiR R R
t
dmapi.i18nR R R t getLoggert __name__RÈ t confR R" R R R R R) R4 RT R` Rm Rq R R R R R R R R R¨ R· R¯ R½ RÂ R RÃ ( ( ( s0 /usr/lib/python2.7/site-packages/dmapi/crypto.pyt <module> sb