Why Gemfury?
Push, build, and install
RubyGems
npm packages
Python packages
Maven artifacts
PHP packages
Go Modules
Debian packages
RPM packages
NuGet packages
Repository URL to install this package:
|
Version:
4.2.29-4.2 ▾
|
3
ÿna«0 ã @ sè d Z ddlmZ ddlZddlZddlZddlmZ ddlm Z ddl
m Z ddl m
Z
ddl mZ dd lmZ dd
lmZ dd lmZ dd lmZ dd
lmZ ddlZddlZddlZddlm Z ddlm Z ddlm Z ddl m Z m!Z! ddlm"Z" ej#e$Z%ej&j'Z'dFddZ(dGddZ)dHddZ*dIddZ+dJdd Z,d d Z-d d Z.d!d" Z/dKd$d%Z0d&d' Z1d(d) Z2d*d+ Z3d,d- Z4d.d/ Z5d0d1 Z6d2d3 Z7d4d5 Z8d6d7 Z9dLd8d9Z:dMd:d;Z;d<d= Z<d>d? Z=d@dA Z>dNdBdCZ?dDdE Z@dS )OzzWrappers around standard crypto data elements.
Includes root and intermediate CAs, SSH key_pairs and x509 certificates.
é )Úabsolute_importN)Ú
exceptions)Úbackends)Úpadding)Úhashes)Ú
serialization)Úx509)Ú processutils)Úlog)Úexcutils)Ú fileutils)Úcontext)Údb)Ú exception)Ú_Ú_LE)Úutilsc C s( t jjr | r tjjt jjd| S t jjS )NZprojects)ÚCONFÚcryptoÚuse_project_caÚosÚpathÚjoinÚca_path)Ú
project_id© r ú /usr/lib/python3.6/crypto.pyÚ ca_folder* s r c C s t jjt| tjjS )N)r r r r r r Zca_file)r r r r r 0 s r c C s t jjt| tjjS )N)r r r r r r Zkey_file)r r r r Úkey_path4 s r c C s t jjt| tjjS )N)r r r r r r Úcrl_file)r r r r Úcrl_path8 s r c C sJ t jjs d } t| }tjj|s,tj| dt |d
}|j
S Q R X d S )N)ÚprojectÚr) r r r r r r Úexistsr ZCryptoCAFileNotFoundÚopenÚread)r Z ca_file_pathZcafiler r r Úfetch_ca< s r& c C sR t } tjjt sNtjjtjjtjjtdd}t j
| t j d|| d dS )z Ensure the CA filesystem exists.ÚCAz genrootca.shÚsh)ÚcwdN)
r r r r# r Úabspathr ÚdirnameÚ__file__r Ú ensure_treer Úexecute)Zca_dirZgenrootca_sh_pathr r r Úensure_ca_filesystemF s
r/ c C sÆ y| j d}tj|tj tj| jdd }tj tj
tj }|j | |j }t
j|}tjrp|jd}djdd t|d d d
|dd d
D S tk
rÀ tjtd d
Y nX d S ) Nzutf-8ú é Úasciiú:c s s | ]\}}|| V qd S )Nr )Ú.0ÚaÚbr r r ú <genexpr>` s z'generate_fingerprint.<locals>.<genexpr>é z failed to generate fingerprint)Úreason)Úencoder Úload_ssh_public_keyr Údefault_backendÚbase64Z b64decodeÚsplitr ZHashZMD5ÚupdateÚfinalizeÚbinasciiÚhexlifyÚsixÚPY3Údecoder ÚzipÚ Exceptionr ÚInvalidKeypairr )Ú
public_keyÚ pub_bytesZpub_dataZdigestZmd5hashÚraw_fpr r r Úgenerate_fingerprintQ s
.rL c C s¼ yxt | tjr| jd} tj| tj }tj |j
t j }tj
rL|jd}djdd t|d d d
|dd d
D S tttjfk
r¶ } ztjtd| d W Y d d }~X nX d S )
Nzutf-8r2 r3 c s s | ]\}}|| V qd S )Nr )r4 r5 r6 r r r r7 o s z,generate_x509_fingerprint.<locals>.<genexpr>r8 r1 z6failed to generate X509 fingerprint. Error message: %s)r9 )Ú
isinstancerC Ú text_typer: r Zload_pem_x509_certificater r< rA rB Ú fingerprintr ZSHA1rD rE r rF Ú
ValueErrorÚ TypeErrorÚErrorr rH r )Zpem_keyÚcertrK Zexr r r Úgenerate_x509_fingerprintf s
.rT é c C sL t jj| }tj }|j| |j }d|j |j f }t |}|||fS )Nz%s %s Generated-by-Nova)
ÚparamikoZRSAKeyZgeneraterC ÚStringIOZwrite_private_keyÚgetvalueZget_nameZ
get_base64rL )ÚbitsÚkeyZkeyoutÚ private_keyrI rO r r r Úgenerate_key_pairv s
r\ c C sJ t jjs d} t| }tjj|s,tj| dt |d
}|j
S Q R X dS )zGet crl file for project.N)r! r" ) r r r r r r r# r ZCryptoCRLFileNotFoundr$ r% )r Z
crl_file_pathZcrlfiler r r Ú fetch_crl s r] c C s¢ t | }tjj|s tj| dt|d}|j }W d Q R X y"tj |d t
j }|j |t
j S tttjfk
r } ztjtj|dW Y d d }~X nX d S )N)r Úrb)r9 )r r r r# r ÚProjectNotFoundr$ r% r Zload_pem_private_keyr r< Zdecryptr ÚPKCS1v15rP rQ r ZUnsupportedAlgorithmZDecryptionFailurerC rN )r ÚtextZprivate_key_fileÚfÚdataZpriv_keyÚexcr r r Ú decrypt_text s re c C sz t |tjr|jd}y*| jd}tj|tj }|j|t j
S t k
rt } zt j
tj|dW Y dd}~X nX dS )z_Encrypt text with an ssh public key.
If text is a Unicode string, encode it to UTF-8.
zutf-8)r9 N)rM rC rN r: r r; r r< Zencryptr r` rG r ZEncryptionFailure)Zssh_public_keyra rJ Zpub_keyrd r r r Ússh_encrypt_text s
rf c C s yBt jddddd|t| d t jddddddtjjt| d W n@ tk
rb tj| d Y n" t j
k
r tj | d Y nX d
S ) zRevoke a cert by file name.ÚopensslÚcaz-configz
./openssl.cnfz-revoke)r) z-gencrlz-out)r N) r r. r r r r ÚOSErrorr r_ r ZProcessExecutionErrorZRevokeCertFailure)r Ú file_namer r r Ú revoke_cert© s rk c C s4 t j }x&tj|| D ]}t|d |d qW dS )zRevoke all user certs.r rj N)r
Úget_admin_contextr Zcertificate_get_all_by_userrk )Úuser_idÚadminrS r r r Úrevoke_certs_by_user· s ro c C s4 t j }x&tj|| D ]}t|d |d qW dS )zRevoke all project certs.r rj N)r
rl r Z certificate_get_all_by_projectrk )r rn rS r r r Úrevoke_certs_by_project¾ s rp c C s6 t j }x(tj|| |D ]}t|d |d qW dS )z!Revoke certs for user in project.r rj N)r
rl r Z'certificate_get_all_by_user_and_projectrk )rm r rn rS r r r Ú revoke_certs_by_user_and_projectÇ s rq c C s t jj| tj f S )z%Helper to generate user cert subject.)r r Zproject_cert_subjectr Úisotime)r r r r Ú_project_cert_subjectÏ s rs c C s t jj|| tj f S )z%Helper to generate user cert subject.)r r Zuser_cert_subjectr rr )rm r r r r Ú_user_cert_subjectÔ s
rt c C sü t | |}tj }tjjtjj|d}tjjtjj|d}tjddd|t| tjdddd|d|d d
|
t |}|j
}W d Q R X t |}|j
} W d Q R X W d Q R X t | |\}
} tjjt |d |
} | || d
}
t
jtj |
|| fS )z-Generate and sign a cert for user in project.ztemp.keyztemp.csrrg Zgenrsaz-outÚreqz-newz-keyz-batchz-subjNznewcerts/%s.pem)rm r rj )rt r Útempdirr r r* r r. Ústrr$ r% Úsign_csrr r Zcertificate_creater
rl )rm r rY ÚsubjectÚtmpdirÚkeyfileÚcsrfilerb r[ ÚcsrÚserialZ
signed_csrZfnamerS r r r Úgenerate_x509_certÚ s$
r c C sè d| }d| }t j À}tjjtjj|d}tjjtjj|d}t|| t jddddd d
d |d d
| ddd|d|dddd\}}t jdddd|dd|dd \} }tj | }
t
|} t j rÔ|
j
d }
|j
d }W d Q R X |
|| fS ) z:Generate a cert for passwordless auth for user in project.z/CN=%sz %s@localhostztemp.keyz temp.confrg ru z-x509z-nodesz-daysZ3650z-configz-newkeyzrsa:%sz-outformZPEMz-keyoutz-subjz -extensionsZ
v3_req_clientT)ÚbinaryZpkcs12z-exportz-inkeyz -passwordzpass:)Z
process_inputr r2 zutf-8N)r rv r r r* r Ú_create_x509_openssl_configr. r= Z b64encoderT rC rD rE ) rm rY ry Úupnrz r{ ÚconffileZ certificateÚ_errÚoutr[ rO r r r Úgenerate_winrm_x509_certò s,
r c
C s, d}t | d}|j|| W d Q R X d S )Nz®distinguished_name = req_distinguished_name
[req_distinguished_name]
[v3_req_client]
extendedKeyUsage = clientAuth
subjectAltName = otherName:1.3.6.1.4.1.311.20.2.3;UTF8:%s
Úw)r$ Úwrite)r r ZcontentÚfiler r r r s r c C sN t jjt| sJt jjt jjt jjtdd}tj d|| t
| t d d S )Nr' z geninter.shr( )r) ) r r r# r r* r r+ r, r r. rs r )r Zgeninter_sh_pathr r r Ú_ensure_project_folder s
r c C s t | }tjj|d}tjj|d}tjj|r4d S td| d\}}t|d}|j| W d Q R X t|d}|j| W d Q R X d S )Nz
server.keyz
server.crtz project-vpni r )r r r r r# r r$ r )r Zproject_folderZkey_fnZcrt_fnrZ r} r{ Úcrtfiler r r Úgenerate_vpn_files% s r c C s2 t jjs d }|s t| t S t| t| t|S )N)r r r Ú _sign_csrr r )Úcsr_textr r r r rx 8 s rx c
C s t j þ}tjj|d}tjj|d}y$t|d}|j| W d Q R X W n6 tk
r tj t
j t d W d Q R X Y nX t
j
d| tj| t jdddd |d
d d ||d
t jddd|dd|d
\}}|jdd j }t|d} || j fS Q R X W d Q R X d S )Nz inbound.csrz outbound.csrr zFailed to write inbound.csrzFlags path: %srg rh z-batchz-outz-configz
./openssl.cnfz-infiles)r) r z-inz-serialz-nooutú=r8 r" )r rv r r r r$ r ÚIOErrorr Zsave_and_reraise_exceptionÚLOGr r Údebugr r- r. Ú
rpartitionÚstripr% )
r r rz ZinboundZoutboundr| r
r r~ r r r r r A s$
r )N)N)N)N)N)rU )rU )rU )N)AÚ__doc__Z
__future__r r= rA r Z cryptographyr Zcryptography.hazmatr Z)cryptography.hazmat.primitives.asymmetricr Z cryptography.hazmat.primitivesr r r Zoslo_concurrencyr Zoslo_logr
ZloggingZ
oslo_utilsr r rV rC Z
dmapi.confZdmapir
r r Z
dmapi.i18nr r r Z getLoggerÚ__name__r Zconfr r r r r r& r/ rL rT r\ r] re rf rk ro rp rq rs rt r r r r r rx r r r r r Ú<module> sb