golden hour
/opt/saltstack/salt/lib/python3.10/site-packages/salt/runners/__pycache__
⬆️ Go Up
Upload
File/Folder
Size
Actions
__init__.cpython-310.pyc
197 B
Del
OK
asam.cpython-310.pyc
7.9 KB
Del
OK
auth.cpython-310.pyc
1.89 KB
Del
OK
bgp.cpython-310.pyc
12.55 KB
Del
OK
cache.cpython-310.pyc
10.98 KB
Del
OK
cloud.cpython-310.pyc
4.16 KB
Del
OK
config.cpython-310.pyc
1.08 KB
Del
OK
ddns.cpython-310.pyc
6.7 KB
Del
OK
digicertapi.cpython-310.pyc
16.23 KB
Del
OK
doc.cpython-310.pyc
1.76 KB
Del
OK
drac.cpython-310.pyc
4.15 KB
Del
OK
error.cpython-310.pyc
771 B
Del
OK
event.cpython-310.pyc
2.32 KB
Del
OK
f5.cpython-310.pyc
8.29 KB
Del
OK
fileserver.cpython-310.pyc
17.12 KB
Del
OK
git_pillar.cpython-310.pyc
3.54 KB
Del
OK
http.cpython-310.pyc
2.55 KB
Del
OK
jobs.cpython-310.pyc
13.26 KB
Del
OK
launchd.cpython-310.pyc
1.49 KB
Del
OK
lxc.cpython-310.pyc
13.3 KB
Del
OK
manage.cpython-310.pyc
21.71 KB
Del
OK
mattermost.cpython-310.pyc
4.21 KB
Del
OK
mine.cpython-310.pyc
1.79 KB
Del
OK
nacl.cpython-310.pyc
8.46 KB
Del
OK
net.cpython-310.pyc
27.7 KB
Del
OK
network.cpython-310.pyc
2.59 KB
Del
OK
pagerduty.cpython-310.pyc
3.96 KB
Del
OK
pillar.cpython-310.pyc
4.25 KB
Del
OK
pkg.cpython-310.pyc
1.37 KB
Del
OK
queue.cpython-310.pyc
8.14 KB
Del
OK
reactor.cpython-310.pyc
4.32 KB
Del
OK
salt.cpython-310.pyc
4.58 KB
Del
OK
saltutil.cpython-310.pyc
15.88 KB
Del
OK
sdb.cpython-310.pyc
2.54 KB
Del
OK
smartos_vmadm.cpython-310.pyc
7.99 KB
Del
OK
spacewalk.cpython-310.pyc
7.54 KB
Del
OK
ssh.cpython-310.pyc
1000 B
Del
OK
state.cpython-310.pyc
8.22 KB
Del
OK
survey.cpython-310.pyc
5.07 KB
Del
OK
test.cpython-310.pyc
2.65 KB
Del
OK
thin.cpython-310.pyc
1.81 KB
Del
OK
vault.cpython-310.pyc
10.01 KB
Del
OK
venafiapi.cpython-310.pyc
5.57 KB
Del
OK
virt.cpython-310.pyc
13.15 KB
Del
OK
vistara.cpython-310.pyc
4.39 KB
Del
OK
winrepo.cpython-310.pyc
5.14 KB
Del
OK
Edit: digicertapi.cpython-310.pyc
o �xe�V � @ s� d Z ddlZddlZddlZddlZddlZddlmZ ddlZ ddl m Z ddl Z ddl Z ddlZ ddlmZmZ z ddlmZ dZW n# eyg dZzddlmZ W n eyd ddlmZ Y nw Y nw dZe�e�Zd d � Z d d � Z d d� Z dd� Z d2dd�Z d2dd�Z!d2dd�Z" d3dd�Z#d4dd�Z$ d5d d �Z%d6d d �Z&d!d"� Z' # d7d$d%�Z(d&d'� Z)d(d)� Z*d*d+� Z+d,d-� Z,d.d/� Z-d0d1� Z.dS )8a< Support for Digicert. Heavily based on the Venafi runner by Joseph Hall (jphall@saltstack.com). Before using this module you need to register an account with Digicert's CertCentral. Login to CertCentral, ensure you have a payment method configured and/or there are adequate funds attached to your account. Click the ``Account`` item in the left sidebar, and select ``Account Access``. The right hand pane should show "Account Access" and a link to create an API key. Create a new API key and assign it to the user that should be attached to requests coming from Salt. NOTE CertCentral will not show the API key again after revealing it the first time. Make sure you copy it right away or you will have to revoke it and generate a new one. Now open ``/etc/salt/master`` and add the API key as shown below. .. code-block:: yaml digicert: api_key: ABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABC Restart your Salt Master. You can also include default values of the following variables to help with creating CSRs: .. code-block:: yaml digicert: api_key: ABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABC shatype: sha256 This API currently only supports RSA key types. Support for other key types will be added if interest warrants. � N)�Sequence)�CommandExecutionError�SaltRunnerError)�RSATF�digicertc C s t �di ��d�r tS dS )zE Only load the module if digicert has configuration in place r �api_keyF)�__opts__�get�__virtualname__� r r �L/opt/saltstack/salt/lib/python3.10/site-packages/salt/runners/digicertapi.py� __virtual__B s r c C � t �di ��dd�S )z Return the base_url r Zbase_urlz%https://www.digicert.com/services/v2/�r r r r r r � _base_urlK s �r c C r )z Return the API key r r � r r r r r �_api_keyT s r c O s� t jjj| fi |��}d|d v r|d S t|d d d �}t|d d d �}|dkr/i S || d }|dkr?|d | S |d | }|d } td|�D ] } | d �|| d � } t jj�| |�} || �| d | � qN|S ) zN Wrapper to assist with paginated responses from Digicert's REST API. �errors�dictZpage�limit�totalr � � z ?offset={})�salt�utils�http�query�int�range�format�extend) �urlZtopkey�args�kwargs�retZlimr ZnumpagesZ aggregate_ret�pZ param_urlZnext_retr r r � _paginate[ s" r& c C sH | r d� t� | �}nd� t� �}t|ddddt� dd�d �}d|i}|S ) z� List domains that CertCentral knows about. You can filter by container_id (also known as "Division") by passing a container_id. CLI Example: .. code-block:: bash salt-run digicert.list_domains z {}/domain?{}z {}/domain�domains�GETT�json�application/json�� X-DC-DEVKEY� Content-Type��method�decode� decode_type� header_dict�r r r& r )� container_idr! �orgsr$ r r r � list_domainsz s � r6 c C sJ | r d� t� | �}nd� t� �}t|dddddt� dd �d �}d|i}|S ) z� List certificate requests made to CertCentral. You can filter by status: ``pending``, ``approved``, ``rejected`` CLI Example: .. code-block:: bash salt-run digicert.list_requests pending z{}/request?status={}z {}/request�requestsr( Tr) Fr* r+ �r/ r0 r1 � raise_errorr2 r3 ��statusr! Zreqsr$ r r r � list_requests� s � r< c C s6 d� t� �}t|dddddt� dd�d �}d|i}|S ) z� List certificate orders made to CertCentral. CLI Example: .. code-block:: bash salt-run digicert.list_orders z{}/order/certificateZordersr( Tr) Fr* r+ r8 r3 r: r r r � list_orders� s � r= �pem_allc C sj | rJt jjjd�t� | �ddddt� dd�d�}|d �d �d kr'd |d iS |d �d d�r5d |d iS |d �d ��dd�}|d �d ��d�}|sUd d ddd�iiS |rpt jjjd�t� ||�dddd|ddt� id�}nt jjjd�t� ||�dddddt� id�}d |v r�d |iS d|vr�d |i}|} t|t �r�|d }|} n|}|} d} |s�t � � \} } | }t � | | � t �| � dddd d d d |g} t�| �} d}| �� D ]}t�d |�}|r�|�d!�} nq�| r�t �| � |�rd"}t j�ttj�}z|�||�}W n t �y d | i}Y nw |� |||� d#|v �r1d ||d# �d$d%�|d# �d&d%�d'�iS d | iS )(a� Retrieve a certificate by order_id or certificate_id and write it to stdout or a filename. A list of permissible cert_formats is here: https://www.digicert.com/services/v2/documentation/appendix-certificate-formats CLI Example: .. code-block:: bash salt-run digicert.get_certificate order_id=48929454 cert_format=apache Including a 'filename' will write the certificate to the desired file. Note that some cert formats are zipped files, and some are binary. If the certificate has not been issued, this function will return the order details inside of which will be a status (one of pending, rejected, processing, issued, revoked, canceled, needs_csr, and needs_approval) If for some reason you want to pipe the output of this command to a file or other command you will want to leave off the ``filename`` argument and make sure to include ``--no-color`` so there will be no terminal ANSI escape sequences. z{}/order/certificate/{}r( FTr) r* r+ )r/ r9 r0 r1 r2 r r; Zissued� certificater �idN� common_name�unknownzTUnknown error, no certificate ID passed on command line or in body returned from API)�code�messagez${}/certificate/{}/download/format/{}r, )r/ r0 �text�headersZtext_outr9 r2 )r/ rE r0 r9 r2 �body�opensslZx509z-nooutz-subjectz-nameoptZ multilinez-inz *commonName *= *(.*)r �digicert/domainsrF zContent-Dispositionz Not providedr- )�filenameZoriginal_filenamer- ) r r r r r r r r � isinstancer �tempfileZmkstemp�os�write�close� subprocess� check_output� splitlines�re�search�group�unlink�cache�Cacher �syspaths� CACHE_DIR�fetch� TypeError�store)�order_idZcertificate_id� minion_idZ cert_formatrJ Z order_certrA Zret_certr$ �certZ tmpfilename�fd�cmd�out�lZcommon_name_match�bankrW �datar r r �get_certificate� s� �� ��� �� �� � � � ��� rg c C s0 t d�t� �ddddt� dd�d�}d|i}|S ) a` List organizations that CertCentral knows about. You can filter by container_id (also known as "Division") by passing a container_id. This function returns validation information by default; pass ``include_validation=False`` to turn it off. CLI Example: .. code-block:: bash salt-run digicert.list_organizations z{}/organizationZ organizationsr( Tr) r* r+ r. )r& r r r )r4 Zinclude_validationr5 r$ r r r �list_organizationsh s � rh � c C s |r t |t�r |g}|rt |t�std��d|i}||d< |r$||d< n t�di ��dd�|d< i }|r<t |t�r<|g}|rGt |t�sGtd��|rM||d < |r_t| |||d |d ||d �}n t| |||d ||d �}||d < | rw| |d d< d|i|d< | r�| |d< |r�||d< | r�| |d< | |d< | r�d| i|d< |r�||d< ||d< tjj � |�}tjj j d� t� �d|dd t� d d �d d �}d!|d" vr�d#}tj�ttj�}|�||�}|d$u r�i }|�| |d" d% d d |d&�� |�|||� t| |� d'|d" iS )(a� Order a certificate. Requires that an Organization has been created inside Digicert's CertCentral. See here for API documentation: https://www.digicert.com/services/v2/documentation/order/order-ssl-determinator CLI Example: .. code-block:: bash salt-run digicert.order_certificate my_minionid my.domain.com 10 3 signature_hash=sha256 dns_names=['this.domain.com', 'that.domain.com'] organization_units='My Domain Org Unit' comments='Comment goes here for the approver' This runner can also be used to renew a certificate by passing `renewal_of_order_id`. Previous order details can be retrieved with digicertapi.list_orders. zDorder_certificate needs a single dns_name, or an array of dns_names.rA � dns_names�signature_hashr �shatype�sha256z,Organization_units is not a valid data type.�organization_unitsr )�ou_namerl �key_len�password)rl rp rq �csr�server_platformr@ Z organization�custom_expiration_date�validity_years�comments� disable_renewal_notificationsZ type_hint�product�renewal_of_order_idr? z{}/order/certificate/ssl�POSTTr) r* r+ F)r/ rf r0 r1 r2 r9 r r rI Nr7 )r_ r^ rr Zorder)rK �strr r r r �gen_csrr r r) �dumpsr r r r r rW rX rY rZ r[ �updater] �_id_map)r_ rA �organization_idru Zcert_key_passphraserk rp rj rn rs rt rv rw Zproduct_type_hintry r? rG rr � encoded_body�qdatare rW rf r r r �order_certificate� s� %� �� � � �� r� c s� d}|dkrZt rt�|d�}|jd� fdd�d�}n tj|d�}|�d� �}|d urZd }tj�t t j �}z|� ||�} || d < | | d < W n t yR || d �} Y nw |�||| � |S )z� Generate and return a private_key. If a ``dns_name`` is passed in, the private_key will be cached under that name. CLI Example: .. code-block:: bash salt-run digicert.gen_key <minion_id> [dns_name] [password] r i Z des_ede3_cbcc s t � �S �N)�bytes)�x�rq r r �<lambda> s zgen_key.<locals>.<lambda>)�cipher�callback)�bitsZPEMNrI � private_keyr_ )r� r_ )�HAS_M2r �gen_keyZas_pemZgenerateZ exportKeyr rW rX r rY rZ r[ r\ r] ) r_ �dns_namerq rp Z keygen_type�genr� re rW rf r r� r r� s* � �r� c C s. t jjjd�t� | �dddt� dd�d�}|S )z� Return the details for an organization CLI Example: .. code-block:: bash salt-run digicert.get_org_details 34 Returns a dictionary with the org details, or with 'error' and 'status' keys. z{}/organization/{}r( Tr) r* r+ r. )r r r r r r r )r� r� r r r �get_org_details0 s �r� rm c C s� t |�}d|v rtd�||d ���|d �dd�dkr#td�|���t�� }t�|d� d } tj � t t j �} | �| |�} | d u rCi } d | vrQt| |||d �| d < d �|�} d�|�} tjj�| d��}|�tjj�| d �� W d � n1 szw Y d�|d d |d d |d d |d d �}|r�|d�|� }|d�|� }d�|| | |�}td d|�}d|v r�td��tjj�| d ��}tjj�|�� �}W d � n1 s�w Y | | d < || d < | �| || � |S ) zk CLI Example: .. code-block:: bash salt-run digicert.gen_csr <minion_id> <dns_name> �errorz@Problem getting organization details for organization_id={} ({})r r; ZactiveZinactivez7Organization with organization_id={} is marked inactivei� rI Nr� )rp z{}/privz{}/csr�wz/C={}/ST={}/L={}/O={}Zcountry�stateZcityZ display_namez/OU={}z/CN={}z/openssl req -new -{} -key {} -out {} -subj '{}'zsalt.cmdzcmd.runz#problems making Certificate RequestzwThere was a problem generating the CSR. Please ensure that you have a valid Organization established inside CertCentral�rr_ rr )r� r r r rL ZmkdtemprM �chmodr rW rX r rY rZ r[ r� r �filesZfopenrN Z stringutilsZto_strZ__salt__r Z to_unicode�readr] )r_ r� r� ro rp rl rq Z org_detailsZtmpdirre rW rf ZtmpprivZtmpcsrZif_�subjectrb �outputZof_rr r r r r| G sf ���� � ��� �r| c C sR d}t j�ttj�}|�|| �}t|t�sg }||vr |� |� |� || |� dS )zA Maintain a relationship between a minion and a dns name zdigicert/minionsN) r rW rX r rY rZ r[ rK �list�appendr] )r_ r� re rW rj r r r r � s r c C sj t jjjd�t� | �ddddt� id�}|d }t|��d�s&t|��d�r/t d �|d ���|� d i �S ) z� Show organization information, especially the company id CLI Example: .. code-block:: bash salt-run digicert.show_company example.com z{}/companies/domain/{}Tr) � tppl-api-key�r; r0 r1 r2 r; �4�5�There was an API error: {}r� r � r r r r r r r r{ � startswithr r )�domainrf r; r r r �show_organization� s � r� c C sh t jjjd�t� �ddddt� id�} | d }t|��d�s%t|��d�r.t d �| d ���| � d i �S ) z� Show certificate requests for this API key CLI Example: .. code-block:: bash salt-run digicert.show_csrs z{}/certificaterequestsTr) r� r� r; r� r� r� r� r r� )rf r; r r r � show_csrs� s � r� c C s( t j�ttj�}d}|�||�}|d S )z� Show a private RSA key CLI Example: .. code-block:: bash salt-run digicert.show_rsa myminion domain.example.com rI r� )r rW rX r rY rZ r[ )r_ r� rW re rf r r r �show_rsa� s r� c C s t j�ttj�} | �d�S )z� List domains that have been cached CLI Example: .. code-block:: bash salt-run digicert.list_domain_cache rI )r rW rX r rY rZ r� )rW r r r �list_domain_cache� s r� c C s� t j�ttj�}t| t�r| �d�} t| t �st d��g }g }| D ] }z |� d|� |� |� W q! t y> |� |� Y q!w ||d�S )z� Delete cached domains from the master CLI Example: .. code-block:: bash salt-run digicert.del_cached_domain domain1.example.com,domain2.example.com �,zwYou must pass in either a string containing one or more domains separated by commas, or a list of single domain stringsrI )Z SucceededZFailed) r rW rX r rY rZ rK r{ �splitr� r �flushr� )r' rW �successZfailedr� r r r �del_cached_domain� s" � � r� r� )NNNr> N)NT) NNri NNNNNFNN)NNri )Nri rm N)/�__doc__ZloggingrM rS rP rL �collections.abcr Z salt.cacher Z salt.syspathsrY Zsalt.utils.filesZsalt.utils.httpZsalt.utils.jsonZsalt.exceptionsr r ZM2Cryptor r� � ImportErrorZCryptodome.PublicKeyZCrypto.PublicKeyr Z getLogger�__name__�logr r r r& r6 r< r= rg rh r� r� r� r| r r� r� r� r� r� r r r r �<module> s� $ ��� � � # �T
Save