Your IP : 216.73.217.13
U
�Ad; � @ s4 U d Z ddlZddlmZ ddlmZ ddlmZ ddlmZm Z ddl
m Z ddl m
Z
dd lmZmZ dd
lmZ e�e�Zdd d d
dgd�Zddddddgd�iZdZddddgZdddeeeed �gd d gd �Zeed < ee�Z d!d"� Z d#d$� Z d%d&� Z d'd(� Z d)d*� Z d+d,� Z!e"e
e ee#dd-�d.d/�Z$dS )0z CA Certs: Add ca certificates.� N)�Logger)�dedent)�log)�subp�util)�Cloud)�Config)�
MetaSchema� get_meta_doc)� PER_INSTANCEz!/usr/local/share/ca-certificates/z#cloud-init-ca-cert-{cert_index}.crtz/etc/ca-certificates.confzupdate-ca-certificates)� ca_cert_path�ca_cert_local_path�ca_cert_filename�ca_cert_config�ca_cert_update_cmd�rhelz/etc/pki/ca-trust/z /usr/share/pki/ca-trust-source/z+anchors/cloud-init-ca-cert-{cert_index}.crtzupdate-ca-trusta/ This module adds CA certificates to the system's CA store and updates any
related files using the appropriate OS-specific utility. The default CA
certificates can be disabled/deleted from use by the system with the
configuration option ``remove_defaults``.
.. note::
certificates must be specified using valid yaml. in order to specify a
multiline certificate, the yaml multiline list syntax must be used
.. note::
Alpine Linux requires the ca-certificates package to be installed in
order to provide the ``update-ca-certificates`` command.
�alpine�debian�ubuntuZ cc_ca_certszCA CertificateszAdd ca certificatesa ca_certs:
remove_defaults: true
trusted:
- single_line_cert
- |
-----BEGIN CERTIFICATE-----
YOUR-ORGS-TRUSTED-CA-CERT-HERE
-----END CERTIFICATE-----
�ca_certs�ca-certs)�id�name�titleZ description�distrosZ frequencyZexamplesZactivate_by_schema_keys�metac C s* t �| t�}tj�|d |d �|d< |S )z�Return a distro-specific ca_certs config dictionary
@param distro_name: String providing the distro class name.
@returns: Dict of distro configurations for ca_cert.
r
r �ca_cert_full_path)�DISTRO_OVERRIDES�get�DEFAULT_CONFIG�os�path�join)� distro_name�cfg� r% �>/usr/lib/python3/dist-packages/cloudinit/config/cc_ca_certs.py�_distro_ca_certs_configsP s �r' c C s t j | d dd� dS )z�
Updates the CA certificate cache on the current machine.
@param distro_cfg: A hash providing _distro_ca_certs_configs function.
r F)ZcaptureN)r ��
distro_cfgr% r% r& �update_ca_certs] s r* c C sH |sdS t |d�D ]0\}}t|�}| d j|d�}tj||dd� qdS )a-
Adds certificates to the system. To actually apply the new certificates
you must also call the appropriate distro-specific utility such as
L{update_ca_certs}.
@param distro_cfg: A hash providing _distro_ca_certs_configs function.
@param certs: A list of certificate strings.
N� r )�
cert_indexi� )�mode)� enumerate�str�formatr �
write_file)r) Zcertsr, �cZcert_file_contentsZcert_file_namer% r% r& � add_ca_certsf s �r3 c C s> | dkrt |� n(| dkr:t|� | dkr:d}t�d|� dS )a.
Disables all default trusted CA certificates. For Alpine, Debian and
Ubuntu to actually apply the changes you must also call
L{update_ca_certs}.
@param distro_name: String providing the distro class name.
@param distro_cfg: A hash providing _distro_ca_certs_configs function.
r )r r r )r r z8ca-certificates ca-certificates/trust_new_crts select no)zdebconf-set-selections�-N)�remove_default_ca_certs�disable_system_ca_certsr )r# r) Z debconf_selr% r% r& �disable_default_ca_certs{ s
�r7 c C s� | d dkrdS d}d}t �| d �jdkr�t�| d �}g }|�� D ]\}||krbd}|�|� qF|dksv|d dkr�|�|� qF|s�|�|� d}|�d | � qFtj| d d
�|�d
d d � dS )
z�
For every entry in the CA_CERT_CONFIG file prefix the entry with a "!"
in order to disable it.
@param distro_cfg: A hash providing _distro_ca_certs_configs function.
r Nz;# Modified by cloud-init to deselect certs due to user-dataFr T� )�#�!r: �
�wb)Zomode) r �stat�st_sizer Z load_file�
splitlines�appendr1 r" )r) Zheader_commentZ added_headerZorigZ out_lines�liner% r% r& r6 � s. �
�r6 c C s: | d dkrdS t �d� t�| d � t�| d � dS )z�
Removes all default trusted CA certificates from the system.
@param distro_cfg: A hash providing _distro_ca_certs_configs function.
r Nz Deleting system CA certificatesr
)�LOG�debugr Zdelete_dir_contentsr( r% r% r& r5 � s
r5 )r r$ �cloudr �args�returnc C s� d|krt �d� nd|kr,t �d| � dS d|krFd|krFt �d� |�d|�d��}t|jj�}d|krvt �d� |�d |�dd
��r�t �d � t|jj|� d |kr�t� |d �}|r�t �d
t
|�� t ||� t �d� t |� dS )au
Call to handle ca_cert sections in cloud-config file.
@param name: The module name "ca_cert" from cloud.cfg
@param cfg: A nested dict containing the entire cloud config contents.
@param cloud: The L{CloudInit} object in use.
@param log: Pre-initialized Python logger object to use for logging.
@param args: Any module arguments from cloud.cfg
r zFDEPRECATION: key 'ca-certs' is now deprecated. Use 'ca_certs' instead.r z<Skipping module named %s, no 'ca_certs' key in configurationNzMFound both ca-certs (deprecated) and ca_certs config keys. Ignoring ca-certs.zremove-defaultszfDEPRECATION: key 'ca-certs.remove-defaults' is now deprecated. Use 'ca_certs.remove_defaults' instead.Zremove_defaultsFz'Disabling/removing default certificatesZtrustedzAdding %d certificateszUpdating certificates)
rB ZwarningrC r r' Zdistror r7 r Zget_cfg_option_list�lenr3 r* )r r$ rD r rE Z ca_cert_cfgr) Z
trusted_certsr% r% r& �handle� sB ��� �
�
rH )%�__doc__r Zloggingr �textwrapr Z cloudinitr r r Zcloudinit.cloudr Zcloudinit.configr Zcloudinit.config.schemar r
Zcloudinit.settingsr Z getLogger�__name__rB r r ZMODULE_DESCRIPTIONr r �__annotations__r' r* r3 r7 r6 r5 r/ �listrH r% r% r% r& �<module> sh
���
���
�