o

�N�g	?�@s�dZd
dl
Z
d
dlZd
dlZd
dlZd
dlZd
dlZd
dlZd
dl	m
Z
mZ
dZdZ
dZe�e�
ZdZdd	�Zd"dd�
Zd
d�Zdd�Zdd�Zeefdd�
Ze
dfdd�
Ze
eedddfdd�
Ze
eedfdd�
Zeed
ddfdd�
Zeefd d!�
ZdS)#a�

Microsoft certificate management via the PKI Client PowerShell module.
https://technet.microsoft.com/en-us/itpro/powershell/windows/pkiclient/pkiclient

The PKI Client PowerShell module is only available on Windows 8+ and Windows
Server 2012+.
https://technet.microsoft.com/en-us/library/hh848636(v=wps.620).aspx

:platform:      Windows

:depends:
    - PowerShell 4
    - PKI Client Module (Windows 8+ / Windows Server 2012+)

.. versionadded:: 2016.11.0
�N)�CommandExecutionError�SaltInvocationErrorZLocalMachine�cerZMyZwin_pkicCsVtj
j��sd
Stj
j�tdd�dkrdStdd�
ds d	Stj
j�	d
�
s)dSt
S)z�
    Requires Windows
    Requires Windows 8+ / Windows Server 2012+
    Requires PowerShell
    Requires PKI Client PowerShell module installed.
    )Fz!Only available on Windows SystemsZ	osversionz6.2.9200���)Fz4Only available on Windows 8+ / Windows Server 2012 +zcmd.shell_info�
powershellZ	installed)FzPowershell not availableZPKI)Fz#PowerShell PKI module not available)�salt�utils�platformZ
is_windowsZversionsZversion_cmpZ
__grains__�__salt__rZ
module_exists�__virtualname__�rr�H/opt/saltstack/salt/lib/python3.10/site-packages/salt/modules/win_pki.py�__virtual__%s



rFcCs�d
g
}|
r|�d�
|�
�

n|�|�

tdd�|�
ddd�}|dr-td	�
||d��
�
|
rNztjjj|d
dd�}|WSt	yM


td
�
|d
�
�
�
w|d
S)zh
    Ensure that the Pki module is loaded, and convert to and extract data from
    Json as needed.
    zImport-Module -Name PKI; z4ConvertTo-Json -Compress -Depth 4 -InputObject @({})zcmd.run_all�rT)�shellZpython_shell�stderrz'Unable to execute command: {}
Error: {}�stdoutF)
�strictz'Unable to parse return data as JSON:
{})
�append�formatr
�joinrrr�json�loads�
ValueError)�cmd�as_jsonZcmd_fullZcmd_ret�itemsrrr
�_cmd_run;s.

�


�

�





��rc
Cs.d
|�d�}
t�
t|
d�
�
std|���
�
dS)zS
    Ensure that the certificate path, as determind from user input, is valid.
    zTest-Path -Path '�
'�
rzInvalid path specified: N)�ast�literal_evalrr)�namerrrr
�_validate_cert_path]s
�r#c
Cs$d
dg}
||
v
rtd�
||
��
�
dS)zU
    Ensure that the certificate format, as determind from user input, is valid.
    r�pfxz<Invalid certificate format '{}' specified. Valid formats: {}N)rr)r"Zcert_formatsrrr
�_validate_cert_formatgs


���r%cCsRt�}d
}
t
|
dd�}|D]}t�||d<|dD]}||d�|�

qq
|S)z�
    Get the certificate location contexts and their corresponding stores.

    :return: A dictionary of the certificate location contexts and stores.
    :rtype: dict

    CLI Example:

    .. code-block:: bash

        salt '*' win_pki.get_stores
    zEGet-ChildItem -Path 'Cert:\' | Select-Object LocationName, StoreNamesT�rrZLocationNameZ
StoreNames)�dictr�listr)�retrr�item�storerrr
�
get_storesus



�r,cCs�t�}t
�}d
g
}d|�d|
��}t|d�

|�d|�d��

|�d�

td�|�
d	d
�}|D]5}t�}|D]}	|	|v
rD||	||	��<q6|�d
d�}
t|
t
�rZdd
�|
D�
|d<ng|d<|||d<q/|S)am

    Get the available certificates in the given store.

    :param str context: The name of the certificate store location context.
    :param str store: The name of the certificate store.

    :return: A dictionary of the certificate thumbprints and properties.
    :rtype: dict

    CLI Example:

    .. code-block:: bash

        salt '*' win_pki.get_certs
    �DnsNameList�Cert:\�
\�
r"zGet-ChildItem -Path 'z' | Select-Objectz8 DnsNameList, SerialNumber, Subject, Thumbprint, VersionrTr&Nc
Ssg|]}
|
�d�
�qS�
ZUnicode)
�get��.0r"rrr
�
<listcomp>�szget_certs.<locals>.<listcomp>�dnsnamesZ
Thumbprint)	r'r(r#rrr�lowerr2�
isinstance)�contextr+r)r�blacklist_keys�
store_pathrr*Z	cert_info�key�namesrrr
�	get_certs�s(









�




r>rc	Csd
t�}t
�}d
g
}|
��}
t|
d�

|rtj�|�
s"t�d|�
|S|
dkr^|rO|�	d�

|�	d�

|�	d|�d��

|�	d	|�d��

|�	d
�

|�	d�

n'|�	d|�d��

|�	d�

n|�	d�

|�	d�

|�	d|�d
��

|�	d�

t
d�|�
dd�}|D]}|D]}||v
r�||||��<q�dd�|d
D�
|d<q�|r�t�d|�
|St�d|�
|S)a�
    Get the details of the certificate file.

    :param str name: The filesystem path of the certificate file.
    :param str cert_format: The certificate format. Specify 'cer' for X.509, or
        'pfx' for PKCS #12.
    :param str password: The password of the certificate. Only applicable to pfx
        format. Note that if used interactively, the password will be seen by all minions.
        To protect the password, use a state and get the password from pillar.

    :return: A dictionary of the certificate thumbprints and properties.
    :rtype: dict

    CLI Example:

    .. code-block:: bash

        salt '*' win_pki.get_cert_file name='C:\certs\example.cer'
    r-r0zPath is not present: %sr$z$CertObject = New-Objectz@ System.Security.Cryptography.X509Certificates.X509Certificate2;z $CertObject.Import('rz,'z,'DefaultKeySet') ; $CertObjectzH | Select-Object DnsNameList, SerialNumber, Subject, Thumbprint, VersionzGet-PfxCertificate -FilePath 'z'); $CertObjectrTr&c
Ssg|]}
|
d�qSr1rr3rrr
r5�sz!get_cert_file.<locals>.<listcomp>r6z0Certificate thumbprint obtained successfully: %sz+Unable to obtain certificate thumbprint: %s)
r'r(r7r%�os�path�isfile�_LOG�errorrrr�debug)	r"�cert_format�passwordr)rr:rr*r<rrr
�
get_cert_file�sT










�




�

�





�


�
�
rGT�basecCs�
t�}d
}d|�d|��}	|
�
�}
t|
d�

td||�}
|
s't�d|�
dS|r1t|
|
|d�}nt|
|
d	�}t||d
�}|d|vrNt�d|d|	�
d
S|
dkr�|rb|�	d�
|�
�

|�	d�

n|�	d�

|�	d�
|
�
�

|�	d|	�d��

|�	d�

|r�|�	d�

n|�	d�
|
�
�

|�	d|	�d��

td�|�
d�

t||d
�}
|
D]}||v
r�|}q�|r�t�d|�
d
St�d|�
dS)a�
    Import the certificate file into the given certificate store.

    :param str name: The path of the certificate file to import.
    :param str cert_format: The certificate format. Specify 'cer' for X.509, or
        'pfx' for PKCS #12.
    :param str context: The name of the certificate store location context.
    :param str store: The name of the certificate store.
    :param bool exportable: Mark the certificate as exportable. Only applicable
        to pfx format.
    :param str password: The password of the certificate. Only applicable to pfx
        format. Note that if used interactively, the password will be seen by all minions.
        To protect the password, use a state and get the password from pillar.
    :param str saltenv: The environment the file resides in.

    :return: A boolean representing whether all changes succeeded.
    :rtype: bool

    CLI Example:

    .. code-block:: bash

        salt '*' win_pki.import_cert name='salt://cert.cer'
    Nr.r/r0z
cp.cache_filez%Unable to get cached copy of file: %sF)r"rErF)r"rE�r9r+�
thumbprintz8Certificate thumbprint '%s' already present in store: %sTr$�/$Password = ConvertTo-SecureString -String '{}'� -AsPlainText -Force; �5$Password = New-Object System.Security.SecureString; z$Import-PfxCertificate -FilePath '{}'z -CertStoreLocation 'r� -Password $Passwordz -Exportablez!Import-Certificate -FilePath '{}'rrz%Certificate imported successfully: %sz Unable to import certificate: %s)
r(r7r%r
rBrCrGr>rDrrrr)r"rEr9r+Z
exportablerFZsaltenvrrJr;Zcached_source_pathZ
cert_props�
current_certs�	new_certsZnew_certrrr
�import_cert
sd!







�



�

�

�



�


�



rQc	Cs�t�}|
�
�}
d
|�d|�d|
��}|��}t|d�

t|d�

|dkrH|r4|�d�|�
�

|�d�

n|�d�

|�d�||��

|�d	�

n	|�d
�||��

|�d|�d��

t�t	d
�
|�
d�
�
}|rot�d|�
|St�
d|�
|S)a�
    Export the certificate to a file from the given certificate store.

    :param str name: The destination path for the exported certificate file.
    :param str thumbprint: The thumbprint value of the target certificate.
    :param str cert_format: The certificate format. Specify 'cer' for X.509, or
        'pfx' for PKCS #12.
    :param str context: The name of the certificate store location context.
    :param str store: The name of the certificate store.
    :param str password: The password of the certificate. Only applicable to pfx
        format. Note that if used interactively, the password will be seen by all minions.
        To protect the password, use a state and get the password from pillar.

    :return: A boolean representing whether all changes succeeded.
    :rtype: bool

    CLI Example:

    .. code-block:: bash

        salt '*' win_pki.export_cert name='C:\certs\example.cer' thumbprint='AAA000'
    r.r/r0r$rKrLrMz/Export-PfxCertificate -Cert '{}' -FilePath '{}'rNz,Export-Certificate -Cert '{}' -FilePath '{}'z | Out-Null; Test-Path -Path 'rrrz%Certificate exported successfully: %sz Unable to export certificate: %s)r(�upperr7r#r%rrr r!rrrBrDrC)	r"rJrEr9r+rFr�	cert_pathr)rrr
�export_certj
s8







�


�

�
�
rTcCs�t�}|�
�}d
|
�d|�d|��}|�d|�d��

t|d�

|r'|�d�

|r2|�d|�d��

|r=|�d|�d��

|�d	�

t�td
�|�
d�
�
S)a
    Check the certificate for validity.

    :param str thumbprint: The thumbprint value of the target certificate.
    :param str context: The name of the certificate store location context.
    :param str store: The name of the certificate store.
    :param bool untrusted_root: Whether the root certificate is required to be
        trusted in chain building.
    :param str dns_name: The DNS name to verify as valid for the certificate.
    :param str eku: The enhanced key usage object identifiers to verify for the
        certificate chain.

    :return: A boolean representing whether the certificate was considered
        valid.
    :rtype: bool

    CLI Example:

    .. code-block:: bash

        salt '*' win_pki.test_cert thumbprint='AAA000' dns_name='example.test'
    r.r/zTest-Certificate -Cert 'rr0z -AllowUntrustedRootz -DnsName 'z -EKU 'z -ErrorAction SilentlyContinuerr)r(rRrr#r r!rr)rJr9r+Zuntrusted_rootZdns_nameZekurrSrrr
�	test_cert�
s










rUcCs�|��}d
|
�d|��}|�d|��}d|�d�}t
|
|d�}||v
r,t�d||�
dSt|d�

t|d	�

t
|
|d�}||vrHt�d
|�
dSt�d|�
dS)
a�

    Remove the certificate from the given certificate store.

    :param str thumbprint: The thumbprint value of the target certificate.
    :param str context: The name of the certificate store location context.
    :param str store: The name of the certificate store.

    :return: A boolean representing whether all changes succeeded.
    :rtype: bool

    CLI Example:

    .. code-block:: bash

        salt '*' win_pki.remove_cert thumbprint='AAA000'
    r.r/zRemove-Item -Path 'rrIz,Certificate '%s' already absent in store: %sTr0rz Unable to remove certificate: %sFz$Certificate removed successfully: %s)rRr>rBrDr#rrC)rJr9r+r;rSrrOrPrrr
�remove_cert�
s$




�






rV)
F)�__doc__r �loggingr?Zsalt.utils.jsonrZsalt.utils.platformZsalt.utils.powershellZsalt.utils.versionsZsalt.exceptionsrrZ_DEFAULT_CONTEXTZ_DEFAULT_FORMATZ_DEFAULT_STORE�	getLogger�__name__rBrrrr#r%r,r>rGrQrTrUrVrrrr
�<module>
sP










"
+L





�i



�I




�1