o

�N�g��@s�dZd
dl
Z
d
dlZd
dlmZ
d
dlmZmZ
e
�e�
Z	dZ
zd
dlZd
dlZdZ
Wney6


dZ
Yn
wdd	�Zdd
d�
Zddd
�
Zdd�Zddd�
Zdd�Zdd�ZdS)z#
Module to interact with keystores
�N)
�datetime)�CommandExecutionError�SaltInvocationError�keystoreTFc
Cstd
ur
d�
t�
}d
|fStS)z
    Check dependencies
    Fz4jks unavailable: {} execution module cant be loaded )�has_depends�format�__virtualname__)
�msg�r
�I/opt/saltstack/salt/lib/python3.10/site-packages/salt/modules/keystore.py�__virtual__s

�
rcCs�tj
j}tj
j}i}|
�d
�
}tj
�||
�}|
���t�
}t	�
|d�}	|	�d�
}
|
���t�
}t	�
|d�}|�d�
}
|r@||d<||d<||d
<|
|d<|
|d<|	t	�
�k|d<|S)	N�sha1z
%Y%m%d%H%M%SZz%B %d %YZpem�aliasZvalid_untilZvalid_startZexpired)�OpenSSL�crypto�
FILETYPE_ASN1�FILETYPE_PEM�digest�dump_certificateZget_notAfter�decodeZ__salt_system_encoding__r�strptime�strftimeZ
get_notBefore�now)r�public_cert�return_cert�ASN1�PEMZ	cert_datar
Zcert_pemZ	raw_untilZ
date_untilZstring_untilZ	raw_startZ
date_startZstring_startr
r
r�_parse_cert%s&

















rcCs�g}g}tj
�||
�}|r|j�|�
}|r||fg
}n|j��}|ra|D]<\}}i}	t|tj�r<|jd
d}
d|	d<nt|tj	�rJ|j
}
d|	d<ntd�
�
t|
�
}|	�
t|||��

|�|	�

q$|S)a�
    Lists certificates in a keytool managed keystore.


    :param keystore: The path to the keystore file to query
    :param passphrase: The passphrase to use to decode the keystore
    :param alias: (Optional) If found, displays details on only this key
    :param return_certs: (Optional) Also return certificate PEM.

    .. warning::

        There are security implications for using return_cert to return decrypted certificates.

    CLI Example:

    .. code-block:: bash

        salt '*' keystore.list /usr/lib/jvm/java-8/jre/lib/security/cacerts changeit
        salt '*' keystore.list /usr/lib/jvm/java-8/jre/lib/security/cacerts changeit debian:verisign_-_g5.pem

    r
�
�PrivateKeyEntry�type�TrustedCertEntryz*Unsupported EntryType detected in keystore)�jks�KeyStore�load�entries�get�items�
isinstancerZ
cert_chainr!�certr�	_get_cert�updater�append)r�
passphraserrZ
decoded_certsr%Zentry_valueZentry_aliasZcert_encZ
entry_dataZcert_resultrr
r
r�list?s2



�











�

r.c
Cs@tj
j}
tj
j}|d
dkrtj
�|
|�}|Stj
�||�}|S)z]
    Gets the correct certificate depending of the encoding

    :param certificate: str
    r
�0)rrrr�load_certificate)�certificaterrrr
r
rr*ws


�
r*cCs
tj
j}tj
j}g}tj�|
�
r&tj�	|
|�}|j
��D]	\}	}
|�|
�

qzt
d
|�
}Wnty<


td|���
�
w|rlt
d
|�
}tj
�||�}
tj
�||�}
tj
�||
�}tj
�||
�}tj�||g
|d�}ntj�||�}|�|�

tj�d|�}|�|
|�
dS)a6
    Adds certificates to an existing keystore or creates a new one if necesssary.

    :param name: alias for the certificate
    :param keystore: The path to the keystore file to query
    :param passphrase: The passphrase to use to decode the keystore
    :param certificate: The PEM public certificate to add to keystore. Can be a string for file.
    :param private_key: (Optional for TrustedCert) The PEM private key to add to the keystore

    CLI Example:

    .. code-block:: bash

        salt '*' keystore.add aliasname /tmp/test.store changeit /tmp/testcert.crt
        salt '*' keystore.add aliasname /tmp/test.store changeit certificate="-----BEGIN CERTIFICATE-----SIb...BM=-----END CERTIFICATE-----"
        salt '*' keystore.add keyname /tmp/test.store changeit /tmp/512.cert private_key=/tmp/512.key

    zx509.get_pem_entryz$Invalid certificate file or string: Zrsa_rawr"T)rrrr�os�path�isfiler"r#r$r%r'r,Z__salt__rr0Zload_privatekeyrZdump_privatekeyr�newr!�save)�namerr-r1Zprivate_keyrr�
certs_list�keystore_objectr�loaded_certZcert_stringZ
key_stringZ
loaded_keyZdumped_certZ
dumped_keyZ	new_entryr
r
r�add�s0








�






r;cCslg}tj
�|
|�}|j��D]
\}}||v
r|�|�

qt|j�
t|�
kr4tj
�d
|�}|�|
|�
dSdS)a�

    Removes a certificate from an existing keystore.
    Returns True if remove was successful, otherwise False

    :param name: alias for the certificate
    :param keystore: The path to the keystore file to query
    :param passphrase: The passphrase to use to decode the keystore

    CLI Example:

    .. code-block:: bash

        salt '*' keystore.remove aliasname /tmp/test.store changeit
    r"TF)	r"r#r$r%r'r,�lenr5r6)r7rr-r8r9rr:r
r
r�remove�s




�

r=c
Cst|�
}
|
�
d
�
S)z�
    Returns the SHA1 sum of a ASN1/PEM certificate

    :param name: ASN1/PEM certificate

    CLI Example:

    .. code-block:: bash

        salt '*' keystore.get_sha1 "(certificate_content_string)"

    �SHA1)r*r)r1rr
r
r�get_sha1�s

r?)
F)NF)
N)�__doc__�loggingr2rZsalt.exceptionsrr�	getLogger�__name__�logrr"rr�ImportErrorrrr.r*r;r=r?r
r
r
r�<module>
s*






�

8
3