| Server IP : 198.38.94.13 / Your IP : 216.73.217.33 Web Server : Apache System : Linux d4744.dxb1.stableserver.net 5.14.0-611.49.1.el9_7.x86_64 #1 SMP PREEMPT_DYNAMIC Tue Apr 21 16:39:08 EDT 2026 x86_64 User : revivere ( 1140) PHP Version : 8.2.33 Disable Function : NONE MySQL : OFF | cURL : ON | WGET : ON | Perl : ON | Python : OFF | Sudo : OFF | Pkexec : OFF Directory : /lib/python3.9/site-packages/ipaclient/install/__pycache__/ |
Upload File : |
a
�jix+ � @ s d dl mZ d dlZd dlZd dlmZ d dlmZmZ d dl m
Z
d dl m Z m
Z
mZmZ d dlmZ d dlmZ d d lmZ d d
lmZmZmZ d d lmZm Z m Z d d l m Z e� e!�Z"G d
d� de j#�Z$d dd�Z%dd� Z&dd� Z'dd� Z(d dd�Z)dd� Z*dS ) � )�absolute_importN)�urlsplit)�
certmonger� certstore)�is_ipa_configured)� admintool�certdb�ipaldap�ipautil)�services)�paths)�tasks)�api�errors�x509)�FQDN�IPA_CA_NICKNAME�RENEWAL_CA_NAME)�check_client_configurationc sD e Zd ZdZdZdZed � fdd� �Zd
� fdd � Zd
d � Z � Z
S )�
CertUpdatezipa-certupdatez%prog [options]zIUpdate local IPA certificate databases with certificates from the server.Fc s* t t| ��|� |jddtd ddd� d S )Nz--force-server�
forced_serverzipa.server.fqdnz6Force the use of the specified server for the update. )�dest�type�default�metavar�help)�superr � add_optionsZ
add_option�str)�cls�parserZ debug_option�� __class__� �D/usr/lib/python3.9/site-packages/ipaclient/install/ipa_certupdate.pyr 0 s �zCertUpdate.add_optionsTc s t � �|� d S )N)r �validate_options)�selfZ
needs_rootr! r# r$ r% < s zCertUpdate.validate_optionsc
C s� t � tj�d�}dtjd< dtjd< z�zddtjd�}| jjd urN| jj|d< tj f i |�� t�
� tj j �
� tt| j� tj j �� W n" tjy� t�dt� � Y n0 W |d u r�tj�dd � q�|tjd< n$|d u r�tj�dd � n
|tjd< 0 d S ) NZ
KRB5CCNAMEz/etc/krb5.keytabZKRB5_CLIENT_KTNAMEzMEMORY:Z
cli_installer)�contextZconfdirr z9Unable to obtain credentials for %s from /etc/krb5.keytab)r �os�environ�getr ZETC_IPA�optionsr r Z bootstrap�finalizeZBackendZ rpcclientZconnect�
run_with_argsZ
disconnectr Z CCacheError�logger�errorr �pop)r& Zold_krb5ccnameZ bootstrap_kwr# r# r$ �run? s6
� �
�zCertUpdate.run)F)T) �__name__�
__module__� __qualname__Z command_name�usage� description� classmethodr r% r1 �
__classcell__r# r# r! r$ r ( s r c C s� |du st |dd�du r(t| jj�j}n|j}t�d|� tj �
|�}z| j j dd�}|d }W n6 t
jt
jfy� | j jddd �}|d d
}Y n0 |�� t�|| jj| jj|�}|r�| j �� d }ng }t|� t� �r�| j jd d d
�}dd� |d D �} t|� ddlm}
m } |
� � � � �rVz|
� |� W n t �yT t�!d� Y n0 z t"|
| | jj#| jj$| � W n t �y� t�!d� Y n0 t%j&j'�(� �r�t%j&j'�)� t%j&j*�(� �r�t%j&j*�)� dS )z�
Run the certupdate procedure with the given API object.
:param api: API object with ldap2/rpcclient backend connected
(such that Commands can be invoked)
Nr z$Updating certificates from server %sz2.107)�version�resultTz2.0)�serverr9 � enable_raz CA serverZenabled)Z
role_servrole�statusc S s g | ] }|d �qS )Z
server_serverr# )�.0r; r# r# r$ �
<listcomp>� � z!run_with_args.<locals>.<listcomp>r )�
cainstance�custodiainstancez.Failed to add lightweight CA tracking requestszFailed to update RA config)+�getattrr �envZ jsonrpc_uri�hostnamer r. �infor Z
LDAPClientZfrom_hostname_secureZCommandZ
ca_is_enabledr Z CommandErrorZ NetworkErrorZ gssapi_bindr Z get_ca_certsZbasedn�realmZca_find�
update_clientr Zserver_role_find�
update_serverZipaserver.installrA rB �
CAInstanceZ
is_configuredZ$add_lightweight_ca_tracking_requests� Exception� exception�update_server_ra_configr< �ca_hostr �
knownservicesZhttpd�
is_running�restartZkrb5kdc) r r+ r; Zldapr: Z
ca_enabled�certsZlwcasZresp�
ca_serversrA rB r# r# r$ r- c sZ ���
� r- c C s� t tj| � t tj| � t tj| � t�tjj �}dD ]d}|�
|�r6z|� |� W q: t j
y� } z*t�d||j|� W Y d }~q6W Y d }~q:d }~0 0 q:q6t|j| � t�� t�| � d S )N)zIPA CAzExternal CA certz Failed to remove %s from %s: %s)� update_filer Z
IPA_CA_CRTZKDC_CA_BUNDLE_PEMZ
CA_BUNDLE_PEMr � NSSDatabaser rD Znss_dirZ has_nickname� delete_certr
�CalledProcessErrorr. r/ Zsecdir� update_dbr
Z(remove_ca_certs_from_systemwide_ca_storeZ(insert_ca_certs_into_systemwide_ca_store)rR Zipa_db�nickname�er# r# r$ rH � s"
�& rH c C s d� tjj�d��}ttj| | � tj j
� � r>tj j
� |� tj
ttd�}t�|�}|d ur�tjjd }t�d|� tj|dd� zt�||�}W n ty� t�d| ��Y n0 t�|d �}|d
ks�|r�t�d | ��t�d |� tj|d
d� t tj | � t tj | � d S )N�-�.)z
cert-databasez
cert-nicknamezca-name�< z$resubmitting certmonger request '%s'z dogtag-ipa-ca-renew-agent-reuse)�cazQResubmitting certmonger request '%s' timed out, please check the request manuallyzca-errorZ
MONITORINGzMError resubmitting certmonger request '%s', please check the request manuallyz!modifying certmonger request '%s'zdogtag-ipa-ca-renew-agent) �joinr rD rG �splitrX r Z"ETC_DIRSRV_SLAPD_INSTANCE_TEMPLATEr rO ZdirsrvrP rQ ZPKI_TOMCAT_ALIAS_DIRr r r Zget_request_idZstartup_timeoutr. �debugZresubmit_requestZwait_for_request� RuntimeErrorr Z ScriptErrorZget_request_valueZmodifyrT ZCA_CRTZ
CACERT_PEM)rR �instanceZcriteriaZ
request_id�timeout�stateZca_errorr# r# r$ rI � sD �
� ��
�� rI c C sj t |�dkrdS |d }|sT| j�� |jtjjtjj|d�}| �|� | � |� n||vrf| � |� dS )z�
After promoting a CA-less deployment to CA-ful, or after removal
of a CA server from the topology, it may be necessary to update
the default.conf ca_host setting on non-CA replicas.
r N)Z host_namerG Z
custodia_peer)
�lenrJ Z$configure_certmonger_renewal_helpersZCustodiaInstancer rD �hostrG Z
import_ra_keyZupdate_ipa_conf)rA rB r< rN rS Z new_ca_hostZcustodiar# r# r$ rM � s
�
rM � c
C sZ dd� |D �}zt j|| |d� W n2 tyT } zt�d| |� W Y d }~n
d }~0 0 d S )Nc s s" | ]}|d dur|d V qdS )� Fr Nr# )r> �cr# r# r$ � <genexpr>" r@ z update_file.<locals>.<genexpr>)�modezfailed to update %s: %s)r Zwrite_certificate_listrK r. r/ )�filenamerR rl rZ r# r# r$ rT ! s
rT c C s� t �| �}|�� D ]\}}|jr|�|� q|D ]f\}}}}} t�|d|�}
z|�|||
� W q0 tj y� } z t
� d|| | � W Y d} ~ q0d} ~ 0 0 q0dS )z�Drop all CA certs from db then add certs from list provided
This may result in some churn as existing certs are dropped
and re-added but this also provides the ability to change
the trust flags.
Tz failed to update %s in %s: %sN) r rU Z
list_certsr^ rV r Zkey_policy_to_trust_flagsZadd_certr
rW r. r/ ) �pathrR Zdb�name�flagsZcertrY ZtrustedZekuZ_serialZ trust_flagsrZ r# r# r$ rX ) s
rX )N)rh )+Z
__future__r Zloggingr( � urllib.parser Zipalib.installr r Z ipalib.factsr Z ipapythonr r r r
Z ipaplatformr Zipaplatform.pathsr Zipaplatform.tasksr
Zipalibr r r Zipalib.constantsr r r Z ipalib.utilr Z getLoggerr2 r. Z AdminToolr r- rH rI rM rT rX r# r# r# r$ �<module> s(
;
Q0%