| Server IP : 198.38.94.13 / Your IP : 216.73.217.33 Web Server : Apache System : Linux d4744.dxb1.stableserver.net 5.14.0-611.49.1.el9_7.x86_64 #1 SMP PREEMPT_DYNAMIC Tue Apr 21 16:39:08 EDT 2026 x86_64 User : revivere ( 1140) PHP Version : 8.2.33 Disable Function : NONE MySQL : OFF | cURL : ON | WGET : ON | Perl : ON | Python : OFF | Sudo : OFF | Pkexec : OFF Directory : /opt/saltstack/salt/lib/python3.10/site-packages/salt/beacons/__pycache__/ |
Upload File : |
o
;j/" � @ s� d Z ddlZddlmZ ddlZddlZz
ddlmZ dZW n e y) dZY nw e�
e �Z dZ
dZd d
� Zd d � Zd
d� Zdd� ZdS )z�
Beacon to monitor certificate expiration dates from files on the filesystem.
.. versionadded:: 3000
:maintainer: <devops@eitr.tech>
:maturity: new
:depends: OpenSSL
� N)�datetime)�cryptoTF�- Z cert_infoc C s2 zddl m} W n
ty t| � Y S w t| |j�r2| jr!dnd}| jdur0|� d| j� �}|S t| |j|j f�r�g }| D ]P}t||j
�rQ|� d|j � �� q?t||j
�ra|� d|j � �� q?t||j�rq|� d |j � �� q?t||j�r�|� d
|j � �� q?|� t|�j� d |j � �� q?d �|�S t| �S )
aF
Render a ``cryptography.x509`` extension value in the OpenSSL-style
short form that pyOpenSSL's ``str(X509Extension)`` produced (for
example "CA:FALSE" or "DNS:foo, IP:1.2.3.4"). Only handles the
common extensions the cert_info beacon callers historically saw;
falls back to ``str(value)`` otherwise.
r )�x509zCA:TRUEzCA:FALSENz
, pathlen:zDNS:zIP:zemail:zURI:�:z, )Z cryptographyr � ImportError�str�
isinstanceZBasicConstraints�caZ path_lengthZSubjectAlternativeNameZIssuerAlternativeNameZDNSName�append�valueZ IPAddressZ
RFC822NameZUniformResourceIdentifier�type�__name__�join)r Z_x509�out�parts�name� r �J/opt/saltstack/salt/lib/python3.10/site-packages/salt/beacons/cert_info.py�_format_extension_value s0 �
r c C s& t du rd} t�dt| � d| fS tS )NFzOpenSSL library is missing.z Unable to load %s beacon: %s)� HAS_OPENSSL�log�error�__virtualname__)�err_msgr r r � __virtual__F s
r c C s, t | t�sdS tjj�| �} d| vrdS dS )z+
Validate the beacon configuration
)Fz2Configuration for cert_info beacon must be a list.�files)Fz=Configuration for cert_info beacon must contain files option.)TzValid beacon configuration)r �list�salt�utils�beacons� list_to_dict)�configr r r �validateO s
r# c C s g }g }t j}tjj�| �} | �dt�}| �dg �D �]_}|}t|t �rPzt
t |��}|| �d|�}W n t yM } z
t
�d||� W Y d}~qd}~ww |}z"tjj�|��} t �t j| �� �}
W d � n1 slw Y W n t|fy� } z
t
�d||� W Y d}~qd}~ww t�|
�� jdd�d�} | t�� j} t
�d|| � |d k s�| |k�rzt
�d
||� g }
t |
d �r�t d |
� � �D ]}|
� |
� |��!� jdd�t"|
� |��d �� q�n4z|
�#� }|j$D ]}|
� |j%j&t'|j(�d �� q�W n t)�y } z
t
�d
||� W Y d}~nd}~ww |� |d�*dd� |
�+� �,� D ��dd� |
�+� �,� D �|
�� jdd�| �-d�|
�.� jdd�t�|
�.� jdd�d��-d�|
�/� |
�0� jdd�d�*dd� |
�1� �,� D ��dd� |
�1� �,� D �|
�2� |
|
�3� d�� q|�r�|� d|i� |S )a�
Monitor the certificate files on the minion.
Specify a notification threshold in days and only emit a beacon if any certificates are
expiring within that timeframe or if `notify_days` equals `-1` (always report information).
The default notification threshold is 45 days and can be overridden at the beacon level and
at an individual certificate level.
.. code-block:: yaml
beacons:
cert_info:
- files:
- /etc/pki/tls/certs/mycert.pem
- /etc/pki/tls/certs/yourcert.pem:
notify_days: 15
- /etc/pki/tls/certs/ourcert.pem
- notify_days: 45
- interval: 86400
� notify_daysr z"Unable to load certificate %s (%s)N�UTF-8��encodingz
%Y%m%d%H%M%SZz"Certificate %s expires in %s days.r zECertificate %s triggered beacon due to %s day notification threshold.�
get_extension)Zext_nameZext_dataz*Unable to enumerate extensions for %s (%s)�,c S �0 g | ]}d � |d jdd�|d jdd���qS �z{}="{}"r r% r& � ��format�decode��.0�tr r r �
<listcomp>� � ���zbeacon.<locals>.<listcomp>c S �" i | ]
\}}|� d �|� d ��qS �r% �r/ �r1 �k�vr r r �
<dictcomp>� � ��zbeacon.<locals>.<dictcomp>z%Y-%m-%d %H:%M:%SZc S r* r+ r- r0 r r r r3 � r4 c S r5 r6 r7 r8 r r r r; � r< )� cert_pathZissuerZ issuer_dictZ notAfter_rawZnotAfterZ
notBefore_rawZ notBeforeZ
serial_numberZsignature_algorithm�subjectZ subject_dict�version�
extensions� has_expired� certificates)4r �Errorr r r r! �get�DEFAULT_NOTIFY_DAYSr �dict�next�iter�
StopIterationr r r ZfopenZload_certificateZ FILETYPE_PEM�read�OSErrorr �strptimeZ get_notAfterr/ �today�days�debug�hasattr�rangeZget_extension_countr r( Zget_short_namer Zto_cryptographyr@ �oid�_namer r � Exceptionr Z
get_issuerZget_components�strftimeZ
get_notBeforeZget_serial_numberZget_signature_algorithmZ get_subjectZ get_versionrA )r" �retrB Z CryptoErrorZglobal_notify_daysr= r$ Znext_cert_path�excZfp_�certZ cert_dateZ date_diffr@ �extZ crypto_certr r r �beacona s�
� �� �� ����
� ���
������
��
���
��
����-rZ )�__doc__�loggingr Zsalt.utils.beaconsr Zsalt.utils.filesZOpenSSLr r r � getLoggerr r rE r r r r# rZ r r r r �<module> s$
�
'