3

�xh�$�@s�
UdZd
dl
Z
d
dlZd
dlmZ
d
dlmZmZ
d
dlm	Z	
d
dl
mZ
d
dlm
Z
mZ
d
dlmZ
e
je�
Zdd	d
ddg
d
�Zdddddg
d
�dddddg
d
�dddddg
d
�d�Zxd:D]Zedee<q�Wxd;D]Zedee<q�WdZddd d!d"ddddddddd#gZd$d%d&eeeed'�
g
d(d)gd*�Ze
ee�
Zd+d,�Zd-d.�Zd/d0�Zd1d2�Zd3d4�Zd5d6�Ze ee	e!dd7�d8d9�Z"dS)<zCA Certs: Add ca certificates.�N)
�dedent)�subp�util)
�Cloud)
�Config)�
MetaSchema�get_meta_doc)
�PER_INSTANCEz!/usr/local/share/ca-certificates/z#cloud-init-ca-cert-{cert_index}.crtz/etc/ca-certificates.confzupdate-ca-certificates)�ca_cert_path�ca_cert_local_path�ca_cert_filename�ca_cert_config�ca_cert_update_cmdz/etc/pki/ca-trust/z/usr/share/pki/ca-trust-source/z+anchors/cloud-init-ca-cert-{cert_index}.crtzupdate-ca-trustz/etc/pki/trust/z/usr/share/pki/trust/)�fedora�rhel�opensuse�opensuse-microos�opensuse-tumbleweed�
opensuse-leap�sle_hpc�	sle-micro�slesr�	almalinux�
cloudlinuxra/This module adds CA certificates to the system's CA store and updates any
related files using the appropriate OS-specific utility. The default CA
certificates can be disabled/deleted from use by the system with the
configuration option ``remove_defaults``.

.. note::
    certificates must be specified using valid yaml. in order to specify a
    multiline certificate, the yaml multiline list syntax must be used

.. note::
    Alpine Linux requires the ca-certificates package to be installed in
    order to provide the ``update-ca-certificates`` command.
�alpine�debianr�ubuntuZcc_ca_certszCA CertificateszAdd ca certificatesa
            ca_certs:
              remove_defaults: true
              trusted:
                - single_line_cert
                - |
                  -----BEGIN CERTIFICATE-----
                  YOUR-ORGS-TRUSTED-CA-CERT-HERE
                  -----END CERTIFICATE-----
            �ca_certszca-certs)�id�name�title�description�distrosZ	frequencyZexamplesZactivate_by_schema_keysc
Cs*tj
|t�}
tjj|
d
|
d�|
d<|
S)z�Return a distro-specific ca_certs config dictionary

    @param distro_name: String providing the distro class name.
    @returns: Dict of distro configurations for ca_cert.
    rr�ca_cert_full_path)�DISTRO_OVERRIDES�get�DEFAULT_CONFIG�os�path�join)�distro_name�cfg�r,�!/usr/lib/python3.6/cc_ca_certs.py�_distro_ca_certs_configs|s

r.c

Cstj|d
dd�
dS)z�
    Updates the CA certificate cache on the current machine.

    @param distro_cfg: A hash providing _distro_ca_certs_configs function.
    rF)
ZcaptureN)
r)
�
distro_cfgr,r,r-�update_ca_certs�sr0cCsL|
sd
Sx>t|
d�D]0\}}t
|�
}|dj|d�
}tj||dd�
qWd
S)a-

    Adds certificates to the system. To actually apply the new certificates
    you must also call the appropriate distro-specific utility such as
    L{update_ca_certs}.

    @param distro_cfg: A hash providing _distro_ca_certs_configs function.
    @param certs: A list of certificate strings.
    N�
r#)
�
cert_indexi�
)
�mode)�	enumerate�str�formatr�
write_file)r/Zcertsr2�
cZcert_file_contentsZcert_file_namer,r,r-�add_ca_certs�s	


r9cCs@|d
krt|
�

n*|dkr<t
|
�

|dkr<d
}tjd|d	�
d
S)a.

    Disables all default trusted CA certificates. For Alpine, Debian and
    Ubuntu to actually apply the changes you must also call
    L{update_ca_certs}.

    @param distro_name: String providing the distro class name.
    @param distro_cfg: A hash providing _distro_ca_certs_configs function.
    rrrrz/ca-certificates ca-certificates/trust_new_crts z	select no�debconf-set-selections�
-)
�dataN)rrr)rrz8ca-certificates ca-certificates/trust_new_crts select no)r:r;)�remove_default_ca_certs�disable_system_ca_certsr)r*r/Zdebconf_selr,r,r-�disable_default_ca_certs�s	



r?c
Cs�|d
}
|
stj
j|
�
r dSd}d}tj|
�
jr�tj|
�
}g}xh|j�D]\}||krhd}|j|�

qL|dks||dd
kr�|j|�

qL|s�|j|�

d}|jd	|�

qLWtj	|
d
j
|�
d
dd�
dS)z�
    For every entry in the CA_CERT_CONFIG file prefix the entry with a "!"
    in order to disable it.

    @param distro_cfg: A hash providing _distro_ca_certs_configs function.
    r
Nz;# Modified by cloud-init to deselect certs due to user-dataFT�r
�
#�
!�

�wb)
Zomode)rArB)r'r(�exists�stat�st_sizerZ	load_file�
splitlines�appendr7r))r/Zca_cert_cfg_fnZheader_commentZadded_headerZorigZ	out_lines�liner,r,r-r>�s(














r>c

Cs:|d
dkrdStj
d�

tj|d
�

tj|d�

dS)z�
    Removes all default trusted CA certificates from the system.

    @param distro_cfg: A hash providing _distro_ca_certs_configs function.
    r
NzDeleting system CA certificatesr)�LOG�debugrZdelete_dir_contents)
r/r,r,r-r=�s




r=)rr+�cloud�args�returncCs�d
|
krtj
dddd�
nd|
kr2tjd|�
dSd
|
krLd|
krLtjd	�

|
jd|
jd
�
�}t|jj�
}d
|kr�tj
dddd�
|jd
|jd
d��r�tjd�

t	|jj|�
d|kr�tj
|d�}|r�tjdt|�
�
t||�
tjd�

t
|�

dS)au

    Call to handle ca_cert sections in cloud-config file.

    @param name: The module name "ca_cert" from cloud.cfg
    @param cfg: A nested dict containing the entire cloud config contents.
    @param cloud: The L{CloudInit} object in use.
    @param log: Pre-initialized Python logger object to use for logging.
    @param args: Any module arguments from cloud.cfg
    zca-certszKey 'ca-certs'z22.1zUse 'ca_certs' instead.)Z
deprecatedZdeprecated_versionZ
extra_messagerz<Skipping module named %s, no 'ca_certs' key in configurationNzMFound both ca-certs (deprecated) and ca_certs config keys. Ignoring ca-certs.zremove-defaultszKey 'remove-defaults'zUse 'remove_defaults' instead.Zremove_defaultsFz'Disabling/removing default certificatesZtrustedzAdding %d certificateszUpdating certificates)rZ	deprecaterKrLZwarningr%r.�distrorr?Zget_cfg_option_list�lenr9r0)rr+rMrNZca_cert_cfgr/Z
trusted_certsr,r,r-�handle�s>

























rR)rrrrrr)rr)#�__doc__Zloggingr'�textwraprZ	cloudinitrrZcloudinit.cloudrZcloudinit.configrZcloudinit.config.schemarrZcloudinit.settingsr	Z	getLogger�__name__rKr&r$rPZMODULE_DESCRIPTIONr"�metar.r0r9r?r>r=r5�listrRr,r,r,r-�<module>s�



















































	'