o

�Ad; �@s:
UdZd
dl
Z
d
dlmZ
d
dlmZ
d
dlmZ
d
dlmZm	Z	
d
dl
mZ
d
dlm
Z

d
d	lmZmZ
d
d
lmZ
e�e�
Zdddd
dg
d�Zddddddg
d�i
ZdZgd�
Zdddeeeed�
g
ddgd�Zeed<ee�
Zdd �Zd!d"�Zd#d$�Zd%d&�Zd'd(�Z d)d*�Z!d+e"d,e
d-ed.ed/e#d0dfd1d2�Z$dS)3zCA Certs: Add ca certificates.�N)
�Logger)
�dedent)
�log)�subp�util)
�Cloud)
�Config)�
MetaSchema�get_meta_doc)
�PER_INSTANCEz!/usr/local/share/ca-certificates/z#cloud-init-ca-cert-{cert_index}.crtz/etc/ca-certificates.confzupdate-ca-certificates)�ca_cert_path�ca_cert_local_path�ca_cert_filename�ca_cert_config�ca_cert_update_cmd�rhelz/etc/pki/ca-trust/z/usr/share/pki/ca-trust-source/z+anchors/cloud-init-ca-cert-{cert_index}.crtzupdate-ca-trusta/This module adds CA certificates to the system's CA store and updates any
related files using the appropriate OS-specific utility. The default CA
certificates can be disabled/deleted from use by the system with the
configuration option ``remove_defaults``.

.. note::
    certificates must be specified using valid yaml. in order to specify a
    multiline certificate, the yaml multiline list syntax must be used

.. note::
    Alpine Linux requires the ca-certificates package to be installed in
    order to provide the ``update-ca-certificates`` command.
)�alpine�debianr�ubuntu�cc_ca_certszCA CertificateszAdd ca certificatesa
            ca_certs:
              remove_defaults: true
              trusted:
                - single_line_cert
                - |
                  -----BEGIN CERTIFICATE-----
                  YOUR-ORGS-TRUSTED-CA-CERT-HERE
                  -----END CERTIFICATE-----
            �ca_certs�ca-certs)�id�name�title�description�distros�	frequency�examples�activate_by_schema_keys�metac
Cs*t�
|t�}
tj�|
d
|
d�|
d<|
S)z�Return a distro-specific ca_certs config dictionary

    @param distro_name: String providing the distro class name.
    @returns: Dict of distro configurations for ca_cert.
    r
r�ca_cert_full_path)�DISTRO_OVERRIDES�get�DEFAULT_CONFIG�os�path�join)�distro_name�cfg�r*�>/usr/lib/python3/dist-packages/cloudinit/config/cc_ca_certs.py�_distro_ca_certs_configsPs


�r,c

Cstj|d
dd�
dS)z�
    Updates the CA certificate cache on the current machine.

    @param distro_cfg: A hash providing _distro_ca_certs_configs function.
    rF)
�captureN)
r�
�
distro_cfgr*r*r+�update_ca_certs]sr0cCsH|
sd
St|
d�D]\}}t
|�
}|dj|d�
}tj||dd�
q	d
S)a-

    Adds certificates to the system. To actually apply the new certificates
    you must also call the appropriate distro-specific utility such as
    L{update_ca_certs}.

    @param distro_cfg: A hash providing _distro_ca_certs_configs function.
    @param certs: A list of certificate strings.
    N�
r!)
�
cert_indexi�
)
�mode)�	enumerate�str�formatr�
write_file)r/�certsr2�
c�cert_file_contents�cert_file_namer*r*r+�add_ca_certsfs	


��r<cCsH|d
kr
t|
�

dS|dvr t
|
�

|dvr"d}t�d|�
dSdSdS)a.

    Disables all default trusted CA certificates. For Alpine, Debian and
    Ubuntu to actually apply the changes you must also call
    L{update_ca_certs}.

    @param distro_name: String providing the distro class name.
    @param distro_cfg: A hash providing _distro_ca_certs_configs function.
    r)rrr)rrz8ca-certificates ca-certificates/trust_new_crts select no)zdebconf-set-selections�
-N)�remove_default_ca_certs�disable_system_ca_certsr)r(r/�debconf_selr*r*r+�disable_default_ca_certs{s	


��rAc
Cs�|d
durdSd}
d}t�
|d
�
jdkrRt�|d
�
}g}|��D].}||
kr1d}|�|�

q#|dks;|ddvrA|�|�

q#|sJ|�|
�

d}|�d	|�

q#tj|d
d
�|�
d
dd�
dS)
z�
    For every entry in the CA_CERT_CONFIG file prefix the entry with a "!"
    in order to disable it.

    @param distro_cfg: A hash providing _distro_ca_certs_configs function.
    rNz;# Modified by cloud-init to deselect certs due to user-dataFr
T�)�
#�
!rD�

�wb)
�omode)	r%�stat�st_sizer�	load_file�
splitlines�appendr7r')r/�header_comment�added_header�orig�	out_lines�liner*r*r+r?�s*
�















�r?c

Cs:|d
durdSt�
d�

t�|d
�

t�|d�

dS)z�
    Removes all default trusted CA certificates from the system.

    @param distro_cfg: A hash providing _distro_ca_certs_configs function.
    rNzDeleting system CA certificatesr
)�LOG�debugr�delete_dir_contentsr.r*r*r+r>�s




r>rr)�cloudr�args�returncCs�d
|
vr
t�
d�

nd|
v
rt�d|�
dSd
|
vr#d|
vr#t�
d�

|
�d|
�d
�
�}t|jj�
}d|vr;t�
d�

|�d	|�dd
��rQt�d�

t|jj|�
d|vrjt�	|d�}|rjt�d
t
|�
�
t||�
t�d�

t|�

dS)au

    Call to handle ca_cert sections in cloud-config file.

    @param name: The module name "ca_cert" from cloud.cfg
    @param cfg: A nested dict containing the entire cloud config contents.
    @param cloud: The L{CloudInit} object in use.
    @param log: Pre-initialized Python logger object to use for logging.
    @param args: Any module arguments from cloud.cfg
    rzFDEPRECATION: key 'ca-certs' is now deprecated. Use 'ca_certs' instead.rz<Skipping module named %s, no 'ca_certs' key in configurationNzMFound both ca-certs (deprecated) and ca_certs config keys. Ignoring ca-certs.zremove-defaultszfDEPRECATION: key 'ca-certs.remove-defaults' is now deprecated. Use 'ca_certs.remove_defaults' instead.�remove_defaultsFz'Disabling/removing default certificates�trustedzAdding %d certificateszUpdating certificates)
rR�warningrSr#r,�distrorrAr�get_cfg_option_list�lenr<r0)rr)rUrrV�ca_cert_cfgr/�
trusted_certsr*r*r+�handle�s@

�


�

�


�
�








r`)%�__doc__r%�loggingr�textwrapr�	cloudinitrrr�cloudinit.cloudr�cloudinit.configr�cloudinit.config.schemar	r
�cloudinit.settingsr�	getLogger�__name__rRr$r"�MODULE_DESCRIPTIONrr �__annotations__r,r0r<rAr?r>r5�listr`r*r*r*r+�<module>
sv











�




��






���
	 
�
�
�
�
��