o
    w7e$                  
   @   s`  U d Z ddlZddlmZ ddlmZ ddlmZmZ ddl	m
Z
 ddlmZ ddlmZmZ dd	lmZ eeZdd
dddgdZdddddgddddddgddddddgddZdD ]Zed ee< q`dZg dZdddeeeedgddgd Zeed!< eeZ d"d# Zd$d% Zd&d' Zd(d) Zd*d+ Z d,d- Z!d.e"d/ed0e
d1e#d2df
d3d4Z$dS )5zCA Certs: Add ca certificates.    N)dedent)log)subputil)Cloud)Config)
MetaSchemaget_meta_doc)PER_INSTANCEz!/usr/local/share/ca-certificates/z#cloud-init-ca-cert-{cert_index}.crtz/etc/ca-certificates.confzupdate-ca-certificates)ca_cert_pathca_cert_local_pathca_cert_filenameca_cert_configca_cert_update_cmdz/etc/pki/ca-trust/z/usr/share/pki/ca-trust-source/z+anchors/cloud-init-ca-cert-{cert_index}.crtzupdate-ca-trustz/etc/pki/trust/z/usr/share/pki/trust/)fedorarhelopensuse)opensuse-microosopensuse-tumbleweedopensuse-leapsle_hpc	sle-microslesr   a/  This module adds CA certificates to the system's CA store and updates any
related files using the appropriate OS-specific utility. The default CA
certificates can be disabled/deleted from use by the system with the
configuration option ``remove_defaults``.

.. note::
    certificates must be specified using valid yaml. in order to specify a
    multiline certificate, the yaml multiline list syntax must be used

.. note::
    Alpine Linux requires the ca-certificates package to be installed in
    order to provide the ``update-ca-certificates`` command.
)alpinedebianr   r   r   r   r   r   r   r   r   ubuntucc_ca_certszCA CertificateszAdd ca certificatesa              ca_certs:
              remove_defaults: true
              trusted:
                - single_line_cert
                - |
                  -----BEGIN CERTIFICATE-----
                  YOUR-ORGS-TRUSTED-CA-CERT-HERE
                  -----END CERTIFICATE-----
            ca_certsca-certs)idnametitledescriptiondistros	frequencyexamplesactivate_by_schema_keysmetac                 C   s*   t | t}tj|d |d |d< |S )zReturn a distro-specific ca_certs config dictionary

    @param distro_name: String providing the distro class name.
    @returns: Dict of distro configurations for ca_cert.
    r   r   ca_cert_full_path)DISTRO_OVERRIDESgetDEFAULT_CONFIGospathjoin)distro_namecfg r1   >/usr/lib/python3/dist-packages/cloudinit/config/cc_ca_certs.py_distro_ca_certs_configst   s
   r3   c                 C   s   t j | d dd dS )z
    Updates the CA certificate cache on the current machine.

    @param distro_cfg: A hash providing _distro_ca_certs_configs function.
    r   F)captureN)r   
distro_cfgr1   r1   r2   update_ca_certs   s   r7   c                 C   sH   |sdS t |dD ]\}}t|}| d j|d}tj||dd q	dS )a-  
    Adds certificates to the system. To actually apply the new certificates
    you must also call the appropriate distro-specific utility such as
    L{update_ca_certs}.

    @param distro_cfg: A hash providing _distro_ca_certs_configs function.
    @param certs: A list of certificate strings.
    N   r(   )
cert_indexi  )mode)	enumeratestrformatr   
write_file)r6   certsr9   ccert_file_contentscert_file_namer1   r1   r2   add_ca_certs   s   	rC   c                 C   sH   | dkr
t | dS | dv r t| | dv r"d}td| dS dS dS )a.  
    Disables all default trusted CA certificates. For Alpine, Debian and
    Ubuntu to actually apply the changes you must also call
    L{update_ca_certs}.

    @param distro_name: String providing the distro class name.
    @param distro_cfg: A hash providing _distro_ca_certs_configs function.
    r   )r   r   r   )r   r   z8ca-certificates ca-certificates/trust_new_crts select no)zdebconf-set-selections-N)remove_default_ca_certsdisable_system_ca_certsr   )r/   r6   debconf_selr1   r1   r2   disable_default_ca_certs   s   	rH   c                 C   s   | d }|rt j|sdS d}d}t |jrat|}g }| D ].}||kr1d}|| q#|dks;|d dv rA|| q#|sJ|| d}|d	|  q#tj	|d

|d
 dd dS dS )z
    For every entry in the CA_CERT_CONFIG file prefix the entry with a "!"
    in order to disable it.

    @param distro_cfg: A hash providing _distro_ca_certs_configs function.
    r   Nz;# Modified by cloud-init to deselect certs due to user-dataFT r   )#!rK   
wb)omode)r,   r-   existsstatst_sizer   	load_file
splitlinesappendr>   r.   )r6   ca_cert_cfg_fnheader_commentadded_headerorig	out_linesliner1   r1   r2   rF      s.   


rF   c                 C   s:   | d du rdS t d t| d  t| d  dS )z
    Removes all default trusted CA certificates from the system.

    @param distro_cfg: A hash providing _distro_ca_certs_configs function.
    r   NzDeleting system CA certificatesr   )LOGdebugr   delete_dir_contentsr5   r1   r1   r2   rE      s
   
rE   r    r0   cloudargsreturnc                 C   s   d|v rt jdddd nd|vrtd|  dS d|v r&d|v r&td	 |d|d}t|jj}d
|v rAt jdddd |d|d
drWtd t	|jj| d|v rpt 
|d}|rptdt| t|| td t| dS )au  
    Call to handle ca_cert sections in cloud-config file.

    @param name: The module name "ca_cert" from cloud.cfg
    @param cfg: A nested dict containing the entire cloud config contents.
    @param cloud: The L{CloudInit} object in use.
    @param log: Pre-initialized Python logger object to use for logging.
    @param args: Any module arguments from cloud.cfg
    r   zKey 'ca-certs'z22.1zUse 'ca_certs' instead.)
deprecateddeprecated_versionextra_messager   z<Skipping module named %s, no 'ca_certs' key in configurationNzMFound both ca-certs (deprecated) and ca_certs config keys. Ignoring ca-certs.zremove-defaultszKey 'remove-defaults'zUse 'remove_defaults' instead.remove_defaultsFz'Disabling/removing default certificatestrustedzAdding %d certificateszUpdating certificates)r   	deprecater[   r\   warningr*   r3   distror    rH   get_cfg_option_listlenrC   r7   )r    r0   r^   r_   ca_cert_cfgr6   trusted_certsr1   r1   r2   handle   sH   



rm   )%__doc__r,   textwrapr   	cloudinitr   loggingr   r   cloudinit.cloudr   cloudinit.configr   cloudinit.config.schemar   r	   cloudinit.settingsr
   	getLogger__name__r[   r+   r)   rh   MODULE_DESCRIPTIONr#   r'   __annotations__r3   r7   rC   rH   rF   rE   r<   listrm   r1   r1   r1   r2   <module>   sv   
		'"