U
    w7e$                     @   sl  U d Z ddlZddlmZ ddlmZ ddlmZmZ ddl	m
Z
 ddlmZ ddlmZmZ dd	lmZ eeZdd
dddgdZdddddgddddddgddddddgddZdD ]Zed ee< qdZddddddddd d!d"d#gZd$d%d&eeeed'gd(d)gd*Zeed+< eeZ d,d- Zd.d/ Zd0d1 Zd2d3 Zd4d5 Z d6d7 Z!e"ee
e#dd8d9d:Z$dS );zCA Certs: Add ca certificates.    N)dedent)log)subputil)Cloud)Config)
MetaSchemaget_meta_doc)PER_INSTANCEz!/usr/local/share/ca-certificates/z#cloud-init-ca-cert-{cert_index}.crtz/etc/ca-certificates.confzupdate-ca-certificates)ca_cert_pathca_cert_local_pathca_cert_filenameca_cert_configca_cert_update_cmdz/etc/pki/ca-trust/z/usr/share/pki/ca-trust-source/z+anchors/cloud-init-ca-cert-{cert_index}.crtzupdate-ca-trustz/etc/pki/trust/z/usr/share/pki/trust/)fedorarhelopensuse)opensuse-microosopensuse-tumbleweedopensuse-leapsle_hpc	sle-microslesr   a/  This module adds CA certificates to the system's CA store and updates any
related files using the appropriate OS-specific utility. The default CA
certificates can be disabled/deleted from use by the system with the
configuration option ``remove_defaults``.

.. note::
    certificates must be specified using valid yaml. in order to specify a
    multiline certificate, the yaml multiline list syntax must be used

.. note::
    Alpine Linux requires the ca-certificates package to be installed in
    order to provide the ``update-ca-certificates`` command.
alpinedebianr   r   r   r   r   r   r   r   ubuntuZcc_ca_certszCA CertificateszAdd ca certificatesa              ca_certs:
              remove_defaults: true
              trusted:
                - single_line_cert
                - |
                  -----BEGIN CERTIFICATE-----
                  YOUR-ORGS-TRUSTED-CA-CERT-HERE
                  -----END CERTIFICATE-----
            ca_certsca-certs)idnametitleZdescriptiondistrosZ	frequencyZexamplesZactivate_by_schema_keysmetac                 C   s*   t | t}tj|d |d |d< |S )zReturn a distro-specific ca_certs config dictionary

    @param distro_name: String providing the distro class name.
    @returns: Dict of distro configurations for ca_cert.
    r   r   ca_cert_full_path)DISTRO_OVERRIDESgetDEFAULT_CONFIGospathjoin)distro_namecfg r,   >/usr/lib/python3/dist-packages/cloudinit/config/cc_ca_certs.py_distro_ca_certs_configst   s     r.   c                 C   s   t j | d dd dS )z
    Updates the CA certificate cache on the current machine.

    @param distro_cfg: A hash providing _distro_ca_certs_configs function.
    r   F)ZcaptureN)r   
distro_cfgr,   r,   r-   update_ca_certs   s    r1   c                 C   sH   |sdS t |dD ]0\}}t|}| d j|d}tj||dd qdS )a-  
    Adds certificates to the system. To actually apply the new certificates
    you must also call the appropriate distro-specific utility such as
    L{update_ca_certs}.

    @param distro_cfg: A hash providing _distro_ca_certs_configs function.
    @param certs: A list of certificate strings.
    N   r#   )
cert_indexi  )mode)	enumeratestrformatr   
write_file)r0   Zcertsr3   cZcert_file_contentsZcert_file_namer,   r,   r-   add_ca_certs   s    	r:   c                 C   s>   | dkrt | n(| dkr:t| | dkr:d}td| dS )a.  
    Disables all default trusted CA certificates. For Alpine, Debian and
    Ubuntu to actually apply the changes you must also call
    L{update_ca_certs}.

    @param distro_name: String providing the distro class name.
    @param distro_cfg: A hash providing _distro_ca_certs_configs function.
    r   )r   r   r   )r   r   z8ca-certificates ca-certificates/trust_new_crts select no)zdebconf-set-selections-N)remove_default_ca_certsdisable_system_ca_certsr   )r*   r0   Zdebconf_selr,   r,   r-   disable_default_ca_certs   s    	
r>   c                 C   s   | d }|rt j|sdS d}d}t |jrt|}g }| D ]\}||krbd}|| qF|dksv|d dkr|| qF|s|| d}|d	|  qFtj	|d

|d
 dd dS )z
    For every entry in the CA_CERT_CONFIG file prefix the entry with a "!"
    in order to disable it.

    @param distro_cfg: A hash providing _distro_ca_certs_configs function.
    r   Nz;# Modified by cloud-init to deselect certs due to user-dataFT r   )#!rA   
wb)Zomode)r'   r(   existsstatst_sizer   Z	load_file
splitlinesappendr8   r)   )r0   Zca_cert_cfg_fnZheader_commentZadded_headerZorigZ	out_linesliner,   r,   r-   r=      s0    

  r=   c                 C   s:   | d dkrdS t d t| d  t| d  dS )z
    Removes all default trusted CA certificates from the system.

    @param distro_cfg: A hash providing _distro_ca_certs_configs function.
    r   NzDeleting system CA certificatesr   )LOGdebugr   Zdelete_dir_contentsr/   r,   r,   r-   r<      s
    
r<   )r   r+   cloudargsreturnc                 C   s   d|krt jdddd nd|kr2td|  dS d|krLd|krLtd	 |d|d}t|jj}d
|krt jdddd |d|d
drtd t	|jj| d|krt 
|d}|rtdt| t|| td t| dS )au  
    Call to handle ca_cert sections in cloud-config file.

    @param name: The module name "ca_cert" from cloud.cfg
    @param cfg: A nested dict containing the entire cloud config contents.
    @param cloud: The L{CloudInit} object in use.
    @param log: Pre-initialized Python logger object to use for logging.
    @param args: Any module arguments from cloud.cfg
    r   zKey 'ca-certs'z22.1zUse 'ca_certs' instead.)Z
deprecatedZdeprecated_versionZextra_messager   z<Skipping module named %s, no 'ca_certs' key in configurationNzMFound both ca-certs (deprecated) and ca_certs config keys. Ignoring ca-certs.zremove-defaultszKey 'remove-defaults'zUse 'remove_defaults' instead.Zremove_defaultsFz'Disabling/removing default certificatesZtrustedzAdding %d certificateszUpdating certificates)r   Z	deprecaterJ   rK   Zwarningr%   r.   distror   r>   Zget_cfg_option_listlenr:   r1   )r   r+   rL   rM   Zca_cert_cfgr0   Ztrusted_certsr,   r,   r-   handle   sJ    
 



rQ   )%__doc__r'   textwrapr   Z	cloudinitr   Zloggingr   r   Zcloudinit.cloudr   Zcloudinit.configr   Zcloudinit.config.schemar   r	   Zcloudinit.settingsr
   Z	getLogger__name__rJ   r&   r$   rO   ZMODULE_DESCRIPTIONr!   r"   __annotations__r.   r1   r:   r>   r=   r<   r6   listrQ   r,   r,   r,   r-   <module>   s   
		'