Anons79 Mini Shell

Directory : /lib/python2.7/site-packages/ansible/modules/crypto/
Upload File :
Current File : //lib/python2.7/site-packages/ansible/modules/crypto/openssl_csr.pyo

�
�Udac@`s�ddlmZmZmZeZidd6dgd6dd6ZdZd	Zd
Z	ddl
Z
ddlZddlZddl
Z
ddlmZdd
lmZddlmZmZddlmZmZmZddlmZdZdZeZ y/ddl!Z!dd
l!mZee!j"�Z#Wn#e$k
rJe
j%�Z e&Z'n4Xe(Z'e!j)j*dkrrdZ+dZ,ndZ+dZ,eZ-ygddl.Z.ddl/Z.ddl0Z.ddl1Z.ddl2Z.ddl3Z.ddl4Z.ee.j"�Z5Wn#e$k
re
j%�Z-e&Z6n"Xe(Z6e.j7j8j9d�Z:dZ;dej<fd��YZ=dej>fd��YZ?de?fd��YZ@de?fd ��YZAd!�ZBeCd"kr�eB�ndS(#i(tabsolute_importtdivisiontprint_functions1.1tmetadata_versiontpreviewtstatust	communitytsupported_bysQ2
---
module: openssl_csr
version_added: '2.4'
short_description: Generate OpenSSL Certificate Signing Request (CSR)
description:
    - This module allows one to (re)generate OpenSSL certificate signing requests.
    - It uses the pyOpenSSL python library to interact with openssl. This module supports
      the subjectAltName, keyUsage, extendedKeyUsage, basicConstraints and OCSP Must Staple
      extensions.
    - "Please note that the module regenerates existing CSR if it doesn't match the module's
      options, or if it seems to be corrupt. If you are concerned that this could overwrite
      your existing CSR, consider using the I(backup) option."
    - The module can use the cryptography Python library, or the pyOpenSSL Python
      library. By default, it tries to detect which one is available. This can be
      overridden with the I(select_crypto_backend) option. Please note that the
      PyOpenSSL backend was deprecated in Ansible 2.9 and will be removed in Ansible 2.13."
requirements:
    - Either cryptography >= 1.3
    - Or pyOpenSSL >= 0.15
author:
- Yanis Guenane (@Spredzy)
options:
    state:
        description:
            - Whether the certificate signing request should exist or not, taking action if the state is different from what is stated.
        type: str
        default: present
        choices: [ absent, present ]
    digest:
        description:
            - The digest used when signing the certificate signing request with the private key.
        type: str
        default: sha256
    privatekey_path:
        description:
            - The path to the private key to use when signing the certificate signing request.
            - Required if I(state) is C(present).
        type: path
    privatekey_passphrase:
        description:
            - The passphrase for the private key.
            - This is required if the private key is password protected.
        type: str
    version:
        description:
            - The version of the certificate signing request.
            - "The only allowed value according to L(RFC 2986,https://tools.ietf.org/html/rfc2986#section-4.1)
               is 1."
        type: int
        default: 1
    force:
        description:
            - Should the certificate signing request be forced regenerated by this ansible module.
        type: bool
        default: no
    path:
        description:
            - The name of the file into which the generated OpenSSL certificate signing request will be written.
        type: path
        required: true
    subject:
        description:
            - Key/value pairs that will be present in the subject name field of the certificate signing request.
            - If you need to specify more than one value with the same key, use a list as value.
        type: dict
        version_added: '2.5'
    country_name:
        description:
            - The countryName field of the certificate signing request subject.
        type: str
        aliases: [ C, countryName ]
    state_or_province_name:
        description:
            - The stateOrProvinceName field of the certificate signing request subject.
        type: str
        aliases: [ ST, stateOrProvinceName ]
    locality_name:
        description:
            - The localityName field of the certificate signing request subject.
        type: str
        aliases: [ L, localityName ]
    organization_name:
        description:
            - The organizationName field of the certificate signing request subject.
        type: str
        aliases: [ O, organizationName ]
    organizational_unit_name:
        description:
            - The organizationalUnitName field of the certificate signing request subject.
        type: str
        aliases: [ OU, organizationalUnitName ]
    common_name:
        description:
            - The commonName field of the certificate signing request subject.
        type: str
        aliases: [ CN, commonName ]
    email_address:
        description:
            - The emailAddress field of the certificate signing request subject.
        type: str
        aliases: [ E, emailAddress ]
    subject_alt_name:
        description:
            - SAN extension to attach to the certificate signing request.
            - This can either be a 'comma separated string' or a YAML list.
            - Values must be prefixed by their options. (i.e., C(email), C(URI), C(DNS), C(RID), C(IP), C(dirName),
              C(otherName) and the ones specific to your CA)
            - Note that if no SAN is specified, but a common name, the common
              name will be added as a SAN except if C(useCommonNameForSAN) is
              set to I(false).
            - More at U(https://tools.ietf.org/html/rfc5280#section-4.2.1.6).
        type: list
        elements: str
        aliases: [ subjectAltName ]
    subject_alt_name_critical:
        description:
            - Should the subjectAltName extension be considered as critical.
        type: bool
        aliases: [ subjectAltName_critical ]
    use_common_name_for_san:
        description:
            - If set to C(yes), the module will fill the common name in for
              C(subject_alt_name) with C(DNS:) prefix if no SAN is specified.
        type: bool
        default: yes
        version_added: '2.8'
        aliases: [ useCommonNameForSAN ]
    key_usage:
        description:
            - This defines the purpose (e.g. encipherment, signature, certificate signing)
              of the key contained in the certificate.
        type: list
        elements: str
        aliases: [ keyUsage ]
    key_usage_critical:
        description:
            - Should the keyUsage extension be considered as critical.
        type: bool
        aliases: [ keyUsage_critical ]
    extended_key_usage:
        description:
            - Additional restrictions (e.g. client authentication, server authentication)
              on the allowed purposes for which the public key may be used.
        type: list
        elements: str
        aliases: [ extKeyUsage, extendedKeyUsage ]
    extended_key_usage_critical:
        description:
            - Should the extkeyUsage extension be considered as critical.
        type: bool
        aliases: [ extKeyUsage_critical, extendedKeyUsage_critical ]
    basic_constraints:
        description:
            - Indicates basic constraints, such as if the certificate is a CA.
        type: list
        elements: str
        version_added: '2.5'
        aliases: [ basicConstraints ]
    basic_constraints_critical:
        description:
            - Should the basicConstraints extension be considered as critical.
        type: bool
        version_added: '2.5'
        aliases: [ basicConstraints_critical ]
    ocsp_must_staple:
        description:
            - Indicates that the certificate should contain the OCSP Must Staple
              extension (U(https://tools.ietf.org/html/rfc7633)).
        type: bool
        version_added: '2.5'
        aliases: [ ocspMustStaple ]
    ocsp_must_staple_critical:
        description:
            - Should the OCSP Must Staple extension be considered as critical
            - Note that according to the RFC, this extension should not be marked
              as critical, as old clients not knowing about OCSP Must Staple
              are required to reject such certificates
              (see U(https://tools.ietf.org/html/rfc7633#section-4)).
        type: bool
        version_added: '2.5'
        aliases: [ ocspMustStaple_critical ]
    select_crypto_backend:
        description:
            - Determines which crypto backend to use.
            - The default choice is C(auto), which tries to use C(cryptography) if available, and falls back to C(pyopenssl).
            - If set to C(pyopenssl), will try to use the L(pyOpenSSL,https://pypi.org/project/pyOpenSSL/) library.
            - If set to C(cryptography), will try to use the L(cryptography,https://cryptography.io/) library.
            - Please note that the C(pyopenssl) backend has been deprecated in Ansible 2.9, and will be removed in Ansible 2.13.
              From that point on, only the C(cryptography) backend will be available.
        type: str
        default: auto
        choices: [ auto, cryptography, pyopenssl ]
        version_added: '2.8'
    backup:
        description:
            - Create a backup file including a timestamp so you can get the original
              CSR back if you overwrote it with a new one by accident.
        type: bool
        default: no
        version_added: "2.8"
    create_subject_key_identifier:
        description:
            - Create the Subject Key Identifier from the public key.
            - "Please note that commercial CAs can ignore the value, respectively use a value of
               their own choice instead. Specifying this option is mostly useful for self-signed
               certificates or for own CAs."
            - Note that this is only supported if the C(cryptography) backend is used!
        type: bool
        default: no
        version_added: "2.9"
    subject_key_identifier:
        description:
            - The subject key identifier as a hex string, where two bytes are separated by colons.
            - "Example: C(00:11:22:33:44:55:66:77:88:99:aa:bb:cc:dd:ee:ff:00:11:22:33)"
            - "Please note that commercial CAs ignore this value, respectively use a value of their
               own choice. Specifying this option is mostly useful for self-signed certificates
               or for own CAs."
            - Note that this option can only be used if I(create_subject_key_identifier) is C(no).
            - Note that this is only supported if the C(cryptography) backend is used!
        type: str
        version_added: "2.9"
    authority_key_identifier:
        description:
            - The authority key identifier as a hex string, where two bytes are separated by colons.
            - "Example: C(00:11:22:33:44:55:66:77:88:99:aa:bb:cc:dd:ee:ff:00:11:22:33)"
            - If specified, I(authority_cert_issuer) must also be specified.
            - "Please note that commercial CAs ignore this value, respectively use a value of their
               own choice. Specifying this option is mostly useful for self-signed certificates
               or for own CAs."
            - Note that this is only supported if the C(cryptography) backend is used!
            - The C(AuthorityKeyIdentifier) will only be added if at least one of I(authority_key_identifier),
              I(authority_cert_issuer) and I(authority_cert_serial_number) is specified.
        type: str
        version_added: "2.9"
    authority_cert_issuer:
        description:
            - Names that will be present in the authority cert issuer field of the certificate signing request.
            - Values must be prefixed by their options. (i.e., C(email), C(URI), C(DNS), C(RID), C(IP), C(dirName),
              C(otherName) and the ones specific to your CA)
            - "Example: C(DNS:ca.example.org)"
            - If specified, I(authority_key_identifier) must also be specified.
            - "Please note that commercial CAs ignore this value, respectively use a value of their
               own choice. Specifying this option is mostly useful for self-signed certificates
               or for own CAs."
            - Note that this is only supported if the C(cryptography) backend is used!
            - The C(AuthorityKeyIdentifier) will only be added if at least one of I(authority_key_identifier),
              I(authority_cert_issuer) and I(authority_cert_serial_number) is specified.
        type: list
        elements: str
        version_added: "2.9"
    authority_cert_serial_number:
        description:
            - The authority cert serial number.
            - Note that this is only supported if the C(cryptography) backend is used!
            - "Please note that commercial CAs ignore this value, respectively use a value of their
               own choice. Specifying this option is mostly useful for self-signed certificates
               or for own CAs."
            - The C(AuthorityKeyIdentifier) will only be added if at least one of I(authority_key_identifier),
              I(authority_cert_issuer) and I(authority_cert_serial_number) is specified.
        type: int
        version_added: "2.9"
extends_documentation_fragment:
- files
notes:
    - If the certificate signing request already exists it will be checked whether subjectAltName,
      keyUsage, extendedKeyUsage and basicConstraints only contain the requested values, whether
      OCSP Must Staple is as requested, and if the request was signed by the given private key.
seealso:
- module: openssl_certificate
- module: openssl_dhparam
- module: openssl_pkcs12
- module: openssl_privatekey
- module: openssl_publickey
s�
- name: Generate an OpenSSL Certificate Signing Request
  openssl_csr:
    path: /etc/ssl/csr/www.ansible.com.csr
    privatekey_path: /etc/ssl/private/ansible.com.pem
    common_name: www.ansible.com

- name: Generate an OpenSSL Certificate Signing Request with a passphrase protected private key
  openssl_csr:
    path: /etc/ssl/csr/www.ansible.com.csr
    privatekey_path: /etc/ssl/private/ansible.com.pem
    privatekey_passphrase: ansible
    common_name: www.ansible.com

- name: Generate an OpenSSL Certificate Signing Request with Subject information
  openssl_csr:
    path: /etc/ssl/csr/www.ansible.com.csr
    privatekey_path: /etc/ssl/private/ansible.com.pem
    country_name: FR
    organization_name: Ansible
    email_address: [email protected]
    common_name: www.ansible.com

- name: Generate an OpenSSL Certificate Signing Request with subjectAltName extension
  openssl_csr:
    path: /etc/ssl/csr/www.ansible.com.csr
    privatekey_path: /etc/ssl/private/ansible.com.pem
    subject_alt_name: 'DNS:www.ansible.com,DNS:m.ansible.com'

- name: Generate an OpenSSL CSR with subjectAltName extension with dynamic list
  openssl_csr:
    path: /etc/ssl/csr/www.ansible.com.csr
    privatekey_path: /etc/ssl/private/ansible.com.pem
    subject_alt_name: "{{ item.value | map('regex_replace', '^', 'DNS:') | list }}"
  with_dict:
    dns_server:
    - www.ansible.com
    - m.ansible.com

- name: Force regenerate an OpenSSL Certificate Signing Request
  openssl_csr:
    path: /etc/ssl/csr/www.ansible.com.csr
    privatekey_path: /etc/ssl/private/ansible.com.pem
    force: yes
    common_name: www.ansible.com

- name: Generate an OpenSSL Certificate Signing Request with special key usages
  openssl_csr:
    path: /etc/ssl/csr/www.ansible.com.csr
    privatekey_path: /etc/ssl/private/ansible.com.pem
    common_name: www.ansible.com
    key_usage:
      - digitalSignature
      - keyAgreement
    extended_key_usage:
      - clientAuth

- name: Generate an OpenSSL Certificate Signing Request with OCSP Must Staple
  openssl_csr:
    path: /etc/ssl/csr/www.ansible.com.csr
    privatekey_path: /etc/ssl/private/ansible.com.pem
    common_name: www.ansible.com
    ocsp_must_staple: yes
s�
privatekey:
    description: Path to the TLS/SSL private key the CSR was generated for
    returned: changed or success
    type: str
    sample: /etc/ssl/private/ansible.com.pem
filename:
    description: Path to the generated Certificate Signing Request
    returned: changed or success
    type: str
    sample: /etc/ssl/csr/www.ansible.com.csr
subject:
    description: A list of the subject tuples attached to the CSR
    returned: changed or success
    type: list
    elements: list
    sample: "[('CN', 'www.ansible.com'), ('O', 'Ansible')]"
subjectAltName:
    description: The alternative names this CSR is valid for
    returned: changed or success
    type: list
    elements: str
    sample: [ 'DNS:www.ansible.com', 'DNS:m.ansible.com' ]
keyUsage:
    description: Purpose for which the public key may be used
    returned: changed or success
    type: list
    elements: str
    sample: [ 'digitalSignature', 'keyAgreement' ]
extendedKeyUsage:
    description: Additional restriction on the public key purposes
    returned: changed or success
    type: list
    elements: str
    sample: [ 'clientAuth' ]
basicConstraints:
    description: Indicates if the certificate belongs to a CA
    returned: changed or success
    type: list
    elements: str
    sample: ['CA:TRUE', 'pathLenConstraint:0']
ocsp_must_staple:
    description: Indicates whether the certificate has the OCSP
                 Must Staple feature enabled
    returned: changed or success
    type: bool
    sample: false
backup_file:
    description: Name of backup file created.
    returned: changed and if I(backup) is C(yes)
    type: str
    sample: /path/to/www.ansible.com.csr.2019-03-09@11:22~
N(tLooseVersion(tcrypto(t
AnsibleModuletmissing_required_lib(t	to_nativetto_bytestto_text(t	ipaddresss0.15s1.3it
tlsfeaturetstatus_requests1.3.6.1.5.5.7.1.24sDER:30:03:02:01:05s0tCertificateSigningRequestErrorcB`seZRS((t__name__t
__module__(((sF/usr/lib/python2.7/site-packages/ansible/modules/crypto/openssl_csr.pyR�stCertificateSigningRequestBasecB`sneZd�Zejd��Zd�Zejd��Zejd��Ze	d�Z
d�Zd�ZRS(c
C`s�tt|�j|jd|jd|jd|j�|jd|_|jd|_|jd|_|jd|_|jd|_	|jd	|_
|jd
|_|jd|_|jd|_
|jd
|_|jd|_|jd|_|jd|_|jd|_|jd|_|jd|_|jd|_|jd|_|jd|_d|_d|_|jr�|jdk	r�|jdd�n|jd|_d|_d|jdfd|jdfd|jdfd |jd!fd"|jd#fd$|jd%fd&|jd'fg|_|jd(rf|jtj |jd(�|_ng|jD]$}|d)rp|d*|d)f^qp|_|j	r�|jd+r�x<|jD].}|d*d2kr�d-|d)g|_	Pq�q�Wn|jdk	rUy%t!j"|jj#d.d/��|_WqUt$k
rQ}t%d0j&|���qUXn|jdk	r�y%t!j"|jj#d.d/��|_Wq�t$k
r�}t%d1j&|���q�XndS(3Ntpathtstatetforcetdigesttprivatekey_pathtprivatekey_passphrasetversiontsubject_alt_nametsubject_alt_name_criticalt	key_usagetkey_usage_criticaltextended_key_usagetextended_key_usage_criticaltbasic_constraintstbasic_constraints_criticaltocsp_must_stapletocsp_must_staple_criticaltcreate_subject_key_identifiertsubject_key_identifiertauthority_key_identifiertauthority_cert_issuertauthority_cert_serial_numbertmsgsSsubject_key_identifier cannot be specified if create_subject_key_identifier is truetbackuptCtcountry_nametSTtstate_or_province_nametLt
locality_nametOtorganization_nametOUtorganizational_unit_nametCNtcommon_nametemailAddresst
email_addresstsubjectiituse_common_name_for_sant
commonNamesDNS:%st:ts(Cannot parse subject_key_identifier: {0}s*Cannot parse authority_key_identifier: {0}(R>R8('tsuperRt__init__tparamst
check_modeRRRRtsubjectAltNametsubjectAltName_criticaltkeyUsagetkeyUsage_criticaltextendedKeyUsagetextendedKeyUsage_criticaltbasicConstraintstbasicConstraints_criticaltocspMustStapletocspMustStaple_criticalR'R(R)R*R+tNonetrequestt
privatekeyt	fail_jsonR-tbackup_fileR<tcrypto_utilstparse_name_fieldtbinasciit	unhexlifytreplacet	ExceptionRtformat(tselftmoduletentrytsubte((sF/usr/lib/python2.7/site-packages/ansible/modules/crypto/openssl_csr.pyRB�sn



			
#7%%cC`sdS(N((R[((sF/usr/lib/python2.7/site-packages/ansible/modules/crypto/openssl_csr.pyt
_generate_csrscC`s�|j|dt�s|jrh|j�}|jrL|j|j�|_ntj	||�t
|_n|j|j
�}|j|t�r�t
|_ndS(s)Generate the certificate signing request.tperms_requiredN(tchecktFalseRR`R-tbackup_localRRSRTt
write_filetTruetchangedtload_file_common_argumentsRCtset_fs_attributes_if_different(R[R\tresultt	file_args((sF/usr/lib/python2.7/site-packages/ansible/modules/crypto/openssl_csr.pytgenerates	cC`sdS(N((R[((sF/usr/lib/python2.7/site-packages/ansible/modules/crypto/openssl_csr.pyt_load_private_key'scC`sdS(N((R[((sF/usr/lib/python2.7/site-packages/ansible/modules/crypto/openssl_csr.pyt
_check_csr+scC`s9tt|�j||�}|j�|s/tS|j�S(s,Ensure the resource is in its desired state.(RARRbRmRcRn(R[R\Ratstate_and_perms((sF/usr/lib/python2.7/site-packages/ansible/modules/crypto/openssl_csr.pyRb/s

cC`s;|jr!|j|j�|_ntt|�j|�dS(N(R-RdRRSRARtremove(R[R\((sF/usr/lib/python2.7/site-packages/ansible/modules/crypto/openssl_csr.pyRp:s	cC`s}i	|jd6|jd6|jd6|jd6|jd6|jd6|jd6|jd6|jd	6}|j	ry|j	|d
<n|S(s'Serialize the object into a dictionary.RQtfilenameR<RERGRIRKRMRgRS(
RRR<RERGRIRKRMRgRS(R[Rj((sF/usr/lib/python2.7/site-packages/ansible/modules/crypto/openssl_csr.pytdump?s








	(
RRRBtabctabstractmethodR`RlRmRnRfRbRpRr(((sF/usr/lib/python2.7/site-packages/ansible/modules/crypto/openssl_csr.pyR�s	C	
	t"CertificateSigningRequestPyOpenSSLcB`s5eZd�Zd�Zd�Zd�Zd�ZRS(cC`sz|jdr |jdd�nx=d	D]5}|j|dk	r'|jddj|��q'q'Wtt|�j|�dS(
NR'R,sHYou cannot use create_subject_key_identifier with the pyOpenSSL backend!R(R)R*R+s.You cannot use {0} with the pyOpenSSL backend!(ssubject_key_identifiersauthority_key_identifiersauthority_cert_issuersauthority_cert_serial_number(RCRRRORZRARuRB(R[R\to((sF/usr/lib/python2.7/site-packages/ansible/modules/crypto/openssl_csr.pyRBUs

 c	C`stj�}|j|jd�|j�}x�|jD]�}|ddk	r6tjj	j
t|d��}|dkr�tdj
|d���ntjj	j|j|tjj	jt|d�ddd�}|dkrtdj
|d|d���qq6q6Wg}|jr�dj|j�}y,|jtjd|j|jd���Wq�tjjk
r�}td	j
djg|jD]}	d
j
|	�^q��t|����q�Xn|jr�dj|j�}
|jtjd|j|
jd���n|jrDdj|j�}
|jtjd|j|
jd���n|jr�dj|j�}
|jtjd
|j|
jd���n|jr�|jtjt |j!t"��n|r�|j#|�n|j$|j%�|j&|j%|j'�||_(tj)tj*|j(�S(Niis&Unknown subject field identifier "{0}"i����s5Invalid value for subject field identifier "{0}": {1}s, REtasciisgError while parsing Subject Alternative Names {0} (check for missing type prefix, such as "DNS:"!): {1}s{0}RGRIRK(+R	tX509Reqtset_versionRtget_subjectR<ROtOpenSSLt_utiltlibtOBJ_txt2nidR
RRZtX509_NAME_add_entry_by_NIDt_namet
MBSTRING_UTF8REtjointappendt
X509ExtensionRFtencodetErrortstrRGRHRIRJRKRLRMtOPENSSL_MUST_STAPLE_NAMERNtOPENSSL_MUST_STAPLE_VALUEtadd_extensionst
set_pubkeyRQtsignRRPtdump_certificate_requesttFILETYPE_PEM(R[treqR<R]tnidtrest
extensionstaltnamesR_tsantusages((sF/usr/lib/python2.7/site-packages/ansible/modules/crypto/openssl_csr.pyR`]sJ=*	,D	+	+	+	"	cC`sHytj|j|j�|_Wn"tjk
rC}t|��nXdS(N(RTtload_privatekeyRRRQtOpenSSLBadPassphraseErrorR(R[texc((sF/usr/lib/python2.7/site-packages/ansible/modules/crypto/openssl_csr.pyRm�scC`sa|jd�r&d|td�}n|jd�r]tj|d�}dj|j�}n|S(NsIP Address:sIP:isIP:{0}(t
startswithtlentcompat_ipaddresst
ip_addressRZt
compressed(R[R�tip((sF/usr/lib/python2.7/site-packages/ansible/modules/crypto/openssl_csr.pyt_normalize_san�sc`s��fd�}�fd��d���fd����fd����fd���fd�������fd�}�fd	�}ytj�jd
d�}Wntk
r�}tSX||�o�||�o�||�S(Nc`s�g�jD]5}tjjjt|d��t|d�f^q
}g|j�j�D]5}tjjjt|d��t|d�f^qX}t|�t|�ks�t	St
S(Nii(R<R{R|R}R~R
Rztget_componentstsetRcRf(tcsrR^R<tcurrent_subject(R[(sF/usr/lib/python2.7/site-packages/ansible/modules/crypto/openssl_csr.pyt_check_subject�s
ENc`s�td�|D�d�}gt|dd�jd�D]'}|j�r5�j|j��^q5}�jr�t|�tg�jD]}�jt|��^q��ks�|j��jkr�t	Sn
|r�t	St
S(Ncs`s'|]}|j�dkr|VqdS(REN(tget_short_name(t.0text((sF/usr/lib/python2.7/site-packages/ansible/modules/crypto/openssl_csr.pys	<genexpr>�sR@terrorstsurrogate_or_strictt,(tnextRtsplittstripR�RER�tget_criticalRFRcRf(R�taltnames_exttaltnameR�tname(R[(sF/usr/lib/python2.7/site-packages/ansible/modules/crypto/openssl_csr.pyt_check_subjectAltName�sF	=c	S`sg|D]}|j�|kr|^q}|r8|sE|rI|rItS|r[|r[tSgt|d�jd�D]'}tjjjt	|j
���^qu}g|D]!}tjjjt	|��^q�}t|�t|�ko�|dj�|kSdS(NiR�(
R�RcRfR�R�R{R|R}R~R
R�R�R�(R�textNametexpectedtcriticalR�t
usages_exttusagetcurrent((sF/usr/lib/python2.7/site-packages/ansible/modules/crypto/openssl_csr.pyt_check_keyUsage_�s+G.c	`s�g|D]}|j�dkr|^q}|r;�jsK|rO�jrOtS|rd�jrdtStjdtdj�j�jd��}|dj�|j�ko�|dj	��j
kSdS(NRGs, Rwi(R�RGRcRfR	R�R�R�tget_dataR�RH(R�R�R�texpected_ext(R[(sF/usr/lib/python2.7/site-packages/ansible/modules/crypto/openssl_csr.pyt_check_keyUsage�s+ *c`s�|d�j�j�S(NRI(RIRJ(R�(R�R[(sF/usr/lib/python2.7/site-packages/ansible/modules/crypto/openssl_csr.pyt_check_extenededKeyUsage�sc`s�|d�j�j�S(NRK(RKRL(R�(R�R[(sF/usr/lib/python2.7/site-packages/ansible/modules/crypto/openssl_csr.pyt_check_basicConstraints�sc`s�g|D]6}t|j��tkrt|�tkr|^q}tjjdkr�|jg|D]0}|j�dkrb|j�dkrb|^qb�n�j	r�t
|�dko�|dj��jkSt
|�dkSdS(NitUNDEFs0i(
R
R�R�R�R{tSSLtOPENSSL_VERSION_NUMBERtextendR�RMR�R�RN(R�R�toms_ext(R[(sF/usr/lib/python2.7/site-packages/ansible/modules/crypto/openssl_csr.pyt_check_ocspMustStaple�sCG	)c`sF|j�}�|�oE�|�oE�|�oE�|�oE�|�S(N(tget_extensions(R�R�(R�R�R�R�R�(sF/usr/lib/python2.7/site-packages/ansible/modules/crypto/openssl_csr.pyt_check_extensions�sc`s0y|j�j�SWntjk
r+tSXdS(N(tverifyRQR	R�Rc(R�(R[(sF/usr/lib/python2.7/site-packages/ansible/modules/crypto/openssl_csr.pyt_check_signature�stbackendt	pyopenssl(RTtload_certificate_requestRRYRc(R[R�R�R�R�tdummy((R�R�R�R�R�R�R[sF/usr/lib/python2.7/site-packages/ansible/modules/crypto/openssl_csr.pyRn�s	
(RRRBR`RmR�Rn(((sF/usr/lib/python2.7/site-packages/ansible/modules/crypto/openssl_csr.pyRuSs
		2		
t%CertificateSigningRequestCryptographycB`s,eZd�Zd�Zd�Zd�ZRS(cC`sWtt|�j|�tjjj�|_||_|j	dkrS|j
d�ndS(Nis_The cryptography backend only supports version 1. (The only valid value according to RFC 2986.)(RAR�RBtcryptographythazmattbackendstdefault_backendtcryptography_backendR\Rtwarn(R[R\((sF/usr/lib/python2.7/site-packages/ansible/modules/crypto/openssl_csr.pyRB�s
	c	C`s�tjj�}y[|jtjjg|jD]2}tjjtj|d�t	|d��^q+��}Wnt
k
r�}t|��nX|jr�|j
tjjg|jD]}tj|�^q��d|j�}n|jrtj|j�}|j
tjj|�d|j�}n|jrrg|jD]}tj|�^q0}|j
tjj|�d|j�}n|jr�i}tj|j�\}}	|j
tjj||	�d|j�}n|jr@y4|j
tjjtjjjg�d|j �}Wq@t!k
r<}
|j
tjj"t#t$�d|j �}q@Xn|j%ry|j
tjj&j'|j(j)��dt*�}n6|j+dk	r�|j
tjj&|j+�dt*�}n|j-dk	s�|j.dk	s�|j/dk	rId}|j.dk	rg|j.D]}tj|�^q�}n|j
tjj0|j-||j/�dt*�}nd}
tj1|j(�r?|j2dkr�tj3j4j5j6�}
q?|j2dkr�tj3j4j5j7�}
q?|j2dkr�tj3j4j5j8�}
q?|j2dkr�tj3j4j5j9�}
q?|j2dkr$tj3j4j5j:�}
q?td	j;|j2���ny"|j<|j(|
|j=�|_>WnJt?k
r�}t@|�d
kr�|
dkr�|jAjBdd�n�nX|j>jCtj3j4jDjEjF�S(
NiiR�tsha256tsha384tsha512tsha1tmd5sUnsupported digest "{0}"s.Algorithm must be a registered hash algorithm.R,sGSigning with Ed25519 and Ed448 keys requires cryptography 2.8 or newer.(GR�tx509t CertificateSigningRequestBuildertsubject_nametNameR<t
NameAttributeRTtcryptography_name_to_oidRt
ValueErrorRREt
add_extensiontSubjectAlternativeNametcryptography_get_nameRFRGt#cryptography_parse_key_usage_paramstKeyUsageRHRItExtendedKeyUsageRJRKt"cryptography_get_basic_constraintstBasicConstraintsRLRMt
TLSFeaturetTLSFeatureTypeRRNtAttributeErrortUnrecognizedExtensiontCRYPTOGRAPHY_MUST_STAPLE_NAMEtCRYPTOGRAPHY_MUST_STAPLE_VALUER'tSubjectKeyIdentifiertfrom_public_keyRQt
public_keyRcR(ROR)R*R+tAuthorityKeyIdentifiert)cryptography_key_needs_digest_for_signingRR�t
primitivesthashestSHA256tSHA384tSHA512tSHA1tMD5RZR�R�RPt	TypeErrorR�R\RRtpublic_bytest
serializationtEncodingtPEM(R[R�R]R_R�RCR�R�tcatpath_lengthR�tissuerstnR((sF/usr/lib/python2.7/site-packages/ansible/modules/crypto/openssl_csr.pyR`�sxL	(	'	%'	*	4	'-("c	C`s�yjt|jd��R}tjjjj|j�|jdkrEdnt
|j�d|j�|_WdQXWnt
k
r�}t|��nXdS(NtrbR�(topenRR�R�R�R�tload_pem_private_keytreadRROR
R�RQRYR(R[tfR_((sF/usr/lib/python2.7/site-packages/ansible/modules/crypto/openssl_csr.pyRmJs	$c`s�fd�}d����fd����fd����fd����fd����fd����fd����fd	���������fd
�}�fd�}ytj�jdd
�}Wntk
r�}tSX||�o||�o||�S(Nc`sqg�jD]#}tj|d�|df^q
}g|jD]}|j|jf^q=}t|�t|�kS(Nii(R<RTR�toidtvalueR�(R�R]R<R^R�(R[(sF/usr/lib/python2.7/site-packages/ansible/modules/crypto/openssl_csr.pyR�Vs3(c`st�fd�|D�d�S(Nc3`s'|]}t|j��r|VqdS(N(t
isinstanceR	(R�R�(texttype(sF/usr/lib/python2.7/site-packages/ansible/modules/crypto/openssl_csr.pys	<genexpr>]s(R�RO(R�R((RsF/usr/lib/python2.7/site-packages/ansible/modules/crypto/openssl_csr.pyt_find_extension[sc`s��|tjj�}|r=g|jD]}t|�^q%ng}�jrwg�jD]!}ttj|��^qVng}t|�t|�kr�t	S|r�|j
�jkr�t	SntS(N(
R�R�R�R	R�RERTR�R�RcR�RFRf(R�tcurrent_altnames_extR�tcurrent_altnamesR�(RR[(sF/usr/lib/python2.7/site-packages/ansible/modules/crypto/openssl_csr.pyR�as.:c`s��|tjj�}�js(|dkS|dkr8tStj�j�}x2|D]*}t|j	d|�||krQtSqQW|j
�jkr�tStS(Nt_(
R�R�R�RGRORcRTR�tgetattrR	R�RHRf(R�tcurrent_keyusage_extRCtparam(RR[(sF/usr/lib/python2.7/site-packages/ansible/modules/crypto/openssl_csr.pyR�ls	

 c`s��|tjj�}|r=g|jD]}t|�^q%ng}�jrwg�jD]!}ttj|��^qVng}t|�t|�kr�t	S|r�|j
�jkr�t	SntS(N(
R�R�R�R	R�RIRTR�R�RcR�RJRf(R�tcurrent_usages_extR�tcurrent_usagesR�(RR[(sF/usr/lib/python2.7/site-packages/ansible/modules/crypto/openssl_csr.pyR�zs.:c`s��|tjj�}|r'|jjnt}|r?|jjnd}tj	�j
�\}}||krmtS||kr}tS�j
r�|dk	o�|j�jkS|dkSdS(N(
R�R�R�R	R�RcRRORTR�RKR�RL(R�tbc_extt
current_catcurrent_path_lengthR�R(RR[(sF/usr/lib/python2.7/site-packages/ansible/modules/crypto/openssl_csr.pyR��s	c`s�y�|tjj�}t}Wn2tk
rS}td�|D�d�}t}nX�jr�|sv|j	�j
krztS|r�tjjj|j
kS|j
j
tkSn
|dkSdS(Ncs`s'|]}|jjtkr|VqdS(N(R	RR�(R�R�((sF/usr/lib/python2.7/site-packages/ansible/modules/crypto/openssl_csr.pys	<genexpr>�s(R�R�R�RfR�R�RORcRMR�RNR�RR	R�(R�ttlsfeature_extthas_tlsfeatureR�(RR[(sF/usr/lib/python2.7/site-packages/ansible/modules/crypto/openssl_csr.pyR��s

	
	c`s��|tjj�}�js-�jdk	r�|s=|jrAtS�jr{tjjj�j	j
��j}|jj|kS|jj�jkSn
|dkSdS(N(
R�R�R�R'R(ROR�RcR�RQR�RR	(R�R�R(RR[(sF/usr/lib/python2.7/site-packages/ansible/modules/crypto/openssl_csr.pyt_check_subject_key_identifier�s	!c`s�|tjj�}�jdk	sB�jdk	sB�jdk	r
|sR|jrVtSd}d}�jdk	r�g�jD]}t	t
j|��^q{}n|jjdk	r�g|jjD]}t	|�^q�}n|jj
�jko||ko|jj�jkS|dkSdS(N(R�R�R�R)ROR*R+R�RcR�RTR�R	tkey_identifier(R�R�tacitcsr_aciR(RR[(sF/usr/lib/python2.7/site-packages/ansible/modules/crypto/openssl_csr.pyt_check_authority_key_identifier�s-.(c`s[|j}�|�oZ�|�oZ�|�oZ�|�oZ�|�oZ�|�oZ�|�S(N(R�(R�R�(RR�R�R�R�R�R(sF/usr/lib/python2.7/site-packages/ansible/modules/crypto/openssl_csr.pyR��s
	c`s�|js
tS|j�jtjjjjj	tjjjj
j�}�jj�jtjjjjj	tjjjj
j�}||kS(N(
tis_signature_validRcR�R�R�R�R�R�R�R�tPublicFormattSubjectPublicKeyInfoRQ(R�tkey_atkey_b(R[(sF/usr/lib/python2.7/site-packages/ansible/modules/crypto/openssl_csr.pyR��s	R�R�(RTR�RRYRc(R[R�R�R�R�R�((	RR�R�R�R�R�RRR[sF/usr/lib/python2.7/site-packages/ansible/modules/crypto/openssl_csr.pyRnUs 	
!(RRRBR`RmRn(((sF/usr/lib/python2.7/site-packages/ansible/modules/crypto/openssl_csr.pyR��s		N	cMC`sItdtdtdddddddg�d	tdddd
�dtdd�d
tdddt�dtdddd�dtdddt�dtdddt�dtdd�dtdddddg�dtdddddg�dtddddd g�d!tdddd"d#g�d$tdddd%d&g�d'tdddd(d)g�d*tdddd+d,g�d-tdd.d/ddd0g�d1tdddtdd2g�d3tdddtdd4g�d5tdd.d/ddd6g�d7tdddtdd8g�d9tdd.d/ddd:d;g�d<tdddtdd=d>g�d?tdd.d/ddd@g�dAtdddtddBg�dCtdddtddDg�dEtdddtddFg�dGtdddt�dHtdddt�dItdd�dJtdd�dKtdd.d/d�dLtdd�dMtddddNddNdOdPg��!dQdbgdRdddgfgdStdTt�}tjj|jd�p�dU}tjj|�s�|j	dV|dWdX|�n|jdM}|dNkrdt
o�ttt
�k}tottt�k}|r'dO}n|r6dP}n|dNkrd|j	dWdYjt
t��qdny�|dPkr�ts�|j	dWtdZjt��d[t�nyttjd\�Wn!tk
r�|j	dWd]�nX|jd^dd_�t|�}nI|dOkrDt
s5|j	dWtd`jt
��d[t�nt|�}n|jddkr�|jr�|j�}|jdp�|j|�|da<|j|�n|j |�nO|jr�|j�}tjj!|jd�|da<|j|�n|j"|�|j�}|j|�Wn,t#j$k
rD}|j	dWt%|��nXdS(cNt
argument_specRttypeR�tdefaulttpresenttchoicestabsentRR�RRRtno_logRtintiRtbooltrequiredR<tdictR/taliasesR.tcountryNameR1R0tstateOrProvinceNameR3R2tlocalityNameR5R4torganizationNameR7R6torganizationalUnitNameR9R8R>R;tER:RtlisttelementsRERRFR=tuseCommonNameForSANRRGR RHR!textKeyUsageRIR"textKeyUsage_criticalRJR#RKR$RLR%RMR&RNR-R'R(R)R*R+tselect_crypto_backendtautoR�R�trequired_togethertrequired_iftadd_file_common_argstsupports_check_modet.R�R,s>The directory %s does not exist or the file is not a directorys]Can't detect any of the required Python libraries cryptography (>= {0}) or PyOpenSSL (>= {1})spyOpenSSL >= {0}t	exceptionR�s1You need to have PyOpenSSL>=0.15 to generate CSRssKThe module is using the PyOpenSSL backend. This backend has been deprecateds2.13scryptography >= {0}Rg(R*R+(&R
R.RfRctosRtdirnameRCtisdirRRtCRYPTOGRAPHY_FOUNDtCRYPTOGRAPHY_VERSIONRtMINIMAL_CRYPTOGRAPHY_VERSIONtPYOPENSSL_FOUNDtPYOPENSSL_VERSIONtMINIMAL_PYOPENSSL_VERSIONRZRtPYOPENSSL_IMP_ERRRR	RxR�t	deprecateRutCRYPTOGRAPHY_IMP_ERRR�RDRrRbt	exit_jsonRltexistsRpRTtOpenSSLObjectErrorR(R\tbase_dirR�tcan_use_cryptographytcan_use_pyopensslR�RjR�((sF/usr/lib/python2.7/site-packages/ansible/modules/crypto/openssl_csr.pytmain�s�!!!'		
		


	!	
t__main__(Dt
__future__RRRR%t
__metaclass__tANSIBLE_METADATAt
DOCUMENTATIONtEXAMPLEStRETURNRsRVRCt	tracebacktdistutils.versionRtansible.module_utilsR	RTtansible.module_utils.basicR
Rtansible.module_utils._textRR
Rtansible.module_utils.compatRR�RKRHRORLR{t__version__RJtImportErrort
format_excRcRIRfR�R�R�R�RNR�tcryptography.x509tcryptography.x509.oidtcryptography.exceptionstcryptography.hazmat.backendst,cryptography.hazmat.primitives.serializationt%cryptography.hazmat.primitives.hashesRGRFR�RtObjectIdentifierR�R�RQRt
OpenSSLObjectRRuR�RUR(((sF/usr/lib/python2.7/site-packages/ansible/modules/crypto/openssl_csr.pyt<module>sp


�A6

	

���	i

Anons79 File Manager Version 1.0, Coded By Anons79
Email: [email protected]