Imported Upstream version 4.0.5
This commit is contained in:
Mario Fetka
@@ -3,9 +3,12 @@ NULL =
|
||||
appdir = $(libexecdir)/certmonger/
|
||||
app_SCRIPTS = \
|
||||
dogtag-ipa-ca-renew-agent-submit \
|
||||
ipa-server-guard \
|
||||
$(NULL)
|
||||
|
||||
EXTRA_DIST = \
|
||||
$(app_SCRIPTS) \
|
||||
$(NULL)
|
||||
|
||||
MAINTAINERCLEANFILES = \
|
||||
*~ \
|
||||
Makefile.in
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
# Makefile.in generated by automake 1.15.1 from Makefile.am.
|
||||
# Makefile.in generated by automake 1.14.1 from Makefile.am.
|
||||
# @configure_input@
|
||||
|
||||
# Copyright (C) 1994-2017 Free Software Foundation, Inc.
|
||||
# Copyright (C) 1994-2013 Free Software Foundation, Inc.
|
||||
|
||||
# This Makefile.in is free software; the Free Software Foundation
|
||||
# gives unlimited permission to copy and/or distribute it,
|
||||
@@ -15,17 +15,7 @@
|
||||
@SET_MAKE@
|
||||
|
||||
VPATH = @srcdir@
|
||||
am__is_gnu_make = { \
|
||||
if test -z '$(MAKELEVEL)'; then \
|
||||
false; \
|
||||
elif test -n '$(MAKE_HOST)'; then \
|
||||
true; \
|
||||
elif test -n '$(MAKE_VERSION)' && test -n '$(CURDIR)'; then \
|
||||
true; \
|
||||
else \
|
||||
false; \
|
||||
fi; \
|
||||
}
|
||||
am__is_gnu_make = test -n '$(MAKEFILE_LIST)' && test -n '$(MAKELEVEL)'
|
||||
am__make_running_with_option = \
|
||||
case $${target_option-} in \
|
||||
?) ;; \
|
||||
@@ -86,22 +76,13 @@ POST_INSTALL = :
|
||||
NORMAL_UNINSTALL = :
|
||||
PRE_UNINSTALL = :
|
||||
POST_UNINSTALL = :
|
||||
build_triplet = @build@
|
||||
host_triplet = @host@
|
||||
subdir = install/certmonger
|
||||
subdir = certmonger
|
||||
DIST_COMMON = $(srcdir)/Makefile.in $(srcdir)/Makefile.am
|
||||
ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
|
||||
am__aclocal_m4_deps = $(top_srcdir)/m4/gettext.m4 \
|
||||
$(top_srcdir)/m4/iconv.m4 $(top_srcdir)/m4/intlmacosx.m4 \
|
||||
$(top_srcdir)/m4/lib-ld.m4 $(top_srcdir)/m4/lib-link.m4 \
|
||||
$(top_srcdir)/m4/lib-prefix.m4 $(top_srcdir)/m4/libtool.m4 \
|
||||
$(top_srcdir)/m4/ltoptions.m4 $(top_srcdir)/m4/ltsugar.m4 \
|
||||
$(top_srcdir)/m4/ltversion.m4 $(top_srcdir)/m4/lt~obsolete.m4 \
|
||||
$(top_srcdir)/m4/nls.m4 $(top_srcdir)/m4/po.m4 \
|
||||
$(top_srcdir)/m4/progtest.m4 $(top_srcdir)/VERSION.m4 \
|
||||
$(top_srcdir)/server.m4 $(top_srcdir)/configure.ac
|
||||
am__aclocal_m4_deps = $(top_srcdir)/../version.m4 \
|
||||
$(top_srcdir)/configure.ac
|
||||
am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
|
||||
$(ACLOCAL_M4)
|
||||
DIST_COMMON = $(srcdir)/Makefile.am $(am__DIST_COMMON)
|
||||
mkinstalldirs = $(install_sh) -d
|
||||
CONFIG_HEADER = $(top_builddir)/config.h
|
||||
CONFIG_CLEAN_FILES =
|
||||
@@ -155,115 +136,38 @@ am__can_run_installinfo = \
|
||||
*) (install-info --version) >/dev/null 2>&1;; \
|
||||
esac
|
||||
am__tagged_files = $(HEADERS) $(SOURCES) $(TAGS_FILES) $(LISP)
|
||||
am__DIST_COMMON = $(srcdir)/Makefile.in
|
||||
DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
|
||||
ACLOCAL = @ACLOCAL@
|
||||
AMTAR = @AMTAR@
|
||||
AM_DEFAULT_VERBOSITY = @AM_DEFAULT_VERBOSITY@
|
||||
API_VERSION = @API_VERSION@
|
||||
AR = @AR@
|
||||
AUTOCONF = @AUTOCONF@
|
||||
AUTOHEADER = @AUTOHEADER@
|
||||
AUTOMAKE = @AUTOMAKE@
|
||||
AWK = @AWK@
|
||||
CC = @CC@
|
||||
CCDEPMODE = @CCDEPMODE@
|
||||
CFLAGS = @CFLAGS@
|
||||
CMOCKA_CFLAGS = @CMOCKA_CFLAGS@
|
||||
CMOCKA_LIBS = @CMOCKA_LIBS@
|
||||
CONFIG_STATUS = @CONFIG_STATUS@
|
||||
CPP = @CPP@
|
||||
CPPFLAGS = @CPPFLAGS@
|
||||
CRYPTO_CFLAGS = @CRYPTO_CFLAGS@
|
||||
CRYPTO_LIBS = @CRYPTO_LIBS@
|
||||
CYGPATH_W = @CYGPATH_W@
|
||||
DATA_VERSION = @DATA_VERSION@
|
||||
DEFS = @DEFS@
|
||||
DEPDIR = @DEPDIR@
|
||||
DIRSRV_CFLAGS = @DIRSRV_CFLAGS@
|
||||
DIRSRV_LIBS = @DIRSRV_LIBS@
|
||||
DLLTOOL = @DLLTOOL@
|
||||
DSYMUTIL = @DSYMUTIL@
|
||||
DUMPBIN = @DUMPBIN@
|
||||
ECHO_C = @ECHO_C@
|
||||
ECHO_N = @ECHO_N@
|
||||
ECHO_T = @ECHO_T@
|
||||
EGREP = @EGREP@
|
||||
EXEEXT = @EXEEXT@
|
||||
FGREP = @FGREP@
|
||||
GETTEXT_DOMAIN = @GETTEXT_DOMAIN@
|
||||
GETTEXT_MACRO_VERSION = @GETTEXT_MACRO_VERSION@
|
||||
GIT_BRANCH = @GIT_BRANCH@
|
||||
GIT_VERSION = @GIT_VERSION@
|
||||
GMSGFMT = @GMSGFMT@
|
||||
GMSGFMT_015 = @GMSGFMT_015@
|
||||
GREP = @GREP@
|
||||
INI_CFLAGS = @INI_CFLAGS@
|
||||
INI_LIBS = @INI_LIBS@
|
||||
INSTALL = @INSTALL@
|
||||
INSTALL_DATA = @INSTALL_DATA@
|
||||
INSTALL_PROGRAM = @INSTALL_PROGRAM@
|
||||
INSTALL_SCRIPT = @INSTALL_SCRIPT@
|
||||
INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@
|
||||
INTLLIBS = @INTLLIBS@
|
||||
INTL_MACOSX_LIBS = @INTL_MACOSX_LIBS@
|
||||
IPAPLATFORM = @IPAPLATFORM@
|
||||
IPA_DATA_DIR = @IPA_DATA_DIR@
|
||||
IPA_SYSCONF_DIR = @IPA_SYSCONF_DIR@
|
||||
JSLINT = @JSLINT@
|
||||
KRAD_LIBS = @KRAD_LIBS@
|
||||
KRB5KDC_SERVICE = @KRB5KDC_SERVICE@
|
||||
KRB5_CFLAGS = @KRB5_CFLAGS@
|
||||
KRB5_LIBS = @KRB5_LIBS@
|
||||
LD = @LD@
|
||||
LDAP_CFLAGS = @LDAP_CFLAGS@
|
||||
LDAP_LIBS = @LDAP_LIBS@
|
||||
LDFLAGS = @LDFLAGS@
|
||||
LIBICONV = @LIBICONV@
|
||||
LIBINTL = @LIBINTL@
|
||||
LIBINTL_LIBS = @LIBINTL_LIBS@
|
||||
LIBOBJS = @LIBOBJS@
|
||||
LIBPDB_NAME = @LIBPDB_NAME@
|
||||
LIBS = @LIBS@
|
||||
LIBTOOL = @LIBTOOL@
|
||||
LIBVERTO_CFLAGS = @LIBVERTO_CFLAGS@
|
||||
LIBVERTO_LIBS = @LIBVERTO_LIBS@
|
||||
LIPO = @LIPO@
|
||||
LN_S = @LN_S@
|
||||
LTLIBICONV = @LTLIBICONV@
|
||||
LTLIBINTL = @LTLIBINTL@
|
||||
LTLIBOBJS = @LTLIBOBJS@
|
||||
LT_SYS_LIBRARY_PATH = @LT_SYS_LIBRARY_PATH@
|
||||
MAINT = @MAINT@
|
||||
MAKEINFO = @MAKEINFO@
|
||||
MANIFEST_TOOL = @MANIFEST_TOOL@
|
||||
MKDIR_P = @MKDIR_P@
|
||||
MK_ASSIGN = @MK_ASSIGN@
|
||||
MK_ELSE = @MK_ELSE@
|
||||
MK_ENDIF = @MK_ENDIF@
|
||||
MK_IFEQ = @MK_IFEQ@
|
||||
MSGATTRIB = @MSGATTRIB@
|
||||
MSGCMP = @MSGCMP@
|
||||
MSGFMT = @MSGFMT@
|
||||
MSGFMT_015 = @MSGFMT_015@
|
||||
MSGINIT = @MSGINIT@
|
||||
MSGMERGE = @MSGMERGE@
|
||||
NAMED_GROUP = @NAMED_GROUP@
|
||||
NDRNBT_CFLAGS = @NDRNBT_CFLAGS@
|
||||
NDRNBT_LIBS = @NDRNBT_LIBS@
|
||||
NDRPAC_CFLAGS = @NDRPAC_CFLAGS@
|
||||
NDRPAC_LIBS = @NDRPAC_LIBS@
|
||||
NDR_CFLAGS = @NDR_CFLAGS@
|
||||
NDR_LIBS = @NDR_LIBS@
|
||||
NM = @NM@
|
||||
NMEDIT = @NMEDIT@
|
||||
NSPR_CFLAGS = @NSPR_CFLAGS@
|
||||
NSPR_LIBS = @NSPR_LIBS@
|
||||
NSS_CFLAGS = @NSS_CFLAGS@
|
||||
NSS_LIBS = @NSS_LIBS@
|
||||
NUM_VERSION = @NUM_VERSION@
|
||||
OBJDUMP = @OBJDUMP@
|
||||
OBJEXT = @OBJEXT@
|
||||
ODS_USER = @ODS_USER@
|
||||
OTOOL = @OTOOL@
|
||||
OTOOL64 = @OTOOL64@
|
||||
PACKAGE = @PACKAGE@
|
||||
PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@
|
||||
PACKAGE_NAME = @PACKAGE_NAME@
|
||||
@@ -272,88 +176,33 @@ PACKAGE_TARNAME = @PACKAGE_TARNAME@
|
||||
PACKAGE_URL = @PACKAGE_URL@
|
||||
PACKAGE_VERSION = @PACKAGE_VERSION@
|
||||
PATH_SEPARATOR = @PATH_SEPARATOR@
|
||||
PKG_CONFIG = @PKG_CONFIG@
|
||||
PKG_CONFIG_LIBDIR = @PKG_CONFIG_LIBDIR@
|
||||
PKG_CONFIG_PATH = @PKG_CONFIG_PATH@
|
||||
POPT_CFLAGS = @POPT_CFLAGS@
|
||||
POPT_LIBS = @POPT_LIBS@
|
||||
POSUB = @POSUB@
|
||||
PYLINT = @PYLINT@
|
||||
PYTHON = @PYTHON@
|
||||
PYTHON2 = @PYTHON2@
|
||||
PYTHON3 = @PYTHON3@
|
||||
PYTHON_EXEC_PREFIX = @PYTHON_EXEC_PREFIX@
|
||||
PYTHON_INSTALL_EXTRA_OPTIONS = @PYTHON_INSTALL_EXTRA_OPTIONS@
|
||||
PYTHON_PLATFORM = @PYTHON_PLATFORM@
|
||||
PYTHON_PREFIX = @PYTHON_PREFIX@
|
||||
PYTHON_VERSION = @PYTHON_VERSION@
|
||||
RANLIB = @RANLIB@
|
||||
SAMBA40EXTRA_LIBPATH = @SAMBA40EXTRA_LIBPATH@
|
||||
SAMBAUTIL_CFLAGS = @SAMBAUTIL_CFLAGS@
|
||||
SAMBAUTIL_LIBS = @SAMBAUTIL_LIBS@
|
||||
SASL_CFLAGS = @SASL_CFLAGS@
|
||||
SASL_LIBS = @SASL_LIBS@
|
||||
SED = @SED@
|
||||
SET_MAKE = @SET_MAKE@
|
||||
SHELL = @SHELL@
|
||||
SSSCERTMAP_CFLAGS = @SSSCERTMAP_CFLAGS@
|
||||
SSSCERTMAP_LIBS = @SSSCERTMAP_LIBS@
|
||||
SSSIDMAP_CFLAGS = @SSSIDMAP_CFLAGS@
|
||||
SSSIDMAP_LIBS = @SSSIDMAP_LIBS@
|
||||
SSSNSSIDMAP_CFLAGS = @SSSNSSIDMAP_CFLAGS@
|
||||
SSSNSSIDMAP_LIBS = @SSSNSSIDMAP_LIBS@
|
||||
STRIP = @STRIP@
|
||||
TALLOC_CFLAGS = @TALLOC_CFLAGS@
|
||||
TALLOC_LIBS = @TALLOC_LIBS@
|
||||
TEVENT_CFLAGS = @TEVENT_CFLAGS@
|
||||
TEVENT_LIBS = @TEVENT_LIBS@
|
||||
UNISTRING_LIBS = @UNISTRING_LIBS@
|
||||
UNLINK = @UNLINK@
|
||||
USE_NLS = @USE_NLS@
|
||||
UUID_CFLAGS = @UUID_CFLAGS@
|
||||
UUID_LIBS = @UUID_LIBS@
|
||||
VENDOR_SUFFIX = @VENDOR_SUFFIX@
|
||||
TX = @TX@
|
||||
VERSION = @VERSION@
|
||||
XGETTEXT = @XGETTEXT@
|
||||
XGETTEXT_015 = @XGETTEXT_015@
|
||||
XGETTEXT_EXTRA_OPTIONS = @XGETTEXT_EXTRA_OPTIONS@
|
||||
XMLRPC_CFLAGS = @XMLRPC_CFLAGS@
|
||||
XMLRPC_LIBS = @XMLRPC_LIBS@
|
||||
abs_builddir = @abs_builddir@
|
||||
abs_srcdir = @abs_srcdir@
|
||||
abs_top_builddir = @abs_top_builddir@
|
||||
abs_top_srcdir = @abs_top_srcdir@
|
||||
ac_ct_AR = @ac_ct_AR@
|
||||
ac_ct_CC = @ac_ct_CC@
|
||||
ac_ct_DUMPBIN = @ac_ct_DUMPBIN@
|
||||
am__include = @am__include@
|
||||
am__leading_dot = @am__leading_dot@
|
||||
am__quote = @am__quote@
|
||||
am__tar = @am__tar@
|
||||
am__untar = @am__untar@
|
||||
bindir = @bindir@
|
||||
build = @build@
|
||||
build_alias = @build_alias@
|
||||
build_cpu = @build_cpu@
|
||||
build_os = @build_os@
|
||||
build_vendor = @build_vendor@
|
||||
builddir = @builddir@
|
||||
datadir = @datadir@
|
||||
datarootdir = @datarootdir@
|
||||
docdir = @docdir@
|
||||
dvidir = @dvidir@
|
||||
exec_prefix = @exec_prefix@
|
||||
host = @host@
|
||||
host_alias = @host_alias@
|
||||
host_cpu = @host_cpu@
|
||||
host_os = @host_os@
|
||||
host_vendor = @host_vendor@
|
||||
htmldir = @htmldir@
|
||||
i18ntests = @i18ntests@
|
||||
includedir = @includedir@
|
||||
infodir = @infodir@
|
||||
install_sh = @install_sh@
|
||||
krb5rundir = @krb5rundir@
|
||||
libdir = @libdir@
|
||||
libexecdir = @libexecdir@
|
||||
localedir = @localedir@
|
||||
@@ -362,20 +211,13 @@ mandir = @mandir@
|
||||
mkdir_p = @mkdir_p@
|
||||
oldincludedir = @oldincludedir@
|
||||
pdfdir = @pdfdir@
|
||||
pkgpyexecdir = @pkgpyexecdir@
|
||||
pkgpythondir = @pkgpythondir@
|
||||
prefix = @prefix@
|
||||
program_transform_name = @program_transform_name@
|
||||
psdir = @psdir@
|
||||
pyexecdir = @pyexecdir@
|
||||
pythondir = @pythondir@
|
||||
sbindir = @sbindir@
|
||||
sharedstatedir = @sharedstatedir@
|
||||
srcdir = @srcdir@
|
||||
sysconfdir = @sysconfdir@
|
||||
sysconfenvdir = @sysconfenvdir@
|
||||
systemdsystemunitdir = @systemdsystemunitdir@
|
||||
systemdtmpfilesdir = @systemdtmpfilesdir@
|
||||
target_alias = @target_alias@
|
||||
top_build_prefix = @top_build_prefix@
|
||||
top_builddir = @top_builddir@
|
||||
@@ -384,17 +226,20 @@ NULL =
|
||||
appdir = $(libexecdir)/certmonger/
|
||||
app_SCRIPTS = \
|
||||
dogtag-ipa-ca-renew-agent-submit \
|
||||
ipa-server-guard \
|
||||
$(NULL)
|
||||
|
||||
EXTRA_DIST = \
|
||||
$(app_SCRIPTS) \
|
||||
$(NULL)
|
||||
|
||||
MAINTAINERCLEANFILES = \
|
||||
*~ \
|
||||
Makefile.in
|
||||
|
||||
all: all-am
|
||||
|
||||
.SUFFIXES:
|
||||
$(srcdir)/Makefile.in: $(srcdir)/Makefile.am $(am__configure_deps)
|
||||
$(srcdir)/Makefile.in: @MAINTAINER_MODE_TRUE@ $(srcdir)/Makefile.am $(am__configure_deps)
|
||||
@for dep in $?; do \
|
||||
case '$(am__configure_deps)' in \
|
||||
*$$dep*) \
|
||||
@@ -403,9 +248,10 @@ $(srcdir)/Makefile.in: $(srcdir)/Makefile.am $(am__configure_deps)
|
||||
exit 1;; \
|
||||
esac; \
|
||||
done; \
|
||||
echo ' cd $(top_srcdir) && $(AUTOMAKE) --foreign install/certmonger/Makefile'; \
|
||||
echo ' cd $(top_srcdir) && $(AUTOMAKE) --foreign certmonger/Makefile'; \
|
||||
$(am__cd) $(top_srcdir) && \
|
||||
$(AUTOMAKE) --foreign install/certmonger/Makefile
|
||||
$(AUTOMAKE) --foreign certmonger/Makefile
|
||||
.PRECIOUS: Makefile
|
||||
Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
|
||||
@case '$?' in \
|
||||
*config.status*) \
|
||||
@@ -418,9 +264,9 @@ Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
|
||||
$(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES)
|
||||
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
|
||||
|
||||
$(top_srcdir)/configure: $(am__configure_deps)
|
||||
$(top_srcdir)/configure: @MAINTAINER_MODE_TRUE@ $(am__configure_deps)
|
||||
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
|
||||
$(ACLOCAL_M4): $(am__aclocal_m4_deps)
|
||||
$(ACLOCAL_M4): @MAINTAINER_MODE_TRUE@ $(am__aclocal_m4_deps)
|
||||
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
|
||||
$(am__aclocal_m4_deps):
|
||||
install-appSCRIPTS: $(app_SCRIPTS)
|
||||
@@ -458,12 +304,6 @@ uninstall-appSCRIPTS:
|
||||
files=`for p in $$list; do echo "$$p"; done | \
|
||||
sed -e 's,.*/,,;$(transform)'`; \
|
||||
dir='$(DESTDIR)$(appdir)'; $(am__uninstall_files_from_dir)
|
||||
|
||||
mostlyclean-libtool:
|
||||
-rm -f *.lo
|
||||
|
||||
clean-libtool:
|
||||
-rm -rf .libs _libs
|
||||
tags TAGS:
|
||||
|
||||
ctags CTAGS:
|
||||
@@ -538,9 +378,10 @@ distclean-generic:
|
||||
maintainer-clean-generic:
|
||||
@echo "This command is intended for maintainers to use"
|
||||
@echo "it deletes files that may require special tools to rebuild."
|
||||
-test -z "$(MAINTAINERCLEANFILES)" || rm -f $(MAINTAINERCLEANFILES)
|
||||
clean: clean-am
|
||||
|
||||
clean-am: clean-generic clean-libtool mostlyclean-am
|
||||
clean-am: clean-generic mostlyclean-am
|
||||
|
||||
distclean: distclean-am
|
||||
-rm -f Makefile
|
||||
@@ -592,7 +433,7 @@ maintainer-clean-am: distclean-am maintainer-clean-generic
|
||||
|
||||
mostlyclean: mostlyclean-am
|
||||
|
||||
mostlyclean-am: mostlyclean-generic mostlyclean-libtool
|
||||
mostlyclean-am: mostlyclean-generic
|
||||
|
||||
pdf: pdf-am
|
||||
|
||||
@@ -606,20 +447,17 @@ uninstall-am: uninstall-appSCRIPTS
|
||||
|
||||
.MAKE: install-am install-strip
|
||||
|
||||
.PHONY: all all-am check check-am clean clean-generic clean-libtool \
|
||||
cscopelist-am ctags-am distclean distclean-generic \
|
||||
distclean-libtool distdir dvi dvi-am html html-am info info-am \
|
||||
install install-am install-appSCRIPTS install-data \
|
||||
install-data-am install-dvi install-dvi-am install-exec \
|
||||
install-exec-am install-html install-html-am install-info \
|
||||
install-info-am install-man install-pdf install-pdf-am \
|
||||
install-ps install-ps-am install-strip installcheck \
|
||||
installcheck-am installdirs maintainer-clean \
|
||||
maintainer-clean-generic mostlyclean mostlyclean-generic \
|
||||
mostlyclean-libtool pdf pdf-am ps ps-am tags-am uninstall \
|
||||
uninstall-am uninstall-appSCRIPTS
|
||||
|
||||
.PRECIOUS: Makefile
|
||||
.PHONY: all all-am check check-am clean clean-generic cscopelist-am \
|
||||
ctags-am distclean distclean-generic distdir dvi dvi-am html \
|
||||
html-am info info-am install install-am install-appSCRIPTS \
|
||||
install-data install-data-am install-dvi install-dvi-am \
|
||||
install-exec install-exec-am install-html install-html-am \
|
||||
install-info install-info-am install-man install-pdf \
|
||||
install-pdf-am install-ps install-ps-am install-strip \
|
||||
installcheck installcheck-am installdirs maintainer-clean \
|
||||
maintainer-clean-generic mostlyclean mostlyclean-generic pdf \
|
||||
pdf-am ps ps-am tags-am uninstall uninstall-am \
|
||||
uninstall-appSCRIPTS
|
||||
|
||||
|
||||
# Tell versions [3.59,3.63) of GNU make to not export all variables.
|
||||
|
||||
@@ -19,8 +19,6 @@
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
from __future__ import print_function
|
||||
|
||||
import os
|
||||
# Prevent garbage from readline on standard output
|
||||
# (see https://fedorahosted.org/freeipa/ticket/4064)
|
||||
@@ -31,21 +29,15 @@ import syslog
|
||||
import traceback
|
||||
import tempfile
|
||||
import shutil
|
||||
import base64
|
||||
import contextlib
|
||||
import json
|
||||
|
||||
from cryptography import x509 as crypto_x509
|
||||
from cryptography.hazmat.backends import default_backend
|
||||
|
||||
import six
|
||||
|
||||
from ipalib.install.kinit import kinit_keytab
|
||||
from ipapython import ipautil
|
||||
from ipapython.dn import DN
|
||||
from ipalib import api, errors, x509
|
||||
from ipalib import api, errors, pkcs10, x509
|
||||
from ipaplatform.paths import paths
|
||||
from ipaserver.plugins.ldap2 import ldap2
|
||||
from ipaserver.install import ca, cainstance, dsinstance, certs
|
||||
from ipaserver.install import cainstance, certs
|
||||
|
||||
# This is a certmonger CA helper script for IPA CA subsystem cert renewal. See
|
||||
# https://git.fedorahosted.org/cgit/certmonger.git/tree/doc/submit.txt for more
|
||||
@@ -61,188 +53,49 @@ UNCONFIGURED = 4
|
||||
WAIT_WITH_DELAY = 5
|
||||
OPERATION_NOT_SUPPORTED_BY_HELPER = 6
|
||||
|
||||
if six.PY3:
|
||||
unicode = str
|
||||
|
||||
|
||||
IPA_CA_NICKNAME = 'caSigningCert cert-pki-ca'
|
||||
|
||||
|
||||
def get_nickname():
|
||||
# we need to get the subject from a CSR in case we are requesting
|
||||
# an OpenSSL certificate for which we have to reverse the order of its DN
|
||||
# components thus changing the CERTMONGER_REQ_SUBJECT
|
||||
# https://pagure.io/certmonger/issue/62
|
||||
csr = os.environ.get('CERTMONGER_CSR').encode('ascii')
|
||||
csr_obj = crypto_x509.load_pem_x509_csr(csr, default_backend())
|
||||
subject = csr_obj.subject
|
||||
if not subject:
|
||||
return None
|
||||
|
||||
subject_base = dsinstance.DsInstance().find_subject_base()
|
||||
if not subject_base:
|
||||
return None
|
||||
|
||||
ca_subject_dn = ca.lookup_ca_subject(api, subject_base)
|
||||
|
||||
nickname_by_subject_dn = {
|
||||
DN(ca_subject_dn): 'caSigningCert cert-pki-ca',
|
||||
DN('CN=CA Audit', subject_base): 'auditSigningCert cert-pki-ca',
|
||||
DN('CN=OCSP Subsystem', subject_base): 'ocspSigningCert cert-pki-ca',
|
||||
DN('CN=CA Subsystem', subject_base): 'subsystemCert cert-pki-ca',
|
||||
DN('CN=KRA Audit', subject_base): 'auditSigningCert cert-pki-kra',
|
||||
DN('CN=KRA Transport Certificate', subject_base):
|
||||
'transportCert cert-pki-kra',
|
||||
DN('CN=KRA Storage Certificate', subject_base):
|
||||
'storageCert cert-pki-kra',
|
||||
DN('CN=IPA RA', subject_base): 'ipaCert',
|
||||
}
|
||||
|
||||
return nickname_by_subject_dn.get(DN(subject))
|
||||
|
||||
|
||||
def is_replicated():
|
||||
return bool(get_nickname())
|
||||
|
||||
|
||||
def is_renewal_master():
|
||||
ca = cainstance.CAInstance(host_name=api.env.host)
|
||||
return ca.is_renewal_master()
|
||||
|
||||
|
||||
@contextlib.contextmanager
|
||||
def ldap_connect():
|
||||
conn = None
|
||||
tmpdir = tempfile.mkdtemp(prefix="tmp-")
|
||||
try:
|
||||
conn = ldap2(api)
|
||||
conn.connect(ccache=os.environ['KRB5CCNAME'])
|
||||
principal = str('host/%s@%s' % (api.env.host, api.env.realm))
|
||||
ccache = ipautil.kinit_hostprincipal(paths.KRB5_KEYTAB, tmpdir,
|
||||
principal)
|
||||
|
||||
conn = ldap2(shared_instance=False, ldap_uri=api.env.ldap_uri)
|
||||
conn.connect(ccache=ccache)
|
||||
|
||||
yield conn
|
||||
finally:
|
||||
if conn is not None and conn.isconnected():
|
||||
conn.disconnect()
|
||||
shutil.rmtree(tmpdir)
|
||||
|
||||
def call_handler(_handler, *args, **kwargs):
|
||||
"""
|
||||
Request handler call wrapper
|
||||
|
||||
Before calling the handler, get the original profile name and cookie from
|
||||
the provided cookie, if there is one. If the profile name does not match
|
||||
the requested profile name, drop the cookie and restart the request.
|
||||
|
||||
After calling the handler, put the requested profile name and cookie
|
||||
returned by the handler in a new cookie and return it.
|
||||
"""
|
||||
operation = os.environ['CERTMONGER_OPERATION']
|
||||
if operation == 'POLL':
|
||||
cookie = os.environ.pop('CERTMONGER_CA_COOKIE', None)
|
||||
if cookie is not None:
|
||||
try:
|
||||
context = json.loads(cookie)
|
||||
if not isinstance(context, dict):
|
||||
raise TypeError
|
||||
except (TypeError, ValueError):
|
||||
return (UNCONFIGURED, "Invalid cookie: %r" % cookie)
|
||||
else:
|
||||
return (UNCONFIGURED, "Cookie not provided")
|
||||
|
||||
if 'profile' in context:
|
||||
profile = context.pop('profile')
|
||||
try:
|
||||
if profile is not None:
|
||||
if not isinstance(profile, unicode):
|
||||
raise TypeError
|
||||
profile = (profile.encode('raw_unicode_escape')
|
||||
.decode('ascii'))
|
||||
except (TypeError, UnicodeEncodeError):
|
||||
return (UNCONFIGURED,
|
||||
"Invalid 'profile' in cookie: %r" % profile)
|
||||
else:
|
||||
return (UNCONFIGURED, "No 'profile' in cookie")
|
||||
|
||||
# If profile has changed between SUBMIT and POLL, restart request
|
||||
if os.environ.get('CERTMONGER_CA_PROFILE') != profile:
|
||||
os.environ['CERTMONGER_OPERATION'] = 'SUBMIT'
|
||||
context = {}
|
||||
|
||||
if 'cookie' in context:
|
||||
cookie = context.pop('cookie')
|
||||
try:
|
||||
if not isinstance(cookie, unicode):
|
||||
raise TypeError
|
||||
cookie = cookie.encode('raw_unicode_escape').decode('ascii')
|
||||
except (TypeError, UnicodeEncodeError):
|
||||
return (UNCONFIGURED,
|
||||
"Invalid 'cookie' in cookie: %r" % cookie)
|
||||
os.environ['CERTMONGER_CA_COOKIE'] = cookie
|
||||
else:
|
||||
context = {}
|
||||
|
||||
result = _handler(*args, **kwargs)
|
||||
|
||||
if result[0] in (WAIT, WAIT_WITH_DELAY):
|
||||
context['cookie'] = (result[-1].encode('ascii')
|
||||
.decode('raw_unicode_escape'))
|
||||
|
||||
profile = os.environ.get('CERTMONGER_CA_PROFILE')
|
||||
if profile is not None:
|
||||
profile = profile.encode('ascii').decode('raw_unicode_escape')
|
||||
context['profile'] = profile
|
||||
|
||||
cookie = json.dumps(context)
|
||||
os.environ['CERTMONGER_CA_COOKIE'] = cookie
|
||||
if result[0] in (WAIT, WAIT_WITH_DELAY):
|
||||
result = result[:-1] + (cookie,)
|
||||
|
||||
return result
|
||||
|
||||
|
||||
def request_cert(reuse_existing, **kwargs):
|
||||
def request_cert():
|
||||
"""
|
||||
Request certificate from IPA CA.
|
||||
"""
|
||||
if reuse_existing:
|
||||
cert = os.environ.get('CERTMONGER_CERTIFICATE')
|
||||
if cert:
|
||||
return (ISSUED, cert)
|
||||
else:
|
||||
return (REJECTED, "New certificate requests not supported")
|
||||
|
||||
syslog.syslog(syslog.LOG_NOTICE,
|
||||
"Forwarding request to dogtag-ipa-renew-agent")
|
||||
|
||||
args = ([paths.DOGTAG_IPA_RENEW_AGENT_SUBMIT,
|
||||
"--cafile", paths.IPA_CA_CRT,
|
||||
"--certfile", paths.RA_AGENT_PEM,
|
||||
"--keyfile", paths.RA_AGENT_KEY] +
|
||||
sys.argv[1:] +
|
||||
['--submit-option', "requestor_name=IPA"])
|
||||
if os.environ.get('CERTMONGER_CA_PROFILE') == 'caCACert':
|
||||
args += ['-N', '-O', 'bypassCAnotafter=true']
|
||||
result = ipautil.run(args, raiseonerr=False, env=os.environ,
|
||||
capture_output=True)
|
||||
if six.PY2:
|
||||
sys.stderr.write(result.raw_error_output)
|
||||
else:
|
||||
# Write bytes directly
|
||||
sys.stderr.buffer.write(result.raw_error_output) #pylint: disable=no-member
|
||||
path = paths.DOGTAG_IPA_RENEW_AGENT_SUBMIT
|
||||
args = [path] + sys.argv[1:]
|
||||
stdout, stderr, rc = ipautil.run(args, raiseonerr=False, env=os.environ)
|
||||
sys.stderr.write(stderr)
|
||||
sys.stderr.flush()
|
||||
|
||||
syslog.syslog(syslog.LOG_NOTICE,
|
||||
"dogtag-ipa-renew-agent returned %d" % result.returncode)
|
||||
syslog.syslog(syslog.LOG_NOTICE, "dogtag-ipa-renew-agent returned %d" % rc)
|
||||
|
||||
stdout = result.output
|
||||
if stdout.endswith('\n'):
|
||||
stdout = stdout[:-1]
|
||||
|
||||
rc = result.returncode
|
||||
if rc == WAIT_WITH_DELAY:
|
||||
delay, _sep, cookie = stdout.partition('\n')
|
||||
delay, sep, cookie = stdout.partition('\n')
|
||||
return (rc, delay, cookie)
|
||||
else:
|
||||
return (rc, stdout)
|
||||
|
||||
|
||||
def store_cert(**kwargs):
|
||||
def store_cert():
|
||||
"""
|
||||
Store certificate in LDAP.
|
||||
"""
|
||||
@@ -257,18 +110,23 @@ def store_cert(**kwargs):
|
||||
try:
|
||||
attempts = int(cookie)
|
||||
except ValueError:
|
||||
return (UNCONFIGURED, "Invalid cookie: %r" % cookie)
|
||||
return (UNCONFIGURED, "Invalid cookie")
|
||||
else:
|
||||
return (OPERATION_NOT_SUPPORTED_BY_HELPER,)
|
||||
|
||||
nickname = get_nickname()
|
||||
csr = os.environ.get('CERTMONGER_CSR')
|
||||
if not csr:
|
||||
return (UNCONFIGURED, "Certificate request not provided")
|
||||
|
||||
nickname = pkcs10.get_friendlyname(csr)
|
||||
if not nickname:
|
||||
return (REJECTED, "Nickname could not be determined")
|
||||
return (REJECTED, "No friendly name in the certificate request")
|
||||
|
||||
cert = os.environ.get('CERTMONGER_CERTIFICATE')
|
||||
if not cert:
|
||||
return (REJECTED, "New certificate requests not supported")
|
||||
cert = x509.load_pem_x509_certificate(cert.encode('ascii'))
|
||||
|
||||
dercert = x509.normalize_certificate(cert)
|
||||
|
||||
dn = DN(('cn', nickname), ('cn', 'ca_renewal'),
|
||||
('cn', 'ipa'), ('cn', 'etc'), api.env.basedn)
|
||||
@@ -276,34 +134,33 @@ def store_cert(**kwargs):
|
||||
with ldap_connect() as conn:
|
||||
try:
|
||||
entry = conn.get_entry(dn, ['usercertificate'])
|
||||
entry['usercertificate'] = [cert]
|
||||
entry['usercertificate'] = [dercert]
|
||||
conn.update_entry(entry)
|
||||
except errors.NotFound:
|
||||
entry = conn.make_entry(
|
||||
dn,
|
||||
objectclass=['top', 'pkiuser', 'nscontainer'],
|
||||
cn=[nickname],
|
||||
usercertificate=[cert])
|
||||
usercertificate=[dercert])
|
||||
conn.add_entry(entry)
|
||||
except errors.EmptyModlist:
|
||||
pass
|
||||
except Exception as e:
|
||||
except Exception, e:
|
||||
attempts += 1
|
||||
if attempts < 10:
|
||||
syslog.syslog(
|
||||
syslog.LOG_ERR,
|
||||
"Updating renewal certificate failed: %s. Sleeping 30s" % e)
|
||||
return (WAIT_WITH_DELAY, 30, str(attempts))
|
||||
return (WAIT_WITH_DELAY, 30, attempts)
|
||||
else:
|
||||
syslog.syslog(
|
||||
syslog.LOG_ERR,
|
||||
"Giving up. To retry storing the certificate, resubmit the "
|
||||
"request with CA \"dogtag-ipa-ca-renew-agent-reuse\"")
|
||||
"request with profile \"ipaStorage\"")
|
||||
|
||||
return (ISSUED, cert.public_bytes(x509.Encoding.PEM).decode('ascii'))
|
||||
return (ISSUED, cert)
|
||||
|
||||
|
||||
def request_and_store_cert(**kwargs):
|
||||
def request_and_store_cert():
|
||||
"""
|
||||
Request certificate from IPA CA and store it in LDAP.
|
||||
"""
|
||||
@@ -316,10 +173,9 @@ def request_and_store_cert(**kwargs):
|
||||
if not cookie:
|
||||
return (UNCONFIGURED, "Cookie not provided")
|
||||
|
||||
state, _sep, cookie = cookie.partition(':')
|
||||
state, sep, cookie = cookie.partition(':')
|
||||
if state not in ('request', 'store'):
|
||||
return (UNCONFIGURED,
|
||||
"Invalid cookie: %r" % os.environ['CERTMONGER_CA_COOKIE'])
|
||||
return (UNCONFIGURED, "Invalid cookie")
|
||||
else:
|
||||
return (OPERATION_NOT_SUPPORTED_BY_HELPER,)
|
||||
|
||||
@@ -329,7 +185,7 @@ def request_and_store_cert(**kwargs):
|
||||
else:
|
||||
os.environ['CERTMONGER_CA_COOKIE'] = cookie
|
||||
|
||||
result = call_handler(request_cert, **kwargs)
|
||||
result = request_cert()
|
||||
if result[0] == WAIT:
|
||||
return (result[0], 'request:%s' % result[1])
|
||||
elif result[0] == WAIT_WITH_DELAY:
|
||||
@@ -340,7 +196,7 @@ def request_and_store_cert(**kwargs):
|
||||
cert = result[1]
|
||||
cookie = None
|
||||
else:
|
||||
cert, _sep, cookie = cookie.partition(':')
|
||||
cert, sep, cookie = cookie.partition(':')
|
||||
|
||||
if cookie is None:
|
||||
os.environ['CERTMONGER_OPERATION'] = 'SUBMIT'
|
||||
@@ -348,7 +204,7 @@ def request_and_store_cert(**kwargs):
|
||||
os.environ['CERTMONGER_CA_COOKIE'] = cookie
|
||||
os.environ['CERTMONGER_CERTIFICATE'] = cert
|
||||
|
||||
result = call_handler(store_cert, **kwargs)
|
||||
result = store_cert()
|
||||
if result[0] == WAIT:
|
||||
return (result[0], 'store:%s:%s' % (cert, result[1]))
|
||||
elif result[0] == WAIT_WITH_DELAY:
|
||||
@@ -356,20 +212,19 @@ def request_and_store_cert(**kwargs):
|
||||
else:
|
||||
return result
|
||||
|
||||
def retrieve_cert():
|
||||
"""
|
||||
Retrieve new certificate from LDAP.
|
||||
"""
|
||||
csr = os.environ.get('CERTMONGER_CSR')
|
||||
if not csr:
|
||||
return (UNCONFIGURED, "Certificate request not provided")
|
||||
|
||||
def retrieve_or_reuse_cert(**kwargs):
|
||||
"""
|
||||
Retrieve certificate from LDAP. If the certificate is not available, reuse
|
||||
the old certificate.
|
||||
"""
|
||||
nickname = get_nickname()
|
||||
nickname = pkcs10.get_friendlyname(csr)
|
||||
if not nickname:
|
||||
return (REJECTED, "Nickname could not be determined")
|
||||
return (REJECTED, "No friendly name in the certificate request")
|
||||
|
||||
cert = os.environ.get('CERTMONGER_CERTIFICATE')
|
||||
if not cert:
|
||||
return (REJECTED, "New certificate requests not supported")
|
||||
cert = x509.load_pem_x509_certificate(cert.encode('ascii'))
|
||||
syslog.syslog(syslog.LOG_NOTICE, "Updating certificate for %s" % nickname)
|
||||
|
||||
with ldap_connect() as conn:
|
||||
try:
|
||||
@@ -378,168 +233,72 @@ def retrieve_or_reuse_cert(**kwargs):
|
||||
('cn', 'ipa'), ('cn', 'etc'), api.env.basedn),
|
||||
['usercertificate'])
|
||||
except errors.NotFound:
|
||||
pass
|
||||
else:
|
||||
cert = entry.single_value['usercertificate']
|
||||
syslog.syslog(
|
||||
syslog.LOG_INFO,
|
||||
"Updated certificate for %s not available" % nickname)
|
||||
# No cert available yet, tell certmonger to wait another 8 hours
|
||||
return (WAIT_WITH_DELAY, 8 * 60 * 60)
|
||||
|
||||
return (ISSUED, cert.public_bytes(x509.Encoding.PEM).decode('ascii'))
|
||||
cert = entry.single_value['usercertificate']
|
||||
cert = base64.b64encode(cert)
|
||||
cert = x509.make_pem(cert)
|
||||
|
||||
return (ISSUED, cert)
|
||||
|
||||
def retrieve_cert_continuous(reuse_existing, **kwargs):
|
||||
def export_csr():
|
||||
"""
|
||||
Retrieve new certificate from LDAP. Repeat every eight hours until the
|
||||
certificate is available.
|
||||
This does not actually renew the cert, it just writes the CSR provided
|
||||
by certmonger to /var/lib/ipa/ca.csr and returns the existing cert.
|
||||
"""
|
||||
old_cert = os.environ.get('CERTMONGER_CERTIFICATE')
|
||||
if old_cert:
|
||||
old_cert = x509.load_pem_x509_certificate(old_cert.encode('ascii'))
|
||||
operation = os.environ.get('CERTMONGER_OPERATION')
|
||||
if operation != 'SUBMIT':
|
||||
return (OPERATION_NOT_SUPPORTED_BY_HELPER,)
|
||||
|
||||
result = call_handler(retrieve_or_reuse_cert,
|
||||
reuse_existing=reuse_existing,
|
||||
**kwargs)
|
||||
if result[0] != ISSUED or reuse_existing:
|
||||
return result
|
||||
|
||||
new_cert = x509.load_pem_x509_certificate(result[1].encode('ascii'))
|
||||
if new_cert == old_cert:
|
||||
syslog.syslog(syslog.LOG_INFO, "Updated certificate not available")
|
||||
# No cert available yet, tell certmonger to wait another 8 hours
|
||||
return (WAIT_WITH_DELAY, 8 * 60 * 60, '')
|
||||
|
||||
return result
|
||||
|
||||
|
||||
def retrieve_cert(**kwargs):
|
||||
"""
|
||||
Retrieve new certificate from LDAP.
|
||||
"""
|
||||
result = call_handler(retrieve_cert_continuous, **kwargs)
|
||||
if result[0] == WAIT_WITH_DELAY:
|
||||
return (REJECTED, "Updated certificate not available")
|
||||
|
||||
return result
|
||||
|
||||
|
||||
def renew_ca_cert(reuse_existing, **kwargs):
|
||||
"""
|
||||
This is used for automatic CA certificate renewal.
|
||||
"""
|
||||
csr = os.environ.get('CERTMONGER_CSR').encode('ascii')
|
||||
csr = os.environ.get('CERTMONGER_CSR')
|
||||
if not csr:
|
||||
return (UNCONFIGURED, "Certificate request not provided")
|
||||
|
||||
cert = os.environ.get('CERTMONGER_CERTIFICATE')
|
||||
if not cert:
|
||||
return (REJECTED, "New certificate requests not supported")
|
||||
cert = x509.load_pem_x509_certificate(cert.encode('ascii'))
|
||||
is_self_signed = cert.is_self_signed()
|
||||
|
||||
operation = os.environ.get('CERTMONGER_OPERATION')
|
||||
if operation == 'SUBMIT':
|
||||
state = 'retrieve'
|
||||
csr_file = paths.IPA_CA_CSR
|
||||
try:
|
||||
with open(csr_file, 'wb') as f:
|
||||
f.write(csr)
|
||||
except Exception, e:
|
||||
return (UNREACHABLE, "Failed to write %s: %s" % (csr_file, e))
|
||||
|
||||
if not reuse_existing and is_renewal_master():
|
||||
state = 'request'
|
||||
|
||||
csr_file = paths.IPA_CA_CSR
|
||||
try:
|
||||
with open(csr_file, 'wb') as f:
|
||||
f.write(csr)
|
||||
except Exception as e:
|
||||
return (UNREACHABLE, "Failed to write %s: %s" % (csr_file, e))
|
||||
elif operation == 'POLL':
|
||||
cookie = os.environ.get('CERTMONGER_CA_COOKIE')
|
||||
if not cookie:
|
||||
return (UNCONFIGURED, "Cookie not provided")
|
||||
|
||||
state, _sep, cookie = cookie.partition(':')
|
||||
if state not in ('retrieve', 'request'):
|
||||
return (UNCONFIGURED,
|
||||
"Invalid cookie: %r" % os.environ['CERTMONGER_CA_COOKIE'])
|
||||
|
||||
os.environ['CERTMONGER_CA_COOKIE'] = cookie
|
||||
else:
|
||||
return (OPERATION_NOT_SUPPORTED_BY_HELPER,)
|
||||
|
||||
if state == 'retrieve':
|
||||
result = call_handler(retrieve_cert,
|
||||
reuse_existing=reuse_existing,
|
||||
**kwargs)
|
||||
if result[0] == REJECTED and not is_self_signed and not reuse_existing:
|
||||
syslog.syslog(syslog.LOG_ALERT,
|
||||
"Certificate with subject '%s' is about to expire, "
|
||||
"use ipa-cacert-manage to renew it"
|
||||
% (os.environ.get("CERTMONGER_REQ_SUBJECT"),))
|
||||
elif state == 'request':
|
||||
profile = os.environ.get('CERTMONGER_CA_PROFILE')
|
||||
os.environ['CERTMONGER_CA_PROFILE'] = 'caCACert'
|
||||
result = call_handler(request_and_store_cert,
|
||||
reuse_existing=reuse_existing,
|
||||
**kwargs)
|
||||
if profile is not None:
|
||||
os.environ['CERTMONGER_CA_PROFILE'] = profile
|
||||
else:
|
||||
del os.environ['CERTMONGER_CA_PROFILE']
|
||||
|
||||
if result[0] == WAIT:
|
||||
return (result[0], '%s:%s' % (state, result[1]))
|
||||
elif result[0] == WAIT_WITH_DELAY:
|
||||
return (result[0], result[1], '%s:%s' % (state, result[2]))
|
||||
else:
|
||||
return result
|
||||
return (ISSUED, cert)
|
||||
|
||||
def main():
|
||||
kwargs = {
|
||||
'reuse_existing': False,
|
||||
handlers = {
|
||||
'ipaStorage': store_cert,
|
||||
'ipaRetrieval': retrieve_cert,
|
||||
'ipaCSRExport': export_csr,
|
||||
}
|
||||
try:
|
||||
sys.argv.remove('--reuse-existing')
|
||||
except ValueError:
|
||||
pass
|
||||
else:
|
||||
kwargs['reuse_existing'] = True
|
||||
|
||||
api.bootstrap(in_server=True, context='renew', confdir=paths.ETC_IPA)
|
||||
api.bootstrap(context='renew')
|
||||
api.finalize()
|
||||
|
||||
operation = os.environ.get('CERTMONGER_OPERATION')
|
||||
if operation not in ('SUBMIT', 'POLL'):
|
||||
return OPERATION_NOT_SUPPORTED_BY_HELPER
|
||||
|
||||
tmpdir = tempfile.mkdtemp(prefix="tmp-")
|
||||
certs.renewal_lock.acquire()
|
||||
try:
|
||||
principal = str('host/%s@%s' % (api.env.host, api.env.realm))
|
||||
ccache_filename = os.path.join(tmpdir, 'ccache')
|
||||
os.environ['KRB5CCNAME'] = ccache_filename
|
||||
kinit_keytab(principal, paths.KRB5_KEYTAB, ccache_filename)
|
||||
|
||||
api.Backend.ldap2.connect()
|
||||
|
||||
if get_nickname() == IPA_CA_NICKNAME:
|
||||
handler = renew_ca_cert
|
||||
elif is_replicated():
|
||||
if is_renewal_master():
|
||||
handler = request_and_store_cert
|
||||
else:
|
||||
handler = retrieve_cert_continuous
|
||||
profile = os.environ.get('CERTMONGER_CA_PROFILE')
|
||||
if profile:
|
||||
handler = handlers.get(profile, request_and_store_cert)
|
||||
else:
|
||||
ca = cainstance.CAInstance(api.env.realm, certs.NSS_DIR)
|
||||
if ca.is_renewal_master():
|
||||
handler = request_and_store_cert
|
||||
else:
|
||||
handler = request_cert
|
||||
|
||||
res = call_handler(handler, **kwargs)
|
||||
for item in res[1:]:
|
||||
print(item)
|
||||
return res[0]
|
||||
finally:
|
||||
if api.Backend.ldap2.isconnected():
|
||||
api.Backend.ldap2.disconnect()
|
||||
certs.renewal_lock.release()
|
||||
shutil.rmtree(tmpdir)
|
||||
handler = retrieve_cert
|
||||
|
||||
res = handler()
|
||||
for item in res[1:]:
|
||||
print item
|
||||
return res[0]
|
||||
|
||||
try:
|
||||
sys.exit(main())
|
||||
except Exception as e:
|
||||
except Exception, e:
|
||||
syslog.syslog(syslog.LOG_ERR, traceback.format_exc())
|
||||
print("Internal error")
|
||||
print "Internal error"
|
||||
sys.exit(UNREACHABLE)
|
||||
|
||||
@@ -1,63 +0,0 @@
|
||||
#!/usr/bin/python2 -E
|
||||
#
|
||||
# Authors:
|
||||
# Jan Cholasta <jcholast@redhat.com>
|
||||
#
|
||||
# Copyright (C) 2015 Red Hat
|
||||
# see file 'COPYING' for use and warranty information
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation, either version 3 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
from __future__ import print_function
|
||||
|
||||
import os
|
||||
# Prevent garbage from readline on standard output
|
||||
# (see https://fedorahosted.org/freeipa/ticket/4064)
|
||||
if not os.isatty(1):
|
||||
os.environ['TERM'] = 'dumb'
|
||||
import sys
|
||||
import syslog
|
||||
import traceback
|
||||
|
||||
import six
|
||||
|
||||
from ipapython import ipautil
|
||||
from ipaserver.install import certs
|
||||
|
||||
|
||||
def main():
|
||||
if len(sys.argv) < 2:
|
||||
raise RuntimeError("Not enough arguments")
|
||||
|
||||
with certs.renewal_lock:
|
||||
result = ipautil.run(sys.argv[1:], raiseonerr=False, env=os.environ)
|
||||
if six.PY2:
|
||||
sys.stdout.write(result.raw_output)
|
||||
sys.stderr.write(result.raw_error_output)
|
||||
else:
|
||||
# Write bytes directly
|
||||
sys.stdout.buffer.write(result.raw_output) #pylint: disable=no-member
|
||||
sys.stderr.buffer.write(result.raw_error_output) #pylint: disable=no-member
|
||||
sys.stdout.flush()
|
||||
sys.stderr.flush()
|
||||
|
||||
return result.returncode
|
||||
|
||||
|
||||
try:
|
||||
sys.exit(main())
|
||||
except Exception as e:
|
||||
syslog.syslog(syslog.LOG_ERR, traceback.format_exc())
|
||||
print("Internal error")
|
||||
sys.exit(3)
|
||||
Reference in New Issue
Block a user