def __init__(self, content_type=None, name=None, label=None, vendor=None, url=None,
gpg=None, enabled=None, metadata_expire=None, required_tags=None):
if (name is None) or (label is None):
raise CertificateException("Content missing name/label")
self.content_type = content_type
self.name = name
self.label = label
self.vendor = vendor
self.url = url
self.gpg = gpg
if not content_type:
raise CertificateException("Content does not have a type set.")
if (enabled not in (None, 0, 1, "0", "1")):
raise CertificateException("Invalid content enabled setting: %s"
% enabled)
# Convert possible incoming None or string (0/1) to a boolean:
# If enabled isn't specified in cert we assume True.
self.enabled = False
if enabled is None or enabled == "1" or enabled is True:
self.enabled = True
self.metadata_expire = metadata_expire
self.required_tags = required_tags or []
def _read_x509(self, x509, path, pem):
if not x509:
if path is not None:
raise CertificateException("Error loading certificate: %s" %
path)
elif pem is not None:
raise CertificateException(
"Error loading certificate from string: %s" % pem)
else:
raise CertificateException(
"Error: none certificate data offered")
# Load the X509 extensions so we can determine what we're dealing with:
try:
extensions = _Extensions2(x509)
redhat_oid = OID(REDHAT_OID_NAMESPACE)
# Trim down to only the extensions in the Red Hat namespace:
extensions = extensions.branch(redhat_oid)
# Check the certificate version, absence of the extension implies v1.0:
cert_version_str = "1.0"
if EXT_CERT_VERSION in extensions:
cert_version_str = extensions[EXT_CERT_VERSION].decode('utf-8')
version = Version(cert_version_str)
if version.major == 1:
return self._create_v1_cert(version, extensions, x509, path)
if version.major == 3:
return self._create_v3_cert(version, extensions, x509, path,
pem)
except CertificateException as e:
raise e
except Exception as e:
log.exception(e)
raise CertificateException(str(e))
def __init__(self,
id=None,
name=None,
version=None,
architectures=None,
provided_tags=None,
brand_type=None,
brand_name=None):
if name is None:
raise CertificateException("Product missing name")
if id is None:
raise CertificateException("Product missing ID")
self.id = id
self.name = name
self.version = version
self.architectures = architectures
# If this is sent in as a string split it, as the field
# can technically be multi-valued:
if isinstance(self.architectures, six.string_types):
self.architectures = parse_tags(self.architectures)
if self.architectures is None:
self.architectures = []
self.provided_tags = provided_tags
if self.provided_tags is None:
self.provided_tags = []
self.brand_type = brand_type
self.brand_name = brand_name
def create_from_pem(self, pem, path=None):
"""
Create appropriate certificate object from a PEM string.
"""
if not pem:
raise CertificateException("Empty certificate")
return self._read_x509(_certificate.load(pem=pem), path, pem)
def __init__(self, x509=None, path=None, version=None, serial=None, start=None,
end=None, subject=None, pem=None):
# The X509 M2crypto object for this certificate.
# WARNING: May be None in tests
self.x509 = x509
# Full file path to the certificate on disk. May be None if the cert
# hasn't yet been written to disk.
self.path = path
# Version of the certificate sent by Candlepin:
self.version = version
if serial is None:
raise CertificateException("Certificate has no serial")
self.serial = serial
# Certificate start/end datetimes:
self.start = start
self.end = end
self.valid_range = DateRange(self.start, self.end)
self.pem = pem
self.subject = subject
def delete(self):
"""
Delete the file associated with this certificate.
"""
if self.path:
os.unlink(self.path)
else:
raise CertificateException('Certificate has no path, cannot delete.')
def create_from_file(self, path):
"""
Create appropriate certificate object from a PEM file on disk.
"""
try:
pem = open(path, 'r').read()
except IOError as err:
raise CertificateException("Error loading certificate: %s" % err)
return self._read_x509(_certificate.load(path), path, pem)
class _CertFactory(object):
"""
Factory for creating certificate objects.
Examines the incoming file or PEM text, parses the OID structure,
from the server, and returns the correct implementation class.
determines the type of certificate we're dealing with
(entitlement/product), as well as the version of the certificate
NOTE: Please use the factory methods that leverage this class in
certificate.py instead of this class.
"""
def create_from_file(self, path):
"""
Create appropriate certificate object from a PEM file on disk.
"""
pem = open(path, 'r').read()
return self._read_x509(_certificate.load(path), path, pem)
def create_from_pem(self, pem, path=None):
"""
Create appropriate certificate object from a PEM string.
"""
if not pem:
raise CertificateException("Empty certificate")
return self._read_x509(_certificate.load(pem=pem), path, pem)
def _read_x509(self, x509, path, pem):
if not x509:
raise CertificateException("Error loading certificate")
# Load the X509 extensions so we can determine what we're dealing with:
try:
extensions = _Extensions2(x509)
redhat_oid = OID(REDHAT_OID_NAMESPACE)
# Trim down to only the extensions in the Red Hat namespace:
extensions = extensions.ltrim(len(redhat_oid))
# Check the certificate version, absence of the extension implies v1.0:
cert_version_str = "1.0"
if EXT_CERT_VERSION in extensions:
cert_version_str = extensions[EXT_CERT_VERSION]
version = Version(cert_version_str)
if version.major == 1:
return self._create_v1_cert(version, extensions, x509, path)
if version.major == 3:
return self._create_v3_cert(version, extensions, x509, path,
pem)
except CertificateException, e:
raise e
except Exception, e:
log.exception(e)
raise CertificateException(str(e))
def test_valid_x509_required(self, mock_create, mock_isfile):
mock_create.side_effect = CertificateException("error!")
mock_isfile.return_value = True
command = RCTCertCommand()
command._do_command = lambda: command._create_cert()
try:
command.main(['dummy-file.pem'])
self.fail("Expected InvalidCLIOptionError since bad x509 file.")
except InvalidCLIOptionError, e:
self.assertEqual(
"Unable to read certificate file 'dummy-file.pem': error!",
str(e))
def key_path(self):
"""
Returns the full path to the cert key's pem.
"""
dir_path, cert_filename = os.path.split(self.path)
try:
key_filename = "%s-key.%s" % tuple(cert_filename.rsplit(".", 1))
except TypeError, e:
log.exception(e)
raise CertificateException(
"Entitlement certificate path \"%s\" is not in "
"in the expected format so the key file path "
"could not be based on it." % self.path)
def _decompress_payload(self, payload):
"""
Certificate payloads arrive in zlib compressed strings
of JSON.
This method de-compresses and parses the JSON and returns the
resulting dict.
"""
try:
decompressed = zlib.decompress(payload).decode('utf-8')
return json.loads(decompressed)
except Exception as e:
log.exception(e)
raise CertificateException("Error decompressing/parsing "
"certificate payload.")
def _read_x509(self, x509, path, pem):
if not x509:
raise CertificateException("Error loading certificate")
# Load the X509 extensions so we can determine what we're dealing with:
try:
extensions = _Extensions2(x509)
redhat_oid = OID(REDHAT_OID_NAMESPACE)
# Trim down to only the extensions in the Red Hat namespace:
extensions = extensions.ltrim(len(redhat_oid))
# Check the certificate version, absence of the extension implies v1.0:
cert_version_str = "1.0"
if EXT_CERT_VERSION in extensions:
cert_version_str = extensions[EXT_CERT_VERSION]
version = Version(cert_version_str)
if version.major == 1:
return self._create_v1_cert(version, extensions, x509, path)
if version.major == 3:
return self._create_v3_cert(version, extensions, x509, path, pem)
except CertificateException, e:
raise e
def __init__(self, id=None):
if id is None:
raise CertificateException("Pool is missing ID")
self.id = id