File: //lib/python3.6/site-packages/ipapython/__pycache__/certdb.cpython-36.pyc
3
�d[e`� � @ s� d dl mZ d dlZd dlZd dlZd dlZd dlZd dlZd dlZd dl Z d dl
Z
d dl Z d dl Z d dl
mZ d dl mZ d dlZd dlmZ d dlmZ d dlmZ d dlmZ d d lmZ d d
l m Z ej e �Z d Z!d-Z"d.Z#e"e# d/ Z$ej%dd�Z&e&dddd�Z'e&ddde(e j)e j*e j+e j,e j-e j.h��Z/e&ddde(e j)h��Z0e&ddde(e j)h��Z1dd� Z2e!fdd�Z3d0dd �Z4d d � Z5d d � Z6d!d"� Z7e j8d#�Z9e j8d$�Z:G d%d&� d&e;�Z<G d'd(� d(e;�Z=G d)d*� d*e;�Z>G d+d,� d,�Z?dS )1� )�absolute_importN)� find_library)�NamedTemporaryFile)�paths)�tasks)�DN)� Principal)�ipautil)�x509z %s IPA CA�cert8.db�key3.db� secmod.db�cert9.db�key4.db�
pkcs11.txt� pwdfile.txt�
TrustFlagszhas_key trusted ca usagesFTc C s t td��S )NZnssdbm3)�boolr � r r � /usr/lib/python3.6/certdb.py�nss_supports_dbmM s r c C s || S )Nr )�realm�formatr r r �get_ca_nicknameQ s r c C s` | j d|�}| j d|�}|dkr(|d }|dk s8|dk r@td��tj| ||� jd��} | |fS )z�
Given a cert blob (str) which may or may not contian leading and
trailing text, pull out just the certificate part. This will return
the FIRST cert in a stream of data.
:returns: a tuple (IPACertificate, last position in cert)
z-----BEGIN CERTIFICATE-----z-----END CERTIFICATE-----r � zUnable to find certificatezutf-8)�find� RuntimeErrorr
�load_pem_x509_certificate�encode)�cert�start�s�er r r �find_cert_from_txtU s r# c C s� d| k}d| kr4d| ks(d| ks(d| kr0t d��d
S d| ksDd| krZd| krTt d ��d
}n d| krhd}nt|ddt� �S | jd �} t� }xBttjtjtj f�D ]*\}}d| | ks�d| | kr�|j
|� q�W d| d kr�|j
tj � t|d
|t|��S )z<
Convert certutil trust flags to TrustFlags object.
�u�p�C�P�Tz&cannot be both trusted and not trustedFNz cannot be both CA and not CAT�,r )FNN) �
ValueErrorr � frozenset�split�set� enumerater
�EKU_SERVER_AUTH�EKU_EMAIL_PROTECTION�EKU_CODE_SIGNING�add�EKU_CLIENT_AUTH)� trust_flags�has_key�ca�
ext_key_usage�i�kpr r r �parse_trust_flagsi s,
r: c C s | \}}}}|dkr"|r dS dS nD|dks2|dkr@|r:dS dS n&|dkrf|rZ|rTdS dS n |rbd S d
S d d d g} x@t tjtjtjf�D ](\}}||kr�| | |r�d nd
7 < q�W |r�tj|kr�| d d7 < |r�x td�D ]}| | d7 < q�W dj| �} | S )z<
Convert TrustFlags object to certutil trust flags.
Fzpu,pu,puzp,p,pNzu,u,uz,,z CTu,Cu,CuzCT,C,CzPu,Pu,PuzP,P,P� r& r' r r( � r$ r) )r. r
r/ r0 r1 r3 �range�join)r4 r5 Ztrustedr6 r7 r8 r9 r r r �unparse_trust_flags� s<
r? c
( C sZ t � ��H}t � ��4}|j| jtjj�� |j� tj||j� |j� y"t j
t j dd|j|jgdd� W n. t j
k
r� } zt|j��W Y dd}~X nX y.| jjtjj�}t|j�jtjjtj�� W n$ tjjtfk
r� td��Y nX ttd|g|��}tj | j �}x6|D ]"} t | tj ��r| j|k�rP �qW td| ��W dQ R X W dQ R X dS ) z�
Verifies the validity of a kdc_cert, ensuring it is trusted by
the ca_certs chain, has a PKINIT_KDC extended key usage support,
and verify it applies to the given realm.
Zverifyz-CAfileT)�capture_outputNzinvalid for a KDCZkrbtgtzinvalid for realm %s) r �write� public_bytesr
�Encoding�PEM�flushZwrite_certificate_list�namer �runr �OPENSSL�CalledProcessErrorr* �output�
extensions�get_extension_for_class� cryptographyZExtendedKeyUsage�list�value�indexZObjectIdentifier�EKU_PKINIT_KDC�ExtensionNotFound�strr Zprocess_othernamesZsan_general_names�
isinstanceZKRB5PrincipalName)
Zkdc_certZca_certsr Zkdc_fileZca_filer" ZekuZ principalZgnsZgnr r r �verify_kdc_cert_validity� s4
rU z+^(?P<nick>.+?)\s+(?P<flags>\w*,\w*,\w*)\s*$zN^<\s*(?P<slot>\d+)>\s+(?P<algo>\w+)\s+(?P<keyid>[0-9a-z]+)\s+(?P<nick>.*?)\s*$c @ s e Zd ZdZdS )�"Pkcs12ImportIncorrectPasswordErrorzB Raised when import_pkcs12 fails because of a wrong password.
N)�__name__�
__module__� __qualname__�__doc__r r r r rV � s rV c @ s e Zd ZdZdS )�Pkcs12ImportOpenErrorz> Raised when import_pkcs12 fails trying to open the file.
N)rW rX rY rZ r r r r r[ � s r[ c @ s e Zd ZdZdS )�Pkcs12ImportUnknownErrorzB Raised when import_pkcs12 fails because of an unknown error.
N)rW rX rY rZ r r r r r\ � s r\ c @ s* e Zd ZdZdHdd�Zdd� Zdd � Zd
d � Zd d
� Zdd� Z dd� Z
dIdd�Z dJdd�Z dd� Z
dKdd�ZdLd d �Zd d � Zd d!� Zd"d#� Zd$d%� Zd&d'� ZdMd(d)�ZdNd*d+�ZdOd,d-�Zd.d/� Zd0d1� Zd2d3� Zd4d5� Zd6d7� Z d8d9� Z d:d;� Z d<d=� Z d>d?� Z d@dA� Z!dBdC� Z"dPdDdE�Z#dFdG� Z$dS )Q� NSSDatabaseaI A general-purpose wrapper around a NSS cert database
For permanent NSS databases, pass the cert DB directory to __init__
For temporary databases, do not pass nssdir, and call close() when done
to remove the DB. Alternatively, a NSSDatabase can be used as a
context manager that calls close() automatically.
N�autoc C s� |d k r$|| _ d| _|dkr$| j� }|dkrDt� rDtd|� d���|d kr\tj� | _ d| _tjj | j d�| _
d | _ d | _ | _
| _f | _f | _| j|� d S )NFr^ �dbmzDNSS is built without support of the legacy database(DBM) directory '�'Tz pwdfile.txt)�secdir�
_is_temporary�_detect_dbtyper r* �tempfileZmkdtemp�os�pathr> �pwd_file�dbtype�certdb�keydb�secmod� filenames�backup_filenames�_set_filenames)�selfZnssdirrh r r r �__init__ s"
zNSSDatabase.__init__c C s@ t jjt jj| jd��r dS t jjt jj| jd��r8dS dS d S )Nzcert9.db�sqlzcert8.dbr_ r^ )re rf �isfiler> ra )ro r r r rc s
zNSSDatabase._detect_dbtypec C s� || _ tjj| jd�tjj| jd�tjj| jd�f}tjj| jd�tjj| jd�tjj| jd�f}|dkr�|\| _| _| _|| jf | _ nR|dkr�|\| _| _| _|| jf | _ n*|d kr�d | _ | _| _d | _ nt
|��| jf| | | _ d S )
Nzcert8.dbzkey3.dbz secmod.dbzcert9.dbzkey4.dbz
pkcs11.txtr_ rq r^ ) rh re rf r> ra ri rj rk rg rl r* rm )ro rh ZdbmfilesZsqlfilesr r r rn % s$ zNSSDatabase._set_filenamesc C s | j rtj| j� d S )N)rb �shutilZrmtreera )ro r r r �close@ s zNSSDatabase.closec C s | S )Nr )ro r r r � __enter__D s zNSSDatabase.__enter__c C s | j � d S )N)rt )ro �typerO �tbr r r �__exit__G s zNSSDatabase.__exit__c C s | j d krtdj| j���d S )NzNSSDB '{}' not initialized.)rl r r ra )ro r r r � _check_dbJ s
zNSSDatabase._check_dbc K sT | j � tjddj| j| j�g}|j|� |jd| jg� tj ||fd| ji|��S )Nz-dz{}:{}z-f�cwd)
ry r �CERTUTILr rh ra �extendrg r rG )ro �args�stdin�kwargs�new_argsr r r � run_certutilP s
zNSSDatabase.run_certutilc K s: | j � tjddj| j| j�g}|j|� tj||f|�S )Nz-dz{}:{}) ry r ZPK12UTILr rh ra r| r rG )ro r} r~ r r� r r r � run_pk12util\ s
zNSSDatabase.run_pk12utilc C s" | j dkrdS tdd� | j D ��S )z0Check DB exists (all files are present)
NFc s s | ]}t jj|�V qd S )N)re rf rr )�.0�filenamer r r � <genexpr>j s z%NSSDatabase.exists.<locals>.<genexpr>)rl �all)ro r r r �existse s
zNSSDatabase.existsFc C s |dk r |}|d@ }|d@ }n d}d}d}d}d} |dk rFt j|�j}|dk rZtj|�j} |rxx| jD ]}
tj|
� qfW t j
j | j �s�t j
| j |� t j
j | j�s�tjt j| jt jt jB |�ddd ��*} | jtj� � | j� t j| j� � W dQ R X | jd
k�r
| j } nd j| j| j �} tjd | d
d| jd| jg}
tj |
d| j d� | j | j � � | j dk�rpt dj| j ���t j!| j || � t j"| j |� t#j$| j dd� x\| j D ]R}
t j
j |
��r�t j!|
|| � |
| jk�r�|}n|}t j"|
|� t#j$|
dd� �q�W dS )z�Create cert DB
:param user: User owner the secdir
:param group: Group owner of the secdir
:param mode: Mode of the secdir
:param backup: Backup the sedir files
Ni� i� i� i� � �wT)�closefdr^ z{}:{}z-dz-Nz-fz-@)r~ rz z Failed to create NSSDB at '{}')�force���r� )%�pwd�getpwnamZpw_uid�grpZgetgrnamZgr_gidrm r Z backup_filere rf r� ra �makedirsrg �io�open�O_CREAT�O_WRONLYrA �ipa_generate_passwordrE �fsync�filenorh r r r{ rG rn rc rl r* �chown�chmodr �restore_context)ro �user�group�modeZbackupZdirmode�filemodeZ pwdfilemodeZuid�gidr� �fZdbdirr} Znew_moder r r � create_dbl sb
zNSSDatabase.create_dbTc C s* | j dks"tjjtjj| jd��r2tdj| j���tj ddj| j�dd| j
d| j
g}t j |d | jd
� d}xn|D ]f\}}tjj| j|�}tjj| j|�}tj
|�}tj|t
j|j�� tj||j|j� tj|dd� qpW | jd� | j� |�r&x2|D ]*\}}tjj| j|�}tj||d � � q�W d S )a� Convert DBM database format to SQL database format
**WARNING** **WARNING** **WARNING** **WARNING** **WARNING**
The caller must ensure that no other process or service is
accessing the NSSDB during migration. The DBM format does not support
multiple processes. If more than one process opens a DBM NSSDB for
writing, the database will become **irreparably corrupted**.
**WARNING** **WARNING** **WARNING** **WARNING** **WARNING**
rq �cert9.dbz$NSS DB {} has been migrated already.z-dzsql:{}z-Nz-fz-@N)r~ rz �cert8.db�key3.db�key4.db� secmod.db�
pkcs11.txtT)r� z .migrated�r� r� �r� r� �r� r� )r� r� r� )rh re rf rr r> ra r* r r r{ rg r rG �statr� �S_IMODE�st_moder� �st_uid�st_gidr r� rn �
list_certs�rename)ro Z
rename_oldr} Z migrationZoldnameZnewnameZoldstat�_r r r �
convert_db� s0
zNSSDatabase.convert_dbc C s� x�| j D ]x}|d }|d }y4tjj|�r6tj||� tjj|�rNtj||� W q tk
r~ } ztjd|� W Y d d }~X qX qW d S )Nz.origz.ipasavez%s)rm re rf r� r� �OSError�logger�debug)ro r� Z backup_pathZ save_pathr" r r r �restore� s zNSSDatabase.restorec C sh | j dgdd�}|jj� }g }x@|D ]8}tj|�}|r$|jd�}t|jd��}|j||f� q$W t|�S )z{Return nicknames and cert flags for all certs in the database
:return: List of (name, trust_flags) tuples
z-LT)r@ �nick�flags) r� rJ �
splitlines�CERT_RE�matchr� r: �append�tuple)ro �result�certsZcertlistr r� �nicknamer4 r r r r� � s
zNSSDatabase.list_certsc C s� | j dgddd�}|jdkr f S g }xR|jj� D ]D}tj|�}|d k r0|jt|jd��|jd�|jd�|jd �f� q0W t |�S )
Nz-KFT)Z
raiseonerrr@ � ZslotZalgo�keyidr� )
r� �
returncoderJ r� �KEY_REr� r� �intr� r� )ro r� Zkeylist�line�mor r r � list_keys
s
zNSSDatabase.list_keysc C s2 g }x(| j � D ] \}}|jr|j||f� qW |S )z�Return nicknames and cert flags for server certs in the database
Server certs have an "u" character in the trust flags.
:return: List of (name, trust_flags) tuples
)r� r5 r� )ro � server_certsrF r� r r r �find_server_certs s
z NSSDatabase.find_server_certsc C sX g }| j ddd|gdd�}|jj� }x.|D ]&}tjd|�}|r*|j|j� d � q*W |S )z�Return names of certs in a given cert's trust chain
The list starts with root ca, then first intermediate CA, second
intermediate, and so on.
:param nickname: Name of the cert
:return: List of certificate names
z-Oz--simple-self-signedz-nT)r@ z\s*"(.*)" \[.*r )r� rJ r� �rer� r� �groups)ro r� Zroot_nicknamesr� �chain�c�mr r r �get_trust_chain* s
zNSSDatabase.get_trust_chainc C s� d|d|d| j g}d }|d k r<tj|d �}|jd|jg� zty| j|� W n` tjk
r� } zB|jdkrxtd| ��n$|jdkr�td | ��n td
| ��W Y d d }~X nX W d |d k r�|j � X d S ) Nz-oz-nz-k�
z-w� z&incorrect password for pkcs#12 file %s�
zFailed to open %sz'unknown error exporting pkcs#12 file %s)
rg r �write_tmp_filer| rF r� rI r� r rt )ro r� �pkcs12_filename�
pkcs12_passwdr} �pkcs12_password_filer" r r r �
export_pkcs12@ s&
zNSSDatabase.export_pkcs12c C s� d|d| j dg}d }|d k r:tj|d �}|jd|jg� zty| j|� W n` tjk
r� } zB|jd krvtd| ��n$|jd kr�t d
| ��n t
d | ��W Y d d }~X nX W d |d k r�|j � X d S )
Nz-iz-kz-vr� z-wr� � z&incorrect password for pkcs#12 file %sr� zFailed to open %sz$unknown error import pkcs#12 file %s)r� r� ) rg r r� r| rF r� rI r� rV r[ r\ rt )ro r� r� r} r� r" r r r �
import_pkcs12Y s*
zNSSDatabase.import_pkcs12c = C s d}d}g }�x�|D �]�}y"t |d��} | j� }
W dQ R X W n4 tk
rp } ztd|| jf ��W Y dd} ~ X nX ttjd|
tj��} | �r�d}
�x | D �]}|j � }|j d�}t
|
d|j � d � j � �}|d0k�rFyt
j|�}W nP tk
�r4 } z2|dk�rtjd
||| � w�tjd ||| � W Y dd} ~ X nX |j|� d }
q�|d1k�r�yt
j|�}W nT tjk
�r� } z4|dk�r�tjd
||| � ntjd||| � w�W Y dd} ~ X nX |j|� d }
q�|d2kr�|�s�q�|�r�td||f ��tjddddddd d | j g }|dk�r|�s"|dk�r>tj|�}|d d |j g7 }ytj ||d d �}W n8 tjk
�r� } ztjd ||| � w�W Y dd} ~ X q�X |j }|}d }
q�q�W |
�r�qtd!| ��yt
j |
�}W n tk
�r� Y nX |j|� q|�r�y| j ||� W nL t!k
�r Y n� tk
�rH } ztd"|t"| �f ��W Y dd} ~ X n~X |�r`td||f ��|}| j#� }|�r�xP|D ]\}}||k�rxP �qxW td#||f ��qt
|�dkrtd$t
|�|f ��qtd%| ��qW |�r�| �r�td&d'j$|� ��x*|D ]"}t"t%|j&��}| j'||t(� �q�W |�r t)j*� ��}t)j*� ��}x"|D ]}|j+|j,t
j-j.�� �qBW |j+|� |j/� tj0� } tj| �} tjd(d)d*|j d+|j d d | j d d | j d,d-d.d-g}ytj |� W n2 tjk
�r� } ztd/| ��W Y dd} ~ X nX | j |j | � W dQ R X W dQ R X dS )3a�
Import certificates and a single private key from multiple files
The files may be in PEM and DER certificate, PKCS#7 certificate chain,
PKCS#8 and raw private key and PKCS#12 formats.
:param files: Names of files to import
:param import_keys: Whether to import private keys
:param key_password: Password to decrypt private keys
:param key_nickname: Nickname of the private key to import from PKCS#12
files
N�rbzFailed to open %s: %ss* -----BEGIN (.+?)-----(.*?)-----END \1-----Fr� � CERTIFICATE� X509 CERTIFICATE� X.509 CERTIFICATEz)Skipping certificate in %s at line %s: %sz/Failed to load certificate in %s at line %s: %sT� PKCS7� PKCS #7 SIGNED DATAz$Skipping PKCS#7 in %s at line %s: %s� PRIVATE KEY� ENCRYPTED PRIVATE KEY� RSA PRIVATE KEY� DSA PRIVATE KEY� EC PRIVATE KEYz*Can't load private key from both %s and %sZpkcs8z-topk8z-v2Zaes256z-v2prfZhmacWithSHA256z-passoutzfile:z-passin)r~ r@ z)Skipping private key in %s at line %s: %szFailed to load %szFailed to load %s: %sz'Server certificate "%s" not found in %sz6%s server certificates found in %s, expecting only onez&Failed to load %s: unrecognized formatz"No server certificates found in %sz, Zpkcs12z-exportz-inz-outz-certpbez aes-128-cbcz-keypbez5No matching certificate found for private key from %s)r� r� r� )r� r� r� )r� r� r� r� r� )1r� �read�IOErrorr �strerrorrN r� �finditer�DOTALLr� �lenr r� r
r r* r� Zwarning�errorr� Zpkcs7_to_certsr rI r| r rH rg r� rF rG Z
raw_outputZload_der_x509_certificater� r\ rS r� r> r �subject�add_cert�EMPTY_TRUST_FLAGSrd r rA rB rC rD rE r� ) ro �filesZ import_keysZ key_passwordZ key_nicknameZkey_fileZ
extracted_keyZextracted_certsr� r� �datar" ZmatchesZloadedr� ZbodyZlabelr� r r� r} Z key_pwdfiler� r� r� Z _trust_flagsZin_fileZout_fileZ out_passwordZ out_pwdfiler r r � import_filest s( "
"
zNSSDatabase.import_filesc C sf |d d� dkr t jd|� nDt|�}y| jdd|d|g� W n" tjk
r` td| ��Y nX d S )N� ZBuiltinz7No need to add trust for built-in root CAs, skipping %sz-Mz-nz-tzSetting trust on %s failed)r� r� r? r� r rI r )ro Z
root_nicknamer4 r r r �trust_root_certC s
zNSSDatabase.trust_root_certc C sX dd|dg}y| j |dd�}W n" tjk
r@ td| ��Y nX t|jdd�\}}|S ) z�
:param nickname: nickname of the certificate in the NSS database
:returns: string in Python2
bytes in Python3
z-Lz-nz-aT)r@ zFailed to get %sr )r )r� r rI r r# rJ )ro r� r} r� r Z_startr r r �get_certQ s zNSSDatabase.get_certc C s, y| j |� W n tk
r" dS X dS d S )NFT)r� r )ro r� r r r � has_nickname_ s
zNSSDatabase.has_nicknamec
C sD | j |�}t|d��}|j|jtjj�� W dQ R X tj|d� dS )z7Export the given cert to PEM file in the given location�wbNi$ ) r� r� rA rB r
rC rD re r� )ro r� �locationr �fdr r r �export_pem_certh s
zNSSDatabase.export_pem_certc C s� y t |��}|j� }W dQ R X W n4 tk
rT } ztd||jf ��W Y dd}~X nX t|�\}}| j|||� yt||� W n tk
r� Y nX td| ��dS )zgImport a cert form the given PEM file.
The file must contain exactly one certificate.
NzFailed to open %s: %sz%%s contains more than one certificate)r� r� r� r r� r# r� r* ) ro r� r� r� r� r� r" r �str r r �import_pem_certo s
" zNSSDatabase.import_pem_certc C s4 t |�}dd|d|dg}| j||jtjj�d� d S )Nz-Az-nz-tz-a)r~ )r? r� rB r
rC rD )ro r r� r� r} r r r r� � s zNSSDatabase.add_certc C s | j dd|g� d S )Nz-Dz-n)r� )ro r� r r r � delete_cert� s zNSSDatabase.delete_certc C s< | j � }x.|D ]&\}}}}||kr| jdd|g� P qW dS )zpDelete the key with provided nick
This commands removes the key but leaves the cert in the DB.
z-Fz-kN)r� r� )ro r� �keysZ_slotZ_algor� r� r r r �delete_key_only� s
zNSSDatabase.delete_key_onlyc C sb y| j dd|g� W n tjk
r4 | j|� Y nX x&| j� D ]\}}||kr@| j|� q@W dS )z%Delete a cert and its key from the DBz-Fz-nN)r� r rI r r� r� )ro r� ZcertnameZ_flagsr r r �delete_key_and_cert� s z NSSDatabase.delete_key_and_certc C sn t j j� }|j|kr&td|j� d���|j|k rBtd|j� d���|jt jdd� |k rjtd|j� d���d S )
z(Common checks for cert validity
znot valid before z UTC is in the future.z has expired z UTCr� )Zhoursz expires in less than one hour (z UTC)N)�datetime�utcnowZnot_valid_beforer* Znot_valid_afterZ timedelta)ro r r r r r �_verify_cert_validity� s
z!NSSDatabase._verify_cert_validityc C s� | j |�}| j|� y | jdd|dddgdd� W n. tjk
r` } zt|j��W Y dd}~X nX y|j|� W n tk
r� td | ��Y nX dS )
z�Verify a certificate is valid for a SSL server with given hostname
Raises a ValueError if the certificate is invalid.
z-Vz-nz-u�Vz-eT)r@ Nzinvalid for server %s)r� r r� r rI r* rJ Zmatch_hostname)ro r� Zhostnamer r" r r r �verify_server_cert_validity� s
z'NSSDatabase.verify_server_cert_validityc C s: | j |�}| j|� |js"td��y|jjtjj�}W n tjj k
rV td��Y nX |j
j shtd��|d k r�|j
j }|d k r�||k r�tdj
||���y|jjtjj�}W n tjj k
r� td��Y nX t|j
j�dkr�td��y | jdd |d
d d gd
d� W n0 tjk
�r4 } zt|j��W Y d d }~X nX d S )Nzhas empty subjectzmissing basic constraintsznot a CA certificatez/basic contraint pathlen {}, must be at least {}z(missing subject key identifier extensionr z(subject key identifier must not be emptyz-Vz-nz-u�Lz-eT)r@ )r� r r� r* rK rL rM r
ZBasicConstraintsrR rO r6 Z path_lengthr ZSubjectKeyIdentifierr� Zdigestr� r rI rJ )ro r� Z
minpathlenr ZbcZplZskir" r r r �verify_ca_cert_validity� sB
z#NSSDatabase.verify_ca_cert_validityc s8 � j |�}� fdd�|D �}t|d |d d� |� d S )Nc s g | ]}� j |��qS r )r� )r� r� )ro r r �
<listcomp> s z8NSSDatabase.verify_kdc_cert_validity.<locals>.<listcomp>r� r� r� )r� rU )ro r� r Z nicknamesr� r )ro r rU s
z$NSSDatabase.verify_kdc_cert_validity)Nr^ )N)N)NNNF)T)N)N)FNN)N)%rW rX rY rZ rp rc rn rt ru rx ry r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r r r r r rU r r r r r] � sH
M
2
O
1r] )r r r
)r r r )r )r )@Z
__future__r � collectionsr Zloggingre r� r� r� r� rs r� rd Z ctypes.utilr r Zcryptography.x509rM Zipaplatform.pathsr Zipaplatform.tasksr Z ipapython.dnr Zipapython.kerberosr Z ipapythonr Zipalibr
Z getLoggerrW r� ZCA_NICKNAME_FMTZ
NSS_DBM_FILESZ
NSS_SQL_FILESZ NSS_FILES�
namedtupler r� r+ r/ r3 r1 r0 ZEKU_PKINIT_CLIENT_AUTHrQ ZIPA_CA_TRUST_FLAGSZEXTERNAL_CA_TRUST_FLAGSZTRUSTED_PEER_TRUST_FLAGSr r r# r: r? rU �compiler� r� r rV r[ r\ r] r r r r �<module> sj
,&