
    Vh3                        d dl mZmZmZ eZdZdZdZd dl	Z	d dl
Z
d dlZd dlZd dlZd dlZd dlmZmZ d dlmZmZ d dlmZmZ d d	lmZ d d
lmZ d dlmZmZmZ d dl m!Z!m"Z" d dl#m$Z$ dZ%dZ&dZ'dZ(	 d dl)Z)d dl)m*Z* d dl+m,Z-  e$e)j\                        Z/dZ0dZ4	 d dl5Z5d dl6m7Z7 d dl8m9Z9  e$e5j\                        Z:dZ;dZ<	 d dl6m=Z= d dl8m>Z> e7j~                  j                  j                         j                  e>j                        j                   e=j                                dZFd ZH G d de      ZI G d de      ZJ G d deJ      ZK G d  d!eJ      ZLd" ZMd# ZNeOd$k(  r eN        yy# e1e2f$ r  ejf                         Z(dZ0Y w xY w# e1$ r  ejf                         Z4dZ;Y w xY w# eG$ r  ejf                         Z<dZFY w xY w)%    )absolute_importdivisionprint_functiona  
module: openssl_pkcs12
author:
  - Guillaume Delpierre (@gdelpierre)
short_description: Generate OpenSSL PKCS#12 archive
description:
  - This module allows one to (re-)generate PKCS#12.
  - The module can use the cryptography Python library, or the pyOpenSSL Python library. By default, it tries to detect which
    one is available, assuming none of the O(iter_size) and O(maciter_size) options are used. This can be overridden with
    the O(select_crypto_backend) option.
requirements:
  - PyOpenSSL >= 0.15, < 23.3.0 or cryptography >= 3.0
extends_documentation_fragment:
  - ansible.builtin.files
  - community.crypto.attributes
  - community.crypto.attributes.files
attributes:
  check_mode:
    support: full
  diff_mode:
    support: none
  safe_file_operations:
    support: full
  idempotent:
    support: partial
    details:
      - The module is not idempotent if O(force=true).
options:
  action:
    description:
      - V(export) or V(parse) a PKCS#12.
    type: str
    default: export
    choices: [export, parse]
  other_certificates:
    description:
      - List of other certificates to include. Pre Ansible 2.8 this parameter was called O(ca_certificates).
      - Assumes there is one PEM-encoded certificate per file. If a file contains multiple PEM certificates, set O(other_certificates_parse_all)
        to V(true).
      - Mutually exclusive with O(other_certificates_content).
    type: list
    elements: path
    aliases: [ca_certificates]
  other_certificates_content:
    description:
      - List of other certificates to include.
      - Assumes there is one PEM-encoded certificate per item. If an item contains multiple PEM certificates, set O(other_certificates_parse_all)
      - Mutually exclusive with O(other_certificates).
    type: list
    elements: str
    version_added: "2.26.0"
  other_certificates_parse_all:
    description:
      - If set to V(true), assumes that the files mentioned in O(other_certificates)/O(other_certificates_content) can contain more than one
        certificate per file/item (or even none per file/item).
    type: bool
    default: false
    version_added: 1.4.0
  certificate_path:
    description:
      - The path to read certificates and private keys from.
      - Must be in PEM format.
      - Mutually exclusive with O(certificate_content).
    type: path
  certificate_content:
    description:
      - Content of the certificate file in PEM format.
      - Mutually exclusive with O(certificate_path).
    type: str
    version_added: "2.26.0"
  force:
    description:
      - Should the file be regenerated even if it already exists.
    type: bool
    default: false
  friendly_name:
    description:
      - Specifies the friendly name for the certificate and private key.
    type: str
    aliases: [name]
  iter_size:
    description:
      - Number of times to repeat the encryption step.
      - This is B(not considered during idempotency checks).
      - This is only used by the C(pyopenssl) backend, or when O(encryption_level=compatibility2022).
      - When using it, the default is V(2048) for C(pyopenssl) and V(50000) for C(cryptography).
    type: int
  maciter_size:
    description:
      - Number of times to repeat the MAC step.
      - This is B(not considered during idempotency checks).
      - This is only used by the C(pyopenssl) backend. When using it, the default is V(1).
    type: int
  encryption_level:
    description:
      - Determines the encryption level used.
      - V(auto) uses the default of the selected backend. For C(cryptography), this is what the cryptography library's specific
        version considers the best available encryption.
      - V(compatibility2022) uses compatibility settings for older software in 2022. This is only supported by the C(cryptography)
        backend if cryptography >= 38.0.0 is available.
      - B(Note) that this option is B(not used for idempotency).
    choices:
      - auto
      - compatibility2022
    default: auto
    type: str
    version_added: 2.8.0
  passphrase:
    description:
      - The PKCS#12 password.
      - B(Note:) PKCS12 encryption is typically not secure and should not be used as a security mechanism. If you need to
        store or send a PKCS12 file safely, you should additionally encrypt it with something else. (L(Source,
        https://cryptography.io/en/latest/hazmat/primitives/asymmetric/serialization/#cryptography.hazmat.primitives.serialization.pkcs12.serialize_key_and_certificates)).
    type: str
  path:
    description:
      - Filename to write the PKCS#12 file to.
    type: path
    required: true
  privatekey_passphrase:
    description:
      - Passphrase source to decrypt any input private keys with.
    type: str
  privatekey_path:
    description:
      - File to read private key from.
      - Mutually exclusive with O(privatekey_content).
    type: path
  privatekey_content:
    description:
      - Content of the private key file.
      - Mutually exclusive with O(privatekey_path).
    type: str
    version_added: "2.3.0"
  state:
    description:
      - Whether the file should exist or not. All parameters except O(path) are ignored when state is V(absent).
    choices: [absent, present]
    default: present
    type: str
  src:
    description:
      - PKCS#12 file path to parse.
    type: path
  backup:
    description:
      - Create a backup file including a timestamp so you can get the original output file back if you overwrote it with a
        new one by accident.
    type: bool
    default: false
  return_content:
    description:
      - If set to V(true), will return the (current or generated) PKCS#12's content as RV(pkcs12).
    type: bool
    default: false
    version_added: "1.0.0"
  select_crypto_backend:
    description:
      - Determines which crypto backend to use.
      - The default choice is V(auto), which tries to use C(cryptography) if available, and falls back to C(pyopenssl). If
        O(iter_size) is used together with O(encryption_level) is not V(compatibility2022), or if O(maciter_size) is used,
        V(auto) will always result in C(pyopenssl) to be chosen for backwards compatibility.
      - If set to V(pyopenssl), will try to use the L(pyOpenSSL,https://pypi.org/project/pyOpenSSL/) library.
      - If set to V(cryptography), will try to use the L(cryptography,https://cryptography.io/) library.
      - B(Note) that the V(pyopenssl) backend is deprecated and will be removed from community.crypto 3.0.0.
    type: str
    default: auto
    choices: [auto, cryptography, pyopenssl]
    version_added: 1.7.0
seealso:
  - module: community.crypto.x509_certificate
  - module: community.crypto.openssl_csr
  - module: community.crypto.openssl_dhparam
  - module: community.crypto.openssl_privatekey
  - module: community.crypto.openssl_publickey
a  
---
- name: Generate PKCS#12 file
  community.crypto.openssl_pkcs12:
    action: export
    path: /opt/certs/ansible.p12
    friendly_name: raclette
    privatekey_path: /opt/certs/keys/key.pem
    certificate_path: /opt/certs/cert.pem
    other_certificates: /opt/certs/ca.pem
  # Note that if /opt/certs/ca.pem contains multiple certificates,
  # only the first one will be used. See the other_certificates_parse_all
  # option for changing this behavior.
    state: present

- name: Generate PKCS#12 file
  community.crypto.openssl_pkcs12:
    action: export
    path: /opt/certs/ansible.p12
    friendly_name: raclette
    privatekey_content: '{{ private_key_contents }}'
    certificate_path: /opt/certs/cert.pem
    other_certificates_parse_all: true
    other_certificates:
      - /opt/certs/ca_bundle.pem
      # Since we set other_certificates_parse_all to true, all
      # certificates in the CA bundle are included and not just
      # the first one.
      - /opt/certs/intermediate.pem
      # In case this file has multiple certificates in it,
      # all will be included as well.
    state: present

- name: Change PKCS#12 file permission
  community.crypto.openssl_pkcs12:
    action: export
    path: /opt/certs/ansible.p12
    friendly_name: raclette
    privatekey_path: /opt/certs/keys/key.pem
    certificate_path: /opt/certs/cert.pem
    other_certificates: /opt/certs/ca.pem
    state: present
    mode: '0600'

- name: Regen PKCS#12 file
  community.crypto.openssl_pkcs12:
    action: export
    src: /opt/certs/ansible.p12
    path: /opt/certs/ansible.p12
    friendly_name: raclette
    privatekey_path: /opt/certs/keys/key.pem
    certificate_path: /opt/certs/cert.pem
    other_certificates: /opt/certs/ca.pem
    state: present
    mode: '0600'
    force: true

- name: Dump/Parse PKCS#12 file
  community.crypto.openssl_pkcs12:
    action: parse
    src: /opt/certs/ansible.p12
    path: /opt/certs/ansible.pem
    state: present

- name: Remove PKCS#12 file
  community.crypto.openssl_pkcs12:
    path: /opt/certs/ansible.p12
    state: absent
a  
filename:
  description: Path to the generate PKCS#12 file.
  returned: changed or success
  type: str
  sample: /opt/certs/ansible.p12
privatekey:
  description: Path to the TLS/SSL private key the public key was generated from.
  returned: changed or success
  type: str
  sample: /etc/ssl/private/ansible.com.pem
backup_file:
  description: Name of backup file created.
  returned: changed and if O(backup) is V(true)
  type: str
  sample: /path/to/ansible.com.pem.2019-03-09@11:22~
pkcs12:
  description: The (current or generated) PKCS#12's content Base64 encoded.
  returned: if O(state) is V(present) and O(return_content) is V(true)
  type: str
  version_added: "1.0.0"
N)AnsibleModulemissing_required_lib)to_bytes	to_native)OpenSSLBadPassphraseErrorOpenSSLObjectError)parse_pkcs12split_pem_list)OpenSSLObjectload_certificateload_privatekey)load_file_if_exists
write_file)LooseVersionz3.0z0.15z23.3.0)crypto)load_pkcs12TF)serialization)serialize_key_and_certificates)hashes)PBESc           	          t        | d      5 }|j                         j                  d      }ddd       t              D cg c]  }t	        d|j                  d      |      ! c}S # 1 sw Y   =xY wc c}w )zX
    Load list of concatenated PEM files, and return a list of parsed certificates.
    rbzutf-8Ncontentbackend)openreaddecoder   r   encode)filenamer   fdatacerts        s/home/dcms/DCMS/lib/python3.12/site-packages/ansible_collections/community/crypto/plugins/modules/openssl_pkcs12.pyload_certificate_setr)   o  sq     
h	 (vvxw'( #4( 	t{{7';WM ( (s    A)$A5)A2c                       e Zd Zy)	PkcsErrorN)__name__
__module____qualname__     r(   r+   r+   {  s    r0   r+   c                   (    e Zd Zd fd	Zej
                  d        Zej
                  d        Zej
                  d        Zej
                  d        Z	ej
                  d        Z
ej
                  d        Zd fd	Zd	 Z fd
Zd Zd ZddZ xZS )Pkcsc           	         t         t        |   |j                  d   |j                  d   |j                  d   |j                         || _        |j                  d   | _        |j                  d   | _        |j                  d   | _        |j                  d   | _	        |j                  d   | _
        |j                  d	   | _        |j                  d
   | _        |j                  d   xs || _        |j                  d   xs d| _        |j                  d   | _        |j                  d   | _        d | _        |j                  d   | _        |j                  d   | _        |j                  d   | _        d | _        |j                  d   | _        |j                  d   | _        |j                  d   d|j                  d<   |j                  d   | _        d | _        | j                  6	 t5        | j                  d      5 }|j7                         | _        d d d        n&| j                  t?        | j                        | _        | j&                  6	 t5        | j&                  d      5 }|j7                         | _        d d d        n&| j(                  t?        | j(                        | _        | j                  r| j                  rStA        | j                        }g | _        |D ]1  }| j                  jC                  tE        || j
                               3 y | j                  D cg c]  }tG        || j
                         c}| _        y | j                  r|| j                  }	| j                  r/tA        tH        jJ                  jM                  d |	D                    }	|	D cg c]#  }tG        d t?        |      | j
                        % c}| _        y y # 1 sw Y   xY w# t8        t:        f$ r}t=        |      d }~ww xY w# 1 sw Y   xY w# t8        t:        f$ r}t=        |      d }~ww xY wc c}w c c}w )Npathstateforceactionother_certificatesother_certificates_parse_allother_certificates_contentcertificate_pathcertificate_contentfriendly_name	iter_sizemaciter_size   encryption_level
passphraseprivatekey_passphraseprivatekey_pathprivatekey_contentreturn_contentsrcmode0400backupr   )r   c              3   2   K   | ]  }t        |        y wNr   ).0r   s     r(   	<genexpr>z Pkcs.__init__.<locals>.<genexpr>  s      24;w/2s   r   )'superr2   __init__params
check_moder   r7   r8   r9   r:   r;   r<   r=   r>   r?   rA   rB   pkcs12rC   rD   rE   pkcs12_bytesrF   rG   rJ   backup_filer    r!   IOErrorOSErrorr+   r   listextendr)   r   	itertoolschainfrom_iterable)selfmoduler   iter_size_defaultfhexc	filenamesother_cert_bundle
other_certcerts	__class__s             r(   rP   zPkcs.__init__  s   dD"MM&!MM'"MM'"		
 mmH-"(--0D"E,2MM*-
) +1--8T*U' &.@ A#)==1F#G #]]?;{3H7H"MM.9>Q &.@ A --5%+]]3J%K"%}}->?"(--0D"E $mm,<==='== ($*FMM&!mmH-  ,%$//6 9"/1wwyD,9 %%1'/0H0H'ID$+%$..5 8.0ggiD+8 $$0&.t/F/F&GD#""00 !8!89	*,')2 %++22,->M '+&=&=+" %ZF+' ,,33E00OO11 2?D2  #(	'  !(:"6'D# -;9 9W% %n$%8 8W% %n$%+'sl   ,O% OO% P *P P (P6&(P;O"O% %P4O??PPP P3#P..P3c                      y)Generate PKCS#12 file archive.Nr/   )r]   r^   s     r(   generate_byteszPkcs.generate_bytes  s     	r0   c                      y rL   r/   )r]   pkcs12_contents     r(   parse_byteszPkcs.parse_bytes      r0   c                      y rL   r/   r]   rS   s     r(   _dump_privatekeyzPkcs._dump_privatekey  rm   r0   c                      y rL   r/   ro   s     r(   _dump_certificatezPkcs._dump_certificate  rm   r0   c                      y rL   r/   ro   s     r(   _dump_other_certificateszPkcs._dump_other_certificates  rm   r0   c                      y rL   r/   ro   s     r(   _get_friendly_namezPkcs._get_friendly_name  rm   r0   c           
          t         t           ||      } fd}|s|S t        j                  j                   j                        r|j                  d   dk(  r j                  |        j                   _        	  j                         \  }}}}|- j                  ! j                   j                        }	||	k7  r#yt        |      t         j                        k7  ry|- j                  ! j!                   j                        }
||
k7  r#yt        |      t         j                        k7  ry|? j"                  3 j%                   j                        }t'        |      t'        |      k7  r#yt        |      t         j"                        k7  ry|r= j)                   j                        }||||k7  ryt        |      t        |      k7  ry |       S |j                  d   dk(  rt        j                  j                   j                        rt        j                  j                   j                        rr	  j                         \  }}}}t+        dj-                  ||g|z   D cg c]  }|t/        |       c}            }t1         j                  d      }||k7  ry |       S y# t        $ r Y yw xY w# t        $ r Y yw xY wc c}w )	z,Ensure the resource is in its desired state.c                       j                   r/	 t        d  j                   j                    j                         yy# t        $ r Y yw xY w)Nr   rB   r   FT)rC   r   rE   r   r   r]   s   r(   _check_pkey_passphrasez*Pkcs.check.<locals>._check_pkey_passphrase  sN    ))!# $ 7 7#'#=#= $	  * ! !s   -> 	A
	A
r7   exportFparse Tignore_errors)rO   r2   checkosr4   existsrQ   ri   rG   r}   r   rE   rp   rS   boolr<   rr   r8   rt   setrv   r   joinr	   r   )r]   r^   perms_requiredstate_and_permsr{   pkcs12_privatekeypkcs12_certificatepkcs12_other_certificatespkcs12_friendly_nameexpected_pkeyexpected_certexpected_other_certsr=   pkeyr'   other_certspemexpected_contentdumped_contentrf   s   `                  r(   r   z
Pkcs.check  s     d1&.I	 ""77>>$))$x)@H)L'yyDH JJL%&-( "-''3 $ 5 5dkk B$5 '(D1H1H,II".((4 $ 6 6t{{ C%6 ()T$2J2J-KK)5''3'+'D'DT[['Q$01S9M5NN /0D9P9P4QQ  !% 7 7 D!-4H4T$(<<$-(D1E,FF 2 &''/ MM(#w.txx(tyy)9=6dK  ( %)$<+#=? "#  1$ON>1 &'' y & Z & s*    J7 K 3K7	KK	KKc                 V   d| j                   i}| j                  r| j                  |d<   | j                  r| j                  |d<   | j                  rX| j                  t        | j                   d      | _        | j                  rt        j                  | j                        nd|d<   |S )z'Serialize the object into a dictionary.r$   rD   rU   NTr   rS   )r4   rD   rU   rF   rT   r   base64	b64encode)r]   results     r(   dumpz	Pkcs.dumpI  s     		
 (,(<(<F$%$($4$4F=!  ($7		QU$V!7;7H7H  !2!23d 8 r0   c                     | j                   r |j                  | j                        | _        t        t
        |   |       y rL   )rJ   backup_localr4   rU   rO   r2   remover]   r^   rf   s     r(   r   zPkcs.remove\  s0    ;;%22499=DdD (r0   c                     	 t        | j                  d      5 }|j                         }ddd       | j                        S # 1 sw Y   xY w# t        $ r}t        |      d}~ww xY w)zRead PKCS#12 file.r   N)r    rG   r!   rl   rV   r+   )r]   	pkcs12_fhrk   ra   s       r(   r}   z
Pkcs.parsea  sd    	!dhh% 2!*!12##N332 2  	!C. 	!s-   A AA AA 	A'A""A'c                      y rL   r/   rz   s    r(   generatezPkcs.generatek  s    r0   c                     | j                   r |j                  | j                        | _        t	        |||       | j
                  r|| _        yy)zWrite the PKCS#12 file.N)rJ   r   r4   rU   r   rF   rT   )r]   r^   r   rH   s       r(   writez
Pkcs.writen  sB    ;;%22499=D67D) 'D r0   )i   )TrL   )r,   r-   r.   rP   abcabstractmethodri   rl   rp   rr   rt   rv   r   r   r   r}   r   r   __classcell__rf   s   @r(   r2   r2     s    Ob 	  	  	  	  	  	 ](~&)
!(r0   r2   c                   B     e Zd Z fdZd Zd Zd Zd Zd Zd Z	 xZ
S )PkcsPyOpenSSLc                 r    t         t        |   |d       | j                  dk7  r|j	                  d       y y )N	pyopensslautoz;The PyOpenSSL backend only supports encryption_level = automsg)rO   r   rP   rA   	fail_jsonr   s     r(   rP   zPkcsPyOpenSSL.__init__x  s=    mT+FK@  F*Q   +r0   c                    t        j                         | _        | j                  r%| j                  j	                  | j                         | j
                  r;| j                  j                  t        d| j
                  | j                               | j                  r.| j                  j                  t        | j                               | j                  rG	 | j                  j                  t        d| j                  | j                  | j                               | j                  j%                  | j&                  | j(                  | j*                        S # t         $ r}t#        |      d}~ww xY w)rh   Nr   ry   )r   PKCS12rS   r8   set_ca_certificatesr<   set_certificater   r   r=   set_friendlynamer   rE   set_privatekeyr   rC   r
   r+   r|   rB   r>   r?   )r]   r^   ra   s      r(   ri   zPkcsPyOpenSSL.generate_bytes  s   mmo""KK++D,C,CD##KK'' $":":DLL KK(($2D2D)EF""
%**# $ 7 7#'#=#= $	 {{!!$//4>>4CTCTUU - %n$%s   AE 	E3#E..E3c                 @   	 t        j                  || j                        }|j                         }|$t        j                  t         j
                  |      }|j                         }|$t        j                  t         j
                  |      }g }|j                         ?|j                         D cg c]&  }t        j                  t         j
                  |      ( }}|j                         }||||fS c c}w # t         j                  $ r}t        |      d }~ww xY wrL   )r   r   rB   get_privatekeydump_privatekeyFILETYPE_PEMget_certificatedump_certificateget_ca_certificatesget_friendlynameErrorr+   )	r]   rk   p12r   crtr   rd   r=   ra   s	            r(   rl   zPkcsPyOpenSSL.parse_bytes  s   	!$$^T__EC%%'D--f.A.A4H%%'C--f.A.A3GK&&(4 '*&=&=&?" ++F,?,?L 
  002M#{M:: || 	!C. 	!s*   B0C: 2+C5C: 5C: :DDDc                 r    |j                         }|r$t        j                  t        j                  |      S d S rL   )r   r   r   r   )r]   rS   pks      r(   rp   zPkcsPyOpenSSL._dump_privatekey  s0    ""$BDv%%f&9&92>N$Nr0   c                 r    |j                         }|r$t        j                  t        j                  |      S d S rL   )r   r   r   r   )r]   rS   r'   s      r(   rr   zPkcsPyOpenSSL._dump_certificate  s0    %%'EIv&&v':':DAStSr0   c                     |j                         g S |j                         D cg c]&  }t        j                  t        j                  |      ( c}S c c}w rL   )r   r   r   r   r]   rS   rd   s      r(   rt   z&PkcsPyOpenSSL._dump_other_certificates  sT    %%'/I %88:
 ##F$7$7D
 	
 
s   +Ac                 "    |j                         S rL   )r   ro   s     r(   rv   z PkcsPyOpenSSL._get_friendly_name  s    &&((r0   r,   r-   r.   rP   ri   rl   rp   rr   rt   rv   r   r   s   @r(   r   r   w  s*    V@!,OT
)r0   r   c                   B     e Zd Z fdZd Zd Zd Zd Zd Zd Z	 xZ
S )PkcsCryptographyc                     t         t        |   |dd       | j                  dk(  rt        s|j                  dt               y y y )NcryptographyiP  )r_   compatibility2022zThe installed cryptography version does not support encryption_level = compatibility2022. You need cryptography >= 38.0.0 and support for SHA1r   	exception)rO   r   rP   rA   "CRYPTOGRAPHY_HAS_COMPATIBILITY2022r   "CRYPTOGRAPHY_COMPATIBILITY2022_ERRr   s     r(   rP   zPkcsCryptography.__init__  sY    .Ne 	/ 	
 !!%886H<   7 9r0   c                    d}| j                   r.	 t        d| j                   | j                  | j                        }d}| j                  r"t        d| j                  | j                        }| j                  t        | j                        nd}||| j                  |f| _        | j                  st        j                         }n| j                  dk(  rt        j                   j"                  j%                         j'                  | j(                        j+                  t,        j.                        j1                  t3        j4                               j7                  t        | j                              }n(t        j8                  t        | j                              }t;        |||| j                  |      S # t        $ r}t        |      d}~ww xY w)rh   Nry   r   r   )rE   r   rC   r   r
   r+   r<   r   r=   r   r8   rS   rB   r   NoEncryptionrA   PrivateFormatr   encryption_builder
kdf_roundsr>   key_cert_algorithmr   PBESv1SHA1And3KeyTripleDESCBC	hmac_hashr   SHA1buildBestAvailableEncryptionr   )r]   r^   r   ra   r'   r=   
encryptions          r(   ri   zPkcsCryptography.generate_bytes  s   ""%& 33#99 LL	 ###d66D
 -1,>,>,JHT''(PT 	
 T4#:#:MJ&335J""&99++22EEGDNN+##D$F$FG6;;=)x01  '>>)J .##
 	
? - %n$%s   -F8 8	GGGc                 
   	 t        || j                        \  }}}}d }|V|j                  t        j                  j
                  t        j                  j                  t        j                               }d }|)|j                  t        j                  j
                        }g }|6|D 	cg c]+  }	|	j                  t        j                  j
                        - }}	||||fS c c}	w # t        $ r}
t        |
      d }
~
ww xY w)Nencodingformatencryption_algorithm)r   rB   private_bytesr   EncodingPEMr   TraditionalOpenSSLr   public_bytes
ValueErrorr+   )r]   rk   private_keycertificateadditional_certificatesr=   r   r   r   rd   ra   s              r(   rl   zPkcsCryptography.parse_bytes
  s   	!^T__= MK&=} D&"00*3377(66II)6)C)C)E 1  C&!..}/E/E/I/IJK&2 '>" ++M,B,B,F,FG 
 #{M::  	!C. 	!s*   B*C) ,0C$C) $C) )	D2C==Dc                     |d   rY|d   j                  t        j                  j                  t        j                  j
                  t        j                               S d S )Nr   r   )r   r   r   r   r   r   r   ro   s     r(   rp   z!PkcsCryptography._dump_privatekey+  s]     ay 1I##&//33$22EE%2%?%?%A $ 	
 	
r0   c                 h    |d   r,|d   j                  t        j                  j                        S d S )Nr@   r   r   r   r   ro   s     r(   rr   z"PkcsCryptography._dump_certificate6  s/    EKAYvay%%m&<&<&@&@AXTXXr0   c                     |d   D cg c]+  }|j                  t        j                  j                        - c}S c c}w )N   r   r   s      r(   rt   z)PkcsCryptography._dump_other_certificates9  s?     %Qi
 ##M$:$:$>$>?
 	
 
s   0;c                     |d   S )N   r/   ro   s     r(   rv   z#PkcsCryptography._get_friendly_name?  s    ayr0   r   r   s   @r(   r   r     s)    0
d!B	
Y
r0   r   c                 *   |dk(  rt         xr t        t        t              k\  }t        xr. t
        t        t              k\  xr t
        t        t              k  }| j                  d   | j                  d   dk7  s| j                  d   d}n	|rd}n|rd}|dk(  r/| j                  dj                  t        t        t              	       |dk(  rat        s:t        d
j                  t        t                    }| j                  |t               | j                  ddd       |t        |       fS |dk(  rFt         s3| j                  t        dj                  t                    t               |t!        |       fS t#        dj                  |            )Nr   r>   rA   r   r?   r   r   zeCannot detect any of the required Python libraries cryptography (>= {0}) or PyOpenSSL (>= {1}, < {2})r   zpyOpenSSL >= {0}, < {1}r   zKThe module is using the PyOpenSSL backend. This backend has been deprecatedz3.0.0zcommunity.crypto)versioncollection_namezcryptography >= {0}z"Unsupported value for backend: {0})CRYPTOGRAPHY_FOUNDCRYPTOGRAPHY_VERSIONr   MINIMAL_CRYPTOGRAPHY_VERSIONPYOPENSSL_FOUNDPYOPENSSL_VERSIONMINIMAL_PYOPENSSL_VERSIONMAXIMAL_PYOPENSSL_VERSIONrQ   r   r   r   PYOPENSSL_IMP_ERR	deprecater   CRYPTOGRAPHY_IMP_ERRr   r   )r^   r   can_use_cryptographycan_use_pyopensslr   s        r(   select_backendr  C  s   &  S$5Q(RR 	
  L!\2K%LLL!L1J$KK 	 MM+&2015HH]]>*6!G!$G!G fI&0--	  	 +&)00-/HC
 0ABY. 	 	

 f---	N	"!()001MN /	   (000=DDWMNNr0   c                  	   t        d:i dt        ddddg      dt        ddd	g
      dt        dd      dt        dd      dt        d      dt        d      dt        dd      dt        ddg      dt        dddgd      dt        d      dt        d      dt        dd !      dt        dd "      d#t        dd !      d$t        d      d%t        dd !      d&t        dd'd(d'g      d)t        d      d*t        dd      d+t        dd      d,t        ddg d-      } ddd)ggg}d$d%gddgddgg}t        d | ||d .      }t        ||j                  d,         \  }}t        j
                  j                  |j                  d         xs d/}t        j
                  j                  |      s|j                  |d0|z  1       	 d}|j                  d&   d'k(  rx|j                  rH|j                         }|j                  d   xs |j                  |       |d2<    |j                  d:i | |j                  |d3      r|j                  d   r|j                  d   dk(  rH|j                  d   s|j                  d45       |j                  |      }	|j                  ||	d6       d }na|j                         \  }
}}}d7j!                  |
|g|z   D cg c]  }|t#        |       c}      }|j                  |t%        |             d }|j'                  |j                        }|j)                  |d         rd }n|j+                  ||      rd }n|j                  rQ|j                         }t        j
                  j-                  |j                  d         |d2<    |j                  d:i | t        j
                  j-                  |j                  d         r|j/                  |       d }|j                         }||d2<   t        j
                  j-                  |j                  d         rGd8t1        j2                  t	        j0                  |j                  d         j4                        z  }||d9<    |j                  d:i | y c c}w # t6        $ r%}|j                  t#        |      5       Y d }~y d }~ww xY w);Nr7   strr|   r}   )typedefaultchoicesr8   rX   r4   ca_certificates)r  elementsaliasesr9   r   F)r  r  r:   )r  r  r;   )r  r<   r6   r=   name)r  r	  rA   r   r   )r  r  r  r>   intr?   rB   T)r  no_log)r  requiredrC   rD   rE   r5   presentabsentrG   rJ   rF   select_crypto_backend)r   r   r   )add_file_common_argsargument_specrequired_ifmutually_exclusivesupports_check_mode.z@The directory '%s' does not exist or the path is not a directory)r
  r   changed)r   zFriendly_name is requiredr   i  r~   z%04orH   r/   )dictr   r  rQ   r   r4   dirnameisdirr   rR   r   r   	exit_jsonri   r   r}   r   r	   r   load_file_common_argumentscheck_file_absent_if_check_modeset_fs_attributes_if_differentr   r   statS_IMODEst_moder   )r  r  r  r^   r   rS   base_dirr  r   rk   r   r'   r   r=   r   dump_content	file_args	file_modera   s                      r(   mainr&    s    8W:MN&3D2E

 &*vu%E $(Ve#D 6* !e, . x8 )< =v
 E" u%  U40!" v-#$ #d;%& &)'(  U48)* y8Y:OP+, f-. //0 712 #0U
3M> 
7UG$K
 
01	23	;< !#- F %VV]];R-STOGVwwv}}V45<H77=="R 	 	
3-==!Y.  $*MM'$:$V&,,vBV>Vy!   *6*<<u<=wAW==*h6!==9((-H(I%+%:%:6%BNLL?"G=C\\^:D$]#%77 )-d|k'A #" &cN$L LL,)?@"G99&--HI55i6GH66y'J  $&GGNN6==3H$Iy!   *6*ww~~fmmF34f%#y77>>&--/0bggfmmF6K.L.T.T!UUI&F6N"6"=>  -Ys^,,-s,   DR& +R!?F!R& !R& &	S/SS__main__)P
__future__r   r   r   r  __metaclass__DOCUMENTATIONEXAMPLESRETURNr   r   rZ   r   r  	tracebackansible.module_utils.basicr   r   +ansible.module_utils.common.text.convertersr   r	   Fansible_collections.community.crypto.plugins.module_utils.crypto.basicr
   r   Uansible_collections.community.crypto.plugins.module_utils.crypto.cryptography_supportr   Dansible_collections.community.crypto.plugins.module_utils.crypto.pemr   Hansible_collections.community.crypto.plugins.module_utils.crypto.supportr   r   r   <ansible_collections.community.crypto.plugins.module_utils.ior   r   Aansible_collections.community.crypto.plugins.module_utils.versionr   r   r   r   r   OpenSSLr   OpenSSL.cryptor   _load_pkcs12__version__r   r   ImportErrorAttributeError
format_excr   r   cryptography.hazmat.primitivesr   3cryptography.hazmat.primitives.serialization.pkcs12r   r   r   r   r   r   r   r   r   r   r   r   r   r   	Exceptionr)   r+   r2   r   r   r  r&  r,   r/   r0   r(   <module>r@     s   A @ obDL
.    	   J K 

  % " $   %W%8%89
 O < ((@(@A
 %) ".5H &&99;NN**i
 *.&		" 	u(= u(pO)D O)dwt wt>OBn-b zF W 	^$ ,	,,.O  /9//1  /)=)=)=)?&).&/s7   0"E* "F
 >A'F( *FF
F%$F%(GG