
    l
j                     2   d dl Z d dlZd dlZd dlmZ d dlZd dlZd dlZd dlm	Z	 d dl
mZ d dlmZ d dl
mZ d dlmZ d dlmZ d dlZd d	lmZ d dlZd dlZd d
lmZmZ d dlZd dlZ e j<                  dd d       Zdez  Z da!d Z" G d dejF                        Z$y)    N)Path)x509)serialization)rsa)hashes)default_backend)NameOID)secret)GLibGObject      c                  .    t         
t               a t         S N)	singletonAuthManager     /usr/libexec/warpinator/auth.pyget_singletonr       s     M	r   c                   t    e Zd Zdej                  j
                  ddfiZd ZddZd Z	d Z
d Zd	 Zd
 Zd Zy)r   group-code-changedNr   c                    t         j                  j                  |        t        j                         | _        d | _        d | _        d | _        d | _	        i | _
        t        j                  j                  d| j                         y )Nzchanged::group-code)r   Object__init__utilget_hostnamehostnameip_infoportprivate_keyserver_certremote_certsprefsprefs_settingsconnectnotify_group_code_changedselfs    r   r   zAuthManager.__init__-   sg    %))+	$$%:D<Z<Z[r   c                 &    | j                  d       y )Nr   )emit)r)   settingskeydatas       r   r'   z%AuthManager.notify_group_code_changed:   s    		&'r   c                 @    || _         || _        | j                          y r   )r   r    _make_key_cert_pair)r)   r   r    s      r   updatezAuthManager.update=   s    	  "r   c                 2    | j                   | j                  fS r   )server_private_keyserver_pub_keyr(   s    r   get_server_credszAuthManager.get_server_credsC   s    '')<)<==r   c                 J    	 | j                   |d|   S # t        $ r Y y w xY w)N.)r#   KeyError)r)   r   r   s      r   get_cached_certzAuthManager.get_cached_certF   s/    	$$'%BCC 		s    	""c           	      B   |t         j                  j                  S t        j                  |      }t        j                         }|j                  t        t        j                         d             |j                         }t        j                  |      }	 |j                  |      }t         j                  j                  }
|r|d|}| j*                  j-                  |      }|t         j                  j.                  }
n;||k(  rt         j                  j0                  }
|
S t         j                  j2                  }
|| j*                  |<   |
S # t        j                   j"                  $ r0}	t%        j&                  d|dt)        |	             d }Y d }	~	d }	~	ww xY w)Nutf-8zDecryption failed for remote 'z': r7   )r   CertProcessingResultFAILUREbase64decodebyteshashlibsha256r1   bytesr$   get_group_codedigestr
   	SecretBoxdecryptnacl
exceptionsCryptoErrorloggingdebugstrr#   getCERT_INSERTEDCERT_UP_TO_DATECERT_UPDATED)r)   r   r   server_datadecodedhasherr-   decodercerteresvals               r   process_remote_certzAuthManager.process_remote_certL   sF   ,,444$$[1!eE002G<=mmo""3'	??7+D
 ''//%w/C##'',C{//==//??
//<<%)Dc"
# ** 	MMXsSTvVWD	s   E F.&FFc                 2   t        j                         }|j                  t        t	        j
                         d             |j                         }t        j                  |      }|j                  | j                        }t        j                  |      }|S )Nr;   )r@   rA   r1   rB   r$   rC   rD   r
   rE   encryptr4   r>   encodebytes)r)   rS   r-   encoder	encryptedencodeds         r   get_encoded_local_certz"AuthManager.get_encoded_local_certk   sn    !eE002G<=mmo""3'OOD$7$78	$$Y/r   c                 z   t        j                  d       t        j                  t	               dd      }|j                         }t        j                         }|j                  t        j                  t        j                  t        j                  | j                        g            }|j                  t        j                  t        j                  t        j                  | j                        g            }|j                  t         j                   j#                         t$        z
        }|j'                  t         j                   j#                         t(        z         }|j+                  t        j,                               }|j                  |      }g }| j.                  j0                  K|j3                  t        j4                  t7        j8                  | j.                  j0                                     | j.                  j:                  K|j3                  t        j4                  t7        j<                  | j.                  j:                                     |j?                  t        j@                  |      d      }|jC                  |tE        jF                         t	                     }|jI                  tJ        jL                  jN                  tJ        jP                  jR                  tK        jT                               }|jW                  tJ        jL                  jN                        }|| _,        || _-        y )Nz!Auth: Creating server credentialsi  i   )backendpublic_exponentkey_sizeT)critical)r!   	algorithmrb   ).rJ   rK   r   generate_private_keycrypto_default_backend
public_keyr   CertificateBuildersubject_nameNameNameAttributer	   COMMON_NAMEr   issuer_namenot_valid_beforedatetimetodaydaynot_valid_afterEXPIRE_TIMEserial_numberrandom_serial_numberr   ip4_addressappend	IPAddress	ipaddressIPv4Addressip6_addressIPv6Addressadd_extensionSubjectAlternativeNamesignr   SHA256private_bytescrypto_serializationEncodingPEMPrivateFormatPKCS8NoEncryptionpublic_bytesr4   r3   )r)   r!   ri   builder	alt_namescertificateser_private_keyser_public_keys           r   r0   zAuthManager._make_key_cert_pairv   sc   9:..*,!
 !++-
))+&&tyyw22DMMB2
 (  %%diiw22DMMB1
 '  **8+<+<+B+B+Ds+JK))(*;*;*A*A*Ck*QR''(A(A(CD$$Z0	<<##/T^^I,A,A$,,BZBZ,[\]<<##/T^^I,A,A$,,BZBZ,[\]''(C(CI(NY]'^ll#v}}*, # 

 &33 ))-- ..44 --/1
 %11 ))--
 -"1r   r   )__name__
__module____qualname__r   SignalFlagsRUN_LAST__gsignals__r   r'   r1   r5   r9   rY   r`   r0   r   r   r   r   r   (   sJ    w22;;T2FL\(#>>	/2r   r   )%rq   statospathlibr   secretsrJ   r{   cryptographyr   cryptography.hazmat.primitivesr   r   )cryptography.hazmat.primitives.asymmetricr   r   cryptography.hazmat.backendsr   rh   cryptography.x509.oidr	   rG   r
   r@   r>   gi.repositoryr   r   r   r$   	timedeltars   ru   r   r   r   r   r   r   r   <module>r      s~      	      P 9 1 R )     '  hAq!3h	}2'.. }2r   