#!/opt/thinlinc/libexec/python3
# -*-mode: python; coding: utf-8 -*-
#
# Copyright 2002-2014 Cendio AB.
# For more information, see http://www.cendio.com
if 82 - 82: Iii1i
import io
import base64
import pickle
import calendar
import errno
import getopt
import ldap
import os
import pwd
import string
import struct
import sys
import tempfile
import time
import urllib . request
import http . client
import re
import hashlib
import locale
import codecs
import subprocess
if 87 - 87: Ii % i1i1i1111I . Oo / OooOoo * I1Ii1I1 - I1I
from thinlinc import hiveconf
from thinlinc import prefix , tl_ldap_iterator
import thinlinc . crypto
import thinlinc . selinux
if 81 - 81: i1 + ooOOO / oOo0O00 * i1iiIII111 * IiIIii11Ii
if 84 - 84: ooo000 - Ooo0Ooo + iI1iII1I1I1i . IIiIIiIi11I1
iI111iiIi11i = 10
OoOoo0o = False
I1i = False
IiI11Ii111 = "thinlinc-ldap-publickey"
if 26 - 26: O0OooooOo + ii % iiI * IIi1i111IiII . Oo / Oo
OOO0o000 = "/opt/thinlinc/etc/ca/"
i1Iiiii1 = { }
ooOOooO0 = "/var/opt/thinlinc/utils/tl-ldap-certalias/crlcache/"
i1iiiiIIIiIi = 1
II = { }
if 34 - 34: Ooo0Ooo + ii * IIiIIiIi11I1 * OooOoo
class Ii111 :
 if 8 - 8: Ii + iiI . O0OooooOo - I1Ii1I1 % O0OooooOo . i1i1i1111I
 if 24 - 24: IIi1i111IiII
 if 9 - 9: ooo000 / iiI . iiI / Ii % i1i1i1111I % Ooo0Ooo
 if 85 - 85: O0OooooOo % ooOOO + i1iiIII111 / ooOOO / ooo000
 raw = None
 if 17 - 17: oOo0O00 * i1iiIII111 - Iii1i . IIi1i111IiII - Oo % i1i1i1111I
 if 69 - 69: ooOOO % OooOoo
 contents = { }
 if 45 - 45: i1
 def __init__ ( self , cert ) :
  if isinstance ( cert , bytes ) :
   self . raw = cert
   if 48 - 48: iI1iII1I1I1i / oOo0O00 % IIi1i111IiII
  self . contents = IiiIii11iII1 ( self . raw )
  if 27 - 27: I1I + ooOOO * IIiIIiIi11I1 % Ii + Ooo0Ooo . ooOOO
 def is_cert ( self ) :
  return self . contents is not None
  if 6 - 6: i1iiIII111
 def __getitem__ ( self , item ) :
  try :
   if 99 - 99: ooOOO * I1Ii1I1
   if 95 - 95: Ooo0Ooo % Iii1i % i1i1i1111I . OooOoo
   return self . contents [ item ]
  except :
   raise AttributeError
   if 70 - 70: IiIIii11Ii
   if 75 - 75: Ooo0Ooo / Ii / IiIIii11Ii + IiIIii11Ii . I1I
def i1I11ii ( s ) :
 if not OoOoo0o :
  if 21 - 21: Iii1i - I1Ii1I1
  return
 s = s . encode ( locale . getpreferredencoding ( ) , errors = "replace" ) . decode ( locale . getpreferredencoding ( ) , errors = "replace" )
 if 95 - 95: i1 - I1Ii1I1 + Oo
 print ( "tl-ldap-certalias:  INFO:" , s )
 if 49 - 49: IIiIIiIi11I1
 if 29 - 29: IiIIii11Ii - oOo0O00
def i1IIiII11 ( s ) :
 if not I1i :
  if 52 - 52: i1iiIII111 % Oo . I1Ii1I1 + ooOOO % Oo . IIi1i111IiII
  return
 s = s . encode ( locale . getpreferredencoding ( ) , errors = "replace" ) . decode ( locale . getpreferredencoding ( ) , errors = "replace" )
 if 56 - 56: i1iiIII111 * IIi1i111IiII - O0OooooOo
 print ( "tl-ldap-certalias: DEBUG:" , s )
 if 15 - 15: I1I % Ii + Ooo0Ooo * Iii1i
 if 67 - 67: I1I * Ooo0Ooo + i1iiIII111 . i1iiIII111 % Oo
def OOOO0O0ooO0O ( s ) :
 s = s . encode ( locale . getpreferredencoding ( ) , errors = "replace" ) . decode ( locale . getpreferredencoding ( ) , errors = "replace" )
 if 87 - 87: IIi1i111IiII / oOo0O00 % ii - oOo0O00 . I1I + Ooo0Ooo
 if 75 - 75: i1iiIII111 * iI1iII1I1I1i - I1I - IIiIIiIi11I1 % I1Ii1I1
 print ( "tl-ldap-certalias: ERROR:" , s , file = sys . stderr )
 if 85 - 85: oOo0O00
 if 66 - 66: IIi1i111IiII * i1i1i1111I + oOo0O00 / I1I / Iii1i / Ii
def IiII11i11II ( filename ) :
 o00o = time . time ( )
 if 97 - 97: Ooo0Ooo
 i1Ii1iiIiI111 = o00o + iI111iiIi11i
 while True :
  O00O0Oo0OOO = time . time ( )
  if O00O0Oo0OOO > i1Ii1iiIiI111 :
   i1I11ii ( "Timeout while waiting for lock %s!" % filename )
   return False
   if 97 - 97: ooOOO * O0OooooOo
  if not os . path . exists ( os . path . dirname ( filename ) ) :
   i1I11ii ( "Failed to create lock in inexisting folder" )
   return False
   if 63 - 63: ooOOO / i1i1i1111I - oOo0O00 * ooOOO / i1iiIII111 + ii
  if os . path . exists ( filename ) :
   i1I11ii ( "Waiting for lockfile %s..." % filename )
   time . sleep ( 3 )
   continue
  else :
   if 11 - 11: i1 / ooo000
   with open ( filename , "w+t" ) as iII :
    OooOO00o = "%s:%d" % ( os . getenv ( "HOSTNAME" , "unknown host" ) ,
 os . getpid ( ) )
    iII . write ( OooOO00o )
    iII . flush ( )
    os . fsync ( iII . fileno ( ) )
    if 98 - 98: IIiIIiIi11I1 - IiIIii11Ii . ooo000 + ii - ii
    if 78 - 78: i1 - ooOOO
    if 56 - 56: ooo000 . ooo000 + I1Ii1I1 * iI1iII1I1I1i
   with open ( filename , 'rt' ) as i111ii1I :
    if i111ii1I . readline ( ) . find ( OooOO00o ) == - 1 :
     i1I11ii ( "Oops, someone stole our lock! Waiting for it again.." )
     continue
  i1IIiII11 ( "Acquired lock %s" % filename )
  return True
  if 18 - 18: Ii / ooo000 + I1I + iI1iII1I1I1i
  if 42 - 42: ooOOO - ooOOO - i1i1i1111I
def o0oOo0o0ooooo ( filename ) :
 iI1i = None
 if 73 - 73: ooOOO - IiIIii11Ii
 if 22 - 22: Oo % oOo0O00 / iiI . oOo0O00 . iiI
 try :
  with open ( filename , 'rt' ) as iI1i :
   ( Ooo000oo0O00o , II1Ii11IiI ) = iI1i . readline ( ) . strip ( ) . split ( ":" )
   oO0O0oOo = int ( II1Ii11IiI )
   if 94 - 94: ooOOO * ii % iI1iII1I1I1i - iiI - ooOOO
   oOO = os . getenv ( "HOSTNAME" , "unknown host" )
   if 32 - 32: IIi1i111IiII % ooo000 * Iii1i + IIiIIiIi11I1
   if oOO != Ooo000oo0O00o or oO0O0oOo != os . getpid ( ) :
    i1I11ii ( "lock %s is owned by process %d on host %s, won't release" % ( filename , oO0O0oOo , Ooo000oo0O00o ) )
    return False
 except FileNotFoundError :
  i1IIiII11 ( "Releasing a non-existant lock %s" % ( filename ) )
  return True
  if 42 - 42: I1I - IiIIii11Ii
 i1IIiII11 ( "Releasing lock %s" % filename )
 os . unlink ( filename )
 return True
 if 34 - 34: IIi1i111IiII + ooOOO * ii
 if 2 - 2: i1i1i1111I / Ooo0Ooo / ii - IIiIIiIi11I1 / IIiIIiIi11I1
def oOo ( directory , mode , owner , group ) :
 try :
  if 52 - 52: oOo0O00 / iiI * IIiIIiIi11I1 + O0OooooOo % Ooo0Ooo + ii
  if 43 - 43: iI1iII1I1I1i * oOo0O00 + ooOOO
  os . mkdir ( directory , mode )
  os . chown ( directory , int ( owner ) , int ( group ) )
  return 0
  if 30 - 30: I1I
 except OSError as o00ooo0OO0000 :
  if o00ooo0OO0000 . errno == errno . ENOENT :
   OOOO0O0ooO0O ( "parent directory of %s does not exist" % directory )
  elif o00ooo0OO0000 . errno == errno . EACCES :
   OOOO0O0ooO0O ( "parent directory of %s is not writable" % directory )
  else :
   OOOO0O0ooO0O ( "unhandled error %s (%d) trying to create directory %s" % ( errno . errorcode [ o00ooo0OO0000 . errno ] ,
 o00ooo0OO0000 . errno ,
 directory ) )
  return o00ooo0OO0000 . errno
  if 37 - 37: I1I
  if 38 - 38: I1Ii1I1 + oOo0O00
class iii1I1 ( Exception ) :
 pass
 if 17 - 17: Oo - iiI . IIiIIiIi11I1 + iI1iII1I1I1i - I1Ii1I1 + Ii
 if 33 - 33: i1i1i1111I . IIiIIiIi11I1 - iiI . Ii
 if 20 - 20: oOo0O00 % i1i1i1111I
def IiiIii11iII1 ( certfile ) :
 if 32 - 32: ii
 if 98 - 98: IIi1i111IiII % i1 % ooo000 % iI1iII1I1I1i
 OOO00o00oo0 = subprocess . PIPE
 Iiiii1iiiII1 = None
 if 77 - 77: Ii + oOo0O00 / oOo0O00 * iI1iII1I1I1i
 if isinstance ( certfile , io . BufferedIOBase ) :
  if 10 - 10: ooOOO / iiI * I1I * Oo - i1 % OooOoo
  OOO00o00oo0 = certfile
 elif isinstance ( certfile , bytes ) :
  Iiiii1iiiII1 = certfile
  if 35 - 35: Ii . I1Ii1I1
 with subprocess . Popen ( [ os . path . join ( prefix . get_tl_prefix ( ) , "libexec" , "tl-certtool" ) ,
 "--subject" ,
 "--novellsubject" ,
 "--issuer" ,
 "--serial" ,
 "--is-ca" ,
 "--expiry" ,
 "--pubkey" ,
 "--signature" ,
 "--crl" ] ,
 stdin = OOO00o00oo0 ,
 stdout = subprocess . PIPE ,
 stderr = subprocess . PIPE ) as OoO0O0OO0 :
  if 70 - 70: i1i1i1111I - Ii % i1iiIII111 - IIi1i111IiII
  if 33 - 33: i1i1i1111I
  if 30 - 30: iiI % ooOOO . Ii % IIiIIiIi11I1 / iI1iII1I1I1i % ooOOO
  if 24 - 24: IIiIIiIi11I1 - IIiIIiIi11I1 . Ooo0Ooo + i1iiIII111 + Oo
  ( I1II1I1i , oOOoO0o ) = OoO0O0OO0 . communicate ( input = Iiiii1iiiII1 )
  I1II1I1i = I1II1I1i . decode ( locale . getpreferredencoding ( False ) )
  oOOoO0o = oOOoO0o . decode ( locale . getpreferredencoding ( False ) )
  if 85 - 85: Ooo0Ooo - I1I . IiIIii11Ii % IIiIIiIi11I1 % iI1iII1I1I1i
  if OoO0O0OO0 . returncode != 0 :
   OOOO0O0ooO0O ( "Failed to load certificate..." )
   if "" != oOOoO0o :
    print ( "stderr from tl-certtool: " , oOOoO0o , file = sys . stderr )
   return None
   if 98 - 98: I1I
  I1II1I1i = I1II1I1i . splitlines ( )
  oO0Ooo = { }
  if 81 - 81: I1Ii1I1 / ii + ii . i1i1i1111I - i1
  try :
   if 15 - 15: OooOoo . oOo0O00 - ooOOO % Ooo0Ooo
   oO0Ooo [ "subject" ] = I1II1I1i [ 0 ] . strip ( )
   if 62 - 62: iI1iII1I1I1i / OooOoo % I1I - IIi1i111IiII
   if 66 - 66: i1i1i1111I / Ooo0Ooo + O0OooooOo + Iii1i + oOo0O00 + iiI
   oO0Ooo [ "novellsubject" ] = I1II1I1i [ 1 ] . rstrip ( "\n" )
   if 75 - 75: OooOoo - ii - IiIIii11Ii - ii + ooo000 % iI1iII1I1I1i
   if 42 - 42: i1 * iiI
   oO0Ooo [ "issuer" ] = I1II1I1i [ 2 ] . strip ( )
   if 50 - 50: Ii - i1iiIII111
   if 96 - 96: ooo000 * OooOoo - Ii - OooOoo
   oO0Ooo [ "serial" ] = I1II1I1i [ 3 ] . strip ( )
   if 65 - 65: Oo + Oo - iI1iII1I1I1i % OooOoo . Ooo0Ooo
   if 84 - 84: IIiIIiIi11I1 . ooOOO
   oO0Ooo [ "is_ca" ] = I1II1I1i [ 4 ] . strip ( ) == "1"
   if 44 - 44: ooo000 * i1i1i1111I * ii + i1iiIII111 - IIiIIiIi11I1
   if 70 - 70: IIi1i111IiII
   i1Ii1iIi11iI = I1II1I1i [ 5 ] . strip ( ) . split ( " " )
   oO0Ooo [ "expiry" ] = ( IioOOOoo ( i1Ii1iIi11iI [ 0 ] ) ,
 IioOOOoo ( i1Ii1iIi11iI [ 1 ] ) )
   if 68 - 68: I1Ii1I1 % I1Ii1I1 / IIi1i111IiII . ooo000
   if 80 - 80: IIiIIiIi11I1 / OooOoo % iI1iII1I1I1i / ooOOO * ooOOO - Iii1i
   O0ooOO0O0O0O = I1II1I1i [ 6 ] . strip ( ) . split ( " " )
   if O0ooOO0O0O0O [ 0 ] != "rsa" :
    print ( "Unknown algorithm %s for certificate, skipping..." % O0ooOO0O0O0O [ 0 ] , file = sys . stderr )
    return None
    if 59 - 59: ooo000 / Oo - i1
   oO0Ooo [ "pubkey" ] = ( "rsa" , { "exponent" : codecs . decode ( O0ooOO0O0O0O [ 1 ] , "hex" ) ,
 "modulus" : codecs . decode ( O0ooOO0O0O0O [ 2 ] , "hex" ) } )
   if 49 - 49: iiI + oOo0O00 + ooo000 . Iii1i + iiI
   if 88 - 88: IIi1i111IiII . IIiIIiIi11I1 * i1 + IiIIii11Ii % I1I / IIi1i111IiII
   oo00oOOo0O0o = I1II1I1i [ 7 ] . strip ( ) . split ( " " )
   oO0Ooo [ "signature" ] = ( oo00oOOo0O0o [ 0 ] , codecs . decode ( oo00oOOo0O0o [ 1 ] , "hex" ) )
   if 12 - 12: Ooo0Ooo + I1I / OooOoo
   if 70 - 70: O0OooooOo % I1Ii1I1 + ooOOO
   oO0Ooo [ "crl" ] = [ ]
   for OOoOooo000O0O in I1II1I1i [ 8 : ] :
    oO0Ooo [ "crl" ] . append ( OOoOooo000O0O . strip ( ) )
  except :
   print ( "Internal error parsing certificate, skipping..." , file = sys . stderr )
   return None
   if 12 - 12: ooOOO . Oo % IiIIii11Ii - ooOOO
  return oO0Ooo
  if 75 - 75: IiIIii11Ii * i1 . Iii1i - IIi1i111IiII
def oo0O0O0Ooooo ( ) :
 if 39 - 39: Oo . ii / ooo000 / iI1iII1I1I1i
 if 48 - 48: ii * iiI - OooOoo * Oo - IIi1i111IiII - Ooo0Ooo
 global i1Iiiii1
 if 36 - 36: IiIIii11Ii
 i1Iiiii1 = { }
 for IiIi1I11I in os . listdir ( OOO0o000 ) :
  IiiIi1 = os . path . join ( OOO0o000 , IiIi1I11I )
  if os . path . isdir ( IiiIi1 ) :
   continue
   if 28 - 28: IIi1i111IiII * Ii . i1 + iiI / i1i1i1111I / ii
  with open ( IiiIi1 , "rb" ) as iIi1i :
   o0Oo = IiiIii11iII1 ( iIi1i )
   if o0Oo is None :
    continue
    if 15 - 15: OooOoo . IiIIii11Ii . iiI / Iii1i + ooOOO / Ii
   if not o0Oo [ "is_ca" ] :
    print ( "Certificate %s is not for a CA, skipping..." % IiiIi1 , file = sys . stderr )
    continue
    if 17 - 17: O0OooooOo - i1i1i1111I . iI1iII1I1I1i - O0OooooOo + Oo % iI1iII1I1I1i
   i1Iiiii1 [ o0Oo [ "subject" ] ] = o0Oo
   if 65 - 65: Ii % O0OooooOo
def OooOOO0oO0Oo ( subject ) :
 if subject not in i1Iiiii1 :
  if 11 - 11: OooOoo % OooOoo . ooOOO
  return None
  if 80 - 80: ii % i1iiIII111 * IIi1i111IiII - oOo0O00 % O0OooooOo - IIi1i111IiII
 return i1Iiiii1 [ subject ]
 if 56 - 56: Oo
def IiIIIII1i ( uri ) :
 if not isinstance ( uri , bytes ) :
  uri = uri . encode ( locale . getpreferredencoding ( ) )
  if 41 - 41: ooOOO + OooOoo + IIiIIiIi11I1 * i1i1i1111I
 hash = codecs . encode ( hashlib . sha1 ( uri ) . digest ( ) , "hex" )
 if 12 - 12: i1i1i1111I
 try :
  with open ( os . path . join ( ooOOooO0 , hash . decode ( "ascii" ) ) , "rb" ) as o0Oo0o000O0oO :
   OoO0OOo00oo0O = pickle . load ( o0Oo0o000O0oO )
   if len ( OoO0OOo00oo0O ) != 2 :
    return None
   if OoO0OOo00oo0O [ 0 ] != i1iiiiIIIiIi :
    return None
    if 29 - 29: IiIIii11Ii
   return OoO0OOo00oo0O [ 1 ]
 except :
  return None
  if 72 - 72: ooOOO . i1 % Ooo0Ooo
  if 72 - 72: ii % IIi1i111IiII . ooOOO * I1Ii1I1 . ooOOO
def Oooo00O ( uri , crl ) :
 i1ii11iIIIIiI , IiIi1I11I = tempfile . mkstemp ( prefix = ".newcrl." , dir = ooOOooO0 )
 with os . fdopen ( i1ii11iIIIIiI , "wb" ) as O0oooo0o0oO :
  pickle . dump ( ( i1iiiiIIIiIi , crl ) , O0oooo0o0oO , - 1 )
  if 57 - 57: IIiIIiIi11I1 - iI1iII1I1I1i % ooOOO - O0OooooOo / IiIIii11Ii . Ooo0Ooo
 if not isinstance ( uri , bytes ) :
  uri = uri . encode ( locale . getpreferredencoding ( ) )
  if 15 - 15: iiI * O0OooooOo - oOo0O00
 hash = codecs . encode ( hashlib . sha1 ( uri ) . digest ( ) , "hex" )
 os . rename ( IiIi1I11I , os . path . join ( ooOOooO0 , hash . decode ( "ascii" ) ) )
 if 6 - 6: IIi1i111IiII - Ii
 if 1 - 1: I1I + OooOoo
def OooO0Oo ( uri ) :
 i1ii11iIIIIiI , IiIi1I11I = tempfile . mkstemp ( prefix = "crl." )
 os . unlink ( IiIi1I11I )
 with os . fdopen ( i1ii11iIIIIiI , "r+b" ) as I1i111IiI1 :
  try :
   i1I11ii ( "Downloading CRL list from %s" % uri )
   IIII1I11IIiIi = urllib . request . urlopen ( uri )
   if 42 - 42: iI1iII1I1I1i % IiIIii11Ii
   while True :
    IiI = IIII1I11IIiIi . read ( 4096 )
    if len ( IiI ) == 0 :
     break
     if 76 - 76: i1i1i1111I % oOo0O00 - i1iiIII111 * i1
    I1i111IiI1 . write ( IiI )
  except :
   print ( "Unable to download %s..." % uri , file = sys . stderr )
   return None
   if 43 - 43: O0OooooOo . Oo
  I1i111IiI1 . seek ( 0 , os . SEEK_SET )
  OoO0OOo00oo0O = I11iiii ( I1i111IiI1 )
  if OoO0OOo00oo0O is None :
   return None
   if 33 - 33: IIi1i111IiII / OooOoo
   if 98 - 98: I1Ii1I1 . IIiIIiIi11I1 * iiI - iI1iII1I1I1i % iiI * IIi1i111IiII
  o0Oo = OooOOO0oO0Oo ( OoO0OOo00oo0O [ "issuer" ] )
  if o0Oo is None :
   print ( "Unknown issuer for CRL..." , file = sys . stderr )
   return None
   if 42 - 42: OooOoo + i1i1i1111I - iI1iII1I1I1i - oOo0O00 * iiI + Ii
   if 46 - 46: oOo0O00 . iI1iII1I1I1i - Ii . oOo0O00 + i1i1i1111I
  I111iI11i = OoO0OOo00oo0O [ "signature" ] [ 0 ]
  OooOoO0o00 = OoO0OOo00oo0O [ "signature" ] [ 1 ]
  if 23 - 23: i1
  O00oOOOOOO = IIi ( I111iI11i )
  if O00oOOOOOO is None :
   print ( "Unknown signature algorithm on CRL..." , file = sys . stderr )
   return None
   if 72 - 72: oOo0O00 - IIi1i111IiII + i1iiIII111 / iiI . OooOoo * IiIIii11Ii
  ( O00o , OOo00000o00O ) = O00oOOOOOO
  if 66 - 66: IiIIii11Ii . I1Ii1I1 + I1I
  I1i111IiI1 . seek ( 0 , os . SEEK_SET )
  if not Ooooo ( I1i111IiI1 , O00o ) :
   print ( "Invalid signature on CRL..." , file = sys . stderr )
   return None
   if 38 - 38: O0OooooOo
  hash = O00o . digest ( )
  if 99 - 99: O0OooooOo * i1iiIII111 . OooOoo % ooo000 % OooOoo
  I111iI11i = o0Oo [ "pubkey" ] [ 0 ]
  i1i1IiII11iI1 = o0Oo [ "pubkey" ] [ 1 ]
  if 37 - 37: i1 - i1 % IIiIIiIi11I1 + IiIIii11Ii / iiI * iI1iII1I1I1i
  if I111iI11i != "rsa" :
   print ( "Unexpected key type for issuer of CRL..." , file = sys . stderr )
   return None
   if 60 - 60: O0OooooOo - Ooo0Ooo % I1Ii1I1
  if not OOo00000o00O ( hash , OooOoO0o00 , i1i1IiII11iI1 [ "exponent" ] , i1i1IiII11iI1 [ "modulus" ] ) :
   print ( "Invalid signature on certificate..." , file = sys . stderr )
   return None
   if 26 - 26: ooOOO / IIiIIiIi11I1 . ii + O0OooooOo . Oo
  return OoO0OOo00oo0O
  if 37 - 37: I1Ii1I1
  if 35 - 35: OooOoo % i1i1i1111I - iI1iII1I1I1i / IiIIii11Ii
  if 4 - 4: ooo000 . IiIIii11Ii % ooo000 / i1i1i1111I
def oO ( certfile , hasher ) :
 if isinstance ( certfile , bytes ) :
  certfile = io . BytesIO ( certfile )
 elif isinstance ( certfile , Ii111 ) :
  certfile = io . BytesIO ( certfile . raw )
  if 13 - 13: i1iiIII111 * OooOoo / oOo0O00 . OooOoo - IIiIIiIi11I1 * iI1iII1I1I1i
  if 79 - 79: i1i1i1111I
 if ord ( certfile . read ( 1 ) ) != 0x30 :
  return False
  if 3 - 3: OooOoo / IIi1i111IiII % O0OooooOo
  if 55 - 55: oOo0O00
 Iii = ord ( certfile . read ( 1 ) )
 if Iii & 0x80 :
  certfile . read ( Iii & 0x7f )
  if 54 - 54: iI1iII1I1I1i % Oo . IIi1i111IiII - Iii1i % O0OooooOo * iiI
  if 31 - 31: oOo0O00 / Iii1i - IiIIii11Ii % iiI / I1Ii1I1 - i1i1i1111I
 IiI = certfile . read ( 1 )
 hasher . update ( IiI )
 if IiI [ 0 ] != 0x30 :
  return False
  if 68 - 68: O0OooooOo . O0OooooOo % O0OooooOo
  if 71 - 71: ooo000
 IiI = certfile . read ( 1 )
 hasher . update ( IiI )
 Iii = IiI [ 0 ]
 if Iii & 0x80 :
  IiI = certfile . read ( Iii & 0x7f )
  hasher . update ( IiI )
  Iii = int ( codecs . encode ( IiI , "hex" ) , 16 )
  if 61 - 61: ooo000
  if 48 - 48: Iii1i * i1i1i1111I + IiIIii11Ii
 while Iii > 0 :
  IiI = certfile . read ( min ( Iii , 4096 ) )
  hasher . update ( IiI )
  Iii -= len ( IiI )
  if 31 - 31: Oo * i1iiIII111 % Ii / ii + I1Ii1I1 + iI1iII1I1I1i
 return True
 if 90 - 90: I1Ii1I1 * i1i1i1111I / iI1iII1I1I1i * Ii
def Ooooo ( crlfile , hasher ) :
 if 38 - 38: I1I . Ii
 if 41 - 41: ooo000 % IIiIIiIi11I1 % ooOOO
 return oO ( crlfile , hasher )
 if 5 - 5: oOo0O00 / Ii + i1iiIII111 * Oo + Ooo0Ooo + ooo000
def IIi ( algorithm ) :
 if algorithm == 'rsa-sha1' :
  return ( hashlib . sha1 ( ) ,
 thinlinc . crypto . verify_rsa_sha1_hashed )
 elif algorithm == 'rsa-sha256' :
  return ( hashlib . sha256 ( ) ,
 thinlinc . crypto . verify_rsa_sha256_hashed )
 elif algorithm == 'rsa-sha384' :
  return ( hashlib . sha384 ( ) ,
 thinlinc . crypto . verify_rsa_sha384_hashed )
 elif algorithm == 'rsa-sha512' :
  return ( hashlib . sha512 ( ) ,
 thinlinc . crypto . verify_rsa_sha512_hashed )
  if 96 - 96: i1iiIII111 - IIiIIiIi11I1 / IIiIIiIi11I1 * IiIIii11Ii
 return None
 if 67 - 67: Ooo0Ooo . Ooo0Ooo . IIi1i111IiII
def IiiI1II ( uri ) :
 global II
 if 58 - 58: Ooo0Ooo * iI1iII1I1I1i / iI1iII1I1I1i + IiIIii11Ii . IIi1i111IiII
 if uri in II :
  return II [ uri ]
  if 56 - 56: Ii * ooo000 . IiIIii11Ii
 OoO0OOo00oo0O = IiIIIII1i ( uri )
 if OoO0OOo00oo0O is None :
  OoO0OOo00oo0O = OooO0Oo ( uri )
  if OoO0OOo00oo0O is not None :
   Oooo00O ( uri , OoO0OOo00oo0O )
 else :
  if 66 - 66: I1Ii1I1 * OooOoo . iI1iII1I1I1i % OooOoo . i1 . IiIIii11Ii
  O00O0Oo0OOO = time . time ( )
  ( Oo0o0OOOOo0 , II1Iiii1 ) = OoO0OOo00oo0O [ "update" ]
  if O00O0Oo0OOO > II1Iiii1 :
   II1iII1Ii1 = OooO0Oo ( uri )
   if II1iII1Ii1 is None :
    if 37 - 37: I1I - OooOoo . iI1iII1I1I1i . iI1iII1I1I1i / i1iiIII111 . IiIIii11Ii
    Ii1111 = ( II1Iiii1 - Oo0o0OOOOo0 )
    if O00O0Oo0OOO > ( Oo0o0OOOOo0 + Ii1111 * 2 ) :
     print ( "Cannot get updated CRL. Using old one..." , file = sys . stderr )
   else :
    OoO0OOo00oo0O = II1iII1Ii1
    Oooo00O ( uri , OoO0OOo00oo0O )
    if 23 - 23: i1 % I1I . OooOoo
    if 31 - 31: IiIIii11Ii . iiI % iI1iII1I1I1i + ii
    if 17 - 17: i1i1i1111I . ooo000 + IIiIIiIi11I1 * Ooo0Ooo % Ooo0Ooo
 II [ uri ] = OoO0OOo00oo0O
 if 74 - 74: OooOoo
 return OoO0OOo00oo0O
 if 41 - 41: iI1iII1I1I1i . O0OooooOo - OooOoo + iiI % OooOoo / Ooo0Ooo
 if 65 - 65: Oo
def I11iiii ( crlfile ) :
 if isinstance ( crlfile , str ) :
  crlfile = io . StringIO ( crlfile )
  if 67 - 67: I1Ii1I1 + I1Ii1I1
 OoO0O0OO0 = subprocess . Popen ( [ os . path . join ( prefix . get_tl_prefix ( ) , "libexec" , "tl-crltool" ) ,
 "--issuer" ,
 "--update" ,
 "--signature" ,
 "--list" ,
 ] ,
 stdin = crlfile ,
 stdout = subprocess . PIPE ,
 stderr = subprocess . PIPE ,
 universal_newlines = True )
 if 42 - 42: IiIIii11Ii / oOo0O00 % ooOOO . ii / OooOoo + oOo0O00
 ( I1II1I1i , oOOoO0o ) = OoO0O0OO0 . communicate ( )
 if 79 - 79: O0OooooOo . I1Ii1I1 * iiI % I1Ii1I1 / IIi1i111IiII
 if OoO0O0OO0 . returncode != 0 :
  print ( "Failed to load CRL..." , file = sys . stderr )
  if "" != oOOoO0o :
   print ( "stderr from tl-crltool: " , oOOoO0o , file = sys . stderr )
  return None
  if 93 - 93: iiI + Iii1i . Ii . iiI * ooOOO
 I1II1I1i = I1II1I1i . splitlines ( )
 if 84 - 84: Ooo0Ooo % IIi1i111IiII
 try :
  OoO0OOo00oo0O = { }
  if 82 - 82: IIiIIiIi11I1
  if 81 - 81: oOo0O00 + i1 - ooo000 * iI1iII1I1I1i + i1i1i1111I
  OoO0OOo00oo0O [ "issuer" ] = I1II1I1i [ 0 ] . strip ( )
  if 89 - 89: I1Ii1I1
  if 57 - 57: iI1iII1I1I1i - i1iiIII111 / OooOoo % i1iiIII111
  OoO00oOo = I1II1I1i [ 1 ] . strip ( ) . split ( " " )
  OoO0OOo00oo0O [ "update" ] = ( IioOOOoo ( OoO00oOo [ 0 ] ) ,
 IioOOOoo ( OoO00oOo [ 1 ] ) )
  if 60 - 60: ooOOO
  if 58 - 58: Oo / Ii
  oo00oOOo0O0o = I1II1I1i [ 2 ] . strip ( ) . split ( " " )
  OoO0OOo00oo0O [ "signature" ] = ( oo00oOOo0O0o [ 0 ] , codecs . decode ( oo00oOOo0O0o [ 1 ] , "hex" ) )
  if 38 - 38: Ooo0Ooo % I1Ii1I1 / iiI + i1iiIII111
  if 25 - 25: O0OooooOo - iI1iII1I1I1i
  OooO0Ooo0 = { }
  for OOoOooo000O0O in I1II1I1i [ 3 : ] :
   oOO0ooOo = OOoOooo000O0O . strip ( ) . split ( " " )
   OooO0Ooo0 [ oOO0ooOo [ 0 ] ] = oOO0ooOo [ 1 : ]
  OoO0OOo00oo0O [ "serials" ] = OooO0Ooo0
 except :
  print ( "Internal error parsing CRL, skipping..." , file = sys . stderr )
  return None
  if 34 - 34: ooo000 + Ii + Ii - ii % IiIIii11Ii / ii
 return OoO0OOo00oo0O
 if 37 - 37: ooo000
def IioOOOoo ( timestamp ) :
 if 65 - 65: ooOOO % IIi1i111IiII % OooOoo . Oo
 if 51 - 51: ii + OooOoo + I1I
 oo = "%y%m%d%H%M%SZ"
 I1Ii11iI1 = "%Y%m%d%H%M%SZ"
 if 41 - 41: IIi1i111IiII - oOo0O00
 if 76 - 76: O0OooooOo % IIiIIiIi11I1 % iiI
 if 39 - 39: IiIIii11Ii . Oo + iiI - oOo0O00
 for format in [ oo , I1Ii11iI1 ] :
  try :
   I111i1 = time . strptime ( timestamp , format )
   if 7 - 7: I1Ii1I1 - IIi1i111IiII % OooOoo - i1 * Ii
   if 74 - 74: I1I . iI1iII1I1I1i . Ooo0Ooo + Ooo0Ooo / I1I * Ooo0Ooo
   if 65 - 65: Ii - OooOoo * I1I % i1iiIII111 % IIiIIiIi11I1
   if 68 - 68: I1Ii1I1 + ii - ii + IiIIii11Ii
   if 87 - 87: ooOOO * IIiIIiIi11I1 % i1 / ii + i1 + oOo0O00
   if 99 - 99: I1I * IIiIIiIi11I1 * i1iiIII111
   if 62 - 62: ooOOO % Oo + iiI
   if format == oo :
    if I111i1 . tm_year >= 2050 :
     I111i1 = time . strptime ( "19%s" % timestamp , I1Ii11iI1 )
     if 87 - 87: ooo000 - OooOoo + Ii + i1i1i1111I + IiIIii11Ii
   return calendar . timegm ( I111i1 )
   if 57 - 57: IIiIIiIi11I1 + I1I / ooOOO % ooOOO % Oo / IIi1i111IiII
  except ValueError as o00ooo0OO0000 :
   if 95 - 95: i1 / O0OooooOo . i1 / Oo . Ooo0Ooo
   if 43 - 43: Oo - OooOoo * ii . Ooo0Ooo / IIiIIiIi11I1 * IIiIIiIi11I1
   continue
   if 84 - 84: i1iiIII111 + oOo0O00
   if 83 - 83: i1i1i1111I
   if 84 - 84: ii / Ii * Ooo0Ooo / Ii / ooo000
 raise ValueError ( "Retrieved date could not be parsed by any format string" )
 if 64 - 64: oOo0O00 * Ii
def I1iIII111Ii ( cert ) :
 if 65 - 65: I1I + i1iiIII111 . iI1iII1I1I1i / ooOOO
 if 92 - 92: i1iiIII111 . oOo0O00
 if 73 - 73: I1Ii1I1 / ooo000 % O0OooooOo - i1i1i1111I + Oo - I1Ii1I1
 if 18 - 18: i1 + ooOOO . i1 - iI1iII1I1I1i
 if 97 - 97: oOo0O00 + iiI % Iii1i
 if 34 - 34: i1 + Oo . oOo0O00 - ooo000 / O0OooooOo * oOo0O00
 if 89 - 89: oOo0O00
 if 48 - 48: i1 / IIiIIiIi11I1 / iI1iII1I1I1i / IIi1i111IiII * IiIIii11Ii
 if 54 - 54: IIiIIiIi11I1 % I1I % IIi1i111IiII / O0OooooOo . O0OooooOo - IiIIii11Ii
 i1iI1I = cert [ 'expiry' ] [ 0 ]
 i1Ii1IiIi1II1 = cert [ 'expiry' ] [ 1 ]
 O00O0Oo0OOO = time . time ( )
 if 8 - 8: oOo0O00 - Iii1i * ooOOO - I1I . iiI
 if i1iI1I > O00O0Oo0OOO :
  return ( False , "Certificate is not yet valid" )
  if 10 - 10: Ooo0Ooo
 if i1Ii1IiIi1II1 <= O00O0Oo0OOO :
  return ( False , "Certificate has expired" )
  if 45 - 45: ii . i1i1i1111I . Ii - Ooo0Ooo + OooOoo / Ooo0Ooo
  if 48 - 48: ooo000 - i1i1i1111I - ii * OooOoo
  if 84 - 84: I1Ii1I1 . ooo000 % O0OooooOo
  if 17 - 17: Iii1i / oOo0O00 . ii - ii - i1 - i1
 o0Oo = OooOOO0oO0Oo ( cert [ "issuer" ] )
 if o0Oo is None :
  return ( False , "Unknown certificate issuer" )
  if 59 - 59: ooOOO / Oo / Ii
  if 85 - 85: Iii1i % I1I / Oo . IIi1i111IiII
  if 5 - 5: Ii % Ii / iI1iII1I1I1i - i1
  if 70 - 70: OooOoo . O0OooooOo
  if 38 - 38: iiI * i1iiIII111
 I111iI11i = cert [ "signature" ] [ 0 ]
 OooOoO0o00 = cert [ "signature" ] [ 1 ]
 if 74 - 74: i1iiIII111 * oOo0O00 / O0OooooOo / Ooo0Ooo / oOo0O00
 O00oOOOOOO = IIi ( I111iI11i )
 if 36 - 36: ii
 if O00oOOOOOO is None :
  return ( False , "Certificate signature algorithm is unknown" )
  if 76 - 76: Ooo0Ooo / IIiIIiIi11I1 % IiIIii11Ii . ooo000 * i1iiIII111 % Ooo0Ooo
 ( O00o , OOo00000o00O ) = O00oOOOOOO
 if 53 - 53: ooo000 + I1Ii1I1
 if not oO ( cert , O00o ) :
  return ( False , "Certificate has invalid signature" )
  if 97 - 97: i1 - oOo0O00 / OooOoo * Ii - ii
 hash = O00o . digest ( )
 if 53 - 53: O0OooooOo % ooo000 / ooOOO / I1I
 I111iI11i = o0Oo [ "pubkey" ] [ 0 ]
 i1i1IiII11iI1 = o0Oo [ "pubkey" ] [ 1 ]
 if 43 - 43: iI1iII1I1I1i . i1i1i1111I + I1I % ooOOO . IIi1i111IiII - IIi1i111IiII
 if I111iI11i != "rsa" :
  return ( False , "Unexpected key type for certificate issuer" )
  if 6 - 6: I1I
 if not OOo00000o00O ( hash , OooOoO0o00 , i1i1IiII11iI1 [ "exponent" ] , i1i1IiII11iI1 [ "modulus" ] ) :
  return ( False , "Certificate signature verification failed" )
  if 98 - 98: ii * IIiIIiIi11I1 / i1iiIII111 / Iii1i + I1I
  if 25 - 25: IIiIIiIi11I1 . IIi1i111IiII / I1I * i1 - i1iiIII111 % oOo0O00
  if 49 - 49: IiIIii11Ii % ooOOO + O0OooooOo + IIiIIiIi11I1
  if 60 - 60: IIiIIiIi11I1
  if 98 - 98: IiIIii11Ii / Ooo0Ooo + Ii
  if 73 - 73: OooOoo * Iii1i
  if 34 - 34: iiI % Ooo0Ooo * OooOoo + i1iiIII111 / i1
  if 49 - 49: IIiIIiIi11I1 / i1iiIII111 % IIiIIiIi11I1 + IIiIIiIi11I1 * iI1iII1I1I1i
  if 22 - 22: I1Ii1I1 + ii / I1Ii1I1 - Ii % Ii % i1i1i1111I
  if 86 - 86: Iii1i
  if 53 - 53: i1 * i1i1i1111I
 for i1IIi in cert [ "crl" ] :
  if not i1IIi . startswith ( "http" ) :
   continue
   if 80 - 80: IIi1i111IiII * IIiIIiIi11I1 - Iii1i . ii % Iii1i - Iii1i
  OoO0OOo00oo0O = IiiI1II ( i1IIi )
  if OoO0OOo00oo0O is None :
   return ( False , "Unable to retrieve CRL at %s" % i1IIi )
   if 68 - 68: ii + Iii1i + Ooo0Ooo % Oo / O0OooooOo . OooOoo
  if cert [ "serial" ] in OoO0OOo00oo0O [ "serials" ] :
   i1I11ii ( "Certificate revoked by CRL list at %s" % i1IIi )
   return ( False , "Certificate has been revoked by CA" )
   if 31 - 31: O0OooooOo % ooOOO
   if 46 - 46: i1i1i1111I - ooo000 + iI1iII1I1I1i
   if 73 - 73: i1 * oOo0O00
   if 88 - 88: Ii
 return ( True , "Certificate OK" )
 if 12 - 12: ooo000 - IIiIIiIi11I1 % Iii1i . I1Ii1I1
def I1I1i1ii ( ) :
 print ( "Usage: tl-ldap-certalias [options]" )
 print ( "Options:" )
 print ( "  -h, --help      Show usage information" )
 print ( "  -v, --verbose   Be more verbose" )
 print ( "  -d, --debug     Show debugging output" )
 print ( "  -s, --simulate  Dry run, don't update files" )
 return
 if 28 - 28: IIiIIiIi11I1 % Ii + ooOOO . iiI % Ii * I1Ii1I1
 if 41 - 41: I1I
def IIiI1II1i11i11I ( exponent , modulus , comment = None ) :
 if 7 - 7: Ooo0Ooo
 if 30 - 30: i1iiIII111
 if comment is not None and isinstance ( comment , str ) :
  comment = comment . encode ( locale . getpreferredencoding ( ) )
  if 78 - 78: ooo000 % Iii1i + ooOOO * IIiIIiIi11I1 - i1
  if 46 - 46: Ooo0Ooo - iiI / ooo000 * IIi1i111IiII . oOo0O00
 if exponent [ 0 ] & 0x80 :
  exponent = b'\0' + exponent
 if modulus [ 0 ] & 0x80 :
  modulus = b'\0' + modulus
  if 32 - 32: i1i1i1111I . OooOoo + OooOoo - ooo000 * IiIIii11Ii + Oo
 iIIIii = struct . pack ( ">I" , len ( b"ssh-rsa" ) )
 iIIIii += b"ssh-rsa"
 if 12 - 12: iI1iII1I1I1i - ii
 iIIIii += struct . pack ( ">I" , len ( exponent ) )
 iIIIii += exponent
 if 72 - 72: Oo - i1i1i1111I . ii + IIi1i111IiII . IIi1i111IiII
 iIIIii += struct . pack ( ">I" , len ( modulus ) )
 iIIIii += modulus
 if 42 - 42: oOo0O00 . ooo000 - ii . i1
 iIIIii = b"ssh-rsa " + base64 . b64encode ( iIIIii )
 if 74 - 74: ooo000 / OooOoo / oOo0O00 + IIiIIiIi11I1 + OooOoo
 if comment is not None :
  iIIIii += b" " + comment
  if 9 - 9: ooOOO - Ooo0Ooo
 return iIIIii . decode ( locale . getpreferredencoding ( ) )
 if 39 - 39: IiIIii11Ii . i1 + IIiIIiIi11I1 * IIi1i111IiII
 if 79 - 79: Oo - OooOoo
 if 39 - 39: ooo000
OOOO00o = [
 ( "emailAddress" , "1.2.840.113549.1.9.1" ) ,
 ]
if 39 - 39: I1I % i1iiIII111 - I1Ii1I1
if 51 - 51: IIiIIiIi11I1 + i1 % i1iiIII111
def OOo0o00o ( ) :
 locale . setlocale ( locale . LC_ALL , "" )
 if 88 - 88: iI1iII1I1I1i . I1I * oOo0O00 - i1i1i1111I * Ooo0Ooo
 try :
  oOoO0o0OOoO0 , O00O0oO000 = getopt . getopt ( sys . argv [ 1 : ] , "vsdh" , [ "verbose" , "simulate" , "debug" , "help" ] )
 except getopt . GetoptError as o00ooo0OO0000 :
  OOOO0O0ooO0O ( o00ooo0OO0000 )
  I1I1i1ii ( )
  return 1
  if 82 - 82: Oo
 I11i = False
 if 73 - 73: ooo000 * Ooo0Ooo + Iii1i . ooOOO . O0OooooOo / O0OooooOo
 global OoOoo0o
 global I1i
 if 72 - 72: iiI * iI1iII1I1I1i / ooo000 + iiI - O0OooooOo
 for ( IIIii1iIII , oOOOoO00OO ) in oOoO0o0OOoO0 :
  if IIIii1iIII in [ "-v" , "--verbose" ] :
   OoOoo0o = True
  elif IIIii1iIII in [ "-d" , "--debug" ] :
   OoOoo0o = True
   I1i = True
  elif IIIii1iIII in [ "-s" , "--simulate" ] :
   I11i = True
  elif IIIii1iIII in [ "-h" , "--help" ] :
   I1I1i1ii ( )
   return 1
   if 9 - 9: Oo . i1iiIII111 . Oo
 if I11i :
  print ( "tl-ldap-certalias:  INFO: Simulation run, won't write changes to disk" )
  if 87 - 87: i1 * O0OooooOo
  if 23 - 23: i1iiIII111 / Ooo0Ooo % i1 - I1Ii1I1 - I1Ii1I1
  if 82 - 82: ooo000 - IIi1i111IiII . iI1iII1I1I1i / Ooo0Ooo % Iii1i - I1I
  if 27 - 27: i1i1i1111I * Oo % ii
 IiIiI1I = thinlinc . selinux . selinux_enabled ( )
 if IiIiI1I :
  i1I11ii ( "This is a SELinux-enabled system." )
 else :
  i1I11ii ( "This system does not use SELinux." )
  if 68 - 68: IIi1i111IiII + IIi1i111IiII - iiI - IiIIii11Ii . iI1iII1I1I1i + IIi1i111IiII
  if 23 - 23: oOo0O00 * iiI % OooOoo . Oo + oOo0O00 / Oo
  if 24 - 24: OooOoo * ooo000 % Ooo0Ooo
  if 77 - 77: ooo000 % Ooo0Ooo
 I111i1iIIiiI = os . path . join ( prefix . get_tl_prefix ( ) , "etc" , "thinlinc.hconf" )
 i1IIiII11 ( "Reading configuration at %s" % I111i1iIIiiI )
 ooOooO0 = hiveconf . open_hive ( I111i1iIIiiI )
 if 65 - 65: Ooo0Ooo - IIiIIiIi11I1 * iI1iII1I1I1i - I1Ii1I1 - iiI . Iii1i
 if not ooOooO0 :
  OOOO0O0ooO0O ( "Could not open ThinLinc configuration at %s" % I111i1iIIiiI )
  return 1
  if 98 - 98: Ii + ooOOO
  if 29 - 29: I1Ii1I1 + iiI - IIiIIiIi11I1 * O0OooooOo % Oo
  if 74 - 74: ooOOO
 oO0oOo00oOoOO = ooOooO0 . get_string ( "/utils/tl-ldap-certalias/ldap_schema" , "rfc2307" )
 if 45 - 45: iI1iII1I1I1i
 if 16 - 16: iiI / IiIIii11Ii
 ooooo0O0O00 = ooOooO0 . get_string ( "/utils/tl-ldap-certalias/users/uri" , None )
 III1I11iiIiI1 = ooOooO0 . get_string ( "/utils/tl-ldap-certalias/users/base" , None )
 ii1Ii = ooOooO0 . get_string ( "/utils/tl-ldap-certalias/users/binddn" , '' )
 O00O = ooOooO0 . get_string ( "/utils/tl-ldap-certalias/users/bindpw" , '' )
 if 81 - 81: iI1iII1I1I1i - i1i1i1111I . O0OooooOo - ooOOO
 if 89 - 89: IIiIIiIi11I1 - iiI + Iii1i
 if 100 - 100: iI1iII1I1I1i . IiIIii11Ii * ii . I1I - I1I - IIiIIiIi11I1
 if not ( ooooo0O0O00 and III1I11iiIiI1 ) :
  OOOO0O0ooO0O ( "Configuration: user source not configured - exiting." )
  return 1
  if 35 - 35: i1iiIII111 + iiI % OooOoo
  if 73 - 73: Ii + Oo . iI1iII1I1I1i * Iii1i
  if 16 - 16: iI1iII1I1I1i - Iii1i
  if 55 - 55: OooOoo * oOo0O00
  if 21 - 21: IiIIii11Ii . i1i1i1111I + IiIIii11Ii
 i1I11iI1 = ooOooO0 . get_string ( "/utils/tl-ldap-certalias/users/filter" , None )
 if 12 - 12: Iii1i . IIiIIiIi11I1 / OooOoo . i1 % iI1iII1I1I1i % Iii1i
 if 2 - 2: Oo + OooOoo - i1i1i1111I - ooo000 / Oo . Oo
 if 41 - 41: OooOoo + OooOoo - OooOoo
 if ( i1I11iI1 is None ) :
  if 9 - 9: Iii1i % I1Ii1I1 % IiIIii11Ii - I1I * OooOoo
  if 53 - 53: iI1iII1I1I1i * i1i1i1111I / OooOoo . iiI . ooo000
  i1I11iI1 = "(&(objectclass=posixAccount)(uidNumber=*))"
  if 45 - 45: OooOoo + ooOOO / i1i1i1111I * i1
  if ( oO0oOo00oOoOO == "AD" ) :
   i1I11iI1 = "(&(objectclass=user)(uidNumber=*))"
   if 71 - 71: IIi1i111IiII % Iii1i + oOo0O00 * O0OooooOo / IIi1i111IiII
   if 66 - 66: ooo000 * oOo0O00
   if 83 - 83: i1
   if 64 - 64: i1 . IIi1i111IiII - O0OooooOo . Iii1i
   if 47 - 47: ooo000 / Ooo0Ooo % IiIIii11Ii
 Ii1 = ooOooO0 . get_string ( "/utils/tl-ldap-certalias/certificate_user_match" ,
 'sameobject' )
 if 9 - 9: ooOOO
 iI = ooOooO0 . get_bool ( "/utils/tl-ldap-certalias/allow_invalid_certificates" ,
 False )
 if 65 - 65: O0OooooOo * Ooo0Ooo - ooo000
 if 11 - 11: ii % OooOoo % i1i1i1111I + i1i1i1111I + I1I % OooOoo
 if not iI :
  oo0O0O0Ooooo ( )
  if 69 - 69: iiI - i1i1i1111I * oOo0O00
  if 90 - 90: i1 * i1 . Ooo0Ooo . Oo
 o0000o = dict ( )
 if 16 - 16: OooOoo
 if 90 - 90: I1Ii1I1
 if Ii1 == "sameobject" :
  if 64 - 64: O0OooooOo % ooOOO * I1Ii1I1
  i1I11ii ( "userCertificate attributes are stored on user objects" )
  if 48 - 48: ooOOO * Oo
  if 99 - 99: i1iiIII111
  if 55 - 55: i1i1i1111I % iiI + i1i1i1111I
  if 64 - 64: IiIIii11Ii % IIiIIiIi11I1 . I1Ii1I1 % IiIIii11Ii
  if 21 - 21: iiI . Oo * i1
  if 95 - 95: Ii . i1 . IIiIIiIi11I1 . ooo000 + OooOoo
  if 23 - 23: ii
  i1I11ii ( "Searching for users on %s/%s" % ( ooooo0O0O00 , III1I11iiIiI1 ) )
  if 92 - 92: Ooo0Ooo * i1iiIII111 / Ooo0Ooo / i1iiIII111 * i1i1i1111I + iiI
  o0ooo0oOoO = tl_ldap_iterator . search ( uri = ooooo0O0O00 ,
 base = III1I11iiIiI1 ,
 user = ii1Ii ,
 password = O00O ,
 filter = i1I11iI1 )
  if 37 - 37: i1i1i1111I + iI1iII1I1I1i % Iii1i
  if not o0ooo0oOoO :
   OOOO0O0ooO0O ( "Failed to get list of users, exiting" )
   return 1
   if 48 - 48: iiI + oOo0O00
  for I1Ii11i in o0ooo0oOoO :
   if 20 - 20: Ooo0Ooo
   ( iI11iIi1I1 , o0oOO ) = I1Ii11i
   if 8 - 8: ooOOO * i1i1i1111I
   i1IIiII11 ( "Found user %s" % iI11iIi1I1 )
   if 6 - 6: Ooo0Ooo % IiIIii11Ii
   if 59 - 59: iiI . O0OooooOo . ooo000 / iiI . Ii % Ooo0Ooo
   try :
    if 85 - 85: oOo0O00 / ooOOO
    if 41 - 41: i1iiIII111 * iI1iII1I1I1i + i1 + i1i1i1111I
    iiiiiIIIIi1 = int ( o0oOO [ 'uidNumber' ] [ 0 ] )
   except KeyError as o00ooo0OO0000 :
    OOOO0O0ooO0O ( "Object %s lacks attribute %s. Skipping user." % ( iI11iIi1I1 , str ( o00ooo0OO0000 ) ) )
    continue
    if 46 - 46: oOo0O00 - iI1iII1I1I1i
   if 'userCertificate;binary' in o0oOO :
    oo0 = o0oOO [ 'userCertificate;binary' ]
   elif 'userCertificate' in o0oOO :
    oo0 = o0oOO [ 'userCertificate' ]
   else :
    oo0 = [ ]
    if 39 - 39: IIi1i111IiII * I1I . OooOoo + i1 . ooo000 + O0OooooOo
    if 7 - 7: ooOOO + Iii1i / iI1iII1I1I1i - ii % Oo / iI1iII1I1I1i
   if iiiiiIIIIi1 not in o0000o :
    o0000o [ iiiiiIIIIi1 ] = [ ]
    if 14 - 14: Iii1i . Ii
    if 100 - 100: I1I / ooo000
   for o0Ooooo0Ooo in oo0 :
    if 43 - 43: Ii
    if 60 - 60: I1Ii1I1
    if 74 - 74: ooo000 * Iii1i - Ooo0Ooo - I1Ii1I1
    oOOO = Ii111 ( o0Ooooo0Ooo )
    if 20 - 20: IIi1i111IiII
    if not oOOO . is_cert ( ) :
     OOOO0O0ooO0O ( "Invalid cert on user %s" % iI11iIi1I1 )
     continue
     if 80 - 80: oOo0O00 / Ooo0Ooo - IIiIIiIi11I1 % i1i1i1111I . ooOOO
    if not iI :
     ( oo00o00o , O0OO00OOO ) = I1iIII111Ii ( oOOO )
     if not oo00o00o :
      i1I11ii ( " Disallowing use of certificate %s" % oOOO [ 'subject' ] )
      i1IIiII11 ( "  Certificate issued by CA %s." % ( oOOO [ 'issuer' ] ) )
      i1IIiII11 ( "  Certificate found on %s." % iI11iIi1I1 )
      i1I11ii ( " Reason: %s" % O0OO00OOO )
      continue
      if 24 - 24: i1iiIII111
    o0000o [ iiiiiIIIIi1 ] += [ oOOO ]
    if 77 - 77: ooOOO . Ii
    if 61 - 61: iiI + I1Ii1I1 / i1 . i1 * ooOOO
  i1I11ii ( "Found %d users, %d users with certificates in LDAP" % ( len ( o0000o ) ,
 len ( [ x for x in o0000o if len ( o0000o [ x ] ) > 0 ] ) ) )
  if 69 - 69: i1 . ooo000 % I1Ii1I1 + i1 / i1iiIII111 % IiIIii11Ii
 elif Ii1 == 'novell_certificate_subjectname' :
  i1I11ii ( "Certificates are matched to users using subject names" )
  if 76 - 76: IiIIii11Ii
  if 73 - 73: iiI / IIiIIiIi11I1 / oOo0O00 % IIiIIiIi11I1 / Ii
  if 12 - 12: i1
  if 78 - 78: O0OooooOo . IIiIIiIi11I1
  if 1 - 1: I1I % i1iiIII111 / I1Ii1I1
  ooiIiI11I1iI = ooOooO0 . get_string ( "/utils/tl-ldap-certalias/certs/uri" , '' )
  Oo0O = ooOooO0 . get_string ( "/utils/tl-ldap-certalias/certs/base" , '' )
  O000 = ooOooO0 . get_string ( "/utils/tl-ldap-certalias/certs/binddn" , '' )
  o0oOO00Ooo0o = ooOooO0 . get_string ( "/utils/tl-ldap-certalias/certs/bindpw" , '' )
  o0O0 = ooOooO0 . get_string ( "/utils/tl-ldap-certalias/certs/filter" ,
 "(userCertificate=*)" )
  if 29 - 29: Oo % OooOoo - i1i1i1111I + IiIIii11Ii / I1Ii1I1 + i1i1i1111I
  i1I11ii ( "Searching for users on %s/%s" % ( ooooo0O0O00 , III1I11iiIiI1 ) )
  if 91 - 91: i1iiIII111 * Iii1i - I1I + i1i1i1111I / ooOOO + Oo
  if 93 - 93: Ii
  o0ooo0oOoO = tl_ldap_iterator . search ( uri = ooooo0O0O00 ,
 base = III1I11iiIiI1 ,
 user = ii1Ii ,
 password = O00O ,
 filter = i1I11iI1 )
  if 50 - 50: Ooo0Ooo * Ooo0Ooo / ooo000 - IiIIii11Ii
  if not o0ooo0oOoO :
   OOOO0O0ooO0O ( "Unable to obtain list of users, exiting" )
   return 1
   if 70 - 70: IIiIIiIi11I1 . i1 % iI1iII1I1I1i / i1i1i1111I
  IIoOo = list ( o0ooo0oOoO )
  if 49 - 49: i1i1i1111I * ii
  i1I11ii ( "Found %d users in LDAP database" % len ( IIoOo ) )
  if 12 - 12: IIi1i111IiII % Iii1i - Ooo0Ooo
  if 84 - 84: Ooo0Ooo % I1Ii1I1
  for I1Ii11i in IIoOo :
   iI11iIi1I1 , o0oOO = I1Ii11i
   iiiiiIIIIi1 = int ( o0oOO [ 'uidNumber' ] [ 0 ] )
   o0000o [ iiiiiIIIIi1 ] = [ ]
   if 7 - 7: i1iiIII111
  i1I11ii ( "Searching for certificates on %s/%s" % ( ooiIiI11I1iI , Oo0O ) )
  if 27 - 27: ii - ii
  OoooO0 = tl_ldap_iterator . search ( uri = ooiIiI11I1iI ,
 base = Oo0O ,
 user = O000 ,
 password = o0oOO00Ooo0o ,
 filter = o0O0 )
  if 71 - 71: Ii / Iii1i + i1i1i1111I - oOo0O00
  if not OoooO0 :
   OOOO0O0ooO0O ( "Unable to obtain list of certificates, exiting" )
   return 1
   if 85 - 85: IIiIIiIi11I1 % Oo / I1I . oOo0O00 / IIiIIiIi11I1 . Oo
  OO0Oo00Oo = list ( OoooO0 )
  if 48 - 48: I1Ii1I1 + Ii - iI1iII1I1I1i + iI1iII1I1I1i
  i1I11ii ( "Found %d certificates in LDAP database" % len ( OO0Oo00Oo ) )
  if 34 - 34: iiI + Ii
  for i1I in OO0Oo00Oo :
   if 70 - 70: i1 % Ii % O0OooooOo - Ooo0Ooo
   if 69 - 69: iiI - IIiIIiIi11I1 / i1i1i1111I + Ii - iiI % O0OooooOo
   if 74 - 74: OooOoo % iI1iII1I1I1i . I1Ii1I1 / I1I / Ii / Ooo0Ooo
   if 11 - 11: I1I - OooOoo * ooOOO % i1i1i1111I + ooo000 . ii
   if 51 - 51: ooOOO + iI1iII1I1I1i % IIi1i111IiII . O0OooooOo % Ooo0Ooo
   if 15 - 15: OooOoo / iiI % Oo % Oo
   ( iI11iIi1I1 , o0oOO ) = i1I
   if 73 - 73: oOo0O00
   if 'userCertificate;binary' in o0oOO :
    oo0 = o0oOO [ 'userCertificate;binary' ]
   elif 'userCertificate' in o0oOO :
    oo0 = o0oOO [ 'userCertificate' ]
   else :
    if 69 - 69: ooOOO - IIiIIiIi11I1 - iiI
    if 78 - 78: I1Ii1I1 . ooo000 + IIi1i111IiII / IIi1i111IiII
    if 88 - 88: Ii - i1iiIII111 - i1 * IIiIIiIi11I1 . IiIIii11Ii + Iii1i
    continue
    if 44 - 44: ooOOO + Oo - i1
   for oOOO in [ Ii111 ( x ) for x in oo0 ] :
    if 18 - 18: iI1iII1I1I1i * ooOOO + Ooo0Ooo
    if 78 - 78: I1I . I1I - IIiIIiIi11I1 - IiIIii11Ii % O0OooooOo . I1Ii1I1
    if 9 - 9: O0OooooOo * OooOoo - O0OooooOo
    if not iI :
     ( oo00o00o , O0OO00OOO ) = I1iIII111Ii ( oOOO )
     if not oo00o00o :
      i1I11ii ( " Disallowing use of certificate %s" % oOOO [ 'subject' ] )
      i1IIiII11 ( "  Certificate issued by CA %s." % ( oOOO [ 'issuer' ] ) )
      i1IIiII11 ( "  Certificate found on %s." % iI11iIi1I1 )
      i1I11ii ( " Reason: %s" % O0OO00OOO )
      continue
      if 73 - 73: I1Ii1I1
    i1IIiII11 ( "Searching for users allowing use of certificate with subject:" )
    i1IIiII11 ( "(rfc4514) %s" % oOOO [ 'subject' ] )
    i1IIiII11 ( " (novell) %s" % oOOO [ 'novellsubject' ] )
    if 25 - 25: i1 . Ii
    if 59 - 59: IiIIii11Ii
    if 91 - 91: IiIIii11Ii + iI1iII1I1I1i
    if 65 - 65: Oo * Iii1i * IiIIii11Ii / IIiIIiIi11I1
    if 77 - 77: IIiIIiIi11I1 / ii % IiIIii11Ii + I1Ii1I1
    if 34 - 34: i1i1i1111I * Iii1i + Ii - iiI / i1 / i1
    def II1i1iIi1i1i ( user ) :
     iI11iIi1I1 , o0oOO = user [ 0 ]
     if 29 - 29: oOo0O00 % ooOOO * Ooo0Ooo
     if 'sasAllowableSubjectNames' not in o0oOO :
      return False
      if 49 - 49: ooOOO - iI1iII1I1I1i / oOo0O00
     for o0 in o0oOO [ 'sasAllowableSubjectNames' ] :
      if o0 == oOOO [ 'subject' ] :
       return True
      elif o0 == oOOO [ 'novellsubject' ] :
       return True
       if 85 - 85: IIi1i111IiII % oOo0O00 % oOo0O00
     return False
     if 88 - 88: IIiIIiIi11I1
    I1III1 = list ( filter ( II1i1iIi1i1i , IIoOo ) )
    i1IIiII11 ( "%d users are allowed to use certificate for login" % len ( I1III1 ) )
    if 92 - 92: I1I + O0OooooOo / Ii / ooo000 % i1iiIII111 * OooOoo
    for IIIII1 in I1III1 :
     iI11iIi1I1 , o0oOO = IIIII1 [ 0 ]
     i1IIiII11 ( "  %s" % iI11iIi1I1 )
     iiiiiIIIIi1 = int ( o0oOO [ 'uidNumber' ] [ 0 ] )
     if not iiiiiIIIIi1 in o0000o :
      o0000o [ iiiiiIIIIi1 ] = [ ]
      if 5 - 5: iiI * i1iiIII111 / i1 * ii * IIiIIiIi11I1
     o0000o [ iiiiiIIIIi1 ] += [ oOOO ]
     if 86 - 86: oOo0O00 % ii / I1Ii1I1
     if 38 - 38: IIiIIiIi11I1
 else :
  if 17 - 17: ii + i1iiIII111 / i1i1i1111I * IiIIii11Ii / oOo0O00 / Ooo0Ooo
  OOOO0O0ooO0O ( "configuration: /utils/tl-ldap-certalias/certificate_user_match does not allow value \"%s\"" % Ii1 )
  return 1
  if 43 - 43: iiI + iI1iII1I1I1i + Oo
  if 61 - 61: iiI
  if 75 - 75: IIiIIiIi11I1 . O0OooooOo / ooo000 . oOo0O00 % Ooo0Ooo
  if 7 - 7: I1I / i1iiIII111
  if 53 - 53: OooOoo - I1Ii1I1 + IIiIIiIi11I1 . I1Ii1I1 + i1iiIII111
  if 82 - 82: Iii1i
  if 58 - 58: I1Ii1I1 / I1Ii1I1 % IIiIIiIi11I1
  if 98 - 98: OooOoo
  if 79 - 79: Ooo0Ooo * Ooo0Ooo - ooo000 - Iii1i
  if 5 - 5: IiIIii11Ii / i1iiIII111 . I1I % Iii1i . i1
  if 29 - 29: oOo0O00 + Oo / O0OooooOo - oOo0O00 % i1i1i1111I / Ii
  if 39 - 39: O0OooooOo - O0OooooOo % i1iiIII111
  if 56 - 56: i1iiIII111 / IiIIii11Ii - I1Ii1I1 / Iii1i - i1 / OooOoo
  if 28 - 28: iiI . I1Ii1I1 % IiIIii11Ii . Ii * ooOOO - ii
 for ii1ii1iIIIi1 in o0000o :
  try :
   Ooo000oOO0o00 = pwd . getpwuid ( ii1ii1iIIIi1 )
  except KeyError :
   if 35 - 35: OooOoo % Oo - IIi1i111IiII % oOo0O00 . Oo
   if 14 - 14: IIi1i111IiII / ooOOO / I1I % IiIIii11Ii
   if 91 - 91: I1Ii1I1 + ii . I1I - IIiIIiIi11I1
   if 43 - 43: Iii1i . i1i1i1111I
   if 15 - 15: IIiIIiIi11I1 * i1i1i1111I / i1i1i1111I % Oo * ooOOO
   OOOO0O0ooO0O ( "No user with uid %d exists on system! Possible misconfiguration detected." % ( ii1ii1iIIIi1 ) )
   continue
   if 83 - 83: oOo0O00 - ooOOO
  ooo = Ooo000oOO0o00 . pw_name
  OOO0ooooo00o = Ooo000oOO0o00 . pw_gid
  O0O0oOOoo = Ooo000oOO0o00 . pw_dir
  OOO0OO0oo = os . path . join ( O0O0oOOoo , ".ssh" )
  iiI1 = os . path . join ( OOO0OO0oo , "authorized_keys" )
  O0OO = os . path . join ( OOO0OO0oo , "authorized_keys.lock" )
  if 79 - 79: OooOoo
  if 62 - 62: Ooo0Ooo . Ii - ooOOO . i1iiIII111
  if 2 - 2: O0OooooOo * iiI * iiI * i1iiIII111 / O0OooooOo % IIi1i111IiII
  if 13 - 13: i1 * IiIIii11Ii - ooo000 * OooOoo
  ii1IIiiIIiII = [ ]
  if 7 - 7: ii / ooo000 * i1 - iI1iII1I1I1i . iI1iII1I1I1i
  i1I11ii ( "Handling uid %d (%s)" % ( ii1ii1iIIIi1 ,
 ooo ) )
  if 74 - 74: IIiIIiIi11I1 . i1iiIII111 - IIiIIiIi11I1 . Iii1i
  for oO0Ooo in o0000o [ ii1ii1iIIIi1 ] :
   if 14 - 14: Ii - ii % i1i1i1111I . IIi1i111IiII
   if not iI :
    ( oo00o00o , O0OO00OOO ) = I1iIII111Ii ( oO0Ooo )
    if not oo00o00o :
     i1I11ii ( " Disallowing use of certificate %s" % oO0Ooo [ 'subject' ] )
     i1IIiII11 ( "  Certificate issued by CA %s." % ( oO0Ooo [ 'issuer' ] ) )
     i1IIiII11 ( "  Certificate found on user %s" % ooo )
     i1I11ii ( " Reason: %s" % O0OO00OOO )
     continue
     if 80 - 80: O0OooooOo + I1I % iI1iII1I1I1i * IiIIii11Ii + i1 . iI1iII1I1I1i
   O0O0Ooo0ooOO0 = IIiI1II1i11i11I ( oO0Ooo [ 'pubkey' ] [ 1 ] [ 'exponent' ] ,
 oO0Ooo [ 'pubkey' ] [ 1 ] [ 'modulus' ] ,
 IiI11Ii111 )
   if 38 - 38: IiIIii11Ii % Oo * I1Ii1I1 . OooOoo - Ooo0Ooo
   ii1IIiiIIiII . append ( O0O0Ooo0ooOO0 )
   if 14 - 14: I1I % Oo / ooo000
  i1IIiII11 ( "%d usable keys from LDAP" % len ( ii1IIiiIIiII ) )
  if 28 - 28: i1iiIII111 / Ooo0Ooo . iiI . Oo
  if 99 - 99: iiI - OooOoo % Iii1i - O0OooooOo
  if 95 - 95: ii
  if 56 - 56: O0OooooOo - iiI / OooOoo / ooo000 . IIi1i111IiII
  if 78 - 78: ooo000 % IIi1i111IiII - i1
  if 36 - 36: oOo0O00 + OooOoo - Ooo0Ooo / IIi1i111IiII
  O000ooo00O0O0 = None
  try :
   os . stat ( iiI1 )
   O000ooo00O0O0 = True
  except OSError as o00ooo0OO0000 :
   if 17 - 17: I1Ii1I1 * ii % i1iiIII111 * Oo * ii + IIiIIiIi11I1
   if 75 - 75: Ooo0Ooo * ii * Ooo0Ooo + O0OooooOo . Oo
   if 4 - 4: Ii / Ii * ooOOO / I1Ii1I1
   if 37 - 37: OooOoo + oOo0O00 . ii / IiIIii11Ii . Oo - IIi1i111IiII
   if 87 - 87: i1 % ii * i1 - oOo0O00 % Ii * ooo000
   if o00ooo0OO0000 . errno == errno . ENOENT :
    O000ooo00O0O0 = False
    if 50 - 50: i1iiIII111 * Ii % ooOOO . I1I
    if 80 - 80: IiIIii11Ii / ii % IIi1i111IiII * I1I
   elif o00ooo0OO0000 . errno == errno . EACCES :
    OOOO0O0ooO0O ( "Permission denied reading %s" % iiI1 )
    OOOO0O0ooO0O ( "tl-ldap-certalias needs to read the user authorized_keys file to be able" )
    OOOO0O0ooO0O ( "to add and remove valid and invalid certificates from LDAP." )
    return errno . EACCES
    if 100 - 100: oOo0O00 / I1Ii1I1 - i1i1i1111I * I1Ii1I1 / O0OooooOo * Oo
   else :
    OOOO0O0ooO0O ( "Unhandled error: %s" % str ( o00ooo0OO0000 ) )
    return o00ooo0OO0000 . errno
    if 49 - 49: Ooo0Ooo
    if 36 - 36: OooOoo + iiI / Iii1i + iI1iII1I1I1i + OooOoo
    if 6 - 6: IIi1i111IiII + Ii
    if 100 - 100: oOo0O00 % iiI - IiIIii11Ii % i1iiIII111 . i1 % I1Ii1I1
    if 67 - 67: O0OooooOo
    if 21 - 21: ii % i1i1i1111I - i1 + I1I
    if 85 - 85: IiIIii11Ii + I1I + IIi1i111IiII
    if 68 - 68: Iii1i % IiIIii11Ii . i1 - IIi1i111IiII
    if 80 - 80: i1iiIII111 . ooo000
  I11Ii1 = [ ]
  OoO0oO0oo = False
  if 22 - 22: Iii1i % i1i1i1111I * I1I / Ooo0Ooo * Oo
  if O000ooo00O0O0 :
   Ii11iiI1Iiii = open ( iiI1 , 'rt' )
   i1i1iI = Ii11iiI1Iiii . readlines ( )
   Ii11iiI1Iiii . close ( )
   if 53 - 53: ooo000 - i1iiIII111 - ooo000 . Oo
   for i1i1IiII11iI1 in i1i1iI :
    if 69 - 69: IIi1i111IiII
    if 9 - 9: Ii % i1i1i1111I * O0OooooOo + oOo0O00 . oOo0O00 * IIi1i111IiII
    if len ( i1i1IiII11iI1 . strip ( ) ) == 0 :
     continue
     if 12 - 12: ooo000 - Iii1i - IIiIIiIi11I1
     if 21 - 21: OooOoo / ooo000 * oOo0O00 % OooOoo * oOo0O00
     if 87 - 87: IiIIii11Ii * ii . OooOoo % Ii . iiI . IIi1i111IiII
     if 51 - 51: i1i1i1111I % I1I + IiIIii11Ii * Ooo0Ooo / O0OooooOo
     if 19 - 19: i1 / IIi1i111IiII
     if 33 - 33: I1Ii1I1 . iiI
     if 7 - 7: ii - oOo0O00 . i1i1i1111I * Oo + I1I
    if i1i1IiII11iI1 . rfind ( IiI11Ii111 ) == - 1 :
     I11Ii1 . append ( i1i1IiII11iI1 . rstrip ( ) )
    else :
     i1IIiII11 ( "Found key with magic comment, this file needs cleaning" )
     OoO0oO0oo = True
     if 93 - 93: i1iiIII111 - OooOoo + i1 * oOo0O00 . IIi1i111IiII
     if 9 - 9: IIiIIiIi11I1 + iI1iII1I1I1i
     if 43 - 43: oOo0O00 * iiI * iiI / IiIIii11Ii % i1iiIII111
     if 55 - 55: i1iiIII111 . i1
     if 29 - 29: Ooo0Ooo * IiIIii11Ii + i1iiIII111 / iI1iII1I1I1i - IiIIii11Ii - oOo0O00
     if 63 - 63: I1Ii1I1 . IIi1i111IiII * ooOOO . ii / I1I
     if 34 - 34: i1i1i1111I * i1i1i1111I * O0OooooOo . Iii1i * iiI % ooo000
  iI11I1iIIi = ( len ( I11Ii1 ) + len ( ii1IIiiIIiII ) ) > 0
  if 99 - 99: oOo0O00 * iI1iII1I1I1i / O0OooooOo % ooo000 . IiIIii11Ii
  if iI11I1iIIi :
   i1IIiII11 ( "User needs authorized keys file (%d existing keys, %d certs in ldap)" % ( len ( I11Ii1 ) , len ( ii1IIiiIIiII ) ) )
   if 65 - 65: i1
  if O000ooo00O0O0 :
   i1IIiII11 ( "User has authorized keys file" )
   if 79 - 79: O0OooooOo / iI1iII1I1I1i / I1Ii1I1 / iiI % OooOoo * IIiIIiIi11I1
  if len ( I11Ii1 ) > 0 :
   i1IIiII11 ( "User has pre-existing ssh keys" )
   if 46 - 46: i1
  if OoO0oO0oo :
   i1IIiII11 ( "Authorized keys file contain old tl-ldap-certalias keys" )
   if 98 - 98: i1i1i1111I / IiIIii11Ii + Ii / I1I
   if 67 - 67: IIiIIiIi11I1 - Ii - Ii
  if I11i :
   iI11I1iIIi = False
   OoO0oO0oo = False
   if 84 - 84: O0OooooOo . ooOOO * ooOOO
   if 75 - 75: I1Ii1I1 % ooo000 - iiI + i1i1i1111I * O0OooooOo
   if 33 - 33: O0OooooOo / IiIIii11Ii - IIiIIiIi11I1 + IIiIIiIi11I1
  if iI11I1iIIi and not O000ooo00O0O0 :
   if 78 - 78: O0OooooOo
   try :
    os . stat ( O0O0oOOoo )
   except OSError as o00ooo0OO0000 :
    if o00ooo0OO0000 . errno == errno . ENOENT :
     if 18 - 18: i1 / O0OooooOo . ooOOO * I1I
     i1I11ii ( "Creating home directory %s for user %s" % ( O0O0oOOoo , ooo ) )
     if 20 - 20: IiIIii11Ii / IIi1i111IiII
     if 92 - 92: i1
     OoO0OOo0o0Ooo = ooOooO0 . get_string ( "/vsmagent/make_homedir_mode" , "0700" )
     try :
      if 6 - 6: iiI % I1Ii1I1
      if 18 - 18: Ii % OooOoo % I1Ii1I1 . I1Ii1I1 + ooo000 % IIi1i111IiII
      if 73 - 73: oOo0O00 . I1I . IIi1i111IiII - IIiIIiIi11I1 - i1 / Ooo0Ooo
      if 77 - 77: I1Ii1I1 % IIi1i111IiII
      if OoO0OOo0o0Ooo [ 0 ] == '0' :
       o0OO00ooOOooo = int ( OoO0OOo0o0Ooo [ 1 : ] , 8 )
      else :
       o0OO00ooOOooo = int ( OoO0OOo0o0Ooo , 10 )
     except ValueError :
      OOOO0O0ooO0O ( "Invalid format of hiveconf variable /vsmagent/make_homedir_mode/: %s"
 % OoO0OOo0o0Ooo )
      o0OO00ooOOooo = 0o700
      if 26 - 26: Ooo0Ooo % IIi1i111IiII / I1Ii1I1 . IIi1i111IiII - IIi1i111IiII
     if not I11i :
      iI1 = oOo ( O0O0oOOoo , o0OO00ooOOooo , ii1ii1iIIIi1 , OOO0ooooo00o )
      if 17 - 17: Iii1i % Ooo0Ooo * Ooo0Ooo % Ii + O0OooooOo
      if 55 - 55: ooo000 - IiIIii11Ii
      if 76 - 76: iiI * Ooo0Ooo . ooOOO / i1 - oOo0O00 . IIi1i111IiII
      if 70 - 70: I1I + Iii1i . O0OooooOo % Oo
      if 67 - 67: ooo000
      if iI1 != 0 :
       OOOO0O0ooO0O ( "Failed to create home directory %s for user %s: error %d [%s]" %
 ( O0O0oOOoo , ooo , iI1 , errno . errorcode [ iI1 ] ) )
       continue
      else :
       i1I11ii ( "Created %s" % O0O0oOOoo )
       if 84 - 84: i1iiIII111 * Ooo0Ooo
       if 47 - 47: OooOoo
       if IiIiI1I :
        i1IIiII11 ( "Restoring SELinux context for path %s" % O0O0oOOoo )
        thinlinc . selinux . selinux_restorecon ( OOOO0O0ooO0O , O0O0oOOoo )
        if 55 - 55: ooOOO % ii + iiI - IIi1i111IiII + ooo000 + I1I
     else :
      i1I11ii ( "Simulating - will not create %s" % O0O0oOOoo )
      if 53 - 53: IIiIIiIi11I1 % IiIIii11Ii / ii % ooOOO - oOo0O00
    else :
     if 74 - 74: ooo000 * OooOoo * Oo
     if 96 - 96: I1Ii1I1 - Oo
     if 28 - 28: i1iiIII111 - IIi1i111IiII % Ii * ooo000 / Iii1i
     OOOO0O0ooO0O ( "Unhandled error while creating home directory: %s" % str ( o00ooo0OO0000 ) )
     return o00ooo0OO0000 . errno
     if 12 - 12: IIi1i111IiII - Ooo0Ooo
     if 12 - 12: ooOOO
   try :
    os . stat ( OOO0OO0oo )
   except OSError as o00ooo0OO0000 :
    if o00ooo0OO0000 . errno == errno . ENOENT :
     i1I11ii ( "%s missing, trying to create." % OOO0OO0oo )
     iI1 = oOo ( OOO0OO0oo , 0o700 , ii1ii1iIIIi1 , OOO0ooooo00o )
     if iI1 != 0 :
      OOOO0O0ooO0O ( "Failed to create %s: errno %d, %s" % ( OOO0OO0oo , iI1 , errno . errorcode [ iI1 ] ) )
      continue
     else :
      i1I11ii ( "Created %s" % OOO0OO0oo )
      if 29 - 29: IIi1i111IiII . ooo000 . ooo000
     if IiIiI1I :
      thinlinc . selinux . selinux_restorecon ( OOOO0O0ooO0O , OOO0OO0oo )
      if 79 - 79: oOo0O00 % IIi1i111IiII * I1Ii1I1 . IIiIIiIi11I1 * Iii1i - I1I
  if I11i :
   continue
   if 85 - 85: I1I + IIi1i111IiII . O0OooooOo % i1 * IIi1i111IiII
   if 22 - 22: IiIIii11Ii . Iii1i / i1i1i1111I / ooo000 + ooo000 + ooo000
   if 76 - 76: Iii1i % i1i1i1111I
   if 12 - 12: ii + IiIIii11Ii % ooOOO + IIi1i111IiII / I1I
   if 59 - 59: Iii1i % I1Ii1I1 + O0OooooOo - Oo
  if len ( ii1IIiiIIiII ) or OoO0oO0oo :
   if not IiII11i11II ( O0OO ) :
    i1I11ii ( "Unable to get exclusive lock for %s, skipping user" % ( iiI1 ) )
    continue
    if 72 - 72: O0OooooOo
   O0O = open ( iiI1 , 'wt' )
   if 69 - 69: iI1iII1I1I1i + iiI - i1 - iI1iII1I1I1i + iI1iII1I1I1i
   for i1i1IiII11iI1 in I11Ii1 + ii1IIiiIIiII :
    i1IIiII11 ( "  Writing key to file..." )
    O0O . write ( i1i1IiII11iI1 + "\n" )
   else :
    i1IIiII11 ( " Cleaning up old keys from authorized_keys file" )
    if 76 - 76: IIiIIiIi11I1
   O0O . close ( )
   if 15 - 15: ooo000 . i1 * i1
   os . chown ( iiI1 , ii1ii1iIIIi1 , OOO0ooooo00o )
   os . chmod ( iiI1 , 0o600 )
   if 41 - 41: O0OooooOo + Iii1i % ooOOO * i1
   if IiIiI1I :
    thinlinc . selinux . selinux_restorecon ( OOOO0O0ooO0O , iiI1 )
    if 37 - 37: ooo000
   if not o0oOo0o0ooooo ( O0OO ) :
    OOOO0O0ooO0O ( "Unable to release lock %s." )
    OOOO0O0ooO0O ( "A likely cause of this is multiple simultaneous tl-ldap-certalias" )
    OOOO0O0ooO0O ( "processes. If this is not the case, remove the lock file and try again." )
    return 1
    if 87 - 87: i1i1i1111I + I1Ii1I1 % i1iiIII111 - I1I + ooOOO % I1Ii1I1
    if 96 - 96: IIiIIiIi11I1 / I1I * i1 / I1I + I1I / i1
    if 80 - 80: Oo / i1i1i1111I . IIiIIiIi11I1
    if 79 - 79: ii
    if 6 - 6: IIi1i111IiII + IIiIIiIi11I1 + ooOOO % IIiIIiIi11I1
 i1I11ii ( "Done with dealing with users and certificates" )
 i1I11ii ( "Updating /etc/passwdaliases file" )
 if not I11i :
  try :
   i1ii11iIIIIiI , Ii1ii1II = tempfile . mkstemp ( prefix = ".passwdaliases." , dir = "/etc" )
  except OSError as o00ooo0OO0000 :
   if o00ooo0OO0000 . errno == errno . EPERM :
    OOOO0O0ooO0O ( "Failed to create new temporary file for passwdaliases" )
    return 1 ;
    if 70 - 70: O0OooooOo
  OoOo00OO0oo0 = ( "# This file is AUTOGENERATED by tl-ldap-certalias.\n"
 "# Do not modify, changes will be overwritten.\n" ) . encode ( locale . getpreferredencoding ( ) )
  os . write ( i1ii11iIIIIiI , OoOo00OO0oo0 )
  if 27 - 27: Oo % IiIIii11Ii + ooOOO % I1Ii1I1
  if 71 - 71: ooOOO / IIi1i111IiII - i1iiIII111
  for iiiiiIIIIi1 in o0000o :
   if 47 - 47: Ooo0Ooo - I1I
   if len ( o0000o [ iiiiiIIIIi1 ] ) == 0 :
    continue
    if 54 - 54: IiIIii11Ii + ooOOO - I1Ii1I1 - OooOoo % i1 % Oo
   for oO0Ooo in o0000o [ iiiiiIIIIi1 ] :
    i1IIiII11 ( "  Associating %s with uid %d" % ( oO0Ooo [ 'subject' ] , int ( iiiiiIIIIi1 ) ) )
    OOoOooo000O0O = "%s:%d\n" % ( oO0Ooo [ 'subject' ] , int ( iiiiiIIIIi1 ) )
    os . write ( i1ii11iIIIIiI , OOoOooo000O0O . encode ( locale . getpreferredencoding ( ) ) )
    if 93 - 93: ii / ooo000 - I1I
  os . fsync ( i1ii11iIIIIiI )
  os . close ( i1ii11iIIIIiI )
  os . chmod ( Ii1ii1II , 0o644 )
  os . rename ( Ii1ii1II , "/etc/passwdaliases" )
  if 19 - 19: IIiIIiIi11I1 / I1Ii1I1 . IIiIIiIi11I1 - O0OooooOo / i1iiIII111 % IIiIIiIi11I1
  if IiIiI1I :
   thinlinc . selinux . selinux_restorecon ( "/etc/passwdaliases" )
   if 39 - 39: iiI % ooo000 . Oo
 i1I11ii ( "Done, exiting." )
 return 0
 if 89 - 89: I1I . ooOOO
if "__main__" == __name__ :
 iI1 = OOo0o00o ( )
 if 61 - 61: iI1iII1I1I1i . i1iiIII111 * IiIIii11Ii + ii + ooOOO % IiIIii11Ii
 if iI1 != 0 :
  i1I11ii ( "tl-ldap-certalias returned error code %d" % iI1 )
  if 3 - 3: IiIIii11Ii . IIi1i111IiII * iiI / iiI
 sys . exit ( iI1 )
# dd678faae9ac167bc83abf78e5cb2f3f0688d3a3
