#!/opt/thinlinc/libexec/python3
# -*-mode: python; coding: utf-8 -*-
#
# Copyright 2002-2014 Cendio AB.
# For more information, see http://www.cendio.com
if 82 - 82: Iii1i
import io
import base64
import pickle
import calendar
import errno
import ldap
import os
import pwd
import string
import struct
import sys
import tempfile
import time
import urllib . request
import http . client
import re
import hashlib
import locale
import codecs
import subprocess
if 87 - 87: Ii % i1i1i1111I . Oo / OooOoo * I1Ii1I1 - I1I
from thinlinc import hiveconf
from thinlinc import prefix , tl_ldap_iterator
import thinlinc . crypto
import thinlinc . selinux
if 81 - 81: i1 + ooOOO / oOo0O00 * i1iiIII111 * IiIIii11Ii
from thinlinc . optionparse import OptionParser
from thinlinc . optcomplete import CompletionResult
from thinlinc . version import TL_VERSION
if 84 - 84: ooo000 - Ooo0Ooo + iI1iII1I1I1i . IIiIIiIi11I1
iI111iiIi11i = 10
OoOoo0o = False
I1i = False
IiI11Ii111 = "thinlinc-ldap-publickey"
if 26 - 26: O0OooooOo + ii % iiI * IIi1i111IiII . Oo / Oo
OOO0o000 = "/opt/thinlinc/etc/ca/"
i1Iiiii1 = { }
ooOOooO0 = "/var/opt/thinlinc/utils/tl-ldap-certalias/crlcache/"
i1iiiiIIIiIi = 1
II = { }
if 34 - 34: Ooo0Ooo + ii * IIiIIiIi11I1 * OooOoo
class Ii111 :
 if 8 - 8: Ii + iiI . O0OooooOo - I1Ii1I1 % O0OooooOo . i1i1i1111I
 if 24 - 24: IIi1i111IiII
 if 9 - 9: ooo000 / iiI . iiI / Ii % i1i1i1111I % Ooo0Ooo
 if 85 - 85: O0OooooOo % ooOOO + i1iiIII111 / ooOOO / ooo000
 raw = None
 if 17 - 17: oOo0O00 * i1iiIII111 - Iii1i . IIi1i111IiII - Oo % i1i1i1111I
 if 69 - 69: ooOOO % OooOoo
 contents = { }
 if 45 - 45: i1
 def __init__ ( self , cert ) :
  if isinstance ( cert , bytes ) :
   self . raw = cert
   if 48 - 48: iI1iII1I1I1i / oOo0O00 % IIi1i111IiII
  self . contents = IiiIii11iII1 ( self . raw )
  if 27 - 27: I1I + ooOOO * IIiIIiIi11I1 % Ii + Ooo0Ooo . ooOOO
 def is_cert ( self ) :
  return self . contents is not None
  if 6 - 6: i1iiIII111
 def __getitem__ ( self , item ) :
  try :
   if 99 - 99: ooOOO * I1Ii1I1
   if 95 - 95: Ooo0Ooo % Iii1i % i1i1i1111I . OooOoo
   return self . contents [ item ]
  except :
   raise AttributeError
   if 70 - 70: IiIIii11Ii
   if 75 - 75: Ooo0Ooo / Ii / IiIIii11Ii + IiIIii11Ii . I1I
def i1I11ii ( s ) :
 if not OoOoo0o :
  if 21 - 21: Iii1i - I1Ii1I1
  return
 s = s . encode ( locale . getpreferredencoding ( ) , errors = "replace" ) . decode ( locale . getpreferredencoding ( ) , errors = "replace" )
 if 95 - 95: i1 - I1Ii1I1 + Oo
 print ( "tl-ldap-certalias:  INFO:" , s )
 if 49 - 49: IIiIIiIi11I1
 if 29 - 29: IiIIii11Ii - oOo0O00
def i1IIiII11 ( s ) :
 if not I1i :
  if 52 - 52: i1iiIII111 % Oo . I1Ii1I1 + ooOOO % Oo . IIi1i111IiII
  return
 s = s . encode ( locale . getpreferredencoding ( ) , errors = "replace" ) . decode ( locale . getpreferredencoding ( ) , errors = "replace" )
 if 56 - 56: i1iiIII111 * IIi1i111IiII - O0OooooOo
 print ( "tl-ldap-certalias: DEBUG:" , s )
 if 15 - 15: I1I % Ii + Ooo0Ooo * Iii1i
 if 67 - 67: I1I * Ooo0Ooo + i1iiIII111 . i1iiIII111 % Oo
def OOOO0O0ooO0O ( s ) :
 s = s . encode ( locale . getpreferredencoding ( ) , errors = "replace" ) . decode ( locale . getpreferredencoding ( ) , errors = "replace" )
 if 87 - 87: IIi1i111IiII / oOo0O00 % ii - oOo0O00 . I1I + Ooo0Ooo
 if 75 - 75: i1iiIII111 * iI1iII1I1I1i - I1I - IIiIIiIi11I1 % I1Ii1I1
 print ( "tl-ldap-certalias: ERROR:" , s , file = sys . stderr )
 if 85 - 85: oOo0O00
 if 66 - 66: IIi1i111IiII * i1i1i1111I + oOo0O00 / I1I / Iii1i / Ii
def IiII11i11II ( filename ) :
 o00o = time . time ( )
 if 97 - 97: Ooo0Ooo
 i1Ii1iiIiI111 = o00o + iI111iiIi11i
 while True :
  O00O0Oo0OOO = time . time ( )
  if O00O0Oo0OOO > i1Ii1iiIiI111 :
   i1I11ii ( "Timeout while waiting for lock %s!" % filename )
   return False
   if 97 - 97: ooOOO * O0OooooOo
  if not os . path . exists ( os . path . dirname ( filename ) ) :
   i1I11ii ( "Failed to create lock in inexisting folder" )
   return False
   if 63 - 63: ooOOO / i1i1i1111I - oOo0O00 * ooOOO / i1iiIII111 + ii
  if os . path . exists ( filename ) :
   i1I11ii ( "Waiting for lockfile %s..." % filename )
   time . sleep ( 3 )
   continue
  else :
   if 11 - 11: i1 / ooo000
   with open ( filename , "w+t" ) as iII :
    OooOO00o = "%s:%d" % ( os . getenv ( "HOSTNAME" , "unknown host" ) ,
 os . getpid ( ) )
    iII . write ( OooOO00o )
    iII . flush ( )
    os . fsync ( iII . fileno ( ) )
    if 98 - 98: IIiIIiIi11I1 - IiIIii11Ii . ooo000 + ii - ii
    if 78 - 78: i1 - ooOOO
    if 56 - 56: ooo000 . ooo000 + I1Ii1I1 * iI1iII1I1I1i
   with open ( filename , 'rt' ) as i111ii1I :
    if i111ii1I . readline ( ) . find ( OooOO00o ) == - 1 :
     i1I11ii ( "Oops, someone stole our lock! Waiting for it again.." )
     continue
  i1IIiII11 ( "Acquired lock %s" % filename )
  return True
  if 18 - 18: Ii / ooo000 + I1I + iI1iII1I1I1i
  if 42 - 42: ooOOO - ooOOO - i1i1i1111I
def o0oOo0o0ooooo ( filename ) :
 iI1i = None
 if 73 - 73: ooOOO - IiIIii11Ii
 if 22 - 22: Oo % oOo0O00 / iiI . oOo0O00 . iiI
 try :
  with open ( filename , 'rt' ) as iI1i :
   ( Ooo000oo0O00o , II1Ii11IiI ) = iI1i . readline ( ) . strip ( ) . split ( ":" )
   oO0O0oOo = int ( II1Ii11IiI )
   if 94 - 94: ooOOO * ii % iI1iII1I1I1i - iiI - ooOOO
   oOO = os . getenv ( "HOSTNAME" , "unknown host" )
   if 32 - 32: IIi1i111IiII % ooo000 * Iii1i + IIiIIiIi11I1
   if oOO != Ooo000oo0O00o or oO0O0oOo != os . getpid ( ) :
    i1I11ii ( "lock %s is owned by process %d on host %s, won't release" % ( filename , oO0O0oOo , Ooo000oo0O00o ) )
    return False
 except FileNotFoundError :
  i1IIiII11 ( "Releasing a non-existant lock %s" % ( filename ) )
  return True
  if 42 - 42: I1I - IiIIii11Ii
 i1IIiII11 ( "Releasing lock %s" % filename )
 os . unlink ( filename )
 return True
 if 34 - 34: IIi1i111IiII + ooOOO * ii
 if 2 - 2: i1i1i1111I / Ooo0Ooo / ii - IIiIIiIi11I1 / IIiIIiIi11I1
def oOo ( directory , mode , owner , group ) :
 try :
  if 52 - 52: oOo0O00 / iiI * IIiIIiIi11I1 + O0OooooOo % Ooo0Ooo + ii
  if 43 - 43: iI1iII1I1I1i * oOo0O00 + ooOOO
  os . mkdir ( directory , mode )
  os . chown ( directory , int ( owner ) , int ( group ) )
  return 0
  if 30 - 30: I1I
 except OSError as o00ooo0OO0000 :
  if o00ooo0OO0000 . errno == errno . ENOENT :
   OOOO0O0ooO0O ( "parent directory of %s does not exist" % directory )
  elif o00ooo0OO0000 . errno == errno . EACCES :
   OOOO0O0ooO0O ( "parent directory of %s is not writable" % directory )
  else :
   OOOO0O0ooO0O ( "unhandled error %s (%d) trying to create directory %s" % ( errno . errorcode [ o00ooo0OO0000 . errno ] ,
 o00ooo0OO0000 . errno ,
 directory ) )
  return o00ooo0OO0000 . errno
  if 37 - 37: I1I
  if 38 - 38: I1Ii1I1 + oOo0O00
class iii1I1 ( Exception ) :
 pass
 if 17 - 17: Oo - iiI . IIiIIiIi11I1 + iI1iII1I1I1i - I1Ii1I1 + Ii
 if 33 - 33: i1i1i1111I . IIiIIiIi11I1 - iiI . Ii
 if 20 - 20: oOo0O00 % i1i1i1111I
def IiiIii11iII1 ( certfile ) :
 if 32 - 32: ii
 if 98 - 98: IIi1i111IiII % i1 % ooo000 % iI1iII1I1I1i
 OOO00o00oo0 = subprocess . PIPE
 Iiiii1iiiII1 = None
 if 77 - 77: Ii + oOo0O00 / oOo0O00 * iI1iII1I1I1i
 if isinstance ( certfile , io . BufferedIOBase ) :
  if 10 - 10: ooOOO / iiI * I1I * Oo - i1 % OooOoo
  OOO00o00oo0 = certfile
 elif isinstance ( certfile , bytes ) :
  Iiiii1iiiII1 = certfile
  if 35 - 35: Ii . I1Ii1I1
 with subprocess . Popen ( [ os . path . join ( prefix . get_tl_prefix ( ) , "libexec" , "tl-certtool" ) ,
 "--subject" ,
 "--novellsubject" ,
 "--issuer" ,
 "--serial" ,
 "--is-ca" ,
 "--expiry" ,
 "--pubkey" ,
 "--signature" ,
 "--crl" ] ,
 stdin = OOO00o00oo0 ,
 stdout = subprocess . PIPE ,
 stderr = subprocess . PIPE ) as OoO0O0OO0 :
  if 70 - 70: i1i1i1111I - Ii % i1iiIII111 - IIi1i111IiII
  if 33 - 33: i1i1i1111I
  if 30 - 30: iiI % ooOOO . Ii % IIiIIiIi11I1 / iI1iII1I1I1i % ooOOO
  if 24 - 24: IIiIIiIi11I1 - IIiIIiIi11I1 . Ooo0Ooo + i1iiIII111 + Oo
  ( I1II1I1i , oOOoO0o ) = OoO0O0OO0 . communicate ( input = Iiiii1iiiII1 )
  I1II1I1i = I1II1I1i . decode ( locale . getpreferredencoding ( False ) )
  oOOoO0o = oOOoO0o . decode ( locale . getpreferredencoding ( False ) )
  if 85 - 85: Ooo0Ooo - I1I . IiIIii11Ii % IIiIIiIi11I1 % iI1iII1I1I1i
  if OoO0O0OO0 . returncode != 0 :
   OOOO0O0ooO0O ( "Failed to load certificate..." )
   if "" != oOOoO0o :
    print ( "stderr from tl-certtool: " , oOOoO0o , file = sys . stderr )
   return None
   if 98 - 98: I1I
  I1II1I1i = I1II1I1i . splitlines ( )
  oO0Ooo = { }
  if 81 - 81: I1Ii1I1 / ii + ii . i1i1i1111I - i1
  try :
   if 15 - 15: OooOoo . oOo0O00 - ooOOO % Ooo0Ooo
   oO0Ooo [ "subject" ] = I1II1I1i [ 0 ] . strip ( )
   if 62 - 62: iI1iII1I1I1i / OooOoo % I1I - IIi1i111IiII
   if 66 - 66: i1i1i1111I / Ooo0Ooo + O0OooooOo + Iii1i + oOo0O00 + iiI
   oO0Ooo [ "novellsubject" ] = I1II1I1i [ 1 ] . rstrip ( "\n" )
   if 75 - 75: OooOoo - ii - IiIIii11Ii - ii + ooo000 % iI1iII1I1I1i
   if 42 - 42: i1 * iiI
   oO0Ooo [ "issuer" ] = I1II1I1i [ 2 ] . strip ( )
   if 50 - 50: Ii - i1iiIII111
   if 96 - 96: ooo000 * OooOoo - Ii - OooOoo
   oO0Ooo [ "serial" ] = I1II1I1i [ 3 ] . strip ( )
   if 65 - 65: Oo + Oo - iI1iII1I1I1i % OooOoo . Ooo0Ooo
   if 84 - 84: IIiIIiIi11I1 . ooOOO
   oO0Ooo [ "is_ca" ] = I1II1I1i [ 4 ] . strip ( ) == "1"
   if 44 - 44: ooo000 * i1i1i1111I * ii + i1iiIII111 - IIiIIiIi11I1
   if 70 - 70: IIi1i111IiII
   i1Ii1iIi11iI = I1II1I1i [ 5 ] . strip ( ) . split ( " " )
   oO0Ooo [ "expiry" ] = ( IioOOOoo ( i1Ii1iIi11iI [ 0 ] ) ,
 IioOOOoo ( i1Ii1iIi11iI [ 1 ] ) )
   if 68 - 68: I1Ii1I1 % I1Ii1I1 / IIi1i111IiII . ooo000
   if 80 - 80: IIiIIiIi11I1 / OooOoo % iI1iII1I1I1i / ooOOO * ooOOO - Iii1i
   O0ooOO0O0O0O = I1II1I1i [ 6 ] . strip ( ) . split ( " " )
   if O0ooOO0O0O0O [ 0 ] != "rsa" :
    print ( "Unknown algorithm %s for certificate, skipping..." % O0ooOO0O0O0O [ 0 ] , file = sys . stderr )
    return None
    if 59 - 59: ooo000 / Oo - i1
   oO0Ooo [ "pubkey" ] = ( "rsa" , { "exponent" : codecs . decode ( O0ooOO0O0O0O [ 1 ] , "hex" ) ,
 "modulus" : codecs . decode ( O0ooOO0O0O0O [ 2 ] , "hex" ) } )
   if 49 - 49: iiI + oOo0O00 + ooo000 . Iii1i + iiI
   if 88 - 88: IIi1i111IiII . IIiIIiIi11I1 * i1 + IiIIii11Ii % I1I / IIi1i111IiII
   oo00oOOo0O0o = I1II1I1i [ 7 ] . strip ( ) . split ( " " )
   oO0Ooo [ "signature" ] = ( oo00oOOo0O0o [ 0 ] , codecs . decode ( oo00oOOo0O0o [ 1 ] , "hex" ) )
   if 12 - 12: Ooo0Ooo + I1I / OooOoo
   if 70 - 70: O0OooooOo % I1Ii1I1 + ooOOO
   oO0Ooo [ "crl" ] = [ ]
   for OOoOooo000O0O in I1II1I1i [ 8 : ] :
    oO0Ooo [ "crl" ] . append ( OOoOooo000O0O . strip ( ) )
  except :
   print ( "Internal error parsing certificate, skipping..." , file = sys . stderr )
   return None
   if 12 - 12: ooOOO . Oo % IiIIii11Ii - ooOOO
  return oO0Ooo
  if 75 - 75: IiIIii11Ii * i1 . Iii1i - IIi1i111IiII
def oo0O0O0Ooooo ( ) :
 if 39 - 39: Oo . ii / ooo000 / iI1iII1I1I1i
 if 48 - 48: ii * iiI - OooOoo * Oo - IIi1i111IiII - Ooo0Ooo
 global i1Iiiii1
 if 36 - 36: IiIIii11Ii
 i1Iiiii1 = { }
 for IiIi1I11I in os . listdir ( OOO0o000 ) :
  IiiIi1 = os . path . join ( OOO0o000 , IiIi1I11I )
  if os . path . isdir ( IiiIi1 ) :
   continue
   if 28 - 28: IIi1i111IiII * Ii . i1 + iiI / i1i1i1111I / ii
  with open ( IiiIi1 , "rb" ) as iIi1i :
   o0Oo = IiiIii11iII1 ( iIi1i )
   if o0Oo is None :
    continue
    if 15 - 15: OooOoo . IiIIii11Ii . iiI / Iii1i + ooOOO / Ii
   if not o0Oo [ "is_ca" ] :
    print ( "Certificate %s is not for a CA, skipping..." % IiiIi1 , file = sys . stderr )
    continue
    if 17 - 17: O0OooooOo - i1i1i1111I . iI1iII1I1I1i - O0OooooOo + Oo % iI1iII1I1I1i
   i1Iiiii1 [ o0Oo [ "subject" ] ] = o0Oo
   if 65 - 65: Ii % O0OooooOo
def OooOOO0oO0Oo ( subject ) :
 if subject not in i1Iiiii1 :
  if 11 - 11: OooOoo % OooOoo . ooOOO
  return None
  if 80 - 80: ii % i1iiIII111 * IIi1i111IiII - oOo0O00 % O0OooooOo - IIi1i111IiII
 return i1Iiiii1 [ subject ]
 if 56 - 56: Oo
def IiIIIII1i ( uri ) :
 if not isinstance ( uri , bytes ) :
  uri = uri . encode ( locale . getpreferredencoding ( ) )
  if 41 - 41: ooOOO + OooOoo + IIiIIiIi11I1 * i1i1i1111I
 hash = codecs . encode ( hashlib . sha1 ( uri ) . digest ( ) , "hex" )
 if 12 - 12: i1i1i1111I
 try :
  with open ( os . path . join ( ooOOooO0 , hash . decode ( "ascii" ) ) , "rb" ) as o0Oo0o000O0oO :
   OoO0OOo00oo0O = pickle . load ( o0Oo0o000O0oO )
   if len ( OoO0OOo00oo0O ) != 2 :
    return None
   if OoO0OOo00oo0O [ 0 ] != i1iiiiIIIiIi :
    return None
    if 29 - 29: IiIIii11Ii
   return OoO0OOo00oo0O [ 1 ]
 except :
  return None
  if 72 - 72: ooOOO . i1 % Ooo0Ooo
  if 72 - 72: ii % IIi1i111IiII . ooOOO * I1Ii1I1 . ooOOO
def Oooo00O ( uri , crl ) :
 i1ii11iIIIIiI , IiIi1I11I = tempfile . mkstemp ( prefix = ".newcrl." , dir = ooOOooO0 )
 with os . fdopen ( i1ii11iIIIIiI , "wb" ) as O0oooo0o0oO :
  pickle . dump ( ( i1iiiiIIIiIi , crl ) , O0oooo0o0oO , - 1 )
  if 57 - 57: IIiIIiIi11I1 - iI1iII1I1I1i % ooOOO - O0OooooOo / IiIIii11Ii . Ooo0Ooo
 if not isinstance ( uri , bytes ) :
  uri = uri . encode ( locale . getpreferredencoding ( ) )
  if 15 - 15: iiI * O0OooooOo - oOo0O00
 hash = codecs . encode ( hashlib . sha1 ( uri ) . digest ( ) , "hex" )
 os . rename ( IiIi1I11I , os . path . join ( ooOOooO0 , hash . decode ( "ascii" ) ) )
 if 6 - 6: IIi1i111IiII - Ii
 if 1 - 1: I1I + OooOoo
def OooO0Oo ( uri ) :
 i1ii11iIIIIiI , IiIi1I11I = tempfile . mkstemp ( prefix = "crl." )
 os . unlink ( IiIi1I11I )
 with os . fdopen ( i1ii11iIIIIiI , "r+b" ) as I1i111IiI1 :
  try :
   i1I11ii ( "Downloading CRL list from %s" % uri )
   IIII1I11IIiIi = urllib . request . urlopen ( uri )
   if 42 - 42: iI1iII1I1I1i % IiIIii11Ii
   while True :
    IiI = IIII1I11IIiIi . read ( 4096 )
    if len ( IiI ) == 0 :
     break
     if 76 - 76: i1i1i1111I % oOo0O00 - i1iiIII111 * i1
    I1i111IiI1 . write ( IiI )
  except :
   print ( "Unable to download %s..." % uri , file = sys . stderr )
   return None
   if 43 - 43: O0OooooOo . Oo
  I1i111IiI1 . seek ( 0 , os . SEEK_SET )
  OoO0OOo00oo0O = I11iiii ( I1i111IiI1 )
  if OoO0OOo00oo0O is None :
   return None
   if 33 - 33: IIi1i111IiII / OooOoo
   if 98 - 98: I1Ii1I1 . IIiIIiIi11I1 * iiI - iI1iII1I1I1i % iiI * IIi1i111IiII
  o0Oo = OooOOO0oO0Oo ( OoO0OOo00oo0O [ "issuer" ] )
  if o0Oo is None :
   print ( "Unknown issuer for CRL..." , file = sys . stderr )
   return None
   if 42 - 42: OooOoo + i1i1i1111I - iI1iII1I1I1i - oOo0O00 * iiI + Ii
   if 46 - 46: oOo0O00 . iI1iII1I1I1i - Ii . oOo0O00 + i1i1i1111I
  I111iI11i = OoO0OOo00oo0O [ "signature" ] [ 0 ]
  OooOoO0o00 = OoO0OOo00oo0O [ "signature" ] [ 1 ]
  if 23 - 23: i1
  O00oOOOOOO = IIi ( I111iI11i )
  if O00oOOOOOO is None :
   print ( "Unknown signature algorithm on CRL..." , file = sys . stderr )
   return None
   if 72 - 72: oOo0O00 - IIi1i111IiII + i1iiIII111 / iiI . OooOoo * IiIIii11Ii
  ( O00o , OOo00000o00O ) = O00oOOOOOO
  if 66 - 66: IiIIii11Ii . I1Ii1I1 + I1I
  I1i111IiI1 . seek ( 0 , os . SEEK_SET )
  if not Ooooo ( I1i111IiI1 , O00o ) :
   print ( "Invalid signature on CRL..." , file = sys . stderr )
   return None
   if 38 - 38: O0OooooOo
  hash = O00o . digest ( )
  if 99 - 99: O0OooooOo * i1iiIII111 . OooOoo % ooo000 % OooOoo
  I111iI11i = o0Oo [ "pubkey" ] [ 0 ]
  i1i1IiII11iI1 = o0Oo [ "pubkey" ] [ 1 ]
  if 37 - 37: i1 - i1 % IIiIIiIi11I1 + IiIIii11Ii / iiI * iI1iII1I1I1i
  if I111iI11i != "rsa" :
   print ( "Unexpected key type for issuer of CRL..." , file = sys . stderr )
   return None
   if 60 - 60: O0OooooOo - Ooo0Ooo % I1Ii1I1
  if not OOo00000o00O ( hash , OooOoO0o00 , i1i1IiII11iI1 [ "exponent" ] , i1i1IiII11iI1 [ "modulus" ] ) :
   print ( "Invalid signature on certificate..." , file = sys . stderr )
   return None
   if 26 - 26: ooOOO / IIiIIiIi11I1 . ii + O0OooooOo . Oo
  return OoO0OOo00oo0O
  if 37 - 37: I1Ii1I1
  if 35 - 35: OooOoo % i1i1i1111I - iI1iII1I1I1i / IiIIii11Ii
  if 4 - 4: ooo000 . IiIIii11Ii % ooo000 / i1i1i1111I
def oO ( certfile , hasher ) :
 if isinstance ( certfile , bytes ) :
  certfile = io . BytesIO ( certfile )
 elif isinstance ( certfile , Ii111 ) :
  certfile = io . BytesIO ( certfile . raw )
  if 13 - 13: i1iiIII111 * OooOoo / oOo0O00 . OooOoo - IIiIIiIi11I1 * iI1iII1I1I1i
  if 79 - 79: i1i1i1111I
 if ord ( certfile . read ( 1 ) ) != 0x30 :
  return False
  if 3 - 3: OooOoo / IIi1i111IiII % O0OooooOo
  if 55 - 55: oOo0O00
 Iii = ord ( certfile . read ( 1 ) )
 if Iii & 0x80 :
  certfile . read ( Iii & 0x7f )
  if 54 - 54: iI1iII1I1I1i % Oo . IIi1i111IiII - Iii1i % O0OooooOo * iiI
  if 31 - 31: oOo0O00 / Iii1i - IiIIii11Ii % iiI / I1Ii1I1 - i1i1i1111I
 IiI = certfile . read ( 1 )
 hasher . update ( IiI )
 if IiI [ 0 ] != 0x30 :
  return False
  if 68 - 68: O0OooooOo . O0OooooOo % O0OooooOo
  if 71 - 71: ooo000
 IiI = certfile . read ( 1 )
 hasher . update ( IiI )
 Iii = IiI [ 0 ]
 if Iii & 0x80 :
  IiI = certfile . read ( Iii & 0x7f )
  hasher . update ( IiI )
  Iii = int ( codecs . encode ( IiI , "hex" ) , 16 )
  if 61 - 61: ooo000
  if 48 - 48: Iii1i * i1i1i1111I + IiIIii11Ii
 while Iii > 0 :
  IiI = certfile . read ( min ( Iii , 4096 ) )
  hasher . update ( IiI )
  Iii -= len ( IiI )
  if 31 - 31: Oo * i1iiIII111 % Ii / ii + I1Ii1I1 + iI1iII1I1I1i
 return True
 if 90 - 90: I1Ii1I1 * i1i1i1111I / iI1iII1I1I1i * Ii
def Ooooo ( crlfile , hasher ) :
 if 38 - 38: I1I . Ii
 if 41 - 41: ooo000 % IIiIIiIi11I1 % ooOOO
 return oO ( crlfile , hasher )
 if 5 - 5: oOo0O00 / Ii + i1iiIII111 * Oo + Ooo0Ooo + ooo000
def IIi ( algorithm ) :
 if algorithm == 'rsa-sha1' :
  return ( hashlib . sha1 ( ) ,
 thinlinc . crypto . verify_rsa_sha1_hashed )
 elif algorithm == 'rsa-sha256' :
  return ( hashlib . sha256 ( ) ,
 thinlinc . crypto . verify_rsa_sha256_hashed )
 elif algorithm == 'rsa-sha384' :
  return ( hashlib . sha384 ( ) ,
 thinlinc . crypto . verify_rsa_sha384_hashed )
 elif algorithm == 'rsa-sha512' :
  return ( hashlib . sha512 ( ) ,
 thinlinc . crypto . verify_rsa_sha512_hashed )
  if 96 - 96: i1iiIII111 - IIiIIiIi11I1 / IIiIIiIi11I1 * IiIIii11Ii
 return None
 if 67 - 67: Ooo0Ooo . Ooo0Ooo . IIi1i111IiII
def IiiI1II ( uri ) :
 global II
 if 58 - 58: Ooo0Ooo * iI1iII1I1I1i / iI1iII1I1I1i + IiIIii11Ii . IIi1i111IiII
 if uri in II :
  return II [ uri ]
  if 56 - 56: Ii * ooo000 . IiIIii11Ii
 OoO0OOo00oo0O = IiIIIII1i ( uri )
 if OoO0OOo00oo0O is None :
  OoO0OOo00oo0O = OooO0Oo ( uri )
  if OoO0OOo00oo0O is not None :
   Oooo00O ( uri , OoO0OOo00oo0O )
 else :
  if 66 - 66: I1Ii1I1 * OooOoo . iI1iII1I1I1i % OooOoo . i1 . IiIIii11Ii
  O00O0Oo0OOO = time . time ( )
  ( Oo0o0OOOOo0 , II1Iiii1 ) = OoO0OOo00oo0O [ "update" ]
  if O00O0Oo0OOO > II1Iiii1 :
   II1iII1Ii1 = OooO0Oo ( uri )
   if II1iII1Ii1 is None :
    if 37 - 37: I1I - OooOoo . iI1iII1I1I1i . iI1iII1I1I1i / i1iiIII111 . IiIIii11Ii
    Ii1111 = ( II1Iiii1 - Oo0o0OOOOo0 )
    if O00O0Oo0OOO > ( Oo0o0OOOOo0 + Ii1111 * 2 ) :
     print ( "Cannot get updated CRL. Using old one..." , file = sys . stderr )
   else :
    OoO0OOo00oo0O = II1iII1Ii1
    Oooo00O ( uri , OoO0OOo00oo0O )
    if 23 - 23: i1 % I1I . OooOoo
    if 31 - 31: IiIIii11Ii . iiI % iI1iII1I1I1i + ii
    if 17 - 17: i1i1i1111I . ooo000 + IIiIIiIi11I1 * Ooo0Ooo % Ooo0Ooo
 II [ uri ] = OoO0OOo00oo0O
 if 74 - 74: OooOoo
 return OoO0OOo00oo0O
 if 41 - 41: iI1iII1I1I1i . O0OooooOo - OooOoo + iiI % OooOoo / Ooo0Ooo
 if 65 - 65: Oo
def I11iiii ( crlfile ) :
 if isinstance ( crlfile , str ) :
  crlfile = io . StringIO ( crlfile )
  if 67 - 67: I1Ii1I1 + I1Ii1I1
 OoO0O0OO0 = subprocess . Popen ( [ os . path . join ( prefix . get_tl_prefix ( ) , "libexec" , "tl-crltool" ) ,
 "--issuer" ,
 "--update" ,
 "--signature" ,
 "--list" ,
 ] ,
 stdin = crlfile ,
 stdout = subprocess . PIPE ,
 stderr = subprocess . PIPE ,
 universal_newlines = True )
 if 42 - 42: IiIIii11Ii / oOo0O00 % ooOOO . ii / OooOoo + oOo0O00
 ( I1II1I1i , oOOoO0o ) = OoO0O0OO0 . communicate ( )
 if 79 - 79: O0OooooOo . I1Ii1I1 * iiI % I1Ii1I1 / IIi1i111IiII
 if OoO0O0OO0 . returncode != 0 :
  print ( "Failed to load CRL..." , file = sys . stderr )
  if "" != oOOoO0o :
   print ( "stderr from tl-crltool: " , oOOoO0o , file = sys . stderr )
  return None
  if 93 - 93: iiI + Iii1i . Ii . iiI * ooOOO
 I1II1I1i = I1II1I1i . splitlines ( )
 if 84 - 84: Ooo0Ooo % IIi1i111IiII
 try :
  OoO0OOo00oo0O = { }
  if 82 - 82: IIiIIiIi11I1
  if 81 - 81: oOo0O00 + i1 - ooo000 * iI1iII1I1I1i + i1i1i1111I
  OoO0OOo00oo0O [ "issuer" ] = I1II1I1i [ 0 ] . strip ( )
  if 89 - 89: I1Ii1I1
  if 57 - 57: iI1iII1I1I1i - i1iiIII111 / OooOoo % i1iiIII111
  OoO00oOo = I1II1I1i [ 1 ] . strip ( ) . split ( " " )
  OoO0OOo00oo0O [ "update" ] = ( IioOOOoo ( OoO00oOo [ 0 ] ) ,
 IioOOOoo ( OoO00oOo [ 1 ] ) )
  if 60 - 60: ooOOO
  if 58 - 58: Oo / Ii
  oo00oOOo0O0o = I1II1I1i [ 2 ] . strip ( ) . split ( " " )
  OoO0OOo00oo0O [ "signature" ] = ( oo00oOOo0O0o [ 0 ] , codecs . decode ( oo00oOOo0O0o [ 1 ] , "hex" ) )
  if 38 - 38: Ooo0Ooo % I1Ii1I1 / iiI + i1iiIII111
  if 25 - 25: O0OooooOo - iI1iII1I1I1i
  OooO0Ooo0 = { }
  for OOoOooo000O0O in I1II1I1i [ 3 : ] :
   oOO0ooOo = OOoOooo000O0O . strip ( ) . split ( " " )
   OooO0Ooo0 [ oOO0ooOo [ 0 ] ] = oOO0ooOo [ 1 : ]
  OoO0OOo00oo0O [ "serials" ] = OooO0Ooo0
 except :
  print ( "Internal error parsing CRL, skipping..." , file = sys . stderr )
  return None
  if 34 - 34: ooo000 + Ii + Ii - ii % IiIIii11Ii / ii
 return OoO0OOo00oo0O
 if 37 - 37: ooo000
def IioOOOoo ( timestamp ) :
 if 65 - 65: ooOOO % IIi1i111IiII % OooOoo . Oo
 if 51 - 51: ii + OooOoo + I1I
 oo = "%y%m%d%H%M%SZ"
 I1Ii11iI1 = "%Y%m%d%H%M%SZ"
 if 41 - 41: IIi1i111IiII - oOo0O00
 if 76 - 76: O0OooooOo % IIiIIiIi11I1 % iiI
 if 39 - 39: IiIIii11Ii . Oo + iiI - oOo0O00
 for format in [ oo , I1Ii11iI1 ] :
  try :
   I111i1 = time . strptime ( timestamp , format )
   if 7 - 7: I1Ii1I1 - IIi1i111IiII % OooOoo - i1 * Ii
   if 74 - 74: I1I . iI1iII1I1I1i . Ooo0Ooo + Ooo0Ooo / I1I * Ooo0Ooo
   if 65 - 65: Ii - OooOoo * I1I % i1iiIII111 % IIiIIiIi11I1
   if 68 - 68: I1Ii1I1 + ii - ii + IiIIii11Ii
   if 87 - 87: ooOOO * IIiIIiIi11I1 % i1 / ii + i1 + oOo0O00
   if 99 - 99: I1I * IIiIIiIi11I1 * i1iiIII111
   if 62 - 62: ooOOO % Oo + iiI
   if format == oo :
    if I111i1 . tm_year >= 2050 :
     I111i1 = time . strptime ( "19%s" % timestamp , I1Ii11iI1 )
     if 87 - 87: ooo000 - OooOoo + Ii + i1i1i1111I + IiIIii11Ii
   return calendar . timegm ( I111i1 )
   if 57 - 57: IIiIIiIi11I1 + I1I / ooOOO % ooOOO % Oo / IIi1i111IiII
  except ValueError as o00ooo0OO0000 :
   if 95 - 95: i1 / O0OooooOo . i1 / Oo . Ooo0Ooo
   if 43 - 43: Oo - OooOoo * ii . Ooo0Ooo / IIiIIiIi11I1 * IIiIIiIi11I1
   continue
   if 84 - 84: i1iiIII111 + oOo0O00
   if 83 - 83: i1i1i1111I
   if 84 - 84: ii / Ii * Ooo0Ooo / Ii / ooo000
 raise ValueError ( "Retrieved date could not be parsed by any format string" )
 if 64 - 64: oOo0O00 * Ii
def I1iIII111Ii ( cert ) :
 if 65 - 65: I1I + i1iiIII111 . iI1iII1I1I1i / ooOOO
 if 92 - 92: i1iiIII111 . oOo0O00
 if 73 - 73: I1Ii1I1 / ooo000 % O0OooooOo - i1i1i1111I + Oo - I1Ii1I1
 if 18 - 18: i1 + ooOOO . i1 - iI1iII1I1I1i
 if 97 - 97: oOo0O00 + iiI % Iii1i
 if 34 - 34: i1 + Oo . oOo0O00 - ooo000 / O0OooooOo * oOo0O00
 if 89 - 89: oOo0O00
 if 48 - 48: i1 / IIiIIiIi11I1 / iI1iII1I1I1i / IIi1i111IiII * IiIIii11Ii
 if 54 - 54: IIiIIiIi11I1 % I1I % IIi1i111IiII / O0OooooOo . O0OooooOo - IiIIii11Ii
 i1iI1I = cert [ 'expiry' ] [ 0 ]
 i1Ii1IiIi1II1 = cert [ 'expiry' ] [ 1 ]
 O00O0Oo0OOO = time . time ( )
 if 8 - 8: oOo0O00 - Iii1i * ooOOO - I1I . iiI
 if i1iI1I > O00O0Oo0OOO :
  return ( False , "Certificate is not yet valid" )
  if 10 - 10: Ooo0Ooo
 if i1Ii1IiIi1II1 <= O00O0Oo0OOO :
  return ( False , "Certificate has expired" )
  if 45 - 45: ii . i1i1i1111I . Ii - Ooo0Ooo + OooOoo / Ooo0Ooo
  if 48 - 48: ooo000 - i1i1i1111I - ii * OooOoo
  if 84 - 84: I1Ii1I1 . ooo000 % O0OooooOo
  if 17 - 17: Iii1i / oOo0O00 . ii - ii - i1 - i1
 o0Oo = OooOOO0oO0Oo ( cert [ "issuer" ] )
 if o0Oo is None :
  return ( False , "Unknown certificate issuer" )
  if 59 - 59: ooOOO / Oo / Ii
  if 85 - 85: Iii1i % I1I / Oo . IIi1i111IiII
  if 5 - 5: Ii % Ii / iI1iII1I1I1i - i1
  if 70 - 70: OooOoo . O0OooooOo
  if 38 - 38: iiI * i1iiIII111
 I111iI11i = cert [ "signature" ] [ 0 ]
 OooOoO0o00 = cert [ "signature" ] [ 1 ]
 if 74 - 74: i1iiIII111 * oOo0O00 / O0OooooOo / Ooo0Ooo / oOo0O00
 O00oOOOOOO = IIi ( I111iI11i )
 if 36 - 36: ii
 if O00oOOOOOO is None :
  return ( False , "Certificate signature algorithm is unknown" )
  if 76 - 76: Ooo0Ooo / IIiIIiIi11I1 % IiIIii11Ii . ooo000 * i1iiIII111 % Ooo0Ooo
 ( O00o , OOo00000o00O ) = O00oOOOOOO
 if 53 - 53: ooo000 + I1Ii1I1
 if not oO ( cert , O00o ) :
  return ( False , "Certificate has invalid signature" )
  if 97 - 97: i1 - oOo0O00 / OooOoo * Ii - ii
 hash = O00o . digest ( )
 if 53 - 53: O0OooooOo % ooo000 / ooOOO / I1I
 I111iI11i = o0Oo [ "pubkey" ] [ 0 ]
 i1i1IiII11iI1 = o0Oo [ "pubkey" ] [ 1 ]
 if 43 - 43: iI1iII1I1I1i . i1i1i1111I + I1I % ooOOO . IIi1i111IiII - IIi1i111IiII
 if I111iI11i != "rsa" :
  return ( False , "Unexpected key type for certificate issuer" )
  if 6 - 6: I1I
 if not OOo00000o00O ( hash , OooOoO0o00 , i1i1IiII11iI1 [ "exponent" ] , i1i1IiII11iI1 [ "modulus" ] ) :
  return ( False , "Certificate signature verification failed" )
  if 98 - 98: ii * IIiIIiIi11I1 / i1iiIII111 / Iii1i + I1I
  if 25 - 25: IIiIIiIi11I1 . IIi1i111IiII / I1I * i1 - i1iiIII111 % oOo0O00
  if 49 - 49: IiIIii11Ii % ooOOO + O0OooooOo + IIiIIiIi11I1
  if 60 - 60: IIiIIiIi11I1
  if 98 - 98: IiIIii11Ii / Ooo0Ooo + Ii
  if 73 - 73: OooOoo * Iii1i
  if 34 - 34: iiI % Ooo0Ooo * OooOoo + i1iiIII111 / i1
  if 49 - 49: IIiIIiIi11I1 / i1iiIII111 % IIiIIiIi11I1 + IIiIIiIi11I1 * iI1iII1I1I1i
  if 22 - 22: I1Ii1I1 + ii / I1Ii1I1 - Ii % Ii % i1i1i1111I
  if 86 - 86: Iii1i
  if 53 - 53: i1 * i1i1i1111I
 for i1IIi in cert [ "crl" ] :
  if not i1IIi . startswith ( "http" ) :
   continue
   if 80 - 80: IIi1i111IiII * IIiIIiIi11I1 - Iii1i . ii % Iii1i - Iii1i
  OoO0OOo00oo0O = IiiI1II ( i1IIi )
  if OoO0OOo00oo0O is None :
   return ( False , "Unable to retrieve CRL at %s" % i1IIi )
   if 68 - 68: ii + Iii1i + Ooo0Ooo % Oo / O0OooooOo . OooOoo
  if cert [ "serial" ] in OoO0OOo00oo0O [ "serials" ] :
   i1I11ii ( "Certificate revoked by CRL list at %s" % i1IIi )
   return ( False , "Certificate has been revoked by CA" )
   if 31 - 31: O0OooooOo % ooOOO
   if 46 - 46: i1i1i1111I - ooo000 + iI1iII1I1I1i
   if 73 - 73: i1 * oOo0O00
   if 88 - 88: Ii
 return ( True , "Certificate OK" )
 if 12 - 12: ooo000 - IIiIIiIi11I1 % Iii1i . I1Ii1I1
def I1I1i1ii ( ) :
 Iii1I1 = OptionParser ( version = TL_VERSION ,
 usage = "%prog [options]" )
 if 73 - 73: I1Ii1I1 . Iii1i + iiI / ooo000 / oOo0O00 . I1Ii1I1
 Iii1I1 . add_option ( "-v" , "--verbose" ,
 action = "store_true" ,
 default = False ,
 dest = "verbose" ,
 help = "be more verbose" )
 if 73 - 73: ooo000 % ii
 Iii1I1 . add_option ( "-d" , "--debug" ,
 action = "store_true" ,
 default = False ,
 dest = "debug" ,
 help = "show debugging output" )
 if 43 - 43: OooOoo * i1i1i1111I * IiIIii11Ii % Ii
 Iii1I1 . add_option ( "-s" , "--simulate" ,
 action = "store_true" ,
 default = False ,
 dest = "simulate" ,
 help = "dry run, don't update files" )
 if 13 - 13: i1i1i1111I / IIi1i111IiII + IIi1i111IiII % ooo000
 Iii1I1 . set_argument_completer ( lambda * oOOOoO0OOo00 : CompletionResult ( completions = [ ] , nospace = False ) )
 if 85 - 85: IIi1i111IiII . i1 + i1i1i1111I * i1i1i1111I
 return Iii1I1
 if 35 - 35: OooOoo - ooo000
 if 41 - 41: i1i1i1111I . oOo0O00 . iI1iII1I1I1i
def Ooo ( exponent , modulus , comment = None ) :
 if 24 - 24: ii - O0OooooOo % Oo - Iii1i
 if 12 - 12: i1i1i1111I % IIi1i111IiII % i1iiIII111
 if comment is not None and isinstance ( comment , str ) :
  comment = comment . encode ( locale . getpreferredencoding ( ) )
  if 50 - 50: oOo0O00
  if 53 - 53: ii . iiI / I1Ii1I1 % ooo000
 if exponent [ 0 ] & 0x80 :
  exponent = b'\0' + exponent
 if modulus [ 0 ] & 0x80 :
  modulus = b'\0' + modulus
  if 22 - 22: oOo0O00 + ooOOO
 ooO = struct . pack ( ">I" , len ( b"ssh-rsa" ) )
 ooO += b"ssh-rsa"
 if 36 - 36: IIiIIiIi11I1 + IiIIii11Ii . i1 + IIiIIiIi11I1
 ooO += struct . pack ( ">I" , len ( exponent ) )
 ooO += exponent
 if 77 - 77: iI1iII1I1I1i / OooOoo . Iii1i + i1iiIII111 - IIi1i111IiII
 ooO += struct . pack ( ">I" , len ( modulus ) )
 ooO += modulus
 if 49 - 49: i1iiIII111 - IIi1i111IiII - OooOoo
 ooO = b"ssh-rsa " + base64 . b64encode ( ooO )
 if 39 - 39: I1I % i1iiIII111 - I1Ii1I1
 if comment is not None :
  ooO += b" " + comment
  if 51 - 51: IIiIIiIi11I1 + i1 % i1iiIII111
 return ooO . decode ( locale . getpreferredencoding ( ) )
 if 49 - 49: IiIIii11Ii - iiI . I1I
 if 76 - 76: ii / iI1iII1I1I1i . I1I * oOo0O00 - i1i1i1111I
 if 53 - 53: OooOoo - oOo0O00 * ooOOO / OooOoo * Ooo0Ooo * ooo000
II1I111I1iI = [
 ( "emailAddress" , "1.2.840.113549.1.9.1" ) ,
 ]
if 90 - 90: i1i1i1111I % i1 . IiIIii11Ii * IIi1i111IiII / Ii
if 73 - 73: ooo000 * Ooo0Ooo + Iii1i . ooOOO . O0OooooOo / O0OooooOo
def III1111 ( ) :
 locale . setlocale ( locale . LC_ALL , "" )
 if 20 - 20: IIiIIiIi11I1 . oOo0O00 . Ooo0Ooo
 global OoOoo0o
 global I1i
 if 11 - 11: OooOoo
 Iii1I1 = I1I1i1ii ( )
 if 45 - 45: iI1iII1I1I1i + O0OooooOo / IIiIIiIi11I1
 ( OO0 , oOOOoO0OOo00 ) = Iii1I1 . parse_args ( )
 if 90 - 90: i1i1i1111I + Ii + Oo * Iii1i
 oo0o0o0oO0OO = OO0 . simulate
 OoOoo0o = OO0 . verbose or OO0 . debug
 I1i = OO0 . debug
 if 30 - 30: I1Ii1I1 * Ooo0Ooo / Iii1i - IIi1i111IiII
 if oo0o0o0oO0OO :
  print ( "tl-ldap-certalias:  INFO: Simulation run, won't write changes to disk" )
  if 26 - 26: Ooo0Ooo % Iii1i - I1I * I1I
  if 36 - 36: iiI . ii . IiIIii11Ii / I1I + Oo - ooOOO
  if 86 - 86: i1iiIII111 % ooo000 % ooo000 % iiI
  if 15 - 15: iI1iII1I1I1i + I1Ii1I1 % oOo0O00
 iiiIiiI = thinlinc . selinux . selinux_enabled ( )
 if iiiIiiI :
  i1I11ii ( "This is a SELinux-enabled system." )
 else :
  i1I11ii ( "This system does not use SELinux." )
  if 89 - 89: ooo000 % Ooo0Ooo
  if 77 - 77: ooo000 % Ooo0Ooo
  if 24 - 24: ii * I1Ii1I1 * I1Ii1I1 % IIiIIiIi11I1
  if 37 - 37: i1iiIII111 / iI1iII1I1I1i
 IIi111II1I = os . path . join ( prefix . get_tl_prefix ( ) , "etc" , "thinlinc.hconf" )
 i1IIiII11 ( "Reading configuration at %s" % IIi111II1I )
 Ooo0ooOoO = hiveconf . open_hive ( IIi111II1I )
 if 29 - 29: I1Ii1I1 + iiI - IIiIIiIi11I1 * O0OooooOo % Oo
 if not Ooo0ooOoO :
  OOOO0O0ooO0O ( "Could not open ThinLinc configuration at %s" % IIi111II1I )
  return 1
  if 74 - 74: ooOOO
  if 100 - 100: ii + iI1iII1I1I1i . I1I % Oo - i1
  if 39 - 39: iI1iII1I1I1i
 OOo = Ooo0ooOoO . get_string ( "/utils/tl-ldap-certalias/ldap_schema" , "rfc2307" )
 if 100 - 100: iiI / IiIIii11Ii
 if 91 - 91: Ooo0Ooo * IIi1i111IiII / I1I / Ii / iiI
 O0oO0OO0O00 = Ooo0ooOoO . get_string ( "/utils/tl-ldap-certalias/users/uri" , None )
 iiI1i1ii = Ooo0ooOoO . get_string ( "/utils/tl-ldap-certalias/users/base" , None )
 I1IIi = Ooo0ooOoO . get_string ( "/utils/tl-ldap-certalias/users/binddn" , '' )
 OOo0oO00 = Ooo0ooOoO . get_string ( "/utils/tl-ldap-certalias/users/bindpw" , '' )
 if 36 - 36: iI1iII1I1I1i + i1iiIII111 - Iii1i % i1i1i1111I * iI1iII1I1I1i * IiIIii11Ii
 if 9 - 9: I1I - I1I - ooOOO - oOo0O00 + i1iiIII111
 if 71 - 71: iiI / i1iiIII111 - Ii * Oo . iI1iII1I1I1i
 if not ( O0oO0OO0O00 and iiI1i1ii ) :
  OOOO0O0ooO0O ( "Configuration: user source not configured - exiting." )
  return 1
  if 3 - 3: I1Ii1I1
  if 57 - 57: Ooo0Ooo . OooOoo / oOo0O00 * I1Ii1I1
  if 36 - 36: IiIIii11Ii
  if 33 - 33: IiIIii11Ii
  if 86 - 86: Ii / oOo0O00 - i1 * i1i1i1111I - Oo * Iii1i
 Ii1 = Ooo0ooOoO . get_string ( "/utils/tl-ldap-certalias/users/filter" , None )
 if 29 - 29: iI1iII1I1I1i * Iii1i . i1iiIII111 * Ooo0Ooo . OooOoo
 if 62 - 62: i1
 if 50 - 50: Oo
 if ( Ii1 is None ) :
  if 14 - 14: oOo0O00 + ooo000 / OooOoo
  if 83 - 83: i1i1i1111I / iiI % IIi1i111IiII . I1Ii1I1 * IiIIii11Ii - I1I
  Ii1 = "(&(objectclass=posixAccount)(uidNumber=*))"
  if 81 - 81: Ooo0Ooo / iI1iII1I1I1i % i1i1i1111I / OooOoo . iiI . ooo000
  if ( OOo == "AD" ) :
   Ii1 = "(&(objectclass=user)(uidNumber=*))"
   if 45 - 45: OooOoo + ooOOO / i1i1i1111I * i1
   if 71 - 71: IIi1i111IiII % Iii1i + oOo0O00 * O0OooooOo / IIi1i111IiII
   if 66 - 66: ooo000 * oOo0O00
   if 83 - 83: i1
   if 64 - 64: i1 . IIi1i111IiII - O0OooooOo . Iii1i
 OO0O = Ooo0ooOoO . get_string ( "/utils/tl-ldap-certalias/certificate_user_match" ,
 'sameobject' )
 if 47 - 47: I1Ii1I1 * i1i1i1111I - iiI . Iii1i . ooOOO
 iI = Ooo0ooOoO . get_bool ( "/utils/tl-ldap-certalias/allow_invalid_certificates" ,
 False )
 if 65 - 65: O0OooooOo * Ooo0Ooo - ooo000
 if 11 - 11: ii % OooOoo % i1i1i1111I + i1i1i1111I + I1I % OooOoo
 if not iI :
  oo0O0O0Ooooo ( )
  if 69 - 69: iiI - i1i1i1111I * oOo0O00
  if 90 - 90: i1 * i1 . Ooo0Ooo . Oo
 o0000o = dict ( )
 if 16 - 16: OooOoo
 if 90 - 90: I1Ii1I1
 if OO0O == "sameobject" :
  if 64 - 64: O0OooooOo % ooOOO * I1Ii1I1
  i1I11ii ( "userCertificate attributes are stored on user objects" )
  if 48 - 48: ooOOO * Oo
  if 99 - 99: i1iiIII111
  if 55 - 55: i1i1i1111I % iiI + i1i1i1111I
  if 64 - 64: IiIIii11Ii % IIiIIiIi11I1 . I1Ii1I1 % IiIIii11Ii
  if 21 - 21: iiI . Oo * i1
  if 95 - 95: Ii . i1 . IIiIIiIi11I1 . ooo000 + OooOoo
  if 23 - 23: ii
  i1I11ii ( "Searching for users on %s/%s" % ( O0oO0OO0O00 , iiI1i1ii ) )
  if 92 - 92: Ooo0Ooo * i1iiIII111 / Ooo0Ooo / i1iiIII111 * i1i1i1111I + iiI
  o0ooo0oOoO = tl_ldap_iterator . search ( uri = O0oO0OO0O00 ,
 base = iiI1i1ii ,
 user = I1IIi ,
 password = OOo0oO00 ,
 filter = Ii1 )
  if 37 - 37: i1i1i1111I + iI1iII1I1I1i % Iii1i
  if not o0ooo0oOoO :
   OOOO0O0ooO0O ( "Failed to get list of users, exiting" )
   return 1
   if 48 - 48: iiI + oOo0O00
  for I1Ii11i in o0ooo0oOoO :
   if 20 - 20: Ooo0Ooo
   ( iI11iIi1I1 , o0oOO ) = I1Ii11i
   if 8 - 8: ooOOO * i1i1i1111I
   i1IIiII11 ( "Found user %s" % iI11iIi1I1 )
   if 6 - 6: Ooo0Ooo % IiIIii11Ii
   if 59 - 59: iiI . O0OooooOo . ooo000 / iiI . Ii % Ooo0Ooo
   try :
    if 85 - 85: oOo0O00 / ooOOO
    if 41 - 41: i1iiIII111 * iI1iII1I1I1i + i1 + i1i1i1111I
    iiiiiIIIIi1 = int ( o0oOO [ 'uidNumber' ] [ 0 ] )
   except KeyError as o00ooo0OO0000 :
    OOOO0O0ooO0O ( "Object %s lacks attribute %s. Skipping user." % ( iI11iIi1I1 , str ( o00ooo0OO0000 ) ) )
    continue
    if 46 - 46: oOo0O00 - iI1iII1I1I1i
   if 'userCertificate;binary' in o0oOO :
    oo0 = o0oOO [ 'userCertificate;binary' ]
   elif 'userCertificate' in o0oOO :
    oo0 = o0oOO [ 'userCertificate' ]
   else :
    oo0 = [ ]
    if 39 - 39: IIi1i111IiII * I1I . OooOoo + i1 . ooo000 + O0OooooOo
    if 7 - 7: ooOOO + Iii1i / iI1iII1I1I1i - ii % Oo / iI1iII1I1I1i
   if iiiiiIIIIi1 not in o0000o :
    o0000o [ iiiiiIIIIi1 ] = [ ]
    if 14 - 14: Iii1i . Ii
    if 100 - 100: I1I / ooo000
   for o0Ooooo0Ooo in oo0 :
    if 43 - 43: Ii
    if 60 - 60: I1Ii1I1
    if 74 - 74: ooo000 * Iii1i - Ooo0Ooo - I1Ii1I1
    oOOO = Ii111 ( o0Ooooo0Ooo )
    if 20 - 20: IIi1i111IiII
    if not oOOO . is_cert ( ) :
     OOOO0O0ooO0O ( "Invalid cert on user %s" % iI11iIi1I1 )
     continue
     if 80 - 80: oOo0O00 / Ooo0Ooo - IIiIIiIi11I1 % i1i1i1111I . ooOOO
    if not iI :
     ( oo00o00o , O0OO00OOO ) = I1iIII111Ii ( oOOO )
     if not oo00o00o :
      i1I11ii ( " Disallowing use of certificate %s" % oOOO [ 'subject' ] )
      i1IIiII11 ( "  Certificate issued by CA %s." % ( oOOO [ 'issuer' ] ) )
      i1IIiII11 ( "  Certificate found on %s." % iI11iIi1I1 )
      i1I11ii ( " Reason: %s" % O0OO00OOO )
      continue
      if 24 - 24: i1iiIII111
    o0000o [ iiiiiIIIIi1 ] += [ oOOO ]
    if 77 - 77: ooOOO . Ii
    if 61 - 61: iiI + I1Ii1I1 / i1 . i1 * ooOOO
  i1I11ii ( "Found %d users, %d users with certificates in LDAP" % ( len ( o0000o ) ,
 len ( [ x for x in o0000o if len ( o0000o [ x ] ) > 0 ] ) ) )
  if 69 - 69: i1 . ooo000 % I1Ii1I1 + i1 / i1iiIII111 % IiIIii11Ii
 elif OO0O == 'novell_certificate_subjectname' :
  i1I11ii ( "Certificates are matched to users using subject names" )
  if 76 - 76: IiIIii11Ii
  if 73 - 73: iiI / IIiIIiIi11I1 / oOo0O00 % IIiIIiIi11I1 / Ii
  if 12 - 12: i1
  if 78 - 78: O0OooooOo . IIiIIiIi11I1
  if 1 - 1: I1I % i1iiIII111 / I1Ii1I1
  ooiIiI11I1iI = Ooo0ooOoO . get_string ( "/utils/tl-ldap-certalias/certs/uri" , '' )
  Oo0O = Ooo0ooOoO . get_string ( "/utils/tl-ldap-certalias/certs/base" , '' )
  O000 = Ooo0ooOoO . get_string ( "/utils/tl-ldap-certalias/certs/binddn" , '' )
  o0oOO00Ooo0o = Ooo0ooOoO . get_string ( "/utils/tl-ldap-certalias/certs/bindpw" , '' )
  o0O0 = Ooo0ooOoO . get_string ( "/utils/tl-ldap-certalias/certs/filter" ,
 "(userCertificate=*)" )
  if 29 - 29: Oo % OooOoo - i1i1i1111I + IiIIii11Ii / I1Ii1I1 + i1i1i1111I
  i1I11ii ( "Searching for users on %s/%s" % ( O0oO0OO0O00 , iiI1i1ii ) )
  if 91 - 91: i1iiIII111 * Iii1i - I1I + i1i1i1111I / ooOOO + Oo
  if 93 - 93: Ii
  o0ooo0oOoO = tl_ldap_iterator . search ( uri = O0oO0OO0O00 ,
 base = iiI1i1ii ,
 user = I1IIi ,
 password = OOo0oO00 ,
 filter = Ii1 )
  if 50 - 50: Ooo0Ooo * Ooo0Ooo / ooo000 - IiIIii11Ii
  if not o0ooo0oOoO :
   OOOO0O0ooO0O ( "Unable to obtain list of users, exiting" )
   return 1
   if 70 - 70: IIiIIiIi11I1 . i1 % iI1iII1I1I1i / i1i1i1111I
  IIoOo = list ( o0ooo0oOoO )
  if 49 - 49: i1i1i1111I * ii
  i1I11ii ( "Found %d users in LDAP database" % len ( IIoOo ) )
  if 12 - 12: IIi1i111IiII % Iii1i - Ooo0Ooo
  if 84 - 84: Ooo0Ooo % I1Ii1I1
  for I1Ii11i in IIoOo :
   iI11iIi1I1 , o0oOO = I1Ii11i
   iiiiiIIIIi1 = int ( o0oOO [ 'uidNumber' ] [ 0 ] )
   o0000o [ iiiiiIIIIi1 ] = [ ]
   if 7 - 7: i1iiIII111
  i1I11ii ( "Searching for certificates on %s/%s" % ( ooiIiI11I1iI , Oo0O ) )
  if 27 - 27: ii - ii
  OoooO0 = tl_ldap_iterator . search ( uri = ooiIiI11I1iI ,
 base = Oo0O ,
 user = O000 ,
 password = o0oOO00Ooo0o ,
 filter = o0O0 )
  if 71 - 71: Ii / Iii1i + i1i1i1111I - oOo0O00
  if not OoooO0 :
   OOOO0O0ooO0O ( "Unable to obtain list of certificates, exiting" )
   return 1
   if 85 - 85: IIiIIiIi11I1 % Oo / I1I . oOo0O00 / IIiIIiIi11I1 . Oo
  OO0Oo00Oo = list ( OoooO0 )
  if 48 - 48: I1Ii1I1 + Ii - iI1iII1I1I1i + iI1iII1I1I1i
  i1I11ii ( "Found %d certificates in LDAP database" % len ( OO0Oo00Oo ) )
  if 34 - 34: iiI + Ii
  for i1I in OO0Oo00Oo :
   if 70 - 70: i1 % Ii % O0OooooOo - Ooo0Ooo
   if 69 - 69: iiI - IIiIIiIi11I1 / i1i1i1111I + Ii - iiI % O0OooooOo
   if 74 - 74: OooOoo % iI1iII1I1I1i . I1Ii1I1 / I1I / Ii / Ooo0Ooo
   if 11 - 11: I1I - OooOoo * ooOOO % i1i1i1111I + ooo000 . ii
   if 51 - 51: ooOOO + iI1iII1I1I1i % IIi1i111IiII . O0OooooOo % Ooo0Ooo
   if 15 - 15: OooOoo / iiI % Oo % Oo
   ( iI11iIi1I1 , o0oOO ) = i1I
   if 73 - 73: oOo0O00
   if 'userCertificate;binary' in o0oOO :
    oo0 = o0oOO [ 'userCertificate;binary' ]
   elif 'userCertificate' in o0oOO :
    oo0 = o0oOO [ 'userCertificate' ]
   else :
    if 69 - 69: ooOOO - IIiIIiIi11I1 - iiI
    if 78 - 78: I1Ii1I1 . ooo000 + IIi1i111IiII / IIi1i111IiII
    if 88 - 88: Ii - i1iiIII111 - i1 * IIiIIiIi11I1 . IiIIii11Ii + Iii1i
    continue
    if 44 - 44: ooOOO + Oo - i1
   for oOOO in [ Ii111 ( x ) for x in oo0 ] :
    if 18 - 18: iI1iII1I1I1i * ooOOO + Ooo0Ooo
    if 78 - 78: I1I . I1I - IIiIIiIi11I1 - IiIIii11Ii % O0OooooOo . I1Ii1I1
    if 9 - 9: O0OooooOo * OooOoo - O0OooooOo
    if not iI :
     ( oo00o00o , O0OO00OOO ) = I1iIII111Ii ( oOOO )
     if not oo00o00o :
      i1I11ii ( " Disallowing use of certificate %s" % oOOO [ 'subject' ] )
      i1IIiII11 ( "  Certificate issued by CA %s." % ( oOOO [ 'issuer' ] ) )
      i1IIiII11 ( "  Certificate found on %s." % iI11iIi1I1 )
      i1I11ii ( " Reason: %s" % O0OO00OOO )
      continue
      if 73 - 73: I1Ii1I1
    i1IIiII11 ( "Searching for users allowing use of certificate with subject:" )
    i1IIiII11 ( "(rfc4514) %s" % oOOO [ 'subject' ] )
    i1IIiII11 ( " (novell) %s" % oOOO [ 'novellsubject' ] )
    if 25 - 25: i1 . Ii
    if 59 - 59: IiIIii11Ii
    if 91 - 91: IiIIii11Ii + iI1iII1I1I1i
    if 65 - 65: Oo * Iii1i * IiIIii11Ii / IIiIIiIi11I1
    if 77 - 77: IIiIIiIi11I1 / ii % IiIIii11Ii + I1Ii1I1
    if 34 - 34: i1i1i1111I * Iii1i + Ii - iiI / i1 / i1
    def II1i1iIi1i1i ( user ) :
     iI11iIi1I1 , o0oOO = user [ 0 ]
     if 29 - 29: oOo0O00 % ooOOO * Ooo0Ooo
     if 'sasAllowableSubjectNames' not in o0oOO :
      return False
      if 49 - 49: ooOOO - iI1iII1I1I1i / oOo0O00
     for o0 in o0oOO [ 'sasAllowableSubjectNames' ] :
      if o0 == oOOO [ 'subject' ] :
       return True
      elif o0 == oOOO [ 'novellsubject' ] :
       return True
       if 85 - 85: IIi1i111IiII % oOo0O00 % oOo0O00
     return False
     if 88 - 88: IIiIIiIi11I1
    I1III1 = list ( filter ( II1i1iIi1i1i , IIoOo ) )
    i1IIiII11 ( "%d users are allowed to use certificate for login" % len ( I1III1 ) )
    if 92 - 92: I1I + O0OooooOo / Ii / ooo000 % i1iiIII111 * OooOoo
    for IIIII1 in I1III1 :
     iI11iIi1I1 , o0oOO = IIIII1 [ 0 ]
     i1IIiII11 ( "  %s" % iI11iIi1I1 )
     iiiiiIIIIi1 = int ( o0oOO [ 'uidNumber' ] [ 0 ] )
     if not iiiiiIIIIi1 in o0000o :
      o0000o [ iiiiiIIIIi1 ] = [ ]
      if 5 - 5: iiI * i1iiIII111 / i1 * ii * IIiIIiIi11I1
     o0000o [ iiiiiIIIIi1 ] += [ oOOO ]
     if 86 - 86: oOo0O00 % ii / I1Ii1I1
     if 38 - 38: IIiIIiIi11I1
 else :
  if 17 - 17: ii + i1iiIII111 / i1i1i1111I * IiIIii11Ii / oOo0O00 / Ooo0Ooo
  OOOO0O0ooO0O ( "configuration: /utils/tl-ldap-certalias/certificate_user_match does not allow value \"%s\"" % OO0O )
  return 1
  if 43 - 43: iiI + iI1iII1I1I1i + Oo
  if 61 - 61: iiI
  if 75 - 75: IIiIIiIi11I1 . O0OooooOo / ooo000 . oOo0O00 % Ooo0Ooo
  if 7 - 7: I1I / i1iiIII111
  if 53 - 53: OooOoo - I1Ii1I1 + IIiIIiIi11I1 . I1Ii1I1 + i1iiIII111
  if 82 - 82: Iii1i
  if 58 - 58: I1Ii1I1 / I1Ii1I1 % IIiIIiIi11I1
  if 98 - 98: OooOoo
  if 79 - 79: Ooo0Ooo * Ooo0Ooo - ooo000 - Iii1i
  if 5 - 5: IiIIii11Ii / i1iiIII111 . I1I % Iii1i . i1
  if 29 - 29: oOo0O00 + Oo / O0OooooOo - oOo0O00 % i1i1i1111I / Ii
  if 39 - 39: O0OooooOo - O0OooooOo % i1iiIII111
  if 56 - 56: i1iiIII111 / IiIIii11Ii - I1Ii1I1 / Iii1i - i1 / OooOoo
  if 28 - 28: iiI . I1Ii1I1 % IiIIii11Ii . Ii * ooOOO - ii
 for ii1ii1iIIIi1 in o0000o :
  try :
   Ooo000oOO0o00 = pwd . getpwuid ( ii1ii1iIIIi1 )
  except KeyError :
   if 35 - 35: OooOoo % Oo - IIi1i111IiII % oOo0O00 . Oo
   if 14 - 14: IIi1i111IiII / ooOOO / I1I % IiIIii11Ii
   if 91 - 91: I1Ii1I1 + ii . I1I - IIiIIiIi11I1
   if 43 - 43: Iii1i . i1i1i1111I
   if 15 - 15: IIiIIiIi11I1 * i1i1i1111I / i1i1i1111I % Oo * ooOOO
   OOOO0O0ooO0O ( "No user with uid %d exists on system! Possible misconfiguration detected." % ( ii1ii1iIIIi1 ) )
   continue
   if 83 - 83: oOo0O00 - ooOOO
  ooo = Ooo000oOO0o00 . pw_name
  OOO0ooooo00o = Ooo000oOO0o00 . pw_gid
  O0O0oOOoo = Ooo000oOO0o00 . pw_dir
  OOO0OO0oo = os . path . join ( O0O0oOOoo , ".ssh" )
  iiI1 = os . path . join ( OOO0OO0oo , "authorized_keys" )
  O0OO = os . path . join ( OOO0OO0oo , "authorized_keys.lock" )
  if 79 - 79: OooOoo
  if 62 - 62: Ooo0Ooo . Ii - ooOOO . i1iiIII111
  if 2 - 2: O0OooooOo * iiI * iiI * i1iiIII111 / O0OooooOo % IIi1i111IiII
  if 13 - 13: i1 * IiIIii11Ii - ooo000 * OooOoo
  ii1IIiiIIiII = [ ]
  if 7 - 7: ii / ooo000 * i1 - iI1iII1I1I1i . iI1iII1I1I1i
  i1I11ii ( "Handling uid %d (%s)" % ( ii1ii1iIIIi1 ,
 ooo ) )
  if 74 - 74: IIiIIiIi11I1 . i1iiIII111 - IIiIIiIi11I1 . Iii1i
  for oO0Ooo in o0000o [ ii1ii1iIIIi1 ] :
   if 14 - 14: Ii - ii % i1i1i1111I . IIi1i111IiII
   if not iI :
    ( oo00o00o , O0OO00OOO ) = I1iIII111Ii ( oO0Ooo )
    if not oo00o00o :
     i1I11ii ( " Disallowing use of certificate %s" % oO0Ooo [ 'subject' ] )
     i1IIiII11 ( "  Certificate issued by CA %s." % ( oO0Ooo [ 'issuer' ] ) )
     i1IIiII11 ( "  Certificate found on user %s" % ooo )
     i1I11ii ( " Reason: %s" % O0OO00OOO )
     continue
     if 80 - 80: O0OooooOo + I1I % iI1iII1I1I1i * IiIIii11Ii + i1 . iI1iII1I1I1i
   O0O0Ooo0ooOO0 = Ooo ( oO0Ooo [ 'pubkey' ] [ 1 ] [ 'exponent' ] ,
 oO0Ooo [ 'pubkey' ] [ 1 ] [ 'modulus' ] ,
 IiI11Ii111 )
   if 38 - 38: IiIIii11Ii % Oo * I1Ii1I1 . OooOoo - Ooo0Ooo
   ii1IIiiIIiII . append ( O0O0Ooo0ooOO0 )
   if 14 - 14: I1I % Oo / ooo000
  i1IIiII11 ( "%d usable keys from LDAP" % len ( ii1IIiiIIiII ) )
  if 28 - 28: i1iiIII111 / Ooo0Ooo . iiI . Oo
  if 99 - 99: iiI - OooOoo % Iii1i - O0OooooOo
  if 95 - 95: ii
  if 56 - 56: O0OooooOo - iiI / OooOoo / ooo000 . IIi1i111IiII
  if 78 - 78: ooo000 % IIi1i111IiII - i1
  if 36 - 36: oOo0O00 + OooOoo - Ooo0Ooo / IIi1i111IiII
  O000ooo00O0O0 = None
  try :
   os . stat ( iiI1 )
   O000ooo00O0O0 = True
  except OSError as o00ooo0OO0000 :
   if 17 - 17: I1Ii1I1 * ii % i1iiIII111 * Oo * ii + IIiIIiIi11I1
   if 75 - 75: Ooo0Ooo * ii * Ooo0Ooo + O0OooooOo . Oo
   if 4 - 4: Ii / Ii * ooOOO / I1Ii1I1
   if 37 - 37: OooOoo + oOo0O00 . ii / IiIIii11Ii . Oo - IIi1i111IiII
   if 87 - 87: i1 % ii * i1 - oOo0O00 % Ii * ooo000
   if o00ooo0OO0000 . errno == errno . ENOENT :
    O000ooo00O0O0 = False
    if 50 - 50: i1iiIII111 * Ii % ooOOO . I1I
    if 80 - 80: IiIIii11Ii / ii % IIi1i111IiII * I1I
   elif o00ooo0OO0000 . errno == errno . EACCES :
    OOOO0O0ooO0O ( "Permission denied reading %s" % iiI1 )
    OOOO0O0ooO0O ( "tl-ldap-certalias needs to read the user authorized_keys file to be able" )
    OOOO0O0ooO0O ( "to add and remove valid and invalid certificates from LDAP." )
    return errno . EACCES
    if 100 - 100: oOo0O00 / I1Ii1I1 - i1i1i1111I * I1Ii1I1 / O0OooooOo * Oo
   else :
    OOOO0O0ooO0O ( "Unhandled error: %s" % str ( o00ooo0OO0000 ) )
    return o00ooo0OO0000 . errno
    if 49 - 49: Ooo0Ooo
    if 36 - 36: OooOoo + iiI / Iii1i + iI1iII1I1I1i + OooOoo
    if 6 - 6: IIi1i111IiII + Ii
    if 100 - 100: oOo0O00 % iiI - IiIIii11Ii % i1iiIII111 . i1 % I1Ii1I1
    if 67 - 67: O0OooooOo
    if 21 - 21: ii % i1i1i1111I - i1 + I1I
    if 85 - 85: IiIIii11Ii + I1I + IIi1i111IiII
    if 68 - 68: Iii1i % IiIIii11Ii . i1 - IIi1i111IiII
    if 80 - 80: i1iiIII111 . ooo000
  I11Ii1 = [ ]
  OoO0oO0oo = False
  if 22 - 22: Iii1i % i1i1i1111I * I1I / Ooo0Ooo * Oo
  if O000ooo00O0O0 :
   Ii11iiI1Iiii = open ( iiI1 , 'rt' )
   i1i1iI = Ii11iiI1Iiii . readlines ( )
   Ii11iiI1Iiii . close ( )
   if 53 - 53: ooo000 - i1iiIII111 - ooo000 . Oo
   for i1i1IiII11iI1 in i1i1iI :
    if 69 - 69: IIi1i111IiII
    if 9 - 9: Ii % i1i1i1111I * O0OooooOo + oOo0O00 . oOo0O00 * IIi1i111IiII
    if len ( i1i1IiII11iI1 . strip ( ) ) == 0 :
     continue
     if 12 - 12: ooo000 - Iii1i - IIiIIiIi11I1
     if 21 - 21: OooOoo / ooo000 * oOo0O00 % OooOoo * oOo0O00
     if 87 - 87: IiIIii11Ii * ii . OooOoo % Ii . iiI . IIi1i111IiII
     if 51 - 51: i1i1i1111I % I1I + IiIIii11Ii * Ooo0Ooo / O0OooooOo
     if 19 - 19: i1 / IIi1i111IiII
     if 33 - 33: I1Ii1I1 . iiI
     if 7 - 7: ii - oOo0O00 . i1i1i1111I * Oo + I1I
    if i1i1IiII11iI1 . rfind ( IiI11Ii111 ) == - 1 :
     I11Ii1 . append ( i1i1IiII11iI1 . rstrip ( ) )
    else :
     i1IIiII11 ( "Found key with magic comment, this file needs cleaning" )
     OoO0oO0oo = True
     if 93 - 93: i1iiIII111 - OooOoo + i1 * oOo0O00 . IIi1i111IiII
     if 9 - 9: IIiIIiIi11I1 + iI1iII1I1I1i
     if 43 - 43: oOo0O00 * iiI * iiI / IiIIii11Ii % i1iiIII111
     if 55 - 55: i1iiIII111 . i1
     if 29 - 29: Ooo0Ooo * IiIIii11Ii + i1iiIII111 / iI1iII1I1I1i - IiIIii11Ii - oOo0O00
     if 63 - 63: I1Ii1I1 . IIi1i111IiII * ooOOO . ii / I1I
     if 34 - 34: i1i1i1111I * i1i1i1111I * O0OooooOo . Iii1i * iiI % ooo000
  iI11I1iIIi = ( len ( I11Ii1 ) + len ( ii1IIiiIIiII ) ) > 0
  if 99 - 99: oOo0O00 * iI1iII1I1I1i / O0OooooOo % ooo000 . IiIIii11Ii
  if iI11I1iIIi :
   i1IIiII11 ( "User needs authorized keys file (%d existing keys, %d certs in ldap)" % ( len ( I11Ii1 ) , len ( ii1IIiiIIiII ) ) )
   if 65 - 65: i1
  if O000ooo00O0O0 :
   i1IIiII11 ( "User has authorized keys file" )
   if 79 - 79: O0OooooOo / iI1iII1I1I1i / I1Ii1I1 / iiI % OooOoo * IIiIIiIi11I1
  if len ( I11Ii1 ) > 0 :
   i1IIiII11 ( "User has pre-existing ssh keys" )
   if 46 - 46: i1
  if OoO0oO0oo :
   i1IIiII11 ( "Authorized keys file contain old tl-ldap-certalias keys" )
   if 98 - 98: i1i1i1111I / IiIIii11Ii + Ii / I1I
   if 67 - 67: IIiIIiIi11I1 - Ii - Ii
  if oo0o0o0oO0OO :
   iI11I1iIIi = False
   OoO0oO0oo = False
   if 84 - 84: O0OooooOo . ooOOO * ooOOO
   if 75 - 75: I1Ii1I1 % ooo000 - iiI + i1i1i1111I * O0OooooOo
   if 33 - 33: O0OooooOo / IiIIii11Ii - IIiIIiIi11I1 + IIiIIiIi11I1
  if iI11I1iIIi and not O000ooo00O0O0 :
   if 78 - 78: O0OooooOo
   try :
    os . stat ( O0O0oOOoo )
   except OSError as o00ooo0OO0000 :
    if o00ooo0OO0000 . errno == errno . ENOENT :
     if 18 - 18: i1 / O0OooooOo . ooOOO * I1I
     i1I11ii ( "Creating home directory %s for user %s" % ( O0O0oOOoo , ooo ) )
     if 20 - 20: IiIIii11Ii / IIi1i111IiII
     if 92 - 92: i1
     OoO0OOo0o0Ooo = Ooo0ooOoO . get_string ( "/vsmagent/make_homedir_mode" , "0700" )
     try :
      if 6 - 6: iiI % I1Ii1I1
      if 18 - 18: Ii % OooOoo % I1Ii1I1 . I1Ii1I1 + ooo000 % IIi1i111IiII
      if 73 - 73: oOo0O00 . I1I . IIi1i111IiII - IIiIIiIi11I1 - i1 / Ooo0Ooo
      if 77 - 77: I1Ii1I1 % IIi1i111IiII
      if OoO0OOo0o0Ooo [ 0 ] == '0' :
       o0OO00ooOOooo = int ( OoO0OOo0o0Ooo [ 1 : ] , 8 )
      else :
       o0OO00ooOOooo = int ( OoO0OOo0o0Ooo , 10 )
     except ValueError :
      OOOO0O0ooO0O ( "Invalid format of hiveconf variable /vsmagent/make_homedir_mode/: %s"
 % OoO0OOo0o0Ooo )
      o0OO00ooOOooo = 0o700
      if 26 - 26: Ooo0Ooo % IIi1i111IiII / I1Ii1I1 . IIi1i111IiII - IIi1i111IiII
     if not oo0o0o0oO0OO :
      iI1 = oOo ( O0O0oOOoo , o0OO00ooOOooo , ii1ii1iIIIi1 , OOO0ooooo00o )
      if 17 - 17: Iii1i % Ooo0Ooo * Ooo0Ooo % Ii + O0OooooOo
      if 55 - 55: ooo000 - IiIIii11Ii
      if 76 - 76: iiI * Ooo0Ooo . ooOOO / i1 - oOo0O00 . IIi1i111IiII
      if 70 - 70: I1I + Iii1i . O0OooooOo % Oo
      if 67 - 67: ooo000
      if iI1 != 0 :
       OOOO0O0ooO0O ( "Failed to create home directory %s for user %s: error %d [%s]" %
 ( O0O0oOOoo , ooo , iI1 , errno . errorcode [ iI1 ] ) )
       continue
      else :
       i1I11ii ( "Created %s" % O0O0oOOoo )
       if 84 - 84: i1iiIII111 * Ooo0Ooo
       if 47 - 47: OooOoo
       if iiiIiiI :
        i1IIiII11 ( "Restoring SELinux context for path %s" % O0O0oOOoo )
        thinlinc . selinux . selinux_restorecon ( OOOO0O0ooO0O , O0O0oOOoo )
        if 55 - 55: ooOOO % ii + iiI - IIi1i111IiII + ooo000 + I1I
     else :
      i1I11ii ( "Simulating - will not create %s" % O0O0oOOoo )
      if 53 - 53: IIiIIiIi11I1 % IiIIii11Ii / ii % ooOOO - oOo0O00
    else :
     if 74 - 74: ooo000 * OooOoo * Oo
     if 96 - 96: I1Ii1I1 - Oo
     if 28 - 28: i1iiIII111 - IIi1i111IiII % Ii * ooo000 / Iii1i
     OOOO0O0ooO0O ( "Unhandled error while creating home directory: %s" % str ( o00ooo0OO0000 ) )
     return o00ooo0OO0000 . errno
     if 12 - 12: IIi1i111IiII - Ooo0Ooo
     if 12 - 12: ooOOO
   try :
    os . stat ( OOO0OO0oo )
   except OSError as o00ooo0OO0000 :
    if o00ooo0OO0000 . errno == errno . ENOENT :
     i1I11ii ( "%s missing, trying to create." % OOO0OO0oo )
     iI1 = oOo ( OOO0OO0oo , 0o700 , ii1ii1iIIIi1 , OOO0ooooo00o )
     if iI1 != 0 :
      OOOO0O0ooO0O ( "Failed to create %s: errno %d, %s" % ( OOO0OO0oo , iI1 , errno . errorcode [ iI1 ] ) )
      continue
     else :
      i1I11ii ( "Created %s" % OOO0OO0oo )
      if 29 - 29: IIi1i111IiII . ooo000 . ooo000
     if iiiIiiI :
      thinlinc . selinux . selinux_restorecon ( OOOO0O0ooO0O , OOO0OO0oo )
      if 79 - 79: oOo0O00 % IIi1i111IiII * I1Ii1I1 . IIiIIiIi11I1 * Iii1i - I1I
  if oo0o0o0oO0OO :
   continue
   if 85 - 85: I1I + IIi1i111IiII . O0OooooOo % i1 * IIi1i111IiII
   if 22 - 22: IiIIii11Ii . Iii1i / i1i1i1111I / ooo000 + ooo000 + ooo000
   if 76 - 76: Iii1i % i1i1i1111I
   if 12 - 12: ii + IiIIii11Ii % ooOOO + IIi1i111IiII / I1I
   if 59 - 59: Iii1i % I1Ii1I1 + O0OooooOo - Oo
  if len ( ii1IIiiIIiII ) or OoO0oO0oo :
   if not IiII11i11II ( O0OO ) :
    i1I11ii ( "Unable to get exclusive lock for %s, skipping user" % ( iiI1 ) )
    continue
    if 72 - 72: O0OooooOo
   O0O = open ( iiI1 , 'wt' )
   if 69 - 69: iI1iII1I1I1i + iiI - i1 - iI1iII1I1I1i + iI1iII1I1I1i
   for i1i1IiII11iI1 in I11Ii1 + ii1IIiiIIiII :
    i1IIiII11 ( "  Writing key to file..." )
    O0O . write ( i1i1IiII11iI1 + "\n" )
   else :
    i1IIiII11 ( " Cleaning up old keys from authorized_keys file" )
    if 76 - 76: IIiIIiIi11I1
   O0O . close ( )
   if 15 - 15: ooo000 . i1 * i1
   os . chown ( iiI1 , ii1ii1iIIIi1 , OOO0ooooo00o )
   os . chmod ( iiI1 , 0o600 )
   if 41 - 41: O0OooooOo + Iii1i % ooOOO * i1
   if iiiIiiI :
    thinlinc . selinux . selinux_restorecon ( OOOO0O0ooO0O , iiI1 )
    if 37 - 37: ooo000
   if not o0oOo0o0ooooo ( O0OO ) :
    OOOO0O0ooO0O ( "Unable to release lock %s." )
    OOOO0O0ooO0O ( "A likely cause of this is multiple simultaneous tl-ldap-certalias" )
    OOOO0O0ooO0O ( "processes. If this is not the case, remove the lock file and try again." )
    return 1
    if 87 - 87: i1i1i1111I + I1Ii1I1 % i1iiIII111 - I1I + ooOOO % I1Ii1I1
    if 96 - 96: IIiIIiIi11I1 / I1I * i1 / I1I + I1I / i1
    if 80 - 80: Oo / i1i1i1111I . IIiIIiIi11I1
    if 79 - 79: ii
    if 6 - 6: IIi1i111IiII + IIiIIiIi11I1 + ooOOO % IIiIIiIi11I1
 i1I11ii ( "Done with dealing with users and certificates" )
 i1I11ii ( "Updating /etc/passwdaliases file" )
 if not oo0o0o0oO0OO :
  try :
   i1ii11iIIIIiI , Ii1ii1II = tempfile . mkstemp ( prefix = ".passwdaliases." , dir = "/etc" )
  except OSError as o00ooo0OO0000 :
   if o00ooo0OO0000 . errno == errno . EPERM :
    OOOO0O0ooO0O ( "Failed to create new temporary file for passwdaliases" )
    return 1 ;
    if 70 - 70: O0OooooOo
  OoOo00OO0oo0 = ( "# This file is AUTOGENERATED by tl-ldap-certalias.\n"
 "# Do not modify, changes will be overwritten.\n" ) . encode ( locale . getpreferredencoding ( ) )
  os . write ( i1ii11iIIIIiI , OoOo00OO0oo0 )
  if 27 - 27: Oo % IiIIii11Ii + ooOOO % I1Ii1I1
  if 71 - 71: ooOOO / IIi1i111IiII - i1iiIII111
  for iiiiiIIIIi1 in o0000o :
   if 47 - 47: Ooo0Ooo - I1I
   if len ( o0000o [ iiiiiIIIIi1 ] ) == 0 :
    continue
    if 54 - 54: IiIIii11Ii + ooOOO - I1Ii1I1 - OooOoo % i1 % Oo
   for oO0Ooo in o0000o [ iiiiiIIIIi1 ] :
    i1IIiII11 ( "  Associating %s with uid %d" % ( oO0Ooo [ 'subject' ] , int ( iiiiiIIIIi1 ) ) )
    OOoOooo000O0O = "%s:%d\n" % ( oO0Ooo [ 'subject' ] , int ( iiiiiIIIIi1 ) )
    os . write ( i1ii11iIIIIiI , OOoOooo000O0O . encode ( locale . getpreferredencoding ( ) ) )
    if 93 - 93: ii / ooo000 - I1I
  os . fsync ( i1ii11iIIIIiI )
  os . close ( i1ii11iIIIIiI )
  os . chmod ( Ii1ii1II , 0o644 )
  os . rename ( Ii1ii1II , "/etc/passwdaliases" )
  if 19 - 19: IIiIIiIi11I1 / I1Ii1I1 . IIiIIiIi11I1 - O0OooooOo / i1iiIII111 % IIiIIiIi11I1
  if iiiIiiI :
   thinlinc . selinux . selinux_restorecon ( "/etc/passwdaliases" )
   if 39 - 39: iiI % ooo000 . Oo
 i1I11ii ( "Done, exiting." )
 return 0
 if 89 - 89: I1I . ooOOO
if "__main__" == __name__ :
 iI1 = III1111 ( )
 if 61 - 61: iI1iII1I1I1i . i1iiIII111 * IiIIii11Ii + ii + ooOOO % IiIIii11Ii
 if iI1 != 0 :
  i1I11ii ( "tl-ldap-certalias returned error code %d" % iI1 )
  if 3 - 3: IiIIii11Ii . IIi1i111IiII * iiI / iiI
 sys . exit ( iI1 )
# dd678faae9ac167bc83abf78e5cb2f3f0688d3a3
