greenbone /
python-gvm
| @@ 2476-2724 (lines=249) @@ | ||
| 2473 | ||
| 2474 | return self._send_xml_command(cmd) |
|
| 2475 | ||
| 2476 | def create_credential( |
|
| 2477 | self, |
|
| 2478 | name: str, |
|
| 2479 | credential_type: CredentialType, |
|
| 2480 | *, |
|
| 2481 | comment: Optional[str] = None, |
|
| 2482 | allow_insecure: Optional[bool] = None, |
|
| 2483 | certificate: Optional[str] = None, |
|
| 2484 | key_phrase: Optional[str] = None, |
|
| 2485 | private_key: Optional[str] = None, |
|
| 2486 | login: Optional[str] = None, |
|
| 2487 | password: Optional[str] = None, |
|
| 2488 | auth_algorithm: Optional[SnmpAuthAlgorithm] = None, |
|
| 2489 | community: Optional[str] = None, |
|
| 2490 | privacy_algorithm: Optional[SnmpPrivacyAlgorithm] = None, |
|
| 2491 | privacy_password: Optional[str] = None, |
|
| 2492 | public_key: Optional[str] = None, |
|
| 2493 | ) -> Any: |
|
| 2494 | """Create a new credential |
|
| 2495 | ||
| 2496 | Create a new credential e.g. to be used in the method of an alert. |
|
| 2497 | ||
| 2498 | Currently the following credential types are supported: |
|
| 2499 | ||
| 2500 | - Username + Password |
|
| 2501 | - Username + SSH-Key |
|
| 2502 | - Client Certificates |
|
| 2503 | - SNMPv1 or SNMPv2c protocol |
|
| 2504 | - S/MIME Certificate |
|
| 2505 | - OpenPGP Key |
|
| 2506 | - Password only |
|
| 2507 | ||
| 2508 | Arguments: |
|
| 2509 | name: Name of the new credential |
|
| 2510 | credential_type: The credential type. |
|
| 2511 | comment: Comment for the credential |
|
| 2512 | allow_insecure: Whether to allow insecure use of the credential |
|
| 2513 | certificate: Certificate for the credential. |
|
| 2514 | Required for client-certificate and smime credential types. |
|
| 2515 | key_phrase: Key passphrase for the private key. |
|
| 2516 | Used for the username+ssh-key credential type. |
|
| 2517 | private_key: Private key to use for login. Required |
|
| 2518 | for usk credential type. Also used for the cc credential type. |
|
| 2519 | The supported key types (dsa, rsa, ecdsa, ...) and formats (PEM, |
|
| 2520 | PKC#12, OpenSSL, ...) depend on your installed GnuTLS version. |
|
| 2521 | login: Username for the credential. Required for username+password, |
|
| 2522 | username+ssh-key and snmp credential type. |
|
| 2523 | password: Password for the credential. Used for username+password |
|
| 2524 | and snmp credential types. |
|
| 2525 | community: The SNMP community |
|
| 2526 | auth_algorithm: The SNMP authentication algorithm. Required for snmp |
|
| 2527 | credential type. |
|
| 2528 | privacy_algorithm: The SNMP privacy algorithm |
|
| 2529 | privacy_password: The SNMP privacy password |
|
| 2530 | public_key: PGP public key in *armor* plain text format. Required |
|
| 2531 | for pgp credential type. |
|
| 2532 | ||
| 2533 | Examples: |
|
| 2534 | Creating a Username + Password credential |
|
| 2535 | ||
| 2536 | .. code-block:: python |
|
| 2537 | ||
| 2538 | gmp.create_credential( |
|
| 2539 | name='UP Credential', |
|
| 2540 | credential_type=CredentialType.USERNAME_PASSWORD, |
|
| 2541 | login='foo', |
|
| 2542 | password='bar', |
|
| 2543 | ) |
|
| 2544 | ||
| 2545 | Creating a Username + SSH Key credential |
|
| 2546 | ||
| 2547 | .. code-block:: python |
|
| 2548 | ||
| 2549 | with open('path/to/private-ssh-key') as f: |
|
| 2550 | key = f.read() |
|
| 2551 | ||
| 2552 | gmp.create_credential( |
|
| 2553 | name='USK Credential', |
|
| 2554 | credential_type=CredentialType.USERNAME_SSH_KEY, |
|
| 2555 | login='foo', |
|
| 2556 | key_phrase='foobar', |
|
| 2557 | private_key=key, |
|
| 2558 | ) |
|
| 2559 | ||
| 2560 | Creating a PGP credential |
|
| 2561 | ||
| 2562 | .. note:: |
|
| 2563 | ||
| 2564 | A compatible public pgp key file can be exported with GnuPG via |
|
| 2565 | :: |
|
| 2566 | ||
| 2567 | $ gpg --armor --export [email protected] > alice.asc |
|
| 2568 | ||
| 2569 | .. code-block:: python |
|
| 2570 | ||
| 2571 | with open('path/to/pgp.key.asc') as f: |
|
| 2572 | key = f.read() |
|
| 2573 | ||
| 2574 | gmp.create_credential( |
|
| 2575 | name='PGP Credential', |
|
| 2576 | credential_type=CredentialType.PGP_ENCRYPTION_KEY, |
|
| 2577 | public_key=key, |
|
| 2578 | ) |
|
| 2579 | ||
| 2580 | Creating a S/MIME credential |
|
| 2581 | ||
| 2582 | .. code-block:: python |
|
| 2583 | ||
| 2584 | with open('path/to/smime-cert') as f: |
|
| 2585 | cert = f.read() |
|
| 2586 | ||
| 2587 | gmp.create_credential( |
|
| 2588 | name='SMIME Credential', |
|
| 2589 | credential_type=CredentialType.SMIME_CERTIFICATE, |
|
| 2590 | certificate=cert, |
|
| 2591 | ) |
|
| 2592 | ||
| 2593 | Creating a Password-Only credential |
|
| 2594 | ||
| 2595 | .. code-block:: python |
|
| 2596 | ||
| 2597 | gmp.create_credential( |
|
| 2598 | name='Password-Only Credential', |
|
| 2599 | credential_type=CredentialType.PASSWORD_ONLY, |
|
| 2600 | password='foo', |
|
| 2601 | ) |
|
| 2602 | Returns: |
|
| 2603 | The response. See :py:meth:`send_command` for details. |
|
| 2604 | """ |
|
| 2605 | if not name: |
|
| 2606 | raise RequiredArgument( |
|
| 2607 | function=self.create_credential.__name__, argument='name' |
|
| 2608 | ) |
|
| 2609 | ||
| 2610 | if not isinstance(credential_type, self.types.CredentialType): |
|
| 2611 | raise InvalidArgumentType( |
|
| 2612 | function=self.create_credential.__name__, |
|
| 2613 | argument='credential_type', |
|
| 2614 | arg_type=CredentialType.__name__, |
|
| 2615 | ) |
|
| 2616 | ||
| 2617 | cmd = XmlCommand("create_credential") |
|
| 2618 | cmd.add_element("name", name) |
|
| 2619 | ||
| 2620 | cmd.add_element("type", credential_type.value) |
|
| 2621 | ||
| 2622 | if comment: |
|
| 2623 | cmd.add_element("comment", comment) |
|
| 2624 | ||
| 2625 | if allow_insecure is not None: |
|
| 2626 | cmd.add_element("allow_insecure", _to_bool(allow_insecure)) |
|
| 2627 | ||
| 2628 | if ( |
|
| 2629 | credential_type == CredentialType.CLIENT_CERTIFICATE |
|
| 2630 | or credential_type == CredentialType.SMIME_CERTIFICATE |
|
| 2631 | ): |
|
| 2632 | if not certificate: |
|
| 2633 | raise RequiredArgument( |
|
| 2634 | function=self.create_credential.__name__, |
|
| 2635 | argument='certificate', |
|
| 2636 | ) |
|
| 2637 | ||
| 2638 | cmd.add_element("certificate", certificate) |
|
| 2639 | ||
| 2640 | if ( |
|
| 2641 | credential_type == CredentialType.USERNAME_PASSWORD |
|
| 2642 | or credential_type == CredentialType.USERNAME_SSH_KEY |
|
| 2643 | or credential_type == CredentialType.SNMP |
|
| 2644 | ): |
|
| 2645 | if not login: |
|
| 2646 | raise RequiredArgument( |
|
| 2647 | function=self.create_credential.__name__, argument='login' |
|
| 2648 | ) |
|
| 2649 | ||
| 2650 | cmd.add_element("login", login) |
|
| 2651 | ||
| 2652 | if credential_type == CredentialType.PASSWORD_ONLY and not password: |
|
| 2653 | raise RequiredArgument( |
|
| 2654 | function=self.create_credential.__name__, argument='password' |
|
| 2655 | ) |
|
| 2656 | ||
| 2657 | if ( |
|
| 2658 | credential_type == CredentialType.USERNAME_PASSWORD |
|
| 2659 | or credential_type == CredentialType.SNMP |
|
| 2660 | or credential_type == CredentialType.PASSWORD_ONLY |
|
| 2661 | ) and password: |
|
| 2662 | cmd.add_element("password", password) |
|
| 2663 | ||
| 2664 | if credential_type == CredentialType.USERNAME_SSH_KEY: |
|
| 2665 | if not private_key: |
|
| 2666 | raise RequiredArgument( |
|
| 2667 | function=self.create_credential.__name__, |
|
| 2668 | argument='private_key', |
|
| 2669 | ) |
|
| 2670 | ||
| 2671 | _xmlkey = cmd.add_element("key") |
|
| 2672 | _xmlkey.add_element("private", private_key) |
|
| 2673 | ||
| 2674 | if key_phrase: |
|
| 2675 | _xmlkey.add_element("phrase", key_phrase) |
|
| 2676 | ||
| 2677 | if credential_type == CredentialType.CLIENT_CERTIFICATE and private_key: |
|
| 2678 | _xmlkey = cmd.add_element("key") |
|
| 2679 | _xmlkey.add_element("private", private_key) |
|
| 2680 | ||
| 2681 | if credential_type == CredentialType.SNMP: |
|
| 2682 | if not isinstance(auth_algorithm, self.types.SnmpAuthAlgorithm): |
|
| 2683 | raise InvalidArgumentType( |
|
| 2684 | function=self.create_credential.__name__, |
|
| 2685 | argument='auth_algorithm', |
|
| 2686 | arg_type=SnmpAuthAlgorithm.__name__, |
|
| 2687 | ) |
|
| 2688 | ||
| 2689 | cmd.add_element("auth_algorithm", auth_algorithm.value) |
|
| 2690 | ||
| 2691 | if community: |
|
| 2692 | cmd.add_element("community", community) |
|
| 2693 | ||
| 2694 | if privacy_algorithm is not None or privacy_password: |
|
| 2695 | _xmlprivacy = cmd.add_element("privacy") |
|
| 2696 | ||
| 2697 | if privacy_algorithm is not None: |
|
| 2698 | if not isinstance( |
|
| 2699 | privacy_algorithm, self.types.SnmpPrivacyAlgorithm |
|
| 2700 | ): |
|
| 2701 | raise InvalidArgumentType( |
|
| 2702 | function=self.create_credential.__name__, |
|
| 2703 | argument='privacy_algorithm', |
|
| 2704 | arg_type=SnmpPrivacyAlgorithm.__name__, |
|
| 2705 | ) |
|
| 2706 | ||
| 2707 | _xmlprivacy.add_element( |
|
| 2708 | "algorithm", privacy_algorithm.value |
|
| 2709 | ) |
|
| 2710 | ||
| 2711 | if privacy_password: |
|
| 2712 | _xmlprivacy.add_element("password", privacy_password) |
|
| 2713 | ||
| 2714 | if credential_type == CredentialType.PGP_ENCRYPTION_KEY: |
|
| 2715 | if not public_key: |
|
| 2716 | raise RequiredArgument( |
|
| 2717 | function=self.create_credential.__name__, |
|
| 2718 | argument='public_key', |
|
| 2719 | ) |
|
| 2720 | ||
| 2721 | _xmlkey = cmd.add_element("key") |
|
| 2722 | _xmlkey.add_element("public", public_key) |
|
| 2723 | ||
| 2724 | return self._send_xml_command(cmd) |
|
| 2725 | ||
| 2726 | def modify_credential( |
|
| 2727 | self, |
|
| @@ 56-304 (lines=249) @@ | ||
| 53 | # Is authenticated on gvmd |
|
| 54 | self._authenticated = False |
|
| 55 | ||
| 56 | def create_credential( |
|
| 57 | self, |
|
| 58 | name: str, |
|
| 59 | credential_type: CredentialType, |
|
| 60 | *, |
|
| 61 | comment: Optional[str] = None, |
|
| 62 | allow_insecure: Optional[bool] = None, |
|
| 63 | certificate: Optional[str] = None, |
|
| 64 | key_phrase: Optional[str] = None, |
|
| 65 | private_key: Optional[str] = None, |
|
| 66 | login: Optional[str] = None, |
|
| 67 | password: Optional[str] = None, |
|
| 68 | auth_algorithm: Optional[SnmpAuthAlgorithm] = None, |
|
| 69 | community: Optional[str] = None, |
|
| 70 | privacy_algorithm: Optional[SnmpPrivacyAlgorithm] = None, |
|
| 71 | privacy_password: Optional[str] = None, |
|
| 72 | public_key: Optional[str] = None, |
|
| 73 | ) -> Any: |
|
| 74 | """Create a new credential |
|
| 75 | ||
| 76 | Create a new credential e.g. to be used in the method of an alert. |
|
| 77 | ||
| 78 | Currently the following credential types are supported: |
|
| 79 | ||
| 80 | - Username + Password |
|
| 81 | - Username + SSH-Key |
|
| 82 | - Client Certificates |
|
| 83 | - SNMPv1 or SNMPv2c protocol |
|
| 84 | - S/MIME Certificate |
|
| 85 | - OpenPGP Key |
|
| 86 | - Password only |
|
| 87 | ||
| 88 | Arguments: |
|
| 89 | name: Name of the new credential |
|
| 90 | credential_type: The credential type. |
|
| 91 | comment: Comment for the credential |
|
| 92 | allow_insecure: Whether to allow insecure use of the credential |
|
| 93 | certificate: Certificate for the credential. |
|
| 94 | Required for client-certificate and smime credential types. |
|
| 95 | key_phrase: Key passphrase for the private key. |
|
| 96 | Used for the username+ssh-key credential type. |
|
| 97 | private_key: Private key to use for login. Required |
|
| 98 | for usk credential type. Also used for the cc credential type. |
|
| 99 | The supported key types (dsa, rsa, ecdsa, ...) and formats (PEM, |
|
| 100 | PKC#12, OpenSSL, ...) depend on your installed GnuTLS version. |
|
| 101 | login: Username for the credential. Required for username+password, |
|
| 102 | username+ssh-key and snmp credential type. |
|
| 103 | password: Password for the credential. Used for username+password |
|
| 104 | and snmp credential types. |
|
| 105 | community: The SNMP community |
|
| 106 | auth_algorithm: The SNMP authentication algorithm. Required for snmp |
|
| 107 | credential type. |
|
| 108 | privacy_algorithm: The SNMP privacy algorithm |
|
| 109 | privacy_password: The SNMP privacy password |
|
| 110 | public_key: PGP public key in *armor* plain text format. Required |
|
| 111 | for pgp credential type. |
|
| 112 | ||
| 113 | Examples: |
|
| 114 | Creating a Username + Password credential |
|
| 115 | ||
| 116 | .. code-block:: python |
|
| 117 | ||
| 118 | gmp.create_credential( |
|
| 119 | name='UP Credential', |
|
| 120 | credential_type=CredentialType.USERNAME_PASSWORD, |
|
| 121 | login='foo', |
|
| 122 | password='bar', |
|
| 123 | ) |
|
| 124 | ||
| 125 | Creating a Username + SSH Key credential |
|
| 126 | ||
| 127 | .. code-block:: python |
|
| 128 | ||
| 129 | with open('path/to/private-ssh-key') as f: |
|
| 130 | key = f.read() |
|
| 131 | ||
| 132 | gmp.create_credential( |
|
| 133 | name='USK Credential', |
|
| 134 | credential_type=CredentialType.USERNAME_SSH_KEY, |
|
| 135 | login='foo', |
|
| 136 | key_phrase='foobar', |
|
| 137 | private_key=key, |
|
| 138 | ) |
|
| 139 | ||
| 140 | Creating a PGP credential |
|
| 141 | ||
| 142 | .. note:: |
|
| 143 | ||
| 144 | A compatible public pgp key file can be exported with GnuPG via |
|
| 145 | :: |
|
| 146 | ||
| 147 | $ gpg --armor --export [email protected] > alice.asc |
|
| 148 | ||
| 149 | .. code-block:: python |
|
| 150 | ||
| 151 | with open('path/to/pgp.key.asc') as f: |
|
| 152 | key = f.read() |
|
| 153 | ||
| 154 | gmp.create_credential( |
|
| 155 | name='PGP Credential', |
|
| 156 | credential_type=CredentialType.PGP_ENCRYPTION_KEY, |
|
| 157 | public_key=key, |
|
| 158 | ) |
|
| 159 | ||
| 160 | Creating a S/MIME credential |
|
| 161 | ||
| 162 | .. code-block:: python |
|
| 163 | ||
| 164 | with open('path/to/smime-cert') as f: |
|
| 165 | cert = f.read() |
|
| 166 | ||
| 167 | gmp.create_credential( |
|
| 168 | name='SMIME Credential', |
|
| 169 | credential_type=CredentialType.SMIME_CERTIFICATE, |
|
| 170 | certificate=cert, |
|
| 171 | ) |
|
| 172 | ||
| 173 | Creating a Password-Only credential |
|
| 174 | ||
| 175 | .. code-block:: python |
|
| 176 | ||
| 177 | gmp.create_credential( |
|
| 178 | name='Password-Only Credential', |
|
| 179 | credential_type=CredentialType.PASSWORD_ONLY, |
|
| 180 | password='foo', |
|
| 181 | ) |
|
| 182 | Returns: |
|
| 183 | The response. See :py:meth:`send_command` for details. |
|
| 184 | """ |
|
| 185 | if not name: |
|
| 186 | raise RequiredArgument( |
|
| 187 | function=self.create_credential.__name__, argument='name' |
|
| 188 | ) |
|
| 189 | ||
| 190 | if not isinstance(credential_type, self.types.CredentialType): |
|
| 191 | raise InvalidArgumentType( |
|
| 192 | function=self.create_credential.__name__, |
|
| 193 | argument='credential_type', |
|
| 194 | arg_type=CredentialType.__name__, |
|
| 195 | ) |
|
| 196 | ||
| 197 | cmd = XmlCommand("create_credential") |
|
| 198 | cmd.add_element("name", name) |
|
| 199 | ||
| 200 | cmd.add_element("type", credential_type.value) |
|
| 201 | ||
| 202 | if comment: |
|
| 203 | cmd.add_element("comment", comment) |
|
| 204 | ||
| 205 | if allow_insecure is not None: |
|
| 206 | cmd.add_element("allow_insecure", _to_bool(allow_insecure)) |
|
| 207 | ||
| 208 | if ( |
|
| 209 | credential_type == CredentialType.CLIENT_CERTIFICATE |
|
| 210 | or credential_type == CredentialType.SMIME_CERTIFICATE |
|
| 211 | ): |
|
| 212 | if not certificate: |
|
| 213 | raise RequiredArgument( |
|
| 214 | function=self.create_credential.__name__, |
|
| 215 | argument='certificate', |
|
| 216 | ) |
|
| 217 | ||
| 218 | cmd.add_element("certificate", certificate) |
|
| 219 | ||
| 220 | if ( |
|
| 221 | credential_type == CredentialType.USERNAME_PASSWORD |
|
| 222 | or credential_type == CredentialType.USERNAME_SSH_KEY |
|
| 223 | or credential_type == CredentialType.SNMP |
|
| 224 | ): |
|
| 225 | if not login: |
|
| 226 | raise RequiredArgument( |
|
| 227 | function=self.create_credential.__name__, argument='login' |
|
| 228 | ) |
|
| 229 | ||
| 230 | cmd.add_element("login", login) |
|
| 231 | ||
| 232 | if credential_type == CredentialType.PASSWORD_ONLY and not password: |
|
| 233 | raise RequiredArgument( |
|
| 234 | function=self.create_credential.__name__, argument='password' |
|
| 235 | ) |
|
| 236 | ||
| 237 | if ( |
|
| 238 | credential_type == CredentialType.USERNAME_PASSWORD |
|
| 239 | or credential_type == CredentialType.SNMP |
|
| 240 | or credential_type == CredentialType.PASSWORD_ONLY |
|
| 241 | ) and password: |
|
| 242 | cmd.add_element("password", password) |
|
| 243 | ||
| 244 | if credential_type == CredentialType.USERNAME_SSH_KEY: |
|
| 245 | if not private_key: |
|
| 246 | raise RequiredArgument( |
|
| 247 | function=self.create_credential.__name__, |
|
| 248 | argument='private_key', |
|
| 249 | ) |
|
| 250 | ||
| 251 | _xmlkey = cmd.add_element("key") |
|
| 252 | _xmlkey.add_element("private", private_key) |
|
| 253 | ||
| 254 | if key_phrase: |
|
| 255 | _xmlkey.add_element("phrase", key_phrase) |
|
| 256 | ||
| 257 | if credential_type == CredentialType.CLIENT_CERTIFICATE and private_key: |
|
| 258 | _xmlkey = cmd.add_element("key") |
|
| 259 | _xmlkey.add_element("private", private_key) |
|
| 260 | ||
| 261 | if credential_type == CredentialType.SNMP: |
|
| 262 | if not isinstance(auth_algorithm, self.types.SnmpAuthAlgorithm): |
|
| 263 | raise InvalidArgumentType( |
|
| 264 | function=self.create_credential.__name__, |
|
| 265 | argument='auth_algorithm', |
|
| 266 | arg_type=SnmpAuthAlgorithm.__name__, |
|
| 267 | ) |
|
| 268 | ||
| 269 | cmd.add_element("auth_algorithm", auth_algorithm.value) |
|
| 270 | ||
| 271 | if community: |
|
| 272 | cmd.add_element("community", community) |
|
| 273 | ||
| 274 | if privacy_algorithm is not None or privacy_password: |
|
| 275 | _xmlprivacy = cmd.add_element("privacy") |
|
| 276 | ||
| 277 | if privacy_algorithm is not None: |
|
| 278 | if not isinstance( |
|
| 279 | privacy_algorithm, self.types.SnmpPrivacyAlgorithm |
|
| 280 | ): |
|
| 281 | raise InvalidArgumentType( |
|
| 282 | function=self.create_credential.__name__, |
|
| 283 | argument='privacy_algorithm', |
|
| 284 | arg_type=SnmpPrivacyAlgorithm.__name__, |
|
| 285 | ) |
|
| 286 | ||
| 287 | _xmlprivacy.add_element( |
|
| 288 | "algorithm", privacy_algorithm.value |
|
| 289 | ) |
|
| 290 | ||
| 291 | if privacy_password: |
|
| 292 | _xmlprivacy.add_element("password", privacy_password) |
|
| 293 | ||
| 294 | if credential_type == CredentialType.PGP_ENCRYPTION_KEY: |
|
| 295 | if not public_key: |
|
| 296 | raise RequiredArgument( |
|
| 297 | function=self.create_credential.__name__, |
|
| 298 | argument='public_key', |
|
| 299 | ) |
|
| 300 | ||
| 301 | _xmlkey = cmd.add_element("key") |
|
| 302 | _xmlkey.add_element("public", public_key) |
|
| 303 | ||
| 304 | return self._send_xml_command(cmd) |
|
| 305 | ||
| 306 | def modify_credential( |
|
| 307 | self, |
|
