a oelD@s\dZddlmZddlmZddlZddlZddlZddlZddlZddl Z ddl m Z ddl m Z ddl m Z ddl mZdd l mZdd l mZdd l mZdd l mZdd l mZddlmZddlmZddlmZddlmZddlmZddlmZddlmZddlmZddlm Z ddlm!Z!ddl"m#Z$ddl"m%Z&ddl'm(Z(ej)dkrnddl*m+Z,nddl,Z,e-e.Z/e0e0dddZ1e0e0ddd Z2e3d!Z4e3d"ej5Z6Gd#d$d$e&ed%Z%Gd&d'd'e$e%ed%Z#Gd(d)d)e#ej7ed%Z8ed*d+d,Z9Gd-d+d+Z:Gd.d/d/Z;e0e0e0e e0dd0d1d2ZszPlugin.__init__).N)addrcCsdS)zAdd plugin arguments to the CLI argument parser. :param callable add: Function that proxies calls to `argparse.ArgumentParser.add_argument` prepending options with unique plugin name prefix. Nr!)clsr0r!r!r#add_parser_argumentsCszPlugin.add_parser_arguments)parserrrcs$tttddfdd }||S)zkInject parser options. See `~.certbot.interfaces.Plugin.inject_parser_options` for docs. N)arg_name_no_prefixargskwargsrcs(jdt|g|Ri|dS)Nz--{0}{1}) add_argumentformatr$)r4r5r6rr3r!r#r0Vsz)Plugin.inject_parser_options..add)strrr2)r1r3rr0r!r9r#inject_parser_optionsNszPlugin.inject_parser_optionsrcCs t|jS)r)r$rr-r!r!r#r$\szPlugin.option_namespacercCs |j|S)z'Option name (include plugin namespace).)r$)r-rr!r!r# option_nameaszPlugin.option_namecCs t|jS)r%)r(rr=r!r!r#r(eszPlugin.dest_namespace)varrcCs|j|ddS)z.Find a destination for given variable ``var``.r r&)r(r'r-r?r!r!r#destjsz Plugin.destcCst|j||S)z0Find a configuration value for variable ``var``.)getattrr)rAr@r!r!r#confpsz Plugin.conf)failed_achallsrcCs(dtdd|D}dj|j|dS)a9Human-readable string to help the user troubleshoot the authenticator. Shown to the user if one or more of the attempted challenges were not a success. Should describe, in simple language, what the authenticator tried to do, what went wrong and what the user should try as their "next steps". TODO: auth_hint belongs in Authenticator but can't be added until the next major version of Certbot. For now, it lives in .Plugin and auth_handler will only call it on authenticators that subclass .Plugin. For now, inherit from `.Plugin` to implement and/or override the method. :param list failed_achalls: List of one or more failed challenges (:class:`achallenges.AnnotatedChallenge` subclasses). :rtype str: z and cSsh|] }|jqSr!)typ).0achallr!r!r# z#Plugin.auth_hint..zThe Certificate Authority couldn't externally verify that the {name} plugin completed the required {challs} challenges. Ensure the plugin is configured correctly and that the changes it makes are accessible from the internet.)rchalls)joinsortedr8r)r-rDrJr!r!r# auth_hinttszPlugin.auth_hint)__name__ __module__ __qualname____doc__rZNamespaceConfigr:r, classmethodrrr2argparseArgumentParserr;propertyr$r>r(rArrCrrZAnnotatedChallengerM __classcell__r!r!r.r#r;s  r) metaclasscseZdZdZeeddfdd Zdeeeedddd Z edd d d Z dd ddZ dd ddZ de ddddZeed ddZeed ddZdd ddZZS)rzAn installer base class with reverter and ssl_dhparam methods defined. Installer plugins do not have to inherit from this class. N)r5r6rcs4tj|i|t|j|j|_t|j|_dSr*)r+r,rr)rZstoragerZReverter)r-r5r6r.r!r#r,szInstaller.__init__F) save_files save_notes temporaryrc Cs^|r|jj}n|jj}z|||Wn4tjyX}ztt|WYd}~n d}~00dS)aAdd files to a checkpoint. :param set save_files: set of filepaths to save :param str save_notes: notes about changes during the save :param bool temporary: True if the files should be added to a temporary checkpoint rather than a permanent one. This is usually used for changes that will soon be reverted. :raises .errors.PluginError: when unable to add to checkpoint N)rZadd_to_temp_checkpointadd_to_checkpointr ReverterError PluginErrorr:)r-rXrYrZZcheckpoint_funcerrr!r!r#r[s  zInstaller.add_to_checkpoint)titlerc CsJz|j|Wn4tjyD}ztt|WYd}~n d}~00dS)zTimestamp and save changes made through the reverter. :param str title: Title describing checkpoint :raises .errors.PluginError: when an error occurs N)rfinalize_checkpointrr\r]r:)r-r_r^r!r!r#r`szInstaller.finalize_checkpointr<c CsHz|jWn4tjyB}ztt|WYd}~n d}~00dS)zRevert all previously modified files. Reverts all modified files that have not been saved as a checkpoint :raises .errors.PluginError: If unable to recover the configuration N)rrecovery_routinerr\r]r:r-r^r!r!r#raszInstaller.recovery_routinec CsHz|jWn4tjyB}ztt|WYd}~n d}~00dS)zkRollback temporary checkpoint. :raises .errors.PluginError: when unable to revert config N)rrevert_temporary_configrr\r]r:rbr!r!r#rcsz!Installer.revert_temporary_config)rollbackrc CsJz|j|Wn4tjyD}ztt|WYd}~n d}~00dS)zRollback saved checkpoints. :param int rollback: Number of checkpoints to revert :raises .errors.PluginError: If there is a problem with the input or the function is unable to correctly revert the configuration N)rrollback_checkpointsrr\r]r:)r-rer^r!r!r#rfs zInstaller.rollback_checkpointscCstj|jjtjS)z(Full absolute path to ssl_dhparams file.)rpathrKr) config_dirrZSSL_DHPARAMS_DESTr=r!r!r# ssl_dhparamsszInstaller.ssl_dhparamscCstj|jjtjS)z:Full absolute path to digest of updated ssl_dhparams file.)rrgrKr)rhrZUPDATED_SSL_DHPARAMS_DIGESTr=r!r!r#updated_ssl_dhparams_digestsz%Installer.updated_ssl_dhparams_digestcCst|j|jtjtjdS)zJCopy Certbot's ssl_dhparams file into the system's config dir if required.N)install_version_controlled_filerirjrZSSL_DHPARAMS_SRCZALL_SSL_DHPARAMS_HASHESr=r!r!r#install_ssl_dhparamss zInstaller.install_ssl_dhparams)F)rd)rNrOrPrQrr,r r:boolr[r`rarcintrfrUrirjrlrVr!r!r.r#rs     rc@seZdZdZdS) Configuratorzt A plugin that extends certbot.plugins.common.Installer and implements certbot.interfaces.Authenticator N)rNrOrPrQr!r!r!r#rosro GenericAddrAddr)boundc@seZdZdZd"eeefedddZee e ee e dddZ ed d d Z eeefd d d ZeedddZed ddZed ddZed ddZe ee dddZeeedddZed ddZeeeddd Zd!S)#rqzRepresents an virtual host address. :param str addr: addr part of vhost address :param str port: port number or \*, or "" Ftupipv6cCs||_||_dSr*rs)r-rtrur!r!r#r,sz Addr.__init__)r1str_addrrcCs|drh|d}|d|d}d}t||dkrX||ddkrX||dd}|||fdd S|d}||d |dfSdS) zInitialize Addr from string.[]Nrd:T)rur) startswithrfindlen partition)r1rvZendIndexhostportrtr!r!r# fromstring s    zAddr.fromstringr<cCs|jdrd|jS|jdS)Nrdz%s:%srrtr=r!r!r#__str__s  z Addr.__str__cCs|jr||jdfS|jS)z5Normalized representation of addr/port tuple rd)ruget_ipv6_explodedrtr=r!r!r#normalized_tuple szAddr.normalized_tuple)otherrcCs t||jr||kSdS)NF) isinstancer/r)r-rr!r!r#__eq__'s z Addr.__eq__cCs t|jSr*)hashrtr=r!r!r#__hash__/sz Addr.__hash__cCs |jdS)z Return addr part of Addr object.rrr=r!r!r#get_addr2sz Addr.get_addrcCs |jdS)z Return port.rdrr=r!r!r#get_port6sz Addr.get_port)r-rrcCs||jd|f|jS)z6Return new address object with same addr and new port.r)r/rtru)r-rr!r!r# get_addr_obj:szAddr.get_addr_obj)addrrcCs|d}|d}||S)z7Return IPv6 address in normalized form, helper functionrwrx)lstriprstrip _explode_ipv6)r-rr!r!r#_normalize_ipv6>s  zAddr._normalize_ipv6cCs |jrd||jdSdS)zReturn IPv6 in normalized formr{rry)rurKrrtr=r!r!r#rDszAddr.get_ipv6_explodedcCsgd}|d}t|t|kr2|dt|}d}t|D]N\}}|sPd}q>t|dkrf|d}|sxt|||<q>t|||t|<q>|S)z#Explode IPv6 address for comparison)0rrrrrrrr{rFTrdr)splitr~ enumeraterr:)r-rresultZ addr_listZ append_to_endiblockr!r!r#rJs   zAddr._explode_ipv6N)F)rNrOrPrQr r:rmr,rRr rprrrrrrrnrrrrrrrrr!r!r!r#rqsc@sLeZdZdZedddZd ejee ddddZ e e j d d d ZdS) ChallengePerformeravAbstract base for challenge performers. :ivar configurator: Authenticator and installer plugin :ivar achalls: Annotated challenges :vartype achalls: `list` of `.KeyAuthorizationAnnotatedChallenge` :ivar indices: Holds the indices of challenges from a larger array so the user of the class doesn't have to. :vartype indices: `list` of `int` ) configuratorcCs||_g|_g|_dSr*)rachallsindices)r-rr!r!r#r,oszChallengePerformer.__init__N)rGidxrcCs$|j||dur |j|dS)zStore challenge to be performed when perform() is called. :param .KeyAuthorizationAnnotatedChallenge achall: Annotated challenge. :param int idx: index to challenge in a larger array N)rappendr)r-rGrr!r!r# add_challts zChallengePerformer.add_challr<cCs tdS)zPerform all added challenges. :returns: challenge responses :rtype: `list` of `acme.challenges.KeyAuthorizationChallengeResponse` N)NotImplementedErrorr=r!r!r#performszChallengePerformer.perform)N)rNrOrPrQror,rZ"KeyAuthorizationAnnotatedChallengerrnrrr Z!KeyAuthorizationChallengeResponserr!r!r!r#rcs  r) dest_path digest_pathsrc_path all_hashesrcstddfdd ddfdd }tjsJ|dSt}|kr`dS||vrp|n`tjrtd}|}Wdn1s0Y|krdStddS) aCopy a file into an active location (likely the system's config dir) if required. :param str dest_path: destination path for version controlled file :param str digest_path: path to save a digest of the file in :param str src_path: path to version controlled file found in distribution :param list all_hashes: hashes of every released version of the file Nr<cs8td}|Wdn1s*0YdS)Nw)openwrite)Zfile_h) current_hashrr!r#_write_current_hashs z._write_current_hashcstdSr*)shutilcopyfiler!)rrrr!r#_install_current_files z>install_version_controlled_file.._install_current_filerzh%s has been manually modified; updated file saved to %s. We recommend updating %s for security purposes.) rZ sha256sumrrgisfilerreadloggerZwarning)rrrrrZactive_file_digestfZ saved_digestr!)rrrrrr#rks(     &rk)test_dirpkgrcCsttddd}|d}|d}|d}t|tjt|tjt|tjt|d|}t|*}t j |t j ||dd Wd n1s0Y|||fS) z5Setup the directories necessary for the configurator.)prefixrcSstt|S)aReturn the real path of a temp directory with the specified prefix Some plugins rely on real paths of symlinks for working correctly. For example, certbot-apache uses real paths of configuration files to tell a virtual host from another. On systems where TMP itself is a symbolic link, (ex: OS X) such plugins will be confused. This function prevents such a case. )rrealpathtempfileZmkdtemp)rr!r!r#expanded_tempdirs z#dir_setup..expanded_tempdirZtempr)ZworkZtestdataT)symlinksN)r:rchmodrZCONFIG_DIRS_MODEimportlib_resourcesfilesjoinpathZas_filercopytreerrgrK)rrrZtemp_dirrhZwork_dirZ test_dir_refrgr!r!r# dir_setups  $r)>rQabcrrrSZloggingrersysrtypingrrrrrr r r r Zacmer ZcertbotrrrrrrZcertbot._internalrZcertbot.compatrrZcertbot.interfacesrZAbstractInstallerrZAbstractPluginZcertbot.plugins.storager version_infoZimportlib.resourcesZ resourcesrZ getLoggerrNrr:r$r(compileZprivate_ips_regex IGNORECASEZhostname_regexZ Authenticatorrorprqrrkrr!r!r!r#sh                          Th b) 3