a
}|g_F @ s d Z ddlZddlZddlZddlZddlmZ ddlmZ ddlmZ ddlm Z ddlm
Z
ddlm Z dd lm Z dd
lm
Z
ddlZdd lmZ dd lmZ dd
lmZ ddlmZ ddlmZ ddlmZ ddlmZ ddlmZ ee Z ej ddddZ ej ddddZ ej ddddZ!ej e"e
ej# dddZ$ej e"e
e e" d d d Z%ej e e" e e
ej# e
ej# f d d d!Z&ej#e"e
e e" d"d#d$Z'e e
eej#ge"f eej#ge
e e" f f d%d&d'Z(ej e"d(d)d*Z)ej ee
eej#ge"f eej#ge
e e" f f eej#ge"f eej#ge"f e e" d+d,d-Z*dCej ej#e+e
e" d/d0d1Z,dDej e"e+e
e" e e" d2d3d4Z-ee" e"d5d6d7Z.ej eej# e"d8d9d:Z/ej eej# ee" dd;dZ1ej ed?e1f e1ee1d@dAdBZ2dS )Ez Tools for managing certificates. N)Any)Callable)Iterable)List)Optional)Tuple)TypeVar)Union)
configuration) crypto_util)errors)ocsp)util)storage)os)configreturnc C s t | dd }| j}|sHtjd|dd\}}|tjks>|sHtdt| |}|sft d|t
||| tj d||d d
d S ) zRename the specified lineage to the new name.
:param config: Configuration.
:type config: :class:`certbot._internal.configuration.NamespaceConfig`
renamer z&Enter the new name for certificate {0}T)force_interactiveUser ended interaction.z,No existing certificate with name {0} found.z Successfully renamed {0} to {1}.F)pauseN)
get_certnames new_certname display_utilZ
input_textformatOKr Errorlineage_for_certnameZConfigurationErrorr Zrename_renewal_config notification)r certnamer codelineage r" B/usr/lib/python3.9/site-packages/certbot/_internal/cert_manager.pyrename_lineage! s(
r$ c C s g }g }t | D ]v}z$t || }t| || W q ty } z4td|| t dt
|| W Y d}~qd}~0 0 qt | || dS )zDisplay information about certs configured with Certbot
:param config: Configuration.
:type config: :class:`certbot._internal.configuration.NamespaceConfig`
zIRenewal configuration file %s produced an unexpected error: %s. Skipping.Traceback was:
%sN)
r renewal_conf_files
RenewableCertr Zverify_renewable_certappend ExceptionloggerZwarningdebug traceback
format_exc_describe_certs)r parsed_certsparse_failures renewal_fileZrenewal_candidateer" r" r# certificates; s
"r3 c C s t | ddd}dg}|D ]}|d| q|d |d tjd|dd sbtd
d S |D ] }t| | t d
| qfd S )
z;Delete Certbot files associated with a certificate lineage.deleteT)allow_multiplez8The following certificate(s) are selected for deletion:
z * aP
WARNING: Before continuing, ensure that the listed certificates are not being used by any installed server software (e.g. Apache, nginx, mail servers). Deleting a certificate that is still being used will cause the server software to stop working. See https://certbot.org/deleting-certs for information on deleting certificates safely.z:
Are you sure you want to delete the above certificate(s)?
)defaultz$Deletion of certificate(s) canceled.Nz.Deleted all files relating to certificate {0}.) r r( r Zyesnojoinr* infor Z delete_filesnotifyr )r certnamesmsgr r" r" r# r4 R s
r4 )
cli_configr r c C s | j }tj|dd zt| |}W n tjy: Y dS 0 zt|| W S ttjfy t
d| t
dt Y dS 0 dS )z)Find a lineage object with name certname. modeNz Renewal conf file %s is broken.r% )
renewal_configs_dirr make_or_verify_dirr Zrenewal_file_for_certnamer CertStorageErrorr' OSErrorr* r+ r, r- )r= r configs_dirr1 r" r" r# r l s r )r r r c C s t | |}|r| S dS )z0Find the domains in the cert with name certname.N)r names)r r r! r" r" r# domains_for_certname~ s
rG )r domainsr c sP t jttt j tt j f ttt j tt j f d fdd }d}t| ||S )a Find existing certs that match the given domain names.
This function searches for certificates whose domains are equal to
the `domains` parameter and certificates whose domains are a subset
of the domains in the `domains` parameter. If multiple certificates
are found whose names are a subset of `domains`, the one whose names
are the largest subset of `domains` is returned.
If multiple certificates' domains are an exact match or equally
sized subsets, which matching certificates are returned is
undefined.
:param config: Configuration.
:type config: :class:`certbot._internal.configuration.NamespaceConfig`
:param domains: List of domain names
:type domains: `list` of `str`
:returns: lineages representing the identically matching cert and the
largest subset if they exist
:rtype: `tuple` of `storage.RenewableCert` or `None`
)candidate_lineagervr c sb |\}}t | }|t kr&| }n4|t rZ|du rB| }nt|t| krZ| }||fS )zsReturn cert as identical_names_cert if it matches,
or subset_names_cert if it matches as subset
N)setrF issubsetlen)rI rJ Zidentical_names_certZsubset_names_certZcandidate_namesrH r" r# update_certs_for_domain_matches s
z?find_duplicative_certs..update_certs_for_domain_matches)NN)r r' r r _search_lineages)r rH rO initr" rN r# find_duplicative_certs s
rR )rI filetyper c s, | j fddt D }|r(|S dS )aJ In order to match things like:
/etc/letsencrypt/archive/example.com/chain1.pem.
Anonymous functions which call this function are eventually passed (in a list) to
`match_and_check_overlaps` to help specify the acceptable_matches.
:param `.storage.RenewableCert` candidate_lineage: Lineage whose archive dir is to
be searched.
:param str filetype: main file name prefix e.g. "fullchain" or "chain".
:returns: Files in candidate_lineage's archive dir that match the provided filetype.
:rtype: list of str or None
c s, g | ]$}t d |rtj |qS )z
{0}[0-9]*.pem)rematchr r pathr8 ).0f archive_dirrS r" r#
s z"_archive_files..N)rZ r listdir)rI rS patternr" rY r# _archive_files s
r^ )r c C s dd dd dd dd gS )z Generates the list that's passed to match_and_check_overlaps. Is its own function to
make unit testing easier.
:returns: list of functions
:rtype: list
c S s | j S N)Zfullchain_pathxr" r" r# z%_acceptable_matches..c S s | j S r_ cert_pathr` r" r" r# rb rc c S s
t | dS )Ncertr^ r` r" r" r# rb rc c S s
t | dS )N fullchainrg r` r" r" r# rb rc r" r" r" r" r# _acceptable_matches s ri )r= r c s( t }t | fdddd }|d S )a If config.cert_path is defined, try to find an appropriate value for config.certname.
:param `configuration.NamespaceConfig` cli_config: parsed command line arguments
:returns: a lineage name
:rtype: str
:raises `errors.Error`: If the specified cert path can't be matched to a lineage name.
:raises `errors.OverlappingMatchFound`: If the matched lineage's archive is shared.
c s j S r_ rd r` r= r" r# rb rc z&cert_path_to_lineage..c S s | j S r_ ) lineagenamer` r" r" r# rb rc r )ri match_and_check_overlaps)r= acceptable_matchesrU r" rj r# cert_path_to_lineage s
rn )r= rm
match_funcrv_funcr c
s t jtt tttt jgtf tt jgttt f f tt d fdd }t| |g |}|sxt
d| j dnt |dkrt
|S )a Searches through all lineages for a match, and checks for duplicates.
If a duplicate is found, an error is raised, as performing operations on lineages
that have their properties incorrectly duplicated elsewhere is probably a bad idea.
:param `configuration.NamespaceConfig` cli_config: parsed command line arguments
:param list acceptable_matches: a list of functions that specify acceptable matches
:param function match_func: specifies what to match
:param function rv_func: specifies what to return
)rI return_valuerm r c sd fdd|D }g }|D ]&}t |tr2||7 }q|r|| q }||v r`| |S )z1Returns a list of matches using _search_lineages.c s g | ] }| qS r" r" )rW funcrI r" r# r[ rc zBmatch_and_check_overlaps..find_matches..)
isinstancelistr( )rI rq rm Zacceptable_matches_resolvedZacceptable_matches_rvitemrU ro rp rs r# find_matches s
z.match_and_check_overlaps..find_matchesz No match found for cert-path ! )r r' r strr r r r rP r r re rM ZOverlappingMatchFound)r= rm ro rp rx Zmatchedr" rw r# rl s
rl F)r rf skip_filter_checksr c C sZ g }t }| jr&|j| jkr&|s&dS | jrDt| j| sDdS tj t
j }g }|j rf|
d |j|kr||
d n||r|
d |rdd| }nF|j| }|jdkrd}n,|jdk rd |jd
d }nd |j d }d
|j|} tt|jd}
|
d|j d|
d|j dd| d| d|j d|j d|S )zJ Returns a human readable description of info about a RenewableCert objectNZ TEST_CERTZEXPIREDZREVOKEDz INVALID: z, rz z VALID: 1 dayzVALID: i z hour(s)z daysz {0} ({1})ra z Certificate Name: z
Serial Number: z
Key Type: z
Domains: z
Expiry Date: z
Certificate Path: z
Private Key Path: )r
ZRevocationCheckerr rk rH rK rL rF datetimenowpytzZUTCZ is_test_certr( Z
target_expiryZ ocsp_revokedr8 ZdaysZsecondsr r Zget_serial_from_certre Zprivate_key_typerh Zprivkey) r rf r| certinfoZcheckerr ZreasonsstatusdiffZ valid_stringserialr" r" r# human_readable_cert_info sL
r )r verbr5
custom_promptr c C s | j }|r|g}nt| }dd |D }|s8td|r||sLd|}n|}tj||ddd\} }| tjkrtdnZ|sd |}n|}tj ||ddd\} }
| tjks|
t
d
t |vrtd||
g}|S ) z4Get certname from flag, interactively, or error out.c S s g | ]}t |qS r" )r Zlineagename_for_filename)rW namer" r" r# r[ I rc z!get_certnames..z No existing certificates found.z+Which certificate(s) would you like to {0}?z --cert-nameT)Zcli_flagr r z(Which certificate would you like to {0}?r ) r r r& r r r r Z checklistr ZmenurangerM ) r r r5 r r r; filenameschoicespromptr indexr" r" r# r A s4
r )msgsr c C s dd dd | D S )zFFormat a results report for a category of single-line renewal outcomesz z
c s s | ]}t |V qd S r_ )r{ )rW r< r" r" r# j rc z _report_lines..)r8 )r r" r" r#
_report_linesh s r )r r/ r c C s4 g }|D ] }t | |}|dur|| qd|S )z)Format a results report for a parsed certNr6 )r r( r8 )r r/ r rf Z cert_infor" r" r# _report_human_readablem s
r )r r/ r0 r c C s g }|j }|s |s |d nL|rP| js,| jr0dnd}|d| |t| | |rh|d |t| tjd|ddd d S )
z/Print information about the certs we know aboutzNo certificates found.z matching r~ z Found the following {0}certs:z3
The following renewal configurations were invalid:r6 F)r wrapN) r( r rH r r r r r r8 )r r/ r0 outr: rU r" r" r# r. x s
r. T.)r= rr
initial_rvargsr c
G s | j }tj|dd |}t| D ]`}zt|| }W n8 ttjfyn t
d| t
dt Y q"Y n0 |||g|R }q"|S )a Iterate func over unbroken lineages, allowing custom return conditions.
Allows flexible customization of return values, including multiple
return values and complex checks.
:param `configuration.NamespaceConfig` cli_config: parsed command line arguments
:param function func: function used while searching over lineages
:param initial_rv: initial return value of the function (any type)
:returns: Whatever was specified by `func` if a match is found.
r> r? z)Renewal conf file %s is broken. Skipping.r% )
rA r rB r r& r' rD r rC r* r+ r, r- )r= rr r r rE rJ r1 rI r" r" r# rP s
rP )F)FN)3__doc__r ZloggingrT r, typingr r r r r r r r r Zcertbotr
r r r
r Zcertbot._internalr Zcertbot.compatr Zcertbot.displayr Z getLogger__name__r* ZNamespaceConfigr$ r3 r4 r{ r' r rG rR r^ ri rn rl boolr r r r r. r rP r" r" r" r# s
5 *
+
'