a
}|ge @ sn d Z ddlZddlZddlZddlZddlZddlZddlZddlm Z ddlm
Z
ddlm Z ddlm Z ddlm
Z
ddlmZ dd lmZ dd
lmZ dd lmZ dd lmZ dd
lmZ ddlmZ ddlmZ ddlmZ ddlmZ ddlm Z ddl m Z ddl m Z ddl m Z ddl m!Z! ddl m"Z" ddl m#Z# ddl$m%Z& ddl'm(Z) ddl*m+Z+ ddl,m Z- e.e/Z0g d Z1d d gZ2g d Z3e4e5e3e2e1d Z6ej7e8ee"j9 d!d"d#Z:ej7e
e8e f dd$d%d&Z;ej7e
e8e f dd$d'd(Ze8ee e8 e8f e e8 d.d/d0Z?e8e8e@d1d2d3ZAe8e8eBd1d4d5ZCe8e8ee8 d1d6d7ZDej7e"j9e@d8d9d:ZEej7e"j9e8dd;dd?ZGej7ee e8 e jHe"j9dd@dAdBZIe e8 e8e8dCdDdEZJej7e e8 e e8 e e8 e e8 ddFdGdHZKej7eeLeLf dIdJdKZMe8ej7ddLdMdNZNdS )OzGFunctionality for autorenewal and associated juggling of configurations N)Any)Dict)Iterable)List)Mapping)Optional)Tuple)Union)default_backend)ec)rsa)load_pem_private_key)
configuration) crypto_util)errors)util)cli)client) constants)hooks)storage)updater)obj)disco)os)Z
config_dirZlogs_dirZwork_dirZ
user_agentserverZaccount
authenticator installer
renew_hookpre_hook post_hookZhttp01_addressZpreferred_chainkey_typeelliptic_curve rsa_key_size http01_port)Z must_stapleZallow_subset_of_names reuse_keyZ autorenew) pref_challs)config full_pathreturnc
C s~ zt || }W nX ttjfyh } z:td| tdt| tdt
W Y d}~dS d}~0 0 d|j vrtd| dS |j d }d|vrtd| dS | d d
|d < t
|}zt| | t| | W nP ttjfy& } z0td |t| tdt
W Y d}~dS d}~0 0 zd d
| D | _W n8 tjyx } z td|| W Y d}~dS d}~0 0 |S )a Try to instantiate a RenewableCert, updating config with relevant items.
This is specifically for use in renewal and enforces several checks
and policies to ensure that we can try to proceed with the renewal
request. The config argument is modified by including relevant options
read from the renewal configuration file.
:param configuration.NamespaceConfig config: configuration for the
current lineage
:param str full_path: Absolute path to the configuration file that
defines this lineage
:returns: the RenewableCert object or None if a fatal error occurred
:rtype: `storage.RenewableCert` or NoneType
z(Renewal configuration file %s is broken.zThe error was: %s
Skipping.Traceback was:
%sN
renewalparamszq s z reconstitute..z{Renewal configuration file %s references a certificate that contains an invalid domain name. The problem was: %s. Skipping.)r
RenewableCertOSErrorr ZCertStorageErrorloggererrorstrdebug traceback
format_excr get"_remove_deprecated_config_elements restore_required_config_elements_restore_plugin_configs
ValueErrorErrornamesdomainsZConfigurationError)r' r( renewal_candidater4 r+ r, r, r/ reconstitute9 sP
rB )r' r+ r) c C sP d|v r | ds |d | _d|v rL| dsL|d }t|trF|g}|| _dS )z
webroot_map is, uniquely, a dict, and the general-purpose configuration
restoring logic is not able to correctly parse it from the serialized
form.
webroot_map webroot_pathN) set_by_userrC
isinstancer5 rD )r' r+ Zwpr, r, r/ _restore_webroot_config| s
rG c C s g }|d dkr t | | n||d |ddurF||d t|D ]n}|dd}| D ]T\}}||d rf| |sf|dv rt| |t | qft
|}t| ||| qfqNdS )a Sets plugin specific values in config from renewalparams
:param configuration.NamespaceConfig config: configuration for the
current lineage
:param configobj.Section renewalparams: Parameters from the renewal
configuration file that defines this lineage
r Zwebrootr N-_)NoneTrueFalse) rG appendr9 setreplaceitems
startswithrE setattrevalr Z
argparse_type)r' r+ Zplugin_prefixesZ
plugin_prefixZ config_itemZ config_valuecastr, r, r/ r< s
r< c
C s i }t dtffttt tttt ttt t t
}|D ]0\}}||v rB| |sB|||| }|||< qB| D ]\}}t
| || q|dS )a Sets non-plugin specific values in config from renewalparams
:param configuration.NamespaceConfig config: configuration for the
current lineage
:param configobj.Section renewalparams: parameters from the renewal
configuration file that defines this lineage
r& N) itertoolschain_restore_pref_challszipBOOL_CONFIG_ITEMSrepeat
_restore_boolINT_CONFIG_ITEMS _restore_intSTR_CONFIG_ITEMS _restore_strrE rP rR )r' r+ Zupdated_valuesZrequired_itemsZ item_nameZ restore_funcvaluekeyr, r, r/ r; s
r; )r+ r) c C s dd | D S )zRemoves deprecated config options from the parsed renewalparams.
:param dict renewalparams: list of parsed renewalparams
:returns: list of renewalparams with deprecated config options removed
:rtype: dict
c S s i | ]\}}|t jvr||qS r, )r ZDEPRECATED_OPTIONS)r- Z option_namevr, r, r/
s
z6_remove_deprecated_config_elements..)rP )r+ r, r, r/ r: s r: ) unused_namer` r) c C s t |tr|gn|}t|S )a Restores preferred challenges from a renewal config file.
If value is a `str`, it should be a single challenge type.
:param str unused_name: option name
:param value: option value
:type value: `list` of `str` or `str`
:returns: converted option value to be stored in the runtime config
:rtype: `list` of `str`
:raises errors.Error: if value can't be converted to a bool
)rF r5 r Zparse_preferred_challenges)rd r` r, r, r/ rW s rW )namer` r) c C s. | }|dvr&td| d| |dkS )a# Restores a boolean key-value pair from a renewal config file.
:param str name: option name
:param str value: option value
:returns: converted option value to be stored in the runtime config
:rtype: bool
:raises errors.Error: if value can't be converted to a bool
)trueZfalsezExpected True or False for z but found rf )lowerr r> )re r` Zlowercase_valuer, r, r/ r[ s r[ c C sV | dkr$|dkr$t d tdS z
t|W S tyP td| Y n0 dS )a# Restores an integer key-value pair from a renewal config file.
:param str name: option name
:param str value: option value
:returns: converted option value to be stored in the runtime config
:rtype: int
:raises errors.Error: if value can't be converted to an int
r$ rJ z!updating legacy http01_port valuez Expected a numeric value for N)r3 infor flag_defaultintr= r r> re r` r, r, r/ r] s
r] c C s@ | dkr0|t jkr0tdt jd | t jd S |dkrtd dS td dS )zDReturn true if any of the circumstances for automatic renewal apply.z+Auto-renewal forced with --force-renewal...Tz0Certificate is due for renewal, auto-renewing...zCCertificate not due for renewal, but simulating renewal for dry runz#Certificate not yet due for renewalF)Zrenew_by_defaultr3 r6 Zshould_autorenewrh dry_run display_utilnotify)r' rl r, r, r/ should_renew7 s
rp )r' rl original_serverr) c C s@ t | jr )r' rl rq r? r, r, r/ _avoid_invalidating_lineageF s
rs c s dr jsdS js$ js$dS jr.dS j dfddfd fddfd fd dfg}|D ]$}|d
rttd |d d
qtdS )zDon't allow combining --reuse-key with any flags that would conflict
with key reuse (--key-type, --rsa-key-size, --elliptic-curve), unless
--new-key is also set.
r% Nz
--key-typec s j kS N)Zprivate_key_typerg r, )ktrl r, r/ n z,_avoid_reuse_key_conflicts..z--rsa-key-sizec s dko j j kS )Nr )r# r, r' ru rl r, r/ rv p rw z--elliptic-curvec s" dko j o j j kS )Necdsa)r" rg r, rx r, r/ rv r s zUnable to change the r z of this certificate because --reuse-key is set. To stop reusing the private key, specify --no-reuse-key. To change the private key this one time and then reuse it in future, add --new-key.)rE r% new_keyr! rg r r> )r' rl Zpotential_conflictsZconflictr, rx r/ _avoid_reuse_key_conflictsS s,
r| )r' r@ le_clientrl r) c C s |j d }|dtd}t| || t| | |s>| }| jrd| jsdt j
|j }t
|| nd}|||\}}}} | jrtdt j
|j n2| }
||
||j|| || | t| ||j dS )z Renew a certificate lineage.r+ r Nz(Dry run: skipping updating lineage at %s) r r9 r ri rs r| r? r% r{ r pathnormpathZprivkey _update_renewal_params_from_keyZobtain_certificaterm r3 r6 dirnamecertlatest_common_versionZsave_successorZpemZupdate_all_links_totruncater r Zlive_dir) r' r@ r} rl Zrenewal_paramsrq r{ Znew_certZ new_chainrI Z
prior_versionr, r, r/
renew_cert s$
r )msgscategoryr) c s fdd| D }dd | S )z:Format a results report for a category of renewal outcomesc 3 s | ]}d | f V qdS )z%s (%s)Nr, )r- mr r, r/ rw zreport..z z
)rr )r r linesr, r r/ report s r )r' renew_successesrenew_failures
renew_skippedparse_failuresr) c C s> t j}tj}|dtj | jr&dnd}|rD|d |t|d |s|s|d| d | jdusz| j dusz| j
dur|d n|r|s|d
| d |t|d nh|r|s|d
| |t|d nF|r|r|d| d |t|d d |d| |t|d |r0|d |t|d |tj dS )a
Print a report to the terminal about the results of the renewal process.
:param configuration.NamespaceConfiguration config: Configuration
:param list renew_successes: list of fullchain paths which were renewed
:param list renew_failures: list of fullchain paths which failed to be renewed
:param list renew_skipped: list of messages to print about skipped certificates
:param list parse_failures: list of renewal parameter paths which had errors
zsimulated renewalZrenewalz7The following certificates are not due for renewal yet:ZskippedzNo zs were attempted.NzNo hooks were run.zCongratulations, all z
s succeeded: successz@All %ss failed. The following certificates could not be renewed:ZfailurezThe following z s succeeded:zThe following %ss failed:zB
Additionally, the following renewal configurations were invalid: Z parsefail) rn ro r3 r4 display_objZ
SIDE_FRAMErm r r r r )r' r r r r ro Z notify_errorZ renewal_nounr, r, r/ _renew_describe_results s@
r )r' r) c s t fdd jD r"td jr:t jg}n
t }g }g }g }g }g }g }tj
ol j }|D ]} t j
d| dd t }
t| } zt|
| } W n\ ty }
zBtd| | |
tdt || W Y d }
~
qrW Y d }
~
n
d }
~
0 0 z| s || n| d
d lm} t j }t |
| r|rtt !d d
}t"d| t#$| d}|%|
|| || j& |'| ( n0t)*| +d| , }|d| j&|-df t./|
| | W qr tyB }
zJtd| |
tdt | r.|| j& |'| ( W Y d }
~
qrd }
~
0 0 qrt0 |||| |sb|rtt1| dt1| dtd ||fS )z5Examine each lineage; renew if due and report resultsc 3 s | ]}| j vV qd S rt )rC )r- domainr' r, r/ r rw z)handle_renewal_request..af Currently, the renew verb is capable of either renewing all installed certificates that are due to be renewed or renewing a single certificate specified by its name. If you would like to renew specific certificates by their domains, use the certonly command instead. The renew verb may provide other options for selecting certificates to renew in the future.z Processing F)pausezTRenewal configuration file %s (cert: %s) produced an unexpected error: %s. Skipping.r* Nr )mainrz i z3Non-interactive renewal: random delay of %s secondsr z%s expires on %sz%Y-%m-%dz-Failed to renew certificate %s with error: %sz renew failure(s), z parse failure(s)zno renewal failures)2anyr@ r r> Zcertnamer Zrenewal_file_for_certnameZrenewal_conf_filessysstdinisattyZrandom_sleep_on_renewrn Z notificationcopydeepcopyZlineagename_for_filenamerB Exceptionr3 r4 r6 r7 r8 rM Zensure_deployedcertbot._internalr
plugins_discoZPluginsRegistryZfind_allrp randomZuniformrh timesleepr Z fullchainextendr? r ZnotAfterversionr strftimer Zrun_generic_updatersr len)r' Z
conf_filesr r r r Zrenewed_domainsZfailed_domainsZapply_random_sleepZ renewal_fileZlineage_configZ lineagenamerA er ZpluginsZ
sleep_timeZexpiryr, r r/ handle_renewal_request s
"
&
r )key_pathr' r) c C s t | d$}t| d t d}W d n1 s40 Y t|tjrZd|_|j|_ n:t|t
j rxd|_|j j
|_n td| dt| dd S )Nrb)passwordZbackendr ry zKey at z is of an unsupported type: .)openr
readr
rF r Z
RSAPrivateKeyr! Zkey_sizer# r ZEllipticCurvePrivateKeyZcurvere r" r r> type)r r' Zfile_hra r, r, r/ r @ s 2
r )O__doc__r rU Zloggingr r r r7 typingr r r r r r r r Z cryptography.hazmat.backendsr
Z)cryptography.hazmat.primitives.asymmetricr r Z,cryptography.hazmat.primitives.serializationr
Zcertbotr r r r r r r r r r r Zcertbot._internal.displayr r Zcertbot._internal.pluginsr r Zcertbot.compatr Zcertbot.displayrn Z getLogger__name__r3 r^ r\ rY rN rV Z CONFIG_ITEMSZNamespaceConfigr5 r1 rB rG r< r; r: rW boolr[ rj r] r_ rp rs r| ZClientr r r listr r r, r, r, r/ s
C ,
"
,
0n