a
}|gC @ s: d Z ddlmZ ddlmZ ddlZddlZddlZddlZddl Z ddl
Z
ddl m Z ddl m
Z
ddl mZ ddl mZ dd l mZ dd
l mZ dd l mZ dd l mZ dd
l mZ ddlmZ ddlmZ ddlmZ ddlmZ ddlmZ ddlm Z ddlm Z ddl m Z ddl m!Z! ddl m"Z" ddl#m$Z% ddl#m&Z' ddl(m)Z) e*e+Z,e-e-dd d Z.e-e-dd d Z/e0d Z1e0d!ej2Z3G d"d# d#e'ed$Z&G d%d& d&e%e&ed$Z$G d'd( d(e$e j4ed$Z5ed)d*d+Z6G d,d* d*Z7G d-d. d.Z8e-e-e-ee- dd/d0d1Z9e-e-ee-e-e-f d2d3d4Z:dS )5zPlugin common functions. )ABCMeta)abstractmethodN)Any)Callable)Iterable)List)Optional)Set)Tuple)Type)TypeVar)
challenges) achallenges)
configuration) crypto_util)errors)
interfaces)reverter) constants)
filesystem)os) Installer)Plugin)
PluginStoragenamereturnc C s | d S )9ArgumentParser options namespace (prefix of all options).- r r r :/usr/lib/python3.9/site-packages/certbot/plugins/common.pyoption_namespace% s r" c C s | ddd S );ArgumentParser dest namespace (prefix of all destinations).r _)replacer r r r! dest_namespace* s r& zX(^127\.0\.0\.1)|(^10\.)|(^172\.1[6-9]\.)|(^172\.2[0-9]\.)|(^172\.3[0-1]\.)|(^192\.168\.)z3^(([a-z0-9]|[a-z0-9][a-z0-9\-]*[a-z0-9])\.)*[a-z]+$c s e Zd ZdZejedd fdd Zee e
d dddd Z ee j
edd
d d Zeed
ddZeedddZeed
ddZeedddZeedddZeej eddd Z ZS ) r zGeneric plugin.N)configr r c s t || || _|| _d S N)super__init__r' r )selfr' r __class__r r! r* 9 s zPlugin.__init__).N)addr c C s dS )zAdd plugin arguments to the CLI argument parser.
:param callable add: Function that proxies calls to
`argparse.ArgumentParser.add_argument` prepending options
with unique plugin name prefix.
Nr )clsr. r r r! add_parser_arguments> s zPlugin.add_parser_arguments)parserr r c s$ t ttdd fdd }| |S )zkInject parser options.
See `~.certbot.interfaces.Plugin.inject_parser_options` for docs.
N)arg_name_no_prefixargskwargsr c s( j dt | g|R i | d S )Nz--{0}{1}) add_argumentformatr" )r2 r3 r4 r r1 r r! r. Q s z)Plugin.inject_parser_options..add)strr r0 )r/ r1 r r. r r7 r! inject_parser_optionsI s z Plugin.inject_parser_optionsr c C s
t | jS )r )r" r r+ r r r! r" W s zPlugin.option_namespacer c C s
| j | S )z'Option name (include plugin namespace).)r" )r+ r r r r! option_name\ s zPlugin.option_namec C s
t | jS )r# )r& r r; r r r! r& ` s zPlugin.dest_namespace)varr c C s | j |dd S )z.Find a destination for given variable ``var``.r r$ )r& r% r+ r= r r r! deste s z Plugin.destc C s t | j| |S )z0Find a configuration value for variable ``var``.)getattrr' r? r> r r r! confk s z Plugin.conf)failed_achallsr c C s( d tdd |D }dj| j|dS )a9 Human-readable string to help the user troubleshoot the authenticator.
Shown to the user if one or more of the attempted challenges were not a success.
Should describe, in simple language, what the authenticator tried to do, what went
wrong and what the user should try as their "next steps".
TODO: auth_hint belongs in Authenticator but can't be added until the next major
version of Certbot. For now, it lives in .Plugin and auth_handler will only call it
on authenticators that subclass .Plugin. For now, inherit from `.Plugin` to implement
and/or override the method.
:param list failed_achalls: List of one or more failed challenges
(:class:`achallenges.AnnotatedChallenge` subclasses).
:rtype str:
z and c S s h | ]
}|j qS r )typ).0achallr r r! z#Plugin.auth_hint..zThe Certificate Authority couldn't externally verify that the {name} plugin completed the required {challs} challenges. Ensure the plugin is configured correctly and that the changes it makes are accessible from the internet.)r challs)joinsortedr6 r )r+ rB rH r r r! auth_hinto s zPlugin.auth_hint)__name__
__module__ __qualname____doc__r ZNamespaceConfigr8 r* classmethodr r r0 argparseArgumentParserr9 propertyr" r< r& r? r rA r r ZAnnotatedChallengerK
__classcell__r r r, r! r 6 s
r ) metaclassc s e Zd ZdZeedd fdd Zd ee eedddd Z edd
d d Z
dd
ddZ dd
ddZ d e
ddddZeed
ddZeed
ddZdd
ddZ ZS ) r zAn installer base class with reverter and ssl_dhparam methods defined.
Installer plugins do not have to inherit from this class.
N)r3 r4 r c s4 t j|i | t| j| j| _t| j| _d S r( )r) r* r r' r Zstorager ZReverter)r+ r3 r4 r, r r! r* s zInstaller.__init__F)
save_files
save_notes temporaryr c
C s^ |r| j j}n| j j}z||| W n4 tjyX } ztt|W Y d}~n
d}~0 0 dS )a Add files to a checkpoint.
:param set save_files: set of filepaths to save
:param str save_notes: notes about changes during the save
:param bool temporary: True if the files should be added to a
temporary checkpoint rather than a permanent one. This is
usually used for changes that will soon be reverted.
:raises .errors.PluginError: when unable to add to checkpoint
N)r Zadd_to_temp_checkpointadd_to_checkpointr
ReverterError PluginErrorr8 )r+ rV rW rX Zcheckpoint_funcerrr r r! rY s
zInstaller.add_to_checkpoint)titler c
C sJ z| j | W n4 tjyD } ztt|W Y d}~n
d}~0 0 dS )zTimestamp and save changes made through the reverter.
:param str title: Title describing checkpoint
:raises .errors.PluginError: when an error occurs
N)r finalize_checkpointr rZ r[ r8 )r+ r] r\ r r r! r^ s z Installer.finalize_checkpointr: c
C sH z| j W n4 tjyB } ztt|W Y d}~n
d}~0 0 dS )zRevert all previously modified files.
Reverts all modified files that have not been saved as a checkpoint
:raises .errors.PluginError: If unable to recover the configuration
N)r recovery_routiner rZ r[ r8 r+ r\ r r r! r_ s zInstaller.recovery_routinec
C sH z| j W n4 tjyB } ztt|W Y d}~n
d}~0 0 dS )zkRollback temporary checkpoint.
:raises .errors.PluginError: when unable to revert config
N)r revert_temporary_configr rZ r[ r8 r` r r r! ra s z!Installer.revert_temporary_config )rollbackr c
C sJ z| j | W n4 tjyD } ztt|W Y d}~n
d}~0 0 dS )zRollback saved checkpoints.
:param int rollback: Number of checkpoints to revert
:raises .errors.PluginError: If there is a problem with the input or
the function is unable to correctly revert the configuration
N)r rollback_checkpointsr rZ r[ r8 )r+ rc r\ r r r! rd s z Installer.rollback_checkpointsc C s t j| jjtjS )z(Full absolute path to ssl_dhparams file.)r pathrI r'
config_dirr ZSSL_DHPARAMS_DESTr; r r r! ssl_dhparams s zInstaller.ssl_dhparamsc C s t j| jjtjS )z:Full absolute path to digest of updated ssl_dhparams file.)r re rI r' rf r ZUPDATED_SSL_DHPARAMS_DIGESTr; r r r! updated_ssl_dhparams_digest s z%Installer.updated_ssl_dhparams_digestc C s t | j| jtjtj dS )zJCopy Certbot's ssl_dhparams file into the system's config dir if required.N) install_version_controlled_filerg rh r ZSSL_DHPARAMS_SRCZALL_SSL_DHPARAMS_HASHESr; r r r! install_ssl_dhparams s z Installer.install_ssl_dhparams)F)rb )rL rM rN rO r r* r r8 boolrY r^ r_ ra intrd rS rg rh rj rT r r r, r! r s
r c @ s e Zd ZdZdS ) Configuratorzt
A plugin that extends certbot.plugins.common.Installer
and implements certbot.interfaces.Authenticator
N)rL rM rN rO r r r r! rm s rm GenericAddrAddr)boundc @ s e Zd ZdZd"eeef edddZee e
ee e
dddZ ed d
d Z
eeef d d d
ZeedddZed ddZed ddZed ddZe
ee
dddZeee ddd Zed d d Zeee dd d Zd!S )#ro zRepresents an virtual host address.
:param str addr: addr part of vhost address
:param str port: port number or \*, or ""
Ftupipv6c C s || _ || _d S r( rq )r+ rr rs r r r! r* s z
Addr.__init__)r/ str_addrr c C s | drh|d}|d|d }d}t||d krX||d dkrX||d d }| ||fdd S |d}| |d
|d fS dS ) z Initialize Addr from string.[]Nrb :T)rs r )
startswithrfindlen partition)r/ rt ZendIndexhostportrr r r r!
fromstring s
zAddr.fromstringr: c C s | j d rd| j S | j d S )Nrb z%s:%sr rr r; r r r! __str__ s
z Addr.__str__c C s | j r| | jd fS | jS )z5Normalized representation of addr/port tuple
rb )rs get_ipv6_explodedrr r; r r r! normalized_tuple s zAddr.normalized_tuple)otherr c C s t || jr | | kS dS )NF)
isinstancer- r )r+ r r r r! __eq__" s z Addr.__eq__c C s
t | jS r( )hashrr r; r r r! __hash__* s z
Addr.__hash__c C s
| j d S )z Return addr part of Addr object.r r r; r r r! get_addr- s z
Addr.get_addrc C s
| j d S )z Return port.rb r r; r r r! get_port1 s z
Addr.get_port)r+ r r c C s | | jd |f| jS )z6Return new address object with same addr and new port.r )r- rr rs )r+ r r r r! get_addr_obj5 s zAddr.get_addr_obj)addrr c C s | d}|d}| |S )z7Return IPv6 address in normalized form, helper functionru rv )lstriprstrip
_explode_ipv6)r+ r r r r! _normalize_ipv69 s
zAddr._normalize_ipv6c C s | j r d| | jd S dS )z Return IPv6 in normalized formry r rw )rs rI r rr r; r r r! r ? s zAddr.get_ipv6_explodedc C s g d}| d}t|t|kr2|dt| }d}t|D ]N\}}|sPd}q>t|dkrf|d}|sxt|||< q>t|||t| < q>|S )z#Explode IPv6 address for comparison)0r r r r r r r ry r FTrb r )splitr| enumerater r8 )r+ r resultZ addr_listZ
append_to_endiblockr r r! r E s
zAddr._explode_ipv6N)F)rL rM rN rO r
r8 rk r* rP r rn r r r r r r rl r r r r r r r r r r r r! ro s c @ sL e Zd ZdZedddZd ejee ddddZ
e e j
d d
d ZdS )
ChallengePerformerav Abstract base for challenge performers.
:ivar configurator: Authenticator and installer plugin
:ivar achalls: Annotated challenges
:vartype achalls: `list` of `.KeyAuthorizationAnnotatedChallenge`
:ivar indices: Holds the indices of challenges from a larger array
so the user of the class doesn't have to.
:vartype indices: `list` of `int`
) configuratorc C s || _ g | _g | _d S r( )r achallsindices)r+ r r r r! r* j s zChallengePerformer.__init__N)rE idxr c C s$ | j | |dur | j| dS )zStore challenge to be performed when perform() is called.
:param .KeyAuthorizationAnnotatedChallenge achall: Annotated
challenge.
:param int idx: index to challenge in a larger array
N)r appendr )r+ rE r r r r! add_challo s z ChallengePerformer.add_challr: c C s
t dS )zPerform all added challenges.
:returns: challenge responses
:rtype: `list` of `acme.challenges.KeyAuthorizationChallengeResponse`
N)NotImplementedErrorr; r r r! perform| s zChallengePerformer.perform)N)rL rM rN rO rm r* r Z"KeyAuthorizationAnnotatedChallenger rl r r r
Z!KeyAuthorizationChallengeResponser r r r r! r ^ s
r ) dest_path digest_pathsrc_path
all_hashesr c s t ddfdd dd fdd }tjsJ| dS t }|kr`dS ||v rp| n`tjrtd}| }W d n1 s0 Y |krdS td dS ) a Copy a file into an active location (likely the system's config dir) if required.
:param str dest_path: destination path for version controlled file
:param str digest_path: path to save a digest of the file in
:param str src_path: path to version controlled file found in distribution
:param list all_hashes: hashes of every released version of the file
Nr: c s8 t d} | W d n1 s*0 Y d S )Nw)openwrite)Zfile_h) current_hashr r r! _write_current_hash s z._write_current_hashc s t d S r( )shutilcopyfiler )r r r r r! _install_current_file s z>install_version_controlled_file.._install_current_filerzh%s has been manually modified; updated file saved to %s. We recommend updating %s for security purposes.) r Z sha256sumr re isfiler readloggerZwarning)r r r r r Zactive_file_digestfZ saved_digestr )r r r r r r! ri s(
&ri )test_dirpkgr c C s t t ddd}|d}|d}|d}t|tj t|tj t|tj tj|d| }tj |*}t
j |t j
|| dd W d
n1 s0 Y |||fS ) z5Setup the directories necessary for the configurator.)prefixr c S s t t| S )a Return the real path of a temp directory with the specified prefix
Some plugins rely on real paths of symlinks for working correctly. For
example, certbot-apache uses real paths of configuration files to tell
a virtual host from another. On systems where TMP itself is a symbolic
link, (ex: OS X) such plugins will be confused. This function prevents
such a case.
)r realpathtempfileZmkdtemp)r r r r! expanded_tempdir s z#dir_setup..expanded_tempdirZtempr' ZworkZtestdataT)symlinksN)r8 r chmodr ZCONFIG_DIRS_MODE importlibZ resourcesfilesjoinpathZas_filer copytreer re rI )r r r Ztemp_dirrf Zwork_dirZ test_dir_refre r r r! dir_setup s $r );rO abcr r rQ Zimportlib.resourcesr Zloggingrer r typingr r r r r r r
r r Zacmer
Zcertbotr r r r r r Zcertbot._internalr Zcertbot.compatr r Zcertbot.interfacesr ZAbstractInstallerr ZAbstractPluginZcertbot.plugins.storager Z getLoggerrL r r8 r" r& compileZprivate_ips_regex
IGNORECASEZhostname_regexZ
Authenticatorrm rn ro r ri r r r r r! sb
Th b) 3