3
گaI @ s" d Z ddlZddlZddlZddlZddlmZ ddlmZ ddlmZ ddlm Z ddlm
Z
ddlm Z dd lm Z dd
lm
Z
ddlZdd lmZ dd lmZ dd
lmZ ddlmZ ddlmZ ddlmZ ddlmZ ddlmZ eje Z ej ddddZ ej ddddZ ej ddddZ!ej ddddZ"ej e#e
ej$ dd d Z%ej e#e
e e# d d d Z&ej e e# e e
ej$ e
ej$ f d!d"d#Z'ej$e#e
e e# d$d%d&Z(e e
eej$ge#f eej$ge
e e# f f d'd(d)Z)ej e#d*d+d,Z*ej ee
eej$ge#f eej$ge
e e# f f eej$ge#f eej$ge#f e e# d-d.d/Z+dEej ej$e,e
e# d1d2d3Z-dFej e#e,e
e# e e# d4d5d6Z.ee# e#d7d8d9Z/ej eej$ e#d:d;d<Z0ej eej$ ee# dd=d>d?Z1e d@Z2ej edAe2f e2ee2dBdCdDZ3dS )Gz Tools for managing certificates. N)Any)Callable)Iterable)List)Optional)Tuple)TypeVar)Union)
configuration) crypto_util)errors)ocsp)util)storage)os)configreturnc C s( x"t j| D ]}t j|| dd q W dS )aj Update the certificate file family symlinks to use archive_dir.
Use the information in the config file to make symlinks point to
the correct archive directory.
.. note:: This assumes that the installation is using a Reverter object.
:param config: Configuration.
:type config: :class:`certbot._internal.configuration.NamespaceConfig`
T)Zupdate_symlinksN)r renewal_conf_files
RenewableCert)r renewal_file r "/usr/lib/python3.6/cert_manager.pyupdate_live_symlinks! s r c C s t | dd }| j}|sJtjdj|dd\}}|tjks@| rJtjdt| |}|shtj dj|t
j ||| tj dj||d d
d S ) zRename the specified lineage to the new name.
:param config: Configuration.
:type config: :class:`certbot._internal.configuration.NamespaceConfig`
renamer z&Enter the new name for certificate {0}T)force_interactivezUser ended interaction.z,No existing certificate with name {0} found.z Successfully renamed {0} to {1}.F)pauseN)
get_certnames new_certname display_utilZ
input_textformatOKr Errorlineage_for_certnameZConfigurationErrorr Zrename_renewal_config notification)r certnamer codelineager r r rename_lineage1 s
r' c C s g }g }xt j| D ]t}y$t j|| }tj| |j| W q tk
r } z.tjd|| tj dt
j |j| W Y dd}~X qX qW t | || dS )zDisplay information about certs configured with Certbot
:param config: Configuration.
:type config: :class:`certbot._internal.configuration.NamespaceConfig`
zIRenewal configuration file %s produced an unexpected error: %s. Skipping.zTraceback was:
%sN)
r r r r Zverify_renewable_certappend ExceptionloggerZwarningdebug traceback
format_exc_describe_certs)r parsed_certsparse_failuresr Zrenewal_candidateer r r certificatesK s
r2 c C s t | ddd}dg}x|D ]}|jd| qW |jd |jd tjdj|dd sftjd
d S x(|D ] }tj| | tj d j
| qlW d S )
z;Delete Certbot files associated with a certificate lineage.deleteT)allow_multiplez8The following certificate(s) are selected for deletion:
z * aP
WARNING: Before continuing, ensure that the listed certificates are not being used by any installed server software (e.g. Apache, nginx, mail servers). Deleting a certificate that is still being used will cause the server software to stop working. See https://certbot.org/deleting-certs for information on deleting certificates safely.z:
Are you sure you want to delete the above certificate(s)?
)defaultz$Deletion of certificate(s) canceled.Nz.Deleted all files relating to certificate {0}.) r r( r Zyesnojoinr* infor Z delete_filesnotifyr )r certnamesmsgr$ r r r r3 b s
r3 )
cli_configr$ r c C s | j }tj|dd ytj| |}W n tjk
r: dS X y tj|| S tjtfk
r~ t j
d| t j
dt j dS X dS )z)Find a lineage object with name certname.i )modeNz Renewal conf file %s is broken.zTraceback was:
%s)
renewal_configs_dirr make_or_verify_dirr Zrenewal_file_for_certnamer CertStorageErrorr IOErrorr* r+ r, r- )r< r$ configs_dirr r r r r" | s r" )r r$ r c C s t | |}|r|j S dS )z0Find the domains in the cert with name certname.N)r" names)r r$ r& r r r domains_for_certname s
rD )r domainsr c sP t jttt j tt j f ttt j tt j f d fdd }d}t| ||S )a Find existing certs that match the given domain names.
This function searches for certificates whose domains are equal to
the `domains` parameter and certificates whose domains are a subset
of the domains in the `domains` parameter. If multiple certificates
are found whose names are a subset of `domains`, the one whose names
are the largest subset of `domains` is returned.
If multiple certificates' domains are an exact match or equally
sized subsets, which matching certificates are returned is
undefined.
:param config: Configuration.
:type config: :class:`certbot._internal.configuration.NamespaceConfig`
:param domains: List of domain names
:type domains: `list` of `str`
:returns: lineages representing the identically matching cert and the
largest subset if they exist
:rtype: `tuple` of `storage.RenewableCert` or `None`
)candidate_lineagervr c sb |\}}t | j }|t kr&| }n4|jt rZ|dkrB| }nt|t|j krZ| }||fS )zsReturn cert as identical_names_cert if it matches,
or subset_names_cert if it matches as subset
N)setrC issubsetlen)rF rG Zidentical_names_certZsubset_names_certZcandidate_names)rE r r update_certs_for_domain_matches s
z?find_duplicative_certs..update_certs_for_domain_matchesN)NN)r r r r _search_lineages)r rE rK Zinitr )rE r find_duplicative_certs s
rM )rF filetyper c s, | j fddtj D }|r(|S dS )aJ In order to match things like:
/etc/letsencrypt/archive/example.com/chain1.pem.
Anonymous functions which call this function are eventually passed (in a list) to
`match_and_check_overlaps` to help specify the acceptable_matches.
:param `.storage.RenewableCert` candidate_lineage: Lineage whose archive dir is to
be searched.
:param str filetype: main file name prefix e.g. "fullchain" or "chain".
:returns: Files in candidate_lineage's archive dir that match the provided filetype.
:rtype: list of str or None
c s, g | ]$}t jd j|rtjj |qS )z
{0}[0-9]*.pem)rematchr r pathr7 ).0f) archive_dirrN r r
s z"_archive_files..N)rT r listdir)rF rN patternr )rT rN r _archive_files s
rX )r c C s dd dd dd dd gS )z Generates the list that's passed to match_and_check_overlaps. Is its own function to
make unit testing easier.
:returns: list of functions
:rtype: list
c S s | j S )N)Zfullchain_path)xr r r s z%_acceptable_matches..c S s | j S )N) cert_path)rY r r r rZ s c S s
t | dS )Ncert)rX )rY r r r rZ s c S s
t | dS )N fullchain)rX )rY r r r rZ s r r r r r _acceptable_matches s r^ )r< r c s( t }t | fdddd }|d S )a If config.cert_path is defined, try to find an appropriate value for config.certname.
:param `configuration.NamespaceConfig` cli_config: parsed command line arguments
:returns: a lineage name
:rtype: str
:raises `errors.Error`: If the specified cert path can't be matched to a lineage name.
:raises `errors.OverlappingMatchFound`: If the matched lineage's archive is shared.
c s j S )N)r[ )rY )r< r r rZ s z&cert_path_to_lineage..c S s | j S )N) lineagename)rY r r r rZ s r )r^ match_and_check_overlaps)r< acceptable_matchesrP r )r< r cert_path_to_lineage s rb )r< ra
match_funcrv_funcr c
s t jtt tttt jgtf tt jgttt f f tt d fdd }t| |g |}|svt j
dj | j nt
|dkrt j |S )a Searches through all lineages for a match, and checks for duplicates.
If a duplicate is found, an error is raised, as performing operations on lineages
that have their properties incorrectly duplicated elsewhere is probably a bad idea.
:param `configuration.NamespaceConfig` cli_config: parsed command line arguments
:param list acceptable_matches: a list of functions that specify acceptable matches
:param function match_func: specifies what to match
:param function rv_func: specifies what to return
)rF return_valuera r c sh fdd|D }g }x.|D ]&}t |tr4||7 }q |r |j| q W }||krd|j |S )z1Returns a list of matches using _search_lineages.c s g | ] }| qS r r )rR func)rF r r rU s zBmatch_and_check_overlaps..find_matches..)
isinstancelistr( )rF re ra Zacceptable_matches_resolvedZacceptable_matches_rvitemrP )rc rd )rF r find_matches
s
z.match_and_check_overlaps..find_matchesz!No match found for cert-path {0}! )r r r strr r r r rL r r! r r[ rJ ZOverlappingMatchFound)r< ra rc rd rj Zmatchedr )rc rd r r` s
4 r` F)r r\ skip_filter_checksr c C sF g }t j }| jr(|j| jkr(| r(dS | jrHt| jj|j rHdS tj j
t j j }g }|j
rn|jd |j|kr|jd n|j|r|jd |rddj| }nB|j| }|jdkrd}n(|jdk rd j|jd
}n d j|j}d j|j|} ttj|jd
}
|jdj|j|
|jdj|j | |j|j dj|S )zJ Returns a human readable description of info about a RenewableCert objectNZ TEST_CERTZEXPIREDZREVOKEDz INVALID: z, rk z VALID: 1 dayzVALID: {0} hour(s)i zVALID: {0} daysz {0} ({1})rY z Certificate Name: {}
Serial Number: {}
Key Type: {}
Domains: {}
Expiry Date: {}
Certificate Path: {}
Private Key Path: {} )r
ZRevocationCheckerr$ r_ rE rH rI rC pytzZUTCZfromutcdatetimeZutcnowZ is_test_certr( Z
target_expiryZ ocsp_revokedr7 Zdaysr Zsecondsr Zget_serial_from_certr[ Zprivate_key_typer] Zprivkey) r r\ rm certinfoZcheckerZnowZreasonsZstatusZdiffZ valid_stringserialr r r human_readable_cert_info& sB
rt )r verbr4
custom_promptr c C s | j }|r|g}ntj| }dd |D }|s8tjd|r||sLdj|}n|}tj||ddd\} }| tjkrtjdnZ|sd j|}n|}tj ||ddd\} }
| tjks|
t
d
t |krtjd||
g}|S ) z4Get certname from flag, interactively, or error out.c S s g | ]}t j|qS r )r Zlineagename_for_filename)rR namer r r rU ` s z!get_certnames..z No existing certificates found.z+Which certificate(s) would you like to {0}?z --cert-nameT)Zcli_flagr zUser ended interaction.z(Which certificate would you like to {0}?r ) r$ r r r r! r r Z checklistr ZmenurangerJ ) r ru r4 rv r$ r: filenameschoicespromptr% indexr r r r X s0
r )msgsr c C s ddj dd | D S )zFFormat a results report for a category of single-line renewal outcomesz z
c s s | ]}t |V qd S )N)rl )rR r; r r r s z _report_lines..)r7 )r} r r r
_report_lines s r )r r/ r c C s8 g }x(|D ] }t | |}|dk r
|j| q
W dj|S )z)Format a results report for a parsed certNr5 )rt r( r7 )r r/ rr r\ Z cert_infor r r _report_human_readable s
r )r r/ r0 r c C s g }|j }| r | r |d nL|rT| js0| jr4dnd}|dj| |t| | |rl|d |t| tjdj|ddd d S )
z/Print information about the certs we know aboutzNo certificates found.z matching ro z Found the following {0}certs:z3
The following renewal configurations were invalid:r5 F)r ZwrapN) r( r$ rE r r r r r# r7 )r r/ r0 outr9 rP r r r r. s
r. T.)r< rf
initial_rvargsr c
G s | j }tj|dd |}xltj| D ]^}ytj|| }W n8 tjtfk
rp t j
d| t j
dt j w$Y nX |||f| }q$W |S )a Iterate func over unbroken lineages, allowing custom return conditions.
Allows flexible customization of return values, including multiple
return values and complex checks.
:param `configuration.NamespaceConfig` cli_config: parsed command line arguments
:param function func: function used while searching over lineages
:param initial_rv: initial return value of the function (any type)
:returns: Whatever was specified by `func` if a match is found.
i )r= z)Renewal conf file %s is broken. Skipping.zTraceback was:
%s)
r> r r? r r r r r@ rA r* r+ r, r- )r< rf r r rB rG r rF r r r rL s
rL )F)FN)4__doc__rq ZloggingrO r, Ztypingr r r r r r r r rp Zcertbotr
r r r
r Zcertbot._internalr Zcertbot.compatr Zcertbot.displayr Z getLogger__name__r* ZNamespaceConfigr r' r2 r3 rl r r" rD rM rX r^ rb r` boolrt r r r r. r rL r r r r sn
3 ( % 1 "&