3
گaB @ s
d Z ddlmZ ddlmZ ddlZddlZddlZddlZddlZddl m
Z
ddl m Z ddl m Z ddl m
Z
dd l mZ dd
l mZ dd l mZ ddlZdd lmZ dd
lmZ ddlmZ ddlmZ ddlmZ ddlmZ ddlmZ ddlm Z ddlm Z ddl m Z ddl m!Z" ddl#m$Z$ ej%e&Z'e(e(dddZ)e(e(ddd Z*ej+d Z,ej+d ej-Z.G d d d e"ed!Z!G d"d# d#e e!ed!Z G d$d% d%e ej/ed!Z0G d&d' d'Z1G d(d) d)Z2e(e(e(e e( dd*d+d,Z3e(e(ee(e(e(f d-d.d/Z4dS )0zPlugin common functions. )ABCMeta)abstractmethodN)Any)Callable)Iterable)List)Optional)Set)Tuple) achallenges)
configuration) crypto_util)
interfaces)errors)reverter) constants)
filesystem)os) Installer)Plugin)
PluginStorage)namereturnc C s | d S )z9ArgumentParser options namespace (prefix of all options).- )r r r /usr/lib/python3.6/common.pyoption_namespace# s r c C s | j ddd S )z;ArgumentParser dest namespace (prefix of all destinations).r _)replace)r r r r dest_namespace( s r zX(^127\.0\.0\.1)|(^10\.)|(^172\.1[6-9]\.)|(^172\.2[0-9]\.)|(^172\.3[0-1]\.)|(^192\.168\.)z3^(([a-z0-9]|[a-z0-9][a-z0-9\-]*[a-z0-9])\.)*[a-z]+$c s e Zd ZdZejedd fdd Zee e
d dddd Z ee j
edd
d d Zeed
ddZeedddZeed
ddZeedddZeedddZeej eddd Z ZS ) r zGeneric plugin.N)configr r c s t j|| || _|| _d S )N)super__init__r r )selfr r ) __class__r r r" 7 s zPlugin.__init__.)addr c C s dS )zAdd plugin arguments to the CLI argument parser.
:param callable add: Function that proxies calls to
`argparse.ArgumentParser.add_argument` prepending options
with unique plugin name prefix.
Nr )clsr% r r r add_parser_arguments< s zPlugin.add_parser_arguments)parserr r c s$ t ttdd fdd }| j|S )zkInject parser options.
See `~.certbot.interfaces.Plugin.inject_parser_options` for docs.
N)arg_name_no_prefixargskwargsr c s" j djt | f|| d S )Nz--{0}{1}) add_argumentformatr )r) r* r+ )r r( r r r% O s z)Plugin.inject_parser_options..add)strr r' )r& r( r r% r )r r( r inject_parser_optionsG s z Plugin.inject_parser_options)r c C s
t | jS )z9ArgumentParser options namespace (prefix of all options).)r r )r# r r r r U s zPlugin.option_namespace)r r c C s
| j | S )z'Option name (include plugin namespace).)r )r# r r r r option_nameZ s zPlugin.option_namec C s
t | jS )z;ArgumentParser dest namespace (prefix of all destinations).)r r )r# r r r r ^ s zPlugin.dest_namespace)varr c C s | j |jdd S )z.Find a destination for given variable ``var``.r r )r r )r# r1 r r r destc s z Plugin.destc C s t | j| j|S )z0Find a configuration value for variable ``var``.)getattrr r2 )r# r1 r r r confi s z Plugin.conf)failed_achallsr c C s( dj tdd |D }dj| j|dS )a9 Human-readable string to help the user troubleshoot the authenticator.
Shown to the user if one or more of the attempted challenges were not a success.
Should describe, in simple language, what the authenticator tried to do, what went
wrong and what the user should try as their "next steps".
TODO: auth_hint belongs in Authenticator but can't be added until the next major
version of Certbot. For now, it lives in .Plugin and auth_handler will only call it
on authenticators that subclass .Plugin. For now, inherit from `.Plugin` to implement
and/or override the method.
:param list failed_achalls: List of one or more failed challenges
(:class:`achallenges.AnnotatedChallenge` subclasses).
:rtype str:
z and c S s h | ]
}|j qS r )typ).0achallr r r s z#Plugin.auth_hint..zThe Certificate Authority couldn't externally verify that the {name} plugin completed the required {challs} challenges. Ensure the plugin is configured correctly and that the changes it makes are accessible from the internet.)r challs)joinsortedr- r )r# r5 r: r r r auth_hintm s zPlugin.auth_hint).N)__name__
__module__ __qualname____doc__r ZNamespaceConfigr. r" classmethodr r r' argparseArgumentParserr/ propertyr r0 r r2 r r4 r r ZAnnotatedChallenger=
__classcell__r r )r$ r r 4 s
r ) metaclassc s e Zd ZdZeedd fdd Zd ee eedddd Z edd
d d Z
dd
ddZ dd
ddZ d e
ddddZeed
ddZeed
ddZdd
ddZ ZS ) r zAn installer base class with reverter and ssl_dhparam methods defined.
Installer plugins do not have to inherit from this class.
N)r* r+ r c s0 t j|| t| j| j| _tj| j| _d S )N)r! r" r r r Zstorager ZReverter)r# r* r+ )r$ r r r" s zInstaller.__init__F)
save_files
save_notes temporaryr c C s\ |r| j j}n| j j}y||| W n2 tjk
rV } ztjt|W Y dd}~X nX dS )a Add files to a checkpoint.
:param set save_files: set of filepaths to save
:param str save_notes: notes about changes during the save
:param bool temporary: True if the files should be added to a
temporary checkpoint rather than a permanent one. This is
usually used for changes that will soon be reverted.
:raises .errors.PluginError: when unable to add to checkpoint
N)r Zadd_to_temp_checkpointadd_to_checkpointr
ReverterError PluginErrorr. )r# rH rI rJ Zcheckpoint_funcerrr r r rK s
zInstaller.add_to_checkpoint)titler c C sH y| j j| W n2 tjk
rB } ztjt|W Y dd}~X nX dS )zTimestamp and save changes made through the reverter.
:param str title: Title describing checkpoint
:raises .errors.PluginError: when an error occurs
N)r finalize_checkpointr rL rM r. )r# rO rN r r r rP s z Installer.finalize_checkpoint)r c C sF y| j j W n2 tjk
r@ } ztjt|W Y dd}~X nX dS )zRevert all previously modified files.
Reverts all modified files that have not been saved as a checkpoint
:raises .errors.PluginError: If unable to recover the configuration
N)r recovery_routiner rL rM r. )r# rN r r r rQ s zInstaller.recovery_routinec C sF y| j j W n2 tjk
r@ } ztjt|W Y dd}~X nX dS )zkRollback temporary checkpoint.
:raises .errors.PluginError: when unable to revert config
N)r revert_temporary_configr rL rM r. )r# rN r r r rR s z!Installer.revert_temporary_config )rollbackr c C sH y| j j| W n2 tjk
rB } ztjt|W Y dd}~X nX dS )zRollback saved checkpoints.
:param int rollback: Number of checkpoints to revert
:raises .errors.PluginError: If there is a problem with the input or
the function is unable to correctly revert the configuration
N)r rollback_checkpointsr rL rM r. )r# rT rN r r r rU s z Installer.rollback_checkpointsc C s t jj| jjtjS )z(Full absolute path to ssl_dhparams file.)r pathr; r
config_dirr ZSSL_DHPARAMS_DEST)r# r r r ssl_dhparams s zInstaller.ssl_dhparamsc C s t jj| jjtjS )z:Full absolute path to digest of updated ssl_dhparams file.)r rV r; r rW r ZUPDATED_SSL_DHPARAMS_DIGEST)r# r r r updated_ssl_dhparams_digest s z%Installer.updated_ssl_dhparams_digestc C s t | j| jtjtj dS )zJCopy Certbot's ssl_dhparams file into the system's config dir if required.N) install_version_controlled_filerX rY r ZSSL_DHPARAMS_SRCZALL_SSL_DHPARAMS_HASHES)r# r r r install_ssl_dhparams s
z Installer.install_ssl_dhparams)F)rS )r> r? r@ rA r r" r r. boolrK rP rQ rR intrU rE rX rY r[ rF r r )r$ r r s
r c @ s e Zd ZdZdS ) Configuratorzt
A plugin that extends certbot.plugins.common.Installer
and implements certbot.interfaces.Authenticator
N)r> r? r@ rA r r r r r^ s r^ c @ s e Zd ZdZd"eeef edddZeed dddZ ed d
d Z
eeef d d d
Z e edddZ
ed ddZed ddZed ddZed dddZeee ddd Zed d d Zeee dd d Zd!S )#AddrzRepresents an virtual host address.
:param str addr: addr part of vhost address
:param str port: port number or \*, or ""
F)tupipv6c C s || _ || _d S )N)r` ra )r# r` ra r r r r" s z
Addr.__init__)str_addrr c C s |j drh|jd}|d|d }d}t||d krX||d dkrX||d d }| ||fdd S |jd}| |d
|d fS dS ) z Initialize Addr from string.[]NrS :T)ra r )
startswithrfindlen partition)r& rb ZendIndexhostportr` r r r
fromstring s
zAddr.fromstring)r c C s | j d rd| j S | j d S )NrS z%s:%sr )r` )r# r r r __str__ s
z Addr.__str__c C s | j r| j | jd fS | jS )z5Normalized representation of addr/port tuple
rS )ra get_ipv6_explodedr` )r# r r r normalized_tuple s zAddr.normalized_tuple)otherr c C s t || jr | j |j kS dS )NF)
isinstancer$ rq )r# rr r r r __eq__ s z Addr.__eq__c C s
t | jS )N)hashr` )r# r r r __hash__% s z
Addr.__hash__c C s
| j d S )z Return addr part of Addr object.r )r` )r# r r r get_addr( s z
Addr.get_addrc C s
| j d S )z Return port.rS )r` )r# r r r get_port, s z
Addr.get_port)rm r c C s | j | jd |f| jS )z6Return new address object with same addr and new port.r )r$ r` ra )r# rm r r r get_addr_obj0 s zAddr.get_addr_obj)addrr c C s |j d}|jd}| j|S )z7Return IPv6 address in normalized form, helper functionrc rd )lstriprstrip
_explode_ipv6)r# rz r r r _normalize_ipv64 s
zAddr._normalize_ipv6c C s | j r dj| j| jd S dS )z Return IPv6 in normalized formrg r re )ra r; r~ r` )r# r r r rp : s zAddr.get_ipv6_explodedc C s ddddddddg}|j d}t|t|kr>|dt| }d}xZt|D ]N\}}|s^d}qLt|dkrt|jd}|st|||< qLt|||t| < qLW |S )z#Explode IPv6 address for comparison0rg r FTrS )splitrj enumerater{ r. )r# rz resultZ addr_listZ
append_to_endiblockr r r r} @ s
zAddr._explode_ipv6N)F)r> r? r@ rA r
r. r\ r" rB rn ro rq r rt r] rv rw rx ry r r~ rp r} r r r r r_ s r_ c @ sL e Zd ZdZedddZd ejee ddddZ
e ej d d
d Z dS )
ChallengePerformerav Abstract base for challenge performers.
:ivar configurator: Authenticator and installer plugin
:ivar achalls: Annotated challenges
:vartype achalls: `list` of `.KeyAuthorizationAnnotatedChallenge`
:ivar indices: Holds the indices of challenges from a larger array
so the user of the class doesn't have to.
:vartype indices: `list` of `int`
) configuratorc C s || _ g | _g | _d S )N)r achallsindices)r# r r r r r" e s zChallengePerformer.__init__N)r8 idxr c C s$ | j j| |dk r | jj| dS )zStore challenge to be performed when perform() is called.
:param .KeyAuthorizationAnnotatedChallenge achall: Annotated
challenge.
:param int idx: index to challenge in a larger array
N)r appendr )r# r8 r r r r add_challj s z ChallengePerformer.add_chall)r c C s
t dS )zPerform all added challenges.
:returns: challenge responses
:rtype: `list` of `acme.challenges.KeyAuthorizationChallengeResponse`
N)NotImplementedError)r# r r r performw s zChallengePerformer.perform)N)
r> r? r@ rA r^ r" r Z"KeyAuthorizationAnnotatedChallenger r] r r r r r r r r Y s
r ) dest_path digest_pathsrc_path
all_hashesr c s t jddfdd dd fdd }tjjsJ| dS t j}|kr`dS ||krp| nLtjjrtd}|j }W dQ R X |krdS tjd dS ) a Copy a file into an active location (likely the system's config dir) if required.
:param str dest_path: destination path for version controlled file
:param str digest_path: path to save a digest of the file in
:param str src_path: path to version controlled file found in distribution
:param list all_hashes: hashes of every released version of the file
N)r c s$ t d} | j W d Q R X d S )Nw)openwrite)Zfile_h) current_hashr r r _write_current_hash s z._write_current_hashc s t j d S )N)shutilZcopyfiler )r r r r r _install_current_file s z>install_version_controlled_file.._install_current_filerzh%s has been manually modified; updated file saved to %s. We recommend updating %s for security purposes.) r
Z sha256sumr rV isfiler readloggerZwarning)r r r r r Zactive_file_digestfZ saved_digestr )r r r r r r rZ s&
rZ )test_dirpkgr c C s t t ddd}|d}|d}|d}tj|tj tj|tj tj|tj tj|tjj d| }t
j |tjj || dd |||fS )
z5Setup the directories necessary for the configurator.)prefixr c S s t jtj| S )a Return the real path of a temp directory with the specified prefix
Some plugins rely on real paths of symlinks for working correctly. For
example, certbot-apache uses real paths of configuration files to tell
a virtual host from another. On systems where TMP itself is a symbolic
link, (ex: OS X) such plugins will be confused. This function prevents
such a case.
)r realpathtempfileZmkdtemp)r r r r expanded_tempdir s z#dir_setup..expanded_tempdirZtempr ZworkZtestdataT)Zsymlinks) r. r chmodr ZCONFIG_DIRS_MODE
pkg_resourcesZresource_filenamer rV r; r Zcopytree)r r r Ztemp_dirrW Zwork_dirZ test_configsr r r dir_setup s r )5rA abcr r rC Zloggingrer r Ztypingr r r r r r r
r Zcertbotr r r
r r r Zcertbot._internalr Zcertbot.compatr r Zcertbot.interfacesr ZAbstractInstallerr ZAbstractPluginZcertbot.plugins.storager Z getLoggerr> r r. r r compileZprivate_ips_regex
IGNORECASEZhostname_regexZ
Authenticatorr^ r_ r rZ r r r r r sT
Thb)2