a á `[ã@södZddlmZddlZddlZddlZddlZddlZddlZddl Z ddl m Z ddl m Z mZddlmZddlZddlZddlZddlmZddlmZdd lmZdd lmZdd lmZdd lmZdd lmZdd lm Z ddlm!Z!ddlm"Z"ddlm#Z#ddlm$Z$ddlm%Z%ddl&m'Z(ddl)m*Z*e +e,¡Z-gd¢Z.ddgZ/gd¢Z0e1e 2e0e/e.d¡ƒZ3dd„Z4dd„Z5dd„Z6d d!„Z7d"d#„Z8d$d%„Z9d&d'„Z:d(d)„Z;d*d+„Zd0d1„Z?d2d3„Z@d4d5„ZAd6d7„ZBd8d9„ZCdS):zGFunctionality for autorenewal and associated juggling of configurationsé)Úprint_functionN)Údefault_backend)ÚecÚrsa)Úload_pem_private_key)ÚList)ÚOptional)Ú crypto_util)Úutil)Úerrors)Ú interfaces)Úcli)Úclient)Ú constants)Úhooks)Ústorage)Úupdater)Údisco)Úos)Z config_dirZlogs_dirZwork_dirZ user_agentÚserverZaccountÚ authenticatorÚ installerÚ renew_hookÚpre_hookÚ post_hookZhttp01_addressZpreferred_chainÚkey_typeÚelliptic_curveÚ rsa_key_sizeÚ http01_port)Z must_stapleZallow_subset_of_namesÚ reuse_keyZ autorenew)Ú pref_challsc CsZzt ||¡}WnDtjtfyTtjdddt d|¡t dt  ¡¡YdS0d|j vrpt d|¡dS|j d}d |vr’t d |¡dSt |ƒ}zt ||ƒt ||ƒWnPttjfy}z0t d |t|ƒ¡t dt  ¡¡WYd}~dSd}~00zd d „| ¡Dƒ|_Wn8tjyT}zt d||¡WYd}~dSd}~00|S)a•Try to instantiate a RenewableCert, updating config with relevant items. This is specifically for use in renewal and enforces several checks and policies to ensure that we can try to proceed with the renewal request. The config argument is modified by including relevant options read from the renewal configuration file. :param configuration.NamespaceConfig config: configuration for the current lineage :param str full_path: Absolute path to the configuration file that defines this lineage :returns: the RenewableCert object or None if a fatal error occurred :rtype: `storage.RenewableCert` or NoneType ÚT)Úexc_infoz2Renewal configuration file %s is broken. Skipping.úTraceback was: %sNÚ renewalparamszdsÿz!_reconstitute..z{Renewal configuration file %s references a certificate that contains an invalid domain name. The problem was: %s. Skipping.)rZ RenewableCertr ZCertStorageErrorÚIOErrorÚloggerÚwarningÚdebugÚ tracebackÚ format_excÚ configurationÚ"_remove_deprecated_config_elementsÚ restore_required_config_elementsÚ_restore_plugin_configsÚ ValueErrorÚErrorÚstrÚnamesÚdomainsZConfigurationError)ÚconfigÚ full_pathÚrenewal_candidater$Úerrorr%r%r(Ú _reconstitute5sN  ÿ ÿ þÿ þr=cCsRd|vrt d¡s|d|_d|vrNt d¡sN|d}t|tjƒrH|g}||_dS)z¥ webroot_map is, uniquely, a dict, and the general-purpose configuration restoring logic is not able to correctly parse it from the serialized form. Ú webroot_mapÚ webroot_pathN)r Ú set_by_clir>Ú isinstanceÚsixÚ string_typesr?)r9r$Zwpr%r%r(Ú_restore_webroot_configos  rDcCsÄg}|ddkrt||ƒn| |d¡| d¡durF| |d¡t|ƒD]p}| dd¡}t |¡D]T\}}| |d¡rht  |¡sh|dvr¢t ||t |ƒƒqht  |¡}t ||||ƒƒqhqNdS)aSets plugin specific values in config from renewalparams :param configuration.NamespaceConfig config: configuration for the current lineage :param configobj.Section renewalparams: Parameters from the renewal configuration file that defines this lineage rZwebrootrNú-Ú_)ÚNoneÚTrueÚFalse) rDÚappendÚgetÚsetÚreplacerBZ iteritemsÚ startswithr r@ÚsetattrÚevalZ argparse_type)r9r$Zplugin_prefixesZ plugin_prefixZ config_itemZ config_valueÚcastr%r%r(r3€s     r3c Cs„t dtfftj tt t¡¡tj t t t ¡¡tj t t t ¡¡¡}|D]4\}}||vrJt  |¡sJ||||ƒ}t|||ƒqJdS)aSets non-plugin specific values in config from renewalparams :param configuration.NamespaceConfig config: configuration for the current lineage :param configobj.Section renewalparams: parameters from the renewal configuration file that defines this lineage r N)Ú itertoolsÚchainÚ_restore_pref_challsrBZmovesÚzipÚBOOL_CONFIG_ITEMSÚrepeatÚ _restore_boolÚINT_CONFIG_ITEMSÚ _restore_intÚSTR_CONFIG_ITEMSÚ _restore_strr r@rO)r9r$Zrequired_itemsZ item_nameZ restore_funcÚvaluer%r%r(r2«s ü r2cCsdd„| ¡DƒS)zàRemoves deprecated config options from the parsed renewalparams. :param dict renewalparams: list of parsed renewalparams :returns: list of renewalparams with deprecated config options removed :rtype: dict cSs i|]\}}|tjvr||“qSr%)r ZDEPRECATED_OPTIONS)r&Z option_nameÚvr%r%r(Ú És  ÿz6_remove_deprecated_config_elements..)Úitems)r$r%r%r(r1Às r1cCs t|tjƒr|gn|}t |¡S)a—Restores preferred challenges from a renewal config file. If value is a `str`, it should be a single challenge type. :param str unused_name: option name :param value: option value :type value: `list` of `str` or `str` :returns: converted option value to be stored in the runtime config :rtype: `list` of `str` :raises errors.Error: if value can't be converted to a bool )rArBrCr Zparse_preferred_challenges)Z unused_namer]r%r%r(rTÍsrTcCs*| ¡}|dvr"t d ||¡¡‚|dkS)a#Restores a boolean key-value pair from a renewal config file. :param str name: option name :param str value: option value :returns: converted option value to be stored in the runtime config :rtype: bool :raises errors.Error: if value can't be converted to a bool )ÚtrueZfalsez,Expected True or False for {0} but found {1}ra)Úlowerr r5Úformat)Únamer]Zlowercase_valuer%r%r(rXãs  ÿrXcCsV|dkr$|dkr$t d¡t d¡Sz t|ƒWStyPt d |¡¡‚Yn0dS)a#Restores an integer key-value pair from a renewal config file. :param str name: option name :param str value: option value :returns: converted option value to be stored in the runtime config :rtype: int :raises errors.Error: if value can't be converted to an int rrGz!updating legacy http01_port valuez Expected a numeric value for {0}N) r+Úinfor Ú flag_defaultÚintr4r r5rc©rdr]r%r%r(rZös     rZcCs@|dkr0|tjkr0t dtjd|¡tjdS|dkrt d¡dSt d¡dS)zDReturn true if any of the circumstances for automatic renewal apply.z+Auto-renewal forced with --force-renewal...Tz)Cert is due for renewal, auto-renewing...zgózreport..z z )rq)Zmsgsr}Úlinesr%r|r(ÚreportesrcCs>tj}tj}|d tj¡ƒ|jr&dnd}|rD|dƒ|t|dƒƒ|s„|s„|dj|dƒ|jdusz|j dusz|j dur‚|d ƒn|r¬|s¬|d j|dƒ|t|d ƒƒnh|rÎ|sÎ|d |ƒ|t|d ƒƒnF|r|r|dj|dƒ|t|d ƒdƒ|d|ƒ|t|d ƒƒ|r0|dƒ|t|dƒƒ|tjƒdS)aË Print a report to the terminal about the results of the renewal process. :param interfaces.IConfig config: Configuration :param list renew_successes: list of fullchain paths which were renewed :param list renew_failures: list of fullchain paths which failed to be renewed :param list renew_skipped: list of messages to print about skipped certificates :param list parse_failures: list of renewal parameter paths which had erorrs z {}zsimulated renewalÚrenewalz7The following certificates are not due for renewal yet:ZskippedzNo {renewal}s were attempted.)r‚NzNo hooks were run.z+Congratulations, all {renewal}s succeeded: Zsuccessz@All %ss failed. The following certificates could not be renewed:Zfailurez#The following {renewal}s succeeded:Ú zThe following %ss failed:zB Additionally, the following renewal configurations were invalid: Z parsefail) Ú display_utilÚnotifyr+r<rcZ SIDE_FRAMErirrrr)r9Úrenew_successesÚrenew_failuresÚ renew_skippedÚparse_failuresr…Z notify_errorZ renewal_nounr%r%r(Ú_renew_describe_resultsks@  ÿÿ ÿ  rŠc s~t‡fdd„ˆjDƒƒr"t d¡‚ˆjr:t ˆˆj¡g}n t ˆ¡}g}g}g}g}tj   ¡ odˆj }|D]Ì}t j  tj¡}|jd|ddt ˆ¡} t |¡} zt| |ƒ} Wn\ty} zBt d|| | ¡t dt ¡¡| |¡WYd } ~ qjWYd } ~ n d } ~ 00zÖ| d ur(| |¡n¼t j  | ¡|  ¡d d lm } t!j" #¡}t$| | ƒr¦|rŠt% &d d ¡}t 'd|¡t( )|¡d}|  *| || ¡| | j+¡n0t, -|  .d|  /¡¡¡}| d| j+| 0d¡f¡t1 2| | |¡Wqjty6} z6t 3d| | ¡t dt ¡¡| | j+¡WYd } ~ qjd } ~ 00qjt4ˆ||||ƒ|sV|rpt d 5t6|ƒt6|ƒ¡¡‚t d¡d S)z5Examine each lineage; renew if due and report resultsc3s|]}|ˆjvVqdS)N)r>)r&Zdomain©r9r%r(r~Ÿrz)handle_renewal_request..afCurrently, the renew verb is capable of either renewing all installed certificates that are due to be renewed or renewing a single certificate specified by its name. If you would like to renew specific certificates by their domains, use the certonly command instead. The renew verb may provide other options for selecting certificates to renew in the future.z Processing F)ÚpausezTRenewal configuration file %s (cert: %s) produced an unexpected error: %s. Skipping.r#Nr)Úmainéiàz3Non-interactive renewal: random delay of %s secondsrmz%s expires on %sz%Y-%m-%dz-Failed to renew certificate %s with error: %sz*{0} renew failure(s), {1} parse failure(s)zno renewal failures)7Úanyr8r r5ZcertnamerZrenewal_file_for_certnameZrenewal_conf_filesÚsysÚstdinÚisattyZrandom_sleep_on_renewÚzopeZ componentZ getUtilityr ZIDisplayZ notificationÚcopyÚdeepcopyZlineagename_for_filenamer=Ú Exceptionr+r,r-r.r/rJZprovideUtilityZensure_deployedÚcertbot._internalrÚ plugins_discoZPluginsRegistryZfind_allrkÚrandomZuniformreÚtimeÚsleeprzZ fullchainr ZnotAfterÚversionryÚstrftimerZrun_generic_updatersr<rŠrcÚlen)r9Z conf_filesr†r‡rˆr‰Zapply_random_sleepZ renewal_fileZdispZlineage_configZ lineagenamer;ÚerZpluginsZ sleep_timeZexpiryr%r‹r(Úhandle_renewal_request›s‚     þ "       ÿ ÿ ÿÿþ$ÿ  ÿr cCs’t|dƒ$}t| ¡dtƒd}Wdƒn1s40Yt|tjƒrZd|_|j|_ n4t|t j ƒrxd|_|j j |_nt d |t|ƒ¡¡‚dS)NÚrb)ZpasswordZbackendrZecdsaz*Key at {0} is of an unsupported type: {1}.)rlrrnrrArZ RSAPrivateKeyrZkey_sizerrZEllipticCurvePrivateKeyZcurverdrr r5rcÚtype)Zkey_pathr9Zfile_hÚkeyr%r%r(rws 2    rw)DÚ__doc__Z __future__rr”rRZloggingr™rršr.Zcryptography.hazmat.backendsrZ)cryptography.hazmat.primitives.asymmetricrrZ,cryptography.hazmat.primitives.serializationrrorBZzope.componentr“Zacme.magic_typingrrZcertbotr Zcertbot.displayr r„r r r—r rrrrrZcertbot._internal.pluginsrr˜Zcertbot.compatrZ getLoggerÚ__name__r+r[rYrVrLrSZ CONFIG_ITEMSr=rDr3r2r1rTrXrZr\rkrtrzrrŠr rwr%r%r%r(Úsh                   ÿ:+ 0k