ó Y[c@sÁdZddlZddlZddlZddlZddlmZddlZddlZddl Z ddl m Z ddl m ZddlmZmZmZmZmZmZmZddlmZddlmZdd lmZdd lmZejeƒZer0eej eej!fZ"nd e#fd „ƒYZ$e j%e j&gZ'd ej(fd„ƒYZ)e j*j+ej,ƒe j*j-ej.ƒdej/fd„ƒYƒƒZ0d„Z1dS(sStandalone Authenticator.iÿÿÿÿN(terrno(t challenges(t standalone(t DefaultDicttDicttSettTupletListtTypet TYPE_CHECKING(t achallenges(terrors(t interfaces(tcommont ServerManagercBs5eZdZd„Zdd„Zd„Zd„ZRS(s§Standalone servers manager. Manager for `ACMEServer` and `ACMETLSServer` instances. `certs` and `http_01_resources` correspond to `acme.crypto_util.SSLSocket.certs` and `acme.crypto_util.SSLSocket.http_01_resources` respectively. All created servers share the same certificates and resources, so if you're running both TLS and non-TLS instances, HTTP01 handlers will serve the same URLs! cCsi|_||_||_dS(N(t _instancestcertsthttp_01_resources(tselfRR((s>/usr/lib/python2.7/dist-packages/certbot/plugins/standalone.pyt__init__-s  tcCsÞ|tjtjfkst‚||jkr8|j|S||f}y@|tjkrntj||jƒ}ntj||j ƒ}Wn(t j k r®}t j ||ƒ‚nX|jƒ|jƒdd}||j|<|S(s,Run ACME server on specified ``port``. This method is idempotent, i.e. all calls with the same pair of ``(port, challenge_type)`` will reuse the same server. :param int port: Port to run the server on. :param challenge_type: Subclass of `acme.challenges.Challenge`, either `acme.challenge.HTTP01` or `acme.challenges.TLSSNI01`. :param str listenaddr: (optional) The address to listen on. Defaults to all addrs. :returns: DualNetworkedServers instance. :rtype: ACMEServerMixin ii(RtTLSSNI01tHTTP01tAssertionErrorRtacme_standalonetTLSSNI01DualNetworkedServersRtHTTP01DualNetworkedServersRtsocketterrorR tStandaloneBindErrort serve_forevert getsocknames(Rtporttchallenge_typet listenaddrtaddresstserversRt real_port((s>/usr/lib/python2.7/dist-packages/certbot/plugins/standalone.pytrun2s     cCsP|j|}x(|jƒD]}tjd|d ŒqW|jƒ|j|=dS(sWStop ACME server running on the specified ``port``. :param int port: sStopping server at %s:%d...iN(RRtloggertdebugtshutdown_and_server_close(RR tinstancetsockname((s>/usr/lib/python2.7/dist-packages/certbot/plugins/standalone.pytstopYs    cCs |jjƒS(sÉReturn all running instances. Once the server is stopped using `stop`, it will not be returned. :returns: Mapping from ``port`` to ``servers``. :rtype: tuple (Rtcopy(R((s>/usr/lib/python2.7/dist-packages/certbot/plugins/standalone.pytrunninghs (t__name__t __module__t__doc__RR&R,R.(((s>/usr/lib/python2.7/dist-packages/certbot/plugins/standalone.pyR s    ' tSupportedChallengesActioncBs#eZdZdd„Zd„ZRS(s9Action class for parsing standalone_supported_challenges.cCs)tjdƒ|j|ƒ}||_dS(NstThe standalone specific supported challenges flag is deprecated. Please use the --preferred-challenges flag instead.(R'twarningt_convert_and_validatetstandalone_supported_challenges(Rtparsert namespacetvaluest option_stringtconverted_values((s>/usr/lib/python2.7/dist-packages/certbot/plugins/standalone.pyt__call__|scCs#|jdƒ}d|krktjdƒg|D]$}|dkrMtjjn|^q/}dj|ƒ}ng|D]}|tjjkrr|^qr}|rÃt j |dj dj|ƒƒƒ‚nt d„t Dƒƒ}t |ƒj|ƒst j |dj djt |ƒ|ƒƒƒ‚n|S(s/Validate the value of supported challenges provided by the user. References to "dvsni" are automatically converted to "tls-sni-01". :param str data: comma delimited list of challenge types :returns: validated and converted list of challenge types :rtype: str t,tdvsnis5Updating legacy standalone_supported_challenges valuesUnrecognized challenges: {0}s, css|]}|jVqdS(N(ttyp(t.0tchall((s>/usr/lib/python2.7/dist-packages/certbot/plugins/standalone.pys ¤ss=Plugin does not support the following (valid) challenges: {0}(tsplitR'tinfoRRR>tjoint ChallengetTYPEStargparset ArgumentErrortformattsettSUPPORTED_CHALLENGEStissubset(RtdatatchallsR@tnamet unrecognizedtchoices((s>/usr/lib/python2.7/dist-packages/certbot/plugins/standalone.pyR4„s(  . "N(R/R0R1tNoneR;R4(((s>/usr/lib/python2.7/dist-packages/certbot/plugins/standalone.pyR2ys t AuthenticatorcBsŒeZdZdZd„Zed„ƒZed„ƒZd„Z d„Z d„Z d„Z d „Z d „Zd „Zd „Zd „ZRS(sStandalone Authenticator. This authenticator creates its own ephemeral TCP listener on the necessary port in order to respond to incoming tls-sni-01 and http-01 challenges from the certificate authority. Therefore, it does not rely on any existing server program. sSpin up a temporary webservercOs‡tt|ƒj||Žtjjƒ|_|jjtjjdƒt j t ƒ|_ i|_ t ƒ|_t|j |jƒ|_dS(Ni(tsuperRRRtOpenSSLtcryptotPKeytkeyt generate_keytTYPE_RSAt collectionst defaultdictRItservedRRRR$(Rtargstkwargs((s>/usr/lib/python2.7/dist-packages/certbot/plugins/standalone.pyR»s  c Cs6|ddtjdtddjd„tDƒƒƒdS(Nssupported-challengesthelptactiontdefaultR<css|]}|jVqdS(N(R>(R?R@((s>/usr/lib/python2.7/dist-packages/certbot/plugins/standalone.pys Ós(RFtSUPPRESSR2RCRJ(tclstadd((s>/usr/lib/python2.7/dist-packages/certbot/plugins/standalone.pytadd_parser_argumentsÎs  cCs3g|jdƒjdƒD]}tjj|^qS(s$Challenges supported by this plugin.ssupported-challengesR<(tconfRARRDRE(RRN((s>/usr/lib/python2.7/dist-packages/certbot/plugins/standalone.pytsupported_challengesÕscCsdS(NsíThis authenticator creates its own ephemeral TCP listener on the necessary port in order to respond to incoming tls-sni-01 and http-01 challenges from the certificate authority. Therefore, it does not rely on any existing server program.((R((s>/usr/lib/python2.7/dist-packages/certbot/plugins/standalone.pyt more_infoÛscCsdS(N((R((s>/usr/lib/python2.7/dist-packages/certbot/plugins/standalone.pytprepareâscCs|jS(N(Rg(Rtdomain((s>/usr/lib/python2.7/dist-packages/certbot/plugins/standalone.pytget_chall_prefåscCs g|D]}|j|ƒ^qS(N(t_try_perform_single(Rtachallstachall((s>/usr/lib/python2.7/dist-packages/certbot/plugins/standalone.pytperforméscCsEx>tr@y|j|ƒSWqtjk r<}t|ƒqXqWdS(N(tTruet_perform_singleR Rt_handle_perform_error(RRnR((s>/usr/lib/python2.7/dist-packages/certbot/plugins/standalone.pyRlìs  cCsZt|jtjƒr-|j|ƒ\}}n|j|ƒ\}}|j|j|ƒ|S(N(t isinstanceR@RRt_perform_http_01t_perform_tls_sni_01R\Rd(RRnR$tresponse((s>/usr/lib/python2.7/dist-packages/certbot/plugins/standalone.pyRqós cCs†|jj}|jj}|jj|tjd|ƒ}|jƒ\}}tj j d|j d|d|ƒ}|j j |ƒ||fS(NR"R@Rvt validation(tconfigt http01_portthttp01_addressR$R&RRtresponse_and_validationRtHTTP01RequestHandlertHTTP01ResourceR@RRd(RRnR taddrR$RvRwtresource((s>/usr/lib/python2.7/dist-packages/certbot/plugins/standalone.pyRtûs   cCsz|jj}|jj}|jj|tjd|ƒ}|jd|jƒ\}\}}|j|f|j |j <||fS(NR"tcert_key( Rxttls_sni_01_portttls_sni_01_addressR$R&RRR{RWRtz_domain(RRnR R~R$Rvtcertt_((s>/usr/lib/python2.7/dist-packages/certbot/plugins/standalone.pyRus   !cCsšxJ|jjƒD]9\}}x*|D]"}||kr#|j|ƒq#q#WqWxFtj|jjƒƒD],\}}|j|sf|jj|ƒqfqfWdS(N(R\titemstremovetsixt iteritemsR$R.R,(RRmtunused_serverstserver_achallsRnR R$((s>/usr/lib/python2.7/dist-packages/certbot/plugins/standalone.pytcleanup s  % (R/R0R1t descriptionRt classmethodRetpropertyRgRhRiRkRoRlRqRtRuRŒ(((s>/usr/lib/python2.7/dist-packages/certbot/plugins/standalone.pyRR®s         cCs¬|jjtjkr3tjdj|jƒƒ‚nu|jjtjkr¥t j j t j ƒ}dj|jƒ}|j|dddtƒ}|s¨tj|ƒ‚q¨n‚dS(Ns†Could not bind TCP port {0} because you don't have the appropriate permissions (for example, you aren't running this program as root).sªCould not bind TCP port {0} because it is already in use by another process on this system (such as a web server). Please stop the program in question and then try again.tRetrytCancelRa(t socket_errorRt socket_errorstEACCESR t PluginErrorRHR t EADDRINUSEtzopet componentt getUtilityR tIDisplaytyesnotFalse(Rtdisplaytmsgt should_retry((s>/usr/lib/python2.7/dist-packages/certbot/plugins/standalone.pyRrs  (2R1RFRZtloggingRRR“RTRˆtzope.interfaceR—tacmeRRRtacme.magic_typingRRRRRRR tcertbotR R R tcertbot.pluginsR t getLoggerR/R'tBaseDualNetworkedServerst"KeyAuthorizationAnnotatedChallenget ServedTypetobjectRRRRJtActionR2t interfacet implementertIAuthenticatortprovidertIPluginFactorytPluginRRRr(((s>/usr/lib/python2.7/dist-packages/certbot/plugins/standalone.pyts6       4U5h