\\S@sdZddlZddlZddlZddlZddlZddlmZddlm Z ddl m Z m Z m Z mZmZddlmZddlmZddlmZdd lmZejeZejd d d gZGd ddeZddZddZddZddZddZ dZ!de!dde!dddd d!d"e!d#d$e!d%e!iZ"d&d'Z#d(d)Z$dS)*zACME AuthHandler.N) challenges)messages) DefaultDictDictListSet Collection) achallenges)errors) error_handler) interfacesAnnotatedAuthzrauthzrachallsc@seZdZdZddZdddZddZd d Zd d Zd dZ ddZ ddZ ddddZ ddZ ddZddZdddZd d!Zd"d#ZdS)$ AuthHandleraACME Authorization Handler for a client. :ivar auth: Authenticator capable of solving :class:`~acme.challenges.Challenge` types :type auth: :class:`certbot.interfaces.IAuthenticator` :ivar acme.client.BackwardsCompatibleClientV2 acme_client: ACME client API. :ivar account: Client's Account :type account: :class:`certbot.account.Account` :ivar list pref_challs: sorted user specified preferred challenges type strings with the most preferred challenge listed first cCs(||_||_||_||_dS)N)authacmeaccount pref_challs)selfrZ acme_clientrrr6/usr/lib/python3/dist-packages/certbot/auth_handler.py__init__+s   zAuthHandler.__init__Fc Csdd|jD}|j|tjjtj}tjjtjj}xx|j |rt j |j |M|j |}tjd|jr|ddd|j|||WdQRXqSW|j|dd|D}|stjd |S) aRetrieve all authorizations for challenges. :param acme.messages.OrderResource orderr: must have authorizations filled in :param bool best_effort: Whether or not all authorizations are required (this is useful in renewal) :returns: List of authorization resources :rtype: list :raises .AuthorizationError: If unable to retrieve all authorizations cSsg|]}t|gqSr)r ).0rrrr As z5AuthHandler.handle_authorizations..zWaiting for verification...z\Challenges loaded. Press continue to submit to CA. Pass "-v" for more info about challenges.pauseTNcSs1g|]'}|jjjtjkr|jqSr)rbodystatusr STATUS_VALID)raauthzrrrrrXs z!Challenges failed for all domains)Zauthorizations_choose_challengeszope component getUtilityr ZIConfigZIDisplayZ notification_has_challengesr Z ExitHandler_cleanup_challenges_solve_challengesloggerinfoZdebug_challenges_respondverify_authzr_completer AuthorizationError)rZorderr best_effortaauthzrsconfigZnotifyrespZret_valrrrhandle_authorizations2s&        z!AuthHandler.handle_authorizationsc Cs*dd|D}|r&tjdx|D]}|jjj}|jjdkrf|jjj}n%tddt t |D}t ||j |jjj j|}|j|j|}|jj|q-WxH|D]@}x7|jD],}t|jtjrtjddSqWqWdS) z Retrieve necessary and pending challenges to satisfy server. NB: Necessary and already validated challenges are not retrieved, as they can be reused for a certificate issuance. cSs.g|]$}|jjjtjkr|qSr)rrrrr)rrrrrrgs z2AuthHandler._choose_challenges..z$Performing the following challenges:css|]}|fVqdS)Nr)rirrr psz1AuthHandler._choose_challenges..z5TLS-SNI-01 is deprecated, and will stop working soon.N)r'r(rrrrZ acme_version combinationstuplerangelengen_challenge_path_get_chall_pref identifiervalue_challenge_factoryrextend isinstancechallZTLSSNI01warning) rr-Zpending_authzrsrZaauthzr_challengesr4pathZaauthzr_achallsachallrrrr as(  %   zAuthHandler._choose_challengescCstdd|DS)z%Do we have any challenges to perform?css|]}|jVqdS)N)r)rrrrrr3sz.AuthHandler._has_challenges..)any)rr-rrrr$szAuthHandler._has_challengesc Csg}|j|}y|r0|jj|}Wn2tjk retjdtjdYnXt|t|kst |S)z1Get Responses for challenges from authenticators.z!Failure in setting up challenges.z0Attempting to clean up outstanding challenges...) _get_all_achallsrZperformr r+r'criticalr(r7AssertionError)rr-r/ all_achallsrrrr&s  zAuthHandler._solve_challengescCs+g}x|D]}|j|jq W|S)zReturn all active challenges.)r=r)rr-rGrrrrrDs zAuthHandler._get_all_achallscCs3t}|j||||j|||dS)z|Send/Receive confirmation of all challenges. .. note:: This method also cleans up the auth_handler state. N)dict_send_responses_poll_challenges)rr-r/r, chall_updaterrrr)s zAuthHandler._respondc Csg}t|}x|t|D]n\}}x_|jD]T}|j|t|} | r5|jj|j| |j|gj|q5WqW|S)aSend responses and make sure errors are handled. :param aauthzrs: authorizations and the selected annotated challenges to try and perform :type aauthzrs: `list` of `AnnotatedAuthzr` :param resps: challenge responses from the authenticator where each response at index i corresponds to the annotated challenge at index i in the list returned by :func:`_get_all_achalls` :type resps: `collections.abc.Iterable` of :class:`~acme.challenges.ChallengeResponse` or `False` or `None` :param dict chall_update: parameter that is updated to hold aauthzr index to list of outstanding solved annotated challenges ) iter enumeraterappendnextrZanswer_challengechallb setdefault) rr-ZrespsrKZactive_achallsZ resps_iterr2rrBr/rrrrIs   !zAuthHandler._send_responsescCsnt|j}t}d}xF|ri||kritj|t} x|D]} |j|| || \} } t| t|| kr|j| qS| sxx| D]\} }|| j| qWqS|r |j| tj d|| j j j j qS| jdd| DqSW| rHt| tj| ||8}|j|d7}q$WdS)z0Wait for all challenge results to be determined.rzChallenge failed for domain %scss|]\}}|VqdS)Nr)r_updatedrrrr3sz/AuthHandler._poll_challenges..r1N)setkeystimeZsleep _handle_checkr7addremover'r@rrr:r;update_report_failed_challsr ZFailedChallengesclear)rr-rKr,Z min_sleepZ max_roundsZindices_to_checkZ comp_indicesroundsZall_failed_achallsindexZ comp_achallsfailed_achallsrBrTrrrrJs6        zAuthHandler._poll_challengesc Csg}g}||}|jj|j\}}t||j||<|jjtjkrf|gfSxy|D]q} | j d|j || } | jtjkr|j | | fqm| jtj krm|j | | fqmW||fS)z)Returns tuple of ('completed', 'failed').rP) rZpollrr rrrrrr\_find_updated_challbrNSTATUS_INVALID) rr-r`rZ completedZfailedZoriginal_aauthzrZupdated_authzrrTrBZupdated_achallrrrrYs   zAuthHandler._handle_checkcCsOx9|jjD]+}t|jt|jjkr |Sq WtjddS)a_Find updated challenge body within Authorization Resource. .. warning:: This assumes only one instance of type of challenge in each challenge resource. :param .AuthorizationResource authzr: Authorization Resource :param .AnnotatedChallenge achall: Annotated challenge for which to get status z4Target challenge not found in authorization resourceN)rrtyper?rPr r+)rrrBZ authzr_challbrrrrbs !z AuthHandler._find_updated_challbcCsg}|jj|}|jrtdd|D}x4|jD])}||krD|jtjj|qDW|r{|Stj d|j ||S)z{Return list of challenge preferences. :param str domain: domain for which you are requesting preferences css|]}|jVqdS)N)typ)rr?rrrr3)sz.AuthHandler._get_chall_pref..zENone of the preferred challenges are supported by the selected plugin) rZget_chall_prefrrVrNrZ ChallengeZTYPESr r+r=)rdomainZ chall_prefsZ plugin_prefZplugin_pref_typesrerrrr9s    zAuthHandler._get_chall_prefNcCstjd|dkr(|j|}|r|jj|x?|D]7}x.|D]&}||jkrR|jj|PqRWqEWdS)a7Cleanup challenges. :param aauthzrs: authorizations and their selected annotated challenges :type aauthzrs: `list` of `AnnotatedAuthzr` :param achalls: annotated challenges to cleanup :type achalls: `list` of :class:`certbot.achallenges.AnnotatedChallenge` zCleaning up challengesN)r'r(rDrZcleanuprr[)rr-rrBrrrrr%5s    zAuthHandler._cleanup_challengescCsWxP|D]H}|j}|jjtjkr|jjtjkrtjdqWdS)aVerifies that all authorizations have been decided. :param aauthzrs: authorizations and their selected annotated challenges :type aauthzrs: `list` of `AnnotatedAuthzr` :returns: Whether all authzr are complete :rtype: bool zIncomplete authorizationsN)rrrrrrcr r+)rr-rrrrrr*Js  z"AuthHandler.verify_authzr_completecCsSg}xF|D]>}|jj|}|jt||jj|jjjq W|S)aiConstruct Namedtuple Challenges :param messages.AuthorizationResource authzr: authorization :param list path: List of indices from `challenges`. :returns: achalls, list of challenge type :class:`certbot.achallenges.Indexed` :rtype: list :raises .errors.Error: if challenge type is not recognized )rrrNchallb_to_achallrkeyr:r;)rrrArr`rPrrrr<[s   #zAuthHandler._challenge_factory)__name__ __module__ __qualname____doc__rr0r r$r&rDr)rIrJrYrbr9r%r*r<rrrrrs  /     %&    rcCs|j}tjd|j|t|tjrMtjd|d|d|St|tj rutj d|d|St j d|jdS)a:Converts a ChallengeBody object to an AnnotatedChallenge. :param .ChallengeBody challb: ChallengeBody :param .JWK account_key: Authorized Account Key :param str domain: Domain of the challb :returns: Appropriate AnnotatedChallenge :rtype: :class:`certbot.achallenges.AnnotatedChallenge` z%s challenge for %srPrf account_keyz*Received unsupported challenge of type: %sN) r?r'r(rer>rZKeyAuthorizationChallenger Z"KeyAuthorizationAnnotatedChallengeZDNSr Error)rPrmrfr?rrrrgss  rgcCs'|rt|||St||SdS)aGenerate a plan to get authority over the identity. .. todo:: This can be possibly be rewritten to use resolved_combinations. :param tuple challbs: A tuple of challenges (:class:`acme.messages.Challenge`) from :class:`acme.messages.AuthorizationResource` to be fulfilled by the client in order to prove possession of the identifier. :param list preferences: List of challenge preferences for domain (:class:`acme.challenges.Challenge` subclasses) :param tuple combinations: A collection of sets of challenges from :class:`acme.messages.Challenge`, each of which would be sufficient to prove possession of the identifier. :returns: tuple of indices from ``challenges``. :rtype: tuple :raises certbot.errors.AuthorizationError: If a path cannot be created that satisfies the CA given the preferences and combinations. N)_find_smart_path_find_dumb_path)challbs preferencesr4rrrr8sr8c Csi}d}x.t|D] \}}|||<||7}qWd}|}d} x]|D]U} x.| D]&} | |j|| jj|7} qcW| |kr| }| }d} qVW|st||S)zFind challenge path with server hints. Can be called if combinations is included. Function uses a simple ranking system to choose the combo with the lowest cost. r1Nr)rMgetr? __class___report_no_chall_path) rqrrr4Z chall_costZmax_costr2Z chall_clsZ best_comboZbest_combo_costZ combo_totalZcomboZchallenge_indexrrrros&       rocsig}x\t|D]N\}tfdd|Dd}|rW|j|qt|qW|S)zFind challenge path without server hints. Should be called if the combinations hint is not included by the server. This function either returns a path containing all challenges provided by the CA or raises an exception. c3s'|]}tj|rdVqdS)TN)r>r?)rZpref_c)rPrrr3sz"_find_dumb_path..F)rMrOrNru)rqrrrAr2Z supportedr)rPrrps rpcCs[d}t|dkr;t|djtjr;|d7}tj|tj|dS)zLogs and raises an error that no satisfiable chall path exists. :param challbs: challenges from the authorization that can't be satisfied zyClient with the currently selected authenticator does not support any combination of challenges that will satisfy the CA.r1rzM You may need to use an authenticator plugin that can do challenges over DNS.N) r7r>r?rZDNS01r'rEr r+)rqmsgrrrrus + ruzTo fix these errors, please make sure that your domain name was entered correctly and the DNS A/AAAA record(s) for that domain contain(s) the right IP address.Z connectiona Additionally, please check that your computer has a publicly routable IP address and that no firewalls are preventing the server from communicating with the client. If you're using the webroot plugin, you should also verify that you are serving files from the webroot path you provided.Zdnssecze Additionally, if you have DNSSEC enabled for your domain, please ensure that the signature is valid.Z malformedzTo fix these errors, please make sure that you did not provide any invalid information to the client, and try running Certbot again.ZserverInternalzoUnfortunately, an error on the ACME server prevented you from completing authorization. Please try again later.Ztlsz Additionally, please check that you have an up-to-date TLS configuration that allows the server to communicate with the Certbot client.Z unauthorizedZ unknownHostcCstjt}x.|D]&}|jr||jjj|qWtjjt j }x0t j |D]}|j t||jqeWdS)zNotifies the user about failed challenges. :param set failed_achalls: A set of failed :class:`certbot.achallenges.AnnotatedChallenge`. N) collections defaultdictlisterrorrerNr!r"r#r Z IReportersixZ itervaluesZ add_message_generate_failed_chall_msgZMEDIUM_PRIORITY)raZproblemsrBZreporterrrrrr]s  r]cCs|dj}|j}tj|r.|j}dg}x1|D])}|jd|j||jjfq>W|tkr|jd|jt|dj |S)aCreates a user friendly error message about failed challenges. :param list failed_achalls: A list of failed :class:`certbot.achallenges.AnnotatedChallenge` with the same error type. :returns: A formatted error message for the client. :rtype: str rz1The following errors were reported by the server:z" Domain: %s Type: %s Detail: %sz ) rzrerZ is_acme_errorcoderNrfZdetail _ERROR_HELPjoin)rarzrervrBrrrr|'s        r|)%rlrwZloggingrXr{Zzope.componentr!rrrZacme.magic_typingrrrrrZcertbotr r r r Z getLoggerrir' namedtupler objectrrgr8rorpruZ_ERROR_HELP_COMMONrr]r|rrrrsH     (Y  %