\\r@sdZddlZddlZddlZddlZddlmZddlmZddl Z ddl Z ddl Z ddlmZddlmZddlmZddlmZdd lmZddlZdd lmZdd lmZdd lmZdd lmZddlmZddlmZddlmZddlmZddlmZddlm Z ddlm!Z!ddlm"Z"ddlm#Z#ddl$m%Z&ddl$m'Z'ddl(m)Z*ej+e,Z-dddZ.ddZ/ddZ0Gddde1Z2d d!Z3dd"d#Z4d$d%Z5Gd&d'd'e1Z6dd(d)Z7d*d+Z8dd,d-Z9d.d/Z:d0d1Z;dS)2zCertbot client API.N)default_backend)generate_private_key)client) crypto_util)errors)messages)Optional)account) auth_handler)cli)compat) constants)eff) error_handler) interfaces)reverter)storage)util)ops) enhancements) selectionc CsAtj|d|d|j dt|}tj|||jS)z Wrangle ACME client constructionr Z verify_ssl user_agent) acme_clientZ ClientNetworkZ no_verify_ssldetermine_user_agentZBackwardsCompatibleClientV2server)configkeyregrnetr0/usr/lib/python3/dist-packages/certbot/client.pyacme_from_config_key.sr!c Cs|jdkrd}tjjddkrBd}d}d}n!tj}tj}tj }|j t j |||j |j|jt|||jrd|jnd }n |j}|S) z Set a user_agent string in the config based on the choice of plugins. (this wasn't knowable at construction time) :returns: the client's User-Agent string :rtype: `str` Nz\CertbotACMEClient/{0} ({1}; {2}{8}) Authenticator/{3} Installer/{4} ({5}; flags: {6}) Py/{7}Z CERTBOT_DOCS1zcertbot(-auto)zOS_NAME OS_VERSIONzmajor.minor.patchlevelz; )rosenvirongetr cli_commandrZget_os_info_uaplatformpython_versionformatcertbot __version__ authenticator installerverbua_flagsZuser_agent_comment)rZuar'Zos_infor)rrr r6s      " rcsttrdSg}jr/|jdjrE|jdjr[|jdjrq|jdd}fd d |D}t|r|jd dj|S)z@Turn some very important CLI flags into clues in the user agent.FLAGSdupZfrnZasnnprepostrenew manual_authmanual_cleanupcs#g|]}t|dqS)Z_hook)getattr).0h)rrr cs zua_flags..hook )r4r5r6r7r8) isinstance DummyConfigZ duplicateappendZrenew_by_defaultallow_subset_of_namesnoninteractive_modeanyjoin)rflagsZ hook_namesZhooksr)rr r0Us           r0c@s.eZdZdZddZddZdS)r@z'Shim for computing a sample user agent.cCs(d|_d|_d|_d|_dS)NZXXXZYYYZ SUBCOMMAND)r-r.rr/)selfrrr __init__js   zDummyConfig.__init__cCsdS)z-Any config properties we might have are None.Nr)rGnamerrr __getattr__pszDummyConfig.__getattr__N)__name__ __module__ __qualname____doc__rHrJrrrr r@hs  r@cCs ttS)zUnable to obtain certificate because authenticator is not set.z+Please register with the ACME server first.zCSR: %s best_effortFZsecondsZ)r rPrSrrTr rdebug_get_order_and_authorizationsdatadatetimeZnowZ timedeltar\Zfinalize_orderrZcert_and_chain_from_fullchainZ fullchain_pemencode)rGcsrorderrr[Zdeadlinecertchainrrr obtain_certificate_from_csrs   z"Client.obtain_certificate_from_csrc s|dk rbt|d}|}|j}WdQRXtjd|d|}tjd|nd}|jjr|ptjdddtj |jj }tj dddddt j |j||jj}n?|ptj|jj |jj}tj|||jj}|j|j|jj}|j} tdd | Dfd d |D} |jjr| |kr|jjstj|jtj|j|j| S|j||\} } | | ||fSdS) aObtains a certificate from the ACME server. `.register` must be called before `.obtain_certificate` :param list domains: domains to get a certificate :returns: certificate as PEM string, chain as PEM string, newly generated private key (`.util.Key`), and DER-encoded Certificate Signing Request (`.util.CSR`). :rtype: tuple Nrbfilepemz%Reusing existing private key from %s.formricss|]}|jjjVqdS)N)ZbodyZ identifiervalue)r:arrr csz,Client.obtain_certificate..cs"g|]}|kr|qSrr)r:d) auth_domainsrr r<ds z-Client.obtain_certificate..)openreadrZKeyrPrQrrUrZmake_keyrVCSRacme_crypto_utilZmake_csrrsZ must_stapleZ init_save_keyZkey_dirZ init_save_csrZcsr_dirrhrirBauthorizationssetr$removerrobtain_certificaterp) rGdomainsZ old_keypathfZkeypathZkeypemrrlrmauthzrZsuccessful_domainsrnror)ryr r1s6     zClient.obtain_certificatec Csby|jj|}Wn$tjk r<tjdYnX|jj||}|jd|S)a`Request a new order and complete its authorizations. :param str csr_pem: A CSR in PEM format. :param bool best_effort: True if failing to complete all authorizations should not raise an exception :returns: order resource containing its completed authorizations :rtype: acme.messages.OrderResource zWThe currently selected ACME CA endpoint does not support issuing wildcard certificates.r~) r\Z new_order acme_errorsZWildcardUnsupportedErrorrrTr Zhandle_authorizationsupdate)rGZcsr_pemrermrrrr rhus z$Client._get_order_and_authorizationscCs|j|\}}}}|jjtjdksM|jjtjdkrZtjd|j||}|jj rtj d|dSt j j |||j||jSdS)aqObtain and enroll certificate. Get a new certificate for the specified domains using the specified authenticator and installer, and then create a new renewable lineage containing it. :param domains: domains to request a certificate for :type domains: `list` of `str` :param certname: requested name of lineage :type certname: `str` or `None` :returns: A new :class:`certbot.storage.RenewableCert` instance referred to the enrolled cert lineage, False if the cert could not be obtained, or None if doing a successful dry run. config_dirwork_dirzdNon-standard path(s), might not work with crontab installed by your operating system package managerz-Dry run: Skipping creating new lineage for %sN)rrrr Z CLI_DEFAULTSrrPrQ_choose_lineagenamerUrgrZ RenewableCertZ new_lineagers)rGrcertnamernror_new_namerrr obtain_and_enroll_certificates    z$Client.obtain_and_enroll_certificatecCs;|r |Stj|dr/|dddS|dSdS)a/Chooses a name for the new lineage. :param domains: domains in certificate request :type domains: `list` of `str` :param certname: requested name of lineage :type certname: `str` or `None` :returns: lineage name that should be used :rtype: str rN)rZis_wildcard_domain)rGrrrrr rs zClient._choose_lineagenamec CsxE|||fD]4}tjtjj|dtj|jjqWt d|\}}z|j |Wd|j Xt j d|t d|\} } t d|\} } t|| t||| || | fS)a Saves the certificate received from the ACME server. :param str cert_pem: :param str chain_pem: :param str cert_path: Candidate path to a certificate. :param str chain_path: Candidate path to a certificate chain. :param str fullchain_path: Candidate path to a full cert chain. :returns: cert_path, chain_path, and fullchain_path as absolute paths to the actual files :rtype: `tuple` of `str` :raises IOError: If unable to find room to write the cert files i cert_pathNz4Server issued certificate; certificate written to %s chain_pathfullchain_path)rZmake_or_verify_dirr$pathdirnamer Z os_geteuidrZstrict_permissions_open_pem_filewritecloserPrQ _save_chain) rGZcert_pem chain_pemrrrrZ cert_fileZ abs_cert_path chain_fileZabs_chain_pathZfullchain_fileZabs_fullchain_pathrrr save_certificates   zClient.save_certificatecCs|jdkr+tjdtjd|dkr=dntjj|}d}tj |j |vx^|D]V}|jj d|dtjj|dtjj|d|d ||jj qrW|jj d WdQRXd }tj |j ||jjWdQRXdS) aInstall certificate :param list domains: list of domains to install the certificate :param str privkey_path: path to certificate private key :param str cert_path: certificate file path (optional) :param str chain_path: chain file path NzANo installer specified, client is unable to deploythe certificatezNo installer availablez!Unable to install the certificateZdomainrZkey_pathrrzDeployed ACME CertificatezuWe were unable to install your certificate, however, we successfully restored your server to its prior configuration.)r.rPrSrrTr$rabspathr ErrorHandler_recovery_routine_with_msgZ deploy_certrY_rollback_and_restartrestart)rGrZ privkey_pathrrrr[domrrr deploy_certificates"  $  zClient.deploy_certificateTc Cs2|jdkr+tjdtjdd}ddd d |fdf}|jj}x|D]\}}} t|j|} ||kr|r|dkr| dkrtj |} | r|j ||| d }qb| rbtjd|qbWd} |r.t j |j | |jjWdQRXdS)a Enhance the configuration. :param list domains: list of domains to configure :param chain_path: chain file path :type chain_path: `str` or `None` :raises .errors.Error: if no installer is specified in the client. NzDNo installer is specified, there isn't any configuration to enhance.zNo installer availableFhstsensure-http-headerStrict-Transport-SecurityredirectZstaplez staple-ocspuirUpgrade-Insecure-RequestsTzKOption %s is not supported by the selected installer. Skipping enhancement.z$We were unable to restart web server)rrr)rrN)rrr)r.rPrSrrTZsupported_enhancementsr9rrZaskapply_enhancementrrrr) rGrrZ ask_redirectZenhancedZenhancement_infoZ supportedZ config_nameZenhancement_nameZoptionZ config_valuer[rrr enhance_configs4       zClient.enhance_configcCsd|}tj|j|x|D]}y|jj|||Wq'tjk r|dkrytjd|ntjd|Yq'tj k rtjd||Yq'Xq'W|jj d|WdQRXdS)aApplies an enhancement on all domains. :param list domains: list of ssl_vhosts (as strings) :param str enhancement: name of enhancement, e.g. ensure-http-header :param str options: options to enhancement, e.g. Strict-Transport-Security .. note:: When more `options` are needed, make options a list. :raises .errors.PluginError: If Enhancement is not supported, or if there is any other problem with the enhancement. zmWe were unable to set up enhancement %s for your server, however, we successfully installed your certificate.zensure-http-headerzEnhancement %s was already set.z#Unable to set enhancement %s for %szAdd enhancement %sN) rrrr.ZenhancerZPluginEnhancementAlreadyPresentrPrSZ PluginErrorrY)rGrZ enhancementZoptionsr[rrrr r;s"         zClient.apply_enhancementcCs9|jjtjjtj}|j||jdS)zCalls the installer's recovery routine and prints success_msg :param str success_msg: message to show on successful recovery N) r.recovery_routinezope component getUtilityr IReporter add_message HIGH_PRIORITY)rG success_msgreporterrrr r^s z!Client._recovery_routine_with_msgc Csxtjdtjjtj}y|jj|jj Wn|j d|j YnX|j ||j dS)zRollback the most recent checkpoint and restart the webserver :param str success_msg: message to show on successful rollback z0Rolling back to previous server configuration...zAn error occurred and we failed to restore your config and restart your server. Please post to https://community.letsencrypt.org/c/server-config with details about your configuration and this error you received.N) rPZcriticalrrrrrr.rollback_checkpointsrrr)rGrrrrr rhs   zClient._rollback_and_restart)rKrLrMrNrHrprrhrrrrrrrrrrrr rcs D  %  * $+# rccCs|jr+tj|j r+tjd|r|jdkrtjjtjj |j }tjj tjj |}t j|j|d}|j rtj|j  rtjd|j r|jrtj|j |jstjddS)aValidate Key and CSR files. Verifies that the client key and csr arguments are valid and correspond to one another. This does not currently check the names in the CSR due to the inability to read SANs from CSRs in python crypto libraries. If csr is left as None, only the key will be validated. :param privkey: Key associated with CSR :type privkey: :class:`certbot.util.Key` :param .util.CSR csr: CSR :raises .errors.Error: when validation fails z#The provided key is not a valid keyZderrsz#The provided CSR is not a valid CSRzThe key and CSR do not matchN)rsrZ valid_privkeyrrTrtOpenSSLZcryptoZload_certificate_requestZ FILETYPE_ASN1riZdump_certificate_requestZ FILETYPE_PEMrr|rrZ valid_csrZcsr_matches_pubkey)ZprivkeyrlZcsr_objZ cert_bufferrrr validate_key_csr~s  rcCsBtj|||dd}|dk r>|j||jdS)zRevert configuration the specified number of checkpoints. :param int checkpoints: Number of checkpoints to revert. :param config: Configuration. :type config: :class:`certbot.interfaces.IConfig` Zquestionz,Which installer should be used for rollback?N)plugin_selectionZpick_installerrr)Zdefault_installerZ checkpointsrZpluginsr.rrr rollbacks   rcCs*tj|}|j|j|dS)zView checkpoints and associated configuration changes. .. note:: This assumes that the installation is using a Reverter object. :param config: Configuration. :type config: :class:`certbot.interfaces.IConfig` N)rZReverterrview_config_changes)rZnumZrevrrr rs  rcCsqtj|r:tj|ddddtjj|fStj|dd}|dtjj|dfSdS)a'Open a pem file. If cli_arg_path was set by the client, open that. Otherwise, uniquify the file path. :param str cli_arg_path: the cli arg name, e.g. cert_path :param str pem_path: the pem file path to open :returns: a tuple of file object and its absolute file path chmodimodewbrN)r Z set_by_clirZ safe_openr$rrZ unique_file)Z cli_arg_pathZpem_pathZuniqrrr rs rc Cs6z|j|Wd|jXtjd|jdS)zSaves chain_pem at a unique path based on chain_path. :param str chain_pem: certificate chain in PEM format :param str chain_file: chain file object NzCert chain written to %s)rrrPrQrI)rrrrr rs r)s\           H /.