/_S@stdZddlmZddlZddlZddlZddlZddlZddlZddl Z ddl Z ddl Z ddl Z ddlZddlmZddlmZddlmZddlmZddlmZdd lmZdd lmZdd lmZdd lmZdd lmZddlmZejeZ ddddddddddddddgZ!dddgZ"d d!d"d#gZ#e$ej%e#e"e!dAZ&d%d&Z'd'd(Z(d)d*Z)d+d,Z*d-d.Z+d/d0Z,d1d2Z-d3d4Z.d5d6Z/d7d8Z0d9d:Z1d;d<Z2d=d>Z3d?d@Z4dS)BzGFunctionality for autorenewal and associated juggling of configurations)print_functionN)List)cli) constants) crypto_util)errors) interfaces)util)hooks)storage)updater)discoZ config_dirZlogs_dirZwork_dirZ user_agentserverZaccount authenticator installerZstandalone_supported_challenges renew_hookpre_hook post_hookZtls_sni_01_addressZhttp01_addressZ rsa_key_sizeZtls_sni_01_port http01_portZ must_stapleZallow_subset_of_names reuse_keyZ autorenew pref_challsc&Csytj||}WnXtjtfk rptjdddtjd|tjdtj dSYnXd|j krtjd|dS|j d}d |krtjd |dSyt ||t ||Wnat tjfk rB}z8tjd |t|tjdtj dSWYdd}~XnXy d d |jD|_Wn?tjk r}ztjd||dSWYdd}~XnX|S)aTry to instantiate a RenewableCert, updating config with relevant items. This is specifically for use in renewal and enforces several checks and policies to ensure that we can try to proceed with the renewal request. The config argument is modified by including relevant options read from the renewal configuration file. :param configuration.NamespaceConfig config: configuration for the current lineage :param str full_path: Absolute path to the configuration file that defines this lineage :returns: the RenewableCert object or None if a fatal error occurred :rtype: `storage.RenewableCert` or NoneType exc_infoTz2Renewal configuration file %s is broken. Skipping.zTraceback was: %sN renewalparamsz`s z!_reconstitute..ztRenewal configuration file %s references a cert that contains an invalid domain name. The problem was: %s. Skipping.)r Z RenewableCertrZCertStorageErrorIOErrorloggerwarningdebug traceback format_exc configuration restore_required_config_elements_restore_plugin_configs ValueErrorErrorstrnamesdomainsZConfigurationError)config full_pathrenewal_candidatererrorrrr _reconstitute2sB         r1cCsvd|kr+tjdsr|d|_nGd|krrtjd|d}t|tjri|g}||_dS)z webroot_map is, uniquely, a dict, and the general-purpose configuration restoring logic is not able to correctly parse it from the serialized form. webroot_map webroot_pathzEAncient renewal conf file without webroot-map, restoring webroot-pathN) r set_by_clir2r r" isinstancesix string_typesr3)r-rZwprrr_restore_webroot_configks     r8cCsg}|ddkr&t||n|j|d|jddk r]|j|dxt|D]}|jdd}xtj|D]y\}}|j|drtj | r|d krt ||t |qtj |}t ||||qWqjWdS) aSets plugin specific values in config from renewalparams :param configuration.NamespaceConfig config: configuration for the current lineage :param configobj.Section renewalparams: Parameters from the renewal configuration file that defines this lineage rZwebrootrN-_NoneTrueFalse)zNonezTruezFalse) r8appendgetsetreplacer6Z iteritems startswithrr4setattrevalZ argparse_type)r-rZplugin_prefixesZ plugin_prefixZ config_itemZ config_valuecastrrrr'|s# r'cCstjdtfftjjttjttjjt tjt tjjt tjt }xS|D]K\}}||krpt j| rp||||}t|||qpWdS)aSets non-plugin specific values in config from renewalparams :param configuration.NamespaceConfig config: configuration for the current lineage :param configobj.Section renewalparams: parameters from the renewal configuration file that defines this lineage rN) itertoolschain_restore_pref_challsr6ZmoveszipBOOL_CONFIG_ITEMSrepeat _restore_boolINT_CONFIG_ITEMS _restore_intSTR_CONFIG_ITEMS _restore_strrr4rC)r-rZrequired_itemsZ item_nameZ restore_funcvaluerrrr&s  !r&cCs.t|tjr|gn|}tj|S)aRestores preferred challenges from a renewal config file. If value is a `str`, it should be a single challenge type. :param str unused_name: option name :param value: option value :type value: `list` of `str` or `str` :returns: converted option value to be stored in the runtime config :rtype: `list` of `str` :raises errors.Error: if value can't be converted to an bool )r5r6r7rZparse_preferred_challenges)Z unused_namerQrrrrHs!rHcCs=|j}|dkr3tjdj|||dkS)a%Restores an boolean key-value pair from a renewal config file. :param str name: option name :param str value: option value :returns: converted option value to be stored in the runtime config :rtype: bool :raises errors.Error: if value can't be converted to an bool truefalsez,Expected True or False for {0} but found {1})ztruezfalse)lowerrr)format)namerQZlowercase_valuerrrrLs  rLc Csq|dkr2|dkr2tjdtjdSyt|SWn*tk rltjdj|YnXdS)a#Restores an integer key-value pair from a renewal config file. :param str name: option name :param str value: option value :returns: converted option value to be stored in the runtime config :rtype: int :raises errors.Error: if value can't be converted to an int rr;z!updating legacy http01_port valuez Expected a numeric value for {0}N) r infor flag_defaultintr(rr)rU)rVrQrrrrNs    rNcCsT|dkr@|tjkr@tjdtjd|tjdS|dkrPdS|S)zRestores an string key-value pair from a renewal config file. :param str name: option name :param str value: option value :returns: converted option value to be stored in the runtime config :rtype: str or None rz$Using server %s instead of legacy %sr;N)rZV1_URIr rWZ CLI_DEFAULTS)rVrQrrrrPs   rPcCsb|jrtjddS|jr7tjddS|jrQtjddStjddS)zDReturn true if any of the circumstances for automatic renewal apply.z+Auto-renewal forced with --force-renewal...Tz)Cert is due for renewal, auto-renewing...zRszreport..z z )rb)Zmsgsrmlinesr)rmrreportPsrpcsg}|jtjjtj}fdd}|jrSddd|rdt|d| r| rd|jdk s|j dk s|j dk rvd n|r| rd t|d nw|r,| r,|d |t|d nJ|rv|rvdt|d d|d|t|d |rdt|d|jrdd|j dj |dddS)Ncs!t|tj|dS)zNotify and log errors.N)r*r r0)err)notifyrr notify_error\sz-_renew_describe_results..notify_errorz;** DRY RUN: simulating 'certbot renew' close to cert expiryz>** (The test certificates below have not been saved.)rz0The following certs are not due for renewal yet:ZskippedzNo renewals were attempted.zNo hooks were run.zOCongratulations, all renewals succeeded. The following certs have been renewed:ZsuccesszFAll renewal attempts failed. The following certs could not be renewed:Zfailurez.The following certs were successfully renewed: z)The following certs could not be renewed:zB Additionally, the following renewal configurations were invalid: Z parsefailz>** (The test certificates above have not been saved.)ZwrapF) r>zope component getUtilityrIDisplayrZrprrr notificationrb)r-renew_successesrenew_failures renew_skippedparse_failuresoutdisprsr)rrr_renew_describe_resultsUsD                   rc sHtfddjDr1tjdjrUtjjg}ntj}g}g}g}g}tj j oj }xS|D]K}t j jtj}|jd|ddtj} tj|} yt| |} Wnatk rb} zAtjd|| | tjdtj|j|wWYd d } ~ XnXy | d kr|j|nt j j| | jd d lm } t!j"j#}t$| | r+|rt%j&d d}tj'd|t(j)|d}| j*| || |j| j+nDt,j-| j.d| j/}|jd| j+|j0dft1j2| | |Wqtk r} zAtjd| || tjdtj|j| j+WYd d } ~ XqXqWt3|||||s |r7tjdj4t5|t5|n tjdd S)z5Examine each lineage; renew if due and report resultsc3s|]}|jkVqdS)N)r2)rZdomain)r-rrrnsz)handle_renewal_request..afCurrently, the renew verb is capable of either renewing all installed certificates that are due to be renewed or renewing a single certificate specified by its name. If you would like to renew specific certificates by their domains, use the certonly command instead. The renew verb may provide other options for selecting certificates to renew in the future.z Processing pauseFzTRenewal configuration file %s (cert: %s) produced an unexpected error: %s. Skipping.zTraceback was: %sNr)main<z3Non-interactive renewal: random delay of %s secondsr^z%s expires on %sz%Y-%m-%dzQAttempting to renew cert (%s) from %s produced an unexpected error: %s. Skipping.z*{0} renew failure(s), {1} parse failure(s)zno renewal failuresi)6anyr,rr)Zcertnamer Zrenewal_file_for_certnameZrenewal_conf_filessysstdinisattyZrandom_sleep_on_renewrurvrwrrxrycopydeepcopyZlineagename_for_filenamer1 Exceptionr r!r"r#r$r>ZprovideUtilityZensure_deployedcertbotr plugins_discoZPluginsRegistryZfind_allr\randomZrandintrWtimeZsleeprkZ fullchainrZnotAfterversionrjZstrftimer Zrun_generic_updatersrrUlen)r-Z conf_filesrzr{r|r}Zapply_random_sleepZ renewal_filerZlineage_configZ lineagenamer/erZpluginsZ sleep_timeZexpiryr)r-rhandle_renewal_requestsr"              '    r)z pref_challs)5__doc__Z __future__rrrFZloggingrfr#rrrr6Zzope.componentrur`Zacme.magic_typingrrrrrrrr r r r Zcertbot.pluginsr rZ getLogger__name__r rOrMrJr@rGZ CONFIG_ITEMSr1r8r'r&rHrLrNrPr\rerkrprrrrrrs`                   9  +          2