U
    ÝÁ]Q0  ã                   @   sT  d Z ddlZddlZddlZddlZddlZddlZddlZddl	Zddl
mZ ddlmZmZmZmZ ddlmZ ddlmZ ddlmZ ddlmZ dd	lmZ dd
lmZ ddlmZ ddlmZ ddlmZ ddlmZ ddlm Z  e !e"¡Z#ej$ %ej&¡ej$ 'ej(¡G dd„ dej)ƒƒƒZ*G dd„ dej+ƒZ,G dd„ dej+ƒZ-dd„ Z.dS )zWebroot plugin.é    N)Ú
challenges)ÚDictÚSetÚDefaultDictÚList)Úachallenges)Úcli)Úerrors)Ú
interfaces)Úos)Ú
filesystem)Úops)Úutil)Úcommon)Ú	safe_openc                       s–   e Zd ZdZdZdZdd„ Zedd„ ƒZdd	„ Z	‡ fd
d„Z
dd„ Zdd„ Zdd„ Zdd„ Zdd„ Zd!dd„Zdd„ Zdd„ Zdd„ Zdd „ Z‡  ZS )"ÚAuthenticatorzWebroot Authenticator.z Place files in webroot directoryzôAuthenticator plugin that performs http-01 challenge by saving
necessary validation resources to appropriate paths on the file
system. It expects that there is some other HTTP server configured
to serve all files under specified web root ({0}).c                 C   s   | j  |  d¡¡S )NÚpath)Ú	MORE_INFOÚformatÚconf©Úself© r   ú9/usr/lib/python3/dist-packages/certbot/plugins/webroot.pyÚ	more_info-   s    zAuthenticator.more_infoc                 C   s&   |ddg t dd |di tdd d S )Nr   z-wa  public_html / webroot path. This can be specified multiple times to handle different domains; each domain will have the webroot path that preceded it.  For instance: `-w /var/www/example -d example.com -d www.example.com -w /var/www/thing -d thing.net -d m.thing.net` (default: Ask))ÚdefaultÚactionÚhelpÚmapa—  JSON dictionary mapping domains to webroot paths; this implies -d for each entry. You may need to escape this from your shell. E.g.: --webroot-map '{"eg1.is,m.eg1.is":"/www/eg1/", "eg2.is":"/www/eg2"}' This option is merged with, but takes precedence over, -w / -d entries. At present, if you put webroot-map in a config file, it needs to be on a single line, like: webroot-map = {"example.com":"/var/www"}.)Ú_WebrootPathActionÚ_WebrootMapAction)ÚclsÚaddr   r   r   Úadd_parser_arguments0   s    
ÿÿz"Authenticator.add_parser_argumentsc                 C   s   t jgS ©N)r   ÚHTTP01)r   Údomainr   r   r   Úget_chall_prefB   s    zAuthenticator.get_chall_prefc                    s.   t t| ƒj||Ž i | _t t¡| _g | _d S r$   )	Úsuperr   Ú__init__Ú
full_rootsÚcollectionsÚdefaultdictÚsetÚ	performedÚ_created_dirs©r   ÚargsÚkwargs©Ú	__class__r   r   r)   F   s    zAuthenticator.__init__c                 C   s   d S r$   r   r   r   r   r   ÚprepareN   s    zAuthenticator.preparec                    s$   ˆ   |¡ ˆ  ¡  ‡ fdd„|D ƒS )Nc                    s   g | ]}ˆ   |¡‘qS r   )Ú_perform_single)Ú.0Úachallr   r   r   Ú
<listcomp>V   s     z)Authenticator.perform.<locals>.<listcomp>)Ú_set_webrootsÚ_create_challenge_dirs)r   Úachallsr   r   r   ÚperformQ   s    
zAuthenticator.performc              	   C   sÈ   |   d¡rD|   d¡d }t d|¡ |D ]}|   d¡ |j|¡ q(n€ttt |   d¡¡ƒƒ}|D ]b}|j|   d¡kr`|  	|j|¡}z| 
|¡ W n tk
r¤   Y nX | d|¡ ||   d¡|j< q`d S )Nr   éÿÿÿÿz4Using the webroot path %s for all unmatched domains.r   r   )r   ÚloggerÚinfoÚ
setdefaultr&   Úlistr-   ÚsixZ
itervaluesÚ_prompt_for_webrootÚremoveÚ
ValueErrorÚinsert)r   r<   Úwebroot_pathr8   Úknown_webrootsZnew_webrootr   r   r   r:   X   s&    
ÿÿzAuthenticator._set_webrootsc                 C   sB   d }|d kr>|r0|   ||¡}|d kr<|  |¡}q|  |d¡}q|S )NT)Ú_prompt_with_webroot_listÚ_prompt_for_new_webroot)r   r&   rI   Úwebrootr   r   r   rD   n   s    z!Authenticator._prompt_for_webrootc                 C   sr   t j tj¡}d|  d¡ }|jd |¡dg| |dd\}}|tj	krTt
 d¡‚q|dkr`d S ||d	  S qd S )
Nz--r   zSelect the webroot for {0}:zEnter a new webrootT)Zcli_flagÚforce_interactiveúIEvery requested domain must have a webroot when using the webroot plugin.r   é   )ÚzopeZ	componentZ
getUtilityr
   ZIDisplayZoption_nameZmenur   Údisplay_utilÚCANCELr	   ÚPluginError)r   r&   rI   ZdisplayZ	path_flagÚcodeÚindexr   r   r   rJ   }   s     ý

ÿz'Authenticator._prompt_with_webroot_listFc                 C   sD   t jtd |¡dd\}}|tjkr8|s,d S t d¡‚nt|ƒS d S )NzInput the webroot for {0}:T)rM   rN   )r   Zvalidated_directoryÚ_validate_webrootr   rQ   rR   r	   rS   )r   r&   Z
allowraiserT   rL   r   r   r   rK      s    ý

ÿz%Authenticator._prompt_for_new_webrootc                 C   sZ  |   d¡}|st d¡‚| ¡ D ]2\}}tj |tjj	¡| j
|< t d| j
| ¡ t d¡}zètt | j
| ¡d d… tdD ]Â}zrt |d¡ | j |¡ ztj||dddd	 W n< ttfk
rò } zt d
¡ t d|¡ W 5 d }~X Y nX W q€ tk
r@ } z*|jtjtjfkr0t d ||¡¡‚W 5 d }~X Y q€X q€W 5 t |¡ X q d S )Nr   zMissing parts of webroot configuration; please set either --webroot-path and --domains, or --webroot-map. Run with  --help webroot for examples.z-Creating root challenges validation dir at %sé   r>   )Úkeyií  T)Z	copy_userZ
copy_groupz3Unable to change owner and uid of webroot directoryúError was: %sz=Couldn't create root for {0} http-01 challenge responses: {1})r   r	   rS   Úitemsr   r   Újoinr   r%   ZURI_ROOT_PATHr*   r?   ÚdebugÚumaskÚsortedr   Zget_prefixesÚlenr   Úmkdirr/   ÚappendZcopy_ownership_and_apply_modeÚOSErrorÚAttributeErrorr@   ÚerrnoZEEXISTZEISDIRr   )r   Zpath_mapÚnamer   Ú	old_umaskÚprefixZ	exceptionr   r   r   r;   œ   sH    
ÿÿ
$    ÿ

" ÿÿz$Authenticator._create_challenge_dirsc                 C   s   t j ||j d¡¡S )NÚtoken)r   r   r[   ZchallÚencode)r   Ú	root_pathr8   r   r   r   Ú_get_validation_pathÅ   s    z"Authenticator._get_validation_pathc              	   C   sˆ   |  ¡ \}}| j|j }|  ||¡}t d|¡ t d¡}z,t|ddd}| 	| 
¡ ¡ W 5 Q R X W 5 t |¡ X | j|  |¡ |S )Nz#Attempting to save validation to %srW   Úwbi¤  )ÚmodeÚchmod)Zresponse_and_validationr*   r&   rk   r?   r\   r   r]   r   Úwriteri   r.   r"   )r   r8   ZresponseZ
validationrj   Úvalidation_pathrf   Zvalidation_filer   r   r   r6   È   s    
zAuthenticator._perform_singlec              
   C   sÔ   |D ]N}| j  |jd ¡}|d k	r|  ||¡}t d|¡ t |¡ | j|  |¡ qg }| j	rÀ| j	 
¡ }zt |¡ W qX tk
r¼ } z(| d|¡ t d|¡ t d|¡ W 5 d }~X Y qXX qX|| _	t d¡ d S )NzRemoving %sr   z3Challenge directory %s was not empty, didn't removerY   zAll challenges cleaned up)r*   Úgetr&   rk   r?   r\   r   rE   r.   r/   ÚpopÚrmdirrb   rG   r@   )r   r<   r8   rj   rp   Znot_removedr   Úexcr   r   r   ÚcleanupÛ   s$    

 zAuthenticator.cleanup)F)Ú__name__Ú
__module__Ú__qualname__Ú__doc__Zdescriptionr   r   Úclassmethodr#   r'   r)   r5   r=   r:   rD   rJ   rK   r;   rk   r6   ru   Ú__classcell__r   r   r3   r   r       s$   

)r   c                   @   s   e Zd ZdZddd„ZdS )r    z%Action class for parsing webroot_map.Nc                    sH   t  t |¡¡D ]2\}‰ tˆ ƒ‰ |j ‡ fdd„t ||¡D ƒ¡ qd S )Nc                 3   s   | ]}|ˆ fV  qd S r$   r   )r7   Úd©rH   r   r   Ú	<genexpr>÷   s    z-_WebrootMapAction.__call__.<locals>.<genexpr>)	rC   Z	iteritemsÚjsonÚloadsrV   Úwebroot_mapÚupdater   Zadd_domains)r   ÚparserÚ	namespacer   Úoption_stringÚdomainsr   r}   r   Ú__call__ô   s
    
ÿz_WebrootMapAction.__call__)N)rv   rw   rx   ry   r‡   r   r   r   r   r    ñ   s   r    c                       s*   e Zd ZdZ‡ fdd„Zddd„Z‡  ZS )r   z&Action class for parsing webroot_path.c                    s   t t| ƒj||Ž d| _d S )NF)r(   r   r)   Ú_domain_before_webrootr0   r3   r   r   r)   þ   s    z_WebrootPathAction.__init__Nc                 C   s\   | j rt d¡‚|jr<|jd }|jD ]}|j ||¡ q&n|jrHd| _ |j t|ƒ¡ d S )NzPIf you specify multiple webroot paths, one of them must precede all domain flagsr>   T)	rˆ   r	   rS   rH   r†   r   rA   ra   rV   )r   rƒ   r„   rH   r…   Zprev_webrootr&   r   r   r   r‡     s    ÿ

z_WebrootPathAction.__call__)N)rv   rw   rx   ry   r)   r‡   r{   r   r   r3   r   r   û   s   r   c                 C   s&   t j | ¡st | d ¡‚t j | ¡S )z·Validates and returns the absolute path of webroot_path.

    :param str webroot_path: path to the webroot directory

    :returns: absolute path of webroot_path
    :rtype: str

    z% does not exist or is not a directory)r   r   Úisdirr	   rS   Úabspathr}   r   r   r   rV     s    	rV   )/ry   Úargparser+   rd   r   ZloggingrC   Zzope.componentrP   Zzope.interfaceZacmer   Zacme.magic_typingr   r   r   r   Zcertbotr   r   r	   r
   Zcertbot.compatr   r   Zcertbot.displayr   r   rQ   Zcertbot.pluginsr   Zcertbot.utilr   Z	getLoggerrv   r?   Z	interfaceZimplementerZIAuthenticatorZproviderZIPluginFactoryZPluginr   ZActionr    r   rV   r   r   r   r   Ú<module>   s:   
 P
