U eà–_ŒSã @s²dZddlmZddlZddlZddlZddlZddlZddlZddl Z ddl Z ddl Z ddl Z ddlmZddlmZddlmZddlmZddlmZdd lmZdd lmZdd lmZdd lmZdd lmZddlmZddlmZe e ¡Z!ddddddddddddg Z"ddgZ#ddd d!gZ$e%e &e$e#e"d"¡ƒZ'd#d$„Z(d%d&„Z)d'd(„Z*d)d*„Z+d+d,„Z,d-d.„Z-d/d0„Z.d1d2„Z/d3d4„Z0d5d6„Z1d7d8„Z2d9d:„Z3d;d<„Z4d=d>„Z5dS)?zGFunctionality for autorenewal and associated juggling of configurationsé)Úprint_functionN)ÚList)Úcli)Ú constants)Ú crypto_util)Úerrors)Úhooks)Ú interfaces)Ústorage)Úupdater)Úutil)Úos)ÚdiscoZ config_dirZlogs_dirZwork_dirZ user_agentÚserverZaccountÚ authenticatorÚ installerÚ renew_hookÚpre_hookÚ post_hookZhttp01_addressZ rsa_key_sizeÚ http01_portZ must_stapleZallow_subset_of_namesÚ reuse_keyZ autorenew)Ú pref_challsc CsXzt ||¡}WnFtjtfk rVtjdddt d|¡t dt  ¡¡YdSXd|j krrt d|¡dS|j d}d |kr”t d |¡dSzt ||ƒt ||ƒWnRt tjfk rþ}z,t d |t|ƒ¡t dt  ¡¡WY¢dSd}~XYnXzd d „| ¡Dƒ|_Wn:tjk rR}zt d||¡WY¢dSd}~XYnX|S)a•Try to instantiate a RenewableCert, updating config with relevant items. This is specifically for use in renewal and enforces several checks and policies to ensure that we can try to proceed with the renewal request. The config argument is modified by including relevant options read from the renewal configuration file. :param configuration.NamespaceConfig config: configuration for the current lineage :param str full_path: Absolute path to the configuration file that defines this lineage :returns: the RenewableCert object or None if a fatal error occurred :rtype: `storage.RenewableCert` or NoneType ÚT)Úexc_infoz2Renewal configuration file %s is broken. Skipping.úTraceback was: %sNÚ renewalparamsz]sÿz!_reconstitute..ztRenewal configuration file %s references a cert that contains an invalid domain name. The problem was: %s. Skipping.)r Z RenewableCertrZCertStorageErrorÚIOErrorÚloggerÚwarningÚdebugÚ tracebackÚ format_excÚ configurationÚ restore_required_config_elementsÚ_restore_plugin_configsÚ ValueErrorÚErrorÚstrÚnamesÚdomainsZConfigurationError)ÚconfigÚ full_pathÚrenewal_candidaterÚerrorrrrÚ _reconstitute/sP  ÿ ÿ þÿ þr3cCsRd|krt d¡s|d|_d|krNt d¡sN|d}t|tjƒrH|g}||_dS)z¥ webroot_map is, uniquely, a dict, and the general-purpose configuration restoring logic is not able to correctly parse it from the serialized form. Ú webroot_mapÚ webroot_pathN)rÚ set_by_clir4Ú isinstanceÚsixÚ string_typesr5)r/rZwprrrÚ_restore_webroot_confighs  r:cCsÄg}|ddkrt||ƒn| |d¡| d¡dk rF| |d¡t|ƒD]p}| dd¡}t |¡D]T\}}| |d¡rht  |¡sh|dkr¢t ||t |ƒƒqht  |¡}t ||||ƒƒqhqNdS)aSets plugin specific values in config from renewalparams :param configuration.NamespaceConfig config: configuration for the current lineage :param configobj.Section renewalparams: Parameters from the renewal configuration file that defines this lineage rZwebrootrNú-Ú_)ÚNoneÚTrueÚFalse) r:ÚappendÚgetÚsetÚreplacer8Z iteritemsÚ startswithrr6ÚsetattrÚevalZ argparse_type)r/rZplugin_prefixesZ plugin_prefixZ config_itemZ config_valueÚcastrrrr)ys     r)c Cs„t dtfftj tt t¡¡tj t t t ¡¡tj t t t ¡¡¡}|D]4\}}||krJt  |¡sJ||||ƒ}t|||ƒqJdS)aSets non-plugin specific values in config from renewalparams :param configuration.NamespaceConfig config: configuration for the current lineage :param configobj.Section renewalparams: parameters from the renewal configuration file that defines this lineage rN)Ú itertoolsÚchainÚ_restore_pref_challsr8ZmovesÚzipÚBOOL_CONFIG_ITEMSÚrepeatÚ _restore_boolÚINT_CONFIG_ITEMSÚ _restore_intÚSTR_CONFIG_ITEMSÚ _restore_strrr6rE)r/rZrequired_itemsZ item_nameZ restore_funcÚvaluerrrr(¤s ü r(cCs t|tjƒr|gn|}t |¡S)a˜Restores preferred challenges from a renewal config file. If value is a `str`, it should be a single challenge type. :param str unused_name: option name :param value: option value :type value: `list` of `str` or `str` :returns: converted option value to be stored in the runtime config :rtype: `list` of `str` :raises errors.Error: if value can't be converted to an bool )r7r8r9rZparse_preferred_challenges)Z unused_namerSrrrrJ¹srJcCs*| ¡}|dkr"t d ||¡¡‚|dkS)a%Restores an boolean key-value pair from a renewal config file. :param str name: option name :param str value: option value :returns: converted option value to be stored in the runtime config :rtype: bool :raises errors.Error: if value can't be converted to an bool )ÚtrueZfalsez,Expected True or False for {0} but found {1}rT)Úlowerrr+Úformat)ÚnamerSZlowercase_valuerrrrNÏs  ÿrNcCsX|dkr$|dkr$t d¡t d¡Sz t|ƒWStk rRt d |¡¡‚YnXdS)a#Restores an integer key-value pair from a renewal config file. :param str name: option name :param str value: option value :returns: converted option value to be stored in the runtime config :rtype: int :raises errors.Error: if value can't be converted to an int rr=z!updating legacy http01_port valuez Expected a numeric value for {0}N) r"ÚinforÚ flag_defaultÚintr*rr+rV©rWrSrrrrPâs    rPcCs@|dkr0|tjkr0t dtjd|¡tjdS|dkrt d¡dSt d¡dS)zDReturn true if any of the circumstances for automatic renewal apply.z+Auto-renewal forced with --force-renewal...Tz)Cert is due for renewal, auto-renewing...zOszreport..z z )rd)ZmsgsroÚlinesrrnrÚreportMsrrcs\g}|j‰tj tj¡}‡fdd„}|jr:ˆdƒˆdƒˆdƒ|r\ˆdƒˆt|dƒƒ|s”|s”ˆdƒ|jdk sŠ|j dk sŠ|j dk r’ˆd ƒn||r´|s´ˆd ƒˆt|d ƒƒn\|rÔ|sÔ|d ƒ|t|d ƒƒn<|r|rˆdƒˆt|d ƒdƒ|dƒ|t|d ƒƒ|r,ˆdƒˆt|dƒƒ|jrDˆdƒˆdƒ|j d  |¡dddS)Ncsˆt|ƒƒt |¡dS)zNotify and log errors.N)r,r"r2)Úerr©ZnotifyrrÚ notify_errorYs z-_renew_describe_results..notify_errorz;** DRY RUN: simulating 'certbot renew' close to cert expiryz>** (The test certificates below have not been saved.)rz0The following certs are not due for renewal yet:ZskippedzNo renewals were attempted.zNo hooks were run.zOCongratulations, all renewals succeeded. The following certs have been renewed:ZsuccesszFAll renewal attempts failed. The following certs could not be renewed:Zfailurez.The following certs were successfully renewed:Ú z)The following certs could not be renewed:zB Additionally, the following renewal configurations were invalid: Z parsefailz>** (The test certificates above have not been saved.)F)Zwrap) r@ÚzopeÚ componentÚ getUtilityr ÚIDisplayr\rrrrrÚ notificationrd)r/Úrenew_successesÚrenew_failuresÚ renew_skippedÚparse_failuresÚoutÚdisprurrtrÚ_renew_describe_resultsRsJ  ÿÿ  r‚c szt‡fdd„ˆjDƒƒr"t d¡‚ˆjr:t ˆˆj¡g}n t ˆ¡}g}g}g}g}tj   ¡ odˆj }|D]Æ}t j  tj¡}|jd|ddt ˆ¡} t |¡} zt| |ƒ} WnVtk r} z6t d|| | ¡t dt ¡¡| |¡WY¢qjW5d } ~ XYnXzÖ| d kr"| |¡n¼t j  | ¡|  ¡d d lm } t!j" #¡}t$| | ƒr |r„t% &d d ¡}t 'd|¡t( )|¡d}|  *| || ¡| | j+¡n0t, -|  .d|  /¡¡¡}| d| j+| 0d¡f¡t1 2| | |¡Wqjtk r0} z0t d| || ¡t dt ¡¡| | j+¡W5d } ~ XYqjXqjt3ˆ||||ƒ|sP|rlt d 4t5|ƒt5|ƒ¡¡‚n t d¡d S)z5Examine each lineage; renew if due and report resultsc3s|]}|ˆjkVqdS)N)r4)rZdomain©r/rrrpˆsz)handle_renewal_request..afCurrently, the renew verb is capable of either renewing all installed certificates that are due to be renewed or renewing a single certificate specified by its name. If you would like to renew specific certificates by their domains, use the certonly command instead. The renew verb may provide other options for selecting certificates to renew in the future.z Processing F)ÚpausezTRenewal configuration file %s (cert: %s) produced an unexpected error: %s. Skipping.rNr)Úmainéiàz3Non-interactive renewal: random delay of %s secondsr`z%s expires on %sz%Y-%m-%dzQAttempting to renew cert (%s) from %s produced an unexpected error: %s. Skipping.z*{0} renew failure(s), {1} parse failure(s)zno renewal failures)6Úanyr.rr+Zcertnamer Zrenewal_file_for_certnameZrenewal_conf_filesÚsysÚstdinÚisattyZrandom_sleep_on_renewrwrxryr rzr{ÚcopyÚdeepcopyZlineagename_for_filenamer3Ú Exceptionr"r#r$r%r&r@ZprovideUtilityZensure_deployedÚcertbotr…Ú plugins_discoZPluginsRegistryZfind_allr^ÚrandomZuniformrXÚtimeÚsleeprlZ fullchainrZnotAfterÚversionrkÚstrftimer Zrun_generic_updatersr‚rVÚlen)r/Z conf_filesr|r}r~rZapply_random_sleepZ renewal_filerZlineage_configZ lineagenamer1Úer…ZpluginsZ sleep_timeZexpiryrrƒrÚhandle_renewal_request„sŽ     þ        ÿ ÿ ÿÿþ ÿ ÿr—)6Ú__doc__Z __future__rr‹rHZloggingrrˆr‘r%rbr8Zzope.componentrwZacme.magic_typingrrŽrrrrrr r r r Zcertbot.compatr Zcertbot.pluginsrrZ getLoggerÚ__name__r"rQrOrLrBrIZ CONFIG_ITEMSr3r:r)r(rJrNrPrRr^rgrlrrr‚r—rrrrÚst              þÿÿ9+2