3
گab> @ s d Z ddlZddlZddlZddlZddlmZ ddlmZ ddlmZ ddlm Z ddlm
Z
ddlm Z dd lm Z dd
lm
Z
dd lmZ dd lmZ dd
lmZ ddlmZ ddlmZ ddlmZ ddlmZ ddlmZ ddlmZ ddl m Z ddl m Z ddl m Z ddl m!Z" ddl#m$Z$ ddl#m!Z! ddl%m&Z& ej'e(Z)dZ*dd gZ+G d d d e$j,ej-Z-G d d d ej.Z/G d!d" d"ej.Z0e1e1d#d$d%Z2dS )&zWebroot plugin. N)Any)Callable) DefaultDict)Dict)Iterable)List)Optional)Sequence)Set)Type)Union)
challenges) crypto_util)errors)
interfaces)cli)"KeyAuthorizationAnnotatedChallenge)
filesystem)os)ops)util)common) safe_opena!
Z@20c5ca1bd58fa8ad5f07a2f1be8b7cbb707c20fcb607a8fc8db9393952846a97Z@8d31383d3a079d2098a9d0c0921f4ab87e708b9868dc3f314d54094c2fe70336c sT e Zd ZdZdZdZedddZee d/ dd d
d Z
e e ed d
dZ
ee eej dddZeedd fdd ZddddZe e eej dddZe e ddddZeee ee d d d Zeee ee d d d Zd0ee ee d"d#d$Z ddd%d&Z ee ed'd(d)Z e ejd*d+d,Z e e ddd-d.Z! Z"S )1
AuthenticatorzWebroot Authenticator.z Place files in webroot directoryzAuthenticator plugin that performs http-01 challenge by saving
necessary validation resources to appropriate paths on the file
system. It expects that there is some other HTTP server configured
to serve all files under specified web root ({0}).)returnc C s | j j| jdS )Npath) MORE_INFOformatconf)self r /usr/lib/python3.6/webroot.py more_infoC s zAuthenticator.more_info.N)addr c C s& |ddg t dd |di tdd d S )Nr z-wa public_html / webroot path. This can be specified multiple times to handle different domains; each domain will have the webroot path that preceded it. For instance: `-w /var/www/example -d example.com -d www.example.com -w /var/www/thing -d thing.net -d m.thing.net` (default: Ask))defaultactionhelpmapa JSON dictionary mapping domains to webroot paths; this implies -d for each entry. You may need to escape this from your shell. E.g.: --webroot-map '{"eg1.is,m.eg1.is":"/www/eg1/", "eg2.is":"/www/eg2"}' This option is merged with, but takes precedence over, -w / -d entries. At present, if you put webroot-map in a config file, it needs to be on a single line, like: webroot-map = {"example.com":"/var/www"}.)_WebrootPathAction_WebrootMapAction)clsr# r r r! add_parser_argumentsF s
z"Authenticator.add_parser_arguments)failed_achallsr c C s dS )NzThe Certificate Authority failed to download the temporary challenge files created by Certbot. Ensure that the listed domains serve their content from the provided --webroot-path/-w and that files created there can be downloaded from the internet.r )r r, r r r! auth_hintX s zAuthenticator.auth_hint)domainr c C s t jgS )N)r
HTTP01)r r. r r r! get_chall_pref^ s z Authenticator.get_chall_pref)argskwargsr c s* t j|| i | _tjt| _g | _d S )N)super__init__
full_roots collections defaultdictset performed
_created_dirs)r r1 r2 ) __class__r r! r4 b s zAuthenticator.__init__c C s d S )Nr )r r r r! preparei s zAuthenticator.prepare)achallsr c s$ j | j fdd|D S )Nc s g | ]} j |qS r )_perform_single).0achall)r r r!
q s z)Authenticator.perform..)
_set_webroots_create_challenge_dirs)r r= r )r r! performl s
zAuthenticator.performc C s | j drH| j dd }tjd| x|D ]}| j dj|j| q*W ntt| j dj }xj|D ]b}|j| j dkrd| j|j|}y|j | W n t
k
r Y nX |j d| || j d|j< qdW d S )Nr z4Using the webroot path %s for all unmatched domains.r' r ) r loggerinfo
setdefaultr. listr8 values_prompt_for_webrootremove
ValueErrorinsert)r r= webroot_pathr@ known_webrootsZ new_webrootr r r! rB s s"
zAuthenticator._set_webroots)r. rQ r c C sF d }x<|d kr@|r2| j ||}|d kr>| j|}q| j|d}qW |S )NT)_prompt_with_webroot_list_prompt_for_new_webroot)r r. rQ webrootr r r! rL s
z!Authenticator._prompt_for_webrootc C sb d| j d }xNtjdj|dg| |dd\}}|tjkrFtjd|dkrRd S ||d S d S )
Nz--r zSelect the webroot for {0}:zEnter a new webrootT)Zcli_flagforce_interactivezIEvery requested domain must have a webroot when using the webroot plugin.r rE )Z option_name display_utilZmenur CANCELr PluginError)r r. rQ Z path_flagcodeindexr r r! rR s
z'Authenticator._prompt_with_webroot_listF)r.
allowraiser c C s> t jtdj|dd\}}|tjkr6|s,d S tjdt|S )NzInput the webroot for {0}:T)rU zIEvery requested domain must have a webroot when using the webroot plugin.)r Zvalidated_directory_validate_webrootr rV rW r rX )r r. r[ rY rT r r r! rS s
z%Authenticator._prompt_for_new_webrootc C s | j d}|stjdx|j D ]\}}tjj|tjjtj j
| j |< t j
d| j | tjd}zxttj| j | d d tdD ]}tjj|rqyttj|d | jj| ytj||dddd W n> ttfk
r } z t jd
t j
d | W Y d d }~X nX W q tk
rJ } ztjd j ||W Y d d }~X qX qW W d tj| X tj s$tjj| j | d
}tjj |rt j d| j | q$t j d| j | t |ddd}|j!t" W d Q R X q$W d S )Nr' zMissing parts of webroot configuration; please set either --webroot-path and --domains, or --webroot-map. Run with --help webroot for examples.z-Creating root challenges validation dir at %s rE )keyi T)Z copy_userZ
copy_groupz3Unable to change owner and uid of webroot directoryz
Error was: %sz=Couldn't create root for {0} http-01 challenge responses: {1}z
web.configzPA web.config file has not been created in %s because another one already exists.zGCreating a web.config file in %s to allow IIS to serve challenge files.wi )modechmodrF )#r r rX itemsr r joinnormcaser
r/ Z
URI_ROOT_PATHr5 rG debugr umasksortedr Z get_prefixeslenisdirmkdirr: appendZ copy_ownership_and_apply_modeOSErrorAttributeErrorZwarningr
POSIX_MODEexistsrH r write_WEB_CONFIG_CONTENT) r Zpath_mapnamer old_umaskprefixZ exceptionweb_config_pathZ
web_configr r r! rC sL
&
"$ z$Authenticator._create_challenge_dirs) root_pathr@ r c C s t jj||jjdS )Ntoken)r r rc Zchallencode)r rv r@ r r r! _get_validation_path s z"Authenticator._get_validation_path)r@ r c C s |j \}}| j|j }| j||}tjd| tjd}z,t|ddd}|j |j
W d Q R X W d tj| X | j | j | |S )Nz#Attempting to save validation to %sr] wbi )r` ra )
Zresponse_and_validationr5 r. ry rG re r rf r rp rx r9 r# )r r@ ZresponseZ
validationrv validation_pathrs Zvalidation_filer r r! r> s
z Authenticator._perform_singlec
C s6 x|D ]}| j j|jd }|d k r| j||}tjd| tj| | j| j| t j
stj j |d}tj j
|rtj|}|tkrtjd| tj| qtjd| qW g }xn| jr | jj }ytj| W q tk
r } z*|jd| tjd| tjd| W Y d d } ~ X qX qW || _tjd d S ) Nz Removing %sz
web.configz4Cleaning web.config file generated by Certbot in %s.zQNot cleaning up the web.config file in %s because it is not generated by Certbot.r z3Challenge directory %s was not empty, didn't removez
Error was: %szAll challenges cleaned up)r5 getr. ry rG re r rM r9 r rn r rc ro r sha256sum_WEB_CONFIG_SHA256SUMSrH r: poprmdirrl rO )
r r= r@ rv r{ ru r} Z not_removedr excr r r! cleanup s8
"zAuthenticator.cleanup).N)F)#__name__
__module__ __qualname____doc__ descriptionr strr" classmethodr r+ r AnnotatedChallenger- r r
Z Challenger0 r r4 r< r ZChallengeResponserD rB r rL rR boolrS rC ry r> r
__classcell__r r )r; r! r 8 s(
:r c @ s> e Zd ZdZdejejeee e
df e e ddddZ dS )r) z%Action class for parsing webroot_map.N)parser namespace webroot_map
option_stringr c sZ |d kr d S xHt jt|j D ]2\} t |jj fddtj||D q W d S )Nc 3 s | ]}| fV qd S )Nr )r? d)rP r r! 1 s z-_WebrootMapAction.__call__..) jsonloadsr rb r\ r updater Z add_domains)r r r r r domainsr )rP r! __call__) s z_WebrootMapAction.__call__)N)
r r r r argparseArgumentParser Namespacer r r r r r r r r r! r) & s r) c sX e Zd ZdZeedd fdd Zd ejeje e
e e df e e
ddddZ
ZS )
r( z&Action class for parsing webroot_path.N)r1 r2 r c s t j|| d| _d S )NF)r3 r4 _domain_before_webroot)r r1 r2 )r; r r! r4 7 s z_WebrootPathAction.__init__)r r rP r r c C sp |d kr d S | j r tjd|jrL|jd }x*|jD ]}|jj|| q4W n |jrXd| _ |jjtt | d S )NzPIf you specify multiple webroot paths, one of them must precede all domain flagsrE TrF )
r r rX rP r r rI rk r\ r )r r r rP r Z prev_webrootr. r r r! r ; s
z_WebrootPathAction.__call__)N)r r r r r r4 r r r r r r r r r r r )r; r! r( 4 s r( )rP r c C s& t jj| stj| d t jj| S )zValidates and returns the absolute path of webroot_path.
:param str webroot_path: path to the webroot directory
:returns: absolute path of webroot_path
:rtype: str
z% does not exist or is not a directory)r r ri r rX abspath)rP r r r! r\ Q s r\ )3r r r6 r ZloggingZtypingr r r r r r r r r
r r Zacmer
Zcertbotr r r Zcertbot._internalr Zcertbot.achallengesr r Zcertbot.compatr r Zcertbot.displayr r rV Zcertbot.pluginsr Z certbot.utilr Z getLoggerr rG rq r~ ZPluginr ZActionr) r( r r\ r r r r! sJ
o