CasperSecurity
o
6��a > � @ sT d Z ddlmZ ddlmZ ddlZddlZddlZddlZddlm Z ddl
Z
ddl m Z ddl m
Z
ddl mZ dd l mZ dd
lmZ dd lmZ dd lmZ dd
lmZ ddlmZ ddlmZ e� e �Z dd� Z dd� Z e�!d�Z"e�!dej#�Z$G dd� deed�ZG dd� deeed�ZG dd � d �Z%G d d � d �Z&d d � Z'd!d"� Z(dS )#zPlugin common functions.� )�ABCMeta)�abstractmethodN)�List)� achallenges)� crypto_util)�errors)�reverter)� constants)�
filesystem)�os)� Installer)�Plugin)�
PluginStoragec C s | d S )�9ArgumentParser options namespace (prefix of all options).�-� ��namer r �8/usr/lib/python3/dist-packages/certbot/plugins/common.py�option_namespace s r c C s | � dd�d S )�;ArgumentParser dest namespace (prefix of all destinations).r �_)�replacer r r r �dest_namespace s r zX(^127\.0\.0\.1)|(^10\.)|(^172\.1[6-9]\.)|(^172\.2[0-9]\.)|(^172\.3[0-1]\.)|(^192\.168\.)z3^(([a-z0-9]|[a-z0-9][a-z0-9\-]*[a-z0-9])\.)*[a-z]+$c s� e Zd ZdZ� fdd�Zeedd� ��Zedd� �Ze dd � �Z
d
d � Z e d d
� �Z dd� Z
dd� Zdeej defdd�Z� ZS )r
zGeneric plugin.c s t � �||� || _|| _d S �N)�super�__init__�configr )�selfr r �� __class__r r r . s
zPlugin.__init__c C s dS )z�Add plugin arguments to the CLI argument parser.
:param callable add: Function that proxies calls to
`argparse.ArgumentParser.add_argument` prepending options
with unique plugin name prefix.
Nr )�cls�addr r r �add_parser_arguments3 s zPlugin.add_parser_argumentsc s � �fdd�}| � |�S )zkInject parser options.
See `~.certbot.interfaces.Plugin.inject_parser_options` for docs.
c s$ �j d�t� �| �g|�R i |��S )Nz--{0}{1})� add_argument�formatr )�arg_name_no_prefix�args�kwargs�r �parserr r r" F s ���z)Plugin.inject_parser_options.<locals>.add)r# )r! r* r r" r r) r �inject_parser_options> s
z Plugin.inject_parser_optionsc C �
t | j�S )r )r r �r r r r r L �
zPlugin.option_namespacec C s
| j | S )z'Option name (include plugin namespace).)r )r r r r r � option_nameQ �
zPlugin.option_namec C r, )r )r r r- r r r r U r. zPlugin.dest_namespacec C s | j |�dd� S )z.Find a destination for given variable ``var``.r r )r r �r �varr r r �destZ s z Plugin.destc C s t | j| �|��S )z0Find a configuration value for variable ``var``.)�getattrr r3 r1 r r r �conf` s z Plugin.conf�failed_achalls�returnc C s( d� tdd� |D ���}dj| j|d�S )a9 Human-readable string to help the user troubleshoot the authenticator.
Shown to the user if one or more of the attempted challenges were not a success.
Should describe, in simple language, what the authenticator tried to do, what went
wrong and what the user should try as their "next steps".
TODO: auth_hint belongs in Authenticator but can't be added until the next major
version of Certbot. For now, it lives in .Plugin and auth_handler will only call it
on authenticators that subclass .Plugin. For now, inherit from `.Plugin` to implement
and/or override the method.
:param list failed_achalls: List of one or more failed challenges
(:class:`achallenges.AnnotatedChallenge` subclasses).
:rtype str:
z and c S s h | ]}|j �qS r )�typ)�.0�achallr r r � <setcomp>x s z#Plugin.auth_hint.<locals>.<setcomp>z�The Certificate Authority couldn't externally verify that the {name} plugin completed the required {challs} challenges. Ensure the plugin is configured correctly and that the changes it makes are accessible from the internet.)r �challs)�join�sortedr% r )r r6 r< r r r � auth_hintd s �zPlugin.auth_hint)�__name__�
__module__� __qualname__�__doc__r � classmethodr r# r+ �propertyr r/ r r3 r5 r r �AnnotatedChallenge�strr? �
__classcell__r r r r r
+ s
r
)� metaclassc sl e Zd ZdZ� fdd�Zddd�Zdd� Zd d
� Zd d � Zddd�Z e
dd� �Z e
dd� �Z dd� Z
� ZS )r z�An installer base class with reverter and ssl_dhparam methods defined.
Installer plugins do not have to inherit from this class.
c s4 t � j|i |�� t| j| j�| _t�| j�| _d S r )r r r r r �storager �Reverter)r r' r( r r r r � s zInstaller.__init__Fc
C sP |r| j j}n| j j}z|||� W dS tjy' } zt�t|���d}~ww )a� Add files to a checkpoint.
:param set save_files: set of filepaths to save
:param str save_notes: notes about changes during the save
:param bool temporary: True if the files should be added to a
temporary checkpoint rather than a permanent one. This is
usually used for changes that will soon be reverted.
:raises .errors.PluginError: when unable to add to checkpoint
N)r �add_to_temp_checkpoint�add_to_checkpointr �
ReverterError� PluginErrorrG )r �
save_files�
save_notes� temporary�checkpoint_func�errr r r rM � s
��zInstaller.add_to_checkpointc
C �< z | j �|� W dS tjy } zt�t|���d}~ww )z�Timestamp and save changes made through the reverter.
:param str title: Title describing checkpoint
:raises .errors.PluginError: when an error occurs
N)r �finalize_checkpointr rN rO rG )r �titlerT r r r rV � s ��z Installer.finalize_checkpointc
C �: z| j �� W dS tjy } zt�t|���d}~ww )z�Revert all previously modified files.
Reverts all modified files that have not been saved as a checkpoint
:raises .errors.PluginError: If unable to recover the configuration
N)r �recovery_routiner rN rO rG �r rT r r r rY � s ��zInstaller.recovery_routinec
C rX )zkRollback temporary checkpoint.
:raises .errors.PluginError: when unable to revert config
N)r �revert_temporary_configr rN rO rG rZ r r r r[ � s ��z!Installer.revert_temporary_config� c
C rU )z�Rollback saved checkpoints.
:param int rollback: Number of checkpoints to revert
:raises .errors.PluginError: If there is a problem with the input or
the function is unable to correctly revert the configuration
N)r �rollback_checkpointsr rN rO rG )r �rollbackrT r r r r] � s ��z Installer.rollback_checkpointsc C � t j�| jjtj�S )z(Full absolute path to ssl_dhparams file.)r �pathr= r �
config_dirr �SSL_DHPARAMS_DESTr- r r r � ssl_dhparams� � zInstaller.ssl_dhparamsc C r_ )z:Full absolute path to digest of updated ssl_dhparams file.)r r` r= r ra r �UPDATED_SSL_DHPARAMS_DIGESTr- r r r �updated_ssl_dhparams_digest� rd z%Installer.updated_ssl_dhparams_digestc C s t | j| jtjtj�S )zJCopy Certbot's ssl_dhparams file into the system's config dir if required.)� install_version_controlled_filerc rf r �SSL_DHPARAMS_SRC�ALL_SSL_DHPARAMS_HASHESr- r r r �install_ssl_dhparams� s �z Installer.install_ssl_dhparams�F)r\ )r@ rA rB rC r rM rV rY r[ r] rE rc rf rj rH r r r r r s
r c @ sv e Zd ZdZd dd�Zedd� �Zdd� Zd d
� Zd d � Z d
d� Z
dd� Z dd� Z dd� Z
dd� Zdd� Zdd� ZdS ) �Addrz�Represents an virtual host address.
:param str addr: addr part of vhost address
:param str port: port number or \*, or ""
Fc C s || _ || _d S r )�tup�ipv6)r rm rn r r r r � s
z
Addr.__init__c C s� |� d�r4|�d�}|d|d � }d}t|�|d kr,||d dkr,||d d� }| ||fdd �S |�d�}| |d
|d f�S ) z Initialize Addr from string.�[�]Nr\ � � �:T)rn r )�
startswith�rfind�len� partition)r! �str_addr�endIndex�host�portrm r r r �
fromstring� s
zAddr.fromstringc C s | j d r
d| j S | j d S )Nr\ z%s:%sr �rm r- r r r �__str__ s
z Addr.__str__c C s | j r | �� | jd fS | jS )z5Normalized representation of addr/port tuple
r\ )rn �get_ipv6_explodedrm r- r r r �normalized_tuple s zAddr.normalized_tuplec C s t || j�r| �� |�� kS dS )NF)�
isinstancer r� )r �otherr r r �__eq__ s z Addr.__eq__c C r, r )�hashrm r- r r r �__hash__ s
z
Addr.__hash__c C �
| j d S )z Return addr part of Addr object.r r} r- r r r �get_addr r0 z
Addr.get_addrc C r� )z Return port.r\ r} r- r r r �get_port r0 z
Addr.get_portc C s | � | jd |f| j�S )z6Return new address object with same addr and new port.r )r rm rn )r r{ r r r � get_addr_obj s zAddr.get_addr_objc C s |� d�}|�d�}| �|�S )z7Return IPv6 address in normalized form, helper functionro rp )�lstrip�rstrip�
_explode_ipv6)r �addrr r r �_normalize_ipv6# s
zAddr._normalize_ipv6c C s | j rd�| �| jd ��S dS )z Return IPv6 in normalized formrs r rq )rn r= r� rm r- r r r r ) s zAddr.get_ipv6_explodedc C s� g d�}|� d�}t|�t|�kr|dt|�� }d}t|�D ]'\}}|s(d}q t|�dkr3|�d�}|s<t|�||< q t|�||t|� < q |S )z#Explode IPv6 address for comparison)�0r� r� r� r� r� r� r� rs r FTr\ r� )�splitrv � enumerater� rG )r r� �result� addr_list�
append_to_end�i�blockr r r r� / s
zAddr._explode_ipv6Nrk )r@ rA rB rC r rD r| r~ r� r� r� r� r� r� r� r r� r r r r rl � s
rl c @ s* e Zd ZdZdd� Zd dd�Zdd� ZdS )
�ChallengePerformerav Abstract base for challenge performers.
:ivar configurator: Authenticator and installer plugin
:ivar achalls: Annotated challenges
:vartype achalls: `list` of `.KeyAuthorizationAnnotatedChallenge`
:ivar indices: Holds the indices of challenges from a larger array
so the user of the class doesn't have to.
:vartype indices: `list` of `int`
c C s || _ g | _g | _d S r )� configurator�achalls�indices)r r� r r r r T s
zChallengePerformer.__init__Nc C s( | j �|� |dur| j�|� dS dS )z�Store challenge to be performed when perform() is called.
:param .KeyAuthorizationAnnotatedChallenge achall: Annotated
challenge.
:param int idx: index to challenge in a larger array
N)r� �appendr� )r r: �idxr r r � add_challY s �z ChallengePerformer.add_challc C s t � �)z�Perform all added challenges.
:returns: challenge responses
:rtype: `list` of `acme.challenges.KeyAuthorizationChallengeResponse`
)�NotImplementedErrorr- r r r �performe s zChallengePerformer.performr )r@ rA rB rC r r� r� r r r r r� H s
r� c s� t ������fdd�� � ��fdd�}tj���s |� dS t ���}|�kr*dS ||v r3|� dS tj���rXt�d�� }|�� }W d � n1 sMw Y |�krXdS � � t�d���� dS )a� Copy a file into an active location (likely the system's config dir) if required.
:param str dest_path: destination path for version controlled file
:param str digest_path: path to save a digest of the file in
:param str src_path: path to version controlled file found in distribution
:param list all_hashes: hashes of every released version of the file
c s: t �d��} | �� � W d � d S 1 sw Y d S )N�w)�open�write)�f)� current_hash� digest_pathr r �_write_current_hashz s "�z<install_version_controlled_file.<locals>._write_current_hashc s t ���� � � d S r )�shutil�copyfiler )r� � dest_path�src_pathr r �_install_current_file~ s
z>install_version_controlled_file.<locals>._install_current_fileN�rzh%s has been manually modified; updated file saved to %s. We recommend updating %s for security purposes.) r � sha256sumr r` �isfiler� �read�logger�warning)r� r� r� �
all_hashesr� �active_file_digestr� � saved_digestr )r� r� r� r� r� r rg p s*
��rg c C s� dd� }|d�}|d�}|d�}t �|tj� t �|tj� t �|tj� t�|tj�d| ��}t j
|tj�|| �dd� |||fS ) z5Setup the directories necessary for the configurator.c S s t �t�| ��S )a� Return the real path of a temp directory with the specified prefix
Some plugins rely on real paths of symlinks for working correctly. For
example, certbot-apache uses real paths of configuration files to tell
a virtual host from another. On systems where TMP itself is a symbolic
link, (ex: OS X) such plugins will be confused. This function prevents
such a case.
)r
�realpath�tempfile�mkdtemp)�prefixr r r �expanded_tempdir� s z#dir_setup.<locals>.expanded_tempdir�tempr �work�testdataT)�symlinks) r
�chmodr �CONFIG_DIRS_MODE�
pkg_resources�resource_filenamer r` r= r� �copytree)�test_dir�pkgr� �temp_dirra �work_dir� test_configsr r r � dir_setup� s ��
r� ))rC �abcr r �logging�rer� r� �typingr r� �certbotr r r r �certbot._internalr �certbot.compatr
r �certbot.interfacesr �AbstractInstallerr
�AbstractPlugin�certbot.plugins.storager � getLoggerr@ r� r r �compile�private_ips_regex�
IGNORECASE�hostname_regexrl r� rg r� r r r r �<module> sD
��Tgb( 2