Edit File: auth_handler.cpython-36.opt-1.pyc
3 گa�O � @ s� d Z ddlZddlZddlZddlmZ ddlmZ ddlmZ ddlmZ ddlm Z ddlm Z ddl Z dd l m Z dd lmZ dd lmZ dd lmZ dd lmZ ddlmZ ddlmZ dd lmZ ddlmZ ddlmZ ddlmZ ddl m Z ddl m Z! ej"e#�Z$G dd� d�Z%ej&e j'e(ej)d�dd�Z*eej& ee ej+ e ee, df ee, d�d d �Z-eej& ee ej+ e ee, df ee, d�d d �Z.eej& ee ej+ ee, d �d!d"�Z/eej& ej0d#�d$d%�Z1eej) e(d&�d'd(�Z2dS ))zACME AuthHandler.� N)�Dict)�Iterable)�List)�Optional)�Tuple)�Type)�Response)� challenges)�client)�errors)�messages)� achallenges)� configuration)� interfaces)� error_handler)�Account)�util)�commonc @ s e Zd ZdZejeej ee e e dd�dd�Z d e jejeee e j d�d d �Ze jee e f d �d d �Ze e j eedd�dd�Zee j e ej d�dd�Ze e e e j d�dd�Z e ej dd�dd�Z e je e e ej d�dd �Z!e e j dd �d d �Z"dS )!� AuthHandlera ACME Authorization Handler for a client. :ivar auth: Authenticator capable of solving :class:`~acme.challenges.Challenge` types :type auth: certbot.interfaces.Authenticator :ivar acme.client.BackwardsCompatibleClientV2 acme_client: ACME client API. :ivar account: Client's Account :type account: :class:`certbot._internal.account.Account` :ivar list pref_challs: sorted user specified preferred challenges type strings with the most preferred challenge listed first N)�auth� acme_client�account� pref_challs�returnc C s || _ || _|| _|| _d S )N)r �acmer r )�selfr r r r � r �"/usr/lib/python3.6/auth_handler.py�__init__/ s zAuthHandler.__init__F� )�orderr�config� best_effort� max_retriesr c C s& |j dd� }|s tjd��| js,tjd��| j|�}|s>|S tj| j|��� y$| j j |�}|j rpt j ddd� W n< tjk r� } z tjd� tjd� |�W Y dd}~X nX x&t||�D ]\} } | jj| j| � q�W tjd � | j|||� d d � |D �} | �stjd ��| S Q R X tjd ��dS )a� Retrieve all authorizations, perform all challenges required to validate these authorizations, then poll and wait for the authorization to be checked. :param acme.messages.OrderResource orderr: must have authorizations filled in :param certbot.configuration.NamespaceConfig config: current Certbot configuration :param bool best_effort: if True, not all authorizations need to be validated (eg. renew) :param int max_retries: maximum number of retries to poll authorizations :returns: list of all validated authorizations :rtype: List :raises .AuthorizationError: If unable to retrieve all authorizations NzNo authorization to handle.z9No ACME client defined, authorizations cannot be handled.z\Challenges loaded. Press continue to submit to CA. Pass "-v" for more info about challenges.T)�pausez!Failure in setting up challenges.z0Attempting to clean up outstanding challenges...zWaiting for verification...c S s g | ]}|j jtjkr|�qS r )�body�statusr � STATUS_VALID)�.0�authzrr r r � <listcomp>l s z5AuthHandler.handle_authorizations.<locals>.<listcomp>zAll challenges have failed.z?An unexpected error occurred while handling the authorizations.)�authorizationsr �AuthorizationErrorr �Error�_choose_challengesr Z ExitHandler�_cleanup_challengesr ZperformZdebug_challenges� display_utilZ notification�logger�critical�info�zipZanswer_challenge�challb�_poll_authorizations) r r r! r" r# �authzrs�achallsZresps�error�achall�respZauthzrs_validatedr r r �handle_authorizations7 s8 z!AuthHandler.handle_authorizations)r r c C s� | j stjd��dd� |jD �}g }g }xf|D ]^}y| j j|�}|j|� W q. tjk r� } z |j|� tjd|j |� W Y dd}~X q.X q.W ||fS )a~ Deactivate all `valid` authorizations in the order, so that they cannot be re-used in subsequent orders. :param messages.OrderResource orderr: must have authorizations filled in :returns: tuple of list of successfully deactivated authorizations, and list of unsuccessfully deactivated authorizations. :rtype: tuple z?No ACME client defined, cannot deactivate valid authorizations.c S s g | ]}|j jtjkr|�qS r )r% r& r r' )r( r) r r r r* � s z?AuthHandler.deactivate_valid_authorizations.<locals>.<listcomp>z)Failed to deactivate authorization %s: %sN) r r r- r+ Zdeactivate_authorization�append� acme_errorsr1 �debugZuri)r r Z to_deactivateZ deactivatedZfailedr) �er r r � deactivate_valid_authorizationsu s &z+AuthHandler.deactivate_valid_authorizations)r7 r# r" r c s: � j stjd��dd� t|�D �}g }d}x�t|�D ]�}|dkrJtj|� � fdd�|j� D �}x |j� D ]\}\} }| ||< qjW dd� |j� D �} x | D ]} t j d | j j j � q�W |j| � d d� |j� D �}|s�P t� fd d �|j� D ��} | tjj� j� }q4W |�r&� j|� |�s&tjd ��|�r6tjd��dS )a Poll the ACME CA server, to wait for confirmation that authorizations have their challenges all verified. The poll may occur several times, until all authorizations are checked (valid or invalid), or after a maximum of retries. z3No ACME client defined, cannot poll authorizations.c S s i | ]\}}|d f|�qS )Nr )r( �indexr) r r r � <dictcomp>� s z4AuthHandler._poll_authorizations.<locals>.<dictcomp>� r c s" i | ]\}\}}� j j|�|�qS r )r Zpoll)r( rB r) �_)r r r rC � s c S s" g | ]\}}|j jtjkr|�qS r )r% r& r ZSTATUS_INVALID)r( r) rE r r r r* � s z4AuthHandler._poll_authorizations.<locals>.<listcomp>z Challenge failed for domain %sc S s, i | ]$\}\}}|j jtjkr||f|�qS r )r% r& r ZSTATUS_PENDING)r( rB r) r; r r r rC � s c 3 s( | ] \}}|d k r� j j|d�V qd S )N� )r � retry_after)r( rE r; )r r r � <genexpr>� s z3AuthHandler._poll_authorizations.<locals>.<genexpr>z Some challenges have failed.z0All authorizations were not finalized by the CA.N)r r r- � enumerate�range�timeZsleep�items�valuesr1 r3 r% � identifier�value�extend�max�datetimeZnowZ total_seconds�_report_failed_authzrsr, ) r r7 r# r" Zauthzrs_to_checkZauthzrs_failed_to_reportZ sleep_secondsrE rB r) Zauthzrs_failedZ authzr_failedrG r )r r r6 � s> z AuthHandler._poll_authorizations)r7 r c C s� | j stjd��dd� |D �}g }|r0tjd� xn|D ]f}|jj}| j jdkrX|jj}nt dd� t t |��D ��}t || j |jjj�|�}|j| j||�� q6W |S )z� Retrieve necessary and pending challenges to satisfy server. NB: Necessary and already validated challenges are not retrieved, as they can be reused for a certificate issuance. z5No ACME client defined, cannot choose the challenges.c S s g | ]}|j jtjkr|�qS r )r% r& r r' )r( r) r r r r* � s z2AuthHandler._choose_challenges.<locals>.<listcomp>z$Performing the following challenges:rD c s s | ] }|fV qd S )Nr )r( �ir r r rH � s z1AuthHandler._choose_challenges.<locals>.<genexpr>)r r r- r1 r3 r% r Z acme_version� combinations�tuplerJ �len�gen_challenge_path�_get_chall_prefrN rO rP �_challenge_factory)r r7 Zpending_authzrsr8 r) Zauthzr_challengesrU �pathr r r r. � s" z AuthHandler._choose_challenges)�domainr c C sr g }| j j|�}| jrdtdd� |D ��}x(| jD ] }||kr0|jtjj| � q0W |rZ|S tj d��|j |� |S )z{Return list of challenge preferences. :param str domain: domain for which you are requesting preferences c s s | ] }|j V qd S )N)�typ)r( �challr r r rH � s z.AuthHandler._get_chall_pref.<locals>.<genexpr>zENone of the preferred challenges are supported by the selected plugin) r Zget_chall_prefr �setr= r � ChallengeZTYPESr r, rP )r r\ Z chall_prefsZ plugin_prefZplugin_pref_typesr] r r r rY � s zAuthHandler._get_chall_pref)r8 r c C s t jd� | jj|� dS )z�Cleanup challenges. :param achalls: annotated challenges to cleanup :type achalls: `list` of :class:`certbot.achallenges.AnnotatedChallenge` zCleaning up challengesN)r1 r3 r Zcleanup)r r8 r r r r/ s z AuthHandler._cleanup_challenges)r) r[ r c C sN | j stjd��g }x4|D ],}|jj| }|jt|| j j|jjj �� qW |S )at Construct Namedtuple Challenges :param messages.AuthorizationResource authzr: authorization :param list path: List of indices from `challenges`. :returns: achalls, list of challenge type :class:`certbot.achallenges.AnnotatedChallenge` :rtype: list :raises .errors.Error: if challenge type is not recognized zAccount is not set.) r r r- r% r r= �challb_to_achall�keyrN rO )r r) r[ r8 rB r5 r r r rZ s z AuthHandler._challenge_factory)�failed_authzrsr c s� � j stjd��i }� fdd�|D �}x"|D ]}|j|jjg �j|� q,W d� jj� d�g}x.t |j � dd� d�D ]\}}|jt |�� qrW |r�t � jt j�r�|jd � jj|�� d �� tjd j|�� d S ) z.Notifies the user about failed authorizations.zAccount is not set.c s6 g | ].}|j jD ] }|jrt|� jj|j jj��qqS r )r% r r9 ra r rb rN rO )r( r) r5 )r r r r* 1 s z6AuthHandler._report_failed_authzrs.<locals>.<listcomp>z= Certbot failed to authenticate some domains (authenticator: z5). The Certificate Authority reported these problems:c S s | d S )Nr r )�itemr r r �<lambda>< s z4AuthHandler._report_failed_authzrs.<locals>.<lambda>)rb z Hint: � � N)r r r- � setdefaultr9 r] r= r �name�sortedrL �_generate_failed_chall_msg� isinstance� plugin_commonZPluginZ auth_hintr0 Znotify�join)r rc Zproblems�failed_achallsr: �msgrE r8 r )r r rS , s z"AuthHandler._report_failed_authzrs)Fr )#�__name__� __module__� __qualname__�__doc__r Z Authenticatorr r ZClientV2r r �strr r Z OrderResourcer ZNamespaceConfig�bool�intZAuthorizationResourcer< r rA r6 r r �AnnotatedChallenger. r r r` rY r/ rZ rS r r r r r s "< B r )r5 � account_keyr\ r c C sb | j }tjd|j|� t|tj�r2tj| ||d�S t|tj �rLtj | |d�S t j dj |j���dS )a: Converts a ChallengeBody object to an AnnotatedChallenge. :param .ChallengeBody challb: ChallengeBody :param .JWK account_key: Authorized Account Key :param str domain: Domain of the challb :returns: Appropriate AnnotatedChallenge :rtype: :class:`certbot.achallenges.AnnotatedChallenge` z%s challenge for %s)r5 r\ ry )r5 r\ z+Received unsupported challenge of type: {0}N) r^ r1 r3 r] rl r ZKeyAuthorizationChallenger Z"KeyAuthorizationAnnotatedChallengeZDNSr r- �format)r5 ry r\ r^ r r r ra G s ra .)�challbs� preferencesrU r c C s |rt | ||�S t| |�S )a� Generate a plan to get authority over the identity. .. todo:: This can be possibly be rewritten to use resolved_combinations. :param tuple challbs: A tuple of challenges (:class:`acme.messages.Challenge`) from :class:`acme.messages.AuthorizationResource` to be fulfilled by the client in order to prove possession of the identifier. :param list preferences: List of challenge preferences for domain (:class:`acme.challenges.Challenge` subclasses) :param tuple combinations: A collection of sets of challenges from :class:`acme.messages.Challenge`, each of which would be sufficient to prove possession of the identifier. :returns: list of indices from ``challenges``. :rtype: list :raises certbot.errors.AuthorizationError: If a path cannot be created that satisfies the CA given the preferences and combinations. )�_find_smart_path�_find_dumb_path)r{ r| rU r r r rX _ s rX c C s� i }d}x$t |�D ]\}}|||< ||7 }qW d}|}d} xF|D ]>} x$| D ] } | |j| | jj|�7 } qJW | |k rz| }| }d} q@W |s�t| ��|S )z�Find challenge path with server hints. Can be called if combinations is included. Function uses a simple ranking system to choose the combo with the lowest cost. rD Nr )rI �getr^ � __class__�_report_no_chall_path) r{ r| rU Z chall_costZmax_costrT Z chall_clsZ best_comboZbest_combo_costZ combo_totalZcomboZchallenge_indexr r r r} � s& r} )r{ r| r c sN g }xDt | �D ]8\}� t� fdd�|D �d�}|r>|j|� qt| ��qW |S )z�Find challenge path without server hints. Should be called if the combinations hint is not included by the server. This function either returns a path containing all challenges provided by the CA or raises an exception. c 3 s | ]}t � j|�rd V qdS )TN)rl r^ )r( Zpref_c)r5 r r rH � s z"_find_dumb_path.<locals>.<genexpr>F)rI �nextr= r� )r{ r| r[ rT Z supportedr )r5 r r~ � s r~ )r{ r c C s> d}t | �dkr*t| d jtj�r*|d7 }tj|� tj|�S )z�Logs and return a raisable error reporting that no satisfiable chall path exists. :param challbs: challenges from the authorization that can't be satisfied :returns: An authorization error :rtype: certbot.errors.AuthorizationError zyClient with the currently selected authenticator does not support any combination of challenges that will satisfy the CA.rD r zM You may need to use an authenticator plugin that can do challenges over DNS.) rW rl r^ r ZDNS01r1 r2 r r, )r{ rp r r r r� � s r� )ro r c C sV | d j }|j}tj|�r |j}g }x&| D ] }|jd|j||j jf � q*W dj|�S )a Creates a user friendly error message about failed challenges. :param list failed_achalls: A list of failed :class:`certbot.achallenges.AnnotatedChallenge` with the same error type. :returns: A formatted error message for the client. :rtype: str r z( Domain: %s Type: %s Detail: %s rg ) r9 r] r Z is_acme_error�coder= r\ Zdetailrn )ro r9 r] rp r: r r r rk � s rk )3rt rR ZloggingrK Ztypingr r r r r r ZjosepyZrequests.modelsr r r r r r> r Zcertbotr r r Zcertbot._internalr Zcertbot._internal.accountr Zcertbot.displayr r0 Zcertbot.pluginsr rm Z getLoggerrq r1 r Z ChallengeBodyZJWKru rx ra r` rw rX r} r~ r, r� rk r r r r �<module> sP * %
Back to File Manager