Edit File: cert_manager.cpython-36.pyc
3 گa�I � @ s" d Z ddlZddlZddlZddlZddlmZ ddlmZ ddlmZ ddlm Z ddlm Z ddlm Z dd lm Z dd lm Z ddlZdd lmZ dd lmZ dd lmZ ddlmZ ddlmZ ddlmZ ddlmZ ddlmZ eje �Z ej dd�dd�Z ej dd�dd�Z ej dd�dd�Z!ej dd�dd�Z"ej e#e ej$ d�d d �Z%ej e#e e e# d �d d �Z&ej e e# e e ej$ e ej$ f d!�d"d#�Z'ej$e#e e e# d$�d%d&�Z(e e eej$ge#f eej$ge e e# f f d'�d(d)�Z)ej e#d*�d+d,�Z*ej ee eej$ge#f eej$ge e e# f f eej$ge#f eej$ge#f e e# d-�d.d/�Z+dEej ej$e,e e# d1�d2d3�Z-dFej e#e,e e# e e# d4�d5d6�Z.ee# e#d7�d8d9�Z/ej eej$ e#d:�d;d<�Z0ej eej$ ee# dd=�d>d?�Z1e d@�Z2ej edAe2f e2ee2dB�dCdD�Z3dS )Gz Tools for managing certificates.� N)�Any)�Callable)�Iterable)�List)�Optional)�Tuple)�TypeVar)�Union)� configuration)� crypto_util)�errors)�ocsp)�util)�storage)�os)�config�returnc C s( x"t j| �D ]}t j|| dd� q W dS )aj Update the certificate file family symlinks to use archive_dir. Use the information in the config file to make symlinks point to the correct archive directory. .. note:: This assumes that the installation is using a Reverter object. :param config: Configuration. :type config: :class:`certbot._internal.configuration.NamespaceConfig` T)Zupdate_symlinksN)r �renewal_conf_files� RenewableCert)r � renewal_file� r �"/usr/lib/python3.6/cert_manager.py�update_live_symlinks! s r c C s� t | d�d }| j}|sJtjdj|�dd�\}}|tjks@| rJtjd��t| |�}|shtj dj|���t j ||| � tj dj||�d d � d S ) z�Rename the specified lineage to the new name. :param config: Configuration. :type config: :class:`certbot._internal.configuration.NamespaceConfig` �renamer z&Enter the new name for certificate {0}T)�force_interactivezUser ended interaction.z,No existing certificate with name {0} found.z Successfully renamed {0} to {1}.F)�pauseN) � get_certnames� new_certname� display_utilZ input_text�format�OKr �Error�lineage_for_certnameZConfigurationErrorr Zrename_renewal_config� notification)r �certnamer �code�lineager r r �rename_lineage1 s r' c C s� g }g }x�t j| �D ]t}y$t j|| �}tj|� |j|� W q tk r� } z.tjd||� tj dt j � � |j|� W Y dd}~X qX qW t | ||� dS )z�Display information about certs configured with Certbot :param config: Configuration. :type config: :class:`certbot._internal.configuration.NamespaceConfig` zIRenewal configuration file %s produced an unexpected error: %s. Skipping.zTraceback was: %sN) r r r r Zverify_renewable_cert�append� Exception�loggerZwarning�debug� traceback� format_exc�_describe_certs)r � parsed_certs�parse_failuresr Zrenewal_candidate�er r r � certificatesK s r2 c C s� t | ddd�}dg}x|D ]}|jd| � qW |jd� |jd� tjdj|�dd �sftjd � d S x(|D ] }tj| |� tj d j |�� qlW d S ) z;Delete Certbot files associated with a certificate lineage.�deleteT)�allow_multiplez8The following certificate(s) are selected for deletion: z * aP WARNING: Before continuing, ensure that the listed certificates are not being used by any installed server software (e.g. Apache, nginx, mail servers). Deleting a certificate that is still being used will cause the server software to stop working. See https://certbot.org/deleting-certs for information on deleting certificates safely.z: Are you sure you want to delete the above certificate(s)?� )�defaultz$Deletion of certificate(s) canceled.Nz.Deleted all files relating to certificate {0}.) r r( r Zyesno�joinr* �infor Z delete_files�notifyr )r � certnames�msgr$ r r r r3 b s r3 )� cli_configr$ r c C s� | j }tj|dd� ytj| |�}W n tjk r: dS X y tj|| �S tjtfk r~ t j d|� t j dt j � � dS X dS )z)Find a lineage object with name certname.i� )�modeNz Renewal conf file %s is broken.zTraceback was: %s) �renewal_configs_dirr �make_or_verify_dirr Zrenewal_file_for_certnamer �CertStorageErrorr �IOErrorr* r+ r, r- )r< r$ � configs_dirr r r r r" | s r" )r r$ r c C s t | |�}|r|j� S dS )z0Find the domains in the cert with name certname.N)r" �names)r r$ r& r r r �domains_for_certname� s rD )r �domainsr c sP t jttt j tt j f ttt j tt j f d�� fdd� }d}t| ||�S )a� Find existing certs that match the given domain names. This function searches for certificates whose domains are equal to the `domains` parameter and certificates whose domains are a subset of the domains in the `domains` parameter. If multiple certificates are found whose names are a subset of `domains`, the one whose names are the largest subset of `domains` is returned. If multiple certificates' domains are an exact match or equally sized subsets, which matching certificates are returned is undefined. :param config: Configuration. :type config: :class:`certbot._internal.configuration.NamespaceConfig` :param domains: List of domain names :type domains: `list` of `str` :returns: lineages representing the identically matching cert and the largest subset if they exist :rtype: `tuple` of `storage.RenewableCert` or `None` )�candidate_lineage�rvr c sb |\}}t | j� �}|t � �kr&| }n4|jt � ��rZ|dkrB| }nt|�t|j� �krZ| }||fS )zsReturn cert as identical_names_cert if it matches, or subset_names_cert if it matches as subset N)�setrC �issubset�len)rF rG Zidentical_names_certZsubset_names_certZcandidate_names)rE r r � update_certs_for_domain_matches� s z?find_duplicative_certs.<locals>.update_certs_for_domain_matchesN)NN)r r r r �_search_lineages)r rE rK Zinitr )rE r �find_duplicative_certs� s rM )rF �filetyper c s, | j � � �fdd�tj� �D �}|r(|S dS )aJ In order to match things like: /etc/letsencrypt/archive/example.com/chain1.pem. Anonymous functions which call this function are eventually passed (in a list) to `match_and_check_overlaps` to help specify the acceptable_matches. :param `.storage.RenewableCert` candidate_lineage: Lineage whose archive dir is to be searched. :param str filetype: main file name prefix e.g. "fullchain" or "chain". :returns: Files in candidate_lineage's archive dir that match the provided filetype. :rtype: list of str or None c s, g | ]$}t jd j��|�rtjj� |��qS )z {0}[0-9]*.pem)�re�matchr r �pathr7 )�.0�f)� archive_dirrN r r � <listcomp>� s z"_archive_files.<locals>.<listcomp>N)rT r �listdir)rF rN �patternr )rT rN r �_archive_files� s rX )r c C s dd� dd� dd� dd� gS )z� Generates the list that's passed to match_and_check_overlaps. Is its own function to make unit testing easier. :returns: list of functions :rtype: list c S s | j S )N)Zfullchain_path)�xr r r �<lambda>� s z%_acceptable_matches.<locals>.<lambda>c S s | j S )N)� cert_path)rY r r r rZ � s c S s t | d�S )N�cert)rX )rY r r r rZ � s c S s t | d�S )N� fullchain)rX )rY r r r rZ � s r r r r r �_acceptable_matches� s r^ )r< r c s( t � }t� |� fdd�dd� �}|d S )a� If config.cert_path is defined, try to find an appropriate value for config.certname. :param `configuration.NamespaceConfig` cli_config: parsed command line arguments :returns: a lineage name :rtype: str :raises `errors.Error`: If the specified cert path can't be matched to a lineage name. :raises `errors.OverlappingMatchFound`: If the matched lineage's archive is shared. c s � j S )N)r[ )rY )r< r r rZ � s z&cert_path_to_lineage.<locals>.<lambda>c S s | j S )N)� lineagename)rY r r r rZ � s r )r^ �match_and_check_overlaps)r< �acceptable_matchesrP r )r< r �cert_path_to_lineage� s rb )r< ra � match_func�rv_funcr c s� t jtt tttt jgtf tt jgttt f f tt d�� �fdd� }t| |g |�}|svt j dj | j ���nt |�dkr�t j� �|S )a Searches through all lineages for a match, and checks for duplicates. If a duplicate is found, an error is raised, as performing operations on lineages that have their properties incorrectly duplicated elsewhere is probably a bad idea. :param `configuration.NamespaceConfig` cli_config: parsed command line arguments :param list acceptable_matches: a list of functions that specify acceptable matches :param function match_func: specifies what to match :param function rv_func: specifies what to return )rF � return_valuera r c sh � fdd�|D �}g }x.|D ]&}t |t�r4||7 }q |r |j|� q W �� �}||krd|j�� �� |S )z1Returns a list of matches using _search_lineages.c s g | ] }|� ��qS r r )rR �func)rF r r rU s zBmatch_and_check_overlaps.<locals>.find_matches.<locals>.<listcomp>)� isinstance�listr( )rF re ra Zacceptable_matches_resolvedZacceptable_matches_rv�itemrP )rc rd )rF r � find_matches s z.match_and_check_overlaps.<locals>.find_matchesz!No match found for cert-path {0}!� )r r r �strr r r r rL r r! r r[ rJ ZOverlappingMatchFound)r< ra rc rd rj Zmatchedr )rc rd r r` � s 4 r` F)r r\ �skip_filter_checksr c C sF g }t j� }| jr(|j| jkr(| r(dS | jrHt| j�j|j� � rHdS tj j t j j � �}g }|j rn|jd� |j|kr�|jd� n|j|�r�|jd� |r�ddj|� }nB|j| }|jdkr�d}n(|jdk r�d j|jd �}n d j|j�}d j|j|�} ttj|j�d �} |jdj|j| |jdj|j� �| |j|j�� dj|�S )zJ Returns a human readable description of info about a RenewableCert objectNZ TEST_CERTZEXPIREDZREVOKEDz INVALID: z, rk z VALID: 1 dayzVALID: {0} hour(s)i zVALID: {0} daysz {0} ({1})rY z� Certificate Name: {} Serial Number: {} Key Type: {} Domains: {} Expiry Date: {} Certificate Path: {} Private Key Path: {}� � )r ZRevocationCheckerr$ r_ rE rH rI rC �pytzZUTCZfromutc�datetimeZutcnowZ is_test_certr( Z target_expiryZ ocsp_revokedr7 Zdaysr Zsecondsr Zget_serial_from_certr[ Zprivate_key_typer] Zprivkey) r r\ rm �certinfoZcheckerZnowZreasonsZstatusZdiffZ valid_string�serialr r r �human_readable_cert_info& sB rt )r �verbr4 � custom_promptr c C s� | j }|r|g}n�tj| �}dd� |D �}|s8tjd��|r||sLdj|�}n|}tj||ddd�\} }| tjkr�tjd��nZ|s�d j|�}n|}tj ||ddd�\} } | tjks�| t d t |��kr�tjd��|| g}|S ) z4Get certname from flag, interactively, or error out.c S s g | ]}t j|��qS r )r Zlineagename_for_filename)rR �namer r r rU ` s z!get_certnames.<locals>.<listcomp>z No existing certificates found.z+Which certificate(s) would you like to {0}?z --cert-nameT)Zcli_flagr zUser ended interaction.z(Which certificate would you like to {0}?r ) r$ r r r r! r r Z checklistr Zmenu�rangerJ ) r ru r4 rv r$ r: � filenames�choices�promptr% �indexr r r r X s0 r )�msgsr c C s ddj dd� | D �� S )zFFormat a results report for a category of single-line renewal outcomesz z c s s | ]}t |�V qd S )N)rl )rR r; r r r � <genexpr>� s z _report_lines.<locals>.<genexpr>)r7 )r} r r r � _report_lines s r )r r/ r c C s8 g }x(|D ] }t | |�}|dk r |j|� q W dj|�S )z)Format a results report for a parsed certNr5 )rt r( r7 )r r/ rr r\ Z cert_infor r r �_report_human_readable� s r� )r r/ r0 r c C s� g }|j }| r | r |d� nL|rT| js0| jr4dnd}|dj|�� |t| |�� |rl|d� |t|�� tjdj|�ddd� d S ) z/Print information about the certs we know aboutzNo certificates found.z matching ro z Found the following {0}certs:z3 The following renewal configurations were invalid:r5 F)r ZwrapN) r( r$ rE r r� r r r# r7 )r r/ r0 �outr9 rP r r r r. � s r. �T.)r< rf � initial_rv�argsr c G s� | j }tj|dd� |}xltj| �D ]^}ytj|| �}W n8 tjtfk rp t j d|� t j dt j � � w$Y nX |||f|�� }q$W |S )a� Iterate func over unbroken lineages, allowing custom return conditions. Allows flexible customization of return values, including multiple return values and complex checks. :param `configuration.NamespaceConfig` cli_config: parsed command line arguments :param function func: function used while searching over lineages :param initial_rv: initial return value of the function (any type) :returns: Whatever was specified by `func` if a match is found. i� )r= z)Renewal conf file %s is broken. Skipping.zTraceback was: %s) r> r r? r r r r r@ rA r* r+ r, r- )r< rf r� r� rB rG r rF r r r rL � s rL )F)FN)4�__doc__rq ZloggingrO r, Ztypingr r r r r r r r rp Zcertbotr r r r r Zcertbot._internalr Zcertbot.compatr Zcertbot.displayr Z getLogger�__name__r* ZNamespaceConfigr r' r2 r3 rl r r" rD rM rX r^ rb r` �boolrt r r r� r. r� rL r r r r �<module> sn 3 ( % 1 "&
Back to File Manager