JFIF $
d d 7
Viewing File: /usr/lib/python3.9/site-packages/certbot/_internal/__pycache__/auth_handler.cpython-39.opt-1.pyc
a
}|�gPR � @ s� d Z ddlZddlZddlZddlmZ ddlmZ ddlmZ ddlmZ ddlm Z ddlm
Z
dd lm Z ddl Z dd
l
mZ dd lmZ dd lmZ dd
lmZ ddlmZ ddlmZ ddlmZ dd
lmZ ddlmZ ddlmZ ddlm Z ddl m Z ddl m!Z" e�#e$�Z%G dd� d�Z&ej'e j(e)ej*d�dd�Z+eej' ee ej, e
e-df d �d d �Z.eej' ej/d �d d!�Z0eej* e)d"�d#d$�Z1dS )%zACME AuthHandler.� N)�Dict)�Iterable)�List)�Optional)�Sequence)�Tuple)�Type)�Response)�
challenges)�client)�errors)�messages)� achallenges)�
configuration)�
interfaces)�
error_handler)�Account)�util)�commonc @ s* e Zd ZdZejeej ee e
e dd�dd�Z d#e
jejeeee
e
j d�d d
�Ze
jee
e
f d �d d
�Ze
e
j eeedd�dd�Zee
j e
ej d�dd�Z e e
e e j d�dd�Z e
ej dd�dd�Z!e
je"e e
ej d�dd �Z#e
e
j dd �d d �Z$e
ej eje d �d!d"�Z%dS )$� AuthHandlera� ACME Authorization Handler for a client.
:ivar auth: Authenticator capable of solving
:class:`~acme.challenges.Challenge` types
:type auth: certbot.interfaces.Authenticator
:ivar acme.client.ClientV2 acme_client: ACME client API.
:ivar account: Client's Account
:type account: :class:`certbot._internal.account.Account`
:ivar list pref_challs: sorted user specified preferred challenges
type strings with the most preferred challenge listed first
N)�auth� acme_client�account� pref_challs�returnc C s || _ || _|| _|| _d S �N)r �acmer r )�selfr r r r � r �B/usr/lib/python3.9/site-packages/certbot/_internal/auth_handler.py�__init__0 s zAuthHandler.__init__F� )�orderr�config� best_effort� max_retries�
max_time_minsr c
C sL |j dd� }|s t�d��| js,t�d��| �|�}|s>|S t�| j|��� z0| j �
|�}|j r|t j
d| �||� dd� W n> tjy� } z$t�d� t�d� | �W Y d} ~ n
d} ~ 0 0 t||�D ]\}
} | j�|
j| � q�t�d � | �||||� d
d � |D �} | �st�d ��| W d � S 1 �s40 Y t�d
��dS )a
Retrieve all authorizations, perform all challenges required to validate
these authorizations, then poll and wait for the authorization to be checked.
:param acme.messages.OrderResource orderr: must have authorizations filled in
:param certbot.configuration.NamespaceConfig config: current Certbot configuration
:param bool best_effort: if True, not all authorizations need to be validated (eg. renew)
:param int max_retries: maximum number of retries to poll authorizations
:param float max_time_mins: maximum time (in minutes) to poll authorizations
:returns: list of all validated authorizations
:rtype: List
:raises .AuthorizationError: If unable to retrieve all authorizations
NzNo authorization to handle.z9No ACME client defined, authorizations cannot be handled.z3Challenges loaded. Press continue to submit to CA.
T)�pausez!Failure in setting up challenges.z0Attempting to clean up outstanding challenges...zWaiting for verification...c S s g | ]}|j jtjkr|�qS r ��body�statusr
Z STATUS_VALID��.0�authzrr r r �
<listcomp>o s �z5AuthHandler.handle_authorizations.<locals>.<listcomp>zAll challenges have failed.z?An unexpected error occurred while handling the authorizations.)�authorizationsr �AuthorizationErrorr �Error�_choose_challengesr Z ExitHandler�_cleanup_challengesr ZperformZdebug_challenges� display_utilZ notification�_debug_challenges_msg�logger�critical�info�zipZanswer_challenge�challb�_poll_authorizations)
r r" r# r$ r% r& �authzrs�achallsZresps�error�achall�respZauthzrs_validatedr r r �handle_authorizations8 s>
��
$z!AuthHandler.handle_authorizations)r" r c C s� | j st�d��dd� |jD �}g }g }|D ]`}z| j �|�}|�|� W q, tjy� } z&|�|� t�d|j |� W Y d}~q,d}~0 0 q,||fS )a~
Deactivate all `valid` authorizations in the order, so that they cannot be re-used
in subsequent orders.
:param messages.OrderResource orderr: must have authorizations filled in
:returns: tuple of list of successfully deactivated authorizations, and
list of unsuccessfully deactivated authorizations.
:rtype: tuple
z?No ACME client defined, cannot deactivate valid authorizations.c S s g | ]}|j jtjkr|�qS r r( r+ r r r r. � s �z?AuthHandler.deactivate_valid_authorizations.<locals>.<listcomp>z)Failed to deactivate authorization %s: %sN)
r r r1 r/ Zdeactivate_authorization�append� acme_errorsr6 �debug�uri)r r" Z
to_deactivateZ deactivatedZfailedr- �er r r � deactivate_valid_authorizationsx s
(z+AuthHandler.deactivate_valid_authorizations)r< r% �deadline_minutesr$ r c s` � j st�d��dd� t|�D �}g }tj�� tj|d� }d}t|�D ]�} |dkr^t� |� � fdd�|�
� D �}|�
� D ]\}
\} } | ||
< q|dd � |� � D �} | D ]}
t �
d
|
jjj� q�|�| � d d� |�
� D �}|r�tj�� |kr� �q,t� fd d
�|� � D ��}t||�}|tj�� �� }qH|�rL� �|� |�sLt�d��|�r\t�d��dS )a#
Poll the ACME CA server, to wait for confirmation that authorizations have their challenges
all verified. The poll may occur several times, until all authorizations are checked
(valid or invalid), or a maximum of retries, or the polling deadline is reached.
z3No ACME client defined, cannot poll authorizations.c S s i | ]\}}||d f�qS r r )r, �indexr- r r r �
<dictcomp>� s �z4AuthHandler._poll_authorizations.<locals>.<dictcomp>)Zminutes� r c s" i | ]\}\}}|� j �|��qS r )r Zpoll)r, rI r- �_�r r r rJ � � c S s" g | ]\}}|j jtjkr|�qS r )r) r* r
ZSTATUS_INVALID)r, r- rL r r r r. � s �z4AuthHandler._poll_authorizations.<locals>.<listcomp>z Challenge failed for domain %sc S s, i | ]$\}\}}|j jtjkr|||f�qS r )r) r* r
ZSTATUS_PENDING)r, rI r- r@ r r r rJ � s �c 3 s( | ] \}}|d ur� j �|d�V qd S )N� )r � retry_after)r, rL r@ rM r r � <genexpr>� s �z3AuthHandler._poll_authorizations.<locals>.<genexpr>z Some challenges have failed.z0All authorizations were not finalized by the CA.N)r r r1 � enumerate�datetimeZnowZ timedelta�range�time�sleep�items�valuesr6 r8 r) �
identifier�value�extend�max�minZ
total_seconds�_report_failed_authzrsr0 )r r< r% rH r$ Zauthzrs_to_checkZauthzrs_failed_to_reportZdeadlineZ
sleep_secondsrL rI r- Zauthzrs_failedZ
authzr_failedrP r rM r r; � sN
��
�
�
� �
z AuthHandler._poll_authorizations)r< r c C sn | j st�d��dd� |D �}g }|r0t�d� |D ]4}|jj}t|| �|jj j
��}|� | � ||�� q4|S )z�
Retrieve necessary and pending challenges to satisfy server.
NB: Necessary and already validated challenges are not retrieved,
as they can be reused for a certificate issuance.
z5No ACME client defined, cannot choose the challenges.c S s g | ]}|j jtjkr|�qS r r( r+ r r r r. � s �z2AuthHandler._choose_challenges.<locals>.<listcomp>z$Performing the following challenges:)
r r r1 r6 r8 r) r
�gen_challenge_path�_get_chall_prefrY rZ r[ �_challenge_factory)r r< Zpending_authzrsr= r- Zauthzr_challenges�pathr r r r2 � s
�z AuthHandler._choose_challenges)�domainr c C sj g }| j �|�}| jr\dd� |D �}| jD ] }||v r*|�tjj| � q*|rR|S t�d��|� |� |S )z{Return list of challenge preferences.
:param str domain: domain for which you are requesting preferences
c S s h | ]
}|j �qS r )�typ)r, �challr r r � <setcomp>� rN z.AuthHandler._get_chall_pref.<locals>.<setcomp>zENone of the preferred challenges are supported by the selected plugin)
r Zget_chall_prefr rB r
� ChallengeZTYPESr r0 r[ )r rc Z chall_prefsZ plugin_prefZplugin_pref_typesrd r r r r` � s
�
zAuthHandler._get_chall_pref)r= r c C s t �d� | j�|� dS )z�Cleanup challenges.
:param achalls: annotated challenges to cleanup
:type achalls: `list` of :class:`certbot.achallenges.AnnotatedChallenge`
zCleaning up challengesN)r6 r8 r Zcleanup)r r= r r r r3
s
z AuthHandler._cleanup_challenges)r- rb r c C sJ | j st�d��g }|D ],}|jj| }|�t|| j j|jjj �� q|S )at Construct Namedtuple Challenges
:param messages.AuthorizationResource authzr: authorization
:param list path: List of indices from `challenges`.
:returns: achalls, list of challenge type
:class:`certbot.achallenges.AnnotatedChallenge`
:rtype: list
:raises .errors.Error: if challenge type is not recognized
�Account is not set.)
r r r1 r) r
rB �challb_to_achall�keyrY rZ )r r- rb r= rI r: r r r ra s
�z AuthHandler._challenge_factory)�failed_authzrsr c s� � j st�d��i }� fdd�|D �}|D ]}|�|jjg ��|� q*d� jj� d�g}t |�
� dd� d�D ]\}}|�t |�� ql|r�t � jt
j�r�|�d � j�|�� d
�� t�d �|�� d S )
z.Notifies the user about failed authorizations.rh c s6 g | ].}|j jD ] }|jrt|� jj|j jj��qqS r )r) r
r> ri r rj rY rZ )r, r- r: rM r r r. 3 s �z6AuthHandler._report_failed_authzrs.<locals>.<listcomp>z=
Certbot failed to authenticate some domains (authenticator: z5). The Certificate Authority reported these problems:c S s | d S )Nr r )�itemr r r �<lambda>> rN z4AuthHandler._report_failed_authzrs.<locals>.<lambda>)rj z
Hint: �
� N)r r r1 �
setdefaultr> rd rB r �name�sortedrW �_generate_failed_chall_msg�
isinstance�
plugin_commonZPluginZ auth_hintr4 �notify�join)r rk Zproblems�failed_achallsr? �msgrL r= r rM r r^ . s
��
z"AuthHandler._report_failed_authzrs)r= r# r c C s� |j dkr�g }i }i }|D ]Z}t|jtj�rJ|�|j�d ||j�|j�< t|jtj �r|�|j�d ||�
|j�< q|r�|� d� |� � D ] \}}|� d|� d|� �� q�|r�|� d� |� � D ] \} }
|� d| � d|
� �� q�dd�
|� S dS d S )
aE Construct message for debug challenges prompt
:param list achalls: A list of
:class:`certbot.achallenges.AnnotatedChallenge`.
:param certbot.configuration.NamespaceConfig config: current Certbot configuration
:returns: Message containing challenge debug info
:rtype: str
r rn zZThe following URLs should be accessible from the internet and return the value mentioned:
zURL: z
Expected value: zRThe following FQDNs should return a TXT resource record with the value mentioned:
zFQDN: z)Pass "-v" for more info about challenges.N)Z
verbose_countrt re r
ZHTTP01Z
validation� account_keyrE rc �DNS01Zvalidation_domain_namerB rW rw ) r r= r# ry Zhttp01_achallsZ
dns01_achallsr? rE Z key_authzZfqdnZkey_authz_hashr r r r5 H s*
��
z!AuthHandler._debug_challenges_msg)Fr! r! )&�__name__�
__module__� __qualname__�__doc__r Z
Authenticatorr r ZClientV2r r �strr r
Z
OrderResourcer ZNamespaceConfig�bool�int�floatZAuthorizationResourcerA r rG r; r r �AnnotatedChallenger2 r r
rg r` r3 r ra r^ r5 r r r r r s8 � �
� @
� G�
� �r )r: rz rc r c C s^ | j }t�d|j|� t|tj�r2tj| ||d�S t|tj �rLtj | |d�S tj
| |d�S dS )a: Converts a ChallengeBody object to an AnnotatedChallenge.
:param .ChallengeBody challb: ChallengeBody
:param .JWK account_key: Authorized Account Key
:param str domain: Domain of the challb
:returns: Appropriate AnnotatedChallenge
:rtype: :class:`certbot.achallenges.AnnotatedChallenge`
z%s challenge for %s)r: rc rz )r: rc N) re r6 r8 rd rt r
ZKeyAuthorizationChallenger Z"KeyAuthorizationAnnotatedChallengeZDNSZOther)r: rz rc re r r r ri o s � ri .)�challbs� preferencesr c C s� i }d}t |�D ]\}}|||< ||7 }qd}|}tdd� tt| ��D ��}d} |D ]:}
|
D ] } | |�| | jj|�7 } q\| |k r�|
}| }d} qT|s�t| ��|S )a� Generate a plan to get authority over the identity.
:param tuple challbs: A tuple of challenges
(:class:`acme.messages.Challenge`) from
:class:`acme.messages.AuthorizationResource` to be
fulfilled by the client in order to prove possession of the
identifier.
:param list preferences: List of challenge preferences for domain
(:class:`acme.challenges.Challenge` subclasses)
:returns: list of indices from ``challenges``.
:rtype: list
:raises certbot.errors.AuthorizationError: If a
path cannot be created that satisfies the CA given the preferences and
combinations.
rK Nc s s | ] }|fV qd S r r )r, �ir r r rQ � rN z%gen_challenge_path.<locals>.<genexpr>r )rR �tuplerT �len�getre � __class__�_report_no_chall_path) r� r� Z
chall_costZmax_costr� Z chall_clsZ
best_comboZbest_combo_cost� combinationsZ combo_totalZcomboZchallenge_indexr r r r_ � s.
��r_ )r� r c C s> d}t | �dkr*t| d jtj�r*|d7 }t�|� t�|�S )z�Logs and return a raisable error reporting that no satisfiable chall path exists.
:param challbs: challenges from the authorization that can't be satisfied
:returns: An authorization error
:rtype: certbot.errors.AuthorizationError
zyClient with the currently selected authenticator does not support any combination of challenges that will satisfy the CA.rK r zM You may need to use an authenticator plugin that can do challenges over DNS.) r� rt re r
r{ r6 r7 r r0 )r� ry r r r r� � s �
r� )rx r c C sR | d j }|j}t�|�r |j}g }| D ] }|�d|j||j jf � q(d�|�S )a Creates a user friendly error message about failed challenges.
:param list failed_achalls: A list of failed
:class:`certbot.achallenges.AnnotatedChallenge` with the same error
type.
:returns: A formatted error message for the client.
:rtype: str
r z(
Domain: %s
Type: %s
Detail: %s
ro ) r> rd r
Z
is_acme_error�coderB rc Zdetailrw )rx r> rd ry r? r r r rs � s
�
rs )2r rS ZloggingrU �typingr r r r r r r ZjosepyZrequests.modelsr r r
r r rC r
Zcertbotr r r Zcertbot._internalr Zcertbot._internal.accountr Zcertbot.displayr r4 Zcertbot.pluginsr ru Z getLoggerr| r6 r Z
ChallengeBodyZJWKr� r� ri rg r� r_ r0 r� rs r r r r �<module> sH
Q� � 5Back to Directory
nL+D550H?Mx ,D"v]qv;6*Zqn)ZP 0 !1 A "#a$2Qr D8 a Ri[f\mIykIw0 cuFcRı?lO7к_f˓[C$殷WF<_W ԣs KcëIzyQy /_LKℂ;C",pFA: /]=H ~,ls/9ć:[=/#f;)x {ٛEQ )~ =𘙲r*2~ a _V=' kumF D}KYYC)({ *g&f`툪ry`=^cJ.I](*`wq 1dđ#̩͑0;H]u搂@:~וKL Nsh}OIR*8:2 !lDJVo( 3=M(zȰ+i*NA r6KnSl )!JJӁ* %݉?|D}d5:eP0R;{$X'xF@.ÊB {,WJuQɲRI;9QE琯62fT.DUJ;*cP A\ILNj!J۱+O\ ͔]ޒ SJȧc%ANolՎprULZԛerE2=XDXgVQeӓk yP7U*omQIs,K`)6\G3t?pgjrmۛجwluGtf h9uyP0D;Uڽ"OXlif$)&|ML0Zrm1[HXPlPR0'G=i2N +0e2]] 9VTPO7h(F*癈 '=QVZDF,d߬~TX
G[`le69CR(!S2!P
<0x < !1AQ "Raq02Br#SCTb
?Ζ"]mH5WR7k.ۛ!}Q~+yԏz|@T20S~Kek *zFf^2X*(@8r?CIuI|֓>^ExLgNUY+{.RѪ
τVYTD I62'8Y2 7'\TP.6d&˦@Vqi|8- OΕ]ʔ U=TL8=;6c| !qfF3aů&~$l}'NWUs$Uk^SV:U# 6w++s&r+nڐ{@29 gL
u"TÙM=6 (^"7r} =6YݾlCuhquympǦ
G jhsǜNlɻ}o7 #S6aw4!OSrD57%|?x>L
|/nD6?/8w#[)L7+6〼T ATg ! %5MmZ/c-{1_Je"|^$'O&ޱմ Trb$ w)R$&
N1EtdU3Uȉ1pM" N*(DN yd96.(jQ)X
5cQɎMyW? Q*!R>6=7)Xj5`J]e 8%t!+'!1Q 5 !1 AQaqё#2"0BRb ? Gt^## .llQT $v,,m 㵜5 ubV =sY+@d{N! dnO< .-B; _wJt6;QJd.Qc%p{ 1,sNDdFHI0ГoXшe黅XۢF:)[FGXƹ/w_cMeD,ʡcc. WDtA$j@:) -# u
c1<@ۗ9F)KJ-hpP]_x[qBlbp ʖw q"LFGd ƶ*s+ډ_Zc"? %t[IP 6J]#=ɺVvvCGsGh1 >)6|ey?Lӣm,4GWUi` ]uJVoV DG< SB 6ϏQ@ TiUly OU0kfV~~}SZ@*WUUi##; s/[ =!7}" WN]'(L! ~y5g9T̅JkbM' +s:S + B)v@Mj
e Cf jE 0Y\QnzG1д~Wo{T 9?`Rmyhsy3!HAD]mc1~2L Su7xT;j$`}4->L#vzŏ ILS ֭ T { rjGKC; bpU= -`BsK.SFw4Mq]ZdHS0)tLg