M/ep> d Z ddlZddlZddlZddlZddlmZ ddlmZ ddlmZ ddlm Z ddlm
Z
ddlm Z dd lm Z dd
lm
Z
dd lmZ dd lmZ dd
lmZ ddlmZ ddlmZ ddlmZ ddlmZ ddlmZ ddlmZ ddlm Z ddlm Z ddl m Z ddl m Z! ddl"m#Z# ddl"m Z ddl$m%Z% ejL e' Z(dZ)dd gZ* G d d e#jV ejX Z, G d d ejZ Z. G d! d"ejZ Z/d#e0d$e0fd%Z1y)&zWebroot plugin. N)Any)Callable) DefaultDict)Dict)Iterable)List)Optional)Sequence)Set)Type)Union)
challenges) crypto_util)errors)
interfaces)cli)AnnotatedChallenge)
filesystem)os)ops)util)common) safe_opena!
@20c5ca1bd58fa8ad5f07a2f1be8b7cbb707c20fcb607a8fc8db9393952846a97@8d31383d3a079d2098a9d0c0921f4ab87e708b9868dc3f314d54094c2fe70336c e Zd ZdZdZdZdefdZede d ddfd Z
d
e e defd Z
d edeeej" fd
Zdededdf fd Zd dZde e de ej, fdZdee ddfdZd ede e dee fdZd ede e dee fdZd!d ede dee fdZ d dZ ded e defd Z d e dej, fd Z de e ddfd Z! xZ"S )"
AuthenticatorzWebroot Authenticator.zSaves the necessary validation files to a .well-known/acme-challenge/ directory within the nominated webroot path. A seperate HTTP server must be running and serving files from the webroot path. HTTP challenge only (wildcards not supported).zAuthenticator plugin that performs http-01 challenge by saving
necessary validation resources to appropriate paths on the file
system. It expects that there is some other HTTP server configured
to serve all files under specified web root ({0}).returnc V | j j | j d S )Npath) MORE_INFOformatconfselfs C/usr/lib/python3/dist-packages/certbot/_internal/plugins/webroot.py more_infozAuthenticator.more_infoF s ~~$$TYYv%677 add).NNc F |ddg t d |di t d y )Nr z-wa public_html / webroot path. This can be specified multiple times to handle different domains; each domain will have the webroot path that preceded it. For instance: `-w /var/www/example -d example.com -d www.example.com -w /var/www/thing -d thing.net -d m.thing.net` (default: Ask))defaultactionhelpmapa JSON dictionary mapping domains to webroot paths; this implies -d for each entry. You may need to escape this from your shell. E.g.: --webroot-map '{"eg1.is,m.eg1.is":"/www/eg1/", "eg2.is":"/www/eg2"}' This option is merged with, but takes precedence over, -w / -d entries. At present, if you put webroot-map in a config file, it needs to be on a single line, like: webroot-map = {"example.com":"/var/www"}.)_WebrootPathAction_WebrootMapAction)clsr) s r& add_parser_argumentsz"Authenticator.add_parser_argumentsI s0 FD"-?N O E2&7/ 0r( failed_achallsc y)NzThe Certificate Authority failed to download the temporary challenge files created by Certbot. Ensure that the listed domains serve their content from the provided --webroot-path/-w and that files created there can be downloaded from the internet. )r% r3 s r& auth_hintzAuthenticator.auth_hint[ s %r( domainc $ t j gS N)r HTTP01)r% r7 s r& get_chall_prefz Authenticator.get_chall_prefa s !!""r( argskwargsc | t | |i | i | _ t j t
| _ g | _ y r9 )super__init__
full_roots collections defaultdictset performed
_created_dirsr% r< r= __class__s r& r@ zAuthenticator.__init__e s7
$)&)*,DOD[D[\_D`(*r( c y r9 r5 r$ s r& preparezAuthenticator.preparel s r( achallsc | j | | j |D cg c] }| j | c}S c c}w r9 )
_set_webroots_create_challenge_dirs_perform_single)r% rK achalls r& performzAuthenticator.performo s; 7# ##%;BC$$V,CCCs Ac f | j d r]| j d d }t j d| |D ]- }| j d j |j | / y t t
| j d j }|D ]~ }|j | j d vs!| j |j | } |j | |j d| || j d |j < y # t $ r Y >w xY w)Nr z4Using the webroot path %s for all unmatched domains.r. r ) r# loggerinfo
setdefaultr7 listrD values_prompt_for_webrootremove
ValueErrorinsert)r% rK webroot_pathrP known_webroots new_webroots r& rM zAuthenticator._set_webrootsv s 99V 99V,R0L KKN$
&!
I % ++FMM<H
I "#dii&6&=&=&?"@ AN!
B== %(88"&":":6==;I#KK &--k: #))![96ADIIe$V]]3
B & s D$$ D0/D0r^ c d }|=|r&| j || }|$| j | }n| j |d }|=|S )NT)_prompt_with_webroot_list_prompt_for_new_webroot)r% r7 r^ webroots r& rY z!Authenticator._prompt_for_webroot sX o 88 P? " : :6 BG 66vtD o r( c d| j d z } t j dj | dg|z |d \ }}|t j k( rt j d |dk( rd S ||d z
S )
Nz--r TzSelect the webroot for {0}:zEnter a new webroot)cli_flagforce_interactiveIEvery requested domain must have a webroot when using the webroot plugin.r ) option_name display_utilmenur" CANCELr PluginError)r% r7 r^ path_flagcodeindexs r& ra z'Authenticator._prompt_with_webroot_list s 4++F33 &++-44V<&'.8"d > !A:4 D>%!)+D Dr(
allowraisec t j t dj | d \ }}|t j
k( r|sy t
j d t | S )NzInput the webroot for {0}:T)rf rg )r validated_directory_validate_webrootr" rj rl r rm )r% r7 rq ro rc s r& rb z%Authenticator._prompt_for_new_webroot se // ( / / 7 "$
g <&& & $$9:
: !))r( c
| j d }|st j d |j D ]" \ }}t j
j
|t j
j t j j | j |< t j d| j | t j d 5 t! t# j$ | j | d d t& D ]o }t j
j) | r# t j* |d | j, j/ | t j0 ||ddd q d d d t j: rct j
j
| j | d
}t j
j= | r%t j? d| j | t j? d| j | tA |dd 5 }|jC tD d d d % y # t2 t4 f$ r6}t j7 d
t j d | Y d }~!d }~ww xY w# t2 $ r*}t j d j9 || d }~ww xY w# 1 sw Y ^xY w# 1 sw Y xY w)Nr. zMissing parts of webroot configuration; please set either --webroot-path and --domains, or --webroot-map. Run with --help webroot for examples.z-Creating root challenges validation dir at %s rS )keyi T) copy_user
copy_groupz3Unable to change owner and uid of webroot directory
Error was: %sz=Couldn't create root for {0} http-01 challenge responses: {1}
web.configzPA web.config file has not been created in %s because another one already exists.zGCreating a web.config file in %s to allow IIS to serve challenge files.w modechmod)#r# r rm itemsr r joinnormcaser r:
URI_ROOT_PATHrA rT debugr
temp_umasksortedr get_prefixeslenisdirmkdirrF append copy_ownership_and_apply_modeOSErrorAttributeErrorwarningr"
POSIX_MODEexistsrU r write_WEB_CONFIG_CONTENT)r% path_mapnamer prefix exceptionweb_config_path
web_configs r& rN z$Authenticator._create_challenge_dirs s 99U#$$01
1 #..* . :JD$$&GGLLrww7G7G!!//81 %2DOOD ! LLH .
0 &&u-
P %T%6%6tt7L%Mcr%RX[ \ PFww}}V, !P
#((7 **11&9E & D D $fetPT VP
P8 (("$'',,tt/Dl"S77>>/2KK !IJN//Z^J_a 89= 9NP SF :* $$%89: :[. :6 !( 8 E "NN+` a "LL ) D DE # P $ 0 0 77=vdI7N P PP+
P
PH: :sa AK 31J(%I ?K >K+ J% /+J J( J% %J(( K 1%K K K K( +K5 root_pathrP c t t j j ||j j d S )Ntoken)r r r challencode)r% r rP s r& _get_validation_pathz"Authenticator._get_validation_path s& ww||Iv||':':7'CDDr( c |j \ }}| j |j }| j || }t j d| t
j d 5 t |dd 5 }|j |j d d d d d d | j | j | |S # 1 sw Y 1xY w# 1 sw Y 5xY w)Nz#Attempting to save validation to %srv wbr} r~ )
response_and_validationrA r7 r rT r r r r r r rE r) )r% rP response
validationr validation_pathvalidation_files r& rO z Authenticator._perform_single s % = = ? *OOFMM2 33IvF :OL
"
"5
) ;?UC
; %%j&7&7&9:
; ;
y!%%f-
;
; ; ;s$ *C9 C C C CC c |D ]8 }| j j |j d }|-| j || }t j d| t
j | | j | j | t j rt j j |d }t j j | st j | }|t v r-t j# d| t
j | #t j# d| ; g }| j$ r=| j$ j' } t
j( | | j$ r=|| _ t j d y # t* $ rH} |j- d| t j# d| t j d| Y d } ~ vd } ~ ww xY w) Nz Removing %sr{ z4Cleaning web.config file generated by Certbot in %s.zQNot cleaning up the web.config file in %s because it is not generated by Certbot.r z3Challenge directory %s was not empty, didn't removerz zAll challenges cleaned up)rA getr7 r rT r r rZ rE r r r r r r sha256sum_WEB_CONFIG_SHA256SUMSrU rF poprmdirr r\ )
r% rK rP r r r r not_removedr excs
r& cleanupzAuthenticator.cleanup s ^F ++FMM4@I$"&";";Iv"N ]O< /*y)008!,,&(ggll9l&KOww~~o6$/$9$9/$J $(>> "KK(^(1 3 IIo 6 "KK )RS\ ^# ^( "$ %%))+D
3 ) 01
3""1d+ QSWX _c22
3s (F' ' G80>G33G8)r N)F)#__name__
__module__ __qualname____doc__ descriptionr! strr' classmethodr r2 r r r6 r r r Challenger; r r@ rJ ChallengeResponserQ rM r rY ra boolrb rN r rO r
__classcell__rH s @r& r r 8 s @K
6I 83 8 0x ': 0t 0 0"&-?(@ &S & #S #Xd:;O;O6P-Q #+c +S +T +
Dt$6 7 DDA]A]<^ DBX.@%A Bd B,
#
tCy
XVY]
E
E26s)
E@H
E *c *t *PXY\P] *5:nEc E;M ERU E
&8
Z=Y=Y
2t$6 7 2D 2r( r c p e Zd ZdZ d dej
dej deee e
df de e ddf
dZ y)
r0 z%Action class for parsing webroot_map.Nparser namespace webroot_map
option_stringr c |y t j t | j D ]H \ }t |j
j
fdt j || D J y )Nc 3 & K | ] }|f
y wr9 r5 ).0dr] s r& z-_WebrootMapAction.__call__.., s )P&'L!)Ps ) jsonloadsr r rt r updater add_domains)r% r r r r domainsr] s @r& __call__z_WebrootMapAction.__call__% st %)ZZK0@%A%G%G%I P !G\,\:L ! ! ( ( )P+.??9g+N)P
P Pr( r9 )
r r r r argparseArgumentParser Namespacer
r r
r r r r5 r( r& r0 r0 " s[ / 15Px 6 6 P8CUCU P #C# $< =P (
P9=Pr( r0 c e Zd ZdZdededdf fd Z d dej dej d e e
e e df d
e e
ddf
d Z
xZS )
r/ z&Action class for parsing webroot_path.r< r= r Nc 2 t | |i | d| _ y )NF)r? r@ _domain_before_webrootrG s r& r@ z_WebrootPathAction.__init__3 s
$)&)&+#r( r r r] r c ^ |y | j rt j d |j r=|j d }|j D ] }|j
j
|| n|j rd| _ |j j t t | y )NzPIf you specify multiple webroot paths, one of them must precede all domain flagsrS T)
r r rm r] r r rV r rt r )r% r r r] r prev_webrootr7 s r& r z_WebrootPathAction.__call__7 s & &$$<=
= ! ! %11"5L#++
G%%00 F
G
*.D ' %%&7L8I&JKr( r9 )r r r r r r@ r r r r
r r
r r r r s @r& r/ r/ 0 sv 0,c ,S ,T , 15Lx 6 6 L8CUCU L $S(3-%= >L (
L9=Lr( r/ r] r c t j j | st j | dz t j j | S )zValidates and returns the absolute path of webroot_path.
:param str webroot_path: path to the webroot directory
:returns: absolute path of webroot_path
:rtype: str
z% does not exist or is not a directory)r r r r rm abspath)r] s r& rt rt M s> 77== & 0W!WXX
77??< ((r( )2r r rB r loggingtypingr r r r r r r r
r r r
acmer certbotr r r certbot._internalr certbot.achallengesr certbot.compatr r certbot.displayr r rj certbot.pluginsr certbot.utilr getLoggerr rT r r Pluginr Actionr0 r/ r rt r5 r( r& r s ! 2 % 0 " " 8 $ GF g2FMM:#;#; g2T P P L L: )C )C )r(