a ‚oe·2ã@spdZddlZddlZddlmZddlmZddl Z ddl Z ddl Z ddl Z ddl mZddl mZddl mZddl mZddl mZddl mZdd l mZdd l mZdd lmZdd lmZdd lmZddlmZe  e¡ZGdd„de jƒZ Gdd„dƒZ!Gdd„dƒZ"Gdd„de e!ƒZ#Gdd„dej$ƒZ$Gdd„de$e!ƒZ%Gdd„de"ƒZ&Gdd„dej'ƒZ(dS)z1Support for standalone client challenge solvers. éN)ÚAny)Úcast)ÚList)ÚMapping)ÚOptional)ÚSet)ÚTuple)ÚType)Úcrypto)ÚSSL)Ú challenges)Ú crypto_utilcsheZdZdZeeddœ‡fdd„ Zddœdd„Zeje e e j e j fd œd d „Zddœd d „Z‡ZS)Ú TLSServerzGeneric TLS Server.N©ÚargsÚkwargsÚreturncsh| dd¡|_|jrtj|_ntj|_| di¡|_| dtj¡|_ | dd¡|_ t ƒj |i|¤ŽdS)NÚipv6FÚcertsÚmethodÚallow_reuse_addressT) ÚpoprÚsocketÚAF_INET6Úaddress_familyÚAF_INETrr Z_DEFAULT_SSL_METHODrrÚsuperÚ__init__©Úselfrr©Ú __class__©ú0C:\Program Files\Certbot\pkgs\acme\standalone.pyrs zTLSServer.__init__©rc Cs.ttjtj|j|jt|ddƒ|jd�ƒ|_dS)NÚ_alpn_selection)Zcert_selectionZalpn_selectionr)rrr Z SSLSocketÚ_cert_selectionÚgetattrr©rr"r"r#Ú _wrap_sock*s   ýzTLSServer._wrap_sock©Ú connectionrcCs| ¡}|r|j |d¡SdS)z.Callback selecting certificate for connection.N)Úget_servernamerÚget©rr+Z server_namer"r"r#r&0szTLSServer._cert_selectioncCs| ¡tj |¡S©N)r)Ú socketserverÚ TCPServerÚ server_bindr(r"r"r#r28szTLSServer.server_bind)Ú__name__Ú __module__Ú __qualname__Ú__doc__rrr)r Ú Connectionrrr ÚPKeyÚX509r&r2Ú __classcell__r"r"r r#rs ÿ rc@seZdZdZdZdZdS)ÚACMEServerMixinz"ACME server common settings mixin.z'ACME client standalone challenge solverTN)r3r4r5r6Úserver_versionrr"r"r"r#r;=sr;c@sjeZdZdZeejeee fe e ddœdd„Z ddœdd„Z e eee fdœd d „Zddœd d „ZdS) ÚBaseDualNetworkedServersaBase class for a pair of IPv6 and IPv4 servers that tries to do everything it's asked for both servers, but where failures in one server don't affect the other. If two servers are instantiated, they will serve on the same port. N)Ú ServerClassÚserver_addressÚremaining_argsrrc Os2|d}g|_g|_d}dD]ò}z`||d<|df|f|dd…}|f|} || i|¤Ž} t d|d|d|rxdnd¡Wnrtjyò} zX| }|jr¾t d |d|d|r¶dnd¡n t d |d|d|rØdnd¡WYd} ~ qd} ~ 00|j | ¡| j ¡d}q|j�s.|�r$|‚n t d ¡‚dS) Né)TFrréz$Successfully bound to %s:%s using %sZIPv6ZIPv4z‚Certbot wasn't able to bind to %s:%s using %s, this is often expected due to the dual stack nature of IPv6 socket implementations.z Failed to bind to %s:%s using %szCould not bind to IPv4 or IPv6.)ÚthreadsÚserversÚloggerÚdebugrÚerrorÚappendÚ getsockname) rr>r?r@rÚportZlast_socket_errZ ip_versionZ new_addressÚnew_argsÚserverÚer"r"r#rLs@  þ  ûþ z!BaseDualNetworkedServers.__init__r$cCs2|jD]&}tj|jd�}| ¡|j |¡qdS)z*Wraps socketserver.TCPServer.serve_forever)ÚtargetN)rDÚ threadingÚThreadÚ serve_foreverÚstartrCrH©rrLÚthreadr"r"r#rQ~s  ÿz&BaseDualNetworkedServers.serve_forevercCsdd„|jDƒS)z/Wraps socketserver.TCPServer.socket.getsocknamecSsg|]}|j ¡‘qSr")rrI)Ú.0rLr"r"r#Ú ˆóz9BaseDualNetworkedServers.getsocknames..)rDr(r"r"r#Ú getsocknames†sz%BaseDualNetworkedServers.getsocknamescCs:|jD]}| ¡| ¡q|jD] }| ¡q"g|_dS)zpWraps socketserver.TCPServer.shutdown, socketserver.TCPServer.server_close, and threading.Thread.joinN)rDZshutdownZ server_closerCÚjoinrSr"r"r#Úshutdown_and_server_closeŠs     z2BaseDualNetworkedServers.shutdown_and_server_close)r3r4r5r6r r0r1rÚstrÚintrrrQrrXrZr"r"r"r#r=Dsÿ 2r=c@s’eZdZdZdZdeeefeee j e j fe e ee j e j ffeddœdd„Zejeee j e j fdœd d „Zejee e d œd d „ZdS)ÚTLSALPN01ServerzTLSALPN01 Server.s acme-tls/1FN)r?rÚchallenge_certsrrcCs tj||tj||d�||_dS)N)rr)rrr0ZBaseRequestHandlerr^)rr?rr^rr"r"r#ršs  þzTLSALPN01Server.__init__r*cCs&| ¡}|r"t d|¡|j|SdS)Nz)Serving challenge cert for server name %s)r,rErFr^r.r"r"r#r&¦s   zTLSALPN01Server._cert_selection)Ú _connectionÚ alpn_protosrcCsBt|ƒdkr.|d|jkr.t d|j¡|jSt dt|ƒ¡dS)z!Callback to select alpn protocol.rArzAgreed on %s ALPNz#Cannot agree on ALPN proto. Got: %srW)ÚlenÚACME_TLS_1_PROTOCOLrErFr[)rr_r`r"r"r#r%µs zTLSALPN01Server._alpn_selection)F)r3r4r5r6rbrr[r\rr r8r9rÚbytesÚboolrr r7rr&r%r"r"r"r#r]•sý ý ÿr]cs*eZdZdZeeddœ‡fdd„ Z‡ZS)Ú HTTPServerzGeneric HTTP Server.Nrcs<| dd¡|_|jrtj|_ntj|_tƒj|i|¤ŽdS)NrF)rrrrrrrrrr r"r#rÃs  zHTTPServer.__init__©r3r4r5r6rrr:r"r"r r#reÀsrecs>eZdZdZdeeefeej e eddœ‡fdd„ Z ‡Z S) Ú HTTP01ServerzHTTP01 Server.FéN)r?Ú resourcesrÚtimeoutrcs tƒj|tj||d�|d�dS)N©Úsimple_http_resourcesrj)r)rrÚHTTP01RequestHandlerÚ partial_init)rr?rirrjr r"r#rÏs ÿþzHTTP01Server.__init__)Frh) r3r4r5r6rr[r\rr ÚHTTP01rdrr:r"r"r r#rgÌs ÿÿrgcs*eZdZdZeeddœ‡fdd„ Z‡ZS)ÚHTTP01DualNetworkedServersz`HTTP01Server Wrapper. Tries everything for both. Failures for one don't affect the other.Nrcstƒjtg|¢Ri|¤ŽdSr/)rrrgrr r"r#rÚsz#HTTP01DualNetworkedServers.__init__rfr"r"r r#rpÖsrpcs¼eZdZdZe dd¡Zeeddœ‡fdd„ Ze e dœd d „ƒZ e edd œd d „Z ddœdd„Zddœdd„Zddœdd„Zddœdd„Zddœdd„Zeeeje ddœdd„ƒZ‡ZS)rmzÍHTTP01 challenge handler. Adheres to the stdlib's `socketserver.BaseRequestHandler` interface. :ivar set simple_http_resources: A set of `HTTP01Resource` objects. TODO: better name? ÚHTTP01Resourcezchall response validationNrcs8| dtƒ¡|_| dd¡|_tƒj|i|¤Ž|dS)Nrlrjrh)rÚsetrlÚ_timeoutrrrr r"r#rêszHTTP01RequestHandler.__init__r$cCs|jS)z� The default timeout this server should apply to requests. :return: timeout to apply :rtype: int )rsr(r"r"r#rjöszHTTP01RequestHandler.timeout)ÚformatrrcGst d|jd||¡dS)zLog arbitrary message.z %s - - %srN)rErFZclient_address)rrtrr"r"r#Ú log_messageÿsz HTTP01RequestHandler.log_messagecCs| d¡tj |¡dS)zHandle request.zIncoming requestN)ruÚBaseHTTPServerÚBaseHTTPRequestHandlerÚhandler(r"r"r#rxs zHTTP01RequestHandler.handlecCs>|jdkr| ¡n&|j dtjj¡r2| ¡n| ¡dS)Nú/)ÚpathÚ handle_indexÚ startswithr roZ URI_ROOT_PATHÚhandle_simple_http_resourceÚ handle_404r(r"r"r#Údo_GETs    zHTTP01RequestHandler.do_GETcCs6| d¡| dd¡| ¡|j |jj ¡¡dS)zHandle index page.éÈz Content-Typeú text/htmlN)Ú send_responseÚ send_headerÚ end_headersÚwfileÚwriterLr<Úencoder(r"r"r#r{s  z!HTTP01RequestHandler.handle_indexcCs4|jtjdd�| dd¡| ¡|j d¡dS)zHandler 404 Not Found errors.z Not Found)Úmessagez Content-typer�s404N)r‚Ú http_clientZ NOT_FOUNDrƒr„r…r†r(r"r"r#r~s zHTTP01RequestHandler.handle_404cCsv|jD]R}|jj|jkr| d|j d¡¡| tj¡| ¡|j   |j  ¡¡dSq| d¡| d|j¡dS)z$Handle HTTP01 provisioned resources.zServing HTTP01 with token %rÚtokenNzNo resources to servez0%s does not correspond to any resource. ignoring) rlZchallrzrur‡r‚r‰ZOKr„r…r†Z validation)rÚresourcer"r"r#r}s  ÿ  ÿz0HTTP01RequestHandler.handle_simple_http_resourcez'functools.partial[HTTP01RequestHandler])rlrjrcCstj|||d�S)z¿Partially initialize this handler. This is useful because `socketserver.BaseServer` takes uninitialized handler and initializes it with the current request. rk)Ú functoolsÚpartial)Úclsrlrjr"r"r#rn-s þz!HTTP01RequestHandler.partial_init)r3r4r5r6Ú collectionsÚ namedtuplerqrrÚpropertyr\rjr[rurxrr{r~r}Ú classmethodrr rornr:r"r"r r#rmÞs"ÿ ÿrm))r6r�rŒZ http.clientZclientr‰Z http.serverrLrvZloggingrr0rOÚtypingrrrrrrrr ZOpenSSLr r Zacmer r Z getLoggerr3rEr1rr;r=r]rergrprwrmr"r"r"r#Ús:               !Q+