a oeH @s"dZddlZddlZddlZddlZddlmZddlmZddlmZddlm Z ddlm Z ddlm Z dd lm Z dd lm Z ddlZdd lmZdd lmZdd lmZddlmZddlmZddlmZddlmZddlmZeeZejddddZejddddZ ejddddZ!ejddddZ"eje#e ej$dddZ%eje#e e e#ddd Z&eje e#e e ej$e ej$fd!d"d#Z'ej$e#e e e#d$d%d&Z(e e eej$ge#feej$ge e e#ffd'd(d)Z)eje#d*d+d,Z*ejee eej$ge#feej$ge e e#ffeej$ge#feej$ge#fe e#d-d.d/Z+dEejej$e,e e#d1d2d3Z-dFeje#e,e e#e e#d4d5d6Z.ee#e#d7d8d9Z/ejeej$e#d:d;d<Z0ejeej$ee#dd=d>d?Z1e d@Z2ejedAe2fe2ee2dBdCdDZ3dS)Gz Tools for managing certificates.N)Any)Callable)Iterable)List)Optional)Tuple)TypeVar)Union) configuration) crypto_util)errors)ocsp)util)storage)os)configreturncCs$t|D]}tj||ddq dS)ajUpdate the certificate file family symlinks to use archive_dir. Use the information in the config file to make symlinks point to the correct archive directory. .. note:: This assumes that the installation is using a Reverter object. :param config: Configuration. :type config: :class:`certbot._internal.configuration.NamespaceConfig` T)Zupdate_symlinksN)rrenewal_conf_files RenewableCert)r renewal_filer?C:\Program Files\Certbot\pkgs\certbot\_internal\cert_manager.pyupdate_live_symlinks!s rcCst|dd}|j}|sHtjd|dd\}}|tjks>|sHtdt||}|sft d|t |||tj d||d d d S) zRename the specified lineage to the new name. :param config: Configuration. :type config: :class:`certbot._internal.configuration.NamespaceConfig` renamerz&Enter the new name for certificate {0}T)force_interactiveUser ended interaction.z,No existing certificate with name {0} found.z Successfully renamed {0} to {1}.F)pauseN) get_certnames new_certname display_utilZ input_textformatOKr Errorlineage_for_certnameZConfigurationErrorrZrename_renewal_config notification)rcertnamercodelineagerrrrename_lineage1s(   r(c Csg}g}t|D]v}z$t||}t|||Wqty}z4td||t dt ||WYd}~qd}~00qt |||dS)zDisplay information about certs configured with Certbot :param config: Configuration. :type config: :class:`certbot._internal.configuration.NamespaceConfig` zIRenewal configuration file %s produced an unexpected error: %s. Skipping.Traceback was: %sN) rrrr Zverify_renewable_certappend ExceptionloggerZwarningdebug traceback format_exc_describe_certs)r parsed_certsparse_failuresrZrenewal_candidateerrr certificatesKs  "r4cCst|ddd}dg}|D]}|d|q|d|dtjd|dd sbtd d S|D] }t||t d |qfd S) z;Delete Certbot files associated with a certificate lineage.deleteT)allow_multiplez8The following certificate(s) are selected for deletion: z * aP WARNING: Before continuing, ensure that the listed certificates are not being used by any installed server software (e.g. Apache, nginx, mail servers). Deleting a certificate that is still being used will cause the server software to stop working. See https://certbot.org/deleting-certs for information on deleting certificates safely.z: Are you sure you want to delete the above certificate(s)? )defaultz$Deletion of certificate(s) canceled.Nz.Deleted all files relating to certificate {0}.) rr*rZyesnojoinr,inforZ delete_filesnotifyr )r certnamesmsgr%rrrr5bs    r5) cli_configr%rc Cs|j}tj|ddzt||}Wntjy:YdS0zt||WStjtfyt d|t dt YdS0dS)z)Find a lineage object with name certname.modeNzRenewal conf file %s is broken.r)) renewal_configs_dirrmake_or_verify_dirrZrenewal_file_for_certnamer CertStorageErrorrIOErrorr,r-r.r/)r>r% configs_dirrrrrr#|s r#)rr%rcCst||}|r|SdS)z0Find the domains in the cert with name certname.N)r#names)rr%r'rrrdomains_for_certnames rH)rdomainsrcsPtjtttjttjftttjttjfdfdd }d}t|||S)aFind existing certs that match the given domain names. This function searches for certificates whose domains are equal to the `domains` parameter and certificates whose domains are a subset of the domains in the `domains` parameter. If multiple certificates are found whose names are a subset of `domains`, the one whose names are the largest subset of `domains` is returned. If multiple certificates' domains are an exact match or equally sized subsets, which matching certificates are returned is undefined. :param config: Configuration. :type config: :class:`certbot._internal.configuration.NamespaceConfig` :param domains: List of domain names :type domains: `list` of `str` :returns: lineages representing the identically matching cert and the largest subset if they exist :rtype: `tuple` of `storage.RenewableCert` or `None` )candidate_lineagervrcsb|\}}t|}|tkr&|}n4|trZ|durB|}nt|t|krZ|}||fS)zsReturn cert as identical_names_cert if it matches, or subset_names_cert if it matches as subset N)setrGissubsetlen)rJrKZidentical_names_certZsubset_names_certZcandidate_namesrIrrupdate_certs_for_domain_matchess   z?find_duplicative_certs..update_certs_for_domain_matches)NN)rrrr_search_lineages)rrIrPinitrrOrfind_duplicative_certss  rS)rJfiletypercs,|jfddtD}|r(|SdS)aJ In order to match things like: /etc/letsencrypt/archive/example.com/chain1.pem. Anonymous functions which call this function are eventually passed (in a list) to `match_and_check_overlaps` to help specify the acceptable_matches. :param `.storage.RenewableCert` candidate_lineage: Lineage whose archive dir is to be searched. :param str filetype: main file name prefix e.g. "fullchain" or "chain". :returns: Files in candidate_lineage's archive dir that match the provided filetype. :rtype: list of str or None cs,g|]$}td|rtj|qS)z {0}[0-9]*.pem)rematchr rpathr9).0f archive_dirrTrr sz"_archive_files..N)r[rlistdir)rJrTpatternrrZr_archive_filess r_)rcCsddddddddgS)z Generates the list that's passed to match_and_check_overlaps. Is its own function to make unit testing easier. :returns: list of functions :rtype: list cSs|jSN)Zfullchain_pathxrrrz%_acceptable_matches..cSs|jSr` cert_pathrarrrrcrdcSs t|dS)Ncertr_rarrrrcrdcSs t|dS)N fullchainrhrarrrrcrdrrrrr_acceptable_matchess  rj)r>rcs(t}t|fdddd}|dS)a If config.cert_path is defined, try to find an appropriate value for config.certname. :param `configuration.NamespaceConfig` cli_config: parsed command line arguments :returns: a lineage name :rtype: str :raises `errors.Error`: If the specified cert path can't be matched to a lineage name. :raises `errors.OverlappingMatchFound`: If the matched lineage's archive is shared. csjSr`rerar>rrrcrdz&cert_path_to_lineage..cSs|jSr`) lineagenamerarrrrcrdr)rjmatch_and_check_overlaps)r>acceptable_matchesrVrrkrcert_path_to_lineages ro)r>rn match_funcrv_funcrc stjttttttjgtfttjgtttffttdfdd }t||g|}|sxt d|j dnt |dkrt |S)a Searches through all lineages for a match, and checks for duplicates. If a duplicate is found, an error is raised, as performing operations on lineages that have their properties incorrectly duplicated elsewhere is probably a bad idea. :param `configuration.NamespaceConfig` cli_config: parsed command line arguments :param list acceptable_matches: a list of functions that specify acceptable matches :param function match_func: specifies what to match :param function rv_func: specifies what to return )rJ return_valuernrcsdfdd|D}g}|D]&}t|tr2||7}q|r||q}||vr`||S)z1Returns a list of matches using _search_lineages.csg|] }|qSrr)rXfuncrJrrr\rdzBmatch_and_check_overlaps..find_matches..) isinstancelistr*)rJrrrnZacceptable_matches_resolvedZacceptable_matches_rvitemrVrprqrtr find_matches s   z.match_and_check_overlaps..find_matcheszNo match found for cert-path !)rrrstrrr rrrQr r"rfrNZOverlappingMatchFound)r>rnrprqryZmatchedrrxrrms  rmF)rrgskip_filter_checksrc CsZg}t}|jr&|j|jkr&|s&dS|jrDt|j|sDdStj t j }g}|j rf| d|j|kr|| dn||r| d|rdd|}nF|j|}|jdkrd}n,|jdkrd |jd d }nd |jd }d |j|} tt|jd} | d|jd| d|jdd|d| d|jd|jd|S)zJ Returns a human readable description of info about a RenewableCert objectNZ TEST_CERTZEXPIREDZREVOKEDz INVALID: z, r{z VALID: 1 dayzVALID: iz hour(s)z daysz {0} ({1})rbz Certificate Name: z Serial Number: z Key Type: z Domains:  z Expiry Date: z Certificate Path: z Private Key Path: )r ZRevocationCheckerr%rlrIrLrMrGdatetimenowpytzZUTCZ is_test_certr*Z target_expiryZ ocsp_revokedr9ZdaysZsecondsr r Zget_serial_from_certrfZprivate_key_typeriZprivkey) rrgr}certinfoZcheckerrZreasonsstatusdiffZ valid_stringserialrrrhuman_readable_cert_info&sL         r)rverbr6 custom_promptrc Cs|j}|r|g}nt|}dd|D}|s8td|r||sLd|}n|}tj||ddd\} }| tjkrtdnZ|sd |}n|}tj ||ddd\} } | tjks| t d t |vrtd|| g}|S) z4Get certname from flag, interactively, or error out.cSsg|]}t|qSr)rZlineagename_for_filename)rXnamerrrr\Yrdz!get_certnames..zNo existing certificates found.z+Which certificate(s) would you like to {0}?z --cert-nameT)Zcli_flagrrz(Which certificate would you like to {0}?r) r%rrr r"r rZ checklistr!ZmenurangerN) rrr6rr%r< filenameschoicespromptr&indexrrrrQs4          r)msgsrcCsdddd|DS)zFFormat a results report for a category of single-line renewal outcomesz z css|]}t|VqdSr`)r|)rXr=rrr zrdz _report_lines..)r9)rrrr _report_linesxsr)rr1rcCs4g}|D] }t||}|dur||qd|S)z)Format a results report for a parsed certNr7)rr*r9)rr1rrgZ cert_inforrr_report_human_readable}s   r)rr1r2rcCsg}|j}|s|s|dnL|rP|js,|jr0dnd}|d||t|||rh|d|t|tjd|dddd S) z/Print information about the certs we know aboutzNo certificates found.z matching rzFound the following {0}certs:z3 The following renewal configurations were invalid:r7F)rwrapN) r*r%rIr rrrr$r9)rr1r2outr;rVrrrr0s  r0T.)r>rs initial_rvargsrc Gs|j}tj|dd|}t|D]`}zt||}Wn8tjtfynt d|t dt Yq"Yn0|||g|R}q"|S)aIterate func over unbroken lineages, allowing custom return conditions. Allows flexible customization of return values, including multiple return values and complex checks. :param `configuration.NamespaceConfig` cli_config: parsed command line arguments :param function func: function used while searching over lineages :param initial_rv: initial return value of the function (any type) :returns: Whatever was specified by `func` if a match is found. r?r@z)Renewal conf file %s is broken. Skipping.r)) rBrrCrrrr rDrEr,r-r.r/)r>rsrrrFrKrrJrrrrQs   rQ)F)FN)4__doc__rZloggingrUr.typingrrrrrrrr rZcertbotr r r r rZcertbot._internalrZcertbot.compatrZcertbot.displayrZ getLogger__name__r,ZNamespaceConfigrr(r4r5r|rr#rHrSr_rjrormboolrrrrr0rrQrrrrs                    5  *  +  '