
    M/euD              
          d Z ddlmZ ddlmZ ddlZddlZddlZddlZddlZddl	Z	ddl
mZ ddl
mZ ddl
mZ ddl
mZ dd	l
mZ dd
l
mZ ddl
mZ ddl
mZ ddl
mZ ddlmZ ddlmZ ddlmZ ddlmZ ddlmZ ddlmZ ddlmZ ddlmZ ddlm Z  ddlm!Z! ddl"m#Z$ ddl"m%Z& ddl'm(Z( ejR                  dk\  rddl*m+Z, nddl,Z, ejZ                  e.      Z/de0de0fdZ1de0de0fdZ2 ejf                  d       Z4 ejf                  d!ejj                        Z6 G d" d#e&e$      Z% G d% d&e$e%e$      Z# G d' d(e#ejn                  e$      Z8 ed)d*+      Z9 G d, d*      Z: G d- d.      Z;d/e0d0e0d1e0d2ee0   ddf
d3Z<d4e0d5e0dee0e0e0f   fd6Z=y)7zPlugin common functions.    )ABCMeta)abstractmethodN)Any)Callable)Iterable)List)Optional)Set)Tuple)Type)TypeVar)
challenges)achallenges)configuration)crypto_util)errors)
interfaces)reverter)	constants)
filesystem)os)	Installer)Plugin)PluginStorage)   	   namereturnc                     | dz   S )9ArgumentParser options namespace (prefix of all options).- r   s    8/usr/lib/python3/dist-packages/certbot/plugins/common.pyoption_namespacer%   *   s    #:    c                 ,    | j                  dd      dz   S );ArgumentParser dest namespace (prefix of all destinations).r!   _)replacer#   s    r$   dest_namespacer+   /   s    <<S!C''r&   zX(^127\.0\.0\.1)|(^10\.)|(^172\.1[6-9]\.)|(^172\.2[0-9]\.)|(^172\.3[0-1]\.)|(^192\.168\.)z3^(([a-z0-9]|[a-z0-9][a-z0-9\-]*[a-z0-9])\.)*[a-z]+$c                   &    e Zd ZdZdej
                  deddf fdZee	de
d   ddfd	              Zed
ej                  deddfd       Zedefd       ZdedefdZedefd       ZdedefdZdedefdZdeej0                     defdZ xZS )r   zGeneric plugin.configr   r   Nc                 B    t         |   ||       || _        || _        y N)super__init__r-   r   )selfr-   r   	__class__s      r$   r1   zPlugin.__init__>   s     &	r&   add).Nc                      y)zAdd plugin arguments to the CLI argument parser.

        :param callable add: Function that proxies calls to
            `argparse.ArgumentParser.add_argument` prepending options
            with unique plugin name prefix.

        Nr"   )clsr4   s     r$   add_parser_argumentszPlugin.add_parser_argumentsC   s    r&   parserc                 ^    dt         dt        dt        ddffd}| j                  |      S )zkInject parser options.

        See `~.certbot.interfaces.Plugin.inject_parser_options` for docs.

        arg_name_no_prefixargskwargsr   Nc                 d     j                   dj                  t              |       g|i | y )Nz--{0}{1})add_argumentformatr%   )r:   r;   r<   r   r8   s      r$   r4   z)Plugin.inject_parser_options.<locals>.addV   s:    F!!"24"8:LM!!!r&   )strr   r7   )r6   r8   r   r4   s    `` r$   inject_parser_optionszPlugin.inject_parser_optionsN   s7    	!C 	! 	!s 	!t 	! '',,r&   c                 ,    t        | j                        S )r    )r%   r   r2   s    r$   r%   zPlugin.option_namespace\   s      		**r&   c                      | j                   |z   S )z'Option name (include plugin namespace).)r%   )r2   r   s     r$   option_namezPlugin.option_namea   s    $$t++r&   c                 ,    t        | j                        S )r(   )r+   r   rC   s    r$   r+   zPlugin.dest_namespacee   s     dii((r&   varc                 @    | j                   |j                  dd      z   S )z.Find a destination for given variable ``var``.r!   r)   )r+   r*   r2   rG   s     r$   destzPlugin.destj   s      ""S[[c%:::r&   c                 L    t        | j                  | j                  |            S )z0Find a configuration value for variable ``var``.)getattrr-   rJ   rI   s     r$   confzPlugin.confp   s    t{{DIIcN33r&   failed_achallsc                     dj                  t        |D ch c]  }|j                   c}            }dj                  | j                  |      S c c}w )a9  Human-readable string to help the user troubleshoot the authenticator.

        Shown to the user if one or more of the attempted challenges were not a success.

        Should describe, in simple language, what the authenticator tried to do, what went
        wrong and what the user should try as their "next steps".

        TODO: auth_hint belongs in Authenticator but can't be added until the next major
        version of Certbot. For now, it lives in .Plugin and auth_handler will only call it
        on authenticators that subclass .Plugin. For now, inherit from `.Plugin` to implement
        and/or override the method.

        :param list failed_achalls: List of one or more failed challenges
                                    (:class:`achallenges.AnnotatedChallenge` subclasses).

        :rtype str:
        z and zThe Certificate Authority couldn't externally verify that the {name} plugin completed the required {challs} challenges. Ensure the plugin is configured correctly and that the changes it makes are accessible from the internet.)r   challs)joinsortedtypr?   r   )r2   rN   achallrP   s       r$   	auth_hintzPlugin.auth_hintt   sK    ( f~%NVfjj%NOP\ TYYv6	8 &Os   A)__name__
__module____qualname____doc__r   NamespaceConfigr@   r1   classmethodr   r   r7   argparseArgumentParserrA   propertyr%   rE   r+   rJ   r   rM   r   r   AnnotatedChallengerU   __classcell__r3   s   @r$   r   r   ;   s   }<< C D 
 x	': t    -8+B+B -# -RV - - +# + +, , , ) ) ); ; ;4 4 48[-K-K(L 8QT 8r&   r   )	metaclassc            	            e Zd ZdZdededdf fdZ	 ddee   ded	eddfd
Z	deddfdZ
ddZddZddeddfdZedefd       Zedefd       ZddZ xZS )r   zAn installer base class with reverter and ssl_dhparam methods defined.

    Installer plugins do not have to inherit from this class.

    r;   r<   r   Nc                     t        |   |i | t        | j                  | j                        | _        t        j                  | j                        | _        y r/   )r0   r1   r   r-   r   storager   Reverter)r2   r;   r<   r3   s      r$   r1   zInstaller.__init__   sA    $)&)$T[[$))< ))$++6r&   
save_files
save_notes	temporaryc                     |r| j                   j                  }n| j                   j                  }	  |||       y# t        j                  $ r#}t        j
                  t        |            d}~ww xY w)a  Add files to a checkpoint.

        :param set save_files: set of filepaths to save
        :param str save_notes: notes about changes during the save
        :param bool temporary: True if the files should be added to a
            temporary checkpoint rather than a permanent one. This is
            usually used for changes that will soon be reverted.

        :raises .errors.PluginError: when unable to add to checkpoint

        N)r   add_to_temp_checkpointadd_to_checkpointr   ReverterErrorPluginErrorr@   )r2   rg   rh   ri   checkpoint_funcerrs         r$   rl   zInstaller.add_to_checkpoint   s_     "mmBBO"mm==O	/J
3## 	/$$SX..	/s   	; A1A,,A1titlec                     	 | j                   j                  |       y# t        j                  $ r#}t        j                  t        |            d}~ww xY w)zTimestamp and save changes made through the reverter.

        :param str title: Title describing checkpoint

        :raises .errors.PluginError: when an error occurs

        N)r   finalize_checkpointr   rm   rn   r@   )r2   rq   rp   s      r$   rs   zInstaller.finalize_checkpoint   sD    	/MM--e4## 	/$$SX..	/    AAAc                     	 | j                   j                          y# t        j                  $ r#}t        j                  t        |            d}~ww xY w)zRevert all previously modified files.

        Reverts all modified files that have not been saved as a checkpoint

        :raises .errors.PluginError: If unable to recover the configuration

        N)r   recovery_routiner   rm   rn   r@   r2   rp   s     r$   rv   zInstaller.recovery_routine   sB    	/MM**,## 	/$$SX..	/    AAAc                     	 | j                   j                          y# t        j                  $ r#}t        j                  t        |            d}~ww xY w)zkRollback temporary checkpoint.

        :raises .errors.PluginError: when unable to revert config

        N)r   revert_temporary_configr   rm   rn   r@   rw   s     r$   rz   z!Installer.revert_temporary_config   sB    	/MM113## 	/$$SX..	/rx   rollbackc                     	 | j                   j                  |       y# t        j                  $ r#}t        j                  t        |            d}~ww xY w)zRollback saved checkpoints.

        :param int rollback: Number of checkpoints to revert

        :raises .errors.PluginError: If there is a problem with the input or
            the function is unable to correctly revert the configuration

        N)r   rollback_checkpointsr   rm   rn   r@   )r2   r{   rp   s      r$   r}   zInstaller.rollback_checkpoints   sD    	/MM..x8## 	/$$SX..	/rt   c                     t         j                  j                  | j                  j                  t
        j                        S )z(Full absolute path to ssl_dhparams file.)r   pathrQ   r-   
config_dirr   SSL_DHPARAMS_DESTrC   s    r$   ssl_dhparamszInstaller.ssl_dhparams   s)     ww||DKK22I4O4OPPr&   c                     t         j                  j                  | j                  j                  t
        j                        S )z:Full absolute path to digest of updated ssl_dhparams file.)r   r   rQ   r-   r   r   UPDATED_SSL_DHPARAMS_DIGESTrC   s    r$   updated_ssl_dhparams_digestz%Installer.updated_ssl_dhparams_digest   s)     ww||DKK22I4Y4YZZr&   c                     t        | j                  | j                  t        j                  t        j
                         y)zJCopy Certbot's ssl_dhparams file into the system's config dir if required.N)install_version_controlled_filer   r   r   SSL_DHPARAMS_SRCALL_SSL_DHPARAMS_HASHESrC   s    r$   install_ssl_dhparamszInstaller.install_ssl_dhparams   s.    ',,&&--		/r&   Fr   N)   )rV   rW   rX   rY   r   r1   r
   r@   boolrl   rs   rv   rz   intr}   r^   r   r   r   r`   ra   s   @r$   r   r      s    
7c 7S 7T 7 -2/CH /# /%)/6:/./ / //	//S / / Qc Q Q [S [ [/r&   r   c                       e Zd ZdZy)Configuratorzt
    A plugin that extends certbot.plugins.common.Installer
    and implements certbot.interfaces.Authenticator
    N)rV   rW   rX   rY   r"   r&   r$   r   r      s    r&   r   GenericAddrAddr)boundc                       e Zd ZdZddeeef   defdZede	e
   dedee
   fd       Zdefd	Zdeeef   fd
ZdedefdZdefdZdefdZdefdZde
dede
fdZdedee   fdZdefdZdedee   fdZy)r   zRepresents an virtual host address.

    :param str addr: addr part of vhost address
    :param str port: port number or \*, or ""

    tupipv6c                      || _         || _        y r/   )r   r   )r2   r   r   s      r$   r1   zAddr.__init__  s    	r&   r6   str_addrr   c                     |j                  d      rK|j                  d      }|d|dz    }d}t        |      |dz   kD  r||dz      dk(  r||dz   d } | ||fd	      S |j                  d      } | |d
   |d   f      S )zInitialize Addr from string.[]Nr       :T)r   r   )
startswithrfindlen	partition)r6   r   endIndexhostportr   s         r$   
fromstringzAddr.fromstring  s     s#~~c*HMX\*DD8}x!|+A0F#0M1.d|$//$$S)CAA'((r&   c                 \    | j                   d   rd| j                   z  S | j                   d   S )Nr   z%s:%sr   r   rC   s    r$   __str__zAddr.__str__  s*    88A;TXX%%xx{r&   c                 p    | j                   r| j                         | j                  d   fS | j                  S )z5Normalized representation of addr/port tuple
        r   )r   get_ipv6_explodedr   rC   s    r$   normalized_tuplezAddr.normalized_tuple   s0     99))+TXXa[88xxr&   otherc                 r    t        || j                        r!| j                         |j                         k(  S y)NF)
isinstancer3   r   )r2   r   s     r$   __eq__zAddr.__eq__'  s2    eT^^, ((*e.D.D.FFFr&   c                 ,    t        | j                        S r/   )hashr   rC   s    r$   __hash__zAddr.__hash__/  s    DHH~r&   c                      | j                   d   S )z Return addr part of Addr object.r   r   rC   s    r$   get_addrzAddr.get_addr2      xx{r&   c                      | j                   d   S )zReturn port.r   r   rC   s    r$   get_portzAddr.get_port6  r   r&   r2   r   c                 X    | j                  | j                  d   |f| j                        S )z6Return new address object with same addr and new port.r   )r3   r   r   )r2   r   s     r$   get_addr_objzAddr.get_addr_obj:  s$    ~~txx{D1499==r&   addrc                 h    |j                  d      }|j                  d      }| j                  |      S )z7Return IPv6 address in normalized form, helper functionr   r   )lstriprstrip_explode_ipv6)r2   r   s     r$   _normalize_ipv6zAddr._normalize_ipv6>  s/    {{3{{3!!$''r&   c                 v    | j                   r-dj                  | j                  | j                  d               S y)zReturn IPv6 in normalized formr   r   r   )r   rQ   r   r   rC   s    r$   r   zAddr.get_ipv6_explodedD  s.    9988D00!=>>r&   c                 B   g d}|j                  d      }t        |      t        |      kD  r|dt        |       }d}t        |      D ]T  \  }}|sd}t        |      dkD  r|j                  d      }|st	        |      ||<   ;t	        |      ||t        |      z
  <   V |S )z#Explode IPv6 address for comparison)0r   r   r   r   r   r   r   r   r   FTr   r   )splitr   	enumerater   r@   )r2   r   result	addr_listappend_to_endiblocks          r$   r   zAddr._explode_ipv6J  s    9JJsO	y>CK'!!CK0I!), 	6HAu !%5zA~S) Jq	 ,/u:qY'(	6 r&   Nr   )rV   rW   rX   rY   r   r@   r   r1   r[   r   r   r	   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r"   r&   r$   r   r     s    E#s(O 4  )[) )S )Xk=R ) ) 
%S/ C D # # # >; >c >k >(C (DI (3 # $s) r&   c                   t    e Zd ZdZdefdZ	 d
dej                  dee	   ddfdZ
deej                     fd	Zy)ChallengePerformerav  Abstract base for challenge performers.

    :ivar configurator: Authenticator and installer plugin
    :ivar achalls: Annotated challenges
    :vartype achalls: `list` of `.KeyAuthorizationAnnotatedChallenge`
    :ivar indices: Holds the indices of challenges from a larger array
        so the user of the class doesn't have to.
    :vartype indices: `list` of `int`

    configuratorc                 .    || _         g | _        g | _        y r/   )r   achallsindices)r2   r   s     r$   r1   zChallengePerformer.__init__o  s    (MO"$r&   NrT   idxr   c                 v    | j                   j                  |       || j                  j                  |       yy)zStore challenge to be performed when perform() is called.

        :param .KeyAuthorizationAnnotatedChallenge achall: Annotated
            challenge.
        :param int idx: index to challenge in a larger array

        N)r   appendr   )r2   rT   r   s      r$   	add_challzChallengePerformer.add_challt  s2     	F#?LL$ r&   c                     t               )zPerform all added challenges.

        :returns: challenge responses
        :rtype: `list` of `acme.challenges.KeyAuthorizationChallengeResponse`


        )NotImplementedErrorrC   s    r$   performzChallengePerformer.perform  s     "##r&   r/   )rV   rW   rX   rY   r   r1   r   "KeyAuthorizationAnnotatedChallenger	   r   r   r   r   !KeyAuthorizationChallengeResponser   r"   r&   r$   r   r   c  sU    	%\ % (,% N N %}%04%$jJJK $r&   r   	dest_pathdigest_pathsrc_path
all_hashesc                    	 t        j                        	d	fdd fd}t        j                  j	                         s |        yt        j                         }|	k(  ry||v r |        yt        j                  j	                        r+t        d      5 }|j                         }ddd       	k(  ry         t        j                  d         y# 1 sw Y   /xY w)a  Copy a file into an active location (likely the system's config dir) if required.

       :param str dest_path: destination path for version controlled file
       :param str digest_path: path to save a digest of the file in
       :param str src_path: path to version controlled file found in distribution
       :param list all_hashes: hashes of every released version of the file
    Nc                  j    t        d      5 } | j                         d d d        y # 1 sw Y   y xY w)Nw)openwrite)file_hcurrent_hashr   s    r$   _write_current_hashz<install_version_controlled_file.<locals>._write_current_hash  s0    +s# 	'vLL&	' 	' 	's   )2c                  @    t        j                                   y r/   )shutilcopyfile)r   r   r   s   r$   _install_current_filez>install_version_controlled_file.<locals>._install_current_file  s    ),r&   rzh%s has been manually modified; updated file saved to %s. We recommend updating %s for security purposes.r   )	r   	sha256sumr   r   isfiler   readloggerwarning)
r   r   r   r   r   active_file_digestfsaved_digestr   r   s
   ```     @@r$   r   r     s     ((2L'
 77>>)$ %..y9\)Z' 77>>+&k3' (1 vvx( |+ 	 Kx	,( (s   #C""C+test_dirpkgc                 Z   dt         dt         fd} |d      } |d      } |d      }t        j                  |t        j                         t        j                  |t        j                         t        j                  |t        j                         t        j                  |      j                  d      j                  |       }t        j                  |      5 }t        j                  |t        j                  j                  ||       d	       d
d
d
       |||fS # 1 sw Y   xY w)z5Setup the directories necessary for the configurator.prefixr   c                 R    t        j                  t        j                  |             S )a  Return the real path of a temp directory with the specified prefix

        Some plugins rely on real paths of symlinks for working correctly. For
        example, certbot-apache uses real paths of configuration files to tell
        a virtual host from another. On systems where TMP itself is a symbolic
        link, (ex: OS X) such plugins will be confused. This function prevents
        such a case.
        )r   realpathtempfilemkdtemp)r   s    r$   expanded_tempdirz#dir_setup.<locals>.expanded_tempdir  s      ""8#3#3F#;<<r&   tempr-   worktestdataT)symlinksN)r@   r   chmodr   CONFIG_DIRS_MODEimportlib_resourcesfilesjoinpathas_filer   copytreer   r   rQ   )r   r   r   temp_dirr   work_dirtest_dir_refr   s           r$   	dir_setupr    s    	= 	= 	=  'H!(+J'HXy99:Z!;!;<Xy99:&,,S1:::FOOPXYL		$	$\	2 Cd"'',,x2T	CC Z))	C Cs   7D!!D*)>rY   abcr   r   r\   loggingrer   sysr   typingr   r   r   r   r	   r
   r   r   r   acmer   certbotr   r   r   r   r   r   certbot._internalr   certbot.compatr   r   certbot.interfacesr   AbstractInstallerr   AbstractPlugincertbot.plugins.storager   version_infoimportlib.resources	resourcesr  	getLoggerrV   r   r@   r%   r+   compileprivate_ips_regex
IGNORECASEhostname_regexAuthenticatorr   r   r   r   r   r  r"   r&   r$   <module>r"     s        	  
             !     ' %  = 7 1v5			8	$3 3 
( ( (
 BJJ78  :BMMKQ8^w Q8he/!6W e/P9j66'  m62_ _D&$ &$R,,s ,, ,,PS ,,08,,BF,,f* *# *%S#*> *r&   