Your IP : 216.73.216.172
U
�]�I � @ s d Z ddlZddlZddlZddlZddlmZ ddlmZ ddlm Z
ddl m Z m
Z
mZ ddlmZ ddlm Z ddlmZ dd lmZ e�e�ZG d
d � d e�Zd d
� Zdd� Zdd� Zdd� Zdd� Z dZ e d e d dde d e e d �Z d d � Z d d � Z dS )!zACME AuthHandler.� N)�
challenges)�messages)�errors)�Dict�List�Tuple)� achallenges)�
error_handler)�
interfacesc @ sR e Zd ZdZdd� Zddd�Zdd � Zd
d � Zd d
� Zdd� Z dd� Z
dd� Z dS )� AuthHandlera ACME Authorization Handler for a client.
:ivar auth: Authenticator capable of solving
:class:`~acme.challenges.Challenge` types
:type auth: :class:`certbot.interfaces.IAuthenticator`
:ivar acme.client.BackwardsCompatibleClientV2 acme_client: ACME client API.
:ivar account: Client's Account
:type account: :class:`certbot.account.Account`
:ivar list pref_challs: sorted user specified preferred challenges
type strings with the most preferred challenge listed first
c C s || _ || _|| _|| _d S �N)�auth�acme�account� pref_challs)�selfr
Z acme_clientr r � r �6/usr/lib/python3/dist-packages/certbot/auth_handler.py�__init__& s zAuthHandler.__init__F� c
C sJ |j dd� }|s t�d��| �|�}|s.|S t�| j|��� zJ| j�|�}t �
d� t j �
tj�}|jr�t j �
tj�j}|ddd� W n< tjk
r� } z t �d� t �
d� | �W 5 d} ~ X Y nX t|�t|�ks�td ��t||�D ]\}
} | j�|
j| � q�| �|||� d
d � |D �} | �s0t�d ��| W 5 Q R � S Q R X dS )
aT
Retrieve all authorizations, perform all challenges required to validate
these authorizations, then poll and wait for the authorization to be checked.
:param acme.messages.OrderResource orderr: must have authorizations filled in
:param bool best_effort: if True, not all authorizations need to be validated (eg. renew)
:param int max_retries: maximum number of retries to poll authorizations
:returns: list of all validated authorizations
:rtype: List
:raises .AuthorizationError: If unable to retrieve all authorizations
NzNo authorization to handle.zWaiting for verification...z\Challenges loaded. Press continue to submit to CA. Pass "-v" for more info about challenges.T)�pausez!Failure in setting up challenges.z0Attempting to clean up outstanding challenges...z(Some challenges have not been performed.c S s g | ]}|j jtjkr|�qS r ��body�statusr Z STATUS_VALID��.0�authzrr r r �
<listcomp>^ s �z5AuthHandler.handle_authorizations.<locals>.<listcomp>zAll challenges have failed.)�authorizationsr �AuthorizationError�_choose_challengesr Z ExitHandler�_cleanup_challengesr
Zperform�logger�info�zope� component�
getUtilityr
ZIConfigZdebug_challengesZIDisplayZ notification�critical�len�AssertionError�zipr Zanswer_challenge�challb�_poll_authorizations)
r �orderr� best_effort� max_retries�authzrs�achallsZrespsZconfigZnotify�error�achall�respZauthzrs_validatedr r r �handle_authorizations- s8
�
z!AuthHandler.handle_authorizationsc C s� dd� |j D �}g }g }|D ]^}z| j�|�}|�|� W q tjk
rx } z |�|� t�d|j|� W 5 d}~X Y q X q ||fS )a~
Deactivate all `valid` authorizations in the order, so that they cannot be re-used
in subsequent orders.
:param messages.OrderResource orderr: must have authorizations filled in
:returns: tuple of list of successfully deactivated authorizations, and
list of unsuccessfully deactivated authorizations.
:rtype: tuple
c S s g | ]}|j jtjkr|�qS r r r r r r r o s �z?AuthHandler.deactivate_valid_authorizations.<locals>.<listcomp>z)Failed to deactivate authorization %s: %sN) r r Zdeactivate_authorization�append� acme_errors�Errorr" �debugZuri)r r- Z
to_deactivateZ deactivatedZfailedr �er r r � deactivate_valid_authorizationse s
$z+AuthHandler.deactivate_valid_authorizationsc
s$ dd� t |�D �}g }d}t|�D ]�}|dkr8t�|� � fdd�|�� D �}|�� D ]\}\} }| ||< qVdd� |�� D �}
|
D ]} t�d| jj j
� q�|� |
� d d� |�� D �}|s� q�t � fd
d �|�� D ��} | t
j
�� �� }q"|�rt|� jj� |�st�d ��|�r t�d
��dS )a
Poll the ACME CA server, to wait for confirmation that authorizations have their challenges
all verified. The poll may occur several times, until all authorizations are checked
(valid or invalid), or after a maximum of retries.
c S s i | ]\}}||d f�qS r r )r �indexr r r r �
<dictcomp>� s � z4AuthHandler._poll_authorizations.<locals>.<dictcomp>� r c s" i | ]\}\}}|� j �|��qS r )r Zpoll)r r< r �_�r r r r= � s
c S s" g | ]\}}|j jtjkr|�qS r )r r r ZSTATUS_INVALID)r r r? r r r r � s �z4AuthHandler._poll_authorizations.<locals>.<listcomp>z Challenge failed for domain %sc S s, i | ]$\}\}}|j jtjkr|||f�qS r )r r r ZSTATUS_PENDING)r r< r r4 r r r r= � s
� c 3 s | ]\}}� j �|d �V qdS )� N)r � retry_after)r r? r4 r@ r r � <genexpr>� s �z3AuthHandler._poll_authorizations.<locals>.<genexpr>z Some challenges have failed.z0All authorizations were not finalized by the CA.N)� enumerate�range�time�sleep�items�valuesr" Zwarningr �
identifier�value�extend�max�datetimeZnowZ
total_seconds�_report_failed_authzrsr �keyr r )
r r0 r/ r. Zauthzrs_to_checkZauthzrs_failed_to_reportZ
sleep_secondsr? r< r Zauthzrs_failedZ
authzr_failedrB r r@ r r, ~ sD �
�
�
� �
z AuthHandler._poll_authorizationsc C s� dd� |D �}g }|r t �d� |D ]f}|jj}| jjdkrF|jj}ntdd� tt |��D ��}t
|| � |jj j
�|�}|�| �||�� q$|S )z�
Retrieve necessary and pending challenges to satisfy server.
NB: Necessary and already validated challenges are not retrieved,
as they can be reused for a certificate issuance.
c S s g | ]}|j jtjkr|�qS r r r r r r r � s �z2AuthHandler._choose_challenges.<locals>.<listcomp>z$Performing the following challenges:r> c s s | ] }|fV qd S r r )r �ir r r rC � s z1AuthHandler._choose_challenges.<locals>.<genexpr>)r" r# r r r Z acme_version� combinations�tuplerE r( �gen_challenge_path�_get_chall_prefrJ rK rL �_challenge_factory)r r0 Zpending_authzrsr1 r Zauthzr_challengesrR �pathr r r r � s
�z AuthHandler._choose_challengesc C sn g }| j �|�}| jr`tdd� |D ��}| jD ] }||kr.|�tjj| � q.|rV|S t� d��|�
|� |S )z{Return list of challenge preferences.
:param str domain: domain for which you are requesting preferences
c s s | ] }|j V qd S r )�typ)r �challr r r rC � s z.AuthHandler._get_chall_pref.<locals>.<genexpr>zENone of the preferred challenges are supported by the selected plugin) r
Zget_chall_prefr �setr6 r Z ChallengeZTYPESr r rL )r �domainZ chall_prefsZ plugin_prefZplugin_pref_typesrX r r r rU � s
�
zAuthHandler._get_chall_prefc C s t �d� | j�|� dS )z�Cleanup challenges.
:param achalls: annotated challenges to cleanup
:type achalls: `list` of :class:`certbot.achallenges.AnnotatedChallenge`
zCleaning up challengesN)r" r# r
Zcleanup)r r1 r r r r! � s
z AuthHandler._cleanup_challengesc C s: g }|D ],}|j j| }|�t|| jj|j jj�� q|S )ai Construct Namedtuple Challenges
:param messages.AuthorizationResource authzr: authorization
:param list path: List of indices from `challenges`.
:returns: achalls, list of challenge type
:class:`certbot.achallenges.Indexed`
:rtype: list
:raises .errors.Error: if challenge type is not recognized
)r r r6 �challb_to_achallr rP rJ rK )r r rW r1 r< r+ r r r rV � s �z AuthHandler._challenge_factoryN)Fr ) �__name__�
__module__� __qualname__�__doc__r r5 r; r, r rU r! rV r r r r r s
8<
r c C sb | j }t�d|j|� t|tj�r2tj| ||d�S t|tj �rLtj | |d�S t
� d� |j���dS )a: Converts a ChallengeBody object to an AnnotatedChallenge.
:param .ChallengeBody challb: ChallengeBody
:param .JWK account_key: Authorized Account Key
:param str domain: Domain of the challb
:returns: Appropriate AnnotatedChallenge
:rtype: :class:`certbot.achallenges.AnnotatedChallenge`
z%s challenge for %s)r+ r[ � account_key)r+ r[ z+Received unsupported challenge of type: {0}N)
rY r" r# rX �
isinstancer ZKeyAuthorizationChallenger Z"KeyAuthorizationAnnotatedChallengeZDNSr r8 �format)r+ ra r[ rY r r r r\
s �
�r\ c C s |rt | ||�S t| |�S )a� Generate a plan to get authority over the identity.
.. todo:: This can be possibly be rewritten to use resolved_combinations.
:param tuple challbs: A tuple of challenges
(:class:`acme.messages.Challenge`) from
:class:`acme.messages.AuthorizationResource` to be
fulfilled by the client in order to prove possession of the
identifier.
:param list preferences: List of challenge preferences for domain
(:class:`acme.challenges.Challenge` subclasses)
:param tuple combinations: A collection of sets of challenges from
:class:`acme.messages.Challenge`, each of which would
be sufficient to prove possession of the identifier.
:returns: tuple of indices from ``challenges``.
:rtype: tuple
:raises certbot.errors.AuthorizationError: If a
path cannot be created that satisfies the CA given the preferences and
combinations.
)�_find_smart_path�_find_dumb_path)�challbs� preferencesrR r r r rT % s rT c C s� i }d}t |�D ]\}}|||< ||7 }qd}|}d} |D ]:}
|
D ] } | |�| | jj|�7 } qB| |k rp|
}| }d} q:|s�t| � |S )z�Find challenge path with server hints.
Can be called if combinations is included. Function uses a simple
ranking system to choose the combo with the lowest cost.
r> Nr )rD �getrY � __class__�_report_no_chall_path) rf rg rR Z
chall_costZmax_costrQ Z chall_clsZ
best_comboZbest_combo_costZ combo_totalZcomboZchallenge_indexr r r rd D s,
��rd c sJ g }t | �D ]8\}� t� fdd�|D �d�}|r<|�|� q t| � q |S )z�Find challenge path without server hints.
Should be called if the combinations hint is not included by the
server. This function either returns a path containing all
challenges provided by the CA or raises an exception.
c 3 s | ]}t � j|�rd V qdS )TN)rb rY )r Zpref_c�r+ r r rC t s �z"_find_dumb_path.<locals>.<genexpr>F)rD �nextr6 rj )rf rg rW rQ Z supportedr rk r re i s �
re c C sB d}t | �dkr*t| d jtj�r*|d7 }t�|� t�|��dS )z�Logs and raises an error that no satisfiable chall path exists.
:param challbs: challenges from the authorization that can't be satisfied
zyClient with the currently selected authenticator does not support any combination of challenges that will satisfy the CA.r> r zM You may need to use an authenticator plugin that can do challenges over DNS.N) r( rb rY r ZDNS01r" r' r r )rf �msgr r r rj ~ s �
rj z�To fix these errors, please make sure that your domain name was entered correctly and the DNS A/AAAA record(s) for that domain contain(s) the right IP address.a Additionally, please check that your computer has a publicly routable IP address and that no firewalls are preventing the server from communicating with the client. If you're using the webroot plugin, you should also verify that you are serving files from the webroot path you provided.ze Additionally, if you have DNSSEC enabled for your domain, please ensure that the signature is valid.z�To fix these errors, please make sure that you did not provide any invalid information to the client, and try running Certbot again.zoUnfortunately, an error on the ACME server prevented you from completing authorization. Please try again later.z� Additionally, please check that you have an up-to-date TLS configuration that allows the server to communicate with the Certbot client.)Z
connectionZdnssecZ malformedZserverInternalZtlsZ unauthorizedZ unknownHostc sh i }� fdd�| D �}|D ]}|� |jjg ��|� qtj�tj�}|� � D ]}|�
t |�|j � qLdS )z.Notifies the user about failed authorizations.c s2 g | ]*}|j jD ] }|jrt|� |j jj��qqS r )r r r2 r\ rJ rK )r r r+ �ra r r r � s
�z*_report_failed_authzrs.<locals>.<listcomp>N)
�
setdefaultr2 rX r6 r$ r% r& r
Z IReporterrI Z add_message�_generate_failed_chall_msgZMEDIUM_PRIORITY)Zfailed_authzrsra Zproblems�failed_achallsr3 Zreporterr1 r rn r rO � s
� rO c C st | d j }|j}t�|�r |j}dg}| D ] }|�d|j||j jf � q*|tkrj|�d� |�t| � d� |�S )a Creates a user friendly error message about failed challenges.
:param list failed_achalls: A list of failed
:class:`certbot.achallenges.AnnotatedChallenge` with the same error
type.
:returns: A formatted error message for the client.
:rtype: str
r z1The following errors were reported by the server:z"
Domain: %s
Type: %s
Detail: %sz
� )
r2 rX r Z
is_acme_error�coder6 r[ Zdetail� _ERROR_HELP�join)rq r2 rX rm r3 r r r rp � s
�
rp )!r` ZloggingrF rN Zzope.componentr$ r r r r r7 Zacme.magic_typingr r r Zcertbotr r r
Z getLoggerr] r" �objectr r\ rT rd re rj Z_ERROR_HELP_COMMONrt rO rp r r r r �<module> s@
x %��