Server : Apache/2.4.62 (Unix) OpenSSL/1.0.2k-fips System : Linux server1.richineiserver.com 3.10.0-1160.119.1.el7.x86_64 #1 SMP Tue Jun 4 14:43:51 UTC 2024 x86_64 User : fdshops ( 1003) PHP Version : 8.2.21 Disable Function : NONE Directory : /lib/python2.7/site-packages/certbot/_internal/ |
�
���_c @ s� d Z d d l Z d d l Z d d l Z d d l Z d d l m Z d d l m Z d d l m
Z
d d l m Z d d l m
Z
d d l m Z d d l m Z d d l m Z d d
l m Z d d l m Z e j e � Z d e f d
� � YZ d � Z d � Z d � Z d � Z d � Z d Z i e d d 6e d d 6d d 6d d 6e d d 6e d 6e d 6Z d � Z d! � Z! d S(" s ACME AuthHandler.i����N( t
challenges( t errors( t messages( t Dict( t List( t Tuple( t achallenges( t
interfaces( t
error_handlert AuthHandlerc B s\ e Z d Z d � Z e d d � Z d � Z d � Z d � Z d � Z d � Z
d � Z RS(
s
ACME Authorization Handler for a client.
:ivar auth: Authenticator capable of solving
:class:`~acme.challenges.Challenge` types
:type auth: :class:`certbot.interfaces.IAuthenticator`
:ivar acme.client.BackwardsCompatibleClientV2 acme_client: ACME client API.
:ivar account: Client's Account
:type account: :class:`certbot._internal.account.Account`
:ivar list pref_challs: sorted user specified preferred challenges
type strings with the most preferred challenge listed first
c C s( | | _ | | _ | | _ | | _ d S( N( t autht acmet accountt pref_challs( t selfR
t acme_clientR R
( ( sB /usr/lib/python2.7/site-packages/certbot/_internal/auth_handler.pyt __init__& s i c C s� | j } | s" t j d � � n | j | � } | s; | St j | j | � �ayl | j j | � } t j
d � t j j
t j � } | j r� t j j
t j � j } | d d t �n Wn6 t j k
r� } t j d � t j
d � | � n Xt | � t | � k st d � � x3 t | | � D]" \ }
} | j j |
j | � q*W| j | | | � g | D]! } | j j t j k rj| ^ qj}
|
s�t j d � � n |
SWd QXd S(
sT
Retrieve all authorizations, perform all challenges required to validate
these authorizations, then poll and wait for the authorization to be checked.
:param acme.messages.OrderResource orderr: must have authorizations filled in
:param bool best_effort: if True, not all authorizations need to be validated (eg. renew)
:param int max_retries: maximum number of retries to poll authorizations
:returns: list of all validated authorizations
:rtype: List
:raises .AuthorizationError: If unable to retrieve all authorizations
s No authorization to handle.s Waiting for verification...s\ Challenges loaded. Press continue to submit to CA. Pass "-v" for more info about challenges.t pauses! Failure in setting up challenges.s0 Attempting to clean up outstanding challenges...s( Some challenges have not been performed.s All challenges have failed.N( t authorizationsR t AuthorizationErrort _choose_challengesR t ExitHandlert _cleanup_challengesR
t performt loggert infot zopet componentt
getUtilityR t IConfigt debug_challengest IDisplayt notificationt Truet criticalt lent AssertionErrort zipR t answer_challenget challbt _poll_authorizationst bodyt statusR t STATUS_VALID( R t orderrt best_effortt max_retriest authzrst achallst respst configt notifyt errort achallt respt authzrt authzrs_validated( ( sB /usr/lib/python2.7/site-packages/certbot/_internal/auth_handler.pyt handle_authorizations- s8
$
!c C s� g | j D]! } | j j t j k r
| ^ q
} g } g } xm | D]e } y# | j j | � } | j | � WqD t j k
r� } | j | � t
j d | j | � qD XqD W| | f S( s~
Deactivate all `valid` authorizations in the order, so that they cannot be re-used
in subsequent orders.
:param messages.OrderResource orderr: must have authorizations filled in
:returns: tuple of list of successfully deactivated authorizations, and
list of unsuccessfully deactivated authorizations.
:rtype: tuple
s) Failed to deactivate authorization %s: %s(
R R) R* R R+ R t deactivate_authorizationt appendt acme_errorst ErrorR t debugt uri( R R, R7 t
to_deactivatet deactivatedt failedt e( ( sB /usr/lib/python2.7/site-packages/certbot/_internal/auth_handler.pyt deactivate_valid_authorizationse s
!
c
s� d � t | � D� } g } d } xEt | � D]7} | d k rQ t j | � n � f d � | j � D� } x* | j � D] \ } \ } } | | | <qz Wg | j � D]' \ } } | j j t j k r� | ^ q� }
x' |
D] } t
j d | j j j
� q� W| j |
� d � | j � D� } | s+Pn t � f d � | j � D� � } | t j j � j � } q/ W| r�t | � j j � | s�t j d � � q�n | r�t j d � � n d
S( s
Poll the ACME CA server, to wait for confirmation that authorizations have their challenges
all verified. The poll may occur several times, until all authorizations are checked
(valid or invalid), or after a maximum of retries.
c S s% i | ] \ } } | d f | � q S( N( t None( t .0t indexR7 ( ( sB /usr/lib/python2.7/site-packages/certbot/_internal/auth_handler.pys
<dictcomp>� s i i c s1 i | ]' \ } \ } } � j j | � | � q S( ( R t poll( RF RG R7 t _( R ( sB /usr/lib/python2.7/site-packages/certbot/_internal/auth_handler.pys
<dictcomp>� s s Challenge failed for domain %sc S s@ i | ]6 \ } \ } } | j j t j k r | | f | � q S( ( R) R* R t STATUS_PENDING( RF RG R7 R6 ( ( sB /usr/lib/python2.7/site-packages/certbot/_internal/auth_handler.pys
<dictcomp>� s c 3 s* | ] \ } } � j j | d � Vq d S( i N( R t retry_after( RF RI R6 ( R ( sB /usr/lib/python2.7/site-packages/certbot/_internal/auth_handler.pys <genexpr>� s s Some challenges have failed.s0 All authorizations were not finalized by the CA.N( t enumeratet ranget timet sleept itemst valuesR) R* R t STATUS_INVALIDR t warningt
identifiert valuet extendt maxt datetimet nowt
total_secondst _report_failed_authzrsR t keyR R (
R R/ R. R- t authzrs_to_checkt authzrs_failed_to_reportt
sleep_secondsRI RG R7 t authzrs_failedt
authzr_failedRK ( ( R sB /usr/lib/python2.7/site-packages/certbot/_internal/auth_handler.pyR( ~ s< !
c C s� g | D]! } | j j t j k r | ^ q } g } | rJ t j d � n x� | D]� } | j j } | j j d k r� | j j } n" t
d � t t | � � D� � } t
| | j | j j j � | � } | j | j | | � � qQ W| S( s�
Retrieve necessary and pending challenges to satisfy server.
NB: Necessary and already validated challenges are not retrieved,
as they can be reused for a certificate issuance.
s$ Performing the following challenges:i c s s | ] } | f Vq d S( N( ( RF t i( ( sB /usr/lib/python2.7/site-packages/certbot/_internal/auth_handler.pys <genexpr>� s ( R) R* R R+ R R R R t acme_versiont combinationst tupleRM R# t gen_challenge_patht _get_chall_prefRT RU RV t _challenge_factory( R R/ R7 t pending_authzrsR0 t authzr_challengesRd t path( ( sB /usr/lib/python2.7/site-packages/certbot/_internal/auth_handler.pyR � s
!
" c C s� g } | j j | � } | j r� t d � | D� � } x7 | j D], } | | k rA | j t j j | � qA qA W| r{ | St j d � � n | j
| � | S( s{ Return list of challenge preferences.
:param str domain: domain for which you are requesting preferences
c s s | ] } | j Vq d S( N( t typ( RF t chall( ( sB /usr/lib/python2.7/site-packages/certbot/_internal/auth_handler.pys <genexpr>� s sE None of the preferred challenges are supported by the selected plugin( R
t get_chall_prefR
t setR; R t Challenget TYPESR R RV ( R t domaint chall_prefst plugin_preft plugin_pref_typesRl ( ( sB /usr/lib/python2.7/site-packages/certbot/_internal/auth_handler.pyRg � s
c C s! t j d � | j j | � d S( s� Cleanup challenges.
:param achalls: annotated challenges to cleanup
:type achalls: `list` of :class:`certbot.achallenges.AnnotatedChallenge`
s Cleaning up challengesN( R R R
t cleanup( R R0 ( ( sB /usr/lib/python2.7/site-packages/certbot/_internal/auth_handler.pyR � s
c C sS g } xF | D]> } | j j | } | j t | | j j | j j j � � q
W| S( si Construct Namedtuple Challenges
:param messages.AuthorizationResource authzr: authorization
:param list path: List of indices from `challenges`.
:returns: achalls, list of challenge type
:class:`certbot.achallenges.Indexed`
:rtype: list
:raises .errors.Error: if challenge type is not recognized
( R) R R; t challb_to_achallR R\ RT RU ( R R7 Rk R0 RG R' ( ( sB /usr/lib/python2.7/site-packages/certbot/_internal/auth_handler.pyRh � s
#( t __name__t
__module__t __doc__R t FalseR9 RD R( R Rg R Rh ( ( ( sB /usr/lib/python2.7/site-packages/certbot/_internal/auth_handler.pyR s 8 <
c C s� | j } t j d | j | � t | t j � rM t j d | d | d | � St | t j � ru t j d | d | � St
j d j | j � � � d S( s: Converts a ChallengeBody object to an AnnotatedChallenge.
:param .ChallengeBody challb: ChallengeBody
:param .JWK account_key: Authorized Account Key
:param str domain: Domain of the challb
:returns: Appropriate AnnotatedChallenge
:rtype: :class:`certbot.achallenges.AnnotatedChallenge`
s %s challenge for %sR' Rr t account_keys+ Received unsupported challenge of type: {0}N(
Rm R R Rl t
isinstanceR t KeyAuthorizationChallengeR t" KeyAuthorizationAnnotatedChallenget DNSR R= t format( R' R| Rr Rm ( ( sB /usr/lib/python2.7/site-packages/certbot/_internal/auth_handler.pyRw
s c C s# | r t | | | � St | | � S( s� Generate a plan to get authority over the identity.
.. todo:: This can be possibly be rewritten to use resolved_combinations.
:param tuple challbs: A tuple of challenges
(:class:`acme.messages.Challenge`) from
:class:`acme.messages.AuthorizationResource` to be
fulfilled by the client in order to prove possession of the
identifier.
:param list preferences: List of challenge preferences for domain
(:class:`acme.challenges.Challenge` subclasses)
:param tuple combinations: A collection of sets of challenges from
:class:`acme.messages.Challenge`, each of which would
be sufficient to prove possession of the identifier.
:returns: tuple of indices from ``challenges``.
:rtype: tuple
:raises certbot.errors.AuthorizationError: If a
path cannot be created that satisfies the CA given the preferences and
combinations.
( t _find_smart_patht _find_dumb_path( t challbst preferencesRd ( ( sB /usr/lib/python2.7/site-packages/certbot/_internal/auth_handler.pyRf $ s c C s� i } d } x. t | � D] \ } } | | | <| | 7} q Wd } | } d } x` | D]X }
x. |
D]& } | | j | | j j | � 7} qc W| | k r� |
} | } n d } qV W| s� t | � n | S( s� Find challenge path with server hints.
Can be called if combinations is included. Function uses a simple
ranking system to choose the combo with the lowest cost.
i i N( RL RE t getRm t __class__t _report_no_chall_path( R� R� Rd t
chall_costt max_costRb t chall_clst
best_combot best_combo_costt combo_totalt combot challenge_index( ( sB /usr/lib/python2.7/site-packages/certbot/_internal/auth_handler.pyR� C s&
c sf g } xY t | � D]K \ } � t � f d � | D� t � } | rT | j | � q t | � q W| S( s� Find challenge path without server hints.
Should be called if the combinations hint is not included by the
server. This function either returns a path containing all
challenges provided by the CA or raises an exception.
c 3 s' | ] } t � j | � r t Vq d S( N( R} Rm R! ( RF t pref_c( R' ( sB /usr/lib/python2.7/site-packages/certbot/_internal/auth_handler.pys <genexpr>s s ( RL t nextR{ R; R� ( R� R� Rk Rb t supported( ( R' sB /usr/lib/python2.7/site-packages/certbot/_internal/auth_handler.pyR� h s c C s^ d } t | � d k r> t | d j t j � r> | d 7} n t j | � t j | � � d S( s� Logs and raises an error that no satisfiable chall path exists.
:param challbs: challenges from the authorization that can't be satisfied
sy Client with the currently selected authenticator does not support any combination of challenges that will satisfy the CA.i i sM You may need to use an authenticator plugin that can do challenges over DNS.N( R# R} Rm R t DNS01R R" R R ( R� t msg( ( sB /usr/lib/python2.7/site-packages/certbot/_internal/auth_handler.pyR� } s +
s� To fix these errors, please make sure that your domain name was entered correctly and the DNS A/AAAA record(s) for that domain contain(s) the right IP address.s Additionally, please check that your computer has a publicly routable IP address and that no firewalls are preventing the server from communicating with the client. If you're using the webroot plugin, you should also verify that you are serving files from the webroot path you provided.t
connectionse Additionally, if you have DNSSEC enabled for your domain, please ensure that the signature is valid.t dnssecs� To fix these errors, please make sure that you did not provide any invalid information to the client, and try running Certbot again.t malformedso Unfortunately, an error on the ACME server prevented you from completing authorization. Please try again later.t serverInternals� Additionally, please check that you have an up-to-date TLS configuration that allows the server to communicate with the Certbot client.t tlst unauthorizedt unknownHostc C s� i } g | D]= } | j j D]* } | j r t | | | j j j � ^ q q
} x- | D]% } | j | j j g � j | � qW Wt j
j t j
� } x- | j � D] } | j t | � | j � q� Wd S( s. Notifies the user about failed authorizations.N( R) R R4 Rw RT RU t
setdefaultRl R; R R R R t IReporterRQ t add_messaget _generate_failed_chall_msgt MEDIUM_PRIORITY( t failed_authzrsR| t problemsR7 R' t failed_achallsR5 t reporterR0 ( ( sB /usr/lib/python2.7/site-packages/certbot/_internal/auth_handler.pyR[ � s -
#c C s� | d j } | j } t j | � r1 | j } n d g } x1 | D]) } | j d | j | | j j f � qA W| t k r� | j d � | j t | � n d j | � S( s Creates a user friendly error message about failed challenges.
:param list failed_achalls: A list of failed
:class:`certbot.achallenges.AnnotatedChallenge` with the same error
type.
:returns: A formatted error message for the client.
:rtype: str
i s1 The following errors were reported by the server:s"
Domain: %s
Type: %s
Detail: %ss
t (
R4 Rl R t
is_acme_errort codeR; Rr t detailt _ERROR_HELPt join( R� R4 Rl R� R5 ( ( sB /usr/lib/python2.7/site-packages/certbot/_internal/auth_handler.pyR� � s
(" Rz RX t loggingRN t zope.componentR R R R R< R t acme.magic_typingR R R t certbotR R t certbot._internalR t getLoggerRx R t objectR Rw Rf R� R� R� t _ERROR_HELP_COMMONR� R[ R� ( ( ( sB /usr/lib/python2.7/site-packages/certbot/_internal/auth_handler.pyt <module> s@ � %