Server : Apache/2.4.62 (Unix) OpenSSL/1.0.2k-fips System : Linux server1.richineiserver.com 3.10.0-1160.119.1.el7.x86_64 #1 SMP Tue Jun 4 14:43:51 UTC 2024 x86_64 User : fdshops ( 1003) PHP Version : 8.2.21 Disable Function : NONE Directory : /lib/python2.7/site-packages/certbot/_internal/ |
�
���_c @ s� d Z d d l m Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l
m Z d d l m
Z
m Z d d l m Z d d l Z d d l Z d d l Z d d l m Z d d l m Z d d l m Z d d
l m Z d d l m Z d d l m Z d d
l m Z d d
l m Z d d l m! Z! d d l m" Z" d d l m# Z# d d l m$ Z$ d d l m% Z% d d l& m' Z( d d l) m* Z* e j+ e, � Z- d d d d d d d d d d d d d! d" d# g Z. d$ d% g Z/ d& d' d( d) g Z0 e1 e j2 e0 e/ e. d: � � Z3 d+ � Z4 d, � Z5 d- � Z6 d. � Z7 d/ � Z8 d0 � Z9 d1 � Z: d2 � Z; d3 � Z< d4 � Z= d5 � Z> d6 � Z? d7 � Z@ d8 � ZA d9 � ZB d S(; sG Functionality for autorenewal and associated juggling of configurationsi����( t print_functionN( t default_backend( t ect rsa( t load_pem_private_key( t List( t Optional( t crypto_util( t util( t errors( t
interfaces( t cli( t client( t constants( t hooks( t storage( t updater( t disco( t ost
config_dirt logs_dirt work_dirt
user_agentt servert accountt
authenticatort installert
renew_hookt pre_hookt post_hookt http01_addresst preferred_chaint key_typet elliptic_curvet rsa_key_sizet http01_portt must_staplet allow_subset_of_namest reuse_keyt autorenewt pref_challsc C s� y t j | | � } WnT t j t f k
rl t j d d t �t j d | � t j d t j
� � d SXd | j k r� t j d | � d S| j d } d | k r� t j d | � d Sy t
| | � t | | � WnL t t j f k
r)} t j d | t | � � t j d t j
� � d SXy/ g | j � D] } t j | � ^ q:| _ Wn* t j k
r�} t j d
| | � d SX| S( s� Try to instantiate a RenewableCert, updating config with relevant items.
This is specifically for use in renewal and enforces several checks
and policies to ensure that we can try to proceed with the renewal
request. The config argument is modified by including relevant options
read from the renewal configuration file.
:param configuration.NamespaceConfig config: configuration for the
current lineage
:param str full_path: Absolute path to the configuration file that
defines this lineage
:returns: the RenewableCert object or None if a fatal error occurred
:rtype: `storage.RenewableCert` or NoneType
t t exc_infos2 Renewal configuration file %s is broken. Skipping.s Traceback was:
%st
renewalparamss< Renewal configuration file %s lacks renewalparams. Skipping.R sJ Renewal configuration file %s does not specify an authenticator. Skipping.sH An error occurred while parsing %s. The error was %s. Skipping the file.s{ Renewal configuration file %s references a certificate that contains an invalid domain name. The problem was: %s. Skipping.N( R t
RenewableCertR t CertStorageErrort IOErrort loggert warningt Truet debugt tracebackt
format_exct Nonet
configurationt restore_required_config_elementst _restore_plugin_configst
ValueErrort Errort strt namesR t enforce_domain_sanityt domainst ConfigurationError( t configt full_patht renewal_candidateR+ t errort d( ( s= /usr/lib/python2.7/site-packages/certbot/_internal/renewal.pyt
_reconstitute5 sB
,
c C s� d | k r, t j d � r, | d | _ n d | k r| t j d � r| | d } t | t j � rp | g } n | | _ n d S( s�
webroot_map is, uniquely, a dict, and the general-purpose configuration
restoring logic is not able to correctly parse it from the serialized
form.
t webroot_mapt webroot_pathN( R t
set_by_cliRF t
isinstancet sixt string_typesRG ( R@ R+ t wp( ( s= /usr/lib/python2.7/site-packages/certbot/_internal/renewal.pyt _restore_webroot_confign s
c C s g } | d d k r& t | | � n | j | d � | j d � d k r` | j | d � n x� t | � D]� } | j d d � } x� t j | � D]| \ } } | j | d � r� t j
| � r� | d
k r� t | | t | � � qt j
| � } t | | | | � � q� q� Wqm Wd S( s Sets plugin specific values in config from renewalparams
:param configuration.NamespaceConfig config: configuration for the
current lineage
:param configobj.Section renewalparams: Parameters from the renewal
configuration file that defines this lineage
R t webrootR t -t _R5 R1 t FalseN( s Nones Trues False( RM t appendt getR5 t sett replaceRJ t iteritemst
startswithR RH t setattrt evalt
argparse_type( R@ R+ t plugin_prefixest
plugin_prefixt config_itemt config_valuet cast( ( s= /usr/lib/python2.7/site-packages/certbot/_internal/renewal.pyR8 s # c C s� t j d t f f t j j t t j t � � t j j t t j t
� � t j j t t j t � � � } xV | D]N \ } } | | k rp t
j | � rp | | | | � } t | | | � qp qp Wd S( s Sets non-plugin specific values in config from renewalparams
:param configuration.NamespaceConfig config: configuration for the
current lineage
:param configobj.Section renewalparams: parameters from the renewal
configuration file that defines this lineage
R( N( t itertoolst chaint _restore_pref_challsRJ t movest zipt BOOL_CONFIG_ITEMSt repeatt
_restore_boolt INT_CONFIG_ITEMSt _restore_intt STR_CONFIG_ITEMSt _restore_strR RH RX ( R@ R+ t required_itemst item_namet restore_funct value( ( s= /usr/lib/python2.7/site-packages/certbot/_internal/renewal.pyR7 � s
! c C s. t | t j � r | g n | } t j | � S( s� Restores preferred challenges from a renewal config file.
If value is a `str`, it should be a single challenge type.
:param str unused_name: option name
:param value: option value
:type value: `list` of `str` or `str`
:returns: converted option value to be stored in the runtime config
:rtype: `list` of `str`
:raises errors.Error: if value can't be converted to a bool
( RI RJ RK R t parse_preferred_challenges( t unused_nameRo ( ( s= /usr/lib/python2.7/site-packages/certbot/_internal/renewal.pyRb � s !c C s@ | j � } | d k r6 t j d j | | � � � n | d k S( s# Restores a boolean key-value pair from a renewal config file.
:param str name: option name
:param str value: option value
:returns: converted option value to be stored in the runtime config
:rtype: bool
:raises errors.Error: if value can't be converted to a bool
t truet falses, Expected True or False for {0} but found {1}( Rr Rs ( t lowerR R: t format( t nameRo t lowercase_value( ( s= /usr/lib/python2.7/site-packages/certbot/_internal/renewal.pyRg � s
c C sp | d k r2 | d k r2 t j d � t j d � Sy t | � SWn) t k
rk t j d j | � � � n Xd S( s# Restores an integer key-value pair from a renewal config file.
:param str name: option name
:param str value: option value
:returns: converted option value to be stored in the runtime config
:rtype: int
:raises errors.Error: if value can't be converted to an int
R# R5 s! updating legacy http01_port values Expected a numeric value for {0}N( R/ t infoR t flag_defaultt intR9 R R: Ru ( Rv Ro ( ( s= /usr/lib/python2.7/site-packages/certbot/_internal/renewal.pyRi � s
c C sT | d k r@ | t j k r@ t j d t j d | � t j d S| d k rP d S| S( s� Restores a string key-value pair from a renewal config file.
:param str name: option name
:param str value: option value
:returns: converted option value to be stored in the runtime config
:rtype: str or None
R s$ Using server %s instead of legacy %sR5 N( R
t V1_URIR/ Rx t CLI_DEFAULTSR5 ( Rv Ro ( ( s= /usr/lib/python2.7/site-packages/certbot/_internal/renewal.pyRk � s
c C sb | j r t j d � t S| j � r7 t j d � t S| j rQ t j d � t St j d � t S( sD Return true if any of the circumstances for automatic renewal apply.s+ Auto-renewal forced with --force-renewal...s) Cert is due for renewal, auto-renewing...s< Cert not due for renewal, but simulating renewal for dry runs Cert not yet due for renewal( t renew_by_defaultR/ R2 R1 t should_autorenewRx t dry_runRQ ( R@ t lineage( ( s= /usr/lib/python2.7/site-packages/certbot/_internal/renewal.pyt should_renew s
c C s� t | j � � } | j � } Wd QXt j j t j j | � } d t | j � � j � k } t
j | j � r� t
j | � s� | r� | j
s� d j | j � � } t j d j | � � � q� q� n d S( s9 Do not renew a valid cert with one from a staging server!Nt fakes , s� You've asked to renew/replace a seemingly valid certificate with a test certificate (domains: {0}). We will not do that unless you use the --break-my-certs flag!( t opent certt readt OpenSSLt cryptot load_certificatet FILETYPE_PEMt reprt
get_issuerRt R t
is_stagingR t break_my_certst joinR< R R: Ru ( R@ R� t original_servert the_filet contentst latest_certt now_validR< ( ( s= /usr/lib/python2.7/site-packages/certbot/_internal/renewal.pyt _avoid_invalidating_lineage& s c C s | j d } | j d t j d � � } t | | | � | sM | j � } n | j r{ t j j | j
� } t | | � n d } | j
| | � \ } } } } | j r� t j d t j j | j � � n; | j � }
| j |
| | j | | � | j | j � � t j | | | j � d S( s Renew a certificate lineage.R+ R s( Dry run: skipping updating lineage at %sN( R6 RS R Ry R� R< R& R t patht normpatht privkeyt _update_renewal_params_from_keyR5 t obtain_certificateR R/ R2 t dirnameR� t latest_common_versiont save_successort pemt update_all_links_toR R t live_dir( R@ R> t le_clientR� t renewal_paramsR� t new_keyt new_certt new_chainRP t
prior_version( ( s= /usr/lib/python2.7/site-packages/certbot/_internal/renewal.pyt
renew_cert< s
" c s' � f d � | D� } d d j | � S( s: Format a results report for a category of renewal outcomesc 3 s | ] } d | � f Vq d S( s %s (%s)N( ( t .0t m( t category( s= /usr/lib/python2.7/site-packages/certbot/_internal/renewal.pys <genexpr>Y s s s
( R� ( t msgsR� t lines( ( R� s= /usr/lib/python2.7/site-packages/certbot/_internal/renewal.pyt reportW s c C s� t j } t j } | d j t j � � | j r7 d n d } | rc | d � | t | d � � n | r� | r� | d j d | � � | j d k s� | j
d k s� | j d k r�| d � q�n� | r� | r� | d j d | � � | t | d � � n� | r-| r-| d
| � | t | d � � n\ | r�| r�| d j d | � � | t | d � d
� | d | � | t | d � � n | r�| d � | t | d � � n | t j � d S( s�
Print a report to the terminal about the results of the renewal process.
:param interfaces.IConfig config: Configuration
:param list renew_successes: list of fullchain paths which were renewed
:param list renew_failures: list of fullchain paths which failed to be renewed
:param list renew_skipped: list of messages to print about skipped certificates
:param list parse_failures: list of renewal parameter paths which had erorrs
s
{}s simulated renewalt renewals7 The following certificates are not due for renewal yet:t skippeds No {renewal}s were attempted.s No hooks were run.s+ Congratulations, all {renewal}s succeeded: t successs@ All %ss failed. The following certificates could not be renewed:t failures# The following {renewal}s succeeded:s
s The following %ss failed:sB
Additionally, the following renewal configurations were invalid: t parsefailN( t display_utilt notifyR/ RC Ru t
SIDE_FRAMER R� R R5 R R ( R@ t renew_successest renew_failurest
renew_skippedt parse_failuresR� t notify_errort renewal_noun( ( s= /usr/lib/python2.7/site-packages/certbot/_internal/renewal.pyt _renew_describe_results] s8
c s$ t � f d � � j D� � r1 t j d � � n � j rU t j � � j � g } n t j � � } g } g } g } g } t j j
� o� � j } x/| D]'} t j
j t j � } | j d | d t �t j � � } t j | � }
y t | | � } WnO t k
rP} t j d | |
| � t j d t j � � | j | � q� n Xy#| d k rp| j | � nt j
j | � | j � d d l! m" }
t# j$ j% � } t& | | � r | r�t' j( d d � } t j) d | � t* j+ | � t } n |
j, | | | � | j | j- � nD t. j/ | j0 d
| j1 � � � } | j d | j- | j2 d � f � t3 j4 | | | � Wq� t k
r�} t j5 d |
| � t j d t j � � | j | j- � q� Xq� Wt6 � | | | | � | s�| rt j d j7 t8 | � t8 | � � � � n t j d � d S( s5 Examine each lineage; renew if due and report resultsc 3 s | ] } | � j k Vq d S( N( RF ( R� t domain( R@ ( s= /usr/lib/python2.7/site-packages/certbot/_internal/renewal.pys <genexpr>� s sf Currently, the renew verb is capable of either renewing all installed certificates that are due to be renewed or renewing a single certificate specified by its name. If you would like to renew specific certificates by their domains, use the certonly command instead. The renew verb may provide other options for selecting certificates to renew in the future.s Processing t pausesT Renewal configuration file %s (cert: %s) produced an unexpected error: %s. Skipping.s Traceback was:
%si����( t maini i< i s3 Non-interactive renewal: random delay of %s secondsR� s %s expires on %ss %Y-%m-%ds- Failed to renew certificate %s with error: %ss* {0} renew failure(s), {1} parse failure(s)s no renewal failuresNi� (9 t anyR> R R: t certnameR t renewal_file_for_certnamet renewal_conf_filest syst stdint isattyt random_sleep_on_renewt zopet componentt
getUtilityR
t IDisplayt notificationRQ t copyt deepcopyt lineagename_for_filenameRE t ExceptionR/ R0 R2 R3 R4 RR R5 t provideUtilityt ensure_deployedt certbot._internalR� t
plugins_discot PluginsRegistryt find_allR� t randomt uniformRx t timet sleepR� t fullchainR t notAftert versionR� t strftimeR t run_generic_updatersRC R� Ru t len( R@ t
conf_filesR� R� R� R� t apply_random_sleept renewal_filet dispt lineage_configt lineagenameRB t eR� t pluginst
sleep_timet expiry( ( R@ s= /usr/lib/python2.7/site-packages/certbot/_internal/renewal.pyt handle_renewal_request� sr
c
C s� t | d � �( } t | j � d d d t � �} Wd QXt | t j � rc d | _ | j | _
nN t | t j � r� d | _ | j
j | _ n! t j d j | t | � � � � d S( Nt rbt passwordt backendR t ecdsas* Key at {0} is of an unsupported type: {1}.( R� R R� R5 R RI R t
RSAPrivateKeyR t key_sizeR" R t EllipticCurvePrivateKeyt curveRv R! R R: Ru t type( t key_pathR@ t file_ht key( ( s= /usr/lib/python2.7/site-packages/certbot/_internal/renewal.pyR� � s ' ( s pref_challs(C t __doc__t
__future__R R� R` t loggingR� R� R� R3 t cryptography.hazmat.backendsR t) cryptography.hazmat.primitives.asymmetricR R t, cryptography.hazmat.primitives.serializationR R� RJ t zope.componentR� t acme.magic_typingR R t certbotR t certbot.displayR R� R R
R� R R R
R R R t certbot._internal.pluginsR R� t certbot.compatR t getLoggert __name__R/ Rj Rh Re RT Ra t CONFIG_ITEMSRE RM R8 R7 Rb Rg Ri Rk R� R� R� R� R� R� R� ( ( ( s= /usr/lib/python2.7/site-packages/certbot/_internal/renewal.pyt <module> sl 9 + 0 k