← Back
Editing: configurator.cpython-38.pyc
U �] � � @ s� d Z ddlmZ ddlZddlZddlZddlZddlZddlZddl Z ddl Z ddl Z ddl mZ ddl mZ ddlmZmZmZ ddlmZ ddlmZ ddlmZ dd lmZ dd lmZ dd lm Z dd l m Z ddl mZ dd l m Z ddl m!Z! ddl m"Z" ddl m#Z# ddl m$Z$ dZ%dZ&dZ'dZ(dZ)e�*e+�Z,e j-�.ej/ej0�e j-�1ej2�G dd� de j3���Z4dd� Z5dd� Z6d d � Z7d d � Z8dS ) zNginx Configuration� )� LooseVersionN)� challenges)� crypto_util)�List�Dict�Set)� constants)�errors)� interfaces)�util)�os)�common)� display_ops)�http_01)� nginxparser)�obj)�parser� � � � c s� e Zd ZdZdZdZdddgZedd� �Ze d d � �Z � fd d �Z e d d� �Z e dd� �Z e dd� �Zdd� Zdd� Zdrdd�Zdd� Zdsd d �Zd d � Zdtd!d"�Zd#d$� Zd%d&� Zd'd(� Zd)d*� Zd+d,� Zd-d.� Zd/d0� Z d1d2� Z dud3d4�Z d5d6� Z d7d8� Z d9d:� Z!d;d<� Z"d=d>� Z#d?d@� Z$dAdB� Z%dvdCdD�Z&dEdF� Z'dGdH� Z(dIdJ� Z)dwdKdL�Z*dMdN� Z+dOdP� Z,dQdR� Z-dSdT� Z.dUdV� Z/dWdX� Z0dYdZ� Z1d[d\� Z2d]d^� Z3d_d`� Z4dadb� Z5dxdcdd�Z6� fdedf�Z7dgdh� Z8dy� fdjdk� Z9dldm� Z:dndo� Z;dpdq� Z<� Z=S )z�NginxConfiguratora: Nginx configurator. .. todo:: Add proper support for comments in the config. Currently, config files modified by the configurator will lose all their comments. :ivar config: Configuration. :type config: :class:`~certbot.interfaces.IConfig` :ivar parser: Handles low level parsing :type parser: :class:`~certbot_nginx.parser` :ivar str save_notes: Human-readable config change notes :ivar reverter: saves and reverts checkpoints :type reverter: :class:`certbot.reverter.Reverter` :ivar tup version: version of Nginx zNginx Web Server pluginZ80�ssl_certificate�ssl_certificate_key� ssl_dhparamc C s6 t � }|dtjd d| d� |dtjd dd� d S )N� server-root� server_rootz*Nginx server root directory. (default: %s))�default�help�ctlzVPath to the 'nginx' binary, used for 'configtest' and retrieving nginx version number.)� _determine_default_server_rootr � CLI_DEFAULTS)�cls�add�default_server_root� r% �</usr/lib/python3/dist-packages/certbot_nginx/configurator.py�add_parser_argumentsL s �z&NginxConfigurator.add_parser_argumentsc C s t j�| �d�d�S )zNginx config file path.r z nginx.conf)r �path�join�conf��selfr% r% r& � nginx_confU s z NginxConfigurator.nginx_confc s� |� dd�}|� dd�}tt| �j||� | �� d| _d| _i | _i | _d| _ d| _ || _ || _ | j | j| jd�| _| j�� dS )a Initialize an Nginx Configurator. :param tup version: version of Nginx as a tuple (1, 4, 7) (used mostly for unittesting) :param tup openssl_version: version of OpenSSL linked to Nginx as a tuple (1, 4, 7) (used mostly for unittesting) �versionN�openssl_version� r )�redirect�ensure-http-header� staple-ocsp)�pop�superr �__init__� _verify_setup� save_notes� new_vhost�_wildcard_vhosts�_wildcard_redirect_vhosts� _chall_outr r. r/ �_enable_redirect�_set_http_header�_enable_ocsp_stapling� _enhance_funcZreverter�recovery_routine)r, �args�kwargsr. r/ �� __class__r% r& r6 Z s" �zNginxConfigurator.__init__c C sd | j dk}| j dko*| jo*t| j�td�k}|r@|r:d}qNd}n|rJd}nd}t�dtj�d |��S ) z4Full absolute path to SSL configuration file source.)r � r )r � � z1.0.2lzoptions-ssl-nginx.confz+options-ssl-nginx-tls13-session-tix-on.confz!options-ssl-nginx-tls12-only.confzoptions-ssl-nginx-old.conf� certbot_nginxZ tls_configs)r. r/ r � pkg_resourcesZresource_filenamer r( r) )r, Z use_tls13Zsession_tix_offZconfig_filenamer% r% r& �mod_ssl_conf_src� s � �z"NginxConfigurator.mod_ssl_conf_srcc C s t j�| jjtj�S )z-Full absolute path to SSL configuration file.)r r( r) �config� config_dirr ZMOD_SSL_CONF_DESTr+ r% r% r& � mod_ssl_conf� s z NginxConfigurator.mod_ssl_confc C s t j�| jjtj�S )z?Full absolute path to digest of updated SSL configuration file.)r r( r) rL rM r ZUPDATED_MOD_SSL_CONF_DIGESTr+ r% r% r& �updated_mod_ssl_conf_digest� s z-NginxConfigurator.updated_mod_ssl_conf_digestc C s t �||| jtj�S )zICopy Certbot's SSL options file into the system's config dir if required.)r Z install_version_controlled_filerK r ZALL_SSL_OPTIONS_HASHES)r, Z options_sslZoptions_ssl_digestr% r% r& �install_ssl_options_conf� s �z*NginxConfigurator.install_ssl_options_confc C s� t �| �d��st�d��| �� t�| �d��| _| jdkrH| � � | _| j dkr\| � � | _ | � | j | j� | �� zt �| �d�� W n> ttjfk r� tjddd� t�d�| �d����Y nX dS ) z�Prepare the authenticator/installer. :raises .errors.NoInstallationError: If Nginx ctl cannot be found :raises .errors.MisconfigurationError: If Nginx is misconfigured r zvCould not find a usable 'nginx' binary. Ensure nginx exists, the binary is executable, and your PATH is set correctly.r NzEncountered error:T��exc_infozUnable to lock {0})r Z exe_existsr* r ZNoInstallationError� config_testr Z NginxParserr. � get_versionr/ �_get_openssl_versionrP rN rO Zinstall_ssl_dhparamsZlock_dir_until_exit�OSErrorZ LockError�logger�debug� PluginError�formatr+ r% r% r& �prepare� s" � zNginxConfigurator.prepareNc C s< |st �d��| j|dd�}|D ]}| �|||||� q dS )aU Deploys certificate to specified virtual host. .. note:: Aborts if the vhost is missing ssl_certificate or ssl_certificate_key. .. note:: This doesn't save the config files! :raises errors.PluginError: When unable to deploy certificate due to a lack of directives or configuration zGThe nginx plugin currently requires --fullchain-path to install a cert.T)�create_if_no_matchN)r rY � choose_vhosts� _deploy_cert)r, �domain� cert_path�key_path� chain_path�fullchain_path�vhosts�vhostr% r% r& � deploy_cert� s �z NginxConfigurator.deploy_certc C s� ddd|gddd|gg}| j �||� t�d|j� | jd|jd�dd � |jD ��f 7 _| jd | 7 _| jd | 7 _d S ) a Helper function for deploy_cert() that handles the actual deployment this exists because we might want to do multiple deployments per domain originally passed for deploy_cert(). This is especially true with wildcard certificates � r � r z'Deploying Certificate to VirtualHost %sz)Changed vhost at %s with addresses of %s z, c s s | ]}t |�V qd S �N��str��.0�addrr% r% r& � <genexpr>� s z1NginxConfigurator._deploy_cert.<locals>.<genexpr>z ssl_certificate %s z ssl_certificate_key %s N)r � update_or_add_server_directivesrW �info�filepr8 r) �addrs)r, re r` ra rb rc Zcert_directivesr% r% r& r^ � s ����z NginxConfigurator._deploy_certc C s� |r| j }dd� }n| j}dd� }||kr2|| S | j�� }i }|D ]H}|dk r^| �||�s^qD|jD ]&} ||�rz||| < qd| |krd||| < qdqDtdd� |�� D ��} t� t | ��} | D ]"}||kr�g ||< || � |� q�| S )zCPrompts user to choose vhosts to install a wildcard certificate forc S s | j S ri ��ssl��xr% r% r& �<lambda> � z;NginxConfigurator._choose_vhosts_wildcard.<locals>.<lambda>c S s | j S ri rt rv r% r% r& rx ry Nc S s g | ]}|�qS r% r% �rm re r% r% r& � <listcomp>$ s z=NginxConfigurator._choose_vhosts_wildcard.<locals>.<listcomp>) r: r; r � get_vhosts� _vhost_listening_on_port_no_ssl�names�set�valuesr Zselect_vhost_multiple�list�append) r, r_ � prefer_ssl�no_ssl_filter_portZ vhosts_cacheZpreference_testrd Zfiltered_vhostsre �nameZ dialog_inputZ return_vhostsr% r% r& �_choose_vhosts_wildcard s2 z)NginxConfigurator._choose_vhosts_wildcardc C s$ | � |�}dd� | �|�fD �}|S )Nc S s g | ]}|d k r|�qS ri r% �rm rw r% r% r& r{ 5 s z:NginxConfigurator._choose_vhost_single.<locals>.<listcomp>)�_get_ranked_matches�_select_best_name_match)r, � target_name�matchesrd r% r% r& �_choose_vhost_single3 s z&NginxConfigurator._choose_vhost_singleFc C sr t �|�r| j|dd�}n | �|�}|sT|rF| �|dt| jj��g}nt� d| ��|D ]}|j sX| � |� qX|S )a@ Chooses a virtual host based on the given domain name. .. note:: This makes the vhost SSL-enabled if it isn't already. Follows Nginx's server block selection rules preferring blocks that are already SSL. .. todo:: This should maybe return list if no obvious answer is presented. .. todo:: The special name "$hostname" corresponds to the machine's hostname. Currently we just ignore this. :param str target_name: domain name :param bool create_if_no_match: If we should create a new vhost from default when there is no match found. If we can't choose a default, raise a MisconfigurationError. :returns: ssl vhosts associated with name :rtype: list of :class:`~certbot_nginx.obj.VirtualHost` T)r� a Cannot find a VirtualHost matching domain %s. In order for Certbot to correctly perform the challenge please add a corresponding server_name directive to your nginx configuration for every domain on your certificate: https://nginx.org/en/docs/http/server_names.html) r �is_wildcard_domainr� r� � _vhost_from_duplicated_defaultrk rL � https_portr �MisconfigurationErrorru �_make_server_ssl)r, r� r\ rd re r% r% r& r] 8 s" ��� z NginxConfigurator.choose_vhostsc C sX t |�}| j�� }d}d}|D ]0}|jD ]$}|jr6d}|jr(|�� |kr(d}q(q ||fS )a, Returns tuple of booleans (ipv6_active, ipv6only_present) ipv6_active is true if any server block listens ipv6 address in any port ipv6only_present is true if ipv6only=on option exists in any server block ipv6 listen directive for the specified port. :param str port: Port to check ipv6only=on directive for :returns: Tuple containing information if IPv6 is enabled in the global configuration, and existence of ipv6only directive for specified port :rtype: tuple of type (bool, bool) FT)rk r r| rs �ipv6Zipv6only�get_port)r, �portrd Z ipv6_activeZipv6only_presentZvhrn r% r% r& � ipv6_infog s zNginxConfigurator.ipv6_infoc C sH | j dkr4| �|||�}| jj|dd�| _ t� | j _| �| j |� | j S )z�if allow_port_mismatch is False, only server blocks with matching ports will be used as a default server block template. NT)Z remove_singleton_listen_params)r9 �_get_default_vhostr �duplicate_vhostr r~ �_add_server_name_to_vhost)r, r_ �allow_port_mismatchr� Z default_vhostr% r% r& r� � s � z0NginxConfigurator._vhost_from_duplicated_defaultc C sP |j �|� ddgg}|j D ] }|d �d� |d �|� q | j�||� d S )Nrg � server_namer rh )r~ r# r� r rp )r, re r_ Z name_blockr� r% r% r& r� � s z+NginxConfigurator._add_server_name_to_vhostc C s� | j �� }g }g }|D ]>}|jD ]2}|jr |�|� | �||�� �rN|�|� qq qt|�dkrj|d S t|�dkr�|r�|d S t� d| ��dS )zRHelper method for _vhost_from_duplicated_default; see argument documentation therer r zxCould not automatically find a matching server block for %s. Set the `server_name` directive to use the Nginx installer.N) r r| rs r r� � _port_matchesr� �lenr r� ) r, r_ r� r� � vhost_listZall_default_vhostsZport_matching_vhostsre rn r% r% r& r� � s" �z$NginxConfigurator._get_default_vhostc C s | j �� }| �||�S )a) Returns a ranked list of vhosts that match target_name. The ranking gives preference to SSL vhosts. :param str target_name: The name to match :returns: list of dicts containing the vhost, the matching name, and the numerical rank :rtype: list )r r| � _rank_matches_by_name_and_ssl)r, r� r� r% r% r& r� � s z%NginxConfigurator._get_ranked_matchesc sf |sdS |d d t tt t tt fkrZ|d d � � fdd�|D �}t|dd� d�d S |d d S ) a Returns the best name match of a ranked list of vhosts. :param list matches: list of dicts containing the vhost, the matching name, and the numerical rank :returns: the most matching vhost :rtype: :class:`~certbot_nginx.obj.VirtualHost` Nr �rankc s g | ]}|d � kr|�qS �r� r% r� r� r% r& r{ � s z=NginxConfigurator._select_best_name_match.<locals>.<listcomp>c S s t | d �S )Nr� )r� rv r% r% r& rx � ry z;NginxConfigurator._select_best_name_match.<locals>.<lambda>��keyre )�START_WILDCARD_RANK�END_WILDCARD_RANK�NO_SSL_MODIFIER�max)r, r� Z wildcardsr% r� r& r� � s � z)NginxConfigurator._select_best_name_matchc C s� g }|D ]�}t �||j�\}}|dkr:|�||td�� q|dkrV|�||td�� q|dkrr|�||td�� q|dkr|�||td�� qt|dd� d�S ) a� Returns a ranked list of vhosts from vhost_list that match target_name. This method should always be followed by a call to _select_best_name_match. :param list vhost_list: list of vhosts to filter and rank :param str target_name: The name to match :returns: list of dicts containing the vhost, the matching name, and the numerical rank :rtype: list �exact)re r� r� Zwildcard_startZ wildcard_endZregexc S s | d S �Nr� r% rv r% r% r& rx � ry z9NginxConfigurator._rank_matches_by_name.<locals>.<lambda>r� ) r Zget_best_matchr~ r� � NAME_RANKr� r� � REGEX_RANK�sorted)r, r� r� r� re Z name_typer� r% r% r& �_rank_matches_by_name� s0 � � � � z'NginxConfigurator._rank_matches_by_namec C s@ | � ||�}|D ] }|d js|d t7 < qt|dd� d�S )a� Returns a ranked list of vhosts from vhost_list that match target_name. The ranking gives preference to SSLishness before name match level. :param list vhost_list: list of vhosts to filter and rank :param str target_name: The name to match :returns: list of dicts containing the vhost, the matching name, and the numerical rank :rtype: list re r� c S s | d S r� r% rv r% r% r& rx ry zANginxConfigurator._rank_matches_by_name_and_ssl.<locals>.<lambda>r� )r� ru r� r� )r, r� r� r� �matchr% r% r& r� � s z/NginxConfigurator._rank_matches_by_name_and_sslc C sZ t �|�r | j|d|d�}n"| �||�}dd� | �|�fD �}|sV|rV| �|d|�g}|S )a Chooses a single virtual host for redirect enhancement. Chooses the vhost most closely matching target_name that is listening to port without using ssl. .. todo:: This should maybe return list if no obvious answer is presented. .. todo:: The special name "$hostname" corresponds to the machine's hostname. Currently we just ignore this. :param str target_name: domain name :param str port: port number :param bool create_if_no_match: If we should create a new vhost from default when there is no match found. If we can't choose a default, raise a MisconfigurationError. :returns: vhosts associated with name :rtype: list of :class:`~certbot_nginx.obj.VirtualHost` F)r� r� c S s g | ]}|d k r|�qS ri r% r� r% r% r& r{ " s z<NginxConfigurator.choose_redirect_vhosts.<locals>.<listcomp>)r r� r� � _get_redirect_ranked_matchesr� r� )r, r� r� r\ rd r� r% r% r& �choose_redirect_vhosts s � z(NginxConfigurator.choose_redirect_vhostsc C s" |dks|d kr|| j kS ||kS )Nr0 )�DEFAULT_LISTEN_PORT)r, Z test_portZ matching_portr% r% r& r� ' s z NginxConfigurator._port_matchesc C sR d}|j s|| jk}n&|j D ] }| �||�� �r |js d}q |rN| j�|� S dS )NFT)rs r� r� r� ru r Zhas_ssl_on_directive)r, re r� Zfound_matching_portrn r% r% r& r} . s z1NginxConfigurator._vhost_listening_on_port_no_sslc s6 �j �� }�fdd�� � �fdd�|D �}��||�S )a� Gets a ranked list of plaintextish port-listening vhosts matching target_name Filter all hosts for those listening on port without using ssl. Rank by how well these match target_name. :param str target_name: The name to match :param str port: port number as a string :returns: list of dicts containing the vhost, the matching name, and the numerical rank :rtype: list c s � � | |�S ri )r} )re r� r+ r% r& �_vhost_matchesM s zFNginxConfigurator._get_redirect_ranked_matches.<locals>._vhost_matchesc s g | ]}� |��r|�qS r% r% rz )r� r� r% r& r{ P s zBNginxConfigurator._get_redirect_ranked_matches.<locals>.<listcomp>)r r| r� )r, r� r� Z all_vhostsZmatching_vhostsr% )r� r� r, r& r� > s z.NginxConfigurator._get_redirect_ranked_matchesc C s� t � }| j�� D ]�}|�|j� |jD ]�}|�� }tj� |�rJ|� |� q&tj � |�s&zD|j rv|� � }t�tj|� nt�tj|� |� t�|�d � W q& tjtjtjfk r� Y q&Y q&X q&qt�|�S )z�Returns all names found in the Nginx Configuration. :returns: All ServerNames, ServerAliases, and reverse DNS entries for virtual host addresses :rtype: set r )r r r| �updater~ rs Zget_addrr Zhostname_regexr� r# Zprivate_ips_regexr� Zget_ipv6_exploded�socketZ inet_ptonZAF_INET6ZAF_INETZ gethostbyaddr�errorZherrorZtimeoutr Zget_filtered_names)r, Z all_namesre rn Zhostr% r% r& � get_all_namesT s" z NginxConfigurator.get_all_namesc C s� t j�| jjd�}tjd|dd�}tj� tjj |j �}t j |t�� gd�}tj�tjj |�}tjt j�|d�dd�\}}|� |�|� W 5 Q R X ||jfS ) zBGenerate invalid certs that let us create ssl directives for NginxZsnakeoili zkey.pem)Zkey_sizeZkey_dirZkeyname)Zdomainszcert.pem�wb)�mode)r r( r) rL �work_dirr Z init_save_key�OpenSSLZcryptoZload_privatekeyZ FILETYPE_PEMZpem�acme_crypto_utilZ gen_ss_certr� Z gethostnameZdump_certificater Z unique_file�write�file)r, Ztmp_dirZle_keyr� ZcertZcert_pemZ cert_filer` r% r% r& �_get_snakeoil_pathst s, � � � � z%NginxConfigurator._get_snakeoil_pathsc C s� | j j}| �|�}dg}dg}|jsBddd| jgg}| j�||� |�� r|dddd�|�ddg}|d s||� d� |� d� |� � r�dddd �|�ddg}| � � \}}||dd d|gdd d|gdd d| j gdd d| j gg} | j�|| � dS )z�Make a server SSL. Make a server SSL by adding new listen and SSL directives. :param vhost: The vhost to add SSL to. :type vhost: :class:`~certbot_nginx.obj.VirtualHost` r0 rg �listenrh z[::]:{0}ru r z ipv6only=onz{0}r r �includer N)rL r� r� rs r� r �add_server_directivesZ ipv6_enabledrZ r� Z ipv4_enabledr� rN Z ssl_dhparams) r, re r� Zipv6infoZ ipv6_blockZ ipv4_blockZ listen_blockZ snakeoil_certZ snakeoil_keyZ ssl_blockr% r% r& r� � sL � � � �z"NginxConfigurator._make_server_sslc C s dddgS )z)Returns currently supported enhancements.r1 r2 r3 r% r+ r% r% r& �supported_enhancements� s z(NginxConfigurator.supported_enhancementsc C sd z| j | ||�W S ttfk r: t�d�|���Y n& tjk r^ t�d||� � Y nX dS )aa Enhance configuration. :param str domain: domain to enhance :param str enhancement: enhancement type defined in :const:`~certbot.constants.ENHANCEMENTS` :param options: options for the enhancement See :const:`~certbot.constants.ENHANCEMENTS` documentation for appropriate parameter. z Unsupported enhancement: {0}zFailed %s for %sN)r@ �KeyError� ValueErrorr rY rZ rW �warning)r, r_ Z enhancementZoptionsr% r% r& �enhance� s �zNginxConfigurator.enhancec C s t t|��}|�|�S ri )�_test_block_from_block�_redirect_block_for_domainZ contains_list)r, re r_ Ztest_redirect_blockr% r% r& �_has_certbot_redirect� s z'NginxConfigurator._has_certbot_redirectc C s� | � |�}|st�d��|D ]p}|�|�r8t�d| ��|jr`tdd� |jD ��r`| �|�\}}ddd|dgt j | dgg}| j � ||� q d S ) ab Enables header identified by header_substring on domain. If the vhost is listening plaintextishly, separates out the relevant directives into a new server block, and only add header directive to HTTPS block. :param str domain: the domain to enable header for. :param str header_substring: String to uniquely identify a header. e.g. Strict-Transport-Security, Upgrade-Insecure-Requests :returns: Success :raises .errors.PluginError: If no viable HTTPS host can be created or set with header header_substring. z8Unable to find corresponding HTTPS host for enhancement.zExisting %s headerc S s g | ] }|j �qS r% rt rl r% r% r& r{ � s z6NginxConfigurator._set_http_header.<locals>.<listcomp>rg Z add_headerrh � N) r] r rY Z has_headerZ PluginEnhancementAlreadyPresentru �anyrs � _split_blockr Z HEADER_ARGSr r� )r, r_ Zheader_substringrd re �_Zheader_directivesr% r% r& r> � s$ � � ��z"NginxConfigurator._set_http_headerc C s t |�}| jj||dd� dS )z(Add redirect directive to vhost T)Z insert_at_topN)r� r r� )r, re r_ �redirect_blockr% r% r& �_add_redirect_block� s �z%NginxConfigurator._add_redirect_blockc s� � j j||d�}dd� }� fdd�}dd� }� jD ]}� j �||� q2� j j|d|d � � j j|d |d � � j j|d|d � ||fS ) a� Splits this "virtual host" (i.e. this nginx server block) into separate HTTP and HTTPS blocks. :param vhost: The server block to break up into two. :param list only_directives: If this exists, only duplicate these directives when splitting the block. :type vhost: :class:`~certbot_nginx.obj.VirtualHost` :returns: tuple (http_vhost, https_vhost) :rtype: tuple of type :class:`~certbot_nginx.obj.VirtualHost` )�only_directivesc S s d| kS �Nru r% �� directiver% r% r& �_ssl_match_func s z7NginxConfigurator._split_block.<locals>._ssl_match_funcc s � j | kS ri )rN r� r+ r% r& �_ssl_config_match_func s z>NginxConfigurator._split_block.<locals>._ssl_config_match_funcc S s d| kS r� r% r� r% r% r& �_no_ssl_match_func s z:NginxConfigurator._split_block.<locals>._no_ssl_match_funcr� )Z match_funcr� )r r� �SSL_DIRECTIVESZremove_server_directives)r, re r� � http_vhostr� r� r� r� r% r+ r& r� s �z NginxConfigurator._split_blockc C sB | j }| �||�}|s(t�d| j � dS |D ]}| �||� q,dS )a� Redirect all equivalent HTTP traffic to ssl_vhost. If the vhost is listening plaintextishly, separate out the relevant directives into a new server block and add a rewrite directive. .. note:: This function saves the configuration :param str domain: domain to enable redirect for :param unused_options: Not currently used :type unused_options: Not Available z>No matching insecure server blocks listening on port %s found.N)r� r� rW rq �_enable_redirect_single)r, r_ Zunused_optionsr� rd re r% r% r& r= % s �z"NginxConfigurator._enable_redirectc C s| |j r:| �|ddg�\}}ddddgg}| j�||� |}| �||�rZt�d| j|j� n | � ||� t�d| j|j� d S ) a� Redirect all equivalent HTTP traffic to ssl_vhost. If the vhost is listening plaintextishly, separate out the relevant directives into a new server block and add a rewrite directive. .. note:: This function saves the configuration :param str domain: domain to enable redirect for :param `~obj.Vhost` vhost: vhost to enable redirect for r� r� rg �returnrh Z404z3Traffic on port %s already redirecting to ssl in %sz/Redirecting all traffic on port %s to ssl in %sN) ru r� r r� r� rW rq r� rr r� )r, r_ re r� r� Zreturn_404_directiver% r% r& r� @ s � �z)NginxConfigurator._enable_redirect_singlec C s$ | � |�}|D ]}| �||� qdS )z�Include OCSP response in TLS handshake :param str domain: domain to enable OCSP response for :param chain_path: chain file path :type chain_path: `str` or `None` N)r] � _enable_ocsp_stapling_single)r, r_ rb rd re r% r% r& r? ] s z'NginxConfigurator._enable_ocsp_staplingc C s� | j dk rt�d��|dkr&t�d��ddd|gdddd gdd dd gd gg}z| j�||� W nD tjk r� } z$t�t|�� t�d � |j ���W 5 d}~X Y nX | j d � |j �7 _ | j d� |�7 _ | j d7 _ | j d7 _ dS )z�Include OCSP response in TLS handshake :param str vhost: vhost to enable OCSP response for :param chain_path: chain file path :type chain_path: `str` or `None` )r r � zCVersion 1.3.7 or greater of nginx is needed to enable OCSP staplingNzh--chain-path is required to enable Online Certificate Status Protocol (OCSP) stapling on nginx >= 1.3.7.rg Zssl_trusted_certificaterh Z ssl_staplingZonZssl_stapling_verifyr� z7An error occurred while enabling OCSP stapling for {0}.z-OCSP Stapling was enabled on SSL Vhost: {0}. z ssl_trusted_certificate {0} z ssl_stapling on z ssl_stapling_verify on ) r. r rY r r� r� rW rX rk rZ r~ r8 rr )r, re rb Zstapling_directivesr� r% r% r& r� i s4 � ��� �z.NginxConfigurator._enable_ocsp_stapling_singlec C s t | �d�| j� dS )zlRestarts nginx server. :raises .errors.MisconfigurationError: If either the reload fails. r N)� nginx_restartr* r- r+ r% r% r& �restart� s zNginxConfigurator.restartc C sV z t �| �d�d| jdg� W n2 tjk rP } zt�t|���W 5 d}~X Y nX dS )z{Check the configuration of Nginx for errors. :raises .errors.MisconfigurationError: If config_test fails r �-cz-tN)r Z run_scriptr* r- r ZSubprocessErrorr� rk )r, �errr% r% r& rS � s z NginxConfigurator.config_testc C s: t �| jjtj� t �| jjtj� t �| jjtj� dS )z�Verify the setup to ensure safe operating environment. Make sure that files/directories are setup with appropriate permissions Aim for defensive coding... make sure all input files have permissions of root. N)r Zmake_or_verify_dirrL r� �core_constantsZCONFIG_DIRS_MODEZ backup_dirrM r+ r% r% r& r7 � s z NginxConfigurator._verify_setupc C s� z6t j| �d�d| jdgt jt jdd�}|�� d }W nL ttfk r� } z*tj t |�dd� t � d| �d� ��W 5 d }~X Y nX |S ) z�Return results of nginx -V :returns: version text :rtype: str :raises .PluginError: Unable to run Nginx version command r r� z-VT)�stdout�stderrZuniversal_newlinesr rQ zUnable to run %s -VN) � subprocess�Popenr* r- �PIPE� communicaterV r� rW rX rk r rY )r, �proc�textr� r% r% r& �_nginx_version� s � �z NginxConfigurator._nginx_versionc C s� | � � }t�dtj�}|�|�}t�dtj�}|�|�}t�d�}|�|�}|sZt�d��|sht�d��|svt�d��|d \}} |dkr�t�d |� t d d � | � d �D ��} | d k r�t� d��| S )z�Return version of Nginx Server. Version is returned as tuple. (ie. 2.4.7 = (2, 4, 7)) :returns: version :rtype: tuple :raises .PluginError: Unable to find Nginx version or version is unsupported z!nginx version: ([^/]+)/([0-9\.]*)zTLS SNI support enabledz --with-http_ssl_modulez Unable to find Nginx versionz;Nginx build is missing SSL module (--with-http_ssl_module).z Nginx build doesn't support SNIr Znginxz:NGINX derivative %s is not officially supported by certbotc S s g | ] }t |��qS r% )�int�rm �ir% r% r& r{ � s z1NginxConfigurator.get_version.<locals>.<listcomp>�.)r � �0 z Nginx version must be 0.8.48+) r� �re�compile� IGNORECASE�findallr rY rW r� �tuple�splitZNotSupportedError) r, r� Z version_regexZversion_matchesZ sni_regexZ sni_matchesZ ssl_regexZ ssl_matchesZ product_nameZproduct_versionZ nginx_versionr% r% r& rT � s0 � � z NginxConfigurator.get_versionc C s> | � � }t�d|�}|s6t�d|�}|s6t�d� dS |d S )a Return version of OpenSSL linked to Nginx. Version is returned as string. If no version can be found, empty string is returned. :returns: openssl_version :rtype: str :raises .PluginError: Unable to run Nginx version command z running with OpenSSL ([^ ]+) zbuilt with OpenSSL ([^ ]+) zQNGINX configured with OpenSSL alternatives is not officiallysupported by Certbot.r0 r )r� r� r� rW r� )r, r� r� r% r% r& rU � s z&NginxConfigurator._get_openssl_versionc C s( dj tj| jjd�dd� | jD ��d�S )z3Human-readable string to help understand the modulez^Configures Nginx to authenticate and install HTTPS.{0}Server root: {root}{0}Version: {version}r� c s s | ]}t |�V qd S ri rj r� r% r% r& ro s z.NginxConfigurator.more_info.<locals>.<genexpr>)�rootr. )rZ r �linesepr Z config_rootr) r. r+ r% r% r& � more_info s ��zNginxConfigurator.more_infoc C sJ t | jj�� �}| �|| j|� d| _| jjdd� |rF|sF| �|� dS )a Saves all changes to the configuration files. :param str title: The title of the save. If a title is given, the configuration will be saved as a new checkpoint and put in a timestamped directory. :param bool temporary: Indicates whether the changes made will be quickly reversed in the future (ie. challenges) :raises .errors.PluginError: If there was an error in an attempt to save the configuration, or an error creating a checkpoint r0 )ZextN)r r Zparsed�keysZadd_to_checkpointr8 ZfiledumpZfinalize_checkpoint)r, �titleZ temporaryZ save_filesr% r% r& �save s zNginxConfigurator.savec s" t t| ��� d| _| j�� dS )z�Revert all previously modified files. Reverts all modified files that have not been saved as a checkpoint :raises .errors.PluginError: If unable to recover the configuration N)r5 r rA r9 r �loadr+ rD r% r& rA . s z"NginxConfigurator.recovery_routinec C s | � � d| _| j�� dS )z�Used to cleanup challenge configurations. :raises .errors.PluginError: If unable to revert the challenge config. N)Zrevert_temporary_configr9 r r� r+ r% r% r& �revert_challenge_config: s z)NginxConfigurator.revert_challenge_configr c s$ t t| ��|� d| _| j�� dS )z�Rollback saved checkpoints. :param int rollback: Number of checkpoints to revert :raises .errors.PluginError: If there is a problem with the input or the function is unable to correctly revert the configuration N)r5 r �rollback_checkpointsr9 r r� )r, ZrollbackrD r% r& r� D s z&NginxConfigurator.rollback_checkpointsc C s t jgS )z%Return list of challenge preferences.)r ZHTTP01)r, Z unused_domainr% r% r& �get_chall_prefT s z NginxConfigurator.get_chall_prefc C s| | j t|�7 _ dgt|� }t�| �}t|�D ]\}}|�||� q2|�� }| �� t|�D ]\}}|||j| < q`|S )a Perform the configuration related challenge. This function currently assumes all challenges will be fulfilled. If this turns out not to be the case in the future. Cleanup and outstanding challenges will have to be designed better. N) r< r� r Z NginxHttp01� enumerateZ add_chall�performr� �indices)r, �achallsZ responsesZ http_doerr� ZachallZ http_responseZrespr% r% r& r Y s zNginxConfigurator.performc C s0 | j t|�8 _ | j dkr,| �� | �� dS )zRevert all challenges.r N)r< r� r� r� )r, r r% r% r& �cleanupy s zNginxConfigurator.cleanup)NN)N)F)F)N)N)NF)r )>�__name__� __module__� __qualname__�__doc__Z descriptionr� r� � classmethodr' �propertyr- r6 rK rN rO rP r[ rf r^ r� r� r] r� r� r� r� r� r� r� r� r� r� r} r� r� r� r� r� r� r� r> r� r� r= r� r? r� r� rS r7 r� rT rU r� r� rA r� r� r� r r � __classcell__r% r% rD r& r - s~ ) % � 1 / % ! 9 " ! ( - r c C s" t �| �}t�|d� |d d� S )Nr ���)r Z UnspacedListr Zcomment_directive)�blockZ test_blockr% r% r& r� � s r� c C sr | }d}t �| �r:d}|�dd�}|�dd�}d| d }d d d d d |d d | d g ddd dd dgd ggdgg}|S )N�=�~r� z\.�*z[^.]+�^�$rg �ifrh z($hostz%s)z r� Z301zhttps://$host$request_urir� )r r� �replace)r_ Zupdated_domainZ match_symbolr� r% r% r& r� � s ���r� c C s� z�t �| d|ddg�}|�� |jdkr�t�� �\}t�� �H}t j| d|g||d�}|�� |jdkr~t�d|�� |�� f ��W 5 Q R X W 5 Q R X W n" t t fk r� t�d��Y nX t � d� d S ) a Restarts the Nginx Server. .. todo:: Nginx restart is fatal if the configuration references non-existent SSL cert/key files. Remove references to /etc/letsencrypt before restart. :param str nginx_ctl: Path to the Nginx binary. r� z-s�reloadr )r� r� znginx restart failed: %s %sznginx restart failedr N) r� r� r� � returncode�tempfileZ TemporaryFiler r� �readrV r� �time�sleep)Z nginx_ctlr- r� �outr� Z nginx_procr% r% r& r� � s$ � � r� c C s0 t j�d�dkr"dtjtjf } n tjd } | S )NZ CERTBOT_DOCS�1z%s or %sr )r �environ�getr ZLINUX_SERVER_ROOTZFREEBSD_DARWIN_SERVER_ROOTr! )r$ r% r% r& r � s � r )9r Zdistutils.versionr Zloggingr� r� r� r r rJ r� Zzope.interface�zopeZacmer r r� Zacme.magic_typingr r r Zcertbotr r� r r r Zcertbot.compatr Zcertbot.pluginsr rI r r r r r r� r� r� r� r� Z getLoggerr rW Z interfaceZ implementerZIAuthenticatorZ IInstallerZproviderZIPluginFactoryZ Installerr r� r� r� r r% r% r% r& �<module> s^ \$
Save File
Cancel