�
E��c� � �" � U d Z ddlZddlmZ ddlmZ ddlmZ ddlmZ ddlmZ ddlmZ dd lm Z dd
l
m Z dd l
m Z dd l
mZ g d
�Z de j deeeef ddf fd�Zde j defd�Zde j de e j defd�Zde e j dee de e j de j ddf
d�Zded ddfd�Z G d� deej � � � Z d d d ej d d!d"gd d#e d$d%d&d'� gZ eeeef e d(< dS ))z(New interface style Certbot enhancements� N)�Any)�Callable)�Dict)� Generator)�Iterable)�List)�Optional)�
configuration)�
interfaces)� constants)�redirectzensure-http-headerz
ocsp-stapling�config�returnc # �R K � t D ] }t | |d � � r|V � � dS )z�
Generator to yield the enabled new style enhancements.
:param config: Configuration.
:type config: certbot.configuration.NamespaceConfig
�cli_destN)�_INDEX�getattr)r �enhs �>/usr/lib/python3/dist-packages/certbot/plugins/enhancements.py�enabled_enhancementsr sA � � � � � � �� �6�3�z�?� +� +� ��I�I�I��� � c �: � t t | � � � � S )z�
Checks if one or more of the requested enhancements are those of the new
enhancement interfaces.
:param config: Configuration.
:type config: certbot.configuration.NamespaceConfig
)�anyr )r s r �
are_requestedr ( s � � �#�F�+�+� ,� ,�,r � installerc �\ � t | � � D ]}t ||d � � s dS � dS )ai
Checks that all of the requested enhancements are supported by the
installer.
:param config: Configuration.
:type config: certbot.configuration.NamespaceConfig
:param installer: Installer object
:type installer: interfaces.Installer
:returns: If all the requested enhancements are supported by the installer
:rtype: bool
�classFT)r �
isinstance)r r r s r �
are_supportedr 3 sB � � $�F�+�+� � ���)�S��\�2�2� ��5�5� � �4r �lineage�domainsc �r � |r2t |� � D ]$} t ||d � � | |� � �#dS dS )a�
Run enable method for each requested enhancement that is supported.
:param lineage: Certificate lineage object
:type lineage: certbot.interfaces.RenewableCert
:param domains: List of domains in certificate to enhance
:type domains: str
:param installer: Installer object
:type installer: interfaces.Installer
:param config: Configuration.
:type config: certbot.configuration.NamespaceConfig
�enable_functionN)r r )r r! r r r s r �enabler$ H sc � �$ � I�'��/�/� I� I�C� 6�G�I�s�#4� 5� 6� 6�w�� H� H� H� H�I� I� I� Ir �add).Nc
� � t D ]7} | |d |d |d |d |d |d �� � �8dS ) z�
Populates the command line flags for certbot._internal.cli.HelpfulParser
:param add: Add function of certbot._internal.cli.HelpfulParser
:type add: func
�
cli_groups�cli_flag�
cli_actionr �cli_flag_default�cli_help)�action�dest�default�helpN)r )r% r s r � populate_clir0 _ se � � � "� "�� ��C� � �s�:��s�<�7H��Z� �#�.@�*A��Z� � "� "� "� "� "�"� "r c �� � e Zd ZdZej dej dededdfd�� � Z ej dej dededdfd�� � Z
ej de ej d e e
dededdf
d
�� � ZdS ) �AutoHSTSEnhancementa;
Enhancement interface that installer plugins can implement in order to
provide functionality that configures the software to have a
'Strict-Transport-Security' with initially low max-age value that will
increase over time.
The plugins implementing new style enhancements are responsible of handling
the saving of configuration checkpoints as well as calling possible restarts
of managed software themselves. For update_autohsts method, the installer may
have to call prepare() to finalize the plugin initialization.
Methods:
enable_autohsts is called when the header is initially installed using a
low max-age value.
update_autohsts is called every time when Certbot is run using 'renew'
verb. The max-age value should be increased over time using this method.
deploy_autohsts is called for every lineage that has had its certificate
renewed. A long HSTS max-age value should be set here, as we should be
confident that the user is able to automatically renew their certificates.
r �args�kwargsr Nc � � dS )a�
Gets called for each lineage every time Certbot is run with 'renew' verb.
Implementation of this method should increase the max-age value.
:param lineage: Certificate lineage object
:type lineage: certbot.interfaces.RenewableCert
.. note:: prepare() method inherited from `interfaces.Plugin` might need
to be called manually within implementation of this interface method
to finalize the plugin initialization.
N� ��selfr r3 r4 s r �update_autohstsz#AutoHSTSEnhancement.update_autohsts� � � � � r c � � dS )a
Gets called for a lineage when its certificate is successfully renewed.
Long max-age value should be set in implementation of this method.
:param lineage: Certificate lineage object
:type lineage: certbot.interfaces.RenewableCert
Nr6 r7 s r �deploy_autohstsz#AutoHSTSEnhancement.deploy_autohsts� r: r r! c � � dS )a�
Enables the AutoHSTS enhancement, installing
Strict-Transport-Security header with a low initial value to be increased
over the subsequent runs of Certbot renew.
:param lineage: Certificate lineage object
:type lineage: certbot.interfaces.RenewableCert
:param domains: List of domains in certificate to enhance
:type domains: `list` of `str`
Nr6 )r8 r r! r3 r4 s r �enable_autohstsz#AutoHSTSEnhancement.enable_autohsts� r: r )�__name__�
__module__� __qualname__�__doc__�abc�abstractmethodr �
RenewableCertr r9 r< r r �strr> r6 r r r2 r2 l s � � � � � �� �2 �� �z�'?� �� �WZ� �_c� � � � �� � �� �z�'?� �� �WZ� �_c� � � � �� � �� �x�
�0H�'I� �T\�]`�Ta� � "� �.1� �6:� � � � �� � � r r2 )� metaclass�AutoHSTSzUGradually increasing max-age value for HTTP Strict Transport Security security headerz --auto-hsts� auto_hsts�security�enhance�
store_truer9 r< r> ) �namer+ r( r* r' r r) r �updater_function�deployer_functionr# r ) rB rC �typingr r r r r r r �certbotr
r �certbot._internalr � ENHANCEMENTS�NamespaceConfigrF r �boolr � Installerr rE r$ r0 �object�ABCMetar2 � CLI_DEFAULTSr �__annotations__r6 r r �<module>r[ s� �� .� .� .�
�
�
�
� � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � !� !� !� !� !� !� � � � � � � '� '� '� '� '� '�B�B�B� ��
� �-�
�2;�D��c��N�D�RV�<V�2W�
�
�
�
�-�-�7� -�D� -� -� -� -��-�7� � %�j�&:� ;��@D�� � � �*I�H�Z� 5�6� I��#� � I� �z� 3�4�I� �0�I�59�I� I� I� I�.
"�h�y�)�
"�d�
"�
"�
"�
"�? � ? � ? � ? � ? �&�C�K� ? � ? � ? � ? �N �/�!� %� 2�;� ?�!�9�-� �"�$� -� .�,�
�
� ���T�#�s�(�^� � � � � � r |