358 lines
9.8 KiB
Python
358 lines
9.8 KiB
Python
from typing import Any
|
|
|
|
from ...adapters import (
|
|
CERTIFICATES,
|
|
PROXY_HOSTS,
|
|
Capability,
|
|
CapabilityOperation,
|
|
DiscoveredObject,
|
|
NormalizedObject,
|
|
ObjectReference,
|
|
)
|
|
from ...certificates.material import CertificateMaterial
|
|
from ...npm_client import NpmClient
|
|
from ...object_normalizer import normalize_discovered_object
|
|
|
|
|
|
_PROXY_HOST_FIELDS = (
|
|
"domain_names",
|
|
"forward_scheme",
|
|
"forward_host",
|
|
"forward_port",
|
|
"certificate_id",
|
|
"ssl_forced",
|
|
"caching_enabled",
|
|
"block_exploits",
|
|
"allow_websocket_upgrade",
|
|
"http2_support",
|
|
"hsts_enabled",
|
|
"hsts_subdomains",
|
|
"enabled",
|
|
)
|
|
|
|
|
|
class Plugin:
|
|
name = "npm"
|
|
capabilities = frozenset(
|
|
{
|
|
Capability(
|
|
PROXY_HOSTS,
|
|
CapabilityOperation.DISCOVER,
|
|
),
|
|
Capability(
|
|
PROXY_HOSTS,
|
|
CapabilityOperation.VERIFY,
|
|
),
|
|
Capability(
|
|
CERTIFICATES,
|
|
CapabilityOperation.DISCOVER,
|
|
),
|
|
Capability(
|
|
CERTIFICATES,
|
|
CapabilityOperation.VERIFY,
|
|
),
|
|
}
|
|
)
|
|
|
|
def __init__(self, config, endpoint):
|
|
self.config = config
|
|
self.endpoint = endpoint
|
|
self.client = NpmClient(config, endpoint)
|
|
|
|
@staticmethod
|
|
def _local_key(row: dict[str, Any], label: str) -> str:
|
|
local_id = row.get("id")
|
|
if isinstance(local_id, bool) or not isinstance(local_id, int):
|
|
raise RuntimeError(
|
|
f"NPM {label} has invalid id: {local_id!r}"
|
|
)
|
|
return str(local_id)
|
|
|
|
def connect(self) -> None:
|
|
self.client.login()
|
|
|
|
def discover(
|
|
self,
|
|
object_type: str,
|
|
) -> list[DiscoveredObject]:
|
|
if object_type == PROXY_HOSTS:
|
|
return self._discover_proxy_hosts()
|
|
if object_type == CERTIFICATES:
|
|
return self._discover_certificates()
|
|
|
|
raise RuntimeError(
|
|
f"{self.endpoint.identity} cannot discover "
|
|
f"object type {object_type!r}"
|
|
)
|
|
|
|
def _proxy_host_from_row(
|
|
self,
|
|
row: dict[str, Any],
|
|
) -> DiscoveredObject:
|
|
payload = {
|
|
field: row.get(field)
|
|
for field in _PROXY_HOST_FIELDS
|
|
}
|
|
|
|
certificate_id = row.get("certificate_id")
|
|
|
|
if certificate_id in (None, "", 0, "0"):
|
|
references = ()
|
|
else:
|
|
if isinstance(certificate_id, bool):
|
|
raise RuntimeError(
|
|
"NPM proxy host has invalid certificate_id"
|
|
)
|
|
|
|
certificate_local_key = str(
|
|
certificate_id
|
|
).strip()
|
|
|
|
if not certificate_local_key:
|
|
raise RuntimeError(
|
|
"NPM proxy host has invalid certificate_id"
|
|
)
|
|
|
|
references = (
|
|
ObjectReference(
|
|
relation="certificate",
|
|
object_type=CERTIFICATES,
|
|
local_key=certificate_local_key,
|
|
),
|
|
)
|
|
|
|
return DiscoveredObject(
|
|
object_type=PROXY_HOSTS,
|
|
local_key=self._local_key(
|
|
row,
|
|
"proxy host",
|
|
),
|
|
payload=payload,
|
|
references=references,
|
|
)
|
|
|
|
def _certificate_from_row(
|
|
self,
|
|
row: dict[str, Any],
|
|
) -> DiscoveredObject:
|
|
meta = row.get("meta")
|
|
if not isinstance(meta, dict):
|
|
meta = {}
|
|
|
|
return DiscoveredObject(
|
|
object_type=CERTIFICATES,
|
|
local_key=self._local_key(
|
|
row,
|
|
"certificate",
|
|
),
|
|
payload={
|
|
"domain_names": list(
|
|
row.get("domain_names") or []
|
|
),
|
|
"provider": str(
|
|
row.get("provider") or ""
|
|
),
|
|
"nice_name": str(
|
|
row.get("nice_name") or ""
|
|
),
|
|
"valid_from": row.get("valid_from"),
|
|
"expires_on": row.get("expires_on"),
|
|
"cluster_managed": (
|
|
meta.get("cluster_managed") is True
|
|
),
|
|
"acme_renew": (
|
|
meta.get("acme_renew") is True
|
|
),
|
|
"dns_challenge": (
|
|
meta.get("dns_challenge") is True
|
|
),
|
|
},
|
|
)
|
|
|
|
def _discover_proxy_hosts(self) -> list[DiscoveredObject]:
|
|
return [
|
|
self._proxy_host_from_row(row)
|
|
for row in self.client.proxy_hosts()
|
|
]
|
|
|
|
def _discover_certificates(self) -> list[DiscoveredObject]:
|
|
return [
|
|
self._certificate_from_row(row)
|
|
for row in self.client.certificates()
|
|
]
|
|
|
|
@staticmethod
|
|
def _portable_certificate_matches(
|
|
actual: NormalizedObject,
|
|
desired: NormalizedObject,
|
|
) -> bool:
|
|
if actual.object_type != CERTIFICATES:
|
|
return False
|
|
|
|
if desired.object_type != CERTIFICATES:
|
|
return False
|
|
|
|
if actual.logical_key != desired.logical_key:
|
|
return False
|
|
|
|
for field in (
|
|
"domain_names",
|
|
"valid_from",
|
|
"expires_on",
|
|
):
|
|
if (
|
|
actual.payload.get(field)
|
|
!= desired.payload.get(field)
|
|
):
|
|
return False
|
|
|
|
return True
|
|
|
|
def _certificate_material_source(
|
|
self,
|
|
desired: NormalizedObject,
|
|
) -> CertificateMaterial:
|
|
if desired.object_type != CERTIFICATES:
|
|
raise RuntimeError(
|
|
"Certificate material source requires "
|
|
"a certificate object"
|
|
)
|
|
|
|
matches: list[
|
|
tuple[str, str, CertificateMaterial]
|
|
] = []
|
|
source_errors: list[str] = []
|
|
|
|
for endpoint in sorted(
|
|
self.config.npm_endpoints,
|
|
key=lambda item: item.identity,
|
|
):
|
|
if endpoint.identity == self.endpoint.identity:
|
|
continue
|
|
|
|
client = NpmClient(
|
|
self.config,
|
|
endpoint,
|
|
)
|
|
|
|
try:
|
|
rows = client.certificates()
|
|
except Exception as exc:
|
|
source_errors.append(
|
|
f"{endpoint.identity}: "
|
|
f"{type(exc).__name__}"
|
|
)
|
|
continue
|
|
|
|
for row in rows:
|
|
candidate = normalize_discovered_object(
|
|
self._certificate_from_row(row)
|
|
)
|
|
|
|
if not self._portable_certificate_matches(
|
|
candidate,
|
|
desired,
|
|
):
|
|
continue
|
|
|
|
if candidate.local_key is None:
|
|
raise RuntimeError(
|
|
"Matching NPM certificate has no "
|
|
"endpoint-local key"
|
|
)
|
|
|
|
material = client.certificate_material(
|
|
candidate.local_key
|
|
)
|
|
|
|
matches.append(
|
|
(
|
|
endpoint.identity,
|
|
candidate.local_key,
|
|
material,
|
|
)
|
|
)
|
|
|
|
if not matches:
|
|
detail = ""
|
|
|
|
if source_errors:
|
|
detail = (
|
|
"; unavailable sources: "
|
|
+ ", ".join(source_errors)
|
|
)
|
|
|
|
raise RuntimeError(
|
|
"No NPM source certificate material found for "
|
|
f"{desired.logical_key!r}"
|
|
f"{detail}"
|
|
)
|
|
|
|
baseline = matches[0][2]
|
|
|
|
for _, _, material in matches[1:]:
|
|
if material != baseline:
|
|
endpoints = ", ".join(
|
|
sorted(
|
|
{
|
|
endpoint_id
|
|
for (
|
|
endpoint_id,
|
|
_,
|
|
_,
|
|
) in matches
|
|
}
|
|
)
|
|
)
|
|
raise RuntimeError(
|
|
"Conflicting NPM certificate material "
|
|
f"sources for {desired.logical_key!r}: "
|
|
f"{endpoints}"
|
|
)
|
|
|
|
return baseline
|
|
|
|
def apply(self, action):
|
|
raise RuntimeError(
|
|
f"{self.endpoint.identity} does not support apply yet"
|
|
)
|
|
|
|
def verify(self, object: NormalizedObject) -> bool:
|
|
if object.local_key is None:
|
|
return False
|
|
|
|
if object.object_type == PROXY_HOSTS:
|
|
row = self.client.proxy_host(
|
|
object.local_key
|
|
)
|
|
actual = normalize_discovered_object(
|
|
self._proxy_host_from_row(row)
|
|
)
|
|
|
|
return actual == object
|
|
|
|
if object.object_type == CERTIFICATES:
|
|
row = self.client.certificate(
|
|
object.local_key
|
|
)
|
|
actual = normalize_discovered_object(
|
|
self._certificate_from_row(row)
|
|
)
|
|
|
|
if actual.local_key != object.local_key:
|
|
return False
|
|
|
|
# Provider, display name, and renewal flags describe how
|
|
# this NPM endpoint manages the certificate. They are not
|
|
# portable certificate identity. A copied Let's Encrypt
|
|
# certificate becomes provider="other" on the recipient.
|
|
return self._portable_certificate_matches(
|
|
actual,
|
|
object,
|
|
)
|
|
|
|
raise RuntimeError(
|
|
f"{self.endpoint.identity} cannot verify "
|
|
f"object type {object.object_type!r}"
|
|
)
|