3
گab @ s d Z ddlmZ ddlZddlmZ ddlmZ ddlmZ ddlmZ ddlm Z dd lm
Z
dd
lm Z dd lm Z dd lm
Z
ddlZdd
lmZ ddlmZ ddlmZ ddlmZ ddlmZ ddlmZ dZdZdddddddd d d d d d!d"d#d$d%d&d'd(d)d*d+d,d-d.d/Zed0d1 ej D Z e j ed2d1 ej D e e d3d4d5Z!G d6d7 d7ej"ej#Z#G d8d9 d9ej$eZ%G d:d; d;e%Z&e&d<Z'e&d=Z(e&d>Z)e&d?Z*e&d@Z+e&dAZ,e&dBZ-e&dCZ.G dDdE dEe%Z/e/dFZ0e/dGZ1G dHdI dIej"Z2G dJdK dKej$Z3G dLdM dMej"Z4G dNdO dOe4Z5G dPdQ dQej"Z6G dRdS dSZ7G dTdU dUe6Z8e3j9G dVdW dWee8Z:G dXdY dYee8Z;G dZd[ d[e5ZG d`da dae6Z?e3j9G dbdc dcee?Z@G ddde deee?ZAG dfdg dge5ZBe3j9G dhdi dieej"ZCG djdk dke5ZDe3j9G dldm dmeej"ZEG dndo doe6ZFG dpdq dqe5ZGe3j9G drds dseFZHdS )tzACME protocol messages. )HashableN)Any)Dict)Iterator)List)Mapping)MutableMapping)Tuple)Type)Optional)
challenges)errors)fields)jws)util)
ResourceMixinzurn:acme:error:zurn:ietf:params:acme:error:z4The request specified an account that does not existzOThe request specified a certificate to be revoked that has already been revokedz2The CSR is unacceptable (e.g., due to a short key)z1The client sent an unacceptable anti-replay noncez>The JWS was signed by a public key the server does not supportz;The revocation reason provided is not allowed by the serverz@The JWS was signed with an algorithm the server does not supportz\Certification Authority Authorization (CAA) records forbid the CA from issuing a certificatezBSpecific error conditions are indicated in the "subproblems" arrayz?The server could not connect to the client to verify the domainzAThere was a problem with a DNS query during identifier validationz4The server could not validate a DNSSEC signed domainz;Response received didn't match the challenge's requirementsz1The provided email for a registration was invalidz$The provided contact URI was invalidz!The request message was malformedz9The server will not issue certificates for the identifierzLThe request attempted to finalize an order that is not ready to be finalizedz,There were too many requests of a given typez(The server experienced an internal errorz=The server experienced a TLS error during domain verificationz)The client lacks sufficient authorizationz@A contact URL for an account used an unsupported protocol schemez*The server could not resolve a domain namez'An identifier is of an unsupported typez,The server requires external account binding)ZaccountDoesNotExistZalreadyRevokedZbadCSRZbadNonceZ badPublicKeyZbadRevocationReasonZbadSignatureAlgorithmZcaaZcompoundZ
connectiondnsZdnssecZincorrectResponseZ invalidEmailZinvalidContactZ malformedZrejectedIdentifierZ
orderNotReadyZ rateLimitedZserverInternalZtlsZ unauthorizedZunsupportedContactZ unknownHostZunsupportedIdentifierexternalAccountRequiredc c s | ]\}}t | |fV qd S )N) ERROR_PREFIX).0namedesc r /usr/lib/python3.6/messages.py < s r c c s | ]\}}t | |fV qd S )N)OLD_ERROR_PREFIX)r r r r r r r ? s )errreturnc C s, t | tr(| jdk r(t| jkp&t| jkS dS )z#Check if argument is an ACME error.NF)
isinstanceErrortypr r )r r r r
is_acme_errorB s r! c @ s e Zd ZdZejddddZejdddZejdddZe e
e d d d
d Z e
ee
d d
dZe
ee
d ddZe
d ddZdS )r zACME error.
https://tools.ietf.org/html/draft-ietf-appsawg-http-problem-00
:ivar unicode typ:
:ivar unicode title:
:ivar unicode detail:
typeTz about:blank) omitemptydefaulttitle)r# detail)codekwargsr c K s. |t krtd| t| }| f d|i|S )zCreate an Error instance with an ACME Error code.
:unicode code: An ACME error code, like 'dnssec'.
:kwargs: kwargs to pass to Error.
z4The supplied code: %s is not a known ACME error coder ) ERROR_CODES
ValueErrorr )clsr' r( r r r r with_codeW s
zError.with_code)r c C s t j| jS )zHardcoded error description based on its type.
:returns: Description if standard ACME error or ``None``.
:rtype: unicode
)ERROR_TYPE_DESCRIPTIONSgetr )selfr r r descriptiong s zError.descriptionc C s( t | jjdddd }|tkr$|S dS )zACME error code.
Basically self.typ without the ERROR_PREFIX.
:returns: error code if standard ACME code or ``None``.
:rtype: unicode
: )maxsplitN)strr rsplitr) )r/ r' r r r r' q s
z
Error.codec C s( dj dd | j| j| j| jfD j S )Ns :: c s s" | ]}|d k r|j ddV qd S )Nasciibackslashreplace)encode)r partr r r r s z Error.__str__..)joinr r0 r& r% decode)r/ r r r __str__ s z
Error.__str__N)__name__
__module__ __qualname____doc__joseFieldr r% r& classmethodr5 r r, propertyr r0 r' r= r r r r r I s r c s e Zd ZU dZdZeZeed f edd fdd Z eddd Z
e ed d
d d Z edd
dZ
eedddZedddZ ZS ) _ConstantzACME constant.r N)r r c s t j | | j|< || _d S )N)super__init__POSSIBLE_NAMESr )r/ r ) __class__r r rH s
z_Constant.__init__)r c C s | j S )N)r )r/ r r r to_partial_json s z_Constant.to_partial_json)jobjr c C s& || j kr tjdj| j| j | S )Nz{0} not recognized)rI rB ZDeserializationErrorformatr> )r+ rL r r r from_json s
z_Constant.from_jsonc C s dj | jj| jS )Nz{0}({1}))rM rJ r> r )r/ r r r __repr__ s z_Constant.__repr__)otherr c C s t |t| o|j| jkS )N)r r" r )r/ rP r r r __eq__ s z_Constant.__eq__c C s t | j| jfS )N)hashrJ r )r/ r r r __hash__ s z_Constant.__hash__)r )r> r? r@ rA __slots__NotImplementedrI r r5 rH rK rD rN rO r boolrQ intrS
__classcell__r r )rJ r rF s
rF c @ s" e Zd ZU dZi Zeed f dS )StatuszACME "status" field.N)r> r? r@ rA rI r r5 r r r r rY s
rY unknownpendingZ
processingZvalidZinvalidZrevokedZreadyZ deactivatedc @ s" e Zd ZU dZi Zeed f dS )IdentifierTypezACME identifier type.N)r> r? r@ rA rI r r5 r r r r r\ s
r\ r Zipc @ s* e Zd ZdZejdejdZejdZ dS )
IdentifierzNACME identifier.
:ivar IdentifierType typ:
:ivar unicode value:
r" )decodervalueN)
r> r? r@ rA rB rC r\ rN r r_ r r r r r] s r] c @ s e Zd ZU dZi Zeeed f G dd dej Z
e eedddZ e ed ed ddd Z
eeef d
d d d
ZeedddZeedddZeeef dddZe eeef d d ddZd
S ) Directoryz
Directory.c s e Zd ZdZejdddZejdddZejdddZejdddZ ejdddZ
e d d
fd d Z e
ed
ddZee d
fdd ZeedddZ ZS )zDirectory.MetazDirectory Meta.zterms-of-serviceT)r# ZtermsOfServicewebsiteZ
caaIdentitiesr N)r( r c s( fdd|j D }t jf | d S )Nc s i | ]\}}| j |qS r )_internal_name)r kv)r/ r r
s z+Directory.Meta.__init__..)itemsrG rH )r/ r( )rJ )r/ r rH s zDirectory.Meta.__init__)r c C s | j p
| jS )zURL for the CA TOS)_terms_of_service_terms_of_service_v2)r/ r r r terms_of_service s z Directory.Meta.terms_of_servicec # s2 x,t j D ] }|dkr$|dd n|V q W d S )Nrg r2 )rG __iter__)r/ r )rJ r r rj s zDirectory.Meta.__iter__)r r c C s |dkrd| S |S )Nri _r )r/ r r r r rb s z Directory.Meta._internal_name)r> r? r@ rA rB rC rg rh ra Zcaa_identitiesZexternal_account_requiredr rH rE r5 ri r rj rb rX r r )rJ r Meta s rl )keyr c C s t |d|S )N
resource_type)getattr)r+ rm r r r
_canon_key s zDirectory._canon_key)resource_body_clsr c C s |j }|| j|< |S )zRegister resource.)rn _REGISTERED_TYPES)r+ rq rn r r r register s
zDirectory.registerN)rL r c C s t j|| j}|| _d S )N)r Zmap_keysrp _jobj)r/ rL Z
canon_jobjr r r rH s zDirectory.__init__)r r c C sD y| |j dd S tk
r> } ztt|W Y d d }~X nX d S )Nrk -)replaceKeyErrorAttributeErrorr5 )r/ r errorr r r __getattr__ s zDirectory.__getattr__c C s@ y| j | j| S tk
r: td| j| d Y nX d S )NzDirectory field "z " not found)rt rp rw )r/ r r r r __getitem__ s zDirectory.__getitem__)r c C s | j S )N)rt )r/ r r r rK s zDirectory.to_partial_jsonc C s | j j|jdi |d< | |S )Nmeta)rl rN pop)r+ rL r r r rN s zDirectory.from_json)r> r? r@ rA rr r r5 r
rB JSONObjectWithFieldsrl rD rp rs r r rH rz r{ rK r rN r r r r r` s
r` c @ s e Zd ZdZejdZdS )ResourcezOACME Resource.
:ivar acme.messages.ResourceBody body: Resource body.
bodyN)r> r? r@ rA rB rC r r r r r r s r c @ s e Zd ZdZejdZdS )ResourceWithURIzQACME Resource with URI.
:ivar unicode ~.uri: Location of the resource.
uriN)r> r? r@ rA rB rC r r r r r r s r c @ s e Zd ZdZdS ) ResourceBodyzACME Resource Body.N)r> r? r@ rA r r r r r s r c @ s4 e Zd ZdZeejeeee ee
f dddZ dS )ExternalAccountBindingz ACME External Account Binding)account_public_keykidhmac_key directoryr c C sR t j|j j }tjj|}|d }tjj |tj
j |dtj j
d||}|j S )zLCreate External Account Binding Resource from contact details, kid and hmac.Z
newAccount)rm N)jsondumpsrK r9 rB Zb64Z b64decoder ZJWSZsignZjwkZJWKOctZjwaZHS256) r+ r r r r Zkey_jsonZdecoded_hmac_keyurlZeabr r r from_data' s z ExternalAccountBinding.from_dataN) r> r? r@ rA rD rB JWKr5 r` r r r r r r r r $ s r c sj e Zd ZdZejddejjdZejddf dZ ejdddZ
ejd ddZ ejd
ddZ ejd ddZ
ejd ddZd
ZdZed&ee ee eeeef ed dddZedd fdd Zeeedf dddZeeef eeef ddd Zeeef d fd d Zeeef d fd d! Z e eedf d d"d#Z e eedf d d$d%Z Z S )' RegistrationzRegistration Resource Body.
:ivar josepy.jwk.JWK key: Public key.
:ivar tuple contact: Contact information following ACME spec,
`tuple` of `unicode`.
:ivar unicode agreement:
rm T)r# r^ contact)r# r$ agreement)r# statusZtermsOfServiceAgreedZonlyReturnExistingZexternalAccountBindingztel:zmailto:N)phoneemailexternal_account_bindingr( r c s d|k}t |jdf }|dk r0|j j| |dk rV|j fdd|jdD |s^|rjt||d< |rv||d< f |S )a
Create registration resource from contact details.
The `contact` keyword being passed to a Registration object is meaningful, so
this function represents empty iterables in its kwargs by passing on an empty
`tuple`.
r Nc s g | ]} j | qS r ) email_prefix)r Zmail)r+ r r
d s z*Registration.from_data..,r )listr} append phone_prefixextendsplittuple)r+ r r r r( Zcontact_providedZdetailsr )r+ r r P s
zRegistration.from_data)r( r c s4 d|kr"|d dk r"t j| dd t jf | dS )z;Note if the user provides a value for the `contact` member.r N _add_contactT)object __setattr__rG rH )r/ r( )rJ r r rH p s zRegistration.__init__.)prefixr c s t fdd| jD S )Nc 3 s( | ] }|j r|t d V qd S )N)
startswithlen)r r& )r r r r y s z/Registration._filter_contact..)r r )r/ r r )r r _filter_contactw s z Registration._filter_contact)rL r c C s t | ddr| jd|d< |S )a
The `contact` member of Registration objects should not be required when
de-serializing (as it would be if the Fields' `omitempty` flag were `False`), but
it should be included in serializations if it was provided.
:param jobj: Dictionary containing this Registrations' data
:type jobj: dict
:returns: Dictionary containing Registrations data to transmit to the server
:rtype: dict
r Fr )ro r9 )r/ rL r r r _add_contact_if_appropriate| s z(Registration._add_contact_if_appropriate)r c s t j }| j|S )z2Modify josepy.JSONDeserializable.to_partial_json())rG rK r )r/ rL )rJ r r rK s
z Registration.to_partial_jsonc s t j }| j|S )z;Modify josepy.JSONObjectWithFields.fields_to_partial_json())rG fields_to_partial_jsonr )r/ rL )rJ r r r s
z#Registration.fields_to_partial_jsonc C s | j | jS )z*All phones found in the ``contact`` field.)r r )r/ r r r phones s zRegistration.phonesc C s | j | jS )z*All emails found in the ``contact`` field.)r r )r/ r r r emails s zRegistration.emails)NNN)!r> r? r@ rA rB rC r rN rm r r r Zterms_of_service_agreedZonly_return_existingr r r rD r r5 r r r rH r r r rK r rE r r rX r r )rJ r r 7 s. r c @ s e Zd ZdZdZejeZdS )NewRegistrationzNew registration.znew-regN)r> r? r@ rA rn r r resourcer r r r r s r c @ s e Zd ZdZdZejeZdS )UpdateRegistrationzUpdate registration.ZregN)r> r? r@ rA rn r r r r r r r r s r c @ s< e Zd ZdZejdejdZejdddZ ejdddZ
dS ) RegistrationResourcezRegistration Resource.
:ivar acme.messages.Registration body:
:ivar unicode new_authzr_uri: Deprecated. Do not use.
:ivar unicode terms_of_service: URL for the CA TOS.
r )r^ new_authzr_uriT)r# ri N) r> r? r@ rA rB rC r rN r r ri r r r r r s r c s e Zd ZdZd!ZejddddZejddddZejde j
de d Z e
jd
dd Zejd ej
ddd Zedd
fdd Zeed fdd Zeeef d fdd Zeeeef eeef d fdd ZeedddZ eeddd Z e e d fd d Z eedd d Z Z!S )"
ChallengeBodya> Challenge Resource Body.
.. todo::
Confusingly, this has a similar name to `.challenges.Challenge`,
as well as `.achallenges.AnnotatedChallenge`. Please use names
such as ``challb`` to distinguish instances of this class from
``achall``.
:ivar acme.challenges.Challenge: Wrapped challenge.
Conveniently, all challenge fields are proxied, i.e. you can
call ``challb.x`` to get ``challb.chall.x`` contents.
:ivar acme.messages.Status status:
:ivar datetime.datetime validated:
:ivar messages.Error error:
challr TN)r# r$ r r )r^ r# r$ validated)r# ry )r( r c s( fdd|j D }t jf | d S )Nc s i | ]\}}| j |qS r )rb )r rc rd )r/ r r re s z*ChallengeBody.__init__..)rf rG rH )r/ r( )rJ )r/ r rH s zChallengeBody.__init__)r r c s t j| j|S )N)rG r9 rb )r/ r )rJ r r r9 s zChallengeBody.encode)r c s t j }|j| jj |S )N)rG rK updater )r/ rL )rJ r r rK s
z ChallengeBody.to_partial_json)rL r c s t j|}tjj||d< |S )Nr )rG fields_from_jsonr Z ChallengerN )r+ rL Z jobj_fields)rJ r r r s z ChallengeBody.fields_from_jsonc C s | j p
| jS )zThe URL of this challenge.)_url_uri)r/ r r r r s zChallengeBody.uric C s t | j|S )N)ro r )r/ r r r r rz s zChallengeBody.__getattr__c # s2 x,t j D ] }|dkr$|dd n|V q W d S )Nr r2 )rG rj )r/ r )rJ r r rj s zChallengeBody.__iter__c C s |dkrd| S |S )Nr rk r )r/ r r r r rb s z ChallengeBody._internal_name)r )"r> r? r@ rA rT rB rC r r rY rN STATUS_PENDINGr r RFC3339Fieldr r ry r rH r5 r9 r rK rD r r rE r rz r rj rb rX r r )rJ r r s&
&r c @ s< e Zd ZdZejdejdZejdZ e
e dddZ dS ) ChallengeResourcezChallenge Resource.
:ivar acme.messages.ChallengeBody body:
:ivar unicode authzr_uri: URI found in the 'up' ``Link`` header.
r )r^
authzr_uri)r c C s | j jS )z The URL of the challenge body.)r r )r/ r r r r s zChallengeResource.uriN)
r> r? r@ rA rB rC r rN r r rE r5 r r r r r r s
r c @ s e Zd ZdZejdejddZejdddZ ejdddZ
ejdde jd Z e
jd
ddZejd ddZe jeeeef eed f d
ddZ eeeeeef d f d f dddZdS )
Authorizationa^ Authorization Resource Body.
:ivar acme.messages.Identifier identifier:
:ivar list challenges: `list` of `.ChallengeBody`
:ivar tuple combinations: Challenge combinations (`tuple` of `tuple`
of `int`, as opposed to `list` of `list` from the spec).
:ivar acme.messages.Status status:
:ivar datetime.datetime expires:
identifierT)r^ r# r )r# combinationsr )r# r^ expireswildcard.)r_ r c C s t dd | D S )Nc s s | ]}t j|V qd S )N)r rN )r r r r r r ) s z+Authorization.challenges..)r )r_ r r r r ' s zAuthorization.challenges)r c s t fdd jD S )z0Combinations with challenges instead of indices.c 3 s$ | ] }t fd d|D V qdS )c 3 s | ]} j | V qd S )N)r )r idx)r/ r r r . s z@Authorization.resolved_combinations...N)r )r Zcombo)r/ r r r . s z6Authorization.resolved_combinations..)r r )r/ r )r/ r resolved_combinations+ s z#Authorization.resolved_combinationsN)r> r? r@ rA rB rC r] rN r r r rY r r r r r r^ r r r5 r r r rE r r r r r r r s
&r c @ s e Zd ZdZdZejeZdS )NewAuthorizationzNew authorization.z new-authzN)r> r? r@ rA rn r r r r r r r r 2 s r c @ s e Zd ZdZdZejeZdS )UpdateAuthorizationzUpdate authorization.ZauthzN)r> r? r@ rA rn r r r r r r r r 9 s r c @ s. e Zd ZdZejdejdZejdddZ dS )AuthorizationResourcezAuthorization Resource.
:ivar acme.messages.Authorization body:
:ivar unicode new_cert_uri: Deprecated. Do not use.
r )r^ new_cert_uriT)r# N)
r> r? r@ rA rB rC r rN r r r r r r r ? s r c @ s2 e Zd ZdZdZejeZej dej
ej dZ dS )CertificateRequestzACME new-cert request.
:ivar josepy.util.ComparableX509 csr:
`OpenSSL.crypto.X509Req` wrapped in `.ComparableX509`
znew-certcsr)r^ encoderN)
r> r? r@ rA rn r r r rB rC Z
decode_csrZ
encode_csrr r r r r r J s
r c @ s$ e Zd ZdZejdZejdZdS )CertificateResourcea Certificate Resource.
:ivar josepy.util.ComparableX509 body:
`OpenSSL.crypto.X509` wrapped in `.ComparableX509`
:ivar unicode cert_chain_uri: URI found in the 'up' ``Link`` header
:ivar tuple authzrs: `tuple` of `AuthorizationResource`.
cert_chain_uriauthzrsN)r> r? r@ rA rB rC r r r r r r r W s
r c @ s< e Zd ZdZdZejeZej dej
ej dZ ej dZ
dS )
Revocationz|Revocation message.
:ivar .ComparableX509 certificate: `OpenSSL.crypto.X509` wrapped in
`.ComparableX509`
z revoke-cert certificate)r^ r reasonN)r> r? r@ rA rn r r r rB rC Z decode_certZ encode_certr r r r r r r d s
r c @ s e Zd ZdZejdddZejdejddZ ejdddZ
ejdddZ ejd ddZ e
jd
ddZejd dejd Zejeeeef eed
f dddZdS )Ordera_ Order Resource Body.
:ivar identifiers: List of identifiers for the certificate.
:vartype identifiers: `list` of `.Identifier`
:ivar acme.messages.Status status:
:ivar authorizations: URLs of authorizations.
:vartype authorizations: `list` of `str`
:ivar str certificate: URL to download certificate as a fullchain PEM.
:ivar str finalize: URL to POST to to request issuance once all
authorizations have "valid" status.
:ivar datetime.datetime expires: When the order expires.
:ivar ~.Error error: Any error that occurred during finalization, if applicable.
identifiersT)r# r )r^ r# authorizationsr finalizer ry )r# r^ .)r_ r c C s t dd | D S )Nc s s | ]}t j|V qd S )N)r] rN )r r r r r r s z$Order.identifiers..)r )r_ r r r r s zOrder.identifiersN)r> r? r@ rA rB rC r rY rN r r r r r r r r ry r^ r r r5 r r r] r r r r r s s
r c @ sT e Zd ZdZejdejdZejdddZ ejdZ
ejdddZ ejd ddZ d
S )
OrderResourcea Order Resource.
:ivar acme.messages.Order body:
:ivar str csr_pem: The CSR this Order will be finalized with.
:ivar authorizations: Fully-fetched AuthorizationResource objects.
:vartype authorizations: `list` of `acme.messages.AuthorizationResource`
:ivar str fullchain_pem: The fetched contents of the certificate URL
produced once the order was finalized, if it's present.
:ivar alternative_fullchains_pem: The fetched contents of alternative certificate
chain URLs produced once the order was finalized, if present and requested during
finalization.
:vartype alternative_fullchains_pem: `list` of `str`
r )r^ csr_pemT)r# r
fullchain_pemalternative_fullchains_pemN)
r> r? r@ rA rB rC r rN r r r r r r r r r r s
r c @ s e Zd ZdZdZdS )NewOrderz
New order.z new-orderN)r> r? r@ rA rn r r r r r s r )IrA collections.abcr r Ztypingr r r r r r r r
r ZjosepyrB Zacmer r
r r r Z acme.mixinsr r r r) dictrf r- r
BaseExceptionrV r! r~ r ZJSONDeSerializablerF rY ZSTATUS_UNKNOWNr ZSTATUS_PROCESSINGZ STATUS_VALIDZSTATUS_INVALIDZSTATUS_REVOKEDZ STATUS_READYZSTATUS_DEACTIVATEDr\ ZIDENTIFIER_FQDNZ
IDENTIFIER_IPr] r` r r r r r rs r r r r r r r r r r r r r r r r r r r s > F k
B$