3 گab@sdZddlmZddlZddlmZddlmZddlmZddlmZddlm Z dd lm Z dd lm Z dd lm Z dd lm Z ddlZdd lmZddlmZddlmZddlmZddlmZddlmZdZdZdddddddddddd d!d"d#d$d%d&d'd(d)d*d+d,d-d.d/Zed0d1ejDZejed2d1ejDee d3d4d5Z!Gd6d7d7ej"ej#Z#Gd8d9d9ej$eZ%Gd:d;d;e%Z&e&d<Z'e&d=Z(e&d>Z)e&d?Z*e&d@Z+e&dAZ,e&dBZ-e&dCZ.GdDdEdEe%Z/e/dFZ0e/dGZ1GdHdIdIej"Z2GdJdKdKej$Z3GdLdMdMej"Z4GdNdOdOe4Z5GdPdQdQej"Z6GdRdSdSZ7GdTdUdUe6Z8e3j9GdVdWdWee8Z:GdXdYdYee8Z;GdZd[d[e5ZGd`dadae6Z?e3j9Gdbdcdcee?Z@Gdddedeee?ZAGdfdgdge5ZBe3j9Gdhdidieej"ZCGdjdkdke5ZDe3j9Gdldmdmeej"ZEGdndodoe6ZFGdpdqdqe5ZGe3j9GdrdsdseFZHdS)tzACME protocol messages.)HashableN)Any)Dict)Iterator)List)Mapping)MutableMapping)Tuple)Type)Optional) challenges)errors)fields)jws)util) ResourceMixinzurn:acme:error:zurn:ietf:params:acme:error:z4The request specified an account that does not existzOThe request specified a certificate to be revoked that has already been revokedz2The CSR is unacceptable (e.g., due to a short key)z1The client sent an unacceptable anti-replay noncez>The JWS was signed by a public key the server does not supportz;The revocation reason provided is not allowed by the serverz@The JWS was signed with an algorithm the server does not supportz\Certification Authority Authorization (CAA) records forbid the CA from issuing a certificatezBSpecific error conditions are indicated in the "subproblems" arrayz?The server could not connect to the client to verify the domainzAThere was a problem with a DNS query during identifier validationz4The server could not validate a DNSSEC signed domainz;Response received didn't match the challenge's requirementsz1The provided email for a registration was invalidz$The provided contact URI was invalidz!The request message was malformedz9The server will not issue certificates for the identifierzLThe request attempted to finalize an order that is not ready to be finalizedz,There were too many requests of a given typez(The server experienced an internal errorz=The server experienced a TLS error during domain verificationz)The client lacks sufficient authorizationz@A contact URL for an account used an unsupported protocol schemez*The server could not resolve a domain namez'An identifier is of an unsupported typez,The server requires external account binding)ZaccountDoesNotExistZalreadyRevokedZbadCSRZbadNonceZ badPublicKeyZbadRevocationReasonZbadSignatureAlgorithmZcaaZcompoundZ connectiondnsZdnssecZincorrectResponseZ invalidEmailZinvalidContactZ malformedZrejectedIdentifierZ orderNotReadyZ rateLimitedZserverInternalZtlsZ unauthorizedZunsupportedContactZ unknownHostZunsupportedIdentifierexternalAccountRequiredccs|]\}}t||fVqdS)N) ERROR_PREFIX).0namedescr/usr/lib/python3.6/messages.py <srccs|]\}}t||fVqdS)N)OLD_ERROR_PREFIX)rrrrrrr?s)errreturncCs,t|tr(|jdk r(t|jkp&t|jkSdS)z#Check if argument is an ACME error.NF) isinstanceErrortyprr)rrrr is_acme_errorBsr!c@seZdZdZejddddZejdddZejdddZe e e dd d d Z e ee d d dZe ee d ddZe d ddZdS)rzACME error. https://tools.ietf.org/html/draft-ietf-appsawg-http-problem-00 :ivar unicode typ: :ivar unicode title: :ivar unicode detail: typeTz about:blank) omitemptydefaulttitle)r#detail)codekwargsrcKs.|tkrtd|t|}|fd|i|S)zCreate an Error instance with an ACME Error code. :unicode code: An ACME error code, like 'dnssec'. :kwargs: kwargs to pass to Error. z4The supplied code: %s is not a known ACME error coder ) ERROR_CODES ValueErrorr)clsr'r(r rrr with_codeWs zError.with_code)rcCs tj|jS)zHardcoded error description based on its type. :returns: Description if standard ACME error or ``None``. :rtype: unicode )ERROR_TYPE_DESCRIPTIONSgetr )selfrrr descriptiongszError.descriptioncCs(t|jjdddd}|tkr$|SdS)zACME error code. Basically self.typ without the ERROR_PREFIX. :returns: error code if standard ACME code or ``None``. :rtype: unicode :)maxsplitN)strr rsplitr))r/r'rrrr'qs z Error.codecCs(djdd|j|j|j|jfDjS)Ns :: css"|]}|dk r|jddVqdS)Nasciibackslashreplace)encode)rpartrrrrsz Error.__str__..)joinr r0r&r%decode)r/rrr__str__sz Error.__str__N)__name__ __module__ __qualname____doc__joseFieldr r%r& classmethodr5rr,propertyr r0r'r=rrrrrIs  rcseZdZUdZdZeZeedfeddfdd Z eddd Z e edd d d Z edd dZ eedddZedddZZS) _ConstantzACME constant.rN)rrcstj||j|<||_dS)N)super__init__POSSIBLE_NAMESr)r/r) __class__rrrHs  z_Constant.__init__)rcCs|jS)N)r)r/rrrto_partial_jsonsz_Constant.to_partial_json)jobjrcCs&||jkrtjdj|j|j|S)Nz{0} not recognized)rIrBZDeserializationErrorformatr>)r+rLrrr from_jsons z_Constant.from_jsoncCsdj|jj|jS)Nz{0}({1}))rMrJr>r)r/rrr__repr__sz_Constant.__repr__)otherrcCst|t|o|j|jkS)N)rr"r)r/rPrrr__eq__sz_Constant.__eq__cCst|j|jfS)N)hashrJr)r/rrr__hash__sz_Constant.__hash__)r)r>r?r@rA __slots__NotImplementedrIrr5rHrKrDrNrOrboolrQintrS __classcell__rr)rJrrFs rFc@s"eZdZUdZiZeedfdS)StatuszACME "status" field.N)r>r?r@rArIrr5rrrrrYs rYunknownpendingZ processingZvalidZinvalidZrevokedZreadyZ deactivatedc@s"eZdZUdZiZeedfdS)IdentifierTypezACME identifier type.N)r>r?r@rArIrr5rrrrr\s r\rZipc@s*eZdZdZejdejdZejdZ dS) IdentifierzNACME identifier. :ivar IdentifierType typ: :ivar unicode value: r")decodervalueN) r>r?r@rArBrCr\rNr r_rrrrr]sr]c@seZdZUdZiZeeedfGdddej Z e eedddZ e ededddd Z eeefd d d d ZeedddZeedddZeeefdddZe eeefdd ddZd S) Directoryz Directory.cseZdZdZejdddZejdddZejdddZejdddZ ejdddZ e d d fd d Z e ed ddZeed fdd ZeedddZZS)zDirectory.MetazDirectory Meta.zterms-of-serviceT)r#ZtermsOfServicewebsiteZ caaIdentitiesrN)r(rc s(fdd|jD}tjf|dS)Ncsi|]\}}|j|qSr)_internal_name)rkv)r/rr sz+Directory.Meta.__init__..)itemsrGrH)r/r()rJ)r/rrHszDirectory.Meta.__init__)rcCs |jp |jS)zURL for the CA TOS)_terms_of_service_terms_of_service_v2)r/rrrterms_of_serviceszDirectory.Meta.terms_of_servicec#s2x,tjD]}|dkr$|ddn|Vq WdS)Nrgr2)rG__iter__)r/r)rJrrrjszDirectory.Meta.__iter__)rrcCs|dkrd|S|S)Nri_r)r/rrrrrbszDirectory.Meta._internal_name)r>r?r@rArBrCrgrhraZcaa_identitiesZexternal_account_requiredrrHrEr5rirrjrbrXrr)rJrMetasrl)keyrcCs t|d|S)N resource_type)getattr)r+rmrrr _canon_keyszDirectory._canon_key)resource_body_clsrcCs"|j}||jkst||j|<|S)zRegister resource.)rn_REGISTERED_TYPESAssertionError)r+rqrnrrrregisters zDirectory.registerN)rLrcCstj||j}||_dS)N)rZmap_keysrp_jobj)r/rLZ canon_jobjrrrrHszDirectory.__init__)rrcCsDy||jddStk r>}ztt|WYdd}~XnXdS)Nrk-)replaceKeyErrorAttributeErrorr5)r/rerrorrrr __getattr__szDirectory.__getattr__c Cs@y|j|j|Stk r:td|j|dYnXdS)NzDirectory field "z " not found)rurprx)r/rrrr __getitem__szDirectory.__getitem__)rcCs|jS)N)ru)r/rrrrKszDirectory.to_partial_jsoncCs |jj|jdi|d<||S)Nmeta)rlrNpop)r+rLrrrrNszDirectory.from_json)r>r?r@rArrrr5r rBJSONObjectWithFieldsrlrDrprtrrrHr{r|rKrrNrrrrr`s r`c@seZdZdZejdZdS)ResourcezOACME Resource. :ivar acme.messages.ResourceBody body: Resource body. bodyN)r>r?r@rArBrCrrrrrrsrc@seZdZdZejdZdS)ResourceWithURIzQACME Resource with URI. :ivar unicode ~.uri: Location of the resource. uriN)r>r?r@rArBrCrrrrrrsrc@seZdZdZdS) ResourceBodyzACME Resource Body.N)r>r?r@rArrrrr src@s4eZdZdZeejeeee ee fdddZ dS)ExternalAccountBindingzACME External Account Binding)account_public_keykidhmac_key directoryrc CsRtj|jj}tjj|}|d}tjj |tj j |dtj j d||}|jS)zLCreate External Account Binding Resource from contact details, kid and hmac.Z newAccount)rmN)jsondumpsrKr9rBZb64Z b64decoderZJWSZsignZjwkZJWKOctZjwaZHS256) r+rrrrZkey_jsonZdecoded_hmac_keyurlZeabrrr from_data's z ExternalAccountBinding.from_dataN) r>r?r@rArDrBJWKr5r`rrrrrrrr$srcsjeZdZdZejddejjdZejddfdZ ejdddZ ejd ddZ ejd ddZ ejd ddZ ejd ddZd ZdZed&eeeeeeeefeddddZeddfdd ZeeedfdddZeeefeeefdddZeeefdfdd Zeeefdfd d! Zeeedfdd"d#Zeeedfdd$d%ZZ S)' RegistrationzRegistration Resource Body. :ivar josepy.jwk.JWK key: Public key. :ivar tuple contact: Contact information following ACME spec, `tuple` of `unicode`. :ivar unicode agreement: rmT)r#r^contact)r#r$ agreement)r#statusZtermsOfServiceAgreedZonlyReturnExistingZexternalAccountBindingztel:zmailto:N)phoneemailexternal_account_bindingr(rc sd|k}t|jdf}|dk r0|jj||dk rV|jfdd|jdD|s^|rjt||d<|rv||d<f|S)a Create registration resource from contact details. The `contact` keyword being passed to a Registration object is meaningful, so this function represents empty iterables in its kwargs by passing on an empty `tuple`. rNcsg|]}j|qSr) email_prefix)rZmail)r+rr dsz*Registration.from_data..,r)listr~append phone_prefixextendsplittuple)r+rrrr(Zcontact_providedZdetailsr)r+rrPs  zRegistration.from_data)r(rc s4d|kr"|ddk r"tj|ddtjf|dS)z;Note if the user provides a value for the `contact` member.rN _add_contactT)object __setattr__rGrH)r/r()rJrrrHpszRegistration.__init__.)prefixrcstfdd|jDS)Nc3s(|] }|jr|tdVqdS)N) startswithlen)rr&)rrrrysz/Registration._filter_contact..)rr)r/rr)rr_filter_contactwszRegistration._filter_contact)rLrcCst|ddr|jd|d<|S)a The `contact` member of Registration objects should not be required when de-serializing (as it would be if the Fields' `omitempty` flag were `False`), but it should be included in serializations if it was provided. :param jobj: Dictionary containing this Registrations' data :type jobj: dict :returns: Dictionary containing Registrations data to transmit to the server :rtype: dict rFr)ror9)r/rLrrr_add_contact_if_appropriate|s z(Registration._add_contact_if_appropriate)rcstj}|j|S)z2Modify josepy.JSONDeserializable.to_partial_json())rGrKr)r/rL)rJrrrKs zRegistration.to_partial_jsoncstj}|j|S)z;Modify josepy.JSONObjectWithFields.fields_to_partial_json())rGfields_to_partial_jsonr)r/rL)rJrrrs z#Registration.fields_to_partial_jsoncCs |j|jS)z*All phones found in the ``contact`` field.)rr)r/rrrphonesszRegistration.phonescCs |j|jS)z*All emails found in the ``contact`` field.)rr)r/rrremailsszRegistration.emails)NNN)!r>r?r@rArBrCrrNrmrrrZterms_of_service_agreedZonly_return_existingrrrrDr r5rrrrHr rrrKrrErrrXrr)rJrr7s. rc@seZdZdZdZejeZdS)NewRegistrationzNew registration.znew-regN)r>r?r@rArnrrresourcerrrrrsrc@seZdZdZdZejeZdS)UpdateRegistrationzUpdate registration.ZregN)r>r?r@rArnrrrrrrrrsrc@s<eZdZdZejdejdZejdddZ ejdddZ dS) RegistrationResourcezRegistration Resource. :ivar acme.messages.Registration body: :ivar unicode new_authzr_uri: Deprecated. Do not use. :ivar unicode terms_of_service: URL for the CA TOS. r)r^new_authzr_uriT)r#riN) r>r?r@rArBrCrrNrrrirrrrrsrcs eZdZdZd!ZejddddZejddddZejde j de d Z e jd dd Zejd ej ddd Zedd fdd Zeedfdd Zeeefdfdd Zeeeefeeefdfdd ZeedddZeedddZeedfdd Zeeddd Z Z!S)" ChallengeBodya>Challenge Resource Body. .. todo:: Confusingly, this has a similar name to `.challenges.Challenge`, as well as `.achallenges.AnnotatedChallenge`. Please use names such as ``challb`` to distinguish instances of this class from ``achall``. :ivar acme.challenges.Challenge: Wrapped challenge. Conveniently, all challenge fields are proxied, i.e. you can call ``challb.x`` to get ``challb.chall.x`` contents. :ivar acme.messages.Status status: :ivar datetime.datetime validated: :ivar messages.Error error: challrTN)r#r$rr)r^r#r$ validated)r#rz)r(rc s(fdd|jD}tjf|dS)Ncsi|]\}}|j|qSr)rb)rrcrd)r/rrresz*ChallengeBody.__init__..)rfrGrH)r/r()rJ)r/rrHszChallengeBody.__init__)rrcstj|j|S)N)rGr9rb)r/r)rJrrr9szChallengeBody.encode)rcstj}|j|jj|S)N)rGrKupdater)r/rL)rJrrrKs zChallengeBody.to_partial_json)rLrcs tj|}tjj||d<|S)Nr)rGfields_from_jsonr Z ChallengerN)r+rLZ jobj_fields)rJrrrs zChallengeBody.fields_from_jsoncCs |jp |jS)zThe URL of this challenge.)_url_uri)r/rrrrszChallengeBody.uricCs t|j|S)N)ror)r/rrrrr{szChallengeBody.__getattr__c#s2x,tjD]}|dkr$|ddn|Vq WdS)Nrr2)rGrj)r/r)rJrrrjszChallengeBody.__iter__cCs|dkrd|S|S)Nrrkr)r/rrrrrbszChallengeBody._internal_name)r)"r>r?r@rArTrBrCrrrYrNSTATUS_PENDINGrr RFC3339FieldrrrzrrHr5r9rrKrDrrrErr{rrjrbrXrr)rJrrs&    &rc@s<eZdZdZejdejdZejdZ e e dddZ dS) ChallengeResourcezChallenge Resource. :ivar acme.messages.ChallengeBody body: :ivar unicode authzr_uri: URI found in the 'up' ``Link`` header. r)r^ authzr_uri)rcCs|jjS)zThe URL of the challenge body.)rr)r/rrrrszChallengeResource.uriN) r>r?r@rArBrCrrNrrrEr5rrrrrrs  rc@seZdZdZejdejddZejdddZ ejdddZ ejdde jd Z e jd ddZejd ddZe jeeeefeed fd ddZ eeeeeefd fd fdddZdS) Authorizationa^Authorization Resource Body. :ivar acme.messages.Identifier identifier: :ivar list challenges: `list` of `.ChallengeBody` :ivar tuple combinations: Challenge combinations (`tuple` of `tuple` of `int`, as opposed to `list` of `list` from the spec). :ivar acme.messages.Status status: :ivar datetime.datetime expires: identifierT)r^r#r )r# combinationsr)r#r^expireswildcard.)r_rcCstdd|DS)Ncss|]}tj|VqdS)N)rrN)rrrrrr)sz+Authorization.challenges..)r)r_rrrr 'szAuthorization.challenges)rcstfddjDS)z0Combinations with challenges instead of indices.c3s$|]}tfdd|DVqdS)c3s|]}j|VqdS)N)r )ridx)r/rrr.sz@Authorization.resolved_combinations...N)r)rZcombo)r/rrr.sz6Authorization.resolved_combinations..)rr)r/r)r/rresolved_combinations+s z#Authorization.resolved_combinationsN)r>r?r@rArBrCr]rNrr rrYrrrrrr^rrr5rr rrErrrrrrrs &rc@seZdZdZdZejeZdS)NewAuthorizationzNew authorization.z new-authzN)r>r?r@rArnrrrrrrrr2src@seZdZdZdZejeZdS)UpdateAuthorizationzUpdate authorization.ZauthzN)r>r?r@rArnrrrrrrrr9src@s.eZdZdZejdejdZejdddZ dS)AuthorizationResourcezAuthorization Resource. :ivar acme.messages.Authorization body: :ivar unicode new_cert_uri: Deprecated. Do not use. r)r^ new_cert_uriT)r#N) r>r?r@rArBrCrrNrrrrrrr?src@s2eZdZdZdZejeZej dej ej dZ dS)CertificateRequestzACME new-cert request. :ivar josepy.util.ComparableX509 csr: `OpenSSL.crypto.X509Req` wrapped in `.ComparableX509` znew-certcsr)r^encoderN) r>r?r@rArnrrrrBrCZ decode_csrZ encode_csrrrrrrrJs rc@s$eZdZdZejdZejdZdS)CertificateResourceaCertificate Resource. :ivar josepy.util.ComparableX509 body: `OpenSSL.crypto.X509` wrapped in `.ComparableX509` :ivar unicode cert_chain_uri: URI found in the 'up' ``Link`` header :ivar tuple authzrs: `tuple` of `AuthorizationResource`. cert_chain_uriauthzrsN)r>r?r@rArBrCrrrrrrrWs rc@s<eZdZdZdZejeZej dej ej dZ ej dZ dS) Revocationz|Revocation message. :ivar .ComparableX509 certificate: `OpenSSL.crypto.X509` wrapped in `.ComparableX509` z revoke-cert certificate)r^rreasonN)r>r?r@rArnrrrrBrCZ decode_certZ encode_certrrrrrrrds  rc@seZdZdZejdddZejdejddZ ejdddZ ejdddZ ejd ddZ e jd ddZejd dejd Zejeeeefeed fdddZdS)Ordera_Order Resource Body. :ivar identifiers: List of identifiers for the certificate. :vartype identifiers: `list` of `.Identifier` :ivar acme.messages.Status status: :ivar authorizations: URLs of authorizations. :vartype authorizations: `list` of `str` :ivar str certificate: URL to download certificate as a fullchain PEM. :ivar str finalize: URL to POST to to request issuance once all authorizations have "valid" status. :ivar datetime.datetime expires: When the order expires. :ivar ~.Error error: Any error that occurred during finalization, if applicable. identifiersT)r#r)r^r#authorizationsrfinalizerrz)r#r^.)r_rcCstdd|DS)Ncss|]}tj|VqdS)N)r]rN)rrrrrrsz$Order.identifiers..)r)r_rrrrszOrder.identifiersN)r>r?r@rArBrCrrYrNrrrrrrrrrzr^rrr5rr r]rrrrrss  rc@sTeZdZdZejdejdZejdddZ ejdZ ejdddZ ejd ddZ d S) OrderResourceaOrder Resource. :ivar acme.messages.Order body: :ivar str csr_pem: The CSR this Order will be finalized with. :ivar authorizations: Fully-fetched AuthorizationResource objects. :vartype authorizations: `list` of `acme.messages.AuthorizationResource` :ivar str fullchain_pem: The fetched contents of the certificate URL produced once the order was finalized, if it's present. :ivar alternative_fullchains_pem: The fetched contents of alternative certificate chain URLs produced once the order was finalized, if present and requested during finalization. :vartype alternative_fullchains_pem: `list` of `str` r)r^csr_pemT)r#r fullchain_pemalternative_fullchains_pemN) r>r?r@rArBrCrrNrrrrrrrrrrs   rc@seZdZdZdZdS)NewOrderz New order.z new-orderN)r>r?r@rArnrrrrrsr)IrAcollections.abcrrZtypingrrrrrrr r r ZjosepyrBZacmer r rrrZ acme.mixinsrrrr)dictrfr-r BaseExceptionrVr!rrZJSONDeSerializablerFrYZSTATUS_UNKNOWNrZSTATUS_PROCESSINGZ STATUS_VALIDZSTATUS_INVALIDZSTATUS_REVOKEDZ STATUS_READYZSTATUS_DEACTIVATEDr\ZIDENTIFIER_FQDNZ IDENTIFIER_IPr]r`rrrrrrtrrrrrrrrrrrrrrrrrrrs                > F  k  B$