a
}|g"z @ sJ d Z ddlZddlZddlmZ ddlmZ ddlZddl Z ddl
Z
ddl m Z ddl m
Z
ddl mZ ddl mZ ddl mZ dd l mZ dd
l mZ dd l mZ dd lmZ ddlZddlZddlZdd
lmZ ddl m Z ddl m Z ddl m Z ddl m!Z! ddl m"Z" ddl m#Z# e$e%Z&dZ'G dd dZ(G dd dZ)dS )zACME client API. N) parsedate_tz)Any)cast)List)Mapping)Optional)Set)Tuple)Union)x509) HTTPAdapter)parse_header_links)
challenges) crypto_util)errors)jws)messages- c @ s e Zd ZdZejdddddZejejddd Z ejejd
d d Z
dNeje ej ejd
ddZ
dOejeejdddZeejdddZejeejejf dddZdPeje ej ejddd Zejejejdd d Zejejd d d!ZdQejejeejd"d#d$Z dRejejeejd"d%d&Z e j e dd'd(d)Z!ed*d+d,Z"e#e#ejd-d.d/Z$eje%e&e% d0d1d2Z'e(e%dejd3d4d5Z)e(dSeje e% e e% ejd6d7d8Z*ejej ejd9d:d;Z+e#e#ejd-dd?Z-ejejdd@dAZ.dTeje ej/ e e% ejdBdCdDZ0ej1e2j3ej4dEdFdGZ5e(eje ejdHdIdJZ6e j e e%ddKdLdMZ7dS )UClientV2zuACME client for a v2 API.
:ivar messages.Directory directory:
:ivar .ClientNetwork net: Client network.
ClientNetworkN) directorynetreturnc C s || _ || _dS )zInitialize.
:param .messages.Directory directory: Directory Resource
:param .ClientNetwork net: Client network.
N)r r )selfr r r //usr/lib/python3.9/site-packages/acme/client.py__init__, s zClientV2.__init__) new_accountr c C sL | | jd |}|jdkr6d|jv r6t|jd | |}|| j_|S )zRegister.
:param .NewRegistration new_account:
:raises .ConflictError: in case the account already exists
:returns: Registration Resource.
:rtype: `.RegistrationResource`
newAccount Location) _postr status_codeheadersr
ConflictError_regr_from_responser account)r r responseregrr r r r 5 s
zClientV2.new_account)r( r c C s | |d| j_| jjS )zQuery server about registration.
:param messages.RegistrationResource regr: Existing Registration
Resource.
T)_get_v2_accountr r& r r( r r r query_registrationH s zClientV2.query_registration)r( updater c C sJ | |}|du r|jn|}tjf i t|}| j||d}|| j_|S )aK Update registration.
:param messages.RegistrationResource regr: Registration Resource.
:param messages.Registration update: Updated body of the
resource. If not provided, body will be taken from `regr`.
:returns: Updated Registration Resource.
:rtype: `.RegistrationResource`
Nbody)r) r. r ZUpdateRegistrationdict_send_recv_regrr r& )r r( r, r. Z updated_regrr r r update_registrationT s
z ClientV2.update_registrationF)r( update_bodyr c C sb d | j _|jjdd}| | jd |}|jd }|j|rJtj |
n|j|d}|| j _|S )NT)Zonly_return_existingr r r. uri) r r& r. r, r! r r# r Registration from_jsonjson)r r( r2 Zonly_existing_regr' Z updated_uriZnew_regrr r r r) j s
zClientV2._get_v2_account)csr_pemr c C s t |}t|j|j}z|jt j}W n t jyD g }Y n0 |j
t j }g }|D ]}| t
jt
j|d q\|D ] }| t
jt
jt|d q|t
j|d} | | jd | }
t
j|
} g } | jD ] }
| | j| |
|
d qt
j| |
j d| |dS )zRequest a new Order object from the server.
:param bytes csr_pem: A CSR in PEM format.
:returns: The newly created order.
:rtype: OrderResource
)typvalue) identifiersZnewOrderr4 r )r. r4 authorizationsr8 ) r Zload_pem_x509_csrr Z%get_names_from_subject_and_extensionsZsubject
extensionsZget_extension_for_classZSubjectAlternativeNameZExtensionNotFoundr: Zget_values_for_typeZ IPAddressappendr
IdentifierZIDENTIFIER_FQDNZ
IDENTIFIER_IPstrZNewOrderr! r Orderr6 r7 r= _authzr_from_response _post_as_get
OrderResourcer# get)r r8 csrZdnsNamesZsan_extZipNamesr; nameiporderr' r. r= urlr r r new_orderv s8
zClientV2.new_order)authzrr c C s( | |j}| ||jj|j}||fS )a Poll Authorization Resource for status.
:param authzr: Authorization Resource
:type authzr: `.AuthorizationResource`
:returns: Updated Authorization Resource and HTTP response.
:rtype: (`.AuthorizationResource`, `requests.Response`)
)rD r4 rC r.
identifier)r rM r' Zupdated_authzrr r r poll s
z
ClientV2.poll)orderrdeadliner c C s6 |du r t j t jdd }| ||}| ||S )ad Poll authorizations and finalize the order.
If no deadline is provided, this method will timeout after 90
seconds.
:param messages.OrderResource orderr: order to finalize
:param datetime.datetime deadline: when to stop polling and timeout
:returns: finalized order
:rtype: messages.OrderResource
NZ seconds)datetimenow timedeltapoll_authorizationsfinalize_order)r rP rQ r r r poll_and_finalize s zClientV2.poll_and_finalizec C s g }|j jD ]L}tj |k r | j| ||d}|j jtjkrL| | q t
d qq t |t |j jk rvt
g }|D ]4}|j jtjkr~|j jD ]}|jdur| | qq~|rt
||j|dS )z Poll Order Resource for status.r< N)r= )r. r= rU rV rC rD statusr ZSTATUS_PENDINGr? timesleeplenr TimeoutError STATUS_VALIDr errorZValidationErrorr, )r rP rQ Z responsesrK rM ZfailedZchallr r r rX s&
z ClientV2.poll_authorizations)rP r c C sR t jt jj|j}tjt|d}| |j
j |}|j tj
| d}|S )a Start the process of finalizing an order.
:param messages.OrderResource orderr: order to finalize
:param datetime.datetime deadline: when to stop polling and timeout
:returns: updated order
:rtype: messages.OrderResource
)rG r- )OpenSSLZcryptoZload_certificate_requestZ FILETYPE_PEMr8 r ZCertificateRequestjoseComparableX509r! r. finalizer, rB r6 r7 )r rP rG Z wrapped_csrresr r r begin_finalization s
zClientV2.begin_finalization)rP rQ fetch_alternative_chainsr c s t j |k rtd |j}tj| }|j
tj krb|j durVt
|j t
dq |j
tjkr |jdur |j}|j||jd}|r |d} fdd|D }|j|d}|S q t
dS ) z
Poll an order that has been finalized for its status.
If it becomes valid, obtain the certificate.
:returns: finalized order (with certificate)
:rtype: messages.OrderResource
r[ NzPThe certificate order failed. No further information was provided by the server.)r. Z
fullchain_pem alternatec s g | ]} |jqS r )rD text).0rK r r r
z.ClientV2.poll_finalization..)Zalternative_fullchains_pem)rU rV r] r^ rD r4 r rB r6 r7 r\ ZSTATUS_INVALIDrb r Z
IssuanceErrorErrorra certificater, rk
_get_linksr` ) r rP rQ ri r' r. Zcertificate_responseZalt_chains_urlsZ
alt_chainsr rm r poll_finalization s&
zClientV2.poll_finalizationc C s | | | |||S )a{ Finalize an order and obtain a certificate.
:param messages.OrderResource orderr: order to finalize
:param datetime.datetime deadline: when to stop polling and timeout
:param bool fetch_alternative_chains: whether to also fetch alternative
certificate chains
:returns: finalized order
:rtype: messages.OrderResource
)rh rs )r rP rQ ri r r r rY
s
zClientV2.finalize_order)certrsnr c C s | ||| jd dS )a Revoke certificate.
:param .ComparableX509 cert: `OpenSSL.crypto.X509` wrapped in
`.ComparableX509`
:param int rsn: Reason code for certificate revocation.
:raises .ClientError: If revocation is unsuccessful.
Z
revokeCertN)_revoker )r rt ru r r r revoke s zClientV2.revoker c C s$ t | jdo"t | jjdo"| jjjS )zGChecks if ACME server requires External Account Binding authentication.metaexternal_account_required)hasattrr ry rz rm r r r rz ' s
z"ClientV2.external_account_requiredargskwargsr c O s, |dd d |dd }| j |i |S )z
Send GET request using the POST-as-GET protocol.
:param args:
:param kwargs:
:return:
Nr[ N)r! )r r} r~ new_argsr r r rD - s zClientV2._post_as_get)r'
relation_typer c s. d|j vrg S t|j d } fdd|D S )z
Retrieves all Link URIs of relation_type from the response.
:param requests.Response response: The requests HTTP response.
:param str relation_type: The relation type to filter by.
ZLinkc s0 g | ](}d |v rd|v r|d kr|d qS )relrK r )rl lr r r rn B s z'ClientV2._get_links..)r# r
)r r' r linksr r r rr 7 s
zClientV2._get_links)rK r r c C s t j|| S )aB
Retrieves the ACME directory (RFC 8555 section 7.1.1) from the ACME server.
:param str url: the URL where the ACME directory is available
:param ClientNetwork net: the ClientNetwork to use to make the request
:returns: the ACME directory object
:rtype: messages.Directory
)r Directoryr6 rF r7 )clsrK r r r r
get_directoryE s
zClientV2.get_directory)r' r4 terms_of_servicer c C s> d|j v r|j d d }tjtj| |jd||dS )Nzterms-of-servicerK r )r. r4 r )r r RegistrationResourcer5 r6 r7 r# rF )r r' r4 r r r r r% Q s
z ClientV2._regr_from_response)r( r. r c C s" | |j|}| j||j|jdS )N)r4 r )r! r4 r% r )r r( r. r' r r r r0 ] s
zClientV2._send_recv_regrc O s& | dt| jd | jj|i |S )zWrapper around self.net.post that adds the newNonce URL.
This is used to retry the request in case of a badNonce error.
new_nonce_urlZnewNonce)
setdefaultgetattrr r postr r} r~ r r r r! k s zClientV2._postc C s | |tjdddS )zDeactivate registration.
:param messages.RegistrationResource regr: The Registration Resource
to be deactivated.
:returns: The Registration resource that was deactivated.
:rtype: `.RegistrationResource`
deactivatedN)r\ Zcontact)r1 r r5 r6 r* r r r deactivate_registrationt s z ClientV2.deactivate_registrationc C s. t jdd}| |j|}| ||jj|jS )a Deactivate authorization.
:param messages.AuthorizationResource authzr: The Authorization resource
to be deactivated.
:returns: The Authorization resource that was deactivated.
:rtype: `.AuthorizationResource`
r )r\ )r ZUpdateAuthorizationr! r4 rC r. rN )r rM r. r' r r r deactivate_authorization s
z!ClientV2.deactivate_authorization)r' rN r4 r c C sF t jt j| |jd|d}|d urB|jj|krBt
||S )Nr r3 ) r AuthorizationResourceZ
Authorizationr6 r7 r# rF r. rN r UnexpectedUpdate)r r' rN r4 rM r r r rC s
z ClientV2._authzr_from_response)challbr' r c C st | |j|}z|jd d }W n ty< tdY n0 tj|tj |
d}|j|jkrpt |j|S )ah Answer challenge.
:param challb: Challenge Resource body.
:type challb: `.ChallengeBody`
:param response: Corresponding Challenge response
:type response: `.challenges.ChallengeResponse`
:returns: Challenge Resource with updated body.
:rtype: `.ChallengeResource`
:raises .UnexpectedUpdate:
ZuprK z"up" Link header missing)
authzr_urir. ) r! r4 r KeyErrorr ClientErrorr ChallengeResource
ChallengeBodyr6 r7 r )r r r' Zrespr Zchallrr r r answer_challenge s zClientV2.answer_challenge)r' defaultr c C s |j dt|}z t|}W nx ty t|}|durz:t|d durV|d nd}tj|dd | W Y S ttfy Y n0 |}Y n0 tj tj|d S )a Compute next `poll` time based on response ``Retry-After`` header.
Handles integers and various datestring formats per
https://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.37
:param requests.Response response: Response from `poll`.
:param int default: Default value (in seconds), used when
``Retry-After`` header is not present or invalid.
:returns: Time point when next `poll` should be performed.
:rtype: `datetime.datetime`
z Retry-AfterNr rS )
r# rF rA int
ValueErrorr rU rW
OverflowErrorrV )r r' r retry_afterrT ZwhenZtz_secsr r r r s
zClientV2.retry_after)rt ru rK r c C s0 | |tj||d}|jtjkr,tddS )a. Revoke certificate.
:param .ComparableX509 cert: `OpenSSL.crypto.X509` wrapped in
`.ComparableX509`
:param int rsn: Reason code for certificate revocation.
:param str url: ACME URL to post to
:raises .ClientError: If revocation is unsuccessful.
)rq reasonz0Successful revocation must return HTTP OK statusN)r! r Z
Revocationr" http_clientZOKr r )r rt ru rK r' r r r rv s
zClientV2._revoke)N)F)N)F)F)NN)NN)8__name__
__module__ __qualname____doc__r r r ZNewRegistrationr r r+ r r5 r1 boolr) bytesrE rL r r requestsResponserO rU rZ rX rh rs rY rd re r rw rz r rD rA r rr classmethodr r% r0 r! r r r@ rC r r ZChallengeResponser r r rv r r r r r % s
& !
r c @ s2 e Zd ZdZdZdZdZdZdej dde
fej e e
j ejeeedd d
d Zdd d
dZejeeedddZed)eje e ejdddZeeeeejdddZ eeejdddZ efeeeejdd d Z ejdd d d Z eeed!d"d#Z eeejdd$d%Z!efeejeeejd&d'd(Z"dS )*r zvWrapper around requests that signs POSTs for authentication.
Also adds user agent, and handles Content-Type.
zapplication/jsonzapplication/jose+jsonzapplication/problem+jsonz Replay-NonceNTz acme-python)keyr& alg
verify_ssl
user_agenttimeoutr c C s\ || _ || _|| _|| _t | _|| _t | _ || _
t }| j d| | j d| d S )Nzhttp://zhttps://)
r r& r r set_noncesr r ZSessionsession_default_timeoutr Zmount)r r r& r r r r Zadapterr r r r s
zClientNetwork.__init__rx c C s& z| j W n ty Y n0 d S r )r close Exceptionrm r r r __del__ s zClientNetwork.__del__)objnoncerK r c C s~ |r|j dd nd}td| | j||d}| jdurJ| jd |d< | j|d < tjj |fi t
t t t
f |j ddS )
zWrap `JSONDeSerializable` object in JWS.
.. todo:: Implement ``acmePath``.
:param josepy.JSONDeSerializable obj:
:param str url: The URL to which this object will be POSTed
:param str nonce:
:rtype: str
)indentro zJWS payload:
%s)r r rK Nr4 Zkidr )Z
json_dumpsencodeloggerdebugr r& r r ZJWSsignr r rA r )r r r rK jobjr~ r r r _wrap_in_jws s
zClientNetwork._wrap_in_jws)r' content_typer c
C s$ |j d}|r"|dd }z | }W n tyD d}Y n0 |jdkrdt|j dd|j s|dur|| j
krt d| zt
j|W q tjy } zt||fW Y d}~qd}~0 0 n
t|nD|dur|| jkrt d | || jkr |du r td
| |S ) a Check response content and its type.
.. note::
Checking is not strict: wrong server response ``Content-Type``
HTTP header is ignored if response is an expected JSON object
(c.f. Boulder #56).
:param str content_type: Expected Content-Type response header.
If JSON is expected and not present in server response, this
function will raise an error. Otherwise, wrong Content-Type
is ignored, but logged.
:raises .messages.Error: If server response body
carries HTTP Problem (https://datatracker.ietf.org/doc/html/rfc7807).
:raises .ClientError: In case of other networking errors.
Content-Type;r Ni r zUNKNOWN-LOCATIONz/Ignoring wrong Content-Type (%r) for JSON Errorz s z.ClientNetwork._send_request..)r r r r r r r Zrequestr
exceptionsZRequestExceptionrematchrA groupsr base64Z b64encodeZcontentencodingrk r" joinr# items)r r rK r} r~ r' eZ err_regexmhostpathZ_err_noerr_msgZ
debug_contentr r r
_send_requestq s<
.
zClientNetwork._send_requestr| c O s | j dg|R i |S )a Send HEAD request without checking the response.
Note, that `_check_response` is not called, as it is expected
that status code other than successfully 2xx will be returned, or
messages2.Error will be raised by the server.
ZHEAD)r r r r r head s zClientNetwork.head)rK r r~ r c K s | j | jd|fi ||dS )z$Send GET request and check response.ZGETr )r r )r rK r r~ r r r rF s zClientNetwork.get)r' r c
C s | j |jv r||j| j }ztjjd |}W n2 tjy` } zt ||W Y d }~n
d }~0 0 t
d| | j
| n
t|d S )Nr zStoring nonce: %s)REPLAY_NONCE_HEADERr# r ZHeader_fieldsdecoderd r r ZBadNoncer r r addZ MissingNonce)r r' r Z
decoded_noncerb r r r
_add_nonce s " zClientNetwork._add_nonce)rK r r c C sL | j sBtd |d u r$| |}n| j| |d d}| | | j S )NzRequesting fresh noncer )r r r r r r pop)r rK r r' r r r
_get_nonce s
zClientNetwork._get_noncec
O sr z| j |i |W S tjyl } z@|jdkrVtd| | j |i |W Y d}~S W Y d}~n
d}~0 0 dS )zPOST object wrapped in `.JWS` and check response.
If the server responded with a badNonce error, the request will
be retried once.
ZbadNoncez Retrying request after error:
%sN)
_post_oncer rp coder r )r r} r~ rb r r r r s
zClientNetwork.post)rK r r r~ r c K sf | dd }| || |||}|dd|i | jd|fd|i|}| j||d}| | |S )Nr r# r r r r )r r r r r r r )r rK r r r~ r r r' r r r r s
zClientNetwork._post_once)N)#r r r r r ZJOSE_CONTENT_TYPEr r rd ZRS256DEFAULT_NETWORK_TIMEOUTZJWKr r r Z JWASignaturer rA r r r ZJSONDeSerializabler r r r r r r r rF r r r r r r r r r s>
:G
r )*r r rU Z email.utilsr Z http.clientZclientr Zloggingr r] typingr r r r r r r r
Z cryptographyr Zjosepyrd rc r Zrequests.adaptersr Zrequests.utilsr
Zacmer r r r r Z getLoggerr r r r r r r r r sB
N