a
}|gf @ sT d Z ddlmZ ddlZddlZddlmZ ddlmZ ddlmZ ddlm Z ddlm
Z
dd lm Z dd
lm Z dd lm
Z
dd lmZ dd
lmZ ddlZddlmZ ddlmZ ddlmZ ddlmZ ddlmZ dZddddddddd d d d d d!d"d#d$d%d&d'd(d)d*d+d,d-d.Zi d/d0 e D Ze e d1d2d3Z G d4d5 d5ej eZ G d6d7 d7e Z!e!d8Z"e!d9Z#G d:d; d;ej$Z%G dd? d?e Z'e'd@Z(e'dAZ)e'dBZ*e'dCZ+e'dDZ,e'dEZ-e'dFZ.e'dGZ/G dHdI dIej Z0G dJdK dKej$Z1G dLdM dMe1Z2G dNdO dOej$Z3G dPdQ dQZ4edRdSdTZ5G dUdS dSe3Z6G dVdW dWe6Z7G dXdY dYe6Z8G dZd[ d[e2Z9G d\d] d]e3Z:G d^d_ d_e1Z;G d`da dae3ZG dfdg dge2Z?G dhdi diej$Z@G djdk dke2ZAG dldm dmej$ZBG dndo doe3ZCG dpdq dqe2ZDG drds dseCZEdS )tzACME protocol messages. )HashableN)Any)Dict)Iterator)List)Mapping)MutableMapping)Optional)Tuple)Type)TypeVar)
challenges)errors)fields)jws)utilzurn:ietf:params:acme:error:z4The request specified an account that does not existzOThe request specified a certificate to be revoked that has already been revokedz2The CSR is unacceptable (e.g., due to a short key)z1The client sent an unacceptable anti-replay noncez>The JWS was signed by a public key the server does not supportz;The revocation reason provided is not allowed by the serverz@The JWS was signed with an algorithm the server does not supportz\Certification Authority Authorization (CAA) records forbid the CA from issuing a certificatezBSpecific error conditions are indicated in the "subproblems" arrayz?The server could not connect to the client to verify the domainzAThere was a problem with a DNS query during identifier validationz4The server could not validate a DNSSEC signed domainz;Response received didn't match the challenge's requirementsz1The provided email for a registration was invalidz$The provided contact URI was invalidz!The request message was malformedz9The server will not issue certificates for the identifierzLThe request attempted to finalize an order that is not ready to be finalizedz,There were too many requests of a given typez(The server experienced an internal errorz=The server experienced a TLS error during domain verificationz)The client lacks sufficient authorizationz@A contact URL for an account used an unsupported protocol schemez*The server could not resolve a domain namez'An identifier is of an unsupported typez,The server requires external account binding)ZaccountDoesNotExistZalreadyRevokedZbadCSRZbadNonceZ badPublicKeyZbadRevocationReasonZbadSignatureAlgorithmZcaaZcompoundZ
connectiondnsZdnssecZincorrectResponseZ invalidEmailZinvalidContactZ malformedZrejectedIdentifierZ
orderNotReadyZ rateLimitedZserverInternalZtlsZ unauthorizedZunsupportedContactZ unknownHostZunsupportedIdentifierexternalAccountRequiredc C s i | ]\}}t | |qS ) ERROR_PREFIX).0nameZdescr r 1/usr/lib/python3.9/site-packages/acme/messages.py
; s r )errreturnc C s" t | tr | jdur t| jv S dS )z#Check if argument is an ACME error.NF)
isinstanceErrortypr )r r r r
is_acme_error@ s
r c s e Zd ZU dZdZeZeed f e d< edd fdd Z
edd d
Z e ed d d d
Z
edddZeedddZedddZ ZS ) _ConstantzACME constant.r POSSIBLE_NAMESNr r c s t | | j|< || _d S N)super__init__r" r selfr __class__r r r& L s
z_Constant.__init__r c C s | j S r$ r! r( r r r to_partial_jsonQ s z_Constant.to_partial_jsonjobjr c C s& || j vr t| j d| j | S )Nz not recognized)r" joseZDeserializationError__name__clsr/ r r r from_jsonT s
z_Constant.from_jsonc C s | j j d| j dS )N())r* r1 r r, r r r __repr__Z s z_Constant.__repr__)otherr c C s t |t| o|j| jkS r$ )r typer )r( r8 r r r __eq__] s z_Constant.__eq__c C s t | j| jfS r$ )hashr* r r, r r r __hash__` s z_Constant.__hash__)r1
__module__ __qualname____doc__ __slots__NotImplementedr" r str__annotations__r& r- classmethodr4 r7 r boolr: intr<
__classcell__r r r) r r G s
r c @ s& e Zd ZU dZi Zeeef ed< dS )IdentifierTypezACME identifier type.r" N r1 r= r> r? r" r rB r rC r r r r rH d s
rH r ipc @ s< e Zd ZU dZejdejdZee d< edZ
e e d< dS )
IdentifierzJACME identifier.
:ivar IdentifierType typ:
:ivar str value:
r9 decoderr valueN) r1 r= r> r? r0 fieldrH r4 r rC rN rB r r r r rK m s
rK c @ s e Zd ZU dZejddddZeed< ejdddZ eed< ejd ddZ
eed < ejd
e j dd Z
ed ed
< ejd
ddZeed ed
< ejeeeef ed dddZeeed dddZeee dddZeee dddZeeddd d Zedd d ZdS ) r a ACME error.
https://datatracker.ietf.org/doc/html/rfc7807
Note: Although Error inherits from JSONObjectWithFields, which is immutable,
we add mutability for Error to comply with the Python exception API.
:ivar str typ:
:ivar str title:
:ivar str detail:
:ivar Identifier identifier:
:ivar tuple subproblems: An array of ACME Errors which may be present when the CA
returns multiple errors related to the same request, `tuple` of `Error`.
r9 Tz about:blank omitemptydefaultr titlerQ detail
identifierrM rQ rK subproblems)r .rN r c C s t dd | D S )Nc s s | ]}t |V qd S r$ )r r4 )r
subproblemr r r z$Error.subproblems..tuplerN r r r rX s zError.subproblems)codekwargsr c K s. |t vrtd| t| }| f d|i|S )zCreate an Error instance with an ACME Error code.
:str code: An ACME error code, like 'dnssec'.
:kwargs: kwargs to pass to Error.
z4The supplied code: %s is not a known ACME error coder ) ERROR_CODES
ValueErrorr )r3 r` ra r r r r with_code s zError.with_coder+ c C s t | jS )zHardcoded error description based on its type.
:returns: Description if standard ACME error or ``None``.
:rtype: str
)ERROR_TYPE_DESCRIPTIONSgetr r, r r r description s zError.descriptionc C s( t | jjdddd }|tv r$|S dS )zACME error code.
Basically self.typ without the ERROR_PREFIX.
:returns: error code if standard ACME code or ``None``.
:rtype: str
: )maxsplitN)rB r rsplitrb )r( r` r r r r` s
z
Error.codeN)r rN r c C s t | ||S r$ )object __setattr__)r( r rN r r r rn s zError.__setattr__c C st d dd | j| j| j| jfD }| jrBd| jj d| }| jrpt | jdkrp| jD ]}|d| 7 }q\|S )Ns :: c s s" | ]}|d ur| ddV qd S )Nasciibackslashreplaceencode)r partr r r r[ s z Error.__str__..z Problem for z: r
)
joinr rg rU rS decoderV rN rX len)r( resultrZ r r r __str__ s
z
Error.__str__) r1 r= r> r? r0 rO r rB rC rS rU rK r4 rV r rX r
rM r r r rD rd propertyrg r` rn ry r r r r r x s$
" r c @ s& e Zd ZU dZi Zeeef ed< dS )StatuszACME "status" field.r" NrI r r r r r{ s
r{ unknownpendingZ
processingZvalidZinvalidZrevokedZreadyZ deactivatedc @ s e Zd ZdZG dd dejZeee f ddddZ
ee dd d
Z ee dd d Z e
ee f d
ddZeeee f d dddZdS ) DirectoryzmDirectory.
Directory resources must be accessed by the exact field name in RFC8555 (section 9.7.5).
c s e Zd ZU dZejdddZeed< ejdddZ eed< ejdddZ
e e ed< ejd ddZ e
ed
< ed d fd
d ZeedddZee d fdd ZeedddZ ZS )zDirectory.MetazDirectory Meta.ZtermsOfServiceTrT _terms_of_servicewebsiteZ
caaIdentitiescaa_identitiesr external_account_requiredNra r c s, fdd| D }t jf i | d S )Nc s i | ]\}} ||qS r _internal_namer kvr, r r r r\ z+Directory.Meta.__init__..itemsr% r& r( ra r) r, r r& s zDirectory.Meta.__init__r+ c C s | j S )zURL for the CA TOS)r r, r r r terms_of_service s z Directory.Meta.terms_of_servicec # s. t D ] }|dkr"|dd n|V q
d S )Nr ri r% __iter__r' r) r r r s zDirectory.Meta.__iter__r# c C s |dkrd| S |S )Nr _r r' r r r r s z Directory.Meta._internal_name)r1 r= r> r? r0 rO r rB rC r r r r rE r r& rz r r r r rG r r r) r Meta s
r Nr. c C s
|| _ d S r$ )_jobjr( r/ r r r r& s zDirectory.__init__r# c
C s@ z
| | W S t y: } ztt|W Y d }~n
d }~0 0 d S r$ )KeyErrorAttributeErrorrB )r( r errorr r r __getattr__ s
zDirectory.__getattr__c C s4 z | j | W S ty. td| dY n0 d S )NzDirectory field "z " not found)r r r' r r r __getitem__ s zDirectory.__getitem__r+ c C s t | jdd S )Nc S s | S r$ r )r r r r
r\ z+Directory.to_partial_json..)r Zmap_keysr r, r r r r- s zDirectory.to_partial_jsonc C s | j |di |d< | |S )Nmeta)r r4 popr2 r r r r4 s zDirectory.from_json)r1 r= r> r? r0 JSONObjectWithFieldsr r rB r r& r r r r- rD r r4 r r r r r~ s r~ c @ s$ e Zd ZU dZedZded< dS )ResourcezOACME Resource.
:ivar acme.messages.ResourceBody body: Resource body.
body ResourceBodyN)r1 r= r> r? r0 rO r rC r r r r r s
r c @ s$ e Zd ZU dZedZeed< dS )ResourceWithURIzKACME Resource with URI.
:ivar str uri: Location of the resource.
uriN) r1 r= r> r? r0 rO r rB rC r r r r r s
r c @ s e Zd ZdZdS )r zACME Resource Body.Nr1 r= r> r? r r r r r ' s r c @ s4 e Zd ZdZeejeeee ee
f dddZ dS )ExternalAccountBindingz ACME External Account Binding)account_public_keykidhmac_key directoryr c C sR t | }tj|}|d }tj |tj
j |dtj j
d||}| S )zLCreate External Account Binding Resource from contact details, kid and hmac.Z
newAccount)keyN)jsondumpsr- rr r0 Zb64Z b64decoder ZJWSsignZjwkZJWKOctZjwaZHS256) r3 r r r r Zkey_jsonZdecoded_hmac_keyurlZeabr r r from_data. s z ExternalAccountBinding.from_dataN) r1 r= r> r? rD r0 JWKrB r~ r r r r r r r r + s
r GenericRegistration Registration)boundc s e Zd ZU dZejddejjdZeje d< ejddddZ
e e df e d< ejd dd
Z
e e d < ejd dd
Zee d < ejd dd
Zee d
< ejddd
Zee d< ejddd
Zee ef e d< dZdZed*ee ee ee eee ef eedddZ edd fdd Z e e e df dd d Z ee ef ee ef d d d Z ee ef d! fd"d# Z ee ef d! fd$d% Z!e"e e df d!d&d'Z#e"e e df d!d(d)Z$ Z%S )+r zRegistration Resource Body.
:ivar jose.JWK key: Public key.
:ivar tuple contact: Contact information following ACME spec,
`tuple` of `str`.
:ivar str agreement:
r TrQ rM contactr rP . agreementrT statusZtermsOfServiceAgreedterms_of_service_agreedZonlyReturnExistingonly_return_existingZexternalAccountBindingexternal_account_bindingztel:zmailto:N)r3 phoneemailr ra r c s d|v }t |dd}|dur0| j| |durV| fdd|dD |s^|rjt||d< |rv||d< f i |S )a
Create registration resource from contact details.
The `contact` keyword being passed to a Registration object is meaningful, so
this function represents empty iterables in its kwargs by passing on an empty
`tuple`.
r r Nc s g | ]} j | qS r ) email_prefix)r Zmailr3 r r
p r\ z*Registration.from_data..,r )listr append phone_prefixextendsplitr^ )r3 r r r ra Zcontact_provideddetailsr r r r [ s zRegistration.from_datar c s8 d|v r"|d dur"t | dd t jf i | dS )z;Note if the user provides a value for the `contact` member.r N _add_contactT)rm rn r% r& r r) r r r& | s zRegistration.__init__)prefixr c s t fdd| jD S )Nc 3 s( | ] }| r|t d V qd S r$ )
startswithrw )r rU r r r r[ s
z/Registration._filter_contact..)r^ r )r( r r r r _filter_contact s z Registration._filter_contactr. c C s t | ddr| d|d< |S )a
The `contact` member of Registration objects should not be required when
de-serializing (as it would be if the Fields' `omitempty` flag were `False`), but
it should be included in serializations if it was provided.
:param jobj: Dictionary containing this Registrations' data
:type jobj: dict
:returns: Dictionary containing Registrations data to transmit to the server
:rtype: dict
r Fr )getattrrr r r r r _add_contact_if_appropriate s z(Registration._add_contact_if_appropriater+ c s t }| |S )z2Modify josepy.JSONDeserializable.to_partial_json())r% r- r r r) r r r- s
z Registration.to_partial_jsonc s t }| |S )z;Modify josepy.JSONObjectWithFields.fields_to_partial_json())r% fields_to_partial_jsonr r r) r r r s
z#Registration.fields_to_partial_jsonc C s | | jS )z*All phones found in the ``contact`` field.)r r r, r r r phones s zRegistration.phonesc C s | | jS )z*All emails found in the ``contact`` field.)r r r, r r r emails s zRegistration.emails)NNN)&r1 r= r> r? r0 rO r r4 r rC r r
rB r r r{ r rE r r r r r r rD r r r r r& r r r- r rz r r rG r r r) r r A s<
c @ s e Zd ZdZdS )NewRegistrationzNew registration.Nr r r r r r s r c @ s e Zd ZdZdS )UpdateRegistrationzUpdate registration.Nr r r r r r s r c @ sV e Zd ZU dZejdejdZee d< ejdddZ
e e d< ejdddZ e e d< dS ) RegistrationResourcezRegistration Resource.
:ivar acme.messages.Registration body:
:ivar str new_authzr_uri: Deprecated. Do not use.
:ivar str terms_of_service: URL for the CA TOS.
r rL new_authzr_uriTrT r N)
r1 r= r> r? r0 rO r r4 r rC r rB r r r r r r s
r c s4 e Zd ZU dZdZejddddZee d< ejde
j de d Z
e
e d< ejd
dd Zeje d
< ejd ej ddd Zee d < edd
fdd Zeed fdd Zeeef d fdd Zeeeef eeef d fdd Ze edddZ eeddd Z e e d fd d Z eedd d Z! Z"S )!
ChallengeBodya> Challenge Resource Body.
.. todo::
Confusingly, this has a similar name to `.challenges.Challenge`,
as well as `.achallenges.AnnotatedChallenge`. Please use names
such as ``challb`` to distinguish instances of this class from
``achall``.
:ivar acme.challenges.Challenge: Wrapped challenge.
Conveniently, all challenge fields are proxied, i.e. you can
call ``challb.x`` to get ``challb.chall.x`` contents.
:ivar acme.messages.Status status:
:ivar datetime.datetime validated:
:ivar messages.Error error:
)challr TNrP _urlr )rM rQ rR validatedrT r r c s, fdd| D }t jf i | d S )Nc s i | ]\}} ||qS r r r r, r r r r\ z*ChallengeBody.__init__..r r r) r, r r& s zChallengeBody.__init__r# c s t | |S r$ )r% rr r r' r) r r rr s zChallengeBody.encoder+ c s t }|| j |S r$ )r% r- updater r r) r r r- s
z ChallengeBody.to_partial_jsonr. c s t |}tj||d< |S )Nr )r% fields_from_jsonr
Z Challenger4 )r3 r/ Z jobj_fieldsr) r r r s z ChallengeBody.fields_from_jsonc C s | j S )zThe URL of this challenge.)r r, r r r r s zChallengeBody.uric C s t | j|S r$ )r r r' r r r r s zChallengeBody.__getattr__c # s& t D ]}|dkrdn|V q
d S )Nr r r r' r) r r r s zChallengeBody.__iter__c C s |dkr dS |S )Nr r r r' r r r r s z ChallengeBody._internal_name)#r1 r= r> r? r@ r0 rO r rB rC r{ r4 STATUS_PENDINGr r rfc3339r datetimer r r r& rr r r- rD r r rz r r r r r rG r r r) r r s(
&r c @ sN e Zd ZU dZejdejdZee d< edZ
e e d< e e dddZ
dS ) ChallengeResourcezChallenge Resource.
:ivar acme.messages.ChallengeBody body:
:ivar str authzr_uri: URI found in the 'up' ``Link`` header.
r rL
authzr_urir+ c C s | j jS )z The URL of the challenge body.)r r r, r r r r s zChallengeResource.uriN)r1 r= r> r? r0 rO r r4 r rC r rB rz r r r r r r s
r c @ s e Zd ZU dZejdejddZee d< ejdddZ
e e e d< ejdde
jdZe
e d< ejd ddZeje d < ejd
ddZee d
< e
je eeef ee d f d d
dZ
dS )
AuthorizationzAuthorization Resource Body.
:ivar acme.messages.Identifier identifier:
:ivar list challenges: `list` of `.ChallengeBody`
:ivar acme.messages.Status status:
:ivar datetime.datetime expires:
rV TrW r
rT r r expireswildcard.rY c C s t dd | D S )Nc s s | ]}t |V qd S r$ )r r4 )r r r r r r[ , r\ z+Authorization.challenges..r] r_ r r r r
* s zAuthorization.challengesN)r1 r= r> r? r0 rO rK r4 rV rC r
r r r{ r r r r r r rE rM r rB r r
r r r r r s
r c @ s e Zd ZdZdS )NewAuthorizationzNew authorization.Nr r r r r r / s r c @ s e Zd ZdZdS )UpdateAuthorizationzUpdate authorization.Nr r r r r r 3 s r c @ s@ e Zd ZU dZejdejdZee d< ejdddZ
e e d< dS )AuthorizationResourcez~Authorization Resource.
:ivar acme.messages.Authorization body:
:ivar str new_cert_uri: Deprecated. Do not use.
r rL new_cert_uriTrT N) r1 r= r> r? r0 rO r r4 r rC r rB r r r r r 7 s
r c @ s0 e Zd ZU dZejdejejdZej e
d< dS )CertificateRequestz~ACME newOrder request.
:ivar jose.ComparableX509 csr:
`OpenSSL.crypto.X509Req` wrapped in `.ComparableX509`
csrrM encoderN) r1 r= r> r? r0 rO Z
decode_csrZ
encode_csrr ComparableX509rC r r r r r B s
r c @ s> e Zd ZU dZedZeed< edZ e
e df ed< dS )CertificateResourcea Certificate Resource.
:ivar josepy.util.ComparableX509 body:
`OpenSSL.crypto.X509` wrapped in `.ComparableX509`
:ivar str cert_chain_uri: URI found in the 'up' ``Link`` header
:ivar tuple authzrs: `tuple` of `AuthorizationResource`.
cert_chain_uriauthzrs.N) r1 r= r> r? r0 rO r rB rC r r
r r r r r r L s
r c @ sB e Zd ZU dZejdejejdZej e
d< edZ e e
d< dS )
RevocationzRevocation message.
:ivar jose.ComparableX509 certificate: `OpenSSL.crypto.X509` wrapped in
`jose.ComparableX509`
certificater reasonN)
r1 r= r> r? r0 rO Z decode_certZ encode_certr r rC r rF r r r r r Y s
r c @ s e Zd ZU dZejdddZee e d< ejde
j ddZ e
e d< ejdddZ
ee e d< ejdddZee d< ejd ddZee d < ejd
ddZeje d
< ejd dej d Zee d < ejeeeef eed
f dddZdS )Ordera_ Order Resource Body.
:ivar identifiers: List of identifiers for the certificate.
:vartype identifiers: `list` of `.Identifier`
:ivar acme.messages.Status status:
:ivar authorizations: URLs of authorizations.
:vartype authorizations: `list` of `str`
:ivar str certificate: URL to download certificate as a fullchain PEM.
:ivar str finalize: URL to POST to to request issuance once all
authorizations have "valid" status.
:ivar datetime.datetime expires: When the order expires.
:ivar ~.Error error: Any error that occurred during finalization, if applicable.
identifiersTrT r rW authorizationsr finalizer r r .rY c C s t dd | D S )Nc s s | ]}t |V qd S r$ )rK r4 )r rV r r r r[ r\ z$Order.identifiers..r] r_ r r r r } s zOrder.identifiersN)r1 r= r> r? r0 rO r r rK rC r{ r4 r r rB r r r r r r r r rM r r r
r r r r r e s
r c @ s e Zd ZU dZejdejdZee d< ejdddd dd d Z
e e d< ed
Z e
e e d
< ejd dd Zee d < ejd
dd Ze
e e d
< e je
eeef eedf dddZ dS )
OrderResourcea Order Resource.
:ivar acme.messages.Order body:
:ivar bytes csr_pem: The CSR this Order will be finalized with.
:ivar authorizations: Fully-fetched AuthorizationResource objects.
:vartype authorizations: `list` of `acme.messages.AuthorizationResource`
:ivar str fullchain_pem: The fetched contents of the certificate URL
produced once the order was finalized, if it's present.
:ivar alternative_fullchains_pem: The fetched contents of alternative certificate
chain URLs produced once the order was finalized, if present and requested during
finalization.
:vartype alternative_fullchains_pem: `list` of `str`
r rL csr_pemTc C s
| dS Nzutf-8rq )sr r r r r\ zOrderResource.c C s
| dS r )rv )br r r r r\ )rQ rM r r
fullchain_pemrT alternative_fullchains_pem.rY c C s t dd | D S )Nc s s | ]}t |V qd S r$ )r r4 )r Zauthzr r r r[ r\ z/OrderResource.authorizations..r] r_ r r r r s z OrderResource.authorizationsN)r1 r= r> r? r0 rO r r4 r rC r bytesr r r r rB r rM r r r
r r r r r s
r c @ s e Zd ZdZdS )NewOrderz
New order.Nr r r r r r s r )Fr? collections.abcr r r typingr r r r r r r r
r r Zjosepyr0 Zacmer
r r r r r rb r re
BaseExceptionrE r ZJSONDeSerializabler rH ZIDENTIFIER_FQDNZ
IDENTIFIER_IPr rK r r{ ZSTATUS_UNKNOWNr ZSTATUS_PROCESSINGZ STATUS_VALIDZSTATUS_INVALIDZSTATUS_REVOKEDZ STATUS_READYZSTATUS_DEACTIVATEDr~ r r r r r r r r r r r r r r r r r r r r r r r r r s ! W7 m
A
&