_c@sdZddlZddlZddlZddlmZddlmZddlmZddlm Z ddlm Z ddl m Z ydd l mZWn!ek rdd lmZnXd Zd Zid d 6dd6dd6dd6dd6dd6dd6dd6dd6dd6d d!6d"d#6d$d%6d&d'6d(d)6d*d+6d,d-6d.d/6d0d16d2d36d4d56d6d76d8d96d:d;6d<d=6d>d?6Zed@ejDZejedAejDdBZejdCejejfdDYZdEejefdFYZdGefdHYZedIZedJZ edKZ!edLZ"edMZ#edNZ$edOZ%edPZ&dQefdRYZ'e'd!Z(dSejfdTYZ)dUejfdVYZ*dWejfdXYZ+dYe+fdZYZ,d[ejfd\YZ-d]e.fd^YZ/d_e-fd`YZ0e*j1dae e0fdbYZ2dce e0fddYZ3dee,fdfYZ4dge-fdhYZ5die+fdjYZ6dke-fdlYZ7e*j1dme e7fdnYZ8doe e7fdpYZ9dqe,fdrYZ:e*j1dse ejfdtYZ;due,fdvYZ<e*j1dwe ejfdxYZ=dye-fdzYZ>d{e,fd|YZ?e*j1d}e>fd~YZ@dS(sACME protocol messages.iN(t challenges(terrors(tfields(tjws(tutil(t ResourceMixin(tHashablesurn:acme:error:surn:ietf:params:acme:error:s4The request specified an account that does not existtaccountDoesNotExistsOThe request specified a certificate to be revoked that has already been revokedtalreadyRevokeds2The CSR is unacceptable (e.g., due to a short key)tbadCSRs1The client sent an unacceptable anti-replay noncetbadNonces>The JWS was signed by a public key the server does not supportt badPublicKeys;The revocation reason provided is not allowed by the servertbadRevocationReasons@The JWS was signed with an algorithm the server does not supporttbadSignatureAlgorithms\Certification Authority Authorization (CAA) records forbid the CA from issuing a certificatetcaasBSpecific error conditions are indicated in the "subproblems" arraytcompounds?The server could not connect to the client to verify the domaint connectionsAThere was a problem with a DNS query during identifier validationtdnss4The server could not validate a DNSSEC signed domaintdnssecs;Response received didn't match the challenge's requirementstincorrectResponses1The provided email for a registration was invalidt invalidEmails$The provided contact URI was invalidtinvalidContacts!The request message was malformedt malformeds9The server will not issue certificates for the identifiertrejectedIdentifiersLThe request attempted to finalize an order that is not ready to be finalizedt orderNotReadys,There were too many requests of a given typet rateLimiteds(The server experienced an internal errortserverInternals=The server experienced a TLS error during domain verificationttlss)The client lacks sufficient authorizationt unauthorizeds@A contact URL for an account used an unsupported protocol schemetunsupportedContacts*The server could not resolve a domain namet unknownHosts'An identifier is of an unsupported typetunsupportedIdentifiers,The server requires external account bindingtexternalAccountRequiredccs%|]\}}t||fVqdS(N(t ERROR_PREFIX(t.0tnametdesc((s1/usr/lib/python2.7/site-packages/acme/messages.pys :sccs%|]\}}t||fVqdS(N(tOLD_ERROR_PREFIX(R"R#R$((s1/usr/lib/python2.7/site-packages/acme/messages.pys =scCs>t|tr:|jdk r:t|jkp9t|jkStS(s#Check if argument is an ACME error.N(t isinstancetErrorttyptNoneR!R%tFalse(terr((s1/usr/lib/python2.7/site-packages/acme/messages.pyt is_acme_error@sR'cBseZdZejddeddZejddeZejddeZe dZ e dZ e d Z d ZRS( sACME error. https://tools.ietf.org/html/draft-ietf-appsawg-http-problem-00 :ivar unicode typ: :ivar unicode title: :ivar unicode detail: ttypet omitemptytdefaults about:blankttitletdetailcKs9|tkrtd|nt|}|d||S(sCreate an Error instance with an ACME Error code. :unicode code: An ACME error code, like 'dnssec'. :kwargs: kwargs to pass to Error. s4The supplied code: %s is not a known ACME error codeR((t ERROR_CODESt ValueErrorR!(tclstcodetkwargsR(((s1/usr/lib/python2.7/site-packages/acme/messages.pyt with_codeVs    cCstj|jS(sHardcoded error description based on its type. :returns: Description if standard ACME error or ``None``. :rtype: unicode (tERROR_TYPE_DESCRIPTIONStgetR((tself((s1/usr/lib/python2.7/site-packages/acme/messages.pyt descriptiondscCs0t|jjdd}|tkr,|SdS(sACME error code. Basically self.typ without the ERROR_PREFIX. :returns: error code if standard ACME code or ``None``. :rtype: unicode t:iN(tstrR(tsplitR2R)(R:R5((s1/usr/lib/python2.7/site-packages/acme/messages.pyR5ns  cCs5djd|j|j|j|jfDjS(Ns :: css-|]#}|dk r|jddVqdS(tasciitbackslashreplaceN(R)tencode(R"tpart((s1/usr/lib/python2.7/site-packages/acme/messages.pys s(tjoinR(R;R1R0tdecode(R:((s1/usr/lib/python2.7/site-packages/acme/messages.pyt__str__}s(t__name__t __module__t__doc__tjosetFieldtTrueR(R0R1t classmethodR7tpropertyR;R5RE(((s1/usr/lib/python2.7/site-packages/acme/messages.pyR'Gs  t _ConstantcBs_eZdZd ZeZdZdZedZ dZ dZ dZ dZ RS( sACME constant.R#cCs-tt|j||j|<||_dS(N(tsuperRNt__init__tPOSSIBLE_NAMESR#(R:R#((s1/usr/lib/python2.7/site-packages/acme/messages.pyRPs cCs|jS(N(R#(R:((s1/usr/lib/python2.7/site-packages/acme/messages.pytto_partial_jsonscCs8||jkr-tjdj|jn|j|S(Ns{0} not recognized(RQRItDeserializationErrortformatRF(R4tjobj((s1/usr/lib/python2.7/site-packages/acme/messages.pyt from_jsonscCsdj|jj|jS(Ns{0}({1})(RTt __class__RFR#(R:((s1/usr/lib/python2.7/site-packages/acme/messages.pyt__repr__scCs%t|t|o$|j|jkS(N(R&R-R#(R:tother((s1/usr/lib/python2.7/site-packages/acme/messages.pyt__eq__scCst|j|jfS(N(thashRWR#(R:((s1/usr/lib/python2.7/site-packages/acme/messages.pyt__hash__scCs ||k S(N((R:RY((s1/usr/lib/python2.7/site-packages/acme/messages.pyt__ne__s(sname(RFRGRHt __slots__tNotImplementedRQRPRRRLRVRXRZR\R](((s1/usr/lib/python2.7/site-packages/acme/messages.pyRNs     tStatuscBseZdZiZRS(sACME "status" field.(RFRGRHRQ(((s1/usr/lib/python2.7/site-packages/acme/messages.pyR`stunknowntpendingt processingtvalidtinvalidtrevokedtreadyt deactivatedtIdentifierTypecBseZdZiZRS(sACME identifier type.(RFRGRHRQ(((s1/usr/lib/python2.7/site-packages/acme/messages.pyRist IdentifiercBs5eZdZejddejZejdZRS(sNACME identifier. :ivar IdentifierType typ: :ivar unicode value: R-tdecodertvalue( RFRGRHRIRJRiRVR(Rl(((s1/usr/lib/python2.7/site-packages/acme/messages.pyRjst DirectorycBs~eZdZiZdejfdYZedZedZ dZ dZ dZ dZ ed ZRS( s Directory.tMetacBseZdZejddeZejddeZejddeZejddeZ ejddeZ dZ e dZ d Zd ZRS( sDirectory Meta.sterms-of-serviceR.ttermsOfServicetwebsitet caaIdentitiesR c s9fd|jD}ttjj|dS(Ncs(i|]\}}|j|qS((t_internal_name(R"tktv(R:(s1/usr/lib/python2.7/site-packages/acme/messages.pys s (titemsRORmRnRP(R:R6((R:s1/usr/lib/python2.7/site-packages/acme/messages.pyRPscCs|jp|jS(sURL for the CA TOS(t_terms_of_servicet_terms_of_service_v2(R:((s1/usr/lib/python2.7/site-packages/acme/messages.pytterms_of_servicesccsBx;ttj|jD]!}|dkr5|dn|VqWdS(NRvi(RORmRnt__iter__(R:R#((s1/usr/lib/python2.7/site-packages/acme/messages.pyRyscCs|dkrd|S|S(NRxt_((R:R#((s1/usr/lib/python2.7/site-packages/acme/messages.pyRrs(RFRGRHRIRJRKRvRwRptcaa_identitiestexternal_account_requiredRPRMRxRyRr(((s1/usr/lib/python2.7/site-packages/acme/messages.pyRns  cCst|d|S(Nt resource_type(tgetattr(R4tkey((s1/usr/lib/python2.7/site-packages/acme/messages.pyt _canon_keyscCs/|j}||jkst||j|<|S(sRegister resource.(R}t_REGISTERED_TYPEStAssertionError(R4tresource_body_clsR}((s1/usr/lib/python2.7/site-packages/acme/messages.pytregisters  cCs"tj||j}||_dS(N(Rtmap_keysRt_jobj(R:RUt canon_jobj((s1/usr/lib/python2.7/site-packages/acme/messages.pyRPscCsDy||jddSWn%tk r?}tt|nXdS(NRzt-(treplacetKeyErrortAttributeErrorR=(R:R#terror((s1/usr/lib/python2.7/site-packages/acme/messages.pyt __getattr__scCsMy|j|j|SWn.tk rHtd|j|dnXdS(NsDirectory field "s " not found(RRR(R:R#((s1/usr/lib/python2.7/site-packages/acme/messages.pyt __getitem__s cCs|jS(N(R(R:((s1/usr/lib/python2.7/site-packages/acme/messages.pyRRscCs,|jj|jdi|d<||S(Ntmeta(RnRVtpop(R4RU((s1/usr/lib/python2.7/site-packages/acme/messages.pyRVs"(RFRGRHRRItJSONObjectWithFieldsRnRLRRRPRRRRRV(((s1/usr/lib/python2.7/site-packages/acme/messages.pyRms    tResourcecBseZdZejdZRS(sOACME Resource. :ivar acme.messages.ResourceBody body: Resource body. tbody(RFRGRHRIRJR(((s1/usr/lib/python2.7/site-packages/acme/messages.pyR stResourceWithURIcBseZdZejdZRS(sOACME Resource with URI. :ivar unicode uri: Location of the resource. turi(RFRGRHRIRJR(((s1/usr/lib/python2.7/site-packages/acme/messages.pyRst ResourceBodycBseZdZRS(sACME Resource Body.(RFRGRH(((s1/usr/lib/python2.7/site-packages/acme/messages.pyRstExternalAccountBindingcBseZdZedZRS(sACME External Account Bindingc Cswtj|jj}tjj|}|d}tjj |tj j d|tj j d||}|jS(sLCreate External Account Binding Resource from contact details, kid and hmac.t newAccountRN(tjsontdumpsRRRARItb64t b64decodeRtJWStsigntjwktJWKOcttjwatHS256R)( R4taccount_public_keytkidthmac_keyt directorytkey_jsontdecoded_hmac_keyturlteab((s1/usr/lib/python2.7/site-packages/acme/messages.pyt from_data#s   (RFRGRHRLR(((s1/usr/lib/python2.7/site-packages/acme/messages.pyR st RegistrationcBs"eZdZejddedejjZejddeddZ ejddeZ ejddeZ ejddeZ ejd deZ ejd deZd Zd Zedddd ZdZdZdZdZdZedZedZRS(sRegistration Resource Body. :ivar josepy.jwk.JWK key: Public key. :ivar tuple contact: Contact information following ACME spec, `tuple` of `unicode`. :ivar unicode agreement: RR.RktcontactR/t agreementtstatusttermsOfServiceAgreedtonlyReturnExistingtexternalAccountBindingstel:smailto:cKsd|k}t|jdd}|dk rG|j|j|n|dk r|jg|jdD]}|j|^qin|s|rt||dt email_prefixttuple(R4tphonetemailRR6tcontact_providedtdetailstmail((s1/usr/lib/python2.7/site-packages/acme/messages.pyRKs   3  cKs<d|kr"tj|dtntt|j|dS(s;Note if the user provides a value for the `contact` member.Rt _add_contactN(tobjectt __setattr__RKRORRP(R:R6((s1/usr/lib/python2.7/site-packages/acme/messages.pyRPis cstfd|jDS(Nc3s.|]$}|jr|tVqdS(N(t startswithtlen(R"R1(tprefix(s1/usr/lib/python2.7/site-packages/acme/messages.pys rs(RR(R:R((Rs1/usr/lib/python2.7/site-packages/acme/messages.pyt_filter_contactpscCs,t|dtr(|jd|dChallenge Resource Body. .. todo:: Confusingly, this has a similar name to `.challenges.Challenge`, as well as `.achallenges.AnnotatedChallenge`. Please use names such as ``challb`` to distinguish instances of this class from ``achall``. :ivar acme.challenges.Challenge: Wrapped challenge. Conveniently, all challenge fields are proxied, i.e. you can call ``challb.x`` to get ``challb.chall.x`` contents. :ivar acme.messages.Status status: :ivar datetime.datetime validated: :ivar messages.Error error: tchallRR.R/RRRkt validatedRc s6fd|jD}ttj|dS(Ncs(i|]\}}|j|qS((Rr(R"RsRt(R:(s1/usr/lib/python2.7/site-packages/acme/messages.pys s (RuRORRP(R:R6((R:s1/usr/lib/python2.7/site-packages/acme/messages.pyRPscCstt|j|j|S(N(RORRARr(R:R#((s1/usr/lib/python2.7/site-packages/acme/messages.pyRAscCs/tt|j}|j|jj|S(N(RORRRtupdateR(R:RU((s1/usr/lib/python2.7/site-packages/acme/messages.pyRRscCs2tt|j|}tjj||d<|S(NR(RORtfields_from_jsonRt ChallengeRV(R4RUt jobj_fields((s1/usr/lib/python2.7/site-packages/acme/messages.pyRscCs|jp|jS(sThe URL of this challenge.(t_urlt_uri(R:((s1/usr/lib/python2.7/site-packages/acme/messages.pyRscCst|j|S(N(R~R(R:R#((s1/usr/lib/python2.7/site-packages/acme/messages.pyRsccs?x8tt|jD]!}|dkr2|dn|VqWdS(NRi(RORRy(R:R#((s1/usr/lib/python2.7/site-packages/acme/messages.pyRyscCs|dkrd|S|S(NRRz((R:R#((s1/usr/lib/python2.7/site-packages/acme/messages.pyRrs(schallN(RFRGRHR^RIRJRKR)RRR`RVtSTATUS_PENDINGRRt RFC3339FieldRR'RRPRARRRLRRMRRRyRr(((s1/usr/lib/python2.7/site-packages/acme/messages.pyRs"     tChallengeResourcecBsDeZdZejddejZejdZe dZ RS(sChallenge Resource. :ivar acme.messages.ChallengeBody body: :ivar unicode authzr_uri: URI found in the 'up' ``Link`` header. RRkt authzr_uricCs |jjS(sThe URL of the challenge body.(RR(R:((s1/usr/lib/python2.7/site-packages/acme/messages.pyRs( RFRGRHRIRJRRVRRRMR(((s1/usr/lib/python2.7/site-packages/acme/messages.pyRst AuthorizationcBseZdZejddejdeZejddeZ ejddeZ ejddede jZ e jddeZejddeZe jd Z ed ZRS( s^Authorization Resource Body. :ivar acme.messages.Identifier identifier: :ivar list challenges: `list` of `.ChallengeBody` :ivar tuple combinations: Challenge combinations (`tuple` of `tuple` of `int`, as opposed to `list` of `list` from the spec). :ivar acme.messages.Status status: :ivar datetime.datetime expires: t identifierRkR.Rt combinationsRtexpirestwildcardcCstd|DS(Ncss|]}tj|VqdS(N(RRV(R"R((s1/usr/lib/python2.7/site-packages/acme/messages.pys s(R(Rl((s1/usr/lib/python2.7/site-packages/acme/messages.pyRscstfdjDS(s0Combinations with challenges instead of indices.c3s+|]!}tfd|DVqdS(c3s|]}j|VqdS(N(R(R"tidx(R:(s1/usr/lib/python2.7/site-packages/acme/messages.pys %sN(R(R"tcombo(R:(s1/usr/lib/python2.7/site-packages/acme/messages.pys %s(RR(R:((R:s1/usr/lib/python2.7/site-packages/acme/messages.pytresolved_combinations"s(RFRGRHRIRJRjRVRKRRRR`RRRRRRkRMR(((s1/usr/lib/python2.7/site-packages/acme/messages.pyRs tNewAuthorizationcBs#eZdZdZejeZRS(sNew authorization.s new-authz(RFRGRHR}RRR(((s1/usr/lib/python2.7/site-packages/acme/messages.pyR)stUpdateAuthorizationcBs#eZdZdZejeZRS(sUpdate authorization.tauthz(RFRGRHR}RRR(((s1/usr/lib/python2.7/site-packages/acme/messages.pyR0stAuthorizationResourcecBs;eZdZejddejZejddeZ RS(sAuthorization Resource. :ivar acme.messages.Authorization body: :ivar unicode new_cert_uri: Deprecated. Do not use. RRkt new_cert_uriR.( RFRGRHRIRJRRVRRKR(((s1/usr/lib/python2.7/site-packages/acme/messages.pyR6stCertificateRequestcBsDeZdZdZejeZejddej dej Z RS(sACME new-cert request. :ivar josepy.util.ComparableX509 csr: `OpenSSL.crypto.X509Req` wrapped in `.ComparableX509` snew-certtcsrRktencoder( RFRGRHR}RRRRIRJt decode_csrt encode_csrR(((s1/usr/lib/python2.7/site-packages/acme/messages.pyRAstCertificateResourcecBs,eZdZejdZejdZRS(sCertificate Resource. :ivar josepy.util.ComparableX509 body: `OpenSSL.crypto.X509` wrapped in `.ComparableX509` :ivar unicode cert_chain_uri: URI found in the 'up' ``Link`` header :ivar tuple authzrs: `tuple` of `AuthorizationResource`. tcert_chain_uritauthzrs(RFRGRHRIRJRR(((s1/usr/lib/python2.7/site-packages/acme/messages.pyRNst RevocationcBsSeZdZdZejeZejddej dej Z ejdZ RS(s|Revocation message. :ivar .ComparableX509 certificate: `OpenSSL.crypto.X509` wrapped in `.ComparableX509` s revoke-certt certificateRkRtreason( RFRGRHR}RRRRIRJt decode_certt encode_certRR(((s1/usr/lib/python2.7/site-packages/acme/messages.pyR[s tOrdercBseZdZejddeZejddejdeZ ejddeZ ejddeZ ejddeZ e jddeZejd dedejZejd ZRS( s^Order Resource Body. :ivar identifiers: List of identifiers for the certificate. :vartype identifiers: `list` of `.Identifier` :ivar acme.messages.Status status: :ivar authorizations: URLs of authorizations. :vartype authorizations: `list` of `str` :ivar str certificate: URL to download certificate as a fullchain PEM. :ivar str finalize: URL to POST to to request issuance once all authorizations have "valid" status. :ivar datetime.datetime expires: When the order expires. :ivar .Error error: Any error that occurred during finalization, if applicable. t identifiersR.RRktauthorizationsRtfinalizeRRcCstd|DS(Ncss|]}tj|VqdS(N(RjRV(R"R((s1/usr/lib/python2.7/site-packages/acme/messages.pys s(R(Rl((s1/usr/lib/python2.7/site-packages/acme/messages.pyRs(RFRGRHRIRJRKRR`RVRRRRRRRR'RRk(((s1/usr/lib/python2.7/site-packages/acme/messages.pyRjs  t OrderResourcecBsteZdZejddejZejddeZ ejdZ ejddeZ ejddeZ RS(sOrder Resource. :ivar acme.messages.Order body: :ivar str csr_pem: The CSR this Order will be finalized with. :ivar authorizations: Fully-fetched AuthorizationResource objects. :vartype authorizations: `list` of `acme.messages.AuthorizationResource` :ivar str fullchain_pem: The fetched contents of the certificate URL produced once the order was finalized, if it's present. :ivar alternative_fullchains_pem: The fetched contents of alternative certificate chain URLs produced once the order was finalized, if present and requested during finalization. :vartype alternative_fullchains_pem: `list` of `str` RRktcsr_pemR.Rt fullchain_pemtalternative_fullchains_pem( RFRGRHRIRJRRVRRKRRRR(((s1/usr/lib/python2.7/site-packages/acme/messages.pyRs  tNewOrdercBseZdZdZRS(s New order.s new-order(RFRGRHR}(((s1/usr/lib/python2.7/site-packages/acme/messages.pyRs(ARHRtjosepyRItsixtacmeRRRRRt acme.mixinsRtcollections.abcRt ImportErrort collectionsR%R!R2tdictRuR8RR,tpython_2_unicode_compatibleRR'tJSONDeSerializableRNR`tSTATUS_UNKNOWNRtSTATUS_PROCESSINGt STATUS_VALIDtSTATUS_INVALIDtSTATUS_REVOKEDt STATUS_READYtSTATUS_DEACTIVATEDRitIDENTIFIER_FQDNRjRmRRRRRRRRRRRRRRRRRRRRRR(((s1/usr/lib/python2.7/site-packages/acme/messages.pyts        <!          G  i  B"