ó ®è­]c@s£dZddlZddlZddlZddlZddlZddlZddlmZddl Z ddl Z ddl Z ddl Z ddlmZddlmZddlmZejeƒZde jfd„ƒYZd e jfd „ƒYZd efd „ƒYZd efd„ƒYZdefd„ƒYZe jejƒdefd„ƒYƒZejdefd„ƒYƒZejdefd„ƒYƒZ ejdefd„ƒYƒZ!ejdefd„ƒYƒZ"ejdefd„ƒYƒZ#ejdefd„ƒYƒZ$ejdefd „ƒYƒZ%ejd!efd"„ƒYƒZ&ejd#efd$„ƒYƒZ'ejd%efd&„ƒYƒZ(dS('s&ACME Identifier Validation Challenges.iÿÿÿÿN(thashes(terrors(t crypto_util(tfieldst ChallengecBs#eZdZiZed„ƒZRS(sACME challenge.cCsNytt|ƒj|ƒSWn-tjk rI}tj|ƒtj|ƒSXdS(N(tsuperRt from_jsontjosetUnrecognizedTypeErrortloggertdebugtUnrecognizedChallenge(tclstjobjterror((s3/usr/lib/python2.7/dist-packages/acme/challenges.pyRs  (t__name__t __module__t__doc__tTYPESt classmethodR(((s3/usr/lib/python2.7/dist-packages/acme/challenges.pyRstChallengeResponsecBs)eZdZiZdZejeƒZRS(sACME challenge response.t challenge(RRRRt resource_typeRtResourcetresource(((s3/usr/lib/python2.7/dist-packages/acme/challenges.pyR'sR cBs/eZdZd„Zd„Zed„ƒZRS(slUnrecognized challenge. ACME specification defines a generic framework for challenges and defines some standard challenges that are implemented in this module. However, other implementations (including peers) might define additional challenge types, which should be ignored if unrecognized. :ivar jobj: Original JSON decoded object. cCs*tt|ƒjƒtj|d|ƒdS(NR (RR t__init__tobjectt __setattr__(tselfR ((s3/usr/lib/python2.7/dist-packages/acme/challenges.pyR<scCs|jS(N(R (R((s3/usr/lib/python2.7/dist-packages/acme/challenges.pytto_partial_json@scCs ||ƒS(N((R R ((s3/usr/lib/python2.7/dist-packages/acme/challenges.pyRDs(RRRRRRR(((s3/usr/lib/python2.7/dist-packages/acme/challenges.pyR /s   t_TokenChallengec Bs]eZdZddZejddejdejej dede ƒƒZ e d„ƒZ RS( s3Challenge with token. :ivar bytes token: i€ittokentencodertdecodertsizetminimumcCsd|jkod|jkS(sÅIs `token` good? .. todo:: acme-spec wants "It MUST NOT contain any non-ASCII characters", but it should also warrant that it doesn't contain ".." or "/"... s..t/(R(R((s3/usr/lib/python2.7/dist-packages/acme/challenges.pyt good_tokenXs (RRRt TOKEN_SIZERtFieldtencode_b64joset functoolstpartialtdecode_b64josetTrueRtpropertyR%(((s3/usr/lib/python2.7/dist-packages/acme/challenges.pyRIs  t!KeyAuthorizationChallengeResponsecBsJeZdZejdƒZejZd„Z d„Z d„Z d„Z RS(s_Response to Challenges based on Key Authorization. :param unicode key_authorization: tkeyAuthorizationcOs*tt|ƒj||Ž|jtƒdS(N(RR.Rt_dump_authorization_keytFalse(Rtargstkwargs((s3/usr/lib/python2.7/dist-packages/acme/challenges.pyRoscCsË|jjdƒ}t|ƒdkr;tjd|jƒtS|d|jdƒkrxtjd|d|jdƒƒtStj|j d|j ƒƒj ƒ}|d|krÇtjd |d|ƒtSt S( s%Verify the key authorization. :param KeyAuthorization chall: Challenge that corresponds to this response. :param JWK account_public_key: :return: ``True`` iff verification of the key authorization was successful. :rtype: bool t.is)Key authorization (%r) is not well formediRs8Mismatching token in key authorization: %r instead of %rt hash_functionis=Mismatching thumbprint in key authorization: %r instead of %r( tkey_authorizationtsplittlenR R R1tencodeRt b64encodet thumbprinttthumbprint_hash_functiontdecodeR,(Rtchalltaccount_public_keytpartsR;((s3/usr/lib/python2.7/dist-packages/acme/challenges.pytverifyss     cCstj|d|ƒdS(s  Set if keyAuthorization is dumped in the JSON representation of this ChallengeResponse. NB: This method is declared as private because it will eventually be removed. :param bool dump: True to dump the keyAuthorization, False otherwise t_dump_auth_keyN(RR(Rtdump((s3/usr/lib/python2.7/dist-packages/acme/challenges.pyR0“scCs5tt|ƒjƒ}|js1|jddƒn|S(NR/(RR.RRBtpoptNone(RR ((s3/usr/lib/python2.7/dist-packages/acme/challenges.pyRœs ( RRRRR'R6RtSHA256R<RRAR0R(((s3/usr/lib/python2.7/dist-packages/acme/challenges.pyR.fs   tKeyAuthorizationChallengecBsPeZdZeZeZejZd„Zd„Z e j d„ƒZ d„Z RS(sÐChallenge based on Key Authorization. :param response_cls: Subclass of `KeyAuthorizationChallengeResponse` that will be used to generate `response`. :param str typ: type of the challenge cCs3|jdƒdtj|jd|jƒƒjƒS(s^Generate Key Authorization. :param JWK account_key: :rtype unicode: RR4R5(R9RR:R;R<R=(Rt account_key((s3/usr/lib/python2.7/dist-packages/acme/challenges.pyR6²s cCs|jd|j|ƒƒS(sËGenerate response to the challenge. :param JWK account_key: :returns: Response (initialized `response_cls`) to the challenge. :rtype: KeyAuthorizationChallengeResponse R6(t response_clsR6(RRH((s3/usr/lib/python2.7/dist-packages/acme/challenges.pytresponse½s cKs tƒ‚dS(sˆGenerate validation for the challenge. Subclasses must implement this method, but they are likely to return completely different data structures, depending on what's necessary to complete the challenge. Interpretation of that return value must be known to the caller. :param JWK account_key: :returns: Challenge-specific validation. N(tNotImplementedError(RRHR3((s3/usr/lib/python2.7/dist-packages/acme/challenges.pyt validationÉs cOs"|j|ƒ|j|||ŽfS(s¼Generate response and validation. Convenience function that return results of `response` and `validation`. :param JWK account_key: :rtype: tuple (RJRL(RRHR2R3((s3/usr/lib/python2.7/dist-packages/acme/challenges.pytresponse_and_validationØs (RRRtNotImplementedttypRIR.R<R6RJtabctabstractmethodRLRM(((s3/usr/lib/python2.7/dist-packages/acme/challenges.pyRG¤s  t DNS01ResponsecBseZdZdZd„ZRS(sACME dns-01 challenge response.sdns-01cCs,|j||ƒ}|s(tjdƒn|S(sðSimple verify. This method no longer checks DNS records and is a simple wrapper around `KeyAuthorizationChallengeResponse.verify`. :param challenges.DNS01 chall: Corresponding challenge. :param unicode domain: Domain name being verified. :param JWK account_public_key: Public key for the key pair being authorized. :return: ``True`` iff verification of the key authorization was successful. :rtype: bool s4Verification of key authorization in response failed(RAR R (RR>tdomainR?tverified((s3/usr/lib/python2.7/dist-packages/acme/challenges.pyt simple_verifyës(RRRRORU(((s3/usr/lib/python2.7/dist-packages/acme/challenges.pyRRæstDNS01cBs5eZdZeZejZdZd„Zd„ZRS(sACME dns-01 challenge.s_acme-challengecKs4tjtj|j|ƒjdƒƒjƒƒjƒS(sWGenerate validation. :param JWK account_key: :rtype: unicode sutf-8(RR:thashlibtsha256R6R9tdigestR=(RRHt unused_kwargs((s3/usr/lib/python2.7/dist-packages/acme/challenges.pyRL scCsdj|j|ƒS(skDomain name for TXT validation record. :param unicode name: Domain name being validated. s{0}.{1}(tformattLABEL(Rtname((s3/usr/lib/python2.7/dist-packages/acme/challenges.pytvalidation_domain_names( RRRRRRIROR\RLR^(((s3/usr/lib/python2.7/dist-packages/acme/challenges.pyRVs   tHTTP01ResponsecBs,eZdZdZdZdZdd„ZRS(s ACME http-01 challenge response.shttp-01iPs c Cs*|j||ƒs#tjdƒtS|dk rd||jkrdtjd|ƒ|dj|ƒ7}n|j|ƒ}tjd|j |ƒyt j |ƒ}Wn-t j j k rË}tjd||ƒtSXtjd||j|jƒ|jj|jƒ}|j|kr&tjd|j|ƒtStS( s¾Simple verify. :param challenges.SimpleHTTP chall: Corresponding challenge. :param unicode domain: Domain name being verified. :param JWK account_public_key: Public key for the key pair being authorized. :param int port: Port used in the validation. :returns: ``True`` iff validation with the files currently served by the HTTP server is successful. :rtype: bool s4Verification of key authorization in response faileds4Using non-standard port for http-01 verification: %ss:{0}sVerifying %s at %s...sUnable to reach %s: %ssReceived %s: %s. Headers: %ssEKey authorization from response (%r) doesn't match HTTP response (%r)N(RAR R R1REtPORTtwarningR[turiROtrequeststgett exceptionstRequestExceptionRttexttheaderstrstriptWHITESPACE_CUTSETR6R,( RR>RSR?tportRbt http_responseRtchallenge_response((s3/usr/lib/python2.7/dist-packages/acme/challenges.pyRU.s.    N(RRRROR`RjRERU(((s3/usr/lib/python2.7/dist-packages/acme/challenges.pyR_s tHTTP01cBsDeZdZeZejZdZed„ƒZd„Z d„Z RS(sACME http-01 challenge.s.well-known/acme-challengecCsd|jd|jdƒS(sTPath (starting with '/') for provisioned resource. :rtype: string R$R(t URI_ROOT_PATHR9(R((s3/usr/lib/python2.7/dist-packages/acme/challenges.pytpathescCsd||jS(söCreate an URI to the provisioned resource. Forms an URI to the HTTPS server provisioned resource (containing :attr:`~SimpleHTTP.token`). :param unicode domain: Domain name being verified. :rtype: string shttp://(Rp(RRS((s3/usr/lib/python2.7/dist-packages/acme/challenges.pyRbns cKs |j|ƒS(sWGenerate validation. :param JWK account_key: :rtype: unicode (R6(RRHRZ((s3/usr/lib/python2.7/dist-packages/acme/challenges.pyRLzs( RRRR_RIRORoR-RpRbRL(((s3/usr/lib/python2.7/dist-packages/acme/challenges.pyRn\s  tTLSSNI01ResponsecBskeZdZdZdZdZed„ƒZed„ƒZd dd„Z d„Z d „Z d d „Z RS( s#ACME tls-sni-01 challenge response.s tls-sni-01s .acme.invalidi»cCs+tj|jjdƒƒjƒjƒjƒS(sC``z`` value used for verification. :rtype bytes: sutf-8(RWRXR6R9t hexdigesttlower(R((s3/usr/lib/python2.7/dist-packages/acme/challenges.pytz”scCs!|jd d|jd|jS(sWDomain name used for verification, generated from `z`. :rtype bytes: i R4(Rtt DOMAIN_SUFFIX(R((s3/usr/lib/python2.7/dist-packages/acme/challenges.pytz_domainžsicCs_|dkr4tjjƒ}|jtjj|ƒntj|d|jj ƒgdt ƒ|fS(skGenerate tls-sni-01 certificate. :param OpenSSL.crypto.PKey key: Optional private key used in certificate generation. If not provided (``None``), then fresh key will be generated. :param int bits: Number of bits for newly generated key. :rtype: `tuple` of `OpenSSL.crypto.X509` and `OpenSSL.crypto.PKey` tdummyt force_sanN( REtOpenSSLtcryptotPKeyt generate_keytTYPE_RSARt gen_ss_certRvR=R,(Rtkeytbits((s3/usr/lib/python2.7/dist-packages/acme/challenges.pytgen_cert§s  cKshd|kr;tj|ƒ}tjd||ƒ||dtj|ƒ}tjd|jdƒ|ƒ|jjƒ|kS(sÏVerify tls-sni-01 challenge certificate. :param OpensSSL.crypto.X509 cert: Challenge certificate. :returns: Whether the certificate was successfully verified. :rtype: bool sCertificate %s. SANs: %sRX(Rt_pyopenssl_cert_or_req_sanR R RYRvR=(Rtcerttsans((s3/usr/lib/python2.7/dist-packages/acme/challenges.pyt verify_certËs cKs‹|j||ƒs#tjdƒtS|dkr~y|jd||}Wq~tjk rz}tjt|ƒdt ƒtSXn|j |ƒS(sSimple verify. Verify ``validation`` using ``account_public_key``, optionally probe tls-sni-01 certificate and check using `verify_cert`. :param .challenges.TLSSNI01 chall: Corresponding challenge. :param str domain: Domain name being validated. :param JWK account_public_key: :param OpenSSL.crypto.X509 cert: Optional certificate. If not provided (``None``) certificate will be retrieved using `probe_cert`. :param int port: Port used to probe the certificate. :returns: ``True`` iff client's control of the domain has been verified. :rtype: bool s4Verification of key authorization in response failedRStexc_infoN( RAR R R1RER‡RtErrortstrR,R‹(RR>RSR?R‰R3R((s3/usr/lib/python2.7/dist-packages/acme/challenges.pyRUÙs  N(RRRRORuR`R-RtRvRERR‡R‹RU(((s3/usr/lib/python2.7/dist-packages/acme/challenges.pyRq„s    tTLSSNI01cBs/eZdZeZejZd„Zd„ZRS(sACME tls-sni-01 challenge.cOs3tjdtddƒtt|ƒj||ŽdS(Ns5TLS-SNI-01 is deprecated, and will stop working soon.t stackleveli(twarningstwarntDeprecationWarningRRR(RR2R3((s3/usr/lib/python2.7/dist-packages/acme/challenges.pyRs  cKs"|j|ƒjd|jdƒƒS(sCGenerate validation. :param JWK account_key: :param OpenSSL.crypto.PKey cert_key: Optional private key used in certificate generation. If not provided (``None``), then fresh key will be generated. :rtype: `tuple` of `OpenSSL.crypto.X509` and `OpenSSL.crypto.PKey` Rtcert_key(RJRRd(RRHR3((s3/usr/lib/python2.7/dist-packages/acme/challenges.pyRL s (RRRRqRIRORRL(((s3/usr/lib/python2.7/dist-packages/acme/challenges.pyRüs   tTLSALPN01ResponsecBseZdZdZRS(sACME TLS-ALPN-01 challenge response. This class only allows initiating a TLS-ALPN-01 challenge returned from the CA. Full support for responding to TLS-ALPN-01 challenges by generating and serving the expected response certificate is not currently provided. s tls-alpn-01(RRRRO(((s3/usr/lib/python2.7/dist-packages/acme/challenges.pyR•st TLSALPN01cBs#eZdZdZeZd„ZRS(s¯ACME tls-alpn-01 challenge. This class simply allows parsing the TLS-ALPN-01 challenge returned from the CA. Full TLS-ALPN-01 support is not currently provided. s tls-alpn-01cKs tƒ‚dS(s&Generate validation for the challenge.N(RK(RRHR3((s3/usr/lib/python2.7/dist-packages/acme/challenges.pyRL.s(RRRROR•RIRL(((s3/usr/lib/python2.7/dist-packages/acme/challenges.pyR–#stDNScBsDeZdZdZdZejd„Zd„Zd„Z d„Z RS(sACME "dns" challenge.tdnss_acme-challengecKs7tjjd|jdtƒjdƒd|d||S(s·Generate validation. :param .JWK account_key: Private account key. :param .JWA alg: :returns: This challenge wrapped in `.JWS` :rtype: .JWS tpayloadt sort_keyssutf-8Rtalg(RtJWStsignt json_dumpsR,R9(RRHR›R3((s3/usr/lib/python2.7/dist-packages/acme/challenges.pytgen_validation;s cCsg|jd|ƒstSy#||j|jjdƒƒkSWn'tjk rb}tjd|ƒtSXdS(swCheck validation. :param JWS validation: :param JWK account_public_key: :rtype: bool Rsutf-8s&Checking validation for DNS failed: %sN( RAR1t json_loadsR™R=RtDeserializationErrorR R (RRLR?R((s3/usr/lib/python2.7/dist-packages/acme/challenges.pytcheck_validationIs cKstd|j||ƒS(s‰Generate response. :param .JWK account_key: Private account key. :param .JWA alg: :rtype: DNSResponse RL(t DNSResponseRŸ(RRHR3((s3/usr/lib/python2.7/dist-packages/acme/challenges.pyt gen_responseZs cCsdj|j|ƒS(skDomain name for TXT validation record. :param unicode name: Domain name being validated. s{0}.{1}(R[R\(RR]((s3/usr/lib/python2.7/dist-packages/acme/challenges.pyR^fs( RRRROR\RtRS256RŸR¢R¤R^(((s3/usr/lib/python2.7/dist-packages/acme/challenges.pyR—3s  R£cBs8eZdZdZejddejjƒZd„Z RS(s@ACME "dns" challenge response. :param JWS validation: R˜RLR!cCs|j|j|ƒS(s~Check validation. :param challenges.DNS chall: :param JWK account_public_key: :rtype: bool (R¢RL(RR>R?((s3/usr/lib/python2.7/dist-packages/acme/challenges.pyR¢zs ( RRRRORR'RœRRLR¢(((s3/usr/lib/python2.7/dist-packages/acme/challenges.pyR£os()RRPR)RWtloggingRƒR‘tcryptography.hazmat.primitivesRtjosepyRRyRctsixtacmeRRRt getLoggerRR tTypedJSONObjectWithFieldsRRR RR.t add_metaclasstABCMetaRGtregisterRRRVR_RnRqRR•R–R—R£(((s3/usr/lib/python2.7/dist-packages/acme/challenges.pytsT          >A   = ' w    ;