U-fyndZddlZddlZddlmZddlmZddlZddl Z ddl Z ddl m Z ddl m Z ddl mZddl mZddl mZdd l mZdd l mZdd l mZddlZddlZddlZdd lmZdd lmZddlmZddlmZddlmZddlm Z ddlm!Z!ej"e#Z$dZ%GddZ&GddZ'dS)zACME client API.N) parsedate_tz)Any)cast)List)Mapping)Optional)Set)Tuple)Union) HTTPAdapter)parse_header_links) challenges) crypto_util)errors)jws)messages-c eZdZdZdejddddfdZdejdejfd Z d ejdejfd Z d8d ejd e ej dejfd Z d9d ejdedejfdZdedejfdZdejdeejejffdZ d8dejde ejdejfdZdejdejdejfdZdejdejfdZ d9dejdejdedejfdZ d9dejdejdedejfdZdejde ddfdZ!defd Z"d!e#d"e#dejfd#Z$d$ejd%e%de&e%fd&Z'e(d'e%dddejfd(Z)e( d:d$ejd)e e%d*e e%dejfd+Z*d ejd,ej dejfd-Z+d!e#d"e#dejfd.Z,d ejdejfd/Z-dejdejfd0Z. d:d$ejd1e ej/d)e e%dejfd2Z0d3ej1d$e2j3dej4fd4Z5e(d$ejd5e dejfd6Z6dejde d'e%ddfd7Z7dS);ClientV2zuACME client for a v2 API. :ivar messages.Directory directory: :ivar .ClientNetwork net: Client network. directorynet ClientNetworkreturnNc"||_||_dS)zInitialize. :param .messages.Directory directory: Directory Resource :param .ClientNetwork net: Client network. N)rr)selfrrs Z/home/cdr/domains/dharristours.com/map/certbot/lib/python3.11/site-packages/acme/client.py__init__zClientV2.__init__*s # new_accountc||jd|}|jdkr(d|jvrt j|jd||}||j_|S)zRegister. :param .NewRegistration new_account: :raises .ConflictError: in case the account already exists :returns: Registration Resource. :rtype: `.RegistrationResource` newAccountLocation) _postr status_codeheadersr ConflictError_regr_from_responseraccount)rrresponseregrs rrzClientV2.new_account3st::dn\:KHH  3 & &:9I+I+I&x'7 'CDD D''11 rr+cZ||d|j_|jjS)zQuery server about registration. :param messages.RegistrationResource regr: Existing Registration Resource. T)_get_v2_accountrr)rr+s rquery_registrationzClientV2.query_registrationFs) //d;;xrupdatec||}||jn|}tjdit |}|||}||j_|S)aKUpdate registration. :param messages.RegistrationResource regr: Registration Resource. :param messages.Registration update: Updated body of the resource. If not provided, body will be taken from `regr`. :returns: Updated Registration Resource. :rtype: `.RegistrationResource` Nbody)r-r3rUpdateRegistrationdict_send_recv_regrrr))rr+r0r3 updated_regrs rupdate_registrationzClientV2.update_registrationRsj##D))$n&*::T&\\::++Dt+<< 'rF update_bodycfd|j_|jd}||jd|}|jd}||r1tj | n|j|}||j_|S)NT)only_return_existingr!r#r3uri) rr)r3r0r$rr&r Registration from_jsonjson)rr+r:only_existing_regr* updated_urinew_regrs rr-zClientV2._get_v2_accounths I,,$,GG::dn\:r#)r3r>authorizationsrE)OpenSSLcryptoload_certificate_request FILETYPE_PEMr _pyopenssl_cert_or_req_all_names_pyopenssl_cert_or_req_san_ipappendr IdentifierIDENTIFIER_FQDN IDENTIFIER_IPNewOrderr$rOrderr@rArL_authzr_from_response _post_as_get OrderResourcer&get) rrEcsrdnsNamesipNamesrInameipsorderr*r3rLurls r new_orderzClientV2.new_ordertsn55gn6QSZ[[?DD;C@@   D   x2x7O         C   x2x7M       !k:::::dnZ8%@@~'' 88& _ _C  ! !$"<"rYr3 identifier)rrer*updated_authzrs rpollz ClientV2.pollsG$$VZ0033 fk,fj::x''rorderrdeadlinec|4tjtjdz}|||}|||S)adPoll authorizations and finalize the order. If no deadline is provided, this method will timeout after 90 seconds. :param messages.OrderResource orderr: order to finalize :param datetime.datetime deadline: when to stop polling and timeout :returns: finalized order :rtype: messages.OrderResource NZseconds)datetimenow timedeltapoll_authorizationsfinalize_order)rrjrks rpoll_and_finalizezClientV2.poll_and_finalizes\  (,,..1CB1O1O1OOH))&(;;""68444rcg}|jjD]}tj|kr||||}|jjtjkr| |n6tj dtj|kt|t|jjkrtjg}|D]G}|jjtjkr+|jjD]}|j| |H|rtj|||S)zPoll Order Resource for status.rKN)rL)r3rLrprqrYrZstatusrSTATUS_PENDINGrStimesleeplenr TimeoutError STATUS_VALIDrerrorValidationErrorr0)rrjrk responsesrcrefailedchalls rrszClientV2.poll_authorizationsse ;-  C#''))H4433D4E4Ec4J4JPS3TT;%)@@@$$V,,, 1 #''))H44 y>>C :;; ; ;%'' ' . .F{!X%:::#[3..E{. f---  1(00 0}}I}666rctjtjj|j}t jtj|}| |j j |}| t j |}|S)aStart the process of finalizing an order. :param messages.OrderResource orderr: order to finalize :param datetime.datetime deadline: when to stop polling and timeout :returns: updated order :rtype: messages.OrderResource )r]r2)rMrNrOrPrErCertificateRequestjoseComparableX509r$r3finalizer0rXr@rA)rrjr] wrapped_csrress rbegin_finalizationzClientV2.begin_finalizationsn55 N '991d6I#6N6NOOO jj-{;;HN$<$z.ClientV2.poll_finalization..s*!Y!Y!Y#$"3"3C"8"8"=!Y!Y!Yr)alternative_fullchains_pem)rprqrzr{rZr>rrXr@rArxSTATUS_INVALIDrr IssuanceErrorErrorr~ certificater0r _get_linksr}) rrjrkrr*r3certificate_responsealt_chains_urls alt_chainss ` rpoll_finalizationzClientV2.poll_finalizationsg##%%00 JqMMM((44H>++HMMOO<t~v..=t~*,GHH=~"< =rargskwargscL|dddz|ddz}|j|i|S)z Send GET request using the POST-as-GET protocol. :param args: :param kwargs: :return: NrwN)r$)rrrnew_argss rrZzClientV2._post_as_get(s:8g%QRR0tz8.v...rr* relation_typecjd|jvrgSt|jd}fd|DS)z Retrieves all Link URIs of relation_type from the response. :param requests.Response response: The requests HTTP response. :param str relation_type: The relation type to filter by. LinkcHg|]}d|vd|v |dk|dS)relrcr4)rlrs rrz'ClientV2._get_links..=sHLLLQA::%1**5]1J1J%1J1J1Jr)r&r )rr*rlinkss ` rrzClientV2._get_links2s_ ) ) )I"8#3F#;<<LLLL%LLL Lrrcctj||S)aB Retrieves the ACME directory (RFC 8555 section 7.1.1) from the ACME server. :param str url: the URL where the ACME directory is available :param ClientNetwork net: the ClientNetwork to use to make the request :returns: the ACME directory object :rtype: messages.Directory )r Directoryr@r\rA)clsrcrs r get_directoryzClientV2.get_directory@s1!++CGGCLL,=,=,?,?@@@rr>terms_of_servicecd|jvr|jdd}tjtj||jd||S)Nzterms-of-servicercr#)r3r>r)rrRegistrationResourcer?r@rAr&r\)rr*r>rs rr(zClientV2._regr_from_responseLss  / /'~.@A%H ,&00AA $$Z55-/// /rr3c|||j|}|||j|jS)N)r>r)r$r>r(r)rr+r3r*s rr7zClientV2._send_recv_regrXsC::dh--'' $(!2(44 4rcx|dt|jd|jj|i|S)zWrapper around self.net.post that adds the newNonce URL. This is used to retry the request in case of a badNonce error. new_nonce_urlnewNonce) setdefaultgetattrrrpostrrrs rr$zClientV2._postfs? /74>:+N+NOOOtx}d-f---rcn||tjdddS)zDeactivate registration. :param messages.RegistrationResource regr: The Registration Resource to be deactivated. :returns: The Registration resource that was deactivated. :rtype: `.RegistrationResource` deactivatedN)rxcontact)r9rr?r@r.s rdeactivate_registrationz ClientV2.deactivate_registrationos>''h.C.M.M$ 6 6/8/899 9rctjd}||j|}|||jj|jS)aDeactivate authorization. :param messages.AuthorizationResource authzr: The Authorization resource to be deactivated. :returns: The Authorization resource that was deactivated. :rtype: `.AuthorizationResource` r)rx)rUpdateAuthorizationr$r>rYr3rg)rrer3r*s rdeactivate_authorizationz!ClientV2.deactivate_authorization}sR+=AAA::fj$//))( K "FJ00 0rrgctjtj||jd|}|$|jj|krtj ||S)Nr#r=) rAuthorizationResource Authorizationr@rAr&r\r3rgrUnexpectedUpdate)rr*rgr>res rrYzClientV2._authzr_from_responsesz/'11(--//BB $$Z55777  !fk&< &J&J)&11 1 rchallbc||j|} |jdd}n"#t$rt jdwxYwt j|t j | }|j|jkrt j |j|S)ahAnswer challenge. :param challb: Challenge Resource body. :type challb: `.ChallengeBody` :param response: Corresponding Challenge response :type response: `.challenges.ChallengeResponse` :returns: Challenge Resource with updated body. :rtype: `.ChallengeResource` :raises .UnexpectedUpdate: uprcz"up" Link header missing) authzr_urir3) r$r>rKeyErrorr ClientErrorrChallengeResource ChallengeBodyr@rAr)rrr*resprchallrs ranswer_challengezClientV2.answer_challenges zz&*h// AD)%0JJ A A A$%?@@ @ A+!'11$))++>>@@@ : # #)&*55 5 s 1Adefaultc|jdt|} t|}nz#t$rmt |}|W t j|d|dnd}t j|dd|z cYS#ttf$rYnwxYw|}YnwxYwt j t j|zS)aCompute next `poll` time based on response ``Retry-After`` header. Handles integers and various datestring formats per https://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.37 :param requests.Response response: Response from `poll`. :param int default: Default value (in seconds), used when ``Retry-After`` header is not present or invalid. :returns: Time point when next `poll` should be performed. :rtype: `datetime.datetime` z Retry-AfterNrrn) r&r\strint ValueErrorrrprr OverflowErrorrq)rr*r retry_afterrowhentz_secss rrzClientV2.retry_afters&**=#g,,GG  +&&GG    ,,D&0T"X=QbWXYYG#,d2A2h7'AAAA"M2DGGG  $$&&);G)L)L)LLLs3:B1 1 1$BDD D 2 1rr)F)NN)8__name__ __module__ __qualname____doc__rrrNewRegistrationrrr/rr?r9boolr-bytesr[rdrr requestsResponserirprursrrrtrrrrrrrZrrr classmethodrr(r7r$rrrTrYrrChallengeResponserrrrr4rrrr#s ("4?tx'?HDa&  x'D  ( =     GK(E$,X-B$C!)!>,  H$A PT $9    !!8+A!!!!F(89(68IIJ(((($CG55(>5$,X->$?5KSKa5555&7(*@7HL]7!)!777772)? ( 6&$$,$5$48$ (5$$$$B9>RRX%;RxGXR15RBJBXRRRR >4. >S >T > > > >=4==== /#//9J//// L8#4 LS LTRUY L L L L A A/ Ah>P A A A[ ASW>B / /8+< /8C= /.6sm /!)!> / / /[ / 4H$A 4&3 48@8U 4 4 4 4.3.#.(2C.... 9H,I 9%-%B 9 9 9 90)1)G0&.&D0000$KO37h.?*283F*G#+C=DD/DcDDDDDDDDrrceZdZdZdZdZdZdZ dej dde fd ej d e e jd ejd ed ededdfdZd$dZdejdededefdZe d%dejde edejfdZdededededejf dZdededejfdZefdedededejfdZdejddfdZded edefd!Z dededejfd"Z!efdedejdededejf d#Z"dS)&rzvWrapper around requests that signs POSTs for authentication. Also adds user agent, and handles Content-Type. zapplication/jsonzapplication/jose+jsonzapplication/problem+jsonz Replay-NonceNTz acme-pythonkeyr)alg verify_ssl user_agenttimeoutrc8||_||_||_||_t |_||_tj|_ ||_ t}|j d||j d|dS)Nzhttp://zhttps://) rr)rrset_noncesrrSessionsession_default_timeoutr mount)rrr)rrrradapters rrzClientNetwork.__init__s $!$ $')) '-- 9g... :w/////rc\ |jdS#t$rYdSwxYwr)rclose Exceptionrs r__del__zClientNetwork.__del__sC  L       DD s  ++objnoncercc |r(|dnd}td||j||d}|j|jd|d<|j|d <tjj |fittttf|dS) zWrap `JSONDeSerializable` object in JWS. .. todo:: Implement ``acmePath``. :param josepy.JSONDeSerializable obj: :param str url: The URL to which this object will be POSTed :param str nonce: :rtype: str )indentrzJWS payload: %s)rr rcNr>kidr) json_dumpsencodeloggerdebugrr)rrJWSsignrrrr)rrr rcjobjrs r _wrap_in_jwszClientNetwork._wrap_in_jwss58@s~~Q~''..000S '...8   < # L/F5Mu w|DDDDc):F$C$CDDOOWXOYYYrr* content_typec|jd}|r-|dd} |}n#t $rd}YnwxYw|jdkr-tj|jdd|j s|s||j krt d| tj|#t j$r}tj||fd}~wwxYwtj||&||jkrt d |||jkr|tjd ||S) aCheck response content and its type. .. note:: Checking is not strict: wrong server response ``Content-Type`` HTTP header is ignored if response is an expected JSON object (c.f. Boulder #56). :param str content_type: Expected Content-Type response header. If JSON is expected and not present in server response, this function will raise an error. Otherwise, wrong Content-Type is ignored, but logged. :raises .messages.Error: If server response body carries HTTP Problem (https://datatracker.ietf.org/doc/html/rfc7807). :raises .ClientError: In case of other networking errors. Content-Type;rNir#zUNKNOWN-LOCATIONz/Ignoring wrong Content-Type (%r) for JSON Errorz::  <%++C00399;;K ==??DD   DDD   3 & &&x'7';';JHZ'['[\\ \{ ]#"===LLI#%%%@".2248880@@@ ,h->???@ (222K33H$H$H  +---s444()[k)[)[\\\s* A A/.A/C99D#DD#methodrrc r|dkr#td||dntd|||j|d<|di|dd|j|d|j |jj||g|Ri|}nt#tj j $r]} d }tj |t|}||\} } } } td | | d | d }~wwxYwd |dvrt!j|j} nd|_|j} td|jdd|jD| |S)aSend HTTP request. Makes sure that `verify_ssl` is respected. Logs request and response (with headers). For allowed parameters please see `requests.request`. :param str method: method for the new `requests.Request` object :param str url: URL for the new `requests.Request` object :raises requests.exceptions.RequestException: in case of any problems :returns: HTTP Response :rtype: `requests.Response` POSTzSending POST request to %s: %sdatazSending %s request to %s.verifyr&z User-AgentrzT.*host='(\S*)'.*Max retries exceeded with url\: (\/\w*).*(\[Errno \d+\])([A-Za-z ]*)Nz Requesting :Acceptzutf-8z!Received response: HTTP %d %s %s c3HK|]\}}d||VdS)z{0}: {1}N)format)rkvs r z.ClientNetwork._send_request..sRFF$(Aq *00A66FFFFFFr)rrrrrrrrequestr exceptionsRequestExceptionrematchrgroupsrbase64 b64encodecontentencodingrr%joinr&items)rr"rcrrr*e err_regexmhostpath_err_noerr_msg debug_contents r _send_requestzClientNetwork._send_requestls" V   LL:vf~ / / / / LL4fc B B B?x)R(((y$$\4?CCC)T%:;;; C+t|+FCI$III&IIHH"3 C C C /pICFF++Ay+,88:: (D$A4AAAAABB B+ C6 vi( ( (",X-=>>MM !(H $MM <)YYFF,4,<,B,B,D,DFFFFF"  $ $ $ s#B;;D,AD''D,c$|jdg|Ri|S)aSend HEAD request without checking the response. Note, that `_check_response` is not called, as it is expected that status code other than successfully 2xx will be returned, or messages2.Error will be raised by the server. HEAD)rCrs rheadzClientNetwork.heads'"t!&:4:::6:::rc J||jd|fi||S)z$Send GET request and check response.GETr)r!rC)rrcrrs rr\zClientNetwork.gets@## D uc 4 4V 4 4<$QQ Qrc|j|jvr|j|j} tjjd|}n,#t j$r}tj ||d}~wwxYwt d||j |dStj|)Nr zStoring nonce: %s)REPLAY_NONCE_HEADERr&rHeader_fieldsdecoderrrBadNoncerrradd MissingNonce)rr*r  decoded_noncers r _add_noncezClientNetwork._add_nonces  #x'7 7 7$T%=>E 4 # 27 ; B B5 I I , 4 4 4oeU333 4 LL,e 4 4 4 L  ] + + + + +%h// /s*A A6A11A6rc$|jsqtd|||}n*|||d}|||jS)NzRequesting fresh noncerI)rrrrFr!rSpop)rrcrr*s r _get_noncezClientNetwork._get_nonces| & LL1 2 2 2$99S>> // -0H0HW[/\\ OOH % % %|!!!rc |j|i|S#tj$r>}|jdkr-td||j|i|cYd}~Sd}~wwxYw)zPOST object wrapped in `.JWS` and check response. If the server responded with a badNonce error, the request will be retried once. badNoncez Retrying request after error: %sN) _post_oncerrcoderr)rrrrs rrzClientNetwork.posts "4?D3F33 3~   zZ'' @%HHH&t777777777   s A2AAAAc 2|dd}||||||}|dd|i|jd|fd|i|}|||}|||S)Nrr&rr$r%rI)rUrrVrrCr!rS)rrcrrrrr%r*s rrYzClientNetwork._post_onces ?D99   dooc=&I&I3OO)nl%CDDD%4%fcGGGGG''|'LL !!!r)rNr)#rrrrrJOSE_CONTENT_TYPErrKrRS256DEFAULT_NETWORK_TIMEOUTJWKrrr JWASignaturerrrrrJSONDeSerializablerrrrr!rrCrFr\rSrVrrYr4rrrrs+/8( Z^*.*#0AX00DH0x8U/V0'0BF0 0;>0]a0000 Z 7ZZ#ZRUZZZZ26:88x'88&.sm8?G?P888[8tECEcE#EEQYQbEEEEN;#;;1B;;;;1BQQsQ#QQ&/QQQQ 08#4 0 0 0 0 0 "c "# "# " " " " #  1B     (9c(?!$DGLTL]rr)(rr5rp email.utilsr http.clientclientrloggingr2rztypingrrrrrr r r josepyrrMrrequests.adaptersr requests.utilsr acmerrrrr getLoggerrrr^rrr4rrrls $$$$$$!!!!!! ))))))------  8 $ $EDEDEDEDEDEDEDEDPFFFFFFFFFFr