Commit | Line | Data |
---|---|---|
61d08fc2 FT |
1 | #!/usr/bin/python3 |
2 | ||
f1b49ff6 FT |
3 | #### ACME client (only http-01 challenges supported thus far) |
4 | ||
d2252d10 | 5 | import sys, os, getopt, binascii, json, pprint, signal, time, calendar, threading |
61d08fc2 | 6 | import urllib.request |
61d08fc2 | 7 | |
f1b49ff6 FT |
8 | ### General utilities |
9 | ||
28d5a321 FT |
10 | class msgerror(Exception): |
11 | def report(self, out): | |
12 | out.write("acmecert: undefined error\n") | |
13 | ||
61d08fc2 FT |
14 | def base64url(dat): |
15 | return binascii.b2a_base64(dat).decode("us-ascii").translate({43: 45, 47: 95, 61: None}).strip() | |
16 | ||
17 | def ebignum(num): | |
18 | h = "%x" % num | |
19 | if len(h) % 2 == 1: h = "0" + h | |
20 | return base64url(binascii.a2b_hex(h)) | |
21 | ||
f1b49ff6 FT |
22 | class maybeopen(object): |
23 | def __init__(self, name, mode): | |
24 | if name == "-": | |
25 | self.opened = False | |
26 | if mode == "r": | |
27 | self.fp = sys.stdin | |
28 | elif mode == "w": | |
29 | self.fp = sys.stdout | |
30 | else: | |
31 | raise ValueError(mode) | |
0305dfdc | 32 | else: |
f1b49ff6 FT |
33 | self.opened = True |
34 | self.fp = open(name, mode) | |
0305dfdc | 35 | |
f1b49ff6 FT |
36 | def __enter__(self): |
37 | return self.fp | |
0305dfdc | 38 | |
f1b49ff6 FT |
39 | def __exit__(self, *excinfo): |
40 | if self.opened: | |
41 | self.fp.close() | |
42 | return False | |
43 | ||
44 | ### Crypto utilities | |
61d08fc2 | 45 | |
0756cac4 FT |
46 | _cryptobke = None |
47 | def cryptobke(): | |
48 | global _cryptobke | |
49 | if _cryptobke is None: | |
50 | from cryptography.hazmat import backends | |
51 | _cryptobke = backends.default_backend() | |
52 | return _cryptobke | |
53 | ||
d2252d10 FT |
54 | class dererror(Exception): |
55 | pass | |
56 | ||
57 | class pemerror(Exception): | |
58 | pass | |
59 | ||
60 | def pemdec(pem, ptypes): | |
61 | if isinstance(ptypes, str): | |
62 | ptypes = [ptypes] | |
63 | p = 0 | |
64 | while True: | |
65 | p = pem.find("-----BEGIN ", p) | |
66 | if p < 0: | |
67 | raise pemerror("could not find any %s in PEM-encoded data" % (ptypes,)) | |
68 | p2 = pem.find("-----", p + 11) | |
69 | if p2 < 0: | |
70 | raise pemerror("incomplete PEM header") | |
71 | ptype = pem[p + 11 : p2] | |
72 | if ptype not in ptypes: | |
73 | p = p2 + 5 | |
74 | continue | |
75 | p3 = pem.find("-----END " + ptype + "-----", p2 + 5) | |
76 | if p3 < 0: | |
77 | raise pemerror("incomplete PEM data") | |
78 | pem = pem[p2 + 5 : p3] | |
79 | return binascii.a2b_base64(pem) | |
80 | ||
81 | class derdecoder(object): | |
82 | def __init__(self, data, offset=0, size=None): | |
83 | self.data = data | |
84 | self.offset = offset | |
85 | self.size = len(data) if size is None else size | |
86 | ||
87 | def end(self): | |
88 | return self.offset >= self.size | |
89 | ||
90 | def byte(self): | |
91 | if self.offset >= self.size: | |
92 | raise dererror("unexpected end-of-data") | |
93 | ret = self.data[self.offset] | |
94 | self.offset += 1 | |
95 | return ret | |
96 | ||
97 | def splice(self, ln): | |
98 | if self.offset + ln > self.size: | |
99 | raise dererror("unexpected end-of-data") | |
100 | ret = self.data[self.offset : self.offset + ln] | |
101 | self.offset += ln | |
102 | return ret | |
103 | ||
104 | def dectag(self): | |
105 | h = self.byte() | |
106 | cl = (h & 0xc0) >> 6 | |
107 | cons = (h & 0x20) != 0 | |
108 | tag = h & 0x1f | |
109 | if tag == 0x1f: | |
110 | raise dererror("extended type tags not supported") | |
111 | return cl, cons, tag | |
112 | ||
113 | def declen(self): | |
114 | h = self.byte() | |
115 | if (h & 0x80) == 0: | |
116 | return h | |
117 | if h == 0x80: | |
118 | raise dererror("indefinite lengths not supported in DER") | |
119 | if h == 0xff: | |
120 | raise dererror("invalid length byte") | |
121 | n = h & 0x7f | |
122 | ret = 0 | |
123 | for i in range(n): | |
124 | ret = (ret << 8) + self.byte() | |
125 | return ret | |
126 | ||
127 | def get(self): | |
128 | cl, cons, tag = self.dectag() | |
129 | ln = self.declen() | |
130 | return cons, cl, tag, self.splice(ln) | |
131 | ||
132 | def getcons(self, ckcl, cktag): | |
133 | cons, cl, tag, data = self.get() | |
134 | if not cons: | |
135 | raise dererror("expected constructed value") | |
136 | if (ckcl != None and ckcl != cl) or (cktag != None and cktag != tag): | |
137 | raise dererror("unexpected value tag: got (%d, %d), expected (%d, %d)" % (cl, tag, ckcl, cktag)) | |
138 | return derdecoder(data) | |
139 | ||
140 | def getint(self): | |
141 | cons, cl, tag, data = self.get() | |
142 | if (cons, cl, tag) == (False, 0, 2): | |
143 | ret = 0 | |
144 | for b in data: | |
145 | ret = (ret << 8) + b | |
146 | return ret | |
147 | raise dererror("unexpected integer type: (%s, %d, %d)" % (cons, cl, tag)) | |
148 | ||
149 | def getstr(self): | |
150 | cons, cl, tag, data = self.get() | |
151 | if (cons, cl, tag) == (False, 0, 12): | |
152 | return data.decode("utf-8") | |
153 | if (cons, cl, tag) == (False, 0, 13): | |
154 | return data.decode("us-ascii") | |
155 | if (cons, cl, tag) == (False, 0, 22): | |
156 | return data.decode("us-ascii") | |
157 | if (cons, cl, tag) == (False, 0, 30): | |
158 | return data.decode("utf-16-be") | |
159 | raise dererror("unexpected string type: (%s, %d, %d)" % (cons, cl, tag)) | |
160 | ||
161 | def getbytes(self): | |
162 | cons, cl, tag, data = self.get() | |
163 | if (cons, cl, tag) == (False, 0, 4): | |
164 | return data | |
165 | raise dererror("unexpected byte-string type: (%s, %d, %d)" % (cons, cl, tag)) | |
166 | ||
167 | def getoid(self): | |
168 | cons, cl, tag, data = self.get() | |
169 | if (cons, cl, tag) == (False, 0, 6): | |
170 | ret = [] | |
171 | ret.append(data[0] // 40) | |
172 | ret.append(data[0] % 40) | |
173 | p = 1 | |
174 | while p < len(data): | |
175 | n = 0 | |
176 | v = data[p] | |
177 | p += 1 | |
178 | while v & 0x80: | |
179 | n = (n + (v & 0x7f)) * 128 | |
180 | v = data[p] | |
181 | p += 1 | |
182 | n += v | |
183 | ret.append(n) | |
184 | return tuple(ret) | |
185 | raise dererror("unexpected object-id type: (%s, %d, %d)" % (cons, cl, tag)) | |
186 | ||
187 | @staticmethod | |
188 | def parsetime(data, c): | |
189 | if c: | |
190 | y = int(data[0:4]) | |
191 | data = data[4:] | |
192 | else: | |
193 | y = int(data[0:2]) | |
194 | y += 1900 if y > 50 else 2000 | |
195 | data = data[2:] | |
196 | m = int(data[0:2]) | |
197 | d = int(data[2:4]) | |
198 | H = int(data[4:6]) | |
199 | data = data[6:] | |
200 | if data[:1].isdigit(): | |
201 | M = int(data[0:2]) | |
202 | data = data[2:] | |
203 | else: | |
204 | M = 0 | |
205 | if data[:1].isdigit(): | |
206 | S = int(data[0:2]) | |
207 | data = data[2:] | |
208 | else: | |
209 | S = 0 | |
210 | if data[:1] == '.': | |
211 | p = 1 | |
212 | while len(data) < p and data[p].isdigit(): | |
213 | p += 1 | |
214 | S += float("0." + data[1:p]) | |
215 | data = data[p:] | |
216 | if len(data) < 1: | |
217 | raise dererror("unspecified local time not supported for decoding") | |
218 | if data[0] == 'Z': | |
219 | tz = 0 | |
220 | elif data[0] == '+': | |
221 | tz = (int(data[1:3]) * 60) + int(data[3:5]) | |
222 | elif data[0] == '-': | |
223 | tz = -((int(data[1:3]) * 60) + int(data[3:5])) | |
224 | else: | |
225 | raise dererror("cannot parse X.690 timestamp") | |
226 | return calendar.timegm((y, m, d, H, M, S)) - (tz * 60) | |
227 | ||
228 | def gettime(self): | |
229 | cons, cl, tag, data = self.get() | |
230 | if (cons, cl, tag) == (False, 0, 23): | |
231 | return self.parsetime(data.decode("us-ascii"), False) | |
232 | if (cons, cl, tag) == (False, 0, 24): | |
233 | return self.parsetime(data.decode("us-ascii"), True) | |
234 | raise dererror("unexpected time type: (%s, %d, %d)" % (cons, cl, tag)) | |
235 | ||
236 | @classmethod | |
237 | def frompem(cls, pem, ptypes): | |
238 | return cls(pemdec(pem, ptypes)) | |
239 | ||
14a46eff | 240 | class certificate(object): |
d2252d10 FT |
241 | def __init__(self, der): |
242 | ci = der.getcons(0, 16).getcons(0, 16) | |
243 | self.ver = ci.getcons(2, 0).getint() | |
244 | self.serial = ci.getint() | |
245 | ci.getcons(0, 16) # Signature algorithm | |
246 | ci.getcons(0, 16) # Issuer | |
247 | vl = ci.getcons(0, 16) | |
248 | self.startdate = vl.gettime() | |
249 | self.enddate = vl.gettime() | |
14a46eff FT |
250 | |
251 | def expiring(self, timespec): | |
252 | if timespec.endswith("y"): | |
253 | timespec = int(timespec[:-1]) * 365 * 86400 | |
254 | elif timespec.endswith("m"): | |
255 | timespec = int(timespec[:-1]) * 30 * 86400 | |
256 | elif timespec.endswith("w"): | |
257 | timespec = int(timespec[:-1]) * 7 * 86400 | |
258 | elif timespec.endswith("d"): | |
259 | timespec = int(timespec[:-1]) * 86400 | |
260 | elif timespec.endswith("h"): | |
261 | timespec = int(timespec[:-1]) * 3600 | |
262 | else: | |
263 | timespec = int(timespec) | |
264 | return (self.enddate - time.time()) < timespec | |
265 | ||
266 | @classmethod | |
267 | def read(cls, fp): | |
d2252d10 | 268 | return cls(derdecoder.frompem(fp.read(), {"CERTIFICATE", "X509 CERTIFICATE"})) |
14a46eff | 269 | |
61d08fc2 | 270 | class signreq(object): |
d2252d10 FT |
271 | def __init__(self, der): |
272 | self.raw = der | |
273 | req = derdecoder(der).getcons(0, 16).getcons(0, 16) | |
274 | self.ver = req.getint() | |
275 | req.getcons(0, 16) # Subject | |
276 | req.getcons(0, 16) # Public key | |
277 | self.altnames = [] | |
278 | if not req.end(): | |
279 | attrs = req.getcons(2, 0) | |
280 | while not attrs.end(): | |
281 | attr = attrs.getcons(0, 16) | |
282 | anm = attr.getoid() | |
283 | if anm == (1, 2, 840, 113549, 1, 9, 14): | |
284 | # Certificate extension request | |
285 | exts = attr.getcons(0, 17).getcons(0, 16) | |
286 | while not exts.end(): | |
287 | ext = exts.getcons(0, 16) | |
288 | extnm = ext.getoid() | |
289 | if extnm == (2, 5, 29, 17): | |
290 | # Subject alternative names | |
291 | names = derdecoder(ext.getbytes()).getcons(0, 16) | |
292 | while not names.end(): | |
293 | cons, cl, tag, data = names.get() | |
294 | if (cons, cl, tag) == (False, 2, 2): | |
295 | self.altnames.append(("DNS", data.decode("us-ascii"))) | |
296 | ||
61d08fc2 | 297 | def domains(self): |
d2252d10 | 298 | return [nm[1] for nm in self.altnames if nm[0] == "DNS"] |
61d08fc2 FT |
299 | |
300 | def der(self): | |
d2252d10 | 301 | return self.raw |
61d08fc2 FT |
302 | |
303 | @classmethod | |
304 | def read(cls, fp): | |
d2252d10 | 305 | return cls(pemdec(fp.read(), {"CERTIFICATE REQUEST"})) |
61d08fc2 | 306 | |
f1b49ff6 FT |
307 | ### Somewhat general request utilities |
308 | ||
309 | def getnonce(): | |
310 | with urllib.request.urlopen(directory()["newNonce"]) as resp: | |
311 | resp.read() | |
312 | return resp.headers["Replay-Nonce"] | |
313 | ||
314 | def req(url, data=None, ctype=None, headers={}, method=None, **kws): | |
315 | if data is not None and not isinstance(data, bytes): | |
316 | data = json.dumps(data).encode("utf-8") | |
317 | ctype = "application/jose+json" | |
318 | req = urllib.request.Request(url, data=data, method=method) | |
319 | for hnam, hval in headers.items(): | |
320 | req.add_header(hnam, hval) | |
321 | if ctype is not None: | |
322 | req.add_header("Content-Type", ctype) | |
323 | return urllib.request.urlopen(req) | |
324 | ||
325 | class problem(msgerror): | |
326 | def __init__(self, code, data, *args, url=None, **kw): | |
327 | super().__init__(*args, **kw) | |
328 | self.code = code | |
329 | self.data = data | |
330 | self.url = url | |
331 | if not isinstance(data, dict): | |
332 | raise ValueError("unexpected problem object type: %r" % (data,)) | |
333 | ||
334 | @property | |
335 | def type(self): | |
336 | return self.data.get("type", "about:blank") | |
337 | @property | |
338 | def title(self): | |
339 | return self.data.get("title") | |
340 | @property | |
341 | def detail(self): | |
342 | return self.data.get("detail") | |
343 | ||
344 | def report(self, out): | |
345 | extra = None | |
346 | if self.title is None: | |
347 | msg = self.detail | |
348 | if "\n" in msg: | |
349 | extra, msg = msg, None | |
350 | else: | |
351 | msg = self.title | |
352 | extra = self.detail | |
353 | if msg is None: | |
354 | msg = self.data.get("type") | |
355 | if msg is not None: | |
356 | out.write("acemcert: %s: %s\n" % ( | |
357 | ("remote service error" if self.url is None else self.url), | |
358 | ("unspecified error" if msg is None else msg))) | |
359 | if extra is not None: | |
360 | out.write("%s\n" % (extra,)) | |
361 | ||
362 | @classmethod | |
363 | def read(cls, err, **kw): | |
1995d63b | 364 | self = cls(err.code, json.loads(err.read().decode("utf-8")), **kw) |
f1b49ff6 FT |
365 | return self |
366 | ||
367 | def jreq(url, data, auth): | |
368 | authdata = {"alg": "RS256", "url": url, "nonce": getnonce()} | |
369 | authdata.update(auth.authdata()) | |
370 | authdata = base64url(json.dumps(authdata).encode("us-ascii")) | |
371 | if data is None: | |
372 | data = "" | |
373 | else: | |
374 | data = base64url(json.dumps(data).encode("us-ascii")) | |
375 | seal = base64url(auth.sign(("%s.%s" % (authdata, data)).encode("us-ascii"))) | |
376 | enc = {"protected": authdata, "payload": data, "signature": seal} | |
377 | try: | |
378 | with req(url, data=enc) as resp: | |
1995d63b | 379 | return json.loads(resp.read().decode("utf-8")), resp.headers |
f1b49ff6 FT |
380 | except urllib.error.HTTPError as exc: |
381 | if exc.headers["Content-Type"] == "application/problem+json": | |
382 | raise problem.read(exc, url=url) | |
383 | raise | |
384 | ||
385 | ## Authentication | |
386 | ||
61d08fc2 FT |
387 | class jwkauth(object): |
388 | def __init__(self, key): | |
389 | self.key = key | |
390 | ||
391 | def authdata(self): | |
0756cac4 FT |
392 | pub = self.key.public_key().public_numbers() |
393 | return {"jwk": {"kty": "RSA", "e": ebignum(pub.e), "n": ebignum(pub.n)}} | |
61d08fc2 FT |
394 | |
395 | def sign(self, data): | |
0756cac4 FT |
396 | from cryptography.hazmat.primitives import hashes |
397 | from cryptography.hazmat.primitives.asymmetric import padding | |
398 | return self.key.sign(data, padding.PKCS1v15(), hashes.SHA256()) | |
61d08fc2 FT |
399 | |
400 | class account(object): | |
401 | def __init__(self, uri, key): | |
402 | self.uri = uri | |
403 | self.key = key | |
404 | ||
405 | def authdata(self): | |
406 | return {"kid": self.uri} | |
407 | ||
408 | def sign(self, data): | |
0756cac4 FT |
409 | from cryptography.hazmat.primitives import hashes |
410 | from cryptography.hazmat.primitives.asymmetric import padding | |
411 | return self.key.sign(data, padding.PKCS1v15(), hashes.SHA256()) | |
61d08fc2 FT |
412 | |
413 | def getinfo(self): | |
414 | data, headers = jreq(self.uri, None, self) | |
415 | return data | |
416 | ||
417 | def validate(self): | |
418 | data = self.getinfo() | |
419 | if data.get("status", "") != "valid": | |
420 | raise Exception("account is not valid: %s" % (data.get("status", "\"\""))) | |
421 | ||
422 | def write(self, out): | |
0756cac4 | 423 | from cryptography.hazmat.primitives import serialization |
61d08fc2 | 424 | out.write("%s\n" % (self.uri,)) |
0756cac4 FT |
425 | out.write("%s\n" % (self.key.private_bytes( |
426 | encoding=serialization.Encoding.PEM, | |
427 | format=serialization.PrivateFormat.TraditionalOpenSSL, | |
428 | encryption_algorithm=serialization.NoEncryption() | |
429 | ).decode("us-ascii"),)) | |
61d08fc2 FT |
430 | |
431 | @classmethod | |
432 | def read(cls, fp): | |
0756cac4 | 433 | from cryptography.hazmat.primitives import serialization |
61d08fc2 FT |
434 | uri = fp.readline() |
435 | if uri == "": | |
436 | raise Exception("missing account URI") | |
437 | uri = uri.strip() | |
0756cac4 | 438 | key = serialization.load_pem_private_key(fp.read().encode("us-ascii"), password=None, backend=cryptobke()) |
61d08fc2 FT |
439 | return cls(uri, key) |
440 | ||
f1b49ff6 | 441 | ### ACME protocol |
61d08fc2 | 442 | |
f1b49ff6 FT |
443 | service = "https://acme-v02.api.letsencrypt.org/directory" |
444 | _directory = None | |
445 | def directory(): | |
446 | global _directory | |
447 | if _directory is None: | |
448 | with req(service) as resp: | |
1995d63b | 449 | _directory = json.loads(resp.read().decode("utf-8")) |
f1b49ff6 | 450 | return _directory |
61d08fc2 FT |
451 | |
452 | def register(keysize=4096): | |
0756cac4 FT |
453 | from cryptography.hazmat.primitives.asymmetric import rsa |
454 | key = rsa.generate_private_key(public_exponent=65537, key_size=keysize, backend=cryptobke()) | |
61d08fc2 FT |
455 | data, headers = jreq(directory()["newAccount"], {"termsOfServiceAgreed": True}, jwkauth(key)) |
456 | return account(headers["Location"], key) | |
457 | ||
458 | def mkorder(acct, csr): | |
459 | data, headers = jreq(directory()["newOrder"], {"identifiers": [{"type": "dns", "value": dn} for dn in csr.domains()]}, acct) | |
460 | data["acmecert.location"] = headers["Location"] | |
461 | return data | |
462 | ||
463 | def httptoken(acct, ch): | |
0756cac4 | 464 | from cryptography.hazmat.primitives import hashes |
61d08fc2 | 465 | jwk = {"kty": "RSA", "e": ebignum(acct.key.e), "n": ebignum(acct.key.n)} |
0756cac4 | 466 | dig = hashes.Hash(hashes.SHA256()) |
61d08fc2 | 467 | dig.update(json.dumps(jwk, separators=(',', ':'), sort_keys=True).encode("us-ascii")) |
0756cac4 | 468 | khash = base64url(dig.finalize()) |
61d08fc2 FT |
469 | return ch["token"], ("%s.%s" % (ch["token"], khash)) |
470 | ||
f1b49ff6 FT |
471 | def finalize(acct, csr, orderid): |
472 | order, headers = jreq(orderid, None, acct) | |
473 | if order["status"] == "valid": | |
474 | pass | |
475 | elif order["status"] == "ready": | |
476 | jreq(order["finalize"], {"csr": base64url(csr.der())}, acct) | |
477 | for n in range(30): | |
478 | resp, headers = jreq(orderid, None, acct) | |
479 | if resp["status"] == "processing": | |
480 | time.sleep(2) | |
481 | elif resp["status"] == "valid": | |
482 | order = resp | |
483 | break | |
484 | else: | |
485 | raise Exception("unexpected order status when finalizing: %s" % resp["status"]) | |
486 | else: | |
487 | raise Exception("order finalization timed out") | |
488 | else: | |
489 | raise Exception("unexpected order state when finalizing: %s" % (order["status"],)) | |
490 | with req(order["certificate"]) as resp: | |
491 | return resp.read().decode("us-ascii") | |
492 | ||
493 | ## http-01 challenge | |
494 | ||
495 | class htconfig(object): | |
496 | def __init__(self): | |
497 | self.roots = {} | |
498 | ||
499 | @classmethod | |
500 | def read(cls, fp): | |
501 | self = cls() | |
502 | for ln in fp: | |
503 | words = ln.split() | |
504 | if len(words) < 1 or ln[0] == '#': | |
505 | continue | |
506 | if words[0] == "root": | |
507 | self.roots[words[1]] = words[2] | |
508 | else: | |
509 | sys.stderr.write("acmecert: warning: unknown htconfig directive: %s\n" % (words[0])) | |
510 | return self | |
511 | ||
61d08fc2 FT |
512 | def authorder(acct, htconf, orderid): |
513 | order, headers = jreq(orderid, None, acct) | |
514 | valid = False | |
515 | tries = 0 | |
516 | while not valid: | |
517 | valid = True | |
518 | tries += 1 | |
519 | if tries > 5: | |
520 | raise Exception("challenges refuse to become valid even after 5 retries") | |
521 | for authuri in order["authorizations"]: | |
522 | auth, headers = jreq(authuri, None, acct) | |
523 | if auth["status"] == "valid": | |
524 | continue | |
525 | elif auth["status"] == "pending": | |
526 | pass | |
527 | else: | |
528 | raise Exception("unknown authorization status: %s" % (auth["status"],)) | |
529 | valid = False | |
530 | if auth["identifier"]["type"] != "dns": | |
531 | raise Exception("unknown authorization type: %s" % (auth["identifier"]["type"],)) | |
532 | dn = auth["identifier"]["value"] | |
533 | if dn not in htconf.roots: | |
534 | raise Exception("no configured ht-root for domain name %s" % (dn,)) | |
535 | for ch in auth["challenges"]: | |
536 | if ch["type"] == "http-01": | |
537 | break | |
538 | else: | |
539 | raise Exception("no http-01 challenge for %s" % (dn,)) | |
540 | root = htconf.roots[dn] | |
541 | tokid, tokval = httptoken(acct, ch) | |
542 | tokpath = os.path.join(root, tokid); | |
543 | fp = open(tokpath, "w") | |
544 | try: | |
545 | with fp: | |
546 | fp.write(tokval) | |
547 | with req("http://%s/.well-known/acme-challenge/%s" % (dn, tokid)) as resp: | |
548 | if resp.read().decode("utf-8") != tokval: | |
549 | raise Exception("challenge from %s does not match written value" % (dn,)) | |
550 | for n in range(30): | |
551 | resp, headers = jreq(ch["url"], {}, acct) | |
552 | if resp["status"] == "processing": | |
553 | time.sleep(2) | |
db705a3b FT |
554 | elif resp["status"] == "pending": |
555 | # I don't think this should happen, but it | |
556 | # does. LE bug? Anyway, just retry. | |
62b251ca FT |
557 | if n < 5: |
558 | time.sleep(2) | |
559 | else: | |
560 | break | |
61d08fc2 FT |
561 | elif resp["status"] == "valid": |
562 | break | |
563 | else: | |
564 | raise Exception("unexpected challenge status for %s when validating: %s" % (dn, resp["status"])) | |
565 | else: | |
566 | raise Exception("challenge processing timed out for %s" % (dn,)) | |
567 | finally: | |
568 | os.unlink(tokpath) | |
569 | ||
f1b49ff6 | 570 | ### Invocation and commands |
cc8619b5 | 571 | |
28d5a321 | 572 | invdata = threading.local() |
cc8619b5 FT |
573 | commands = {} |
574 | ||
28d5a321 FT |
575 | class usageerr(msgerror): |
576 | def __init__(self): | |
577 | self.cmd = invdata.cmd | |
578 | ||
579 | def report(self, out): | |
580 | out.write("%s\n" % (self.cmd.__doc__,)) | |
581 | ||
f1b49ff6 FT |
582 | ## User commands |
583 | ||
cc8619b5 FT |
584 | def cmd_reg(args): |
585 | "usage: acmecert reg [OUTPUT-FILE]" | |
586 | acct = register() | |
bfe6116d | 587 | os.umask(0o077) |
cc8619b5 FT |
588 | with maybeopen(args[1] if len(args) > 1 else "-", "w") as fp: |
589 | acct.write(fp) | |
590 | commands["reg"] = cmd_reg | |
591 | ||
592 | def cmd_validate_acct(args): | |
593 | "usage: acmecert validate-acct ACCOUNT-FILE" | |
594 | if len(args) < 2: raise usageerr() | |
595 | with maybeopen(args[1], "r") as fp: | |
40a14578 | 596 | account.read(fp).validate() |
cc8619b5 FT |
597 | commands["validate-acct"] = cmd_validate_acct |
598 | ||
599 | def cmd_acct_info(args): | |
600 | "usage: acmecert acct-info ACCOUNT-FILE" | |
601 | if len(args) < 2: raise usageerr() | |
602 | with maybeopen(args[1], "r") as fp: | |
603 | pprint.pprint(account.read(fp).getinfo()) | |
9cef04aa | 604 | commands["acct-info"] = cmd_acct_info |
cc8619b5 FT |
605 | |
606 | def cmd_order(args): | |
607 | "usage: acmecert order ACCOUNT-FILE CSR [OUTPUT-FILE]" | |
8cea2234 | 608 | if len(args) < 3: raise usageerr() |
cc8619b5 FT |
609 | with maybeopen(args[1], "r") as fp: |
610 | acct = account.read(fp) | |
611 | with maybeopen(args[2], "r") as fp: | |
612 | csr = signreq.read(fp) | |
613 | order = mkorder(acct, csr) | |
614 | with maybeopen(args[3] if len(args) > 3 else "-", "w") as fp: | |
615 | fp.write("%s\n" % (order["acmecert.location"])) | |
616 | commands["order"] = cmd_order | |
617 | ||
618 | def cmd_http_auth(args): | |
619 | "usage: acmecert http-auth ACCOUNT-FILE HTTP-CONFIG {ORDER-ID|ORDER-FILE}" | |
620 | if len(args) < 4: raise usageerr() | |
621 | with maybeopen(args[1], "r") as fp: | |
622 | acct = account.read(fp) | |
623 | with maybeopen(args[2], "r") as fp: | |
624 | htconf = htconfig.read(fp) | |
625 | if "://" in args[3]: | |
626 | orderid = args[3] | |
627 | else: | |
628 | with maybeopen(args[3], "r") as fp: | |
629 | orderid = fp.readline().strip() | |
630 | authorder(acct, htconf, orderid) | |
631 | commands["http-auth"] = cmd_http_auth | |
632 | ||
633 | def cmd_get(args): | |
634 | "usage: acmecert get ACCOUNT-FILE CSR {ORDER-ID|ORDER-FILE}" | |
635 | if len(args) < 4: raise usageerr() | |
636 | with maybeopen(args[1], "r") as fp: | |
637 | acct = account.read(fp) | |
638 | with maybeopen(args[2], "r") as fp: | |
639 | csr = signreq.read(fp) | |
640 | if "://" in args[3]: | |
641 | orderid = args[3] | |
642 | else: | |
643 | with maybeopen(args[3], "r") as fp: | |
644 | orderid = fp.readline().strip() | |
645 | sys.stdout.write(finalize(acct, csr, orderid)) | |
646 | commands["get"] = cmd_get | |
647 | ||
648 | def cmd_http_order(args): | |
649 | "usage: acmecert http-order ACCOUNT-FILE CSR HTTP-CONFIG [OUTPUT-FILE]" | |
650 | if len(args) < 4: raise usageerr() | |
651 | with maybeopen(args[1], "r") as fp: | |
652 | acct = account.read(fp) | |
653 | with maybeopen(args[2], "r") as fp: | |
654 | csr = signreq.read(fp) | |
655 | with maybeopen(args[3], "r") as fp: | |
656 | htconf = htconfig.read(fp) | |
657 | orderid = mkorder(acct, csr)["acmecert.location"] | |
658 | authorder(acct, htconf, orderid) | |
659 | with maybeopen(args[4] if len(args) > 4 else "-", "w") as fp: | |
660 | fp.write(finalize(acct, csr, orderid)) | |
661 | commands["http-order"] = cmd_http_order | |
662 | ||
663 | def cmd_check_cert(args): | |
664 | "usage: acmecert check-cert CERT-FILE TIME-SPEC" | |
665 | if len(args) < 3: raise usageerr() | |
666 | with maybeopen(args[1], "r") as fp: | |
667 | crt = certificate.read(fp) | |
668 | sys.exit(1 if crt.expiring(args[2]) else 0) | |
669 | commands["check-cert"] = cmd_check_cert | |
670 | ||
671 | def cmd_directory(args): | |
672 | "usage: acmecert directory" | |
673 | pprint.pprint(directory()) | |
674 | commands["directory"] = cmd_directory | |
675 | ||
f1b49ff6 FT |
676 | ## Main invocation |
677 | ||
61d08fc2 | 678 | def usage(out): |
cc8619b5 FT |
679 | out.write("usage: acmecert [-D SERVICE] COMMAND [ARGS...]\n") |
680 | out.write(" acmecert -h [COMMAND]\n") | |
681 | buf = " COMMAND is any of: " | |
682 | f = True | |
683 | for cmd in commands: | |
684 | if len(buf) + len(cmd) > 70: | |
685 | out.write("%s\n" % (buf,)) | |
686 | buf = " " | |
687 | f = True | |
688 | if not f: | |
689 | buf += ", " | |
690 | buf += cmd | |
691 | f = False | |
692 | if not f: | |
693 | out.write("%s\n" % (buf,)) | |
61d08fc2 FT |
694 | |
695 | def main(argv): | |
696 | global service | |
697 | opts, args = getopt.getopt(argv[1:], "hD:") | |
698 | for o, a in opts: | |
699 | if o == "-h": | |
cc8619b5 FT |
700 | if len(args) > 0: |
701 | cmd = commands.get(args[0]) | |
702 | if cmd is None: | |
703 | sys.stderr.write("acmecert: unknown command: %s\n" % (args[0],)) | |
704 | sys.exit(1) | |
705 | sys.stdout.write("%s\n" % (cmd.__doc__,)) | |
706 | else: | |
707 | usage(sys.stdout) | |
61d08fc2 FT |
708 | sys.exit(0) |
709 | elif o == "-D": | |
710 | service = a | |
711 | if len(args) < 1: | |
712 | usage(sys.stderr) | |
713 | sys.exit(1) | |
cc8619b5 FT |
714 | cmd = commands.get(args[0]) |
715 | if cmd is None: | |
61d08fc2 FT |
716 | sys.stderr.write("acmecert: unknown command: %s\n" % (args[0],)) |
717 | usage(sys.stderr) | |
718 | sys.exit(1) | |
cc8619b5 | 719 | try: |
28d5a321 FT |
720 | try: |
721 | invdata.cmd = cmd | |
722 | cmd(args) | |
723 | finally: | |
724 | invdata.cmd = None | |
725 | except msgerror as exc: | |
726 | exc.report(sys.stderr) | |
cc8619b5 | 727 | sys.exit(1) |
61d08fc2 FT |
728 | |
729 | if __name__ == "__main__": | |
730 | try: | |
731 | main(sys.argv) | |
732 | except KeyboardInterrupt: | |
733 | signal.signal(signal.SIGINT, signal.SIG_DFL) | |
734 | os.kill(os.getpid(), signal.SIGINT) |