PKBkN#Zjjlancer/__init__.py""" Provision TLS *Cer*tificates for your *LAN*, using the ACME DNS challenge. """ __version__ = '0.4.0' PK&kNũ' lancer/_cloudflare.pyimport attr import treq from txacme.interfaces import IResponder from txacme.challenges._libcloud import _validation from zope.interface import implementer from twisted.internet.defer import inlineCallbacks from twisted.internet.task import deferLater from hyperlink import parse from ._common import ConsistencyChecker base = parse("https://api.cloudflare.com/client/v4/") def global_reactor(): from twisted.internet import reactor return reactor @attr.s(hash=False) @implementer(IResponder) class CloudflareV4Responder(object): """ Cloudflare API V4 responder. """ _email = attr.ib() _api_key = attr.ib() _zone_name = attr.ib() _reactor = attr.ib(default=attr.Factory(global_reactor)) challenge_type = u'dns-01' def _headers(self): """ Auth headers that Cloudflare expects. """ return { b"X-Auth-Key": self._api_key, b"X-Auth-Email": self._email } @inlineCallbacks def start_responding(self, server_name, challenge, response): validation = _validation(response) full_name = challenge.validation_domain_name(server_name) # subdomain = _split_zone(full_name, self._zone_name) zones_list_url = str(base.child("zones").set("name", self._zone_name)) response = yield treq.get(zones_list_url, headers=self._headers()) data = yield response.json() assert len(data['result']) == 1 zone_id = data['result'][0]['id'] records_base = base.child("zones").child(zone_id).child("dns_records") records_query_url = str(records_base .set("type", "TXT") .set("name", full_name)) response = yield treq.get(records_query_url, headers=self._headers()) data = yield response.json() records = data['result'] dns_record = { "type": "TXT", "ttl": 120, "name": full_name, "content": validation } if records: put_to = str(records_base.child(records[0]["id"])) response = yield treq.put( put_to, json=dns_record, headers=self._headers() ) else: post_to = str(records_base) response = yield treq.post(post_to, json=dns_record, headers=self._headers()) yield response.json() yield ConsistencyChecker.default(self._reactor).check(full_name, validation) @inlineCallbacks def stop_responding(self, server_name, challenge, response): # Ignore stop_responding right now. yield deferLater(self._reactor, 1.0, lambda: None) PKYkN$ lancer/_common.py import attr from twisted.names.client import Resolver from twisted.logger import Logger from twisted.internet.defer import inlineCallbacks, gatherResults, returnValue from twisted.internet.task import deferLater log = Logger("lancer.consistency") INTERQUERY_DELAY = 5.0 @attr.s class ConsistencyChecker(object): """ Check the consistency of DNS resolution results. """ _resolvers = attr.ib() _reactor = attr.ib() @classmethod def default(cls, reactor): """ Create a consistency checker with resolvers from Google, Cloudflare, OpenDNS, and Level3. """ return cls( [ Resolver(servers=[(addr, 53)], reactor=reactor) for addr in [ # Google "8.8.8.8", "8.8.4.4", # Level3 "4.2.2.2", "4.2.2.1", # OpenDNS "208.67.222.222", "208.67.220.220", # Cloudflare "1.1.1.1", "1.0.0.1", ] ], reactor, ) @inlineCallbacks def check(self, name, content): """ Check DNS consistency between a challenge TXT record name and the observable response in the DNS. """ while True: gathered = yield gatherResults( [ resolver.lookupText(name).addCallbacks( lambda response: response[0][0].payload.data[0].decode("ascii"), lambda failure: "", ) for resolver in self._resolvers ] ) if gathered and all((each == content) for each in gathered): log.info( "all resolvers confirm {name} is {content!r}", name=name, content=content, ) yield deferLater(self._reactor, INTERQUERY_DELAY, lambda: None) returnValue(True) else: log.warn( "expected {content} for {name}: dissenting responses {dissenting}", dissenting=[each for each in gathered if each != content], content=content, name=name, ) yield deferLater(self._reactor, INTERQUERY_DELAY, lambda: None) PKYwMs"i i lancer/_gandi.pyimport attr import treq from txacme.interfaces import IResponder from txacme.challenges._libcloud import _validation, _split_zone from zope.interface import implementer from twisted.internet.defer import inlineCallbacks from twisted.internet.task import deferLater @attr.s(hash=False) @implementer(IResponder) class GandiV5Responder(object): """ Gandi V5 API responder. """ _api_key = attr.ib() _zone_name = attr.ib() _settle_delay = attr.ib(default=60.0) challenge_type = u'dns-01' def _headers(self): return { # b"Content-Type": [b"application/json"], b"X-API-Key": [self._api_key.encode("ascii")] } @inlineCallbacks def start_responding(self, server_name, challenge, response): from twisted.internet import reactor validation = _validation(response) full_name = challenge.validation_domain_name(server_name) subdomain = _split_zone(full_name, self._zone_name) if subdomain == '': subdomain = '@' url = ( 'https://dns.api.gandi.net/api/v5/domains/' '{zone}/records' ).format( zone=self._zone_name, subdomain=subdomain, type='TXT', ) body = {"rrset_name": subdomain, "rrset_type": "TXT", "rrset_ttl": 300, "rrset_values": [ validation ]} print(body) response = yield treq.post(url, json=body, headers=self._headers()) print((yield treq.json_content(response))) yield deferLater(reactor, self._settle_delay, lambda: None) print("start settled") @inlineCallbacks def stop_responding(self, server_name, challenge, response): from twisted.internet import reactor full_name = challenge.validation_domain_name(server_name) subdomain = _split_zone(full_name, self._zone_name) url = ( 'https://dns.api.gandi.net/api/v5/domains/' '{zone}/records/{subdomain}/{type}' ).format( zone=self._zone_name, subdomain=subdomain, type='TXT', ) if subdomain == '': subdomain = '@' response = yield treq.delete(url, headers=self._headers()) print((yield response.text())) yield deferLater(reactor, self._settle_delay, lambda: None) print("stop settled") PKwM0燠lancer/_impl.py import sys, json, six from secretly import secretly from functools import partial from twisted.internet.defer import Deferred from twisted.internet.task import react from twisted.python.filepath import FilePath from twisted.logger import globalLogBeginner, textFileLogObserver from cryptography.hazmat.primitives import serialization from cryptography.hazmat.backends import default_backend from josepy.jwk import JWKRSA from josepy.jwa import RS256 from txacme.service import AcmeIssuingService from txacme.store import DirectoryStore from txacme.client import Client from txacme.urls import LETSENCRYPT_DIRECTORY, LETSENCRYPT_STAGING_DIRECTORY from txacme.util import generate_private_key from txacme.challenges import LibcloudDNSResponder from ._cloudflare import CloudflareV4Responder from ._gandi import GandiV5Responder def maybe_key(pem_path): acme_key_file = pem_path.child(u'client.key') if acme_key_file.exists(): key = serialization.load_pem_private_key( acme_key_file.getContent(), password=None, backend=default_backend() ) else: key = generate_private_key(u'rsa') acme_key_file.setContent( key.private_bytes( encoding=serialization.Encoding.PEM, format=serialization.PrivateFormat.TraditionalOpenSSL, encryption_algorithm=serialization.NoEncryption() ) ) acme_key = JWKRSA(key=key) return acme_key def main(reactor): acme_path = FilePath(sys.argv[1]).asTextMode() myconfig = acme_path.child("lancer.json") if myconfig.exists(): cfg = json.loads(myconfig.getContent().decode("utf-8")) driver_name = cfg['driver_name'] zone_name = cfg['zone_name'] user_name = cfg['user_name'] staging = cfg.get('staging', False) else: driver_name = six.moves.input("driver ('rackspace' or 'cloudflare')? ") user_name = six.moves.input("user? ") zone_name = six.moves.input("zone? ") staging = False myconfig.setContent(json.dumps({ "driver_name": driver_name, "user_name": user_name, "zone_name": zone_name, "staging": staging }).encode("utf-8")) globalLogBeginner.beginLoggingTo([textFileLogObserver(sys.stdout)]) def action(secret): password = secret if driver_name == 'gandi': responders = [ GandiV5Responder(api_key=password, zone_name=zone_name) ] elif driver_name == 'cloudflare': responders = [ CloudflareV4Responder(email=user_name, api_key=password, zone_name=zone_name) ] else: responders = [ LibcloudDNSResponder.create(reactor, driver_name, user_name, password, zone_name) ] acme_key = maybe_key(acme_path) cert_store = DirectoryStore(acme_path) if staging: le_url = LETSENCRYPT_STAGING_DIRECTORY else: le_url = LETSENCRYPT_DIRECTORY client_creator = partial(Client.from_url, reactor=reactor, url=le_url, key=acme_key, alg=RS256) clock = reactor service = AcmeIssuingService(cert_store, client_creator, clock, responders) service._registered = False return service._check_certs() return secretly(reactor, action=action, system='libcloud/' + driver_name, username=user_name) def script(): react(main) PK!Hb=*'.'lancer-0.4.0.dist-info/entry_points.txtN+I/N.,()IKN-Pz9VI..PK mJ$/00lancer-0.4.0.dist-info/LICENSEThe MIT License (MIT) Copyright (c) 2017 Glyph Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. PK!Hd BUclancer-0.4.0.dist-info/WHEEL HM K-*ϳR03rOK-J,/RH,rzd&Y)r$[)T&UD"PK!Hd lancer-0.4.0.dist-info/METADATAXn}h$8uMXY6,z͙&LGٟX$ /<d?!gȡdx XerT_J/rEN=Cv&J9Йl^ \)z§wZLxXޚGgwGvJ/_I~t)rvγ( 2e/L)J,qMzf/Z;kNU&gߞzwƎj2vŸөS"K r^V]FD̪h/Om^^1[' |2OQU'1{#?J<."v7:Yo>V~ -EVʋBͳ{R*pAUH[3Oj%cw8ogHHDcM3CaP RH'^&[3!uڨdDjrLƯENgt$srn Ea@[me#Hv"#H4(:#@Qɳ"*|cI|S9>s{P#\pUlJ:e]}N  dЄg&)ݼF-jVsew@l#دS~l,+0BLw~Λ7jj\&i RzSGc 5؉ ~>pAGRop27;,X!z=zX-<6h&prNp%ǔ 80=I=tr!ѝ<yLF׮T^X &JXh"{qݍ4ԱeG;-ڤD4$y!54iLr"xVI,]ңKy7>]akPC-).s `r[>OF1fy뒉ƍ?PU7.һQl67hgBŒ͔ `1x;l3;4PBOYFz?v(o6C6rHL$l#+puqzLƛ5'$A7r "^?Ab$eʭ ⷯBR#N"d e #Nκ6kW+xa+f{ 7jz 'g1$&>2yP>ICi[  8D:iI=4ԇU }2;H`']bOкX Dߙ:Iܝfw&n Nyʫ|r"Zx mHP K>/ \42,Fn3✟'yrJ75uNnOY2 B&l>hhB95i^vWƂ /lj\m"2/%%>ffAE W{^5B5F+W^w<́Yءv%"Y3Tiɩ+Ak_y­7 1a<:Nv=*8i!K\O_縷PKBkN#Zjjlancer/__init__.pyPK&kNũ' lancer/_cloudflare.pyPKYkN$ x lancer/_common.pyPKYwMs"i i lancer/_gandi.pyPKwM0燠lancer/_impl.pyPK!Hb=*'.'-lancer-0.4.0.dist-info/entry_points.txtPK mJ$/00R.lancer-0.4.0.dist-info/LICENSEPK!Hd BUc2lancer-0.4.0.dist-info/WHEELPK!Hd M3lancer-0.4.0.dist-info/METADATAPK!Hbc=lancer-0.4.0.dist-info/RECORDPK ?