From d8a75faa53e1c00bc2be8b4dc267b53353e5ddcc Mon Sep 17 00:00:00 2001 From: Felix Fontein Date: Mon, 18 Mar 2019 22:31:13 +0100 Subject: [PATCH] Reference RFC 8555 instead of latest draft. (#53674) (#53836) (cherry picked from commit a043570579796c37c059b577f04ac45939de3e5e) --- lib/ansible/module_utils/acme.py | 16 ++++++++-------- .../modules/crypto/acme/acme_account.py | 6 +++--- .../modules/crypto/acme/acme_account_facts.py | 2 +- .../modules/crypto/acme/acme_certificate.py | 18 +++++++++--------- .../crypto/acme/acme_certificate_revoke.py | 4 ++-- 5 files changed, 23 insertions(+), 23 deletions(-) diff --git a/lib/ansible/module_utils/acme.py b/lib/ansible/module_utils/acme.py index 5ef80dbeb3d..0b4229325b7 100644 --- a/lib/ansible/module_utils/acme.py +++ b/lib/ansible/module_utils/acme.py @@ -443,7 +443,7 @@ class ACMEDirectory(object): and allows to obtain a Replay-Nonce. The acme_directory URL needs to support unauthenticated GET requests; ACME endpoints requiring authentication are not supported. - https://tools.ietf.org/html/draft-ietf-acme-acme-14#section-7.1.1 + https://tools.ietf.org/html/rfc8555#section-7.1.1 ''' def __init__(self, module, account): @@ -514,7 +514,7 @@ class ACMEAccount(object): def get_keyauthorization(self, token): ''' Returns the key authorization for the given token - https://tools.ietf.org/html/draft-ietf-acme-acme-14#section-8.1 + https://tools.ietf.org/html/rfc8555#section-8.1 ''' accountkey_json = json.dumps(self.jwk, sort_keys=True, separators=(',', ':')) thumbprint = nopad_b64(hashlib.sha256(accountkey_json.encode('utf8')).digest()) @@ -551,10 +551,10 @@ class ACMEAccount(object): ''' Sends a JWS signed HTTP POST request to the ACME server and returns the response as dictionary - https://tools.ietf.org/html/draft-ietf-acme-acme-14#section-6.2 + https://tools.ietf.org/html/rfc8555#section-6.2 If payload is None, a POST-as-GET is performed. - (https://tools.ietf.org/html/draft-ietf-acme-acme-15#section-6.3) + (https://tools.ietf.org/html/rfc8555#section-6.3) ''' key_data = key_data or self.key_data jws_header = jws_header or self.jws_header @@ -585,7 +585,7 @@ class ACMEAccount(object): try: decoded_result = self.module.from_json(content.decode('utf8')) # In case of badNonce error, try again (up to 5 times) - # (https://tools.ietf.org/html/draft-ietf-acme-acme-14#section-6.6) + # (https://tools.ietf.org/html/rfc8555#section-6.7) if (400 <= info['status'] < 600 and decoded_result.get('type') == 'urn:ietf:params:acme:error:badNonce' and failed_tries <= 5): @@ -659,7 +659,7 @@ class ACMEAccount(object): Registers a new ACME account. Returns True if the account was created and False if it already existed (e.g. it was not newly created). - https://tools.ietf.org/html/draft-ietf-acme-acme-14#section-7.3 + https://tools.ietf.org/html/rfc8555#section-7.3 ''' contact = [] if contact is None else contact @@ -695,7 +695,7 @@ class ACMEAccount(object): if result.get('status') == 'deactivated': # A probable bug in Pebble (https://github.com/letsencrypt/pebble/issues/179) # and Boulder: this should not return a valid account object according to - # https://tools.ietf.org/html/draft-ietf-acme-acme-16#section-7.3.6: + # https://tools.ietf.org/html/rfc8555#section-7.3.6: # "Once an account is deactivated, the server MUST NOT accept further # requests authorized by that account's key." if not allow_creation: @@ -762,7 +762,7 @@ class ACMEAccount(object): will be stored in self.uri; if it is None, the account does not exist. - https://tools.ietf.org/html/draft-ietf-acme-acme-14#section-7.3 + https://tools.ietf.org/html/rfc8555#section-7.3 ''' new_account = True diff --git a/lib/ansible/modules/crypto/acme/acme_account.py b/lib/ansible/modules/crypto/acme/acme_account.py index 1fbe8165012..803974da2ca 100644 --- a/lib/ansible/modules/crypto/acme/acme_account.py +++ b/lib/ansible/modules/crypto/acme/acme_account.py @@ -21,7 +21,7 @@ version_added: "2.6" short_description: Create, modify or delete ACME accounts description: - "Allows to create, modify or delete accounts with a CA supporting the - L(ACME protocol,https://tools.ietf.org/html/draft-ietf-acme-acme-14), + L(ACME protocol,https://tools.ietf.org/html/rfc8555), such as L(Let's Encrypt,https://letsencrypt.org/)." - "This module only works with the ACME v2 protocol." notes: @@ -55,7 +55,7 @@ options: description: - "A list of contact URLs." - "Email addresses must be prefixed with C(mailto:)." - - "See https://tools.ietf.org/html/draft-ietf-acme-acme-14#section-7.1.2 + - "See U(https://tools.ietf.org/html/rfc8555#section-7.3) for what is allowed." - "Must be specified when state is C(present). Will be ignored if state is C(absent) or C(changed_key)." @@ -223,7 +223,7 @@ def main(): # Now we can start the account key rollover if not module.check_mode: # Compose inner signed message - # https://tools.ietf.org/html/draft-ietf-acme-acme-14#section-7.3.6 + # https://tools.ietf.org/html/rfc8555#section-7.3.5 url = account.directory['keyChange'] protected = { "alg": new_key_data['alg'], diff --git a/lib/ansible/modules/crypto/acme/acme_account_facts.py b/lib/ansible/modules/crypto/acme/acme_account_facts.py index 12c77fb0b79..c209d1e35b9 100644 --- a/lib/ansible/modules/crypto/acme/acme_account_facts.py +++ b/lib/ansible/modules/crypto/acme/acme_account_facts.py @@ -21,7 +21,7 @@ version_added: "2.7" short_description: Retrieves information on ACME accounts description: - "Allows to retrieve information on accounts a CA supporting the - L(ACME protocol,https://tools.ietf.org/html/draft-ietf-acme-acme-14), + L(ACME protocol,https://tools.ietf.org/html/rfc8555), such as L(Let's Encrypt,https://letsencrypt.org/)." - "This module only works with the ACME v2 protocol." notes: diff --git a/lib/ansible/modules/crypto/acme/acme_certificate.py b/lib/ansible/modules/crypto/acme/acme_certificate.py index 1c5426b5748..d5b1b9933e6 100644 --- a/lib/ansible/modules/crypto/acme/acme_certificate.py +++ b/lib/ansible/modules/crypto/acme/acme_certificate.py @@ -21,7 +21,7 @@ version_added: "2.2" short_description: Create SSL/TLS certificates with the ACME protocol description: - "Create and renew SSL/TLS certificates with a CA supporting the - L(ACME protocol,https://tools.ietf.org/html/draft-ietf-acme-acme-14), + L(ACME protocol,https://tools.ietf.org/html/rfc8555), such as L(Let's Encrypt,https://letsencrypt.org/). The current implementation supports the C(http-01), C(dns-01) and C(tls-alpn-01) challenges." @@ -36,7 +36,7 @@ description: the necessary certificate has to be created and served. It is I(not) the responsibility of this module to perform these steps." - "For details on how to fulfill these challenges, you might have to read through - L(the main ACME specification,https://tools.ietf.org/html/draft-ietf-acme-acme-14#section-8) + L(the main ACME specification,https://tools.ietf.org/html/rfc8555#section-8) and the L(TLS-ALPN-01 specification,https://tools.ietf.org/html/draft-ietf-acme-tls-alpn-05#section-3). Also, consider the examples provided for this module." notes: @@ -311,7 +311,7 @@ authorizations: type: complex contains: authorization: - description: ACME authorization object. See U(https://tools.ietf.org/html/draft-ietf-acme-acme-14#section-7.1.4) + description: ACME authorization object. See U(https://tools.ietf.org/html/rfc8555#section-7.1.4) returned: success type: dict order_uri: @@ -496,11 +496,11 @@ class ACMEClient(object): keyauthorization = self.account.get_keyauthorization(token) if type == 'http-01': - # https://tools.ietf.org/html/draft-ietf-acme-acme-14#section-8.3 + # https://tools.ietf.org/html/rfc8555#section-8.3 resource = '.well-known/acme-challenge/' + token data[type] = {'resource': resource, 'resource_value': keyauthorization} elif type == 'dns-01': - # https://tools.ietf.org/html/draft-ietf-acme-acme-14#section-8.4 + # https://tools.ietf.org/html/rfc8555#section-8.4 resource = '_acme-challenge' value = nopad_b64(hashlib.sha256(to_bytes(keyauthorization)).digest()) record = (resource + domain[1:]) if domain.startswith('*.') else (resource + '.' + domain) @@ -577,7 +577,7 @@ class ACMEClient(object): ''' Create a new certificate based on the csr. Return the certificate object as dict - https://tools.ietf.org/html/draft-ietf-acme-acme-14#section-7.4 + https://tools.ietf.org/html/rfc8555#section-7.4 ''' csr = pem_to_der(self.csr) new_cert = { @@ -611,7 +611,7 @@ class ACMEClient(object): def _download_cert(self, url): ''' Download and parse the certificate chain. - https://tools.ietf.org/html/draft-ietf-acme-acme-14#section-7.4.2 + https://tools.ietf.org/html/rfc8555#section-7.4.2 ''' content, info = self.account.get_request(url, parse_json_result=False, headers={'Accept': 'application/pem-certificate-chain'}) @@ -679,7 +679,7 @@ class ACMEClient(object): def _new_order_v2(self): ''' Start a new certificate order (ACME v2 protocol). - https://tools.ietf.org/html/draft-ietf-acme-acme-14#section-7.4 + https://tools.ietf.org/html/rfc8555#section-7.4 ''' identifiers = [] for domain in self.domains: @@ -836,7 +836,7 @@ class ACMEClient(object): ''' Deactivates all valid authz's. Does not raise exceptions. https://community.letsencrypt.org/t/authorization-deactivation/19860/2 - https://tools.ietf.org/html/draft-ietf-acme-acme-14#section-7.5.2 + https://tools.ietf.org/html/rfc8555#section-7.5.2 ''' authz_deactivate = { 'status': 'deactivated' diff --git a/lib/ansible/modules/crypto/acme/acme_certificate_revoke.py b/lib/ansible/modules/crypto/acme/acme_certificate_revoke.py index dfc8c63bfa2..e3ddaf11557 100644 --- a/lib/ansible/modules/crypto/acme/acme_certificate_revoke.py +++ b/lib/ansible/modules/crypto/acme/acme_certificate_revoke.py @@ -21,7 +21,7 @@ version_added: "2.7" short_description: Revoke certificates with the ACME protocol description: - "Allows to revoke certificates issued by a CA supporting the - L(ACME protocol,https://tools.ietf.org/html/draft-ietf-acme-acme-14), + L(ACME protocol,https://tools.ietf.org/html/rfc8555), such as L(Let's Encrypt,https://letsencrypt.org/)." notes: - "Exactly one of C(account_key_src), C(account_key_content), @@ -188,7 +188,7 @@ def main(): result, info = account.send_signed_request(endpoint, payload) if info['status'] != 200: already_revoked = False - # Standarized error in draft 14 (https://tools.ietf.org/html/draft-ietf-acme-acme-14#section-7.6) + # Standarized error from draft 14 on (https://tools.ietf.org/html/rfc8555#section-7.6) if result.get('type') == 'urn:ietf:params:acme:error:alreadyRevoked': already_revoked = True else: