U
|
I=®d´. ã @ s´ d Z ddlZddlZddlZddlZddlZddlZddlZddlm Z m
|
Z
|
m Z e dej ¡Zdd Zdd Zd
|
d Zdd d Zdd Zdd Zdd Zdd Zdd Zdd ZdS )a¦
|
Low-level helpers for the SecureTransport bindings.
|
|
These are Python functions that are not directly related to the high-level APIs
|
but are necessary to get them to work. They include a whole bunch of low-level
|
CoreFoundation messing about and memory management. The concerns in this module
|
are almost entirely about trying to avoid memory leaks and providing
|
appropriate and useful assistance to the higher-level code.
|
é Né )ÚSecurityÚCoreFoundationÚCFConsts; -----BEGIN CERTIFICATE-----
|
(.*?)
|
-----END CERTIFICATE-----c C s t t j| t| ¡S )zv
|
Given a bytestring, create a CFData object from it. This CFData object must
|
be CFReleased by the caller.
|
)r Ú CFDataCreateÚkCFAllocatorDefaultÚlen)Z
|
bytestring© r úmD:\z\workplace\VsCode\pyvenv\venv\Lib\site-packages\pip/_vendor/urllib3/contrib/_securetransport/low_level.pyÚ_cf_data_from_bytes s
|
ÿr c C sZ t | }dd | D }dd | D }tj| | }tj| | }t tj|||tjtj¡S )zK
|
Given a list of Python tuples, create an associated CFDictionary.
|
c s s | ]}|d V qdS )r Nr ©Ú.0Útr r r
|
Ú <genexpr>, s z-_cf_dictionary_from_tuples.<locals>.<genexpr>c s s | ]}|d V qdS )r Nr r r r r
|
r - s )r r Ú CFTypeRefZCFDictionaryCreater Z kCFTypeDictionaryKeyCallBacksZ kCFTypeDictionaryValueCallBacks)ZtuplesZdictionary_sizeÚkeysÚvaluesZcf_keysZ cf_valuesr r r
|
Ú_cf_dictionary_from_tuples% s úr c C sn t | t t j¡¡}t |tj¡}|dkrXt d¡}t ||dtj¡}|sRt
|
d|j }|dk rj| d¡}|S )z¨
|
Creates a Unicode string from a CFString object. Used entirely for error
|
reporting.
|
|
Yes, it annoys me quite a lot that this function is this complex.
|
Ni z'Error copying C string from CFStringRefúutf-8) ÚctypesÚcastÚPOINTERÚc_void_pr ZCFStringGetCStringPtrr ZkCFStringEncodingUTF8Úcreate_string_bufferZCFStringGetCStringÚOSErrorÚvalueÚdecode)r Zvalue_as_void_pÚstringÚbufferÚresultr r r
|
Ú_cf_string_to_unicode; s& ÿ
|
ÿ
|
r c C s\ | dkr dS t | d¡}t|}t |¡ |dks:|dkrBd| }|dkrPtj}||dS )z[
|
Checks the return code and throws an exception if there is an error to
|
report
|
r NÚ z OSStatus %s)r ZSecCopyErrorMessageStringr r Ú CFReleaseÚsslÚSSLError)ÚerrorZexception_classZcf_error_stringÚoutputr r r
|
Ú_assert_no_errorT s
|
r' c C sØ | dd¡} dd t | ¡D }|s.t d¡t tjdt tj
|
¡¡}|sTt d¡z`|D ]V}t |}|stt d¡t tj|¡}t |¡ |st d¡t ||¡ t |¡ qZW n tk
|
rÒ t |¡ Y nX |S ) z
|
Given a bundle of certs in PEM format, turns them into a CFArray of certs
|
that can be used to validate a cert chain.
|
s
|
ó
|
c S s g | ]}t | d ¡¡qS )r )Úbase64Ú b64decodeÚgroup)r Úmatchr r r
|
Ú
|
<listcomp>q s z(_cert_array_from_pem.<locals>.<listcomp>z No root certificates specifiedr zUnable to allocate memory!z Unable to build cert object!)ÚreplaceÚ _PEM_CERTS_REÚfinditerr# r$ r ÚCFArrayCreateMutabler r ÚbyrefÚkCFTypeArrayCallBacksr r Z SecCertificateCreateWithDatar" ÚCFArrayAppendValueÚ Exception)Z
|
pem_bundleZ der_certsZ
|
cert_arrayZ der_bytesZcertdataÚcertr r r
|
Ú_cert_array_from_pemi s< ÿ
|
|
ý
|
|
ÿ
|
|
r7 c C s t ¡ }t | ¡|kS )z=
|
Returns True if a given CFTypeRef is a certificate.
|
)r ZSecCertificateGetTypeIDr Ú CFGetTypeID©ÚitemÚexpectedr r r
|
Ú_is_cert s r< c C s t ¡ }t | ¡|kS )z;
|
Returns True if a given CFTypeRef is an identity.
|
)r ZSecIdentityGetTypeIDr r8 r9 r r r
|
Ú _is_identity s r= c
|
C s t d¡} t | dd
¡ d¡}t | dd
¡}t ¡ }t j ||¡ d¡}t
|
¡ }t
|
|t ||ddt |¡¡}t| ||fS )a³
|
This function creates a temporary Mac keychain that we can use to work with
|
credentials. This keychain uses a one-time password and a temporary file to
|
store the data. We expect to have one keychain per socket. The returned
|
SecKeychainRef must be freed by the caller, including calling
|
SecKeychainDelete.
|
|
Returns a tuple of the SecKeychainRef and the path to the temporary
|
directory that contains it.
|
é( Né r F)ÚosÚurandomr) Ú b16encoder ÚtempfileÚmkdtempÚpathÚjoinÚencoder ZSecKeychainRefZSecKeychainCreater r r2 r' )Z random_bytesÚfilenameÚpasswordZ tempdirectoryZ keychain_pathÚkeychainÚstatusr r r
|
Ú_temporary_keychain¦ s
|
ÿrL c C s g }g }d}t |d}| ¡ }W 5 Q R X z²t tj|t|¡}t ¡ }t |ddddd| t
|
|¡¡}t | t |¡} t| D ]X}
|
t ||
|
¡} t
|
| tj¡} t| r¼t | ¡ | | ¡ qt| rt | ¡ | | ¡ qW 5 |rìt |¡ t |¡ X ||fS )zÊ
|
Given a single file, loads all the trust objects from it into arrays and
|
the keychain.
|
Returns a tuple of lists: the first list is a list of identities, the
|
second a list of certs.
|
NÚrbr )ÚopenÚreadr r" r r r Z
|
CFArrayRefr Z SecItemImportr r2 r' ZCFArrayGetCountÚrangeZCFArrayGetValueAtIndexr r r< ZCFRetainÚappendr= ) rJ rE Ú certificatesÚ
|
identitiesZ result_arrayÚfZ raw_filedataZfiledatar Z result_countÚindexr: r r r
|
Ú_load_items_from_fileÉ sJ ÿø
|
|
|
|
|
rV c
|
G sê g }g }dd |D }z°|D ]&}t| |\}}| |¡ | |¡ q |st ¡ }t | |d t
|
|¡¡} t | | |¡ t | d¡¡ t tjdt
|
tj¡¡}
|
t ||¡D ]} t |
|
| ¡ q®|
|
W ¢S t ||¡D ]}t |¡ qÔX dS )zü
|
Load certificates and maybe keys from a number of files. Has the end goal
|
of returning a CFArray containing one SecIdentityRef, and then zero or more
|
SecCertificateRef objects, suitable for use as a client certificate trust
|
chain.
|
c s s | ]}|r|V qd S )Nr )r rE r r r
|
r $ s z*_load_client_cert_chain.<locals>.<genexpr>r N)Ú itertoolsÚchainr r" rV Úextendr ZSecIdentityRefZ SecIdentityCreateWithCertificater r2 r' rQ Úpopr1 r r3 r4 ) rJ ÚpathsrR rS ÚobjÚ file_pathZnew_identitiesZ new_certsZ new_identityrK Z trust_chainr: r r r
|
Ú_load_client_cert_chain s8
|
ÿ
|
|
ýr^ )N)Ú__doc__r) r rW Úrer@ r# rC Zbindingsr r r ÚcompileÚDOTALLr/ r r r r' r7 r< r= rL rV r^ r r r r
|
Ú<module> s, ÿ
|
|
-#7
|
