Ld\?PdZddlmZddlZddlZddlZddlZddlZddlZddl Z ddl Z ddl Z ddl m Z mZmZmZmZmZmZmZmZmZejdejZddZd?dZd@dZ dAdBdZdCd"Z dDd&Z!dDd'Z"dEd)Z#dFd/Z$dGd1Z%d2d3d4d5d6d7Z&dHd9Z'Gd:d;Z(dS)Ia Low-level helpers for the SecureTransport bindings. These are Python functions that are not directly related to the high-level APIs but are necessary to get them to work. They include a whole bunch of low-level CoreFoundation messing about and memory management. The concerns in this module are almost entirely about trying to avoid memory leaks and providing appropriate and useful assistance to the higher-level code. ) annotationsN) CFArrayCFConstCFData CFDictionaryCFMutableArrayCFString CFTypeRefCoreFoundationSecKeychainRefSecuritys;-----BEGIN CERTIFICATE----- (.*?) -----END CERTIFICATE----- bytestringbytesreturnrc\tjtj|t|S)zv Given a bytestring, create a CFData object from it. This CFData object must be CFReleased by the caller. )r CFDataCreatekCFAllocatorDefaultlen)rs PF:\djangOuth\env\Lib\site-packages\urllib3/contrib/_securetransport/low_level.py_cf_data_from_bytesr)s)  &*JJ  tuples#list[tuple[typing.Any, typing.Any]]rct|}d|D}d|D}tj|z|}tj|z|}tjtj|||tjtjS)zK Given a list of Python tuples, create an associated CFDictionary. c3&K|] }|dV dS)rN.0ts r z-_cf_dictionary_from_tuples..<s& ! !QAaD ! ! ! ! ! !rc3&K|] }|dV dS)rNrrs rr!z-_cf_dictionary_from_tuples..=s& # #qad # # # # # #r)rr r CFDictionaryCreaterkCFTypeDictionaryKeyCallBackskCFTypeDictionaryValueCallBacks)rdictionary_sizekeysvaluescf_keys cf_valuess r_cf_dictionary_from_tuplesr+3s &kkO " !& ! ! !D # #F # # #F'/9DAG)O;fEI  ,*46   rpy_bstrr ctj|}tjtj|t j}|S)zi Given a Python binary data, create a CFString. The string must be CFReleased by the caller. )ctypesc_char_pr CFStringCreateWithCStringrrkCFStringEncodingUTF8)r,c_strcf_strs r_cfstrr4Ks; OG $ $E  5* %F Mrlst list[bytes]r cd} tjtjdtjtj}|st d|D]e}t|}|st d tj||tj |M#tj |wxYwn@#t$r3}|rtj |tj d|dd}~wwxYw|S)z Given a list of Python binary data, create an associated CFMutableArray. The array must be CFReleased by the caller. Raises an ssl.SSLError on failure. NrUnable to allocate memory!zUnable to allocate array: ) r CFArrayCreateMutablerr.byrefkCFTypeArrayCallBacks MemoryErrorr4CFArrayAppendValue CFRelease BaseExceptionsslSSLError)r5cf_arritemr3es r_create_cfstring_arrayrEYs-FG4  . L= > >    <:;; ; 1 1DD\\F @!">??? 11&&AAA(0000(0000 1 GGG  -  $V , , ,l;;;<<$FG Ms0A1B:6B  B: B66B:: C7.C22C7value str | Nonecrtj|tjtj}t j|t j}|Mtjd}t j ||dt j}|std|j }|| d}|S)z Creates a Unicode string from a CFString object. Used entirely for error reporting. Yes, it annoys me quite a lot that this function is this complex. Niz'Error copying C string from CFStringRefutf-8) r.castPOINTERc_void_pr CFStringGetCStringPtrrr1create_string_bufferCFStringGetCStringOSErrorrFdecode)rFvalue_as_void_pstringbufferresults r_cf_string_to_unicoderVxsk%)H)HIIO  16F~,T222 VT7+H   ECDD D w'' Mrerrorintexception_classtype[BaseException] | NoneNonec|dkrdStj|d}t|}tj|||dkrd|}| t j}||)z[ Checks the return code and throws an exception if there is an error to report rNz OSStatus )rSecCopyErrorMessageStringrVr r>r@rA)rWrYcf_error_stringoutputs r_assert_no_errorrasy zz8EEO "? 3 3F_--- ~2$U$$, /& ! !!r pem_bundlerc|dd}dt|D}|stjdt jt jdtj t j }|stjd |D]}t|}|stjdtj t j|}t j||stjdt j||t j|n##t $rt j|wxYw|S)z Given a bundle of certs in PEM format, turns them into a CFArray of certs that can be used to validate a cert chain. s  c\g|])}tj|d*S)r)base64 b64decodegroup)rmatchs r z(_cert_array_from_pem..s:-2Q((rzNo root certificates specifiedrr8zUnable to build cert object!)replace _PEM_CERTS_REfinditerr@rAr r9rr.r:r;rrSecCertificateCreateWithDatar>r= Exception)rb der_certs cert_array der_bytescertdatacerts r_cert_array_from_pemrus ##GU33J6C6L6LZ6X6XI =l;<<<4*  ^9::J 9l7888" + +I*955H Al#?@@@82HD  $X . . . Cl#ABBB  -j$ ? ? ?  $T * * * * +   ,,,  s $BE E!rCr boolcXtj}tj||kS)z= Returns True if a given CFTypeRef is a certificate. )rSecCertificateGetTypeIDr CFGetTypeIDrCexpecteds r_is_certr|s(/11H  %d + +x 77rcXtj}tj||kS)z; Returns True if a given CFTypeRef is an identity. )rSecIdentityGetTypeIDr ryrzs r _is_identityrs(,..H  %d + +x 77rtuple[SecKeychainRef, str]c tjd}tj|ddd}tj|dd}t j}tj|| d}tj }tj |t||ddtj|}t!|||fS)a This function creates a temporary Mac keychain that we can use to work with credentials. This keychain uses a one-time password and a temporary file to store the data. We expect to have one keychain per socket. The returned SecKeychainRef must be freed by the caller, including calling SecKeychainDelete. Returns a tuple of the SecKeychainRef and the path to the temporary directory that contains it. (NrIF)osurandomrf b16encoderQtempfilemkdtemppathjoinencoderr SecKeychainCreaterr.r:ra) random_bytesfilenamepassword tempdirectory keychain_pathkeychainstatuss r_temporary_keychainrs":b>>L RaR 01188AAH QRR 011H$&&MGLL99@@IIM&((H  's8}}htV\(=S=SFV ] ""rrr rstr'tuple[list[CFTypeRef], list[CFTypeRef]]c g}g}d}t|d5}|}dddn #1swxYwY tjtj|t |}tj}tj|ddddd|tj |}t|tj |} t| D]} tj|| } tj| tj} t#| r*tj| || ot)| r)tj| ||  |rtj|tj|n/#|rtj|tj|wxYw||fS)z Given a single file, loads all the trust objects from it into arrays and the keychain. Returns a tuple of lists: the first list is a list of identities, the second a list of certs. Nrbr)openreadr rrr CFArrayRefr SecItemImportr.r:raCFArrayGetCountrangeCFArrayGetValueAtIndexrJr r|CFRetainappendrr>) rr certificates identities result_arrayf raw_filedatafiledatarU result_countindexrCs r_load_items_from_filer s,LJL dD   Qvvxx                $+!.  . c,>O>O  &022 '       L & &       &5lCC <(( ( (E!8uMMD;t^%=>>D~~ ('---##D))))d## ('---!!$''' (  3  $\ 2 2 2 ****  3  $\ 2 2 2 ****  %%s8<<EF77,G#pathscTg}g}d|D} |D]?}t||\}}||||@|stj}tj||dt j|} t| ||tj | dtj tj dt jtj} tj||D]} tj| | | tj||D]} tj | S#tj||D]} tj | wxYw)z Load certificates and maybe keys from a number of files. Has the end goal of returning a CFArray containing one SecIdentityRef, and then zero or more SecCertificateRef objects, suitable for use as a client certificate trust chain. c3K|]}||V dSNr)rrs rr!z*_load_client_cert_chain..fs'55t5d555555rr)rextendrSecIdentityRef SecIdentityCreateWithCertificater.r:rarr r>popr9rr; itertoolschainr=) rrrrfiltered_paths file_pathnew_identities new_certs new_identityr trust_chainrCobjs r_load_client_cert_chainrBs@LJ65u555N"*' + +I(=h (R(R %NI   n - - -    * * * * :#244L>,q/6< +E+EF V $ $ $   l + + +  $\%5%5a%8%8 9 9 9%9  . L= > >  OJ == A AD  -k4 @ @ @ @?:|<< * *C  $S ) ) ) ) *9?:|<< * *C  $S ) ) ) ) *s D:E99.F')r)r)rr)rr)rr)SSLv2SSLv3TLSv1zTLSv1.1zTLSv1.2versionct|\}}d}d}tjd||}t|}d}tjd|||||z}|S)z6 Builds a TLS alert record for an unknown CA. r0z>BBz>BBBH)TLS_PROTOCOL_VERSIONSstructpackr) rver_majver_minseverity_fataldescription_unknown_camsgmsg_lenrecord_type_alertrecords r_build_tls_unknown_ca_alertrsf-W5GWN! +e^-C D DC#hhG ["3Wgw O ORU UF MrceZdZdZdZdZdZdZdZdZ dZ d Z dZ dZ dZdZdZd ZdZd Zd ZdZd ZdZdZdZdZdZdZdZdZdZdZ dZ!dZ"dZ#dZ$dZ%dZ&dZ'dZ(d Z)d!Z*d"Z+d#S)$ SecurityConstzU A class object that acts as essentially a namespace for Security constants. rrrr iriiiiiiiiiiiiiiiiiii iQi,iRN),__name__ __module__ __qualname____doc__"kSSLSessionOptionBreakOnServerAuth kSSLProtocol2 kSSLProtocol3 kTLSProtocol1kTLSProtocol11kTLSProtocol12kTLSProtocol13kTLSProtocolMaxSupportedkSSLClientSidekSSLStreamTypekSecFormatPEMSequencekSecTrustResultInvalidkSecTrustResultProceedkSecTrustResultDenykSecTrustResultUnspecified&kSecTrustResultRecoverableTrustFailure kSecTrustResultFatalTrustFailurekSecTrustResultOtherErrorerrSSLProtocolerrSSLWouldBlockerrSSLClosedGracefulerrSSLClosedNoNotifyerrSSLClosedAborterrSSLXCertChainInvalid errSSLCryptoerrSSLInternalerrSSLCertExpirederrSSLCertNotYetValiderrSSLUnknownRootCerterrSSLNoRootCerterrSSLHostNameMismatcherrSSLPeerHandshakeFailerrSSLPeerUserCancellederrSSLWeakPeerEphemeralDHKeyerrSSLServerAuthCompletederrSSLRecordOverflowerrSecVerifyFailederrSecNoTrustSettingserrSecItemNotFounderrSecInvalidTrustSettingsrrrrrs*+&MMMNNN"NN!"-.*'($ !N  #LN!!"###( % "!'rr)rrrr)rrrr)r,rrr )r5r6rr )rFr rrGr)rWrXrYrZrr[)rbrrr)rCr rrv)rr)rr rrrr)rr rrGrr)rrrr))r __future__rrfr.rrrer@rrtypingbindingsrrrrr r r r r rcompileDOTALLrlrr+r4rErVrarur|rrrrrrrrrrr sr#"""""                            Dbi 0    >4?C""""".++++\88888888 # # # #F6&6&6&6&rH*H*H*H*X       6(6(6(6(6(6(6(6(6(6(r