3 deb6@sdZddlZddlZddlZddlZddlZddlZddlZddlZddl m Z m Z m Z ej dejZddZdd Zd d Zd d ZddZd#ddZddZddZddZddZddZddZd$d%d&d'd(d Zd!d"ZdS))a Low-level helpers for the SecureTransport bindings. These are Python functions that are not directly related to the high-level APIs but are necessary to get them to work. They include a whole bunch of low-level CoreFoundation messing about and memory management. The concerns in this module are almost entirely about trying to avoid memory leaks and providing appropriate and useful assistance to the higher-level code. N)CFConstCoreFoundationSecuritys;-----BEGIN CERTIFICATE----- (.*?) -----END CERTIFICATE-----cCstjtj|t|S)zv Given a bytestring, create a CFData object from it. This CFData object must be CFReleased by the caller. )r CFDataCreatekCFAllocatorDefaultlen)Z bytestringr a/var/www/agendate/envp3/lib/python3.6/site-packages/urllib3/contrib/_securetransport/low_level.py_cf_data_from_bytessr cCsZt|}dd|D}dd|D}tj||}tj||}tjtj|||tjtjS)zK Given a list of Python tuples, create an associated CFDictionary. css|]}|dVqdS)rNr ).0tr r r ,sz-_cf_dictionary_from_tuples..css|]}|dVqdS)rNr )r r r r r r-s)rr CFTypeRefZCFDictionaryCreaterZkCFTypeDictionaryKeyCallBacksZkCFTypeDictionaryValueCallBacks)ZtuplesZdictionary_sizekeysvaluesZcf_keysZ cf_valuesr r r _cf_dictionary_from_tuples%srcCs tj|}tjtj|tj}|S)zi Given a Python binary data, create a CFString. The string must be CFReleased by the caller. )ctypesc_char_prZCFStringCreateWithCStringrrkCFStringEncodingUTF8)Zpy_bstrZc_strcf_strr r r _cfstr;s  rcCsd}yhtjtjdtjtj}|s*tdx>|D]6}t|}|sHtdztj||Wdtj |Xq0WWn@t k r}z$|rtj |t j d|fWYdd}~XnX|S)z Given a list of Python binary data, create an associated CFMutableArray. The array must be CFReleased by the caller. Raises an ssl.SSLError on failure. NrzUnable to allocate memory!zUnable to allocate array: %s) rCFArrayCreateMutablerrbyrefkCFTypeArrayCallBacks MemoryErrorrCFArrayAppendValue CFRelease BaseExceptionsslSSLError)lstZcf_arritemrer r r _create_cfstring_arrayIs(  "r$cCsntj|tjtj}tj|tj}|dkrXtjd}tj ||dtj}|sRt d|j }|dk rj|j d}|S)z Creates a Unicode string from a CFString object. Used entirely for error reporting. Yes, it annoys me quite a lot that this function is this complex. Niz'Error copying C string from CFStringRefzutf-8) rcastPOINTERc_void_prZCFStringGetCStringPtrrrcreate_string_bufferZCFStringGetCStringOSErrorvaluedecode)r*Zvalue_as_void_pstringbufferresultr r r _cf_string_to_unicodehs   r/cCs\|dkr dStj|d}t|}tj||dks:|dkrBd|}|dkrPtj}||dS)z[ Checks the return code and throws an exception if there is an error to report rNz OSStatus %s)rZSecCopyErrorMessageStringr/rrrr )errorZexception_classZcf_error_stringoutputr r r _assert_no_errors  r3c Cs|jdd}ddtj|D}|s.tjdtjtjdtj tj }|sTtjdydx^|D]V}t |}|svtjdt j tj|}tj||stjdtj||tj|q\WWn tk rtj|YnX|S) z Given a bundle of certs in PEM format, turns them into a CFArray of certs that can be used to validate a cert chain. s  cSsg|]}tj|jdqS)r)base64 b64decodegroup)r matchr r r sz(_cert_array_from_pem..zNo root certificates specifiedrzUnable to allocate memory!zUnable to build cert object!)replace _PEM_CERTS_REfinditerrr rrrrrrr rZSecCertificateCreateWithDatarr Exception)Z pem_bundleZ der_certsZ cert_arrayZ der_bytesZcertdatacertr r r _cert_array_from_pems4          r?cCstj}tj||kS)z= Returns True if a given CFTypeRef is a certificate. )rZSecCertificateGetTypeIDr CFGetTypeID)r"expectedr r r _is_certsrBcCstj}tj||kS)z; Returns True if a given CFTypeRef is an identity. )rZSecIdentityGetTypeIDrr@)r"rAr r r _is_identitysrCcCstjd}tj|ddjd}tj|dd}tj}tjj||j d}t j }t j |t ||ddtj|}t|||fS)a This function creates a temporary Mac keychain that we can use to work with credentials. This keychain uses a one-time password and a temporary file to store the data. We expect to have one keychain per socket. The returned SecKeychainRef must be freed by the caller, including calling SecKeychainDelete. Returns a tuple of the SecKeychainRef and the path to the temporary directory that contains it. (Nzutf-8F)osurandomr5 b16encoder+tempfilemkdtemppathjoinencoderZSecKeychainRefZSecKeychainCreaterrrr3)Z random_bytesfilenamepasswordZ tempdirectoryZ keychain_pathkeychainstatusr r r _temporary_keychains rRc Csg}g}d}t|d}|j}WdQRXztjtj|t|}tj}tj|ddddd|t j |}t |tj |} xdt | D]X} tj|| } t j| tj} t| rtj| |j| qt| rtj| |j| qWWd|rtj|tj|X||fS)z Given a single file, loads all the trust objects from it into arrays and the keychain. Returns a tuple of lists: the first list is a list of identities, the second a list of certs. Nrbr)openreadrrrrZ CFArrayRefrZ SecItemImportrrr3ZCFArrayGetCountrangeZCFArrayGetValueAtIndexr%rrBZCFRetainappendrCr) rPrK certificates identitiesZ result_arrayfZ raw_filedataZfiledatar.Z result_countindexr"r r r _load_items_from_filesB         r\c Gsg}g}dd|D}zx.|D]&}t||\}}|j||j|qW|stj}tj||dtj|}t||j|t j |j dt j t j dtjt j} x tj||D]} t j| | qW| Sxtj||D]} t j | qWXdS)z Load certificates and maybe keys from a number of files. Has the end goal of returning a CFArray containing one SecIdentityRef, and then zero or more SecCertificateRef objects, suitable for use as a client certificate trust chain. css|]}|r|VqdS)Nr )r rKr r r rRsz*_load_client_cert_chain..rN)r\extendrZSecIdentityRefZ SecIdentityCreateWithCertificaterrr3rWrrpoprrr itertoolschainr) rPpathsrXrY file_pathZnew_identitiesZ new_certsZ new_identityrQZ trust_chainr"objr r r _load_client_cert_chain.s0    rd)ZSSLv2ZSSLv3TLSv1zTLSv1.1zTLSv1.2c CsHt|\}}d}d}tjd||}t|}d}tjd|||||}|S)z6 Builds a TLS alert record for an unknown CA. re0z>BBz>BBBH)TLS_PROTOCOL_VERSIONSstructpackr) versionZver_majZver_minZseverity_fatalZdescription_unknown_camsgZmsg_lenZrecord_type_alertrecordr r r _build_tls_unknown_ca_alerts rp)N)rre)rfr)rfr)rfre)rfrf)__doc__r5rr_rFrerrkrIZbindingsrrrcompileDOTALLr;r rrr$r/r3r?rBrCrRr\rdrjrpr r r r  s:   .#7L