U ��.e�.�@s�dZddlZddlZddlZddlZddlZddlZddlZddlm Z m Z mZe�dej �Zdd�Zdd �Zd d�Zddd �Zdd�Zdd�Zdd�Zdd�Zdd�Zdd�ZdS)a� Low-level helpers for the SecureTransport bindings. These are Python functions that are not directly related to the high-level APIs but are necessary to get them to work. They include a whole bunch of low-level CoreFoundation messing about and memory management. The concerns in this module are almost entirely about trying to avoid memory leaks and providing appropriate and useful assistance to the higher-level code. �N�)�Security�CoreFoundation�CFConsts;-----BEGIN CERTIFICATE----- (.*?) -----END CERTIFICATE-----cCst�tj|t|��S)zv Given a bytestring, create a CFData object from it. This CFData object must be CFReleased by the caller. )r�CFDataCreate�kCFAllocatorDefault�len)Z bytestring�r �Z/usr/lib/python3.8/site-packages/pip/_vendor/urllib3/contrib/_securetransport/low_level.py�_cf_data_from_bytess �rcCsZt|�}dd�|D�}dd�|D�}tj||�}tj||�}t�tj|||tjtj�S)zK Given a list of Python tuples, create an associated CFDictionary. css|]}|dVqdS)rNr ��.0�tr r r � ,sz-_cf_dictionary_from_tuples..css|]}|dVqdS)rNr rr r r r-s)rr� CFTypeRefZCFDictionaryCreaterZkCFTypeDictionaryKeyCallBacksZkCFTypeDictionaryValueCallBacks)ZtuplesZdictionary_size�keys�valuesZcf_keysZ cf_valuesr r r �_cf_dictionary_from_tuples%s�rcCsnt�|t�tj��}t�|tj�}|dkrXt�d�}t� ||dtj�}|sRt d��|j}|dk rj|�d�}|S)z� Creates a Unicode string from a CFString object. Used entirely for error reporting. Yes, it annoys me quite a lot that this function is this complex. Niz'Error copying C string from CFStringRef�utf-8) �ctypes�castZPOINTERZc_void_prZCFStringGetCStringPtrrZkCFStringEncodingUTF8Zcreate_string_bufferZCFStringGetCString�OSError�value�decode)rZvalue_as_void_p�string�buffer�resultr r r �_cf_string_to_unicode;s&� � rcCs\|dkrdSt�|d�}t|�}t�|�|dks:|dkrBd|}|dkrPtj}||��dS)z[ Checks the return code and throws an exception if there is an error to report rN�zOSStatus %s)rZSecCopyErrorMessageStringrr� CFRelease�ssl�SSLError)�errorZexception_classZcf_error_string�outputr r r �_assert_no_errorTs r$cCs�|�dd�}dd�t�|�D�}|s.t�d��t�tjdt� tj ��}|sTt�d��z`|D]V}t|�}|stt�d��t� tj|�}t�|�|s�t�d��t�||�t�|�qZWntk r�t�|�YnX|S) z� Given a bundle of certs in PEM format, turns them into a CFArray of certs that can be used to validate a cert chain. s � cSsg|]}t�|�d��qS)r)�base64Z b64decode�group)r �matchr r r � qsz(_cert_array_from_pem..zNo root certificates specifiedrzUnable to allocate memory!zUnable to build cert object!)�replace� _PEM_CERTS_RE�finditerr r!r�CFArrayCreateMutablerr�byref�kCFTypeArrayCallBacksrrZSecCertificateCreateWithDatar�CFArrayAppendValue� Exception)Z pem_bundleZ der_certsZ cert_arrayZ der_bytesZcertdataZcertr r r �_cert_array_from_pemis<� � � r2cCst��}t�|�|kS)z= Returns True if a given CFTypeRef is a certificate. )rZSecCertificateGetTypeIDr�CFGetTypeID��itemZexpectedr r r �_is_cert�sr6cCst��}t�|�|kS)z; Returns True if a given CFTypeRef is an identity. )rZSecIdentityGetTypeIDrr3r4r r r �_is_identity�sr7c Cs�t�d�}t�|dd��d�}t�|dd��}t��}tj�||�� d�}t ��}t �|t |�|ddt�|��}t|�||fS)a� This function creates a temporary Mac keychain that we can use to work with credentials. This keychain uses a one-time password and a temporary file to store the data. We expect to have one keychain per socket. The returned SecKeychainRef must be freed by the caller, including calling SecKeychainDelete. Returns a tuple of the SecKeychainRef and the path to the temporary directory that contains it. �(N�rF)�os�urandomr&Z b16encoder�tempfileZmkdtemp�path�join�encoderZSecKeychainRefZSecKeychainCreaterrr.r$)Zrandom_bytes�filenameZpasswordZ tempdirectoryZ keychain_path�keychain�statusr r r �_temporary_keychain�s �rCcCsg}g}d}t|d��}|��}W5QRXz�t�tj|t|��}t��}t� |ddddd|t �|��}t|�t� |�} t| �D]X} t�|| �}t �|tj�}t|�r�t�|�|�|�q�t|�r�t�|�|�|�q�W5|r�t�|�t�|�X||fS)z� Given a single file, loads all the trust objects from it into arrays and the keychain. Returns a tuple of lists: the first list is a list of identities, the second a list of certs. N�rbr)�open�readrrrrrZ CFArrayRefrZ SecItemImportrr.r$ZCFArrayGetCount�rangeZCFArrayGetValueAtIndexrrr6ZCFRetain�appendr7)rAr=�certificates� identitiesZresult_array�fZraw_filedataZfiledatarZresult_count�indexr5r r r �_load_items_from_file�sJ�� rMc Gs�g}g}dd�|D�}z�|D]&}t||�\}}|�|�|�|�q|s�t��}t�||dt � |��} t| �|�|�t�|� d��t�tjdt � tj��} t�||�D]}t�| |�q�| W�St�||�D]}t�|�q�XdS)z� Load certificates and maybe keys from a number of files. Has the end goal of returning a CFArray containing one SecIdentityRef, and then zero or more SecCertificateRef objects, suitable for use as a client certificate trust chain. css|]}|r|VqdS)Nr )r r=r r r r$sz*_load_client_cert_chain..rN)� itertools�chainrrrM�extendrZSecIdentityRefZ SecIdentityCreateWithCertificaterr.r$rH�popr-rr/r0)rA�pathsrIrJ�objZ file_pathZnew_identitiesZ new_certsZnew_identityrBZtrust_chainr5r r r �_load_client_cert_chains8 � �rT)N)�__doc__r&rrN�rer:r r<Zbindingsrrr�compile�DOTALLr+rrrr$r2r6r7rCrMrTr r r r �s, � -#7