관리-도구
편집 파일: low_level.cpython-37.pyc
B ��`T6 � @ s� d Z ddlZddlZddlZddlZddlZddlZddlZddlZddl m Z m Z m Z e� dej�Zdd� Zdd � Zd d � Zd d � Zdd� Zd&dd�Zdd� Zdd� Zdd� Zdd� Zdd� Zd d � Zd d d d!d"d#�Z d$d%� Z dS )'a� Low-level helpers for the SecureTransport bindings. These are Python functions that are not directly related to the high-level APIs but are necessary to get them to work. They include a whole bunch of low-level CoreFoundation messing about and memory management. The concerns in this module are almost entirely about trying to avoid memory leaks and providing appropriate and useful assistance to the higher-level code. � N� )�CFConst�CoreFoundation�Securitys; -----BEGIN CERTIFICATE----- (.*?) -----END CERTIFICATE-----c C s t �t j| t| ��S )zv Given a bytestring, create a CFData object from it. This CFData object must be CFReleased by the caller. )r � CFDataCreate�kCFAllocatorDefault�len)Z bytestring� r �[/opt/alt/python37/lib/python3.7/site-packages/urllib3/contrib/_securetransport/low_level.py�_cf_data_from_bytes s r c C sZ t | �}dd� | D �}dd� | D �}tj| |� }tj| |� }t�tj|||tjtj�S )zK Given a list of Python tuples, create an associated CFDictionary. c s s | ]}|d V qdS )r Nr )�.0�tr r r � <genexpr>, s z-_cf_dictionary_from_tuples.<locals>.<genexpr>c s s | ]}|d V qdS )r Nr )r r r r r r - s )r r � CFTypeRefZCFDictionaryCreater Z kCFTypeDictionaryKeyCallBacksZ kCFTypeDictionaryValueCallBacks)ZtuplesZdictionary_size�keys�valuesZcf_keysZ cf_valuesr r r �_cf_dictionary_from_tuples% s r c C s t �| �}t�tj|tj�}|S )zi Given a Python binary data, create a CFString. The string must be CFReleased by the caller. )�ctypes�c_char_pr ZCFStringCreateWithCStringr r �kCFStringEncodingUTF8)Zpy_bstrZc_str�cf_strr r r �_cfstr; s r c C s� d}yht �t jdt�t j��}|s*td��x>| D ]6}t|�}|sHtd��zt �||� W dt � |� X q0W W n@ t k r� } z"|r�t � |� t � d|f ��W dd}~X Y nX |S )z� Given a list of Python binary data, create an associated CFMutableArray. The array must be CFReleased by the caller. Raises an ssl.SSLError on failure. Nr zUnable to allocate memory!z Unable to allocate array: %s) r �CFArrayCreateMutabler r �byref�kCFTypeArrayCallBacks� MemoryErrorr �CFArrayAppendValue� CFRelease� BaseException�ssl�SSLError)�lstZcf_arr�itemr �er r r �_create_cfstring_arrayI s( "r$ c C sn t �| t �t j��}t�|tj�}|dkrXt �d�}t� ||dtj�}|sRt d��|j }|dk rj|� d�}|S )z� Creates a Unicode string from a CFString object. Used entirely for error reporting. Yes, it annoys me quite a lot that this function is this complex. Ni z'Error copying C string from CFStringRefzutf-8) r �cast�POINTER�c_void_pr ZCFStringGetCStringPtrr r �create_string_bufferZCFStringGetCString�OSError�value�decode)r* Zvalue_as_void_p�string�buffer�resultr r r �_cf_string_to_unicodeh s r/ c C s\ | dkr dS t �| d�}t|�}t�|� |dks:|dkrBd| }|dkrPtj}||��dS )z[ Checks the return code and throws an exception if there is an error to report r N� z OSStatus %s)r ZSecCopyErrorMessageStringr/ r r r r )�errorZexception_classZcf_error_string�outputr r r �_assert_no_error� s r3 c C s� | � dd�} dd� t�| �D �}|s.t�d��t�tjdt� tj ��}|sTt�d��ydx^|D ]V}t |�}|svt�d��t � tj|�}t�|� |s�t�d��t�||� t�|� q\W W n tk r� t�|� Y nX |S ) z� Given a bundle of certs in PEM format, turns them into a CFArray of certs that can be used to validate a cert chain. s � c S s g | ]}t �|�d ���qS )r )�base64� b64decode�group)r �matchr r r � <listcomp>� s z(_cert_array_from_pem.<locals>.<listcomp>z No root certificates specifiedr zUnable to allocate memory!z Unable to build cert object!)�replace� _PEM_CERTS_RE�finditerr r r r r r r r r r Z SecCertificateCreateWithDatar r � Exception)Z pem_bundleZ der_certsZ cert_arrayZ der_bytesZcertdataZcertr r r �_cert_array_from_pem� s2 r> c C s t �� }t�| �|kS )z= Returns True if a given CFTypeRef is a certificate. )r ZSecCertificateGetTypeIDr � CFGetTypeID)r" �expectedr r r �_is_cert� s rA c C s t �� }t�| �|kS )z; Returns True if a given CFTypeRef is an identity. )r ZSecIdentityGetTypeIDr r? )r" r@ r r r � _is_identity� s rB c C s� t �d�} t�| dd� ��d�}t�| dd� �}t�� }t j�||�� d�}t � � }t � |t |�|ddt�|��}t|� ||fS )a� This function creates a temporary Mac keychain that we can use to work with credentials. This keychain uses a one-time password and a temporary file to store the data. We expect to have one keychain per socket. The returned SecKeychainRef must be freed by the caller, including calling SecKeychainDelete. Returns a tuple of the SecKeychainRef and the path to the temporary directory that contains it. �( N� zutf-8F)�os�urandomr5 � b16encoder+ �tempfile�mkdtemp�path�join�encoder ZSecKeychainRefZSecKeychainCreater r r r3 )Z random_bytes�filename�passwordZ tempdirectoryZ keychain_path�keychain�statusr r r �_temporary_keychain� s rQ c C s g }g }d}t |d��}|�� }W dQ R X z�t�tj|t|��}t�� }t�|ddddd| t � |��}t |� t� |�} xdt | �D ]X} t�|| �} t �| tj�} t| �r�t�| � |�| � q�t| �r�t�| � |�| � q�W W d|r�t�|� t�|� X ||fS )z� Given a single file, loads all the trust objects from it into arrays and the keychain. Returns a tuple of lists: the first list is a list of identities, the second a list of certs. N�rbr )�open�readr r r r Z CFArrayRefr Z SecItemImportr r r3 ZCFArrayGetCount�rangeZCFArrayGetValueAtIndexr% r rA ZCFRetain�appendrB r ) rO rJ � certificates� identitiesZ result_array�fZ raw_filedataZfiledatar. Z result_count�indexr" r r r �_load_items_from_file� sB r[ c G s� g }g }dd� |D �}z�x.|D ]&}t | |�\}}|�|� |�|� q W |s�t�� }t�| |d t�|��}t|� |�|� t � |� d�� t � t j dt�t j��} x t�||�D ]} t �| | � q�W | S x t�||�D ]} t � | � q�W X dS )z� Load certificates and maybe keys from a number of files. Has the end goal of returning a CFArray containing one SecIdentityRef, and then zero or more SecCertificateRef objects, suitable for use as a client certificate trust chain. c s s | ]}|r|V qd S )Nr )r rJ r r r r Q s z*_load_client_cert_chain.<locals>.<genexpr>r N)r[ �extendr ZSecIdentityRefZ SecIdentityCreateWithCertificater r r3 rV r r �popr r r � itertools�chainr ) rO �pathsrW rX � file_pathZnew_identitiesZ new_certsZ new_identityrP Z trust_chainr" �objr r r �_load_client_cert_chain- s0 rc )r � )� r )re r )re rd )re re )ZSSLv2ZSSLv3ZTLSv1zTLSv1.1zTLSv1.2c C sH t | \}}d}d}t�d||�}t|�}d}t�d||||�| }|S )z6 Builds a TLS alert record for an unknown CA. rd �0 z>BB� z>BBBH)�TLS_PROTOCOL_VERSIONS�struct�packr ) �versionZver_majZver_minZseverity_fatalZdescription_unknown_ca�msgZmsg_lenZrecord_type_alert�recordr r r �_build_tls_unknown_ca_alert� s rn )N) �__doc__r5 r r^ rE �rer ri rH Zbindingsr r r �compile�DOTALLr; r r r r$ r/ r3 r> rA rB rQ r[ rc rh rn r r r r �<module> s: -#7L