ó
•abc @ sì d Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l m Z m
Z
m Z e j d e j
ƒ Z d „ Z d „ Z d „ Z d d „ Z d
„ Z d „ Z d „ Z d
„ Z d „ Z d „ Z d S( s¦
Low-level helpers for the SecureTransport bindings.
These are Python functions that are not directly related to the high-level APIs
but are necessary to get them to work. They include a whole bunch of low-level
CoreFoundation messing about and memory management. The concerns in this module
are almost entirely about trying to avoid memory leaks and providing
appropriate and useful assistance to the higher-level code.
iÿÿÿÿNi ( t Securityt CoreFoundationt CFConsts; -----BEGIN CERTIFICATE-----
(.*?)
-----END CERTIFICATE-----c C s t j t j | t | ƒ ƒ S( sv
Given a bytestring, create a CFData object from it. This CFData object must
be CFReleased by the caller.
( R t CFDataCreatet kCFAllocatorDefaultt len( t
bytestring( ( sZ /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/_securetransport/low_level.pyt _cf_data_from_bytes s c C sw t | ƒ } d „ | Dƒ } d „ | Dƒ } t j | | Œ } t j | | Œ } t j t j | | | t j t j ƒ S( sK
Given a list of Python tuples, create an associated CFDictionary.
c s s | ] } | d Vq d S( i N( ( t .0t t( ( sZ /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/_securetransport/low_level.pys , s c s s | ] } | d Vq d S( i N( ( R R ( ( sZ /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/_securetransport/low_level.pys - s ( R R t CFTypeReft CFDictionaryCreateR t kCFTypeDictionaryKeyCallBackst kCFTypeDictionaryValueCallBacks( t tuplest dictionary_sizet keyst valuest cf_keyst cf_values( ( sZ /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/_securetransport/low_level.pyt _cf_dictionary_from_tuples% s c C s¬ t j | t j t j ƒ ƒ } t j | t j ƒ } | d k rŠ t j d ƒ } t j
| | d t j ƒ } | s~ t d ƒ ‚ n | j } n | d k r¨ | j
d ƒ } n | S( s¨
Creates a Unicode string from a CFString object. Used entirely for error
reporting.
Yes, it annoys me quite a lot that this function is this complex.
i s' Error copying C string from CFStringRefs utf-8N( t ctypest castt POINTERt c_void_pR t CFStringGetCStringPtrR t kCFStringEncodingUTF8t Nonet create_string_buffert CFStringGetCStringt OSErrort valuet decode( R t value_as_void_pt stringt buffert result( ( sZ /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/_securetransport/low_level.pyt _cf_string_to_unicode; s" c C sˆ | d k r d St j | d ƒ } t | ƒ } t j | ƒ | d k sS | d k r` d | } n | d k rx t j } n | | ƒ ‚ d S( s[
Checks the return code and throws an exception if there is an error to
report
i Nu u OSStatus %s( R t SecCopyErrorMessageStringR R% R t CFReleaset sslt SSLError( t errort exception_classt cf_error_stringt output( ( sZ /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/_securetransport/low_level.pyt _assert_no_errorX s
c C s= g t j | ƒ D] } t j | j d ƒ ƒ ^ q } | sL t j d ƒ ‚ n t j t j d t
j t j ƒ ƒ } | sˆ t j d ƒ ‚ n y x‰ | D] } t
| ƒ } | s¼ t j d ƒ ‚ n t j t j | ƒ } t j | ƒ | sö t j d ƒ ‚ n t j | | ƒ t j | ƒ q’ WWn t k
r8t j | ƒ n X| S( s‚
Given a bundle of certs in PEM format, turns them into a CFArray of certs
that can be used to validate a cert chain.
i s No root certificates specifiedi s Unable to allocate memory!s Unable to build cert object!( t
_PEM_CERTS_REt finditert base64t b64decodet groupR( R) R t CFArrayCreateMutableR R t byreft kCFTypeArrayCallBacksR R t SecCertificateCreateWithDataR' t CFArrayAppendValuet Exception( t
pem_bundlet matcht der_certst
cert_arrayt der_bytest certdatat cert( ( sZ /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/_securetransport/low_level.pyt _cert_array_from_pemm s2 1
c C s t j ƒ } t j | ƒ | k S( s=
Returns True if a given CFTypeRef is a certificate.
( R t SecCertificateGetTypeIDR t CFGetTypeID( t itemt expected( ( sZ /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/_securetransport/low_level.pyt _is_cert˜ s c C s t j ƒ } t j | ƒ | k S( s;
Returns True if a given CFTypeRef is an identity.
( R t SecIdentityGetTypeIDR RC ( RD RE ( ( sZ /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/_securetransport/low_level.pyt _is_identity s c C sµ t j d ƒ } t j | d ƒ j d ƒ } t j | d ƒ } t j ƒ } t j j | | ƒ j d ƒ } t
j ƒ } t
j | t
| ƒ | t d t j | ƒ ƒ } t | ƒ | | f S( s³
This function creates a temporary Mac keychain that we can use to work with
credentials. This keychain uses a one-time password and a temporary file to
store the data. We expect to have one keychain per socket. The returned
SecKeychainRef must be freed by the caller, including calling
SecKeychainDelete.
Returns a tuple of the SecKeychainRef and the path to the temporary
directory that contains it.
i( i s utf-8N( t ost urandomR1 t b64encodeR t tempfilet mkdtempt patht joint encodeR t SecKeychainReft SecKeychainCreateR t FalseR R R5 R. ( t random_bytest filenamet passwordt
tempdirectoryt
keychain_patht keychaint status( ( sZ /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/_securetransport/low_level.pyt _temporary_keychain¨ s
c C sk g } g } d } t | d ƒ } | j ƒ } Wd QXzt j t j | t | ƒ ƒ } t j ƒ } t j | d d d d d | t
j | ƒ ƒ } t | ƒ t j
| ƒ } x t | ƒ D] }
t j | |
ƒ } t
j | t j ƒ } t | ƒ r t j | ƒ | j | ƒ q¶ t | ƒ r¶ t j | ƒ | j | ƒ q¶ q¶ WWd | rSt j | ƒ n t j | ƒ X| | f S( sÊ
Given a single file, loads all the trust objects from it into arrays and
the keychain.
Returns a tuple of lists: the first list is a list of identities, the
second a list of certs.
t rbNi ( R t opent readR R R R t
CFArrayRefR t
SecItemImportR R5 R. t CFArrayGetCountt ranget CFArrayGetValueAtIndexR R
RF t CFRetaint appendRH R' ( RY RN t certificatest
identitiest result_arrayt ft raw_filedatat filedataR$ t result_countt indexRD ( ( sZ /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/_securetransport/low_level.pyt _load_items_from_fileÐ sH
c G sK g } g } d „ | Dƒ } zý x= | D]5 } t | | ƒ \ } } | j | ƒ | j | ƒ q& W| sà t j ƒ } t j | | d t j | ƒ ƒ } t | ƒ | j | ƒ t j
| j d ƒ ƒ n t j t j
d t j t j ƒ ƒ } x* t j | | ƒ D] }
t j | |
ƒ qú W| SWd x' t j | | ƒ D] } t j
| ƒ q/WXd S( sü
Load certificates and maybe keys from a number of files. Has the end goal
of returning a CFArray containing one SecIdentityRef, and then zero or more
SecCertificateRef objects, suitable for use as a client certificate trust
chain.
c s s | ] } | r | Vq d S( N( ( R RN ( ( sZ /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/_securetransport/low_level.pys / s i N( Rn t extendR t SecIdentityReft SecIdentityCreateWithCertificateR R5 R. Re R R' t popR4 R R6 t itertoolst chainR8 ( RY t pathsRf Rg t file_patht new_identitiest new_certst new_identityRZ t trust_chainRD t obj( ( sZ /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/_securetransport/low_level.pyt _load_client_cert_chain s6
( t __doc__R1 R Rs t reRI R( RL t bindingsR R R t compilet DOTALLR/ R R R% R R. RA RF RH R[ Rn R| ( ( ( sZ /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/_securetransport/low_level.pyt s(
+ ( ;