3
nf�\�/ � @ s� d Z ddlZddlZddlZddlZddlZddlZddlZddlm Z m
Z
m Z ej dej
�Zdd� Zdd � Zd
d � Zdd d
�Zdd� Zdd� Zdd� Zdd� Zdd� Zdd� ZdS )a�
Low-level helpers for the SecureTransport bindings.
These are Python functions that are not directly related to the high-level APIs
but are necessary to get them to work. They include a whole bunch of low-level
CoreFoundation messing about and memory management. The concerns in this module
are almost entirely about trying to avoid memory leaks and providing
appropriate and useful assistance to the higher-level code.
� N� )�Security�CoreFoundation�CFConsts; -----BEGIN CERTIFICATE-----
(.*?)
-----END CERTIFICATE-----c C s t jt j| t| ��S )zv
Given a bytestring, create a CFData object from it. This CFData object must
be CFReleased by the caller.
)r � CFDataCreate�kCFAllocatorDefault�len)Z
bytestring� r � /usr/lib/python3.6/low_level.py�_cf_data_from_bytes s r c C sZ t | �}dd� | D �}dd� | D �}tj| |� }tj| |� }tjtj|||tjtj�S )zK
Given a list of Python tuples, create an associated CFDictionary.
c s s | ]}|d V qdS )r Nr )�.0�tr r r
� <genexpr>, s z-_cf_dictionary_from_tuples.<locals>.<genexpr>c s s | ]}|d V qdS )r Nr )r r
r r r
r - s )r r � CFTypeRefZCFDictionaryCreater Z kCFTypeDictionaryKeyCallBacksZ kCFTypeDictionaryValueCallBacks)ZtuplesZdictionary_size�keys�valuesZcf_keysZ cf_valuesr r r
�_cf_dictionary_from_tuples% s r c C sn t j| t jt j��}tj|tj�}|dkrXt jd�}tj ||dtj�}|sRt
d��|j }|dk rj|j d�}|S )z�
Creates a Unicode string from a CFString object. Used entirely for error
reporting.
Yes, it annoys me quite a lot that this function is this complex.
Ni z'Error copying C string from CFStringRefzutf-8)
�ctypes�castZPOINTERZc_void_pr ZCFStringGetCStringPtrr ZkCFStringEncodingUTF8Zcreate_string_bufferZCFStringGetCString�OSError�value�decode)r Zvalue_as_void_p�string�buffer�resultr r r
�_cf_string_to_unicode; s"
r c C s\ | dkr dS t j| d�}t|�}tj|� |dks:|dkrBd| }|dkrPtj}||��dS )z[
Checks the return code and throws an exception if there is an error to
report
r N� z OSStatus %s)r ZSecCopyErrorMessageStringr r � CFRelease�ssl�SSLError)�errorZexception_classZcf_error_string�outputr r r
�_assert_no_errorX s
r" c C s� | j dd�} dd� tj| �D �}|s.tjd��tjtjdtj tj
��}|sTtjd��ydx^|D ]V}t |�}|svtjd��t j
tj|�}tj|� |s�tjd��tj||� tj|� q\W W n tk
r� tj|� Y nX |S ) z�
Given a bundle of certs in PEM format, turns them into a CFArray of certs
that can be used to validate a cert chain.
s
�
c S s g | ]}t j|jd ���qS )r )�base64Z b64decode�group)r �matchr r r
�
<listcomp>v s z(_cert_array_from_pem.<locals>.<listcomp>z No root certificates specifiedr zUnable to allocate memory!z Unable to build cert object!)�replace�
_PEM_CERTS_RE�finditerr r r �CFArrayCreateMutabler r �byref�kCFTypeArrayCallBacksr r Z SecCertificateCreateWithDatar �CFArrayAppendValue� Exception)Z
pem_bundleZ der_certsZ
cert_arrayZ der_bytesZcertdataZcertr r r
�_cert_array_from_pemm s4
r0 c C s t j� }tj| �|kS )z=
Returns True if a given CFTypeRef is a certificate.
)r ZSecCertificateGetTypeIDr � CFGetTypeID)�item�expectedr r r
�_is_cert� s r4 c C s t j� }tj| �|kS )z;
Returns True if a given CFTypeRef is an identity.
)r ZSecIdentityGetTypeIDr r1 )r2 r3 r r r
� _is_identity� s r5 c C s� t jd�} tj| dd� �jd�}tj| dd� �}tj� }t jj||�j d�}t
j � }t
j |t
|�|ddtj|��}t|� ||fS )a�
This function creates a temporary Mac keychain that we can use to work with
credentials. This keychain uses a one-time password and a temporary file to
store the data. We expect to have one keychain per socket. The returned
SecKeychainRef must be freed by the caller, including calling
SecKeychainDelete.
Returns a tuple of the SecKeychainRef and the path to the temporary
directory that contains it.
�( N� zutf-8F)�os�urandomr$ Z b16encoder �tempfileZmkdtemp�path�join�encoder ZSecKeychainRefZSecKeychainCreater r r, r" )Z random_bytes�filenameZpasswordZ
tempdirectoryZ
keychain_path�keychain�statusr r r
�_temporary_keychain� s
rA c C s g }g }d}t |d��}|j� }W dQ R X z�tjtj|t|��}tj� }tj|ddddd| t j
|��}t |� tj |�} xdt
| �D ]X}
tj||
�} t j| tj�} t| �r�tj| � |j| � q�t| �r�tj| � |j| � q�W W d|r�tj|� tj|� X ||fS )z�
Given a single file, loads all the trust objects from it into arrays and
the keychain.
Returns a tuple of lists: the first list is a list of identities, the
second a list of certs.
N�rbr )�open�readr r r r Z
CFArrayRefr Z
SecItemImportr r, r" ZCFArrayGetCount�rangeZCFArrayGetValueAtIndexr r r4 ZCFRetain�appendr5 r ) r? r; � certificates�
identitiesZ result_array�fZ raw_filedataZfiledatar Z result_count�indexr2 r r r
�_load_items_from_file� sH
rK c G s� g }g }dd� |D �}z�x.|D ]&}t | |�\}}|j|� |j|� q W |s�tj� }tj| |d tj|��}t|� |j|� t j
|j d�� t j t j
dtjt j��} x tj||�D ]}
t j| |
� q�W | S x tj||�D ]} t j
| � q�W X dS )z�
Load certificates and maybe keys from a number of files. Has the end goal
of returning a CFArray containing one SecIdentityRef, and then zero or more
SecCertificateRef objects, suitable for use as a client certificate trust
chain.
c s s | ]}|r|V qd S )Nr )r r; r r r
r 2 s z*_load_client_cert_chain.<locals>.<genexpr>r N)rK �extendr ZSecIdentityRefZ SecIdentityCreateWithCertificater r, r" rF r r �popr+ r r- � itertools�chainr. ) r? �pathsrG rH Z file_pathZnew_identitiesZ new_certsZ new_identityr@ Z trust_chainr2 �objr r r
�_load_client_cert_chain s6
rR )N)�__doc__r$ r rN �rer8 r r: Zbindingsr r r �compile�DOTALLr) r r r r" r0 r4 r5 rA rK rR r r r r
�<module> s(
.(;