3
rpY%w              1   @   s  d Z ddlmZ ddlZddlZddlZddlZddlZddl	Z	ddl
Z
ddlZddlZddlmZ ddlmZmZmZ ddlmZmZmZmZ ydd	l	mZ W n$ ek
r   dZdd
lmZ Y nX yed W n ek
r   edY nX ddgZdZejZ ej!j"Z#ej$ Z%ej& Z'dZ(ej)ej*ej+ej,ej-ej.ej/ej0ej1ej2ej3ej4ej5ej6ej7ej8ej9ej:ej;ej<ej=ej>ej?ej@ejAejBejCejDejEejFejGejHejIg!ZJe
jKejLejMfiZNeOe
drejPejPfeNe
jQ< eOe
drejRejRfeNe
jS< eOe
drejLejLfeNe
jT< eOe
dr0ejUejUfeNe
jV< eOe
drNejMejMfeNe
jW< eOe
drjeNe
jK eNe
jX< dd ZYdd ZZdd Z[dd Z\ej]e[Z^ej_e\Z`G dd deaZberd&dd Zcn
d'd"d Zceceb_cG d#d$ d$eaZddS )(aU  
SecureTranport support for urllib3 via ctypes.

This makes platform-native TLS available to urllib3 users on macOS without the
use of a compiler. This is an important feature because the Python Package
Index is moving to become a TLSv1.2-or-higher server, and the default OpenSSL
that ships with macOS is not capable of doing TLSv1.2. The only way to resolve
this is to give macOS users an alternative solution to the problem, and that
solution is to use SecureTransport.

We use ctypes here because this solution must not require a compiler. That's
because pip is not allowed to require a compiler either.

This is not intended to be a seriously long-term solution to this problem.
The hope is that PEP 543 will eventually solve this issue for us, at which
point we can retire this contrib module. But in the short term, we need to
solve the impending tire fire that is Python on Mac without this kind of
contrib module. So...here we are.

To use this module, simply import and inject it::

    import urllib3.contrib.securetransport
    urllib3.contrib.securetransport.inject_into_urllib3()

Happy TLSing!
    )absolute_importN   )util   )SecuritySecurityConstCoreFoundation)_assert_no_error_cert_array_from_pem_temporary_keychain_load_client_cert_chain)_fileobject)backport_makefile    z5SecureTransport only works on Pythons with memoryviewinject_into_urllib3extract_from_urllib3Ti @  PROTOCOL_SSLv2PROTOCOL_SSLv3PROTOCOL_TLSv1PROTOCOL_TLSv1_1PROTOCOL_TLSv1_2PROTOCOL_TLSc               C   s(   t tj_tt_ttj_dt_dtj_dS )zG
    Monkey-patch urllib3 with SecureTransport-backed SSL-support.
    TN)SecureTransportContextr   ssl_
SSLContextHAS_SNIIS_SECURETRANSPORT r   r   A/usr/lib/python3/dist-packages/urllib3/contrib/securetransport.pyr      s
    c               C   s(   t tj_tt_ttj_dt_dtj_dS )z>
    Undo monkey-patching by :func:`inject_into_urllib3`.
    FN)orig_util_SSLContextr   r   r   orig_util_HAS_SNIr   r   r   r   r   r   r      s
    c             C   sl  d}y,t j| }|dkr tjS |j}|d }|j }d}d}tj| j|}	t	|	}
ylxf||k r|dksr|dkrt
j|g|}|stjtjd|j|
|| }||7 }|sZ|stjS P qZW W nT tjk
r } z4|j}|dk	o|tjkr|tjkrtjS  W Y dd}~X nX ||d< ||kr0tjS dS  tk
rf } z|dk	rV||_tjS d}~X nX dS )zs
    SecureTransport read callback. This is called by ST to request that data
    be returned from the socket.
    Nr   z	timed out)_connection_refsgetr   errSSLInternalsocket
gettimeoutctypesc_charZfrom_address
memoryviewr   Zwait_for_readerrorerrnoEAGAIN	recv_intoerrSSLClosedGraceful
ECONNRESETerrSSLClosedAborterrSSLWouldBlock	Exception
_exception)connection_iddata_bufferdata_length_pointerwrapped_socketbase_socketZrequested_lengthtimeoutr)   Z
read_countbufferZbuffer_viewZ	readablesZ
chunk_sizeer   r   r   _read_callback   sN    




r;   c             C   sN  d}yt j| }|dkr tjS |j}|d }tj||}|j }d}d}	y`xZ|	|k r|dksf|dkrtj	|g|}
|
stj
tjd|j|}|	|7 }	||d }qNW W nN tj
k
r } z0|j}|dk	r|tjkr|tjkrtjS  W Y dd}~X nX |	|d< |	|krtjS dS  tk
rH } z|dk	r8||_tjS d}~X nX dS )zx
    SecureTransport write callback. This is called by ST to request that data
    actually be sent on the network.
    Nr   z	timed out)r!   r"   r   r#   r$   r&   	string_atr%   r   Zwait_for_writer)   r*   r+   sendr.   r/   r0   r1   r2   )r3   r4   r5   r6   r7   Zbytes_to_writedatar8   r)   sentZ	writablesZ
chunk_sentr:   r   r   r   _write_callback   sD    





r@   c               @   s   e Zd ZdZdd Zejdd Zdd Zdd	 Z	d
d Z
dd Zdd Zdd Zd(ddZdd Zdd Zdd Zdd Zdd Zdd  Zd)d"d#Zd$d% Zd&d' ZdS )*WrappedSocketz
    API-compatibility wrapper for Python's OpenSSL wrapped socket object.

    Note: _makefile_refs, _drop(), and _reuse() are needed for the garbage
    collector of PyPy.
    c             C   sL   || _ d | _d| _d| _d | _d | _d | _d | _| j j | _	| j j
d d S )Nr   F)r$   context_makefile_refs_closedr2   	_keychain_keychain_dir_client_cert_chainr%   _timeout
settimeout)selfr$   r   r   r   __init__.  s    zWrappedSocket.__init__c             c   s4   d| _ dV  | j dk	r0| j d }| _ | j  |dS )a]  
        A context manager that can be used to wrap calls that do I/O from
        SecureTransport. If any of the I/O callbacks hit an exception, this
        context manager will correctly propagate the exception after the fact.
        This avoids silently swallowing those exceptions.

        It also correctly forces the socket closed.
        N)r2   close)rJ   Z	exceptionr   r   r   _raise_on_error@  s    

zWrappedSocket._raise_on_errorc             C   s2   t jtt t }t j| j|tt}t| dS )a4  
        Sets up the allowed ciphers. By default this matches the set in
        util.ssl_.DEFAULT_CIPHERS, at least as supported by macOS. This is done
        custom and doesn't allow changing at this time, mostly because parsing
        OpenSSL cipher strings is going to be a freaking nightmare.
        N)r   ZSSLCipherSuitelenCIPHER_SUITESZSSLSetEnabledCiphersrB   r	   )rJ   ciphersresultr   r   r   _set_ciphersU  s    zWrappedSocket._set_ciphersc       	      C   s  |sdS t jj|r2t|d}|j }W dQ R X d}tj }zt|}tj| j	t
j|}t| |srtjdtj||}t| tj|d}t| tj }tj|t
j|}t| W d|rtj| |dkrtj| X tjtjf}|j|kr
tjd|j dS )z
        Called when we have set custom validation. We do this in two cases:
        first, when cert validation is entirely disabled; and second, when
        using a custom trust DB.
        NrbzFailed to copy trust referenceTz)certificate verify failed, error code: %d)ospathisfileopenreadr   SecTrustRefr
   SSLCopyPeerTrustrB   r&   byrefr	   sslZSSLErrorZSecTrustSetAnchorCertificatesZ!SecTrustSetAnchorCertificatesOnlyZSecTrustResultTypeZSecTrustEvaluater   	CFReleaser   ZkSecTrustResultUnspecifiedZkSecTrustResultProceedvalue)	rJ   verifytrust_bundlefZ
cert_arraytrustrQ   Ztrust_resultZ	successesr   r   r   _custom_validateb  s@    

zWrappedSocket._custom_validatec	             C   s  t jdtjtj| _t j| jtt}	t	|	 t
4 t| d }
x|
tkrV|
d d }
q@W | t|
< W dQ R X t j| j|
}	t	|	 |rt|ts|jd}t j| j|t|}	t	|	 | j  t j| j|}	t	|	 t j| j|}	t	|	 | s|dk	rt j| jtjd}	t	|	 |rNt \| _| _t| j||| _t j| j| j}	t	|	 xf| j R t j| j}	|	tj kr~t!j"dn(|	tj#kr| j$|| wPn
t	|	 P W dQ R X qPW dS )z
        Actually performs the TLS handshake. This is run automatically by
        wrapped socket, and shouldn't be needed in user code.
        Nir   zutf-8Tzhandshake timed out)%r   ZSSLCreateContextr   ZkSSLClientSideZkSSLStreamTyperB   ZSSLSetIOFuncs_read_callback_pointer_write_callback_pointerr	   _connection_ref_lockidr!   ZSSLSetConnection
isinstancebytesencodeZSSLSetPeerDomainNamerN   rR   ZSSLSetProtocolVersionMinZSSLSetProtocolVersionMaxZSSLSetSessionOptionZ"kSSLSessionOptionBreakOnServerAuthr   rE   rF   r   rG   ZSSLSetCertificaterM   ZSSLHandshaker0   r$   r8   ZerrSSLServerAuthCompletedrc   )rJ   server_hostnamer_   r`   Zmin_versionZmax_versionZclient_certZ
client_keyZclient_key_passphraserQ   Zhandler   r   r   	handshake  s\    



zWrappedSocket.handshakec             C   s
   | j j S )N)r$   fileno)rJ   r   r   r   rm     s    zWrappedSocket.filenoc             C   s*   | j dkr|  j d8  _ | jr&| j  d S )Nr   r   )rC   rD   rL   )rJ   r   r   r   _decref_socketios  s    
zWrappedSocket._decref_socketiosc             C   s&   t j|}| j||}|d | }|S )N)r&   Zcreate_string_bufferr,   )rJ   Zbufsizr9   Z
bytes_readr>   r   r   r   recv  s    
zWrappedSocket.recvNc             C   s   | j r
dS |d krt|}tj| j|}tjd}| j  tj| j	||tj
|}W d Q R X |tjkr|jdkrtjdn"|tjtjfkr| j  nt| |jS )Nr   zrecv timed out)rD   rN   r&   r'   Zfrom_bufferc_size_trM   r   ZSSLReadrB   r[   r   r0   r^   r$   r8   r-   ZerrSSLClosedNoNotifyrL   r	   )rJ   r9   nbytesprocessed_bytesrQ   r   r   r   r,   
  s     




zWrappedSocket.recv_intoc             C   s
   || _ d S )N)rH   )rJ   r8   r   r   r   rI   2  s    zWrappedSocket.settimeoutc             C   s   | j S )N)rH   )rJ   r   r   r   r%   5  s    zWrappedSocket.gettimeoutc             C   sh   t jd}| j " tj| j|t|t j|}W d Q R X |tj	krZ|j
dkrZtjdnt| |j
S )Nr   zsend timed out)r&   rp   rM   r   ZSSLWriterB   rN   r[   r   r0   r^   r$   r8   r	   )rJ   r>   rr   rQ   r   r   r   r=   8  s    

"zWrappedSocket.sendc             C   s8   d}x.|t |k r2| j|||t  }||7 }qW d S )Nr   )rN   r=   SSL_WRITE_BLOCKSIZE)rJ   r>   Z
total_sentr?   r   r   r   sendallI  s    zWrappedSocket.sendallc          	   C   s$   | j   tj| j W d Q R X d S )N)rM   r   ZSSLCloserB   )rJ   r   r   r   shutdownO  s    
zWrappedSocket.shutdownc             C   s   | j dk rd| _| jr(tj| j d | _| jr@tj| j d | _| jrvtj| j tj| j t	j
| j d  | _| _| jj S |  j d8  _ d S )Nr   T)rC   rD   rB   r   r]   rG   rE   r   ZSecKeychainDeleteshutilZrmtreerF   r$   rL   )rJ   r   r   r   rL   S  s    

zWrappedSocket.closeFc       
      C   s   |st dtj }d }d }ztj| jtj|}t| |sBd S tj|}|sTd S tj	|d}|sht
tj|}|szt
tj|}tj|}	tj|	|}W d |rtj| |rtj| X |S )Nz2SecureTransport only supports dumping binary certsr   )
ValueErrorr   rY   rZ   rB   r&   r[   r	   ZSecTrustGetCertificateCountZSecTrustGetCertificateAtIndexAssertionErrorZSecCertificateCopyDatar   ZCFDataGetLengthZCFDataGetBytePtrr<   r]   )
rJ   Zbinary_formrb   ZcertdataZ	der_bytesrQ   Z
cert_countZleafZdata_lengthr4   r   r   r   getpeercertf  s6    




zWrappedSocket.getpeercertc             C   s   |  j d7  _ d S )Nr   )rC   )rJ   r   r   r   _reuse  s    zWrappedSocket._reusec             C   s&   | j dk r| j  n|  j d8  _ d S )Nr   )rC   rL   )rJ   r   r   r   _drop  s    

zWrappedSocket._drop)N)F)__name__
__module____qualname____doc__rK   
contextlibcontextmanagerrM   rR   rc   rl   rm   rn   ro   r,   rI   r%   r=   rt   ru   rL   ry   rz   r{   r   r   r   r   rA   '  s&   >Z
(
>rA   c             C   s   |  j d7  _ t| ||ddS )Nr   T)rL   )rC   r   )rJ   modebufsizer   r   r   makefile  s    r   rc             O   s   d}t | ||f||S )Nr   )r   )rJ   r   	bufferingargskwargsr   r   r   r     s    c               @   s   e Zd ZdZdd Zedd Zejdd Zedd Zejd	d Zed
d Z	e	jdd Z	dd Z
dd Zdd ZdddZdddZdddZdS )r   z
    I am a wrapper class for the SecureTransport library, to translate the
    interface of the standard library ``SSLContext`` object to calls into
    SecureTransport.
    c             C   s8   t | \| _| _d| _d| _d | _d | _d | _d | _d S )Nr   F)	_protocol_to_min_max_min_version_max_version_options_verify_trust_bundle_client_cert_client_key_client_key_passphrase)rJ   Zprotocolr   r   r   rK     s    zSecureTransportContext.__init__c             C   s   dS )z
        SecureTransport cannot have its hostname checking disabled. For more,
        see the comment on getpeercert() in this file.
        Tr   )rJ   r   r   r   check_hostname  s    z%SecureTransportContext.check_hostnamec             C   s   dS )z
        SecureTransport cannot have its hostname checking disabled. For more,
        see the comment on getpeercert() in this file.
        Nr   )rJ   r^   r   r   r   r     s    c             C   s   | j S )N)r   )rJ   r   r   r   options  s    zSecureTransportContext.optionsc             C   s
   || _ d S )N)r   )rJ   r^   r   r   r   r     s    c             C   s   | j rtjS tjS )N)r   r\   CERT_REQUIREDZ	CERT_NONE)rJ   r   r   r   verify_mode  s    z"SecureTransportContext.verify_modec             C   s   |t jkrdnd| _d S )NTF)r\   r   r   )rJ   r^   r   r   r   r     s    c             C   s   d S )Nr   )rJ   r   r   r   set_default_verify_paths  s    
z/SecureTransportContext.set_default_verify_pathsc             C   s   | j  S )N)r   )rJ   r   r   r   load_default_certs  s    z)SecureTransportContext.load_default_certsc             C   s   |t jjkrtdd S )Nz5SecureTransport doesn't support custom cipher strings)r   r   ZDEFAULT_CIPHERSrw   )rJ   rP   r   r   r   set_ciphers  s    z"SecureTransportContext.set_ciphersNc             C   s   |d k	rt d|p|| _d S )Nz1SecureTransport does not support cert directories)rw   r   )rJ   ZcafileZcapathZcadatar   r   r   load_verify_locations  s    z,SecureTransportContext.load_verify_locationsc             C   s   || _ || _|| _d S )N)r   r   Z_client_cert_passphrase)rJ   ZcertfileZkeyfileZpasswordr   r   r   load_cert_chain  s    z&SecureTransportContext.load_cert_chainFTc          	   C   sL   | s
t |st |st t|}|j|| j| j| j| j| j| j| j	 |S )N)
rx   rA   rl   r   r   r   r   r   r   r   )rJ   ZsockZserver_sideZdo_handshake_on_connectZsuppress_ragged_eofsrk   r6   r   r   r   wrap_socket  s    

z"SecureTransportContext.wrap_socket)NNN)NN)FTTN)r|   r}   r~   r   rK   propertyr   setterr   r   r   r   r   r   r   r   r   r   r   r   r     s    	

	
  r   )r   )r   N)er   Z
__future__r   r   r&   r*   os.pathrT   rv   r$   r\   Z	threadingweakref r   Z_securetransport.bindingsr   r   r   Z_securetransport.low_levelr	   r
   r   r   r   ImportErrorZpackages.backports.makefiler   r(   	NameError__all__r   r    r   r   r   WeakValueDictionaryr!   ZLockrf   rs   ZTLS_AES_256_GCM_SHA384ZTLS_CHACHA20_POLY1305_SHA256ZTLS_AES_128_GCM_SHA256Z'TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384Z%TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384Z'TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256Z%TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256Z#TLS_DHE_DSS_WITH_AES_256_GCM_SHA384Z#TLS_DHE_RSA_WITH_AES_256_GCM_SHA384Z#TLS_DHE_DSS_WITH_AES_128_GCM_SHA256Z#TLS_DHE_RSA_WITH_AES_128_GCM_SHA256Z'TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384Z%TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384Z$TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHAZ"TLS_ECDHE_RSA_WITH_AES_256_CBC_SHAZ#TLS_DHE_RSA_WITH_AES_256_CBC_SHA256Z#TLS_DHE_DSS_WITH_AES_256_CBC_SHA256Z TLS_DHE_RSA_WITH_AES_256_CBC_SHAZ TLS_DHE_DSS_WITH_AES_256_CBC_SHAZ'TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256Z%TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256Z$TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHAZ"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHAZ#TLS_DHE_RSA_WITH_AES_128_CBC_SHA256Z#TLS_DHE_DSS_WITH_AES_128_CBC_SHA256Z TLS_DHE_RSA_WITH_AES_128_CBC_SHAZ TLS_DHE_DSS_WITH_AES_128_CBC_SHAZTLS_RSA_WITH_AES_256_GCM_SHA384ZTLS_RSA_WITH_AES_128_GCM_SHA256ZTLS_RSA_WITH_AES_256_CBC_SHA256ZTLS_RSA_WITH_AES_128_CBC_SHA256ZTLS_RSA_WITH_AES_256_CBC_SHAZTLS_RSA_WITH_AES_128_CBC_SHArO   ZPROTOCOL_SSLv23ZkTLSProtocol1ZkTLSProtocol12r   hasattrZkSSLProtocol2r   ZkSSLProtocol3r   r   ZkTLSProtocol11r   r   r   r   r   r;   r@   ZSSLReadFuncrd   ZSSLWriteFuncre   objectrA   r   r   r   r   r   r   <module>   s   95

   

