o
    "gP                  
   @   s`  d dl Z d dlZd dlZd dlZd dlZd dlmZmZmZmZm	Z	m
Z
mZmZmZ d dlmZ ddlmZ e d  ZeeeedZedk rXeded   ded  ed	kZd
ededefddZeddZeddZeZe
Z eZ!eZ"eZ#eZ$eZ%eZ&eZ'eZ(ee'Z)eZ*e	Z+ee&Z,ee"Z-ee#Z.ee$Z/ee%Z0eZ1eZ2eeZ3eeZ4eeZ5eZ6eZ7z*e*e-gej8_9e3ej8_:e3gej;_9e-ej;_:e+egej<_9e.ej<_:e5e/gej=_9e+ej=_:e5egej>_9e+ej>_:e2gej?_9e4ej?_:ee.gej@_9e4ej@_:e)e)ee5gejA_9e+ejA_:e5ee6gejB_9e+ejB_:e5ee6gejC_9e+ejC_:e5e_5e6e_6e+e_+dZDdZEe)gejF_9dejF_:e)gejG_9e(ejG_:e*ee!gejH_9e.ejH_:e.e!gejI_9eejI_:e.ee e!gejJ_9eejJ_:e*ee gejK_9e-ejK_:e-gejL_9e ejL_:e-gejM_9eejM_:e*ee)e e1gejN_9e/ejN_:e*e e1gejO_9e0ejO_:e0egejP_9dejP_:e/gejQ_9e ejQ_:e/e gejR_9eejR_:e,gejS_9e ejS_:e,gejT_9e.ejT_:e*Uede_VeUede_We)e_)e/e_/e.e_.e,e_,W n eXy ZY zedeY ddZY[Yww erze5ee,gejZ_9eejZ_:W n eXy ZY zedeY ddZY[Yww de+dej[dej[dej[fddZ\e\ejA_]e\ej=_]e\ej>_]e\ejB_]e\ejC_]G dd dZ^de_de-fd d!Z`de_de#fd"d#Zad$e.dedB fd%d&Zbd'ece_ de0fd(d)Zde jed*ejfdejgd fd+d,Zh	d7d-ejfd.ece_ d/edB ddfd0d1Zid-ejfd2ej[ddfd3d4Zjd-ejfd2ej[ddfd5d6ZkdS )8    N)	CDLLPOINTERc_boolc_char_pc_int32c_longc_uint32c_ulongc_void_p)find_library   )_set_ssl_context_verify_mode.)
      z,Only OS X 10.8 and newer are supported, not )r      namemacos10_16_pathreturnc                 C   sN   zt dkr|}nt| }|stt|ddW S  ty&   td|  ddw )z:Loads a CDLL by name, falling back to known path on 10.16+)r      T)	use_errnozThe library z failed to loadN)_mac_version_infor   OSErrorr   ImportError)r   r   path r   \/root/parts/websockify/install/lib/python3.10/site-packages/pip/_vendor/truststore/_macos.py
_load_cdll   s   r   Securityz6/System/Library/Frameworks/Security.framework/SecurityCoreFoundationzB/System/Library/Frameworks/CoreFoundation.framework/CoreFoundation   r   kCFAllocatorDefaultkCFTypeArrayCallBackszError initializing ctypes: result_argsc              	   C   s   t | dkr|S d}z=t| d}t|ttj}t|t	j
}|du r=td}t||dt	j
} | s:td|j}W |durGt| n|durRt| w w |du s[|dkr`d|  }t|)z<
    Raises an error if the OSStatus value is non-zero.
    r   N   'Error copying C string from CFStringRef z8SecureTransport operation returned a non-zero OSStatus: )intr   SecCopyErrorMessageStringctypescastr   r
   r   CFStringGetCStringPtrCFConstkCFStringEncodingUTF8create_string_bufferCFStringGetCStringr   value	CFReleasesslSSLError)r#   r$   r%   error_message_cfstringerror_message_cfstring_c_void_pmessagebufferr   r   r   _handle_osstatus   s@   



r:   c                   @   s(   e Zd ZdZedZdZdZdZdZ	dS )r.   zCoreFoundation constantsi  iiiiN)
__name__
__module____qualname____doc__CFStringEncodingr/   #errSecIncompleteCertRevocationCheckerrSecHostNameMismatcherrSecCertificateExpirederrSecNotTrustedr   r   r   r   r.     s    r.   r2   c                 C   s   t t j| t| S N)r   CFDataCreater!   len)r2   r   r   r   _bytes_to_cf_data_ref&  s   rG   c                 C   s    t | }ttj|tj}|S )zi
    Given a Python binary data, create a CFString.
    The string must be CFReleased by the caller.
    )r+   r   r   CFStringCreateWithCStringr!   r.   r/   )r2   c_strcf_strr   r   r   _bytes_to_cf_string,  s   
rK   cf_string_refc                 C   sZ   t | tj}|du r"td}t | |dtj}|std|j}|dur+|	d}|S )z
    Creates a Unicode string from a CFString object. Used entirely for error
    reporting.
    Yes, it annoys me quite a lot that this function is this complex.
    Nr&   r'   zutf-8)
r   r-   r.   r/   r+   r0   r1   r   r2   decode)rL   stringr9   r#   r   r   r   _cf_string_ref_to_str:  s   


rO   certsc              
   C   s   t t jdtt j}|std| D ]7}d}d}z!t|}t	t j|}t 
|| W |r4t | |r;t | q|rCt | |rKt | w w |S )zBuilds a CFArray of SecCertificateRefs from a list of DER-encoded certificates.
    Responsibility of the caller to call CoreFoundation.CFRelease on the CFArray.
    r   zUnable to allocate memory!N)r   CFArrayCreateMutabler!   r+   byrefr"   MemoryErrorrG   r   SecCertificateCreateWithDataCFArrayAppendValuer3   )rP   cf_array	cert_datacf_datasec_cert_refr   r   r   _der_certs_to_cf_cert_arrayQ  s6   



rZ   ctxc              	   c   sP    | j }| j}d| _ t| tj zd V  W || _ t| | d S || _ t| | w )NF)check_hostnameverify_moder   r4   	CERT_NONE)r[   r\   r]   r   r   r   _configure_contexto  s   r_   ssl_context
cert_chainserver_hostnamec              	   C   s  d }d }d }z|d ur0| j r0d }zt|d}td|}W |r&t| n|r/t| w w tdd }|}| jtj	@ rht
tjdttj}t|| t| tttB }t|| t| n
| jtj@ rrtdd }zt|}t }t||t| W |rt| n	|rt| w w | jdd}	|	rd }
zt|	}
t||
 W |
rt|
 n	|
rt|
 w w t|d trt| | nt| | W |rt| |rt| d S d S |rt| |rt| w w )NasciiTr   z/VERIFY_CRL_CHECK_LEAF not implemented for macOS)binary_formF)r\   rK   encoder   SecPolicyCreateSSLr   r3   verify_flagsr4   VERIFY_CRL_CHECK_CHAINrQ   r!   r+   rR   r"   rU   SecPolicyCreateRevocation#kSecRevocationUseAnyAvailableMethod%kSecRevocationRequirePositiveResponseVERIFY_CRL_CHECK_LEAFNotImplementedErrorrZ   SecTrustRefSecTrustCreateWithCertificatesget_ca_certsSecTrustSetAnchorCertificates!SecTrustSetAnchorCertificatesOnly _is_macos_version_10_14_or_later"_verify_peercerts_impl_macos_10_14"_verify_peercerts_impl_macos_10_13)r`   ra   rb   rP   policiestrustcf_str_hostname
ssl_policyrevocation_policyctx_ca_certs_derctx_ca_certsr   r   r   _verify_peercerts_impl|  s   







r}   sec_trust_refc              	   C   s   t  }t |t| zt|j}W n ttfy!   d}Y nw | j	t
jkrK|dvrMddddddd	}||d
| }t
|}||_||_|dS dS )zVerify using 'SecTrustEvaluate' API for macOS 10.13 and earlier.
    macOS 10.14 added the 'SecTrustEvaluateWithError' API.
    )r      zInvalid trust result typezUser confirmation requiredz.User specified that certificate is not trustedz"Recoverable trust failure occurredzFatal trust failure occurredz0Other error occurred, certificate may be revoked)r      r             zUnknown trust result: N)r   SecTrustResultTypeSecTrustEvaluater+   rR   r)   r2   
ValueError	TypeErrorr]   r4   CERT_REQUIREDgetSSLCertVerificationErrorverify_messageverify_code)r`   r~   sec_trust_result_typesec_trust_result_type_as_int sec_trust_result_type_to_messageerror_messageerrr   r   r   ru     s4   

ru   c           
   	   C   s   t  }t|t|}|dkrd}n|dkrd}ntd|d}|s>t |}| j	tj
kr>|tjks<|tjkr>d}|sqd}z%t |}t|pMd}t }t|t| t|}	||	_||	_|	|rpt | w w dS )z>Verify using 'SecTrustEvaluateWithError' API for macOS 10.14+.r   Tr   Fz8Unknown result from Security.SecTrustEvaluateWithError: NzCertificate verification failed)r   
CFErrorRefr   SecTrustEvaluateWithErrorr+   rR   r4   r5   CFErrorGetCoder]   r   r.   rC   rB   CFErrorCopyDescriptionrO   r   SecTrustGetTrustResultr   r   r   r3   )
r`   r~   cf_errorsec_trust_eval_result
is_trustedcf_error_codecf_error_string_refcf_error_messager   r   r   r   r   rt     sJ   






rt   rD   )l
contextlibr+   platformr4   typingr   r   r   r   r   r   r   r	   r
   ctypes.utilr   _ssl_constantsr   mac_ver_mac_versiontuplemapr)   splitr   r   rs   strr   r   r   BooleanCFIndexr?   CFDataCFStringCFArrayCFMutableArrayCFErrorCFTypeCFTypeID	CFTypeRefCFAllocatorRefOSStatusr   	CFDataRefCFStringRef
CFArrayRefCFMutableArrayRefCFArrayCallBacksCFOptionFlagsSecCertificateRefSecPolicyRefrn   r   SecTrustOptionFlagsrT   argtypesrestypeSecCertificateCopyDatar*   rq   rr   ri   rf   ro   r   r   rj   rk   r3   CFGetTypeIDrH   r-   r1   rE   CFDataGetLengthCFDataGetBytePtrCFArrayCreaterQ   rU   CFArrayGetCountCFArrayGetValueAtIndexr   r   in_dllr!   r"   AttributeErrorer   Anyr:   errcheckr.   bytesrG   rK   rO   listrZ   contextmanager
SSLContextIteratorr_   r}   ru   rt   r   r   r   r   <module>   st   ,









 5
Y
,