ó ùR‹_c@sÿdZddlZddlZddlmZddlZddlZddlZddlm Z dZ dZ ej dej ƒZej dej ƒZejeƒZej d ej ƒZd „Zd „Zed „Zed „Zdd„Zd„ZdS(s/Helper functions for getting mTLS cert and key.iÿÿÿÿN(tpath(t exceptionss,~/.secureConnect/context_aware_metadata.jsontcert_provider_commands:-----BEGIN CERTIFICATE-----.+-----END CERTIFICATE----- ? ?sH-----BEGIN [A-Z ]*PRIVATE KEY-----.+-----END [A-Z ]*PRIVATE KEY----- ? ?s6-----BEGIN PASSPHRASE-----(.+)-----END PASSPHRASE-----cCs6tj|ƒ}tj|ƒs2tjd|ƒdS|S(søChecks for context aware metadata. If it exists, returns the absolute path; otherwise returns None. Args: metadata_path (str): context aware metadata path. Returns: str: absolute path if exists and None otherwise. s0%s is not found, skip client SSL authentication.N(Rt expandusertexistst_LOGGERtdebugtNone(t metadata_path((s[/var/www/syncserver/local/lib/python2.7/site-packages/google/auth/transport/_mtls_helper.pyt_check_dca_metadata_path3s cCsay(t|ƒ}tj|ƒ}WdQXWn2tk r\}tj|ƒ}tj||ƒnX|S(sLoads context aware metadata from the given path. Args: metadata_path (str): context aware metadata path. Returns: Dict[str, str]: The metadata. Raises: google.auth.exceptions.ClientCertError: If failed to parse metadata as JSON. N(topentjsontloadt ValueErrorRtClientCertErrortsixt raise_from(Rtftmetadatat caught_exctnew_exc((s[/var/www/syncserver/local/lib/python2.7/site-packages/google/auth/transport/_mtls_helper.pyt_read_dca_metadata_fileDs c CsØy7tj|dtjdtjƒ}|jƒ\}}Wn2tk rk}tj|ƒ}tj||ƒnX|j dkr”tjd|j ƒ‚nt j t |ƒ}t |ƒdkrÊtjdƒ‚nt j t|ƒ}t |ƒdkrtjdƒ‚nt j t|ƒ} |r}t | ƒdkr<tjdƒ‚nd |dkr^tjd ƒ‚n|d|d| djƒfSd |dkrŸtjd ƒ‚nt | ƒdkrÃtjd ƒ‚n|d|dd fS(s!Run the provided command, and return client side mTLS cert, key and passphrase. Args: command (List[str]): cert provider command. expect_encrypted_key (bool): If encrypted private key is expected. Returns: Tuple[bytes, bytes, bytes]: client certificate bytes in PEM format, key bytes in PEM format and passphrase bytes. Raises: google.auth.exceptions.ClientCertError: if problems occurs when running the cert provider command or generating cert, key and passphrase. tstdouttstderris5Cert provider command returns non-zero status code %sis,Client SSL certificate is missing or invalids$Client SSL key is missing or invalids Passphrase is missing or invalidt ENCRYPTEDs!Encrypted private key is expecteds%Encrypted private key is not expectedsPassphrase is not expectedN(t subprocesstPopentPIPEt communicatetOSErrorRRRRt returncodetretfindallt _CERT_REGEXtlent _KEY_REGEXt_PASSPHRASE_REGEXtstripR( tcommandtexpect_encrypted_keytprocessRRRRt cert_matcht key_matchtpassphrase_match((s[/var/www/syncserver/local/lib/python2.7/site-packages/google/auth/transport/_mtls_helper.pyt_run_cert_provider_commandZs8cCs£ttƒ}|r“t|ƒ}t|kr<tjdƒ‚n|t}|rhd|krh|jdƒnt|d|ƒ\}}}t|||fSt dddfS(s†Returns the client side certificate, private key and passphrase. Args: generate_encrypted_key (bool): If set to True, encrypted private key and passphrase will be generated; otherwise, unencrypted private key will be generated and passphrase will be None. Returns: Tuple[bool, bytes, bytes, bytes]: A boolean indicating if cert, key and passphrase are obtained, the cert bytes and key bytes both in PEM format, and passphrase bytes. Raises: google.auth.exceptions.ClientCertError: if problems occurs when getting the cert, key and passphrase. s"Cert provider command is not founds--with_passphraseR'N( R tCONTEXT_AWARE_METADATA_PATHRt_CERT_PROVIDER_COMMANDRRtappendR,tTruetFalseR(tgenerate_encrypted_keyRt metadata_jsonR&tcerttkeyt passphrase((s[/var/www/syncserver/local/lib/python2.7/site-packages/google/auth/transport/_mtls_helper.pytget_client_ssl_credentialss    cCsJ|r"|ƒ\}}t||fStdtƒ\}}}}|||fS(sReturns the client side certificate and private key. The function first tries to get certificate and key from client_cert_callback; if the callback is None or doesn't provide certificate and key, the function tries application default SSL credentials. Args: client_cert_callback (Optional[Callable[[], (bytes, bytes)]]): An optional callback which returns client certificate bytes and private key bytes both in PEM format. Returns: Tuple[bool, bytes, bytes]: A boolean indicating if cert and key are obtained, the cert bytes and key bytes both in PEM format. Raises: google.auth.exceptions.ClientCertError: if problems occurs when getting the cert and key. R2(R0R7R1(tclient_cert_callbackR4R5thas_certt_((s[/var/www/syncserver/local/lib/python2.7/site-packages/google/auth/transport/_mtls_helper.pytget_client_cert_and_key·s  cCs>ddlm}|j|j|d|ƒ}|j|j|ƒS(s#A helper function to decrypt the private key with the given passphrase. google-auth library doesn't support passphrase protected private key for mutual TLS channel. This helper function can be used to decrypt the passphrase protected private key in order to estalish mutual TLS channel. For example, if you have a function which produces client cert, passphrase protected private key and passphrase, you can convert it to a client cert callback function accepted by google-auth:: from google.auth.transport import _mtls_helper def your_client_cert_function(): return cert, encrypted_key, passphrase # callback accepted by google-auth for mutual TLS channel. def client_cert_callback(): cert, encrypted_key, passphrase = your_client_cert_function() decrypted_key = _mtls_helper.decrypt_private_key(encrypted_key, passphrase) return cert, decrypted_key Args: key (bytes): The private key bytes in PEM format. passphrase (bytes): The passphrase bytes. Returns: bytes: The decrypted private key in PEM format. Raises: ImportError: If pyOpenSSL is not installed. OpenSSL.crypto.Error: If there is any problem decrypting the private key. iÿÿÿÿ(tcryptoR6(tOpenSSLR<tload_privatekeyt FILETYPE_PEMtdump_privatekey(R5R6R<tpkey((s[/var/www/syncserver/local/lib/python2.7/site-packages/google/auth/transport/_mtls_helper.pytdecrypt_private_keyÓs!(t__doc__R tloggingtosRRRRt google.authRR-R.tcompiletDOTALLR!R#t getLoggert__name__RR$R RR1R,R7RR;RB(((s[/var/www/syncserver/local/lib/python2.7/site-packages/google/auth/transport/_mtls_helper.pyts.         6 '