File manager - Edit - /home/newsbmcs.com/public_html/static/img/logo/transport.tar
Back
__pycache__/unixconn.cpython-310.pyc 0000644 00000006040 15027745274 0013333 0 ustar 00 o �hc � @ s| d dl Z d dlZd dlZd dlZddlmZ ddlmZ ej j Z G dd� dej j �Z G dd � d ejj�ZG d d � d e�ZdS ) � N� )� constants� )�BaseHTTPAdapterc s& e Zd Zd� fdd� Zdd� Z� ZS )�UnixHTTPConnection�< c s& t � jd|d� || _|| _|| _d S )N� localhost)�timeout)�super�__init__�base_url� unix_socketr )�selfr r r �� __class__� �O/usr/local/CyberPanel/lib/python3.10/site-packages/docker/transport/unixconn.pyr s � zUnixHTTPConnection.__init__c C s2 t � t jt j�}|�| j� |�| j� || _d S �N)�socket�AF_UNIX� SOCK_STREAM� settimeoutr �connectr �sock)r r r r r r s zUnixHTTPConnection.connect)r )�__name__� __module__� __qualname__r r � __classcell__r r r r r s r c s& e Zd Zd� fdd� Zdd� Z� ZS )�UnixHTTPConnectionPoolr � c s( t � jd||d� || _|| _|| _d S )Nr )r �maxsize)r r r � socket_pathr )r r r! r r r r r r s � z UnixHTTPConnectionPool.__init__c C s t | j| j| j�S r )r r r! r )r r r r � _new_conn' s �z UnixHTTPConnectionPool._new_conn)r r )r r r r r" r r r r r r s r c sL e Zd Zejjjg d� Zdejej f� fdd� Z d dd�Z dd � Z � Z S ) �UnixHTTPAdapter)�poolsr! r � max_pool_sizer c sR |� dd�}|�d�sd|� �}|| _|| _|| _t|dd� d�| _t� �� d S )Nz http+unix://� �/c S s | � � S r )�close)�pr r r �<lambda>> s z*UnixHTTPAdapter.__init__.<locals>.<lambda>)� dispose_func) �replace� startswithr! r r% �RecentlyUsedContainerr$ r r )r � socket_urlr �pool_connectionsr% r! r r r r 4 s �zUnixHTTPAdapter.__init__Nc C sp | j j�* | j �|�}|r|W d � S t|| j| j| jd�}|| j |< W d � |S 1 s1w Y |S )N)r )r$ �lock�getr r! r r% )r �url�proxies�poolr r r �get_connectionB s � � � � z UnixHTTPAdapter.get_connectionc C s |j S r )�path_url)r �requestr4 r r r � request_urlP s zUnixHTTPAdapter.request_urlr )r r r �requests�adapters� HTTPAdapter� __attrs__r �DEFAULT_NUM_POOLS�DEFAULT_MAX_POOL_SIZEr r6 r9 r r r r r r# - s � r# )r �requests.adaptersr: �urllib3�urllib3.connectionr& r �basehttpadapterr � _collectionsr. � connection�HTTPConnectionr �connectionpool�HTTPConnectionPoolr r# r r r r �<module> s __pycache__/npipeconn.cpython-310.pyc 0000644 00000006635 15027745274 0013475 0 ustar 00 o �h� � @ s� d dl Z d dlZd dlZd dlZddlmZ ddlmZ ddl m Z ej j Z G dd� dej j�ZG d d � d ejj�ZG d d � d e�ZdS ) � N� )� constants� )�BaseHTTPAdapter)� NpipeSocketc s& e Zd Zd� fdd� Zdd� Z� ZS )�NpipeHTTPConnection�< c s t � jd|d� || _|| _d S )N� localhost)�timeout��super�__init__� npipe_pathr )�selfr r �� __class__� �P/usr/local/CyberPanel/lib/python3.10/site-packages/docker/transport/npipeconn.pyr s � z NpipeHTTPConnection.__init__c C s( t � }|�| j� |�| j� || _d S �N)r � settimeoutr �connectr �sock)r r r r r r s zNpipeHTTPConnection.connect)r )�__name__� __module__� __qualname__r r � __classcell__r r r r r s r c s. e Zd Zd � fdd� Zdd� Zdd� Z� ZS ) �NpipeHTTPConnectionPoolr � c s" t � jd||d� || _|| _d S )Nr )r �maxsizer )r r r r r r r r s � z NpipeHTTPConnectionPool.__init__c C s t | j| j�S r )r r r )r r r r � _new_conn% s �z!NpipeHTTPConnectionPool._new_connc C sx d }z | j j| j|d�}W n( ty! } ztj�| d�|�d }~w tjy5 | jr3tj� | d�d �Y nw |p;| � � S )N)�blockr zPool is closed.z>Pool reached maximum size and no more connections are allowed.) �pool�getr �AttributeError�urllib3� exceptions�ClosedPoolError�queue�Empty�EmptyPoolErrorr )r r �conn�aer r r � _get_conn- s" ����� z!NpipeHTTPConnectionPool._get_conn)r r )r r r r r r, r r r r r r s r c sL e Zd Zejjjg d� Zdejej f� fdd� Z d dd�Z dd � Z � Z S ) �NpipeHTTPAdapter)r �poolsr � max_pool_sizer c s: |� dd�| _|| _|| _t|dd� d�| _t� �� d S )Nznpipe://� c S s | � � S r )�close)�pr r r �<lambda>N s z+NpipeHTTPAdapter.__init__.<locals>.<lambda>)� dispose_func)�replacer r r/ �RecentlyUsedContainerr. r r )r �base_urlr �pool_connectionsr/ r r r r G s �zNpipeHTTPAdapter.__init__Nc C sn | j j�) | j �|�}|r|W d � S t| j| j| jd�}|| j |< W d � |S 1 s0w Y |S )N)r )r. �lockr" r r r r/ )r �url�proxiesr! r r r �get_connectionR s �� � � z NpipeHTTPAdapter.get_connectionc C s |j S r )�path_url)r �requestr; r r r � request_url` s z NpipeHTTPAdapter.request_urlr )r r r �requests�adapters� HTTPAdapter� __attrs__r �DEFAULT_NUM_POOLS�DEFAULT_MAX_POOL_SIZEr r< r? r r r r r r- @ s � r- )r' �requests.adaptersr@ r$ �urllib3.connectionr0 r �basehttpadapterr � npipesocketr � _collectionsr6 � connection�HTTPConnectionr �connectionpool�HTTPConnectionPoolr r- r r r r �<module> s # __pycache__/__init__.cpython-310.pyc 0000644 00000006225 15027745274 0013236 0 ustar 00 o �h% � @ sj d Z ddlZddlmZ ejejejejfZ ej fZ dZ G dd� dej d�ZG dd� dej d�ZdS ) a Transport - HTTP client library support. :mod:`google.auth` is designed to work with various HTTP client libraries such as urllib3 and requests. In order to work across these libraries with different interfaces some abstraction is needed. This module provides two interfaces that are implemented by transport adapters to support HTTP libraries. :class:`Request` defines the interface expected by :mod:`google.auth` to make requests. :class:`Response` defines the interface for the return value of :class:`Request`. � N� c @ s: e Zd ZdZejdd� �Zejdd� �Zejdd� �ZdS ) �ResponsezHTTP Response data.c C � t d��)zint: The HTTP status code.zstatus must be implemented.��NotImplementedError��self� r �T/usr/local/CyberPanel/lib/python3.10/site-packages/google/auth/transport/__init__.py�status4 � zResponse.statusc C r )z-Mapping[str, str]: The HTTP response headers.z headers must be implemented.r r r r r �headers9 r zResponse.headersc C r )zbytes: The response body.zdata must be implemented.r r r r r �data> r z Response.dataN) �__name__� __module__� __qualname__�__doc__�abc�abstractpropertyr r r r r r r r 1 s r )� metaclassc @ s" e Zd ZdZej ddd��ZdS )�Requestz�Interface for a callable that makes HTTP requests. Specific transport implementations should provide an implementation of this that adapts their specific request / response API. .. automethod:: __call__ �GETNc K r )a Make an HTTP request. Args: url (str): The URI to be requested. method (str): The HTTP method to use for the request. Defaults to 'GET'. body (bytes): The payload / body in HTTP request. headers (Mapping[str, str]): Request headers. timeout (Optional[int]): The number of seconds to wait for a response from the server. If not specified or if None, the transport-specific default timeout will be used. kwargs: Additionally arguments passed on to the transport's request method. Returns: Response: The HTTP response. Raises: google.auth.exceptions.TransportError: If any exception occurred. z __call__ must be implemented.r )r �url�method�bodyr �timeout�kwargsr r r �__call__M s zRequest.__call__)r NNN)r r r r r �abstractmethodr r r r r r D s �r )r r � http.client�client� http_client�INTERNAL_SERVER_ERROR�SERVICE_UNAVAILABLE�REQUEST_TIMEOUT�TOO_MANY_REQUESTS� DEFAULT_RETRYABLE_STATUS_CODES� UNAUTHORIZED� DEFAULT_REFRESH_STATUS_CODES� DEFAULT_MAX_REFRESH_ATTEMPTS�ABCMetar r r r r r �<module> s � __pycache__/npipesocket.cpython-310.pyc 0000644 00000017070 15027745274 0014023 0 ustar 00 o �h� � @ s| d dl Z d dlZd dlZd dlZd dlZd dlZd dlZd dlZdZdZ d Z dZ dd� Z G dd� d�Z G d d � d ej�ZdS ) � N�� i � c s t �� �� fdd��}|S )Nc s$ | j rtd��� | g|�R i |��S )Nz1Can not reuse socket after connection was closed.)�_closed� RuntimeError)�self�args�kwargs��f� �R/usr/local/CyberPanel/lib/python3.10/site-packages/docker/transport/npipesocket.py�wrapped s �z check_closed.<locals>.wrapped)� functools�wraps)r r r r r � check_closed s r c @ s$ e Zd ZdZd8dd�Zdd� Zdd� Zd d � Zed9d d ��Z edd� �Z edd� �Z edd� �Z dd� Z dd� Zd8dd�Zdd� Zd d � Zd:d d �Zed9d d!��Zed9d"d#��Zed;d$d%��Zed9d&d'��Zed9d(d)��Zed9d*d+��Zed,d-� �Zd.d/� Zd0d1� Zd2d3� Z d4d5� Z ed6d7� �Z dS )<� NpipeSocketz� Partial implementation of the socket API over windows named pipes. This implementation is only designed to be used as a client socket, and server-specific methods (bind, listen, accept...) are not implemented. Nc C s t j| _|| _d| _d S �NF)� win32pipe�NMPWAIT_USE_DEFAULT_WAIT�_timeout�_handler )r �handler r r �__init__$ s zNpipeSocket.__init__c C � t � ��N��NotImplementedError�r r r r �accept) � zNpipeSocket.acceptc C r r r �r �addressr r r �bind, r zNpipeSocket.bindc C s | j �� d| _d S �NT)r �Closer r r r r �close/ � zNpipeSocket.closer c C s� zt �|t jt jB dd t jttB t jB d�}W n- tj yD } z |j t kr>|d }|t k r>t �d� | �||�W Y d }~S |�d }~ww t�|�d | _|| _|| _d S )Nr � )� win32file� CreateFile� GENERIC_READ� GENERIC_WRITE� OPEN_EXISTING�cSECURITY_ANONYMOUS�cSECURITY_SQOS_PRESENT�FILE_FLAG_OVERLAPPEDr �error�winerror�cERROR_PIPE_BUSY�MAXIMUM_RETRY_COUNT�time�sleep�connect�GetNamedPipeInfo�flagsr �_address)r r! � retry_countr �er r r r6 3 s4 ��� �� zNpipeSocket.connectc C s | � |�S r )r6 r r r r � connect_exS � zNpipeSocket.connect_exc C s d| _ | jS r# )r r r r r r �detachW s zNpipeSocket.detachc C s t | j�S r )r r r r r r �dup\ r= zNpipeSocket.dupc C � | j S r �r9 r r r r � getpeername` r zNpipeSocket.getpeernamec C r@ r rA r r r r � getsocknamec r zNpipeSocket.getsocknamec C r r r )r �level�optname�buflenr r r � getsockoptf r zNpipeSocket.getsockoptc C r r r )r �control�optionr r r �ioctli r zNpipeSocket.ioctlc C r r r )r �backlogr r r �listenl r zNpipeSocket.listenc C s@ |� d�dkr t� �t| �}|d u s|dkrtj}tj||d�S )N�b�rr )� buffer_size)�stripr �NpipeFileIOBase�io�DEFAULT_BUFFER_SIZE�BufferedReader)r �mode�bufsize�rawior r r �makefileo s zNpipeSocket.makefilec C s t �| j|�\}}|S r )r( �ReadFiler )r rV r8 �err�datar r r �recvw s zNpipeSocket.recvc C s | � ||�}|| jfS r )r\ r9 )r rV r8 r[ r r r �recvfrom| s zNpipeSocket.recvfromc C s | � |||�| jfS r )� recv_intor9 )r �buf�nbytesr8 r r r � recvfrom_into� s zNpipeSocket.recvfrom_intoc C s� |}t |t�s t|�}t�d ddd �}z;t�� }||_t�| j |r'|d |� n||�\}}t� || j �}|tj krAt� | j � t�t�| j |d�W t�|� S t�|� w �NTr )� isinstance� memoryview� win32event� CreateEvent� pywintypes� OVERLAPPED�hEventr( rY r �WaitForSingleObjectr � WAIT_TIMEOUT�CancelIo� TimeoutError�GetOverlappedResult�win32api� CloseHandle) r r_ r` �readbuf�event� overlappedrZ r[ � wait_resultr r r r^ � s$ � zNpipeSocket.recv_intoc C s� t �d ddd �}z1t�� }||_t�| j||� t �|| j �}|t j kr,t� | j� t �t� | j|d�W t�|� S t�|� w rb )re rf rg rh ri r( � WriteFiler rj r rk rl rm rn ro rp )r �stringr8 rr rs rt r r r �send� s zNpipeSocket.sendc C s | � ||�S r )rw )r rv r8 r r r �sendall� s zNpipeSocket.sendallc C s | � |� | �|�S r )r6 rw )r rv r! r r r �sendto� s zNpipeSocket.sendtoc C s |r| � d �S | � d�S )Nr )� settimeout)r �flagr r r � setblocking� s zNpipeSocket.setblockingc C sD |d u r t j| _d S t|ttf�r|dk rtd��t|d �| _d S )Nr zTimeout value out of rangei� )re �INFINITEr rc �float�int� ValueError)r �valuer r r rz � s zNpipeSocket.settimeoutc C r@ r )r r r r r � gettimeout� r zNpipeSocket.gettimeoutc C r r r )r rD rE r� r r r � setsockopt� r zNpipeSocket.setsockoptc C s | � � S r )r% )r �howr r r �shutdown� s zNpipeSocket.shutdownr )r )NN)r r ) �__name__� __module__� __qualname__�__doc__r r r" r% r r6 r< r> r? rB rC rG rJ rL rX r\ r] ra r^ rw rx ry r| rz r� r� r� r r r r r sP r c sT e Zd Zdd� Z� fdd�Zdd� Zdd� Zd d � Zd d � Zd d� Z dd� Z � Z S )rQ c C s || _ d S r )�sock)r � npipe_socketr r r r � � zNpipeFileIOBase.__init__c s t � �� d | _d S r )�superr% r� r �� __class__r r r% � r& zNpipeFileIOBase.closec C s | j �� S r )r� �filenor r r r r� � r� zNpipeFileIOBase.filenoc C � dS r r r r r r �isatty� � zNpipeFileIOBase.isattyc C r� r# r r r r r �readable� r� zNpipeFileIOBase.readablec C s | j �|�S r )r� r^ )r r_ r r r �readinto� s zNpipeFileIOBase.readintoc C r� r r r r r r �seekable� r� zNpipeFileIOBase.seekablec C r� r r r r r r �writable� r� zNpipeFileIOBase.writable) r� r� r� r r% r� r� r� r� r� r� � __classcell__r r r� r rQ � s rQ )r rR r4 rg ro re r( r r2 r. r- r3 r r � RawIOBaserQ r r r r �<module> s 2 __pycache__/sshconn.cpython-310.pyc 0000644 00000016205 15027745274 0013151 0 ustar 00 o �h� � @ s� d dl Z d dlZd dlZd dlZd dlZd dlZd dlZd dlZd dl Z d dl Z d dl Z ddl mZ ddlmZ e jjZG dd� dej�ZG dd � d e jj�ZG d d � d e jj�ZG d d � d e�ZdS )� N� )� constants� )�BaseHTTPAdapterc sT e Zd Z� fdd�Zdd� Zdd� Zdd� Zd d � Zd d � Zd d� Z dd� Z � Z S )� SSHSocketc sj t � �tjtj� || _d | _d | _d| jv r!| j�d�\| _| _d| jv r0| j�d�\| _| _d | _ d S )N�:�@) �super�__init__�socket�AF_INET� SOCK_STREAM�host�port�user�split�proc)�selfr �� __class__� �N/usr/local/CyberPanel/lib/python3.10/site-packages/docker/transport/sshconn.pyr s � zSSHSocket.__init__c K s� dg}| j r |d| j g }| jr|d| jg }|d| jdg }d }tjs*dd� }|}ttj�}|�dd � |�d d � t j ||t j t j |d �| _ d S ) N�sshz-lz-pz--�docker system dial-stdioc S s t � t jt j� d S �N)�signal�SIGINT�SIG_IGNr r r r �f. s z SSHSocket.connect.<locals>.f�LD_LIBRARY_PATH� SSL_CERT_FILE)�env�stdout�stdin� preexec_fn) r r r r �IS_WINDOWS_PLATFORM�dict�os�environ�pop� subprocess�Popen�PIPEr )r �kwargs�args� preexec_funcr r! r r r �connect" s( �zSSHSocket.connectc C s6 | j r| j jjr td��| j j�|�}| j j�� |S �Nz<SSH subprocess not initiated.connect() must be called first.)r r# �closed� Exception�write�flush)r �data�writtenr r r �_write? s zSSHSocket._writec C s | � |� d S r �r8 �r r6 r r r �sendallG s zSSHSocket.sendallc C s | � |�S r r9 r: r r r �sendJ s zSSHSocket.sendc C s | j std��| j j�|�S r1 )r r3 r" �read)r �nr r r �recvM s zSSHSocket.recvc C s | j s| �� | | j j_| j jS r )r r0 r" �channel)r �moder r r �makefileS s zSSHSocket.makefilec C s< | j r| j jjr d S | j j�d� | j j�� | j �� d S )Ns )r r# r2 r4 r5 � terminate�r r r r �closeZ s zSSHSocket.close) �__name__� __module__� __qualname__r r0 r8 r; r< r? rB rE � __classcell__r r r r r s r c s& e Zd Zd� fdd� Zdd� Z� ZS )� SSHConnectionN�< c s& t � jd|d� || _|| _|| _d S )N� localhost)�timeout)r r � ssh_transportrM �ssh_host)r rN rM r r r r r c s � zSSHConnection.__init__c C sP | j r| j �� }|�| j� |�d� nt| j�}|�| j� |�� || _d S )Nr ) rN � open_session� settimeoutrM � exec_commandr rO r0 �sock)r rS r r r r0 k s zSSHConnection.connect)NrK N)rF rG rH r r0 rI r r r r rJ b s rJ c s2 e Zd ZdZd � fdd� Zdd� Zd d � Z� ZS ) �SSHConnectionPoolr NrK � c s6 t � jd||d� d | _|| _|r|�� | _|| _d S )NrL )rM �maxsize)r r rN rM � get_transportrO )r � ssh_clientrM rV r r r r r { s � zSSHConnectionPool.__init__c C s t | j| j| j�S r )rJ rN rM rO rD r r r � _new_conn� s zSSHConnectionPool._new_connc C sx d }z | j j| j|d�}W n( ty! } ztj�| d�|�d }~w tjy5 | jr3tj� | d�d �Y nw |p;| � � S )N)�blockrM zPool is closed.z>Pool reached maximum size and no more connections are allowed.) �pool�getrZ �AttributeError�urllib3� exceptions�ClosedPoolError�queue�Empty�EmptyPoolErrorrY )r rM �conn�aer r r � _get_conn� s" ����� zSSHConnectionPool._get_conn)NrK rU N)rF rG rH �schemer rY rf rI r r r r rT x s rT c sb e Zd Zejjjg d� Zdejej df� fdd� Z dd� Z dd � Z dd d �Z � fd d�Z� ZS )�SSHHTTPAdapter)�poolsrM rX � ssh_params� max_pool_sizerK Fc sj d | _ |s| �|� | �� || _|�d�r |td�d � | _|| _|| _t|dd� d�| _ t � � � d S )Nzssh://c S s | � � S r )rE )�pr r r �<lambda>� s z)SSHHTTPAdapter.__init__.<locals>.<lambda>)� dispose_func) rX �_create_paramiko_client�_connectrO � startswith�lenrM rk �RecentlyUsedContainerri r r )r �base_urlrM �pool_connectionsrk � shell_outr r r r � s �zSSHHTTPAdapter.__init__c C s@ t �d��t j� t�� | _tj� |�}|j |j |j d�| _ tj�d�}tj�|�r�t�� }t|�� }|�|� W d � n1 sBw Y |�|j �}d|v r[t�|d �| j d< d|v rf|d | j d< |j d u rvd|v rv|d | j d< |j d u r�d|v r�|d | j d < d |v r�|d | j d < | j�� | j�t�� � d S ) N�paramiko)�hostnamer �usernamez ~/.ssh/config� proxycommandrS rx r r ry � identityfile� key_filename)�logging� getLogger�setLevel�WARNINGrw � SSHClientrX �urllib�parse�urlparserx r ry rj r' �path� expanduser�exists� SSHConfig�open�lookup� ProxyCommand�load_system_host_keys�set_missing_host_key_policy� RejectPolicy)r rt �ssh_config_file�confr � host_configr r r ro � s8 � � � z&SSHHTTPAdapter._create_paramiko_clientc C s" | j r| j jdi | j�� d S d S )Nr )rX r0 rj rD r r r rp � s �zSSHHTTPAdapter._connectNc C s� | j st| j | j| j| jd�S | jj�7 | j�|�}|r%|W d � S | j r1| j �� s1| � � t| j | j| j| jd�}|| j|< W d � |S 1 sMw Y |S )N)rX rM rV r ) rX rT rM rk rO ri �lockr\ rW rp )r �url�proxiesr[ r r r �get_connection� s2 � �� ��z SSHHTTPAdapter.get_connectionc s" t � �� | jr| j�� d S d S r )r rE rX rD r r r rE � s �zSSHHTTPAdapter.closer )rF rG rH �requests�adapters� HTTPAdapter� __attrs__r �DEFAULT_NUM_POOLS�DEFAULT_MAX_POOL_SIZEr ro rp r� rE rI r r r r rh � s � rh )r} r' ra r r r* � urllib.parser� rw �requests.adaptersr� r^ �urllib3.connection� r �basehttpadapterr � _collectionsrs r � connection�HTTPConnectionrJ �connectionpool�HTTPConnectionPoolrT rh r r r r �<module> s$ N' __pycache__/basehttpadapter.cpython-310.pyc 0000644 00000001554 15027745274 0014652 0 ustar 00 o �h� � @ s d dl ZG dd� dejj�ZdS )� Nc s& e Zd Z� fdd�Zddd�Z� ZS )�BaseHTTPAdapterc s& t � �� t| d�r| j�� d S d S )N�pools)�super�close�hasattrr �clear)�self�� __class__� �V/usr/local/CyberPanel/lib/python3.10/site-packages/docker/transport/basehttpadapter.pyr s �zBaseHTTPAdapter.closeNc C s | � |j|�S )N)�get_connection�url)r �request�verify�proxies�certr r r � get_connection_with_tls_context s z/BaseHTTPAdapter.get_connection_with_tls_context)NN)�__name__� __module__� __qualname__r r � __classcell__r r r r r s r )�requests.adapters�requests�adapters� HTTPAdapterr r r r r �<module> s npipeconn.py 0000644 00000006705 15027745274 0007134 0 ustar 00 import queue import requests.adapters import urllib3 import urllib3.connection from .. import constants from .basehttpadapter import BaseHTTPAdapter from .npipesocket import NpipeSocket RecentlyUsedContainer = urllib3._collections.RecentlyUsedContainer class NpipeHTTPConnection(urllib3.connection.HTTPConnection): def __init__(self, npipe_path, timeout=60): super().__init__( 'localhost', timeout=timeout ) self.npipe_path = npipe_path self.timeout = timeout def connect(self): sock = NpipeSocket() sock.settimeout(self.timeout) sock.connect(self.npipe_path) self.sock = sock class NpipeHTTPConnectionPool(urllib3.connectionpool.HTTPConnectionPool): def __init__(self, npipe_path, timeout=60, maxsize=10): super().__init__( 'localhost', timeout=timeout, maxsize=maxsize ) self.npipe_path = npipe_path self.timeout = timeout def _new_conn(self): return NpipeHTTPConnection( self.npipe_path, self.timeout ) # When re-using connections, urllib3 tries to call select() on our # NpipeSocket instance, causing a crash. To circumvent this, we override # _get_conn, where that check happens. def _get_conn(self, timeout): conn = None try: conn = self.pool.get(block=self.block, timeout=timeout) except AttributeError as ae: # self.pool is None raise urllib3.exceptions.ClosedPoolError(self, "Pool is closed.") from ae except queue.Empty: if self.block: raise urllib3.exceptions.EmptyPoolError( self, "Pool reached maximum size and no more " "connections are allowed." ) from None # Oh well, we'll create a new connection then return conn or self._new_conn() class NpipeHTTPAdapter(BaseHTTPAdapter): __attrs__ = requests.adapters.HTTPAdapter.__attrs__ + ['npipe_path', 'pools', 'timeout', 'max_pool_size'] def __init__(self, base_url, timeout=60, pool_connections=constants.DEFAULT_NUM_POOLS, max_pool_size=constants.DEFAULT_MAX_POOL_SIZE): self.npipe_path = base_url.replace('npipe://', '') self.timeout = timeout self.max_pool_size = max_pool_size self.pools = RecentlyUsedContainer( pool_connections, dispose_func=lambda p: p.close() ) super().__init__() def get_connection(self, url, proxies=None): with self.pools.lock: pool = self.pools.get(url) if pool: return pool pool = NpipeHTTPConnectionPool( self.npipe_path, self.timeout, maxsize=self.max_pool_size ) self.pools[url] = pool return pool def request_url(self, request, proxies): # The select_proxy utility in requests errors out when the provided URL # doesn't have a hostname, like is the case when using a UNIX socket. # Since proxies are an irrelevant notion in the case of UNIX sockets # anyway, we simply return the path URL directly. # See also: https://github.com/docker/docker-sdk-python/issues/811 return request.path_url sshconn.py 0000644 00000017363 15027745274 0006620 0 ustar 00 import logging import os import queue import signal import socket import subprocess import urllib.parse import paramiko import requests.adapters import urllib3 import urllib3.connection from .. import constants from .basehttpadapter import BaseHTTPAdapter RecentlyUsedContainer = urllib3._collections.RecentlyUsedContainer class SSHSocket(socket.socket): def __init__(self, host): super().__init__( socket.AF_INET, socket.SOCK_STREAM) self.host = host self.port = None self.user = None if ':' in self.host: self.host, self.port = self.host.split(':') if '@' in self.host: self.user, self.host = self.host.split('@') self.proc = None def connect(self, **kwargs): args = ['ssh'] if self.user: args = args + ['-l', self.user] if self.port: args = args + ['-p', self.port] args = args + ['--', self.host, 'docker system dial-stdio'] preexec_func = None if not constants.IS_WINDOWS_PLATFORM: def f(): signal.signal(signal.SIGINT, signal.SIG_IGN) preexec_func = f env = dict(os.environ) # drop LD_LIBRARY_PATH and SSL_CERT_FILE env.pop('LD_LIBRARY_PATH', None) env.pop('SSL_CERT_FILE', None) self.proc = subprocess.Popen( args, env=env, stdout=subprocess.PIPE, stdin=subprocess.PIPE, preexec_fn=preexec_func) def _write(self, data): if not self.proc or self.proc.stdin.closed: raise Exception('SSH subprocess not initiated.' 'connect() must be called first.') written = self.proc.stdin.write(data) self.proc.stdin.flush() return written def sendall(self, data): self._write(data) def send(self, data): return self._write(data) def recv(self, n): if not self.proc: raise Exception('SSH subprocess not initiated.' 'connect() must be called first.') return self.proc.stdout.read(n) def makefile(self, mode): if not self.proc: self.connect() self.proc.stdout.channel = self return self.proc.stdout def close(self): if not self.proc or self.proc.stdin.closed: return self.proc.stdin.write(b'\n\n') self.proc.stdin.flush() self.proc.terminate() class SSHConnection(urllib3.connection.HTTPConnection): def __init__(self, ssh_transport=None, timeout=60, host=None): super().__init__( 'localhost', timeout=timeout ) self.ssh_transport = ssh_transport self.timeout = timeout self.ssh_host = host def connect(self): if self.ssh_transport: sock = self.ssh_transport.open_session() sock.settimeout(self.timeout) sock.exec_command('docker system dial-stdio') else: sock = SSHSocket(self.ssh_host) sock.settimeout(self.timeout) sock.connect() self.sock = sock class SSHConnectionPool(urllib3.connectionpool.HTTPConnectionPool): scheme = 'ssh' def __init__(self, ssh_client=None, timeout=60, maxsize=10, host=None): super().__init__( 'localhost', timeout=timeout, maxsize=maxsize ) self.ssh_transport = None self.timeout = timeout if ssh_client: self.ssh_transport = ssh_client.get_transport() self.ssh_host = host def _new_conn(self): return SSHConnection(self.ssh_transport, self.timeout, self.ssh_host) # When re-using connections, urllib3 calls fileno() on our # SSH channel instance, quickly overloading our fd limit. To avoid this, # we override _get_conn def _get_conn(self, timeout): conn = None try: conn = self.pool.get(block=self.block, timeout=timeout) except AttributeError as ae: # self.pool is None raise urllib3.exceptions.ClosedPoolError(self, "Pool is closed.") from ae except queue.Empty: if self.block: raise urllib3.exceptions.EmptyPoolError( self, "Pool reached maximum size and no more " "connections are allowed." ) from None # Oh well, we'll create a new connection then return conn or self._new_conn() class SSHHTTPAdapter(BaseHTTPAdapter): __attrs__ = requests.adapters.HTTPAdapter.__attrs__ + [ 'pools', 'timeout', 'ssh_client', 'ssh_params', 'max_pool_size' ] def __init__(self, base_url, timeout=60, pool_connections=constants.DEFAULT_NUM_POOLS, max_pool_size=constants.DEFAULT_MAX_POOL_SIZE, shell_out=False): self.ssh_client = None if not shell_out: self._create_paramiko_client(base_url) self._connect() self.ssh_host = base_url if base_url.startswith('ssh://'): self.ssh_host = base_url[len('ssh://'):] self.timeout = timeout self.max_pool_size = max_pool_size self.pools = RecentlyUsedContainer( pool_connections, dispose_func=lambda p: p.close() ) super().__init__() def _create_paramiko_client(self, base_url): logging.getLogger("paramiko").setLevel(logging.WARNING) self.ssh_client = paramiko.SSHClient() base_url = urllib.parse.urlparse(base_url) self.ssh_params = { "hostname": base_url.hostname, "port": base_url.port, "username": base_url.username } ssh_config_file = os.path.expanduser("~/.ssh/config") if os.path.exists(ssh_config_file): conf = paramiko.SSHConfig() with open(ssh_config_file) as f: conf.parse(f) host_config = conf.lookup(base_url.hostname) if 'proxycommand' in host_config: self.ssh_params["sock"] = paramiko.ProxyCommand( host_config['proxycommand'] ) if 'hostname' in host_config: self.ssh_params['hostname'] = host_config['hostname'] if base_url.port is None and 'port' in host_config: self.ssh_params['port'] = host_config['port'] if base_url.username is None and 'user' in host_config: self.ssh_params['username'] = host_config['user'] if 'identityfile' in host_config: self.ssh_params['key_filename'] = host_config['identityfile'] self.ssh_client.load_system_host_keys() self.ssh_client.set_missing_host_key_policy(paramiko.RejectPolicy()) def _connect(self): if self.ssh_client: self.ssh_client.connect(**self.ssh_params) def get_connection(self, url, proxies=None): if not self.ssh_client: return SSHConnectionPool( ssh_client=self.ssh_client, timeout=self.timeout, maxsize=self.max_pool_size, host=self.ssh_host ) with self.pools.lock: pool = self.pools.get(url) if pool: return pool # Connection is closed try a reconnect if self.ssh_client and not self.ssh_client.get_transport(): self._connect() pool = SSHConnectionPool( ssh_client=self.ssh_client, timeout=self.timeout, maxsize=self.max_pool_size, host=self.ssh_host ) self.pools[url] = pool return pool def close(self): super().close() if self.ssh_client: self.ssh_client.close() unixconn.py 0000644 00000005543 15027745274 0007003 0 ustar 00 import socket import requests.adapters import urllib3 import urllib3.connection from .. import constants from .basehttpadapter import BaseHTTPAdapter RecentlyUsedContainer = urllib3._collections.RecentlyUsedContainer class UnixHTTPConnection(urllib3.connection.HTTPConnection): def __init__(self, base_url, unix_socket, timeout=60): super().__init__( 'localhost', timeout=timeout ) self.base_url = base_url self.unix_socket = unix_socket self.timeout = timeout def connect(self): sock = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) sock.settimeout(self.timeout) sock.connect(self.unix_socket) self.sock = sock class UnixHTTPConnectionPool(urllib3.connectionpool.HTTPConnectionPool): def __init__(self, base_url, socket_path, timeout=60, maxsize=10): super().__init__( 'localhost', timeout=timeout, maxsize=maxsize ) self.base_url = base_url self.socket_path = socket_path self.timeout = timeout def _new_conn(self): return UnixHTTPConnection( self.base_url, self.socket_path, self.timeout ) class UnixHTTPAdapter(BaseHTTPAdapter): __attrs__ = requests.adapters.HTTPAdapter.__attrs__ + ['pools', 'socket_path', 'timeout', 'max_pool_size'] def __init__(self, socket_url, timeout=60, pool_connections=constants.DEFAULT_NUM_POOLS, max_pool_size=constants.DEFAULT_MAX_POOL_SIZE): socket_path = socket_url.replace('http+unix://', '') if not socket_path.startswith('/'): socket_path = f"/{socket_path}" self.socket_path = socket_path self.timeout = timeout self.max_pool_size = max_pool_size self.pools = RecentlyUsedContainer( pool_connections, dispose_func=lambda p: p.close() ) super().__init__() def get_connection(self, url, proxies=None): with self.pools.lock: pool = self.pools.get(url) if pool: return pool pool = UnixHTTPConnectionPool( url, self.socket_path, self.timeout, maxsize=self.max_pool_size ) self.pools[url] = pool return pool def request_url(self, request, proxies): # The select_proxy utility in requests errors out when the provided URL # doesn't have a hostname, like is the case when using a UNIX socket. # Since proxies are an irrelevant notion in the case of UNIX sockets # anyway, we simply return the path URL directly. # See also: https://github.com/docker/docker-py/issues/811 return request.path_url npipesocket.py 0000644 00000014671 15027745274 0007470 0 ustar 00 import functools import io import time import pywintypes import win32api import win32event import win32file import win32pipe cERROR_PIPE_BUSY = 0xe7 cSECURITY_SQOS_PRESENT = 0x100000 cSECURITY_ANONYMOUS = 0 MAXIMUM_RETRY_COUNT = 10 def check_closed(f): @functools.wraps(f) def wrapped(self, *args, **kwargs): if self._closed: raise RuntimeError( 'Can not reuse socket after connection was closed.' ) return f(self, *args, **kwargs) return wrapped class NpipeSocket: """ Partial implementation of the socket API over windows named pipes. This implementation is only designed to be used as a client socket, and server-specific methods (bind, listen, accept...) are not implemented. """ def __init__(self, handle=None): self._timeout = win32pipe.NMPWAIT_USE_DEFAULT_WAIT self._handle = handle self._closed = False def accept(self): raise NotImplementedError() def bind(self, address): raise NotImplementedError() def close(self): self._handle.Close() self._closed = True @check_closed def connect(self, address, retry_count=0): try: handle = win32file.CreateFile( address, win32file.GENERIC_READ | win32file.GENERIC_WRITE, 0, None, win32file.OPEN_EXISTING, (cSECURITY_ANONYMOUS | cSECURITY_SQOS_PRESENT | win32file.FILE_FLAG_OVERLAPPED), 0 ) except win32pipe.error as e: # See Remarks: # https://msdn.microsoft.com/en-us/library/aa365800.aspx if e.winerror == cERROR_PIPE_BUSY: # Another program or thread has grabbed our pipe instance # before we got to it. Wait for availability and attempt to # connect again. retry_count = retry_count + 1 if (retry_count < MAXIMUM_RETRY_COUNT): time.sleep(1) return self.connect(address, retry_count) raise e self.flags = win32pipe.GetNamedPipeInfo(handle)[0] self._handle = handle self._address = address @check_closed def connect_ex(self, address): return self.connect(address) @check_closed def detach(self): self._closed = True return self._handle @check_closed def dup(self): return NpipeSocket(self._handle) def getpeername(self): return self._address def getsockname(self): return self._address def getsockopt(self, level, optname, buflen=None): raise NotImplementedError() def ioctl(self, control, option): raise NotImplementedError() def listen(self, backlog): raise NotImplementedError() def makefile(self, mode=None, bufsize=None): if mode.strip('b') != 'r': raise NotImplementedError() rawio = NpipeFileIOBase(self) if bufsize is None or bufsize <= 0: bufsize = io.DEFAULT_BUFFER_SIZE return io.BufferedReader(rawio, buffer_size=bufsize) @check_closed def recv(self, bufsize, flags=0): err, data = win32file.ReadFile(self._handle, bufsize) return data @check_closed def recvfrom(self, bufsize, flags=0): data = self.recv(bufsize, flags) return (data, self._address) @check_closed def recvfrom_into(self, buf, nbytes=0, flags=0): return self.recv_into(buf, nbytes, flags), self._address @check_closed def recv_into(self, buf, nbytes=0): readbuf = buf if not isinstance(buf, memoryview): readbuf = memoryview(buf) event = win32event.CreateEvent(None, True, True, None) try: overlapped = pywintypes.OVERLAPPED() overlapped.hEvent = event err, data = win32file.ReadFile( self._handle, readbuf[:nbytes] if nbytes else readbuf, overlapped ) wait_result = win32event.WaitForSingleObject(event, self._timeout) if wait_result == win32event.WAIT_TIMEOUT: win32file.CancelIo(self._handle) raise TimeoutError return win32file.GetOverlappedResult(self._handle, overlapped, 0) finally: win32api.CloseHandle(event) @check_closed def send(self, string, flags=0): event = win32event.CreateEvent(None, True, True, None) try: overlapped = pywintypes.OVERLAPPED() overlapped.hEvent = event win32file.WriteFile(self._handle, string, overlapped) wait_result = win32event.WaitForSingleObject(event, self._timeout) if wait_result == win32event.WAIT_TIMEOUT: win32file.CancelIo(self._handle) raise TimeoutError return win32file.GetOverlappedResult(self._handle, overlapped, 0) finally: win32api.CloseHandle(event) @check_closed def sendall(self, string, flags=0): return self.send(string, flags) @check_closed def sendto(self, string, address): self.connect(address) return self.send(string) def setblocking(self, flag): if flag: return self.settimeout(None) return self.settimeout(0) def settimeout(self, value): if value is None: # Blocking mode self._timeout = win32event.INFINITE elif not isinstance(value, (float, int)) or value < 0: raise ValueError('Timeout value out of range') else: # Timeout mode - Value converted to milliseconds self._timeout = int(value * 1000) def gettimeout(self): return self._timeout def setsockopt(self, level, optname, value): raise NotImplementedError() @check_closed def shutdown(self, how): return self.close() class NpipeFileIOBase(io.RawIOBase): def __init__(self, npipe_socket): self.sock = npipe_socket def close(self): super().close() self.sock = None def fileno(self): return self.sock.fileno() def isatty(self): return False def readable(self): return True def readinto(self, buf): return self.sock.recv_into(buf) def seekable(self): return False def writable(self): return False basehttpadapter.py 0000644 00000000711 15027745274 0010305 0 ustar 00 import requests.adapters class BaseHTTPAdapter(requests.adapters.HTTPAdapter): def close(self): super().close() if hasattr(self, 'pools'): self.pools.clear() # Fix for requests 2.32.2+: # https://github.com/psf/requests/commit/c98e4d133ef29c46a9b68cd783087218a8075e05 def get_connection_with_tls_context(self, request, verify, proxies=None, cert=None): return self.get_connection(request.url, proxies) __init__.py 0000644 00000007045 15027745274 0006700 0 ustar 00 # Copyright 2016 Google LLC # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. """Transport - HTTP client library support. :mod:`google.auth` is designed to work with various HTTP client libraries such as urllib3 and requests. In order to work across these libraries with different interfaces some abstraction is needed. This module provides two interfaces that are implemented by transport adapters to support HTTP libraries. :class:`Request` defines the interface expected by :mod:`google.auth` to make requests. :class:`Response` defines the interface for the return value of :class:`Request`. """ import abc import http.client as http_client DEFAULT_RETRYABLE_STATUS_CODES = ( http_client.INTERNAL_SERVER_ERROR, http_client.SERVICE_UNAVAILABLE, http_client.REQUEST_TIMEOUT, http_client.TOO_MANY_REQUESTS, ) """Sequence[int]: HTTP status codes indicating a request can be retried. """ DEFAULT_REFRESH_STATUS_CODES = (http_client.UNAUTHORIZED,) """Sequence[int]: Which HTTP status code indicate that credentials should be refreshed. """ DEFAULT_MAX_REFRESH_ATTEMPTS = 2 """int: How many times to refresh the credentials and retry a request.""" class Response(metaclass=abc.ABCMeta): """HTTP Response data.""" @abc.abstractproperty def status(self): """int: The HTTP status code.""" raise NotImplementedError("status must be implemented.") @abc.abstractproperty def headers(self): """Mapping[str, str]: The HTTP response headers.""" raise NotImplementedError("headers must be implemented.") @abc.abstractproperty def data(self): """bytes: The response body.""" raise NotImplementedError("data must be implemented.") class Request(metaclass=abc.ABCMeta): """Interface for a callable that makes HTTP requests. Specific transport implementations should provide an implementation of this that adapts their specific request / response API. .. automethod:: __call__ """ @abc.abstractmethod def __call__( self, url, method="GET", body=None, headers=None, timeout=None, **kwargs ): """Make an HTTP request. Args: url (str): The URI to be requested. method (str): The HTTP method to use for the request. Defaults to 'GET'. body (bytes): The payload / body in HTTP request. headers (Mapping[str, str]): Request headers. timeout (Optional[int]): The number of seconds to wait for a response from the server. If not specified or if None, the transport-specific default timeout will be used. kwargs: Additionally arguments passed on to the transport's request method. Returns: Response: The HTTP response. Raises: google.auth.exceptions.TransportError: If any exception occurred. """ # pylint: disable=redundant-returns-doc, missing-raises-doc # (pylint doesn't play well with abstract docstrings.) raise NotImplementedError("__call__ must be implemented.") _custom_tls_signer.py 0000644 00000023405 15030037514 0011022 0 ustar 00 # Copyright 2022 Google LLC # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. """ Code for configuring client side TLS to offload the signing operation to signing libraries. """ import ctypes import json import logging import os import sys import cffi # type: ignore from google.auth import exceptions _LOGGER = logging.getLogger(__name__) # C++ offload lib requires google-auth lib to provide the following callback: # using SignFunc = int (*)(unsigned char *sig, size_t *sig_len, # const unsigned char *tbs, size_t tbs_len) # The bytes to be signed and the length are provided via `tbs` and `tbs_len`, # the callback computes the signature, and write the signature and its length # into `sig` and `sig_len`. # If the signing is successful, the callback returns 1, otherwise it returns 0. SIGN_CALLBACK_CTYPE = ctypes.CFUNCTYPE( ctypes.c_int, # return type ctypes.POINTER(ctypes.c_ubyte), # sig ctypes.POINTER(ctypes.c_size_t), # sig_len ctypes.POINTER(ctypes.c_ubyte), # tbs ctypes.c_size_t, # tbs_len ) # Cast SSL_CTX* to void* def _cast_ssl_ctx_to_void_p_pyopenssl(ssl_ctx): return ctypes.cast(int(cffi.FFI().cast("intptr_t", ssl_ctx)), ctypes.c_void_p) # Cast SSL_CTX* to void* def _cast_ssl_ctx_to_void_p_stdlib(context): return ctypes.c_void_p.from_address( id(context) + ctypes.sizeof(ctypes.c_void_p) * 2 ) # Load offload library and set up the function types. def load_offload_lib(offload_lib_path): _LOGGER.debug("loading offload library from %s", offload_lib_path) # winmode parameter is only available for python 3.8+. lib = ( ctypes.CDLL(offload_lib_path, winmode=0) if sys.version_info >= (3, 8) and os.name == "nt" else ctypes.CDLL(offload_lib_path) ) # Set up types for: # int ConfigureSslContext(SignFunc sign_func, const char *cert, SSL_CTX *ctx) lib.ConfigureSslContext.argtypes = [ SIGN_CALLBACK_CTYPE, ctypes.c_char_p, ctypes.c_void_p, ] lib.ConfigureSslContext.restype = ctypes.c_int return lib # Load signer library and set up the function types. # See: https://github.com/googleapis/enterprise-certificate-proxy/blob/main/cshared/main.go def load_signer_lib(signer_lib_path): _LOGGER.debug("loading signer library from %s", signer_lib_path) # winmode parameter is only available for python 3.8+. lib = ( ctypes.CDLL(signer_lib_path, winmode=0) if sys.version_info >= (3, 8) and os.name == "nt" else ctypes.CDLL(signer_lib_path) ) # Set up types for: # func GetCertPemForPython(configFilePath *C.char, certHolder *byte, certHolderLen int) lib.GetCertPemForPython.argtypes = [ctypes.c_char_p, ctypes.c_char_p, ctypes.c_int] # Returns: certLen lib.GetCertPemForPython.restype = ctypes.c_int # Set up types for: # func SignForPython(configFilePath *C.char, digest *byte, digestLen int, # sigHolder *byte, sigHolderLen int) lib.SignForPython.argtypes = [ ctypes.c_char_p, ctypes.c_char_p, ctypes.c_int, ctypes.c_char_p, ctypes.c_int, ] # Returns: the signature length lib.SignForPython.restype = ctypes.c_int return lib def load_provider_lib(provider_lib_path): _LOGGER.debug("loading provider library from %s", provider_lib_path) # winmode parameter is only available for python 3.8+. lib = ( ctypes.CDLL(provider_lib_path, winmode=0) if sys.version_info >= (3, 8) and os.name == "nt" else ctypes.CDLL(provider_lib_path) ) lib.ECP_attach_to_ctx.argtypes = [ctypes.c_void_p, ctypes.c_char_p] lib.ECP_attach_to_ctx.restype = ctypes.c_int return lib # Computes SHA256 hash. def _compute_sha256_digest(to_be_signed, to_be_signed_len): from cryptography.hazmat.primitives import hashes data = ctypes.string_at(to_be_signed, to_be_signed_len) hash = hashes.Hash(hashes.SHA256()) hash.update(data) return hash.finalize() # Create the signing callback. The actual signing work is done by the # `SignForPython` method from the signer lib. def get_sign_callback(signer_lib, config_file_path): def sign_callback(sig, sig_len, tbs, tbs_len): _LOGGER.debug("calling sign callback...") digest = _compute_sha256_digest(tbs, tbs_len) digestArray = ctypes.c_char * len(digest) # reserve 2000 bytes for the signature, shoud be more then enough. # RSA signature is 256 bytes, EC signature is 70~72. sig_holder_len = 2000 sig_holder = ctypes.create_string_buffer(sig_holder_len) signature_len = signer_lib.SignForPython( config_file_path.encode(), # configFilePath digestArray.from_buffer(bytearray(digest)), # digest len(digest), # digestLen sig_holder, # sigHolder sig_holder_len, # sigHolderLen ) if signature_len == 0: # signing failed, return 0 return 0 sig_len[0] = signature_len bs = bytearray(sig_holder) for i in range(signature_len): sig[i] = bs[i] return 1 return SIGN_CALLBACK_CTYPE(sign_callback) # Obtain the certificate bytes by calling the `GetCertPemForPython` method from # the signer lib. The method is called twice, the first time is to compute the # cert length, then we create a buffer to hold the cert, and call it again to # fill the buffer. def get_cert(signer_lib, config_file_path): # First call to calculate the cert length cert_len = signer_lib.GetCertPemForPython( config_file_path.encode(), # configFilePath None, # certHolder 0, # certHolderLen ) if cert_len == 0: raise exceptions.MutualTLSChannelError("failed to get certificate") # Then we create an array to hold the cert, and call again to fill the cert cert_holder = ctypes.create_string_buffer(cert_len) signer_lib.GetCertPemForPython( config_file_path.encode(), # configFilePath cert_holder, # certHolder cert_len, # certHolderLen ) return bytes(cert_holder) class CustomTlsSigner(object): def __init__(self, enterprise_cert_file_path): """ This class loads the offload and signer library, and calls APIs from these libraries to obtain the cert and a signing callback, and attach them to SSL context. The cert and the signing callback will be used for client authentication in TLS handshake. Args: enterprise_cert_file_path (str): the path to a enterprise cert JSON file. The file should contain the following field: { "libs": { "ecp_client": "...", "tls_offload": "..." } } """ self._enterprise_cert_file_path = enterprise_cert_file_path self._cert = None self._sign_callback = None self._provider_lib = None def load_libraries(self): with open(self._enterprise_cert_file_path, "r") as f: enterprise_cert_json = json.load(f) libs = enterprise_cert_json.get("libs", {}) signer_library = libs.get("ecp_client", None) offload_library = libs.get("tls_offload", None) provider_library = libs.get("ecp_provider", None) # Using newer provider implementation. This is mutually exclusive to the # offload implementation. if provider_library: self._provider_lib = load_provider_lib(provider_library) return # Using old offload implementation if offload_library and signer_library: self._offload_lib = load_offload_lib(offload_library) self._signer_lib = load_signer_lib(signer_library) self.set_up_custom_key() return raise exceptions.MutualTLSChannelError("enterprise cert file is invalid") def set_up_custom_key(self): # We need to keep a reference of the cert and sign callback so it won't # be garbage collected, otherwise it will crash when used by signer lib. self._cert = get_cert(self._signer_lib, self._enterprise_cert_file_path) self._sign_callback = get_sign_callback( self._signer_lib, self._enterprise_cert_file_path ) def should_use_provider(self): if self._provider_lib: return True return False def attach_to_ssl_context(self, ctx): if self.should_use_provider(): if not self._provider_lib.ECP_attach_to_ctx( _cast_ssl_ctx_to_void_p_stdlib(ctx), self._enterprise_cert_file_path.encode("ascii"), ): raise exceptions.MutualTLSChannelError( "failed to configure ECP Provider SSL context" ) elif self._offload_lib and self._signer_lib: if not self._offload_lib.ConfigureSslContext( self._sign_callback, ctypes.c_char_p(self._cert), _cast_ssl_ctx_to_void_p_pyopenssl(ctx._ctx._context), ): raise exceptions.MutualTLSChannelError( "failed to configure ECP Offload SSL context" ) else: raise exceptions.MutualTLSChannelError("Invalid ECP configuration.") _aiohttp_requests.py 0000644 00000034421 15030037514 0010662 0 ustar 00 # Copyright 2020 Google LLC # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. """Transport adapter for Async HTTP (aiohttp). NOTE: This async support is experimental and marked internal. This surface may change in minor releases. """ from __future__ import absolute_import import asyncio import functools import aiohttp # type: ignore import urllib3 # type: ignore from google.auth import exceptions from google.auth import transport from google.auth.transport import requests # Timeout can be re-defined depending on async requirement. Currently made 60s more than # sync timeout. _DEFAULT_TIMEOUT = 180 # in seconds class _CombinedResponse(transport.Response): """ In order to more closely resemble the `requests` interface, where a raw and deflated content could be accessed at once, this class lazily reads the stream in `transport.Response` so both return forms can be used. The gzip and deflate transfer-encodings are automatically decoded for you because the default parameter for autodecompress into the ClientSession is set to False, and therefore we add this class to act as a wrapper for a user to be able to access both the raw and decoded response bodies - mirroring the sync implementation. """ def __init__(self, response): self._response = response self._raw_content = None def _is_compressed(self): headers = self._response.headers return "Content-Encoding" in headers and ( headers["Content-Encoding"] == "gzip" or headers["Content-Encoding"] == "deflate" ) @property def status(self): return self._response.status @property def headers(self): return self._response.headers @property def data(self): return self._response.content async def raw_content(self): if self._raw_content is None: self._raw_content = await self._response.content.read() return self._raw_content async def content(self): # Load raw_content if necessary await self.raw_content() if self._is_compressed(): decoder = urllib3.response.MultiDecoder( self._response.headers["Content-Encoding"] ) decompressed = decoder.decompress(self._raw_content) return decompressed return self._raw_content class _Response(transport.Response): """ Requests transport response adapter. Args: response (requests.Response): The raw Requests response. """ def __init__(self, response): self._response = response @property def status(self): return self._response.status @property def headers(self): return self._response.headers @property def data(self): return self._response.content class Request(transport.Request): """Requests request adapter. This class is used internally for making requests using asyncio transports in a consistent way. If you use :class:`AuthorizedSession` you do not need to construct or use this class directly. This class can be useful if you want to manually refresh a :class:`~google.auth.credentials.Credentials` instance:: import google.auth.transport.aiohttp_requests request = google.auth.transport.aiohttp_requests.Request() credentials.refresh(request) Args: session (aiohttp.ClientSession): An instance :class:`aiohttp.ClientSession` used to make HTTP requests. If not specified, a session will be created. .. automethod:: __call__ """ def __init__(self, session=None): # TODO: Use auto_decompress property for aiohttp 3.7+ if session is not None and session._auto_decompress: raise exceptions.InvalidOperation( "Client sessions with auto_decompress=True are not supported." ) self.session = session async def __call__( self, url, method="GET", body=None, headers=None, timeout=_DEFAULT_TIMEOUT, **kwargs, ): """ Make an HTTP request using aiohttp. Args: url (str): The URL to be requested. method (Optional[str]): The HTTP method to use for the request. Defaults to 'GET'. body (Optional[bytes]): The payload or body in HTTP request. headers (Optional[Mapping[str, str]]): Request headers. timeout (Optional[int]): The number of seconds to wait for a response from the server. If not specified or if None, the requests default timeout will be used. kwargs: Additional arguments passed through to the underlying requests :meth:`requests.Session.request` method. Returns: google.auth.transport.Response: The HTTP response. Raises: google.auth.exceptions.TransportError: If any exception occurred. """ try: if self.session is None: # pragma: NO COVER self.session = aiohttp.ClientSession( auto_decompress=False ) # pragma: NO COVER requests._LOGGER.debug("Making request: %s %s", method, url) response = await self.session.request( method, url, data=body, headers=headers, timeout=timeout, **kwargs ) return _CombinedResponse(response) except aiohttp.ClientError as caught_exc: new_exc = exceptions.TransportError(caught_exc) raise new_exc from caught_exc except asyncio.TimeoutError as caught_exc: new_exc = exceptions.TransportError(caught_exc) raise new_exc from caught_exc class AuthorizedSession(aiohttp.ClientSession): """This is an async implementation of the Authorized Session class. We utilize an aiohttp transport instance, and the interface mirrors the google.auth.transport.requests Authorized Session class, except for the change in the transport used in the async use case. A Requests Session class with credentials. This class is used to perform requests to API endpoints that require authorization:: from google.auth.transport import aiohttp_requests async with aiohttp_requests.AuthorizedSession(credentials) as authed_session: response = await authed_session.request( 'GET', 'https://www.googleapis.com/storage/v1/b') The underlying :meth:`request` implementation handles adding the credentials' headers to the request and refreshing credentials as needed. Args: credentials (google.auth._credentials_async.Credentials): The credentials to add to the request. refresh_status_codes (Sequence[int]): Which HTTP status codes indicate that credentials should be refreshed and the request should be retried. max_refresh_attempts (int): The maximum number of times to attempt to refresh the credentials and retry the request. refresh_timeout (Optional[int]): The timeout value in seconds for credential refresh HTTP requests. auth_request (google.auth.transport.aiohttp_requests.Request): (Optional) An instance of :class:`~google.auth.transport.aiohttp_requests.Request` used when refreshing credentials. If not passed, an instance of :class:`~google.auth.transport.aiohttp_requests.Request` is created. kwargs: Additional arguments passed through to the underlying ClientSession :meth:`aiohttp.ClientSession` object. """ def __init__( self, credentials, refresh_status_codes=transport.DEFAULT_REFRESH_STATUS_CODES, max_refresh_attempts=transport.DEFAULT_MAX_REFRESH_ATTEMPTS, refresh_timeout=None, auth_request=None, auto_decompress=False, **kwargs, ): super(AuthorizedSession, self).__init__(**kwargs) self.credentials = credentials self._refresh_status_codes = refresh_status_codes self._max_refresh_attempts = max_refresh_attempts self._refresh_timeout = refresh_timeout self._is_mtls = False self._auth_request = auth_request self._auth_request_session = None self._loop = asyncio.get_event_loop() self._refresh_lock = asyncio.Lock() self._auto_decompress = auto_decompress async def request( self, method, url, data=None, headers=None, max_allowed_time=None, timeout=_DEFAULT_TIMEOUT, auto_decompress=False, **kwargs, ): """Implementation of Authorized Session aiohttp request. Args: method (str): The http request method used (e.g. GET, PUT, DELETE) url (str): The url at which the http request is sent. data (Optional[dict]): Dictionary, list of tuples, bytes, or file-like object to send in the body of the Request. headers (Optional[dict]): Dictionary of HTTP Headers to send with the Request. timeout (Optional[Union[float, aiohttp.ClientTimeout]]): The amount of time in seconds to wait for the server response with each individual request. Can also be passed as an ``aiohttp.ClientTimeout`` object. max_allowed_time (Optional[float]): If the method runs longer than this, a ``Timeout`` exception is automatically raised. Unlike the ``timeout`` parameter, this value applies to the total method execution time, even if multiple requests are made under the hood. Mind that it is not guaranteed that the timeout error is raised at ``max_allowed_time``. It might take longer, for example, if an underlying request takes a lot of time, but the request itself does not timeout, e.g. if a large file is being transmitted. The timout error will be raised after such request completes. """ # Headers come in as bytes which isn't expected behavior, the resumable # media libraries in some cases expect a str type for the header values, # but sometimes the operations return these in bytes types. if headers: for key in headers.keys(): if type(headers[key]) is bytes: headers[key] = headers[key].decode("utf-8") async with aiohttp.ClientSession( auto_decompress=self._auto_decompress, trust_env=kwargs.get("trust_env", False), ) as self._auth_request_session: auth_request = Request(self._auth_request_session) self._auth_request = auth_request # Use a kwarg for this instead of an attribute to maintain # thread-safety. _credential_refresh_attempt = kwargs.pop("_credential_refresh_attempt", 0) # Make a copy of the headers. They will be modified by the credentials # and we want to pass the original headers if we recurse. request_headers = headers.copy() if headers is not None else {} # Do not apply the timeout unconditionally in order to not override the # _auth_request's default timeout. auth_request = ( self._auth_request if timeout is None else functools.partial(self._auth_request, timeout=timeout) ) remaining_time = max_allowed_time with requests.TimeoutGuard(remaining_time, asyncio.TimeoutError) as guard: await self.credentials.before_request( auth_request, method, url, request_headers ) with requests.TimeoutGuard(remaining_time, asyncio.TimeoutError) as guard: response = await super(AuthorizedSession, self).request( method, url, data=data, headers=request_headers, timeout=timeout, **kwargs, ) remaining_time = guard.remaining_timeout if ( response.status in self._refresh_status_codes and _credential_refresh_attempt < self._max_refresh_attempts ): requests._LOGGER.info( "Refreshing credentials due to a %s response. Attempt %s/%s.", response.status, _credential_refresh_attempt + 1, self._max_refresh_attempts, ) # Do not apply the timeout unconditionally in order to not override the # _auth_request's default timeout. auth_request = ( self._auth_request if timeout is None else functools.partial(self._auth_request, timeout=timeout) ) with requests.TimeoutGuard( remaining_time, asyncio.TimeoutError ) as guard: async with self._refresh_lock: await self._loop.run_in_executor( None, self.credentials.refresh, auth_request ) remaining_time = guard.remaining_timeout return await self.request( method, url, data=data, headers=headers, max_allowed_time=remaining_time, timeout=timeout, _credential_refresh_attempt=_credential_refresh_attempt + 1, **kwargs, ) return response urllib3.py 0000644 00000037261 15030037514 0006501 0 ustar 00 # Copyright 2016 Google LLC # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. """Transport adapter for urllib3.""" from __future__ import absolute_import import logging import os import warnings # Certifi is Mozilla's certificate bundle. Urllib3 needs a certificate bundle # to verify HTTPS requests, and certifi is the recommended and most reliable # way to get a root certificate bundle. See # http://urllib3.readthedocs.io/en/latest/user-guide.html\ # #certificate-verification # For more details. try: import certifi except ImportError: # pragma: NO COVER certifi = None # type: ignore try: import urllib3 # type: ignore import urllib3.exceptions # type: ignore except ImportError as caught_exc: # pragma: NO COVER raise ImportError( "The urllib3 library is not installed from please install the " "urllib3 package to use the urllib3 transport." ) from caught_exc from packaging import version # type: ignore from google.auth import environment_vars from google.auth import exceptions from google.auth import transport from google.oauth2 import service_account if version.parse(urllib3.__version__) >= version.parse("2.0.0"): # pragma: NO COVER RequestMethods = urllib3._request_methods.RequestMethods # type: ignore else: # pragma: NO COVER RequestMethods = urllib3.request.RequestMethods # type: ignore _LOGGER = logging.getLogger(__name__) class _Response(transport.Response): """urllib3 transport response adapter. Args: response (urllib3.response.HTTPResponse): The raw urllib3 response. """ def __init__(self, response): self._response = response @property def status(self): return self._response.status @property def headers(self): return self._response.headers @property def data(self): return self._response.data class Request(transport.Request): """urllib3 request adapter. This class is used internally for making requests using various transports in a consistent way. If you use :class:`AuthorizedHttp` you do not need to construct or use this class directly. This class can be useful if you want to manually refresh a :class:`~google.auth.credentials.Credentials` instance:: import google.auth.transport.urllib3 import urllib3 http = urllib3.PoolManager() request = google.auth.transport.urllib3.Request(http) credentials.refresh(request) Args: http (urllib3.request.RequestMethods): An instance of any urllib3 class that implements :class:`~urllib3.request.RequestMethods`, usually :class:`urllib3.PoolManager`. .. automethod:: __call__ """ def __init__(self, http): self.http = http def __call__( self, url, method="GET", body=None, headers=None, timeout=None, **kwargs ): """Make an HTTP request using urllib3. Args: url (str): The URI to be requested. method (str): The HTTP method to use for the request. Defaults to 'GET'. body (bytes): The payload / body in HTTP request. headers (Mapping[str, str]): Request headers. timeout (Optional[int]): The number of seconds to wait for a response from the server. If not specified or if None, the urllib3 default timeout will be used. kwargs: Additional arguments passed throught to the underlying urllib3 :meth:`urlopen` method. Returns: google.auth.transport.Response: The HTTP response. Raises: google.auth.exceptions.TransportError: If any exception occurred. """ # urllib3 uses a sentinel default value for timeout, so only set it if # specified. if timeout is not None: kwargs["timeout"] = timeout try: _LOGGER.debug("Making request: %s %s", method, url) response = self.http.request( method, url, body=body, headers=headers, **kwargs ) return _Response(response) except urllib3.exceptions.HTTPError as caught_exc: new_exc = exceptions.TransportError(caught_exc) raise new_exc from caught_exc def _make_default_http(): if certifi is not None: return urllib3.PoolManager(cert_reqs="CERT_REQUIRED", ca_certs=certifi.where()) else: return urllib3.PoolManager() def _make_mutual_tls_http(cert, key): """Create a mutual TLS HTTP connection with the given client cert and key. See https://github.com/urllib3/urllib3/issues/474#issuecomment-253168415 Args: cert (bytes): client certificate in PEM format key (bytes): client private key in PEM format Returns: urllib3.PoolManager: Mutual TLS HTTP connection. Raises: ImportError: If certifi or pyOpenSSL is not installed. OpenSSL.crypto.Error: If the cert or key is invalid. """ import certifi from OpenSSL import crypto import urllib3.contrib.pyopenssl # type: ignore urllib3.contrib.pyopenssl.inject_into_urllib3() ctx = urllib3.util.ssl_.create_urllib3_context() ctx.load_verify_locations(cafile=certifi.where()) pkey = crypto.load_privatekey(crypto.FILETYPE_PEM, key) x509 = crypto.load_certificate(crypto.FILETYPE_PEM, cert) ctx._ctx.use_certificate(x509) ctx._ctx.use_privatekey(pkey) http = urllib3.PoolManager(ssl_context=ctx) return http class AuthorizedHttp(RequestMethods): # type: ignore """A urllib3 HTTP class with credentials. This class is used to perform requests to API endpoints that require authorization:: from google.auth.transport.urllib3 import AuthorizedHttp authed_http = AuthorizedHttp(credentials) response = authed_http.request( 'GET', 'https://www.googleapis.com/storage/v1/b') This class implements :class:`urllib3.request.RequestMethods` and can be used just like any other :class:`urllib3.PoolManager`. The underlying :meth:`urlopen` implementation handles adding the credentials' headers to the request and refreshing credentials as needed. This class also supports mutual TLS via :meth:`configure_mtls_channel` method. In order to use this method, the `GOOGLE_API_USE_CLIENT_CERTIFICATE` environment variable must be explicitly set to `true`, otherwise it does nothing. Assume the environment is set to `true`, the method behaves in the following manner: If client_cert_callback is provided, client certificate and private key are loaded using the callback; if client_cert_callback is None, application default SSL credentials will be used. Exceptions are raised if there are problems with the certificate, private key, or the loading process, so it should be called within a try/except block. First we set the environment variable to `true`, then create an :class:`AuthorizedHttp` instance and specify the endpoints:: regular_endpoint = 'https://pubsub.googleapis.com/v1/projects/{my_project_id}/topics' mtls_endpoint = 'https://pubsub.mtls.googleapis.com/v1/projects/{my_project_id}/topics' authed_http = AuthorizedHttp(credentials) Now we can pass a callback to :meth:`configure_mtls_channel`:: def my_cert_callback(): # some code to load client cert bytes and private key bytes, both in # PEM format. some_code_to_load_client_cert_and_key() if loaded: return cert, key raise MyClientCertFailureException() # Always call configure_mtls_channel within a try/except block. try: is_mtls = authed_http.configure_mtls_channel(my_cert_callback) except: # handle exceptions. if is_mtls: response = authed_http.request('GET', mtls_endpoint) else: response = authed_http.request('GET', regular_endpoint) You can alternatively use application default SSL credentials like this:: try: is_mtls = authed_http.configure_mtls_channel() except: # handle exceptions. Args: credentials (google.auth.credentials.Credentials): The credentials to add to the request. http (urllib3.PoolManager): The underlying HTTP object to use to make requests. If not specified, a :class:`urllib3.PoolManager` instance will be constructed with sane defaults. refresh_status_codes (Sequence[int]): Which HTTP status codes indicate that credentials should be refreshed and the request should be retried. max_refresh_attempts (int): The maximum number of times to attempt to refresh the credentials and retry the request. default_host (Optional[str]): A host like "pubsub.googleapis.com". This is used when a self-signed JWT is created from service account credentials. """ def __init__( self, credentials, http=None, refresh_status_codes=transport.DEFAULT_REFRESH_STATUS_CODES, max_refresh_attempts=transport.DEFAULT_MAX_REFRESH_ATTEMPTS, default_host=None, ): if http is None: self.http = _make_default_http() self._has_user_provided_http = False else: self.http = http self._has_user_provided_http = True self.credentials = credentials self._refresh_status_codes = refresh_status_codes self._max_refresh_attempts = max_refresh_attempts self._default_host = default_host # Request instance used by internal methods (for example, # credentials.refresh). self._request = Request(self.http) # https://google.aip.dev/auth/4111 # Attempt to use self-signed JWTs when a service account is used. if isinstance(self.credentials, service_account.Credentials): self.credentials._create_self_signed_jwt( "https://{}/".format(self._default_host) if self._default_host else None ) super(AuthorizedHttp, self).__init__() def configure_mtls_channel(self, client_cert_callback=None): """Configures mutual TLS channel using the given client_cert_callback or application default SSL credentials. The behavior is controlled by `GOOGLE_API_USE_CLIENT_CERTIFICATE` environment variable. (1) If the environment variable value is `true`, the function returns True if the channel is mutual TLS and False otherwise. The `http` provided in the constructor will be overwritten. (2) If the environment variable is not set or `false`, the function does nothing and it always return False. Args: client_cert_callback (Optional[Callable[[], (bytes, bytes)]]): The optional callback returns the client certificate and private key bytes both in PEM format. If the callback is None, application default SSL credentials will be used. Returns: True if the channel is mutual TLS and False otherwise. Raises: google.auth.exceptions.MutualTLSChannelError: If mutual TLS channel creation failed for any reason. """ use_client_cert = os.getenv( environment_vars.GOOGLE_API_USE_CLIENT_CERTIFICATE, "false" ) if use_client_cert != "true": return False try: import OpenSSL except ImportError as caught_exc: new_exc = exceptions.MutualTLSChannelError(caught_exc) raise new_exc from caught_exc try: found_cert_key, cert, key = transport._mtls_helper.get_client_cert_and_key( client_cert_callback ) if found_cert_key: self.http = _make_mutual_tls_http(cert, key) else: self.http = _make_default_http() except ( exceptions.ClientCertError, ImportError, OpenSSL.crypto.Error, ) as caught_exc: new_exc = exceptions.MutualTLSChannelError(caught_exc) raise new_exc from caught_exc if self._has_user_provided_http: self._has_user_provided_http = False warnings.warn( "`http` provided in the constructor is overwritten", UserWarning ) return found_cert_key def urlopen(self, method, url, body=None, headers=None, **kwargs): """Implementation of urllib3's urlopen.""" # pylint: disable=arguments-differ # We use kwargs to collect additional args that we don't need to # introspect here. However, we do explicitly collect the two # positional arguments. # Use a kwarg for this instead of an attribute to maintain # thread-safety. _credential_refresh_attempt = kwargs.pop("_credential_refresh_attempt", 0) if headers is None: headers = self.headers # Make a copy of the headers. They will be modified by the credentials # and we want to pass the original headers if we recurse. request_headers = headers.copy() self.credentials.before_request(self._request, method, url, request_headers) response = self.http.urlopen( method, url, body=body, headers=request_headers, **kwargs ) # If the response indicated that the credentials needed to be # refreshed, then refresh the credentials and re-attempt the # request. # A stored token may expire between the time it is retrieved and # the time the request is made, so we may need to try twice. # The reason urllib3's retries aren't used is because they # don't allow you to modify the request headers. :/ if ( response.status in self._refresh_status_codes and _credential_refresh_attempt < self._max_refresh_attempts ): _LOGGER.info( "Refreshing credentials due to a %s response. Attempt %s/%s.", response.status, _credential_refresh_attempt + 1, self._max_refresh_attempts, ) self.credentials.refresh(self._request) # Recurse. Pass in the original headers, not our modified set. return self.urlopen( method, url, body=body, headers=headers, _credential_refresh_attempt=_credential_refresh_attempt + 1, **kwargs ) return response # Proxy methods for compliance with the urllib3.PoolManager interface def __enter__(self): """Proxy to ``self.http``.""" return self.http.__enter__() def __exit__(self, exc_type, exc_val, exc_tb): """Proxy to ``self.http``.""" return self.http.__exit__(exc_type, exc_val, exc_tb) def __del__(self): if hasattr(self, "http") and self.http is not None: self.http.clear() @property def headers(self): """Proxy to ``self.http``.""" return self.http.headers @headers.setter def headers(self, value): """Proxy to ``self.http``.""" self.http.headers = value _http_client.py 0000644 00000007172 15030037514 0007577 0 ustar 00 # Copyright 2016 Google LLC # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. """Transport adapter for http.client, for internal use only.""" import http.client as http_client import logging import socket import urllib from google.auth import exceptions from google.auth import transport _LOGGER = logging.getLogger(__name__) class Response(transport.Response): """http.client transport response adapter. Args: response (http.client.HTTPResponse): The raw http client response. """ def __init__(self, response): self._status = response.status self._headers = {key.lower(): value for key, value in response.getheaders()} self._data = response.read() @property def status(self): return self._status @property def headers(self): return self._headers @property def data(self): return self._data class Request(transport.Request): """http.client transport request adapter.""" def __call__( self, url, method="GET", body=None, headers=None, timeout=None, **kwargs ): """Make an HTTP request using http.client. Args: url (str): The URI to be requested. method (str): The HTTP method to use for the request. Defaults to 'GET'. body (bytes): The payload / body in HTTP request. headers (Mapping): Request headers. timeout (Optional(int)): The number of seconds to wait for a response from the server. If not specified or if None, the socket global default timeout will be used. kwargs: Additional arguments passed throught to the underlying :meth:`~http.client.HTTPConnection.request` method. Returns: Response: The HTTP response. Raises: google.auth.exceptions.TransportError: If any exception occurred. """ # socket._GLOBAL_DEFAULT_TIMEOUT is the default in http.client. if timeout is None: timeout = socket._GLOBAL_DEFAULT_TIMEOUT # http.client doesn't allow None as the headers argument. if headers is None: headers = {} # http.client needs the host and path parts specified separately. parts = urllib.parse.urlsplit(url) path = urllib.parse.urlunsplit( ("", "", parts.path, parts.query, parts.fragment) ) if parts.scheme != "http": raise exceptions.TransportError( "http.client transport only supports the http scheme, {}" "was specified".format(parts.scheme) ) connection = http_client.HTTPConnection(parts.netloc, timeout=timeout) try: _LOGGER.debug("Making request: %s %s", method, url) connection.request(method, path, body=body, headers=headers, **kwargs) response = connection.getresponse() return Response(response) except (http_client.HTTPException, socket.error) as caught_exc: new_exc = exceptions.TransportError(caught_exc) raise new_exc from caught_exc finally: connection.close() __pycache__/_aiohttp_requests.cpython-310.pyc 0000644 00000027106 15030037514 0015223 0 ustar 00 o �h9 � @ s� d Z ddlmZ ddlZddlZddlZddlZddlmZ ddlm Z ddl m Z dZ G dd � d e j �ZG d d � d e j �ZG d d � d e j�ZG dd� dej�ZdS )z�Transport adapter for Async HTTP (aiohttp). NOTE: This async support is experimental and marked internal. This surface may change in minor releases. � )�absolute_importN)� exceptions)� transport)�requests� c @ sT e Zd ZdZdd� Zdd� Zedd� �Zedd � �Zed d � �Z d d � Z dd� Z dS )�_CombinedResponsea@ In order to more closely resemble the `requests` interface, where a raw and deflated content could be accessed at once, this class lazily reads the stream in `transport.Response` so both return forms can be used. The gzip and deflate transfer-encodings are automatically decoded for you because the default parameter for autodecompress into the ClientSession is set to False, and therefore we add this class to act as a wrapper for a user to be able to access both the raw and decoded response bodies - mirroring the sync implementation. c C s || _ d | _d S �N)� _response� _raw_content��self�response� r �]/usr/local/CyberPanel/lib/python3.10/site-packages/google/auth/transport/_aiohttp_requests.py�__init__3 s z_CombinedResponse.__init__c C s( | j j}d|v o|d dkp|d dkS )N�Content-Encoding�gzip�deflate�r �headers)r r r r r �_is_compressed7 s �z _CombinedResponse._is_compressedc C � | j jS r �r �status�r r r r r > � z_CombinedResponse.statusc C r r r r r r r r B r z_CombinedResponse.headersc C r r �r �contentr r r r �dataF r z_CombinedResponse.datac � s& �| j d u r| jj�� I d H | _ | j S r )r r r �readr r r r � raw_contentJ s � z _CombinedResponse.raw_contentc � sB �| � � I d H | �� r tj�| jjd �}|�| j�}|S | jS )Nr ) r r �urllib3r � MultiDecoderr r � decompressr )r �decoder� decompressedr r r r O s � � z_CombinedResponse.contentN) �__name__� __module__� __qualname__�__doc__r r �propertyr r r r r r r r r r & s r c @ s< e Zd ZdZdd� Zedd� �Zedd� �Zedd � �Zd S ) � _Responsezz Requests transport response adapter. Args: response (requests.Response): The raw Requests response. c C s || _ d S r )r r r r r r d s z_Response.__init__c C r r r r r r r r g r z_Response.statusc C r r r r r r r r k r z_Response.headersc C r r r r r r r r o r z_Response.dataN) r& r' r( r) r r* r r r r r r r r+ \ s r+ c @ s, e Zd ZdZddd�Zdddefdd�ZdS ) �Requesta� Requests request adapter. This class is used internally for making requests using asyncio transports in a consistent way. If you use :class:`AuthorizedSession` you do not need to construct or use this class directly. This class can be useful if you want to manually refresh a :class:`~google.auth.credentials.Credentials` instance:: import google.auth.transport.aiohttp_requests request = google.auth.transport.aiohttp_requests.Request() credentials.refresh(request) Args: session (aiohttp.ClientSession): An instance :class:`aiohttp.ClientSession` used to make HTTP requests. If not specified, a session will be created. .. automethod:: __call__ Nc C s" |d ur |j r t�d��|| _d S )Nz<Client sessions with auto_decompress=True are not supported.)�_auto_decompressr �InvalidOperation�session)r r/ r r r r � s � zRequest.__init__�GETc � s� �z+| j du rtjdd�| _ tj�d||� | j j||f|||d�|��I dH }t|�W S tjyA } zt � |�} | |�d}~w t j yU } zt � |�} | |�d}~ww )a� Make an HTTP request using aiohttp. Args: url (str): The URL to be requested. method (Optional[str]): The HTTP method to use for the request. Defaults to 'GET'. body (Optional[bytes]): The payload or body in HTTP request. headers (Optional[Mapping[str, str]]): Request headers. timeout (Optional[int]): The number of seconds to wait for a response from the server. If not specified or if None, the requests default timeout will be used. kwargs: Additional arguments passed through to the underlying requests :meth:`requests.Session.request` method. Returns: google.auth.transport.Response: The HTTP response. Raises: google.auth.exceptions.TransportError: If any exception occurred. NF)�auto_decompresszMaking request: %s %s�r r �timeout) r/ �aiohttp� ClientSessionr �_LOGGER�debug�requestr � ClientErrorr �TransportError�asyncio� TimeoutError) r �url�method�bodyr r3 �kwargsr � caught_exc�new_excr r r �__call__� s0 �! ��� � � ��zRequest.__call__r )r& r' r( r) r �_DEFAULT_TIMEOUTrC r r r r r, t s �r, c sH e Zd ZdZejejdddf� fdd� Zdddedf� fdd� Z � Z S )�AuthorizedSessionaN This is an async implementation of the Authorized Session class. We utilize an aiohttp transport instance, and the interface mirrors the google.auth.transport.requests Authorized Session class, except for the change in the transport used in the async use case. A Requests Session class with credentials. This class is used to perform requests to API endpoints that require authorization:: from google.auth.transport import aiohttp_requests async with aiohttp_requests.AuthorizedSession(credentials) as authed_session: response = await authed_session.request( 'GET', 'https://www.googleapis.com/storage/v1/b') The underlying :meth:`request` implementation handles adding the credentials' headers to the request and refreshing credentials as needed. Args: credentials (google.auth._credentials_async.Credentials): The credentials to add to the request. refresh_status_codes (Sequence[int]): Which HTTP status codes indicate that credentials should be refreshed and the request should be retried. max_refresh_attempts (int): The maximum number of times to attempt to refresh the credentials and retry the request. refresh_timeout (Optional[int]): The timeout value in seconds for credential refresh HTTP requests. auth_request (google.auth.transport.aiohttp_requests.Request): (Optional) An instance of :class:`~google.auth.transport.aiohttp_requests.Request` used when refreshing credentials. If not passed, an instance of :class:`~google.auth.transport.aiohttp_requests.Request` is created. kwargs: Additional arguments passed through to the underlying ClientSession :meth:`aiohttp.ClientSession` object. NFc s^ t t| �jdi |�� || _|| _|| _|| _d| _|| _d | _ t � � | _ t � � | _|| _d S )NFr )�superrE r � credentials�_refresh_status_codes�_max_refresh_attempts�_refresh_timeout�_is_mtls� _auth_request�_auth_request_sessionr; �get_event_loop�_loop�Lock� _refresh_lockr- )r rG �refresh_status_codes�max_refresh_attempts�refresh_timeout� auth_requestr1 r@ �� __class__r r r � s zAuthorizedSession.__init__c � s� �|r|� � D ]} t|| �tu r|| �d�|| < qtj| j|�dd�d�4 I dH �� | _t | j�} | | _ |� dd�} |durD|� � ni } |du rM| j nt j| j |d�} |} t�| tj��}| j�| ||| �I dH W d � n1 suw Y t�| tj�� }tt| �j||f|| |d �|��I dH }W d � n1 s�w Y |j} |j| jv �r5| | jk �r@tj � d |j| d | j� |du r�| j nt j| j |d�} t�| tj��2}| j 4 I dH � | j � d| jj!| �I dH W d �I dH n 1 I dH s�w Y W d � n 1 �sw Y |j} | j||f||| || d d �|��I dH W d �I dH S W d �I dH |S W d �I dH |S 1 I dH �sRw Y |S ) a� Implementation of Authorized Session aiohttp request. Args: method (str): The http request method used (e.g. GET, PUT, DELETE) url (str): The url at which the http request is sent. data (Optional[dict]): Dictionary, list of tuples, bytes, or file-like object to send in the body of the Request. headers (Optional[dict]): Dictionary of HTTP Headers to send with the Request. timeout (Optional[Union[float, aiohttp.ClientTimeout]]): The amount of time in seconds to wait for the server response with each individual request. Can also be passed as an ``aiohttp.ClientTimeout`` object. max_allowed_time (Optional[float]): If the method runs longer than this, a ``Timeout`` exception is automatically raised. Unlike the ``timeout`` parameter, this value applies to the total method execution time, even if multiple requests are made under the hood. Mind that it is not guaranteed that the timeout error is raised at ``max_allowed_time``. It might take longer, for example, if an underlying request takes a lot of time, but the request itself does not timeout, e.g. if a large file is being transmitted. The timout error will be raised after such request completes. zutf-8� trust_envF)r1 rX N�_credential_refresh_attemptr )r3 r2 z;Refreshing credentials due to a %s response. Attempt %s/%s.� )r r �max_allowed_timer3 rY )"�keys�type�bytes�decoder4 r5 r- �getrM r, rL �pop�copy� functools�partialr � TimeoutGuardr; r< rG �before_requestrF rE r8 �remaining_timeoutr rH rI r6 �inforQ rO �run_in_executor�refresh)r r> r= r r r[ r3 r1 r@ �keyrU rY �request_headers�remaining_time�guardr rV r r r8 s� �+ � � �� � � ��� � � ��� �(�� ��� ��*�R��R�RzAuthorizedSession.request) r& r' r( r) r � DEFAULT_REFRESH_STATUS_CODES� DEFAULT_MAX_REFRESH_ATTEMPTSr rD r8 � __classcell__r r rV r rE � s )��rE )r) � __future__r r; rc r4 r! � google.authr r �google.auth.transportr rD �Responser r+ r, r5 rE r r r r �<module> s 6T __pycache__/urllib3.cpython-310.pyc 0000644 00000031530 15030037514 0013031 0 ustar 00 o �h�> � @ s: d Z ddlmZ ddlZddlZddlZzddlZW n ey% dZY nw z ddlZddl ZW n eyA Z zed�e �dZ [ ww ddl m Z ddl mZ ddl mZ ddl mZ dd lmZ e �ej�e �d �krpejjZnejjZe�e�ZG d d � d ej�Z G d d� dej �Z dd� Z dd� Z G dd� de�Z dS )z Transport adapter for urllib3.� )�absolute_importNzjThe urllib3 library is not installed from please install the urllib3 package to use the urllib3 transport.)�version)�environment_vars)� exceptions)� transport)�service_accountz2.0.0c @ s< e Zd ZdZdd� Zedd� �Zedd� �Zedd � �Zd S ) � _Responsezurllib3 transport response adapter. Args: response (urllib3.response.HTTPResponse): The raw urllib3 response. c C � || _ d S �N)� _response)�self�response� r �S/usr/local/CyberPanel/lib/python3.10/site-packages/google/auth/transport/urllib3.py�__init__A � z_Response.__init__c C � | j jS r )r �status�r r r r r D � z_Response.statusc C r r )r �headersr r r r r H r z_Response.headersc C r r )r �datar r r r r L r z_Response.dataN) �__name__� __module__� __qualname__�__doc__r �propertyr r r r r r r r : s r c @ s$ e Zd ZdZdd� Z ddd�ZdS ) �Requesta# urllib3 request adapter. This class is used internally for making requests using various transports in a consistent way. If you use :class:`AuthorizedHttp` you do not need to construct or use this class directly. This class can be useful if you want to manually refresh a :class:`~google.auth.credentials.Credentials` instance:: import google.auth.transport.urllib3 import urllib3 http = urllib3.PoolManager() request = google.auth.transport.urllib3.Request(http) credentials.refresh(request) Args: http (urllib3.request.RequestMethods): An instance of any urllib3 class that implements :class:`~urllib3.request.RequestMethods`, usually :class:`urllib3.PoolManager`. .. automethod:: __call__ c C r r )�http)r r r r r r k r zRequest.__init__�GETNc K sr |dur||d< zt �d||� | jj||f||d�|��}t|�W S tjjy8 } zt�|�} | |�d}~ww )a= Make an HTTP request using urllib3. Args: url (str): The URI to be requested. method (str): The HTTP method to use for the request. Defaults to 'GET'. body (bytes): The payload / body in HTTP request. headers (Mapping[str, str]): Request headers. timeout (Optional[int]): The number of seconds to wait for a response from the server. If not specified or if None, the urllib3 default timeout will be used. kwargs: Additional arguments passed throught to the underlying urllib3 :meth:`urlopen` method. Returns: google.auth.transport.Response: The HTTP response. Raises: google.auth.exceptions.TransportError: If any exception occurred. N�timeoutzMaking request: %s %s��bodyr ) �_LOGGER�debugr �requestr �urllib3r � HTTPError�TransportError) r �url�methodr" r r �kwargsr � caught_exc�new_excr r r �__call__n s" ��� ��zRequest.__call__)r NNN)r r r r r r. r r r r r Q s �r c C s" t d ur tjdt �� d�S t�� S )N� CERT_REQUIRED)� cert_reqs�ca_certs)�certifir& � PoolManager�wherer r r r �_make_default_http� s r5 c C s� ddl }ddlm} ddl}|jj�� |jj� � }|j |� � d� |� |j |�}|�|j | �}|j�|� |j�|� |j|d�}|S )a� Create a mutual TLS HTTP connection with the given client cert and key. See https://github.com/urllib3/urllib3/issues/474#issuecomment-253168415 Args: cert (bytes): client certificate in PEM format key (bytes): client private key in PEM format Returns: urllib3.PoolManager: Mutual TLS HTTP connection. Raises: ImportError: If certifi or pyOpenSSL is not installed. OpenSSL.crypto.Error: If the cert or key is invalid. r N)�crypto)�cafile)� ssl_context)r2 �OpenSSLr6 �urllib3.contrib.pyopenssl�contrib� pyopenssl�inject_into_urllib3�util�ssl_�create_urllib3_context�load_verify_locationsr4 �load_privatekey� FILETYPE_PEM�load_certificate�_ctx�use_certificate�use_privatekeyr3 ) �cert�keyr2 r6 r& �ctx�pkey�x509r r r r �_make_mutual_tls_http� s rM c st e Zd ZdZdejejdf� fdd� Zddd�Zddd�Z d d � Z d d � Z d d� Z e dd� �Zejdd� �Z� ZS )�AuthorizedHttpa� A urllib3 HTTP class with credentials. This class is used to perform requests to API endpoints that require authorization:: from google.auth.transport.urllib3 import AuthorizedHttp authed_http = AuthorizedHttp(credentials) response = authed_http.request( 'GET', 'https://www.googleapis.com/storage/v1/b') This class implements :class:`urllib3.request.RequestMethods` and can be used just like any other :class:`urllib3.PoolManager`. The underlying :meth:`urlopen` implementation handles adding the credentials' headers to the request and refreshing credentials as needed. This class also supports mutual TLS via :meth:`configure_mtls_channel` method. In order to use this method, the `GOOGLE_API_USE_CLIENT_CERTIFICATE` environment variable must be explicitly set to `true`, otherwise it does nothing. Assume the environment is set to `true`, the method behaves in the following manner: If client_cert_callback is provided, client certificate and private key are loaded using the callback; if client_cert_callback is None, application default SSL credentials will be used. Exceptions are raised if there are problems with the certificate, private key, or the loading process, so it should be called within a try/except block. First we set the environment variable to `true`, then create an :class:`AuthorizedHttp` instance and specify the endpoints:: regular_endpoint = 'https://pubsub.googleapis.com/v1/projects/{my_project_id}/topics' mtls_endpoint = 'https://pubsub.mtls.googleapis.com/v1/projects/{my_project_id}/topics' authed_http = AuthorizedHttp(credentials) Now we can pass a callback to :meth:`configure_mtls_channel`:: def my_cert_callback(): # some code to load client cert bytes and private key bytes, both in # PEM format. some_code_to_load_client_cert_and_key() if loaded: return cert, key raise MyClientCertFailureException() # Always call configure_mtls_channel within a try/except block. try: is_mtls = authed_http.configure_mtls_channel(my_cert_callback) except: # handle exceptions. if is_mtls: response = authed_http.request('GET', mtls_endpoint) else: response = authed_http.request('GET', regular_endpoint) You can alternatively use application default SSL credentials like this:: try: is_mtls = authed_http.configure_mtls_channel() except: # handle exceptions. Args: credentials (google.auth.credentials.Credentials): The credentials to add to the request. http (urllib3.PoolManager): The underlying HTTP object to use to make requests. If not specified, a :class:`urllib3.PoolManager` instance will be constructed with sane defaults. refresh_status_codes (Sequence[int]): Which HTTP status codes indicate that credentials should be refreshed and the request should be retried. max_refresh_attempts (int): The maximum number of times to attempt to refresh the credentials and retry the request. default_host (Optional[str]): A host like "pubsub.googleapis.com". This is used when a self-signed JWT is created from service account credentials. Nc s� |d u r t � | _d| _n|| _d| _|| _|| _|| _|| _t| j�| _t | jt j �r:| j� | jr7d� | j�nd � tt| ��� d S )NFTz https://{}/)r5 r �_has_user_provided_http� credentials�_refresh_status_codes�_max_refresh_attempts� _default_hostr �_request� isinstancer � Credentials�_create_self_signed_jwt�format�superrN r )r rP r �refresh_status_codes�max_refresh_attempts� default_host�� __class__r r r s �zAuthorizedHttp.__init__c C s� t �tjd�}|dkr dS zddl}W n ty' } zt�|�}||�d}~ww ztj � |�\}}}|r;t ||�| _ nt � | _ W n tjt|jjfyZ } zt�|�}||�d}~ww | jrgd| _t�dt� |S )aS Configures mutual TLS channel using the given client_cert_callback or application default SSL credentials. The behavior is controlled by `GOOGLE_API_USE_CLIENT_CERTIFICATE` environment variable. (1) If the environment variable value is `true`, the function returns True if the channel is mutual TLS and False otherwise. The `http` provided in the constructor will be overwritten. (2) If the environment variable is not set or `false`, the function does nothing and it always return False. Args: client_cert_callback (Optional[Callable[[], (bytes, bytes)]]): The optional callback returns the client certificate and private key bytes both in PEM format. If the callback is None, application default SSL credentials will be used. Returns: True if the channel is mutual TLS and False otherwise. Raises: google.auth.exceptions.MutualTLSChannelError: If mutual TLS channel creation failed for any reason. �false�trueFr Nz1`http` provided in the constructor is overwritten)�os�getenvr �!GOOGLE_API_USE_CLIENT_CERTIFICATEr9 � ImportErrorr �MutualTLSChannelErrorr � _mtls_helper�get_client_cert_and_keyrM r r5 �ClientCertErrorr6 �ErrorrO �warnings�warn� UserWarning) r �client_cert_callback�use_client_certr9 r, r- �found_cert_keyrH rI r r r �configure_mtls_channel0 sF � �� �� � ���z%AuthorizedHttp.configure_mtls_channelc K s� |� dd�}|du r | j}|�� }| j�| j|||� | jj||f||d�|��}|j| j v rW|| j k rWt � d|j|d | j � | j� | j� | j||f|||d d�|��S |S )z$Implementation of urllib3's urlopen.�_credential_refresh_attemptr Nr! z;Refreshing credentials due to a %s response. Attempt %s/%s.� )r" r rq )�popr �copyrP �before_requestrT r �urlopenr rQ rR r# �info�refresh) r r* r) r" r r+ rq �request_headersr r r r rv m s@ ��� ���� zAuthorizedHttp.urlopenc C s | j �� S ��Proxy to ``self.http``.)r � __enter__r r r r r| � s zAuthorizedHttp.__enter__c C s | j �|||�S rz )r �__exit__)r �exc_type�exc_val�exc_tbr r r r} � s zAuthorizedHttp.__exit__c C s* t | d�r| jd ur| j�� d S d S d S )Nr )�hasattrr �clearr r r r �__del__� s �zAuthorizedHttp.__del__c C r rz �r r r r r r r � s zAuthorizedHttp.headersc C s || j _dS )r{ Nr� )r �valuer r r r � s r )NN)r r r r r � DEFAULT_REFRESH_STATUS_CODES� DEFAULT_MAX_REFRESH_ATTEMPTSr rp rv r| r} r� r r �setter� __classcell__r r r] r rN � s U� =; rN )!r � __future__r �loggingra rj r2 rd r& �urllib3.exceptionsr, � packagingr � google.authr r r � google.oauth2r �parse� __version__�_request_methods�RequestMethodsr% � getLoggerr r# �Responser r r5 rM rN r r r r �<module> sF � ���� D! __pycache__/requests.cpython-310.pyc 0000644 00000043374 15030037514 0013341 0 ustar 00 o �hOW � @ s< d Z ddlmZ ddlZddlZddlZddlZddlZzddlZW n e y3 Z ze d�e �dZ [ ww ddl Zddl Zddl mZ ddlmZ ddlmZ ddlmZ ddlZdd lmZ e�e�Zd ZG d d � d ej�Z G d d� de �Z G dd� dej �Z G dd� dej j!�Z"G dd� dej j!�Z#G dd� dej$�Z%dS )z Transport adapter for Requests.� )�absolute_importNzmThe requests library is not installed from please install the requests package to use the requests transport.)�create_urllib3_context)�environment_vars)� exceptions)� transport)�service_account�x c @ s< e Zd ZdZdd� Zedd� �Zedd� �Zedd � �Zd S ) � _ResponsezuRequests transport response adapter. Args: response (requests.Response): The raw Requests response. c C s || _ d S �N)� _response)�self�response� r �T/usr/local/CyberPanel/lib/python3.10/site-packages/google/auth/transport/requests.py�__init__7 s z_Response.__init__c C � | j jS r )r � status_code�r r r r �status: � z_Response.statusc C r r )r �headersr r r r r > r z_Response.headersc C r r )r �contentr r r r �dataB r z_Response.dataN) �__name__� __module__� __qualname__�__doc__r �propertyr r r r r r r r 0 s r c @ s0 e Zd ZdZejjfdd�Zdd� Zdd� Z dS ) � TimeoutGuardaU A context manager raising an error if the suite execution took too long. Args: timeout (Union[None, Union[float, Tuple[float, float]]]): The maximum number of seconds a suite can run without the context manager raising a timeout exception on exit. If passed as a tuple, the smaller of the values is taken as a timeout. If ``None``, a timeout error is never raised. timeout_error_type (Optional[Exception]): The type of the error to raise on timeout. Defaults to :class:`requests.exceptions.Timeout`. c C s || _ || _|| _d S r )�_timeout�remaining_timeout�_timeout_error_type)r �timeout�timeout_error_typer r r r U s zTimeoutGuard.__init__c C s t � � | _| S r )�time�_startr r r r � __enter__Z s zTimeoutGuard.__enter__c s� |rd S | j d u r d S t�� | j � d}t| j tj�r'| j � | _| jdk}nt� fdd�| j D ��| _t| j�dk}|rA| � � �d S )NFr c 3 s � | ]}|� V qd S r r )�.0�x��elapsedr r � <genexpr>l s � z(TimeoutGuard.__exit__.<locals>.<genexpr>) r r$ r% � isinstance�numbers�Numberr �tuple�minr! )r �exc_type� exc_value� traceback� deadline_hitr r) r �__exit__^ s �zTimeoutGuard.__exit__N) r r r r �requestsr �Timeoutr r& r5 r r r r r G s r c @ s4 e Zd ZdZd dd�Zdd� Zdddefdd �ZdS ) �Requesta� Requests request adapter. This class is used internally for making requests using various transports in a consistent way. If you use :class:`AuthorizedSession` you do not need to construct or use this class directly. This class can be useful if you want to manually refresh a :class:`~google.auth.credentials.Credentials` instance:: import google.auth.transport.requests import requests request = google.auth.transport.requests.Request() credentials.refresh(request) Args: session (requests.Session): An instance :class:`requests.Session` used to make HTTP requests. If not specified, a session will be created. .. automethod:: __call__ Nc C s |st �� }|| _d S r )r6 �Session�session)r r: r r r r � s zRequest.__init__c C sF zt | d�r| jd ur| j�� W d S W d S W d S ty" Y d S w )Nr: )�hasattrr: �close� TypeErrorr r r r �__del__� s � �zRequest.__del__�GETc K sd zt �d||� | jj||f|||d�|��}t|�W S tjjy1 } zt�|�} | |�d}~ww )aR Make an HTTP request using requests. Args: url (str): The URI to be requested. method (str): The HTTP method to use for the request. Defaults to 'GET'. body (bytes): The payload or body in HTTP request. headers (Mapping[str, str]): Request headers. timeout (Optional[int]): The number of seconds to wait for a response from the server. If not specified or if None, the requests default timeout will be used. kwargs: Additional arguments passed through to the underlying requests :meth:`~requests.Session.request` method. Returns: google.auth.transport.Response: The HTTP response. Raises: google.auth.exceptions.TransportError: If any exception occurred. zMaking request: %s %s�r r r" N) �_LOGGER�debugr: �requestr r6 r �RequestException�TransportError) r �url�method�bodyr r" �kwargsr � caught_exc�new_excr r r �__call__� s ��� ��zRequest.__call__r )r r r r r r> �_DEFAULT_TIMEOUTrL r r r r r8 s s �r8 c �8 e Zd ZdZ� fdd�Z� fdd�Z� fdd�Z� ZS )�_MutualTlsAdaptera7 A TransportAdapter that enables mutual TLS. Args: cert (bytes): client certificate in PEM format key (bytes): client private key in PEM format Raises: ImportError: if certifi or pyOpenSSL is not installed OpenSSL.crypto.Error: if client cert or key is invalid c s� dd l }ddlm} dd l}|jj�� |�|j|�}|� |j|�}t � }|j |� � d� |j �|� |j �|� || _t � } | j |� � d� | j �|� | j �|� | | _tt| ��� d S )Nr )�crypto��cafile)�certifi�OpenSSLrP �urllib3.contrib.pyopenssl�contrib� pyopenssl�inject_into_urllib3�load_privatekey� FILETYPE_PEM�load_certificater �load_verify_locations�where�_ctx�use_certificate�use_privatekey�_ctx_poolmanager�_ctx_proxymanager�superrO r ) r �cert�keyrS rP �urllib3�pkey�x509�ctx_poolmanager�ctx_proxymanager�� __class__r r r � s" z_MutualTlsAdapter.__init__c �$ | j |d< tt| �j|i |�� d S �N� ssl_context)ra rc rO �init_poolmanager�r �argsrI rk r r rp � � z"_MutualTlsAdapter.init_poolmanagerc � | j |d< tt| �j|i |��S rn )rb rc rO �proxy_manager_forrq rk r r ru � � z#_MutualTlsAdapter.proxy_manager_for�r r r r r rp ru � __classcell__r r rk r rO � s rO c rN )�_MutualTlsOffloadAdaptera� A TransportAdapter that enables mutual TLS and offloads the client side signing operation to the signing library. Args: enterprise_cert_file_path (str): the path to a enterprise cert JSON file. The file should contain the following field: { "libs": { "signer_library": "...", "offload_library": "..." } } Raises: ImportError: if certifi or pyOpenSSL is not installed google.auth.exceptions.MutualTLSChannelError: If mutual TLS channel creation failed for any reason. c s� dd l }ddlm} |�|�| _| j�� dd l}|jj� � t � }|j |� � d� | j� |� || _t � }|j |� � d� | j� |� || _tt| ��� d S )Nr )�_custom_tls_signerrQ )rS �google.auth.transportrz �CustomTlsSigner�signer�load_librariesrU rV rW rX r r\ r] �attach_to_ssl_contextra rb rc ry r )r �enterprise_cert_file_pathrS rz rf � poolmanager� proxymanagerrk r r r s z!_MutualTlsOffloadAdapter.__init__c rm rn )ra rc ry rp rq rk r r rp rs z)_MutualTlsOffloadAdapter.init_poolmanagerc rt rn )rb rc ry ru rq rk r r ru " rv z*_MutualTlsOffloadAdapter.proxy_manager_forrw r r rk r ry � s ry c sh e Zd ZdZejejdddf� fdd� Zd dd�Zddde f� fdd� Z e d d � �Z � fd d �Z � ZS )�AuthorizedSessiona" A Requests Session class with credentials. This class is used to perform requests to API endpoints that require authorization:: from google.auth.transport.requests import AuthorizedSession authed_session = AuthorizedSession(credentials) response = authed_session.request( 'GET', 'https://www.googleapis.com/storage/v1/b') The underlying :meth:`request` implementation handles adding the credentials' headers to the request and refreshing credentials as needed. This class also supports mutual TLS via :meth:`configure_mtls_channel` method. In order to use this method, the `GOOGLE_API_USE_CLIENT_CERTIFICATE` environment variable must be explicitly set to ``true``, otherwise it does nothing. Assume the environment is set to ``true``, the method behaves in the following manner: If client_cert_callback is provided, client certificate and private key are loaded using the callback; if client_cert_callback is None, application default SSL credentials will be used. Exceptions are raised if there are problems with the certificate, private key, or the loading process, so it should be called within a try/except block. First we set the environment variable to ``true``, then create an :class:`AuthorizedSession` instance and specify the endpoints:: regular_endpoint = 'https://pubsub.googleapis.com/v1/projects/{my_project_id}/topics' mtls_endpoint = 'https://pubsub.mtls.googleapis.com/v1/projects/{my_project_id}/topics' authed_session = AuthorizedSession(credentials) Now we can pass a callback to :meth:`configure_mtls_channel`:: def my_cert_callback(): # some code to load client cert bytes and private key bytes, both in # PEM format. some_code_to_load_client_cert_and_key() if loaded: return cert, key raise MyClientCertFailureException() # Always call configure_mtls_channel within a try/except block. try: authed_session.configure_mtls_channel(my_cert_callback) except: # handle exceptions. if authed_session.is_mtls: response = authed_session.request('GET', mtls_endpoint) else: response = authed_session.request('GET', regular_endpoint) You can alternatively use application default SSL credentials like this:: try: authed_session.configure_mtls_channel() except: # handle exceptions. Args: credentials (google.auth.credentials.Credentials): The credentials to add to the request. refresh_status_codes (Sequence[int]): Which HTTP status codes indicate that credentials should be refreshed and the request should be retried. max_refresh_attempts (int): The maximum number of times to attempt to refresh the credentials and retry the request. refresh_timeout (Optional[int]): The timeout value in seconds for credential refresh HTTP requests. auth_request (google.auth.transport.requests.Request): (Optional) An instance of :class:`~google.auth.transport.requests.Request` used when refreshing credentials. If not passed, an instance of :class:`~google.auth.transport.requests.Request` is created. default_host (Optional[str]): A host like "pubsub.googleapis.com". This is used when a self-signed JWT is created from service account credentials. Nc s� t t| ��� || _|| _|| _|| _d| _|| _|d u r6t � � | _ t j j dd�}| j �d|� t| j �}nd | _ || _t| jtj�rT| j�| jrOd�| j�nd � d S d S )NF� )� max_retries�https://z https://{}/)rc r� r � credentials�_refresh_status_codes�_max_refresh_attempts�_refresh_timeout�_is_mtls� _default_hostr6 r9 �_auth_request_session�adapters� HTTPAdapter�mountr8 � _auth_requestr, r � Credentials�_create_self_signed_jwt�format)r r� �refresh_status_codes�max_refresh_attempts�refresh_timeout� auth_request� default_host� retry_adapterrk r r r ~ s& ��zAuthorizedSession.__init__c C s� t �tjd�}|dkrd| _dS zddl}W n ty* } zt�|�}||�d}~ww z t j j j � |�\| _}}| jrIt||�}| �d|� W dS W dS tjt|jjfye } zt�|�}||�d}~ww )a� Configure the client certificate and key for SSL connection. The function does nothing unless `GOOGLE_API_USE_CLIENT_CERTIFICATE` is explicitly set to `true`. In this case if client certificate and key are successfully obtained (from the given client_cert_callback or from application default SSL credentials), a :class:`_MutualTlsAdapter` instance will be mounted to "https://" prefix. Args: client_cert_callback (Optional[Callable[[], (bytes, bytes)]]): The optional callback returns the client certificate and private key bytes both in PEM format. If the callback is None, application default SSL credentials will be used. Raises: google.auth.exceptions.MutualTLSChannelError: If mutual TLS channel creation failed for any reason. �false�trueFNr r� )�os�getenvr �!GOOGLE_API_USE_CLIENT_CERTIFICATEr� rT � ImportErrorr �MutualTLSChannelError�google�authr � _mtls_helper�get_client_cert_and_keyrO r� �ClientCertErrorrP �Error) r �client_cert_callback�use_client_certrT rJ rK rd re � mtls_adapterr r r �configure_mtls_channel� sD � �� �� � � ��z(AuthorizedSession.configure_mtls_channelc s� |� dd�}|dur|�� ni } |du r| jntj| j|d�} |} t| ��} | j�| ||| � W d � n1 s9w Y | j} t| ��} t t | �j ||f|| |d�|��} W d � n1 saw Y | j} | j | j v r�|| jk r�t�d| j |d | j� |du r�| jntj| j|d�} t| ��} | j�| � W d � n1 s�w Y | j} | j ||f||| ||d d�|��S | S ) a� Implementation of Requests' request. Args: timeout (Optional[Union[float, Tuple[float, float]]]): The amount of time in seconds to wait for the server response with each individual request. Can also be passed as a tuple ``(connect_timeout, read_timeout)``. See :meth:`requests.Session.request` documentation for details. max_allowed_time (Optional[float]): If the method runs longer than this, a ``Timeout`` exception is automatically raised. Unlike the ``timeout`` parameter, this value applies to the total method execution time, even if multiple requests are made under the hood. Mind that it is not guaranteed that the timeout error is raised at ``max_allowed_time``. It might take longer, for example, if an underlying request takes a lot of time, but the request itself does not timeout, e.g. if a large file is being transmitted. The timout error will be raised after such request completes. �_credential_refresh_attemptr N)r" r@ z;Refreshing credentials due to a %s response. Attempt %s/%s.� )r r �max_allowed_timer" r� )�pop�copyr� � functools�partialr r� �before_requestr rc r� rC r r� r� rA �info�refresh)r rG rF r r r� r" rI r� �request_headersr� �remaining_time�guardr rk r r rC � sj &�� � ��� � � �� ���� zAuthorizedSession.requestc C s | j S )z3Indicates if the created SSL channel is mutual TLS.)r� r r r r �is_mtlsO s zAuthorizedSession.is_mtlsc s& | j d ur | j �� tt| ��� d S r )r� r< rc r� r rk r r r< T s zAuthorizedSession.closer )r r r r r � DEFAULT_REFRESH_STATUS_CODES� DEFAULT_MAX_REFRESH_ATTEMPTSr r� rM rC r r� r< rx r r rk r r� ' s" Y� +9�q r� )&r � __future__r r� �loggingr- r� r$ r6 r� rJ �requests.adapters�requests.exceptions�#requests.packages.urllib3.util.ssl_r � google.authr r r �"google.auth.transport._mtls_helperr� � google.oauth2r � getLoggerr rA rM �Responser �objectr r8 r� r� rO ry r9 r� r r r r �<module> sB ���� ,P.6 __pycache__/_custom_tls_signer.cpython-310.pyc 0000644 00000013747 15030037514 0015371 0 ustar 00 o �h' � @ s� d Z ddlZddlZddlZddlZddlZddlZddlmZ e� e �Z e� ej e�ej�e�ej�e�ej�ej�Zdd� Zdd� Zdd � Zd d � Zd d � Zdd� Zdd� Zdd� ZG dd� de�ZdS )z] Code for configuring client side TLS to offload the signing operation to signing libraries. � N)� exceptionsc C s t �tt�� �d| ��t j�S )N�intptr_t)�ctypes�cast�int�cffi�FFI�c_void_p)�ssl_ctx� r �^/usr/local/CyberPanel/lib/python3.10/site-packages/google/auth/transport/_custom_tls_signer.py�!_cast_ssl_ctx_to_void_p_pyopenssl1 s r c C s t j�t| �t �t j�d �S )N� )r r � from_address�id�sizeof)�contextr r r � _cast_ssl_ctx_to_void_p_stdlib6 s �r c C sX t �d| � tjdkrtjdkrtj| dd�nt�| �}ttj tj g|j _ tj |j _|S )Nz loading offload library from %s�� � �ntr ��winmode)�_LOGGER�debug�sys� version_info�os�namer �CDLL�SIGN_CALLBACK_CTYPE�c_char_pr �ConfigureSslContext�argtypes�c_int�restype)�offload_lib_path�libr r r �load_offload_lib= s �� � r) c C s� t �d| � tjdkrtjdkrtj| dd�nt�| �}tjtjtj g|j _ tj |j _ tjtjtj tjtj g|j _ tj |j _ |S )Nz loading signer library from %sr r r r )r r r r r r r r r" r% �GetCertPemForPythonr$ r& � SignForPython)�signer_lib_pathr( r r r �load_signer_libU s �� � r- c C sV t �d| � tjdkrtjdkrtj| dd�nt�| �}tjtj g|j _ tj |j _ |S )Nz loading provider library from %sr r r r )r r r r r r r r r r" �ECP_attach_to_ctxr$ r% r& )�provider_lib_pathr( r r r �load_provider_libu s �� r0 c C s8 ddl m} t�| |�}|�|�� �}|�|� |�� S )Nr )�hashes)� cryptography.hazmat.primitivesr1 r � string_at�Hash�SHA256�update�finalize)� to_be_signed�to_be_signed_lenr1 �data�hashr r r �_compute_sha256_digest� s r< c s � �fdd�}t |�S )Nc s� t �d� t||�}tjt|� }d}t�|�}��� �� |� t |��t|�||�}|dkr0dS ||d< t |�} t |�D ]} | | | | < q<dS )Nzcalling sign callback...i� r � ) r r r< r �c_char�len�create_string_bufferr+ �encode� from_buffer� bytearray�range) �sig�sig_len�tbs�tbs_len�digest� digestArray�sig_holder_len� sig_holder� signature_len�bs�i��config_file_path� signer_libr r � sign_callback� s& � z(get_sign_callback.<locals>.sign_callback)r! )rR rQ rS r rP r �get_sign_callback� s rT c C sH | � |�� d d�}|dkrt�d��t�|�}| � |�� ||� t|�S )Nr zfailed to get certificate)r* rA r �MutualTLSChannelErrorr r@ �bytes)rR rQ �cert_len� cert_holderr r r �get_cert� s � �rY c @ s4 e Zd Zdd� Zdd� Zdd� Zdd� Zd d � Zd S ) �CustomTlsSignerc C s || _ d| _d| _d| _dS )a� This class loads the offload and signer library, and calls APIs from these libraries to obtain the cert and a signing callback, and attach them to SSL context. The cert and the signing callback will be used for client authentication in TLS handshake. Args: enterprise_cert_file_path (str): the path to a enterprise cert JSON file. The file should contain the following field: { "libs": { "ecp_client": "...", "tls_offload": "..." } } N)�_enterprise_cert_file_path�_cert�_sign_callback� _provider_lib)�self�enterprise_cert_file_pathr r r �__init__� s zCustomTlsSigner.__init__c C s� t | jd��%}t�|�}|�di �}|�dd �}|�dd �}|�dd �}W d � n1 s.w Y |r<t|�| _d S |rP|rPt|�| _t |�| _ | � � d S t � d��)N�r�libs� ecp_client� tls_offload� ecp_providerz enterprise cert file is invalid)�openr[ �json�load�getr0 r^ r) � _offload_libr- � _signer_lib�set_up_custom_keyr rU )r_ �f�enterprise_cert_jsonrc �signer_library�offload_library�provider_libraryr r r �load_libraries� s � z CustomTlsSigner.load_librariesc C s$ t | j| j�| _t| j| j�| _d S )N)rY rl r[ r\ rT r] �r_ r r r rm � s �z!CustomTlsSigner.set_up_custom_keyc C s | j rdS dS )NTF)r^ rt r r r �should_use_provider s z#CustomTlsSigner.should_use_providerc C sv | � � r| j�t|�| j�d��st�d��d S | jr6| j r6| j� | j t � | j�t|jj��s4t�d��d S t�d��)N�asciiz,failed to configure ECP Provider SSL contextz+failed to configure ECP Offload SSL contextzInvalid ECP configuration.)ru r^ r. r r[ rA r rU rk rl r# r] r r" r\ r �_ctx�_context)r_ �ctxr r r �attach_to_ssl_context s( ��� ��� z%CustomTlsSigner.attach_to_ssl_contextN)�__name__� __module__� __qualname__ra rs rm ru rz r r r r rZ � s rZ ) �__doc__r rh �loggingr r r � google.authr � getLoggerr{ r � CFUNCTYPEr% �POINTER�c_ubyte�c_size_tr! r r r) r- r0 r< rT rY �objectrZ r r r r �<module> s2 � & __pycache__/grpc.cpython-310.pyc 0000644 00000027643 15030037514 0012422 0 ustar 00 o �hq6 � @ s� d Z ddlmZ ddlZddlZddlmZ ddlmZ ddlm Z ddl m Z zddl Z W n e y? Z ze d�e�dZ[ww e�e�ZG d d � d e j�Z dd d �ZG d d� d�ZdS )z Authorization support for gRPC.� )�absolute_importN)�environment_vars)� exceptions)� _mtls_helper)�service_accountzWgRPC is not installed from please install the grpcio package to use the gRPC transport.c s2 e Zd ZdZd � fdd� Zdd� Zdd� Z� ZS ) �AuthMetadataPluginan A `gRPC AuthMetadataPlugin`_ that inserts the credentials into each request. .. _gRPC AuthMetadataPlugin: http://www.grpc.io/grpc/python/grpc.html#grpc.AuthMetadataPlugin Args: credentials (google.auth.credentials.Credentials): The credentials to add to requests. request (google.auth.transport.Request): A HTTP transport request object used to refresh credentials as needed. default_host (Optional[str]): A host like "pubsub.googleapis.com". This is used when a self-signed JWT is created from service account credentials. Nc s$ t t| ��� || _|| _|| _d S �N)�superr �__init__� _credentials�_request� _default_host)�self� credentials�request� default_host�� __class__� �P/usr/local/CyberPanel/lib/python3.10/site-packages/google/auth/transport/grpc.pyr 6 s zAuthMetadataPlugin.__init__c C sT i }t | jtj�r| j�| jrd�| j�nd� | j�| j|j |j |� t |� � �S )z�Gets the authorization headers for a request. Returns: Sequence[Tuple[str, str]]: A list of request headers (key, value) to add to the request. z https://{}/N) � isinstancer r � Credentials�_create_self_signed_jwtr �format�before_requestr � method_name� service_url�list�items)r �context�headersr r r �_get_authorization_headers? s �� z-AuthMetadataPlugin._get_authorization_headersc C s || � |�d� dS )a Passes authorization metadata into the given callback. Args: context (grpc.AuthMetadataContext): The RPC context. callback (grpc.AuthMetadataPluginCallback): The callback that will be invoked to pass in the authorization metadata. N)r! )r r �callbackr r r �__call__W s zAuthMetadataPlugin.__call__r )�__name__� __module__� __qualname__�__doc__r r! r# � __classcell__r r r r r % s r c K s� t | |�}t�|�}|r|rt�d��|s>t�tjd�}|dkr/|r/|� \} } tj | | d�}n|dkr:t � } | j }nt� � }t� ||�} tj || fi |��S )au Creates a secure authorized gRPC channel. This creates a channel with SSL and :class:`AuthMetadataPlugin`. This channel can be used to create a stub that can make authorized requests. Users can configure client certificate or rely on device certificates to establish a mutual TLS channel, if the `GOOGLE_API_USE_CLIENT_CERTIFICATE` variable is explicitly set to `true`. Example:: import google.auth import google.auth.transport.grpc import google.auth.transport.requests from google.cloud.speech.v1 import cloud_speech_pb2 # Get credentials. credentials, _ = google.auth.default() # Get an HTTP request function to refresh credentials. request = google.auth.transport.requests.Request() # Create a channel. channel = google.auth.transport.grpc.secure_authorized_channel( credentials, regular_endpoint, request, ssl_credentials=grpc.ssl_channel_credentials()) # Use the channel to create a stub. cloud_speech.create_Speech_stub(channel) Usage: There are actually a couple of options to create a channel, depending on if you want to create a regular or mutual TLS channel. First let's list the endpoints (regular vs mutual TLS) to choose from:: regular_endpoint = 'speech.googleapis.com:443' mtls_endpoint = 'speech.mtls.googleapis.com:443' Option 1: create a regular (non-mutual) TLS channel by explicitly setting the ssl_credentials:: regular_ssl_credentials = grpc.ssl_channel_credentials() channel = google.auth.transport.grpc.secure_authorized_channel( credentials, regular_endpoint, request, ssl_credentials=regular_ssl_credentials) Option 2: create a mutual TLS channel by calling a callback which returns the client side certificate and the key (Note that `GOOGLE_API_USE_CLIENT_CERTIFICATE` environment variable must be explicitly set to `true`):: def my_client_cert_callback(): code_to_load_client_cert_and_key() if loaded: return (pem_cert_bytes, pem_key_bytes) raise MyClientCertFailureException() try: channel = google.auth.transport.grpc.secure_authorized_channel( credentials, mtls_endpoint, request, client_cert_callback=my_client_cert_callback) except MyClientCertFailureException: # handle the exception Option 3: use application default SSL credentials. It searches and uses the command in a context aware metadata file, which is available on devices with endpoint verification support (Note that `GOOGLE_API_USE_CLIENT_CERTIFICATE` environment variable must be explicitly set to `true`). See https://cloud.google.com/endpoint-verification/docs/overview:: try: default_ssl_credentials = SslCredentials() except: # Exception can be raised if the context aware metadata is malformed. # See :class:`SslCredentials` for the possible exceptions. # Choose the endpoint based on the SSL credentials type. if default_ssl_credentials.is_mtls: endpoint_to_use = mtls_endpoint else: endpoint_to_use = regular_endpoint channel = google.auth.transport.grpc.secure_authorized_channel( credentials, endpoint_to_use, request, ssl_credentials=default_ssl_credentials) Option 4: not setting ssl_credentials and client_cert_callback. For devices without endpoint verification support or `GOOGLE_API_USE_CLIENT_CERTIFICATE` environment variable is not `true`, a regular TLS channel is created; otherwise, a mutual TLS channel is created, however, the call should be wrapped in a try/except block in case of malformed context aware metadata. The following code uses regular_endpoint, it works the same no matter the created channle is regular or mutual TLS. Regular endpoint ignores client certificate and key:: channel = google.auth.transport.grpc.secure_authorized_channel( credentials, regular_endpoint, request) The following code uses mtls_endpoint, if the created channle is regular, and API mtls_endpoint is confgured to require client SSL credentials, API calls using this channel will be rejected:: channel = google.auth.transport.grpc.secure_authorized_channel( credentials, mtls_endpoint, request) Args: credentials (google.auth.credentials.Credentials): The credentials to add to requests. request (google.auth.transport.Request): A HTTP transport request object used to refresh credentials as needed. Even though gRPC is a separate transport, there's no way to refresh the credentials without using a standard http transport. target (str): The host and port of the service. ssl_credentials (grpc.ChannelCredentials): Optional SSL channel credentials. This can be used to specify different certificates. This argument is mutually exclusive with client_cert_callback; providing both will raise an exception. If ssl_credentials and client_cert_callback are None, application default SSL credentials are used if `GOOGLE_API_USE_CLIENT_CERTIFICATE` environment variable is explicitly set to `true`, otherwise one way TLS SSL credentials are used. client_cert_callback (Callable[[], (bytes, bytes)]): Optional callback function to obtain client certicate and key for mutual TLS connection. This argument is mutually exclusive with ssl_credentials; providing both will raise an exception. This argument does nothing unless `GOOGLE_API_USE_CLIENT_CERTIFICATE` environment variable is explicitly set to `true`. kwargs: Additional arguments to pass to :func:`grpc.secure_channel`. Returns: grpc.Channel: The created gRPC channel. Raises: google.auth.exceptions.MutualTLSChannelError: If mutual TLS channel creation failed for any reason. zUReceived both ssl_credentials and client_cert_callback; these are mutually exclusive.�false�true��certificate_chain� private_key)r �grpc�metadata_call_credentialsr �MalformedError�os�getenvr �!GOOGLE_API_USE_CLIENT_CERTIFICATE�ssl_channel_credentials�SslCredentials�ssl_credentials� composite_channel_credentials�secure_channel) r r �targetr6 �client_cert_callback�kwargs�metadata_plugin�google_auth_credentials�use_client_cert�cert�key�adc_ssl_credentils�composite_credentialsr r r �secure_authorized_channelb s0 �� ��rC c @ s0 e Zd ZdZdd� Zedd� �Zedd� �ZdS ) r5 aF Class for application default SSL credentials. The behavior is controlled by `GOOGLE_API_USE_CLIENT_CERTIFICATE` environment variable whose default value is `false`. Client certificate will not be used unless the environment variable is explicitly set to `true`. See https://google.aip.dev/auth/4114 If the environment variable is `true`, then for devices with endpoint verification support, a device certificate will be automatically loaded and mutual TLS will be established. See https://cloud.google.com/endpoint-verification/docs/overview. c C s: t �tjd�}|dkrd| _d S t�tj�}|d u| _d S )Nr) r* F)r1 r2 r r3 �_is_mtlsr �_check_dca_metadata_path�CONTEXT_AWARE_METADATA_PATH)r r> � metadata_pathr r r r ) s � �zSslCredentials.__init__c C sj | j r-zt�� \}}}}tj||d�| _W | jS tjy, } zt�|�}||�d}~ww t�� | _| jS )a Get the created SSL channel credentials. For devices with endpoint verification support, if the device certificate loading has any problems, corresponding exceptions will be raised. For a device without endpoint verification support, no exceptions will be raised. Returns: grpc.ChannelCredentials: The created grpc channel credentials. Raises: google.auth.exceptions.MutualTLSChannelError: If mutual TLS channel creation failed for any reason. r+ N) rD r �get_client_ssl_credentialsr. r4 �_ssl_credentialsr �ClientCertError�MutualTLSChannelError)r �_r? r@ � caught_exc�new_excr r r r6 6 s � � �� z SslCredentials.ssl_credentialsc C s | j S )z?Indicates if the created SSL channel credentials is mutual TLS.)rD )r r r r �is_mtlsT s zSslCredentials.is_mtlsN)r$ r% r& r' r �propertyr6 rO r r r r r5 s r5 )NN)r' � __future__r �loggingr1 � google.authr r �google.auth.transportr � google.oauth2r r. � ImportErrorrM � getLoggerr$ �_LOGGERr rC r5 r r r r �<module> s2 ���� A � : __pycache__/_http_client.cpython-310.pyc 0000644 00000006507 15030037514 0014137 0 ustar 00 o �hz � @ sr d Z ddlmZ ddlZddlZddlZddlmZ ddlm Z e� e �Z G dd� de j �Z G dd� de j�ZdS ) z9Transport adapter for http.client, for internal use only.� N)� exceptions)� transportc @ s< e Zd ZdZdd� Zedd� �Zedd� �Zedd � �Zd S ) �Responsez�http.client transport response adapter. Args: response (http.client.HTTPResponse): The raw http client response. c C s* |j | _dd� |�� D �| _|�� | _d S )Nc S s i | ] \}}|� � |�qS � )�lower)�.0�key�valuer r �X/usr/local/CyberPanel/lib/python3.10/site-packages/google/auth/transport/_http_client.py� <dictcomp>% s z%Response.__init__.<locals>.<dictcomp>)�status�_status� getheaders�_headers�read�_data)�self�responser r r �__init__# s zResponse.__init__c C � | j S �N)r �r r r r r ( � zResponse.statusc C r r )r r r r r �headers, r zResponse.headersc C r r )r r r r r �data0 r z Response.dataN) �__name__� __module__� __qualname__�__doc__r �propertyr r r r r r r r s r c @ s e Zd ZdZ ddd�ZdS )�Requestz&http.client transport request adapter.�GETNc K s� |du rt j}|du r i }tj�|�}tj�dd|j|j|jf�}|j dkr/t � d� |j ���t j|j|d�} z;z"t�d||� | j||f||d�|�� | �� } t| �W W | �� S t jt jfyr } zt � | �} | | �d} ~ ww | �� w )a; Make an HTTP request using http.client. Args: url (str): The URI to be requested. method (str): The HTTP method to use for the request. Defaults to 'GET'. body (bytes): The payload / body in HTTP request. headers (Mapping): Request headers. timeout (Optional(int)): The number of seconds to wait for a response from the server. If not specified or if None, the socket global default timeout will be used. kwargs: Additional arguments passed throught to the underlying :meth:`~http.client.HTTPConnection.request` method. Returns: Response: The HTTP response. Raises: google.auth.exceptions.TransportError: If any exception occurred. N� �httpzDhttp.client transport only supports the http scheme, {}was specified)�timeoutzMaking request: %s %s)�bodyr )�socket�_GLOBAL_DEFAULT_TIMEOUT�urllib�parse�urlsplit� urlunsplit�path�query�fragment�schemer �TransportError�format� http_client�HTTPConnection�netloc�_LOGGER�debug�request� getresponser �close� HTTPException�error) r �url�methodr% r r$ �kwargs�partsr, � connectionr � caught_exc�new_excr r r �__call__8 s4 � � � �� zRequest.__call__)r! NNN)r r r r rC r r r r r 5 s �r )r � http.client�clientr2 �loggingr& r( � google.authr r � getLoggerr r5 r r r r r r �<module> s __pycache__/mtls.cpython-310.pyc 0000644 00000006341 15030037514 0012436 0 ustar 00 o �h� � @ s8 d Z ddlmZ ddlmZ dd� Zdd� Zdd � Zd S ) zUtilites for mutual TLS.� )� exceptions)� _mtls_helperc C s t �t j�} | duS )z�Check if default client SSL credentials exists on the device. Returns: bool: indicating if the default client cert source exists. N)r �_check_dca_metadata_path�CONTEXT_AWARE_METADATA_PATH)� metadata_path� r �P/usr/local/CyberPanel/lib/python3.10/site-packages/google/auth/transport/mtls.py� has_default_client_cert_source s �r c C s t � st�d��dd� } | S )a� Get a callback which returns the default client SSL credentials. Returns: Callable[[], [bytes, bytes]]: A callback which returns the default client certificate bytes and private key bytes, both in PEM format. Raises: google.auth.exceptions.DefaultClientCertSourceError: If the default client SSL credentials don't exist or are malformed. z(Default client cert source doesn't existc S sH z t �� \} }}W ||fS tttfy# } zt�|�}||�d }~ww )N)r �get_client_cert_and_key�OSError� RuntimeError� ValueErrorr �MutualTLSChannelError)�_� cert_bytes� key_bytes� caught_exc�new_excr r r �callback1 s � ��z,default_client_cert_source.<locals>.callback�r r r )r r r r �default_client_cert_source! s � r c s" t � st�d��� �fdd�}|S )at Get a callback which returns the default encrpyted client SSL credentials. Args: cert_path (str): The cert file path. The default client certificate will be written to this file when the returned callback is called. key_path (str): The key file path. The default encrypted client key will be written to this file when the returned callback is called. Returns: Callable[[], [str, str, bytes]]: A callback which generates the default client certificate, encrpyted private key and passphrase. It writes the certificate and private key into the cert_path and key_path, and returns the cert_path, key_path and passphrase bytes. Raises: google.auth.exceptions.DefaultClientCertSourceError: If any problem occurs when loading or saving the client certificate and key. z2Default client encrypted cert source doesn't existc s� z@t jdd�\} }}}t� d�� }|�|� W d � n1 s w Y t�d�� }|�|� W d � n1 s:w Y W n tjtfyW } zt�|�}||�d }~ww � �|fS )NT)�generate_encrypted_key�wb)r �get_client_ssl_credentials�open�writer �ClientCertErrorr r )r r r �passphrase_bytes� cert_file�key_filer r �� cert_path�key_pathr r r U s( � � �� �� z6default_client_encrypted_cert_source.<locals>.callbackr )r! r" r r r r �$default_client_encrypted_cert_source= s �r# N)�__doc__� google.authr �google.auth.transportr r r r# r r r r �<module> s __pycache__/_mtls_helper.cpython-310.pyc 0000644 00000025513 15030037514 0014136 0 ustar 00 o �h�5 � @ s� d Z ddlZddlZddlmZmZ ddlZddlZddlm Z dZ dZ dZ dZ e�d ej�Ze�d ej�Ze�e�Ze�d ej�Zd d � Zdd� Zd%dd�Zd%dd�Zdd� Zdd� Zdd� Z dd� Z d&d d �Z d e fd d �Z d%d!d"�Z d#d$� Z!dS )'z/Helper functions for getting mTLS cert and key.� N)�environ�path)� exceptionsz,~/.secureConnect/context_aware_metadata.jsonz(~/.config/gcloud/certificate_config.json� GOOGLE_API_CERTIFICATE_CONFIG�cert_provider_commands: -----BEGIN CERTIFICATE-----.+-----END CERTIFICATE----- ? ?sH -----BEGIN [A-Z ]*PRIVATE KEY-----.+-----END [A-Z ]*PRIVATE KEY----- ? ?s6 -----BEGIN PASSPHRASE-----(.+)-----END PASSPHRASE-----c C s( t �| �} t �| �st�d| � dS | S )z�Checks for context aware metadata. If it exists, returns the absolute path; otherwise returns None. Args: metadata_path (str): context aware metadata path. Returns: str: absolute path if exists and None otherwise. z0%s is not found, skip client SSL authentication.N)r � expanduser�exists�_LOGGER�debug)� metadata_path� r �X/usr/local/CyberPanel/lib/python3.10/site-packages/google/auth/transport/_mtls_helper.py�_check_dca_metadata_path3 s r c C sf z t | ��}t�|�}W d � W |S 1 sw Y W |S ty2 } zt�|�}||�d}~ww )a\ Reads and loads JSON from the given path. Used to read both X509 workload certificate and secure connect configurations. Args: path (str): the path to read from. Returns: Dict[str, str]: The JSON stored at the file. Raises: google.auth.exceptions.ClientCertError: If failed to parse the file as JSON. N)�open�json�load� ValueErrorr �ClientCertError)r �f� json_data� caught_exc�new_excr r r �_load_json_fileD s ��� ��r c C s* t | �\}}|du r|du rdS t||�S )a Read the workload identity cert and key files specified in the certificate config provided. If no config path is provided, check the environment variable: "GOOGLE_API_CERTIFICATE_CONFIG" first, then the well known gcloud location: "~/.config/gcloud/certificate_config.json". Args: certificate_config_path (string): The certificate config path. If no path is provided, the environment variable will be checked first, then the well known gcloud location. Returns: Tuple[Optional[bytes], Optional[bytes]]: client certificate bytes in PEM format and key bytes in PEM format. Raises: google.auth.exceptions.ClientCertError: if problems occurs when retrieving the certificate or key information. N�NN)� _get_workload_cert_and_key_paths�_read_cert_and_key_files)�certificate_config_path� cert_path�key_pathr r r �_get_workload_cert_and_key[ s r c C sJ | du rt �td�}|dur|dkr|} nt} t�| �} t�| �s#dS | S )a Get the certificate configuration path based on the following order: 1: Explicit override, if set 2: Environment variable, if set 3: Well-known location Returns "None" if the selected config file does not exist. Args: certificate_config_path (string): The certificate config path. If provided, the well known location and environment variable will be ignored. Returns: The absolute path of the certificate config file, and None if the file does not exist. N� )r �get� _CERTIFICATE_CONFIGURATION_ENV�'_CERTIFICATE_CONFIGURATION_DEFAULT_PATHr r r )r �env_pathr r r �_get_cert_config_pathu s r% c C s� t | �}|d u r dS t|�}d|vrt�d�|���|d }d|vr*t�d�|���|d }d|vr:t�d�|���|d }d|vrJt�d �|���|d }||fS ) Nr � cert_configszWCertificate config file {} is in an invalid format, a "cert configs" object is expected�workloadzXCertificate config file {} is in an invalid format, a "workload" cert config is expectedr ziCertificate config file {} is in an invalid format, a "cert_path" is expected in the workload cert configr zhCertificate config file {} is in an invalid format, a "key_path" is expected in the workload cert config)r% r r r �format)� config_path� absolute_path�datar& r' r r r r r r � sB ��������r c C s t | �}t|�}||fS �N)�_read_cert_file�_read_key_file)r r � cert_data�key_datar r r r � s r c C �b t | d�� }|�� }W d � n1 sw Y t�t|�}t|�dkr-t�d�| ���|d S )N�rb� z[Certificate file {} is in an invalid format, a single PEM formatted certificate is expectedr ) r �read�re�findall� _CERT_REGEX�lenr r r( )r � cert_filer/ � cert_matchr r r r- � s � ��r- c C r1 )Nr2 r3 z[Private key file {} is in an invalid format, a single PEM formatted private key is expectedr ) r r4 r5 r6 � _KEY_REGEXr8 r r r( )r �key_filer0 � key_matchr r r r. � s � ��r. Fc C s@ zt j| t jt jd�}|�� \}}W n ty& } zt�|�}||�d}~ww |jdkr4t�d|j ��t� t |�}t |�dkrEt�d��t� t |�}t |�dkrVt�d��t� t |�} |r�t | �dkrit�d��d |d vrtt�d ��|d |d | d �� fS d |d v r�t�d ��t | �dkr�t�d ��|d |d dfS ) a! Run the provided command, and return client side mTLS cert, key and passphrase. Args: command (List[str]): cert provider command. expect_encrypted_key (bool): If encrypted private key is expected. Returns: Tuple[bytes, bytes, bytes]: client certificate bytes in PEM format, key bytes in PEM format and passphrase bytes. Raises: google.auth.exceptions.ClientCertError: if problems occurs when running the cert provider command or generating cert, key and passphrase. )�stdout�stderrNr z5Cert provider command returns non-zero status code %sr3 z,Client SSL certificate is missing or invalidz$Client SSL key is missing or invalidz Passphrase is missing or invalids ENCRYPTEDz!Encrypted private key is expectedz%Encrypted private key is not expectedzPassphrase is not expected)� subprocess�Popen�PIPE� communicate�OSErrorr r � returncoder5 r6 r7 r8 r; �_PASSPHRASE_REGEX�strip) �command�expect_encrypted_key�processr> r? r r r: r= �passphrase_matchr r r �_run_cert_provider_command� s@ � �� � rL c C sf t |�}|r1t|�}t|vrt�d��|t }| r"d|vr"|�d� t|| d�\}}}d|||fS dS )a� Returns the client side certificate, private key and passphrase. Args: generate_encrypted_key (bool): If set to True, encrypted private key and passphrase will be generated; otherwise, unencrypted private key will be generated and passphrase will be None. context_aware_metadata_path (str): The context_aware_metadata.json file path. Returns: Tuple[bool, bytes, bytes, bytes]: A boolean indicating if cert, key and passphrase are obtained, the cert bytes and key bytes both in PEM format, and passphrase bytes. Raises: google.auth.exceptions.ClientCertError: if problems occurs when getting the cert, key and passphrase. z"Cert provider command is not foundz--with_passphrase)rI T)FNNN)r r �_CERT_PROVIDER_COMMANDr r �appendrL )�generate_encrypted_key�context_aware_metadata_pathr � metadata_jsonrH �cert�key� passphraser r r �get_client_ssl_credentials s � rU c C s4 | r | � \}}d||fS t dd�\}}}}|||fS )a Returns the client side certificate and private key. The function first tries to get certificate and key from client_cert_callback; if the callback is None or doesn't provide certificate and key, the function tries application default SSL credentials. Args: client_cert_callback (Optional[Callable[[], (bytes, bytes)]]): An optional callback which returns client certificate bytes and private key bytes both in PEM format. Returns: Tuple[bool, bytes, bytes]: A boolean indicating if cert and key are obtained, the cert bytes and key bytes both in PEM format. Raises: google.auth.exceptions.ClientCertError: if problems occurs when getting the cert and key. TF)rO )rU )�client_cert_callbackrR rS �has_cert�_r r r �get_client_cert_and_keyB s rY c C s, ddl m} |j|j| |d�}|�|j|�S )a# A helper function to decrypt the private key with the given passphrase. google-auth library doesn't support passphrase protected private key for mutual TLS channel. This helper function can be used to decrypt the passphrase protected private key in order to estalish mutual TLS channel. For example, if you have a function which produces client cert, passphrase protected private key and passphrase, you can convert it to a client cert callback function accepted by google-auth:: from google.auth.transport import _mtls_helper def your_client_cert_function(): return cert, encrypted_key, passphrase # callback accepted by google-auth for mutual TLS channel. def client_cert_callback(): cert, encrypted_key, passphrase = your_client_cert_function() decrypted_key = _mtls_helper.decrypt_private_key(encrypted_key, passphrase) return cert, decrypted_key Args: key (bytes): The private key bytes in PEM format. passphrase (bytes): The passphrase bytes. Returns: bytes: The decrypted private key in PEM format. Raises: ImportError: If pyOpenSSL is not installed. OpenSSL.crypto.Error: If there is any problem decrypting the private key. r )�crypto)rT )�OpenSSLrZ �load_privatekey� FILETYPE_PEM�dump_privatekey)rS rT rZ �pkeyr r r �decrypt_private_key^ s !r` r, )F)"�__doc__r �logging�osr r r5 r@ � google.authr �CONTEXT_AWARE_METADATA_PATHr# r" rM �compile�DOTALLr7 r; � getLogger�__name__r rF r r r r% r r r- r. rL rU rY r` r r r r �<module> sH � � � * 7 � + _mtls_helper.py 0000644 00000032751 15030037514 0007601 0 ustar 00 # Copyright 2020 Google LLC # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. """Helper functions for getting mTLS cert and key.""" import json import logging from os import environ, path import re import subprocess from google.auth import exceptions CONTEXT_AWARE_METADATA_PATH = "~/.secureConnect/context_aware_metadata.json" _CERTIFICATE_CONFIGURATION_DEFAULT_PATH = "~/.config/gcloud/certificate_config.json" _CERTIFICATE_CONFIGURATION_ENV = "GOOGLE_API_CERTIFICATE_CONFIG" _CERT_PROVIDER_COMMAND = "cert_provider_command" _CERT_REGEX = re.compile( b"-----BEGIN CERTIFICATE-----.+-----END CERTIFICATE-----\r?\n?", re.DOTALL ) # support various format of key files, e.g. # "-----BEGIN PRIVATE KEY-----...", # "-----BEGIN EC PRIVATE KEY-----...", # "-----BEGIN RSA PRIVATE KEY-----..." # "-----BEGIN ENCRYPTED PRIVATE KEY-----" _KEY_REGEX = re.compile( b"-----BEGIN [A-Z ]*PRIVATE KEY-----.+-----END [A-Z ]*PRIVATE KEY-----\r?\n?", re.DOTALL, ) _LOGGER = logging.getLogger(__name__) _PASSPHRASE_REGEX = re.compile( b"-----BEGIN PASSPHRASE-----(.+)-----END PASSPHRASE-----", re.DOTALL ) def _check_dca_metadata_path(metadata_path): """Checks for context aware metadata. If it exists, returns the absolute path; otherwise returns None. Args: metadata_path (str): context aware metadata path. Returns: str: absolute path if exists and None otherwise. """ metadata_path = path.expanduser(metadata_path) if not path.exists(metadata_path): _LOGGER.debug("%s is not found, skip client SSL authentication.", metadata_path) return None return metadata_path def _load_json_file(path): """Reads and loads JSON from the given path. Used to read both X509 workload certificate and secure connect configurations. Args: path (str): the path to read from. Returns: Dict[str, str]: The JSON stored at the file. Raises: google.auth.exceptions.ClientCertError: If failed to parse the file as JSON. """ try: with open(path) as f: json_data = json.load(f) except ValueError as caught_exc: new_exc = exceptions.ClientCertError(caught_exc) raise new_exc from caught_exc return json_data def _get_workload_cert_and_key(certificate_config_path=None): """Read the workload identity cert and key files specified in the certificate config provided. If no config path is provided, check the environment variable: "GOOGLE_API_CERTIFICATE_CONFIG" first, then the well known gcloud location: "~/.config/gcloud/certificate_config.json". Args: certificate_config_path (string): The certificate config path. If no path is provided, the environment variable will be checked first, then the well known gcloud location. Returns: Tuple[Optional[bytes], Optional[bytes]]: client certificate bytes in PEM format and key bytes in PEM format. Raises: google.auth.exceptions.ClientCertError: if problems occurs when retrieving the certificate or key information. """ cert_path, key_path = _get_workload_cert_and_key_paths(certificate_config_path) if cert_path is None and key_path is None: return None, None return _read_cert_and_key_files(cert_path, key_path) def _get_cert_config_path(certificate_config_path=None): """Get the certificate configuration path based on the following order: 1: Explicit override, if set 2: Environment variable, if set 3: Well-known location Returns "None" if the selected config file does not exist. Args: certificate_config_path (string): The certificate config path. If provided, the well known location and environment variable will be ignored. Returns: The absolute path of the certificate config file, and None if the file does not exist. """ if certificate_config_path is None: env_path = environ.get(_CERTIFICATE_CONFIGURATION_ENV, None) if env_path is not None and env_path != "": certificate_config_path = env_path else: certificate_config_path = _CERTIFICATE_CONFIGURATION_DEFAULT_PATH certificate_config_path = path.expanduser(certificate_config_path) if not path.exists(certificate_config_path): return None return certificate_config_path def _get_workload_cert_and_key_paths(config_path): absolute_path = _get_cert_config_path(config_path) if absolute_path is None: return None, None data = _load_json_file(absolute_path) if "cert_configs" not in data: raise exceptions.ClientCertError( 'Certificate config file {} is in an invalid format, a "cert configs" object is expected'.format( absolute_path ) ) cert_configs = data["cert_configs"] if "workload" not in cert_configs: raise exceptions.ClientCertError( 'Certificate config file {} is in an invalid format, a "workload" cert config is expected'.format( absolute_path ) ) workload = cert_configs["workload"] if "cert_path" not in workload: raise exceptions.ClientCertError( 'Certificate config file {} is in an invalid format, a "cert_path" is expected in the workload cert config'.format( absolute_path ) ) cert_path = workload["cert_path"] if "key_path" not in workload: raise exceptions.ClientCertError( 'Certificate config file {} is in an invalid format, a "key_path" is expected in the workload cert config'.format( absolute_path ) ) key_path = workload["key_path"] return cert_path, key_path def _read_cert_and_key_files(cert_path, key_path): cert_data = _read_cert_file(cert_path) key_data = _read_key_file(key_path) return cert_data, key_data def _read_cert_file(cert_path): with open(cert_path, "rb") as cert_file: cert_data = cert_file.read() cert_match = re.findall(_CERT_REGEX, cert_data) if len(cert_match) != 1: raise exceptions.ClientCertError( "Certificate file {} is in an invalid format, a single PEM formatted certificate is expected".format( cert_path ) ) return cert_match[0] def _read_key_file(key_path): with open(key_path, "rb") as key_file: key_data = key_file.read() key_match = re.findall(_KEY_REGEX, key_data) if len(key_match) != 1: raise exceptions.ClientCertError( "Private key file {} is in an invalid format, a single PEM formatted private key is expected".format( key_path ) ) return key_match[0] def _run_cert_provider_command(command, expect_encrypted_key=False): """Run the provided command, and return client side mTLS cert, key and passphrase. Args: command (List[str]): cert provider command. expect_encrypted_key (bool): If encrypted private key is expected. Returns: Tuple[bytes, bytes, bytes]: client certificate bytes in PEM format, key bytes in PEM format and passphrase bytes. Raises: google.auth.exceptions.ClientCertError: if problems occurs when running the cert provider command or generating cert, key and passphrase. """ try: process = subprocess.Popen( command, stdout=subprocess.PIPE, stderr=subprocess.PIPE ) stdout, stderr = process.communicate() except OSError as caught_exc: new_exc = exceptions.ClientCertError(caught_exc) raise new_exc from caught_exc # Check cert provider command execution error. if process.returncode != 0: raise exceptions.ClientCertError( "Cert provider command returns non-zero status code %s" % process.returncode ) # Extract certificate (chain), key and passphrase. cert_match = re.findall(_CERT_REGEX, stdout) if len(cert_match) != 1: raise exceptions.ClientCertError("Client SSL certificate is missing or invalid") key_match = re.findall(_KEY_REGEX, stdout) if len(key_match) != 1: raise exceptions.ClientCertError("Client SSL key is missing or invalid") passphrase_match = re.findall(_PASSPHRASE_REGEX, stdout) if expect_encrypted_key: if len(passphrase_match) != 1: raise exceptions.ClientCertError("Passphrase is missing or invalid") if b"ENCRYPTED" not in key_match[0]: raise exceptions.ClientCertError("Encrypted private key is expected") return cert_match[0], key_match[0], passphrase_match[0].strip() if b"ENCRYPTED" in key_match[0]: raise exceptions.ClientCertError("Encrypted private key is not expected") if len(passphrase_match) > 0: raise exceptions.ClientCertError("Passphrase is not expected") return cert_match[0], key_match[0], None def get_client_ssl_credentials( generate_encrypted_key=False, context_aware_metadata_path=CONTEXT_AWARE_METADATA_PATH, ): """Returns the client side certificate, private key and passphrase. Args: generate_encrypted_key (bool): If set to True, encrypted private key and passphrase will be generated; otherwise, unencrypted private key will be generated and passphrase will be None. context_aware_metadata_path (str): The context_aware_metadata.json file path. Returns: Tuple[bool, bytes, bytes, bytes]: A boolean indicating if cert, key and passphrase are obtained, the cert bytes and key bytes both in PEM format, and passphrase bytes. Raises: google.auth.exceptions.ClientCertError: if problems occurs when getting the cert, key and passphrase. """ metadata_path = _check_dca_metadata_path(context_aware_metadata_path) if metadata_path: metadata_json = _load_json_file(metadata_path) if _CERT_PROVIDER_COMMAND not in metadata_json: raise exceptions.ClientCertError("Cert provider command is not found") command = metadata_json[_CERT_PROVIDER_COMMAND] if generate_encrypted_key and "--with_passphrase" not in command: command.append("--with_passphrase") # Execute the command. cert, key, passphrase = _run_cert_provider_command( command, expect_encrypted_key=generate_encrypted_key ) return True, cert, key, passphrase return False, None, None, None def get_client_cert_and_key(client_cert_callback=None): """Returns the client side certificate and private key. The function first tries to get certificate and key from client_cert_callback; if the callback is None or doesn't provide certificate and key, the function tries application default SSL credentials. Args: client_cert_callback (Optional[Callable[[], (bytes, bytes)]]): An optional callback which returns client certificate bytes and private key bytes both in PEM format. Returns: Tuple[bool, bytes, bytes]: A boolean indicating if cert and key are obtained, the cert bytes and key bytes both in PEM format. Raises: google.auth.exceptions.ClientCertError: if problems occurs when getting the cert and key. """ if client_cert_callback: cert, key = client_cert_callback() return True, cert, key has_cert, cert, key, _ = get_client_ssl_credentials(generate_encrypted_key=False) return has_cert, cert, key def decrypt_private_key(key, passphrase): """A helper function to decrypt the private key with the given passphrase. google-auth library doesn't support passphrase protected private key for mutual TLS channel. This helper function can be used to decrypt the passphrase protected private key in order to estalish mutual TLS channel. For example, if you have a function which produces client cert, passphrase protected private key and passphrase, you can convert it to a client cert callback function accepted by google-auth:: from google.auth.transport import _mtls_helper def your_client_cert_function(): return cert, encrypted_key, passphrase # callback accepted by google-auth for mutual TLS channel. def client_cert_callback(): cert, encrypted_key, passphrase = your_client_cert_function() decrypted_key = _mtls_helper.decrypt_private_key(encrypted_key, passphrase) return cert, decrypted_key Args: key (bytes): The private key bytes in PEM format. passphrase (bytes): The passphrase bytes. Returns: bytes: The decrypted private key in PEM format. Raises: ImportError: If pyOpenSSL is not installed. OpenSSL.crypto.Error: If there is any problem decrypting the private key. """ from OpenSSL import crypto # First convert encrypted_key_bytes to PKey object pkey = crypto.load_privatekey(crypto.FILETYPE_PEM, key, passphrase=passphrase) # Then dump the decrypted key bytes return crypto.dump_privatekey(crypto.FILETYPE_PEM, pkey) mtls.py 0000644 00000007321 15030037514 0006076 0 ustar 00 # Copyright 2020 Google LLC # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. """Utilites for mutual TLS.""" from google.auth import exceptions from google.auth.transport import _mtls_helper def has_default_client_cert_source(): """Check if default client SSL credentials exists on the device. Returns: bool: indicating if the default client cert source exists. """ metadata_path = _mtls_helper._check_dca_metadata_path( _mtls_helper.CONTEXT_AWARE_METADATA_PATH ) return metadata_path is not None def default_client_cert_source(): """Get a callback which returns the default client SSL credentials. Returns: Callable[[], [bytes, bytes]]: A callback which returns the default client certificate bytes and private key bytes, both in PEM format. Raises: google.auth.exceptions.DefaultClientCertSourceError: If the default client SSL credentials don't exist or are malformed. """ if not has_default_client_cert_source(): raise exceptions.MutualTLSChannelError( "Default client cert source doesn't exist" ) def callback(): try: _, cert_bytes, key_bytes = _mtls_helper.get_client_cert_and_key() except (OSError, RuntimeError, ValueError) as caught_exc: new_exc = exceptions.MutualTLSChannelError(caught_exc) raise new_exc from caught_exc return cert_bytes, key_bytes return callback def default_client_encrypted_cert_source(cert_path, key_path): """Get a callback which returns the default encrpyted client SSL credentials. Args: cert_path (str): The cert file path. The default client certificate will be written to this file when the returned callback is called. key_path (str): The key file path. The default encrypted client key will be written to this file when the returned callback is called. Returns: Callable[[], [str, str, bytes]]: A callback which generates the default client certificate, encrpyted private key and passphrase. It writes the certificate and private key into the cert_path and key_path, and returns the cert_path, key_path and passphrase bytes. Raises: google.auth.exceptions.DefaultClientCertSourceError: If any problem occurs when loading or saving the client certificate and key. """ if not has_default_client_cert_source(): raise exceptions.MutualTLSChannelError( "Default client encrypted cert source doesn't exist" ) def callback(): try: ( _, cert_bytes, key_bytes, passphrase_bytes, ) = _mtls_helper.get_client_ssl_credentials(generate_encrypted_key=True) with open(cert_path, "wb") as cert_file: cert_file.write(cert_bytes) with open(key_path, "wb") as key_file: key_file.write(key_bytes) except (exceptions.ClientCertError, OSError) as caught_exc: new_exc = exceptions.MutualTLSChannelError(caught_exc) raise new_exc from caught_exc return cert_path, key_path, passphrase_bytes return callback requests.py 0000644 00000053517 15030037514 0007002 0 ustar 00 # Copyright 2016 Google LLC # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. """Transport adapter for Requests.""" from __future__ import absolute_import import functools import logging import numbers import os import time try: import requests except ImportError as caught_exc: # pragma: NO COVER raise ImportError( "The requests library is not installed from please install the requests package to use the requests transport." ) from caught_exc import requests.adapters # pylint: disable=ungrouped-imports import requests.exceptions # pylint: disable=ungrouped-imports from requests.packages.urllib3.util.ssl_ import ( # type: ignore create_urllib3_context, ) # pylint: disable=ungrouped-imports from google.auth import environment_vars from google.auth import exceptions from google.auth import transport import google.auth.transport._mtls_helper from google.oauth2 import service_account _LOGGER = logging.getLogger(__name__) _DEFAULT_TIMEOUT = 120 # in seconds class _Response(transport.Response): """Requests transport response adapter. Args: response (requests.Response): The raw Requests response. """ def __init__(self, response): self._response = response @property def status(self): return self._response.status_code @property def headers(self): return self._response.headers @property def data(self): return self._response.content class TimeoutGuard(object): """A context manager raising an error if the suite execution took too long. Args: timeout (Union[None, Union[float, Tuple[float, float]]]): The maximum number of seconds a suite can run without the context manager raising a timeout exception on exit. If passed as a tuple, the smaller of the values is taken as a timeout. If ``None``, a timeout error is never raised. timeout_error_type (Optional[Exception]): The type of the error to raise on timeout. Defaults to :class:`requests.exceptions.Timeout`. """ def __init__(self, timeout, timeout_error_type=requests.exceptions.Timeout): self._timeout = timeout self.remaining_timeout = timeout self._timeout_error_type = timeout_error_type def __enter__(self): self._start = time.time() return self def __exit__(self, exc_type, exc_value, traceback): if exc_value: return # let the error bubble up automatically if self._timeout is None: return # nothing to do, the timeout was not specified elapsed = time.time() - self._start deadline_hit = False if isinstance(self._timeout, numbers.Number): self.remaining_timeout = self._timeout - elapsed deadline_hit = self.remaining_timeout <= 0 else: self.remaining_timeout = tuple(x - elapsed for x in self._timeout) deadline_hit = min(self.remaining_timeout) <= 0 if deadline_hit: raise self._timeout_error_type() class Request(transport.Request): """Requests request adapter. This class is used internally for making requests using various transports in a consistent way. If you use :class:`AuthorizedSession` you do not need to construct or use this class directly. This class can be useful if you want to manually refresh a :class:`~google.auth.credentials.Credentials` instance:: import google.auth.transport.requests import requests request = google.auth.transport.requests.Request() credentials.refresh(request) Args: session (requests.Session): An instance :class:`requests.Session` used to make HTTP requests. If not specified, a session will be created. .. automethod:: __call__ """ def __init__(self, session=None): if not session: session = requests.Session() self.session = session def __del__(self): try: if hasattr(self, "session") and self.session is not None: self.session.close() except TypeError: # NOTE: For certain Python binary built, the queue.Empty exception # might not be considered a normal Python exception causing # TypeError. pass def __call__( self, url, method="GET", body=None, headers=None, timeout=_DEFAULT_TIMEOUT, **kwargs ): """Make an HTTP request using requests. Args: url (str): The URI to be requested. method (str): The HTTP method to use for the request. Defaults to 'GET'. body (bytes): The payload or body in HTTP request. headers (Mapping[str, str]): Request headers. timeout (Optional[int]): The number of seconds to wait for a response from the server. If not specified or if None, the requests default timeout will be used. kwargs: Additional arguments passed through to the underlying requests :meth:`~requests.Session.request` method. Returns: google.auth.transport.Response: The HTTP response. Raises: google.auth.exceptions.TransportError: If any exception occurred. """ try: _LOGGER.debug("Making request: %s %s", method, url) response = self.session.request( method, url, data=body, headers=headers, timeout=timeout, **kwargs ) return _Response(response) except requests.exceptions.RequestException as caught_exc: new_exc = exceptions.TransportError(caught_exc) raise new_exc from caught_exc class _MutualTlsAdapter(requests.adapters.HTTPAdapter): """ A TransportAdapter that enables mutual TLS. Args: cert (bytes): client certificate in PEM format key (bytes): client private key in PEM format Raises: ImportError: if certifi or pyOpenSSL is not installed OpenSSL.crypto.Error: if client cert or key is invalid """ def __init__(self, cert, key): import certifi from OpenSSL import crypto import urllib3.contrib.pyopenssl # type: ignore urllib3.contrib.pyopenssl.inject_into_urllib3() pkey = crypto.load_privatekey(crypto.FILETYPE_PEM, key) x509 = crypto.load_certificate(crypto.FILETYPE_PEM, cert) ctx_poolmanager = create_urllib3_context() ctx_poolmanager.load_verify_locations(cafile=certifi.where()) ctx_poolmanager._ctx.use_certificate(x509) ctx_poolmanager._ctx.use_privatekey(pkey) self._ctx_poolmanager = ctx_poolmanager ctx_proxymanager = create_urllib3_context() ctx_proxymanager.load_verify_locations(cafile=certifi.where()) ctx_proxymanager._ctx.use_certificate(x509) ctx_proxymanager._ctx.use_privatekey(pkey) self._ctx_proxymanager = ctx_proxymanager super(_MutualTlsAdapter, self).__init__() def init_poolmanager(self, *args, **kwargs): kwargs["ssl_context"] = self._ctx_poolmanager super(_MutualTlsAdapter, self).init_poolmanager(*args, **kwargs) def proxy_manager_for(self, *args, **kwargs): kwargs["ssl_context"] = self._ctx_proxymanager return super(_MutualTlsAdapter, self).proxy_manager_for(*args, **kwargs) class _MutualTlsOffloadAdapter(requests.adapters.HTTPAdapter): """ A TransportAdapter that enables mutual TLS and offloads the client side signing operation to the signing library. Args: enterprise_cert_file_path (str): the path to a enterprise cert JSON file. The file should contain the following field: { "libs": { "signer_library": "...", "offload_library": "..." } } Raises: ImportError: if certifi or pyOpenSSL is not installed google.auth.exceptions.MutualTLSChannelError: If mutual TLS channel creation failed for any reason. """ def __init__(self, enterprise_cert_file_path): import certifi from google.auth.transport import _custom_tls_signer self.signer = _custom_tls_signer.CustomTlsSigner(enterprise_cert_file_path) self.signer.load_libraries() import urllib3.contrib.pyopenssl urllib3.contrib.pyopenssl.inject_into_urllib3() poolmanager = create_urllib3_context() poolmanager.load_verify_locations(cafile=certifi.where()) self.signer.attach_to_ssl_context(poolmanager) self._ctx_poolmanager = poolmanager proxymanager = create_urllib3_context() proxymanager.load_verify_locations(cafile=certifi.where()) self.signer.attach_to_ssl_context(proxymanager) self._ctx_proxymanager = proxymanager super(_MutualTlsOffloadAdapter, self).__init__() def init_poolmanager(self, *args, **kwargs): kwargs["ssl_context"] = self._ctx_poolmanager super(_MutualTlsOffloadAdapter, self).init_poolmanager(*args, **kwargs) def proxy_manager_for(self, *args, **kwargs): kwargs["ssl_context"] = self._ctx_proxymanager return super(_MutualTlsOffloadAdapter, self).proxy_manager_for(*args, **kwargs) class AuthorizedSession(requests.Session): """A Requests Session class with credentials. This class is used to perform requests to API endpoints that require authorization:: from google.auth.transport.requests import AuthorizedSession authed_session = AuthorizedSession(credentials) response = authed_session.request( 'GET', 'https://www.googleapis.com/storage/v1/b') The underlying :meth:`request` implementation handles adding the credentials' headers to the request and refreshing credentials as needed. This class also supports mutual TLS via :meth:`configure_mtls_channel` method. In order to use this method, the `GOOGLE_API_USE_CLIENT_CERTIFICATE` environment variable must be explicitly set to ``true``, otherwise it does nothing. Assume the environment is set to ``true``, the method behaves in the following manner: If client_cert_callback is provided, client certificate and private key are loaded using the callback; if client_cert_callback is None, application default SSL credentials will be used. Exceptions are raised if there are problems with the certificate, private key, or the loading process, so it should be called within a try/except block. First we set the environment variable to ``true``, then create an :class:`AuthorizedSession` instance and specify the endpoints:: regular_endpoint = 'https://pubsub.googleapis.com/v1/projects/{my_project_id}/topics' mtls_endpoint = 'https://pubsub.mtls.googleapis.com/v1/projects/{my_project_id}/topics' authed_session = AuthorizedSession(credentials) Now we can pass a callback to :meth:`configure_mtls_channel`:: def my_cert_callback(): # some code to load client cert bytes and private key bytes, both in # PEM format. some_code_to_load_client_cert_and_key() if loaded: return cert, key raise MyClientCertFailureException() # Always call configure_mtls_channel within a try/except block. try: authed_session.configure_mtls_channel(my_cert_callback) except: # handle exceptions. if authed_session.is_mtls: response = authed_session.request('GET', mtls_endpoint) else: response = authed_session.request('GET', regular_endpoint) You can alternatively use application default SSL credentials like this:: try: authed_session.configure_mtls_channel() except: # handle exceptions. Args: credentials (google.auth.credentials.Credentials): The credentials to add to the request. refresh_status_codes (Sequence[int]): Which HTTP status codes indicate that credentials should be refreshed and the request should be retried. max_refresh_attempts (int): The maximum number of times to attempt to refresh the credentials and retry the request. refresh_timeout (Optional[int]): The timeout value in seconds for credential refresh HTTP requests. auth_request (google.auth.transport.requests.Request): (Optional) An instance of :class:`~google.auth.transport.requests.Request` used when refreshing credentials. If not passed, an instance of :class:`~google.auth.transport.requests.Request` is created. default_host (Optional[str]): A host like "pubsub.googleapis.com". This is used when a self-signed JWT is created from service account credentials. """ def __init__( self, credentials, refresh_status_codes=transport.DEFAULT_REFRESH_STATUS_CODES, max_refresh_attempts=transport.DEFAULT_MAX_REFRESH_ATTEMPTS, refresh_timeout=None, auth_request=None, default_host=None, ): super(AuthorizedSession, self).__init__() self.credentials = credentials self._refresh_status_codes = refresh_status_codes self._max_refresh_attempts = max_refresh_attempts self._refresh_timeout = refresh_timeout self._is_mtls = False self._default_host = default_host if auth_request is None: self._auth_request_session = requests.Session() # Using an adapter to make HTTP requests robust to network errors. # This adapter retrys HTTP requests when network errors occur # and the requests seems safely retryable. retry_adapter = requests.adapters.HTTPAdapter(max_retries=3) self._auth_request_session.mount("https://", retry_adapter) # Do not pass `self` as the session here, as it can lead to # infinite recursion. auth_request = Request(self._auth_request_session) else: self._auth_request_session = None # Request instance used by internal methods (for example, # credentials.refresh). self._auth_request = auth_request # https://google.aip.dev/auth/4111 # Attempt to use self-signed JWTs when a service account is used. if isinstance(self.credentials, service_account.Credentials): self.credentials._create_self_signed_jwt( "https://{}/".format(self._default_host) if self._default_host else None ) def configure_mtls_channel(self, client_cert_callback=None): """Configure the client certificate and key for SSL connection. The function does nothing unless `GOOGLE_API_USE_CLIENT_CERTIFICATE` is explicitly set to `true`. In this case if client certificate and key are successfully obtained (from the given client_cert_callback or from application default SSL credentials), a :class:`_MutualTlsAdapter` instance will be mounted to "https://" prefix. Args: client_cert_callback (Optional[Callable[[], (bytes, bytes)]]): The optional callback returns the client certificate and private key bytes both in PEM format. If the callback is None, application default SSL credentials will be used. Raises: google.auth.exceptions.MutualTLSChannelError: If mutual TLS channel creation failed for any reason. """ use_client_cert = os.getenv( environment_vars.GOOGLE_API_USE_CLIENT_CERTIFICATE, "false" ) if use_client_cert != "true": self._is_mtls = False return try: import OpenSSL except ImportError as caught_exc: new_exc = exceptions.MutualTLSChannelError(caught_exc) raise new_exc from caught_exc try: ( self._is_mtls, cert, key, ) = google.auth.transport._mtls_helper.get_client_cert_and_key( client_cert_callback ) if self._is_mtls: mtls_adapter = _MutualTlsAdapter(cert, key) self.mount("https://", mtls_adapter) except ( exceptions.ClientCertError, ImportError, OpenSSL.crypto.Error, ) as caught_exc: new_exc = exceptions.MutualTLSChannelError(caught_exc) raise new_exc from caught_exc def request( self, method, url, data=None, headers=None, max_allowed_time=None, timeout=_DEFAULT_TIMEOUT, **kwargs ): """Implementation of Requests' request. Args: timeout (Optional[Union[float, Tuple[float, float]]]): The amount of time in seconds to wait for the server response with each individual request. Can also be passed as a tuple ``(connect_timeout, read_timeout)``. See :meth:`requests.Session.request` documentation for details. max_allowed_time (Optional[float]): If the method runs longer than this, a ``Timeout`` exception is automatically raised. Unlike the ``timeout`` parameter, this value applies to the total method execution time, even if multiple requests are made under the hood. Mind that it is not guaranteed that the timeout error is raised at ``max_allowed_time``. It might take longer, for example, if an underlying request takes a lot of time, but the request itself does not timeout, e.g. if a large file is being transmitted. The timout error will be raised after such request completes. """ # pylint: disable=arguments-differ # Requests has a ton of arguments to request, but only two # (method, url) are required. We pass through all of the other # arguments to super, so no need to exhaustively list them here. # Use a kwarg for this instead of an attribute to maintain # thread-safety. _credential_refresh_attempt = kwargs.pop("_credential_refresh_attempt", 0) # Make a copy of the headers. They will be modified by the credentials # and we want to pass the original headers if we recurse. request_headers = headers.copy() if headers is not None else {} # Do not apply the timeout unconditionally in order to not override the # _auth_request's default timeout. auth_request = ( self._auth_request if timeout is None else functools.partial(self._auth_request, timeout=timeout) ) remaining_time = max_allowed_time with TimeoutGuard(remaining_time) as guard: self.credentials.before_request(auth_request, method, url, request_headers) remaining_time = guard.remaining_timeout with TimeoutGuard(remaining_time) as guard: response = super(AuthorizedSession, self).request( method, url, data=data, headers=request_headers, timeout=timeout, **kwargs ) remaining_time = guard.remaining_timeout # If the response indicated that the credentials needed to be # refreshed, then refresh the credentials and re-attempt the # request. # A stored token may expire between the time it is retrieved and # the time the request is made, so we may need to try twice. if ( response.status_code in self._refresh_status_codes and _credential_refresh_attempt < self._max_refresh_attempts ): _LOGGER.info( "Refreshing credentials due to a %s response. Attempt %s/%s.", response.status_code, _credential_refresh_attempt + 1, self._max_refresh_attempts, ) # Do not apply the timeout unconditionally in order to not override the # _auth_request's default timeout. auth_request = ( self._auth_request if timeout is None else functools.partial(self._auth_request, timeout=timeout) ) with TimeoutGuard(remaining_time) as guard: self.credentials.refresh(auth_request) remaining_time = guard.remaining_timeout # Recurse. Pass in the original headers, not our modified set, but # do pass the adjusted max allowed time (i.e. the remaining total time). return self.request( method, url, data=data, headers=headers, max_allowed_time=remaining_time, timeout=timeout, _credential_refresh_attempt=_credential_refresh_attempt + 1, **kwargs ) return response @property def is_mtls(self): """Indicates if the created SSL channel is mutual TLS.""" return self._is_mtls def close(self): if self._auth_request_session is not None: self._auth_request_session.close() super(AuthorizedSession, self).close() grpc.py 0000644 00000033161 15030037514 0006053 0 ustar 00 # Copyright 2016 Google LLC # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. """Authorization support for gRPC.""" from __future__ import absolute_import import logging import os from google.auth import environment_vars from google.auth import exceptions from google.auth.transport import _mtls_helper from google.oauth2 import service_account try: import grpc # type: ignore except ImportError as caught_exc: # pragma: NO COVER raise ImportError( "gRPC is not installed from please install the grpcio package to use the gRPC transport." ) from caught_exc _LOGGER = logging.getLogger(__name__) class AuthMetadataPlugin(grpc.AuthMetadataPlugin): """A `gRPC AuthMetadataPlugin`_ that inserts the credentials into each request. .. _gRPC AuthMetadataPlugin: http://www.grpc.io/grpc/python/grpc.html#grpc.AuthMetadataPlugin Args: credentials (google.auth.credentials.Credentials): The credentials to add to requests. request (google.auth.transport.Request): A HTTP transport request object used to refresh credentials as needed. default_host (Optional[str]): A host like "pubsub.googleapis.com". This is used when a self-signed JWT is created from service account credentials. """ def __init__(self, credentials, request, default_host=None): # pylint: disable=no-value-for-parameter # pylint doesn't realize that the super method takes no arguments # because this class is the same name as the superclass. super(AuthMetadataPlugin, self).__init__() self._credentials = credentials self._request = request self._default_host = default_host def _get_authorization_headers(self, context): """Gets the authorization headers for a request. Returns: Sequence[Tuple[str, str]]: A list of request headers (key, value) to add to the request. """ headers = {} # https://google.aip.dev/auth/4111 # Attempt to use self-signed JWTs when a service account is used. # A default host must be explicitly provided since it cannot always # be determined from the context.service_url. if isinstance(self._credentials, service_account.Credentials): self._credentials._create_self_signed_jwt( "https://{}/".format(self._default_host) if self._default_host else None ) self._credentials.before_request( self._request, context.method_name, context.service_url, headers ) return list(headers.items()) def __call__(self, context, callback): """Passes authorization metadata into the given callback. Args: context (grpc.AuthMetadataContext): The RPC context. callback (grpc.AuthMetadataPluginCallback): The callback that will be invoked to pass in the authorization metadata. """ callback(self._get_authorization_headers(context), None) def secure_authorized_channel( credentials, request, target, ssl_credentials=None, client_cert_callback=None, **kwargs ): """Creates a secure authorized gRPC channel. This creates a channel with SSL and :class:`AuthMetadataPlugin`. This channel can be used to create a stub that can make authorized requests. Users can configure client certificate or rely on device certificates to establish a mutual TLS channel, if the `GOOGLE_API_USE_CLIENT_CERTIFICATE` variable is explicitly set to `true`. Example:: import google.auth import google.auth.transport.grpc import google.auth.transport.requests from google.cloud.speech.v1 import cloud_speech_pb2 # Get credentials. credentials, _ = google.auth.default() # Get an HTTP request function to refresh credentials. request = google.auth.transport.requests.Request() # Create a channel. channel = google.auth.transport.grpc.secure_authorized_channel( credentials, regular_endpoint, request, ssl_credentials=grpc.ssl_channel_credentials()) # Use the channel to create a stub. cloud_speech.create_Speech_stub(channel) Usage: There are actually a couple of options to create a channel, depending on if you want to create a regular or mutual TLS channel. First let's list the endpoints (regular vs mutual TLS) to choose from:: regular_endpoint = 'speech.googleapis.com:443' mtls_endpoint = 'speech.mtls.googleapis.com:443' Option 1: create a regular (non-mutual) TLS channel by explicitly setting the ssl_credentials:: regular_ssl_credentials = grpc.ssl_channel_credentials() channel = google.auth.transport.grpc.secure_authorized_channel( credentials, regular_endpoint, request, ssl_credentials=regular_ssl_credentials) Option 2: create a mutual TLS channel by calling a callback which returns the client side certificate and the key (Note that `GOOGLE_API_USE_CLIENT_CERTIFICATE` environment variable must be explicitly set to `true`):: def my_client_cert_callback(): code_to_load_client_cert_and_key() if loaded: return (pem_cert_bytes, pem_key_bytes) raise MyClientCertFailureException() try: channel = google.auth.transport.grpc.secure_authorized_channel( credentials, mtls_endpoint, request, client_cert_callback=my_client_cert_callback) except MyClientCertFailureException: # handle the exception Option 3: use application default SSL credentials. It searches and uses the command in a context aware metadata file, which is available on devices with endpoint verification support (Note that `GOOGLE_API_USE_CLIENT_CERTIFICATE` environment variable must be explicitly set to `true`). See https://cloud.google.com/endpoint-verification/docs/overview:: try: default_ssl_credentials = SslCredentials() except: # Exception can be raised if the context aware metadata is malformed. # See :class:`SslCredentials` for the possible exceptions. # Choose the endpoint based on the SSL credentials type. if default_ssl_credentials.is_mtls: endpoint_to_use = mtls_endpoint else: endpoint_to_use = regular_endpoint channel = google.auth.transport.grpc.secure_authorized_channel( credentials, endpoint_to_use, request, ssl_credentials=default_ssl_credentials) Option 4: not setting ssl_credentials and client_cert_callback. For devices without endpoint verification support or `GOOGLE_API_USE_CLIENT_CERTIFICATE` environment variable is not `true`, a regular TLS channel is created; otherwise, a mutual TLS channel is created, however, the call should be wrapped in a try/except block in case of malformed context aware metadata. The following code uses regular_endpoint, it works the same no matter the created channle is regular or mutual TLS. Regular endpoint ignores client certificate and key:: channel = google.auth.transport.grpc.secure_authorized_channel( credentials, regular_endpoint, request) The following code uses mtls_endpoint, if the created channle is regular, and API mtls_endpoint is confgured to require client SSL credentials, API calls using this channel will be rejected:: channel = google.auth.transport.grpc.secure_authorized_channel( credentials, mtls_endpoint, request) Args: credentials (google.auth.credentials.Credentials): The credentials to add to requests. request (google.auth.transport.Request): A HTTP transport request object used to refresh credentials as needed. Even though gRPC is a separate transport, there's no way to refresh the credentials without using a standard http transport. target (str): The host and port of the service. ssl_credentials (grpc.ChannelCredentials): Optional SSL channel credentials. This can be used to specify different certificates. This argument is mutually exclusive with client_cert_callback; providing both will raise an exception. If ssl_credentials and client_cert_callback are None, application default SSL credentials are used if `GOOGLE_API_USE_CLIENT_CERTIFICATE` environment variable is explicitly set to `true`, otherwise one way TLS SSL credentials are used. client_cert_callback (Callable[[], (bytes, bytes)]): Optional callback function to obtain client certicate and key for mutual TLS connection. This argument is mutually exclusive with ssl_credentials; providing both will raise an exception. This argument does nothing unless `GOOGLE_API_USE_CLIENT_CERTIFICATE` environment variable is explicitly set to `true`. kwargs: Additional arguments to pass to :func:`grpc.secure_channel`. Returns: grpc.Channel: The created gRPC channel. Raises: google.auth.exceptions.MutualTLSChannelError: If mutual TLS channel creation failed for any reason. """ # Create the metadata plugin for inserting the authorization header. metadata_plugin = AuthMetadataPlugin(credentials, request) # Create a set of grpc.CallCredentials using the metadata plugin. google_auth_credentials = grpc.metadata_call_credentials(metadata_plugin) if ssl_credentials and client_cert_callback: raise exceptions.MalformedError( "Received both ssl_credentials and client_cert_callback; " "these are mutually exclusive." ) # If SSL credentials are not explicitly set, try client_cert_callback and ADC. if not ssl_credentials: use_client_cert = os.getenv( environment_vars.GOOGLE_API_USE_CLIENT_CERTIFICATE, "false" ) if use_client_cert == "true" and client_cert_callback: # Use the callback if provided. cert, key = client_cert_callback() ssl_credentials = grpc.ssl_channel_credentials( certificate_chain=cert, private_key=key ) elif use_client_cert == "true": # Use application default SSL credentials. adc_ssl_credentils = SslCredentials() ssl_credentials = adc_ssl_credentils.ssl_credentials else: ssl_credentials = grpc.ssl_channel_credentials() # Combine the ssl credentials and the authorization credentials. composite_credentials = grpc.composite_channel_credentials( ssl_credentials, google_auth_credentials ) return grpc.secure_channel(target, composite_credentials, **kwargs) class SslCredentials: """Class for application default SSL credentials. The behavior is controlled by `GOOGLE_API_USE_CLIENT_CERTIFICATE` environment variable whose default value is `false`. Client certificate will not be used unless the environment variable is explicitly set to `true`. See https://google.aip.dev/auth/4114 If the environment variable is `true`, then for devices with endpoint verification support, a device certificate will be automatically loaded and mutual TLS will be established. See https://cloud.google.com/endpoint-verification/docs/overview. """ def __init__(self): use_client_cert = os.getenv( environment_vars.GOOGLE_API_USE_CLIENT_CERTIFICATE, "false" ) if use_client_cert != "true": self._is_mtls = False else: # Load client SSL credentials. metadata_path = _mtls_helper._check_dca_metadata_path( _mtls_helper.CONTEXT_AWARE_METADATA_PATH ) self._is_mtls = metadata_path is not None @property def ssl_credentials(self): """Get the created SSL channel credentials. For devices with endpoint verification support, if the device certificate loading has any problems, corresponding exceptions will be raised. For a device without endpoint verification support, no exceptions will be raised. Returns: grpc.ChannelCredentials: The created grpc channel credentials. Raises: google.auth.exceptions.MutualTLSChannelError: If mutual TLS channel creation failed for any reason. """ if self._is_mtls: try: _, cert, key, _ = _mtls_helper.get_client_ssl_credentials() self._ssl_credentials = grpc.ssl_channel_credentials( certificate_chain=cert, private_key=key ) except exceptions.ClientCertError as caught_exc: new_exc = exceptions.MutualTLSChannelError(caught_exc) raise new_exc from caught_exc else: self._ssl_credentials = grpc.ssl_channel_credentials() return self._ssl_credentials @property def is_mtls(self): """Indicates if the created SSL channel credentials is mutual TLS.""" return self._is_mtls
| ver. 1.4 |
Github
|
.
| PHP 8.2.28 | Generation time: 0.02 |
proxy
|
phpinfo
|
Settings