@scrypted/server 0.0.141 → 0.0.142

package/.venv/lib/python3.9/site-packages/pip/_vendor/urllib3/contrib/_securetransport/low_level.py

@@ -1,397 +0,0 @@
-"""
-Low-level helpers for the SecureTransport bindings.
-
-These are Python functions that are not directly related to the high-level APIs
-but are necessary to get them to work. They include a whole bunch of low-level
-CoreFoundation messing about and memory management. The concerns in this module
-are almost entirely about trying to avoid memory leaks and providing
-appropriate and useful assistance to the higher-level code.
-"""
-import base64
-import ctypes
-import itertools
-import os
-import re
-import ssl
-import struct
-import tempfile
-
-from .bindings import CFConst, CoreFoundation, Security
-
-# This regular expression is used to grab PEM data out of a PEM bundle.
-_PEM_CERTS_RE = re.compile(
-    b"-----BEGIN CERTIFICATE-----\n(.*?)\n-----END CERTIFICATE-----", re.DOTALL
-)
-
-
-def _cf_data_from_bytes(bytestring):
-    """
-    Given a bytestring, create a CFData object from it. This CFData object must
-    be CFReleased by the caller.
-    """
-    return CoreFoundation.CFDataCreate(
-        CoreFoundation.kCFAllocatorDefault, bytestring, len(bytestring)
-    )
-
-
-def _cf_dictionary_from_tuples(tuples):
-    """
-    Given a list of Python tuples, create an associated CFDictionary.
-    """
-    dictionary_size = len(tuples)
-
-    # We need to get the dictionary keys and values out in the same order.
-    keys = (t[0] for t in tuples)
-    values = (t[1] for t in tuples)
-    cf_keys = (CoreFoundation.CFTypeRef * dictionary_size)(*keys)
-    cf_values = (CoreFoundation.CFTypeRef * dictionary_size)(*values)
-
-    return CoreFoundation.CFDictionaryCreate(
-        CoreFoundation.kCFAllocatorDefault,
-        cf_keys,
-        cf_values,
-        dictionary_size,
-        CoreFoundation.kCFTypeDictionaryKeyCallBacks,
-        CoreFoundation.kCFTypeDictionaryValueCallBacks,
-    )
-
-
-def _cfstr(py_bstr):
-    """
-    Given a Python binary data, create a CFString.
-    The string must be CFReleased by the caller.
-    """
-    c_str = ctypes.c_char_p(py_bstr)
-    cf_str = CoreFoundation.CFStringCreateWithCString(
-        CoreFoundation.kCFAllocatorDefault,
-        c_str,
-        CFConst.kCFStringEncodingUTF8,
-    )
-    return cf_str
-
-
-def _create_cfstring_array(lst):
-    """
-    Given a list of Python binary data, create an associated CFMutableArray.
-    The array must be CFReleased by the caller.
-
-    Raises an ssl.SSLError on failure.
-    """
-    cf_arr = None
-    try:
-        cf_arr = CoreFoundation.CFArrayCreateMutable(
-            CoreFoundation.kCFAllocatorDefault,
-            0,
-            ctypes.byref(CoreFoundation.kCFTypeArrayCallBacks),
-        )
-        if not cf_arr:
-            raise MemoryError("Unable to allocate memory!")
-        for item in lst:
-            cf_str = _cfstr(item)
-            if not cf_str:
-                raise MemoryError("Unable to allocate memory!")
-            try:
-                CoreFoundation.CFArrayAppendValue(cf_arr, cf_str)
-            finally:
-                CoreFoundation.CFRelease(cf_str)
-    except BaseException as e:
-        if cf_arr:
-            CoreFoundation.CFRelease(cf_arr)
-        raise ssl.SSLError("Unable to allocate array: %s" % (e,))
-    return cf_arr
-
-
-def _cf_string_to_unicode(value):
-    """
-    Creates a Unicode string from a CFString object. Used entirely for error
-    reporting.
-
-    Yes, it annoys me quite a lot that this function is this complex.
-    """
-    value_as_void_p = ctypes.cast(value, ctypes.POINTER(ctypes.c_void_p))
-
-    string = CoreFoundation.CFStringGetCStringPtr(
-        value_as_void_p, CFConst.kCFStringEncodingUTF8
-    )
-    if string is None:
-        buffer = ctypes.create_string_buffer(1024)
-        result = CoreFoundation.CFStringGetCString(
-            value_as_void_p, buffer, 1024, CFConst.kCFStringEncodingUTF8
-        )
-        if not result:
-            raise OSError("Error copying C string from CFStringRef")
-        string = buffer.value
-    if string is not None:
-        string = string.decode("utf-8")
-    return string
-
-
-def _assert_no_error(error, exception_class=None):
-    """
-    Checks the return code and throws an exception if there is an error to
-    report
-    """
-    if error == 0:
-        return
-
-    cf_error_string = Security.SecCopyErrorMessageString(error, None)
-    output = _cf_string_to_unicode(cf_error_string)
-    CoreFoundation.CFRelease(cf_error_string)
-
-    if output is None or output == u"":
-        output = u"OSStatus %s" % error
-
-    if exception_class is None:
-        exception_class = ssl.SSLError
-
-    raise exception_class(output)
-
-
-def _cert_array_from_pem(pem_bundle):
-    """
-    Given a bundle of certs in PEM format, turns them into a CFArray of certs
-    that can be used to validate a cert chain.
-    """
-    # Normalize the PEM bundle's line endings.
-    pem_bundle = pem_bundle.replace(b"\r\n", b"\n")
-
-    der_certs = [
-        base64.b64decode(match.group(1)) for match in _PEM_CERTS_RE.finditer(pem_bundle)
-    ]
-    if not der_certs:
-        raise ssl.SSLError("No root certificates specified")
-
-    cert_array = CoreFoundation.CFArrayCreateMutable(
-        CoreFoundation.kCFAllocatorDefault,
-        0,
-        ctypes.byref(CoreFoundation.kCFTypeArrayCallBacks),
-    )
-    if not cert_array:
-        raise ssl.SSLError("Unable to allocate memory!")
-
-    try:
-        for der_bytes in der_certs:
-            certdata = _cf_data_from_bytes(der_bytes)
-            if not certdata:
-                raise ssl.SSLError("Unable to allocate memory!")
-            cert = Security.SecCertificateCreateWithData(
-                CoreFoundation.kCFAllocatorDefault, certdata
-            )
-            CoreFoundation.CFRelease(certdata)
-            if not cert:
-                raise ssl.SSLError("Unable to build cert object!")
-
-            CoreFoundation.CFArrayAppendValue(cert_array, cert)
-            CoreFoundation.CFRelease(cert)
-    except Exception:
-        # We need to free the array before the exception bubbles further.
-        # We only want to do that if an error occurs: otherwise, the caller
-        # should free.
-        CoreFoundation.CFRelease(cert_array)
-        raise
-
-    return cert_array
-
-
-def _is_cert(item):
-    """
-    Returns True if a given CFTypeRef is a certificate.
-    """
-    expected = Security.SecCertificateGetTypeID()
-    return CoreFoundation.CFGetTypeID(item) == expected
-
-
-def _is_identity(item):
-    """
-    Returns True if a given CFTypeRef is an identity.
-    """
-    expected = Security.SecIdentityGetTypeID()
-    return CoreFoundation.CFGetTypeID(item) == expected
-
-
-def _temporary_keychain():
-    """
-    This function creates a temporary Mac keychain that we can use to work with
-    credentials. This keychain uses a one-time password and a temporary file to
-    store the data. We expect to have one keychain per socket. The returned
-    SecKeychainRef must be freed by the caller, including calling
-    SecKeychainDelete.
-
-    Returns a tuple of the SecKeychainRef and the path to the temporary
-    directory that contains it.
-    """
-    # Unfortunately, SecKeychainCreate requires a path to a keychain. This
-    # means we cannot use mkstemp to use a generic temporary file. Instead,
-    # we're going to create a temporary directory and a filename to use there.
-    # This filename will be 8 random bytes expanded into base64. We also need
-    # some random bytes to password-protect the keychain we're creating, so we
-    # ask for 40 random bytes.
-    random_bytes = os.urandom(40)
-    filename = base64.b16encode(random_bytes[:8]).decode("utf-8")
-    password = base64.b16encode(random_bytes[8:])  # Must be valid UTF-8
-    tempdirectory = tempfile.mkdtemp()
-
-    keychain_path = os.path.join(tempdirectory, filename).encode("utf-8")
-
-    # We now want to create the keychain itself.
-    keychain = Security.SecKeychainRef()
-    status = Security.SecKeychainCreate(
-        keychain_path, len(password), password, False, None, ctypes.byref(keychain)
-    )
-    _assert_no_error(status)
-
-    # Having created the keychain, we want to pass it off to the caller.
-    return keychain, tempdirectory
-
-
-def _load_items_from_file(keychain, path):
-    """
-    Given a single file, loads all the trust objects from it into arrays and
-    the keychain.
-    Returns a tuple of lists: the first list is a list of identities, the
-    second a list of certs.
-    """
-    certificates = []
-    identities = []
-    result_array = None
-
-    with open(path, "rb") as f:
-        raw_filedata = f.read()
-
-    try:
-        filedata = CoreFoundation.CFDataCreate(
-            CoreFoundation.kCFAllocatorDefault, raw_filedata, len(raw_filedata)
-        )
-        result_array = CoreFoundation.CFArrayRef()
-        result = Security.SecItemImport(
-            filedata,  # cert data
-            None,  # Filename, leaving it out for now
-            None,  # What the type of the file is, we don't care
-            None,  # what's in the file, we don't care
-            0,  # import flags
-            None,  # key params, can include passphrase in the future
-            keychain,  # The keychain to insert into
-            ctypes.byref(result_array),  # Results
-        )
-        _assert_no_error(result)
-
-        # A CFArray is not very useful to us as an intermediary
-        # representation, so we are going to extract the objects we want
-        # and then free the array. We don't need to keep hold of keys: the
-        # keychain already has them!
-        result_count = CoreFoundation.CFArrayGetCount(result_array)
-        for index in range(result_count):
-            item = CoreFoundation.CFArrayGetValueAtIndex(result_array, index)
-            item = ctypes.cast(item, CoreFoundation.CFTypeRef)
-
-            if _is_cert(item):
-                CoreFoundation.CFRetain(item)
-                certificates.append(item)
-            elif _is_identity(item):
-                CoreFoundation.CFRetain(item)
-                identities.append(item)
-    finally:
-        if result_array:
-            CoreFoundation.CFRelease(result_array)
-
-        CoreFoundation.CFRelease(filedata)
-
-    return (identities, certificates)
-
-
-def _load_client_cert_chain(keychain, *paths):
-    """
-    Load certificates and maybe keys from a number of files. Has the end goal
-    of returning a CFArray containing one SecIdentityRef, and then zero or more
-    SecCertificateRef objects, suitable for use as a client certificate trust
-    chain.
-    """
-    # Ok, the strategy.
-    #
-    # This relies on knowing that macOS will not give you a SecIdentityRef
-    # unless you have imported a key into a keychain. This is a somewhat
-    # artificial limitation of macOS (for example, it doesn't necessarily
-    # affect iOS), but there is nothing inside Security.framework that lets you
-    # get a SecIdentityRef without having a key in a keychain.
-    #
-    # So the policy here is we take all the files and iterate them in order.
-    # Each one will use SecItemImport to have one or more objects loaded from
-    # it. We will also point at a keychain that macOS can use to work with the
-    # private key.
-    #
-    # Once we have all the objects, we'll check what we actually have. If we
-    # already have a SecIdentityRef in hand, fab: we'll use that. Otherwise,
-    # we'll take the first certificate (which we assume to be our leaf) and
-    # ask the keychain to give us a SecIdentityRef with that cert's associated
-    # key.
-    #
-    # We'll then return a CFArray containing the trust chain: one
-    # SecIdentityRef and then zero-or-more SecCertificateRef objects. The
-    # responsibility for freeing this CFArray will be with the caller. This
-    # CFArray must remain alive for the entire connection, so in practice it
-    # will be stored with a single SSLSocket, along with the reference to the
-    # keychain.
-    certificates = []
-    identities = []
-
-    # Filter out bad paths.
-    paths = (path for path in paths if path)
-
-    try:
-        for file_path in paths:
-            new_identities, new_certs = _load_items_from_file(keychain, file_path)
-            identities.extend(new_identities)
-            certificates.extend(new_certs)
-
-        # Ok, we have everything. The question is: do we have an identity? If
-        # not, we want to grab one from the first cert we have.
-        if not identities:
-            new_identity = Security.SecIdentityRef()
-            status = Security.SecIdentityCreateWithCertificate(
-                keychain, certificates[0], ctypes.byref(new_identity)
-            )
-            _assert_no_error(status)
-            identities.append(new_identity)
-
-            # We now want to release the original certificate, as we no longer
-            # need it.
-            CoreFoundation.CFRelease(certificates.pop(0))
-
-        # We now need to build a new CFArray that holds the trust chain.
-        trust_chain = CoreFoundation.CFArrayCreateMutable(
-            CoreFoundation.kCFAllocatorDefault,
-            0,
-            ctypes.byref(CoreFoundation.kCFTypeArrayCallBacks),
-        )
-        for item in itertools.chain(identities, certificates):
-            # ArrayAppendValue does a CFRetain on the item. That's fine,
-            # because the finally block will release our other refs to them.
-            CoreFoundation.CFArrayAppendValue(trust_chain, item)
-
-        return trust_chain
-    finally:
-        for obj in itertools.chain(identities, certificates):
-            CoreFoundation.CFRelease(obj)
-
-
-TLS_PROTOCOL_VERSIONS = {
-    "SSLv2": (0, 2),
-    "SSLv3": (3, 0),
-    "TLSv1": (3, 1),
-    "TLSv1.1": (3, 2),
-    "TLSv1.2": (3, 3),
-}
-
-
-def _build_tls_unknown_ca_alert(version):
-    """
-    Builds a TLS alert record for an unknown CA.
-    """
-    ver_maj, ver_min = TLS_PROTOCOL_VERSIONS[version]
-    severity_fatal = 0x02
-    description_unknown_ca = 0x30
-    msg = struct.pack(">BB", severity_fatal, description_unknown_ca)
-    msg_len = len(msg)
-    record_type_alert = 0x15
-    record = struct.pack(">BBBH", record_type_alert, ver_maj, ver_min, msg_len) + msg
-    return record

package/.venv/lib/python3.9/site-packages/pip/_vendor/urllib3/contrib/appengine.py

@@ -1,314 +0,0 @@
-"""
-This module provides a pool manager that uses Google App Engine's
-`URLFetch Service <https://cloud.google.com/appengine/docs/python/urlfetch>`_.
-
-Example usage::
-
-    from pip._vendor.urllib3 import PoolManager
-    from pip._vendor.urllib3.contrib.appengine import AppEngineManager, is_appengine_sandbox
-
-    if is_appengine_sandbox():
-        # AppEngineManager uses AppEngine's URLFetch API behind the scenes
-        http = AppEngineManager()
-    else:
-        # PoolManager uses a socket-level API behind the scenes
-        http = PoolManager()
-
-    r = http.request('GET', 'https://google.com/')
-
-There are `limitations <https://cloud.google.com/appengine/docs/python/\
-urlfetch/#Python_Quotas_and_limits>`_ to the URLFetch service and it may not be
-the best choice for your application. There are three options for using
-urllib3 on Google App Engine:
-
-1. You can use :class:`AppEngineManager` with URLFetch. URLFetch is
-   cost-effective in many circumstances as long as your usage is within the
-   limitations.
-2. You can use a normal :class:`~urllib3.PoolManager` by enabling sockets.
-   Sockets also have `limitations and restrictions
-   <https://cloud.google.com/appengine/docs/python/sockets/\
-   #limitations-and-restrictions>`_ and have a lower free quota than URLFetch.
-   To use sockets, be sure to specify the following in your ``app.yaml``::
-
-        env_variables:
-            GAE_USE_SOCKETS_HTTPLIB : 'true'
-
-3. If you are using `App Engine Flexible
-<https://cloud.google.com/appengine/docs/flexible/>`_, you can use the standard
-:class:`PoolManager` without any configuration or special environment variables.
-"""
-
-from __future__ import absolute_import
-
-import io
-import logging
-import warnings
-
-from ..exceptions import (
-    HTTPError,
-    HTTPWarning,
-    MaxRetryError,
-    ProtocolError,
-    SSLError,
-    TimeoutError,
-)
-from ..packages.six.moves.urllib.parse import urljoin
-from ..request import RequestMethods
-from ..response import HTTPResponse
-from ..util.retry import Retry
-from ..util.timeout import Timeout
-from . import _appengine_environ
-
-try:
-    from google.appengine.api import urlfetch
-except ImportError:
-    urlfetch = None
-
-
-log = logging.getLogger(__name__)
-
-
-class AppEnginePlatformWarning(HTTPWarning):
-    pass
-
-
-class AppEnginePlatformError(HTTPError):
-    pass
-
-
-class AppEngineManager(RequestMethods):
-    """
-    Connection manager for Google App Engine sandbox applications.
-
-    This manager uses the URLFetch service directly instead of using the
-    emulated httplib, and is subject to URLFetch limitations as described in
-    the App Engine documentation `here
-    <https://cloud.google.com/appengine/docs/python/urlfetch>`_.
-
-    Notably it will raise an :class:`AppEnginePlatformError` if:
-        * URLFetch is not available.
-        * If you attempt to use this on App Engine Flexible, as full socket
-          support is available.
-        * If a request size is more than 10 megabytes.
-        * If a response size is more than 32 megabytes.
-        * If you use an unsupported request method such as OPTIONS.
-
-    Beyond those cases, it will raise normal urllib3 errors.
-    """
-
-    def __init__(
-        self,
-        headers=None,
-        retries=None,
-        validate_certificate=True,
-        urlfetch_retries=True,
-    ):
-        if not urlfetch:
-            raise AppEnginePlatformError(
-                "URLFetch is not available in this environment."
-            )
-
-        warnings.warn(
-            "urllib3 is using URLFetch on Google App Engine sandbox instead "
-            "of sockets. To use sockets directly instead of URLFetch see "
-            "https://urllib3.readthedocs.io/en/1.26.x/reference/urllib3.contrib.html.",
-            AppEnginePlatformWarning,
-        )
-
-        RequestMethods.__init__(self, headers)
-        self.validate_certificate = validate_certificate
-        self.urlfetch_retries = urlfetch_retries
-
-        self.retries = retries or Retry.DEFAULT
-
-    def __enter__(self):
-        return self
-
-    def __exit__(self, exc_type, exc_val, exc_tb):
-        # Return False to re-raise any potential exceptions
-        return False
-
-    def urlopen(
-        self,
-        method,
-        url,
-        body=None,
-        headers=None,
-        retries=None,
-        redirect=True,
-        timeout=Timeout.DEFAULT_TIMEOUT,
-        **response_kw
-    ):
-
-        retries = self._get_retries(retries, redirect)
-
-        try:
-            follow_redirects = redirect and retries.redirect != 0 and retries.total
-            response = urlfetch.fetch(
-                url,
-                payload=body,
-                method=method,
-                headers=headers or {},
-                allow_truncated=False,
-                follow_redirects=self.urlfetch_retries and follow_redirects,
-                deadline=self._get_absolute_timeout(timeout),
-                validate_certificate=self.validate_certificate,
-            )
-        except urlfetch.DeadlineExceededError as e:
-            raise TimeoutError(self, e)
-
-        except urlfetch.InvalidURLError as e:
-            if "too large" in str(e):
-                raise AppEnginePlatformError(
-                    "URLFetch request too large, URLFetch only "
-                    "supports requests up to 10mb in size.",
-                    e,
-                )
-            raise ProtocolError(e)
-
-        except urlfetch.DownloadError as e:
-            if "Too many redirects" in str(e):
-                raise MaxRetryError(self, url, reason=e)
-            raise ProtocolError(e)
-
-        except urlfetch.ResponseTooLargeError as e:
-            raise AppEnginePlatformError(
-                "URLFetch response too large, URLFetch only supports"
-                "responses up to 32mb in size.",
-                e,
-            )
-
-        except urlfetch.SSLCertificateError as e:
-            raise SSLError(e)
-
-        except urlfetch.InvalidMethodError as e:
-            raise AppEnginePlatformError(
-                "URLFetch does not support method: %s" % method, e
-            )
-
-        http_response = self._urlfetch_response_to_http_response(
-            response, retries=retries, **response_kw
-        )
-
-        # Handle redirect?
-        redirect_location = redirect and http_response.get_redirect_location()
-        if redirect_location:
-            # Check for redirect response
-            if self.urlfetch_retries and retries.raise_on_redirect:
-                raise MaxRetryError(self, url, "too many redirects")
-            else:
-                if http_response.status == 303:
-                    method = "GET"
-
-                try:
-                    retries = retries.increment(
-                        method, url, response=http_response, _pool=self
-                    )
-                except MaxRetryError:
-                    if retries.raise_on_redirect:
-                        raise MaxRetryError(self, url, "too many redirects")
-                    return http_response
-
-                retries.sleep_for_retry(http_response)
-                log.debug("Redirecting %s -> %s", url, redirect_location)
-                redirect_url = urljoin(url, redirect_location)
-                return self.urlopen(
-                    method,
-                    redirect_url,
-                    body,
-                    headers,
-                    retries=retries,
-                    redirect=redirect,
-                    timeout=timeout,
-                    **response_kw
-                )
-
-        # Check if we should retry the HTTP response.
-        has_retry_after = bool(http_response.getheader("Retry-After"))
-        if retries.is_retry(method, http_response.status, has_retry_after):
-            retries = retries.increment(method, url, response=http_response, _pool=self)
-            log.debug("Retry: %s", url)
-            retries.sleep(http_response)
-            return self.urlopen(
-                method,
-                url,
-                body=body,
-                headers=headers,
-                retries=retries,
-                redirect=redirect,
-                timeout=timeout,
-                **response_kw
-            )
-
-        return http_response
-
-    def _urlfetch_response_to_http_response(self, urlfetch_resp, **response_kw):
-
-        if is_prod_appengine():
-            # Production GAE handles deflate encoding automatically, but does
-            # not remove the encoding header.
-            content_encoding = urlfetch_resp.headers.get("content-encoding")
-
-            if content_encoding == "deflate":
-                del urlfetch_resp.headers["content-encoding"]
-
-        transfer_encoding = urlfetch_resp.headers.get("transfer-encoding")
-        # We have a full response's content,
-        # so let's make sure we don't report ourselves as chunked data.
-        if transfer_encoding == "chunked":
-            encodings = transfer_encoding.split(",")
-            encodings.remove("chunked")
-            urlfetch_resp.headers["transfer-encoding"] = ",".join(encodings)
-
-        original_response = HTTPResponse(
-            # In order for decoding to work, we must present the content as
-            # a file-like object.
-            body=io.BytesIO(urlfetch_resp.content),
-            msg=urlfetch_resp.header_msg,
-            headers=urlfetch_resp.headers,
-            status=urlfetch_resp.status_code,
-            **response_kw
-        )
-
-        return HTTPResponse(
-            body=io.BytesIO(urlfetch_resp.content),
-            headers=urlfetch_resp.headers,
-            status=urlfetch_resp.status_code,
-            original_response=original_response,
-            **response_kw
-        )
-
-    def _get_absolute_timeout(self, timeout):
-        if timeout is Timeout.DEFAULT_TIMEOUT:
-            return None  # Defer to URLFetch's default.
-        if isinstance(timeout, Timeout):
-            if timeout._read is not None or timeout._connect is not None:
-                warnings.warn(
-                    "URLFetch does not support granular timeout settings, "
-                    "reverting to total or default URLFetch timeout.",
-                    AppEnginePlatformWarning,
-                )
-            return timeout.total
-        return timeout
-
-    def _get_retries(self, retries, redirect):
-        if not isinstance(retries, Retry):
-            retries = Retry.from_int(retries, redirect=redirect, default=self.retries)
-
-        if retries.connect or retries.read or retries.redirect:
-            warnings.warn(
-                "URLFetch only supports total retries and does not "
-                "recognize connect, read, or redirect retry parameters.",
-                AppEnginePlatformWarning,
-            )
-
-        return retries
-
-
-# Alias methods from _appengine_environ to maintain public API interface.
-
-is_appengine = _appengine_environ.is_appengine
-is_appengine_sandbox = _appengine_environ.is_appengine_sandbox
-is_local_appengine = _appengine_environ.is_local_appengine
-is_prod_appengine = _appengine_environ.is_prod_appengine
-is_prod_appengine_mvms = _appengine_environ.is_prod_appengine_mvms