py2docfx 0.1.11.dev1830301__py3-none-any.whl → 0.1.11.dev1860114__py3-none-any.whl

py2docfx/venv/template/Lib/site-packages/pip/_vendor/urllib3/contrib/securetransport.py

@@ -1,921 +0,0 @@
-"""
-SecureTranport support for urllib3 via ctypes.
-
-This makes platform-native TLS available to urllib3 users on macOS without the
-use of a compiler. This is an important feature because the Python Package
-Index is moving to become a TLSv1.2-or-higher server, and the default OpenSSL
-that ships with macOS is not capable of doing TLSv1.2. The only way to resolve
-this is to give macOS users an alternative solution to the problem, and that
-solution is to use SecureTransport.
-
-We use ctypes here because this solution must not require a compiler. That's
-because pip is not allowed to require a compiler either.
-
-This is not intended to be a seriously long-term solution to this problem.
-The hope is that PEP 543 will eventually solve this issue for us, at which
-point we can retire this contrib module. But in the short term, we need to
-solve the impending tire fire that is Python on Mac without this kind of
-contrib module. So...here we are.
-
-To use this module, simply import and inject it::
-
-    import pip._vendor.urllib3.contrib.securetransport as securetransport
-    securetransport.inject_into_urllib3()
-
-Happy TLSing!
-
-This code is a bastardised version of the code found in Will Bond's oscrypto
-library. An enormous debt is owed to him for blazing this trail for us. For
-that reason, this code should be considered to be covered both by urllib3's
-license and by oscrypto's:
-
-.. code-block::
-
-    Copyright (c) 2015-2016 Will Bond <will@wbond.net>
-
-    Permission is hereby granted, free of charge, to any person obtaining a
-    copy of this software and associated documentation files (the "Software"),
-    to deal in the Software without restriction, including without limitation
-    the rights to use, copy, modify, merge, publish, distribute, sublicense,
-    and/or sell copies of the Software, and to permit persons to whom the
-    Software is furnished to do so, subject to the following conditions:
-
-    The above copyright notice and this permission notice shall be included in
-    all copies or substantial portions of the Software.
-
-    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
-    FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
-    DEALINGS IN THE SOFTWARE.
-"""
-from __future__ import absolute_import
-
-import contextlib
-import ctypes
-import errno
-import os.path
-import shutil
-import socket
-import ssl
-import struct
-import threading
-import weakref
-
-from pip._vendor import six
-
-from .. import util
-from ..util.ssl_ import PROTOCOL_TLS_CLIENT
-from ._securetransport.bindings import CoreFoundation, Security, SecurityConst
-from ._securetransport.low_level import (
-    _assert_no_error,
-    _build_tls_unknown_ca_alert,
-    _cert_array_from_pem,
-    _create_cfstring_array,
-    _load_client_cert_chain,
-    _temporary_keychain,
-)
-
-try:  # Platform-specific: Python 2
-    from socket import _fileobject
-except ImportError:  # Platform-specific: Python 3
-    _fileobject = None
-    from ..packages.backports.makefile import backport_makefile
-
-__all__ = ["inject_into_urllib3", "extract_from_urllib3"]
-
-# SNI always works
-HAS_SNI = True
-
-orig_util_HAS_SNI = util.HAS_SNI
-orig_util_SSLContext = util.ssl_.SSLContext
-
-# This dictionary is used by the read callback to obtain a handle to the
-# calling wrapped socket. This is a pretty silly approach, but for now it'll
-# do. I feel like I should be able to smuggle a handle to the wrapped socket
-# directly in the SSLConnectionRef, but for now this approach will work I
-# guess.
-#
-# We need to lock around this structure for inserts, but we don't do it for
-# reads/writes in the callbacks. The reasoning here goes as follows:
-#
-#    1. It is not possible to call into the callbacks before the dictionary is
-#       populated, so once in the callback the id must be in the dictionary.
-#    2. The callbacks don't mutate the dictionary, they only read from it, and
-#       so cannot conflict with any of the insertions.
-#
-# This is good: if we had to lock in the callbacks we'd drastically slow down
-# the performance of this code.
-_connection_refs = weakref.WeakValueDictionary()
-_connection_ref_lock = threading.Lock()
-
-# Limit writes to 16kB. This is OpenSSL's limit, but we'll cargo-cult it over
-# for no better reason than we need *a* limit, and this one is right there.
-SSL_WRITE_BLOCKSIZE = 16384
-
-# This is our equivalent of util.ssl_.DEFAULT_CIPHERS, but expanded out to
-# individual cipher suites. We need to do this because this is how
-# SecureTransport wants them.
-CIPHER_SUITES = [
-    SecurityConst.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
-    SecurityConst.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
-    SecurityConst.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
-    SecurityConst.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
-    SecurityConst.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,
-    SecurityConst.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,
-    SecurityConst.TLS_DHE_RSA_WITH_AES_256_GCM_SHA384,
-    SecurityConst.TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,
-    SecurityConst.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,
-    SecurityConst.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
-    SecurityConst.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,
-    SecurityConst.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
-    SecurityConst.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,
-    SecurityConst.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
-    SecurityConst.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,
-    SecurityConst.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
-    SecurityConst.TLS_DHE_RSA_WITH_AES_256_CBC_SHA256,
-    SecurityConst.TLS_DHE_RSA_WITH_AES_256_CBC_SHA,
-    SecurityConst.TLS_DHE_RSA_WITH_AES_128_CBC_SHA256,
-    SecurityConst.TLS_DHE_RSA_WITH_AES_128_CBC_SHA,
-    SecurityConst.TLS_AES_256_GCM_SHA384,
-    SecurityConst.TLS_AES_128_GCM_SHA256,
-    SecurityConst.TLS_RSA_WITH_AES_256_GCM_SHA384,
-    SecurityConst.TLS_RSA_WITH_AES_128_GCM_SHA256,
-    SecurityConst.TLS_AES_128_CCM_8_SHA256,
-    SecurityConst.TLS_AES_128_CCM_SHA256,
-    SecurityConst.TLS_RSA_WITH_AES_256_CBC_SHA256,
-    SecurityConst.TLS_RSA_WITH_AES_128_CBC_SHA256,
-    SecurityConst.TLS_RSA_WITH_AES_256_CBC_SHA,
-    SecurityConst.TLS_RSA_WITH_AES_128_CBC_SHA,
-]
-
-# Basically this is simple: for PROTOCOL_SSLv23 we turn it into a low of
-# TLSv1 and a high of TLSv1.2. For everything else, we pin to that version.
-# TLSv1 to 1.2 are supported on macOS 10.8+
-_protocol_to_min_max = {
-    util.PROTOCOL_TLS: (SecurityConst.kTLSProtocol1, SecurityConst.kTLSProtocol12),
-    PROTOCOL_TLS_CLIENT: (SecurityConst.kTLSProtocol1, SecurityConst.kTLSProtocol12),
-}
-
-if hasattr(ssl, "PROTOCOL_SSLv2"):
-    _protocol_to_min_max[ssl.PROTOCOL_SSLv2] = (
-        SecurityConst.kSSLProtocol2,
-        SecurityConst.kSSLProtocol2,
-    )
-if hasattr(ssl, "PROTOCOL_SSLv3"):
-    _protocol_to_min_max[ssl.PROTOCOL_SSLv3] = (
-        SecurityConst.kSSLProtocol3,
-        SecurityConst.kSSLProtocol3,
-    )
-if hasattr(ssl, "PROTOCOL_TLSv1"):
-    _protocol_to_min_max[ssl.PROTOCOL_TLSv1] = (
-        SecurityConst.kTLSProtocol1,
-        SecurityConst.kTLSProtocol1,
-    )
-if hasattr(ssl, "PROTOCOL_TLSv1_1"):
-    _protocol_to_min_max[ssl.PROTOCOL_TLSv1_1] = (
-        SecurityConst.kTLSProtocol11,
-        SecurityConst.kTLSProtocol11,
-    )
-if hasattr(ssl, "PROTOCOL_TLSv1_2"):
-    _protocol_to_min_max[ssl.PROTOCOL_TLSv1_2] = (
-        SecurityConst.kTLSProtocol12,
-        SecurityConst.kTLSProtocol12,
-    )
-
-
-def inject_into_urllib3():
-    """
-    Monkey-patch urllib3 with SecureTransport-backed SSL-support.
-    """
-    util.SSLContext = SecureTransportContext
-    util.ssl_.SSLContext = SecureTransportContext
-    util.HAS_SNI = HAS_SNI
-    util.ssl_.HAS_SNI = HAS_SNI
-    util.IS_SECURETRANSPORT = True
-    util.ssl_.IS_SECURETRANSPORT = True
-
-
-def extract_from_urllib3():
-    """
-    Undo monkey-patching by :func:`inject_into_urllib3`.
-    """
-    util.SSLContext = orig_util_SSLContext
-    util.ssl_.SSLContext = orig_util_SSLContext
-    util.HAS_SNI = orig_util_HAS_SNI
-    util.ssl_.HAS_SNI = orig_util_HAS_SNI
-    util.IS_SECURETRANSPORT = False
-    util.ssl_.IS_SECURETRANSPORT = False
-
-
-def _read_callback(connection_id, data_buffer, data_length_pointer):
-    """
-    SecureTransport read callback. This is called by ST to request that data
-    be returned from the socket.
-    """
-    wrapped_socket = None
-    try:
-        wrapped_socket = _connection_refs.get(connection_id)
-        if wrapped_socket is None:
-            return SecurityConst.errSSLInternal
-        base_socket = wrapped_socket.socket
-
-        requested_length = data_length_pointer[0]
-
-        timeout = wrapped_socket.gettimeout()
-        error = None
-        read_count = 0
-
-        try:
-            while read_count < requested_length:
-                if timeout is None or timeout >= 0:
-                    if not util.wait_for_read(base_socket, timeout):
-                        raise socket.error(errno.EAGAIN, "timed out")
-
-                remaining = requested_length - read_count
-                buffer = (ctypes.c_char * remaining).from_address(
-                    data_buffer + read_count
-                )
-                chunk_size = base_socket.recv_into(buffer, remaining)
-                read_count += chunk_size
-                if not chunk_size:
-                    if not read_count:
-                        return SecurityConst.errSSLClosedGraceful
-                    break
-        except (socket.error) as e:
-            error = e.errno
-
-            if error is not None and error != errno.EAGAIN:
-                data_length_pointer[0] = read_count
-                if error == errno.ECONNRESET or error == errno.EPIPE:
-                    return SecurityConst.errSSLClosedAbort
-                raise
-
-        data_length_pointer[0] = read_count
-
-        if read_count != requested_length:
-            return SecurityConst.errSSLWouldBlock
-
-        return 0
-    except Exception as e:
-        if wrapped_socket is not None:
-            wrapped_socket._exception = e
-        return SecurityConst.errSSLInternal
-
-
-def _write_callback(connection_id, data_buffer, data_length_pointer):
-    """
-    SecureTransport write callback. This is called by ST to request that data
-    actually be sent on the network.
-    """
-    wrapped_socket = None
-    try:
-        wrapped_socket = _connection_refs.get(connection_id)
-        if wrapped_socket is None:
-            return SecurityConst.errSSLInternal
-        base_socket = wrapped_socket.socket
-
-        bytes_to_write = data_length_pointer[0]
-        data = ctypes.string_at(data_buffer, bytes_to_write)
-
-        timeout = wrapped_socket.gettimeout()
-        error = None
-        sent = 0
-
-        try:
-            while sent < bytes_to_write:
-                if timeout is None or timeout >= 0:
-                    if not util.wait_for_write(base_socket, timeout):
-                        raise socket.error(errno.EAGAIN, "timed out")
-                chunk_sent = base_socket.send(data)
-                sent += chunk_sent
-
-                # This has some needless copying here, but I'm not sure there's
-                # much value in optimising this data path.
-                data = data[chunk_sent:]
-        except (socket.error) as e:
-            error = e.errno
-
-            if error is not None and error != errno.EAGAIN:
-                data_length_pointer[0] = sent
-                if error == errno.ECONNRESET or error == errno.EPIPE:
-                    return SecurityConst.errSSLClosedAbort
-                raise
-
-        data_length_pointer[0] = sent
-
-        if sent != bytes_to_write:
-            return SecurityConst.errSSLWouldBlock
-
-        return 0
-    except Exception as e:
-        if wrapped_socket is not None:
-            wrapped_socket._exception = e
-        return SecurityConst.errSSLInternal
-
-
-# We need to keep these two objects references alive: if they get GC'd while
-# in use then SecureTransport could attempt to call a function that is in freed
-# memory. That would be...uh...bad. Yeah, that's the word. Bad.
-_read_callback_pointer = Security.SSLReadFunc(_read_callback)
-_write_callback_pointer = Security.SSLWriteFunc(_write_callback)
-
-
-class WrappedSocket(object):
-    """
-    API-compatibility wrapper for Python's OpenSSL wrapped socket object.
-
-    Note: _makefile_refs, _drop(), and _reuse() are needed for the garbage
-    collector of PyPy.
-    """
-
-    def __init__(self, socket):
-        self.socket = socket
-        self.context = None
-        self._makefile_refs = 0
-        self._closed = False
-        self._exception = None
-        self._keychain = None
-        self._keychain_dir = None
-        self._client_cert_chain = None
-
-        # We save off the previously-configured timeout and then set it to
-        # zero. This is done because we use select and friends to handle the
-        # timeouts, but if we leave the timeout set on the lower socket then
-        # Python will "kindly" call select on that socket again for us. Avoid
-        # that by forcing the timeout to zero.
-        self._timeout = self.socket.gettimeout()
-        self.socket.settimeout(0)
-
-    @contextlib.contextmanager
-    def _raise_on_error(self):
-        """
-        A context manager that can be used to wrap calls that do I/O from
-        SecureTransport. If any of the I/O callbacks hit an exception, this
-        context manager will correctly propagate the exception after the fact.
-        This avoids silently swallowing those exceptions.
-
-        It also correctly forces the socket closed.
-        """
-        self._exception = None
-
-        # We explicitly don't catch around this yield because in the unlikely
-        # event that an exception was hit in the block we don't want to swallow
-        # it.
-        yield
-        if self._exception is not None:
-            exception, self._exception = self._exception, None
-            self.close()
-            raise exception
-
-    def _set_ciphers(self):
-        """
-        Sets up the allowed ciphers. By default this matches the set in
-        util.ssl_.DEFAULT_CIPHERS, at least as supported by macOS. This is done
-        custom and doesn't allow changing at this time, mostly because parsing
-        OpenSSL cipher strings is going to be a freaking nightmare.
-        """
-        ciphers = (Security.SSLCipherSuite * len(CIPHER_SUITES))(*CIPHER_SUITES)
-        result = Security.SSLSetEnabledCiphers(
-            self.context, ciphers, len(CIPHER_SUITES)
-        )
-        _assert_no_error(result)
-
-    def _set_alpn_protocols(self, protocols):
-        """
-        Sets up the ALPN protocols on the context.
-        """
-        if not protocols:
-            return
-        protocols_arr = _create_cfstring_array(protocols)
-        try:
-            result = Security.SSLSetALPNProtocols(self.context, protocols_arr)
-            _assert_no_error(result)
-        finally:
-            CoreFoundation.CFRelease(protocols_arr)
-
-    def _custom_validate(self, verify, trust_bundle):
-        """
-        Called when we have set custom validation. We do this in two cases:
-        first, when cert validation is entirely disabled; and second, when
-        using a custom trust DB.
-        Raises an SSLError if the connection is not trusted.
-        """
-        # If we disabled cert validation, just say: cool.
-        if not verify:
-            return
-
-        successes = (
-            SecurityConst.kSecTrustResultUnspecified,
-            SecurityConst.kSecTrustResultProceed,
-        )
-        try:
-            trust_result = self._evaluate_trust(trust_bundle)
-            if trust_result in successes:
-                return
-            reason = "error code: %d" % (trust_result,)
-        except Exception as e:
-            # Do not trust on error
-            reason = "exception: %r" % (e,)
-
-        # SecureTransport does not send an alert nor shuts down the connection.
-        rec = _build_tls_unknown_ca_alert(self.version())
-        self.socket.sendall(rec)
-        # close the connection immediately
-        # l_onoff = 1, activate linger
-        # l_linger = 0, linger for 0 seoncds
-        opts = struct.pack("ii", 1, 0)
-        self.socket.setsockopt(socket.SOL_SOCKET, socket.SO_LINGER, opts)
-        self.close()
-        raise ssl.SSLError("certificate verify failed, %s" % reason)
-
-    def _evaluate_trust(self, trust_bundle):
-        # We want data in memory, so load it up.
-        if os.path.isfile(trust_bundle):
-            with open(trust_bundle, "rb") as f:
-                trust_bundle = f.read()
-
-        cert_array = None
-        trust = Security.SecTrustRef()
-
-        try:
-            # Get a CFArray that contains the certs we want.
-            cert_array = _cert_array_from_pem(trust_bundle)
-
-            # Ok, now the hard part. We want to get the SecTrustRef that ST has
-            # created for this connection, shove our CAs into it, tell ST to
-            # ignore everything else it knows, and then ask if it can build a
-            # chain. This is a buuuunch of code.
-            result = Security.SSLCopyPeerTrust(self.context, ctypes.byref(trust))
-            _assert_no_error(result)
-            if not trust:
-                raise ssl.SSLError("Failed to copy trust reference")
-
-            result = Security.SecTrustSetAnchorCertificates(trust, cert_array)
-            _assert_no_error(result)
-
-            result = Security.SecTrustSetAnchorCertificatesOnly(trust, True)
-            _assert_no_error(result)
-
-            trust_result = Security.SecTrustResultType()
-            result = Security.SecTrustEvaluate(trust, ctypes.byref(trust_result))
-            _assert_no_error(result)
-        finally:
-            if trust:
-                CoreFoundation.CFRelease(trust)
-
-            if cert_array is not None:
-                CoreFoundation.CFRelease(cert_array)
-
-        return trust_result.value
-
-    def handshake(
-        self,
-        server_hostname,
-        verify,
-        trust_bundle,
-        min_version,
-        max_version,
-        client_cert,
-        client_key,
-        client_key_passphrase,
-        alpn_protocols,
-    ):
-        """
-        Actually performs the TLS handshake. This is run automatically by
-        wrapped socket, and shouldn't be needed in user code.
-        """
-        # First, we do the initial bits of connection setup. We need to create
-        # a context, set its I/O funcs, and set the connection reference.
-        self.context = Security.SSLCreateContext(
-            None, SecurityConst.kSSLClientSide, SecurityConst.kSSLStreamType
-        )
-        result = Security.SSLSetIOFuncs(
-            self.context, _read_callback_pointer, _write_callback_pointer
-        )
-        _assert_no_error(result)
-
-        # Here we need to compute the handle to use. We do this by taking the
-        # id of self modulo 2**31 - 1. If this is already in the dictionary, we
-        # just keep incrementing by one until we find a free space.
-        with _connection_ref_lock:
-            handle = id(self) % 2147483647
-            while handle in _connection_refs:
-                handle = (handle + 1) % 2147483647
-            _connection_refs[handle] = self
-
-        result = Security.SSLSetConnection(self.context, handle)
-        _assert_no_error(result)
-
-        # If we have a server hostname, we should set that too.
-        if server_hostname:
-            if not isinstance(server_hostname, bytes):
-                server_hostname = server_hostname.encode("utf-8")
-
-            result = Security.SSLSetPeerDomainName(
-                self.context, server_hostname, len(server_hostname)
-            )
-            _assert_no_error(result)
-
-        # Setup the ciphers.
-        self._set_ciphers()
-
-        # Setup the ALPN protocols.
-        self._set_alpn_protocols(alpn_protocols)
-
-        # Set the minimum and maximum TLS versions.
-        result = Security.SSLSetProtocolVersionMin(self.context, min_version)
-        _assert_no_error(result)
-
-        result = Security.SSLSetProtocolVersionMax(self.context, max_version)
-        _assert_no_error(result)
-
-        # If there's a trust DB, we need to use it. We do that by telling
-        # SecureTransport to break on server auth. We also do that if we don't
-        # want to validate the certs at all: we just won't actually do any
-        # authing in that case.
-        if not verify or trust_bundle is not None:
-            result = Security.SSLSetSessionOption(
-                self.context, SecurityConst.kSSLSessionOptionBreakOnServerAuth, True
-            )
-            _assert_no_error(result)
-
-        # If there's a client cert, we need to use it.
-        if client_cert:
-            self._keychain, self._keychain_dir = _temporary_keychain()
-            self._client_cert_chain = _load_client_cert_chain(
-                self._keychain, client_cert, client_key
-            )
-            result = Security.SSLSetCertificate(self.context, self._client_cert_chain)
-            _assert_no_error(result)
-
-        while True:
-            with self._raise_on_error():
-                result = Security.SSLHandshake(self.context)
-
-                if result == SecurityConst.errSSLWouldBlock:
-                    raise socket.timeout("handshake timed out")
-                elif result == SecurityConst.errSSLServerAuthCompleted:
-                    self._custom_validate(verify, trust_bundle)
-                    continue
-                else:
-                    _assert_no_error(result)
-                    break
-
-    def fileno(self):
-        return self.socket.fileno()
-
-    # Copy-pasted from Python 3.5 source code
-    def _decref_socketios(self):
-        if self._makefile_refs > 0:
-            self._makefile_refs -= 1
-        if self._closed:
-            self.close()
-
-    def recv(self, bufsiz):
-        buffer = ctypes.create_string_buffer(bufsiz)
-        bytes_read = self.recv_into(buffer, bufsiz)
-        data = buffer[:bytes_read]
-        return data
-
-    def recv_into(self, buffer, nbytes=None):
-        # Read short on EOF.
-        if self._closed:
-            return 0
-
-        if nbytes is None:
-            nbytes = len(buffer)
-
-        buffer = (ctypes.c_char * nbytes).from_buffer(buffer)
-        processed_bytes = ctypes.c_size_t(0)
-
-        with self._raise_on_error():
-            result = Security.SSLRead(
-                self.context, buffer, nbytes, ctypes.byref(processed_bytes)
-            )
-
-        # There are some result codes that we want to treat as "not always
-        # errors". Specifically, those are errSSLWouldBlock,
-        # errSSLClosedGraceful, and errSSLClosedNoNotify.
-        if result == SecurityConst.errSSLWouldBlock:
-            # If we didn't process any bytes, then this was just a time out.
-            # However, we can get errSSLWouldBlock in situations when we *did*
-            # read some data, and in those cases we should just read "short"
-            # and return.
-            if processed_bytes.value == 0:
-                # Timed out, no data read.
-                raise socket.timeout("recv timed out")
-        elif result in (
-            SecurityConst.errSSLClosedGraceful,
-            SecurityConst.errSSLClosedNoNotify,
-        ):
-            # The remote peer has closed this connection. We should do so as
-            # well. Note that we don't actually return here because in
-            # principle this could actually be fired along with return data.
-            # It's unlikely though.
-            self.close()
-        else:
-            _assert_no_error(result)
-
-        # Ok, we read and probably succeeded. We should return whatever data
-        # was actually read.
-        return processed_bytes.value
-
-    def settimeout(self, timeout):
-        self._timeout = timeout
-
-    def gettimeout(self):
-        return self._timeout
-
-    def send(self, data):
-        processed_bytes = ctypes.c_size_t(0)
-
-        with self._raise_on_error():
-            result = Security.SSLWrite(
-                self.context, data, len(data), ctypes.byref(processed_bytes)
-            )
-
-        if result == SecurityConst.errSSLWouldBlock and processed_bytes.value == 0:
-            # Timed out
-            raise socket.timeout("send timed out")
-        else:
-            _assert_no_error(result)
-
-        # We sent, and probably succeeded. Tell them how much we sent.
-        return processed_bytes.value
-
-    def sendall(self, data):
-        total_sent = 0
-        while total_sent < len(data):
-            sent = self.send(data[total_sent : total_sent + SSL_WRITE_BLOCKSIZE])
-            total_sent += sent
-
-    def shutdown(self):
-        with self._raise_on_error():
-            Security.SSLClose(self.context)
-
-    def close(self):
-        # TODO: should I do clean shutdown here? Do I have to?
-        if self._makefile_refs < 1:
-            self._closed = True
-            if self.context:
-                CoreFoundation.CFRelease(self.context)
-                self.context = None
-            if self._client_cert_chain:
-                CoreFoundation.CFRelease(self._client_cert_chain)
-                self._client_cert_chain = None
-            if self._keychain:
-                Security.SecKeychainDelete(self._keychain)
-                CoreFoundation.CFRelease(self._keychain)
-                shutil.rmtree(self._keychain_dir)
-                self._keychain = self._keychain_dir = None
-            return self.socket.close()
-        else:
-            self._makefile_refs -= 1
-
-    def getpeercert(self, binary_form=False):
-        # Urgh, annoying.
-        #
-        # Here's how we do this:
-        #
-        # 1. Call SSLCopyPeerTrust to get hold of the trust object for this
-        #    connection.
-        # 2. Call SecTrustGetCertificateAtIndex for index 0 to get the leaf.
-        # 3. To get the CN, call SecCertificateCopyCommonName and process that
-        #    string so that it's of the appropriate type.
-        # 4. To get the SAN, we need to do something a bit more complex:
-        #    a. Call SecCertificateCopyValues to get the data, requesting
-        #       kSecOIDSubjectAltName.
-        #    b. Mess about with this dictionary to try to get the SANs out.
-        #
-        # This is gross. Really gross. It's going to be a few hundred LoC extra
-        # just to repeat something that SecureTransport can *already do*. So my
-        # operating assumption at this time is that what we want to do is
-        # instead to just flag to urllib3 that it shouldn't do its own hostname
-        # validation when using SecureTransport.
-        if not binary_form:
-            raise ValueError("SecureTransport only supports dumping binary certs")
-        trust = Security.SecTrustRef()
-        certdata = None
-        der_bytes = None
-
-        try:
-            # Grab the trust store.
-            result = Security.SSLCopyPeerTrust(self.context, ctypes.byref(trust))
-            _assert_no_error(result)
-            if not trust:
-                # Probably we haven't done the handshake yet. No biggie.
-                return None
-
-            cert_count = Security.SecTrustGetCertificateCount(trust)
-            if not cert_count:
-                # Also a case that might happen if we haven't handshaked.
-                # Handshook? Handshaken?
-                return None
-
-            leaf = Security.SecTrustGetCertificateAtIndex(trust, 0)
-            assert leaf
-
-            # Ok, now we want the DER bytes.
-            certdata = Security.SecCertificateCopyData(leaf)
-            assert certdata
-
-            data_length = CoreFoundation.CFDataGetLength(certdata)
-            data_buffer = CoreFoundation.CFDataGetBytePtr(certdata)
-            der_bytes = ctypes.string_at(data_buffer, data_length)
-        finally:
-            if certdata:
-                CoreFoundation.CFRelease(certdata)
-            if trust:
-                CoreFoundation.CFRelease(trust)
-
-        return der_bytes
-
-    def version(self):
-        protocol = Security.SSLProtocol()
-        result = Security.SSLGetNegotiatedProtocolVersion(
-            self.context, ctypes.byref(protocol)
-        )
-        _assert_no_error(result)
-        if protocol.value == SecurityConst.kTLSProtocol13:
-            raise ssl.SSLError("SecureTransport does not support TLS 1.3")
-        elif protocol.value == SecurityConst.kTLSProtocol12:
-            return "TLSv1.2"
-        elif protocol.value == SecurityConst.kTLSProtocol11:
-            return "TLSv1.1"
-        elif protocol.value == SecurityConst.kTLSProtocol1:
-            return "TLSv1"
-        elif protocol.value == SecurityConst.kSSLProtocol3:
-            return "SSLv3"
-        elif protocol.value == SecurityConst.kSSLProtocol2:
-            return "SSLv2"
-        else:
-            raise ssl.SSLError("Unknown TLS version: %r" % protocol)
-
-    def _reuse(self):
-        self._makefile_refs += 1
-
-    def _drop(self):
-        if self._makefile_refs < 1:
-            self.close()
-        else:
-            self._makefile_refs -= 1
-
-
-if _fileobject:  # Platform-specific: Python 2
-
-    def makefile(self, mode, bufsize=-1):
-        self._makefile_refs += 1
-        return _fileobject(self, mode, bufsize, close=True)
-
-else:  # Platform-specific: Python 3
-
-    def makefile(self, mode="r", buffering=None, *args, **kwargs):
-        # We disable buffering with SecureTransport because it conflicts with
-        # the buffering that ST does internally (see issue #1153 for more).
-        buffering = 0
-        return backport_makefile(self, mode, buffering, *args, **kwargs)
-
-
-WrappedSocket.makefile = makefile
-
-
-class SecureTransportContext(object):
-    """
-    I am a wrapper class for the SecureTransport library, to translate the
-    interface of the standard library ``SSLContext`` object to calls into
-    SecureTransport.
-    """
-
-    def __init__(self, protocol):
-        self._min_version, self._max_version = _protocol_to_min_max[protocol]
-        self._options = 0
-        self._verify = False
-        self._trust_bundle = None
-        self._client_cert = None
-        self._client_key = None
-        self._client_key_passphrase = None
-        self._alpn_protocols = None
-
-    @property
-    def check_hostname(self):
-        """
-        SecureTransport cannot have its hostname checking disabled. For more,
-        see the comment on getpeercert() in this file.
-        """
-        return True
-
-    @check_hostname.setter
-    def check_hostname(self, value):
-        """
-        SecureTransport cannot have its hostname checking disabled. For more,
-        see the comment on getpeercert() in this file.
-        """
-        pass
-
-    @property
-    def options(self):
-        # TODO: Well, crap.
-        #
-        # So this is the bit of the code that is the most likely to cause us
-        # trouble. Essentially we need to enumerate all of the SSL options that
-        # users might want to use and try to see if we can sensibly translate
-        # them, or whether we should just ignore them.
-        return self._options
-
-    @options.setter
-    def options(self, value):
-        # TODO: Update in line with above.
-        self._options = value
-
-    @property
-    def verify_mode(self):
-        return ssl.CERT_REQUIRED if self._verify else ssl.CERT_NONE
-
-    @verify_mode.setter
-    def verify_mode(self, value):
-        self._verify = True if value == ssl.CERT_REQUIRED else False
-
-    def set_default_verify_paths(self):
-        # So, this has to do something a bit weird. Specifically, what it does
-        # is nothing.
-        #
-        # This means that, if we had previously had load_verify_locations
-        # called, this does not undo that. We need to do that because it turns
-        # out that the rest of the urllib3 code will attempt to load the
-        # default verify paths if it hasn't been told about any paths, even if
-        # the context itself was sometime earlier. We resolve that by just
-        # ignoring it.
-        pass
-
-    def load_default_certs(self):
-        return self.set_default_verify_paths()
-
-    def set_ciphers(self, ciphers):
-        # For now, we just require the default cipher string.
-        if ciphers != util.ssl_.DEFAULT_CIPHERS:
-            raise ValueError("SecureTransport doesn't support custom cipher strings")
-
-    def load_verify_locations(self, cafile=None, capath=None, cadata=None):
-        # OK, we only really support cadata and cafile.
-        if capath is not None:
-            raise ValueError("SecureTransport does not support cert directories")
-
-        # Raise if cafile does not exist.
-        if cafile is not None:
-            with open(cafile):
-                pass
-
-        self._trust_bundle = cafile or cadata
-
-    def load_cert_chain(self, certfile, keyfile=None, password=None):
-        self._client_cert = certfile
-        self._client_key = keyfile
-        self._client_cert_passphrase = password
-
-    def set_alpn_protocols(self, protocols):
-        """
-        Sets the ALPN protocols that will later be set on the context.
-
-        Raises a NotImplementedError if ALPN is not supported.
-        """
-        if not hasattr(Security, "SSLSetALPNProtocols"):
-            raise NotImplementedError(
-                "SecureTransport supports ALPN only in macOS 10.12+"
-            )
-        self._alpn_protocols = [six.ensure_binary(p) for p in protocols]
-
-    def wrap_socket(
-        self,
-        sock,
-        server_side=False,
-        do_handshake_on_connect=True,
-        suppress_ragged_eofs=True,
-        server_hostname=None,
-    ):
-        # So, what do we do here? Firstly, we assert some properties. This is a
-        # stripped down shim, so there is some functionality we don't support.
-        # See PEP 543 for the real deal.
-        assert not server_side
-        assert do_handshake_on_connect
-        assert suppress_ragged_eofs
-
-        # Ok, we're good to go. Now we want to create the wrapped socket object
-        # and store it in the appropriate place.
-        wrapped_socket = WrappedSocket(sock)
-
-        # Now we can handshake
-        wrapped_socket.handshake(
-            server_hostname,
-            self._verify,
-            self._trust_bundle,
-            self._min_version,
-            self._max_version,
-            self._client_cert,
-            self._client_key,
-            self._client_key_passphrase,
-            self._alpn_protocols,
-        )
-        return wrapped_socket