U
    Ïøïcb  ã                   @   s¤   d dl mZmZmZmZ d dlZd dlZddlmZ ddl	m
Z
mZ ddlmZmZ ddlmZmZmZ ejd	k rveZd
dgZdd„ Zddd
„Zdd„ Zdd„ ZdS )é    )Úunicode_literalsÚdivisionÚabsolute_importÚprint_functionNé   )ÚCertificate)ÚnewÚunwrapé   )ÚCoreFoundationÚ	CFHelpers)ÚSecurityÚSecurityConstÚhandle_sec_error)é   Úextract_from_systemÚsystem_pathc                   C   s   d S )N© r   r   r   ú</tmp/pip-unpacked-wheel-c04l8219/oscrypto/_mac/trust_list.pyr      s    Fc                 C   s¦  t tdƒ}t |¡}t|ƒ t|ƒ}i }i }d}tƒ tƒ f}t |¡}	td|	ƒD ]$}
t 	||
¡}t
|ƒ\}}|||< qPt |¡ tjtjfD ]Ä}t tdƒ}t ||¡}|tjkr´qŒt|ƒ t|ƒ}t |¡}	td|	ƒD ]l}
t 	||
¡}t tdƒ}t |||¡}|tjkrqØ|tjkrHt
|ƒ\}}||krØt| || dƒ ||= qØt|ƒ t|ƒ}tƒ }tƒ }t |¡}td|ƒD ]j}t 	||¡}t |¡}| di ¡ d|¡}| dd¡}|dkoÂ|d	k}|rÖ| |¡ n
| |¡ qxt
|ƒ\}}||kr||kr<t| || d
ƒ ||= n ||kr0t|gƒ}||f||< t |¡ qØt |¡ qŒg }|D ]D}|svt| || dƒ | ||¡}| || |d |d f¡ q\|S )aÇ  
    Extracts trusted CA certificates from the OS X trusted root keychain.

    :param cert_callback:
        A callback that is called once for each certificate in the trust store.
        It should accept two parameters: an asn1crypto.x509.Certificate object,
        and a reason. The reason will be None if the certificate is being
        exported, otherwise it will be a unicode string of the reason it won't.

    :param callback_only_on_failure:
        A boolean - if the callback should only be called when a certificate is
        not exported.

    :raises:
        OSError - when an error is returned by the OS crypto library

    :return:
        A list of 3-element tuples:
         - 0: a byte string of a DER-encoded certificate
         - 1: a set of unicode strings that are OIDs of purposes to trust the
              certificate for
         - 2: a set of unicode strings that are OIDs of purposes to reject the
              certificate for
    zCFArrayRef *z2.5.29.37.0r   zinvalid trust settingsZkSecTrustSettingsPolicyZSecPolicyOidZkSecTrustSettingsResultr
   r   zexplicitly distrustedN)r   r   r   ZSecTrustCopyAnchorCertificatesr   r	   ÚsetZCFArrayGetCountÚrangeZCFArrayGetValueAtIndexÚ_cert_detailsÚ	CFReleaser   ZkSecTrustSettingsDomainUserZkSecTrustSettingsDomainAdminZ SecTrustSettingsCopyCertificatesZerrSecNoTrustSettingsZ!SecTrustSettingsCopyTrustSettingsZerrSecItemNotFoundZerrSecInvalidTrustSettingsÚ_cert_callbackr   Zcf_dictionary_to_dictÚgetÚaddÚappend)Zcert_callbackZcallback_only_on_failureZcerts_pointer_pointerÚresZcerts_pointerZcertificatesZ
trust_infoZall_purposesZdefault_trustÚlengthÚindexÚcert_pointerÚder_certÚ	cert_hashÚdomainZ#cert_trust_settings_pointer_pointerZcert_trust_settings_pointerZtrust_settings_pointer_pointerZtrust_settings_pointerZ
trust_oidsZreject_oidsZsettings_lengthZsettings_indexZsettings_dict_entryZsettings_dictZ
policy_oidZtrust_resultZshould_trustÚoutputZcert_trust_infor   r   r   r      s’    








ý



ý

 c                 C   s   | sdS | t  |¡|ƒ dS )aY  
    Constructs an asn1crypto.x509.Certificate object and calls the export
    callback

    :param callback:
        The callback to call

    :param der_cert:
        A byte string of the DER-encoded certificate

    :param reason:
        None if cert is being exported, or a unicode string of the reason it
        is not being exported
    N)r   Úload)Úcallbackr!   Úreasonr   r   r   r   £   s    r   c              	   C   sL   d}z.t | ¡}t |¡}t |¡ ¡ }||fW ¢S |dk	rFt  |¡ X dS )a  
    Return the certificate and a hash of it

    :param cert_pointer:
        A SecCertificateRef

    :return:
        A 2-element tuple:
         - [0]: A byte string of the SHA1 hash of the cert
         - [1]: A byte string of the DER-encoded contents of the cert
    N)	r   r   r   ZSecCertificateCopyDatar   Zcf_data_to_bytesÚhashlibÚsha1Údigest)r    Zdata_pointerr!   r"   r   r   r   r   ¸   s    

r   )NF)Ú
__future__r   r   r   r   r(   ÚsysZ_asn1r   Z_ffir   r	   Z_core_foundationr   r   Z	_securityr   r   r   Úversion_infoÚxranger   Ú__all__r   r   r   r   r   r   r   r   Ú<module>   s    
þ
 
