8?j^ dZddlZddlZddlZddlZddlmZddlZddl m Z m Z ddl m Z ejeZ ddededeed ejfd Zd Zd Z dd ZddZ ddZdS)z< Helper functions for mTLS in async for discovery of certs. N)Optional)_agent_identity_utils exceptions)secure_cert_key_paths cert_bytes key_bytes passphrasereturnc| t|||5\}}}tjtjj}|r|}|||||cdddS#1swxYwYdS#tjtttttf$r}tj d|d}~wwxYw)aCreates an SSLContext with the given client certificate and key. This function writes the certificate and key to temporary files so that ssl.create_default_context can load them, as the ssl module requires file paths for client certificates. These temporary files are deleted immediately after the SSL context is created. Args: cert_bytes (bytes): The client certificate content in PEM format. key_bytes (bytes): The client private key content in PEM format. passphrase (Optional[bytes]): The passphrase for the private key, if any. Returns: ssl.SSLContext: The configured SSL context with client certificate. Raises: google.auth.exceptions.TransportError: If there is an error loading the certificate. )r )certfilekeyfilepasswordNz3Failed to load client certificate and key for mTLS.)rsslcreate_default_contextPurpose SERVER_AUTHload_cert_chainSSLErrorOSErrorIOError ValueError RuntimeError TypeErrorrTransportError) rrr cert_pathkey_pathpassphrase_valcontextrexcs OC:\Projects\Historical\venv\Lib\site-packages\google/auth/aio/transport/mtls.pymake_client_cert_ssl_contextr! s"$ ":yZ P P P U   01HIIG )''&$%(                    L'7J i P' A   s;A3AA& A3&A**A3-A*.A33.B;!B66B;cK tj|g|Rd{VS#t$r+tj}|jd|g|Rd{VcYSwxYw)zRun a blocking function in an executor to avoid blocking the event loop. This implements the non-blocking execution strategy for disk I/O operations. N)asyncio to_threadAttributeErrorget_running_looprun_in_executor)funcargsloops r _run_in_executorr+Gs =&t3d3333333333 ===')))T)$.callbackgs| *-D-F-F'F'F'F'F'F'F $Az99z2 * * * 6zBBGz ) *9$$sAA  A)googleauth transportmtlshas_default_client_cert_sourcerr1)r5s r default_client_cert_sourcer;Us] ; % D D# E   . 6   %%% OcKttjjjj|dd{V\}}|r|rd||dfSdS)aReturns the client side certificate, private key and passphrase. We look for certificates and keys with the following order of priority: 1. Certificate and key specified by certificate_config.json. Currently, only X.509 workload certificates are supported. Args: certificate_config_path (str): The certificate_config.json file path. Returns: Tuple[bool, bytes, bytes, bytes]: A boolean indicating if cert, key and passphrase are obtained, the cert bytes and key bytes both in PEM format, and passphrase bytes. Raises: google.auth.exceptions.ClientCertError: if problems occurs when getting the cert, key and passphrase. FNT)FNNN)r+r6r7r8 _mtls_helper_get_workload_cert_and_key)certificate_config_pathcertkeys r get_client_ssl_credentialsrCsss.' *E ID#  %%T3$$ " "r<cK|r4|}tj|r |d{V\}}n|\}}d||fStd{V\}}}}|||fS)aReturns the client side certificate and private key. The function first tries to get certificate and key from client_cert_callback; if the callback is None or doesn't provide certificate and key, the function tries application default SSL credentials. Args: client_cert_callback (Optional[Callable[[], (bytes, bytes)]]): An optional callback which returns client certificate bytes and private key bytes both in PEM format. Returns: Tuple[bool, bytes, bytes]: A boolean indicating if cert and key are obtained, the cert bytes and key bytes both in PEM format. Raises: google.auth.exceptions.ClientCertError: if problems occurs when getting the cert and key. NT)inspect isawaitablerC)client_cert_callbackresultrArBhas_certr2s r r0r0s(%%''  v & & $ ID##ID#T3#=#?#???????HdC T3 r<cKt|d{V\}}|rsdSfd}t|d{V\}}|||fS)auAsync helper to retrieve certs and compute fingerprints for mTLS rotation. Args: cached_cert (bytes): The cached client certificate. client_cert_callback (Optional[Callable[[], (bytes, bytes)]]): An optional callback which returns client certificate bytes and private key bytes both in PEM format. Returns: Tuple[Optional[bytes], Optional[bytes], Optional[str], Optional[str]]: call_cert_bytes, call_key_bytes, cached_fingerprint, current_cert_fingerprint. Returns (None, None, None, None) if mTLS is disabled or no client certificate is present. N)NNNNctj}tj|}rtj}nd}||fSr/)rparse_certificate!calculate_certificate_fingerprintget_cached_cert_fingerprint)cert_objcurrent_fingerprintcached_fingerprint cached_certcall_cert_bytess r _fetch_fingerprintszGcheck_parameters_for_unauthorized_response.._fetch_fingerprintss`(:?KK3U     &!6!R""  "& !#666r<)r0r+)rRrGis_mtlscall_key_bytesrTrQcurrent_cert_fingerprintrSs` @r *check_parameters_for_unauthorized_responserXs 6M66000000,G_n &/&%% 7 7 7 7 7 7:J::44444400 N,>@X XXr<r/)__doc__r#rEloggingrtypingrgoogle.auth.transport.mtlsr6 google.authrr"google.auth.transport._mtls_helperr getLogger__name___LOGGERbytes SSLContextr!r+r;rCr0rXr<r resL !!!!99999999DDDDDD ' H % %HL$$$"'$5=e_$^$$$$N = = =>! # # # #FB'+&Y&Y&Y&Y&Y&Yr<