@wj{udZddlZddlZddlZddlZddlmZmZmZddlZddl Z ddl Z ddl Z ddl m Z mZmZmZmZmZddlmZddlmZddlmZddlmZd Zd Zd Zej6d ej8Zej6d ej8Zej>e Z!ej6dej8Z"Gdde#Z$dee%de&fdZ'ejP d3dee)e%dfdee)e%dfdee)deeee%ee%ee)fddffdZ*de)dee)dee)ee)ffdZ+de%fdZ,ejPdee)dee)deeee%ee%fddffdZ-de.de)ddfd Z/ejPdee)dee)dee)deeee%ee%ee)fddffd!Z0d"Z1d#Z2 d4d$Z3d4d%Z4d5d&Z5d'Z6d(Z7d)Z8d6d+Z9d*edfd,Z:d3d-Z;d.Zd1Z?d2Z@y)7z/Helper functions for getting mTLS cert and key.N)environgetenvpath)cast GeneratorListOptionalTupleUnion)_agent_identity_utils) _cloud_sdk)environment_vars) exceptionsz,~/.secureConnect/context_aware_metadata.jsonz(~/.config/gcloud/certificate_config.jsoncert_provider_commands:-----BEGIN CERTIFICATE-----.+-----END CERTIFICATE----- ? ?sH-----BEGIN [A-Z ]*PRIVATE KEY-----.+-----END [A-Z ]*PRIVATE KEY----- ? ?s6-----BEGIN PASSPHRASE-----(.+)-----END PASSPHRASE-----ceZdZdZy)_MemfdCreationErrorz@Raised when Linux in-memory virtual file creation (memfd) fails.N)__name__ __module__ __qualname____doc__`/root/dashboard-youtube/.venv/lib/python3.12/site-packages/google/auth/transport/_mtls_helper.pyrr<sJrrrreturncn|y t|d5 dddy#1swYyxYw#t$rYywxYw)NTrbF)openOSError)rs r _can_readrBsC | $      s ((%(( 44certkey passphrasec#Kt|trd|vr|jd}t|trd|vr|jd}t|trt|tr|||fyt|tr|nd}t|tr|nd}tj dk(rt tdr t||5\}}|tjj|rl|tjj|rKt|r@t|r5tt|xs|tt|xs||f dddydddt|||5\}}}tt|xs|tt|xs||fdddy#1swYOxYw#t$rY]wxYw#1swYyxYww)a~Provides secure file paths for certificate and key. This function is implemented as a context manager generator to ensure that any temporary resources (such as in-memory virtual files or encrypted physical temp files) are automatically cleaned up and securely wiped when the context exits. It supports mixed inputs (e.g. passing one as a string path and the other as bytes). If a parameter is already a string path or None, it is passed through as-is, and only raw bytes are written to temporary storage. Args: cert (Union[str, bytes, None]): Certificate path, raw PEM content bytes, or None. key (Union[str, bytes, None]): Private key path, raw PEM content bytes, or None. passphrase (Optional[bytes]): Optional passphrase for the private key. Yields: Tuple[str, str, Optional[bytes]]: The certificate path, key path, and the passphrase needed to load the key (either the user's original, or the newly generated one if Tier 3 had to encrypt the key). Raises: OSError: If temporary file creation or writing fails during the Tier 3 fallback. z -----BEGIN utf-8Nlinux memfd_create) isinstancestrencodebytessysplatformhasattros_memfd_cert_key_pathsrexistsrrr_tempfile_cert_key_paths)r r!r" cert_bytes key_bytes cert_pathkey_pathnew_passphrases rsecure_cert_key_pathsr7Ms>$$!6{{7##s  4jj!$C!5C##$D%0dJ!#u-4I  ||w72~#> &z9= AV)X% )B$x(@ + (0C"3 (9T:DS=%&&    "*i DWI3 )T*Dho#,FVV WW!  #    WWsgB>G F8 BF,F8GF8& G30G# G,F51F88 GGGGG Gr3cddl}ddlm}ddl} |j |d}|}|!|j dj d}n!t|tr|j d}|j|jj|jj|j|}||fS#tt |j"j$f$r||fcYSwxYw)aCEncrypts a plaintext PEM key if necessary, returning the bytes and passphrase. If the key is already encrypted, or if parsing/encryption fails, the key is returned as-is (plaintext) as a fallback. This allows the caller (underlying SSL context) to attempt loading the key directly and handle any failures. rN serializationpassword r$encodingformatencryption_algorithm) cryptographycryptography.hazmat.primitivesr:secretsload_pem_private_key token_hexr)r'r( private_bytesEncodingPEM PrivateFormatPKCS8BestAvailableEncryption ValueError TypeErrorrUnsupportedAlgorithm)r3r"rBr:rDpkeytarget_passphraseencrypted_contents r_encrypt_key_if_plaintextrSs<%11)d1K&  $ ' 1 1" 5 < >) $ wwy) )U # !q GGEDL ! GGI HHQXXZ  !  IIi  ! !         IIi    sr+C AB4CC4B=9C C  C C  C CCD C65D6 D?DDDr2c#Kg}g} |df|dffD]\}}||tj|tj}|j|tj|dd5}|j |ddd|jd||jd |\} } | | f|D]} tj|y#1swY[xYw#t tf$r}td|d}~wwxYw#t $rYVwxYw#|D]'} tj|#t $rY%wxYwwxYww) zCreates secure, in-memory virtual files on Linux using memfd_create. Yields: Tuple[Optional[str], Optional[str]]: In-memory file paths pointing to the active descriptors (e.g., '/proc/self/fd/3'). mtls_certmtls_keyNwbF)closefdz/proc/self/fd/z(Failed to create in-memory virtual files) r.r& MFD_CLOEXECappendfdopenrXrAttributeErrorrclose) r2r3 cleanup_fdspathsdatanamefdr^excr4r5s rr/r/s^K!#E  *K89j:QR ' d#r~~>B&&r*2tU;&q &LL>"!67LL& '$ 8!! B   && ( %:     B     sEAC&C80C( D4E:DEC CC>- C99C>>D D  E D  ED>D-,D>- D9 6D>8D9 9D>>Ernrlcn tj|d}|5|j ||j  tj|jdddy#t$r' tj|#t$rYwxYwwxYw#t$rYGwxYw#1swYyxYw)zJWrites data to a file descriptor, securely flushes to disk, and closes it.rcN) r.rg BaseExceptionrirrXrYrZr[)rnrlr^s r_write_secure_tempfilerrs IIb$        HHQXXZ    HHRL         sWA)"B+#B) B3B B BBBB B(%B+'B((B++B4c#Ktjjdr&tjdtjrdnd}ddg}|}|}d}|t ||\}} t ||gD]3\}} |  tj|\} } | ||<t| | 5|d|d|f|d} |d} | r t| | r7 tjj| rtj| yyy#t$rtjd\} } YwxYw#t$rYmwxYw#t$rYywxYw#| rF tjj| rtj| ww#t$rYwwxYwwxYw#|d} |d} | r t| n#t$rYnwxYw| rF tjj| rtj| ww#t$rYwwxYww#| rF tjj| rtj| ww#t$rYwwxYwwxYwxYww)zCreates secure temporary file paths on disk, encrypting private keys. Yields: Tuple[Optional[str], Optional[str], Optional[bytes]]: The temporary file paths and the passphrase needed to load the key. z/dev/shmN)dirr)r.risdiraccessW_OKrS enumeratetempfilemkstemprrrr_ Exceptionr0r\)r2r3r"tmp_dir cleanup_filesr6 cert_datakey_datairlrnrcert_cleanup_pathkey_cleanup_paths rr1r1s 77== $:rww)G   +/MNIH#H GH I4G=;I= H IH  I I4II I II IIIctj|}tj|stj d|y|S)aJChecks for config file path. If it exists, returns the absolute path with user expansion; otherwise returns None. Args: config_path (str): The config file path for either context_aware_metadata.json or certificate_config.json for example Returns: str: absolute path if exists and None otherwise. z%s is not found.N)r expanduserr0_LOGGERdebug) config_paths r_check_config_pathrIs6//+.K ;;{ # (+6 rc t|5}tj|}ddd|S#1swYSxYw#t$r}t j |}||d}~wwxYw)a\Reads and loads JSON from the given path. Used to read both X509 workload certificate and secure connect configurations. Args: path (str): the path to read from. Returns: Dict[str, str]: The JSON stored at the file. Raises: google.auth.exceptions.ClientCertError: If failed to parse the file as JSON. N)rjsonloadrMrClientCertError)rr^ json_data caught_excnew_excs r_load_json_filerZsf& $Z %1 ! I %   %  &,,Z8:%&s) :-:7:: A AA cBt||\}}||yt||S)aRead the workload identity cert and key files specified in the certificate config provided. If no config path is provided, check the environment variable: "GOOGLE_API_CERTIFICATE_CONFIG" first, then the well known gcloud location: "~/.config/gcloud/certificate_config.json". Args: certificate_config_path (string): The certificate config path. If no path is provided, the environment variable will be checked first, then the well known gcloud location. include_context_aware (bool): If context aware metadata path should be checked for the SecureConnect mTLS configuration. Returns: Tuple[Optional[bytes], Optional[bytes]]: client certificate bytes in PEM format and key bytes in PEM format. Raises: google.auth.exceptions.ClientCertError: if problems occurs when retrieving the certificate or key information. NN) _get_workload_cert_and_key_paths_read_cert_and_key_files)certificate_config_pathinclude_context_awarer4r5s r_get_workload_cert_and_keyrqs6,;!6IxX- #Ix 88rc d}d}|tjtjd}||dk7r|}dtj}nwtjtjd}|r||dk7r|}dtj}n4t j jtjd}d}t j|}t j|s|rtjd||y|S) aGet the certificate configuration path based on the following order: 1: Explicit override, if set 2: Environment variable, if set 3: Well-known location Returns "None" if the selected config file does not exist. Args: certificate_config_path (string): The certificate config path. If provided, the well known location and environment variable will be ignored. include_context_aware (bool): If context aware metadata path should be checked for the SecureConnect mTLS configuration. Returns: The absolute path of the certificate config file, and None if the file does not exist. zfunction argumentTNzenvironment variable zcertificate_config.jsonFzOCertificate configuration file explicitly specified via %s at %s does not exist)rgetrGOOGLE_API_CERTIFICATE_CONFIG3CLOUDSDK_CONTEXT_AWARE_CERTIFICATE_CONFIG_FILE_PATHr.rjoinr get_config_pathrr0rr)rrsource is_explicitenv_paths r_get_cert_config_pathrs&!FK&;;/MMtT  HN&. #'(8(V(V'WX {{ TTH%)=(b.*2'01A1u1u0vw*,'',,..02K+'$ "oo.EF ;;. /  MMa'   ""rct||}|yt|}d|vr$tjdj ||d}d|vry|d}d|vsd|vr$tjdj ||d}|d}||fS)Nr cert_configszWCertificate config file {} is in an invalid format, a "cert configs" object is expectedworkloadr4r5zMWorkload certificate configuration is missing "cert_path" or "key_path" in {})rrrrr@)rr absolute_pathrlrrr4r5s rrrs)+7LMM = )DT!(( e l l   'L%J'H("j&@(( [ b b   %I #H h rc6t|}t|}||fSN)_read_cert_file_read_key_file)r4r5rrs rrrs! *Ih'H h rct|d5}|j}dddtjt}t |dk7r$t jdj||dS#1swYZxYw)Nrruz[Certificate file {} is in an invalid format, a single PEM formatted certificate is expectedr) rreadrefindall _CERT_REGEXlenrrr@)r4 cert_filer cert_matchs rrrs} i %)NN$ %K3J :!(( i p p   a=%% A77Bct|d5}|j}dddtjt}t |dk7r$t jdj||dS#1swYZxYw)Nrruz[Private key file {} is in an invalid format, a single PEM formatted private key is expectedr) rrrr _KEY_REGEXrrrr@)r5key_filer key_matchs rrrs| h #==?# :x0I 9~(( i p p   Q<##rFc tj|tjtj}|j\}}|jdk7r"t j d|jztjt|}t|dk7rt j dtjt|}t|dk7rt j dtjt|} |r[t| dk7rt j dd |dvrt j d |d|d| djfSd |dvrt j d t| dkDrt j d |d|ddfS#t$r}t j |}||d}~wwxYw) a!Run the provided command, and return client side mTLS cert, key and passphrase. Args: command (List[str]): cert provider command. expect_encrypted_key (bool): If encrypted private key is expected. Returns: Tuple[bytes, bytes, bytes]: client certificate bytes in PEM format, key bytes in PEM format and passphrase bytes. Raises: google.auth.exceptions.ClientCertError: if problems occurs when running the cert provider command or generating cert, key and passphrase. )stdoutstderrNrz5Cert provider command returns non-zero status code %sruz,Client SSL certificate is missing or invalidz$Client SSL key is missing or invalidz Passphrase is missing or invalids ENCRYPTEDz!Encrypted private key is expectedz%Encrypted private key is not expectedzPassphrase is not expected) subprocessPopenPIPE communicaterrr returncoderrrrr_PASSPHRASE_REGEXstrip) commandexpect_encrypted_keyprocessrrrrrrpassphrase_matchs r_run_cert_provider_commandrs &"" JOOJOO !,,. Q(( CgFXFX X  K0J :!(()WXX :v.I 9~(()OPPzz"3V<  A %,,-OP P y| +,,-PQ Q!}il,GGc t|\}}|r|rd||dfSt|}|r_t|}t|vrt j d|t}|rd|vr|j dt||\}}}d|||fSy)aReturns the client side certificate, private key and passphrase. We look for certificates and keys with the following order of priority: 1. Certificate and key specified by certificate_config.json. Currently, only X.509 workload certificates are supported. 2. Certificate and key specified by context aware metadata (i.e. SecureConnect). Args: generate_encrypted_key (bool): If set to True, encrypted private key and passphrase will be generated; otherwise, unencrypted private key will be generated and passphrase will be None. This option only affects keys obtained via context_aware_metadata.json. context_aware_metadata_path (str): The context_aware_metadata.json file path. certificate_config_path (str): The certificate_config.json file path. Returns: Tuple[bool, bytes, bytes, bytes]: A boolean indicating if cert, key and passphrase are obtained, the cert bytes and key bytes both in PEM format, and passphrase bytes. Raises: google.auth.exceptions.ClientCertError: if problems occurs when getting the cert, key and passphrase. TNz"Cert provider command is not foundz--with_passphrase)r)FNNN)rrr_CERT_PROVIDER_COMMANDrrrfr) generate_encrypted_keycontext_aware_metadata_pathrr r! metadata_path metadata_jsonrr"s rget_client_ssl_credentialsrEs>++BCID# T3$$''BCM' 6 ! 6,,-QR R 67 !&9&H NN. /!; *@! c:T3 ** "rcP|r|\}}d||fStd\}}}}|||fS)aReturns the client side certificate and private key. The function first tries to get certificate and key from client_cert_callback; if the callback is None or doesn't provide certificate and key, the function tries application default SSL credentials. Args: client_cert_callback (Optional[Callable[[], (bytes, bytes)]]): An optional callback which returns client certificate bytes and private key bytes both in PEM format. Returns: Tuple[bool, bytes, bytes]: A boolean indicating if cert and key are obtained, the cert bytes and key bytes both in PEM format. Raises: google.auth.exceptions.ClientCertError: if problems occurs when getting the cert and key. TFrr)client_cert_callbackr r!has_cert_s rget_client_cert_and_keyrs?((* cT37uUHdC T3 rcLt|tr|jd}t|tr|jd}ddlm}|j ||}|j |jj|jj|jS)aA helper function to decrypt the private key with the given passphrase. google-auth library doesn't support passphrase protected private key for mutual TLS channel. This helper function can be used to decrypt the passphrase protected private key in order to estalish mutual TLS channel. For example, if you have a function which produces client cert, passphrase protected private key and passphrase, you can convert it to a client cert callback function accepted by google-auth:: from google.auth.transport import _mtls_helper def your_client_cert_function(): return cert, encrypted_key, passphrase # callback accepted by google-auth for mutual TLS channel. def client_cert_callback(): cert, encrypted_key, passphrase = your_client_cert_function() decrypted_key = _mtls_helper.decrypt_private_key(encrypted_key, passphrase) return cert, decrypted_key Args: key (bytes): The private key bytes in PEM format. passphrase (bytes): The passphrase bytes. Returns: bytes: The decrypted private key in PEM format. Raises: ValueError: If there is any problem decrypting the private key. r$rr9r;r>) r'r(r)rCr:rErGrHrIrJrK NoEncryption)r!r"r:rPs rdecrypt_private_keyrs@#sjj!*c"&&w/ <  - -cJ - GD   ''++**00*779  rcttjxsttj}|r|j dk(Sy)Ntrue)rr!GOOGLE_API_USE_CLIENT_CERTIFICATE-CLOUDSDK_CONTEXT_AWARE_USE_CLIENT_CERTIFICATElower)use_client_certs r_check_use_client_cert_envrsI::P  NN O$$&&00 rct}||Std}|rw t|d5}tj|}dddttr&|jd}t|trd|vrytjd |y#1swYVxYw#t t tjf$r!}tjd||Yd}~yd}~wwxYw) aReturns boolean for whether the client certificate should be used for mTLS. If GOOGLE_API_USE_CLIENT_CERTIFICATE is set to true or false, a corresponding bool value will be returned. If the value is set to an unexpected string, it will default to False. If GOOGLE_API_USE_CLIENT_CERTIFICATE is unset, the value will be inferred as True (auto-enabled) if a workload config file exists (pointed at by GOOGLE_API_CERTIFICATE_CONFIG or CLOUDSDK_CONTEXT_AWARE_CERTIFICATE_CONFIG_FILE_PATH, or the default path like ~/.config/gcloud/certificate_config.json) containing a "workload" section. Otherwise, it returns False. Returns: bool: Whether the client certificate should be used for mTLS connection. NT)rrzSmTLS auto-enablement failed: Could not read/parse certificate file at %s. Error: %sFrrzmTLS auto-enablement failed: Certificate configuration file at %s is missing the required ['cert_configs']['workload'] section.) rrrrrFileNotFoundErrorrJSONDecodeErrorrrr'dictr) env_overrider4r^contenters rcheck_use_client_certrs ./L &DAI i% '))A, ' gt $";;~6L,-* 2L   N   + ' '!7D,@,@A  MMe    s. B!BB!BB!!C ?CC ct\}}tj|}tj|}|rtj|}n|}||||fS)ayReturns the cached and current cert fingerprint for reconfiguring mTLS. Args: cached_cert(bytes): The cached client certificate. Returns: bytes: The client callback cert bytes. bytes: The client callback key bytes. str: The base64-encoded SHA256 cached fingerprint. str: The base64-encoded SHA256 current cert fingerprint. )call_client_cert_callbackr parse_certificate!calculate_certificate_fingerprintget_cached_cert_fingerprint) cached_certcall_cert_bytescall_key_bytescert_objcurrent_cert_fingerprintcached_fingerprints r*check_parameters_for_unauthorized_responser sh'@&A#O^$66GH4VV 2NN  6 N,>@X XXrc,td\}}}}||fS)zCCalls the client cert callback and returns the certificate and key.Trr)rr2r3r"s rrr$s%+E#,(Az9j y  rr)NT)T)F)Ar contextlibrloggingr.rrrrrr+rztypingrrrr r r google.authr r rrCONTEXT_AWARE_METADATA_PATH&CERTIFICATE_CONFIGURATION_DEFAULT_PATHrcompileDOTALLrr getLoggerrrrrrr(boolrcontextmanagerr*r7rSr_r/intrrr1rrrrrrrrrrrrrrrrrrrrs6  $$  @@-"("L*T&0bjjCRYY RZZQII '  H %BJJ=ryy  ' HSMd #'HW sD !HW uc4 HWHWuXc]HSM8E?BCT4OP HWHWV % %"*5/ % 5(5/ !" %Fs2 %%,4UO%uXc]HSM12D$>?%%Ps%D( 3333uXc]HSM8E?BCT4OP 33l"09=9@3#l!H  3-n! ; 7#t8/d0fY4!r