o
    =jX  ã                   @   s  d Z ddlmZmZ ddlZddlZddlZddlmZ ddl	Z	ddl
mZmZ ddlZddlmZ ddlmZmZ e e¡ZdZed	ƒZed
ƒZdd„ Zdd„ ZeG dd„ dƒƒZdefdd„ZG dd„ dejƒZdd„ Zeƒ fdefdd„Z G dd„ deƒZ!dS )z5Mutual TLS for Google Compute Engine metadata server.é    )Ú	dataclassÚfieldN)ÚPath)ÚurlparseÚ
urlunparse)ÚHTTPAdapter)Úenvironment_varsÚ
exceptionsÚntz#C:/ProgramData/Google/ComputeEnginez/run/google-mds-mtlsc                   C   ó   t jtkr	td S td S )Nzmds-mtls-root.crtzroot.crt©ÚosÚnameÚ_WINDOWS_OS_NAMEÚ"_WINDOWS_MTLS_COMPONENTS_BASE_PATHÚ_MTLS_COMPONENTS_BASE_PATH© r   r   újC:\Users\psant\Downloads\Anu Raj Backend\school\venv\Lib\site-packages\google/auth/compute_engine/_mtls.pyÚ_get_mds_root_crt_path,   ó   
r   c                   C   r   )Nzmds-mtls-client.keyz
client.keyr   r   r   r   r   Ú"_get_mds_client_combined_cert_path3   r   r   c                   @   s2   e Zd ZU eed�Zeed< eed�Z	eed< dS )ÚMdsMtlsConfig)Údefault_factoryÚca_cert_pathÚclient_combined_cert_pathN)
Ú__name__Ú
__module__Ú__qualname__r   r   r   r   Ú__annotations__r   r   r   r   r   r   r   :   s   
 ÿÿr   Úmds_mtls_configc                 C   s   t j | j¡ot j | j¡S )z&Checks if the mTLS certificates exist.N)r   ÚpathÚexistsr   r   )r   r   r   r   Ú_certs_existD   s   ÿr"   c                   @   s   e Zd ZdZdZdZdZdS )ÚMdsMtlsModeaG  MDS mTLS mode. Used to configure connection behavior when connecting to MDS.

    STRICT: Always use HTTPS/mTLS.  If certificates are not found locally, an error will be returned.
    NONE: Never use mTLS. Requests will use regular HTTP.
    DEFAULT: Use mTLS if certificates are found locally, otherwise use regular HTTP.
    ÚstrictÚnoneÚdefaultN)r   r   r   Ú__doc__ÚSTRICTÚNONEÚDEFAULTr   r   r   r   r#   K   s
    r#   c                  C   s6   t j tjd¡ ¡ } zt| ƒW S  ty   tdƒ‚w )z7Parses the GCE_METADATA_MTLS_MODE environment variable.r%   zXInvalid value for GCE_METADATA_MTLS_MODE. Must be one of 'strict', 'none', or 'default'.N)r   ÚenvironÚgetr   ZGCE_METADATA_MTLS_MODEÚlowerr#   Ú
ValueError)Zmode_strr   r   r   Ú_parse_mds_modeX   s   
ÿÿr/   c                 C   s<   t ƒ }|tjkrt| ƒst d¡‚dS |tjkrdS t| ƒS )z:Determines if mTLS should be used for the metadata server.z+mTLS certificates not found in strict mode.TFN)r/   r#   r(   r"   r	   ZMutualTLSChannelErrorr)   )r   Úmoder   r   r   Úshould_use_mds_mtlsc   s   
ÿ
r1   c                       sP   e Zd ZdZeƒ fdef‡ fdd„Z‡ fdd„Z‡ fdd„Z‡ fd	d
„Z‡  Z	S )ÚMdsMtlsAdapterz7An HTTP adapter that uses mTLS for the metadata server.r   c                    sD   t  ¡ | _| jj|jd� | jj|jd� tt| ƒj	|i |¤Ž d S )N)Úcafile)Úcertfile)
ÚsslÚcreate_default_contextÚssl_contextÚload_verify_locationsr   Úload_cert_chainr   Úsuperr2   Ú__init__)Úselfr   ÚargsÚkwargs©Ú	__class__r   r   r;   u   s   
ÿzMdsMtlsAdapter.__init__c                    ó    | j |d< tt| ƒj|i |¤ŽS ©Nr7   )r7   r:   r2   Úinit_poolmanager©r<   r=   r>   r?   r   r   rC      ó   
zMdsMtlsAdapter.init_poolmanagerc                    rA   rB   )r7   r:   r2   Úproxy_manager_forrD   r?   r   r   rF   ƒ   rE   z MdsMtlsAdapter.proxy_manager_forc              
      sÄ   t ƒ tjkrtt| ƒj|fi |¤ŽS ztt| ƒj|fi |¤Ž}| ¡  |W S  tjt	j
jt	j
jfya } z(t d|¡ t|jƒ}t|jdd�ƒ}||_tƒ }|j|fi |¤ŽW  Y d }~S d }~ww )NzcmTLS connection to Compute Engine Metadata server failed. Falling back to standard HTTP. Reason: %sÚhttp)Úscheme)r/   r#   r(   r:   r2   ÚsendÚraise_for_statusr5   ÚSSLErrorÚrequestsr	   Ú	HTTPErrorÚ_LOGGERÚwarningr   Úurlr   Ú_replacer   )r<   Úrequestr>   ÚresponseÚeZparsed_original_urlZhttp_fallback_urlZhttp_adapterr?   r   r   rI   ‡   s,   ýý
€ïzMdsMtlsAdapter.send)
r   r   r   r'   r   r;   rC   rF   rI   Ú__classcell__r   r   r?   r   r2   r   s    ÿÿ
r2   )"r'   Údataclassesr   r   ÚenumÚloggingr   Úpathlibr   r5   Úurllib.parser   r   rL   Zrequests.adaptersr   Zgoogle.authr   r	   Ú	getLoggerr   rN   r   r   r   r   r   r   r"   ÚEnumr#   r/   r1   r2   r   r   r   r   Ú<module>   s0   
	