o
    RDi'                     @  s  U d dl mZ d dlZd dlZd dlZd dlZd dlZd dlmZ d dl	m
Z
 d dlmZ d dlmZ d dlmZmZ d dlZd dlZdd	lmZmZ dd
lmZmZmZ ddlmZ ddlmZ ddl m!Z!m"Z" ddl#m$Z% ddl&m'Z'm(Z( ddl)m*Z* erd dl+m,Z, ej-Z.de/d< e.Z0de/d< eZ1de/d< e Z2de/d< e2Z3de/d< 	 dZ4de/d< e5e6Z7dLdd Z8dMd%d&Z9dNd'd(Z:ed)dd*Z;d+e/d)< 	,dOdPd0d1Z<dQd4d5Z=dRd6d7Z>dRd8d9Z?dSd;d<Z@e
e*jAdTd?d@ZB	dUdVdJdKZCdS )W    )annotationsN)
ContextVar)wraps)	signature)socket)TYPE_CHECKINGAny   )4OCSP_ROOT_CERTS_DICT_LOCK_TIMEOUT_DEFAULT_NO_TIMEOUTOCSPMode)CertRevocationCheckMode	CRLConfigCRLValidator)$ER_OCSP_RESPONSE_CERT_STATUS_REVOKED)OperationalError)SessionManagerSessionManagerFactory)
connection)PyOpenSSLContextWrappedSocket)ssl_)x509r   DEFAULT_OCSP_MODEFEATURE_OCSP_MODEint$FEATURE_ROOT_CERTS_DICT_LOCK_TIMEOUTr   DEFAULT_CRL_CONFIGFEATURE_CRL_CONFIG
str | None%FEATURE_OCSP_RESPONSE_CACHE_FILE_NAMEkwargsdict[str, Any]returnc                 C  s*   |  d}|r	|S tj dptj dS )zResolve CA bundle path from kwargs or standard environment variables.

    Precedence:
      1) kwargs['ca_certs'] if provided by caller
      2) REQUESTS_CA_BUNDLE
      3) SSL_CERT_FILE
    ca_certsREQUESTS_CA_BUNDLESSL_CERT_FILE)getosenviron)r    caf r*   \/var/www/Datamplify/venv/lib/python3.10/site-packages/snowflake/connector/ssl_wrap_socket.py_resolve_cafile5   s   
r,   ctxr   cafileNonec                 C  s   |rz	| j |dd W n tjttfy   Y nw z&| j }ddlm} t	|dr:t	|j
dr=||j
j W dS W dS W dS  tttjjttfyP   Y dS w )zOLoad CA bundle (when provided) and enable OpenSSL partial-chain support on ctx.N)r.   capathr   )cryptoX509StoreFlagsPARTIAL_CHAIN)load_verify_locationssslSSLErrorOSError
ValueError_ctxget_cert_storeOpenSSLr1   hasattrr2   	set_flagsr3   AttributeErrorImportErrorSSLError)r-   r.   store_cryptor*   r*   r+    _ensure_partial_chain_on_contextC   s"   
rD   c                 C  s8   t tj}ztj|_W n	 ty   Y nw t||  |S )zNCreate PyOpenSSL context configured for CERT_REQUIRED and partial-chain trust.)r   r   PROTOCOL_TLS_CLIENTr5   CERT_REQUIREDverify_mode	ExceptionrD   )r.   r-   r*   r*   r+   !_build_context_with_partial_chainX   s   

rI   _CURRENT_SESSION_MANAGER)defaultz.ContextVar[weakref.ref[SessionManager] | None]Tcreate_default_if_missingboolSessionManager | Nonec                 K  sN   t  }|du r| rt S dS | }|du r| rt S dS |jdi |S )zReturn the SessionManager associated with the current handshake, if any.

    If the weak reference is dead or no manager was set, returns ``None``.
    Nr*   )rJ   r&   r   get_managerclone)rL   clone_kwargssm_weak_refcontext_session_managerr*   r*   r+   get_current_session_managerm   s   

rT   smr   c                 C  s   t | durt| S dS )a  Set the SessionManager for the current execution context.

    Called from SnowflakeConnection so that OCSP downloads
    use the same proxy / header configuration as the initiating connection.

    Alternative approach would be moving method inject_into_urllib3() inside
    connection initialization, but in case this delay (from module import time
    to connection initialization time) would cause some code to break we stayed
    with this approach, having in mind soon OCSP deprecation.
    N)rJ   setweakrefref)rU   r*   r*   r+   set_current_session_manager   s   rY   c                 C  s&   zt |  W dS  ty   Y dS w )zPRestore previous SessionManager context stored in *token* (from ContextVar.set).N)rJ   resetrH   )tokenr*   r*   r+   reset_current_session_manager   s
   r\   c                   C  s   t d tt_dS )z@Monkey-patch urllib3 with PyOpenSSL-backed SSL-support and OCSP.z#Injecting ssl_wrap_socket_with_ocspN)logdebug+ssl_wrap_socket_with_cert_revocation_checksconnection_ssl_wrap_socketr*   r*   r*   r+   inject_into_urllib3   s   

rb   list[x509.Certificate]c                   sL   t  }|j| d |jdd}ddlm  ddlm  fdd|D S )	N)r.   T)binary_formr   )default_backend)load_der_x509_certificatec                   s   g | ]}|  qS r*   r*   ).0certre   rf   r*   r+   
<listcomp>   s    z._load_trusted_certificates.<locals>.<listcomp>)r5   create_default_contextr4   get_ca_certscryptography.hazmat.backendsre   cryptography.x509rf   )r.   r-   certsr*   ri   r+   _load_trusted_certificates   s   rp   argsr   c                  O  sL  t tjj| i |}|j}|d}|dst |d< |d}t|}t	|t
s3t||d< nt|| tjdi |}tdtjj tjtjkrotjtt t|d}||jshtd|tdtd |S td	tjt ttj krd
dl!m"}	 |	tttj#k|t$d%||j}
|
std| td|S td |S )Nserver_hostnamer#   ssl_contextzCRL Check Mode: %s)trusted_certificateszIThe certificate is revoked or could not be validated via CRL: hostname={})msgerrnozXThe certificate revocation check was successful. No additional checks will be performed.z0OCSP Mode: %s, OCSP response cache file name: %sr	   )SnowflakeOCSPAsn1Crypto)ocsp_response_cache_uriuse_fail_openhostnameroot_certs_dict_lock_timeoutz?The certificate is revoked or could not be validated: hostname=z~This connection does not perform OCSP checks. Revocation status of the certificate will not be checked against OCSP Responder.r*   )&_sigr   ra   bind_partial	argumentsr&   certifiwherer,   
isinstancer   rI   rD   r]   r^   r   cert_revocation_check_modenamer   DISABLEDr   from_configrT   rp   validate_connectionr   r   formatr   r   r   r   DISABLE_OCSP_CHECKSocsp_asn1cryptorw   	FAIL_OPENr   validate)rq   r    boundparamsrr   provided_ctxcafile_for_ctxretcrl_validatorSFOCSPvr*   r*   r+   r_      sx   




	


r_        rz   strport	max_retrytimeout
int | NoneOpenSSL.SSL.Connectionc                 C  s   d}d}t |D ]]}z7t }|| |f tjtjj}|dur&|| tj||}	|		  |	
| d |	  |	W   S  tjjtfye }
 z|
}t|d d}t| W Y d}
~
qd}
~
ww |rj|dS )zfThe OpenSSL connection without validating certificates.

    This is used to diagnose SSL issues.
    Nr	   zutf-8      )ranger   connectr;   r@   ContextSSLv23_METHODset_timeout
Connectionset_connect_stateset_tlsext_host_nameencodedo_handshakeSysCallErrorr7   mintimesleep)rz   r   r   r   errsleeping_time_clientcontext
client_sslexr*   r*   r+   _openssl_connect   s4   

r   )r    r!   r"   r   )r-   r   r.   r   r"   r/   )r.   r   r"   r   )T)rL   rM   r"   rN   )rU   rN   r"   r   )r"   r/   )r.   r   r"   rc   )rq   r   r    r   r"   r   )r   r   N)
rz   r   r   r   r   r   r   r   r"   r   )D
__future__r   loggingr'   r5   r   rW   contextvarsr   	functoolsr   inspectr   r|   r   typingr   r   r   OpenSSL.SSLr;   	constantsr
   r   crlr   r   r   	errorcoder   errorsr   session_managerr   r   vendored.urllib3r   r`   "vendored.urllib3.contrib.pyopensslr   r   vendored.urllib3.utilr   cryptographyr   r   r   __annotations__r   r   r   r   r   	getLogger__name__r]   r,   rD   rI   rJ   rT   rY   r\   rb   rp   ra   r_   r   r*   r*   r*   r+   <module>   sb    	







	
Q