o
    Þ­jX  ã                   @   s  d Z ddlmZmZ ddlZddlZddlZddlmZ ddl	Z	ddl
mZmZ ddlZddlmZ ddlmZmZ e e¡ZdZed	ƒZed
ƒZdd„ Zdd„ ZeG dd„ dƒƒZdefdd„ZG dd„ dejƒZdd„ Zeƒ fdefdd„Z G dd„ deƒZ!dS )z5Mutual TLS for Google Compute Engine metadata server.é    )Ú	dataclassÚfieldN)ÚPath)ÚurlparseÚ
urlunparse)ÚHTTPAdapter)Úenvironment_varsÚ
exceptionsÚntz#C:/ProgramData/Google/ComputeEnginez/run/google-mds-mtlsc                   C   ó   t jtkr	td S td S )Nzmds-mtls-root.crtzroot.crt©ÚosÚnameÚ_WINDOWS_OS_NAMEÚ"_WINDOWS_MTLS_COMPONENTS_BASE_PATHÚ_MTLS_COMPONENTS_BASE_PATH© r   r   ú]/var/www/html/CropPilot/venv/lib/python3.10/site-packages/google/auth/compute_engine/_mtls.pyÚ_get_mds_root_crt_path,   ó   
r   c                   C   r   )Nzmds-mtls-client.keyz
client.keyr   r   r   r   r   Ú"_get_mds_client_combined_cert_path3   r   r   c                   @   s2   e Zd ZU eed�Zeed< eed�Z	eed< dS )ÚMdsMtlsConfig)Údefault_factoryÚca_cert_pathÚclient_combined_cert_pathN)
Ú__name__Ú
__module__Ú__qualname__r   r   r   r   Ú__annotations__r   r   r   r   r   r   r   :   s   
 ÿÿr   Úmds_mtls_configc                 C   s   t j | j¡ot j | j¡S )z&Checks if the mTLS certificates exist.)r   ÚpathÚexistsr   r   )r   r   r   r   Ú_certs_existD   s   ÿr"   c                   @   s   e Zd ZdZdZdZdZdS )ÚMdsMtlsModeaG  MDS mTLS mode. Used to configure connection behavior when connecting to MDS.

    STRICT: Always use HTTPS/mTLS.  If certificates are not found locally, an error will be returned.
    NONE: Never use mTLS. Requests will use regular HTTP.
    DEFAULT: Use mTLS if certificates are found locally, otherwise use regular HTTP.
    ÚstrictÚnoneÚdefaultN)r   r   r   Ú__doc__ÚSTRICTÚNONEÚDEFAULTr   r   r   r   r#   K   s
    r#   c                  C   s6   t j tjd¡ ¡ } zt| ƒW S  ty   tdƒ‚w )z7Parses the GCE_METADATA_MTLS_MODE environment variable.r%   zXInvalid value for GCE_METADATA_MTLS_MODE. Must be one of 'strict', 'none', or 'default'.)r   ÚenvironÚgetr   ÚGCE_METADATA_MTLS_MODEÚlowerr#   Ú
ValueError)Úmode_strr   r   r   Ú_parse_mds_modeX   s   
ÿÿr1   c                 C   s<   t ƒ }|tjkrt| ƒst d¡‚dS |tjkrdS t| ƒS )z:Determines if mTLS should be used for the metadata server.z+mTLS certificates not found in strict mode.TF)r1   r#   r(   r"   r	   ÚMutualTLSChannelErrorr)   )r   Úmoder   r   r   Úshould_use_mds_mtlsc   s   
ÿ
r4   c                       sP   e Zd ZdZeƒ fdef‡ fdd„Z‡ fdd„Z‡ fdd„Z‡ fd	d
„Z‡  Z	S )ÚMdsMtlsAdapterz7An HTTP adapter that uses mTLS for the metadata server.r   c                    sD   t  ¡ | _| jj|jd� | jj|jd� tt| ƒj	|i |¤Ž d S )N)Úcafile)Úcertfile)
ÚsslÚcreate_default_contextÚssl_contextÚload_verify_locationsr   Úload_cert_chainr   Úsuperr5   Ú__init__)Úselfr   ÚargsÚkwargs©Ú	__class__r   r   r>   u   s   
ÿzMdsMtlsAdapter.__init__c                    ó    | j |d< tt| ƒj|i |¤ŽS ©Nr:   )r:   r=   r5   Úinit_poolmanager©r?   r@   rA   rB   r   r   rF      ó   
zMdsMtlsAdapter.init_poolmanagerc                    rD   rE   )r:   r=   r5   Úproxy_manager_forrG   rB   r   r   rI   ƒ   rH   z MdsMtlsAdapter.proxy_manager_forc              
      sÄ   t ƒ tjkrtt| ƒj|fi |¤ŽS ztt| ƒj|fi |¤Ž}| ¡  |W S  tjt	j
jt	j
jfya } z(t d|¡ t|jƒ}t|jdd�ƒ}||_tƒ }|j|fi |¤ŽW  Y d }~S d }~ww )NzcmTLS connection to Compute Engine Metadata server failed. Falling back to standard HTTP. Reason: %sÚhttp)Úscheme)r1   r#   r(   r=   r5   ÚsendÚraise_for_statusr8   ÚSSLErrorÚrequestsr	   Ú	HTTPErrorÚ_LOGGERÚwarningr   Úurlr   Ú_replacer   )r?   ÚrequestrA   ÚresponseÚeÚparsed_original_urlÚhttp_fallback_urlÚhttp_adapterrB   r   r   rL   ‡   s,   ýý
€ïzMdsMtlsAdapter.send)
r   r   r   r'   r   r>   rF   rI   rL   Ú__classcell__r   r   rB   r   r5   r   s    ÿÿ
r5   )"r'   Údataclassesr   r   ÚenumÚloggingr   Úpathlibr   r8   Úurllib.parser   r   rO   Úrequests.adaptersr   Úgoogle.authr   r	   Ú	getLoggerr   rQ   r   r   r   r   r   r   r"   ÚEnumr#   r1   r4   r5   r   r   r   r   Ú<module>   s0   
	