a ‚oe´ã@sddlZddlZddlZddlmZddlmZmZddlm Z m Z ddl m Z ddl mZddlmZddlmZdd lmZdd lmZdd lmZdd lmZdd lmZddlmZddl m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&gd¢Z'ej(Z(ej)Z)Z*ej+Z+Z,ej-Z-Z.ej/Z/Z0ej1Z1Z2ej3Z4ej5Z6dZ7dZ8dZ9dZ:dZ;dZdZ?dZ@z"ejAZAejBZBejCZCejDZDejEZEWn(eFyšdZAdZBdZCdZDdZEYn0ejGZHejIZJejKZLejMZNejOZPzejQZRe' Sd ¡WneFyâYn0ejTZUejVZWejXZYejZZ[ej\Z]ej^Z_ej`ZaejbZcejdZeejfZgejhZiejjZkejlZmejnZoejpZqejrZsejtZuejvZwejxZyejzZ{ej|Z}ej~Zej€Zej‚Zƒzej„Z…e' Sd!¡WneFyœYn0zej†Z‡e' Sd"¡WneFyÆYn0zejˆZ‰e' Sd#¡WneFyðYn0ejŠZ‹ejŒZejŽZejZ‘ej’Z“ej”Z•ej–Z—ej˜Z™ejšZ›ejœZejžZŸej Z¡ej¢Z£ej¤Z¤ej¥Z¥ej¦Z¦ej§Z§ej¨Z¨ej©Z©ejªZªej«Z«ej¬Z¬ej­Z­ej®Z®ej¯Z¯ej°Z°ej±Z±ej²Z²ej³Z³Gd$d%„d%ƒZ´gd&¢Zµd'gZ¶d(Z·d)Z¸Gd*d+„d+e¹ƒZºeeeºƒZ»eeºƒZ¼Gd,d-„d-eºƒZ½Gd.d/„d/eºƒZ¾Gd0d1„d1eºƒZ¿Gd2d3„d3eºƒZÀGd4d5„d5eºƒZÁGd6d7„d7ƒZÂGd8d9„d9eƒZÃeăZÅGd:d;„d;eƒZÆGdd?„d?eƒZÈGd@dA„dAeƒZÉGdBdC„dCeƒZÊdDdE„ZËdFdG„ZÌeÌZÍdHdI„ZÎeÎejÏdJƒZÐeÎeÑedKdƒdLƒZÒGdMdN„dNƒZÓGdOdP„dPƒZÔGdQdR„dRƒZÕdS)SéN)Ú errorcode)ÚpartialÚwraps)ÚchainÚcount)Úplatform)ÚWeakValueDictionary)Ú UNSPECIFIED)Úexception_from_error_queue)Úffi)Úlib)Ú make_assert)Úno_zero_allocator)Ú path_bytes)Útext_to_bytes_and_warn)Ú FILETYPE_PEMÚX509ÚPKeyÚX509NameÚ X509StoreÚ_PassphraseHelper)bÚOPENSSL_VERSION_NUMBERÚSSLEAY_VERSIONÚ SSLEAY_CFLAGSÚSSLEAY_PLATFORMÚ SSLEAY_DIRÚSSLEAY_BUILT_ONÚOPENSSL_VERSIONÚOPENSSL_CFLAGSÚOPENSSL_PLATFORMÚ OPENSSL_DIRÚOPENSSL_BUILT_ONÚ SENT_SHUTDOWNÚRECEIVED_SHUTDOWNÚ SSLv23_METHODÚ TLSv1_METHODÚTLSv1_1_METHODÚTLSv1_2_METHODÚ TLS_METHODÚTLS_SERVER_METHODÚTLS_CLIENT_METHODÚ DTLS_METHODÚDTLS_SERVER_METHODÚDTLS_CLIENT_METHODÚ SSL3_VERSIONÚ TLS1_VERSIONÚTLS1_1_VERSIONÚTLS1_2_VERSIONÚTLS1_3_VERSIONÚ OP_NO_SSLv2Ú OP_NO_SSLv3Ú OP_NO_TLSv1Ú OP_NO_TLSv1_1Ú OP_NO_TLSv1_2ÚMODE_RELEASE_BUFFERSÚOP_SINGLE_DH_USEÚOP_SINGLE_ECDH_USEÚOP_EPHEMERAL_RSAÚOP_MICROSOFT_SESS_ID_BUGÚOP_NETSCAPE_CHALLENGE_BUGÚ#OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUGÚOP_SSLREF2_REUSE_CERT_TYPE_BUGÚOP_MICROSOFT_BIG_SSLV3_BUFFERÚOP_MSIE_SSLV2_RSA_PADDINGÚOP_SSLEAY_080_CLIENT_DH_BUGÚ OP_TLS_D5_BUGÚOP_TLS_BLOCK_PADDING_BUGÚOP_DONT_INSERT_EMPTY_FRAGMENTSÚOP_CIPHER_SERVER_PREFERENCEÚOP_TLS_ROLLBACK_BUGÚOP_PKCS1_CHECK_1ÚOP_PKCS1_CHECK_2ÚOP_NETSCAPE_CA_DN_BUGÚ"OP_NETSCAPE_DEMO_CIPHER_CHANGE_BUGÚOP_NO_COMPRESSIONÚOP_NO_QUERY_MTUÚOP_COOKIE_EXCHANGEÚ OP_NO_TICKETÚOP_ALLÚ VERIFY_PEERÚVERIFY_FAIL_IF_NO_PEER_CERTÚVERIFY_CLIENT_ONCEÚ VERIFY_NONEÚSESS_CACHE_OFFÚSESS_CACHE_CLIENTÚSESS_CACHE_SERVERÚSESS_CACHE_BOTHÚSESS_CACHE_NO_AUTO_CLEARÚSESS_CACHE_NO_INTERNAL_LOOKUPÚSESS_CACHE_NO_INTERNAL_STOREÚSESS_CACHE_NO_INTERNALÚSSL_ST_CONNECTÚ SSL_ST_ACCEPTÚ SSL_ST_MASKÚ SSL_CB_LOOPÚ SSL_CB_EXITÚ SSL_CB_READÚ SSL_CB_WRITEÚ SSL_CB_ALERTÚSSL_CB_READ_ALERTÚSSL_CB_WRITE_ALERTÚSSL_CB_ACCEPT_LOOPÚSSL_CB_ACCEPT_EXITÚSSL_CB_CONNECT_LOOPÚSSL_CB_CONNECT_EXITÚSSL_CB_HANDSHAKE_STARTÚSSL_CB_HANDSHAKE_DONEÚErrorÚ WantReadErrorÚWantWriteErrorÚWantX509LookupErrorÚZeroReturnErrorÚ SysCallErrorÚNO_OVERLAPPING_PROTOCOLSÚSSLeay_versionÚSessionÚContextÚ ConnectionÚX509VerificationCodesééééééé é é é iiiiiÚ OP_NO_TLSv1_3ÚOP_NO_RENEGOTIATIONÚOP_IGNORE_UNEXPECTED_EOFÚOP_LEGACY_SERVER_CONNECTc@sfeZdZdZejZejZej Z ej Z ej ZejZejZejZejZejZejZejZejZejZ ej!Z"ej#Z$ej%Z&ej'Z(ej)Z*ej+Z,ej-Z.ej/Z0ej1Z2ej3Z4ej5Z6ej7Z8ej9Z:ej;Zej?Z@ejAZBejCZDejEZFejGZHejIZJejKZLejMZNejOZPejQZRejSZTejUZVejWZXejYZZej[Z\ej]Z^ej_Z`ejaZbejcZdejeZfejgZhejiZjejkZlejmZnejoZpejqZrejsZtejuZvdS)rxa\ Success and error codes for X509 verification, as returned by the underlying ``X509_STORE_CTX_get_error()`` function and passed by pyOpenSSL to verification callback functions. See `OpenSSL Verification Errors `_ for details. N)wÚ__name__Ú __module__Ú __qualname__Ú__doc__Ú_libÚ X509_V_OKZOKZ$X509_V_ERR_UNABLE_TO_GET_ISSUER_CERTZERR_UNABLE_TO_GET_ISSUER_CERTZX509_V_ERR_UNABLE_TO_GET_CRLZERR_UNABLE_TO_GET_CRLZ+X509_V_ERR_UNABLE_TO_DECRYPT_CERT_SIGNATUREZ$ERR_UNABLE_TO_DECRYPT_CERT_SIGNATUREZ*X509_V_ERR_UNABLE_TO_DECRYPT_CRL_SIGNATUREZ#ERR_UNABLE_TO_DECRYPT_CRL_SIGNATUREZ-X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEYZ&ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEYZ!X509_V_ERR_CERT_SIGNATURE_FAILUREZERR_CERT_SIGNATURE_FAILUREZ X509_V_ERR_CRL_SIGNATURE_FAILUREZERR_CRL_SIGNATURE_FAILUREZX509_V_ERR_CERT_NOT_YET_VALIDZERR_CERT_NOT_YET_VALIDZX509_V_ERR_CERT_HAS_EXPIREDZERR_CERT_HAS_EXPIREDZX509_V_ERR_CRL_NOT_YET_VALIDZERR_CRL_NOT_YET_VALIDZX509_V_ERR_CRL_HAS_EXPIREDZERR_CRL_HAS_EXPIREDZ)X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELDZ"ERR_ERROR_IN_CERT_NOT_BEFORE_FIELDZ(X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELDZ!ERR_ERROR_IN_CERT_NOT_AFTER_FIELDZ)X509_V_ERR_ERROR_IN_CRL_LAST_UPDATE_FIELDZ"ERR_ERROR_IN_CRL_LAST_UPDATE_FIELDZ)X509_V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELDZ"ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELDZX509_V_ERR_OUT_OF_MEMZERR_OUT_OF_MEMZ&X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERTZERR_DEPTH_ZERO_SELF_SIGNED_CERTZ$X509_V_ERR_SELF_SIGNED_CERT_IN_CHAINZERR_SELF_SIGNED_CERT_IN_CHAINZ,X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLYZ%ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLYZ*X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATUREZ#ERR_UNABLE_TO_VERIFY_LEAF_SIGNATUREZX509_V_ERR_CERT_CHAIN_TOO_LONGZERR_CERT_CHAIN_TOO_LONGZX509_V_ERR_CERT_REVOKEDZERR_CERT_REVOKEDZX509_V_ERR_INVALID_CAZERR_INVALID_CAZX509_V_ERR_PATH_LENGTH_EXCEEDEDZERR_PATH_LENGTH_EXCEEDEDZX509_V_ERR_INVALID_PURPOSEZERR_INVALID_PURPOSEZX509_V_ERR_CERT_UNTRUSTEDZERR_CERT_UNTRUSTEDZX509_V_ERR_CERT_REJECTEDZERR_CERT_REJECTEDZ"X509_V_ERR_SUBJECT_ISSUER_MISMATCHZERR_SUBJECT_ISSUER_MISMATCHZX509_V_ERR_AKID_SKID_MISMATCHZERR_AKID_SKID_MISMATCHZ&X509_V_ERR_AKID_ISSUER_SERIAL_MISMATCHZERR_AKID_ISSUER_SERIAL_MISMATCHZX509_V_ERR_KEYUSAGE_NO_CERTSIGNZERR_KEYUSAGE_NO_CERTSIGNZ#X509_V_ERR_UNABLE_TO_GET_CRL_ISSUERZERR_UNABLE_TO_GET_CRL_ISSUERZ'X509_V_ERR_UNHANDLED_CRITICAL_EXTENSIONZ ERR_UNHANDLED_CRITICAL_EXTENSIONZX509_V_ERR_KEYUSAGE_NO_CRL_SIGNZERR_KEYUSAGE_NO_CRL_SIGNZ+X509_V_ERR_UNHANDLED_CRITICAL_CRL_EXTENSIONZ$ERR_UNHANDLED_CRITICAL_CRL_EXTENSIONZX509_V_ERR_INVALID_NON_CAZERR_INVALID_NON_CAZ%X509_V_ERR_PROXY_PATH_LENGTH_EXCEEDEDZERR_PROXY_PATH_LENGTH_EXCEEDEDZ(X509_V_ERR_KEYUSAGE_NO_DIGITAL_SIGNATUREZ!ERR_KEYUSAGE_NO_DIGITAL_SIGNATUREZ)X509_V_ERR_PROXY_CERTIFICATES_NOT_ALLOWEDZ"ERR_PROXY_CERTIFICATES_NOT_ALLOWEDZX509_V_ERR_INVALID_EXTENSIONZERR_INVALID_EXTENSIONZ#X509_V_ERR_INVALID_POLICY_EXTENSIONZERR_INVALID_POLICY_EXTENSIONZX509_V_ERR_NO_EXPLICIT_POLICYZERR_NO_EXPLICIT_POLICYZX509_V_ERR_DIFFERENT_CRL_SCOPEZERR_DIFFERENT_CRL_SCOPEZ(X509_V_ERR_UNSUPPORTED_EXTENSION_FEATUREZ!ERR_UNSUPPORTED_EXTENSION_FEATUREZX509_V_ERR_UNNESTED_RESOURCEZERR_UNNESTED_RESOURCEZX509_V_ERR_PERMITTED_VIOLATIONZERR_PERMITTED_VIOLATIONZX509_V_ERR_EXCLUDED_VIOLATIONZERR_EXCLUDED_VIOLATIONZX509_V_ERR_SUBTREE_MINMAXZERR_SUBTREE_MINMAXZ&X509_V_ERR_UNSUPPORTED_CONSTRAINT_TYPEZERR_UNSUPPORTED_CONSTRAINT_TYPEZ(X509_V_ERR_UNSUPPORTED_CONSTRAINT_SYNTAXZ!ERR_UNSUPPORTED_CONSTRAINT_SYNTAXZ"X509_V_ERR_UNSUPPORTED_NAME_SYNTAXZERR_UNSUPPORTED_NAME_SYNTAXZ$X509_V_ERR_CRL_PATH_VALIDATION_ERRORZERR_CRL_PATH_VALIDATION_ERRORZX509_V_ERR_HOSTNAME_MISMATCHZERR_HOSTNAME_MISMATCHZX509_V_ERR_EMAIL_MISMATCHZERR_EMAIL_MISMATCHZX509_V_ERR_IP_ADDRESS_MISMATCHZERR_IP_ADDRESS_MISMATCHZ#X509_V_ERR_APPLICATION_VERIFICATIONZERR_APPLICATION_VERIFICATION©rrú,C:\Program Files\Certbot\pkgs\OpenSSL\SSL.pyrxs˜ ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿrx)z"/etc/ssl/certs/ca-certificates.crtz /etc/pki/tls/certs/ca-bundle.crtz/etc/ssl/ca-bundle.pemz/etc/pki/tls/cacert.pemz1/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pemz/etc/ssl/certss$/opt/pyca/cryptography/openssl/certss'/opt/pyca/cryptography/openssl/cert.pemc@seZdZdZdS)rmz4 An error occurred in an `OpenSSL.SSL` API. N©r‡rˆr‰rŠrrrrŽrm‘srmc@s eZdZdS)rnN©r‡rˆr‰rrrrŽrn›srnc@s eZdZdS)roNrrrrrŽroŸsroc@s eZdZdS)rpNrrrrrŽrp£srpc@s eZdZdS)rqNrrrrrŽrq§srqc@s eZdZdS)rrNrrrrrŽrr«srrc@s eZdZdZdd„Zdd„ZdS)Ú_CallbackExceptionHelperaÅ A base class for wrapper classes that allow for intelligent exception handling in OpenSSL callbacks. :ivar list _problems: Any exceptions that occurred while executing in a context where they could not be raised in the normal way. Typically this is because OpenSSL has called into some Python code and requires a return value. The exceptions are saved to be raised later when it is possible to do so. cCs g|_dS©N)Ú _problems©ÚselfrrrŽÚ__init__»sz!_CallbackExceptionHelper.__init__cCs4|jr0z tƒWnty"Yn0|j d¡‚dS)z Raise an exception from the OpenSSL error queue or that was previously captured whe running a callback. rN)r“Ú_raise_current_errorrmÚpopr”rrrŽÚraise_if_problem¾s   z)_CallbackExceptionHelper.raise_if_problemN)r‡rˆr‰rŠr–r™rrrrŽr‘¯s r‘c@seZdZdZdd„ZdS)Ú _VerifyHelperz^ Wrap a callback such that it can be used as a certificate verification callback. cs2t ˆ¡tˆƒ‡‡fdd„ƒ}t d|¡ˆ_dS)Nc s¶t |¡}t |¡t |¡}t |¡}t |¡}t ¡}t ||¡}t j |}zˆ|||||ƒ} Wn2t y–} zˆj   | ¡WYd} ~ dSd} ~ 00| r®t |tj¡dSdSdS©Nré)r‹ZX509_STORE_CTX_get_current_certÚ X509_up_refrÚ_from_raw_x509_ptrZX509_STORE_CTX_get_errorZX509_STORE_CTX_get_error_depthZ"SSL_get_ex_data_X509_STORE_CTX_idxZX509_STORE_CTX_get_ex_datarwÚ_reverse_mappingÚ Exceptionr“ÚappendZX509_STORE_CTX_set_errorrŒ) ÚokZ store_ctxZx509ÚcertZ error_numberZ error_depthÚindexÚsslZ connectionÚresultÚe©Úcallbackr•rrŽÚwrapperÔs&        ÿ z'_VerifyHelper.__init__..wrapperzint (*)(int, X509_STORE_CTX *)©r‘r–rÚ_ffir©©r•r©rªrr¨rŽr–Ñs  ÿz_VerifyHelper.__init__N©r‡rˆr‰rŠr–rrrrŽršËsršc@seZdZdZdd„ZdS)Ú_ALPNSelectHelperzQ Wrap a callback such that it can be used as an ALPN selection callback. cs2t ˆ¡tˆƒ‡‡fdd„ƒ}t d|¡ˆ_dS)Nc szÞtj|}t ||¡dd…}g}|r\|d} |d| d…} | | ¡|| dd…}q$ˆ||ƒ} d} | tur|d} d} nt| tƒsŽtdƒ‚t  dt | ƒ¡t  d| ¡g|_ |j dd|d<|j d|d<| sØt j WSt jWSty} zˆj | ¡t jWYd} ~ Sd} ~ 00dS) NrrœTóFz^ALPN callback must return a bytestring or the special NO_OVERLAPPING_PROTOCOLS sentinel value.zunsigned char *úunsigned char[])rwrŸr¬Úbufferr¡rsÚ isinstanceÚbytesÚ TypeErrorÚnewÚlenÚ_alpn_select_callback_argsr‹ZSSL_TLSEXT_ERR_NOACKZSSL_TLSEXT_ERR_OKr r“ZSSL_TLSEXT_ERR_ALERT_FATAL)r¥ÚoutÚoutlenZin_ZinlenÚargÚconnZinstrZ protolistZ encoded_lenÚprotoZoutbytesZ any_acceptedr§r¨rrŽrªþs:    ÿ  þ z+_ALPNSelectHelper.__init__..wrapperz^int (*)(SSL *, unsigned char **, unsigned char *, const unsigned char *, unsigned int, void *)r«r­rr¨rŽr–ûs +ûz_ALPNSelectHelper.__init__Nr®rrrrŽr¯ösr¯c@seZdZdZdd„ZdS)Ú_OCSPServerCallbackHelperað Wrap a callback such that it can be used as an OCSP callback for the server side. Annoyingly, OpenSSL defines one OCSP callback but uses it in two different ways. For servers, that callback is expected to retrieve some OCSP data and hand it to OpenSSL, and may return only SSL_TLSEXT_ERR_OK, SSL_TLSEXT_ERR_FATAL, and SSL_TLSEXT_ERR_NOACK. For clients, that callback is expected to check the OCSP data, and returns a negative value on error, 0 if the response is not acceptable, or positive if it is. These are mutually exclusive return code behaviours, and they mean that we need two helpers so that we always return an appropriate error code if the user's code throws an exception. Given that we have to have two helpers anyway, these helpers are a bit more helpery than most: specifically, they hide a few more of the OpenSSL functions so that the user has an easier time writing these callbacks. This helper implements the server side. cs2t ˆ¡tˆƒ‡‡fdd„ƒ}t d|¡ˆ_dS)Nc s¼z„tj|}|tjkr"t |¡}nd}ˆ||ƒ}t|tƒsBtdƒ‚|sLWdSt|ƒ}t   |¡}|t  ||¡dd…<t   |||¡WdSt y¶}zˆj |¡WYd}~dSd}~00dS)Nz'OCSP callback must return a bytestring.ryré)rwrŸr¬ÚNULLÚ from_handler³r´rµr·r‹ZOPENSSL_mallocr²ZSSL_set_tlsext_status_ocsp_respr r“r¡)r¥Úcdatar¼ÚdataÚ ocsp_dataZocsp_data_lengthZdata_ptrr§r¨rrŽrªLs(      ÿ z3_OCSPServerCallbackHelper.__init__..wrapperúint (*)(SSL *, void *)r«r­rr¨rŽr–Is &z"_OCSPServerCallbackHelper.__init__Nr®rrrrŽr¾3sr¾c@seZdZdZdd„ZdS)Ú_OCSPClientCallbackHelperað Wrap a callback such that it can be used as an OCSP callback for the client side. Annoyingly, OpenSSL defines one OCSP callback but uses it in two different ways. For servers, that callback is expected to retrieve some OCSP data and hand it to OpenSSL, and may return only SSL_TLSEXT_ERR_OK, SSL_TLSEXT_ERR_FATAL, and SSL_TLSEXT_ERR_NOACK. For clients, that callback is expected to check the OCSP data, and returns a negative value on error, 0 if the response is not acceptable, or positive if it is. These are mutually exclusive return code behaviours, and they mean that we need two helpers so that we always return an appropriate error code if the user's code throws an exception. Given that we have to have two helpers anyway, these helpers are a bit more helpery than most: specifically, they hide a few more of the OpenSSL functions so that the user has an easier time writing these callbacks. This helper implements the client side. cs2t ˆ¡tˆƒ‡‡fdd„ƒ}t d|¡ˆ_dS)Nc s²zztj|}|tjkr"t |¡}nd}t d¡}t ||¡}|dkrJd}nt |d|¡dd…}ˆ|||ƒ}t t |ƒƒWSt y¬}zˆj   |¡WYd}~dSd}~00dS)Núunsigned char **rr°éÿÿÿÿ)rwrŸr¬rÀrÁr¶r‹ZSSL_get_tlsext_status_ocsp_respr²ÚintÚboolr r“r¡) r¥rÂr¼rÃZocsp_ptrZocsp_lenrÄZvalidr§r¨rrŽrªs       z3_OCSPClientCallbackHelper.__init__..wrapperrÅr«r­rr¨rŽr–Œs z"_OCSPClientCallbackHelper.__init__Nr®rrrrŽrÆvsrÆc@seZdZdd„ZdS)Ú_CookieGenerateCallbackHelpercs2t ˆ¡tˆƒ‡‡fdd„ƒ}t d|¡ˆ_dS)Nc slz4tj|}ˆ|ƒ}||dt|ƒ…<t|ƒ|d<WdStyf}zˆj |¡WYd}~dSd}~00dSr›)rwrŸr·r r“r¡)r¥r¹rºr¼Úcookier§r¨rrŽrªµs   z7_CookieGenerateCallbackHelper.__init__..wrapperz/int (*)(SSL *, unsigned char *, unsigned int *)r«r­rr¨rŽr–²s  þz&_CookieGenerateCallbackHelper.__init__N©r‡rˆr‰r–rrrrŽr˱srËc@seZdZdd„ZdS)Ú_CookieVerifyCallbackHelpercs2t ˆ¡tˆƒ‡‡fdd„ƒ}t d|¡ˆ_dS)Nc sZz"tj|}ˆ|t|d|…ƒƒWStyT}zˆj |¡WYd}~dSd}~00dS©Nr)rwrŸr´r r“r¡)r¥Zc_cookieZ cookie_lenr¼r§r¨rrŽrªÌs   z5_CookieVerifyCallbackHelper.__init__..wrapperz-int (*)(SSL *, unsigned char *, unsigned int)r«r­rr¨rŽr–És þz$_CookieVerifyCallbackHelper.__init__NrÍrrrrŽrÎÈsrÎcCsdd}t|tƒs(t|ddƒ}|dur(|ƒ}t|tƒr6|}t|tƒsJtdƒ‚n|dkr`td|fƒ‚|S)NÚfilenoz3argument must be an int, or have a fileno() method.rz1file descriptor cannot be a negative integer (%i))r³rÉÚgetattrrµÚ ValueError)ÚobjÚfdÚmethrrrŽÚ_asFileDescriptorÛs     ÿrÖcCst t |¡¡S)z” Return a string describing the version of OpenSSL in use. :param type: One of the :const:`OPENSSL_` constants defined in this module. )r¬Ústringr‹ÚOpenSSL_version)ÚtyperrrŽrØïsrØcs‡‡fdd„}|S)a” Builds a decorator that ensures that functions that rely on OpenSSL functions that are not present in this build raise NotImplementedError, rather than AttributeError coming out of cryptography. :param flag: A cryptography flag that guards the functions, e.g. ``Cryptography_HAS_NEXTPROTONEG``. :param error: The string to be used in the exception if the flag is false. cs$ˆst|ƒ‡fdd„ƒ}|S|SdS)Ncs tˆƒ‚dSr’©ÚNotImplementedError)ÚargsÚkwargs)ÚerrorrrŽÚexplode sz<_make_requires.._requires_decorator..explode)r)Úfuncrß©rÞÚflagrrŽÚ_requires_decorators z+_make_requires.._requires_decoratorr)rârÞrãrrárŽÚ_make_requiresûs  räzALPN not availableZCryptography_HAS_KEYLOGzKey logging not availablec@seZdZdZdS)ruzÉ A class representing an SSL session. A session defines certain connection parameters which may be re-used to speed up the setup of subsequent connections. .. versionadded:: 0.14 NrrrrrŽrusruc@s(eZdZUdZeejdfeejefe eje fe eje fe ejdfeejdfeejdfeejdfeejdfeejdfi Zejejed<dd„Zdd„Zdd „Zddd d „Z d d „Z!dedd„Z"dd„Z#dd„Z$dd„Z%dd„Z&e'fdd„Z(dd„Z)dd„Z*dd„Z+e,fd d!„Z-d"d#„Z.d$d%„Z/d&d'„Z0d(d)„Z1d*d+„Z2d,d-„Z3dfd.d/„Z4d0d1„Z5d2d3„Z6d4d5„Z7d6d7„Z8d8d9„Z9d:d;„Z:dd?„ZdDdE„Z?e@dFdG„ƒZAdHdI„ZBdJdK„ZCdLdM„ZDdNdO„ZEdPdQ„ZFdRdS„ZGdTdU„ZHeIdVdW„ƒZJeIdXdY„ƒZKdZd[„ZLdgd\d]„ZMdhd^d_„ZNd`da„ZOdbdc„ZPdS)irvau :class:`OpenSSL.SSL.Context` instances define the parameters for setting up new SSL connections. :param method: One of TLS_METHOD, TLS_CLIENT_METHOD, TLS_SERVER_METHOD, DTLS_METHOD, DTLS_CLIENT_METHOD, or DTLS_SERVER_METHOD. SSLv23_METHOD, TLSv1_METHOD, etc. are deprecated and should not be used. NÚ_methodscCst|tƒstdƒ‚z|j|\}}Wnty>tdƒ‚Yn0|ƒ}t|tjkƒt   |¡}t|tjkƒt  |t j ¡}||_ d|_d|_d|_d|_d|_d|_d|_d|_d|_d|_d|_d|_d|_d|_d|_d|_| t j¡|dur |  |¡| !|¡dS)Nzmethod must be an integerzNo such protocol)"r³rÉrµråÚKeyErrorrÒÚ_openssl_assertr¬rÀr‹Z SSL_CTX_newÚgcZ SSL_CTX_freeÚ_contextÚ_passphrase_helperÚ_passphrase_callbackÚ_passphrase_userdataÚ_verify_helperÚ_verify_callbackÚ_info_callbackÚ_keylog_callbackÚ_tlsext_servername_callbackÚ _app_dataÚ_alpn_select_helperÚ_alpn_select_callbackÚ _ocsp_helperÚ_ocsp_callbackÚ _ocsp_dataÚ_cookie_generate_helperÚ_cookie_verify_helperÚset_modeZSSL_MODE_ENABLE_PARTIAL_WRITEÚset_min_proto_versionÚset_max_proto_version)r•ÚmethodZ method_funcÚversionZ method_objÚcontextrrrŽr–Bs@      zContext.__init__cCstt |j|¡dkƒdS)aD Set the minimum supported protocol version. Setting the minimum version to 0 will enable protocol versions down to the lowest version supported by the library. If the underlying OpenSSL build is missing support for the selected version, this method will raise an exception. rœN)rçr‹ZSSL_CTX_set_min_proto_versionré©r•rþrrrŽrûis ÿzContext.set_min_proto_versioncCstt |j|¡dkƒdS)aC Set the maximum supported protocol version. Setting the maximum version to 0 will enable protocol versions up to the highest version supported by the library. If the underlying OpenSSL build is missing support for the selected version, this method will raise an exception. rœN)rçr‹ZSSL_CTX_set_max_proto_versionrérrrrŽrüvs ÿzContext.set_max_proto_versioncCsN|durtj}nt|ƒ}|dur(tj}nt|ƒ}t |j||¡}|sJtƒdS)aU Let SSL know where we can find trusted certificates for the certificate chain. Note that the certificates have to be in PEM format. If capath is passed, it must be a directory prepared using the ``c_rehash`` tool included with OpenSSL. Either, but not both, of *pemfile* or *capath* may be :data:`None`. :param cafile: In which file we can find the certificates (``bytes`` or ``unicode``). :param capath: In which directory we can find the certificates (``bytes`` or ``unicode``). :return: None N)r¬rÀÚ _path_bytesr‹ZSSL_CTX_load_verify_locationsrér—)r•ÚcafileÚcapathZ load_resultrrrŽÚload_verify_locationsƒsÿzContext.load_verify_locationscs&tˆƒ‡‡fdd„ƒ}tt|dddS)Ncsˆ||ˆjƒSr’)rì)ÚsizeZverifyÚuserdatar¨rrŽrª¤sz'Context._wrap_callback..wrapperT)Z more_argsÚtruncate)rrrr­rr¨rŽÚ_wrap_callback£s ÿzContext._wrap_callbackcCs@t|ƒstdƒ‚| |¡|_|jj|_t |j|j¡||_ dS)aò Set the passphrase callback. This function will be called when a private key with a passphrase is loaded. :param callback: The Python callback to use. This must accept three positional arguments. First, an integer giving the maximum length of the passphrase it may return. If the returned passphrase is longer than this, it will be truncated. Second, a boolean value which will be true if the user should be prompted for the passphrase twice and the callback should verify that the two values supplied are equal. Third, the value given as the *userdata* parameter to :meth:`set_passwd_cb`. The *callback* must return a byte string. If an error occurs, *callback* should return a false value (e.g. an empty string). :param userdata: (optional) A Python object which will be given as argument to the callback :return: None úcallback must be callableN) Úcallablerµrrêr©rër‹ZSSL_CTX_set_default_passwd_cbrérì)r•r©rrrrŽÚ set_passwd_cb¬s  ÿzContext.set_passwd_cbcCsˆt |j¡}t|dkƒt t ¡¡ d¡}t t ¡¡ d¡}|  ||¡s„t t  ¡¡}t t  ¡¡}|t kr„|t kr„| tt¡dS)a× Specify that the platform provided CA certificates are to be used for verification purposes. This method has some caveats related to the binary wheels that cryptography (pyOpenSSL's primary dependency) ships: * macOS will only load certificates using this method if the user has the ``openssl@1.1`` `Homebrew `_ formula installed in the default location. * Windows will not work. * manylinux cryptography wheels will work on most common Linux distributions in pyOpenSSL 17.1.0 and above. pyOpenSSL detects the manylinux wheel and attempts to load roots via a fallback path. :return: None rœÚasciiN)r‹Z SSL_CTX_set_default_verify_pathsrérçr¬r×ZX509_get_default_cert_dir_envÚdecodeZX509_get_default_cert_file_envÚ_check_env_vars_setZX509_get_default_cert_dirZX509_get_default_cert_fileÚ_CRYPTOGRAPHY_MANYLINUX_CA_DIRÚ_CRYPTOGRAPHY_MANYLINUX_CA_FILEÚ_fallback_default_verify_pathsÚ_CERTIFICATE_FILE_LOCATIONSÚ_CERTIFICATE_PATH_LOCATIONS)r•Ú set_resultÚ dir_env_varÚ file_env_varZ default_dirZ default_filerrrŽÚset_default_verify_pathsÉs(  ÿÿþ ÿþÿz Context.set_default_verify_pathscCs tj |¡duptj |¡duS)zp Check to see if the default cert dir/file environment vars are present. :return: bool N)ÚosÚenvironÚget)r•rrrrrŽrùsþzContext._check_env_vars_setcCsN|D]}tj |¡r| |¡q$q|D] }tj |¡r(| d|¡qJq(dS)aV Default verify paths are based on the compiled version of OpenSSL. However, when pyca/cryptography is compiled as a manylinux wheel that compiled location can potentially be wrong. So, like Go, we will try a predefined set of paths and attempt to load roots from there. :return: None N)rÚpathÚisfilerÚisdir)r•Z file_pathZdir_pathrrrrrŽrs     z&Context._fallback_default_verify_pathscCs$t|ƒ}t |j|¡}|s tƒdS)zÍ Load a certificate chain from a file. :param certfile: The name of the certificate chain file (``bytes`` or ``unicode``). Must be PEM encoded. :return: None N)rr‹Z"SSL_CTX_use_certificate_chain_filerér—)r•Úcertfiler¦rrrŽÚuse_certificate_chain_files ÿz"Context.use_certificate_chain_filecCs8t|ƒ}t|tƒstdƒ‚t |j||¡}|s4tƒdS)ah Load a certificate from a file :param certfile: The name of the certificate file (``bytes`` or ``unicode``). :param filetype: (optional) The encoding of the file, which is either :const:`FILETYPE_PEM` or :const:`FILETYPE_ASN1`. The default is :const:`FILETYPE_PEM`. :return: None úfiletype must be an integerN)rr³rÉrµr‹ZSSL_CTX_use_certificate_filerér—)r•rÚfiletypeÚ use_resultrrrŽÚuse_certificate_file)s  ÿzContext.use_certificate_filecCs0t|tƒstdƒ‚t |j|j¡}|s,tƒdS©zs Load a certificate from a X509 object :param cert: The X509 object :return: None zcert must be an X509 instanceN)r³rrµr‹ZSSL_CTX_use_certificateréÚ_x509r—©r•r£r"rrrŽÚuse_certificate?s  zContext.use_certificatecCsDt|tƒstdƒ‚t |j¡}t |j|¡}|s@t |¡t ƒdS)z‰ Add certificate to chain :param certobj: The X509 certificate object to add to the chain :return: None z certobj must be an X509 instanceN) r³rrµr‹ZX509_dupr%ZSSL_CTX_add_extra_chain_certréZ X509_freer—)r•ZcertobjÚcopyÚ add_resultrrrŽÚadd_extra_chain_certNs   zContext.add_extra_chain_certcCs |jdur|j t¡tƒdSr’)rêr™rmr—r”rrrŽÚ_raise_passphrase_exception_s  z#Context._raise_passphrase_exceptioncCsHt|ƒ}|turt}nt|tƒs(tdƒ‚t |j||¡}|sD|  ¡dS)aR Load a private key from a file :param keyfile: The name of the key file (``bytes`` or ``unicode``) :param filetype: (optional) The encoding of the file, which is either :const:`FILETYPE_PEM` or :const:`FILETYPE_ASN1`. The default is :const:`FILETYPE_PEM`. :return: None r N) rÚ _UNSPECIFIEDrr³rÉrµr‹ZSSL_CTX_use_PrivateKey_filerér+)r•Zkeyfiler!r"rrrŽÚuse_privatekey_filees  ÿzContext.use_privatekey_filecCs2t|tƒstdƒ‚t |j|j¡}|s.| ¡dS©zs Load a private key from a PKey object :param pkey: The PKey object :return: None zpkey must be a PKey instanceN)r³rrµr‹ZSSL_CTX_use_PrivateKeyréÚ_pkeyr+©r•Zpkeyr"rrrŽÚuse_privatekey}s  zContext.use_privatekeycCst |j¡stƒdS)zß Check if the private key (loaded with :meth:`use_privatekey`) matches the certificate (loaded with :meth:`use_certificate`) :return: :data:`None` (raises :exc:`Error` if something's wrong) N)r‹ZSSL_CTX_check_private_keyrér—r”rrrŽÚcheck_privatekeyŒs zContext.check_privatekeycCs0t td|ƒ¡}t|tjkƒt |j|¡dS)a% Load the trusted certificates that will be sent to the client. Does not actually imply any of the certificates are trusted; that must be configured separately. :param bytes cafile: The path to a certificates file in PEM format. :return: None rN)r‹ZSSL_load_client_CA_fileÚ_text_to_bytes_and_warnrçr¬rÀÚSSL_CTX_set_client_CA_listré)r•rZca_listrrrŽÚload_client_ca–s ÿzContext.load_client_cacCs*td|ƒ}tt |j|t|ƒ¡dkƒdS)aV Set the session id to *buf* within which a session can be reused for this Context object. This is needed when doing session resumption, because there is no way for a stored session to know which Context object it is associated with. :param bytes buf: The session id. :returns: None ÚbufrœN)r3rçr‹ZSSL_CTX_set_session_id_contextrér·)r•r6rrrŽÚset_session_id¥s ÿÿzContext.set_session_idcCs t|tƒstdƒ‚t |j|¡S)aŽ Set the behavior of the session cache used by all connections using this Context. The previously set mode is returned. See :const:`SESS_CACHE_*` for details about particular modes. :param mode: One or more of the SESS_CACHE_* flags (combine using bitwise or) :returns: The previously set caching mode. .. versionadded:: 0.14 úmode must be an integer)r³rÉrµr‹ZSSL_CTX_set_session_cache_moderé©r•ÚmoderrrŽÚset_session_cache_mode¶s zContext.set_session_cache_modecCs t |j¡S)z‡ Get the current session cache mode. :returns: The currently used cache mode. .. versionadded:: 0.14 )r‹ZSSL_CTX_get_session_cache_moderér”rrrŽÚget_session_cache_modeÇszContext.get_session_cache_modecCstt|tƒstdƒ‚|dur:d|_d|_t |j|tj ¡n6t |ƒsJtdƒ‚t |ƒ|_|jj |_t |j||j¡dS)aÚ Set the verification flags for this Context object to *mode* and specify that *callback* should be used for verification callbacks. :param mode: The verify mode, this should be one of :const:`VERIFY_NONE` and :const:`VERIFY_PEER`. If :const:`VERIFY_PEER` is used, *mode* can be OR:ed with :const:`VERIFY_FAIL_IF_NO_PEER_CERT` and :const:`VERIFY_CLIENT_ONCE` to further control the behaviour. :param callback: The optional Python verification callback to use. This should take five arguments: A Connection object, an X509 object, and three integer variables, which are in turn potential error number, error depth and return code. *callback* should return True if verification passes and False otherwise. If omitted, OpenSSL's default verification is used. :return: None See SSL_CTX_set_verify(3SSL) for further details. r8Nr ) r³rÉrµrírîr‹ZSSL_CTX_set_verifyrér¬rÀr ršr©©r•r:r©rrrŽÚ set_verifyÑs   zContext.set_verifycCs$t|tƒstdƒ‚t |j|¡dS)zÙ Set the maximum depth for the certificate chain verification that shall be allowed for this Context object. :param depth: An integer specifying the verify depth :return: None zdepth must be an integerN)r³rÉrµr‹ZSSL_CTX_set_verify_depthré)r•ÚdepthrrrŽÚset_verify_depthôs zContext.set_verify_depthcCs t |j¡S)z„ Retrieve the Context object's verify mode, as set by :meth:`set_verify`. :return: The verify mode )r‹ZSSL_CTX_get_verify_moderér”rrrŽÚget_verify_modeszContext.get_verify_modecCs t |j¡S)zŒ Retrieve the Context object's verify depth, as set by :meth:`set_verify_depth`. :return: The verify depth )r‹ZSSL_CTX_get_verify_depthrér”rrrŽÚget_verify_depth szContext.get_verify_depthcCstt|ƒ}t |d¡}|tjkr$tƒt |tj¡}t |tjtjtj¡}t |tj ¡}t  |j |¡}t |dkƒdS)zº Load parameters for Ephemeral Diffie-Hellman :param dhfile: The file to load EDH parameters from (``bytes`` or ``unicode``). :return: None órrœN) rr‹Z BIO_new_filer¬rÀr—rèZBIO_freeZPEM_read_bio_DHparamsZDH_freeZSSL_CTX_set_tmp_dhrérç)r•ZdhfileÚbioZdhÚresrrrŽÚ load_tmp_dhs   zContext.load_tmp_dhcCst |j| ¡¡dS)a  Select a curve to use for ECDHE key exchange. :param curve: A curve object to use as returned by either :meth:`OpenSSL.crypto.get_elliptic_curve` or :meth:`OpenSSL.crypto.get_elliptic_curves`. :return: None N)r‹ZSSL_CTX_set_tmp_ecdhréZ _to_EC_KEY)r•ZcurverrrŽÚ set_tmp_ecdh(s zContext.set_tmp_ecdhcCsZtd|ƒ}t|tƒstdƒ‚tt |j|¡dkƒt|dƒ}|  ¡gd¢krVt dgƒ‚dS)zó Set the list of ciphers to be used in this context. See the OpenSSL manual for more information (e.g. :manpage:`ciphers(1)`). :param bytes cipher_list: An OpenSSL cipher string. :return: None Ú cipher_listz"cipher_list must be a byte string.rœN)ZTLS_AES_256_GCM_SHA384ZTLS_CHACHA20_POLY1305_SHA256ZTLS_AES_128_GCM_SHA256)z SSL routinesÚSSL_CTX_set_cipher_listzno cipher match) r3r³r´rµrçr‹rIrérwÚget_cipher_listrm)r•rHZtmpconnrrrŽÚset_cipher_list4s  ÿ ÿÿzContext.set_cipher_listcCs®t ¡}t|tjkƒzf|D]\}t|tƒs>td t |ƒj ¡ƒ‚t  |j ¡}t|tjkƒt  ||¡}|st |¡tƒqWntyšt |¡‚Yn0t |j|¡dS)a_ Set the list of preferred client certificate signers for this server context. This list of certificate authorities will be sent to the client when the server requests a client certificate. :param certificate_authorities: a sequence of X509Names. :return: None .. versionadded:: 0.10 z3client CAs must be X509Name objects, not {} objectsN)r‹Zsk_X509_NAME_new_nullrçr¬rÀr³rrµÚformatrÙr‡Ú X509_NAME_dupÚ_nameZsk_X509_NAME_pushÚX509_NAME_freer—r Zsk_X509_NAME_freer4ré)r•Zcertificate_authoritiesZ name_stackZca_namer(Z push_resultrrrŽÚset_client_ca_list[s(  ÿÿ      zContext.set_client_ca_listcCs2t|tƒstdƒ‚t |j|j¡}t|dkƒdS)ai Add the CA certificate to the list of preferred signers for this context. The list of certificate authorities will be sent to the client when the server requests a client certificate. :param certificate_authority: certificate authority's X509 certificate. :return: None .. versionadded:: 0.10 z.certificate_authority must be an X509 instancerœN)r³rrµr‹ZSSL_CTX_add_client_CArér%rç)r•Zcertificate_authorityr)rrrŽÚ add_client_ca~s ÿzContext.add_client_cacCs t|tƒstdƒ‚t |j|¡S)aQ Set the timeout for newly created sessions for this Context object to *timeout*. The default value is 300 seconds. See the OpenSSL manual for more information (e.g. :manpage:`SSL_CTX_set_timeout(3)`). :param timeout: The timeout in (whole) seconds :return: The previous session timeout ztimeout must be an integer)r³rÉrµr‹ZSSL_CTX_set_timeoutré)r•ÚtimeoutrrrŽÚ set_timeout“s zContext.set_timeoutcCs t |j¡S)z” Retrieve session timeout, as set by :meth:`set_timeout`. The default is 300 seconds. :return: The session timeout )r‹ZSSL_CTX_get_timeoutrér”rrrŽÚ get_timeout¡szContext.get_timeoutcs6tˆƒ‡fdd„ƒ}t d|¡|_t |j|j¡dS)að Set the information callback to *callback*. This function will be called from time to time during SSL handshakes. :param callback: The Python callback to use. This should take three arguments: a Connection object and two integers. The first integer specifies where in the SSL handshake the function was called, and the other the return code from a (possibly failed) internal function call. :return: None csˆtj|||ƒdSr’©rwrŸ)r¥ÚwhereZ return_code©r©rrŽrª·sz*Context.set_info_callback..wrapperzvoid (*)(const SSL *, int, int)N)rr¬r©rïr‹ZSSL_CTX_set_info_callbackrér­rrWrŽÚset_info_callbackªs ÿzContext.set_info_callbackcs6tˆƒ‡fdd„ƒ}t d|¡|_t |j|j¡dS)a Set the TLS key logging callback to *callback*. This function will be called whenever TLS key material is generated or received, in order to allow applications to store this keying material for debugging purposes. :param callback: The Python callback to use. This should take two arguments: a Connection object and a bytestring that contains the key material in the format used by NSS for its SSLKEYLOGFILE debugging output. :return: None cst |¡}ˆtj||ƒdSr’)r¬r×rwrŸ)r¥ÚlinerWrrŽrªÏs z,Context.set_keylog_callback..wrapperz#void (*)(const SSL *, const char *)N)rr¬r©rðr‹ZSSL_CTX_set_keylog_callbackrér­rrWrŽÚset_keylog_callbackÀs ÿzContext.set_keylog_callbackcCs|jS)zw Get the application data (supplied via :meth:`set_app_data()`) :return: The application data ©ròr”rrrŽÚ get_app_dataÙszContext.get_app_datacCs ||_dS)z Set the application data (will be returned from get_app_data()) :param data: Any Python object :return: None Nr[©r•rÃrrrŽÚ set_app_dataászContext.set_app_datacCs.t |j¡}|tjkrdSt t¡}||_|S)zú Get the certificate store for the context. This can be used to add "trusted" certificates without using the :meth:`load_verify_locations` method. :return: A X509Store object or None if it does not have one. N)r‹ZSSL_CTX_get_cert_storerér¬rÀrÚ__new__Z_store)r•ÚstoreZpystorerrrŽÚget_cert_storeês    zContext.get_cert_storecCs t|tƒstdƒ‚t |j|¡S)zÝ Add options. Options set before are not cleared! This method should be used with the :const:`OP_*` constants. :param options: The options to add. :return: The new option bitmask. zoptions must be an integer)r³rÉrµr‹ZSSL_CTX_set_optionsré)r•ÚoptionsrrrŽÚ set_optionsûs zContext.set_optionscCs t|tƒstdƒ‚t |j|¡S)zà Add modes via bitmask. Modes set before are not cleared! This method should be used with the :const:`MODE_*` constants. :param mode: The mode to add. :return: The new mode bitmask. r8)r³rÉrµr‹ZSSL_CTX_set_moderér9rrrŽrús zContext.set_modecs6tˆƒ‡fdd„ƒ}t d|¡|_t |j|j¡dS)a Specify a callback function to be called when clients specify a server name. :param callback: The callback function. It will be invoked with one argument, the Connection instance. .. versionadded:: 0.13 csˆtj|ƒdSrÏrU)r¥Zalertr»rWrrŽrª sz7Context.set_tlsext_servername_callback..wrapperzint (*)(SSL *, int *, void *)N)rr¬r©rñr‹Z&SSL_CTX_set_tlsext_servername_callbackrér­rrWrŽÚset_tlsext_servername_callbacks ÿÿz&Context.set_tlsext_servername_callbackcCs,t|tƒstdƒ‚tt |j|¡dkƒdS)z÷ Enable support for negotiating SRTP keying material. :param bytes profiles: A colon delimited list of protection profile names, like ``b'SRTP_AES128_CM_SHA1_80:SRTP_AES128_CM_SHA1_32'``. :return: None zprofiles must be a byte string.rN)r³r´rµrçr‹ZSSL_CTX_set_tlsext_use_srtpré)r•ZprofilesrrrŽÚset_tlsext_use_srtp,s  ÿzContext.set_tlsext_use_srtpcCsR|s tdƒ‚d t dd„|Dƒ¡¡}t d|¡}tt |j |t |ƒ¡dkƒdS)a• Specify the protocols that the client is prepared to speak after the TLS connection has been negotiated using Application Layer Protocol Negotiation. :param protos: A list of the protocols to be offered to the server. This list should be a Python list of bytestrings representing the protocols to offer, e.g. ``[b'http/1.1', b'spdy/2']``. ú'at least one protocol must be specifiedr°css |]}tt|ƒfƒ|fVqdSr’©r´r·©Ú.0ÚprrrŽÚ Or°z*Context.set_alpn_protos..r±rN) rÒÚjoinrÚ from_iterabler¬r¶rçr‹ZSSL_CTX_set_alpn_protosrér·©r•ZprotosZprotostrZ input_strrrrŽÚset_alpn_protos;sÿ  ÿýÿzContext.set_alpn_protoscCs,t|ƒ|_|jj|_t |j|jtj¡dS)aœ Specify a callback function that will be called on the server when a client offers protocols using ALPN. :param callback: The callback function. It will be invoked with two arguments: the Connection, and a list of offered protocols as bytestrings, e.g ``[b'http/1.1', b'spdy/2']``. It can return one of those bytestrings to indicate the chosen protocol, the empty bytestring to terminate the TLS connection, or the :py:obj:`NO_OVERLAPPING_PROTOCOLS` to indicate that no offered protocol was selected, but that the connection should not be aborted. N) r¯rór©rôr‹ZSSL_CTX_set_alpn_select_cbrér¬rÀ©r•r©rrrŽÚset_alpn_select_callbackas    ÿz Context.set_alpn_select_callbackcCsh||_|j|_|dur tj|_n t |¡|_t |j |j¡}t |dkƒt  |j |j¡}t |dkƒdS)z© This internal helper does the common work for ``set_ocsp_server_callback`` and ``set_ocsp_client_callback``, which is almost all of it. Nrœ) rõr©rör¬rÀr÷Z new_handler‹ZSSL_CTX_set_tlsext_status_cbrérçZSSL_CTX_set_tlsext_status_arg)r•ÚhelperrÃÚrcrrrŽÚ_set_ocsp_callbackvs  ÿ zContext._set_ocsp_callbackcCst|ƒ}| ||¡dS)aû Set a callback to provide OCSP data to be stapled to the TLS handshake on the server side. :param callback: The callback function. It will be invoked with two arguments: the Connection, and the optional arbitrary data you have provided. The callback must return a bytestring that contains the OCSP data to staple to the handshake. If no OCSP data is available for this connection, return the empty bytestring. :param data: Some opaque data that will be passed into the callback function when called. This can be used to avoid needing to do complex data lookups or to keep track of what context is being used. This parameter is optional. N)r¾rt©r•r©rÃrrrrrŽÚset_ocsp_server_callbackŠsz Context.set_ocsp_server_callbackcCst|ƒ}| ||¡dS)a Set a callback to validate OCSP data stapled to the TLS handshake on the client side. :param callback: The callback function. It will be invoked with three arguments: the Connection, a bytestring containing the stapled OCSP assertion, and the optional arbitrary data you have provided. The callback must return a boolean that indicates the result of validating the OCSP data: ``True`` if the OCSP data is valid and the certificate can be trusted, or ``False`` if either the OCSP data is invalid or the certificate has been revoked. :param data: Some opaque data that will be passed into the callback function when called. This can be used to avoid needing to do complex data lookups or to keep track of what context is being used. This parameter is optional. N)rÆrtrurrrŽÚset_ocsp_client_callbackœsz Context.set_ocsp_client_callbackcCs t|ƒ|_t |j|jj¡dSr’)rËrør‹ZSSL_CTX_set_cookie_generate_cbrér©rprrrŽÚset_cookie_generate_callback°s  þz$Context.set_cookie_generate_callbackcCs t|ƒ|_t |j|jj¡dSr’)rÎrùr‹ZSSL_CTX_set_cookie_verify_cbrér©rprrrŽÚset_cookie_verify_callback·s  þz"Context.set_cookie_verify_callback)N)N)N)N)N)Qr‡rˆr‰rŠr$r‹Z TLS_methodr%r/r&r0r'r1r(r)ZTLS_server_methodr*ZTLS_client_methodr+Z DTLS_methodr,ZDTLS_server_methodr-ZDTLS_client_methodråÚtypingÚClassVarÚDictÚ__annotations__r–rûrürrr rrrrrr#r'r*r+r,r-r1r2r5r7r;r<r>r@rArBrFrGrKrPrQrSrTrXÚ_requires_keylogrZr\r^rarcrúrdreÚ_requires_alpnrorqrtrvrwrxryrrrrŽrv*s~           ö '   0     #    '#      %   rvc@sTeZdZeƒZd‹dd„Zdd„Zdd„Zdd „Zd d „Z d d „Z dŒdd„Z dd„Z dd„Z dd„Zdd„Zdd„Zdd„Zdd„Zddd „ZeZdŽd!d"„Zdd#d$„ZeZdd%d&„Zd'd(„Zd)d*„Zd+d,„Zd-d.„Zd/d0„Zd1d2„Zd3d4„Zd5d6„Z d7d8„Z!d9d:„Z"d;d<„Z#d=d>„Z$d?d@„Z%dAdB„Z&dCdD„Z'dEdF„Z(dGdH„Z)dIdJ„Z*dKdL„Z+dMdN„Z,dOdP„Z-dQdR„Z.dSdT„Z/dUdV„Z0dWdX„Z1dYdZ„Z2d‘d[d\„Z3d]d^„Z4d_d`„Z5dadb„Z6e7dcdd„ƒZ8dedf„Z9dgdh„Z:didj„Z;dkdl„Zdqdr„Z?dsdt„Z@dudv„ZAdwdx„ZBdydz„ZCd{d|„ZDd}d~„ZEdd€„ZFdd‚„ZGdƒd„„ZHeId…d†„ƒZJeId‡dˆ„ƒZKd‰dŠ„ZLdS)’rwNcCst|tƒstdƒ‚t |j¡}t |tj¡|_ t  |j tj ¡||_d|_ d|_ |j|_|j|_|j|_|j|_||j|j <|duràd|_t t ¡¡|_t|jtjkƒt t ¡¡|_t|jtjkƒt |j |j|j¡n2d|_d|_||_t |j t|jƒ¡}t|dkƒdS)zò Create a new Connection object, using the given OpenSSL.SSL.Context instance and socket. :param context: An SSL Context to use for this connection :param socket: The socket to use for transport layer ú"context must be a Context instanceNrœ)r³rvrµr‹ZSSL_newrér¬rèZSSL_freeÚ_sslZ SSL_set_modeZSSL_MODE_AUTO_RETRYròr¸rírîrørùrŸÚ_socketZBIO_newZ BIO_s_memÚ _into_sslrçrÀÚ _from_sslZ SSL_set_bioZ SSL_set_fdrÖ)r•rÿÚsocketr¥rrrrŽr–Âs6    ÿzConnection.__init__cCs6|jdur&td|jj›d|›dƒ‚n t|j|ƒSdS)zy Look up attributes on the wrapped socket object if they are not found on the Connection object. Nú'z' object has no attribute ')r‚ÚAttributeErrorÚ __class__r‡rÑ©r•ÚnamerrrŽÚ __getattr__üs  ÿzConnection.__getattr__cCs||jjdur|jj ¡|jjdur0|jj ¡|jjdurH|jj ¡t ||¡}|tjkrhtƒ‚n|tj krzt ƒ‚nþ|tj krŒt ƒ‚nì|tj kržtƒ‚nÚ|tjkrt ¡dkrþ|dkròtdkrÔt ¡d}ntj}|dkròt|t |¡ƒ‚tddƒ‚ntƒnr|tjkrdt ¡dkrdt ¡}t |¡}tjr\t|tjkƒt ¡tddƒ‚ntƒn|tjkrrntƒdS)NrÚwin32rÈzUnexpected EOF) rérír™rórõr‹Z SSL_get_errorZSSL_ERROR_WANT_READrnZSSL_ERROR_WANT_WRITEroZSSL_ERROR_ZERO_RETURNrqZSSL_ERROR_WANT_X509_LOOKUPrpZSSL_ERROR_SYSCALLZERR_peek_errorrr¬Z getwinerrorÚerrnorrrrr—Z SSL_ERROR_SSLZERR_GET_REASONZ-Cryptography_HAS_UNEXPECTED_EOF_WHILE_READINGrçZ"SSL_R_UNEXPECTED_EOF_WHILE_READINGZERR_clear_errorZSSL_ERROR_NONE)r•r¥r¦rÞrZ peeked_errorÚreasonrrrŽÚ_raise_ssl_errorsL                ÿ  zConnection._raise_ssl_errorcCs|jS)zh Retrieve the :class:`Context` object associated with this :class:`Connection`. )rér”rrrŽÚ get_context?szConnection.get_contextcCs,t|tƒstdƒ‚t |j|j¡||_dS)zª Switch this connection to a new session context. :param context: A :class:`Context` instance giving the new session context to use. r€N)r³rvrµr‹ZSSL_set_SSL_CTXrré)r•rÿrrrŽÚ set_contextFs zConnection.set_contextcCs(t |jtj¡}|tjkrdSt |¡S)zï Retrieve the servername extension value if provided in the client hello message, or None if there wasn't one. :return: A byte string giving the server name or :data:`None`. .. versionadded:: 0.13 N)r‹ZSSL_get_servernamerZTLSEXT_NAMETYPE_host_namer¬rÀr×r‰rrrŽÚget_servernameSs ÿ zConnection.get_servernamecCstt|tƒstdƒ‚|dur:d|_d|_t |j|tj ¡n6t |ƒsJtdƒ‚t |ƒ|_|jj |_t |j||j¡dS)z— Override the Context object's verification flags for this specific connection. See :py:meth:`Context.set_verify` for details. r8Nr ) r³rÉrµrírîr‹ZSSL_set_verifyrr¬rÀr ršr©r=rrrŽr>ds   zConnection.set_verifycCs t |j¡S)z‡ Retrieve the Connection object's verify mode, as set by :meth:`set_verify`. :return: The verify mode )r‹ZSSL_get_verify_moderr”rrrŽrAxszConnection.get_verify_modecCs0t|tƒstdƒ‚t |j|j¡}|s,tƒdSr$)r³rrµr‹ZSSL_use_certificaterr%r—r&rrrŽr's  zConnection.use_certificatecCs4t|tƒstdƒ‚t |j|j¡}|s0|j ¡dSr.) r³rrµr‹ZSSL_use_PrivateKeyrr/rér+r0rrrŽr1s  zConnection.use_privatekeycCst |j|¡dS)aK For DTLS, set the maximum UDP payload size (*not* including IP/UDP overhead). Note that you might have to set :data:`OP_NO_QUERY_MTU` to prevent OpenSSL from spontaneously clearing this. :param mtu: An integer giving the maximum transmission unit. .. versionadded:: 21.1 N)r‹Z SSL_set_mtur)r•ZmturrrŽÚset_ciphertext_mtuŸs zConnection.set_ciphertext_mtucCsttdƒstdƒ‚t |j¡S)a  For DTLS, get the maximum size of unencrypted data you can pass to :meth:`write` without exceeding the MTU (as passed to :meth:`set_ciphertext_mtu`). :return: The effective MTU as an integer. .. versionadded:: 21.1 ÚDTLS_get_data_mtuz requires OpenSSL 1.1.1 or better)Úhasattrr‹rÛr”rr”rrrŽÚget_cleartext_mtu­s zConnection.get_cleartext_mtucCs6t|tƒstdƒ‚nd|vr$tdƒ‚t |j|¡dS)z­ Set the value of the servername extension to send in the client hello. :param name: A byte string giving the name. .. versionadded:: 0.13 zname must be a byte stringózname must not contain NUL byteN)r³r´rµr‹ZSSL_set_tlsext_host_namerr‰rrrŽÚset_tlsext_host_name¼s   zConnection.set_tlsext_host_namecCs t |j¡S)zÏ Get the number of bytes that can be safely read from the SSL buffer (**not** the underlying transport buffer). :return: The number of bytes available in the receive buffer. )r‹Z SSL_pendingrr”rrrŽÚpendingÌszConnection.pendingrcCsrtd|ƒ}t |¡J}t|ƒdkr*tdƒ‚t |j|t|ƒ¡}| |j|¡|WdƒS1sd0YdS)a³ Send data on the connection. NOTE: If you get one of the WantRead, WantWrite or WantX509Lookup exceptions on this, you have to call the method again with the SAME buffer. :param buf: The string, buffer or memoryview to send :param flags: (optional) Included for compatibility with the socket API, the value is ignored :return: The number of bytes written r6éÿÿÿz,Cannot send more than 2**31-1 bytes at once.N) r3r¬Ú from_bufferr·rÒr‹Ú SSL_writerr)r•r6ÚflagsrÃr¦rrrŽÚsendÕs   ÿzConnection.sendcCs†td|ƒ}t |¡^}t|ƒ}d}|r`t |j||t|dƒ¡}| |j|¡||7}||8}q"|WdƒS1sx0YdS)a© Send "all" data on the connection. This calls send() repeatedly until all data is sent. If an error occurs, it's impossible to tell how much data has been sent. :param buf: The string, buffer or memoryview to send :param flags: (optional) Included for compatibility with the socket API, the value is ignored :return: The number of bytes written r6rršN) r3r¬r›r·r‹rœrÚminr)r•r6rrÃZ left_to_sendZ total_sentr¦rrrŽÚsendallñs  ÿ zConnection.sendallcCs`td|ƒ}|dur.|tj@r.t |j||¡}nt |j||¡}| |j|¡t  ||¡dd…S)a Receive data on the connection. :param bufsiz: The maximum number of bytes to read :param flags: (optional) The only supported flag is ``MSG_PEEK``, all other flags are ignored. :return: The string read from the Connection úchar[]N) Ú_no_zero_allocatorr…ÚMSG_PEEKr‹ÚSSL_peekrÚSSL_readrr¬r²)r•Úbufsizrr6r¦rrrŽÚrecvs zConnection.recvcCsˆ|durt|ƒ}nt|t|ƒƒ}td|ƒ}|durN|tj@rNt |j||¡}nt |j||¡}|  |j|¡t t   ||¡ƒ|d|…<|S)ae Receive data on the connection and copy it directly into the provided buffer, rather than creating a new string. :param buffer: The buffer to copy into. :param nbytes: (optional) The maximum number of bytes to read into the buffer. If not present, defaults to the size of the buffer. If larger than the size of the buffer, is reduced to the size of the buffer. :param flags: (optional) The only supported flag is ``MSG_PEEK``, all other flags are ignored. :return: The number of bytes read into the buffer. Nr¡) r·rŸr¢r…r£r‹r¤rr¥rÚ memoryviewr¬r²)r•r²Únbytesrr6r¦rrrŽÚ recv_into!s  zConnection.recv_intocCsVt |¡rLt |¡rtƒ‚qRt |¡r.tƒ‚qRt |¡rBtdƒ‚qRtdƒ‚ntƒdS)NÚBIO_should_io_specialzunknown bio failure) r‹ZBIO_should_retryZBIO_should_readrnZBIO_should_writeror«rÒr—)r•rDr¦rrrŽÚ_handle_bio_errorsFs      zConnection._handle_bio_errorscCsh|jdurtdƒ‚t|tƒs$tdƒ‚td|ƒ}t |j||¡}|dkrT| |j|¡t  ||¡dd…S)a¹ If the Connection was created with a memory BIO, this method can be used to read bytes from the write end of that memory BIO. Many Connection methods will add bytes which must be read in this manner or the buffer will eventually fill up and the Connection will be able to take no further actions. :param bufsiz: The maximum number of bytes to read :return: The string read. NúConnection sock was not Nonezbufsiz must be an integerr¡r) r„rµr³rÉr¢r‹ZBIO_readr¬r¬r²)r•r¦r6r¦rrrŽÚbio_readXs   zConnection.bio_readcCsxtd|ƒ}|jdurtdƒ‚t |¡>}t |j|t|ƒ¡}|dkrR| |j|¡|WdƒS1sj0YdS)aj If the Connection was created with a memory BIO, this method can be used to add bytes to the read end of that memory BIO. The Connection can then read the bytes (for example, in response to a call to :meth:`recv`). :param buf: The string to put into the memory BIO. :return: The number of bytes written r6Nr­r) r3rƒrµr¬r›r‹Z BIO_writer·r¬)r•r6rÃr¦rrrŽÚ bio_writeps   zConnection.bio_writecCs$| ¡s tt |j¡dkƒdSdS)z‹ Renegotiate the session. :return: True if the renegotiation can be started, False otherwise :rtype: bool rœTF)Úrenegotiate_pendingrçr‹ZSSL_renegotiaterr”rrrŽÚ renegotiate…szConnection.renegotiatecCst |j¡}| |j|¡dS)a Perform an SSL handshake (usually called after :meth:`renegotiate` or one of :meth:`set_accept_state` or :meth:`set_connect_state`). This can raise the same exceptions as :meth:`send` and :meth:`recv`. :return: None. N)r‹ZSSL_do_handshakerr©r•r¦rrrŽÚ do_handshake‘s zConnection.do_handshakecCst |j¡dkS)zÑ Check if there's a renegotiation in progress, it will return False once a renegotiation is finished. :return: Whether there's a renegotiation in progress :rtype: bool rœ)r‹ZSSL_renegotiate_pendingrr”rrrŽr°œszConnection.renegotiate_pendingcCs t |j¡S)z‚ Find out the total number of renegotiations. :return: The number of renegotiations. :rtype: int )r‹ZSSL_total_renegotiationsrr”rrrŽÚtotal_renegotiations¦szConnection.total_renegotiationscCst |j¡|j |¡S)a4 Call the :meth:`connect` method of the underlying socket and set up SSL on the socket, using the :class:`Context` object supplied to this :class:`Connection` object at creation. :param addr: A remote address :return: What the socket's connect method returns )r‹ÚSSL_set_connect_staterr‚Úconnect)r•ÚaddrrrrŽr¶¯s zConnection.connectcCs|jj}| ¡||ƒS)a• Call the :meth:`connect_ex` method of the underlying socket and set up SSL on the socket, using the Context object supplied to this Connection object at creation. Note that if the :meth:`connect_ex` method of the socket doesn't return 0, SSL won't be initialized. :param addr: A remove address :return: What the socket's connect_ex method returns )r‚Ú connect_exÚset_connect_state)r•r·r¸rrrŽr¸»s zConnection.connect_excCs*|j ¡\}}t|j|ƒ}| ¡||fS)a‹ Call the :meth:`accept` method of the underlying socket and set up SSL on the returned socket, using the Context object supplied to this :class:`Connection` object at creation. :return: A *(conn, addr)* pair where *conn* is the new :class:`Connection` object created, and *address* is as returned by the socket's :meth:`accept`. )r‚ÚacceptrwréÚset_accept_state)r•Zclientr·r¼rrrŽrºÉs  zConnection.acceptc Cs‚t ¡}zt |j|¡}Wt |¡n t |¡0|jdurF|j ¡|jdurZ|j ¡|dkrhtƒ‚|dkr~|  |j|¡dS)z• Call the OpenSSL function DTLSv1_listen on this connection. See the OpenSSL manual for more details. :return: None Nr) r‹Z BIO_ADDR_newÚ DTLSv1_listenrZ BIO_ADDR_freerør™rùrnr)r•Zbio_addrr¦rrrŽr¼Øs    zConnection.DTLSv1_listencCs@t d¡}t d¡}t |j||¡r8|d|ddSdSdS)a} Determine when the DTLS SSL object next needs to perform internal processing due to the passage of time. When the returned number of seconds have passed, the :meth:`DTLSv1_handle_timeout` method needs to be called. :return: The time left in seconds before the next timeout or `None` if no timeout is currently active. ztime_t *zlong *ri@BN)r¬r¶r‹ZCryptography_DTLSv1_get_timeoutr)r•Zptv_secZptv_usecrrrŽÚDTLSv1_get_timeoutòs  zConnection.DTLSv1_get_timeoutcCs0t |j¡}|dkr$| |j|¡nt|ƒSdS)z° Handles any timeout events which have become pending on a DTLS SSL object. :return: `True` if there was a pending timeout, `False` otherwise. rN)r‹ÚDTLSv1_handle_timeoutrrrÊr²rrrŽr¾ s z Connection.DTLSv1_handle_timeoutcCs$|jdurtdƒ‚t |jd¡dS)zÕ If the Connection was created with a memory BIO, this method can be used to indicate that *end of file* has been reached on the read end of that memory BIO. :return: None Nr­r)r„rµr‹ZBIO_set_mem_eof_returnrƒr”rrrŽÚ bio_shutdown s zConnection.bio_shutdowncCs8t |j¡}|dkr$| |j|¡n|dkr0dSdSdS)aQ Send the shutdown message to the Connection. :return: True if the shutdown completed successfully (i.e. both sides have sent closure alerts), False otherwise (in which case you call :meth:`recv` or :meth:`send` when the connection becomes readable/writeable). rTFN)r‹Z SSL_shutdownrrr²rrrŽÚshutdown s zConnection.shutdowncCsFg}tƒD]6}t |j|¡}|tjkr*qB| t |¡ d¡¡q |S)z€ Retrieve the list of ciphers used by the Connection object. :return: A list of native cipher strings. úutf-8) rr‹ZSSL_get_cipher_listrr¬rÀr¡r×r )r•ZciphersÚir¦rrrŽrJ/ s  zConnection.get_cipher_listcCs~t |j¡}|tjkrgSg}tt |¡ƒD]L}t ||¡}t |¡}t |tjkƒt   t ¡}t  |tj ¡|_| |¡q,|S)aØ Get CAs whose certificates are suggested for client authentication. :return: If this is a server connection, the list of certificate authorities that will be sent or has been sent to the client, as controlled by this :class:`Connection`'s :class:`Context`. If this is a client connection, the list will be empty until the connection with the server is established. .. versionadded:: 0.10 )r‹ZSSL_get_client_CA_listrr¬rÀÚrangeZsk_X509_NAME_numZsk_X509_NAME_valuerMrçrr_rèrOrNr¡)r•Zca_namesr¦rÂrŠr(ZpynamerrrŽÚget_client_ca_list= s      zConnection.get_client_ca_listcOs tdƒ‚dS)zœ The makefile() method is not implemented, since there is no dup semantics for SSL connections :raise: NotImplementedError z1Cannot make file object of OpenSSL.SSL.ConnectionNrÚ©r•rÜrÝrrrŽÚmakefileZ sÿzConnection.makefilecCs|jS)zr Retrieve application data as set by :meth:`set_app_data`. :return: The application data r[r”rrrŽr\e szConnection.get_app_datacCs ||_dS)zg Set application data :param data: The application data :return: None Nr[r]rrrŽr^m szConnection.set_app_datacCs t |j¡S)zž Get the shutdown state of the Connection. :return: The shutdown state, a bitvector of SENT_SHUTDOWN, RECEIVED_SHUTDOWN. )r‹ZSSL_get_shutdownrr”rrrŽÚ get_shutdownv szConnection.get_shutdowncCs$t|tƒstdƒ‚t |j|¡dS)z— Set the shutdown state of the Connection. :param state: bitvector of SENT_SHUTDOWN, RECEIVED_SHUTDOWN. :return: None zstate must be an integerN)r³rÉrµr‹ZSSL_set_shutdownr)r•ÚstaterrrŽÚ set_shutdown s zConnection.set_shutdowncCst t |j¡¡S)zš Retrieve a verbose string detailing the state of the Connection. :return: A string representing the state :rtype: bytes )r¬r×r‹ZSSL_state_string_longrr”rrrŽÚget_state_string‹ szConnection.get_state_stringcCsft |j¡}|tjkrdSt |jtjd¡}t|dkƒtd|ƒ}t |j||¡t ||¡dd…S)z Retrieve the random value used with the server hello message. :return: A string representing the state Nrr±) r‹ÚSSL_get_sessionrr¬rÀZSSL_get_server_randomrçr¢r²©r•ÚsessionÚlengthÚoutprrrŽÚ server_random” s    zConnection.server_randomcCsft |j¡}|tjkrdSt |jtjd¡}t|dkƒtd|ƒ}t |j||¡t ||¡dd…S)z Retrieve the random value used with the client hello message. :return: A string representing the state Nrr±) r‹rËrr¬rÀZSSL_get_client_randomrçr¢r²rÌrrrŽÚ client_random£ s    zConnection.client_randomcCsbt |j¡}|tjkrdSt |tjd¡}t|dkƒtd|ƒ}t |||¡t ||¡dd…S)zz Retrieve the value of the master key for this session. :return: A string representing the state Nrr±) r‹rËrr¬rÀZSSL_SESSION_get_master_keyrçr¢r²rÌrrrŽÚ master_key³ s    zConnection.master_keyc Csntd|ƒ}tj}d}d}|dur0|}t|ƒ}d}t |j|||t|ƒ|||¡}t|dkƒt ||¡dd…S)aH Obtain keying material for application use. :param: label - a disambiguating label string as described in RFC 5705 :param: olen - the length of the exported key material in bytes :param: context - a per-association context value :return: the exported key material bytes or None r±rNrœ) r¢r¬rÀr·r‹ZSSL_export_keying_materialrrçr²) r•ZlabelZolenrÿrÏZ context_bufZ context_lenZ use_contextÚsuccessrrrŽÚexport_keying_materialà s( ø z!Connection.export_keying_materialcOs|jj|i|¤ŽS)z® Call the :meth:`shutdown` method of the underlying socket. See :manpage:`shutdown(2)`. :return: What the socket's shutdown() method returns )r‚rÀrÅrrrŽÚ sock_shutdowná szConnection.sock_shutdowncCs.t |j¡}|tjkr*t |¡t |¡SdS)za Retrieve the local certificate (if any) :return: The local certificate N)r‹ZSSL_get_certificaterr¬rÀrrrž©r•r£rrrŽÚget_certificateê s     zConnection.get_certificatecCs$t |j¡}|tjkr t |¡SdS)zi Retrieve the other side's certificate (if any) :return: The peer's certificate N)r‹ZSSL_get_peer_certificaterr¬rÀrržrÖrrrŽÚget_peer_certificateö s   zConnection.get_peer_certificatecCs`g}tt |¡ƒD]H}t ||¡}t|tjkƒt |¡}t|dkƒt  |¡}|  |¡q|S)zb Internal helper to convert a STACK_OF(X509) to a list of X509 instances. rœ) rÃr‹Z sk_X509_numZ sk_X509_valuerçr¬rÀrrržr¡)Ú cert_stackr¦rÂr£rEZpycertrrrŽÚ_cert_stack_to_list s     zConnection._cert_stack_to_listcCs$t |j¡}|tjkrdS| |¡S)z Retrieve the other side's certificate (if any) :return: A list of X509 instances giving the peer's certificate chain, or None if it does not have one. N)r‹ZSSL_get_peer_cert_chainrr¬rÀrÚ©r•rÙrrrŽÚget_peer_cert_chain s  zConnection.get_peer_cert_chaincCs$t |j¡}|tjkrdS| |¡S)aÑ Retrieve the verified certificate chain of the peer including the peer's end entity certificate. It must be called after a session has been successfully established. If peer verification was not successful the chain may be incomplete, invalid, or None. :return: A list of X509 instances giving the peer's verified certificate chain, or None if it does not have one. .. versionadded:: 20.0 N)r‹ZSSL_get0_verified_chainrr¬rÀrÚrÛrrrŽÚget_verified_chain s  zConnection.get_verified_chaincCs t |j¡S)z£ Checks if more data has to be read from the transport layer to complete an operation. :return: True iff more data has to be read )r‹Z SSL_want_readrr”rrrŽÚ want_read1 szConnection.want_readcCs t |j¡S)z Checks if there is data to write to the transport layer to complete an operation. :return: True iff there is data to write )r‹ZSSL_want_writerr”rrrŽÚ want_write: szConnection.want_writecCst |j¡dS)z– Set the connection to work in server mode. The handshake will be handled automatically by read/write. :return: None N)r‹ZSSL_set_accept_staterr”rrrŽr»C szConnection.set_accept_statecCst |j¡dS)z– Set the connection to work in client mode. The handshake will be handled automatically by read/write. :return: None N)r‹rµrr”rrrŽr¹L szConnection.set_connect_statecCs8t |j¡}|tjkrdSt t¡}t |tj¡|_ |S)zÄ Returns the Session currently used. :return: An instance of :class:`OpenSSL.SSL.Session` or :obj:`None` if no session exists. .. versionadded:: 0.14 N) r‹ZSSL_get1_sessionrr¬rÀrur_rèZSSL_SESSION_freeÚ_session)r•rÍZ pysessionrrrŽÚ get_sessionU s   zConnection.get_sessioncCs2t|tƒstdƒ‚t |j|j¡}t|dkƒdS)zÜ Set the session to be used when the TLS/SSL connection is established. :param session: A Session instance representing the session to use. :returns: None .. versionadded:: 0.14 z"session must be a Session instancerœN)r³rurµr‹ZSSL_set_sessionrràrç)r•rÍr¦rrrŽÚ set_sessionf s zConnection.set_sessioncCsRt dd¡}||j|dƒ}|dkr&dStd|ƒ}||j||ƒt ||¡dd…S)a‚ Helper to implement :meth:`get_finished` and :meth:`get_peer_finished`. :param function: Either :data:`SSL_get_finished`: or :data:`SSL_get_peer_finished`. :return: :data:`None` if the desired message has not yet been received, otherwise the contents of the message. :rtype: :class:`bytes` or :class:`NoneType` r¡rN)r¬r¶rr¢r²)r•ÚfunctionÚemptyrr6rrrŽÚ_get_finished_messageu s  z Connection._get_finished_messagecCs | tj¡S)a Obtain the latest TLS Finished message that we sent. :return: The contents of the message or :obj:`None` if the TLS handshake has not yet completed. :rtype: :class:`bytes` or :class:`NoneType` .. versionadded:: 0.15 )rår‹ZSSL_get_finishedr”rrrŽÚ get_finished— s zConnection.get_finishedcCs | tj¡S)a! Obtain the latest TLS Finished message that we received from the peer. :return: The contents of the message or :obj:`None` if the TLS handshake has not yet completed. :rtype: :class:`bytes` or :class:`NoneType` .. versionadded:: 0.15 )rår‹ZSSL_get_peer_finishedr”rrrŽÚget_peer_finished£ s zConnection.get_peer_finishedcCs8t |j¡}|tjkrdSt t |¡¡}| d¡SdS)a Obtain the name of the currently used cipher. :returns: The name of the currently used cipher or :obj:`None` if no connection has been established. :rtype: :class:`unicode` or :class:`NoneType` .. versionadded:: 0.15 NrÁ)r‹ÚSSL_get_current_cipherrr¬rÀr×ZSSL_CIPHER_get_namer )r•ÚcipherrŠrrrŽÚget_cipher_name¯ s  zConnection.get_cipher_namecCs,t |j¡}|tjkrdSt |tj¡SdS)a. Obtain the number of secret bits of the currently used cipher. :returns: The number of secret bits of the currently used cipher or :obj:`None` if no connection has been established. :rtype: :class:`int` or :class:`NoneType` .. versionadded:: 0.15 N)r‹rèrr¬rÀZSSL_CIPHER_get_bits)r•rérrrŽÚget_cipher_bitsÀ s  zConnection.get_cipher_bitscCs8t |j¡}|tjkrdSt t |¡¡}| d¡SdS)a% Obtain the protocol version of the currently used cipher. :returns: The protocol name of the currently used cipher or :obj:`None` if no connection has been established. :rtype: :class:`unicode` or :class:`NoneType` .. versionadded:: 0.15 NrÁ)r‹rèrr¬rÀr×ZSSL_CIPHER_get_versionr )r•rérþrrrŽÚget_cipher_versionÐ s  zConnection.get_cipher_versioncCst t |j¡¡}| d¡S)a> Retrieve the protocol version of the current connection. :returns: The TLS version of the current connection, for example the value for TLS 1.2 would be ``TLSv1.2``or ``Unknown`` for connections that were not successfully established. :rtype: :class:`unicode` rÁ)r¬r×r‹ZSSL_get_versionrr rrrrŽÚget_protocol_version_nameá s z$Connection.get_protocol_version_namecCst |j¡}|S)a  Retrieve the SSL or TLS protocol version of the current connection. :returns: The TLS version of the current connection. For example, it will return ``0x769`` for connections made over TLS version 1. :rtype: :class:`int` )r‹Z SSL_versionrrrrrŽÚget_protocol_versioní s zConnection.get_protocol_versioncCsR|s tdƒ‚d t dd„|Dƒ¡¡}t d|¡}tt |j |t |ƒ¡dkƒdS)ah Specify the client's ALPN protocol list. These protocols are offered to the server during protocol negotiation. :param protos: A list of the protocols to be offered to the server. This list should be a Python list of bytestrings representing the protocols to offer, e.g. ``[b'http/1.1', b'spdy/2']``. rfr°css |]}tt|ƒfƒ|fVqdSr’rgrhrrrŽrk r°z-Connection.set_alpn_protos..r±rN) rÒrlrrmr¬r¶rçr‹ZSSL_set_alpn_protosrr·rnrrrŽroø sÿ ÿzConnection.set_alpn_protoscCsHt d¡}t d¡}t |j||¡|s,dSt |d|d¡dd…S)zÇ Get the protocol that was negotiated by ALPN. :returns: A bytestring of the protocol name. If no protocol has been negotiated yet, returns an empty bytestring. rÇzunsigned int *r°rN)r¬r¶r‹ZSSL_get0_alpn_selectedrr²)r•rÃZdata_lenrrrŽÚget_alpn_proto_negotiated s   z$Connection.get_alpn_proto_negotiatedcCs t |jtj¡}t|dkƒdS)a Called to request that the server sends stapled OCSP data, if available. If this is not called on the client side then the server will not send OCSP data. Should be used in conjunction with :meth:`Context.set_ocsp_client_callback`. rœN)r‹ZSSL_set_tlsext_status_typerZTLSEXT_STATUSTYPE_ocsprç)r•rsrrrŽÚ request_ocsp- sÿzConnection.request_ocsp)N)N)r)r)N)NN)N)Mr‡rˆr‰rrŸr–r‹rrr‘r’r>rAr'r1r“r–r˜r™ržÚwriter r§Úreadrªr¬r®r¯r±r³r°r´r¶r¸rºr¼r½r¾r¿rÀrJrÄrÆr\r^rÇrÉrÊrÐrÑrÒrÔrÕr×rØÚ staticmethodrÚrÜrÝrÞrßr»r¹rárârårærçrêrërìrírîrrorïrðrrrrŽrw¿s” : 7       %                      "     " rw)Örr…rzrrÚ functoolsrrÚ itertoolsrrÚsysrÚweakrefrZ OpenSSL._utilr r,r Z_exception_from_error_queuer r¬r r‹r Z _make_assertrr¢rrrr3ZOpenSSL.cryptorrrrrrÚ__all__rrrrrrrr rr!rZSSL_SENT_SHUTDOWNr"ZSSL_RECEIVED_SHUTDOWNr#r$r%r&r'r(r)r*r+r,r-r.r/r0r1r2r‡ZSSL_OP_NO_SSLv2r3ZSSL_OP_NO_SSLv3r4ZSSL_OP_NO_TLSv1r5ZSSL_OP_NO_TLSv1_1r6ZSSL_OP_NO_TLSv1_2r7ZSSL_OP_NO_TLSv1_3rƒr¡ZSSL_MODE_RELEASE_BUFFERSr8ZSSL_OP_SINGLE_DH_USEr9ZSSL_OP_SINGLE_ECDH_USEr:ZSSL_OP_EPHEMERAL_RSAr;ZSSL_OP_MICROSOFT_SESS_ID_BUGr<ZSSL_OP_NETSCAPE_CHALLENGE_BUGr=Z'SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUGr>Z"SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUGr?Z!SSL_OP_MICROSOFT_BIG_SSLV3_BUFFERr@ZSSL_OP_MSIE_SSLV2_RSA_PADDINGrAZSSL_OP_SSLEAY_080_CLIENT_DH_BUGrBZSSL_OP_TLS_D5_BUGrCZSSL_OP_TLS_BLOCK_PADDING_BUGrDZ"SSL_OP_DONT_INSERT_EMPTY_FRAGMENTSrEZSSL_OP_CIPHER_SERVER_PREFERENCErFZSSL_OP_TLS_ROLLBACK_BUGrGZSSL_OP_PKCS1_CHECK_1rHZSSL_OP_PKCS1_CHECK_2rIZSSL_OP_NETSCAPE_CA_DN_BUGrJZ&SSL_OP_NETSCAPE_DEMO_CIPHER_CHANGE_BUGrKZSSL_OP_NO_COMPRESSIONrLZSSL_OP_NO_QUERY_MTUrMZSSL_OP_COOKIE_EXCHANGErNZSSL_OP_NO_TICKETrOZSSL_OP_NO_RENEGOTIATIONr„ZSSL_OP_IGNORE_UNEXPECTED_EOFr…ZSSL_OP_LEGACY_SERVER_CONNECTr†Z SSL_OP_ALLrPZSSL_VERIFY_PEERrQZSSL_VERIFY_FAIL_IF_NO_PEER_CERTrRZSSL_VERIFY_CLIENT_ONCErSZSSL_VERIFY_NONErTZSSL_SESS_CACHE_OFFrUZSSL_SESS_CACHE_CLIENTrVZSSL_SESS_CACHE_SERVERrWZSSL_SESS_CACHE_BOTHrXZSSL_SESS_CACHE_NO_AUTO_CLEARrYZ!SSL_SESS_CACHE_NO_INTERNAL_LOOKUPrZZ SSL_SESS_CACHE_NO_INTERNAL_STOREr[ZSSL_SESS_CACHE_NO_INTERNALr\r]r^r_r`rarbrcrdrerfrgrhrirjrkrlrxrrrrr rmr—rçrnrorprqrrr‘ršÚobjectrsr¯r¾rÆrËrÎrÖrØrträZCryptography_HAS_ALPNrrÑr~rurvrwrrrrŽÚsR            f       ÿÿk ÿ (=C; ÿ ÿ