Edit File: SSL.cpython-36.pyc
3 �F\�[ � R @ s d dl Z d dlZd dlmZ d dlmZmZ d dlmZm Z d dl m Z d dl m Z d dlmZ d dlmZmZmZmZ d d lmZmZmZ m Z m Z m!Z"m#Z$m%Z&m'Z( d d l)m*Z*m+Z+m,Z,m-Z-m.Z.m/Z/ d d d ddddddddddddddd d d d d d!d"d#d$d%d&d'd(d)d*d+d,d-d.d/d0d1d2d3d4d5d6d7d8d9d:d;d<d=d>d?d@dAdBdCdDdEdFdGdHdIdJdKdLdMdNdOdPdQdRdSdTdUdVdWdXdYdZd[d\gRZ0ye1Z2W n& e3k �r� G d]d^� d^e4�Z2Y nX e j5Z5e j6Z6e j7Z7e j8Z8e j9Z9e j:Z:e j;Z<e j=Z>d_Z?d`Z@daZAdbZBdcZCddZDe jEZFe jGZHe jIZJe jKZLe jMZNe jOZPe jQZRe jSZTe jUZVe jWZXe jYZZe j[Z\e j]Z^e j_Z`e jaZbe jcZde jeZfe jgZhe jiZje jkZle jmZne joZpe jqZre jsZte juZve jwZxe jyZze j{Z|e j}Z~e jZ�e j�Z�e j�Z�e j�Z�e j�Z�e j�Z�e j�Z�e j�Z�e j�Z�e j�Z�e j�Z�e j�Z�e j�Z�e j�Z�e j�Z�e j�Z�e j��r$e j�Z�e j�Z�e j�Z�e j�Z�e0j�dedfdgdhg� e j�Z�e j�Z�e j�Z�e j�Z�e j�Z�e j�Z�e j�Z�e j�Z�e j�Z�e j�Z�e j�Z�e j�Z�e j�Z�didjdkdldmgZ�dngZ�doZ�dpZ�G dqdS� dSe��Z�eee��Z�e e��Z�G drdT� dTe��Z�G dsdU� dUe��Z�G dtdV� dVe��Z�G dudW� dWe��Z�G dvdX� dXe��Z�G dwdx� dxe4�Z�G dydz� dze��Z�G d{d|� d|e��Z�G d}d~� d~e��Z�G dd�� d�e��Z�G d�d�� d�e��Z�G d�d�� d�e��Z�d�d�� Z�d�dY� Z�d�d�� Z�e�e j�d��Z�e�e j�d��Z�e�e j�d��Z�G d�dZ� dZe4�Z�G d�d[� d[e4�Z�ee�e�d�eσZ�G d�d\� d\e4�Z�ee�e�d�eσZ�e jӃ dS )�� N)�platform)�wraps�partial)�count�chain)�WeakValueDictionary)� errorcode)� deprecated)� binary_type� integer_types�int2byte� indexbytes) � UNSPECIFIED�exception_from_error_queue�ffi�lib� make_assert�native� path_string�text_to_bytes_and_warn�no_zero_allocator)� FILETYPE_PEM�_PassphraseHelper�PKey�X509Name�X509� X509Store�OPENSSL_VERSION_NUMBER�SSLEAY_VERSION� SSLEAY_CFLAGS�SSLEAY_PLATFORM� SSLEAY_DIR�SSLEAY_BUILT_ON� SENT_SHUTDOWN�RECEIVED_SHUTDOWN� SSLv2_METHOD� SSLv3_METHOD� SSLv23_METHOD� TLSv1_METHOD�TLSv1_1_METHOD�TLSv1_2_METHOD� OP_NO_SSLv2� OP_NO_SSLv3� OP_NO_TLSv1� OP_NO_TLSv1_1� OP_NO_TLSv1_2�MODE_RELEASE_BUFFERS�OP_SINGLE_DH_USE�OP_SINGLE_ECDH_USE�OP_EPHEMERAL_RSA�OP_MICROSOFT_SESS_ID_BUG�OP_NETSCAPE_CHALLENGE_BUG�#OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG� OP_SSLREF2_REUSE_CERT_TYPE_BUG� OP_MICROSOFT_BIG_SSLV3_BUFFER�OP_MSIE_SSLV2_RSA_PADDING�OP_SSLEAY_080_CLIENT_DH_BUG� OP_TLS_D5_BUG�OP_TLS_BLOCK_PADDING_BUG� OP_DONT_INSERT_EMPTY_FRAGMENTS�OP_CIPHER_SERVER_PREFERENCE�OP_TLS_ROLLBACK_BUG�OP_PKCS1_CHECK_1�OP_PKCS1_CHECK_2�OP_NETSCAPE_CA_DN_BUG�"OP_NETSCAPE_DEMO_CIPHER_CHANGE_BUG�OP_NO_COMPRESSION�OP_NO_QUERY_MTU�OP_COOKIE_EXCHANGE� OP_NO_TICKET�OP_ALL� VERIFY_PEER�VERIFY_FAIL_IF_NO_PEER_CERT�VERIFY_CLIENT_ONCE� VERIFY_NONE�SESS_CACHE_OFF�SESS_CACHE_CLIENT�SESS_CACHE_SERVER�SESS_CACHE_BOTH�SESS_CACHE_NO_AUTO_CLEAR� SESS_CACHE_NO_INTERNAL_LOOKUP� SESS_CACHE_NO_INTERNAL_STORE�SESS_CACHE_NO_INTERNAL�SSL_ST_CONNECT� SSL_ST_ACCEPT� SSL_ST_MASK� SSL_CB_LOOP� SSL_CB_EXIT� SSL_CB_READ� SSL_CB_WRITE� SSL_CB_ALERT�SSL_CB_READ_ALERT�SSL_CB_WRITE_ALERT�SSL_CB_ACCEPT_LOOP�SSL_CB_ACCEPT_EXIT�SSL_CB_CONNECT_LOOP�SSL_CB_CONNECT_EXIT�SSL_CB_HANDSHAKE_START�SSL_CB_HANDSHAKE_DONE�Error� WantReadError�WantWriteError�WantX509LookupError�ZeroReturnError� SysCallError�SSLeay_version�Session�Context� Connectionc @ s e Zd ZdS )�_bufferN)�__name__� __module__� __qualname__� rs rs �/usr/lib/python3.6/SSL.pyro v s ro � � � � � � � SSL_ST_INIT� SSL_ST_BEFORE� SSL_ST_OK�SSL_ST_RENEGOTIATEz"/etc/ssl/certs/ca-certificates.crtz /etc/pki/tls/certs/ca-bundle.crtz/etc/ssl/ca-bundle.pemz/etc/pki/tls/cacert.pemz1/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pemz/etc/ssl/certss$ /opt/pyca/cryptography/openssl/certss' /opt/pyca/cryptography/openssl/cert.pemc @ s e Zd ZdZdS )re z4 An error occurred in an `OpenSSL.SSL` API. N)rp rq rr �__doc__rs rs rs rt re � s c @ s e Zd ZdS )rf N)rp rq rr rs rs rs rt rf � s c @ s e Zd ZdS )rg N)rp rq rr rs rs rs rt rg � s c @ s e Zd ZdS )rh N)rp rq rr rs rs rs rt rh s c @ s e Zd ZdS )ri N)rp rq rr rs rs rs rt ri s c @ s e Zd ZdS )rj N)rp rq rr rs rs rs rt rj s c @ s e Zd ZdZdd� Zdd� ZdS )�_CallbackExceptionHelpera� A base class for wrapper classes that allow for intelligent exception handling in OpenSSL callbacks. :ivar list _problems: Any exceptions that occurred while executing in a context where they could not be raised in the normal way. Typically this is because OpenSSL has called into some Python code and requires a return value. The exceptions are saved to be raised later when it is possible to do so. c C s g | _ d S )N)� _problems)�selfrs rs rt �__init__ s z!_CallbackExceptionHelper.__init__c C s6 | j r2y t� W n tk r$ Y nX | j jd��dS )z� Raise an exception from the OpenSSL error queue or that was previously captured whe running a callback. r N)r� �_raise_current_errorre �pop)r� rs rs rt �raise_if_problem s z)_CallbackExceptionHelper.raise_if_problemN)rp rq rr r r� r� rs rs rs rt r� s r� c @ s e Zd ZdZdd� ZdS )� _VerifyHelperz^ Wrap a callback such that it can be used as a certificate verification callback. c s2 t j�� t� �� �fdd��}tjd|��_d S )Nc s� t j|�}t j|� tj|�}t j|�}t j|�}t j� }t j||�}t j | }y� ||||| �} W n, t k r� } z�j j | � dS d } ~ X n X | r�t j|t j� dS dS d S )Nr ru )�_libZ X509_STORE_CTX_get_current_cert� X509_up_refr �_from_raw_x509_ptrZX509_STORE_CTX_get_errorZ X509_STORE_CTX_get_error_depthZ"SSL_get_ex_data_X509_STORE_CTX_idxZX509_STORE_CTX_get_ex_datarn �_reverse_mapping� Exceptionr� �appendZX509_STORE_CTX_set_errorZ X509_V_OK) �okZ store_ctxZx509�certZ error_numberZ error_depth�index�sslZ connection�result�e)�callbackr� rs rt �wrapper2 s$ z'_VerifyHelper.__init__.<locals>.wrapperz int (*)(int, X509_STORE_CTX *))r� r� r �_ffir� )r� r� r� rs )r� r� rt r� / s z_VerifyHelper.__init__N)rp rq rr r r� rs rs rs rt r� ) s r� c @ s e Zd ZdZdd� ZdS )�_NpnAdvertiseHelperzT Wrap a callback such that it can be used as an NPN advertisement callback. c s2 t j�� t� �� �fdd��}tjd|��_d S )Nc s� ynt j| }� |�}djtjdd� |D ���}tjdt|��tjd|�g|_|jd d |d< |jd |d< dS t k r� } z�j j |� dS d }~X nX d S ) N� c s s | ]}t t|��|fV qd S )N)r �len)�.0�prs rs rt � <genexpr>a s z@_NpnAdvertiseHelper.__init__.<locals>.wrapper.<locals>.<genexpr>zunsigned int *zunsigned char[]r ru rv ) rn r� �joinr � from_iterabler� �newr� � _npn_advertise_callback_argsr� r� r� )r� �out�outlen�arg�conn�protos�protostrr� )r� r� rs rt r� X s z-_NpnAdvertiseHelper.__init__.<locals>.wrapperz>int (*)(SSL *, const unsigned char **, unsigned int *, void *))r� r� r r� r� )r� r� r� rs )r� r� rt r� U s z _NpnAdvertiseHelper.__init__N)rp rq rr r r� rs rs rs rt r� P s r� c @ s e Zd ZdZdd� ZdS )�_NpnSelectHelperzP Wrap a callback such that it can be used as an NPN selection callback. c s2 t j�� t� �� �fdd��}tjd|��_d S )Nc s� y�t j| }tj||�d d � }g }x<|r`t|d�} |d| d � } |j| � || d d � }q&W � ||�} tjdt| ��tjd| �g|_|jd d |d< |jd |d< dS t k r� } z�j j| � dS d } ~ X nX d S )Nr ru zunsigned char *zunsigned char[]rv ) rn r� r� �bufferr r� r� r� �_npn_select_callback_argsr� r� ) r� r� r� �in_�inlenr� r� �instr� protolist�length�proto�outstrr� )r� r� rs rt r� � s$ z*_NpnSelectHelper.__init__.<locals>.wrapperz^int (*)(SSL *, unsigned char **, unsigned char *, const unsigned char *, unsigned int, void *))r� r� r r� r� )r� r� r� rs )r� r� rt r� ~ s "z_NpnSelectHelper.__init__N)rp rq rr r r� rs rs rs rt r� y s r� c @ s e Zd ZdZdd� ZdS )�_ALPNSelectHelperzQ Wrap a callback such that it can be used as an ALPN selection callback. c s2 t j�� t� �� �fdd��}tjd|��_d S )Nc s� y�t j| }tj||�d d � }g }x<|r`t|d�} |d| d � } |j| � || d d � }q&W � ||�} t| t�s~td��tj dt | ��tj d| �g|_ |j d d |d< |j d |d< dS t k r� } z�j j| � dS d } ~ X nX d S )Nr ru z'ALPN callback must return a bytestring.zunsigned char *zunsigned char[]rv )rn r� r� r� r r� � isinstance� _binary_type� TypeErrorr� r� �_alpn_select_callback_argsr� r� ) r� r� r� r� r� r� r� r� r� Z encoded_lenr� r� r� )r� r� rs rt r� � s( z+_ALPNSelectHelper.__init__.<locals>.wrapperz^int (*)(SSL *, unsigned char **, unsigned char *, const unsigned char *, unsigned int, void *))r� r� r r� r� )r� r� r� rs )r� r� rt r� � s $z_ALPNSelectHelper.__init__N)rp rq rr r r� rs rs rs rt r� � s r� c @ s e Zd ZdZdd� ZdS )�_OCSPServerCallbackHelpera� Wrap a callback such that it can be used as an OCSP callback for the server side. Annoyingly, OpenSSL defines one OCSP callback but uses it in two different ways. For servers, that callback is expected to retrieve some OCSP data and hand it to OpenSSL, and may return only SSL_TLSEXT_ERR_OK, SSL_TLSEXT_ERR_FATAL, and SSL_TLSEXT_ERR_NOACK. For clients, that callback is expected to check the OCSP data, and returns a negative value on error, 0 if the response is not acceptable, or positive if it is. These are mutually exclusive return code behaviours, and they mean that we need two helpers so that we always return an appropriate error code if the user's code throws an exception. Given that we have to have two helpers anyway, these helpers are a bit more helpery than most: specifically, they hide a few more of the OpenSSL functions so that the user has an easier time writing these callbacks. This helper implements the server side. c s2 t j�� t� �� �fdd��}tjd|��_d S )Nc s� y�t j| }|tjkr"tj|�}nd }� ||�}t|t�sBtd��|sJdS t|�}t j |�}|tj ||�d d �< t j | ||� dS t k r� } z�jj|� dS d }~X nX d S )Nz'OCSP callback must return a bytestring.rw r rv )rn r� r� �NULL� from_handler� r� r� r� r� ZOPENSSL_mallocr� Z SSL_set_tlsext_status_ocsp_respr� r� r� )r� �cdatar� �data� ocsp_dataZocsp_data_lengthZdata_ptrr� )r� r� rs rt r� � s& z3_OCSPServerCallbackHelper.__init__.<locals>.wrapperzint (*)(SSL *, void *))r� r� r r� r� )r� r� r� rs )r� r� rt r� � s 'z"_OCSPServerCallbackHelper.__init__N)rp rq rr r r� rs rs rs rt r� � s r� c @ s e Zd ZdZdd� ZdS )�_OCSPClientCallbackHelpera� Wrap a callback such that it can be used as an OCSP callback for the client side. Annoyingly, OpenSSL defines one OCSP callback but uses it in two different ways. For servers, that callback is expected to retrieve some OCSP data and hand it to OpenSSL, and may return only SSL_TLSEXT_ERR_OK, SSL_TLSEXT_ERR_FATAL, and SSL_TLSEXT_ERR_NOACK. For clients, that callback is expected to check the OCSP data, and returns a negative value on error, 0 if the response is not acceptable, or positive if it is. These are mutually exclusive return code behaviours, and they mean that we need two helpers so that we always return an appropriate error code if the user's code throws an exception. Given that we have to have two helpers anyway, these helpers are a bit more helpery than most: specifically, they hide a few more of the OpenSSL functions so that the user has an easier time writing these callbacks. This helper implements the client side. c s2 t j�� t� �� �fdd��}tjd|��_d S )Nc s� yxt j| }|tjkr"tj|�}nd }tjd�}tj| |�}|dk rJd}ntj|d |�d d � }� |||�}t t |��S t k r� } z�j j |� dS d }~X nX d S )Nzunsigned char **r r� ru ���)rn r� r� r� r� r� r� Z SSL_get_tlsext_status_ocsp_respr� �int�boolr� r� r� ) r� r� r� r� Zocsp_ptrZocsp_lenr� Zvalidr� )r� r� rs rt r� 9 s z3_OCSPClientCallbackHelper.__init__.<locals>.wrapperzint (*)(SSL *, void *))r� r� r r� r� )r� r� r� rs )r� r� rt r� 6 s z"_OCSPClientCallbackHelper.__init__N)rp rq rr r r� rs rs rs rt r� s r� c C sd d }t | t�s(t| dd �}|d k r(|� } t | t�r6| }t |t�sJtd��n|dk r`td|f ��|S )N�filenoz3argument must be an int, or have a fileno() method.r z1file descriptor cannot be a negative integer (%i))r� r �getattrr� � ValueError)�obj�fd�methrs rs rt �_asFileDescriptor[ s r� c C s t jtj| ��S )z� Return a string describing the version of OpenSSL in use. :param type: One of the :const:`SSLEAY_` constants defined in this module. )r� �stringr� rk )�typers rs rt rk n s c s � �fdd�}|S )a� Builds a decorator that ensures that functions that rely on OpenSSL functions that are not present in this build raise NotImplementedError, rather than AttributeError coming out of cryptography. :param flag: A cryptography flag that guards the functions, e.g. ``Cryptography_HAS_NEXTPROTONEG``. :param error: The string to be used in the exception if the flag is false. c s$ �s t | �� fdd��}|S | S d S )Nc s t � ��d S )N)�NotImplementedError)�args�kwargs)�errorrs rt �explode� s z<_make_requires.<locals>._requires_decorator.<locals>.explode)r )�funcr� )r� �flagrs rt �_requires_decorator� s z+_make_requires.<locals>._requires_decoratorrs )r� r� r� rs )r� r� rt �_make_requiresw s r� zNPN not availablezALPN not availablezSNI not availablec @ s e Zd ZdZdS )rl z� A class representing an SSL session. A session defines certain connection parameters which may be re-used to speed up the setup of subsequent connections. .. versionadded:: 0.14 N)rp rq rr r rs rs rs rt rl � s c @ s� e Zd ZdZededededede diZ e dd � e j � D ��Z d d � Z ded d�Zdd� Zdfdd�Zdd� Zdd� Zdd� Zdd� Zefdd �Zd d � Zd d � Zd!d"� Zefd#d$�Zd%d&� Z d'd(� Z d)d*� Z d+d,� Z d-d.� Z d/d0� Z!d1d2� Z"d3d4� Z#d5d6� Z$d7d8� Z%d9d:� Z&d;d<� Z'd=d>� Z(d?d@� Z)dAdB� Z*dCdD� Z+dEdF� Z,dGdH� Z-dIdJ� Z.dKdL� Z/dMdN� Z0dOdP� Z1dQdR� Z2e3dSdT� �Z4dUdV� Z5e6dWdX� �Z7e6dYdZ� �Z8e9d[d\� �Z:e9d]d^� �Z;d_d`� Z<dgdadb�Z=dhdcdd�Z>d S )irm z� :class:`OpenSSL.SSL.Context` instances define the parameters for setting up new SSL connections. :param method: One of SSLv2_METHOD, SSLv3_METHOD, SSLv23_METHOD, or TLSv1_METHOD. Z SSLv2_methodZ SSLv3_methodZ SSLv23_methodZ TLSv1_methodZTLSv1_1_methodZTLSv1_2_methodc c s0 | ](\}}t t|d �d k r|t t|�fV qd S )N)r� r� )r� Z identifier�namers rs rt r� � s zContext.<genexpr>c C s& t |t�std��y| j| }W n tk r< td��Y nX |� }t|tjk� t j |�}t|tjk� tj |t j �}y t j |d�}t|dk� W n tk r� Y nX || _d | _d | _d | _d | _d | _d | _d | _d | _d | _d | _d | _d | _d | _ d | _ d | _ d | _ d | _ | j!t j"� d S )Nzmethod must be an integerzNo such protocolru )#r� r r� �_methods�KeyErrorr� �_openssl_assertr� r� r� Z SSL_CTX_new�gcZ SSL_CTX_freeZSSL_CTX_set_ecdh_auto�AttributeError�_context�_passphrase_helper�_passphrase_callback�_passphrase_userdata�_verify_helper�_verify_callback�_info_callback�_tlsext_servername_callback� _app_data�_npn_advertise_helper�_npn_advertise_callback�_npn_select_helper�_npn_select_callback�_alpn_select_helper�_alpn_select_callback� _ocsp_helper�_ocsp_callback� _ocsp_data�set_modeZ SSL_MODE_ENABLE_PARTIAL_WRITE)r� �methodZ method_funcZ method_obj�context�resrs rs rt r� � sF zContext.__init__Nc C sN |dkrt j}nt|�}|dkr(t j}nt|�}tj| j||�}|sJt� dS )aU Let SSL know where we can find trusted certificates for the certificate chain. Note that the certificates have to be in PEM format. If capath is passed, it must be a directory prepared using the ``c_rehash`` tool included with OpenSSL. Either, but not both, of *pemfile* or *capath* may be :data:`None`. :param cafile: In which file we can find the certificates (``bytes`` or ``unicode``). :param capath: In which directory we can find the certificates (``bytes`` or ``unicode``). :return: None N)r� r� � _path_stringr� Z SSL_CTX_load_verify_locationsr� r� )r� �cafile�capathZ load_resultrs rs rt �load_verify_locations� s z Context.load_verify_locationsc s& t � �� �fdd��}tt|ddd�S )Nc s � | |�j �S )N)r� )�sizeZverify�userdata)r� r� rs rt r� s z'Context._wrap_callback.<locals>.wrapperT)Z more_args�truncate)r r r )r� r� r� rs )r� r� rt �_wrap_callback s zContext._wrap_callbackc C s@ t |�std��| j|�| _| jj| _tj| j| j� || _ dS )a� Set the passphrase callback. This function will be called when a private key with a passphrase is loaded. :param callback: The Python callback to use. This must accept three positional arguments. First, an integer giving the maximum length of the passphrase it may return. If the returned passphrase is longer than this, it will be truncated. Second, a boolean value which will be true if the user should be prompted for the passphrase twice and the callback should verify that the two values supplied are equal. Third, the value given as the *userdata* parameter to :meth:`set_passwd_cb`. The *callback* must return a byte string. If an error occurs, *callback* should return a false value (e.g. an empty string). :param userdata: (optional) A Python object which will be given as argument to the callback :return: None zcallback must be callableN) �callabler� r� r� r� r� r� Z SSL_CTX_set_default_passwd_cbr� r� )r� r� r� rs rs rt � set_passwd_cb s zContext.set_passwd_cbc C s� t j| j�}t|dk� tjt j� �jd�}tjt j� �jd�}| j ||�s�tjt j � �}tjt j � �}|t kr�|t kr�| jtt� dS )a� Specify that the platform provided CA certificates are to be used for verification purposes. This method has some caveats related to the binary wheels that cryptography (pyOpenSSL's primary dependency) ships: * macOS will only load certificates using this method if the user has the ``openssl@1.1`` `Homebrew <https://brew.sh>`_ formula installed in the default location. * Windows will not work. * manylinux1 cryptography wheels will work on most common Linux distributions in pyOpenSSL 17.1.0 and above. pyOpenSSL detects the manylinux1 wheel and attempts to load roots via a fallback path. :return: None ru �asciiN)r� Z SSL_CTX_set_default_verify_pathsr� r� r� r� Z X509_get_default_cert_dir_env�decodeZ X509_get_default_cert_file_env�_check_env_vars_setZX509_get_default_cert_dirZX509_get_default_cert_file� _CRYPTOGRAPHY_MANYLINUX1_CA_DIR� _CRYPTOGRAPHY_MANYLINUX1_CA_FILE� _fallback_default_verify_paths�_CERTIFICATE_FILE_LOCATIONS�_CERTIFICATE_PATH_LOCATIONS)r� � set_result� dir_env_var� file_env_varZ default_dirZ default_filers rs rt �set_default_verify_paths- s z Context.set_default_verify_pathsc C s t jj|�dk p t jj|�dk S )zp Check to see if the default cert dir/file environment vars are present. :return: bool N)�os�environ�get)r� r r rs rs rt r� ^ s zContext._check_env_vars_setc C sR x$|D ] }t jj|�r| j|� P qW x&|D ] }t jj|�r,| jd|� P q,W dS )aW Default verify paths are based on the compiled version of OpenSSL. However, when pyca/cryptography is compiled as a manylinux1 wheel that compiled location can potentially be wrong. So, like Go, we will try a predefined set of paths and attempt to load roots from there. :return: None N)r �path�isfiler� �isdir)r� Z file_pathZdir_pathr� r� rs rs rt r� i s z&Context._fallback_default_verify_pathsc C s$ t |�}tj| j|�}|s t� dS )z� Load a certificate chain from a file. :param certfile: The name of the certificate chain file (``bytes`` or ``unicode``). Must be PEM encoded. :return: None N)r� r� Z"SSL_CTX_use_certificate_chain_filer� r� )r� �certfiler� rs rs rt �use_certificate_chain_file} s z"Context.use_certificate_chain_filec C s8 t |�}t|t�std��tj| j||�}|s4t� dS )ah Load a certificate from a file :param certfile: The name of the certificate file (``bytes`` or ``unicode``). :param filetype: (optional) The encoding of the file, which is either :const:`FILETYPE_PEM` or :const:`FILETYPE_ASN1`. The default is :const:`FILETYPE_PEM`. :return: None zfiletype must be an integerN)r� r� r r� r� Z SSL_CTX_use_certificate_filer� r� )r� r �filetype� use_resultrs rs rt �use_certificate_file� s z Context.use_certificate_filec C s0 t |t�std��tj| j|j�}|s,t� dS )zs Load a certificate from a X509 object :param cert: The X509 object :return: None z cert must be an X509 instanceN)r� r r� r� ZSSL_CTX_use_certificater� �_x509r� )r� r� r rs rs rt �use_certificate� s zContext.use_certificatec C sD t |t�std��tj|j�}tj| j|�}|s@tj|� t � dS )z� Add certificate to chain :param certobj: The X509 certificate object to add to the chain :return: None z certobj must be an X509 instanceN) r� r r� r� �X509_dupr Z SSL_CTX_add_extra_chain_certr� Z X509_freer� )r� Zcertobj�copy� add_resultrs rs rt �add_extra_chain_cert� s z Context.add_extra_chain_certc C s | j d k r| j jt� t� d S )N)r� r� re r� )r� rs rs rt �_raise_passphrase_exception� s z#Context._raise_passphrase_exceptionc C sH t |�}|tkrt}nt|t�s(td��tj| j||�}|sD| j � dS )aR Load a private key from a file :param keyfile: The name of the key file (``bytes`` or ``unicode``) :param filetype: (optional) The encoding of the file, which is either :const:`FILETYPE_PEM` or :const:`FILETYPE_ASN1`. The default is :const:`FILETYPE_PEM`. :return: None zfiletype must be an integerN) r� � _UNSPECIFIEDr r� r r� r� ZSSL_CTX_use_PrivateKey_filer� r )r� Zkeyfiler r rs rs rt �use_privatekey_file� s zContext.use_privatekey_filec C s2 t |t�std��tj| j|j�}|s.| j� dS )zs Load a private key from a PKey object :param pkey: The PKey object :return: None z pkey must be a PKey instanceN)r� r r� r� ZSSL_CTX_use_PrivateKeyr� Z_pkeyr )r� Zpkeyr rs rs rt �use_privatekey� s zContext.use_privatekeyc C s t j| j�st� dS )z� Check if the private key (loaded with :meth:`use_privatekey`) matches the certificate (loaded with :meth:`use_certificate`) :return: :data:`None` (raises :exc:`Error` if something's wrong) N)r� ZSSL_CTX_check_private_keyr� r� )r� rs rs rt �check_privatekey� s zContext.check_privatekeyc C s0 t jtd|��}t|tjk� t j| j|� dS )a% Load the trusted certificates that will be sent to the client. Does not actually imply any of the certificates are trusted; that must be configured separately. :param bytes cafile: The path to a certificates file in PEM format. :return: None r� N)r� ZSSL_load_client_CA_file�_text_to_bytes_and_warnr� r� r� �SSL_CTX_set_client_CA_listr� )r� r� Zca_listrs rs rt �load_client_ca� s zContext.load_client_cac C s* t d|�}ttj| j|t|��dk� dS )aV Set the session id to *buf* within which a session can be reused for this Context object. This is needed when doing session resumption, because there is no way for a stored session to know which Context object it is associated with. :param bytes buf: The session id. :returns: None �bufru N)r r� r� Z SSL_CTX_set_session_id_contextr� r� )r� r rs rs rt �set_session_id s zContext.set_session_idc C s t |t�std��tj| j|�S )a� Set the behavior of the session cache used by all connections using this Context. The previously set mode is returned. See :const:`SESS_CACHE_*` for details about particular modes. :param mode: One or more of the SESS_CACHE_* flags (combine using bitwise or) :returns: The previously set caching mode. .. versionadded:: 0.14 zmode must be an integer)r� r r� r� Z SSL_CTX_set_session_cache_moder� )r� �moders rs rt �set_session_cache_mode s z Context.set_session_cache_modec C s t j| j�S )z� Get the current session cache mode. :returns: The currently used cache mode. .. versionadded:: 0.14 )r� Z SSL_CTX_get_session_cache_moder� )r� rs rs rt �get_session_cache_mode, s z Context.get_session_cache_modec C sL t |t�std��t|�s"td��t|�| _| jj| _tj | j || j� dS )a� et the verification flags for this Context object to *mode* and specify that *callback* should be used for verification callbacks. :param mode: The verify mode, this should be one of :const:`VERIFY_NONE` and :const:`VERIFY_PEER`. If :const:`VERIFY_PEER` is used, *mode* can be OR:ed with :const:`VERIFY_FAIL_IF_NO_PEER_CERT` and :const:`VERIFY_CLIENT_ONCE` to further control the behaviour. :param callback: The Python callback to use. This should take five arguments: A Connection object, an X509 object, and three integer variables, which are in turn potential error number, error depth and return code. *callback* should return True if verification passes and False otherwise. :return: None See SSL_CTX_set_verify(3SSL) for further details. zmode must be an integerzcallback must be callableN) r� r r� r� r� r� r� r� r� ZSSL_CTX_set_verifyr� )r� r r� rs rs rt � set_verify6 s zContext.set_verifyc C s$ t |t�std��tj| j|� dS )z� Set the maximum depth for the certificate chain verification that shall be allowed for this Context object. :param depth: An integer specifying the verify depth :return: None zdepth must be an integerN)r� r r� r� ZSSL_CTX_set_verify_depthr� )r� �depthrs rs rt �set_verify_depthS s zContext.set_verify_depthc C s t j| j�S )z� Retrieve the Context object's verify mode, as set by :meth:`set_verify`. :return: The verify mode )r� ZSSL_CTX_get_verify_moder� )r� rs rs rt �get_verify_mode` s zContext.get_verify_modec C s t j| j�S )z� Retrieve the Context object's verify depth, as set by :meth:`set_verify_depth`. :return: The verify depth )r� ZSSL_CTX_get_verify_depthr� )r� rs rs rt �get_verify_depthi s zContext.get_verify_depthc C sh t |�}tj|d�}|tjkr$t� tj|tj�}tj|tjtjtj�}tj|tj �}tj | j |� dS )z� Load parameters for Ephemeral Diffie-Hellman :param dhfile: The file to load EDH parameters from (``bytes`` or ``unicode``). :return: None � rN) r� r� Z BIO_new_filer� r� r� r� ZBIO_freeZPEM_read_bio_DHparamsZDH_freeZSSL_CTX_set_tmp_dhr� )r� Zdhfile�bioZdhrs rs rt � load_tmp_dhr s zContext.load_tmp_dhc C s t j| j|j� � dS )a Select a curve to use for ECDHE key exchange. :param curve: A curve object to use as returned by either :meth:`OpenSSL.crypto.get_elliptic_curve` or :meth:`OpenSSL.crypto.get_elliptic_curves`. :return: None N)r� ZSSL_CTX_set_tmp_ecdhr� Z _to_EC_KEY)r� Zcurvers rs rt � set_tmp_ecdh� s zContext.set_tmp_ecdhc C sV t d|�}t|t�s td��ttj| j|�dk� t| d�}t|j � dddgk� dS )z� Set the list of ciphers to be used in this context. See the OpenSSL manual for more information (e.g. :manpage:`ciphers(1)`). :param bytes cipher_list: An OpenSSL cipher string. :return: None � cipher_listz"cipher_list must be a byte string.ru NZTLS_AES_256_GCM_SHA384Z TLS_CHACHA20_POLY1305_SHA256ZTLS_AES_128_GCM_SHA256) r r� �bytesr� r� r� ZSSL_CTX_set_cipher_listr� rn �get_cipher_list)r� r+ Ztmpconnrs rs rt �set_cipher_list� s zContext.set_cipher_listc C s� t j� }t|tjk� yjxd|D ]\}t|t�s@tdt|�j f ��t j |j �}t|tjk� t j ||�}|s t j |� t� q W W n tk r� t j|� � Y nX t j| j|� dS )a_ Set the list of preferred client certificate signers for this server context. This list of certificate authorities will be sent to the client when the server requests a client certificate. :param certificate_authorities: a sequence of X509Names. :return: None .. versionadded:: 0.10 z3client CAs must be X509Name objects, not %s objectsN)r� Zsk_X509_NAME_new_nullr� r� r� r� r r� r� rp � X509_NAME_dup�_nameZsk_X509_NAME_push�X509_NAME_freer� r� Zsk_X509_NAME_freer r� )r� Zcertificate_authoritiesZ name_stackZca_namer Z push_resultrs rs rt �set_client_ca_list� s$ zContext.set_client_ca_listc C s2 t |t�std��tj| j|j�}t|dk� dS )ai Add the CA certificate to the list of preferred signers for this context. The list of certificate authorities will be sent to the client when the server requests a client certificate. :param certificate_authority: certificate authority's X509 certificate. :return: None .. versionadded:: 0.10 z.certificate_authority must be an X509 instanceru N)r� r r� r� ZSSL_CTX_add_client_CAr� r r� )r� Zcertificate_authorityr rs rs rt � add_client_ca� s zContext.add_client_cac C s t |t�std��tj| j|�S )aQ Set the timeout for newly created sessions for this Context object to *timeout*. The default value is 300 seconds. See the OpenSSL manual for more information (e.g. :manpage:`SSL_CTX_set_timeout(3)`). :param timeout: The timeout in (whole) seconds :return: The previous session timeout ztimeout must be an integer)r� r r� r� ZSSL_CTX_set_timeoutr� )r� Ztimeoutrs rs rt � set_timeout� s zContext.set_timeoutc C s t j| j�S )z� Retrieve session timeout, as set by :meth:`set_timeout`. The default is 300 seconds. :return: The session timeout )r� ZSSL_CTX_get_timeoutr� )r� rs rs rt � get_timeout� s zContext.get_timeoutc s6 t � �� fdd��}tjd|�| _tj| j| j� dS )a� Set the information callback to *callback*. This function will be called from time to time during SSL handshakes. :param callback: The Python callback to use. This should take three arguments: a Connection object and two integers. The first integer specifies where in the SSL handshake the function was called, and the other the return code from a (possibly failed) internal function call. :return: None c s � t j| ||� d S )N)rn r� )r� �whereZ return_code)r� rs rt r� s z*Context.set_info_callback.<locals>.wrapperz void (*)(const SSL *, int, int)N)r r� r� r� r� ZSSL_CTX_set_info_callbackr� )r� r� r� rs )r� rt �set_info_callback s zContext.set_info_callbackc C s | j S )zw Get the application data (supplied via :meth:`set_app_data()`) :return: The application data )r� )r� rs rs rt � get_app_data s zContext.get_app_datac C s || _ dS )z� Set the application data (will be returned from get_app_data()) :param data: Any Python object :return: None N)r� )r� r� rs rs rt � set_app_data s zContext.set_app_datac C s. t j| j�}|tjkrdS tjt�}||_|S )z� Get the certificate store for the context. This can be used to add "trusted" certificates without using the :meth:`load_verify_locations` method. :return: A X509Store object or None if it does not have one. N)r� ZSSL_CTX_get_cert_storer� r� r� r �__new__Z_store)r� ZstoreZpystorers rs rt �get_cert_store& s zContext.get_cert_storec C s t |t�std��tj| j|�S )z� Add options. Options set before are not cleared! This method should be used with the :const:`OP_*` constants. :param options: The options to add. :return: The new option bitmask. zoptions must be an integer)r� r r� r� ZSSL_CTX_set_optionsr� )r� Zoptionsrs rs rt � set_options7 s zContext.set_optionsc C s t |t�std��tj| j|�S )z� Add modes via bitmask. Modes set before are not cleared! This method should be used with the :const:`MODE_*` constants. :param mode: The mode to add. :return: The new mode bitmask. zmode must be an integer)r� r r� r� ZSSL_CTX_set_moder� )r� r rs rs rt r� D s zContext.set_modec s6 t � �� fdd��}tjd|�| _tj| j| j� dS )a Specify a callback function to be called when clients specify a server name. :param callback: The callback function. It will be invoked with one argument, the Connection instance. .. versionadded:: 0.13 c s � t j| � dS )Nr )rn r� )r� Zalertr� )r� rs rt r� \ s z7Context.set_tlsext_servername_callback.<locals>.wrapperz int (*)(SSL *, int *, void *)N)r r� r� r� r� Z&SSL_CTX_set_tlsext_servername_callbackr� )r� r� r� rs )r� rt � set_tlsext_servername_callbackQ s z&Context.set_tlsext_servername_callbackc C s, t |t�std��ttj| j|�dk� dS )z� Enable support for negotiating SRTP keying material. :param bytes profiles: A colon delimited list of protection profile names, like ``b'SRTP_AES128_CM_SHA1_80:SRTP_AES128_CM_SHA1_32'``. :return: None z profiles must be a byte string.r N)r� r, r� r� r� ZSSL_CTX_set_tlsext_use_srtpr� )r� Zprofilesrs rs rt �set_tlsext_use_srtpf s zContext.set_tlsext_use_srtpc C s, t |�| _| jj| _tj| j| jtj� dS )a� Specify a callback function that will be called when offering `Next Protocol Negotiation <https://technotes.googlecode.com/git/nextprotoneg.html>`_ as a server. :param callback: The callback function. It will be invoked with one argument, the :class:`Connection` instance. It should return a list of bytestrings representing the advertised protocols, like ``[b'http/1.1', b'spdy/2']``. .. versionadded:: 0.15 N) r� r� r� r� r� Z%SSL_CTX_set_next_protos_advertised_cbr� r� r� )r� r� rs rs rt �set_npn_advertise_callbacku s z"Context.set_npn_advertise_callbackc C s, t |�| _| jj| _tj| j| jtj� dS )a� Specify a callback function that will be called when a server offers Next Protocol Negotiation options. :param callback: The callback function. It will be invoked with two arguments: the Connection, and a list of offered protocols as bytestrings, e.g. ``[b'http/1.1', b'spdy/2']``. It should return one of those bytestrings, the chosen protocol. .. versionadded:: 0.15 N) r� r� r� r� r� Z SSL_CTX_set_next_proto_select_cbr� r� r� )r� r� rs rs rt �set_npn_select_callback� s z Context.set_npn_select_callbackc C s> dj tjdd� |D ���}tjd|�}tj| j|t|�� dS )a� Specify the protocols that the client is prepared to speak after the TLS connection has been negotiated using Application Layer Protocol Negotiation. :param protos: A list of the protocols to be offered to the server. This list should be a Python list of bytestrings representing the protocols to offer, e.g. ``[b'http/1.1', b'spdy/2']``. r� c s s | ]}t t|��|fV qd S )N)r r� )r� r� rs rs rt r� � s z*Context.set_alpn_protos.<locals>.<genexpr>zunsigned char[]N) r� r r� r� r� r� ZSSL_CTX_set_alpn_protosr� r� )r� r� r� � input_strrs rs rt �set_alpn_protos� s zContext.set_alpn_protosc C s, t |�| _| jj| _tj| j| jtj� dS )a� Specify a callback function that will be called on the server when a client offers protocols using ALPN. :param callback: The callback function. It will be invoked with two arguments: the Connection, and a list of offered protocols as bytestrings, e.g ``[b'http/1.1', b'spdy/2']``. It should return one of those bytestrings, the chosen protocol. N) r� r� r� r� r� ZSSL_CTX_set_alpn_select_cbr� r� r� )r� r� rs rs rt �set_alpn_select_callback� s z Context.set_alpn_select_callbackc C sh || _ |j| _|dkr tj| _n tj|�| _tj| j | j�}t |dk� tj | j | j�}t |dk� dS )z� This internal helper does the common work for ``set_ocsp_server_callback`` and ``set_ocsp_client_callback``, which is almost all of it. Nru ) r� r� r� r� r� r� Z new_handler� Z SSL_CTX_set_tlsext_status_cbr� r� Z SSL_CTX_set_tlsext_status_arg)r� �helperr� �rcrs rs rt �_set_ocsp_callback� s zContext._set_ocsp_callbackc C s t |�}| j||� dS )a� Set a callback to provide OCSP data to be stapled to the TLS handshake on the server side. :param callback: The callback function. It will be invoked with two arguments: the Connection, and the optional arbitrary data you have provided. The callback must return a bytestring that contains the OCSP data to staple to the handshake. If no OCSP data is available for this connection, return the empty bytestring. :param data: Some opaque data that will be passed into the callback function when called. This can be used to avoid needing to do complex data lookups or to keep track of what context is being used. This parameter is optional. N)r� rF )r� r� r� rD rs rs rt �set_ocsp_server_callback� s z Context.set_ocsp_server_callbackc C s t |�}| j||� dS )a� Set a callback to validate OCSP data stapled to the TLS handshake on the client side. :param callback: The callback function. It will be invoked with three arguments: the Connection, a bytestring containing the stapled OCSP assertion, and the optional arbitrary data you have provided. The callback must return a boolean that indicates the result of validating the OCSP data: ``True`` if the OCSP data is valid and the certificate can be trusted, or ``False`` if either the OCSP data is invalid or the certificate has been revoked. :param data: Some opaque data that will be passed into the callback function when called. This can be used to avoid needing to do complex data lookups or to keep track of what context is being used. This parameter is optional. N)r� rF )r� r� r� rD rs rs rt �set_ocsp_client_callback� s z Context.set_ocsp_client_callback)N)N)N)N)?rp rq rr r r% r& r' r( r) r* r� �dict�itemsr� r� r� r� r r� r� r r r r r r r r r r r r r r! r" r$ r% r& r) r* r. r2 r3 r4 r5 r7 r8 r9 r; r< r� � _requires_snir= r> � _requires_npnr? r@ �_requires_alpnrB rC rF rG rH rs rs rs rt rm � sn . 1 % z4ContextType has been deprecated, use Context insteadc @ s e Zd ZdZe� Zdxdd�Zdd� Zdd� Zd d � Z d d � Z e d d� �Z e dd� �Z dd� Zdydd�ZeZdzdd�Zd{dd�ZeZd|dd�Zd d � Zd d � Zd d!� Zd"d#� Zd$d%� Zd&d'� Zd(d)� Zd*d+� Z d,d-� Z d.d/� Z d0d1� Z d2d3� Z d4d5� Z!d6d7� Z"d8d9� Z#d:d;� Z$d<d=� Z%d>d?� Z&d@dA� Z'dBdC� Z(dDdE� Z)dFdG� Z*dHdI� Z+d}dJdK�Z,dLdM� Z-dNdO� Z.dPdQ� Z/dRdS� Z0dTdU� Z1dVdW� Z2dXdY� Z3dZd[� Z4d\d]� Z5d^d_� Z6d`da� Z7dbdc� Z8ddde� Z9dfdg� Z:dhdi� Z;djdk� Z<dldm� Z=dndo� Z>e?dpdq� �Z@eAdrds� �ZBeAdtdu� �ZCdvdw� ZDdS )~rn z Nc C s t |t�std��tj|j�}tj|tj�| _ tj | j tj � || _d| _ d| _ d| _d| _| | j| j < |dkr�d| _tjtj� �| _t| jtjk� tjtj� �| _t| jtjk� tj| j | j| j� n2d| _d| _|| _tj| j t| j��}t|dk� dS )z� Create a new Connection object, using the given OpenSSL.SSL.Context instance and socket. :param context: An SSL Context to use for this connection :param socket: The socket to use for transport layer z"context must be a Context instanceNru )r� rm r� r� ZSSL_newr� r� r� ZSSL_free�_sslZ SSL_set_modeZSSL_MODE_AUTO_RETRYr� r� r� r� r� �_socketZBIO_newZ BIO_s_mem� _into_sslr� r� � _from_sslZ SSL_set_bioZ SSL_set_fdr� )r� r� �socketr� r rs rs rt r� s0 zConnection.__init__c C s0 | j dkr td| jj|f ��n t| j |�S dS )zy Look up attributes on the wrapped socket object if they are not found on the Connection object. Nz!'%s' object has no attribute '%s')rO r� � __class__rp r� )r� r� rs rs rt � __getattr__< s zConnection.__getattr__c C sT | j jd k r| j jj� | j jd k r0| j jj� | j jd k rH| j jj� | j jd k r`| j jj� | j jd k rx| j jj� tj||�}|tj kr�t � �n�|tj kr�t � �n�|tj kr�t� �n�|tjkr�t� �n�|tjk�r<tj� dk�r4|dk �r(tdk�rtj� d }ntj}|dk�r(t|tj|���tdd��nt� n|tjk�rJnt� d S )Nr Zwin32ru zUnexpected EOFr� ) r� r� r� r� r� r� r� r� Z SSL_get_errorZSSL_ERROR_WANT_READrf ZSSL_ERROR_WANT_WRITErg ZSSL_ERROR_ZERO_RETURNri ZSSL_ERROR_WANT_X509_LOOKUPrh ZSSL_ERROR_SYSCALLZERR_peek_errorr r� Z getwinerror�errnorj r r r� ZSSL_ERROR_NONE)r� r� r� r� rU rs rs rt �_raise_ssl_errorH s@ zConnection._raise_ssl_errorc C s | j S )zh Retrieve the :class:`Context` object associated with this :class:`Connection`. )r� )r� rs rs rt � get_contextq s zConnection.get_contextc C s, t |t�std��tj| j|j� || _dS )z� Switch this connection to a new session context. :param context: A :class:`Context` instance giving the new session context to use. z"context must be a Context instanceN)r� rm r� r� ZSSL_set_SSL_CTXrN r� )r� r� rs rs rt � set_contextx s zConnection.set_contextc C s( t j| jt j�}|tjkr dS tj|�S )z� Retrieve the servername extension value if provided in the client hello message, or None if there wasn't one. :return: A byte string giving the server name or :data:`None`. .. versionadded:: 0.13 N)r� ZSSL_get_servernamerN ZTLSEXT_NAMETYPE_host_namer� r� r� )r� r� rs rs rt �get_servername� s zConnection.get_servernamec C s6 t |t�std��nd|kr$td��tj| j|� dS )z� Set the value of the servername extension to send in the client hello. :param name: A byte string giving the name. .. versionadded:: 0.13 zname must be a byte string� z name must not contain NUL byteN)r� r, r� r� ZSSL_set_tlsext_host_namerN )r� r� rs rs rt �set_tlsext_host_name� s z Connection.set_tlsext_host_namec C s t j| j�S )z� Get the number of bytes that can be safely read from the SSL buffer (**not** the underlying transport buffer). :return: The number of bytes available in the receive buffer. )r� Z SSL_pendingrN )r� rs rs rt �pending� s zConnection.pendingr c C sz t d|�}t|t�r |j� }t|t�r.t|�}t|t�s@td��t|�dkrTt d��t j | j |t|��}| j | j |� |S )a� Send data on the connection. NOTE: If you get one of the WantRead, WantWrite or WantX509Lookup exceptions on this, you have to call the method again with the SAME buffer. :param buf: The string, buffer or memoryview to send :param flags: (optional) Included for compatibility with the socket API, the value is ignored :return: The number of bytes written r z0data must be a memoryview, buffer or byte stringi���z,Cannot send more than 2**31-1 bytes at once.)r r� � memoryview�tobytesro �strr, r� r� r� r� � SSL_writerN rV )r� r �flagsr� rs rs rt �send� s zConnection.sendc C s� t d|�}t|t�r |j� }t|t�r.t|�}t|t�s@td��t|�}d}t j d|�}x@|r�t j | j || t|d��}| j| j |� ||7 }||8 }qZW dS )a� Send "all" data on the connection. This calls send() repeatedly until all data is sent. If an error occurs, it's impossible to tell how much data has been sent. :param buf: The string, buffer or memoryview to send :param flags: (optional) Included for compatibility with the socket API, the value is ignored :return: The number of bytes written r z/buf must be a memoryview, buffer or byte stringr zchar[]i���N)r r� r] r^ ro r_ r, r� r� r� r� r� r` rN �minrV )r� r ra Z left_to_sendZ total_sentr� r� rs rs rt �sendall� s$ zConnection.sendallc C s` t d|�}|dk r.|tj@ r.tj| j||�}ntj| j||�}| j| j|� tj ||�dd� S )a Receive data on the connection. :param bufsiz: The maximum number of bytes to read :param flags: (optional) The only supported flag is ``MSG_PEEK``, all other flags are ignored. :return: The string read from the Connection zchar[]N) �_no_zero_allocatorrR �MSG_PEEKr� �SSL_peekrN �SSL_readrV r� r� )r� �bufsizra r r� rs rs rt �recv� s zConnection.recvc C s� |dkrt |�}nt|t |��}td|�}|dk rN|tj@ rNtj| j||�}ntj| j||�}| j | j|� t t j ||��|d|�< |S )ae Receive data on the connection and copy it directly into the provided buffer, rather than creating a new string. :param buffer: The buffer to copy into. :param nbytes: (optional) The maximum number of bytes to read into the buffer. If not present, defaults to the size of the buffer. If larger than the size of the buffer, is reduced to the size of the buffer. :param flags: (optional) The only supported flag is ``MSG_PEEK``, all other flags are ignored. :return: The number of bytes read into the buffer. Nzchar[]) r� rc re rR rf r� rg rN rh rV r] r� r� )r� r� �nbytesra r r� rs rs rt � recv_into s zConnection.recv_intoc C sV t j|�rLt j|�r t� �qRt j|�r.t� �qRt j|�rBtd��qRtd��nt� d S )N�BIO_should_io_specialzunknown bio failure) r� ZBIO_should_retryZBIO_should_readrf ZBIO_should_writerg rm r� r� )r� r( r� rs rs rt �_handle_bio_errors( s z Connection._handle_bio_errorsc C sh | j dkrtd��t|t�s$td��td|�}tj| j ||�}|dkrT| j| j |� tj ||�dd� S )a� If the Connection was created with a memory BIO, this method can be used to read bytes from the write end of that memory BIO. Many Connection methods will add bytes which must be read in this manner or the buffer will eventually fill up and the Connection will be able to take no further actions. :param bufsiz: The maximum number of bytes to read :return: The string read. Nz Connection sock was not Nonezbufsiz must be an integerzchar[]r ) rQ r� r� r re r� ZBIO_readrn r� r� )r� ri r r� rs rs rt �bio_read: s zConnection.bio_readc C sJ t d|�}| jdkr td��tj| j|t|��}|dkrF| j| j|� |S )aj If the Connection was created with a memory BIO, this method can be used to add bytes to the read end of that memory BIO. The Connection can then read the bytes (for example, in response to a call to :meth:`recv`). :param buf: The string to put into the memory BIO. :return: The number of bytes written r Nz Connection sock was not Noner )r rP r� r� Z BIO_writer� rn )r� r r� rs rs rt � bio_writeR s zConnection.bio_writec C s$ | j � s ttj| j�dk� dS dS )z� Renegotiate the session. :return: True if the renegotiation can be started, False otherwise :rtype: bool ru TF)�renegotiate_pendingr� r� ZSSL_renegotiaterN )r� rs rs rt � renegotiatef s zConnection.renegotiatec C s t j| j�}| j| j|� dS )a Perform an SSL handshake (usually called after :meth:`renegotiate` or one of :meth:`set_accept_state` or :meth:`set_accept_state`). This can raise the same exceptions as :meth:`send` and :meth:`recv`. :return: None. N)r� ZSSL_do_handshakerN rV )r� r� rs rs rt � do_handshaker s zConnection.do_handshakec C s t j| j�dkS )z� Check if there's a renegotiation in progress, it will return False once a renegotiation is finished. :return: Whether there's a renegotiation in progress :rtype: bool ru )r� ZSSL_renegotiate_pendingrN )r� rs rs rt rq } s z Connection.renegotiate_pendingc C s t j| j�S )z� Find out the total number of renegotiations. :return: The number of renegotiations. :rtype: int )r� ZSSL_total_renegotiationsrN )r� rs rs rt �total_renegotiations� s z Connection.total_renegotiationsc C s t j| j� | jj|�S )a4 Call the :meth:`connect` method of the underlying socket and set up SSL on the socket, using the :class:`Context` object supplied to this :class:`Connection` object at creation. :param addr: A remote address :return: What the socket's connect method returns )r� �SSL_set_connect_staterN rO �connect)r� �addrrs rs rt rv � s zConnection.connectc C s | j j}| j� ||�S )a� Call the :meth:`connect_ex` method of the underlying socket and set up SSL on the socket, using the Context object supplied to this Connection object at creation. Note that if the :meth:`connect_ex` method of the socket doesn't return 0, SSL won't be initialized. :param addr: A remove address :return: What the socket's connect_ex method returns )rO � connect_ex�set_connect_state)r� rw rx rs rs rt rx � s zConnection.connect_exc C s* | j j� \}}t| j|�}|j� ||fS )a� Call the :meth:`accept` method of the underlying socket and set up SSL on the returned socket, using the Context object supplied to this :class:`Connection` object at creation. :return: A *(conn, addr)* pair where *conn* is the new :class:`Connection` object created, and *address* is as returned by the socket's :meth:`accept`. )rO �acceptrn r� �set_accept_state)r� Zclientrw r� rs rs rt rz � s zConnection.acceptc C s$ | j dkrtd��tj| jd� dS )z� If the Connection was created with a memory BIO, this method can be used to indicate that *end of file* has been reached on the read end of that memory BIO. :return: None Nz Connection sock was not Noner )rQ r� r� ZBIO_set_mem_eof_returnrP )r� rs rs rt � bio_shutdown� s zConnection.bio_shutdownc C s8 t j| j�}|dk r$| j| j|� n|dkr0dS dS dS )aQ Send the shutdown message to the Connection. :return: True if the shutdown completed successfully (i.e. both sides have sent closure alerts), False otherwise (in which case you call :meth:`recv` or :meth:`send` when the connection becomes readable/writeable). r TFN)r� Z SSL_shutdownrN rV )r� r� rs rs rt �shutdown� s zConnection.shutdownc C sF g }x<t � D ]2}tj| j|�}|tjkr*P |jttj|��� q W |S )z� Retrieve the list of ciphers used by the Connection object. :return: A list of native cipher strings. ) r r� ZSSL_get_cipher_listrN r� r� r� �_nativer� )r� Zciphers�ir� rs rs rt r- � s zConnection.get_cipher_listc C s� t j| j�}|tjkrg S g }x^tt j|��D ]L}t j||�}t j|�}t |tjk� t j t �}tj |t j �|_|j|� q.W |S )a� Get CAs whose certificates are suggested for client authentication. :return: If this is a server connection, the list of certificate authorities that will be sent or has been sent to the client, as controlled by this :class:`Connection`'s :class:`Context`. If this is a client connection, the list will be empty until the connection with the server is established. .. versionadded:: 0.10 )r� ZSSL_get_client_CA_listrN r� r� �rangeZsk_X509_NAME_numZsk_X509_NAME_valuer/ r� r r: r� r1 r0 r� )r� Zca_namesr� r r� r Zpynamers rs rt �get_client_ca_list� s z Connection.get_client_ca_listc O s t d��dS )z� The makefile() method is not implemented, since there is no dup semantics for SSL connections :raise: NotImplementedError z1Cannot make file object of OpenSSL.SSL.ConnectionN)r� )r� r� r� rs rs rt �makefile s zConnection.makefilec C s | j S )zr Retrieve application data as set by :meth:`set_app_data`. :return: The application data )r� )r� rs rs rt r8 s zConnection.get_app_datac C s || _ dS )zg Set application data :param data: The application data :return: None N)r� )r� r� rs rs rt r9 s zConnection.set_app_datac C s t j| j�S )z� Get the shutdown state of the Connection. :return: The shutdown state, a bitvector of SENT_SHUTDOWN, RECEIVED_SHUTDOWN. )r� ZSSL_get_shutdownrN )r� rs rs rt � get_shutdown s zConnection.get_shutdownc C s$ t |t�std��tj| j|� dS )z� Set the shutdown state of the Connection. :param state: bitvector of SENT_SHUTDOWN, RECEIVED_SHUTDOWN. :return: None zstate must be an integerN)r� r r� r� ZSSL_set_shutdownrN )r� �staters rs rt � set_shutdown& s zConnection.set_shutdownc C s t jtj| j��S )z� Retrieve a verbose string detailing the state of the Connection. :return: A string representing the state :rtype: bytes )r� r� r� ZSSL_state_string_longrN )r� rs rs rt �get_state_string2 s zConnection.get_state_stringc C sf t j| j�}|tjkrdS t j| jtjd�}|dks8t�td|�}t j| j||� tj||�dd� S )z� Retrieve the random value used with the server hello message. :return: A string representing the state Nr zunsigned char[]) r� �SSL_get_sessionrN r� r� ZSSL_get_server_random�AssertionErrorre r� )r� �sessionr� �outprs rs rt � server_random; s zConnection.server_randomc C sf t j| j�}|tjkrdS t j| jtjd�}|dks8t�td|�}t j| j||� tj||�dd� S )z� Retrieve the random value used with the client hello message. :return: A string representing the state Nr zunsigned char[]) r� r� rN r� r� ZSSL_get_client_randomr� re r� )r� r� r� r� rs rs rt � client_randomJ s zConnection.client_randomc C sb t j| j�}|tjkrdS t j|tjd�}|dks6t�td|�}t j|||� tj||�dd� S )zz Retrieve the value of the master key for this session. :return: A string representing the state Nr zunsigned char[]) r� r� rN r� r� ZSSL_SESSION_get_master_keyr� re r� )r� r� r� r� rs rs rt � master_keyZ s zConnection.master_keyc C sn t d|�}tj}d}d}|dk r0|}t|�}d}tj| j|||t|�|||�}t|dk� tj||�dd� S )aH Obtain keying material for application use. :param: label - a disambiguating label string as described in RFC 5705 :param: olen - the length of the exported key material in bytes :param: context - a per-association context value :return: the exported key material bytes or None zunsigned char[]r Nru ) re r� r� r� r� ZSSL_export_keying_materialrN r� r� ) r� ZlabelZolenr� r� Z context_bufZ context_lenZ use_context�successrs rs rt �export_keying_materialj s z!Connection.export_keying_materialc O s | j j||�S )z� Call the :meth:`shutdown` method of the underlying socket. See :manpage:`shutdown(2)`. :return: What the socket's shutdown() method returns )rO r} )r� r� r� rs rs rt � sock_shutdown� s zConnection.sock_shutdownc C s. t j| j�}|tjkr*t j|� tj|�S dS )za Retrieve the local certificate (if any) :return: The local certificate N)r� ZSSL_get_certificaterN r� r� r� r r� )r� r� rs rs rt �get_certificate� s zConnection.get_certificatec C s$ t j| j�}|tjkr tj|�S dS )zi Retrieve the other side's certificate (if any) :return: The peer's certificate N)r� ZSSL_get_peer_certificaterN r� r� r r� )r� r� rs rs rt �get_peer_certificate� s z Connection.get_peer_certificatec C s` t j| j�}|tjkrdS g }x<tt j|��D ]*}t jt j||��}t j |�}|j |� q.W |S )z� Retrieve the other side's certificate (if any) :return: A list of X509 instances giving the peer's certificate chain, or None if it does not have one. N) r� ZSSL_get_peer_cert_chainrN r� r� r� Z sk_X509_numr Z sk_X509_valuer r� r� )r� Z cert_stackr� r r� Zpycertrs rs rt �get_peer_cert_chain� s z Connection.get_peer_cert_chainc C s t j| j�S )z� Checks if more data has to be read from the transport layer to complete an operation. :return: True iff more data has to be read )r� Z SSL_want_readrN )r� rs rs rt � want_read� s zConnection.want_readc C s t j| j�S )z� Checks if there is data to write to the transport layer to complete an operation. :return: True iff there is data to write )r� ZSSL_want_writerN )r� rs rs rt � want_write� s zConnection.want_writec C s t j| j� dS )z� Set the connection to work in server mode. The handshake will be handled automatically by read/write. :return: None N)r� ZSSL_set_accept_staterN )r� rs rs rt r{ � s zConnection.set_accept_statec C s t j| j� dS )z� Set the connection to work in client mode. The handshake will be handled automatically by read/write. :return: None N)r� ru rN )r� rs rs rt ry � s z Connection.set_connect_statec C s8 t j| j�}|tjkrdS tjt�}tj|t j�|_ |S )z� Returns the Session currently used. :return: An instance of :class:`OpenSSL.SSL.Session` or :obj:`None` if no session exists. .. versionadded:: 0.14 N) r� ZSSL_get1_sessionrN r� r� rl r: r� ZSSL_SESSION_free�_session)r� r� Z pysessionrs rs rt � get_session� s zConnection.get_sessionc C s0 t |t�std��tj| j|j�}|s,t� dS )z� Set the session to be used when the TLS/SSL connection is established. :param session: A Session instance representing the session to use. :returns: None .. versionadded:: 0.14 z"session must be a Session instanceN)r� rl r� r� ZSSL_set_sessionrN r� r� )r� r� r� rs rs rt � set_session� s zConnection.set_sessionc C sR t jdd�}|| j|d�}|dkr&dS td|�}|| j||� t j||�dd� S )a� Helper to implement :meth:`get_finished` and :meth:`get_peer_finished`. :param function: Either :data:`SSL_get_finished`: or :data:`SSL_get_peer_finished`. :return: :data:`None` if the desired message has not yet been received, otherwise the contents of the message. :rtype: :class:`bytes` or :class:`NoneType` zchar[]r N)r� r� rN re r� )r� Zfunction�emptyr� r rs rs rt �_get_finished_message� s z Connection._get_finished_messagec C s | j tj�S )a Obtain the latest TLS Finished message that we sent. :return: The contents of the message or :obj:`None` if the TLS handshake has not yet completed. :rtype: :class:`bytes` or :class:`NoneType` .. versionadded:: 0.15 )r� r� ZSSL_get_finished)r� rs rs rt � get_finished s zConnection.get_finishedc C s | j tj�S )a! Obtain the latest TLS Finished message that we received from the peer. :return: The contents of the message or :obj:`None` if the TLS handshake has not yet completed. :rtype: :class:`bytes` or :class:`NoneType` .. versionadded:: 0.15 )r� r� ZSSL_get_peer_finished)r� rs rs rt �get_peer_finished( s z Connection.get_peer_finishedc C s8 t j| j�}|tjkrdS tjt j|��}|jd�S dS )a Obtain the name of the currently used cipher. :returns: The name of the currently used cipher or :obj:`None` if no connection has been established. :rtype: :class:`unicode` or :class:`NoneType` .. versionadded:: 0.15 Nzutf-8)r� �SSL_get_current_cipherrN r� r� r� ZSSL_CIPHER_get_namer� )r� �cipherr� rs rs rt �get_cipher_name4 s zConnection.get_cipher_namec C s, t j| j�}|tjkrdS t j|tj�S dS )a. Obtain the number of secret bits of the currently used cipher. :returns: The number of secret bits of the currently used cipher or :obj:`None` if no connection has been established. :rtype: :class:`int` or :class:`NoneType` .. versionadded:: 0.15 N)r� r� rN r� r� ZSSL_CIPHER_get_bits)r� r� rs rs rt �get_cipher_bitsE s zConnection.get_cipher_bitsc C s8 t j| j�}|tjkrdS tjt j|��}|jd�S dS )a% Obtain the protocol version of the currently used cipher. :returns: The protocol name of the currently used cipher or :obj:`None` if no connection has been established. :rtype: :class:`unicode` or :class:`NoneType` .. versionadded:: 0.15 Nzutf-8)r� r� rN r� r� r� ZSSL_CIPHER_get_versionr� )r� r� �versionrs rs rt �get_cipher_versionU s z Connection.get_cipher_versionc C s t jtj| j��}|jd�S )a> Retrieve the protocol version of the current connection. :returns: The TLS version of the current connection, for example the value for TLS 1.2 would be ``TLSv1.2``or ``Unknown`` for connections that were not successfully established. :rtype: :class:`unicode` zutf-8)r� r� r� ZSSL_get_versionrN r� )r� r� rs rs rt �get_protocol_version_namef s z$Connection.get_protocol_version_namec C s t j| j�}|S )a Retrieve the SSL or TLS protocol version of the current connection. :returns: The TLS version of the current connection. For example, it will return ``0x769`` for connections made over TLS version 1. :rtype: :class:`int` )r� Z SSL_versionrN )r� r� rs rs rt �get_protocol_versionr s z Connection.get_protocol_versionc C s@ t jd�}t jd�}tj| j||� t j|d |d �dd� S )z� Get the protocol that was negotiated by NPN. :returns: A bytestring of the protocol name. If no protocol has been negotiated yet, returns an empty string. .. versionadded:: 0.15 zunsigned char **zunsigned int *r N)r� r� r� Z SSL_get0_next_proto_negotiatedrN r� )r� r� �data_lenrs rs rt �get_next_proto_negotiated} s z$Connection.get_next_proto_negotiatedc C s> dj tjdd� |D ���}tjd|�}tj| j|t|�� dS )ah Specify the client's ALPN protocol list. These protocols are offered to the server during protocol negotiation. :param protos: A list of the protocols to be offered to the server. This list should be a Python list of bytestrings representing the protocols to offer, e.g. ``[b'http/1.1', b'spdy/2']``. r� c s s | ]}t t|��|fV qd S )N)r r� )r� r� rs rs rt r� � s z-Connection.set_alpn_protos.<locals>.<genexpr>zunsigned char[]N) r� r r� r� r� r� ZSSL_set_alpn_protosrN r� )r� r� r� rA rs rs rt rB � s zConnection.set_alpn_protosc C sH t jd�}t jd�}tj| j||� |s,dS t j|d |d �dd� S )z� Get the protocol that was negotiated by ALPN. :returns: A bytestring of the protocol name. If no protocol has been negotiated yet, returns an empty string. zunsigned char **zunsigned int *r� r N)r� r� r� ZSSL_get0_alpn_selectedrN r� )r� r� r� rs rs rt �get_alpn_proto_negotiated� s z$Connection.get_alpn_proto_negotiatedc C s t j| jt j�}t|dk� dS )a Called to request that the server sends stapled OCSP data, if available. If this is not called on the client side then the server will not send OCSP data. Should be used in conjunction with :meth:`Context.set_ocsp_client_callback`. ru N)r� ZSSL_set_tlsext_status_typerN ZTLSEXT_STATUSTYPE_ocspr� )r� rE rs rs rt � request_ocsp� s zConnection.request_ocsp)N)r )r )N)NN)N)Erp rq rr r r r� r� rT rV rW rX rK rY r[ r\ rb �writerd rj �readrl rn ro rp rr rs rq rt rv rx rz r| r} r- r� r� r8 r9 r� r� r� r� r� r� r� r� r� r� r� r� r� r{ ry r� r� r� r� r� r� r� r� r� r� rL r� rM rB r� r� rs rs rs rt rn s| 6 ) $ % " z:ConnectionType has been deprecated, use Connection instead)�r rR �sysr � functoolsr r � itertoolsr r �weakrefr rU r Zcryptography.utilsr Zsixr r� r r r Z OpenSSL._utilr r r Z_exception_from_error_queuer r� r r� r Z _make_assertr r~ r r� r r r re ZOpenSSL.cryptor r r r r r �__all__r� ro � NameError�objectr r r r r! r" ZSSL_SENT_SHUTDOWNr# ZSSL_RECEIVED_SHUTDOWNr$ r% r& r' r( r) r* ZSSL_OP_NO_SSLv2r+ ZSSL_OP_NO_SSLv3r, ZSSL_OP_NO_TLSv1r- ZSSL_OP_NO_TLSv1_1r. ZSSL_OP_NO_TLSv1_2r/ ZSSL_MODE_RELEASE_BUFFERSr0 ZSSL_OP_SINGLE_DH_USEr1 ZSSL_OP_SINGLE_ECDH_USEr2 ZSSL_OP_EPHEMERAL_RSAr3 Z SSL_OP_MICROSOFT_SESS_ID_BUGr4 Z SSL_OP_NETSCAPE_CHALLENGE_BUGr5 Z'SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUGr6 Z"SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUGr7 Z!SSL_OP_MICROSOFT_BIG_SSLV3_BUFFERr8 Z SSL_OP_MSIE_SSLV2_RSA_PADDINGr9 Z SSL_OP_SSLEAY_080_CLIENT_DH_BUGr: ZSSL_OP_TLS_D5_BUGr; Z SSL_OP_TLS_BLOCK_PADDING_BUGr< Z"SSL_OP_DONT_INSERT_EMPTY_FRAGMENTSr= Z SSL_OP_CIPHER_SERVER_PREFERENCEr> ZSSL_OP_TLS_ROLLBACK_BUGr? ZSSL_OP_PKCS1_CHECK_1r@ ZSSL_OP_PKCS1_CHECK_2rA ZSSL_OP_NETSCAPE_CA_DN_BUGrB Z&SSL_OP_NETSCAPE_DEMO_CIPHER_CHANGE_BUGrC ZSSL_OP_NO_COMPRESSIONrD ZSSL_OP_NO_QUERY_MTUrE ZSSL_OP_COOKIE_EXCHANGErF ZSSL_OP_NO_TICKETrG Z SSL_OP_ALLrH ZSSL_VERIFY_PEERrI Z SSL_VERIFY_FAIL_IF_NO_PEER_CERTrJ ZSSL_VERIFY_CLIENT_ONCErK ZSSL_VERIFY_NONErL ZSSL_SESS_CACHE_OFFrM ZSSL_SESS_CACHE_CLIENTrN ZSSL_SESS_CACHE_SERVERrO ZSSL_SESS_CACHE_BOTHrP Z SSL_SESS_CACHE_NO_AUTO_CLEARrQ Z!SSL_SESS_CACHE_NO_INTERNAL_LOOKUPrR Z SSL_SESS_CACHE_NO_INTERNAL_STORErS ZSSL_SESS_CACHE_NO_INTERNALrT rU rV rW ZCryptography_HAS_SSL_STr{ r| r} r~ �extendrX rY rZ r[ r\ r] r^ r_ r` ra rb rc rd r� r� r� r� r� re r� r� rf rg rh ri rj r� r� r� r� r� r� r� r� rk r� Z Cryptography_HAS_NEXTPROTONEGrL ZCryptography_HAS_ALPNrM Z Cryptography_HAS_TLSEXT_HOSTNAMErK rl rm rp �DeprecationWarningZ ContextTypern ZConnectionTypeZSSL_library_initrs rs rs rt �<module> s� , ')13C; Z I