DY~1@sXddlZddlZddlmZddlmZmZddlmZm Z ddl m Z ddl m Z ddlmZddlmZmZmZmZdd lmZmZmZmZmZ m!Z"m#Z$m%Z&m'Z(dd l)m*Z*m+Z+m,Z,m-Z-m.Z.m/Z/y e0Z1Wn(e2k rHGd d d e3Z1YnXy e4Z5Wn(e2k r}Gd dde3Z5YnXej6Z6ej7Z7ej8Z8ej9Z9ej:Z:ej;Z;ej<Z=ej>Z?dZ@dZAdZBdZCdZDdZEejFZGejHZIejJZKejLZMejNZOejPZQejRZSejTZUejVZWejXZYejZZ[ej\Z]ej^Z_ej`ZaejbZcejdZeejfZgejhZiejjZkejlZmejnZoejpZqejrZsejtZuejvZwejxZyejzZ{ej|Z}ej~ZejZejZejZejZejZejZejZejZejZejZejZejZejZejZejZejZejrejZejZejZejZejZejZejZejZejZejZejZejZejZejZejZejZejZdddddgZdgZdZdZGdddeZeeeZe eZGdd d eZGd!d"d"eZGd#d$d$eZGd%d&d&eZGd'd(d(eZGd)d*d*e3ZGd+d,d,eZGd-d.d.eZGd/d0d0eZGd1d2d2eZGd3d4d4eZGd5d6d6eZd7d8Zd9d:Zd;d<Zeejd=Zeejd>Zeejd?ZGd@dAdAe3ZGdBdCdCe3ZeeedDeZGdEdFdFe3ZeeedGeZejdS)HN)platform)wrapspartial)countchain)WeakValueDictionary) errorcode) deprecated) binary_type integer_typesint2byte indexbytes) UNSPECIFIEDexception_from_error_queueffilib make_assertnative path_stringtext_to_bytes_and_warnno_zero_allocator) FILETYPE_PEM_PassphraseHelperPKeyX509NameX509 X509Storec@seZdZdS) _memoryviewN)__name__ __module__ __qualname__r!r!-/usr/lib/python3/dist-packages/OpenSSL/SSL.pyr!s rc@seZdZdS)_bufferN)rrr r!r!r!r"r#'s r#z"/etc/ssl/certs/ca-certificates.crtz /etc/pki/tls/certs/ca-bundle.crtz/etc/ssl/ca-bundle.pemz/etc/pki/tls/cacert.pemz1/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pemz/etc/ssl/certss$/opt/pyca/cryptography/openssl/certss'/opt/pyca/cryptography/openssl/cert.pemc@seZdZdZdS)Errorz4 An error occurred in an `OpenSSL.SSL` API. N)rrr __doc__r!r!r!r"r*s r*c@seZdZdS) WantReadErrorN)rrr r!r!r!r"r,s r,c@seZdZdS)WantWriteErrorN)rrr r!r!r!r"r-s r-c@seZdZdS)WantX509LookupErrorN)rrr r!r!r!r"r.s r.c@seZdZdS)ZeroReturnErrorN)rrr r!r!r!r"r/s r/c@seZdZdS) SysCallErrorN)rrr r!r!r!r"r0s r0c@s.eZdZdZddZddZdS)_CallbackExceptionHelpera A base class for wrapper classes that allow for intelligent exception handling in OpenSSL callbacks. :ivar list _problems: Any exceptions that occurred while executing in a context where they could not be raised in the normal way. Typically this is because OpenSSL has called into some Python code and requires a return value. The exceptions are saved to be raised later when it is possible to do so. cCs g|_dS)N) _problems)selfr!r!r"__init__sz!_CallbackExceptionHelper.__init__c Cs?|jr;y tWntk r(YnX|jjddS)z Raise an exception from the OpenSSL error queue or that was previously captured whe running a callback. rN)r2_raise_current_errorr*pop)r3r!r!r"raise_if_problems    z)_CallbackExceptionHelper.raise_if_problemN)rrr r+r4r7r!r!r!r"r1s  r1c@s"eZdZdZddZdS) _VerifyHelperz^ Wrap a callback such that it can be used as a certificate verification callback. csGtjtfdd}tjd|_dS)Nc stjt}tj||_tj|}tj|}tj}tj||}t j |}y|||||}Wn9t k r} zj j | dSWYdd} ~ Xn"X|rtj|tjdSdSdS)Nrr$)r__new___libZX509_STORE_CTX_get_current_cert_x509ZX509_STORE_CTX_get_errorZX509_STORE_CTX_get_error_depthZ"SSL_get_ex_data_X509_STORE_CTX_idxZX509_STORE_CTX_get_ex_data Connection_reverse_mapping Exceptionr2appendZX509_STORE_CTX_set_errorZ X509_V_OK) okZ store_ctxcertZ error_numberZ error_depthindexsslZ connectionresulte)callbackr3r!r"wrappers"  z'_VerifyHelper.__init__..wrapperzint (*)(int, X509_STORE_CTX *))r1r4r_ffirF)r3rFrGr!)rFr3r"r4s !z_VerifyHelper.__init__N)rrr r+r4r!r!r!r"r8s r8c@s"eZdZdZddZdS)_NpnAdvertiseHelperzT Wrap a callback such that it can be used as an NPN advertisement callback. csGtjtfdd}tjd|_dS)Ncsytj|}|}djtjdd|D}tjdt|tjd|g|_|jdd|d<|jd|d sz@_NpnAdvertiseHelper.__init__..wrapper..zunsigned int *zunsigned char[]rr$r%) r<r=joinr from_iterablerHnewrK_npn_advertise_callback_argsr>r2r?)rCoutoutlenargconnprotosprotostrrE)rFr3r!r"rGs  z-_NpnAdvertiseHelper.__init__..wrapperz>int (*)(SSL *, const unsigned char **, unsigned int *, void *))r1r4rrHrF)r3rFrGr!)rFr3r"r4s  !z_NpnAdvertiseHelper.__init__N)rrr r+r4r!r!r!r"rIs rIc@s"eZdZdZddZdS)_NpnSelectHelperzP Wrap a callback such that it can be used as an NPN selection callback. csGtjtfdd}tjd|_dS)Nc s*ytj|}tj||dd}g}xN|rt|d} |d| d} |j| || dd}q5W||} tjdt| tjd| g|_|jdd|d<|jd|dr2) rCrSrTin_inlenrUrVinstr protolistlprotooutstrrE)rFr3r!r"rG+s$   z*_NpnSelectHelper.__init__..wrapperz^int (*)(SSL *, unsigned char **, unsigned char *, const unsigned char *, unsigned int, void *))r1r4rrHrF)r3rFrGr!)rFr3r"r4(s  !"z_NpnSelectHelper.__init__N)rrr r+r4r!r!r!r"rY#s rYc@s"eZdZdZddZdS)_ALPNSelectHelperzQ Wrap a callback such that it can be used as an ALPN selection callback. csGtjtfdd}tjd|_dS)Nc sEytj|}tj||dd}g}xN|rt|d} |d| d} |j| || dd}q5W||} t| tstdtj dt | tj d| g|_ |j dd|d<|j d|dr2) rCrSrTr\r]rUrVr^r_Z encoded_lenrarbrE)rFr3r!r"rG\s(    z+_ALPNSelectHelper.__init__..wrapperz^int (*)(SSL *, unsigned char **, unsigned char *, const unsigned char *, unsigned int, void *))r1r4rrHrF)r3rFrGr!)rFr3r"r4Ys  !$z_ALPNSelectHelper.__init__N)rrr r+r4r!r!r!r"rcTs rcc@s"eZdZdZddZdS)_OCSPServerCallbackHelpera Wrap a callback such that it can be used as an OCSP callback for the server side. Annoyingly, OpenSSL defines one OCSP callback but uses it in two different ways. For servers, that callback is expected to retrieve some OCSP data and hand it to OpenSSL, and may return only SSL_TLSEXT_ERR_OK, SSL_TLSEXT_ERR_FATAL, and SSL_TLSEXT_ERR_NOACK. For clients, that callback is expected to check the OCSP data, and returns a negative value on error, 0 if the response is not acceptable, or positive if it is. These are mutually exclusive return code behaviours, and they mean that we need two helpers so that we always return an appropriate error code if the user's code throws an exception. Given that we have to have two helpers anyway, these helpers are a bit more helpery than most: specifically, they hide a few more of the OpenSSL functions so that the user has an easier time writing these callbacks. This helper implements the server side. csGtjtfdd}tjd|_dS)Ncsytj|}|tjkr1tj|}nd}||}t|tsatd|skdSt|}t j |}|tj ||ddr2r?)rCcdatarVdata ocsp_dataZocsp_data_lengthZdata_ptrrE)rFr3r!r"rGs&    z3_OCSPServerCallbackHelper.__init__..wrapperzint (*)(SSL *, void *))r1r4rrHrF)r3rFrGr!)rFr3r"r4s !,z"_OCSPServerCallbackHelper.__init__N)rrr r+r4r!r!r!r"rhs rhc@s"eZdZdZddZdS)_OCSPClientCallbackHelpera Wrap a callback such that it can be used as an OCSP callback for the client side. Annoyingly, OpenSSL defines one OCSP callback but uses it in two different ways. For servers, that callback is expected to retrieve some OCSP data and hand it to OpenSSL, and may return only SSL_TLSEXT_ERR_OK, SSL_TLSEXT_ERR_FATAL, and SSL_TLSEXT_ERR_NOACK. For clients, that callback is expected to check the OCSP data, and returns a negative value on error, 0 if the response is not acceptable, or positive if it is. These are mutually exclusive return code behaviours, and they mean that we need two helpers so that we always return an appropriate error code if the user's code throws an exception. Given that we have to have two helpers anyway, these helpers are a bit more helpery than most: specifically, they hide a few more of the OpenSSL functions so that the user has an easier time writing these callbacks. This helper implements the client side. csGtjtfdd}tjd|_dS)Nc sytj|}|tjkr1tj|}nd}tjd}tj||}|dkrmd}n tj|d|dd}|||}t t |SWn9t k r}zj j |dSWYdd}~XnXdS)Nzunsigned char **rrJr$)r<r=rHrirjrQr:ZSSL_get_tlsext_status_ocsp_resprZintboolr>r2r?) rCrkrVrlZocsp_ptrZocsp_lenrmZvalidrE)rFr3r!r"rGs    z3_OCSPClientCallbackHelper.__init__..wrapperzint (*)(SSL *, void *))r1r4rrHrF)r3rFrGr!)rFr3r"r4s !z"_OCSPClientCallbackHelper.__init__N)rrr r+r4r!r!r!r"rns rncCsd}t|ts<t|dd}|dk r<|}t|trQ|}t|tsotdn|dkrtd|f|S)Nfilenoz3argument must be an int, or have a fileno() method.rz1file descriptor cannot be a negative integer (%i))rdr getattrrf ValueError)objfdmethr!r!r"_asFileDescriptor s   rxcCstjtj|S)z Return a string describing the version of OpenSSL in use. :param type: One of the SSLEAY_ constants defined in this module. )rHstringr:SSLeay_version)typer!r!r"rzsrzcsfdd}|S)a Builds a decorator that ensures that functions that rely on OpenSSL functions that are not present in this build raise NotImplementedError, rather than AttributeError coming out of cryptography. :param flag: A cryptography flag that guards the functions, e.g. ``Cryptography_HAS_NEXTPROTONEG``. :param error: The string to be used in the exception if the flag is false. cs0s(t|fdd}|S|SdS)NcstdS)N)NotImplementedError)argskwargs)errorr!r"explode2sz<_make_requires.._requires_decorator..explode)r)funcr)rflagr!r"_requires_decorator0sz+_make_requires.._requires_decoratorr!)rrrr!)rrr"_make_requires&s  rzNPN not availablezALPN not availablezSNI not availablec@seZdZdS)SessionN)rrr r!r!r!r"rKs rc @seZdZdZededededede diZ e dd e j DZ d d Z d d dZddZd ddZddZddZddZddZeddZddZdd Zd!d"Zed#d$Zd%d&Zd'd(Zd)d*Zd+d,Zd-d.Z d/d0Z!d1d2Z"d3d4Z#d5d6Z$d7d8Z%d9d:Z&d;d<Z'd=d>Z(d?d@Z)dAdBZ*dCdDZ+dEdFZ,dGdHZ-dIdJZ.dKdLZ/dMdNZ0dOdPZ1dQdRZ2e3dSdTZ4e5dUdVZ6e5dWdXZ7e8dYdZZ9e8d[d\Z:d]d^Z;d d_d`Z<d dadbZ=d S)cContextzn :class:`OpenSSL.SSL.Context` instances define the parameters for setting up new SSL connections. Z SSLv2_methodZ SSLv3_methodZ SSLv23_methodZ TLSv1_methodZTLSv1_1_methodZTLSv1_2_methodccsB|]8\}}tt|ddk r|tt|fVqdS)N)rsr:)rLZ identifiernamer!r!r"rN]s zContext.cCst|tstdy|j|}Wntk rLtdYnX|}t|tjkt j |}t|tjktj |t j }y&t j |d}t|dkWntk rYnX||_d|_d|_d|_d|_d|_d|_d|_d|_d|_d|_d|_d|_d|_d|_d|_d|_d|_ |j!t j"dS)zo :param method: One of SSLv2_METHOD, SSLv3_METHOD, SSLv23_METHOD, or TLSv1_METHOD. zmethod must be an integerzNo such protocolr$N)#rdr rf_methodsKeyErrorrt_openssl_assertrHrir:Z SSL_CTX_newgcZ SSL_CTX_freeZSSL_CTX_set_ecdh_autoAttributeError_context_passphrase_helper_passphrase_callback_passphrase_userdata_verify_helper_verify_callback_info_callback_tlsext_servername_callback _app_data_npn_advertise_helper_npn_advertise_callback_npn_select_helper_npn_select_callback_alpn_select_helper_alpn_select_callback _ocsp_helper_ocsp_callback _ocsp_dataset_modeZSSL_MODE_ENABLE_PARTIAL_WRITE)r3methodZ method_funcZ method_objcontextresr!r!r"r4asF                      zContext.__init__NcCsq|dkrtj}n t|}|dkr<tj}n t|}tj|j||}|smtdS)aX Let SSL know where we can find trusted certificates for the certificate chain :param cafile: In which file we can find the certificates (``bytes`` or ``unicode``). :param capath: In which directory we can find the certificates (``bytes`` or ``unicode``). :return: None N)rHri _path_stringr:ZSSL_CTX_load_verify_locationsrr5)r3cafilecapathZ load_resultr!r!r"load_verify_locationss      zContext.load_verify_locationscs:tfdd}tt|ddddS)Ncs||jS)N)r)sizeZverifyuserdata)rFr3r!r"rGsz'Context._wrap_callback..wrapperZ more_argsTtruncate)rrr)r3rFrGr!)rFr3r"_wrap_callbacks!zContext._wrap_callbackcCs\t|std|j||_|jj|_tj|j|j||_ dS)z Set the passphrase callback :param callback: The Python callback to use :param userdata: (optional) A Python object which will be given as argument to the callback :return: None zcallback must be callableN) callablerfrrrFrr:ZSSL_CTX_set_default_passwd_cbrr)r3rFrr!r!r" set_passwd_cbs  zContext.set_passwd_cbcCstj|j}t|dktjtjjd}tjtjjd}|j ||stjtj }tjtj }|t kr|t kr|jttdS)z[ Use the platform-specific CA certificate locations :return: None r$asciiN)r:Z SSL_CTX_set_default_verify_pathsrrrHryZX509_get_default_cert_dir_envdecodeZX509_get_default_cert_file_env_check_env_vars_setZX509_get_default_cert_dirZX509_get_default_cert_file_CRYPTOGRAPHY_MANYLINUX1_CA_DIR _CRYPTOGRAPHY_MANYLINUX1_CA_FILE_fallback_default_verify_paths_CERTIFICATE_FILE_LOCATIONS_CERTIFICATE_PATH_LOCATIONS)r3 set_result dir_env_var file_env_varZ default_dirZ default_filer!r!r"set_default_verify_pathss     z Context.set_default_verify_pathscCs.tjj|dk p-tjj|dk S)zp Check to see if the default cert dir/file environment vars are present. :return: bool N)osenvironget)r3rrr!r!r"rszContext._check_env_vars_setcCsix.|D]&}tjj|r|j|PqWx1|D])}tjj|r8|jd|Pq8WdS)aW Default verify paths are based on the compiled version of OpenSSL. However, when pyca/cryptography is compiled as a manylinux1 wheel that compiled location can potentially be wrong. So, like Go, we will try a predefined set of paths and attempt to load roots from there. :return: None N)rpathisfilerisdir)r3Z file_pathZdir_pathrrr!r!r"rs   z&Context._fallback_default_verify_pathscCs2t|}tj|j|}|s.tdS)z Load a certificate chain from a file :param certfile: The name of the certificate chain file (``bytes`` or ``unicode``). :return: None N)rr:Z"SSL_CTX_use_certificate_chain_filerr5)r3certfilerDr!r!r"use_certificate_chain_files z"Context.use_certificate_chain_filecCsPt|}t|ts'tdtj|j||}|sLtdS)z Load a certificate from a file :param certfile: The name of the certificate file (``bytes`` or ``unicode``). :param filetype: (optional) The encoding of the file, default is PEM :return: None zfiletype must be an integerN)rrdr rfr:ZSSL_CTX_use_certificate_filerr5)r3rfiletype use_resultr!r!r"use_certificate_files  zContext.use_certificate_filecCsDt|tstdtj|j|j}|s@tdS)zs Load a certificate from a X509 object :param cert: The X509 object :return: None zcert must be an X509 instanceN)rdrrfr:ZSSL_CTX_use_certificaterr;r5)r3rArr!r!r"use_certificate3s  zContext.use_certificatecCs`t|tstdtj|j}tj|j|}|s\tj|t dS)z Add certificate to chain :param certobj: The X509 certificate object to add to the chain :return: None z certobj must be an X509 instanceN) rdrrfr:X509_dupr;ZSSL_CTX_add_extra_chain_certr X509_freer5)r3Zcertobjcopy add_resultr!r!r"add_extra_chain_certAs  zContext.add_extra_chain_certcCs*|jdk r|jjttdS)N)rr7r*r5)r3r!r!r"_raise_passphrase_exceptionRsz#Context._raise_passphrase_exceptioncCsht|}|tkr!t}nt|ts<tdtj|j||}|sd|j dS)z Load a private key from a file :param keyfile: The name of the key file (``bytes`` or ``unicode``) :param filetype: (optional) The encoding of the file, default is PEM :return: None zfiletype must be an integerN) r _UNSPECIFIEDrrdr rfr:ZSSL_CTX_use_PrivateKey_filerr)r3Zkeyfilerrr!r!r"use_privatekey_fileXs    zContext.use_privatekey_filecCsGt|tstdtj|j|j}|sC|jdS)zs Load a private key from a PKey object :param pkey: The PKey object :return: None zpkey must be a PKey instanceN)rdrrfr:ZSSL_CTX_use_PrivateKeyrZ_pkeyr)r3Zpkeyrr!r!r"use_privatekeyms  zContext.use_privatekeycCstj|jstdS)z Check that the private key and certificate match up :return: None (raises an exception if something's wrong) N)r:ZSSL_CTX_check_private_keyrr5)r3r!r!r"check_privatekey{szContext.check_privatekeycCsBtjtd|}t|tjktj|j|dS)a% Load the trusted certificates that will be sent to the client. Does not actually imply any of the certificates are trusted; that must be configured separately. :param bytes cafile: The path to a certificates file in PEM format. :return: None rN)r:ZSSL_load_client_CA_file_text_to_bytes_and_warnrrHriSSL_CTX_set_client_CA_listr)r3rZca_listr!r!r"load_client_cas zContext.load_client_cacCs;td|}ttj|j|t|dkdS)aV Set the session id to *buf* within which a session can be reused for this Context object. This is needed when doing session resumption, because there is no way for a stored session to know which Context object it is associated with. :param bytes buf: The session id. :returns: None bufr$N)rrr:ZSSL_CTX_set_session_id_contextrrK)r3rr!r!r"set_session_ids  zContext.set_session_idcCs.t|tstdtj|j|S)z Enable/disable session caching and specify the mode used. :param mode: One or more of the SESS_CACHE_* flags (combine using bitwise or) :returns: The previously set caching mode. zmode must be an integer)rdr rfr:ZSSL_CTX_set_session_cache_moder)r3moder!r!r"set_session_cache_modes zContext.set_session_cache_modecCstj|jS)z: :returns: The currently used cache mode. )r:ZSSL_CTX_get_session_cache_moder)r3r!r!r"get_session_cache_modeszContext.get_session_cache_modecCsnt|tstdt|s3tdt||_|jj|_tj |j ||jdS)aG Set the verify mode and verify callback :param mode: The verify mode, this is either VERIFY_NONE or VERIFY_PEER combined with possible other flags :param callback: The Python callback to use :return: None See SSL_CTX_set_verify(3SSL) for further details. zmode must be an integerzcallback must be callableN) rdr rfrr8rrFrr:ZSSL_CTX_set_verifyr)r3rrFr!r!r" set_verifys    zContext.set_verifycCs2t|tstdtj|j|dS)zz Set the verify depth :param depth: An integer specifying the verify depth :return: None zdepth must be an integerN)rdr rfr:ZSSL_CTX_set_verify_depthr)r3Zdepthr!r!r"set_verify_depths zContext.set_verify_depthcCstj|jS)zG Get the verify mode :return: The verify mode )r:ZSSL_CTX_get_verify_moder)r3r!r!r"get_verify_modeszContext.get_verify_modecCstj|jS)zI Get the verify depth :return: The verify depth )r:ZSSL_CTX_get_verify_depthr)r3r!r!r"get_verify_depthszContext.get_verify_depthcCst|}tj|d}|tjkr4ttj|tj}tj|tjtjtj}tj|tj }tj |j |dS)z Load parameters for Ephemeral Diffie-Hellman :param dhfile: The file to load EDH parameters from (``bytes`` or ``unicode``). :return: None rN) rr:Z BIO_new_filerHrir5rZBIO_freeZPEM_read_bio_DHparamsZDH_freeZSSL_CTX_set_tmp_dhr)r3ZdhfilebioZdhr!r!r" load_tmp_dhs !zContext.load_tmp_dhcCstj|j|jdS)a Select a curve to use for ECDHE key exchange. :param curve: A curve object to use as returned by either :py:meth:`OpenSSL.crypto.get_elliptic_curve` or :py:meth:`OpenSSL.crypto.get_elliptic_curves`. :return: None N)r:ZSSL_CTX_set_tmp_ecdhrZ _to_EC_KEY)r3Zcurver!r!r" set_tmp_ecdhs zContext.set_tmp_ecdhcCsMtd|}t|ts*tdttj|j|dkdS)z Set the list of ciphers to be used in this context. See the OpenSSL manual for more information (e.g. :manpage:`ciphers(1)`). :param bytes cipher_list: An OpenSSL cipher string. :return: None cipher_listz"cipher_list must be a byte string.r$N)rrdbytesrfrr:ZSSL_CTX_set_cipher_listr)r3rr!r!r"set_cipher_list s  zContext.set_cipher_listc Cstj}t|tjkyx|D]}t|tsZtdt|j ftj |j }t|tjktj ||}|s)tj |tq)WWntj|YnXtj|j|dS)a? Set the list of preferred client certificate signers for this server context. This list of certificate authorities will be sent to the client when the server requests a client certificate. :param certificate_authorities: a sequence of X509Names. :return: None z3client CAs must be X509Name objects, not %s objectsN)r:Zsk_X509_NAME_new_nullrrHrirdrrfr{r X509_NAME_dup_nameZsk_X509_NAME_pushX509_NAME_freer5Zsk_X509_NAME_freerr)r3Zcertificate_authoritiesZ name_stackZca_namerZ push_resultr!r!r"set_client_ca_lists$    zContext.set_client_ca_listcCsGt|tstdtj|j|j}t|dkdS)aI Add the CA certificate to the list of preferred signers for this context. The list of certificate authorities will be sent to the client when the server requests a client certificate. :param certificate_authority: certificate authority's X509 certificate. :return: None z.certificate_authority must be an X509 instancer$N)rdrrfr:ZSSL_CTX_add_client_CArr;r)r3Zcertificate_authorityrr!r!r" add_client_caAs  zContext.add_client_cacCs.t|tstdtj|j|S)z Set session timeout :param timeout: The timeout in seconds :return: The previous session timeout ztimeout must be an integer)rdr rfr:ZSSL_CTX_set_timeoutr)r3Ztimeoutr!r!r" set_timeoutSs zContext.set_timeoutcCstj|jS)zO Get the session timeout :return: The session timeout )r:ZSSL_CTX_get_timeoutr)r3r!r!r" get_timeout_szContext.get_timeoutcsMtfdd}tjd||_tj|j|jdS)zr Set the info callback :param callback: The Python callback to use :return: None cstj|||dS)N)r<r=)rCZwhereZ return_code)rFr!r"rGnsz*Context.set_info_callback..wrapperzvoid (*)(const SSL *, int, int)N)rrHrFrr:ZSSL_CTX_set_info_callbackr)r3rFrGr!)rFr"set_info_callbackgszContext.set_info_callbackcCs|jS)zo Get the application data (supplied via set_app_data()) :return: The application data )r)r3r!r!r" get_app_datauszContext.get_app_datacCs ||_dS)z Set the application data (will be returned from get_app_data()) :param data: Any Python object :return: None N)r)r3rlr!r!r" set_app_data}szContext.set_app_datacCsAtj|j}|tjkr%dStjt}||_|S)z Get the certificate store for the context. :return: A X509Store object or None if it does not have one. N)r:ZSSL_CTX_get_cert_storerrHrirr9Z_store)r3ZstoreZpystorer!r!r"get_cert_stores  zContext.get_cert_storecCs.t|tstdtj|j|S)z Add options. Options set before are not cleared! :param options: The options to add. :return: The new option bitmask. zoptions must be an integer)rdr rfr:ZSSL_CTX_set_optionsr)r3Zoptionsr!r!r" set_optionss zContext.set_optionscCs.t|tstdtj|j|S)z Add modes via bitmask. Modes set before are not cleared! :param mode: The mode to add. :return: The new mode bitmask. zmode must be an integer)rdr rfr:ZSSL_CTX_set_moder)r3rr!r!r"rs zContext.set_modecsMtfdd}tjd||_tj|j|jdS)z Specify a callback function to be called when clients specify a server name. :param callback: The callback function. It will be invoked with one argument, the Connection instance. cstj|dS)Nr)r<r=)rCZalertrU)rFr!r"rGsz7Context.set_tlsext_servername_callback..wrapperz#int (*)(const SSL *, int *, void *)N)rrHrFrr:Z&SSL_CTX_set_tlsext_servername_callbackr)r3rFrGr!)rFr"set_tlsext_servername_callbacks z&Context.set_tlsext_servername_callbackcCs>t||_|jj|_tj|j|jtjdS)a Specify a callback function that will be called when offering `Next Protocol Negotiation `_ as a server. :param callback: The callback function. It will be invoked with one argument, the Connection instance. It should return a list of bytestrings representing the advertised protocols, like ``[b'http/1.1', b'spdy/2']``. N) rIrrFrr:Z%SSL_CTX_set_next_protos_advertised_cbrrHri)r3rFr!r!r"set_npn_advertise_callbacks z"Context.set_npn_advertise_callbackcCs>t||_|jj|_tj|j|jtjdS)a Specify a callback function that will be called when a server offers Next Protocol Negotiation options. :param callback: The callback function. It will be invoked with two arguments: the Connection, and a list of offered protocols as bytestrings, e.g. ``[b'http/1.1', b'spdy/2']``. It should return one of those bytestrings, the chosen protocol. N) rYrrFrr:Z SSL_CTX_set_next_proto_select_cbrrHri)r3rFr!r!r"set_npn_select_callbacks zContext.set_npn_select_callbackcCsWdjtjdd|D}tjd|}tj|j|t|dS)ag Specify the clients ALPN protocol list. These protocols are offered to the server during protocol negotiation. :param protos: A list of the protocols to be offered to the server. This list should be a Python list of bytestrings representing the protocols to offer, e.g. ``[b'http/1.1', b'spdy/2']``. rJcss'|]}tt||fVqdS)N)r rK)rLrMr!r!r"rNsz*Context.set_alpn_protos..zunsigned char[]N) rOrrPrHrQr:ZSSL_CTX_set_alpn_protosrrK)r3rWrX input_strr!r!r"set_alpn_protoss zContext.set_alpn_protoscCs>t||_|jj|_tj|j|jtjdS)ab Set the callback to handle ALPN protocol choice. :param callback: The callback function. It will be invoked with two arguments: the Connection, and a list of offered protocols as bytestrings, e.g ``[b'http/1.1', b'spdy/2']``. It should return one of those bytestrings, the chosen protocol. N) rcrrFrr:ZSSL_CTX_set_alpn_select_cbrrHri)r3rFr!r!r"set_alpn_select_callbacks z Context.set_alpn_select_callbackcCs||_|j|_|dkr0tj|_ntj||_tj|j |j}t |dktj |j |j}t |dkdS)z This internal helper does the common work for ``set_ocsp_server_callback`` and ``set_ocsp_client_callback``, which is almost all of it. Nr$) rrFrrHrirZ new_handler:ZSSL_CTX_set_tlsext_status_cbrrZSSL_CTX_set_tlsext_status_arg)r3helperrlrcr!r!r"_set_ocsp_callbacks   zContext._set_ocsp_callbackcCs t|}|j||dS)a Set a callback to provide OCSP data to be stapled to the TLS handshake on the server side. :param callback: The callback function. It will be invoked with two arguments: the Connection, and the optional arbitrary data you have provided. The callback must return a bytestring that contains the OCSP data to staple to the handshake. If no OCSP data is available for this connection, return the empty bytestring. :param data: Some opaque data that will be passed into the callback function when called. This can be used to avoid needing to do complex data lookups or to keep track of what context is being used. This parameter is optional. N)rhr)r3rFrlrr!r!r"set_ocsp_server_callbacks z Context.set_ocsp_server_callbackcCs t|}|j||dS)a Set a callback to validate OCSP data stapled to the TLS handshake on the client side. :param callback: The callback function. It will be invoked with three arguments: the Connection, a bytestring containing the stapled OCSP assertion, and the optional arbitrary data you have provided. The callback must return a boolean that indicates the result of validating the OCSP data: ``True`` if the OCSP data is valid and the certificate can be trusted, or ``False`` if either the OCSP data is invalid or the certificate has been revoked. :param data: Some opaque data that will be passed into the callback function when called. This can be used to avoid needing to do complex data lookups or to keep track of what context is being used. This parameter is optional. N)rnr)r3rFrlrr!r!r"set_ocsp_client_callback,s z Context.set_ocsp_client_callback)>rrr r+ SSLv2_METHOD SSLv3_METHOD SSLv23_METHOD TLSv1_METHODTLSv1_1_METHODTLSv1_2_METHODrdictitemsr4rrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr _requires_snir _requires_npnrr_requires_alpnrrrrrr!r!r!r"rOsl    2  '               #       rz4ContextType has been deprecated, use Context insteadc@seZdZdZeZdddZddZddZd d Z d d Z e d dZ e ddZ ddZdddZeZdddZdddZeZddddZddZddZd d!Zd"d#Zd$d%Zd&d'Zd(d)Zd*d+Zd,d-Zd.d/Zd0d1Zd2d3Z d4d5Z!d6d7Z"d8d9Z#d:d;Z$d<d=Z%d>d?Z&d@dAZ'dBdCZ(dDdEZ)dFdGZ*dHdIZ+dJdKZ,dLdMZ-dNdOZ.dPdQZ/dRdSZ0dTdUZ1dVdWZ2dXdYZ3dZd[Z4d\d]Z5d^d_Z6d`daZ7dbdcZ8dddeZ9dfdgZ:dhdiZ;djdkZ<e=dldmZ>e?dndoZ@e?dpdqZAdrdsZBdS)tr<z NcCs_t|tstdtj|j}tj|tj|_ ||_d|_ d|_ d|_ d|_ ||j|j <|dkrd|_tjtj|_t|jtjktjtj|_t|jtjktj|j |j|jnId|_d|_||_tj|j t|j}t|dkdS)z Create a new Connection object, using the given OpenSSL.SSL.Context instance and socket. :param context: An SSL Context to use for this connection :param socket: The socket to use for transport layer z"context must be a Context instanceNr$)rdrrfr:ZSSL_newrrHrZSSL_free_sslrrRr[rgr=_socketZBIO_newZ BIO_s_mem _into_sslrri _from_sslZ SSL_set_bioZ SSL_set_fdrx)r3rsocketrCrr!r!r"r4Ls.           zConnection.__init__cCsB|jdkr.td|jj|fnt|j|SdS)zy Look up attributes on the wrapped socket object if they are not found on the Connection object. Nz!'%s' object has no attribute '%s')rr __class__rrs)r3rr!r!r" __getattr__}szConnection.__getattr__cCs|jjdk r"|jjj|jjdk rD|jjj|jjdk rf|jjj|jjdk r|jjj|jjdk r|jjjtj||}|tj krt n|tj krt n|tj kr tn|tjkr(tn|tjkrtjdkr|dkrtdkrttjd}n tj}|dkrt|tj|tddqtn|tjkrntdS)Nrwin32r$zUnexpected EOFro)rrr7rrrrr:Z SSL_get_errorZSSL_ERROR_WANT_READr,ZSSL_ERROR_WANT_WRITEr-ZSSL_ERROR_ZERO_RETURNr/ZSSL_ERROR_WANT_X509_LOOKUPr.ZSSL_ERROR_SYSCALLZERR_peek_errorrrHZ getwinerrorerrnor0rrr5ZSSL_ERROR_NONE)r3rCrDrr r!r!r"_raise_ssl_errors@         zConnection._raise_ssl_errorcCs|jS)z% Get session context )r)r3r!r!r" get_contextszConnection.get_contextcCs>t|tstdtj|j|j||_dS)z Switch this connection to a new session context :param context: A :py:class:`Context` instance giving the new session context to use. z"context must be a Context instanceN)rdrrfr:ZSSL_set_SSL_CTXrr)r3rr!r!r" set_contexts zConnection.set_contextcCs8tj|jtj}|tjkr+dStj|S)z Retrieve the servername extension value if provided in the client hello message, or None if there wasn't one. :return: A byte string giving the server name or :py:data:`None`. N)r:ZSSL_get_servernamerZTLSEXT_NAMETYPE_host_namerHriry)r3rr!r!r"get_servernames zConnection.get_servernamecCsMt|tstdnd|kr6tdtj|j|dS)z Set the value of the servername extension to send in the client hello. :param name: A byte string giving the name. zname must be a byte stringszname must not contain NUL byteN)rdrrfr:ZSSL_set_tlsext_host_namer)r3rr!r!r"set_tlsext_host_names   zConnection.set_tlsext_host_namecCstj|jS)z Get the number of bytes that can be safely read from the connection :return: The number of bytes available in the receive buffer. )r:Z SSL_pendingr)r3r!r!r"pendingszConnection.pendingrcCstd|}t|tr*|j}t|trEt|}t|ts`tdt|dkr~t dt j |j |t|}|j |j ||S)a Send data on the connection. NOTE: If you get one of the WantRead, WantWrite or WantX509Lookup exceptions on this, you have to call the method again with the SAME buffer. :param buf: The string, buffer or memoryview to send :param flags: (optional) Included for compatibility with the socket API, the value is ignored :return: The number of bytes written rz0data must be a memoryview, buffer or byte stringiz,Cannot send more than 2**31-1 bytes at once.)rrdrtobytesr#strrrfrKrtr: SSL_writerr )r3rflagsrDr!r!r"sends     zConnection.sendcCstd|}t|tr*|j}t|trEt|}t|ts`tdt|}d}t j d|}xV|rt j |j ||t|d}|j|j |||7}||8}qWdS)a Send "all" data on the connection. This calls send() repeatedly until all data is sent. If an error occurs, it's impossible to tell how much data has been sent. :param buf: The string, buffer or memoryview to send :param flags: (optional) Included for compatibility with the socket API, the value is ignored :return: The number of bytes written rz/buf must be a memoryview, buffer or byte stringrzchar[]iN)rrdrrr#rrrfrKrHrQr:rrminr )r3rrZ left_to_sendZ total_sentrlrDr!r!r"sendalls$       zConnection.sendallcCstd|}|dk rC|tj@rCtj|j||}ntj|j||}|j|j|tj ||ddS)a Receive data on the connection. :param bufsiz: The maximum number of bytes to read :param flags: (optional) The only supported flag is ``MSG_PEEK``, all other flags are ignored. :return: The string read from the Connection zchar[]N) _no_zero_allocatorrMSG_PEEKr:SSL_peekrSSL_readr rHrZ)r3bufsizrrrDr!r!r"recv,s zConnection.recvc Cs|dkrt|}nt|t|}td|}|dk rs|tj@rstj|j||}ntj|j||}|j |j|y&t t j |||d|s & !zConnection.recv_intocCs}tj|rrtj|r*tqytj|rEtqytj|rctdqytdntdS)NBIO_should_io_specialzunknown bio failure) r:ZBIO_should_retryZBIO_should_readr,ZBIO_should_writer-r$rtr5)r3rrDr!r!r"_handle_bio_errorsgs  zConnection._handle_bio_errorscCs|jdkrtdt|ts6tdtd|}tj|j||}|dkr||j|j|tj ||ddS)z When using non-socket connections this function reads the "dirty" data that would have traveled away on the network. :param bufsiz: The maximum number of bytes to read :return: The string read. NzConnection sock was not Nonezbufsiz must be an integerzchar[]r) rrfrdr rr:ZBIO_readr%rHrZ)r3rrrDr!r!r"bio_readys   zConnection.bio_readcCsktd|}|jdkr*tdtj|j|t|}|dkrg|j|j||S)z When using non-socket connections this function sends "dirty" data that would have traveled in on the network. :param buf: The string to put into the memory BIO. :return: The number of bytes written rNzConnection sock was not Noner)rrrfr:Z BIO_writerKr%)r3rrDr!r!r" bio_writes  zConnection.bio_writecCs0|js,ttj|jdkdSdS)z Renegotiate the session. :return: True if the renegotiation can be started, False otherwise :rtype: bool r$TF)renegotiate_pendingrr:ZSSL_renegotiater)r3r!r!r" renegotiates zConnection.renegotiatecCs)tj|j}|j|j|dS)z Perform an SSL handshake (usually called after renegotiate() or one of set_*_state()). This can raise the same exceptions as send and recv. :return: None. N)r:ZSSL_do_handshakerr )r3rDr!r!r" do_handshakeszConnection.do_handshakecCstj|jdkS)z Check if there's a renegotiation in progress, it will return False once a renegotiation is finished. :return: Whether there's a renegotiation in progress :rtype: bool r$)r:ZSSL_renegotiate_pendingr)r3r!r!r"r(szConnection.renegotiate_pendingcCstj|jS)z Find out the total number of renegotiations. :return: The number of renegotiations. :rtype: int )r:ZSSL_total_renegotiationsr)r3r!r!r"total_renegotiationsszConnection.total_renegotiationscCs tj|j|jj|S)z Connect to remote host and set up client-side SSL :param addr: A remote address :return: What the socket's connect method returns )r:SSL_set_connect_staterrconnect)r3addrr!r!r"r-szConnection.connectcCs |jj}|j||S)a Connect to remote host and set up client-side SSL. Note that if the socket's connect_ex method doesn't return 0, SSL won't be initialized. :param addr: A remove address :return: What the socket's connect_ex method returns )r connect_exset_connect_state)r3r.r/r!r!r"r/s  zConnection.connect_excCs;|jj\}}t|j|}|j||fS)z Accept incoming connection and set up SSL on it :return: A (conn,addr) pair where conn is a Connection and addr is an address )racceptr<rset_accept_state)r3Zclientr.rVr!r!r"r1s zConnection.acceptcCs2|jdkrtdtj|jddS)z When using non-socket connections this function signals end of data on the input for this connection. :return: None NzConnection sock was not Noner)rrfr:ZBIO_set_mem_eof_returnr)r3r!r!r" bio_shutdowns zConnection.bio_shutdowncCsLtj|j}|dkr4|j|j|n|dkrDdSdSdS)a Send closure alert :return: True if the shutdown completed successfully (i.e. both sides have sent closure alerts), false otherwise (i.e. you have to wait for a ZeroReturnError on a recv() method call rTFN)r:Z SSL_shutdownrr )r3rDr!r!r"shutdowns   zConnection.shutdowncCs_g}xRtD]G}tj|j|}|tjkr;P|jttj|qW|S)z Retrieve the list of ciphers used by the Connection object. :return: A list of native cipher strings. ) rr:ZSSL_get_cipher_listrrHrir?_nativery)r3ZciphersirDr!r!r"get_cipher_lists zConnection.get_cipher_listcCstj|j}|tjkr%gSg}xttj|D]n}tj||}tj|}t |tjkt j t }tj |tj |_|j|qAW|S)a Get CAs whose certificates are suggested for client authentication. :return: If this is a server connection, a list of X509Names representing the acceptable CAs as set by :py:meth:`OpenSSL.SSL.Context.set_client_ca_list` or :py:meth:`OpenSSL.SSL.Context.add_client_ca`. If this is a client connection, the list of such X509Names sent by the server, or an empty list if that has not yet happened. )r:ZSSL_get_client_CA_listrrHrirangeZsk_X509_NAME_numZsk_X509_NAME_valuerrrr9rrrr?)r3Zca_namesrDr6rrZpynamer!r!r"get_client_ca_lists zConnection.get_client_ca_listcCstddS)z The makefile() method is not implemented, since there is no dup semantics for SSL connections :raise: NotImplementedError z1Cannot make file object of OpenSSL.SSL.ConnectionN)r|)r3r!r!r"makefile0szConnection.makefilecCs|jS)zM Get application data :return: The application data )r)r3r!r!r"r:szConnection.get_app_datacCs ||_dS)zh Set application data :param data - The application data :return: None N)r)r3rlr!r!r"rBszConnection.set_app_datacCstj|jS)z Get shutdown state :return: The shutdown state, a bitvector of SENT_SHUTDOWN, RECEIVED_SHUTDOWN. )r:ZSSL_get_shutdownr)r3r!r!r" get_shutdownKszConnection.get_shutdowncCs2t|tstdtj|j|dS)z Set shutdown state :param state - bitvector of SENT_SHUTDOWN, RECEIVED_SHUTDOWN. :return: None zstate must be an integerN)rdr rfr:ZSSL_set_shutdownr)r3stater!r!r" set_shutdownTs zConnection.set_shutdowncCstjtj|jS)z Retrieve a verbose string detailing the state of the Connection. :return: A string representing the state :rtype: bytes )rHryr:ZSSL_state_string_longr)r3r!r!r"get_state_string`szConnection.get_state_stringcCstj|j}|tjkr%dStj|jtjd}|dksRttd|}tj|j||tj||ddS)zi Get a copy of the server hello nonce. :return: A string representing the state Nrzunsigned char[]) r:SSL_get_sessionrrHriZSSL_get_server_randomAssertionErrorrrZ)r3sessionlengthoutpr!r!r" server_randomiszConnection.server_randomcCstj|j}|tjkr%dStj|jtjd}|dksRttd|}tj|j||tj||ddS)zi Get a copy of the client hello nonce. :return: A string representing the state Nrzunsigned char[]) r:r?rrHriZSSL_get_client_randomr@rrZ)r3rArBrCr!r!r" client_randomxszConnection.client_randomcCstj|j}|tjkr%dStj|tjd}|dksOttd|}tj|||tj||ddS)za Get a copy of the master key. :return: A string representing the state Nrzunsigned char[]) r:r?rrHriZSSL_SESSION_get_master_keyr@rrZ)r3rArBrCr!r!r" master_keyszConnection.master_keycOs|jj||S)z_ See shutdown(2) :return: What the socket's shutdown() method returns )rr4)r3r}r~r!r!r" sock_shutdownszConnection.sock_shutdowncCsPtj|j}|tjkrLtjt}tj|tj|_ |SdS)zi Retrieve the other side's certificate (if any) :return: The peer's certificate N) r:ZSSL_get_peer_certificaterrHrirr9rrr;)r3rApycertr!r!r"get_peer_certificates zConnection.get_peer_certificatecCstj|j}|tjkr%dSg}xlttj|D]U}tjtj||}t j t }tj |tj |_ |j|qAW|S)z Retrieve the other side's certificate (if any) :return: A list of X509 instances giving the peer's certificate chain, or None if it does not have one. N)r:ZSSL_get_peer_cert_chainrrHrir8Z sk_X509_numrZ sk_X509_valuerr9rrr;r?)r3Z cert_stackrDr6rArHr!r!r"get_peer_cert_chainszConnection.get_peer_cert_chaincCstj|jS)z Checks if more data has to be read from the transport layer to complete an operation. :return: True iff more data has to be read )r:Z SSL_want_readr)r3r!r!r" want_readszConnection.want_readcCstj|jS)z Checks if there is data to write to the transport layer to complete an operation. :return: True iff there is data to write )r:ZSSL_want_writer)r3r!r!r" want_writeszConnection.want_writecCstj|jdS)z Set the connection to work in server mode. The handshake will be handled automatically by read/write. :return: None N)r:ZSSL_set_accept_stater)r3r!r!r"r2szConnection.set_accept_statecCstj|jdS)z Set the connection to work in client mode. The handshake will be handled automatically by read/write. :return: None N)r:r,r)r3r!r!r"r0szConnection.set_connect_statecCsPtj|j}|tjkr%dStjt}tj|tj|_ |S)z Returns the Session currently used. @return: An instance of :py:class:`OpenSSL.SSL.Session` or :py:obj:`None` if no session exists. N) r:ZSSL_get1_sessionrrHrirr9rZSSL_SESSION_free_session)r3rAZ pysessionr!r!r" get_sessions zConnection.get_sessioncCsDt|tstdtj|j|j}|s@tdS)z Set the session to be used when the TLS/SSL connection is established. :param session: A Session instance representing the session to use. :returns: None z"session must be a Session instanceN)rdrrfr:ZSSL_set_sessionrrMr5)r3rArDr!r!r" set_sessions  zConnection.set_sessioncCsstjdd}||j|d}|dkr7dStd|}||j||tj||ddS)a Helper to implement :py:meth:`get_finished` and :py:meth:`get_peer_finished`. :param function: Either :py:data:`SSL_get_finished`: or :py:data:`SSL_get_peer_finished`. :return: :py:data:`None` if the desired message has not yet been received, otherwise the contents of the message. :rtype: :py:class:`bytes` or :py:class:`NoneType` zchar[]rN)rHrQrrrZ)r3Zfunctionemptyrrr!r!r"_get_finished_messages z Connection._get_finished_messagecCs|jtjS)a Obtain the latest `handshake finished` message sent to the peer. :return: The contents of the message or :py:obj:`None` if the TLS handshake has not yet completed. :rtype: :py:class:`bytes` or :py:class:`NoneType` )rQr:ZSSL_get_finished)r3r!r!r" get_finished$szConnection.get_finishedcCs|jtjS)a  Obtain the latest `handshake finished` message received from the peer. :return: The contents of the message or :py:obj:`None` if the TLS handshake has not yet completed. :rtype: :py:class:`bytes` or :py:class:`NoneType` )rQr:ZSSL_get_peer_finished)r3r!r!r"get_peer_finished.szConnection.get_peer_finishedcCsNtj|j}|tjkr%dStjtj|}|jdSdS)z Obtain the name of the currently used cipher. :returns: The name of the currently used cipher or :py:obj:`None` if no connection has been established. :rtype: :py:class:`unicode` or :py:class:`NoneType` Nzutf-8)r:SSL_get_current_cipherrrHriryZSSL_CIPHER_get_namer)r3cipherrr!r!r"get_cipher_name8s zConnection.get_cipher_namecCs<tj|j}|tjkr%dStj|tjSdS)a Obtain the number of secret bits of the currently used cipher. :returns: The number of secret bits of the currently used cipher or :py:obj:`None` if no connection has been established. :rtype: :py:class:`int` or :py:class:`NoneType` N)r:rTrrHriZSSL_CIPHER_get_bits)r3rUr!r!r"get_cipher_bitsGszConnection.get_cipher_bitscCsNtj|j}|tjkr%dStjtj|}|jdSdS)a Obtain the protocol version of the currently used cipher. :returns: The protocol name of the currently used cipher or :py:obj:`None` if no connection has been established. :rtype: :py:class:`unicode` or :py:class:`NoneType` Nzutf-8)r:rTrrHriryZSSL_CIPHER_get_versionr)r3rUversionr!r!r"get_cipher_versionUs zConnection.get_cipher_versioncCs(tjtj|j}|jdS)a? Obtain the protocol version of the current connection. :returns: The TLS version of the current connection, for example the value for TLS 1.2 would be ``TLSv1.2``or ``Unknown`` for connections that were not successfully established. :rtype: :py:class:`unicode` zutf-8)rHryr:ZSSL_get_versionrr)r3rXr!r!r"get_protocol_version_nameds z$Connection.get_protocol_version_namecCstj|j}|S)z Obtain the protocol version of the current connection. :returns: The TLS version of the current connection, for example the value for TLS 1 would be 0x769. :rtype: :py:class:`int` )r:Z SSL_versionr)r3rXr!r!r"get_protocol_versionpszConnection.get_protocol_versioncCsVtjd}tjd}tj|j||tj|d|dddS)z> Get the protocol that was negotiated by NPN. zunsigned char **zunsigned int *rN)rHrQr:ZSSL_get0_next_proto_negotiatedrrZ)r3rldata_lenr!r!r"get_next_proto_negotiated{sz$Connection.get_next_proto_negotiatedcCsWdjtjdd|D}tjd|}tj|j|t|dS)ah Specify the client's ALPN protocol list. These protocols are offered to the server during protocol negotiation. :param protos: A list of the protocols to be offered to the server. This list should be a Python list of bytestrings representing the protocols to offer, e.g. ``[b'http/1.1', b'spdy/2']``. rJcss'|]}tt||fVqdS)N)r rK)rLrMr!r!r"rNsz-Connection.set_alpn_protos..zunsigned char[]N) rOrrPrHrQr:ZSSL_set_alpn_protosrrK)r3rWrXrr!r!r"rs zConnection.set_alpn_protoscCs`tjd}tjd}tj|j|||s>dStj|d|dddS)z? Get the protocol that was negotiated by ALPN. zunsigned char **zunsigned int *rJrN)rHrQr:ZSSL_get0_alpn_selectedrrZ)r3rlr\r!r!r"get_alpn_proto_negotiateds z$Connection.get_alpn_proto_negotiatedcCs,tj|jtj}t|dkdS)a Called to request that the server sends stapled OCSP data, if available. If this is not called on the client side then the server will not send OCSP data. Should be used in conjunction with :meth:`Context.set_ocsp_client_callback`. r$N)r:ZSSL_set_tlsext_status_typerZTLSEXT_STATUSTYPE_ocspr)r3rr!r!r" request_ocspszConnection.request_ocsp)Crrr r+rr=r4r r rrrrrrrwriterrreadr#r%r&r'r)r*r(r+r-r/r1r3r4r7r9r:rrr;r=r>rDrErFrGrIrJrKrLr2r0rNrOrQrRrSrVrWrYrZr[rr]rrr^r_r!r!r!r"r<Gsx  1 )   $)               "     r<z:ConnectionType has been deprecated, use Connection instead)rrsysr functoolsrr itertoolsrrweakrefrr rZcryptography.utilsr Zsixr rer r r Z OpenSSL._utilrrrZ_exception_from_error_queuerrHrr:rZ _make_assertrr5rrrrrrZOpenSSL.cryptorrrrrrr rr!objectrZr#ZOPENSSL_VERSION_NUMBERZSSLEAY_VERSIONZ SSLEAY_CFLAGSZSSLEAY_PLATFORMZ SSLEAY_DIRZSSLEAY_BUILT_ONZSSL_SENT_SHUTDOWNZ SENT_SHUTDOWNZSSL_RECEIVED_SHUTDOWNZRECEIVED_SHUTDOWNrrrrrrZSSL_OP_NO_SSLv2Z OP_NO_SSLv2ZSSL_OP_NO_SSLv3Z OP_NO_SSLv3ZSSL_OP_NO_TLSv1Z OP_NO_TLSv1ZSSL_OP_NO_TLSv1_1Z OP_NO_TLSv1_1ZSSL_OP_NO_TLSv1_2Z OP_NO_TLSv1_2ZSSL_MODE_RELEASE_BUFFERSZMODE_RELEASE_BUFFERSZSSL_OP_SINGLE_DH_USEZOP_SINGLE_DH_USEZSSL_OP_SINGLE_ECDH_USEZOP_SINGLE_ECDH_USEZSSL_OP_EPHEMERAL_RSAZOP_EPHEMERAL_RSAZSSL_OP_MICROSOFT_SESS_ID_BUGZOP_MICROSOFT_SESS_ID_BUGZSSL_OP_NETSCAPE_CHALLENGE_BUGZOP_NETSCAPE_CHALLENGE_BUGZ'SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUGZ#OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUGZ"SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUGZOP_SSLREF2_REUSE_CERT_TYPE_BUGZ!SSL_OP_MICROSOFT_BIG_SSLV3_BUFFERZOP_MICROSOFT_BIG_SSLV3_BUFFERZSSL_OP_MSIE_SSLV2_RSA_PADDINGZOP_MSIE_SSLV2_RSA_PADDINGZSSL_OP_SSLEAY_080_CLIENT_DH_BUGZOP_SSLEAY_080_CLIENT_DH_BUGZSSL_OP_TLS_D5_BUGZ OP_TLS_D5_BUGZSSL_OP_TLS_BLOCK_PADDING_BUGZOP_TLS_BLOCK_PADDING_BUGZ"SSL_OP_DONT_INSERT_EMPTY_FRAGMENTSZOP_DONT_INSERT_EMPTY_FRAGMENTSZSSL_OP_CIPHER_SERVER_PREFERENCEZOP_CIPHER_SERVER_PREFERENCEZSSL_OP_TLS_ROLLBACK_BUGZOP_TLS_ROLLBACK_BUGZSSL_OP_PKCS1_CHECK_1ZOP_PKCS1_CHECK_1ZSSL_OP_PKCS1_CHECK_2ZOP_PKCS1_CHECK_2ZSSL_OP_NETSCAPE_CA_DN_BUGZOP_NETSCAPE_CA_DN_BUGZ&SSL_OP_NETSCAPE_DEMO_CIPHER_CHANGE_BUGZ"OP_NETSCAPE_DEMO_CIPHER_CHANGE_BUGZSSL_OP_NO_COMPRESSIONZOP_NO_COMPRESSIONZSSL_OP_NO_QUERY_MTUZOP_NO_QUERY_MTUZSSL_OP_COOKIE_EXCHANGEZOP_COOKIE_EXCHANGEZSSL_OP_NO_TICKETZ OP_NO_TICKETZ SSL_OP_ALLZOP_ALLZSSL_VERIFY_PEERZ VERIFY_PEERZSSL_VERIFY_FAIL_IF_NO_PEER_CERTZVERIFY_FAIL_IF_NO_PEER_CERTZSSL_VERIFY_CLIENT_ONCEZVERIFY_CLIENT_ONCEZSSL_VERIFY_NONEZ VERIFY_NONEZSSL_SESS_CACHE_OFFZSESS_CACHE_OFFZSSL_SESS_CACHE_CLIENTZSESS_CACHE_CLIENTZSSL_SESS_CACHE_SERVERZSESS_CACHE_SERVERZSSL_SESS_CACHE_BOTHZSESS_CACHE_BOTHZSSL_SESS_CACHE_NO_AUTO_CLEARZSESS_CACHE_NO_AUTO_CLEARZ!SSL_SESS_CACHE_NO_INTERNAL_LOOKUPZSESS_CACHE_NO_INTERNAL_LOOKUPZ SSL_SESS_CACHE_NO_INTERNAL_STOREZSESS_CACHE_NO_INTERNAL_STOREZSSL_SESS_CACHE_NO_INTERNALZSESS_CACHE_NO_INTERNALZSSL_ST_CONNECTZ SSL_ST_ACCEPTZ SSL_ST_MASKZCryptography_HAS_SSL_STZ SSL_ST_INITZ SSL_ST_BEFOREZ SSL_ST_OKZSSL_ST_RENEGOTIATEZ SSL_CB_LOOPZ SSL_CB_EXITZ SSL_CB_READZ SSL_CB_WRITEZ SSL_CB_ALERTZSSL_CB_READ_ALERTZSSL_CB_WRITE_ALERTZSSL_CB_ACCEPT_LOOPZSSL_CB_ACCEPT_EXITZSSL_CB_CONNECT_LOOPZSSL_CB_CONNECT_EXITZSSL_CB_HANDSHAKE_STARTZSSL_CB_HANDSHAKE_DONErrrrr>r*r5rr,r-r.r/r0r1r8rIrYrcrhrnrxrzrZCryptography_HAS_NEXTPROTONEGrZCryptography_HAS_ALPNrZ Cryptography_HAS_TLSEXT_HOSTNAMErrrrDeprecationWarningZ ContextTyper<ZConnectionTypeZSSL_library_initr!r!r!r"s  "@ .                                                                              &)13H;   u