⚝
One Hat Cyber Team
⚝
Your IP:
216.73.216.144
Server IP:
157.245.143.252
Server:
Linux www 6.11.0-9-generic #9-Ubuntu SMP PREEMPT_DYNAMIC Mon Oct 14 13:19:59 UTC 2024 x86_64
Server Software:
nginx/1.26.0
PHP Version:
8.3.11
Buat File
|
Buat Folder
Eksekusi
Dir :
~
/
lib
/
python3
/
dist-packages
/
OpenSSL
/
__pycache__
/
View File Name :
SSL.cpython-312.pyc
fh U d dl Z d dlZd dlZd dlmZ d dlmZmZ d dlm Z m Z d dl m Z d dlm Z mZmZmZmZmZmZ d dlmZ d dlmZ d d lmZ d d lmZ d d lm Z d d lm Z d d lm!Z" d dlm#Z$ d dlm%Z& d dl'm(Z(m)Z)m*Z*m+Z+m,Z,m-Z-m.Z. g dZ/e j` Z0e1e2d< e jf Z3e1e2d< e jh Z4e1e2d< e jj Z5e1e2d< e jl Z6e1e2d< e jn Z7e1e2d< e3Z8e4Z9e5Z:e6Z;e7Z<e jz Z>e j~ Z@dZAdZBdZCdZDd ZEd ZFd ZGd ZHd ZId!ZJe j ZKe1e2d"< e j ZLe1e2d#< e j ZMe1e2d$< e j ZNe1e2d%< e j ZOe1e2d&< e j ZQe1e2d'< e j ZSe1e2d(< e j ZUe1e2d)< e j ZWe1e2d*< e j ZYe1e2d+< e j Z[e1e2d,< e/j d, e j Z_e1e2d-< e j Zae1e2d.< e j Zce1e2d/< e j Zee1e2d0< e j Zge1e2d1< e j Zie1e2d2< e j Zke1e2d3< e j Zme1e2d4< e j Zoe1e2d5< e j Zqe1e2d6< e j Zse1e2d7< e j Zue1e2d8< e j Zwe1e2d9< e j Zye1e2d:< e j Z{e1e2d;< e j Z}e1e2d<< e j Ze j Ze1e2d=< e j Ze1e2d>< e j Ze1e2d?< e j Ze1e2d@< e j Ze1e2dA< e j Ze1e2dB< e j Ze1e2dC< e j Ze1e2dD< e/j dD e j Ze1e2dE< e/j dE e j$ Ze1e2dF< e/j dF e j( Ze1e2dG< e j, Ze1e2dH< e j0 Ze1e2dI< e j4 Ze1e2dJ< e j8 Ze1e2dK< e j< Ze1e2dL< e j@ Ze1e2dM< e jD Ze1e2dN< e jH Ze1e2dO< e jL Ze1e2dP< e jP Ze1e2dQ< e jT Ze1e2dR< e jX Ze1e2dS< e j\ Ze1e2dT< e j^ Ze1e2dU< e j` Ze1e2dV< e jb Ze1e2dW< e jd Ze1e2dX< e jf Ze1e2dY< e jh Ze1e2dZ< e jj Ze1e2d[< e jl Ze1e2d\< e jn Ze1e2d]< e jp Ze1e2d^< e jr Ze1e2d_< e jt Ze1e2d`< e jv Ze1e2da< e jx Ze1e2db< e jz Ze1e2dc< edd Z G de df Z e Zedgej ee ef gdf Zedggef Zedgegef Zedgeee gef Zedgee gef Zee1eee gef Zedge)e1e1e1gef Z G dh di Zg djZdkgZdlZdmZ G dn doeЫ Z eeeѫ Z e eѫ Z G dp dqeѫ Z G dr dseѫ Z G dt dueѫ Z G dv dweѫ Z G dx dyeѫ Z G dz d{ Z G d| d}e٫ Z G d~ de٫ Z G d de٫ Z G d de٫ Z G d de٫ Z G d de٫ Zde de1fdZde1defdZeZde1dedeegef fdZ ee j d Z e ee dd d Z G d d Z G d d Z G d dg Zy# e]$ r Y w xY w# e]$ r Y w xY w# e]$ r Y w xY w# e]$ r Y w xY w) N) errorcode)partialwraps)chaincount)platform)AnyCallableListOptionalSequenceTupleTypeVar)WeakValueDictionary)StrOrBytesPath)exception_from_error_queue)ffi)lib) make_assert)no_zero_allocator) path_bytes)text_to_bytes_and_warn) FILETYPE_PEMX509PKeyX509Name X509Store_EllipticCurve_PassphraseHelper)bOPENSSL_VERSION_NUMBERSSLEAY_VERSION SSLEAY_CFLAGSSSLEAY_PLATFORM SSLEAY_DIRSSLEAY_BUILT_ONOPENSSL_VERSIONOPENSSL_CFLAGSOPENSSL_PLATFORM OPENSSL_DIROPENSSL_BUILT_ON SENT_SHUTDOWNRECEIVED_SHUTDOWN SSLv23_METHOD TLSv1_METHODTLSv1_1_METHODTLSv1_2_METHOD TLS_METHODTLS_SERVER_METHODTLS_CLIENT_METHOD DTLS_METHODDTLS_SERVER_METHODDTLS_CLIENT_METHOD SSL3_VERSION TLS1_VERSIONTLS1_1_VERSIONTLS1_2_VERSIONTLS1_3_VERSION OP_NO_SSLv2 OP_NO_SSLv3 OP_NO_TLSv1 OP_NO_TLSv1_1 OP_NO_TLSv1_2MODE_RELEASE_BUFFERSOP_SINGLE_DH_USEOP_SINGLE_ECDH_USEOP_EPHEMERAL_RSAOP_MICROSOFT_SESS_ID_BUGOP_NETSCAPE_CHALLENGE_BUG#OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG OP_SSLREF2_REUSE_CERT_TYPE_BUG OP_MICROSOFT_BIG_SSLV3_BUFFEROP_MSIE_SSLV2_RSA_PADDINGOP_SSLEAY_080_CLIENT_DH_BUG OP_TLS_D5_BUGOP_TLS_BLOCK_PADDING_BUG OP_DONT_INSERT_EMPTY_FRAGMENTSOP_CIPHER_SERVER_PREFERENCEOP_TLS_ROLLBACK_BUGOP_PKCS1_CHECK_1OP_PKCS1_CHECK_2OP_NETSCAPE_CA_DN_BUG"OP_NETSCAPE_DEMO_CIPHER_CHANGE_BUGOP_NO_COMPRESSIONOP_NO_QUERY_MTUOP_COOKIE_EXCHANGE OP_NO_TICKETOP_ALL VERIFY_PEERVERIFY_FAIL_IF_NO_PEER_CERTVERIFY_CLIENT_ONCE VERIFY_NONESESS_CACHE_OFFSESS_CACHE_CLIENTSESS_CACHE_SERVERSESS_CACHE_BOTHSESS_CACHE_NO_AUTO_CLEAR SESS_CACHE_NO_INTERNAL_LOOKUP SESS_CACHE_NO_INTERNAL_STORESESS_CACHE_NO_INTERNALSSL_ST_CONNECT SSL_ST_ACCEPT SSL_ST_MASK SSL_CB_LOOP SSL_CB_EXIT SSL_CB_READ SSL_CB_WRITE SSL_CB_ALERTSSL_CB_READ_ALERTSSL_CB_WRITE_ALERTSSL_CB_ACCEPT_LOOPSSL_CB_ACCEPT_EXITSSL_CB_CONNECT_LOOPSSL_CB_CONNECT_EXITSSL_CB_HANDSHAKE_STARTSSL_CB_HANDSHAKE_DONEError WantReadErrorWantWriteErrorWantX509LookupErrorZeroReturnError SysCallErrorNO_OVERLAPPING_PROTOCOLSSSLeay_versionSessionContext ConnectionX509VerificationCodesr r& r' r( r) r* r7 r8 r9 r: r; r< r= r> r? r@ OP_NO_TLSv1_3rA rB rC rD rE rF rG rH rI rJ rK rL rM rN rO rP rR rS rT rU rV rW rX OP_NO_RENEGOTIATIONOP_IGNORE_UNEXPECTED_EOFOP_LEGACY_SERVER_CONNECTrY rZ r[ r\ r] r^ r_ r` ra rb rc rd re rf rg rh ri rj rk rl rm rn ro rp rq rr rs rt ru _Tc e Zd Zy)_NoOverlappingProtocolsN__name__ __module__ __qualname__ -/usr/lib/python3/dist-packages/OpenSSL/SSL.pyr r r r r c h e Zd ZdZej Zej Zej Z ej Z ej Zej Zej" Zej& Zej* Zej. Zej2 Zej6 Z ej: Z ej> Z ejB Z"ejF Z$ejJ Z&ejN Z(ejR Z*ejV Z,ejZ Z.ej^ Z0ejb Z2ejf Z4ejj Z6ejn Z8ejr Z:ejv Z<ejz Z>ej~ Z@ej ZBej ZDej ZFej ZHej ZJej ZLej ZNej ZPej ZRej ZTej ZVej ZXej ZZej Z\ej Z^ej Z`ej Zbej Zdej Zfej Zhej Zjej Zlej Znej Zpej Zrej Ztej Zvy)r a\ Success and error codes for X509 verification, as returned by the underlying ``X509_STORE_CTX_get_error()`` function and passed by pyOpenSSL to verification callback functions. See `OpenSSL Verification Errors <https://www.openssl.org/docs/manmaster/man3/X509_verify_cert_error_string.html#ERROR-CODES>`_ for details. N)wr r r __doc___lib X509_V_OKOK$X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT ERR_UNABLE_TO_GET_ISSUER_CERT X509_V_ERR_UNABLE_TO_GET_CRLERR_UNABLE_TO_GET_CRL+X509_V_ERR_UNABLE_TO_DECRYPT_CERT_SIGNATURE$ERR_UNABLE_TO_DECRYPT_CERT_SIGNATURE*X509_V_ERR_UNABLE_TO_DECRYPT_CRL_SIGNATURE#ERR_UNABLE_TO_DECRYPT_CRL_SIGNATURE-X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY&ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY!X509_V_ERR_CERT_SIGNATURE_FAILUREERR_CERT_SIGNATURE_FAILURE X509_V_ERR_CRL_SIGNATURE_FAILUREERR_CRL_SIGNATURE_FAILURE X509_V_ERR_CERT_NOT_YET_VALIDERR_CERT_NOT_YET_VALIDX509_V_ERR_CERT_HAS_EXPIREDERR_CERT_HAS_EXPIRED X509_V_ERR_CRL_NOT_YET_VALIDERR_CRL_NOT_YET_VALIDX509_V_ERR_CRL_HAS_EXPIREDERR_CRL_HAS_EXPIRED)X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD"ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD(X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD!ERR_ERROR_IN_CERT_NOT_AFTER_FIELD)X509_V_ERR_ERROR_IN_CRL_LAST_UPDATE_FIELD"ERR_ERROR_IN_CRL_LAST_UPDATE_FIELD)X509_V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD"ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELDX509_V_ERR_OUT_OF_MEMERR_OUT_OF_MEM&X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT ERR_DEPTH_ZERO_SELF_SIGNED_CERT$X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN ERR_SELF_SIGNED_CERT_IN_CHAIN,X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY%ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY*X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE#ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE X509_V_ERR_CERT_CHAIN_TOO_LONGERR_CERT_CHAIN_TOO_LONGX509_V_ERR_CERT_REVOKEDERR_CERT_REVOKEDX509_V_ERR_INVALID_CAERR_INVALID_CA X509_V_ERR_PATH_LENGTH_EXCEEDEDERR_PATH_LENGTH_EXCEEDEDX509_V_ERR_INVALID_PURPOSEERR_INVALID_PURPOSEX509_V_ERR_CERT_UNTRUSTEDERR_CERT_UNTRUSTEDX509_V_ERR_CERT_REJECTEDERR_CERT_REJECTED"X509_V_ERR_SUBJECT_ISSUER_MISMATCHERR_SUBJECT_ISSUER_MISMATCH X509_V_ERR_AKID_SKID_MISMATCHERR_AKID_SKID_MISMATCH&X509_V_ERR_AKID_ISSUER_SERIAL_MISMATCH ERR_AKID_ISSUER_SERIAL_MISMATCH X509_V_ERR_KEYUSAGE_NO_CERTSIGNERR_KEYUSAGE_NO_CERTSIGN#X509_V_ERR_UNABLE_TO_GET_CRL_ISSUER ERR_UNABLE_TO_GET_CRL_ISSUER'X509_V_ERR_UNHANDLED_CRITICAL_EXTENSION ERR_UNHANDLED_CRITICAL_EXTENSION X509_V_ERR_KEYUSAGE_NO_CRL_SIGNERR_KEYUSAGE_NO_CRL_SIGN+X509_V_ERR_UNHANDLED_CRITICAL_CRL_EXTENSION$ERR_UNHANDLED_CRITICAL_CRL_EXTENSIONX509_V_ERR_INVALID_NON_CAERR_INVALID_NON_CA%X509_V_ERR_PROXY_PATH_LENGTH_EXCEEDED ERR_PROXY_PATH_LENGTH_EXCEEDED(X509_V_ERR_KEYUSAGE_NO_DIGITAL_SIGNATURE!ERR_KEYUSAGE_NO_DIGITAL_SIGNATURE)X509_V_ERR_PROXY_CERTIFICATES_NOT_ALLOWED"ERR_PROXY_CERTIFICATES_NOT_ALLOWED X509_V_ERR_INVALID_EXTENSIONERR_INVALID_EXTENSION#X509_V_ERR_INVALID_POLICY_EXTENSION ERR_INVALID_POLICY_EXTENSION X509_V_ERR_NO_EXPLICIT_POLICYERR_NO_EXPLICIT_POLICY X509_V_ERR_DIFFERENT_CRL_SCOPEERR_DIFFERENT_CRL_SCOPE(X509_V_ERR_UNSUPPORTED_EXTENSION_FEATURE!ERR_UNSUPPORTED_EXTENSION_FEATURE X509_V_ERR_UNNESTED_RESOURCEERR_UNNESTED_RESOURCE X509_V_ERR_PERMITTED_VIOLATIONERR_PERMITTED_VIOLATION X509_V_ERR_EXCLUDED_VIOLATIONERR_EXCLUDED_VIOLATIONX509_V_ERR_SUBTREE_MINMAXERR_SUBTREE_MINMAX&X509_V_ERR_UNSUPPORTED_CONSTRAINT_TYPE ERR_UNSUPPORTED_CONSTRAINT_TYPE(X509_V_ERR_UNSUPPORTED_CONSTRAINT_SYNTAX!ERR_UNSUPPORTED_CONSTRAINT_SYNTAX"X509_V_ERR_UNSUPPORTED_NAME_SYNTAXERR_UNSUPPORTED_NAME_SYNTAX$X509_V_ERR_CRL_PATH_VALIDATION_ERROR ERR_CRL_PATH_VALIDATION_ERROR X509_V_ERR_HOSTNAME_MISMATCHERR_HOSTNAME_MISMATCHX509_V_ERR_EMAIL_MISMATCHERR_EMAIL_MISMATCH X509_V_ERR_IP_ADDRESS_MISMATCHERR_IP_ADDRESS_MISMATCH#X509_V_ERR_APPLICATION_VERIFICATION ERR_APPLICATION_VERIFICATIONr r r r r + s B$($M$M! = = 88 ) 77 ( :: + "&!G!G $ E E ! ? ? ;; = = 99 66 ' 55 & 66 ' 66 ' //N 33 $ %)$M$M! 99 * 77 ( # A A33//N # C C 99 77 55"&"I"I ! ? ? 33 $ $ C C #'#K#K 44 % $ C C 88 ) 77%)%O%O" 55 & 66 ' ! = =#'#K#K ! ? ? " A A 55 & ! = = " A A ! ? ? 77 33 $ 55 & #'"I"I $($M$M! = = 77 " A A#'#K#K r r )z"/etc/ssl/certs/ca-certificates.crtz /etc/pki/tls/certs/ca-bundle.crtz/etc/ssl/ca-bundle.pemz/etc/pki/tls/cacert.pemz1/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pemz/etc/ssl/certss$ /opt/pyca/cryptography/openssl/certss' /opt/pyca/cryptography/openssl/cert.pemc e Zd ZdZy)rv z4 An error occurred in an `OpenSSL.SSL` API. N)r r r r r r r rv rv s r rv c e Zd Zy)rw Nr r r r rw rw r r rw c e Zd Zy)rx Nr r r r rx rx r r rx c e Zd Zy)ry Nr r r r ry ry r r ry c e Zd Zy)rz Nr r r r rz rz r r rz c e Zd Zy)r{ Nr r r r r{ r{ r r r{ c e Zd ZdZddZddZy)_CallbackExceptionHelpera A base class for wrapper classes that allow for intelligent exception handling in OpenSSL callbacks. :ivar list _problems: Any exceptions that occurred while executing in a context where they could not be raised in the normal way. Typically this is because OpenSSL has called into some Python code and requires a return value. The exceptions are saved to be raised later when it is possible to do so. Nc g | _ y N) _problemsselfs r __init__z!_CallbackExceptionHelper.__init__ s *,r c | j r& t | j j d y# t $ r Y 'w xY w)z Raise an exception from the OpenSSL error queue or that was previously captured whe running a callback. r N)r _raise_current_errorrv popr s r raise_if_problemz)_CallbackExceptionHelper.raise_if_problem sF >> $& ..$$Q' ' s 4 A A returnN)r r r r r r! r r r r r s - (r r c e Zd ZdZdeddfdZy) _VerifyHelperz^ Wrap a callback such that it can be used as a certificate verification callback. callbackr# Nc t j t fd }t j d| _ y )Nc t j | }t j | t j | }t j | }t j | }t j }t j || }t j | } ||||| } | r%t j |t j yy# t $ r%} j j | Y d } ~ yd } ~ ww xY w)N r )r X509_STORE_CTX_get_current_cert X509_up_refr _from_raw_x509_ptrX509_STORE_CTX_get_error X509_STORE_CTX_get_error_depth"SSL_get_ex_data_X509_STORE_CTX_idxX509_STORE_CTX_get_ex_datar _reverse_mappingX509_STORE_CTX_set_errorr Exceptionr append) ok store_ctxx509cert error_number error_depthindexssl connectionresulter& r s r wrapperz'_VerifyHelper.__init__.<locals>.wrapper s 77 BD T "**40D 88CL ==iHK;;=E11)UCC#44S9J ! lK 11)T^^L %%a( s ) C D &DD z int (*)(int, X509_STORE_CTX *)r r r _ffir& r r& r@ s `` r r z_VerifyHelper.__init__ s> ))$/ x 2 ,g r )r r r r _VerifyCallbackr r r r r% r% s T r r% c e Zd ZdZdeddfdZy)_ALPNSelectHelperzQ Wrap a callback such that it can be used as an ALPN selection callback. r& r# Nc t j t fd }t j d| _ y )Nc t j | }t j || d d }g }|r)|d } |d| dz } |j | || dz d }|r) || } d} | t u rd} d} nt | t s t d t j dt | t j d| g|_ |j d d |d< |j d |d< | st j S t j S # t $ r5} j j | t j" cY d } ~ S d } ~ ww xY w) Nr r) Tr Fz^ALPN callback must return a bytestring or the special NO_OVERLAPPING_PROTOCOLS sentinel value.zunsigned char *unsigned char[])r r1 rB bufferr4 r| isinstancebytes TypeErrornewlen_alpn_select_callback_argsr SSL_TLSEXT_ERR_NOACKSSL_TLSEXT_ERR_OKr3 r SSL_TLSEXT_ERR_ALERT_FATAL)r< outoutlenin_inlenargconninstr protolist encoded_lenprotooutbytes any_acceptedr? r& r s r r@ z+_ALPNSelectHelper.__init__.<locals>.wrapper s] ( 7!2237 C/2 "'(K !!kAo 6E $$U+ !+/"3 4E $D)4 # 77 "H#(L#He4#K HH .H >HH .93/ ! ; ;A >q Aq 88;A# 444--- 7%%a(666 7s+ AD B%D D E*E E Ez^int (*)(SSL *, unsigned char **, unsigned char *, const unsigned char *, unsigned int, void *)rA rC s `` r r z_ALPNSelectHelper.__init__ sD ))$/ x ) 7 ) 7V ? r )r r r r _ALPNSelectCallbackr r r r rF rF s 5 !4 5 5 r rF c & e Zd ZdZdee ddfdZy)_OCSPServerCallbackHelpera Wrap a callback such that it can be used as an OCSP callback for the server side. Annoyingly, OpenSSL defines one OCSP callback but uses it in two different ways. For servers, that callback is expected to retrieve some OCSP data and hand it to OpenSSL, and may return only SSL_TLSEXT_ERR_OK, SSL_TLSEXT_ERR_FATAL, and SSL_TLSEXT_ERR_NOACK. For clients, that callback is expected to check the OCSP data, and returns a negative value on error, 0 if the response is not acceptable, or positive if it is. These are mutually exclusive return code behaviours, and they mean that we need two helpers so that we always return an appropriate error code if the user's code throws an exception. Given that we have to have two helpers anyway, these helpers are a bit more helpery than most: specifically, they hide a few more of the OpenSSL functions so that the user has an easier time writing these callbacks. This helper implements the server side. r& r# Nc t j t fd }t j d| _ y )Nc t j | }|t j k7 rt j | }nd } || }t |t s t d |syt | }t j | }|t j || d d t j | || y# t $ r%} j j | Y d }~yd }~ww xY w)Nz'OCSP callback must return a bytestring.r r )r r1 rB NULL from_handlerK rL rM rO r OPENSSL_mallocrJ SSL_set_tlsext_status_ocsp_respr3 r r4 ) r< cdatarY data ocsp_dataocsp_data_lengthdata_ptrr? r& r s r r@ z3_OCSPServerCallbackHelper.__init__.<locals>.wrapper` s # !2237 DII% ++E2D D %T4 0 !)U3#$MNN ! $'y> ../?@=F H&67:44#3 %%a( s A$B9 (AB9 9 C'C""C'int (*)(SSL *, void *)rA rC s `` r r z"_OCSPServerCallbackHelper.__init__] s= ))$/ x $ $ L &>H r )r r r r _OCSPServerCallbackr r r r r rb rb G s# **I!4S!9 *Id *Ir rb c & e Zd ZdZdee ddfdZy)_OCSPClientCallbackHelpera Wrap a callback such that it can be used as an OCSP callback for the client side. Annoyingly, OpenSSL defines one OCSP callback but uses it in two different ways. For servers, that callback is expected to retrieve some OCSP data and hand it to OpenSSL, and may return only SSL_TLSEXT_ERR_OK, SSL_TLSEXT_ERR_FATAL, and SSL_TLSEXT_ERR_NOACK. For clients, that callback is expected to check the OCSP data, and returns a negative value on error, 0 if the response is not acceptable, or positive if it is. These are mutually exclusive return code behaviours, and they mean that we need two helpers so that we always return an appropriate error code if the user's code throws an exception. Given that we have to have two helpers anyway, these helpers are a bit more helpery than most: specifically, they hide a few more of the OpenSSL functions so that the user has an easier time writing these callbacks. This helper implements the client side. r& r# Nc t j t fd }t j d| _ y )Nc t j | }|t j k7 rt j | }nd }t j d }t j | | }|dk rd}n t j |d | d d } ||| }t t | S # t $ r%} j j | Y d }~yd }~ww xY w)Nunsigned char **r r )r r1 rB rf rg rN r SSL_get_tlsext_status_ocsp_resprJ intboolr3 r r4 ) r< rj rY rk ocsp_ptrocsp_lenrl validr? r& r s r r@ z3_OCSPClientCallbackHelper.__init__.<locals>.wrapper s !2237 DII% ++E2D D 88$67 ??XNa< #I !% HQK B1 EI y$7 4;'' %%a( s B*B. . C 7CC ro rA rC s `` r r z"_OCSPClientCallbackHelper.__init__ s< ))$/ x < &>H r )r r r r _OCSPClientCallbackr r r r r rr rr s# *"I!4S!9 "Id "Ir rr c e Zd ZdeddfdZy) _CookieGenerateCallbackHelperr& r# Nc t j t fd }t j d| _ y )Nc t j | } | }||dt | t | |d< y# t $ r%}j j | Y d }~yd }~ww xY w)Nr r) )r r1 rO r3 r r4 )r< rT rU rY cookier? r& r s r r@ z7_CookieGenerateCallbackHelper.__init__.<locals>.wrapper sf !2237!$ '-AF $ Kq %%a( s 7; A)A$$A)z/int (*)(SSL *, unsigned char *, unsigned int *)rA rC s `` r r z&_CookieGenerateCallbackHelper.__init__ s? ))$/ x = r )r r r _CookieGenerateCallbackr r r r r r s !8 T r r c e Zd ZdeddfdZy)_CookieVerifyCallbackHelperr& r# Nc t j t fd }t j d| _ y )Nc t j | } |t |d| S # t $ r%}j j | Y d }~yd }~ww xY wNr )r r1 rL r3 r r4 )r< c_cookie cookie_lenrY r? r& r s r r@ z5_CookieVerifyCallbackHelper.__init__.<locals>.wrapper sV !2237 eHQz,B&CDD %%a( s '+ AAAz-int (*)(SSL *, unsigned char *, unsigned int)rA rC s `` r r z$_CookieVerifyCallbackHelper.__init__ s? ))$/ x ; r )r r r _CookieVerifyCallbackr r r r r r s !6 4 r r objr# c d }t | t st | dd }| | } t | t r| }t |t s t d |dk rt d|fz |S )Nfilenoz3argument must be an int, or have a fileno() method.r z1file descriptor cannot be a negative integer (%i))rK rx getattrrM ValueError)r fdmeths r _asFileDescriptorr sv B c3 sHd+ &C#s b# MNN a ?2% G Ir typec R t j t j | S )z Return a string describing the version of OpenSSL in use. :param type: One of the :const:`OPENSSL_` constants defined in this module. )rB stringr OpenSSL_version)r s r r r s ;;t++D1 22r flagerrorc fd}|S )a Builds a decorator that ensures that functions that rely on OpenSSL functions that are not present in this build raise NotImplementedError, rather than AttributeError coming out of cryptography. :param flag: A cryptography flag that guards the functions, e.g. ``Cryptography_HAS_NEXTPROTONEG``. :param error: The string to be used in the exception if the flag is false. c 6 st | fd }|S | S )Nc t r NotImplementedError)argskwargsr s r explodez<_make_requires.<locals>._requires_decorator.<locals>.explode s )%00r )r )funcr r r s r _requires_decoratorz+_make_requires.<locals>._requires_decorator s( 4[ 1 1 NKr r )r r r s `` r _make_requiresr s r zALPN not availableCryptography_HAS_KEYLOGzKey logging not availablec e Zd ZU dZeed< y)r~ z A class representing an SSL session. A session defines certain connection parameters which may be re-used to speed up the setup of subsequent connections. .. versionadded:: 0.14 _sessionN)r r r r r __annotations__r r r r~ r~ 2 s Mr r~ c x e Zd ZU dZeej dfeej efe ej e fe ej e fe ej dfeej dfeej" dfeej& dfeej* dfeej. dfi Zej4 ej6 e ej: e g e f e e f f e!d< de ddfdZ"de ddfdZ#de ddfd Z$ dTd e e% d e e% ddfd Z&d e'e( de)fdZ* dTd e'e( de e( ddfdZ+dUdZ,de-de-de.fdZ/de0e- de0e- ddfdZ1de%ddfdZ2e3fde%de ddfdZ4d e5ddfd Z6d e5ddfd Z7dUd Z8e3fd!e%de ddfd"Z9d#e:ddfd$Z;dUd%Z<d e=ddfd&Z>d'e=ddfd(Z?d)e ddfd*Z@de fd+ZA dTd)e d e eB ddfd,ZCd-e ddfd.ZDde fd/ZEde fd0ZFd1e%ddfd2ZGd3eHddfd4ZId5e=ddfd6ZJd7eKeL ddfd8ZMd9e5ddfd:ZNd;e ddfd<ZOde fd=ZPd e d>e e gdf ddfd?ZQeRd e d>e=gdf ddfd@ ZSde fdAZTdBe ddfdCZUde eV fdDZWdEe ddfdFZXd)e ddfdGZYd e d>gdf ddfdHZZdIe=ddfdJZ[e\dKe0e= ddfdL Z]e\d e^ddfdM Z_dNej eaebf dBe e ddfdOZc dTd ede( dBe e( ddfdPZe dTd efe( dBe e( ddfdQZgd ehddfdRZid ejddfdSZky)Vr au :class:`OpenSSL.SSL.Context` instances define the parameters for setting up new SSL connections. :param method: One of TLS_METHOD, TLS_CLIENT_METHOD, TLS_SERVER_METHOD, DTLS_METHOD, DTLS_CLIENT_METHOD, or DTLS_SERVER_METHOD. SSLv23_METHOD, TLSv1_METHOD, etc. are deprecated and should not be used. N_methodsmethodr# c t |t s t d | j | \ }} | }t |t j k7 t j | }t |t j k7 t j |t j }|| _ d | _ d | _ d | _ d | _ d | _ d | _ d | _ d | _ d | _ d | _ d | _ d | _ d | _ d | _ d | _ d | _ | j= t j> |#| jA | | jC | y y # t $ r t d w xY w)Nzmethod must be an integerzNo such protocol)"rK rx rM r KeyErrorr _openssl_assertrB rf r SSL_CTX_newgc SSL_CTX_free_context_passphrase_helper_passphrase_callback_passphrase_userdata_verify_helper_verify_callback_info_callback_keylog_callback_tlsext_servername_callback _app_data_alpn_select_helper_alpn_select_callback _ocsp_helper_ocsp_callback _ocsp_data_cookie_generate_helper_cookie_verify_helperset_mode SSL_MODE_ENABLE_PARTIAL_WRITEset_min_proto_versionset_max_proto_version)r r method_funcversion method_objcontexts r r zContext.__init__X su &#& 78 8 1#'==#8 K !] dii/0"":.499,-'''4#4#45 ?C HL!37!7;;? " $ +/( @D DH" *. $ " d889 & &w / & &w / K 1 /0 0 1s E# #E8r c \ t t j | j | dk( y)aD Set the minimum supported protocol version. Setting the minimum version to 0 will enable protocol versions down to the lowest version supported by the library. If the underlying OpenSSL build is missing support for the selected version, this method will raise an exception. r) N)r r SSL_CTX_set_min_proto_versionr r r s r r z Context.set_min_proto_version % . .t}}g F! K r c \ t t j | j | dk( y)aC Set the maximum supported protocol version. Setting the maximum version to 0 will enable protocol versions up to the highest version supported by the library. If the underlying OpenSSL build is missing support for the selected version, this method will raise an exception. r) N)r r SSL_CTX_set_max_proto_versionr r s r r z Context.set_max_proto_version r r cafilecapathc |t j }n t | }|t j }n t | }t j | j || }|s t yy)aM Let SSL know where we can find trusted certificates for the certificate chain. Note that the certificates have to be in PEM format. If capath is passed, it must be a directory prepared using the ``c_rehash`` tool included with OpenSSL. Either, but not both, of *pemfile* or *capath* may be :data:`None`. :param cafile: In which file we can find the certificates (``bytes`` or ``str``). :param capath: In which directory we can find the certificates (``bytes`` or ``str``). :return: None N)rB rf _path_bytesr SSL_CTX_load_verify_locationsr r )r r r load_results r load_verify_locationsz Context.load_verify_locations s_ ( >YYF (F >YYF (F88 MM66 " r r& c t dt dt dt dt f fd }t t |dd S )Nsizeverifyuserdatar# c , | |j S r )r )r r r r& r s r r@ z'Context._wrap_callback.<locals>.wrapper s D&$*C*CD Dr T) more_argstruncate)r rx ry r rL r r rC s `` r _wrap_callbackzContext._wrap_callback sU x E# Et Es Eu E E ! 'TD r r c t | s t d | j | | _ | j j | _ t j | j | j || _ y)a Set the passphrase callback. This function will be called when a private key with a passphrase is loaded. :param callback: The Python callback to use. This must accept three positional arguments. First, an integer giving the maximum length of the passphrase it may return. If the returned passphrase is longer than this, it will be truncated. Second, a boolean value which will be true if the user should be prompted for the passphrase twice and the callback should verify that the two values supplied are equal. Third, the value given as the *userdata* parameter to :meth:`set_passwd_cb`. The *callback* must return a byte string. If an error occurs, *callback* should return a false value (e.g. an empty string). :param userdata: (optional) A Python object which will be given as argument to the callback :return: None callback must be callableN) callablerM r r r& r r SSL_CTX_set_default_passwd_cbr r )r r& r s r set_passwd_cbzContext.set_passwd_cb sf . ! 78 8"&"5"5h"? $($;$;$D$D! ** MM444 %-!r c T t j | j }t |dk( t j t j j d }t j t j j d }| j || s}t j t j }t j t j }|t k( r%|t k( r| j t t yyyy)a Specify that the platform provided CA certificates are to be used for verification purposes. This method has some caveats related to the binary wheels that cryptography (pyOpenSSL's primary dependency) ships: * macOS will only load certificates using this method if the user has the ``openssl@1.1`` `Homebrew <https://brew.sh>`_ formula installed in the default location. * Windows will not work. * manylinux cryptography wheels will work on most common Linux distributions in pyOpenSSL 17.1.0 and above. pyOpenSSL detects the manylinux wheel and attempts to load roots via a fallback path. :return: None r) asciiN)r SSL_CTX_set_default_verify_pathsr r rB r X509_get_default_cert_dir_envdecode X509_get_default_cert_file_env_check_env_vars_setX509_get_default_cert_dirX509_get_default_cert_file _CRYPTOGRAPHY_MANYLINUX_CA_DIR _CRYPTOGRAPHY_MANYLINUX_CA_FILE _fallback_default_verify_paths_CERTIFICATE_FILE_LOCATIONS_CERTIFICATE_PATH_LOCATIONS)r set_result dir_env_var file_env_var default_dir default_files r set_default_verify_pathsz Context.set_default_verify_paths s ( ::4==I a( kk$"D"D"FGNN {{ / / 1 &/ '' \B ++d&D&D&FGK ;;t'F'F'HIL == $CC 33/1L D > Cr r r c t j j | duxs! t j j | duS )zp Check to see if the default cert dir/file environment vars are present. :return: bool N)osenvironget)r r r s r r zContext._check_env_vars_set! s8 JJNN< ( 4 7zz~~k*$6 r file_pathdir_pathc |D ]4 }t j j | s#| j | n |D ]5 }t j j | s#| j d| y y)aV Default verify paths are based on the compiled version of OpenSSL. However, when pyca/cryptography is compiled as a manylinux wheel that compiled location can potentially be wrong. So, like Go, we will try a predefined set of paths and attempt to load roots from there. :return: None N)r pathisfiler isdir)r r r r r s r r z&Context._fallback_default_verify_paths, s^ Fww~~f%**62 Fww}}V$**48 r certfilec t t | }t j | j | }|s t yy)z Load a certificate chain from a file. :param certfile: The name of the certificate chain file (``bytes`` or ``str``). Must be PEM encoded. :return: None N)r r "SSL_CTX_use_certificate_chain_filer r )r r r> s r use_certificate_chain_filez"Context.use_certificate_chain_fileB s7 x(88 MM8 " r filetypec t | }t |t s t d t j | j || }|s t yy)ad Load a certificate from a file :param certfile: The name of the certificate file (``bytes`` or ``str``). :param filetype: (optional) The encoding of the file, which is either :const:`FILETYPE_PEM` or :const:`FILETYPE_ASN1`. The default is :const:`FILETYPE_PEM`. :return: None filetype must be an integerN)r rK rx rM r SSL_CTX_use_certificate_filer r )r r r use_results r use_certificate_filez Context.use_certificate_fileS sO x((C( 9: :66 MM8X " r r8 c t |t s t d t j | j |j }|s t yyzs Load a certificate from a X509 object :param cert: The X509 object :return: None z cert must be an X509 instanceN)rK r rM r SSL_CTX_use_certificater _x509r r r8 r s r use_certificatezContext.use_certificatek sB $% ;< <11$--L " r certobjc t |t s t d t j |j }t j | j | }|s t j | t yy)z Add certificate to chain :param certobj: The X509 certificate object to add to the chain :return: None z certobj must be an X509 instanceN) rK r rM r X509_dupr SSL_CTX_add_extra_chain_certr X509_freer )r r copy add_results r add_extra_chain_certz Context.add_extra_chain_certz s\ '4( >? ?}}W]]+66t}}dK NN4 " r c n | j | j j t t y r )r r! rv r r s r _raise_passphrase_exceptionz#Context._raise_passphrase_exception s( " " . # # 4 4U ; r keyfilec t | }t |t s t d t j | j || }|s| j yy)aN Load a private key from a file :param keyfile: The name of the key file (``bytes`` or ``str``) :param filetype: (optional) The encoding of the file, which is either :const:`FILETYPE_PEM` or :const:`FILETYPE_ASN1`. The default is :const:`FILETYPE_PEM`. :return: None r N)r rK rx rM r SSL_CTX_use_PrivateKey_filer r )r r r r s r use_privatekey_filezContext.use_privatekey_file sU g&(C( 9: :55 MM7H , , . r pkeyc t |t s t d t j | j |j }|s| j yyzs Load a private key from a PKey object :param pkey: The PKey object :return: None z pkey must be a PKey instanceN)rK r rM r SSL_CTX_use_PrivateKeyr _pkeyr r r! r s r use_privatekeyzContext.use_privatekey sH $% :; ;00 K , , . r c X t j | j s t yy)z Check if the private key (loaded with :meth:`use_privatekey`) matches the certificate (loaded with :meth:`use_certificate`) :return: :data:`None` (raises :exc:`Error` if something's wrong) N)r SSL_CTX_check_private_keyr r r s r check_privatekeyzContext.check_privatekey s! --dmm< " =r c t j t d| }t |t j k7 t j | j | y)a% Load the trusted certificates that will be sent to the client. Does not actually imply any of the certificates are trusted; that must be configured separately. :param bytes cafile: The path to a certificates file in PEM format. :return: None r N)r SSL_load_client_CA_file_text_to_bytes_and_warnr rB rf SSL_CTX_set_client_CA_listr )r r ca_lists r load_client_cazContext.load_client_ca sE .. #Hf 5 499,- '' w?r bufc t d| }t t j | j |t | dk( y)aV Set the session id to *buf* within which a session can be reused for this Context object. This is needed when doing session resumption, because there is no way for a stored session to know which Context object it is associated with. :param bytes buf: The session id. :returns: None r1 r) N)r- r r SSL_CTX_set_session_id_contextr rO )r r1 s r set_session_idzContext.set_session_id s: &eS1 / / sCH M r modec x t |t s t d t j | j | S )a Set the behavior of the session cache used by all connections using this Context. The previously set mode is returned. See :const:`SESS_CACHE_*` for details about particular modes. :param mode: One or more of the SESS_CACHE_* flags (combine using bitwise or) :returns: The previously set caching mode. .. versionadded:: 0.14 mode must be an integer)rK rx rM r SSL_CTX_set_session_cache_moder r r5 s r set_session_cache_modez Context.set_session_cache_mode s1 $$ 56 6224==$GGr c @ t j | j S )z Get the current session cache mode. :returns: The currently used cache mode. .. versionadded:: 0.14 )r SSL_CTX_get_session_cache_moder r s r get_session_cache_modez Context.get_session_cache_mode s 224==AAr c t |t s t d |>d| _ d| _ t j | j |t j yt | s t d t | | _ | j j | _ t j | j || j y)a Set the verification flags for this Context object to *mode* and specify that *callback* should be used for verification callbacks. :param mode: The verify mode, this should be one of :const:`VERIFY_NONE` and :const:`VERIFY_PEER`. If :const:`VERIFY_PEER` is used, *mode* can be OR:ed with :const:`VERIFY_FAIL_IF_NO_PEER_CERT` and :const:`VERIFY_CLIENT_ONCE` to further control the behaviour. :param callback: The optional Python verification callback to use. This should take five arguments: A Connection object, an X509 object, and three integer variables, which are in turn potential error number, error depth and return code. *callback* should return True if verification passes and False otherwise. If omitted, OpenSSL's default verification is used. :return: None See SSL_CTX_set_verify(3SSL) for further details. r7 Nr ) rK rx rM r r r SSL_CTX_set_verifyr rB rf r r% r& r r5 r& s r set_verifyzContext.set_verify s , $$ 56 6 "&D $(D ! # #DMM4 CH% ;<<"/"9D $($7$7$@$@D ! # #DMM49N9N Or depthc z t |t s t d t j | j | y)z Set the maximum depth for the certificate chain verification that shall be allowed for this Context object. :param depth: An integer specifying the verify depth :return: None zdepth must be an integerN)rK rx rM r SSL_CTX_set_verify_depthr )r rB s r set_verify_depthzContext.set_verify_depth" s. %% 67 7 %%dmmU;r c @ t j | j S )z Retrieve the Context object's verify mode, as set by :meth:`set_verify`. :return: The verify mode )r SSL_CTX_get_verify_moder r s r get_verify_modezContext.get_verify_mode/ s ++DMM::r c @ t j | j S )z Retrieve the Context object's verify depth, as set by :meth:`set_verify_depth`. :return: The verify depth )r SSL_CTX_get_verify_depthr r s r get_verify_depthzContext.get_verify_depth8 s ,,T]];;r dhfilec t | }t j |d }|t j k( r t t j |t j }t j |t j t j t j }t j |t j }t j | j | }t |dk( y)z Load parameters for Ephemeral Diffie-Hellman :param dhfile: The file to load EDH parameters from (``bytes`` or ``str``). :return: None rr) N) r r BIO_new_filerB rf r r BIO_freePEM_read_bio_DHparamsDH_freeSSL_CTX_set_tmp_dhr r )r rL biodhress r load_tmp_dhzContext.load_tmp_dhA s V$ - $)) "ggc4==) ' 'TYY 499 M WWR &%%dmmR8q!r curvec ` t j | j |j y)a Select a curve to use for ECDHE key exchange. :param curve: A curve object to use as returned by either :meth:`OpenSSL.crypto.get_elliptic_curve` or :meth:`OpenSSL.crypto.get_elliptic_curves`. :return: None N)r SSL_CTX_set_tmp_ecdhr _to_EC_KEY)r rX s r set_tmp_ecdhzContext.set_tmp_ecdhV s! !!$--1A1A1CDr cipher_listc t d| }t |t s t d t t j | j | dk( t | d }|j g dk( r t dg y)z Set the list of ciphers to be used in this context. See the OpenSSL manual for more information (e.g. :manpage:`ciphers(1)`). :param bytes cipher_list: An OpenSSL cipher string. :return: None r] z"cipher_list must be a byte string.r) N)TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256TLS_AES_128_GCM_SHA256)z SSL routinesSSL_CTX_set_cipher_listzno cipher match) r- rK rL rM r r rb r r get_cipher_listrv )r r] tmpconns r set_cipher_listzContext.set_cipher_listb s .m[I +u- @A A ( ( D I T4( " " $ ) r certificate_authoritiesc F t j }t |t j k7 |D ] }t |t s"t dt | j d t j |j }t |t j k7 t j || }|rt j | t t j" | j$ | y# t $ r t j | w xY w)a_ Set the list of preferred client certificate signers for this server context. This list of certificate authorities will be sent to the client when the server requests a client certificate. :param certificate_authorities: a sequence of X509Names. :return: None .. versionadded:: 0.10 z)client CAs must be X509Name objects, not z objectsN)r sk_X509_NAME_new_nullr rB rf rK r rM r r X509_NAME_dup_namesk_X509_NAME_pushX509_NAME_freer r3 sk_X509_NAME_freer. r )r rf name_stackca_namer push_results r set_client_ca_listzContext.set_client_ca_list s //1 dii/0 2!'84#C =112(< ))'--8 12 " 4 4Z F "''-(* 3 '' zB " ": . s B D =!D D certificate_authorityc t |t s t d t j | j |j }t |dk( y)ai Add the CA certificate to the list of preferred signers for this context. The list of certificate authorities will be sent to the client when the server requests a client certificate. :param certificate_authority: certificate authority's X509 certificate. :return: None .. versionadded:: 0.10 z.certificate_authority must be an X509 instancer) N)rK r rM r SSL_CTX_add_client_CAr r r )r rr r s r add_client_cazContext.add_client_ca sI /6 LM M// MM066 a(r timeoutc x t |t s t d t j | j | S )aQ Set the timeout for newly created sessions for this Context object to *timeout*. The default value is 300 seconds. See the OpenSSL manual for more information (e.g. :manpage:`SSL_CTX_set_timeout(3)`). :param timeout: The timeout in (whole) seconds :return: The previous session timeout ztimeout must be an integer)rK rx rM r SSL_CTX_set_timeoutr )r rv s r set_timeoutzContext.set_timeout s1 '3' 89 9'' w??r c @ t j | j S )z Retrieve session timeout, as set by :meth:`set_timeout`. The default is 300 seconds. :return: The session timeout )r SSL_CTX_get_timeoutr r s r get_timeoutzContext.get_timeout s '' 66r r c t fd }t j d| | _ t j | j | j y)a Set the information callback to *callback*. This function will be called from time to time during SSL handshakes. :param callback: The Python callback to use. This should take three arguments: a Connection object and two integers. The first integer specifies where in the SSL handshake the function was called, and the other the return code from a (possibly failed) internal function call. :return: None c < t j | || y r r r1 )r< where return_coder& s r r@ z*Context.set_info_callback.<locals>.wrapper s Z005uk Jr z void (*)(const SSL *, int, int)N)r rB r& r r SSL_CTX_set_info_callbackr rC s ` r set_info_callbackzContext.set_info_callback sQ x K K #mm -w &&t}}d6I6IJr c t fd }t j d| | _ t j | j | j y)a Set the TLS key logging callback to *callback*. This function will be called whenever TLS key material is generated or received, in order to allow applications to store this keying material for debugging purposes. :param callback: The Python callback to use. This should take two arguments: a Connection object and a bytestring that contains the key material in the format used by NSS for its SSLKEYLOGFILE debugging output. :return: None c d t j | } t j | | y r )rB r r r1 )r< liner& s r r@ z,Context.set_keylog_callback.<locals>.wrapper s& ;;t$D Z005t <r z#void (*)(const SSL *, const char *)N)r rB r& r r SSL_CTX_set_keylog_callbackr rC s ` r set_keylog_callbackzContext.set_keylog_callback sO " x = = !% 17! (( 8M8MNr c | j S )zw Get the application data (supplied via :meth:`set_app_data()`) :return: The application data r r s r get_app_datazContext.get_app_data ~~ r rk c || _ y)z Set the application data (will be returned from get_app_data()) :param data: Any Python object :return: None Nr r rk s r set_app_datazContext.set_app_data r c t j | j }|t j k( ryt j t }||_ |S )z Get the certificate store for the context. This can be used to add "trusted" certificates without using the :meth:`load_verify_locations` method. :return: A X509Store object or None if it does not have one. N)r SSL_CTX_get_cert_storer rB rf r __new___store)r storepystores r get_cert_storezContext.get_cert_store sC ++DMM: DII ##I. r optionsc x t |t s t d t j | j | S )z Add options. Options set before are not cleared! This method should be used with the :const:`OP_*` constants. :param options: The options to add. :return: The new option bitmask. zoptions must be an integer)rK rx rM r SSL_CTX_set_optionsr )r r s r set_optionszContext.set_options/ s1 '3' 89 9'' w??r c x t |t s t d t j | j | S )z Add modes via bitmask. Modes set before are not cleared! This method should be used with the :const:`MODE_*` constants. :param mode: The mode to add. :return: The new mode bitmask. r7 )rK rx rM r SSL_CTX_set_moder r9 s r r zContext.set_mode< s1 $$ 56 6$$T]]D99r c t fd }t j d| | _ t j | j | j y)a Specify a callback function to be called when clients specify a server name. :param callback: The callback function. It will be invoked with one argument, the Connection instance. .. versionadded:: 0.13 c 8 t j | yr r )r< alertrX r& s r r@ z7Context.set_tlsext_servername_callback.<locals>.wrapperV s Z005 6r z int (*)(SSL *, int *, void *)N)r rB r& r r &SSL_CTX_set_tlsext_servername_callbackr rC s ` r set_tlsext_servername_callbackz&Context.set_tlsext_servername_callbackI sR x ,0== +W, ( 33 MM4;; r profilesc t |t s t d t t j | j | dk( y)z Enable support for negotiating SRTP keying material. :param bytes profiles: A colon delimited list of protection profile names, like ``b'SRTP_AES128_CM_SHA1_80:SRTP_AES128_CM_SHA1_32'``. :return: None z profiles must be a byte string.r N)rK rL rM r r SSL_CTX_set_tlsext_use_srtpr )r r s r set_tlsext_use_srtpzContext.set_tlsext_use_srtpb s; (E* => > , ,T]]H E J r protosc |s t d dj t j d |D }t j d| }t t j | j |t | dk( y)a Specify the protocols that the client is prepared to speak after the TLS connection has been negotiated using Application Layer Protocol Negotiation. :param protos: A list of the protocols to be offered to the server. This list should be a Python list of bytestrings representing the protocols to offer, e.g. ``[b'http/1.1', b'spdy/2']``. 'at least one protocol must be specifiedr c 3 J K | ] }t t | f |f y wr rL rO .0ps r <genexpr>z*Context.set_alpn_protos.<locals>.<genexpr> ! Fv!Ay!11 5v !#rI r N) r joinr from_iterablerB rN r r SSL_CTX_set_alpn_protosr rO r r protostr input_strs r set_alpn_protoszContext.set_alpn_protosq s{ FG G 88 Fv F F HH .9 ( ( y#h- r c t | | _ | j j | _ t j | j | j t j y)a Specify a callback function that will be called on the server when a client offers protocols using ALPN. :param callback: The callback function. It will be invoked with two arguments: the Connection, and a list of offered protocols as bytestrings, e.g ``[b'http/1.1', b'spdy/2']``. It can return one of those bytestrings to indicate the chosen protocol, the empty bytestring to terminate the TLS connection, or the :py:obj:`NO_OVERLAPPING_PROTOCOLS` to indicate that no offered protocol was selected, but that the connection should not be aborted. N) rF r r& r r SSL_CTX_set_alpn_select_cbr rB rf r r& s r set_alpn_select_callbackz Context.set_alpn_select_callback sH $5X#> %)%=%=%F%F" '' MM455tyy r helperc x || _ |j | _ |t j | _ nt j | | _ t j | j | j }t |dk( t j | j | j }t |dk( y)z This internal helper does the common work for ``set_ocsp_server_callback`` and ``set_ocsp_client_callback``, which is almost all of it. Nr) ) r r& r rB rf r new_handler SSL_CTX_set_tlsext_status_cbr r SSL_CTX_set_tlsext_status_arg)r r rk rcs r _set_ocsp_callbackzContext._set_ocsp_callback s # $oo < "iiDO "ood 3DO . . MM4.. a / / t Oa r c > t | }| j || y)a Set a callback to provide OCSP data to be stapled to the TLS handshake on the server side. :param callback: The callback function. It will be invoked with two arguments: the Connection, and the optional arbitrary data you have provided. The callback must return a bytestring that contains the OCSP data to staple to the handshake. If no OCSP data is available for this connection, return the empty bytestring. :param data: Some opaque data that will be passed into the callback function when called. This can be used to avoid needing to do complex data lookups or to keep track of what context is being used. This parameter is optional. N)rb r r r& rk r s r set_ocsp_server_callbackz Context.set_ocsp_server_callback s & +84 -r c > t | }| j || y)a Set a callback to validate OCSP data stapled to the TLS handshake on the client side. :param callback: The callback function. It will be invoked with three arguments: the Connection, a bytestring containing the stapled OCSP assertion, and the optional arbitrary data you have provided. The callback must return a boolean that indicates the result of validating the OCSP data: ``True`` if the OCSP data is valid and the certificate can be trusted, or ``False`` if either the OCSP data is invalid or the certificate has been revoked. :param data: Some opaque data that will be passed into the callback function when called. This can be used to avoid needing to do complex data lookups or to keep track of what context is being used. This parameter is optional. N)rr r r s r set_ocsp_client_callbackz Context.set_ocsp_client_callback s * +84 -r c t | | _ t j | j | j j y r )r r r SSL_CTX_set_cookie_generate_cbr r& r s r set_cookie_generate_callbackz$Context.set_cookie_generate_callback s6 (EX'N$ ++ MM ( ( 1 1 r c t | | _ t j | j | j j y r )r r r SSL_CTX_set_cookie_verify_cbr r& r s r set_cookie_verify_callbackz"Context.set_cookie_verify_callback s6 &A%J" )) MM & & / / r r r" )lr r r r r- r TLS_methodr. r8 r/ r9 r0 r: r1 r2 TLS_server_methodr3 TLS_client_methodr4 DTLS_methodr5 DTLS_server_methodr6 DTLS_client_methodr typingClassVarDictrx r r r r r r r r _StrOrBytesPathr _PassphraseCallbackr r r r r strry r r r r r r r r r r r r r' r* rL r0 r4 r: r= rD rA rE rH rK rW r r\ re r r rq ru ry r| r _requires_keylogr r r r r r r r r _requires_alpnr r` r Unionrr rb r rp r r} r r r r r r r r r r > s .t 5 .9 .9T__d+D 2 2D9D 2 2D9d&&-T 4 4d ;T 4 4d ; foo C hr3w&7# &FGGH -0s -0t -0^ S T S T -1"# )"# )"# "#H +B/ "& -%b) - 2, - -B.` s # $ c.23i ,#? #t #$ :F#'#36# #0 #D #T # #D #T #" 9E/&/25/ /0 /4 /D / # @U @t @ % D "H3 H4 H"B B @D#P#P#+O#<#P #PJ <c <d <; ;<# <"/ "d "* E. ET E%5 %T %N#C'/'9#C #CJ)4 )D )* @3 @4 @ 7S 7K ,S!94!?@K K0 O ,!6!<=O O O4 c 3 " @3 @4 @ :S :T : , !56 2 E d # d5k # d # # J 1D (! %'@ @ ! sm ! !: ".%b). rl. .2 ".%b). rl. .0 / - r r c D e Zd ZU e Zej ed f ed< ddde de e j ddfdZ de defdZd ed eddfd Zde fd Zde ddfd Zde e fdZ dddede e ddfdZdefdZdeddfdZdeddfdZdeddfdZ defdZ deddfdZ defdZ ded ed edefd Z e Z!ded ed edefd Z"ddd ed e e defd!Z#e#Z$ dfd"ed#e e d e e defd$Z%d%ed edejL fd&Z'd edefd'Z(d edefd(Z)de*fd)Z+dgd*Z,de*fd+Z-defd,Z.d-eddfd.Z/d-edefd/Z0de1d ef fd0Z2dgd1Z3de e fd2Z4de*fd3Z5dgd4Z6de*fd5Z7de8e fd6Z9de8e: fd7Z;d8ed9edejL fd:Z<defd;Z=d<eddfd=Z>defd>Z?d?eddfd@Z@defdAZAde e fdBZBde e fdCZCde e fdDZD dddEedFede e defdGZEd8ed9eddfdHZFde e fdIZGde e fdJZHeIdKede8e fdL ZJde e8e fdMZKde e8e fdNZLde*fdOZMde*fdPZNdgdQZOdgdRZPde eQ fdSZRdTeQddfdUZSdVeTeeegef de e fdWZUde e fdXZVde e fdYZWde e fdZZXde e fd[ZYde e fd\ZZde fd]Z[defd^Z\e]d_e8e ddfd` Z^e]defda Z_defdbZ`dgdcZay)hr r1 Nr socketr# c | t |t s t d t j |j }t j |t j | _ t j | j t j || _ d| _ d| _ |j | _ |j | _ |j | _ |j" | _ | | j$ | j < |d| _ t j( t j* | _ t/ | j, t j0 k7 t j( t j* | _ t/ | j2 t j0 k7 t j4 | j | j, | j2 yd| _ d| _ || _ t j6 | j t9 | j& }t/ |dk( y)z Create a new Connection object, using the given OpenSSL.SSL.Context instance and socket. :param context: An SSL Context to use for this connection :param socket: The socket to use for transport layer "context must be a Context instanceNr) ) rK r rM r SSL_newr rB r SSL_free_ssl SSL_set_modeSSL_MODE_AUTO_RETRYr rP r r r r r1 _socketBIO_new BIO_s_mem _into_sslr rf _from_ssl SSL_set_bio SSL_set_fdr )r r r r< r s r r zConnection.__init__ s '7+ @A All7++,GGC / $))T%=%=> +/' & 4 4 ' 8 8 (/'F'F$%,%B%B"+/ dii( > DL !\\$..*: ;DN DNNdii 7 8 !\\$..*: ;DN DNNdii 7 8 TYY G !DN !DN!DL ,T\\:J J!O ,r namec | j &t d| j j d| d t | j | S )zy Look up attributes on the wrapped socket object if they are not found on the Connection object. 'z' object has no attribute ')r AttributeError __class__r r r r s r __getattr__zConnection.__getattr__H sL << DNN++,,GvQO 4<<. .r r< r> c : | j j $| j j j | j j $| j j j | j j $| j j j t j || }|t j k( r t |t j k( r t |t j k( r t |t j k( r t |t j k( rt j dk( rf|dk rUt" dk( rt% j& d }nt$ j( }|dk7 r t+ |t- j. | t+ dd t1 y |t j2 k( rt j dk7 rt j }t j4 | }t j6 r<t9 |t j: k( t j< t+ dd t1 y |t j> k( ry t1 y )Nr win32rv zUnexpected EOF) r r r! r r r SSL_get_errorSSL_ERROR_WANT_READrw SSL_ERROR_WANT_WRITErx SSL_ERROR_ZERO_RETURNrz SSL_ERROR_WANT_X509_LOOKUPry SSL_ERROR_SYSCALLERR_peek_errorr rB getwinerrorerrnor{ r r r SSL_ERROR_SSLERR_GET_REASON-Cryptography_HAS_UNEXPECTED_EOF_WHILE_READINGr "SSL_R_UNEXPECTED_EOF_WHILE_READINGERR_clear_errorSSL_ERROR_NONE)r r< r> r r peeked_errorreasons r _raise_ssl_errorzConnection._raise_ssl_errorT s == ' ' 3 MM ( ( 9 9 ; == , , 8 MM - - > > @ == % % 1 MM & & 7 7 9""3/ D,, , / ! d// / " " d00 0!# # d55 5%' ' d,, ,""$)A: 7* $ 0 0 21 5 $ z *5)--2F GG"2'788 %& d(( (T-@-@-Ba-G ..0L(( 6FAA d E EE $$&"2'788$& d)) ) "r c | j S )zh Retrieve the :class:`Context` object associated with this :class:`Connection`. )r r s r get_contextzConnection.get_context s }} r c t |t s t d t j | j |j || _ y)z Switch this connection to a new session context. :param context: A :class:`Context` instance giving the new session context to use. r N)rK r rM r SSL_set_SSL_CTXr r )r r s r set_contextzConnection.set_context s; '7+ @A A TYY(8(89 r c t j | j t j }|t j k( ryt j | S )z Retrieve the servername extension value if provided in the client hello message, or None if there wasn't one. :return: A byte string giving the server name or :data:`None`. .. versionadded:: 0.13 N)r SSL_get_servernamer TLSEXT_NAMETYPE_host_namerB rf r r s r get_servernamezConnection.get_servername sC && IIt55 499 {{4 r r5 r& c t |t s t d |>d| _ d| _ t j | j |t j yt | s t d t | | _ | j j | _ t j | j || j y)z Override the Context object's verification flags for this specific connection. See :py:meth:`Context.set_verify` for details. r7 Nr ) rK rx rM r r r SSL_set_verifyr rB rf r r% r& r@ s r rA zConnection.set_verify s $$ 56 6 "&D $(D ! 4 ;H% ;<<"/"9D $($7$7$@$@D ! 41F1F Gr c @ t j | j S )z Retrieve the Connection object's verify mode, as set by :meth:`set_verify`. :return: The verify mode )r SSL_get_verify_moder r s r rH zConnection.get_verify_mode s '' 22r r8 c t |t s t d t j | j |j }|s t yyr )rK r rM r SSL_use_certificater r r r s r r zConnection.use_certificate sB $% ;< <--diiD " r r! c t |t s t d t j | j |j }|s| j j yyr# ) rK r rM r SSL_use_PrivateKeyr r% r r r& s r r' zConnection.use_privatekey sL $% :; ;,,TYY C MM 5 5 7 r mtuc D t j | j | y)aK For DTLS, set the maximum UDP payload size (*not* including IP/UDP overhead). Note that you might have to set :data:`OP_NO_QUERY_MTU` to prevent OpenSSL from spontaneously clearing this. :param mtu: An integer giving the maximum transmission unit. .. versionadded:: 21.1 N)r SSL_set_mtur )r r s r set_ciphertext_mtuz Connection.set_ciphertext_mtu s C(r c v t t d s t d t j | j S )a For DTLS, get the maximum size of unencrypted data you can pass to :meth:`write` without exceeding the MTU (as passed to :meth:`set_ciphertext_mtu`). :return: The effective MTU as an integer. .. versionadded:: 21.1 DTLS_get_data_mtuz requires OpenSSL 1.1.1 or better)hasattrr r r r r s r get_cleartext_mtuz Connection.get_cleartext_mtu s0 t 01%&HI I%%dii00r c t |t s t d d|v r t d t j | j | y)z Set the value of the servername extension to send in the client hello. :param name: A byte string giving the name. .. versionadded:: 0.13 zname must be a byte string z name must not contain NUL byteN)rK rL rM r SSL_set_tlsext_host_namer r s r set_tlsext_host_namez Connection.set_tlsext_host_name sC $& 89 9 d] <= = %%dii6r c @ t j | j S )z Get the number of bytes that can be safely read from the SSL buffer (**not** the underlying transport buffer). :return: The number of bytes available in the receive buffer. )r SSL_pendingr r s r pendingzConnection.pending s **r r1 flagsc 2 t d| }t j | 5 }t | dkD r t d t j | j |t | }| j | j | |cddd S # 1 sw Y yxY w)a Send data on the connection. NOTE: If you get one of the WantRead, WantWrite or WantX509Lookup exceptions on this, you have to call the method again with the SAME buffer. :param buf: The string, buffer or memoryview to send :param flags: (optional) Included for compatibility with the socket API, the value is ignored :return: The number of bytes written r1 z,Cannot send more than 2**31-1 bytes at once.N) r- rB from_bufferrO r r SSL_writer r )r r1 r) rk r> s r sendzConnection.send# s{ &eS1 c "d3x*$ B ^^DIItSY?F ! !$))V 4 # " "s A!B Bc @ t d| }t j | 5 }t | }d}|rWt j | j ||z t |d }| j | j | ||z }||z }|rW|cddd S # 1 sw Y yxY w)a Send "all" data on the connection. This calls send() repeatedly until all data is sent. If an error occurs, it's impossible to tell how much data has been sent. :param buf: The string, buffer or memoryview to send :param flags: (optional) Included for compatibility with the socket API, the value is ignored :return: The number of bytes written r1 r r+ N) r- rB r, rO r r- r minr )r r1 r) rk left_to_send total_sentr> s r sendallzConnection.sendall? s &eS1 c "d s8LJ IItj 0#lJ2O %%dii8f$ & # " "s A&B BB bufsizc 4 t d| }|5|t j z r"t j | j || }n!t j | j || }| j | j | t j || dd S )a Receive data on the connection. :param bufsiz: The maximum number of bytes to read :param flags: (optional) The only supported flag is ``MSG_PEEK``, all other flags are ignored. :return: The string read from the Connection char[]N) _no_zero_allocatorr MSG_PEEKr SSL_peekr SSL_readr rB rJ )r r4 r) r1 r> s r recvzConnection.recv\ sw !62 !8]]499c6:F]]499c6:F dii0{{3'**r rJ nbytesc | t | }nt |t | }t d| }|5|t j z r"t j | j || }n!t j | j || }| j | j | t t j || |d| |S )ae Receive data on the connection and copy it directly into the provided buffer, rather than creating a new string. :param buffer: The buffer to copy into. :param nbytes: (optional) The maximum number of bytes to read into the buffer. If not present, defaults to the size of the buffer. If larger than the size of the buffer, is reduced to the size of the buffer. :param flags: (optional) The only supported flag is ``MSG_PEEK``, all other flags are ignored. :return: The number of bytes read into the buffer. Nr6 ) rO r0 r7 r r8 r r9 r r: r memoryviewrB rJ )r rJ r< r) r1 r> s r recv_intozConnection.recv_intoo s & >[FV-F !62 !8]]499c6:F]]499c6:F dii0 %T[[f%=>w r rT c t j | rit j | r t t j | r t t j | r t d t d t y )NBIO_should_io_specialzunknown bio failure) r BIO_should_retryBIO_should_readrw BIO_should_writerx rA r r )r rT r> s r _handle_bio_errorsz Connection._handle_bio_errors so %##C(#o%&&s+$&&++C0 !!899 !!677 ! "r c 4 | j t d t |t s t d t d| }t j | j || }|dk r | j | j | t j || dd S )a If the Connection was created with a memory BIO, this method can be used to read bytes from the write end of that memory BIO. Many Connection methods will add bytes which must be read in this manner or the buffer will eventually fill up and the Connection will be able to take no further actions. :param bufsiz: The maximum number of bytes to read :return: The string read. N Connection sock was not Nonezbufsiz must be an integerr6 r ) r rM rK rx r7 r BIO_readrE rB rJ )r r4 r1 r> s r bio_readzConnection.bio_read s >> ! :; ;&#& 78 8 62 t~~sF; Q; # #DNNF ;{{3'**r c 8 t d| }| j t d t j | 5 }t j | j |t | }|dk r | j | j | |cddd S # 1 sw Y yxY w)aj If the Connection was created with a memory BIO, this method can be used to add bytes to the read end of that memory BIO. The Connection can then read the bytes (for example, in response to a call to :meth:`recv`). :param buf: The string to put into the memory BIO. :return: The number of bytes written r1 NrG r ) r- r rM rB r, r BIO_writerO rE )r r1 rk r> s r bio_writezConnection.bio_write sz &eS1 >> ! :; ; c "d^^DNND#d)DF{''? # " "s A BBc | | j s,t t j | j dk( yy)zv Renegotiate the session. :return: True if the renegotiation can be started, False otherwise r) TF)renegotiate_pendingr r SSL_renegotiater r s r renegotiatezConnection.renegotiate s2 '') D 0 0 ;q @ Ar c z t j | j }| j | j | y)a Perform an SSL handshake (usually called after :meth:`renegotiate` or one of :meth:`set_accept_state` or :meth:`set_connect_state`). This can raise the same exceptions as :meth:`send` and :meth:`recv`. :return: None. N)r SSL_do_handshaker r r r> s r do_handshakezConnection.do_handshake s, &&tyy1 dii0r c F t j | j dk( S )z Check if there's a renegotiation in progress, it will return False once a renegotiation is finished. :return: Whether there's a renegotiation in progress r) )r SSL_renegotiate_pendingr r s r rN z Connection.renegotiate_pending s ++DII6!;;r c @ t j | j S )zn Find out the total number of renegotiations. :return: The number of renegotiations. )r SSL_total_renegotiationsr r s r total_renegotiationsz Connection.total_renegotiations s ,,TYY77r addrc v t j | j | j j | S )a4 Call the :meth:`connect` method of the underlying socket and set up SSL on the socket, using the :class:`Context` object supplied to this :class:`Connection` object at creation. :param addr: A remote address :return: What the socket's connect method returns )r SSL_set_connect_stater r connect)r rZ s r r] zConnection.connect s+ ""499-||##D))r c ^ | j j }| j || S )a Call the :meth:`connect_ex` method of the underlying socket and set up SSL on the socket, using the Context object supplied to this Connection object at creation. Note that if the :meth:`connect_ex` method of the socket doesn't return 0, SSL won't be initialized. :param addr: A remove address :return: What the socket's connect_ex method returns )r connect_exset_connect_state)r rZ r_ s r r_ zConnection.connect_ex s* \\,, $ r c | j j \ }}t | j | }|j ||fS )a Call the :meth:`accept` method of the underlying socket and set up SSL on the returned socket, using the Context object supplied to this :class:`Connection` object at creation. :return: A *(conn, addr)* pair where *conn* is the new :class:`Connection` object created, and *address* is as returned by the socket's :meth:`accept`. )r acceptr r set_accept_state)r clientrZ rY s r rb zConnection.accept s@ ||**, $--0 d|r c t j } t j | j | }t j | | j | j j | j | j j |dk( r t |dk r | j | j | yy# t j | w xY w)z Call the OpenSSL function DTLSv1_listen on this connection. See the OpenSSL manual for more details. :return: None Nr ) r BIO_ADDR_new DTLSv1_listenr BIO_ADDR_freer r! r rw r )r bio_addrr> s r rg zConnection.DTLSv1_listen( s $$& )'' 8<F x ( ' ' 3 ( ( 9 9 ; % % 1 & & 7 7 9 Q; / ! A: ! !$))V 4 x (s C C c t j d }t j d }t j | j || r|d |d dz z S y)a} Determine when the DTLS SSL object next needs to perform internal processing due to the passage of time. When the returned number of seconds have passed, the :meth:`DTLSv1_handle_timeout` method needs to be called. :return: The time left in seconds before the next timeout or `None` if no timeout is currently active. ztime_t *zlong *r i@B N)rB rN r Cryptography_DTLSv1_get_timeoutr )r ptv_secptv_usecs r DTLSv1_get_timeoutz Connection.DTLSv1_get_timeoutB sQ ((:&88H% / / 7H M1:!w!67 7r c t j | j }|dk r#| j | j | J d t | S )z Handles any timeout events which have become pending on a DTLS SSL object. :return: `True` if there was a pending timeout, `False` otherwise. r unreachable)r DTLSv1_handle_timeoutr r ry rS s r rq z Connection.DTLSv1_handle_timeoutT sG ++DII6 A: ! !$))V 4 '- '5< r c r | j t d t j | j d y)z If the Connection was created with a memory BIO, this method can be used to indicate that *end of file* has been reached on the read end of that memory BIO. :return: None NrG r )r rM r BIO_set_mem_eof_returnr r s r bio_shutdownzConnection.bio_shutdownb s. >> ! :; ; ##DNNA6r c t j | j }|dk r#| j | j | J d |dkD ryy)aQ Send the shutdown message to the Connection. :return: True if the shutdown completed successfully (i.e. both sides have sent closure alerts), False otherwise (in which case you call :meth:`recv` or :meth:`send` when the connection becomes readable/writeable). r Frp T)r SSL_shutdownr r rS s r shutdownzConnection.shutdowno sJ ""499- A: ! !$))V 4 '- '5 aZr c g }t D ]k }t j | j | }|t j k( r |S |j t j | j d m |S )z Retrieve the list of ciphers used by the Connection object. :return: A list of native cipher strings. utf-8) r r SSL_get_cipher_listr rB rf r4 r r )r ciphersir> s r rc zConnection.get_cipher_list sh A--dii;F" NN4;;v.55g> ? r c t j | j }|t j k( rg S g }t t j | D ] }t j || }t j | }t |t j k7 t j t }t j |t j |_ |j | |S )a Get CAs whose certificates are suggested for client authentication. :return: If this is a server connection, the list of certificate authorities that will be sent or has been sent to the client, as controlled by this :class:`Connection`'s :class:`Context`. If this is a client connection, the list will be empty until the connection with the server is established. .. versionadded:: 0.10 )r SSL_get_client_CA_listr rB rf rangesk_X509_NAME_numsk_X509_NAME_valueri r r r r rl rj r4 )r ca_namesr> r| r r pynames r get_client_ca_listz Connection.get_client_ca_list s ..tyy9 tyy It,,X67A**8Q7D%%d+D DDII - . %%h/F 774)<)<=FL MM& ! 8 r r r c t d )z The makefile() method is not implemented, since there is no dup semantics for SSL connections :raise: NotImplementedError z1Cannot make file object of OpenSSL.SSL.Connectionr r r r s r makefilezConnection.makefile s " ? r c | j S )zr Retrieve application data as set by :meth:`set_app_data`. :return: The application data r r s r r zConnection.get_app_data r r rk c || _ y)zg Set application data :param data: The application data :return: None Nr r s r r zConnection.set_app_data r r c @ t j | j S )z Get the shutdown state of the Connection. :return: The shutdown state, a bitvector of SENT_SHUTDOWN, RECEIVED_SHUTDOWN. )r SSL_get_shutdownr r s r get_shutdownzConnection.get_shutdown s $$TYY//r statec z t |t s t d t j | j | y)z Set the shutdown state of the Connection. :param state: bitvector of SENT_SHUTDOWN, RECEIVED_SHUTDOWN. :return: None zstate must be an integerN)rK rx rM r SSL_set_shutdownr )r r s r set_shutdownzConnection.set_shutdown s. %% 67 7 dii/r c f t j t j | j S )z Retrieve a verbose string detailing the state of the Connection. :return: A string representing the state )rB r r SSL_state_string_longr r s r get_state_stringzConnection.get_state_string s" {{455dii@AAr c n t j | j }|t j k( ryt j | j t j d }t |dkD t d| }t j | j || t j || dd S )z Retrieve the random value used with the server hello message. :return: A string representing the state Nr rI ) r SSL_get_sessionr rB rf SSL_get_server_randomr r7 rJ r sessionlengthoutps r server_randomzConnection.server_random s &&tyy1 dii ++DIItyy!D #!"3V< ""499dF;{{4(++r c n t j | j }|t j k( ryt j | j t j d }t |dkD t d| }t j | j || t j || dd S )z Retrieve the random value used with the client hello message. :return: A string representing the state Nr rI ) r r r rB rf SSL_get_client_randomr r7 rJ r s r client_randomzConnection.client_random s &&tyy1 dii ++DIItyy!D #!"3V< ""499dF;{{4(++r c F t j | j }|t j k( ryt j |t j d }t |dkD t d| }t j ||| t j || dd S )zz Retrieve the value of the master key for this session. :return: A string representing the state Nr rI ) r r r rB rf SSL_SESSION_get_master_keyr r7 rJ r s r master_keyzConnection.master_key s &&tyy1 dii 00$))QG #!"3V< ''v>{{4(++r labelolenc t d| }t j }d}d}||}t | }d}t j | j |||t | ||| }t |dk( t j || dd S )aH Obtain keying material for application use. :param: label - a disambiguating label string as described in RFC 5705 :param: olen - the length of the exported key material in bytes :param: context - a per-association context value :return: the exported key material bytes or None rI r Nr) ) r7 rB rf rO r SSL_export_keying_materialr r rJ ) r r r r r context_buf context_len use_contextsuccesss r export_keying_materialz!Connection.export_keying_material s ""3T:ii !K g,KK11 II J 1 %{{4&q))r c : | j j |i |S )z Call the :meth:`shutdown` method of the underlying socket. See :manpage:`shutdown(2)`. :return: What the socket's shutdown() method returns )r rw r s r sock_shutdownzConnection.sock_shutdown4 s %t||$$d5f55r c t j | j }|t j k7 r*t j | t j | S y)za Retrieve the local certificate (if any) :return: The local certificate N)r SSL_get_certificater rB rf r+ r r, r r8 s r get_certificatezConnection.get_certificate= sF '' 2 499 T "**40 0r c t j | j }|t j k7 rt j | S y)zi Retrieve the other side's certificate (if any) :return: The peer's certificate N)r SSL_get_peer_certificater rB rf r r, r s r get_peer_certificatez Connection.get_peer_certificateI s8 ,,TYY7 499 **40 0r cert_stackc F g }t t j | D ]} }t j | | }t |t j k7 t j | }t |dk\ t j | }|j | |S )zb Internal helper to convert a STACK_OF(X509) to a list of X509 instances. r) ) r r sk_X509_num sk_X509_valuer rB rf r+ r r, r4 )r r> r| r8 rV pycerts r _cert_stack_to_listz Connection._cert_stack_to_listT s t'' 34A%%j!4D DDII - .""4(C C1H %,,T2F MM& ! 5 r c t j | j }|t j k( ry| j | S )z Retrieve the other side's certificate (if any) :return: A list of X509 instances giving the peer's certificate chain, or None if it does not have one. N)r SSL_get_peer_cert_chainr rB rf r r r s r get_peer_cert_chainz Connection.get_peer_cert_chaind s8 11$))< "'' 33r c t j | j }|t j k( ry| j | S )a Retrieve the verified certificate chain of the peer including the peer's end entity certificate. It must be called after a session has been successfully established. If peer verification was not successful the chain may be incomplete, invalid, or None. :return: A list of X509 instances giving the peer's verified certificate chain, or None if it does not have one. .. versionadded:: 20.0 N)r SSL_get0_verified_chainr rB rf r r s r get_verified_chainz Connection.get_verified_chainq s8 11$))< "'' 33r c @ t j | j S )z Checks if more data has to be read from the transport layer to complete an operation. :return: True iff more data has to be read )r SSL_want_readr r s r want_readzConnection.want_read s !!$)),,r c @ t j | j S )z Checks if there is data to write to the transport layer to complete an operation. :return: True iff there is data to write )r SSL_want_writer r s r want_writezConnection.want_write s ""499--r c B t j | j y)z Set the connection to work in server mode. The handshake will be handled automatically by read/write. :return: None N)r SSL_set_accept_stater r s r rc zConnection.set_accept_state s !!$)),r c B t j | j y)z Set the connection to work in client mode. The handshake will be handled automatically by read/write. :return: None N)r r\ r r s r r` z Connection.set_connect_state s ""499-r c t j | j }|t j k( ryt j t }t j |t j |_ |S )z Returns the Session currently used. :return: An instance of :class:`OpenSSL.SSL.Session` or :obj:`None` if no session exists. .. versionadded:: 0.14 N) r SSL_get1_sessionr rB rf r~ r r SSL_SESSION_freer )r r pysessions r get_sessionzConnection.get_session sT '' 2 dii OOG, !WWWd.C.C D r r c t |t s t d t j | j |j }t |dk( y)z Set the session to be used when the TLS/SSL connection is established. :param session: A Session instance representing the session to use. :returns: None .. versionadded:: 0.14 z"session must be a Session instancer) N)rK r~ rM r SSL_set_sessionr r r )r r r> s r set_sessionzConnection.set_session sB '7+ @A A%%dii1A1AB! $r functionc t j dd } || j |d }|dk( ryt d| } || j || t j || dd S )aN Helper to implement :meth:`get_finished` and :meth:`get_peer_finished`. :param function: Either :data:`SSL_get_finished`: or :data:`SSL_get_peer_finished`. :return: :data:`None` if the desired message has not yet been received, otherwise the contents of the message. r6 r N)rB rN r r7 rJ )r r emptyr r1 s r _get_finished_messagez Connection._get_finished_message sb 2 1% 5!, 19 40C&{{3%a((r c @ | j t j S )z Obtain the latest TLS Finished message that we sent. :return: The contents of the message or :obj:`None` if the TLS handshake has not yet completed. .. versionadded:: 0.15 )r r SSL_get_finishedr s r get_finishedzConnection.get_finished s ))$*?*?@@r c @ | j t j S )z Obtain the latest TLS Finished message that we received from the peer. :return: The contents of the message or :obj:`None` if the TLS handshake has not yet completed. .. versionadded:: 0.15 )r r SSL_get_peer_finishedr s r get_peer_finishedz Connection.get_peer_finished s ))$*D*DEEr c t j | j }|t j k( ryt j t j | }|j d S )z Obtain the name of the currently used cipher. :returns: The name of the currently used cipher or :obj:`None` if no connection has been established. .. versionadded:: 0.15 Nry )r SSL_get_current_cipherr rB rf r SSL_CIPHER_get_namer )r cipherr s r get_cipher_namezConnection.get_cipher_name sO ,,TYY7 TYY ;;t 7 7 ?@D;;w' 'r c t j | j }|t j k( ryt j |t j S )z Obtain the number of secret bits of the currently used cipher. :returns: The number of secret bits of the currently used cipher or :obj:`None` if no connection has been established. .. versionadded:: 0.15 N)r r r rB rf SSL_CIPHER_get_bits)r r s r get_cipher_bitszConnection.get_cipher_bits s> ,,TYY7 TYY ++FDII> >r c t j | j }|t j k( ryt j t j | }|j d S )z Obtain the protocol version of the currently used cipher. :returns: The protocol name of the currently used cipher or :obj:`None` if no connection has been established. .. versionadded:: 0.15 Nry )r r r rB rf r SSL_CIPHER_get_versionr )r r r s r get_cipher_versionz Connection.get_cipher_version sO ,,TYY7 TYY kk$"="=f"EFG>>'* *r c t j t j | j }|j d S )a Retrieve the protocol version of the current connection. :returns: The TLS version of the current connection, for example the value for TLS 1.2 would be ``TLSv1.2``or ``Unknown`` for connections that were not successfully established. ry )rB r r SSL_get_versionr r r s r get_protocol_version_namez$Connection.get_protocol_version_name0 s0 ++d 2 2499 =>~~g&&r c D t j | j }|S )z Retrieve the SSL or TLS protocol version of the current connection. :returns: The TLS version of the current connection. For example, it will return ``0x769`` for connections made over TLS version 1. )r SSL_versionr r s r get_protocol_versionz Connection.get_protocol_version; s ""499-r r c |s t d dj t j d |D }t j d| }t t j | j |t | dk( y)ah Specify the client's ALPN protocol list. These protocols are offered to the server during protocol negotiation. :param protos: A list of the protocols to be offered to the server. This list should be a Python list of bytestrings representing the protocols to offer, e.g. ``[b'http/1.1', b'spdy/2']``. r r c 3 J K | ] }t t | f |f y wr r r s r r z-Connection.set_alpn_protos.<locals>.<genexpr>Y r r rI r N) r r r r rB rN r r SSL_set_alpn_protosr rO r s r r zConnection.set_alpn_protosE ss FG G 88 Fv F F HH .9 $ $TYY 3x= IQ N r c t j d }t j d }t j | j || |syt j |d |d dd S )z Get the protocol that was negotiated by ALPN. :returns: A bytestring of the protocol name. If no protocol has been negotiated yet, returns an empty bytestring. ru zunsigned int *r r N)rB rN r SSL_get0_alpn_selectedr rJ )r rk data_lens r get_alpn_proto_negotiatedz$Connection.get_alpn_proto_negotiatedh s\ xx*+88 ,- ##DIItX>{{47HQK033r c t j | j }|syt j |j S )z Get the SRTP protocol which was negotiated. :returns: A bytestring of the SRTP profile name. If no profile has been negotiated yet, returns an empty bytestring. r )r SSL_get_selected_srtp_profiler rB r r )r profiles r get_selected_srtp_profilez$Connection.get_selected_srtp_profilez s1 44TYY?{{7<<((r c | t j | j t j }t |dk( y)a Called to request that the server sends stapled OCSP data, if available. If this is not called on the client side then the server will not send OCSP data. Should be used in conjunction with :meth:`Context.set_ocsp_client_callback`. r) N)r SSL_set_tlsext_status_typer TLSEXT_STATUSTYPE_ocspr )r r s r request_ocspzConnection.request_ocsp s1 , , IIt22 a r r )r )NNr" )br r r r r1 r MutableMappingr r r r r r r r rx r r r rL r rD rA rH r r r r' r r! r% r( r. writer3 r; readr? NoReturnrE rI rL ry rP rT rN rY r] r_ r rb rg rn rq rt rw r rc r r r r r r r r r r r r r r r staticmethodr r r r r rc r` r~ r r r r r r r r r r r r r r r r r r r r r sg f++C ,=> CG:- :-(0 (?:- :-x / / /5#C 5# 5# 5#n W 7 t ! !$ @DHH#+O#<H H,3 3 #D #T # 84 8D 8 )c )d ) 13 1 7 74 7 + + c # 4 E 5 S :+3 +x} + +" D !% # (( ( } ( (T#c #3 #6?? #$+s +u +0U s * T 1<T <8c 8 *C *D * s s lC /0 54HSM $ t 7$ $ c DN : c S V__ c 0c 0 0# 0$ 0B% B ,x , ,x , ,HUO ," CG * *"% *08 * *@63 6# 6$ 6 $ htn T 4Xd4j%9 44HT$Z$8 4&-4 -.D .-.Xg . " %7 %t % !) #sC #!56!) % !)F Ahuo A F8E? F(# ( ?# ? +HSM + '3 'c d5k d D 45 4 4" )5 ) !r )r r r r r functoolsr r itertoolsr r sysr r r r r r r r weakrefr OpenSSL._utilr r r _exception_from_error_queuer rB r r r _make_assertr r7 r r r r- OpenSSL.cryptor r r r r r r __all__r rx r r& r' r( r) r* r! r" r# r$ r% SSL_SENT_SHUTDOWNr+ SSL_RECEIVED_SHUTDOWNr, r- r. r/ r0 r1 r2 r3 r4 r5 r6 r7 r8 r9 r: r; SSL_OP_NO_SSLv2r< SSL_OP_NO_SSLv3r= SSL_OP_NO_TLSv1r> SSL_OP_NO_TLSv1_1r? SSL_OP_NO_TLSv1_2r@ SSL_OP_NO_TLSv1_3r r4 r SSL_MODE_RELEASE_BUFFERSrA SSL_OP_SINGLE_DH_USErB SSL_OP_SINGLE_ECDH_USErC SSL_OP_EPHEMERAL_RSArD SSL_OP_MICROSOFT_SESS_ID_BUGrE SSL_OP_NETSCAPE_CHALLENGE_BUGrF 'SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUGrG "SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUGrH !SSL_OP_MICROSOFT_BIG_SSLV3_BUFFERrI SSL_OP_MSIE_SSLV2_RSA_PADDINGrJ SSL_OP_SSLEAY_080_CLIENT_DH_BUGrK SSL_OP_TLS_D5_BUGrL SSL_OP_TLS_BLOCK_PADDING_BUGrM "SSL_OP_DONT_INSERT_EMPTY_FRAGMENTSrN SSL_OP_CIPHER_SERVER_PREFERENCErO SSL_OP_TLS_ROLLBACK_BUGrP SSL_OP_PKCS1_CHECK_1rQ SSL_OP_PKCS1_CHECK_2rR SSL_OP_NETSCAPE_CA_DN_BUGrS &SSL_OP_NETSCAPE_DEMO_CIPHER_CHANGE_BUGrT SSL_OP_NO_COMPRESSIONrU SSL_OP_NO_QUERY_MTUrV SSL_OP_COOKIE_EXCHANGErW SSL_OP_NO_TICKETrX SSL_OP_NO_RENEGOTIATIONr SSL_OP_IGNORE_UNEXPECTED_EOFr SSL_OP_LEGACY_SERVER_CONNECTr SSL_OP_ALLrY SSL_VERIFY_PEERrZ SSL_VERIFY_FAIL_IF_NO_PEER_CERTr[ SSL_VERIFY_CLIENT_ONCEr\ SSL_VERIFY_NONEr] SSL_SESS_CACHE_OFFr^ SSL_SESS_CACHE_CLIENTr_ SSL_SESS_CACHE_SERVERr` SSL_SESS_CACHE_BOTHra SSL_SESS_CACHE_NO_AUTO_CLEARrb !SSL_SESS_CACHE_NO_INTERNAL_LOOKUPrc SSL_SESS_CACHE_NO_INTERNAL_STORErd SSL_SESS_CACHE_NO_INTERNALre rf rg rh ri rj rk rl rm rn ro rp rq rr rs rt ru r r r| r rL r` r ry r r} rp r rD r r r r r r3 rv r r rw rx ry rz r{ r r% rF rb rr r r r r r} r r Cryptography_HAS_ALPNr r r r~ r r r r r <module>r; s $ " J J J ' c L # 9 9 9++ +)) ) -- # -## S # -- # - " "&& .. %% c %%% c %)) ))) ))) )'' S ''' S ''' S '++ s +++ s + //M3/ NN?# ! 9 9 c 9 11 # 1 55 C 5 11 # 1 $ A A # A!%!C!C 3 C00 $S '+&M&M M%)%K%K s K!%!C!C 3 C#'#G#G S G++ s + $ A A # A&*&M&M M#'#G#G S G 77 S 7,, 11 # 1 ! ; ; s ;// #C 33 3 3// / 55 C 5)) c ) # ; ;; NN() $($E$E cE NN-. $($E$E cE NN-. oo '' S '#'#G#G S G 55 C 5'' S '-- - 33 3 3 33 3 3// / $ A A # A%)%K%K s K$($I$I c I " = = =)) )'' s '## S ### S ### S ### S #%% c %%% c % // 3 / 11 C 1 11 C 1 11 C 1 33 S 3 33 S 3 " 9 9 9 ! 7 7 s 7 T] 34 T%["99: #L>5#89 ,!6!<= eXb\ BD HI hrl ;U BC T8B< 8% ?@ L$S#>DEgL gLV "I "L I :EB u% E U % e 5 ( (8% , % P: 0 : z@I 8 @IF8I 8 8Iv $< . ": &3 3 (3# 3% 3 ! S XrdBh-? 2 4 " D+Q/1L F F R J! J!W2 J sH "^ #^ 0#^+ #^7 ^ ^ ^('^(+^43^47_ ?_