HEX

File: //opt/saltstack/salt/lib/python3.10/site-packages/OpenSSL/__pycache__/SSL.cpython-310.pyc
o

;jU��@s�UddlmZddlZddlZddlZddlZddlZddlmZddl	m
Z
ddlmZm
Z
ddlmZmZddlmZddlmZmZmZmZdd	lmZdd
lmZddlmZddlmZdd
lmZ ddlm!Z"ddlm#Z$ddlm%Z&ddlm'Z(ddlm)Z*ddlm+Z,ddl-m.Z.m/Z/m0Z0m1Z1m2Z2m3Z3m4Z4m5Z5gd�Z6e$j7Z7de8d<e$j9Z9de8d<e$j:Z:de8d<e$j;Z;de8d<e$j<Z<de8d<e$j=Z=de8d<e9Z>e:Z?e;Z@e<ZAe=ZBe$jCZDe$jEZFdZGdZHdZId ZJd!ZKd"ZLd#ZMd$ZNd%ZOd&ZPe$jQZQde8d'<e$jRZRde8d(<e$jSZSde8d)<e$jTZTde8d*<e$jUZUde8d+<e$jVZWde8d,<e$jXZYde8d-<e$jZZ[de8d.<e$j\Z]de8d/<e$j^Z_de8d0<e$j`Zade8d1<e$jbZcde8d2<e$jdZede8d3<e$jfZgde8d4<e$jhZide8d5<e$jjZkde8d6<e$jlZmde8d7<e$jnZode8d8<e$jpZqde8d9<e$jrZsde8d:<e$jtZude8d;<e$jvZwde8d<<e$jxZyde8d=<e$jzZ{de8d><e$j|Z}de8d?<e$j~Zde8d@<e$j�Z�de8dA<e$j�Z�e$j�Z�de8dB<e$j�Z�de8dC<e$j�Z�de8dD<e$j�Z�de8dE<e$j�Z�de8dF<ze$j�Z�dGe8dH<e6��dH�Wne��y�dZ�Ynwe$j�Z�de8dI<ze$j�Z�de8dJ<e6��dJ�Wn
e��yYnwze$j�Z�de8dK<e6��dK�Wn
e��y'Ynwze$j�Z�de8dL<e6��dL�Wn
e��y@Ynwe$j�Z�de8dM<e$j�Z�de8dN<e$j�Z�de8dO<e$j�Z�de8dP<e$j�Z�de8dQ<e$j�Z�de8dR<e$j�Z�de8dS<e$j�Z�de8dT<e$j�Z�de8dU<e$j�Z�de8dV<e$j�Z�de8dW<e$j�Z�de8dX<e$j�Z�de8dY<e$j�Z�de8dZ<e$j�Z�de8d[<e$j�Z�de8d\<e$j�Z�de8d]<e$j�Z�de8d^<e$j�Z�de8d_<e$j�Z�de8d`<e$j�Z�de8da<e$j�Z�de8db<e$j�Z�de8dc<e$j�Z�de8dd<e$j�Z�de8de<e$j�Z�de8df<e$j�Z�de8dg<e$j�Z�de8dh<e$j�Z�de8di<ej�e�e�e�fZ�edj�Z�Gdkdl�dl�Z�eʃZ�edmej�e�gej�e�e�ffZ�edmge�fZ�edme�ge�fZ�edme�ee�ge�fZ�edmee�ge�fZ�ee�e�ee�ge�fZ�edme/e�e�e�ge�fZ�Gdndo�do�Z�gdp�Z�dqgZ�drZ�dsZ�Gdtdu�dueۃZ�ee e܃Z�e&e܃Z�Gdvdw�dwe܃Z�Gdxdy�dye܃Z�Gdzd{�d{e܃Z�Gd|d}�d}e܃Z�Gd~d�de܃Z�Gd�d��d��Z�Gd�d��d�e�Z�Gd�d��d�e�Z�Gd�d��d�e�Z�Gd�d��d�e�Z�Gd�d��d�e�Z�Gd�d��d�e�Z�d�d�d��Z�d�d�d��Z�e�Z�d�d�d��Z�e�e�e$d�d�d��Z�e�e�e$d�d�d��Z�e�e�e$d�d�d��Z�Gd�d��d��Z�ed�ed�efd��Z�d�d�d��Z�Gd�d��d��Z�Gd�dm�dm�Z�dS)��)�annotationsN)�Sequence)�	errorcode)�partial�wraps)�chain�count)�platform)�Any�Callable�Optional�TypeVar)�WeakValueDictionary)�x509)�ec)�StrOrBytesPath)�exception_from_error_queue)�ffi)�lib)�make_assert)�no_zero_allocator)�
path_bytes)�text_to_bytes_and_warn)�FILETYPE_PEM�X509�PKey�X509Name�	X509Store�_EllipticCurve�_PassphraseHelper�_PrivateKey)b�DTLS_CLIENT_METHOD�DTLS_METHOD�DTLS_SERVER_METHOD�MODE_RELEASE_BUFFERS�NO_OVERLAPPING_PROTOCOLS�OPENSSL_BUILT_ON�OPENSSL_CFLAGS�OPENSSL_DIR�OPENSSL_PLATFORM�OPENSSL_VERSION�OPENSSL_VERSION_NUMBER�OP_ALL�OP_CIPHER_SERVER_PREFERENCE�OP_DONT_INSERT_EMPTY_FRAGMENTS�OP_EPHEMERAL_RSA�OP_MICROSOFT_BIG_SSLV3_BUFFER�OP_MICROSOFT_SESS_ID_BUG�OP_MSIE_SSLV2_RSA_PADDING�OP_NETSCAPE_CA_DN_BUG�OP_NETSCAPE_CHALLENGE_BUG�"OP_NETSCAPE_DEMO_CIPHER_CHANGE_BUG�#OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG�OP_NO_COMPRESSION�OP_NO_QUERY_MTU�OP_NO_TICKET�OP_PKCS1_CHECK_1�OP_PKCS1_CHECK_2�OP_SINGLE_DH_USE�OP_SINGLE_ECDH_USE�OP_SSLEAY_080_CLIENT_DH_BUG�OP_SSLREF2_REUSE_CERT_TYPE_BUG�OP_TLS_BLOCK_PADDING_BUG�
OP_TLS_D5_BUG�OP_TLS_ROLLBACK_BUG�RECEIVED_SHUTDOWN�
SENT_SHUTDOWN�SESS_CACHE_BOTH�SESS_CACHE_CLIENT�SESS_CACHE_NO_AUTO_CLEAR�SESS_CACHE_NO_INTERNAL�SESS_CACHE_NO_INTERNAL_LOOKUP�SESS_CACHE_NO_INTERNAL_STORE�SESS_CACHE_OFF�SESS_CACHE_SERVER�SSL3_VERSION�SSLEAY_BUILT_ON�
SSLEAY_CFLAGS�
SSLEAY_DIR�SSLEAY_PLATFORM�SSLEAY_VERSION�SSL_CB_ACCEPT_EXIT�SSL_CB_ACCEPT_LOOP�SSL_CB_ALERT�SSL_CB_CONNECT_EXIT�SSL_CB_CONNECT_LOOP�SSL_CB_EXIT�SSL_CB_HANDSHAKE_DONE�SSL_CB_HANDSHAKE_START�SSL_CB_LOOP�SSL_CB_READ�SSL_CB_READ_ALERT�SSL_CB_WRITE�SSL_CB_WRITE_ALERT�
SSL_ST_ACCEPT�SSL_ST_CONNECT�SSL_ST_MASK�TLS1_1_VERSION�TLS1_2_VERSION�TLS1_3_VERSION�TLS1_VERSION�TLS_CLIENT_METHOD�
TLS_METHOD�TLS_SERVER_METHOD�VERIFY_CLIENT_ONCE�VERIFY_FAIL_IF_NO_PEER_CERT�VERIFY_NONE�VERIFY_PEER�
Connection�Context�Error�OP_NO_SSLv2�OP_NO_SSLv3�OP_NO_TLSv1�
OP_NO_TLSv1_1�
OP_NO_TLSv1_2�
OP_NO_TLSv1_3�SSLeay_version�
SSLv23_METHOD�Session�SysCallError�TLSv1_1_METHOD�TLSv1_2_METHOD�TLSv1_METHOD�
WantReadError�WantWriteError�WantX509LookupError�X509VerificationCodes�ZeroReturnError�intr+r*r'r)r(r&�������	�
��rMrfrcrdrerqrrrsrtrurvr$r<r=r/r1r4r6r?r0r2r>rAr@r.r-rBr;r3r5r7r8�
int | None�OP_COOKIE_EXCHANGEr9�OP_NO_RENEGOTIATION�OP_IGNORE_UNEXPECTED_EOF�OP_LEGACY_SERVER_CONNECTr,rmrkrjrlrKrFrLrErGrIrJrHrar`rbr[rXr\r^rUr]r_rTrSrWrVrZrY�_Tc@�eZdZdS)�_NoOverlappingProtocolsN��__name__�
__module__�__qualname__�r�r��?/opt/saltstack/salt/lib/python3.10/site-packages/OpenSSL/SSL.pyr��r�rnc@sfeZdZdZejZejZej	Z
ejZej
ZejZejZejZejZejZejZejZejZejZ ej!Z"ej#Z$ej%Z&ej'Z(ej)Z*ej+Z,ej-Z.ej/Z0ej1Z2ej3Z4ej5Z6ej7Z8ej9Z:ej;Z<ej=Z>ej?Z@ejAZBejCZDejEZFejGZHejIZJejKZLejMZNejOZPejQZRejSZTejUZVejWZXejYZZej[Z\ej]Z^ej_Z`ejaZbejcZdejeZfejgZhejiZjejkZlejmZnejoZpejqZrejsZtejuZvdS)r�a\
    Success and error codes for X509 verification, as returned by the
    underlying ``X509_STORE_CTX_get_error()`` function and passed by pyOpenSSL
    to verification callback functions.

    See `OpenSSL Verification Errors
    <https://www.openssl.org/docs/manmaster/man3/X509_verify_cert_error_string.html#ERROR-CODES>`_
    for details.
    N)wr�r�r��__doc__�_lib�	X509_V_OK�OKZ$X509_V_ERR_UNABLE_TO_GET_ISSUER_CERTZERR_UNABLE_TO_GET_ISSUER_CERTZX509_V_ERR_UNABLE_TO_GET_CRLZERR_UNABLE_TO_GET_CRLZ+X509_V_ERR_UNABLE_TO_DECRYPT_CERT_SIGNATUREZ$ERR_UNABLE_TO_DECRYPT_CERT_SIGNATUREZ*X509_V_ERR_UNABLE_TO_DECRYPT_CRL_SIGNATUREZ#ERR_UNABLE_TO_DECRYPT_CRL_SIGNATUREZ-X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEYZ&ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEYZ!X509_V_ERR_CERT_SIGNATURE_FAILUREZERR_CERT_SIGNATURE_FAILUREZ X509_V_ERR_CRL_SIGNATURE_FAILUREZERR_CRL_SIGNATURE_FAILUREZX509_V_ERR_CERT_NOT_YET_VALIDZERR_CERT_NOT_YET_VALIDZX509_V_ERR_CERT_HAS_EXPIREDZERR_CERT_HAS_EXPIREDZX509_V_ERR_CRL_NOT_YET_VALIDZERR_CRL_NOT_YET_VALIDZX509_V_ERR_CRL_HAS_EXPIREDZERR_CRL_HAS_EXPIREDZ)X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELDZ"ERR_ERROR_IN_CERT_NOT_BEFORE_FIELDZ(X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELDZ!ERR_ERROR_IN_CERT_NOT_AFTER_FIELDZ)X509_V_ERR_ERROR_IN_CRL_LAST_UPDATE_FIELDZ"ERR_ERROR_IN_CRL_LAST_UPDATE_FIELDZ)X509_V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELDZ"ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELDZX509_V_ERR_OUT_OF_MEMZERR_OUT_OF_MEMZ&X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERTZERR_DEPTH_ZERO_SELF_SIGNED_CERTZ$X509_V_ERR_SELF_SIGNED_CERT_IN_CHAINZERR_SELF_SIGNED_CERT_IN_CHAINZ,X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLYZ%ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLYZ*X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATUREZ#ERR_UNABLE_TO_VERIFY_LEAF_SIGNATUREZX509_V_ERR_CERT_CHAIN_TOO_LONGZERR_CERT_CHAIN_TOO_LONGZX509_V_ERR_CERT_REVOKEDZERR_CERT_REVOKEDZX509_V_ERR_INVALID_CAZERR_INVALID_CAZX509_V_ERR_PATH_LENGTH_EXCEEDEDZERR_PATH_LENGTH_EXCEEDEDZX509_V_ERR_INVALID_PURPOSEZERR_INVALID_PURPOSEZX509_V_ERR_CERT_UNTRUSTEDZERR_CERT_UNTRUSTEDZX509_V_ERR_CERT_REJECTEDZERR_CERT_REJECTEDZ"X509_V_ERR_SUBJECT_ISSUER_MISMATCHZERR_SUBJECT_ISSUER_MISMATCHZX509_V_ERR_AKID_SKID_MISMATCHZERR_AKID_SKID_MISMATCHZ&X509_V_ERR_AKID_ISSUER_SERIAL_MISMATCHZERR_AKID_ISSUER_SERIAL_MISMATCHZX509_V_ERR_KEYUSAGE_NO_CERTSIGNZERR_KEYUSAGE_NO_CERTSIGNZ#X509_V_ERR_UNABLE_TO_GET_CRL_ISSUERZERR_UNABLE_TO_GET_CRL_ISSUERZ'X509_V_ERR_UNHANDLED_CRITICAL_EXTENSIONZ ERR_UNHANDLED_CRITICAL_EXTENSIONZX509_V_ERR_KEYUSAGE_NO_CRL_SIGNZERR_KEYUSAGE_NO_CRL_SIGNZ+X509_V_ERR_UNHANDLED_CRITICAL_CRL_EXTENSIONZ$ERR_UNHANDLED_CRITICAL_CRL_EXTENSIONZX509_V_ERR_INVALID_NON_CAZERR_INVALID_NON_CAZ%X509_V_ERR_PROXY_PATH_LENGTH_EXCEEDEDZERR_PROXY_PATH_LENGTH_EXCEEDEDZ(X509_V_ERR_KEYUSAGE_NO_DIGITAL_SIGNATUREZ!ERR_KEYUSAGE_NO_DIGITAL_SIGNATUREZ)X509_V_ERR_PROXY_CERTIFICATES_NOT_ALLOWEDZ"ERR_PROXY_CERTIFICATES_NOT_ALLOWEDZX509_V_ERR_INVALID_EXTENSIONZERR_INVALID_EXTENSIONZ#X509_V_ERR_INVALID_POLICY_EXTENSIONZERR_INVALID_POLICY_EXTENSIONZX509_V_ERR_NO_EXPLICIT_POLICYZERR_NO_EXPLICIT_POLICYZX509_V_ERR_DIFFERENT_CRL_SCOPEZERR_DIFFERENT_CRL_SCOPEZ(X509_V_ERR_UNSUPPORTED_EXTENSION_FEATUREZ!ERR_UNSUPPORTED_EXTENSION_FEATUREZX509_V_ERR_UNNESTED_RESOURCEZERR_UNNESTED_RESOURCEZX509_V_ERR_PERMITTED_VIOLATIONZERR_PERMITTED_VIOLATIONZX509_V_ERR_EXCLUDED_VIOLATIONZERR_EXCLUDED_VIOLATIONZX509_V_ERR_SUBTREE_MINMAXZERR_SUBTREE_MINMAXZ&X509_V_ERR_UNSUPPORTED_CONSTRAINT_TYPEZERR_UNSUPPORTED_CONSTRAINT_TYPEZ(X509_V_ERR_UNSUPPORTED_CONSTRAINT_SYNTAXZ!ERR_UNSUPPORTED_CONSTRAINT_SYNTAXZ"X509_V_ERR_UNSUPPORTED_NAME_SYNTAXZERR_UNSUPPORTED_NAME_SYNTAXZ$X509_V_ERR_CRL_PATH_VALIDATION_ERRORZERR_CRL_PATH_VALIDATION_ERRORZX509_V_ERR_HOSTNAME_MISMATCHZERR_HOSTNAME_MISMATCHZX509_V_ERR_EMAIL_MISMATCHZERR_EMAIL_MISMATCHZX509_V_ERR_IP_ADDRESS_MISMATCHZERR_IP_ADDRESS_MISMATCHZ#X509_V_ERR_APPLICATION_VERIFICATIONZERR_APPLICATION_VERIFICATIONr�r�r�r�r�5s�
������������������
r�)z"/etc/ssl/certs/ca-certificates.crtz /etc/pki/tls/certs/ca-bundle.crtz/etc/ssl/ca-bundle.pemz/etc/pki/tls/cacert.pemz1/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pemz/etc/ssl/certss$/opt/pyca/cryptography/openssl/certss'/opt/pyca/cryptography/openssl/cert.pemc@seZdZdZdS)rpz4
    An error occurred in an `OpenSSL.SSL` API.
    N)r�r�r�r�r�r�r�r�rp�srpc@r�)r~Nr�r�r�r�r�r~�r�r~c@r�)rNr�r�r�r�r�r�r�rc@r�)r�Nr�r�r�r�r�r��r�r�c@r�)r�Nr�r�r�r�r�r��r�r�c@r�)rzNr�r�r�r�r�rz�r�rzc@s$eZdZdZd	dd�Zd	dd�ZdS)
�_CallbackExceptionHelpera�
    A base class for wrapper classes that allow for intelligent exception
    handling in OpenSSL callbacks.

    :ivar list _problems: Any exceptions that occurred while executing in a
        context where they could not be raised in the normal way.  Typically
        this is because OpenSSL has called into some Python code and requires a
        return value.  The exceptions are saved to be raised later when it is
        possible to do so.
    �return�NonecCs
g|_dS�N)�	_problems��selfr�r�r��__init__�s
z!_CallbackExceptionHelper.__init__cCs4|jrzt�Wn	tyYnw|j�d��dS)z�
        Raise an exception from the OpenSSL error queue or that was previously
        captured whe running a callback.
        rN)r��_raise_current_errorrp�popr�r�r�r��raise_if_problem�s
��z)_CallbackExceptionHelper.raise_if_problemN�r�r�)r�r�r�r�r�r�r�r�r�r�r��s
r�c@�eZdZdZd	dd�ZdS)
�
_VerifyHelperz^
    Wrap a callback such that it can be used as a certificate verification
    callback.
    �callback�_VerifyCallbackr�r�c�2t���t����fdd��}t�d|��_dS)Nc
s�t�|�}t�|�t�|�}t�|�}t�|�}t��}t�||�}t	j
|}z
�|||||�}	WntyK}
z
�j�
|
�WYd}
~
dSd}
~
ww|	rWt�|tj�dSdS)Nr�)r�ZX509_STORE_CTX_get_current_cert�X509_up_refr�_from_raw_x509_ptrZX509_STORE_CTX_get_errorZX509_STORE_CTX_get_error_depthZ"SSL_get_ex_data_X509_STORE_CTX_idxZX509_STORE_CTX_get_ex_datarn�_reverse_mapping�	Exceptionr��appendZX509_STORE_CTX_set_errorr�)�okZ	store_ctxr�certZerror_numberZerror_depth�index�ssl�
connection�result�e�r�r�r�r��wrapper�s*






���z'_VerifyHelper.__init__.<locals>.wrapperzint (*)(int, X509_STORE_CTX *)�r�r�r�_ffir��r�r�r�r�r�r�r��s

�z_VerifyHelper.__init__N)r�r�r�r��r�r�r�r�r�r�r�r�r�r��sr�c@r�)
�_ALPNSelectHelperzQ
    Wrap a callback such that it can be used as an ALPN selection callback.
    r��_ALPNSelectCallbackr�r�cr�)Nc
szptj|}t�||�dd�}g}|r/|d}	|d|	d�}
|�|
�||	dd�}|s�||�}d}|tur?d}d}n	t|t�sHtd��t�	dt
|��t�	d|�g|_|jdd|d<|jd|d<|smtj
WStjWSty�}
z�j�|
�tjWYd}
~
Sd}
~
ww)	Nrr�T�Fz^ALPN callback must return a bytestring or the special NO_OVERLAPPING_PROTOCOLS sentinel value.zunsigned char *�unsigned char[])rnr�r��bufferr�r%�
isinstance�bytes�	TypeError�new�len�_alpn_select_callback_argsr�ZSSL_TLSEXT_ERR_NOACKZSSL_TLSEXT_ERR_OKr�r��SSL_TLSEXT_ERR_ALERT_FATAL)r��out�outlenZin_Zinlen�arg�connZinstrZ	protolistZencoded_len�protoZoutbytesZany_acceptedr�r�r�r�r�s@

�

�	
���z+_ALPNSelectHelper.__init__.<locals>.wrapperz^int (*)(SSL *, unsigned char **, unsigned char *, const unsigned char *, unsigned int, void *)r�r�r�r�r�r�s
+
�z_ALPNSelectHelper.__init__N�r�r�r�r�r�r�r�r�r�r�sr�c@r�)
�_OCSPServerCallbackHelpera�
    Wrap a callback such that it can be used as an OCSP callback for the server
    side.

    Annoyingly, OpenSSL defines one OCSP callback but uses it in two different
    ways. For servers, that callback is expected to retrieve some OCSP data and
    hand it to OpenSSL, and may return only SSL_TLSEXT_ERR_OK,
    SSL_TLSEXT_ERR_FATAL, and SSL_TLSEXT_ERR_NOACK. For clients, that callback
    is expected to check the OCSP data, and returns a negative value on error,
    0 if the response is not acceptable, or positive if it is. These are
    mutually exclusive return code behaviours, and they mean that we need two
    helpers so that we always return an appropriate error code if the user's
    code throws an exception.

    Given that we have to have two helpers anyway, these helpers are a bit more
    helpery than most: specifically, they hide a few more of the OpenSSL
    functions so that the user has an easier time writing these callbacks.

    This helper implements the server side.
    r��_OCSPServerCallback[Any]r�r�cr�)Nc
s�zBtj|}|tjkrt�|�}nd}�||�}t|t�s!td��|s&WdSt|�}t	�
|�}|t�||�dd�<t	�|||�WdSt
y[}z
�j�|�WYd}~dSd}~ww)Nz'OCSP callback must return a bytestring.r�r�)rnr�r��NULL�from_handler�r�r�r�r�ZOPENSSL_mallocr�ZSSL_set_tlsext_status_ocsp_respr�r�r�)r��cdatar��data�	ocsp_dataZocsp_data_lengthZdata_ptrr�r�r�r�r�js,




���z3_OCSPServerCallbackHelper.__init__.<locals>.wrapper�int (*)(SSL *, void *)r�r�r�r�r�r�gs
&z"_OCSPServerCallbackHelper.__init__N)r�r�r�r�r�r�r�r�r�r�Q�r�c@r�)
�_OCSPClientCallbackHelpera�
    Wrap a callback such that it can be used as an OCSP callback for the client
    side.

    Annoyingly, OpenSSL defines one OCSP callback but uses it in two different
    ways. For servers, that callback is expected to retrieve some OCSP data and
    hand it to OpenSSL, and may return only SSL_TLSEXT_ERR_OK,
    SSL_TLSEXT_ERR_FATAL, and SSL_TLSEXT_ERR_NOACK. For clients, that callback
    is expected to check the OCSP data, and returns a negative value on error,
    0 if the response is not acceptable, or positive if it is. These are
    mutually exclusive return code behaviours, and they mean that we need two
    helpers so that we always return an appropriate error code if the user's
    code throws an exception.

    Given that we have to have two helpers anyway, these helpers are a bit more
    helpery than most: specifically, they hide a few more of the OpenSSL
    functions so that the user has an easier time writing these callbacks.

    This helper implements the client side.
    r��_OCSPClientCallback[Any]r�r�cr�)Nc	
s�z=tj|}|tjkrt�|�}nd}t�d�}t�||�}|dkr%d}nt�|d|�dd�}�|||�}t	t
|��WStyV}z
�j�
|�WYd}~dSd}~ww)N�unsigned char **rr����)rnr�r�r�r�r�r�ZSSL_get_tlsext_status_ocsp_respr�r��boolr�r�r�)	r�r�r�r�Zocsp_ptrZocsp_lenr�Zvalidr�r�r�r�r��s"


��z3_OCSPClientCallbackHelper.__init__.<locals>.wrapperr�r�r�r�r�r�r��s
z"_OCSPClientCallbackHelper.__init__N)r�r�r�r�r�r�r�r�r�r��r�r�c@�eZdZddd�ZdS)	�_CookieGenerateCallbackHelperr��_CookieGenerateCallbackr�r�cs@t���ttdd��t�����fdd��}t�d|��_dS)NZDTLS1_COOKIE_LENGTH�c
s�z-tj|}�|�}t|��krtdt|��d��d���||dt|��<t|�|d<WdStyF}z
�j�|�WYd}~dSd}~ww)NzCookie too long (got z bytes, max �)rr�)rnr�r��
ValueErrorr�r�r�)r�r�r�r�Zcookier��r�Zmax_cookie_lenr�r�r�r��s"
����z7_CookieGenerateCallbackHelper.__init__.<locals>.wrapperz/int (*)(SSL *, unsigned char *, unsigned int *))r�r��getattrr�rr�r�r�r�r�r�r��s

�z&_CookieGenerateCallbackHelper.__init__N�r�r�r�r��r�r�r�r�r�r�r�r�r���r�c@r�)	�_CookieVerifyCallbackHelperr��_CookieVerifyCallbackr�r�cr�)Nc
sVztj|}�|t|d|���WSty*}z
�j�|�WYd}~dSd}~ww�Nr)rnr�r�r�r�r�)r�Zc_cookieZ
cookie_lenr�r�r�r�r�r��s
��z5_CookieVerifyCallbackHelper.__init__.<locals>.wrapperz-int (*)(SSL *, unsigned char *, unsigned int)r�r�r�r�r�r��s

�z$_CookieVerifyCallbackHelper.__init__N�r�r�r�r�r�r�r�r�r�r��r�r��objr
r�cCsfd}t|t�st|dd�}|dur|�}t|t�r|}t|t�s$td��|dkr1td|d�d���|S)N�filenoz3argument must be an int, or have a fileno() method.rz.file descriptor cannot be a negative integer (�ir�)r�r�r�r�r�)r��fd�methr�r�r��_asFileDescriptors


�r��typer�cCst�t�|��S)z�
    Return a string describing the version of OpenSSL in use.

    :param type: One of the :const:`OPENSSL_` constants defined in this module.
    )r��stringr��OpenSSL_version)r�r�r�r�r�sr��flag�error�str�Callable[[_T], _T]cs��fdd�}|S)a�
    Builds a decorator that ensures that functions that rely on OpenSSL
    functions that are not present in this build raise NotImplementedError,
    rather than AttributeError coming out of cryptography.

    :param flag: A cryptography flag that guards the functions, e.g.
        ``Cryptography_HAS_NEXTPROTONEG``.
    :param error: The string to be used in the exception if the flag is false.
    cs �st|��fdd��}|S|S)Ncst���r���NotImplementedError)�args�kwargs)r�r�r��explode.sz<_make_requires.<locals>._requires_decorator.<locals>.explode)r)�funcr�r�r�r�r��_requires_decorator+s
z+_make_requires.<locals>._requires_decoratorr�)r�r�r	r�rr��_make_requires sr
ZCryptography_HAS_KEYLOGzKey logging not availableZ$Cryptography_HAS_SSL_GET0_GROUP_NAMEzAGetting group name is not supported by the linked OpenSSL versionZCryptography_HAS_SSL_COOKIEz$DTLS cookie support is not availablec@seZdZUdZded<dS)ryz�
    A class representing an SSL session.  A session defines certain connection
    parameters which may be re-used to speed up the setup of subsequent
    connections.

    .. versionadded:: 0.14
    r
�_sessionN)r�r�r�r��__annotations__r�r�r�r�ryHs
ry�F.)�bound�fcs"t��d	�fdd��}t�t|�S)
Nr�rorr
rr�cs,|jrtjdtdd��|g|�Ri|��S)NzjAttempting to mutate a Context after a Connection was created. In the future, this will raise an exceptionr���
stacklevel)�_used�warnings�warn�DeprecationWarning�r�rr�rr�r��innerXs�z _require_not_used.<locals>.inner)r�rorr
rr
r�r
)r�typing�castr
)rrr�rr��_require_not_usedWsrc@s2eZdZUdZeejdfeejefe	eje
feejefe
ejdfeejdfeejdfeejdfeejdfeejdfi
Zded<d�d	d
�Zed�dd
��Zed�dd��Ze	d�d�dd��Zd�dd�Ze	d�d�dd��Z ed�dd��Z!d�d$d%�Z"d�d)d*�Z#ed�d-d.��Z$ee%fd�d0d1��Z&ed�d4d5��Z'ed�d7d8��Z(d�d9d:�Z)ee%fd�d<d=��Z*ed�d@dA��Z+d�dBdC�Z,ed�dEdF��Z-ed�dHdI��Z.ed�dKdL��Z/d�dMdN�Z0e	d�d�dPdQ��Z1ed�dSdT��Z2d�dUdV�Z3d�dWdX�Z4ed�dZd[��Z5ed�d^d_��Z6ed�dadb��Z7ed�ddde��Z8ed�dhdi��Z9ed�dkdl��Z:ed�dndo��Z;d�dpdq�Z<ed�dsdt��Z=e>ed�dvdw���Z?d�dydz�Z@ed�d|d}��ZAd�dd��ZBed�d�d���ZCed�d�d���ZDed�d�d���ZEed�d�d���ZFed�d�d���ZGed�d�d���ZHed�d�d���ZId�d�d��ZJe	d�d�d�d���ZKe	d�d�d�d���ZLeeMd�d�d����ZNeeMd�d�d����ZOdS)�roau
    :class:`OpenSSL.SSL.Context` instances define the parameters for setting
    up new SSL connections.

    :param method: One of TLS_METHOD, TLS_CLIENT_METHOD, TLS_SERVER_METHOD,
                   DTLS_METHOD, DTLS_CLIENT_METHOD, or DTLS_SERVER_METHOD.
                   SSLv23_METHOD, TLSv1_METHOD, etc. are deprecated and should
                   not be used.
    Nz@typing.ClassVar[dict[int, tuple[Callable[[], Any], int | None]]]�_methods�methodr�r�r�cCst|t�s	td��z	|j|\}}Wntytd��w|�}t|tjk�t	�
|�}t|tjk�t�|t	j�}||_
d|_d|_d|_d|_d|_d|_d|_d|_d|_d|_d|_d|_d|_d|_d|_d|_d|_|�t	j t	j!B�|dur�|�"|�|�#|�dSdS)Nzmethod must be an integerzNo such protocolF)$r�r�r�r�KeyErrorr��_openssl_assertr�r�r�ZSSL_CTX_new�gcZSSL_CTX_free�_contextr�_passphrase_helper�_passphrase_callback�_passphrase_userdata�_verify_helper�_verify_callback�_info_callback�_keylog_callback�_tlsext_servername_callback�	_app_data�_alpn_select_helper�_alpn_select_callback�_ocsp_helper�_ocsp_callback�
_ocsp_data�_cookie_generate_helper�_cookie_verify_helper�set_modeZSSL_MODE_ENABLE_PARTIAL_WRITEZ#SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER�set_min_proto_version�set_max_proto_version)r�rZmethod_func�versionZ
method_obj�contextr�r�r�r��sT
�
�����
�zContext.__init__r5cC�tt�|j|�dk�dS)aD
        Set the minimum supported protocol version. Setting the minimum
        version to 0 will enable protocol versions down to the lowest version
        supported by the library.

        If the underlying OpenSSL build is missing support for the selected
        version, this method will raise an exception.
        r�N)rr�ZSSL_CTX_set_min_proto_versionr!�r�r5r�r�r�r3��
�zContext.set_min_proto_versioncCr7)aC
        Set the maximum supported protocol version. Setting the maximum
        version to 0 will enable protocol versions up to the highest version
        supported by the library.

        If the underlying OpenSSL build is missing support for the selected
        version, this method will raise an exception.
        r�N)rr�ZSSL_CTX_set_max_proto_versionr!r8r�r�r�r4�r9zContext.set_max_proto_version�cafile�_StrOrBytesPath | None�capathcCsR|durtj}nt|�}|durtj}nt|�}t�|j||�}|s't�dSdS)aM
        Let SSL know where we can find trusted certificates for the certificate
        chain.  Note that the certificates have to be in PEM format.

        If capath is passed, it must be a directory prepared using the
        ``c_rehash`` tool included with OpenSSL.  Either, but not both, of
        *pemfile* or *capath* may be :data:`None`.

        :param cafile: In which file we can find the certificates (``bytes`` or
            ``str``).
        :param capath: In which directory we can find the certificates
            (``bytes`` or ``str``).

        :return: None
        N)r�r��_path_bytesr�ZSSL_CTX_load_verify_locationsr!r�)r�r:r<Zload_resultr�r�r��load_verify_locations�s�
�zContext.load_verify_locationsr��_PassphraseCallback[_T]rcs(t��d
��fd	d
��}tt|ddd�S)N�sizer��verifyr��userdatar
r�r�cs�||�j�Sr�)r$)r@rArBr�r�r�r��sz'Context._wrap_callback.<locals>.wrapperT)Z	more_args�truncate)r@r�rAr�rBr
r�r�)rrrr�r�r�r��_wrap_callback�s
�zContext._wrap_callbackrB�	_T | NonecCs@t|�std��|�|�|_|jj|_t�|j|j�||_	dS)a�
        Set the passphrase callback.  This function will be called
        when a private key with a passphrase is loaded.

        :param callback: The Python callback to use.  This must accept three
            positional arguments.  First, an integer giving the maximum length
            of the passphrase it may return.  If the returned passphrase is
            longer than this, it will be truncated.  Second, a boolean value
            which will be true if the user should be prompted for the
            passphrase twice and the callback should verify that the two values
            supplied are equal. Third, the value given as the *userdata*
            parameter to :meth:`set_passwd_cb`.  The *callback* must return
            a byte string. If an error occurs, *callback* should return a false
            value (e.g. an empty string).
        :param userdata: (optional) A Python object which will be given as
                         argument to the callback
        :return: None
        �callback must be callableN)
�callabler�rDr"r�r#r�ZSSL_CTX_set_default_passwd_cbr!r$)r�r�rBr�r�r��
set_passwd_cb�s
�
zContext.set_passwd_cbcCslt�|j�}t|dk�|�dd�s0t�t���}t�t���}|t	kr2|t
kr4|�tt
�dSdSdSdS)a�
        Specify that the platform provided CA certificates are to be used for
        verification purposes. This method has some caveats related to the
        binary wheels that cryptography (pyOpenSSL's primary dependency) ships:

        *   macOS will only load certificates using this method if the user has
            the ``openssl@3`` `Homebrew <https://brew.sh>`_ formula installed
            in the default location.
        *   Windows will not work.
        *   manylinux cryptography wheels will work on most common Linux
            distributions in pyOpenSSL 17.1.0 and above.  pyOpenSSL detects the
            manylinux wheel and attempts to load roots via a fallback path.

        :return: None
        r��SSL_CERT_DIR�
SSL_CERT_FILEN)r�Z SSL_CTX_set_default_verify_pathsr!r�_check_env_vars_setr�r�ZX509_get_default_cert_dirZX509_get_default_cert_file�_CRYPTOGRAPHY_MANYLINUX_CA_DIR�_CRYPTOGRAPHY_MANYLINUX_CA_FILE�_fallback_default_verify_paths�_CERTIFICATE_FILE_LOCATIONS�_CERTIFICATE_PATH_LOCATIONS)r��
set_resultZdefault_dirZdefault_filer�r�r��set_default_verify_paths!s��z Context.set_default_verify_paths�dir_env_varr�file_env_varr�cCs tj�|�duptj�|�duS)zp
        Check to see if the default cert dir/file environment vars are present.

        :return: bool
        N)�os�environ�get)r�rSrTr�r�r�rKLs�zContext._check_env_vars_set�	file_path�	list[str]�dir_pathcCsP|D]}tj�|�r|�|�nq|D]}tj�|�r%|�d|�dSqdS)aV
        Default verify paths are based on the compiled version of OpenSSL.
        However, when pyca/cryptography is compiled as a manylinux wheel
        that compiled location can potentially be wrong. So, like Go, we
        will try a predefined set of paths and attempt to load roots
        from there.

        :return: None
        N)rU�path�isfiler>�isdir)r�rXrZr:r<r�r�r�rNWs
���z&Context._fallback_default_verify_paths�certfile�_StrOrBytesPathcCs(t|�}t�|j|�}|st�dSdS)z�
        Load a certificate chain from a file.

        :param certfile: The name of the certificate chain file (``bytes`` or
            ``str``).  Must be PEM encoded.

        :return: None
        N)r=r�Z"SSL_CTX_use_certificate_chain_filer!r�)r�r^r�r�r�r��use_certificate_chain_filems
�
�z"Context.use_certificate_chain_file�filetypecCs<t|�}t|t�s
td��t�|j||�}|st�dSdS)ad
        Load a certificate from a file

        :param certfile: The name of the certificate file (``bytes`` or
            ``str``).
        :param filetype: (optional) The encoding of the file, which is either
            :const:`FILETYPE_PEM` or :const:`FILETYPE_ASN1`.  The default is
            :const:`FILETYPE_PEM`.

        :return: None
        �filetype must be an integerN)r=r�r�r�r�ZSSL_CTX_use_certificate_filer!r�)r�r^ra�
use_resultr�r�r��use_certificate_files
�
�zContext.use_certificate_filer��X509 | x509.CertificatecC�Ht|t�st�|�}ntjdtdd�t�|j|j	�}|s"t
�dSdS�zs
        Load a certificate from a X509 object

        :param cert: The X509 object
        :return: None
        �ePassing pyOpenSSL X509 objects is deprecated. You should use a cryptography.x509.Certificate instead.r�rN)r�r�from_cryptographyrrrr�ZSSL_CTX_use_certificater!�_x509r��r�r�rcr�r�r��use_certificate�s
	�	
�zContext.use_certificate�certobjcCs\t|t�st�|�}ntjdtdd�t�|j�}t�	|j
|�}|s,t�|�t�dSdS)z�
        Add certificate to chain

        :param certobj: The X509 certificate object to add to the chain
        :return: None
        rhr�rN)
r�rrirrrr�ZX509_duprjZSSL_CTX_add_extra_chain_certr!Z	X509_freer�)r�rm�copy�
add_resultr�r�r��add_extra_chain_cert�s
�	

�zContext.add_extra_chain_certcCs |jdur|j�t�t�dSr�)r"r�rpr�r�r�r�r��_raise_passphrase_exception�s

z#Context._raise_passphrase_exception�keyfilecCs>t|�}t|t�s
td��t�|j||�}|s|��dSdS)aN
        Load a private key from a file

        :param keyfile: The name of the key file (``bytes`` or ``str``)
        :param filetype: (optional) The encoding of the file, which is either
            :const:`FILETYPE_PEM` or :const:`FILETYPE_ASN1`.  The default is
            :const:`FILETYPE_PEM`.

        :return: None
        rbN)r=r�r�r�r�ZSSL_CTX_use_PrivateKey_filer!rq)r�rrrarcr�r�r��use_privatekey_file�s
��zContext.use_privatekey_file�pkey�_PrivateKey | PKeycCsJt|t�st�|�}ntjdtdd�t�|j|j	�}|s#|�
�dSdS�zs
        Load a private key from a PKey object

        :param pkey: The PKey object
        :return: None
        z`Passing pyOpenSSL PKey objects is deprecated. You should use a cryptography private key instead.r�rN)r�r�from_cryptography_keyrrrr�ZSSL_CTX_use_PrivateKeyr!�_pkeyrq�r�rtrcr�r�r��use_privatekey�s
	�	�zContext.use_privatekeycCst�|j�st�dSdS)z�
        Check if the private key (loaded with :meth:`use_privatekey`) matches
        the certificate (loaded with :meth:`use_certificate`)

        :return: :data:`None` (raises :exc:`Error` if something's wrong)
        N)r�ZSSL_CTX_check_private_keyr!r�r�r�r�r��check_privatekeys
�zContext.check_privatekeyr�cCs0t�td|��}t|tjk�t�|j|�dS)a%
        Load the trusted certificates that will be sent to the client.  Does
        not actually imply any of the certificates are trusted; that must be
        configured separately.

        :param bytes cafile: The path to a certificates file in PEM format.
        :return: None
        r:N)r�ZSSL_load_client_CA_file�_text_to_bytes_and_warnrr�r��SSL_CTX_set_client_CA_listr!)r�r:Zca_listr�r�r��load_client_cas

�zContext.load_client_ca�bufcCs*td|�}tt�|j|t|��dk�dS)aV
        Set the session id to *buf* within which a session can be reused for
        this Context object.  This is needed when doing session resumption,
        because there is no way for a stored session to know which Context
        object it is associated with.

        :param bytes buf: The session id.

        :returns: None
        rr�N)r|rr�ZSSL_CTX_set_session_id_contextr!r�)r�rr�r�r��set_session_ids
��zContext.set_session_id�modecC� t|t�s	td��t�|j|�S)a�
        Set the behavior of the session cache used by all connections using
        this Context.  The previously set mode is returned.  See
        :const:`SESS_CACHE_*` for details about particular modes.

        :param mode: One or more of the SESS_CACHE_* flags (combine using
            bitwise or)
        :returns: The previously set caching mode.

        .. versionadded:: 0.14
        �mode must be an integer)r�r�r�r�ZSSL_CTX_set_session_cache_moder!�r�r�r�r�r��set_session_cache_mode0s

zContext.set_session_cache_modecC�t�|j�S)z�
        Get the current session cache mode.

        :returns: The currently used cache mode.

        .. versionadded:: 0.14
        )r�ZSSL_CTX_get_session_cache_moder!r�r�r�r��get_session_cache_modeBszContext.get_session_cache_mode�_VerifyCallback | NonecC�vt|t�s	td��|durd|_d|_t�|j|tj	�dSt
|�s&td��t|�|_|jj|_t�|j||j�dS)a�
        Set the verification flags for this Context object to *mode* and
        specify that *callback* should be used for verification callbacks.

        :param mode: The verify mode, this should be one of
            :const:`VERIFY_NONE` and :const:`VERIFY_PEER`. If
            :const:`VERIFY_PEER` is used, *mode* can be OR:ed with
            :const:`VERIFY_FAIL_IF_NO_PEER_CERT` and
            :const:`VERIFY_CLIENT_ONCE` to further control the behaviour.
        :param callback: The optional Python verification callback to use.
            This should take five arguments: A Connection object, an X509
            object, and three integer variables, which are in turn potential
            error number, error depth and return code. *callback* should
            return True if verification passes and False otherwise.
            If omitted, OpenSSL's default verification is used.
        :return: None

        See SSL_CTX_set_verify(3SSL) for further details.
        r�NrF)
r�r�r�r%r&r�ZSSL_CTX_set_verifyr!r�r�rGr�r��r�r�r�r�r�r��
set_verifyLs


zContext.set_verify�depthcC�$t|t�s	td��t�|j|�dS)z�
        Set the maximum depth for the certificate chain verification that shall
        be allowed for this Context object.

        :param depth: An integer specifying the verify depth
        :return: None
        zdepth must be an integerN)r�r�r�r�ZSSL_CTX_set_verify_depthr!)r�r�r�r�r��set_verify_depthrs
	zContext.set_verify_depthcCr�)z�
        Retrieve the Context object's verify mode, as set by
        :meth:`set_verify`.

        :return: The verify mode
        )r�ZSSL_CTX_get_verify_moder!r�r�r�r��get_verify_mode��zContext.get_verify_modecCr�)z�
        Retrieve the Context object's verify depth, as set by
        :meth:`set_verify_depth`.

        :return: The verify depth
        )r�ZSSL_CTX_get_verify_depthr!r�r�r�r��get_verify_depth�r�zContext.get_verify_depth�dhfilecCstt|�}t�|d�}|tjkrt�t�|tj�}t�|tjtjtj�}t�|tj	�}t�
|j|�}t|dk�dS)z�
        Load parameters for Ephemeral Diffie-Hellman

        :param dhfile: The file to load EDH parameters from (``bytes`` or
            ``str``).

        :return: None
        �rr�N)
r=r�ZBIO_new_filer�r�r�r ZBIO_freeZPEM_read_bio_DHparamsZDH_freeZSSL_CTX_set_tmp_dhr!r)r�r��bioZdh�resr�r�r��load_tmp_dh�s

zContext.load_tmp_dh�curve�!_EllipticCurve | ec.EllipticCurvecCs�t|t�rtjdtdd�t�|j|���dS|j	}|dkr"d}n|dkr(d}t�
|���}|tjkr7t
�t�|�}t|tjk�t�|tj�}t�|j|�dS)	a�
        Select a curve to use for ECDHE key exchange.

        :param curve: A curve instance from cryptography
            (:class:`~cryptogragraphy.hazmat.primitives.asymmetric.ec.EllipticCurve`).
            Alternatively (deprecated) a curve object from either
            :meth:`OpenSSL.crypto.get_elliptic_curve` or
            :meth:`OpenSSL.crypto.get_elliptic_curves`.

        :return: None
        z|Passing pyOpenSSL elliptic curves to set_tmp_ecdh is deprecated. You should use cryptography's elliptic curve types instead.r�rZ	secp192r1Z
prime192v1Z	secp256r1Z
prime256v1N)r�rrrrr�ZSSL_CTX_set_tmp_ecdhr!Z
_to_EC_KEY�nameZOBJ_txt2nid�encodeZ	NID_undefr�ZEC_KEY_new_by_curve_namerr�r�r ZEC_KEY_free)r�r�r��nidrr�r�r��set_tmp_ecdh�s&
�	

zContext.set_tmp_ecdh�cipher_listcCs6td|�}t|t�std��tt�|j|�dk�dS)ak
        Set the list of ciphers to be used in this context.

        See the OpenSSL manual for more information (e.g.
        :manpage:`ciphers(1)`).

        Note this API does not change the cipher suites used in TLS 1.3
        Use `set_tls13_ciphersuites` for that.

        :param bytes cipher_list: An OpenSSL cipher string.
        :return: None
        r�z"cipher_list must be a byte string.r�N)r|r�r�r�rr�ZSSL_CTX_set_cipher_listr!)r�r�r�r�r��set_cipher_list�s

�zContext.set_cipher_list�ciphersuitescC�,t|t�s	td��tt�|j|�dk�dS)a�
        Set the list of TLS 1.3 ciphers to be used in this context.
        OpenSSL maintains a separate list of TLS 1.3+ ciphers to
        ciphers for TLS 1.2 and lowers.

        See the OpenSSL manual for more information (e.g.
        :manpage:`ciphers(1)`).

        :param bytes ciphersuites: An OpenSSL cipher string containing
            TLS 1.3+ ciphersuites.
        :return: None

        .. versionadded:: 25.2.0
        z#ciphersuites must be a byte string.r�N)r�r�r�rr�ZSSL_CTX_set_ciphersuitesr!)r�r�r�r�r��set_tls13_ciphersuites�s

�zContext.set_tls13_ciphersuites�certificate_authorities�Sequence[X509Name]cCs�t��}t|tjk�z4|D]/}t|t�s tdt|�j	�d���t�
|j�}t|tjk�t�||�}|s=t�
|�t�qWn
tyLt�|��wt�|j|�dS)a_
        Set the list of preferred client certificate signers for this server
        context.

        This list of certificate authorities will be sent to the client when
        the server requests a client certificate.

        :param certificate_authorities: a sequence of X509Names.
        :return: None

        .. versionadded:: 0.10
        z)client CAs must be X509Name objects, not z objectsN)r�Zsk_X509_NAME_new_nullrr�r�r�rr�r�r��
X509_NAME_dup�_nameZsk_X509_NAME_push�X509_NAME_freer�r�Zsk_X509_NAME_freer}r!)r�r�Z
name_stackZca_namernZpush_resultr�r�r��set_client_ca_list�s.
��
��
�zContext.set_client_ca_list�certificate_authoritycCsFt|t�st�|�}ntjdtdd�t�|j|j	�}t
|dk�dS)ai
        Add the CA certificate to the list of preferred signers for this
        context.

        The list of certificate authorities will be sent to the client when the
        server requests a client certificate.

        :param certificate_authority: certificate authority's X509 certificate.
        :return: None

        .. versionadded:: 0.10
        rhr�rr�N)r�rrirrrr�ZSSL_CTX_add_client_CAr!rjr)r�r�ror�r�r��
add_client_ca$s
��	�zContext.add_client_ca�timeoutcCr�)aQ
        Set the timeout for newly created sessions for this Context object to
        *timeout*.  The default value is 300 seconds. See the OpenSSL manual
        for more information (e.g. :manpage:`SSL_CTX_set_timeout(3)`).

        :param timeout: The timeout in (whole) seconds
        :return: The previous session timeout
        ztimeout must be an integer)r�r�r�r�ZSSL_CTX_set_timeoutr!)r�r�r�r�r��set_timeoutGs

zContext.set_timeoutcCr�)z�
        Retrieve session timeout, as set by :meth:`set_timeout`. The default
        is 300 seconds.

        :return: The session timeout
        )r�ZSSL_CTX_get_timeoutr!r�r�r�r��get_timeoutVr�zContext.get_timeout�&Callable[[Connection, int, int], None]c�6t���fdd��}t�d|�|_t�|j|j�dS)��
        Set the information callback to *callback*. This function will be
        called from time to time during SSL handshakes.

        :param callback: The Python callback to use.  This should take three
            arguments: a Connection object and two integers.  The first integer
            specifies where in the SSL handshake the function was called, and
            the other the return code from a (possibly failed) internal
            function call.
        :return: None
        c��tj|||�dSr��rnr��r��whereZreturn_code�r�r�r�r�o�z*Context.set_info_callback.<locals>.wrapper�void (*)(const SSL *, int, int)N)rr�r�r'r�ZSSL_CTX_set_info_callbackr!r�r�r�r��set_info_callback_s�zContext.set_info_callback�#Callable[[Connection, bytes], None]cr�)a
        Set the TLS key logging callback to *callback*. This function will be
        called whenever TLS key material is generated or received, in order
        to allow applications to store this keying material for debugging
        purposes.

        :param callback: The Python callback to use.  This should take two
            arguments: a Connection object and a bytestring that contains
            the key material in the format used by NSS for its SSLKEYLOGFILE
            debugging output.
        :return: None
        cst�|�}�tj||�dSr�)r�r�rnr�)r��liner�r�r�r��s
z,Context.set_keylog_callback.<locals>.wrapperz#void (*)(const SSL *, const char *)N)rr�r�r(r�ZSSL_CTX_set_keylog_callbackr!r�r�r�r��set_keylog_callbackxs�zContext.set_keylog_callbackr
cC�|jS)zw
        Get the application data (supplied via :meth:`set_app_data()`)

        :return: The application data
        �r*r�r�r�r��get_app_data��zContext.get_app_datar�cC�
||_dS)z�
        Set the application data (will be returned from get_app_data())

        :param data: Any Python object
        :return: None
        Nr��r�r�r�r�r��set_app_data�s
zContext.set_app_data�X509Store | NonecCs.t�|j�}|tjkr
dSt�t�}||_|S)z�
        Get the certificate store for the context.  This can be used to add
        "trusted" certificates without using the
        :meth:`load_verify_locations` method.

        :return: A X509Store object or None if it does not have one.
        N)r�ZSSL_CTX_get_cert_storer!r�r�r�__new__Z_store)r��storeZpystorer�r�r��get_cert_store�s

zContext.get_cert_store�optionscCr�)z�
        Add options. Options set before are not cleared!
        This method should be used with the :const:`OP_*` constants.

        :param options: The options to add.
        :return: The new option bitmask.
        zoptions must be an integer)r�r�r�r�ZSSL_CTX_set_optionsr!)r�r�r�r�r��set_options��
	zContext.set_optionscCr�)z�
        Add modes via bitmask. Modes set before are not cleared!  This method
        should be used with the :const:`MODE_*` constants.

        :param mode: The mode to add.
        :return: The new mode bitmask.
        r�)r�r�r�r�ZSSL_CTX_set_moder!r�r�r�r�r2�r�zContext.set_mode�
mode_to_clearcCst�|j|�S)z�
        Modes previously set cannot be overwritten without being
        cleared first. This method should be used to clear existing modes.
        )r�ZSSL_CTX_clear_moder!)r�r�r�r�r��
clear_mode�szContext.clear_mode�Callable[[Connection], None]cr�)a
        Specify a callback function to be called when clients specify a server
        name.

        :param callback: The callback function.  It will be invoked with one
            argument, the Connection instance.

        .. versionadded:: 0.13
        cs<z
�tj|�WdStytjt���tjYSwr�)rnr�r��sys�
excepthook�exc_infor�r�)r�Zalertr�r�r�r�r��s�
�z7Context.set_tlsext_servername_callback.<locals>.wrapperzint (*)(SSL *, int *, void *)N)rr�r�r)r�Z&SSL_CTX_set_tlsext_servername_callbackr!r�r�r�r��set_tlsext_servername_callback�s��z&Context.set_tlsext_servername_callback�profilescCr�)z�
        Enable support for negotiating SRTP keying material.

        :param bytes profiles: A colon delimited list of protection profile
            names, like ``b'SRTP_AES128_CM_SHA1_80:SRTP_AES128_CM_SHA1_32'``.
        :return: None
        zprofiles must be a byte string.rN)r�r�r�rr�ZSSL_CTX_set_tlsext_use_srtpr!)r�r�r�r�r��set_tlsext_use_srtp�s

	�zContext.set_tlsext_use_srtp�protos�list[bytes]cC�R|std��d�t�dd�|D���}t�d|�}tt�|j	|t
|��dk�dS)a�
        Specify the protocols that the client is prepared to speak after the
        TLS connection has been negotiated using Application Layer Protocol
        Negotiation.

        :param protos: A list of the protocols to be offered to the server.
            This list should be a Python list of bytestrings representing the
            protocols to offer, e.g. ``[b'http/1.1', b'spdy/2']``.
        �'at least one protocol must be specifiedr�cs�"�|]}tt|�f�|fVqdSr��r�r���.0�pr�r�r��	<genexpr>�� z*Context.set_alpn_protos.<locals>.<genexpr>r�rN)r��joinr�
from_iterabler�r�rr�ZSSL_CTX_set_alpn_protosr!r��r�r�ZprotostrZ	input_strr�r�r��set_alpn_protos	s����zContext.set_alpn_protosr�cCs,t|�|_|jj|_t�|j|jtj�dS)a�
        Specify a callback function that will be called on the server when a
        client offers protocols using ALPN.

        :param callback: The callback function.  It will be invoked with two
            arguments: the Connection, and a list of offered protocols as
            bytestrings, e.g ``[b'http/1.1', b'spdy/2']``.  It can return
            one of those bytestrings to indicate the chosen protocol, the
            empty bytestring to terminate the TLS connection, or the
            :py:obj:`NO_OVERLAPPING_PROTOCOLS` to indicate that no offered
            protocol was selected, but that the connection should not be
            aborted.
        N)	r�r+r�r,r�ZSSL_CTX_set_alpn_select_cbr!r�r��r�r�r�r�r��set_alpn_select_callback/s


�z Context.set_alpn_select_callback�helper�5_OCSPClientCallbackHelper | _OCSPServerCallbackHelper�
Any | NonecCsh||_|j|_|durtj|_nt�|�|_t�|j	|j�}t
|dk�t�|j	|j�}t
|dk�dS)z�
        This internal helper does the common work for
        ``set_ocsp_server_callback`` and ``set_ocsp_client_callback``, which is
        almost all of it.
        Nr�)r-r�r.r�r�r/Z
new_handler�ZSSL_CTX_set_tlsext_status_cbr!rZSSL_CTX_set_tlsext_status_arg)r�r�r��rcr�r�r��_set_ocsp_callbackDs

�zContext._set_ocsp_callback�_OCSPServerCallback[_T]cC�t|�}|�||�dS)a�
        Set a callback to provide OCSP data to be stapled to the TLS handshake
        on the server side.

        :param callback: The callback function. It will be invoked with two
            arguments: the Connection, and the optional arbitrary data you have
            provided. The callback must return a bytestring that contains the
            OCSP data to staple to the handshake. If no OCSP data is available
            for this connection, return the empty bytestring.
        :param data: Some opaque data that will be passed into the callback
            function when called. This can be used to avoid needing to do
            complex data lookups or to keep track of what context is being
            used. This parameter is optional.
        N)r�r��r�r�r�r�r�r�r��set_ocsp_server_callback\sz Context.set_ocsp_server_callback�_OCSPClientCallback[_T]cCr�)a�
        Set a callback to validate OCSP data stapled to the TLS handshake on
        the client side.

        :param callback: The callback function. It will be invoked with three
            arguments: the Connection, a bytestring containing the stapled OCSP
            assertion, and the optional arbitrary data you have provided. The
            callback must return a boolean that indicates the result of
            validating the OCSP data: ``True`` if the OCSP data is valid and
            the certificate can be trusted, or ``False`` if either the OCSP
            data is invalid or the certificate has been revoked.
        :param data: Some opaque data that will be passed into the callback
            function when called. This can be used to avoid needing to do
            complex data lookups or to keep track of what context is being
            used. This parameter is optional.
        N)r�r�r�r�r�r��set_ocsp_client_callbackssz Context.set_ocsp_client_callbackr�cC� t|�|_t�|j|jj�dSr�)r�r0r�ZSSL_CTX_set_cookie_generate_cbr!r�r�r�r�r��set_cookie_generate_callback��

�z$Context.set_cookie_generate_callbackr�cCr�r�)r�r1r�ZSSL_CTX_set_cookie_verify_cbr!r�r�r�r�r��set_cookie_verify_callback�r�z"Context.set_cookie_verify_callback)rr�r�r�)r5r�r�r�r�)r:r;r<r;r�r�)r�r?r�r)r�r?rBrEr�r�r�)rSrrTrr�r�)rXrYrZrYr�r�)r^r_r�r�)r^r_rar�r�r��r�rer�r�)rmrer�r�)rrr_rar�r�r��rtrur�r�)r:r�r�r�)rr�r�r�)r�r�r�r��r�r��r�r�r�r�r�r�)r�r�r�r�)r�r_r�r�)r�r�r�r�)r�r�r�r�)r�r�r�r�)r�r�r�r�)r�rer�r�)r�r�r�r��r�r�r�r�)r�r�r�r��r�r
�r�r
r�r�)r�r�)r�r�r�r�)r�r�r�r�)r�r�r�r�)r�r�r�r��r�r�r�r�r�)r�r�r�r�r�r�)r�r�r�rEr�r�)r�r�r�rEr�r�r�r�)Pr�r�r�r�rxr�Z
TLS_methodr}rfr{rcr|rdrhriZTLS_server_methodrgZTLS_client_methodr"ZDTLS_methodr#ZDTLS_server_methodr!ZDTLS_client_methodrrr�rr3r4r>rDrHrRrKrNr`rrdrlrprqrsrzr{r~r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r��_requires_keylogr�r�r�r�r�r2r�r�r�r�r�r�r�r��_requires_ssl_cookier�r�r�r�r�r�rohs�










�
�
1

�
$�!
*
�
�



�%

		'%"
	

	

%
��	roc@seZdZUe�Zded<	d�d�d
d�Zd�dd�Zd�dd�Zd�dd�Z	d�dd�Z
d�dd�Z	d�d�d d!�Zd�d"d#�Z
d�d&d'�Zd�d*d+�Zd�d-d.�Zd�d/d0�Zd�d2d3�Zd�d4d5�Zd�d�d:d;�ZeZd�d�d<d=�Zd�d�d@dA�ZeZ		d�d�dDdE�Zd�dHdI�Zd�dJdK�Zd�dLdM�Zd�dOdP�Zd�dQdR�Zd�dSdT�Zd�dUdV�Z d�dXdY�Z!d�dZd[�Z"d�d]d^�Z#d�d_d`�Z$d�dadb�Z%d�dcdd�Z&d�dedf�Z'd�dgdh�Z(d�djdk�Z)d�dmdn�Z*d�dqdr�Z+d�dsdt�Z,d�dvdw�Z-d�dxdy�Z.d�d{d|�Z/�dd}d~�Z0d�dd��Z1d�d�d��Z2d�d�d��Z3	dߐdd�d��Z4�dd�d��Z5e6j7�dd�d���Z8e6j7d�d���dd�d���Z8d�d���dd�d��Z8e6j7�dd�d���Z9e6j7d�d���dd�d���Z9d�d���dd�d��Z9e:�dd�d���Z;e:�dd�d���Z<e6j7�dd�d���Z=e6j7d�d���d	d�d���Z=d�d���d
d�d��Z=e6j7�dd�d���Z>e6j7d�d���d	d�d���Z>d�d���d
d�d��Z>d�d�d��Z?d�d�d��Z@d�d�d��ZAd�d�d��ZB�dd�d��ZC�dd�d��ZD�d
d�d��ZEd�d�dZFd�d�dĄZG�dd�dǄZHd�d�dɄZI�dd�d˄ZJ�dd�d̈́ZKd�d�dτZL�dd�dӄZM�dd�dՄZN�dd�dׄZOeP�dd�dل�ZQd�d�dۄZR�dd�dބZSdS(rnz&typing.MutableMapping[Any, Connection]r�Nr6ro�socket�socket.socket | Noner�r�cCst|t�s	td��d|_t�|j�}t�|tj	�|_
t�|j
tj�||_d|_
d|_|j|_|j|_|j|_|j|_||j|j
<|durtd|_t�t���|_t|jtjk�t�t���|_t|jtjk�t�|j
|j|j�dSd|_d|_||_t�|j
t|j��}t|dk�dS)z�
        Create a new Connection object, using the given OpenSSL.SSL.Context
        instance and socket.

        :param context: An SSL Context to use for this connection
        :param socket: The socket to use for transport layer
        �"context must be a Context instanceTNr�)r�ror�rr�ZSSL_newr!r�r ZSSL_free�_sslZSSL_set_modeZSSL_MODE_AUTO_RETRYr*r�r%r&r0r1r��_socketZBIO_newZ	BIO_s_mem�	_into_sslrr��	_from_sslZSSL_set_bioZ
SSL_set_fdr�)r�r6r�r�rQr�r�r�r��s8

�zConnection.__init__r�rr
cCs0|jdurtd|jj�d|�d���t|j|�S)zy
        Look up attributes on the wrapped socket object if they are not found
        on the Connection object.
        N�'z' object has no attribute ')r�AttributeError�	__class__r�r��r�r�r�r�r��__getattr__�s

�zConnection.__getattr__r�r�r�cCsr|jjdur|jj��|jjdur|jj��|jjdur$|jj��t�||�}|tjkr2t��|tj	kr:t
��|tjkrBt��|tj
krJt��|tjkr�tdkrZt��d}ntj}t��dksg|dkr||dkrw|dkrwt|t�|���tdd��t�dS|tjkr�t��dkr�t��}t�|�}tjr�t|tjk�t��tdd��t�dS|tjkr�dSt�dS)N�win32rr�zUnexpected EOF) r!r%r�r+r-r�Z
SSL_get_error�SSL_ERROR_WANT_READr~�SSL_ERROR_WANT_WRITEr�SSL_ERROR_ZERO_RETURNr��SSL_ERROR_WANT_X509_LOOKUPr��SSL_ERROR_SYSCALLr	r�Zgetwinerror�errnoZERR_peek_errorrzrrWr��
SSL_ERROR_SSLZERR_GET_REASONZ-Cryptography_HAS_UNEXPECTED_EOF_WHILE_READINGrZ"SSL_R_UNEXPECTED_EOF_WHILE_READINGZERR_clear_errorZSSL_ERROR_NONE)r�r�r�r�rZpeeked_error�reasonr�r�r��_raise_ssl_error�sJ







�



zConnection._raise_ssl_errorcCr�)zh
        Retrieve the :class:`Context` object associated with this
        :class:`Connection`.
        )r!r�r�r�r��get_context'szConnection.get_contextcCs4t|t�s	td��t�|j|j�||_d|j_dS)z�
        Switch this connection to a new session context.

        :param context: A :class:`Context` instance giving the new session
            context to use.
        r�TN)r�ror�r�ZSSL_set_SSL_CTXr�r!r)r�r6r�r�r��set_context.s

zConnection.set_context�bytes | NonecCs(t�|jtj�}|tjkrdSt�|�S)z�
        Retrieve the servername extension value if provided in the client hello
        message, or None if there wasn't one.

        :return: A byte string giving the server name or :data:`None`.

        .. versionadded:: 0.13
        N)r�ZSSL_get_servernamer�ZTLSEXT_NAMETYPE_host_namer�r�r�rr�r�r��get_servername<s	�

zConnection.get_servernamer�r�r�cCr�)z�
        Override the Context object's verification flags for this specific
        connection. See :py:meth:`Context.set_verify` for details.
        r�NrF)
r�r�r�r%r&r�ZSSL_set_verifyr�r�r�rGr�r�r�r�r�r�r�Ms


zConnection.set_verifycCr�)z�
        Retrieve the Connection object's verify mode, as set by
        :meth:`set_verify`.

        :return: The verify mode
        )r�ZSSL_get_verify_moder�r�r�r�r�r�cr�zConnection.get_verify_moder�recCrfrg)r�rrirrrr�ZSSL_use_certificater�rjr�rkr�r�r�rlls
�	
�zConnection.use_certificatertrucCsLt|t�st�|�}ntjdtdd�t�|j|j	�}|s$|j
��dSdSrv)r�rrwrrrr�ZSSL_use_PrivateKeyr�rxr!rqryr�r�r�rz�s
�	�zConnection.use_privatekey�mtucCst�|j|�dS)aK
        For DTLS, set the maximum UDP payload size (*not* including IP/UDP
        overhead).

        Note that you might have to set :data:`OP_NO_QUERY_MTU` to prevent
        OpenSSL from spontaneously clearing this.

        :param mtu: An integer giving the maximum transmission unit.

        .. versionadded:: 21.1
        N)r�ZSSL_set_mtur�)r�rr�r�r��set_ciphertext_mtu�szConnection.set_ciphertext_mtucCsttd�s	td��t�|j�S)a

        For DTLS, get the maximum size of unencrypted data you can pass to
        :meth:`write` without exceeding the MTU (as passed to
        :meth:`set_ciphertext_mtu`).

        :return: The effective MTU as an integer.

        .. versionadded:: 21.1
        �DTLS_get_data_mtuz requires OpenSSL 1.1.1 or better)�hasattrr�rrr�r�r�r�r��get_cleartext_mtu�s
zConnection.get_cleartext_mtur�cCs4t|t�s	td��d|vrtd��t�|j|�dS)z�
        Set the value of the servername extension to send in the client hello.

        :param name: A byte string giving the name.

        .. versionadded:: 0.13
        zname must be a byte string�zname must not contain NUL byteN)r�r�r�r�ZSSL_set_tlsext_host_namer�rr�r�r��set_tlsext_host_name�s

zConnection.set_tlsext_host_namecCr�)z�
        Get the number of bytes that can be safely read from the SSL buffer
        (**not** the underlying transport buffer).

        :return: The number of bytes available in the receive buffer.
        )r�ZSSL_pendingr�r�r�r�r��pending�r�zConnection.pendingrr�_Buffer�flagscCsrtd|�}t�|��%}t|�dkrtd��t�|j|t|��}|�|j|�|Wd�S1s2wYdS)a�
        Send data on the connection. NOTE: If you get one of the WantRead,
        WantWrite or WantX509Lookup exceptions on this, you have to call the
        method again with the SAME buffer.

        :param buf: The string, buffer or memoryview to send
        :param flags: (optional) Included for compatibility with the socket
                      API, the value is ignored
        :return: The number of bytes written
        r��z,Cannot send more than 2**31-1 bytes at once.N)	r|r��from_bufferr�r�r��	SSL_writer�r)r�rrr�r�r�r�r��send�s
�$�zConnection.sendcCs�td|�}t�|��0}t|�}d}|r1t�|j||t|d��}|�|j|�||7}||8}|s|Wd�S1s=wYdS)a�
        Send "all" data on the connection. This calls send() repeatedly until
        all data is sent. If an error occurs, it's impossible to tell how much
        data has been sent.

        :param buf: The string, buffer or memoryview to send
        :param flags: (optional) Included for compatibility with the socket
                      API, the value is ignored
        :return: The number of bytes written
        rrr N)	r|r�r!r�r�r"r��minr)r�rrr�Zleft_to_send�
total_sentr�r�r�r��sendall�s
��
$�zConnection.sendall�bufsizr�cCs`td|�}|dur|tj@rt�|j||�}nt�|j||�}|�|j|�t�	||�dd�S)a
        Receive data on the connection.

        :param bufsiz: The maximum number of bytes to read
        :param flags: (optional) The only supported flag is ``MSG_PEEK``,
            all other flags are ignored.
        :return: The string read from the Connection
        �char[]N)
�_no_zero_allocatorr��MSG_PEEKr��SSL_peekr��SSL_readrr�r�)r�r'rrr�r�r�r��recv	s
	zConnection.recvr��nbytescCs�|dur	t|�}nt|t|��}td|�}|dur'|tj@r't�|j||�}nt�|j||�}|�	|j|�t
t�||��|d|�<|S)ae
        Receive data on the connection and copy it directly into the provided
        buffer, rather than creating a new string.

        :param buffer: The buffer to copy into.
        :param nbytes: (optional) The maximum number of bytes to read into the
            buffer. If not present, defaults to the size of the buffer. If
            larger than the size of the buffer, is reduced to the size of the
            buffer.
        :param flags: (optional) The only supported flag is ``MSG_PEEK``,
            all other flags are ignored.
        :return: The number of bytes read into the buffer.
        Nr()
r�r$r)r�r*r�r+r�r,r�
memoryviewr�r�)r�r�r.rrr�r�r�r��	recv_into	s

zConnection.recv_intor��typing.NoReturncCsNt�|�r"t�|�r
t��t�|�rt��t�|�rtd��td��t�dS)N�BIO_should_io_specialzunknown bio failure)	r�ZBIO_should_retryZBIO_should_readr~ZBIO_should_writerr2r�r�)r�r�r�r�r�r��_handle_bio_errorsH	s




zConnection._handle_bio_errorscCsh|jdur	td��t|t�std��td|�}t�|j||�}|dkr*|�|j|�t�	||�dd�S)a�
        If the Connection was created with a memory BIO, this method can be
        used to read bytes from the write end of that memory BIO.  Many
        Connection methods will add bytes which must be read in this manner or
        the buffer will eventually fill up and the Connection will be able to
        take no further actions.

        :param bufsiz: The maximum number of bytes to read
        :return: The string read.
        N�Connection sock was not Nonezbufsiz must be an integerr(r)
rr�r�r�r)r�ZBIO_readr3r�r�)r�r'rr�r�r�r��bio_readZ	s


zConnection.bio_readcCsxtd|�}|jdurtd��t�|��}t�|j|t|��}|dkr)|�|j|�|Wd�S1s5wYdS)aj
        If the Connection was created with a memory BIO, this method can be
        used to add bytes to the read end of that memory BIO.  The Connection
        can then read the bytes (for example, in response to a call to
        :meth:`recv`).

        :param buf: The string to put into the memory BIO.
        :return: The number of bytes written
        rNr4r)	r|rr�r�r!r�Z	BIO_writer�r3)r�rr�r�r�r�r��	bio_writer	s


$�zConnection.bio_writer�cCs$|��stt�|j�dk�dSdS)zv
        Renegotiate the session.

        :return: True if the renegotiation can be started, False otherwise
        r�TF)�renegotiate_pendingrr�ZSSL_renegotiater�r�r�r�r��renegotiate�	szConnection.renegotiatecCst�|j�}|�|j|�dS)a
        Perform an SSL handshake (usually called after :meth:`renegotiate` or
        one of :meth:`set_accept_state` or :meth:`set_connect_state`). This can
        raise the same exceptions as :meth:`send` and :meth:`recv`.

        :return: None.
        N)r�ZSSL_do_handshaker�r�r�r�r�r�r��do_handshake�	szConnection.do_handshakecCst�|j�dkS)z�
        Check if there's a renegotiation in progress, it will return False once
        a renegotiation is finished.

        :return: Whether there's a renegotiation in progress
        r�)r�ZSSL_renegotiate_pendingr�r�r�r�r�r7�	�zConnection.renegotiate_pendingcCr�)zn
        Find out the total number of renegotiations.

        :return: The number of renegotiations.
        )r�ZSSL_total_renegotiationsr�r�r�r�r��total_renegotiations�	szConnection.total_renegotiations�addrcCst�|j�|j�|�S)a4
        Call the :meth:`connect` method of the underlying socket and set up SSL
        on the socket, using the :class:`Context` object supplied to this
        :class:`Connection` object at creation.

        :param addr: A remote address
        :return: What the socket's connect method returns
        )r��SSL_set_connect_stater�r�connect)r�r=r�r�r�r?�	s	zConnection.connectcCs|jj}|��||�S)a�
        Call the :meth:`connect_ex` method of the underlying socket and set up
        SSL on the socket, using the Context object supplied to this Connection
        object at creation. Note that if the :meth:`connect_ex` method of the
        socket doesn't return 0, SSL won't be initialized.

        :param addr: A remove address
        :return: What the socket's connect_ex method returns
        )r�
connect_ex�set_connect_state)r�r=r@r�r�r�r@�	s
zConnection.connect_ex�tuple[Connection, Any]cCs*|j��\}}t|j|�}|��||fS)a�
        Call the :meth:`accept` method of the underlying socket and set up SSL
        on the returned socket, using the Context object supplied to this
        :class:`Connection` object at creation.

        :return: A *(conn, addr)* pair where *conn* is the new
            :class:`Connection` object created, and *address* is as returned by
            the socket's :meth:`accept`.
        )r�acceptrnr!�set_accept_state)r��clientr=r�r�r�r�rC�	s
zConnection.acceptc	Cs�t��}zt�|j|�}Wt�|�nt�|�w|jdur#|j��|jdur-|j��|dkr4t��|dkrA|�	|j|�dSdS)z�
        Call the OpenSSL function DTLSv1_listen on this connection. See the
        OpenSSL manual for more details.

        :return: None
        Nr)
r�ZBIO_ADDR_new�
DTLSv1_listenr�Z
BIO_ADDR_freer0r�r1r~r)r�Zbio_addrr�r�r�r�rF�	s



�zConnection.DTLSv1_listencCs<t�d�}t�d�}t�|j||�r|d|ddSdS)a}
        Determine when the DTLS SSL object next needs to perform internal
        processing due to the passage of time.

        When the returned number of seconds have passed, the
        :meth:`DTLSv1_handle_timeout` method needs to be called.

        :return: The time left in seconds before the next timeout or `None`
            if no timeout is currently active.
        ztime_t *zlong *ri@BN)r�r�r�ZCryptography_DTLSv1_get_timeoutr�)r�Zptv_secZptv_usecr�r�r��DTLSv1_get_timeout�	s


zConnection.DTLSv1_get_timeoutcCs2t�|j�}|dkr|�|j|�Jd��t|�S)z�
        Handles any timeout events which have become pending on a DTLS SSL
        object.

        :return: `True` if there was a pending timeout, `False` otherwise.
        rF�unreachable)r��DTLSv1_handle_timeoutr�rr�r9r�r�r�rI
s
z Connection.DTLSv1_handle_timeoutcCs$|jdur	td��t�|jd�dS)z�
        If the Connection was created with a memory BIO, this method can be
        used to indicate that *end of file* has been reached on the read end of
        that memory BIO.

        :return: None
        Nr4r)rr�r�ZBIO_set_mem_eof_returnrr�r�r�r��bio_shutdown
s
zConnection.bio_shutdowncCs:t�|j�}|dkr|�|j|�Jd��|dkrdSdS)aQ
        Send the shutdown message to the Connection.

        :return: True if the shutdown completed successfully (i.e. both sides
                 have sent closure alerts), False otherwise (in which case you
                 call :meth:`recv` or :meth:`send` when the connection becomes
                 readable/writeable).
        rFrHT)r�ZSSL_shutdownr�rr9r�r�r��shutdown
s	zConnection.shutdownrYcCsHg}t�D]}t�|j|�}|tjkr|S|�t�|��d��q|S)z�
        Retrieve the list of ciphers used by the Connection object.

        :return: A list of native cipher strings.
        �utf-8)	rr�ZSSL_get_cipher_listr�r�r�r�r��decode)r��ciphersr�r�r�r�r��get_cipher_list0
s

�zConnection.get_cipher_list�list[X509Name]cCs~t�|j�}|tjkr
gSg}tt�|��D]&}t�||�}t�|�}t	|tjk�t
�t
�}t�|tj
�|_|�|�q|S)a�
        Get CAs whose certificates are suggested for client authentication.

        :return: If this is a server connection, the list of certificate
            authorities that will be sent or has been sent to the client, as
            controlled by this :class:`Connection`'s :class:`Context`.

            If this is a client connection, the list will be empty until the
            connection with the server is established.

        .. versionadded:: 0.10
        )r�ZSSL_get_client_CA_listr�r�r��rangeZsk_X509_NAME_numZsk_X509_NAME_valuer�rrr�r r�r�r�)r�Zca_namesr�r�r�rnZpynamer�r�r��get_client_ca_list>
s


zConnection.get_client_ca_listrrcOstd��)z�
        The makefile() method is not implemented, since there is no dup
        semantics for SSL connections

        :raise: NotImplementedError
        z1Cannot make file object of OpenSSL.SSL.Connectionrrr�r�r��makefile[
s�zConnection.makefilecCr�)zr
        Retrieve application data as set by :meth:`set_app_data`.

        :return: The application data
        r�r�r�r�r�r�f
r�zConnection.get_app_datar�cCr�)zg
        Set application data

        :param data: The application data
        :return: None
        Nr�r�r�r�r�r�n
s
zConnection.set_app_datacCr�)z�
        Get the shutdown state of the Connection.

        :return: The shutdown state, a bitvector of SENT_SHUTDOWN,
            RECEIVED_SHUTDOWN.
        )r�ZSSL_get_shutdownr�r�r�r�r��get_shutdownw
r�zConnection.get_shutdown�statecCr�)z�
        Set the shutdown state of the Connection.

        :param state: bitvector of SENT_SHUTDOWN, RECEIVED_SHUTDOWN.
        :return: None
        zstate must be an integerN)r�r�r�r�ZSSL_set_shutdownr�)r�rUr�r�r��set_shutdown�
s
zConnection.set_shutdowncCst�t�|j��S)z�
        Retrieve a verbose string detailing the state of the Connection.

        :return: A string representing the state
        )r�r�r�ZSSL_state_string_longr�r�r�r�r��get_state_string�
szConnection.get_state_stringcC�ft�|j�}|tjkr
dSt�|jtjd�}t|dk�td|�}t�|j||�t�||�dd�S)z�
        Retrieve the random value used with the server hello message.

        :return: A string representing the state
        Nrr�)	r��SSL_get_sessionr�r�r�ZSSL_get_server_randomrr)r��r��session�length�outpr�r�r��
server_random�
s

zConnection.server_randomcCrX)z�
        Retrieve the random value used with the client hello message.

        :return: A string representing the state
        Nrr�)	r�rYr�r�r�ZSSL_get_client_randomrr)r�rZr�r�r��
client_random�
s

zConnection.client_randomcCsbt�|j�}|tjkr
dSt�|tjd�}t|dk�td|�}t�|||�t�||�dd�S)zz
        Retrieve the value of the master key for this session.

        :return: A string representing the state
        Nrr�)	r�rYr�r�r�ZSSL_SESSION_get_master_keyrr)r�rZr�r�r��
master_key�
s

zConnection.master_key�label�olenc	
Csntd|�}tj}d}d}|dur|}t|�}d}t�|j|||t|�|||�}t|dk�t�||�dd�S)aH
        Obtain keying material for application use.

        :param: label - a disambiguating label string as described in RFC 5705
        :param: olen - the length of the exported key material in bytes
        :param: context - a per-association context value
        :return: the exported key material bytes or None
        r�rNr�)	r)r�r�r�r�ZSSL_export_keying_materialr�rr�)	r�rarbr6r]Zcontext_bufZcontext_lenZuse_context�successr�r�r��export_keying_material�
s(
�
z!Connection.export_keying_materialcOs|jj|i|��S)z�
        Call the :meth:`shutdown` method of the underlying socket.
        See :manpage:`shutdown(2)`.

        :return: What the socket's shutdown() method returns
        )rrKrr�r�r��
sock_shutdown�
szConnection.sock_shutdown�as_cryptography�typing.Literal[True]�x509.Certificate | NonecC�dSr�r��r�rfr�r�r��get_certificate�
�zConnection.get_certificateF)rf�typing.Literal[False]�X509 | NonecCrir�r�rjr�r�r�rk�
rl�,typing.Literal[True] | typing.Literal[False]�X509 | x509.Certificate | NonecCs>t�|j�}|tjkrt�|�t�|�}|r|��S|SdS)a

        Retrieve the local certificate (if any)

        :param bool as_cryptography: Controls whether a
            ``cryptography.x509.Certificate`` or an ``OpenSSL.crypto.X509``
            object should be returned.

        :return: The local certificate
        N)	r�ZSSL_get_certificater�r�r�r�rr��to_cryptography�r�rfr��pycertr�r�r�rk�
s


cCrir�r�rjr�r�r��get_peer_certificaterlzConnection.get_peer_certificatecCrir�r�rjr�r�r�rtrlcCs4t�|j�}|tjkrt�|�}|r|��S|SdS)a
        Retrieve the other side's certificate (if any)

        :param bool as_cryptography: Controls whether a
            ``cryptography.x509.Certificate`` or an ``OpenSSL.crypto.X509``
            object should be returned.

        :return: The peer's certificate
        N)r�ZSSL_get_peer_certificater�r�r�rr�rqrrr�r�r�rts

�
cert_stack�
list[X509]cCs`g}tt�|��D]$}t�||�}t|tjk�t�|�}t|dk�t�	|�}|�
|�q	|S�zb
        Internal helper to convert a STACK_OF(X509) to a list of X509
        instances.
        r�)rQr��sk_X509_num�
sk_X509_valuerr�r�r�rr�r��rur�r�r�r�rsr�r�r��_cert_stack_to_list1s

zConnection._cert_stack_to_list�list[x509.Certificate]cCsdg}tt�|��D]&}t�||�}t|tjk�t�|�}t|dk�t�	|�}|�
|���q	|Srw)rQr�rxryrr�r�r�rr�r�rqrzr�r�r�� _cert_stack_to_cryptography_listAs

z+Connection._cert_stack_to_cryptography_list�list[x509.Certificate] | NonecCrir�r�rjr�r�r��get_peer_cert_chainSrlzConnection.get_peer_cert_chain�list[X509] | NonecCrir�r�rjr�r�r�rYrl�*list[X509] | list[x509.Certificate] | NonecC�2t�|j�}|tjkr
dS|r|�|�S|�|�S)as
        Retrieve the other side's certificate (if any)

        :param bool as_cryptography: Controls whether a list of
            ``cryptography.x509.Certificate`` or ``OpenSSL.crypto.X509``
            object should be returned.

        :return: A list of X509 instances giving the peer's certificate chain,
                 or None if it does not have one.
        N)r�ZSSL_get_peer_cert_chainr�r�r�r}r{�r�rfrur�r�r�r_s


cCrir�r�rjr�r�r��get_verified_chainvrlzConnection.get_verified_chaincCrir�r�rjr�r�r�r�|rlcCr�)a�
        Retrieve the verified certificate chain of the peer including the
        peer's end entity certificate. It must be called after a session has
        been successfully established. If peer verification was not successful
        the chain may be incomplete, invalid, or None.

        :param bool as_cryptography: Controls whether a list of
            ``cryptography.x509.Certificate`` or ``OpenSSL.crypto.X509``
            object should be returned.

        :return: A list of X509 instances giving the peer's verified
                 certificate chain, or None if it does not have one.

        .. versionadded:: 20.0
        N)r�ZSSL_get0_verified_chainr�r�r�r}r{r�r�r�r�r��s


cCr�)z�
        Checks if more data has to be read from the transport layer to complete
        an operation.

        :return: True iff more data has to be read
        )r�Z
SSL_want_readr�r�r�r�r��	want_read�r�zConnection.want_readcCr�)z�
        Checks if there is data to write to the transport layer to complete an
        operation.

        :return: True iff there is data to write
        )r�ZSSL_want_writer�r�r�r�r��
want_write�r�zConnection.want_writecC�t�|j�dS)z�
        Set the connection to work in server mode. The handshake will be
        handled automatically by read/write.

        :return: None
        N)r�ZSSL_set_accept_stater�r�r�r�r�rD�r;zConnection.set_accept_statecCr�)z�
        Set the connection to work in client mode. The handshake will be
        handled automatically by read/write.

        :return: None
        N)r�r>r�r�r�r�r�rA�r;zConnection.set_connect_state�Session | NonecCs8t�|j�}|tjkr
dSt�t�}t�|tj�|_	|S)z�
        Returns the Session currently used.

        :return: An instance of :class:`OpenSSL.SSL.Session` or
            :obj:`None` if no session exists.

        .. versionadded:: 0.14
        N)
r�ZSSL_get1_sessionr�r�r�ryr�r ZSSL_SESSION_freer)r�r[Z	pysessionr�r�r��get_session�s	

zConnection.get_sessionr[rycCs2t|t�s	td��t�|j|j�}t|dk�dS)z�
        Set the session to be used when the TLS/SSL connection is established.

        :param session: A Session instance representing the session to use.
        :returns: None

        .. versionadded:: 0.14
        z"session must be a Session instancer�N)r�ryr�r�ZSSL_set_sessionr�rr)r�r[r�r�r�r��set_session�s
	zConnection.set_session�function�Callable[[Any, Any, int], int]cCsRt�dd�}||j|d�}|dkrdStd|�}||j||�t�||�dd�S)aN
        Helper to implement :meth:`get_finished` and
        :meth:`get_peer_finished`.

        :param function: Either :data:`SSL_get_finished`: or
            :data:`SSL_get_peer_finished`.

        :return: :data:`None` if the desired message has not yet been
            received, otherwise the contents of the message.
        r(rN)r�r�r�r)r�)r�r��emptyr@rr�r�r��_get_finished_message�s
z Connection._get_finished_messagecC�|�tj�S)z�
        Obtain the latest TLS Finished message that we sent.

        :return: The contents of the message or :obj:`None` if the TLS
            handshake has not yet completed.

        .. versionadded:: 0.15
        )r�r�ZSSL_get_finishedr�r�r�r��get_finished�	zConnection.get_finishedcCr�)z�
        Obtain the latest TLS Finished message that we received from the peer.

        :return: The contents of the message or :obj:`None` if the TLS
            handshake has not yet completed.

        .. versionadded:: 0.15
        )r�r�ZSSL_get_peer_finishedr�r�r�r��get_peer_finishedr�zConnection.get_peer_finished�
str | NonecC�4t�|j�}|tjkr
dSt�t�|��}|�d�S)z�
        Obtain the name of the currently used cipher.

        :returns: The name of the currently used cipher or :obj:`None`
            if no connection has been established.

        .. versionadded:: 0.15
        NrL)r��SSL_get_current_cipherr�r�r�r�ZSSL_CIPHER_get_namerM)r��cipherr�r�r�r��get_cipher_name�
	

zConnection.get_cipher_namecCs(t�|j�}|tjkr
dSt�|tj�S)z�
        Obtain the number of secret bits of the currently used cipher.

        :returns: The number of secret bits of the currently used cipher
            or :obj:`None` if no connection has been established.

        .. versionadded:: 0.15
        N)r�r�r�r�r�ZSSL_CIPHER_get_bits)r�r�r�r�r��get_cipher_bits,s	
zConnection.get_cipher_bitscCr�)z�
        Obtain the protocol version of the currently used cipher.

        :returns: The protocol name of the currently used cipher
            or :obj:`None` if no connection has been established.

        .. versionadded:: 0.15
        NrL)r�r�r�r�r�r�ZSSL_CIPHER_get_versionrM)r�r�r5r�r�r��get_cipher_version;r�zConnection.get_cipher_versioncCst�t�|j��}|�d�S)a
        Retrieve the protocol version of the current connection.

        :returns: The TLS version of the current connection, for example
            the value for TLS 1.2 would be ``TLSv1.2``or ``Unknown``
            for connections that were not successfully established.
        rL)r�r�r�ZSSL_get_versionr�rMr8r�r�r��get_protocol_version_nameKs
z$Connection.get_protocol_version_namecCst�|j�}|S)z�
        Retrieve the SSL or TLS protocol version of the current connection.

        :returns: The TLS version of the current connection.  For example,
            it will return ``0x769`` for connections made over TLS version 1.
        )r�ZSSL_versionr�r8r�r�r��get_protocol_versionVszConnection.get_protocol_versionr�r�cCr�)ah
        Specify the client's ALPN protocol list.

        These protocols are offered to the server during protocol negotiation.

        :param protos: A list of the protocols to be offered to the server.
            This list should be a Python list of bytestrings representing the
            protocols to offer, e.g. ``[b'http/1.1', b'spdy/2']``.
        r�r�csr�r�r�r�r�r�r�r�sr�z-Connection.set_alpn_protos.<locals>.<genexpr>r�rN)r�r�rr�r�r�rr�ZSSL_set_alpn_protosr�r�r�r�r�r�r�`s
��zConnection.set_alpn_protoscCsHt�d�}t�d�}t�|j||�|sdSt�|d|d�dd�S)z�
        Get the protocol that was negotiated by ALPN.

        :returns: A bytestring of the protocol name.  If no protocol has been
            negotiated yet, returns an empty bytestring.
        r�zunsigned int *r�rN)r�r�r�ZSSL_get0_alpn_selectedr�r�)r�r�Zdata_lenr�r�r��get_alpn_proto_negotiated�s

z$Connection.get_alpn_proto_negotiatedcCs t�|j�}|s
dSt�|j�S)z�
        Get the SRTP protocol which was negotiated.

        :returns: A bytestring of the SRTP profile name. If no profile has been
            negotiated yet, returns an empty bytestring.
        r�)r�ZSSL_get_selected_srtp_profiler�r�r�r�)r�Zprofiler�r�r��get_selected_srtp_profile�sz$Connection.get_selected_srtp_profilecCsDt�|j�}|tjkr
dSt�|j�}|tjkrdSt�|��d�S)z�
        Get the name of the negotiated group for the key exchange.

        :return: A string giving the group name or :data:`None`.
        NrL)r�rYr�r�r�ZSSL_get0_group_namer�rM)r�r[Z
group_namer�r�r��get_group_name�s


zConnection.get_group_namecCs t�|jtj�}t|dk�dS)a
        Called to request that the server sends stapled OCSP data, if
        available. If this is not called on the client side then the server
        will not send OCSP data. Should be used in conjunction with
        :meth:`Context.set_ocsp_client_callback`.
        r�N)r�ZSSL_set_tlsext_status_typer�ZTLSEXT_STATUSTYPE_ocspr)r�r�r�r�r��request_ocsp�s�zConnection.request_ocspr�cr�)r�cr�r�r�r�r�r�r�r��r�z-Connection.set_info_callback.<locals>.wrapperr�N)rr�r�r'r�ZSSL_set_info_callbackr�r�r�r�r�r��s�zConnection.set_info_callbackr�)r6ror�r�r�r�)r�rr�r
)r�r
r�r�r�r�)r�ro)r6ror�r�)r�rr�r�r�r�)rr�r�r�)r�r�r�r�)r)rrrr�r�r�)r'r�rr�r�r�)NN)r�r
r.r�rr�r�r�)r�r
r�r�r�r1)r'r�r�r�)rrr�r�)r�r�r�)r=r
r�r�)r=r
r�r�)r�rB)r�r�)r�rY)r�rP)rr
rr
r�r1r�r�)rUr�r�r�)r�r�)rar�rbr�r6rr�r�)rr
rr
r�r�)rfrgr�rh)rfrmr�rn)rfror�rp)rur
r�rv)rur
r�r|)rfrgr�r~)rfrmr�r�)rfror�r�)r�r�)r[ryr�r�)r�r�r�r)r�r�)r�rr�r�)Tr�r�r�rr�rr�rrrrrr�r�rlrzrrrrr#�writer&r-�readr0r3r5r6r8r:r7r<r?r@rCrFrGrIrJrKrOrRrSr�r�rTrVrWr^r_r`rdrer�overloadrkrt�staticmethodr{r}rr�r�r�rDrAr�r�r�r�r�r�r�r�r�r�r�r�r��_requires_ssl_get0_group_namer�r�r�r�r�r�r�rn�s�

��
>

5

�

	




	�
*





	













	
	


� 	��������

	
	
		
#



"

)r�r
r�r�)r�r�r�r�)r�r�r�rr�r)rr
r�r
)��
__future__rrUr�r�rr�collections.abcrrr�	functoolsrr�	itertoolsrrr	r
rrr
�weakrefrZcryptographyrZ)cryptography.hazmat.primitives.asymmetricrZ
OpenSSL._utilrr_rZ_exception_from_error_queuerr�rr�rZ_make_assertrr)rr=rr|ZOpenSSL.cryptorrrrrrrr �__all__r+rr*r'r)r(r&rRrOrQrPrNZSSL_SENT_SHUTDOWNrDZSSL_RECEIVED_SHUTDOWNrCrxr}r{r|rhrirgr"r#r!rMrfrcrdreZSSL_OP_NO_SSLv2rqZSSL_OP_NO_SSLv3rrZSSL_OP_NO_TLSv1rsZSSL_OP_NO_TLSv1_1rtZSSL_OP_NO_TLSv1_2ruZSSL_OP_NO_TLSv1_3rvZSSL_MODE_RELEASE_BUFFERSr$ZSSL_OP_SINGLE_DH_USEr<ZSSL_OP_SINGLE_ECDH_USEr=ZSSL_OP_EPHEMERAL_RSAr/ZSSL_OP_MICROSOFT_SESS_ID_BUGr1ZSSL_OP_NETSCAPE_CHALLENGE_BUGr4Z'SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUGr6Z"SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUGr?Z!SSL_OP_MICROSOFT_BIG_SSLV3_BUFFERr0ZSSL_OP_MSIE_SSLV2_RSA_PADDINGr2ZSSL_OP_SSLEAY_080_CLIENT_DH_BUGr>ZSSL_OP_TLS_D5_BUGrAZSSL_OP_TLS_BLOCK_PADDING_BUGr@Z"SSL_OP_DONT_INSERT_EMPTY_FRAGMENTSr.ZSSL_OP_CIPHER_SERVER_PREFERENCEr-ZSSL_OP_TLS_ROLLBACK_BUGrBZSSL_OP_PKCS1_CHECK_1r:ZSSL_OP_PKCS1_CHECK_2r;ZSSL_OP_NETSCAPE_CA_DN_BUGr3Z&SSL_OP_NETSCAPE_DEMO_CIPHER_CHANGE_BUGr5ZSSL_OP_NO_COMPRESSIONr7ZSSL_OP_NO_QUERY_MTUr8ZSSL_OP_COOKIE_EXCHANGEr�r�rZSSL_OP_NO_TICKETr9ZSSL_OP_NO_RENEGOTIATIONr�ZSSL_OP_IGNORE_UNEXPECTED_EOFr�ZSSL_OP_LEGACY_SERVER_CONNECTr�Z
SSL_OP_ALLr,ZSSL_VERIFY_PEERrmZSSL_VERIFY_FAIL_IF_NO_PEER_CERTrkZSSL_VERIFY_CLIENT_ONCErjZSSL_VERIFY_NONErlZSSL_SESS_CACHE_OFFrKZSSL_SESS_CACHE_CLIENTrFZSSL_SESS_CACHE_SERVERrLZSSL_SESS_CACHE_BOTHrEZSSL_SESS_CACHE_NO_AUTO_CLEARrGZ!SSL_SESS_CACHE_NO_INTERNAL_LOOKUPrIZ SSL_SESS_CACHE_NO_INTERNAL_STORErJZSSL_SESS_CACHE_NO_INTERNALrHrar`rbr[rXr\r^rUr]r_rTrSrWrVrZrY�Unionr��	bytearrayr/rr�r�r%�Listr�r�r�r�Z_OCSPClientCallbackZ_OCSPServerCallbackr�Z_PassphraseCallbackr�r�rOrPrLrMr�rpr�rr~rr�r�rzr�r�r�r�r�r�r�r�r�rwr
r�r�r�r�ryr
rrornr�r�r�r��<module>s�(f
�
��������k	�
(=C;

	
�
�
�
C