⚝
One Hat Cyber Team
⚝
Your IP:
216.73.216.9
Server IP:
97.74.87.16
Server:
Linux 16.87.74.97.host.secureserver.net 5.14.0-503.38.1.el9_5.x86_64 #1 SMP PREEMPT_DYNAMIC Fri Apr 18 08:52:10 EDT 2025 x86_64
Server Software:
Apache
PHP Version:
8.2.28
Buat File
|
Buat Folder
Eksekusi
Dir :
~
/
var
/
opt
/
nydus
/
ops
/
oscrypto
/
_win
/
__pycache__
/
View File Name :
tls.cpython-39.pyc
a ���g�� � @ s d dl mZmZmZmZ d dlZd dlZd dlZd dl Z d dl Z ddl m Z ddlmZ ddlmZmZmZmZmZmZmZmZmZmZmZm Z m Z m Z ddl m Z m!Z!m"Z" dd l#m$Z$m%Z%m"Z& dd l'm(Z( dd l)m*Z*m+Z+m,Z,m-Z- dd l.m/Z/m0Z0m1Z1m2Z2 dd l3m4Z4m5Z5m6Z6m7Z7m8Z8m9Z9m:Z:m;Z;m<Z<m=Z=m>Z>m?Z?m@Z@mAZAmBZBmCZCmDZDmEZEmFZF ddlGmHZHm Z ddlImJZJ ejKdk �r�eLZMejNZOnePZOejKdk �r�ejQZRnejRZRddgZSe�Td�ZUe�V� ZWeWd eWd fZXG dd� de0�ZYG dd� de/�ZZG dd� de[�Z\G dd� de[�Z]dS )� )�unicode_literals�division�absolute_import�print_functionN� )� Certificate)�pretty_message)�buffer_from_bytes�buffer_from_unicode�bytes_from_buffer�cast�deref�is_null�native�new�null�ref�sizeof�struct�unwrap�write_to_buffer� )�secur32� Secur32Const� handle_error)�crypt32� Crypt32Constr )�kernel32)� type_name�str_cls�byte_cls� int_types)�TLSError�TLSVerificationError�TLSDisconnectError�TLSGracefulDisconnectError)�detect_client_auth_request�detect_other_protocol� extract_chain�get_dh_params_length� parse_alert�parse_session_info�raise_client_auth�raise_dh_params�raise_disconnection�raise_expired_not_yet_valid�raise_handshake�raise_hostname�raise_no_issuer�raise_protocol_error�raise_protocol_version� raise_revoked�raise_self_signed�raise_verification�raise_weak_signature)�load_certificater )�parse_certificate)� )r; � � TLSSession� TLSSockets ( | | )c @ s e Zd ZdS )�_TLSDowngradeErrorN)�__name__� __module__� __qualname__� rC rC �B/opt/nydus/tmp/pip-target-mke_irhy/lib/python/oscrypto/_win/tls.pyr? Q s r? c @ s e Zd ZdZdS )�_TLSRetryErrorz� TLSv1.2 on Windows 7 and 8 seems to have isuses with some DHE_RSA ServerKeyExchange messages due to variable length integer encoding. This exception is used to trigger a reconnection to attempt the handshake again. N)r@ rA rB �__doc__rC rC rC rD rE V s rE c @ s> e Zd ZdZdZdZdZdZdZd dd�Z dd� Z dd � Z dS ) r= zj A TLS session object that multiple TLSSocket objects can share for the sake of session reuse NFc C sL t |t�s ttdt|����|| _|du r6tg d��}t |t�rLt|g�}n t |t�shttdt|����|tg d�� }|r�ttdt |����|| _ g | _ |�r@|D ]�}t |t �r�|j }nxt |t�r�t|�}ndt |t��rt|d�� }t|�� �}W d � n1 �s0 Y n t |t��s2ttdt|����| j �|� q�| �� dS ) a] :param protocol: A unicode string or set of unicode strings representing allowable protocols to negotiate with the server: - "TLSv1.2" - "TLSv1.1" - "TLSv1" - "SSLv3" Default is: {"TLSv1", "TLSv1.1", "TLSv1.2"} :param manual_validation: If certificate and certificate path validation should be skipped and left to the developer to implement :param extra_trust_roots: A list containing one or more certificates to be treated as trust roots, in one of the following formats: - A byte string of the DER encoded certificate - A unicode string of the certificate filename - An asn1crypto.x509.Certificate object - An oscrypto.asymmetric.Certificate object :raises: ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type OSError - when an error is returned by the OS crypto library zM manual_validation must be a boolean, not %s N)�TLSv1�TLSv1.1�TLSv1.2zu protocol must be a unicode string or set of unicode strings, not %s ��SSLv3rG rH rI z� protocol must contain only the unicode strings "SSLv3", "TLSv1", "TLSv1.1", "TLSv1.2", not %s �rbz� extra_trust_roots must be a list of byte strings, unicode strings, asn1crypto.x509.Certificate objects or oscrypto.asymmetric.Certificate objects, not %s )� isinstance�bool� TypeErrorr r �_manual_validation�setr � ValueError�repr� _protocols�_extra_trust_rootsr Zasn1r r: �open�read�Asn1Certificate�append�_obtain_credentials)�self�protocolZmanual_validationZextra_trust_rootsZunsupported_protocolsZextra_trust_root�frC rC rD �__init__m sN � �� . �zTLSSession.__init__c C s� t jt jt jt jd�}d}|�� D ]\}}|| jv r"||O }q"t jt jt j t j t j t j t j t jt jt jg }d| jv r�|�t jt jt jg� ttdt|� �}t|�D ]\}}|||< q�t jt jB } | js�| j s�| t j O } n | t j O } t td�} t | �} t j!| _"d| _#t$� | _%t$� | _&d| _'t$� | _(t|�| _)|| _*|| _+d| _,d| _-d| _.| | _/d| _0ttd�} t�1t$� t j2t j3t$� | t$� t$� | t$� � } t4| � | | _5dS )zU Obtains a credentials handle from secur32.dll for use with SChannel rJ r rI z ALG_ID[%s]Z SCHANNEL_CREDz CredHandle *N)6r �SP_PROT_SSL3_CLIENT�SP_PROT_TLS1_CLIENT�SP_PROT_TLS1_1_CLIENT�SP_PROT_TLS1_2_CLIENT�itemsrT Z CALG_AES_128Z CALG_AES_256Z CALG_3DESZ CALG_SHA1Z CALG_ECDHEZ CALG_DH_EPHEMZ CALG_RSA_KEYXZ CALG_RSA_SIGNZ CALG_ECDSAZ CALG_DSS_SIGN�extendZ CALG_SHA512Z CALG_SHA384Z CALG_SHA256r r �len� enumerateZSCH_USE_STRONG_CRYPTOZSCH_CRED_NO_DEFAULT_CREDSrP rU Z SCH_CRED_AUTO_CRED_VALIDATIONZ SCH_CRED_MANUAL_CRED_VALIDATIONr r ZSCHANNEL_CRED_VERSIONZ dwVersionZcCredsr ZpaCredZ hRootStoreZcMappersZ aphMappersZcSupportedAlgsZpalgSupportedAlgsZgrbitEnabledProtocolsZdwMinimumCipherStrengthZdwMaximumCipherStrengthZdwSessionLifespan�dwFlagsZ dwCredFormatZAcquireCredentialsHandleWZ UNISP_NAMEZSECPKG_CRED_OUTBOUNDr �_credentials_handle)r[ Zprotocol_valuesZprotocol_bit_mask�key�valueZalgsZ alg_array�index�alg�flagsZschannel_cred_pointerZ schannel_credZcred_handle_pointer�resultrC rC rD rZ � s~ � � � � z TLSSession._obtain_credentialsc C s$ | j r t�| j �}t|� d | _ d S �N)rh r ZFreeCredentialsHandler )r[ rn rC rC rD �__del__ s zTLSSession.__del__)NFN) r@ rA rB rF rT Z_ciphersrP rU rh r^ rZ rp rC rC rC rD r= a s ZQc @ s� e Zd ZdZdZdZdZdZdZdZ dZ dZ dZ dZ dZdZdZdZdZdZdZdZdZdZdZdZdZdZe d=dd��Z d>dd�Z d d � Z d d � Z d?d d�Z!dd� Z"d@dd�Z#dd� Z$dd� Z%dd� Z&dd� Z'dAdd �Z(d d � Z)d d � Z*d!d"� Z+d#d$� Z,e-d%d&� �Z.e-d'd(� �Z/e-d)d*� �Z0e-d+d,� �Z1e-d-d.� �Z2e-d/d0� �Z3e-d1d2� �Z4e-d3d4� �Z5e-d5d6� �Z6e-d7d8� �Z7e-d9d:� �Z8d;d<� Z9dS )Br> z8 A wrapper around a socket.socket that adds TLS NFc C s� t |tj�s ttdt|����t |t�s:ttdt|����|dur^t |t�s^ttdt|����| dd|d�}||_||_ z |� � W nf t y� } z t |j |j�}|�W Y d}~n:d}~0 ty� } zt|j �}|�W Y d}~n d}~0 0 |S )az Takes an existing socket and adds TLS :param socket: A socket.socket object to wrap with TLS :param hostname: A unicode string of the hostname or IP the socket is connected to :param session: An existing TLSSession object to allow for session reuse, specific protocol or manual certificate validation :raises: ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type OSError - when an error is returned by the OS crypto library zU socket must be an instance of socket.socket, not %s zK hostname must be a unicode string, not %s N�` session must be an instance of oscrypto.tls.TLSSession, not %s )�session)rM �socket_�socketrO r r r r= �_socket� _hostname� _handshaker? r# �message� certificaterE r" )�clsrt �hostnamerr Z new_socket�eZnew_erC rC rD �wrapE s6 � �� zTLSSocket.wrap� c C s� d| _ d| _|du r$|du r$d| _n|t|t�s@ttdt|����t|t�s\ttdt|����|dur�t|t j �s�ttdt|����t � ||f|�| _| j� |� |du r�t� }n t|t�s�ttdt|����|| _| j�r�|| _z | �� W n� t�y^ | �� t|jtdg� |j|j�}|�� d| _ || _t � ||f|�| _| j� |� | �� Y n@ t�y� d| _ t � ||f|�| _| j� |� | �� Y n0 dS )a� :param address: A unicode string of the domain name or IP address to connect to :param port: An integer of the port number to connect to :param timeout: An integer timeout to use for the socket :param session: An oscrypto.tls.TLSSession object to allow for session reuse and controlling the protocols and validation performed � NzR address must be a unicode string, not %s zI port must be an integer, not %s zJ timeout must be a number, not %s rq rI )�_received_bytes�_decrypted_bytesru rM r rO r r r! �numbers�Numberrs �create_connection� settimeoutr= �_sessionrv rw r? �closerT rQ rP rU rp rE )r[ �address�port�timeoutrr Z new_sessionrC rC rD r^ � sf � �� � � zTLSSocket.__init__c C sn t td| �}td|�D ]&}d|| _tj|| _t� || _qt td�}t |�}tj |_ ||_ ||_||fS )z� Creates a SecBufferDesc struct and contained SecBuffer structs :param number: The number of contains SecBuffer objects to create :return: A tuple of (SecBufferDesc pointer, SecBuffer array) z SecBuffer[%d]r � SecBufferDesc)r r �range�cbBufferr �SECBUFFER_EMPTY� BufferTyper �pvBufferr r �SECBUFFER_VERSION� ulVersion�cBuffers�pBuffers)r[ �number�buffersrk �sec_buffer_desc_pointer�sec_buffer_descrC rC rD �_create_buffers� s zTLSSocket._create_buffersc ( C s2 d}d}�z�t �tjtjt� dt� �}t|�r6td� t� }| j j D ]B}|� � }t � |tj|t |�tjt� �}|sztd� |�|j� qDtt d�}t�| jtj|�}t|� t|�}tt d|�}ttd�} t�| � tt d| �} tt d�} tt dtj �| d< tt dtj �| d< tt dtj �| d < t t d �} t| �} d | _ tt d | �| _!t t d �}t|�}tj"|_#| |_$t t d�}t|�}||_%t&t |�}||_'tt d�}t �(t� || ||tj)tj*B t� |�}t|� tj+}t|�}t|�}t,t-|j.�}|dk�rbt|j/�}t|�}t,t-|j0�}|j1|d }t|�}t|j2�} t3| j4t,t-| j5��} t6�7| �} | j|v �rb|tj8O }t t d�} t| �} t&t | �| _'tj9| _:d| _;tt dt<| j=��| _>t t d�}!t|!�}"t&t |"�|"_'||"_?tt d| �|"_@t t d�}#t|#�}$t&t |$�|$_'t �AtjB||!|#�}t|� t|�}%t3|%j4t,t-|%j5��}t6�7|�}|$jC}&|&�r�|&tjDk�rRtE|� |&tjFk�r�tG|�}'|'jH�rxtI|� ntJ|� |&tjKk�r�tL|| j=� |&tjMk�r�tN|� |&tjOk�r�tP|� tQ|� |jRtddg�v �r�tN|� W |�r�t �S|d� |�r.t �T|� n$|�r t �S|d� |�r,t �T|� 0 dS )z� Manually invoked windows certificate chain builder and verification step when there are extra trust roots to include in the search process Nr zPCERT_CONTEXT *Z PCERT_CONTEXTz FILETIME *z char *[3]zchar *r r ZCERT_ENHKEY_USAGEr; zchar **ZCERT_USAGE_MATCHZCERT_CHAIN_PARAzPCERT_CHAIN_CONTEXT *Z SSL_EXTRA_CERT_CHAIN_POLICY_PARAz wchar_t *ZCERT_CHAIN_POLICY_PARAzvoid *ZCERT_CHAIN_POLICY_STATUS�md5Zmd2)Ur Z CertOpenStorer ZCERT_STORE_PROV_MEMORYZX509_ASN_ENCODINGr r �handle_crypt32_errorrQ r� rU �dumpZ CertAddEncodedCertificateToStorere ZCERT_STORE_ADD_USE_EXISTING�add�sha256r r �QueryContextAttributesW�_context_handle_pointerr � SECPKG_ATTR_REMOTE_CERT_CONTEXTr r r r ZGetSystemTimeAsFileTimeZPKIX_KP_SERVER_AUTHZSERVER_GATED_CRYPTOZ SGC_NETSCAPEr ZcUsageIdentifierZrgpszUsageIdentifierZUSAGE_MATCH_TYPE_ORZdwType�UsageZRequestedUsager ZcbSizeZCertGetCertificateChainZCERT_CHAIN_CACHE_END_CERTZ&CERT_CHAIN_REVOCATION_CHECK_CACHE_ONLYZ.CERT_CHAIN_POLICY_IGNORE_ALL_REV_UNKNOWN_FLAGSr �intZcChainZrgpChainZcElementZ rgpElementZ pCertContextr � pbCertEncoded� cbCertEncodedrX �loadZ'CERT_CHAIN_POLICY_ALLOW_UNKNOWN_CA_FLAGZAUTHTYPE_SERVERZ dwAuthTypeZ fdwChecksr rv ZpwszServerNamerg ZpvExtraPolicyParaZ CertVerifyCertificateChainPolicyZCERT_CHAIN_POLICY_SSLZdwErrorZCERT_E_EXPIREDr/ ZCERT_E_UNTRUSTEDROOTr9 � self_signedr6 r2 ZCERT_E_CN_NO_MATCHr1 �TRUST_E_CERT_SIGNATUREr8 ZCRYPT_E_REVOKEDr5 r7 Z hash_algo�CertCloseStoreZCertFreeCertificateChain)(r[ �storeZcert_chain_context_pointerZ cert_hashes�cert� cert_datarn � cert_context_pointer_pointer�cert_context_pointerZorig_now_pointerZ now_pointerZusage_identifiersZcert_enhkey_usage_pointerZcert_enhkey_usageZcert_usage_match_pointerZcert_usage_matchZcert_chain_para_pointerZcert_chain_paraZcert_chain_para_sizeZ"cert_chain_context_pointer_pointerZ cert_chain_policy_para_flagsZcert_chain_contextZ num_chainsZfirst_simple_chain_pointerZfirst_simple_chainZ num_elementsZlast_element_pointerZ last_elementZlast_element_certZlast_element_cert_dataZ last_certZ(ssl_extra_cert_chain_policy_para_pointerZ ssl_extra_cert_chain_policy_paraZ cert_chain_policy_para_pointerZcert_chain_policy_paraZ cert_chain_policy_status_pointerZcert_chain_policy_status� cert_context�error� oscrypto_certrC rC rD � _extra_trust_root_validation� s � � � � � � � � z&TLSSocket._extra_trust_root_validationc ! C sL d}d}d}�z�z^|r | j }nttd�}|}tjdtjdtjdtjdtjdtj dtj d i}d | _ |D ]}| j |O _ qf| � d �\}}tj |d _| � d �\} }tj |d _tj|d _ttd �} |r�|} t� } n t� } |} t�| jj| | j| j d d t� d | | | t� � } | ttjtjg�v�r*t| t� |�s6| }n| }d}d}|d jd k�r�t|d j |d j�}||7 }| j � |� d |d _t� |d j � t� |d _ t d�}t!td|�|d _ d}| tjk�rz$d}| j �"d�}|dk�r�t#� W n t$�y d}Y n0 ||7 }| j%|7 _%t&| j%�|d _t'|| j%� t�| jj|| j| j d d |d t� | | t� � } | tj(k�r�tj |d _|d jtj)k�r�tj)|d _d |d _t*|d j ��s�t� |d j � t� |d _ |�r�t#� �q�| tj+k�r$t,|��r t-� t.|�}|�r |dk�r t/� t0� | tj1k�rHt2|�}t3|d | j� | tj4k�rht2|�}t5|d � | tj6k�r�t2|�}|d }t7|�}|j8�s�t9|� t:|� | tj;k�r�t<|�dk �r�t=� | tj>k�r�t-� | t?j@k�r�tA|� | tjBk�r�|d jd k�rzt|d j |d j�}||7 }|dd� }|dk�sD|dk�rzd| jjCv �rzt&| jjC�d k�rzt2|�}tDd|d ��t,|��r�t-� tE|��r�tF|� t0� | tjGk�s�| tjHk�r�d| jjCv �r�tId ��|�r�t#� | tjJk�r�t<|�dk �r�t=� | ttjtjg�v�r t| t� |d jd k�r|t|d j |d j�}||7 }| j � |� d |d _t� |d j � t� |d _ |d jtjKk�r�|d j}| j%| d� | _%tj)|d _d |d _t� |d j � t� |d _ | tjk�r�|| d� }nd| _%�q�tLtd �}t�M|tjN|�} t| t� tO|�} tjPd tjQd tjRd tjSd!tjTdi�UtVtW| jX�tY| jX��| _Z| jZtg d"��v �r�t[||�} | d# | _\| d$ | _]| d% | _^| d& | __t`| �} |D ]&}|| B d k�r�tatbd'|| ����q�|�s\|| _ d}tLtd(�} t�M| j tjc| �} t| � tO| �} tVtW| jd�| _etVtW| jf�| _gtVtW| jh�| _i| je| jg | ji | _j| jjk�rn| �l� W n$ tatmjnf�y� | �o� � Y n0 W |�r�t*|d j ��s�t� |d j � t*|d j ��s�t� |d j � |�rHt�p|� nX|�r6t*|d j ��st� |d j � t*|d j ��s6t� |d j � |�rFt�p|� 0 dS ))z� Perform an initial TLS handshake, or a renegotiation :param renegotiate: If the handshake is for a renegotiation Nz CtxtHandle *zreplay detectionzsequence detectionZconfidentialityzmemory allocationZ integrityzstream orientationz disable automatic client authr r r �ULONG *r i � �BYTE *F� T)r �F i � r< � (� +rI zMServer certificate verification failed - weak certificate signature algorithmzTLS handshake failedZ SecPkgContext_ConnectionInfoZSSLv2rK rG rH rJ � cipher_suite� compression� session_id�session_ticketzl Unable to obtain a credential context with the property %s ZSecPkgContext_StreamSizes)qr� r r r ZISC_REQ_REPLAY_DETECTZISC_REQ_SEQUENCE_DETECTZISC_REQ_CONFIDENTIALITYZISC_REQ_ALLOCATE_MEMORYZISC_REQ_INTEGRITYZISC_REQ_STREAMZISC_REQ_USE_SUPPLIED_CREDS�_context_flagsr� �SECBUFFER_TOKENr� �SECBUFFER_ALERTr �InitializeSecurityContextWr� rh rv rQ �SEC_E_OK�SEC_I_CONTINUE_NEEDEDr r" r� r r� ru �send�FreeContextBufferr r �recvr. �socket_error_clsr� re r �SEC_E_INCOMPLETE_MESSAGEr� r ZSEC_E_ILLEGAL_MESSAGEr& r, r* r4 r0 ZSEC_E_WRONG_PRINCIPALr( r1 ZSEC_E_CERT_EXPIREDr/ ZSEC_E_UNTRUSTED_ROOTr9 r� r2 r6 ZSEC_E_INTERNAL_ERRORr) r- Z SEC_I_INCOMPLETE_CREDENTIALSr r� r8 ZSEC_E_INVALID_TOKENrT r? r' r3 ZSEC_E_BUFFER_TOO_SMALLZSEC_E_MESSAGE_ALTEREDrE ZSEC_E_INVALID_PARAMETER�SECBUFFER_EXTRAr r� ZSECPKG_ATTR_CONNECTION_INFOr ZSP_PROT_SSL2_CLIENTr_ r` ra rb �getr r� Z dwProtocolr � _protocolr+ � _cipher_suite� _compression� _session_id�_session_ticketr �OSErrorr ZSECPKG_ATTR_STREAM_SIZESZcbHeader� _header_sizeZcbMaximumMessage� _message_sizeZ cbTrailer� _trailer_size� _buffer_sizerU r� rs r� r� �DeleteSecurityContext)!r[ � renegotiateZ in_buffers� out_buffersZnew_context_handle_pointerZtemp_context_handle_pointerZrequested_flags�flagZin_sec_buffer_desc_pointer�out_sec_buffer_desc_pointer� output_context_flags_pointerZ first_handleZ second_handlern Zhandshake_server_bytesZhandshake_client_bytes�tokenZin_data_buffer� bytes_readZ fail_lateZ alert_info�chainr� r� Z alert_bytesZ alert_number� extra_amountZconnection_info_pointerZconnection_infoZ session_infoZoutput_context_flagsZstream_sizes_pointerZ stream_sizesrC rC rD rw � s� � � � � � �� � � �zTLSSocket._handshakec sX t |t�s ttdt|�����jdu rZ�jdkrR�jd|� }�j|d� �_|S ��� �js�t �j ��_�� d�\�_ �_ tj�j d _ttd�j��j d _t|�j �}t� ��j d � �j d ��j d ��j d �� �����fd d �}�j}t|�}d�_|dk�r&��d��s&d�_|S t�j�dk}||k �r,|�rp� j�j�|�7 _t�j�dk�rpt� t t�j��j �}|dk�r��q,|�j d _ t �j�jd|� � t� �j�j dt� �}d }|tj k�r�|� d }�q4nX|tj!k�rd �_"��#� �q,n8|tj$k�r*�j%d d� ��&|�S |tj'k�r@t(|t)� t*tj+tj,tj-g�} d} � ���fD ]f} | j} | tjk�r�|t.| j| j �7 }t|�}n2| tj/k�r�t0t1| j �} n| | v�rdt2td| ����qd| �r�j|| d� �_n�j|d� �_|� ��d��rd }|�s4t�j�dk�r4�q,�q4t|�|k�rT||d� �_|d|� }|S )a0 Reads data from the TLS-wrapped socket :param max_length: The number of bytes to read :raises: socket.socket - when a non-TLS socket error occurs oscrypto.errors.TLSError - when a TLS-related error occurs ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type OSError - when an error is returned by the OS crypto library :return: A byte string of the data read zG max_length must be an integer, not %s Nr r � r� r r r; c s^ t j� _ttd�j�� _d� _t j�_��_d�_t j�_��_d�_t j�_��_d�_d S )Nr� r ) r �SECBUFFER_DATAr� r r �_decrypt_data_bufferr� r� r� rC �Zbuf0Zbuf1�buf2Zbuf3Z null_valuer[ rC rD �_reset_buffers s z&TLSSocket.read.<locals>._reset_buffersFT)r� z] Unexpected decrypt output buffer of type %s )3rM r! rO r r r� r� � _raise_closedr� r r� r� � _decrypt_desc�_decrypt_buffersr r� r� r r r� �maxr re � select_readr� ru r� r. �minr� r ZDecryptMessager� ZSEC_I_CONTEXT_EXPIRED�_remote_closed�shutdownZSEC_I_RENEGOTIATErw rW r� r r" rQ r� �SECBUFFER_STREAM_HEADER�SECBUFFER_STREAM_TRAILERr r� r r� r� ) r[ � max_length�outputZto_recvr� Z output_lenZdo_read�data_lenrn Zvalid_buffer_typesr� �bufZ buffer_typerC r� rD rW � s� � � � � zTLSSocket.readc C s8 t | j�dkrdS t�| jgg g |�\}}}t |�dkS )aZ Blocks until the socket is ready to be read from, or the timeout is hit :param timeout: A float - the period of time to wait for data to be read. None for no time limit. :return: A boolean - if data is ready to be read. Will only be False if timeout is not None. r T)re r� �selectru )r[ r� Z read_ready�_rC rC rD r� � s zTLSSocket.select_readc C s� t |t�s&t |t�s&ttdt|����d}t |t�}t| j�dkrP| j}d| _n | �d�}t|�}||7 }|r�|� |�}|dur�|� � }q�q4t d|t|� d �}|� ||�}|dkr4|t|� }q�q4||d� | j | _|d|� S )a� Reads data from the socket until a marker is found. Data read may include data beyond the marker. :param marker: A byte string or regex object from re.compile(). Used to determine when to stop reading. Regex objects are more inefficient since they must scan the entire byte string of read data each time data is read off the socket. :return: A byte string of the data read z_ marker must be a byte string or compiled regex object, not %s r r r� Nr ���) rM r �PatternrO r r re r� rW �search�endr� �find) r[ �markerr� �is_regex�chunk�offset�matchr� �startrC rC rD � read_until� s2 � zTLSSocket.read_untilc C s | � t�S )z� Reads a line from the socket, including the line ending of "\r\n", "\r", or "\n" :return: A byte string of the next line from the socket )r � _line_regex�r[ rC rC rD � read_line� s zTLSSocket.read_linec C s0 d}|}|dkr,|| � |�7 }|t|� }q|S )z� Reads exactly the specified number of bytes from the socket :param num_bytes: An integer - the exact number of bytes to read :return: A byte string of the data that was read r r )rW re )r[ � num_bytesr� � remainingrC rC rD � read_exactly� s zTLSSocket.read_exactlyc C s� | j du r| �� | js�t| j| j | j �| _| �d�\| _| _ t j | j d _ | j| j d _ ttd| j�| j d _t j| j d _ t| j| j�| j d _t j| j d _ | j| j d _ t| j| j| j �| j d _t|�dk�r�tt|�| j�}t| j|d|� | j� || j d _ t| j| j| �| j d _t�| j d| jd�}|t jk�rVt|t� tt | j d j �}|tt | j d j �7 }|tt | j d j �7 }z| j � t | j|�� W n< t j!�y� } z |j"dk�r�t#� � W Y d}~n d}~0 0 ||d� }q�dS )a� Writes data to the TLS-wrapped socket :param data: A byte string to write to the socket :raises: socket.socket - when a non-TLS socket error occurs oscrypto.errors.TLSError - when a TLS-related error occurs ValueError - when any of the parameters contain an invalid value TypeError - when any of the parameters are of the wrong type OSError - when an error is returned by the OS crypto library Nr� r r� r r iE' )$r� r� �_encrypt_data_bufferr r� r� r� r� � _encrypt_desc�_encrypt_buffersr r� r� r� r r r� r� r r� re r� r ZEncryptMessager� r r" r r� ru r� r rs r� �errnor. )r[ �dataZto_writern �to_sendr| rC rC rD �write� sH � zTLSSocket.writec C s& t � g | jgg |�\}}}t|�dkS )aw Blocks until the socket is ready to be written to, or the timeout is hit :param timeout: A float - the period of time to wait for the socket to be ready to written to. None for no time limit. :return: A boolean - if the socket is ready for writing. Will only be False if timeout is not None. r )r� ru re )r[ r� r� Z write_readyrC rC rD � select_write' s zTLSSocket.select_writec C sf | j du rdS d}�z�tdkr�ttd�}d|d _tj|d _ttdt d��|d _ t td�}t |�}tj |_d |_||_t�| j |�}t|t� | �d �\}}tj|d _tj|d _ttd �}t�| jj| j | j| jddt� dt� ||t� � }t tj tj tj g�}||v�rt|t� t |d j |d j�} z| j!�"| � W n t#j$�yV Y n0 W |�r�t%|d j ��s�t�&|d j � t%|d j ��s�t�&|d j � t�'| j � d| _ z| j!�(t#j)� W n t#j$�y� Y n0 n�|�r$t%|d j ��st�&|d j � t%|d j ��s$t�&|d j � t�'| j � d| _ z| j!�(t#j)� W n t#j$�y^ Y n0 0 dS ) z� Shuts down the TLS session and then shuts down the underlying socket :raises: OSError - when an error is returned by the OS crypto library N)r� r z SecBuffer[1]r� r r� s r� r r r� )*r� �_win_version_infor r r� r r� r� r r r� r r r� r� r� r� ZApplyControlTokenr r" r� r� r� r� rh rv r� r rQ r� ZSEC_E_CONTEXT_EXPIREDr� r ru r� rs r� r r� r� r� � SHUT_RDWR) r[ r� r� r� r� rn r� r� Zacceptable_resultsr� rC rC rD r� 7 s� �� � zTLSSocket.shutdownc C st z<| � � W | jrpz| j�� W n tjy4 Y n0 d| _n2| jrnz| j�� W n tjyf Y n0 d| _0 dS )zN Shuts down the TLS session and socket and forcibly closes it N)r� ru r� rs r� r rC rC rD r� � s �zTLSSocket.closec C s� t td�}t�| jtj|�}t|t� t |�}t td|�}t |�}t |j t t|j��}t�|�| _g | _d}zt|j}t�|t� �}t|�s�t |�}t |j t t|j��} | |kr�| j�t�| �� t�||�}q�W |r�t�|d� n|r�t�|d� 0 dS )zh Reads end-entity and intermediate certificate information from the TLS session zCERT_CONTEXT **zCERT_CONTEXT *Nr )r r r r� r� r r� r r" r r r r� r r� r� rX r� � _certificate�_intermediatesZ hCertStoreZCertEnumCertificatesInStorer r rY r� ) r[ r� rn r� r� r� Z store_handleZcontext_pointer�contextr rC rC rD �_read_certificates� s6 � �z TLSSocket._read_certificatesc C s | j rtd��ntd��dS )zi Raises an exception describing if the local or remote end closed the connection z$The remote end closed the connectionz!The connection was already closedN)r� r% r$ r rC rC rD r� � s zTLSSocket._raise_closedc C s* | j du r| �� | jdu r$| �� | jS )zu An asn1crypto.x509.Certificate object of the end-entity certificate presented by the server N)r� r� r r r rC rC rD ry � s zTLSSocket.certificatec C s* | j du r| �� | jdu r$| �� | jS )zz A list of asn1crypto.x509.Certificate objects that were presented as intermediates by the server N)r� r� r r r r rC rC rD � intermediates� s zTLSSocket.intermediatesc C s | j S )zg A unicode string of the IANA cipher suite name of the negotiated cipher suite )r� r rC rC rD r� � s zTLSSocket.cipher_suitec C s | j S )zM A unicode string of: "TLSv1.2", "TLSv1.1", "TLSv1", "SSLv3" )r� r rC rC rD r\ � s zTLSSocket.protocolc C s | j S )z5 A boolean if compression is enabled )r� r rC rC rD r� � s zTLSSocket.compressionc C s | j S �zM A unicode string of "new" or "reused" or None for no ticket )r� r rC rC rD r� s zTLSSocket.session_idc C s | j S r )r� r rC rC rD r� s zTLSSocket.session_ticketc C s | j S )zM The oscrypto.tls.TLSSession object used for this connection )r� r rC rC rD rr s zTLSSocket.sessionc C s | j S )zN A unicode string of the TLS server domain name or IP address )rv r rC rC rD r{ s zTLSSocket.hostnamec C s | j �� d S )zJ An integer of the port number the socket is connected to r )rt � getpeernamer rC rC rD r� % s zTLSSocket.portc C s | j du r| �� | jS )z9 The underlying socket.socket connection N)r� r� ru r rC rC rD rt - s zTLSSocket.socketc C s | � � d S ro )r� r rC rC rD rp 8 s zTLSSocket.__del__)N)r~ N)F)N)N):r@ rA rB rF ru r� r� r� rv r� r� r� r� r� r r r r� r� r� r r r� r� r� r� r� r� � classmethodr} r^ r� r� rw rW r� r r r r r r� r� r r� �propertyry r r� r\ r� r� r� rr r{ r� rt rp rC rC rC rD r> s� > W 3 0 + 7 > T( )^� __future__r r r r �sys�rert rs r� r� Z_asn1r rX �_errorsr Z_ffir r r r r r r r r r r r r r Z_secur32r r r Z_crypt32r r r� Z _kernel32r �_typesr r r r! �errorsr" r# r$ r% �_tlsr& r' r( r) r* r+ r, r- r. r/ r0 r1 r2 r3 r4 r5 r6 r7 r8 Z asymmetricr9 �keysr: � version_info�xranger� r� r� Z WindowsErrorZ _pattern_typer� �__all__�compiler �getwindowsversionZ_gwvr r? rE �objectr= r> rC rC rC rD �<module> sD @ T � ?