
    Bwg                        d dl mZmZmZmZ d dlZd dlZd dlZd dl	Z	d dl
Z
ddlmZ ddlmZ ddlmZmZmZmZmZmZmZmZmZmZmZmZmZmZ ddlm Z m!Z!m"Z" dd	l#m$Z$m%Z%m"Z& dd
l'm(Z( ddl)m*Z*m+Z+m,Z,m-Z- ddl.m/Z/m0Z0m1Z1m2Z2 ddl3m4Z4m5Z5m6Z6m7Z7m8Z8m9Z9m:Z:m;Z;m<Z<m=Z=m>Z>m?Z?m@Z@mAZAmBZBmCZCmDZDmEZEmFZF ddlGmHZHmZ ddlImJZJ ej                  dk  reLZMej                  ZOnePZOej                  dk  rej                  ZRnej                  ZRddgZS ej                  d      ZU ej                         ZWeWd    eWd   fZX G d de0      ZY G d de/      ZZ G d de[      Z\ G d de[      Z]y)    )unicode_literalsdivisionabsolute_importprint_functionN   )Certificate)pretty_message)buffer_from_bytesbuffer_from_unicodebytes_from_buffercastderefis_nullnativenewnullrefsizeofstructunwrapwrite_to_buffer   )secur32Secur32Consthandle_error)crypt32Crypt32Constr   )kernel32)	type_namestr_clsbyte_cls	int_types)TLSErrorTLSVerificationErrorTLSDisconnectErrorTLSGracefulDisconnectError)detect_client_auth_requestdetect_other_protocolextract_chainget_dh_params_lengthparse_alertparse_session_inforaise_client_authraise_dh_paramsraise_disconnectionraise_expired_not_yet_validraise_handshakeraise_hostnameraise_no_issuerraise_protocol_errorraise_protocol_versionraise_revokedraise_self_signedraise_verificationraise_weak_signature)load_certificater   )parse_certificate)   )r<      
TLSSession	TLSSockets   (
||
)c                       e Zd Zy)_TLSDowngradeErrorN)__name__
__module____qualname__     H/var/www/horilla/myenv/lib/python3.12/site-packages/oscrypto/_win/tls.pyrA   rA   Q   s    rF   rA   c                       e Zd ZdZy)_TLSRetryErrorz
    TLSv1.2 on Windows 7 and 8 seems to have isuses with some DHE_RSA
    ServerKeyExchange messages due to variable length integer encoding. This
    exception is used to trigger a reconnection to attempt the handshake again.
    N)rB   rC   rD   __doc__rE   rF   rG   rI   rI   V   s     	rF   rI   c                   8    e Zd ZdZdZdZdZdZdZddZ	d Z
d Zy)r>   zj
    A TLS session object that multiple TLSSocket objects can share for the
    sake of session reuse
    Nc           	      j   t        |t              st        t        dt	        |                  || _        |t        g d      }t        |t              rt        |g      }n.t        |t              st        t        dt	        |                  |t        g d      z
  }|rt        t        dt        |                  || _
        g | _        |r|D ]  }t        |t              r|j                  }nt        |t              rt        |      }nmt        |t              r/t!        |d      5 }t        |j#                               }ddd       n.t        |t$              st        t        dt	        |                  | j                  j'                  |        | j)                          y# 1 sw Y   7xY w)	a]  
        :param protocol:
            A unicode string or set of unicode strings representing allowable
            protocols to negotiate with the server:

             - "TLSv1.2"
             - "TLSv1.1"
             - "TLSv1"
             - "SSLv3"

            Default is: {"TLSv1", "TLSv1.1", "TLSv1.2"}

        :param manual_validation:
            If certificate and certificate path validation should be skipped
            and left to the developer to implement

        :param extra_trust_roots:
            A list containing one or more certificates to be treated as trust
            roots, in one of the following formats:
             - A byte string of the DER encoded certificate
             - A unicode string of the certificate filename
             - An asn1crypto.x509.Certificate object
             - An oscrypto.asymmetric.Certificate object

        :raises:
            ValueError - when any of the parameters contain an invalid value
            TypeError - when any of the parameters are of the wrong type
            OSError - when an error is returned by the OS crypto library
        zM
                manual_validation must be a boolean, not %s
                N)TLSv1TLSv1.1TLSv1.2zu
                protocol must be a unicode string or set of unicode strings,
                not %s
                SSLv3rM   rN   rO   z
                protocol must contain only the unicode strings "SSLv3", "TLSv1",
                "TLSv1.1", "TLSv1.2", not %s
                rbz
                        extra_trust_roots must be a list of byte strings, unicode
                        strings, asn1crypto.x509.Certificate objects or
                        oscrypto.asymmetric.Certificate objects, not %s
                        )
isinstancebool	TypeErrorr	   r   _manual_validationsetr    
ValueErrorrepr
_protocols_extra_trust_rootsr   asn1r!   r;   openreadAsn1Certificateappend_obtain_credentials)selfprotocolmanual_validationextra_trust_rootsunsupported_protocolsextra_trust_rootfs          rG   __init__zTLSSession.__init__m   s   > +T2N +,	   #4:;Hh(H:HHc*N (#   !)3/W+X X ^ *+   #"$$5 A .<'7'<'<$ 0(;'89I'J$ 0':.5 G+<QVVX+F(G G#$4oF#N
 ""23%   ''../?@#A& 	  "G Gs   *F))F2	c                 ,   t         j                  t         j                  t         j                  t         j                  d}d}|j                         D ]  \  }}|| j                  v s||z  } t         j                  t         j                  t         j                  t         j                  t         j                  t         j                  t         j                  t         j                  t         j                  t         j                   g
}d| j                  v r>|j#                  t         j$                  t         j&                  t         j(                  g       t+        t,        dt/        |      z        }t1        |      D ]
  \  }}|||<    t         j2                  t         j4                  z  }	| j6                  s | j8                  s|	t         j:                  z  }	n|	t         j<                  z  }	t?        t,        d      }
tA        |
      }t         jB                  |_"        d|_#        tI               |_%        tI               |_&        d|_'        tI               |_(        t/        |      |_)        ||_*        ||_+        d|_,        d|_-        d|_.        |	|_/        d|_0        t+        t,        d      }t-        jb                  tI               t         jd                  t         jf                  tI               |
tI               tI               |tI               	      }ti        |       || _5        y)zU
        Obtains a credentials handle from secur32.dll for use with SChannel
        rP   r   rO   z
ALG_ID[%s]SCHANNEL_CREDzCredHandle *N)6r   SP_PROT_SSL3_CLIENTSP_PROT_TLS1_CLIENTSP_PROT_TLS1_1_CLIENTSP_PROT_TLS1_2_CLIENTitemsrZ   CALG_AES_128CALG_AES_256	CALG_3DES	CALG_SHA1
CALG_ECDHECALG_DH_EPHEMCALG_RSA_KEYXCALG_RSA_SIGN
CALG_ECDSACALG_DSS_SIGNextendCALG_SHA512CALG_SHA384CALG_SHA256r   r   len	enumerateSCH_USE_STRONG_CRYPTOSCH_CRED_NO_DEFAULT_CREDSrV   r[   SCH_CRED_AUTO_CRED_VALIDATIONSCH_CRED_MANUAL_CRED_VALIDATIONr   r   SCHANNEL_CRED_VERSION	dwVersioncCredsr   paCred
hRootStorecMappers
aphMapperscSupportedAlgspalgSupportedAlgsgrbitEnabledProtocolsdwMinimumCipherStrengthdwMaximumCipherStrengthdwSessionLifespandwFlagsdwCredFormatAcquireCredentialsHandleW
UNISP_NAMESECPKG_CRED_OUTBOUNDr   _credentials_handle)rb   protocol_valuesprotocol_bit_maskkeyvaluealgs	alg_arrayindexalgflagsschannel_cred_pointerschannel_credcred_handle_pointerresults                 rG   ra   zTLSSession._obtain_credentials   s    "55!55#99#99	
 )//1 	+JCdoo%!U*!	+
 %%%%""""##&&&&&&##&&
 'KK((((((  D	!9:	#D/ 	#JE3"Ie	# 22\5[5[[&&t/F/F\???E\AAAE &w @45"."D"D #v#'6 !"#'6 '*9~$*3'.?+01-01-*+' %%&"!'>:22F##--F!FFF

 	V#6 rF   c                     | j                   r2t        j                  | j                         }t        |       d | _         y y N)r   r   FreeCredentialsHandler   )rb   r   s     rG   __del__zTLSSession.__del__  s6    ##2243K3KLF '+D$ $rF   )NFN)rB   rC   rD   rJ   rZ   _ciphersrV   r[   r   ri   ra   r   rE   rF   rG   r>   r>   a   s8    
 JHX#tO7b,rF   c                      e Zd ZdZdZdZdZdZdZdZ	dZ
dZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZed d       Zd!dZd Zd Z d"dZ!d	 Z"d d
Z#d Z$d Z%d Z&d Z'd dZ(d Z)d Z*d Z+d Z,e-d        Z.e-d        Z/e-d        Z0e-d        Z1e-d        Z2e-d        Z3e-d        Z4e-d        Z5e-d        Z6e-d        Z7e-d        Z8d Z9y)#r?   z8
    A wrapper around a socket.socket that adds TLS
    NFc                 2   t        |t        j                        st        t	        dt        |                  t        |t              st        t	        dt        |                  |.t        |t              st        t	        dt        |                   | dd|      }||_        ||_	        	 |j                          |S # t        $ r'}t        |j                  |j                        }|d}~wt        $ r}t!        |j                        }|d}~ww xY w)az  
        Takes an existing socket and adds TLS

        :param socket:
            A socket.socket object to wrap with TLS

        :param hostname:
            A unicode string of the hostname or IP the socket is connected to

        :param session:
            An existing TLSSession object to allow for session reuse, specific
            protocol or manual certificate validation

        :raises:
            ValueError - when any of the parameters contain an invalid value
            TypeError - when any of the parameters are of the wrong type
            OSError - when an error is returned by the OS crypto library
        zU
                socket must be an instance of socket.socket, not %s
                zK
                hostname must be a unicode string, not %s
                N`
                session must be an instance of oscrypto.tls.TLSSession, not %s
                )session)rS   socket_socketrU   r	   r   r    r>   _socket	_hostname
_handshakerA   r$   messagecertificaterI   r#   )clsr   hostnamer   
new_socketenew_es          rG   wrapzTLSSocket.wrapE  s   * &'..1N &!	   (G,N (#	   z':'FN '"	   tW5
#
'

	!!#  # 	(AMMBEK 	QYY'EK	s$   1C 	D"C..D:DDc                    d| _         d| _        |
|d| _        nt        |t              st        t        dt        |                  t        |t              st        t        dt        |                  |8t        |t        j                        st        t        dt        |                  t        j                  ||f|      | _        | j                  j                  |       |t               }n.t        |t              st        t        dt        |                  || _        | j                  r|| _        	 | j#                          yy# t$        $ r | j'                          t        |j(                  t+        dg      z
  |j,                  |j.                        }|j1                          d| _         || _        t        j                  ||f|      | _        | j                  j                  |       | j#                          Y yt2        $ rR d| _         t        j                  ||f|      | _        | j                  j                  |       | j#                          Y yw xY w)a  
        :param address:
            A unicode string of the domain name or IP address to connect to

        :param port:
            An integer of the port number to connect to

        :param timeout:
            An integer timeout to use for the socket

        :param session:
            An oscrypto.tls.TLSSession object to allow for session reuse and
            controlling the protocols and validation performed
        rF   NzR
                    address must be a unicode string, not %s
                    zI
                    port must be an integer, not %s
                    zJ
                    timeout must be a number, not %s
                    r   rO   )_received_bytes_decrypted_bytesr   rS   r    rU   r	   r   r"   numbersNumberr   create_connection
settimeoutr>   _sessionr   r   rA   closerZ   rW   rV   r[   r   rI   )rb   addressporttimeoutr   new_sessions         rG   ri   zTLSSocket.__init__  s'      # #?t|DL gw/ g&	!   dI. dO	!   ":gw~~+N g&	!   #44gt_gNDLLL##G,? lGGZ0N '"	    <<$DN"!	 
 ' "

(&&i[)99....
 !'*$ +&88'4'R''0!" "'*$&88'4'R''0!	"s   ?E B7I$
AI$#I$c                 6   t        t        d|z        }t        d|      D ]6  }d||   _        t        j
                  ||   _        t               ||   _        8 t        t        d      }t        |      }t        j                  |_        ||_        ||_        ||fS )z
        Creates a SecBufferDesc struct and contained SecBuffer structs

        :param number:
            The number of contains SecBuffer objects to create

        :return:
            A tuple of (SecBufferDesc pointer, SecBuffer array)
        zSecBuffer[%d]r   SecBufferDesc)r   r   rangecbBufferr   SECBUFFER_EMPTY
BufferTyper   pvBufferr   r   SECBUFFER_VERSION	ulVersioncBufferspBuffers)rb   numberbuffersr   sec_buffer_desc_pointersec_buffer_descs         rG   _create_bufferszTLSSocket._create_buffers  s     g781f% 	-E&'GEN#(4(D(DGEN%&*fGEN#	-
 #)/"B !89$0$B$B!#) #* '11rF   c           
      $   d}d}	 t        j                  t        j                  t        j                  t               dt                     }t        |      rt        d       t               }| j                  j                  D ]  }|j                         }t        j                  |t        j                  |t        |      t        j                  t                     }|st        d       |j                  |j                           t#        t         d      }t%        j&                  | j(                  t*        j,                  |      }t/        |       t1        |      }t3        t         d|      }t#        t4        d      }	t5        j6                  |	       t3        t         d|	      }
t#        t         d      }t3        t         dt        j8                        |d<   t3        t         dt        j:                        |d<   t3        t         dt        j<                        |d	<   t?        t         d
      }t1        |      }d|_         t3        t         d|      |_!        t?        t         d      }t1        |      }t        jD                  |_#        ||_$        t?        t         d      }t1        |      }||_%        tM        t         |      }||_'        t#        t         d      }t        jP                  t               ||
||t        jR                  t        jT                  z  t               |      }t        |       t        jV                  }t1        |      }t1        |      }tY        tZ        |j\                        }|dk(  rt1        |j^                        }t1        |      }tY        tZ        |j`                        }|jb                  |dz
     }t1        |      }t1        |jd                        }tg        |jh                  tY        tZ        |jj                              }tm        jn                  |      }|j                   |v r|t        jp                  z  }t?        t         d      }t1        |      } tM        t         |       | _'        t        jr                  | _:        d| _;        t3        t         dty        | jz                              | _>        t?        t         d      }!t1        |!      }"tM        t         |"      |"_'        ||"_?        t3        t         d|      |"_@        t?        t         d      }#t1        |#      }$tM        t         |$      |$_'        t        j                  t        j                  ||!|#      }t        |       t1        |      }%tg        |%jh                  tY        tZ        |%jj                              }tm        jn                  |      }|$j                  }&|&r|&t        j                  k(  rt        |       |&t        j                  k(  r.t        |      }'|'j                  rt        |       nt        |       |&t        j                  k(  rt        || jz                         |&t        j                  k(  rt        |       |&t        j                  k(  rt        |       t        |       |j                  t        ddg      v rt        |       |rt        j                  |d       |rt        j                  |       yy# |rt        j                  |d       |rt        j                  |       w w xY w)z
        Manually invoked windows certificate chain builder and verification
        step when there are extra trust roots to include in the search process
        Nr   zPCERT_CONTEXT *PCERT_CONTEXTz
FILETIME *z	char *[3]zchar *r   r   CERT_ENHKEY_USAGEr<   zchar **CERT_USAGE_MATCHCERT_CHAIN_PARAzPCERT_CHAIN_CONTEXT * SSL_EXTRA_CERT_CHAIN_POLICY_PARAz	wchar_t *CERT_CHAIN_POLICY_PARAzvoid *CERT_CHAIN_POLICY_STATUSmd5md2)Ur   CertOpenStorer   CERT_STORE_PROV_MEMORYX509_ASN_ENCODINGr   r   handle_crypt32_errorrW   r   r[   dump CertAddEncodedCertificateToStorer   CERT_STORE_ADD_USE_EXISTINGaddsha256r   r   QueryContextAttributesW_context_handle_pointerr   SECPKG_ATTR_REMOTE_CERT_CONTEXTr   r   r   r   GetSystemTimeAsFileTimePKIX_KP_SERVER_AUTHSERVER_GATED_CRYPTOSGC_NETSCAPEr   cUsageIdentifierrgpszUsageIdentifierUSAGE_MATCH_TYPE_ORdwTypeUsageRequestedUsager   cbSizeCertGetCertificateChainCERT_CHAIN_CACHE_END_CERT&CERT_CHAIN_REVOCATION_CHECK_CACHE_ONLY.CERT_CHAIN_POLICY_IGNORE_ALL_REV_UNKNOWN_FLAGSr   intcChainrgpChaincElement
rgpElementpCertContextr   pbCertEncodedcbCertEncodedr_   load'CERT_CHAIN_POLICY_ALLOW_UNKNOWN_CA_FLAGAUTHTYPE_SERVER
dwAuthType	fdwChecksr   r   pwszServerNamer   pvExtraPolicyPara CertVerifyCertificateChainPolicyCERT_CHAIN_POLICY_SSLdwErrorCERT_E_EXPIREDr0   CERT_E_UNTRUSTEDROOTr:   self_signedr7   r3   CERT_E_CN_NO_MATCHr2   TRUST_E_CERT_SIGNATUREr9   CRYPT_E_REVOKEDr6   r8   	hash_algoCertCloseStoreCertFreeCertificateChain)(rb   storecert_chain_context_pointercert_hashescert	cert_datar   cert_context_pointer_pointercert_context_pointerorig_now_pointernow_pointerusage_identifierscert_enhkey_usage_pointercert_enhkey_usagecert_usage_match_pointercert_usage_matchcert_chain_para_pointercert_chain_paracert_chain_para_size"cert_chain_context_pointer_pointercert_chain_policy_para_flagscert_chain_context
num_chainsfirst_simple_chain_pointerfirst_simple_chainnum_elementslast_element_pointerlast_elementlast_element_certlast_element_cert_data	last_cert(ssl_extra_cert_chain_policy_para_pointer ssl_extra_cert_chain_policy_paracert_chain_policy_para_pointercert_chain_policy_para cert_chain_policy_status_pointercert_chain_policy_statuscert_contexterroroscrypto_certs(                                           rG   _extra_trust_root_validationz&TLSSocket._extra_trust_root_validation  s    %)"g	M ))33..E u~$Q'%K88 - IIK	 AA 22	N <<F (+,- ,/w8I+J(44,,<<,F
  #)*F#G #'BV#W   #8\:,,-=>w6FGK #G[ 9#'<;[;[#\a #'<;[;[#\a #'<;T;T#Ua (.w8K(L% &'@ A12.59'9N_5`2'-g7I'J$%&>?&2&F&F#%6"&,W6G&H#$%<=O-=O*#)'?#C %9O"14W>U1V.44$'669l9ll2	F !(+7+f+f()/0R)S&
 "((B!C%7%>%>?JQ-34F4O4O-P*%+,F%G"%c+=+F+FG'9'D'D\TUEU'V$%&:;$*<+D+D$E!):%333 1 ? ?@*& ,001GH	##{20L4h4hh07=gGi7j4/56^/_,6<WFf6g,3:F:V:V,79:,6>B#DNN3?,; .4G=U-V*%+,J%K",27<R,S")-I"*7;GXOw7x"4/5g?Y/Z,'-.N'O$.4W>V.W$+==22*.0	F !(!"67L),*D*DfSR^RlRlFmnI"''	2D,44EL777/5L===$4T$:M$00)$/'-L;;;"48L???(.L888!$'"4(~~eU^!44$T* &&ua0)001KL * &&ua0)001KL *s   Z&[ 2\c                 B   d}d}d}	 |r| j                   }nt        t        d      }|}t        j                  dt        j
                  dt        j                  dt        j                  dt        j                  dt        j                  dt        j                  d	i}d
| _        |D ]  }| xj                  |z  c_         | j                  d      \  }}t        j                  |d
   _        | j                  d      \  }	}t        j                  |d
   _        t        j                  |d   _        t        t        d      }
|r|}t!               }nt!               }|}t        j"                  | j$                  j&                  || j(                  | j                  d
d
t!               d
||	|
t!                     }|t+        t        j,                  t        j.                  g      vrt1        |t2               |s|}n|}d}d}|d
   j4                  d
kD  rt7        |d
   j8                  |d
   j4                        }||z  }| j:                  j=                  |       d
|d
   _        t        j>                  |d
   j8                         t!               |d
   _        tA        d      }tC        t        d|      |d
   _        d}|t        j,                  k7  r		 d}| j:                  jE                  d      }|dk(  r
tG                ||z  }| xjJ                  |z  c_%        tM        | jJ                        |d
   _        tO        || jJ                         t        j"                  | j$                  j&                  || j(                  | j                  d
d
|d
t!               |	|
t!                     }|t        jP                  k(  rt        j                  |d
   _        |d   j                  t        jR                  k7  rnt        jR                  |d   _        d
|d   _        tU        |d   j8                        s4t        j>                  |d   j8                         t!               |d   _        |r
tG                |t        jV                  k(  r;tY        |      r
t[                t]        |      }|r|dk(  r
t_                ta                |t        jb                  k(  r$te        |      }tg        |d
   | j(                         |t        jh                  k(  rte        |      }tk        |d
          |t        jl                  k(  r=te        |      }|d
   }to        |      }|jp                  sts        |       tu        |       |t        jv                  k(  rty        |      dk  r
t{                |t        j|                  k(  r
t[                |t~        j                  k(  rt               |t        j                  k(  r|d   j4                  d
kD  rt7        |d   j8                  |d   j4                        }||z  }|dd }|dk(  s|dk(  rTd| j$                  j                  v r<tM        | j$                  j                        dkD  rte        |      }t        d|d
         tY        |      r
t[                t        |      rt        |       ta                |t        j                  k(  s|t        j                  k(  r#d| j$                  j                  v rt        d      |r
tG                |t        j                  k(  rty        |      dk  r
t{                |t+        t        j,                  t        j.                  g      vrt1        |t2               |d
   j4                  d
kD  rt7        |d
   j8                  |d
   j4                        }||z  }| j:                  j=                  |       d
|d
   _        t        j>                  |d
   j8                         t!               |d
   _        |d   j                  t        j                  k(  r|d   j4                  }| jJ                  | d | _%        t        jR                  |d   _        d
|d   _        t        j>                  |d   j8                         t!               |d   _        |t        j,                  k(  r|| d }nd| _%        |t        j,                  k7  r	t        t        d      }t        j                  |t        j                  |      }t1        |t2               t        |      }t        j                  dt        j                  dt        j                  d t        j                  d!t        j                  dij                  t        t        |j                        t        |j                              | _Z        | j                  t+        g d"      v r4t        ||      }|d#   | _\        |d$   | _]        |d%   | _^        |d&   | __        t        |
      }|D ]"  }||z  d
k(  st        t        d'||                |s|| _         d}t        t        d(      }t        j                  | j                   t        j                  |      }t1        |       t        |      } t        t        | j                        | _e        t        t        | j                        | _g        t        t        | j                        | _i        | j                  | j                  z   | j                  z   | _j        | j$                  j                  r| j                          |rttU        |d
   j8                        s"t        j>                  |d
   j8                         tU        |d   j8                        s"t        j>                  |d   j8                         |rt        j                  |       yy# tH        $ r d}Y w xY w# t        t        j                  f$ r | j                           w xY w# |rttU        |d
   j8                        s"t        j>                  |d
   j8                         tU        |d   j8                        s"t        j>                  |d   j8                         |rt        j                  |       w w xY w))z
        Perform an initial TLS handshake, or a renegotiation

        :param renegotiate:
            If the handshake is for a renegotiation
        NzCtxtHandle *zreplay detectionzsequence detectionconfidentialityzmemory allocation	integrityzstream orientationzdisable automatic client authr   r   r   ULONG *rF   i   BYTE *F    T)r   F   i      r=      (   +rO   zMServer certificate verification failed - weak certificate signature algorithmzTLS handshake failedSecPkgContext_ConnectionInfoSSLv2rQ   rM   rN   rP   cipher_suitecompression
session_idsession_ticketzl
                        Unable to obtain a credential context with the property %s
                        SecPkgContext_StreamSizes)qr   r   r   r   ISC_REQ_REPLAY_DETECTISC_REQ_SEQUENCE_DETECTISC_REQ_CONFIDENTIALITYISC_REQ_ALLOCATE_MEMORYISC_REQ_INTEGRITYISC_REQ_STREAMISC_REQ_USE_SUPPLIED_CREDS_context_flagsr   SECBUFFER_TOKENr   SECBUFFER_ALERTr   InitializeSecurityContextWr   r   r   rW   SEC_E_OKSEC_I_CONTINUE_NEEDEDr   r#   r   r   r   r   sendFreeContextBufferr
   r   recvr/   socket_error_clsr   r   r   SEC_E_INCOMPLETE_MESSAGEr   r   SEC_E_ILLEGAL_MESSAGEr'   r-   r+   r5   r1   SEC_E_WRONG_PRINCIPALr)   r2   SEC_E_CERT_EXPIREDr0   SEC_E_UNTRUSTED_ROOTr:   r  r3   r7   SEC_E_INTERNAL_ERRORr*   r.   SEC_I_INCOMPLETE_CREDENTIALSr   r  r9   SEC_E_INVALID_TOKENrZ   rA   r(   r4   SEC_E_BUFFER_TOO_SMALLSEC_E_MESSAGE_ALTEREDrI   SEC_E_INVALID_PARAMETERSECBUFFER_EXTRAr   r   SECPKG_ATTR_CONNECTION_INFOr   SP_PROT_SSL2_CLIENTrl   rm   rn   ro   getr   r   
dwProtocolr    	_protocolr,   _cipher_suite_compression_session_id_session_ticketr   OSErrorr	   SECPKG_ATTR_STREAM_SIZEScbHeader_header_sizecbMaximumMessage_message_size	cbTrailer_trailer_size_buffer_sizer[   r>  r   r<  r   DeleteSecurityContext)!rb   renegotiate
in_buffersout_buffersnew_context_handle_pointertemp_context_handle_pointerrequested_flagsflagin_sec_buffer_desc_pointerout_sec_buffer_desc_pointeroutput_context_flags_pointerfirst_handlesecond_handler   handshake_server_byteshandshake_client_bytestokenin_data_buffer
bytes_read	fail_late
alert_infochainr  r=  alert_bytesalert_numberextra_amountconnection_info_pointerconnection_infosession_infooutput_context_flagsstream_sizes_pointerstream_sizess!                                    rG   r   zTLSSocket._handshake  s    
%)"`	J.2.J.J+-0.-I*.H+ 224F446J446G446I..++-A779XO #$D' ,##t+#, 6:5I5I!5L2&
'3'C'CJqM$7;7K7KA7N4'(4(D(DKN%(4(D(DKN%+.w	+B(: $#v ;7711##+,F S,"7"79[9[!\]]VX..;+.:+%("%("1~&&*)+a.*A*A;q>CZCZ[&%/&!!%(*+A'))+a.*A*AB*.&A'.u5N%)'8^%LJqM"JL111% %I!%!2!24!8J!S(+- '*4&$$
2$),T-A-A)B
1&0D0DE ;;MM55/NN''.F/0F \BBB/;/K/KJqM, "!}//<3O3OO3?3O3O
1012
1.&z!}'='=>#55jm6L6LM59VJqM2 +-\???12HI)+!,-C!DJ!jG&;.0#%\???)*@AE"58T^^<\<<<)*@AE/a9\>>>)*@AE 8D$4T$:M(44'-%d+\>>>+,BCdJ')\FFF%'\@@@(.\=== #1~..2&7A8O8OQ\]^Q_QhQh&i.+=.'21Q'7'72lg6M(DMM,D,DDT]]MeMeIfijIj(56L(M&8$s$)!H'" !" 22HI)+,-CD,-CD#% \@@@FlNpNpDp DMM$<$<<,-CDD')\AAA+,BCdJ')l&;&;\=_=_%`!aa 2q>**Q.-k!n.E.E{ST~G^G^_E*e3*LL%%e,./KN+--k!n.E.EF.2fKN+a=++|/K/KK#-a=#9#9L+/+?+?+OD(/;/K/KJqM,-.JqM*--jm.D.DE-1VJqM* !6!661G1W. ,/D(_ L111b '-W6T&U#44+88'F
 *$%<=O 00'00'00'22I22I c&o8897?C]C];^_ N ~~%M!NN12HJ`a%1.%A"$0$?!#/#= '34D'E$#()E#F ' //A5!. (-	#   /J,-1*'-g7R'S$ 8800 99(
 V$%&:;$*30E0E$F!%+C1N1N%O"%+C1G1G%H"$($5$58J8J$JTM_M_$_!}}//113 {1~667--k!n.E.EF{1~667--k!n.E.EF)--.HI *_ ) % $I%H ' 	JJL	 {1~667--k!n.E.EF{1~667--k!n.E.EF)--.HI *sL   J?o  ,o 4Wo  Eo  D'o  oo  oo   +pp Brc                 	    t        |t              st        t        dt	        |                   j
                  D j                  dk7  r% j                  d| } j                  |d  _        |S  j                           j                  st         j                         _         j                  d      \   _         _        t        j                   j                  d   _        t#        t$        d j                         j                  d   _        t)        | j                        }t+                j                  d    j                  d    j                  d    j                  d	    fd
} j                  }t-        |      }d _        |dkD  r j/                  d      s	d _        |S t-         j0                        dk(  }||k  r|rP xj0                   j2                  j5                  |      z  c_        t-         j0                        dk(  r
t7                t9        t-         j0                         j                        }|dk(  rnT| j                  d   _        t=         j                   j0                  d|        t%        j>                   j
                   j                  dt+                     }d}|t        j@                  k(  r |        d}|t        jB                  k(  rd _"         jG                          n|t        jH                  k(  r# jK                  d        jM                  |      S |t        jN                  k7  rtQ        |tR               tU        t        jV                  t        jX                  t        jZ                  g      }	d}
fD ]  }|j                   }|t        j                  k(  r/|t]        |j&                  |j:                        z  }t-        |      }Q|t        j^                  k(  rta        tb        |j:                        }
||	vste        t        d|             |
r j0                  ||
z
  d  _        n j0                  |d  _         |         j/                  d      rd}|st-         j0                        dk(  rn||k  rt-        |      |kD  r||d  _        |d| }|S )a0  
        Reads data from the TLS-wrapped socket

        :param max_length:
            The number of bytes to read

        :raises:
            socket.socket - when a non-TLS socket error occurs
            oscrypto.errors.TLSError - when a TLS-related error occurs
            ValueError - when any of the parameters contain an invalid value
            TypeError - when any of the parameters are of the wrong type
            OSError - when an error is returned by the OS crypto library

        :return:
            A byte string of the data read
        zG
                max_length must be an integer, not %s
                NrF   r      rC  r   r   r<   c                  P   t         j                   _        t        t        dj
                         _        d _        t         j                  _        _        d_        t         j                  _        _        d_        t         j                  _        _        d_        y )NrC  r   )	r   SECBUFFER_DATAr   r   r   _decrypt_data_bufferr   r   r   )buf0buf1buf2buf3
null_valuerb   s   rG   _reset_buffersz&TLSSocket.read.<locals>._reset_buffers  s~    *99DO (D4M4MNDMDM*::DO&DMDM*::DO&DMDM*::DO&DMDMrF   FT)r  z]
                        Unexpected decrypt output buffer of type %s
                        )3rS   r"   rU   r	   r   r   r   _raise_closedr  r
   r~  r   _decrypt_desc_decrypt_buffersr   r  r   r   r   r   maxr   r   select_readr   r   r_  r/   minr   r   DecryptMessagera  SEC_I_CONTEXT_EXPIRED_remote_closedshutdownSEC_I_RENEGOTIATEr   r^   r[  r   r#   rW   r   SECBUFFER_STREAM_HEADERSECBUFFER_STREAM_TRAILERr   rl  r   r   rv  )rb   
max_lengthoutputto_recvr  
output_lendo_readdata_lenr   valid_buffer_typesr  bufbuffer_typer  r  r  r  r  s   `            @@@@@rG   r^   zTLSSocket.read  ss   $ *i0N *%	   ''/ $$+..q<(,(=(=jk(J%  (((9$:K:K(LD%8<8L8LQ8O5D 52>2M2MD!!!$/04WhHaHa0bD!!!$-j$"3"34 V
$$Q'$$Q'$$Q'$$Q'	 	" &&[
 # >$"2"21"5$'D!M d**+q0:%$$(9(9'(BB$t++,1')3t334d6G6GHH1}08D!!!$-D55t7K7KAh7WX++,,""	F G>>> <===&*#<999D1yy,,<000VX.!$,,4455& "
  LdD$/ !nn,"="==/cllKKF!$VJ L$@$@@#)#s||#<L (::!. $	#   '+';';H|<S<T'U$'+';';HI'F$  "s4#7#78A=S :%Z v;#$*:;$7D!Aj)FrF   c                     t        | j                        dkD  ryt        j                  | j                  gg g |      \  }}}t        |      dkD  S )aZ  
        Blocks until the socket is ready to be read from, or the timeout is hit

        :param timeout:
            A float - the period of time to wait for data to be read. None for
            no time limit.

        :return:
            A boolean - if data is ready to be read. Will only be False if
            timeout is not None.
        r   T)r   r   selectr   )rb   r   
read_ready_s       rG   r  zTLSSocket.select_read  sJ     t$$%)!==$,,RI
Aq:""rF   c                 F   t        |t              s.t        |t              st        t	        dt        |                  d}t        |t              }	 t        | j                        dkD  r| j                  }d| _        n| j                  d      }t        |      }||z  }|r$|j                  |      }|R|j                         }nBt        d|t        |      z
  dz
        }|j                  ||      }|dk7  r|t        |      z   }n||d | j                  z   | _        |d| S )a  
        Reads data from the socket until a marker is found. Data read may
        include data beyond the marker.

        :param marker:
            A byte string or regex object from re.compile(). Used to determine
            when to stop reading. Regex objects are more inefficient since
            they must scan the entire byte string of read data each time data
            is read off the socket.

        :return:
            A byte string of the data read
        z_
                marker must be a byte string or compiled regex object, not %s
                rF   r   rD  Nr   )rS   r!   PatternrU   r	   r   r   r   r^   searchendr  find)	rb   markerr  is_regexchunkoffsetmatchr  starts	            rG   
read_untilzTLSSocket.read_until  s*    &(+Jvw4ON &!	   fg.4(()A---(+%		$[FeOFf-$))+C
 AvF3a78FE2B;#f+-C/ 2 !'stt/D/D Da}rF   c                 ,    | j                  t              S )z
        Reads a line from the socket, including the line ending of "\r\n", "\r",
        or "\n"

        :return:
            A byte string of the next line from the socket
        )r  _line_regexrb   s    rG   	read_linezTLSSocket.read_line  s     {++rF   c                 h    d}|}|dkD  r(|| j                  |      z  }|t        |      z
  }|dkD  r(|S )z
        Reads exactly the specified number of bytes from the socket

        :param num_bytes:
            An integer - the exact number of bytes to read

        :return:
            A byte string of the data that was read
        rF   r   )r^   r   )rb   	num_bytesr  	remainings       rG   read_exactlyzTLSSocket.read_exactly  sF     	!mdii	**F!CK/I !m rF   c                 :   | j                   | j                          | j                  st        | j                  | j
                  z   | j                  z         | _        | j                  d      \  | _        | _	        t        j                  | j                  d   _        | j                  | j                  d   _        t        t        d| j                        | j                  d   _        t        j"                  | j                  d   _        t%        | j                  | j                        | j                  d   _        t        j&                  | j                  d   _        | j                  | j                  d   _        t%        | j                  | j                  | j
                  z         | j                  d   _        t)        |      dkD  rt+        t)        |      | j
                        }t-        | j                  |d| | j                         || j                  d   _        t%        | j                  | j                  |z         | j                  d   _        t        j.                  | j                   d| j                  d      }|t        j0                  k7  rt3        |t4               t7        t8        | j                  d   j                        }|t7        t8        | j                  d   j                        z  }|t7        t8        | j                  d   j                        z  }	 | j:                  j=                  t?        | j                  |             ||d }t)        |      dkD  ryy# t@        jB                  $ r}|jD                  dk(  r
tG                 d}~ww xY w)a  
        Writes data to the TLS-wrapped socket

        :param data:
            A byte string to write to the socket

        :raises:
            socket.socket - when a non-TLS socket error occurs
            oscrypto.errors.TLSError - when a TLS-related error occurs
            ValueError - when any of the parameters contain an invalid value
            TypeError - when any of the parameters are of the wrong type
            OSError - when an error is returned by the OS crypto library
        Nr  r   rC  r   r   iE'  )$r   r  _encrypt_data_bufferr
   ry  r{  r}  r   _encrypt_desc_encrypt_buffersr   r  r   r   r   r   r   r  r   r  r   r  r   EncryptMessager[  r   r#   r   r   r   r]  r   r   r<  errnor/   )rb   datato_writer   to_sendr   s         rG   writezTLSSocket.write  s    ''/ (((9$:K:KdN`N`:`cgcucu:u(vD%8<8L8LQ8O5D 52>2V2VD!!!$/040A0AD!!!$-04WhHaHa0bD!!!$-2>2M2MD!!!$/03D4M4MtO`O`0aD!!!$-2>2W2WD!!!$/040B0BD!!!$-03D4M4MtO`O`cgcucuOu0vD!!!$-$i!m3t9d&8&89HD55tAh7GIZIZ[08D!!!$-03D4M4MtO`O`ckOk0lD!!!$-++,,""	F ...VX.S$"7"7":"C"CDGvc4#8#8#;#D#DEEGvc4#8#8#;#D#DEEG!!"3D4M4Mw"WX >D7 $i!m, MM 77e#')s   "/M( (N;NNc                 l    t        j                   g | j                  gg |      \  }}}t        |      dkD  S )aw  
        Blocks until the socket is ready to be written to, or the timeout is hit

        :param timeout:
            A float - the period of time to wait for the socket to be ready to
            written to. None for no time limit.

        :return:
            A boolean - if the socket is ready for writing. Will only be False
            if timeout is not None.
        r   )r  r   r   )rb   r   r  write_readys       rG   select_writezTLSSocket.select_write'  s5     #MM"t||nb'J;;!##rF   c                 
   | j                   yd}	 t        dk\  rt        t        d      }d|d   _        t
        j                  |d   _        t        t        dt        d            |d   _
        t        t        d      }t        |      }t
        j                  |_        d	|_        ||_        t        j"                  | j                   |      }t%        |t&               | j)                  d
      \  }}t
        j                  |d   _        t
        j*                  |d	   _        t        t        d      }t        j,                  | j.                  j0                  | j                   | j2                  | j4                  ddt7               dt7               ||t7                     }t9        t
        j:                  t
        j<                  t
        j>                  g      }||vrt%        |t&               tA        |d   j                  |d   j                        }		 | jB                  jE                  |	       |rttK        |d   j                        s"t        jL                  |d   j                         tK        |d	   j                        s"t        jL                  |d	   j                         t        jN                  | j                          d| _         	 | jB                  jQ                  tF        jR                         y# tF        jH                  $ r Y w xY w# tF        jH                  $ r Y yw xY w# |rttK        |d   j                        s"t        jL                  |d   j                         tK        |d	   j                        s"t        jL                  |d	   j                         t        jN                  | j                          d| _         	 | jB                  jQ                  tF        jR                         w # tF        jH                  $ r Y w w xY wxY w)z
        Shuts down the TLS session and then shuts down the underlying socket

        :raises:
            OSError - when an error is returned by the OS crypto library
        N)rF  r   zSecBuffer[1]r  r   rC  s      r   r   r   rB  )*r   _win_version_infor   r   r   r   rX  r   r   r
   r   r   r   r   r   r   r   ApplyControlTokenr   r#   r   rY  rZ  r   r   r   rW  r   rW   r[  SEC_E_CONTEXT_EXPIREDr\  r   r   r]  r   r<  r   r^  r  r  	SHUT_RDWR)
rb   r  r   r   r   r   r  r  acceptable_resultsr  s
             rG   r  zTLSSocket.shutdown7  sH    ''/F	 !F*g~6 '(
#(4(D(D
%&*7H>OPc>d&e
#*0/*J'"()@"A,8,J,J)+,(+2( 2243O3OQhiVX.7;7K7KA7N4'(4(D(DKN%(4(D(DKN%+.w	+B(7711,,##+,F "%%%2222& "
 //VX.%k!n&=&={1~?V?VWE !!%(
 {1~667--k!n.E.EF{1~667--k!n.E.EF))$*F*FG+/D(%%g&7&78 MM  MM  {1~667--k!n.E.EF{1~667--k!n.E.EF))$*F*FG+/D(%%g&7&78MM sa   G;L! K/ )L /LL! LL! LL!BP?)O)(P)O?<P>O??Pc                 R   	 | j                          | j                  r#	 | j                  j                          d| _        yy# t        j                  $ r Y w xY w# | j                  r=	 | j                  j                          n# t        j                  $ r Y nw xY wd| _        w w xY w)zN
        Shuts down the TLS session and socket and forcibly closes it
        N)r  r   r   r   r<  r  s    rG   r   zTLSSocket.close  s    
		$MMO ||LL&&(  $     ||LL&&( # s@   A A AAB&)BB&BB&BB&c                    t        t        d      }t        j                  | j                  t
        j                  |      }t        |t               t        |      }t        t        d|      }t        |      }t        |j                  t        t        |j                              }t!        j"                  |      | _        g | _        d}	 |j(                  }t        j*                  |t-                     }t/        |      st        |      }t        |j                  t        t        |j                              }	|	|k7  r.| j&                  j1                  t!        j"                  |	             t        j*                  ||      }t/        |      s|rt        j2                  |d       yy# |rt        j2                  |d       w w xY w)zh
        Reads end-entity and intermediate certificate information from the
        TLS session
        zCERT_CONTEXT **zCERT_CONTEXT *Nr   )r   r   r   r   r   r   r   r   r#   r   r   r   r  r   r   r  r_   r  _certificate_intermediates
hCertStoreCertEnumCertificatesInStorer   r   r`   r  )
rb   r  r   r  r;  r  store_handlecontext_pointercontextr  s
             rG   _read_certificateszTLSSocket._read_certificates  sz    (+74E'F$00((88(

 	VX&%&BC#G-=?ST23%l&@&@&lNhNhBij	+00; 	8'22L%AA,PTPVWOo. 1()>)>sGLaLa@bc 9$''../C/CD/IJ")"E"ElTc"d o. &&|Q7 |&&|Q7 s   	CF& &Gc                 F    | j                   rt        d      t        d      )zi
        Raises an exception describing if the local or remote end closed the
        connection
        z$The remote end closed the connectionz!The connection was already closed)r  r&   r%   r  s    rG   r  zTLSSocket._raise_closed  s%     ,-STT$%HIIrF   c                     | j                   | j                          | j                  | j                          | j                  S )zu
        An asn1crypto.x509.Certificate object of the end-entity certificate
        presented by the server
        )r   r  r  r  r  s    rG   r   zTLSSocket.certificate  s@     ''/ $##%   rF   c                     | j                   | j                          | j                  | j                          | j                  S )zz
        A list of asn1crypto.x509.Certificate objects that were presented as
        intermediates by the server
        )r   r  r  r  r  r  s    rG   intermediateszTLSSocket.intermediates  s@     ''/ $##%"""rF   c                     | j                   S )zg
        A unicode string of the IANA cipher suite name of the negotiated
        cipher suite
        )rr  r  s    rG   rK  zTLSSocket.cipher_suite  s     !!!rF   c                     | j                   S )zM
        A unicode string of: "TLSv1.2", "TLSv1.1", "TLSv1", "SSLv3"
        )rq  r  s    rG   rc   zTLSSocket.protocol       ~~rF   c                     | j                   S )z5
        A boolean if compression is enabled
        )rs  r  s    rG   rL  zTLSSocket.compression  s        rF   c                     | j                   S zM
        A unicode string of "new" or "reused" or None for no ticket
        )rt  r  s    rG   rM  zTLSSocket.session_id  s     rF   c                     | j                   S r  )ru  r  s    rG   rN  zTLSSocket.session_ticket  s     ###rF   c                     | j                   S )zM
        The oscrypto.tls.TLSSession object used for this connection
        )r   r  s    rG   r   zTLSSocket.session  s     }}rF   c                     | j                   S )zN
        A unicode string of the TLS server domain name or IP address
        )r   r  s    rG   r   zTLSSocket.hostname  r  rF   c                 <    | j                   j                         d   S )zJ
        An integer of the port number the socket is connected to
        r   )r   getpeernamer  s    rG   r   zTLSSocket.port%  s     {{&&(++rF   c                 R    | j                   | j                          | j                  S )z9
        The underlying socket.socket connection
        )r   r  r   r  s    rG   r   zTLSSocket.socket-  s&     ''/ ||rF   c                 $    | j                          y r   )r   r  s    rG   r   zTLSSocket.__del__8  s    

rF   r   )
   N)F):rB   rC   rD   rJ   r   r   r   rW  r   ry  r{  r}  r   r   r  r  r  r  r  r  r  r  rq  rr  rs  rt  ru  r  classmethodr   ri   r   r>  r   r^   r  r  r  r  r  r  r  r   r  r  propertyr   r  rK  rc   rL  rM  rN  r   r   r   r   r   rE   rF   rG   r?   r?     s    GH"NILMMOMMLNIMLKON< <|U"n26pMdlJ\	hT#(5n	,&<"|$ Rh$ &8P	J ! ! # # " "   ! !     $ $     , ,  rF   )^
__future__r   r   r   r   sysrer   r   r  r   _asn1r   r_   _errorsr	   _ffir
   r   r   r   r   r   r   r   r   r   r   r   r   r   _secur32r   r   r   _crypt32r   r   r   	_kernel32r   _typesr   r    r!   r"   errorsr#   r$   r%   r&   _tlsr'   r(   r)   r*   r+   r,   r-   r.   r/   r0   r1   r2   r3   r4   r5   r6   r7   r8   r9   
asymmetricr:   keysr;   version_infoxranger   r<  r`  WindowsError_pattern_typer  __all__compiler  getwindowsversion_gwvr  rA   rI   objectr>   r?   rE   rF   rG   <module>r     s6   R R 
 	    2 $     : 9 Q Q  < < c c     * 6 $dE}}#fGjjG  bjj)s!Wd1g& 	- 	
	X 	{, {,|Z ZrF   