U
    
W[ü   ã                   @   sŠ  d Z ddlmZmZ ddlmZ dZddlmZm	Z	m
Z
 ddlmZmZ ddlmZ eejƒeG dd	„ d	ƒƒƒZG d
d„ deƒZeejƒeG dd„ dƒƒƒZe	ejfdd„ e
ejƒD ƒžŽ G dd„ dejƒƒZeejƒG dd„ dejƒƒZG dd„ dejƒZG dd„ dejƒZddlmZmZmZmZmZmZm Z!m"Z#m$Z%m&Z&m'Z'm(Z(m)Z)m*Z*m+Z+m,Z,m-Z- d	dddddddddd d!d"d#d$d%d&d'd(d)gZ.d*S )+a	  
This module implements Transport Layer Security (TLS) support for Twisted.  It
requires U{PyOpenSSL <https://pypi.python.org/pypi/pyOpenSSL>}.

If you wish to establish a TLS connection, please use one of the following
APIs:

    - SSL endpoints for L{servers
      <twisted.internet.endpoints.SSL4ServerEndpoint>} and L{clients
      <twisted.internet.endpoints.SSL4ClientEndpoint>}

    - L{startTLS <twisted.internet.interfaces.ITLSTransport.startTLS>}

    - L{connectSSL <twisted.internet.interfaces.IReactorSSL.connectSSL>}

    - L{listenSSL <twisted.internet.interfaces.IReactorSSL.listenSSL>}

These APIs all require a C{contextFactory} argument that specifies their
security properties, such as certificate, private key, certificate authorities
to verify the peer, allowed TLS protocol versions, cipher suites, and so on.
The recommended value for this argument is a L{CertificateOptions} instance;
see its documentation for an explanation of the available options.

The C{contextFactory} name is a bit of an anachronism now, as context factories
have been replaced with "connection creators", but these objects serve the same
role.

Be warned that implementing your own connection creator (i.e.: value for the
C{contextFactory}) is both difficult and dangerous; the Twisted team has worked
hard to make L{CertificateOptions}' API comprehensible and unsurprising, and
the Twisted team is actively maintaining it to ensure that it becomes more
secure over time.

If you are really absolutely sure that you want to take on the risk of
implementing your own connection creator based on the pyOpenSSL API, see the
L{server connection creator
<twisted.internet.interfaces.IOpenSSLServerConnectionCreator>} and L{client
connection creator
<twisted.internet.interfaces.IOpenSSLServerConnectionCreator>} interfaces.

Developers using Twisted, please ignore the L{Port}, L{Connector}, and
L{Client} classes defined here, as these are details of certain reactors' TLS
implementations, exposed by accident (and remaining here only for compatibility
reasons).  If you wish to establish a TLS connection, please use one of the
APIs listed above.

@note: "SSL" (Secure Sockets Layer) is an antiquated synonym for "TLS"
    (Transport Layer Security).  You may see these terms used interchangeably
    throughout the documentation.
é    )ÚdivisionÚabsolute_import)ÚSSLT)ÚimplementerÚimplementer_onlyÚimplementedBy)ÚtcpÚ
interfaces)Ú	_oldStylec                   @   s   e Zd ZdZdZdd„ ZdS )ÚContextFactoryz>A factory for SSL context objects, for server SSL connections.r   c                 C   s   t ‚dS )z4Return a SSL.Context object. override in subclasses.N)ÚNotImplementedError©Úself© r   ú6/usr/lib/python3/dist-packages/twisted/internet/ssl.pyÚ
getContextL   s    zContextFactory.getContextN)Ú__name__Ú
__module__Ú__qualname__Ú__doc__ÚisClientr   r   r   r   r   r   E   s   r   c                   @   sF   e Zd ZdZdZejejfdd„Zdd„ Z	dd„ Z
d	d
„ Zdd„ ZdS )ÚDefaultOpenSSLContextFactoryaQ  
    L{DefaultOpenSSLContextFactory} is a factory for server-side SSL context
    objects.  These objects define certain parameters related to SSL
    handshakes and the subsequent connection.

    @ivar _contextFactory: A callable which will be used to create new
        context objects.  This is typically L{OpenSSL.SSL.Context}.
    Nc                 C   s$   || _ || _|| _|| _|  ¡  dS )zÐ
        @param privateKeyFileName: Name of a file containing a private key
        @param certificateFileName: Name of a file containing a certificate
        @param sslmethod: The SSL method to use
        N)ÚprivateKeyFileNameÚcertificateFileNameÚ	sslmethodÚ_contextFactoryÚcacheContext)r   r   r   r   r   r   r   r   Ú__init__]   s
    z%DefaultOpenSSLContextFactory.__init__c                 C   sD   | j d kr@|  | j¡}| tj¡ | | j¡ | | j	¡ || _ d S ©N)
Ú_contextr   r   Úset_optionsr   ÚOP_NO_SSLv2Zuse_certificate_filer   Zuse_privatekey_filer   ©r   Zctxr   r   r   r   o   s    
z)DefaultOpenSSLContextFactory.cacheContextc                 C   s   | j  ¡ }|d= |S )Nr   )Ú__dict__Úcopy)r   Údr   r   r   Ú__getstate__z   s    
z)DefaultOpenSSLContextFactory.__getstate__c                 C   s
   || _ d S r   )r#   )r   Ústater   r   r   Ú__setstate__€   s    z)DefaultOpenSSLContextFactory.__setstate__c                 C   s   | j S )z(
        Return an SSL context.
        )r   r   r   r   r   r   „   s    z'DefaultOpenSSLContextFactory.getContext)r   r   r   r   r   r   ÚSSLv23_METHODÚContextr   r   r&   r(   r   r   r   r   r   r   R   s    ÿ
r   c                   @   s(   e Zd ZdZdZejZejZ	dd„ Z
dS )ÚClientContextFactoryz"A context factory for SSL clients.é   c                 C   s   |   | j¡}| tj¡ |S r   )r   Úmethodr    r   r!   r"   r   r   r   r   ™   s    zClientContextFactory.getContextN)r   r   r   r   r   r   r)   r-   r*   r   r   r   r   r   r   r+   Œ   s
   r+   c                 C   s   g | ]}|t jkr|‘qS r   )r	   ZITLSTransport)Ú.0Úir   r   r   Ú
<listcomp>¢   s    
ÿr0   c                   @   s"   e Zd ZdZddd„Zdd„ ZdS )ÚClientz
    I am an SSL client.
    Nc                 C   s    || _ tj | |||||¡ d S r   )Ú
ctxFactoryr   r1   r   )r   ÚhostÚportÚbindAddressr2   Z	connectorÚreactorr   r   r   r   ©   s    zClient.__init__c                 C   s$   |   | j¡ |  ¡  tj | ¡ d S r   )ÚstartTLSr2   ZstartWritingr   r1   Ú_connectDoner   r   r   r   r8   ®   s    zClient._connectDone)N)r   r   r   r   r   r8   r   r   r   r   r1   ¡   s   
r1   c                   @   s   e Zd ZdZdd„ ZdS )ÚServerz
    I am an SSL server.
    c                 O   s&   t jj| f|ž|Ž |  | jj¡ d S r   )r   r9   r   r7   Zserverr2   )r   ÚargsÚkwargsr   r   r   r   »   s    zServer.__init__N)r   r   r   r   r   r   r   r   r   r9   µ   s   r9   c                   @   s*   e Zd ZdZeZdZd
dd„Zdd	„ ZdS )ÚPortz
    I am an SSL port.
    ZTLSé2   Ú Nc                 C   s    t j | |||||¡ || _d S r   )r   r<   r   r2   )r   r4   Úfactoryr2   ZbacklogZ	interfacer6   r   r   r   r   É   s    zPort.__init__c                 C   s   t j | |¡d S )z|
        Override the normal prefix to include an annotation indicating this is a
        port for TLS connections.
        z (TLS))r   r<   Ú_getLogPrefix)r   r?   r   r   r   r@   Î   s    zPort._getLogPrefix)r=   r>   N)	r   r   r   r   r9   Z	transportZ_typer   r@   r   r   r   r   r<   Á   s
   
r<   c                   @   s   e Zd Zddd„Zdd„ ZdS )Ú	ConnectorNc              	   C   s*   || _ tj | ||||||¡ | ¡  d S r   )ÚcontextFactoryr   rA   r   r   )r   r3   r4   r?   rB   Ztimeoutr5   r6   r   r   r   r   Ø   s    zConnector.__init__c                 C   s   t | j| j| j| j| | jƒS r   )r1   r3   r4   r5   rB   r6   r   r   r   r   Ú_makeTransportá   s    zConnector._makeTransport)N)r   r   r   r   rC   r   r   r   r   rA   ×   s   
	rA   )ÚKeyPairÚDistinguishedNameÚDNÚCertificateÚCertificateRequestÚPrivateCertificateÚOpenSSLAcceptableCiphersÚOpenSSLCertificateOptionsÚOpenSSLDiffieHellmanParametersÚplatformTrustÚOpenSSLDefaultPathsÚVerificationErrorÚoptionsForClientTLSÚProtocolNegotiationSupportÚprotocolNegotiationMechanismsÚtrustRootFromCertificatesÚ
TLSVersionrE   rF   rG   rH   rI   rD   ÚAcceptableCiphersÚCertificateOptionsÚDiffieHellmanParametersrM   rN   rT   rO   rP   rQ   rR   rS   N)/r   Z
__future__r   r   ZOpenSSLr   Z	supportedZzope.interfacer   r   r   Ztwisted.internetr   r	   Ztwisted.python._oldstyler
   ZIOpenSSLContextFactoryr   r   r+   ZISSLTransportr1   r9   r<   rA   Ztwisted.internet._sslverifyrD   rE   rF   rG   rH   rI   rJ   rU   rK   rV   rL   rW   rM   rN   rO   rP   rQ   rR   rS   rT   Ú__all__r   r   r   r   Ú<module>   sV   3:ÿL           õ