use super::error::{PySSLError, SSL_ERROR_SSL};

use crate::{

common::lock::{PyMutex, PyRwLock},

vm::{

AsObject, Py, PyObject, PyObjectRef, PyPayload, PyRef, PyResult, TryFromObject,

VirtualMachine,

builtins::{PyBytesRef, PyType, PyUtf8StrRef},

function::{

ArgBytesLike, ArgIntoBool, ArgIntoFloat, ArgStrOrBytesLike, FuncArgs, OptionalArg,

PyComparisonValue, PySetterValue,

},

stdlib::_warnings,

types::{Comparable, Constructor, PyComparisonOp, Representable},

},

};

use rustpython_host_env::ssl::oid;

use rustpython_vm::exceptions;

const UNAVAILABLE: &str = "TLS is not available on this platform";

#[pyattr]

const PROTOCOL_TLS: i32 = rustpython_host_env::ssl::PROTOCOL_TLS;

#[pyattr]

const PROTOCOL_SSLv23: i32 = PROTOCOL_TLS;

#[pyattr]

const PROTOCOL_TLS_CLIENT: i32 = rustpython_host_env::ssl::PROTOCOL_TLS_CLIENT;

#[pyattr]

const PROTOCOL_TLS_SERVER: i32 = rustpython_host_env::ssl::PROTOCOL_TLS_SERVER;

#[pyattr]

const PROTOCOL_TLSv1: i32 = rustpython_host_env::ssl::PROTOCOL_TLSV1;

#[pyattr]

const PROTOCOL_TLSv1_1: i32 = rustpython_host_env::ssl::PROTOCOL_TLSV1_1;

#[pyattr]

const PROTOCOL_TLSv1_2: i32 = rustpython_host_env::ssl::PROTOCOL_TLSV1_2;

#[pyattr]

const PROTOCOL_TLSv1_3: i32 = rustpython_host_env::ssl::PROTOCOL_TLSV1_3;

#[pyattr]

use rustpython_host_env::ssl::{

PROTO_MAXIMUM_SUPPORTED, PROTO_MINIMUM_SUPPORTED, PROTO_SSL3 as PROTO_SSLv3,

PROTO_TLSV1 as PROTO_TLSv1, PROTO_TLSV1_1 as PROTO_TLSv1_1, PROTO_TLSV1_2 as PROTO_TLSv1_2,

PROTO_TLSV1_3 as PROTO_TLSv1_3,

};

#[pyattr]

const CERT_NONE: i32 = rustpython_host_env::ssl::CERT_NONE;

#[pyattr]

const CERT_OPTIONAL: i32 = rustpython_host_env::ssl::CERT_OPTIONAL;

#[pyattr]

const CERT_REQUIRED: i32 = rustpython_host_env::ssl::CERT_REQUIRED;

#[pyattr]

const VERIFY_DEFAULT: i32 = rustpython_host_env::ssl::VERIFY_DEFAULT;

#[pyattr]

const VERIFY_CRL_CHECK_LEAF: i32 = rustpython_host_env::ssl::VERIFY_CRL_CHECK_LEAF;

#[pyattr]

const VERIFY_CRL_CHECK_CHAIN: i32 = rustpython_host_env::ssl::VERIFY_CRL_CHECK_CHAIN;

#[pyattr]

const VERIFY_X509_STRICT: i32 = rustpython_host_env::ssl::VERIFY_X509_STRICT;

#[pyattr]

const VERIFY_ALLOW_PROXY_CERTS: i32 = rustpython_host_env::ssl::VERIFY_ALLOW_PROXY_CERTS;

#[pyattr]

const VERIFY_X509_TRUSTED_FIRST: i32 = rustpython_host_env::ssl::VERIFY_X509_TRUSTED_FIRST;

#[pyattr]

const VERIFY_X509_PARTIAL_CHAIN: i32 = rustpython_host_env::ssl::VERIFY_X509_PARTIAL_CHAIN;

#[pyattr]

const HOSTFLAG_NEVER_CHECK_SUBJECT: i32 =

rustpython_host_env::ssl::HOSTFLAG_NEVER_CHECK_SUBJECT;

#[pyattr]

use rustpython_host_env::ssl::{

OP_ALL, OP_CIPHER_SERVER_PREFERENCE, OP_ENABLE_MIDDLEBOX_COMPAT, OP_IGNORE_UNEXPECTED_EOF,

OP_LEGACY_SERVER_CONNECT, OP_NO_COMPRESSION, OP_NO_RENEGOTIATION, OP_NO_SSLv2, OP_NO_SSLv3,

OP_NO_TICKET, OP_NO_TLSV1 as OP_NO_TLSv1, OP_NO_TLSV1_1 as OP_NO_TLSv1_1,

OP_NO_TLSV1_2 as OP_NO_TLSv1_2, OP_NO_TLSV1_3 as OP_NO_TLSv1_3, OP_SINGLE_DH_USE,

OP_SINGLE_ECDH_USE,

};

#[pyattr]

use rustpython_host_env::ssl::{

ALERT_DESCRIPTION_ACCESS_DENIED, ALERT_DESCRIPTION_BAD_CERTIFICATE,

ALERT_DESCRIPTION_BAD_CERTIFICATE_HASH_VALUE,

ALERT_DESCRIPTION_BAD_CERTIFICATE_STATUS_RESPONSE, ALERT_DESCRIPTION_BAD_RECORD_MAC,

ALERT_DESCRIPTION_CERTIFICATE_EXPIRED, ALERT_DESCRIPTION_CERTIFICATE_REQUIRED,

ALERT_DESCRIPTION_CERTIFICATE_REVOKED, ALERT_DESCRIPTION_CERTIFICATE_UNKNOWN,

ALERT_DESCRIPTION_CERTIFICATE_UNOBTAINABLE, ALERT_DESCRIPTION_CLOSE_NOTIFY,

ALERT_DESCRIPTION_DECODE_ERROR, ALERT_DESCRIPTION_DECOMPRESSION_FAILURE,

ALERT_DESCRIPTION_DECRYPT_ERROR, ALERT_DESCRIPTION_DECRYPTION_FAILED,

ALERT_DESCRIPTION_EXPORT_RESTRICTION, ALERT_DESCRIPTION_HANDSHAKE_FAILURE,

ALERT_DESCRIPTION_ILLEGAL_PARAMETER, ALERT_DESCRIPTION_INAPPROPRIATE_FALLBACK,

ALERT_DESCRIPTION_INSUFFICIENT_SECURITY, ALERT_DESCRIPTION_INTERNAL_ERROR,

ALERT_DESCRIPTION_MISSING_EXTENSION, ALERT_DESCRIPTION_NO_APPLICATION_PROTOCOL,

ALERT_DESCRIPTION_NO_CERTIFICATE, ALERT_DESCRIPTION_NO_RENEGOTIATION,

ALERT_DESCRIPTION_PROTOCOL_VERSION, ALERT_DESCRIPTION_RECORD_OVERFLOW,

ALERT_DESCRIPTION_UNEXPECTED_MESSAGE, ALERT_DESCRIPTION_UNKNOWN_CA,

ALERT_DESCRIPTION_UNKNOWN_PSK_IDENTITY, ALERT_DESCRIPTION_UNRECOGNIZED_NAME,

ALERT_DESCRIPTION_UNSUPPORTED_CERTIFICATE, ALERT_DESCRIPTION_UNSUPPORTED_EXTENSION,

ALERT_DESCRIPTION_USER_CANCELLED,

};

#[pyattr]

const OPENSSL_VERSION_NUMBER: i32 = 0x30300000;

#[pyattr]

const OPENSSL_VERSION: &str = "OpenSSL 3.3.0-compatible (rustls-free wasm)";

#[pyattr]

const OPENSSL_VERSION_INFO: (i32, i32, i32, i32, i32) = (3, 3, 0, 0, 15);

#[pyattr]

const _OPENSSL_API_VERSION: (i32, i32, i32, i32, i32) = (3, 3, 0, 0, 15);

#[pyattr(once)]

fn _DEFAULT_CIPHERS(_vm: &VirtualMachine) -> String {

"DEFAULT".to_owned()

}

#[pyattr]

const HAS_SNI: bool = true;

#[pyattr]

const HAS_TLS_UNIQUE: bool = false;

#[pyattr]

const HAS_ECDH: bool = false;

#[pyattr]

const HAS_NPN: bool = false;

#[pyattr]

const HAS_ALPN: bool = true;

#[pyattr]

const HAS_PSK: bool = false;

#[pyattr]

const HAS_PSK_TLS13: bool = false;

#[pyattr]

const HAS_SSLv2: bool = false;

#[pyattr]

const HAS_SSLv3: bool = false;

#[pyattr]

const HAS_TLSv1: bool = false;

#[pyattr]

const HAS_TLSv1_1: bool = false;

#[pyattr]

const HAS_TLSv1_2: bool = false;

#[pyattr]

const HAS_TLSv1_3: bool = false;

#[pyattr]

const HAS_PHA: bool = false;

#[pyattr]

use rustpython_host_env::ssl::{ENCODING_DER, ENCODING_PEM, ENCODING_PEM_AUX};

fn ssl_error<T>(vm: &VirtualMachine, message: impl Into<String>) -> PyResult<T> {

Err(vm

.new_os_subtype_error(

PySSLError::class(&vm.ctx).to_owned(),

Some(SSL_ERROR_SSL),

message.into(),

)

.upcast())

}

fn validate_hostname(hostname: &str, vm: &VirtualMachine) -> PyResult<()> {

use rustpython_host_env::ssl::HostnameError;

match rustpython_host_env::ssl::validate_hostname(hostname) {

Ok(()) => Ok(()),

Err(HostnameError::EmbeddedNul) => Err(exceptions::nul_char_type_error(vm)),

Err(error) => Err(vm.new_value_error(error.message().to_owned())),

}

}

fn parse_length_prefixed_alpn(bytes: &[u8], vm: &VirtualMachine) -> PyResult<Vec<Vec<u8>>> {

rustpython_host_env::ssl::parse_length_prefixed_alpn(bytes)

.map_err(|error| vm.new_value_error(error.0))

}

#[pyattr]

#[pyclass(name = "_SSLContext", module = "_ssl", traverse)]

#[derive(Debug, PyPayload)]

struct PySSLContext {

#[pytraverse(skip)]

protocol: i32,

#[pytraverse(skip)]

check_hostname: PyRwLock<bool>,

#[pytraverse(skip)]

host_flags: PyRwLock<i32>,

#[pytraverse(skip)]

verify_mode: PyRwLock<i32>,

#[pytraverse(skip)]

verify_flags: PyRwLock<i32>,

#[pytraverse(skip)]

options: PyRwLock<i32>,

#[pytraverse(skip)]

alpn_protocols: PyRwLock<Vec<Vec<u8>>>,

#[pytraverse(skip)]

post_handshake_auth: PyRwLock<bool>,

#[pytraverse(skip)]

num_tickets: PyRwLock<i32>,

#[pytraverse(skip)]

minimum_version: PyRwLock<i32>,

#[pytraverse(skip)]

maximum_version: PyRwLock<i32>,

sni_callback: PyRwLock<Option<PyObjectRef>>,

msg_callback: PyRwLock<Option<PyObjectRef>>,

keylog_filename: PyRwLock<Option<PyObjectRef>>,

}

#[pyclass(with(Constructor, Representable), flags(BASETYPE))]

impl PySSLContext {

#[pygetset]

fn check_hostname(zelf: &Py<Self>) -> bool {

*zelf.check_hostname.read()

}

#[pygetset(setter)]

fn set_check_hostname(zelf: &Py<Self>, value: ArgIntoBool) {

let value = value.into_bool();

*zelf.check_hostname.write() = value;

if value && *zelf.verify_mode.read() == CERT_NONE {

*zelf.verify_mode.write() = CERT_REQUIRED;

}

}

#[pygetset]

fn _host_flags(zelf: &Py<Self>) -> i32 {

*zelf.host_flags.read()

}

#[pygetset(setter)]

fn set__host_flags(zelf: &Py<Self>, value: i32) {

*zelf.host_flags.write() = value;

}

#[pygetset]

fn verify_mode(zelf: &Py<Self>) -> i32 {

*zelf.verify_mode.read()

}

#[pygetset(setter)]

fn set_verify_mode(zelf: &Py<Self>, mode: i32, vm: &VirtualMachine) -> PyResult<()> {

if !(CERT_NONE..=CERT_REQUIRED).contains(&mode) {

return Err(vm.new_value_error("invalid verify mode"));

}

if mode == CERT_NONE && *zelf.check_hostname.read() {

return Err(vm.new_value_error(

"Cannot set verify_mode to CERT_NONE when check_hostname is enabled",

));

}

*zelf.verify_mode.write() = mode;

Ok(())

}

#[pygetset]

fn protocol(zelf: &Py<Self>) -> i32 {

zelf.protocol

}

#[pygetset]

fn verify_flags(zelf: &Py<Self>) -> i32 {

*zelf.verify_flags.read()

}

#[pygetset(setter)]

fn set_verify_flags(zelf: &Py<Self>, value: i32) {

*zelf.verify_flags.write() = value;

}

#[pygetset]

fn post_handshake_auth(zelf: &Py<Self>) -> bool {

*zelf.post_handshake_auth.read()

}

#[pygetset(setter)]

fn set_post_handshake_auth(zelf: &Py<Self>, value: ArgIntoBool) {

let value = value.into_bool();

*zelf.post_handshake_auth.write() = value;

}

#[pygetset]

fn num_tickets(zelf: &Py<Self>) -> i32 {

*zelf.num_tickets.read()

}

#[pygetset(setter)]

fn set_num_tickets(zelf: &Py<Self>, value: i32, vm: &VirtualMachine) -> PyResult<()> {

if value < 0 {

return Err(vm.new_value_error("num_tickets must be a non-negative integer"));

}

if zelf.protocol != PROTOCOL_TLS_SERVER {

return Err(

vm.new_value_error("num_tickets can only be set on server-side contexts")

);

}

*zelf.num_tickets.write() = value;

Ok(())

}

#[pygetset]

fn options(zelf: &Py<Self>) -> i32 {

*zelf.options.read()

}

#[pygetset(setter)]

fn set_options(zelf: &Py<Self>, value: i32, vm: &VirtualMachine) -> PyResult<()> {

if value < 0 {

return Err(vm.new_value_error("options must be non-negative"));

}

let opt_no = OP_NO_SSLv2

| OP_NO_SSLv3

| OP_NO_TLSv1

| OP_NO_TLSv1_1

| OP_NO_TLSv1_2

| OP_NO_TLSv1_3;

let old_opts = *zelf.options.read();

let set = !old_opts & value;

if (set & opt_no) != 0 {

_warnings::warn(

vm.ctx.exceptions.deprecation_warning,

"ssl.OP_NO_SSL*/ssl.OP_NO_TLS* options are deprecated".to_owned(),

2,

vm,

)?;

}

*zelf.options.write() = value;

Ok(())

}

#[pygetset]

fn minimum_version(zelf: &Py<Self>) -> i32 {

let v = *zelf.minimum_version.read();

if v == 0 { PROTO_MINIMUM_SUPPORTED } else { v }

}

#[pygetset(setter)]

fn set_minimum_version(zelf: &Py<Self>, value: i32, vm: &VirtualMachine) -> PyResult<()> {

if value != 0

&& value != -2

&& value != -1

&& !(PROTO_SSLv3..=PROTO_TLSv1_3).contains(&value)

{

return Err(vm.new_value_error(format!("invalid protocol version: {value}")));

}

*zelf.minimum_version.write() = value;

Ok(())

}

#[pygetset]

fn maximum_version(zelf: &Py<Self>) -> i32 {

let v = *zelf.maximum_version.read();

if v == 0 { PROTO_MAXIMUM_SUPPORTED } else { v }

}

#[pygetset(setter)]

fn set_maximum_version(zelf: &Py<Self>, value: i32, vm: &VirtualMachine) -> PyResult<()> {

if value != 0

&& value != -2

&& value != -1

&& !(PROTO_SSLv3..=PROTO_TLSv1_3).contains(&value)

{

return Err(vm.new_value_error(format!("invalid protocol version: {value}")));

}

*zelf.maximum_version.write() = value;

Ok(())

}

#[pygetset]

fn sni_callback(zelf: &Py<Self>) -> Option<PyObjectRef> {

zelf.sni_callback.read().clone()

}

#[pygetset(setter)]

fn set_sni_callback(

zelf: &Py<Self>,

callback: Option<PyObjectRef>,

vm: &VirtualMachine,

) -> PyResult<()> {

if let Some(ref cb) = callback

&& !cb.is(vm.ctx.types.none_type)

&& !cb.is_callable()

{

return Err(vm.new_type_error("sni_callback must be callable or None"));

}

*zelf.sni_callback.write() = callback;

Ok(())

}

#[pymethod]

fn set_servername_callback(

zelf: &Py<Self>,

callback: Option<PyObjectRef>,

vm: &VirtualMachine,

) -> PyResult<()> {

Self::set_sni_callback(zelf, callback, vm)

}

#[pygetset]

fn security_level(_zelf: &Py<Self>) -> i32 {

2

}

#[pygetset]

fn _msg_callback(zelf: &Py<Self>) -> Option<PyObjectRef> {

zelf.msg_callback.read().clone()

}

#[pygetset(setter)]

fn set__msg_callback(

zelf: &Py<Self>,

callback: Option<PyObjectRef>,

vm: &VirtualMachine,

) -> PyResult<()> {

if let Some(ref cb) = callback

&& !cb.is(vm.ctx.types.none_type)

&& !cb.is_callable()

{

return Err(vm.new_type_error("msg_callback must be callable or None"));

}

*zelf.msg_callback.write() = callback;

Ok(())

}

#[pygetset]

fn keylog_filename(zelf: &Py<Self>) -> Option<PyObjectRef> {

zelf.keylog_filename.read().clone()

}

#[pygetset(setter)]

fn set_keylog_filename(

zelf: &Py<Self>,

value: PySetterValue,

vm: &VirtualMachine,

) -> PyResult<()> {

let PySetterValue::Assign(value) = value else {

return Err(vm.new_attribute_error("attribute 'keylog_filename' cannot be deleted"));

};

if vm.is_none(&value) {

*zelf.keylog_filename.write() = None;

return Ok(());

}

*zelf.keylog_filename.write() = Some(value);

Ok(())

}

#[pymethod]

fn _set_alpn_protocols(

zelf: &Py<Self>,

protos: ArgBytesLike,

vm: &VirtualMachine,

) -> PyResult<()> {

let bytes = protos.borrow_buf();

let alpn_list = parse_length_prefixed_alpn(&bytes, vm)?;

*zelf.alpn_protocols.write() = alpn_list;

Ok(())

}

#[pymethod]

fn set_default_verify_paths(_zelf: &Py<Self>, _vm: &VirtualMachine) -> PyResult<()> {

Ok(())

}

#[pymethod]

fn load_default_certs(_zelf: &Py<Self>, _vm: &VirtualMachine) -> PyResult<()> {

Ok(())

}

#[pymethod]

fn load_verify_locations(

_zelf: &Py<Self>,

args: LoadVerifyLocationsArgs,

vm: &VirtualMachine,

) -> PyResult<()> {

let has_cafile = args.cafile.is_some();

let has_capath = args.capath.is_some();

let has_cadata = args.cadata.is_some();

if !has_cafile && !has_capath && !has_cadata {

return Err(vm.new_type_error("cafile, capath and cadata cannot be all omitted"));

}

Ok(())

}

#[pymethod]

fn load_cert_chain(_zelf: &Py<Self>, _args: FuncArgs, vm: &VirtualMachine) -> PyResult<()> {

ssl_error(vm, UNAVAILABLE)

}

#[pymethod]

fn set_ciphers(

_zelf: &Py<Self>,

_ciphers: PyUtf8StrRef,

vm: &VirtualMachine,

) -> PyResult<()> {

ssl_error(vm, UNAVAILABLE)

}

#[pymethod]

fn set_ecdh_curve(

_zelf: &Py<Self>,

_name: PyUtf8StrRef,

vm: &VirtualMachine,

) -> PyResult<()> {

ssl_error(vm, UNAVAILABLE)

}

#[pymethod]

fn load_dh_params(

_zelf: &Py<Self>,

_filepath: PyObjectRef,

vm: &VirtualMachine,

) -> PyResult<()> {

ssl_error(vm, UNAVAILABLE)

}

#[pymethod]

fn get_ciphers(_zelf: &Py<Self>, vm: &VirtualMachine) -> PyResult<PyObjectRef> {

Ok(vm.ctx.new_list(Vec::new()).into())

}

#[pymethod]

fn get_ca_certs(

_zelf: &Py<Self>,

args: GetCertArgs,

vm: &VirtualMachine,

) -> PyResult<PyObjectRef> {

let _ = args.binary_form;

Ok(vm.ctx.new_list(Vec::new()).into())

}

#[pymethod]

fn cert_store_stats(_zelf: &Py<Self>, vm: &VirtualMachine) -> PyResult<PyObjectRef> {

let dict = vm.ctx.new_dict();

dict.set_item("x509", vm.ctx.new_int(0).into(), vm)?;

dict.set_item("crl", vm.ctx.new_int(0).into(), vm)?;

dict.set_item("x509_ca", vm.ctx.new_int(0).into(), vm)?;

Ok(dict.into())

}

#[pymethod]

fn session_stats(_zelf: &Py<Self>, vm: &VirtualMachine) -> PyResult<PyObjectRef> {

let dict = vm.ctx.new_dict();

dict.set_item("number", vm.ctx.new_int(0).into(), vm)?;

dict.set_item("connect", vm.ctx.new_int(0).into(), vm)?;

dict.set_item("connect_good", vm.ctx.new_int(0).into(), vm)?;

dict.set_item("connect_renegotiate", vm.ctx.new_int(0).into(), vm)?;

dict.set_item("accept", vm.ctx.new_int(0).into(), vm)?;

dict.set_item("accept_good", vm.ctx.new_int(0).into(), vm)?;

dict.set_item("accept_renegotiate", vm.ctx.new_int(0).into(), vm)?;

dict.set_item("hits", vm.ctx.new_int(0).into(), vm)?;

dict.set_item("misses", vm.ctx.new_int(0).into(), vm)?;

dict.set_item("timeouts", vm.ctx.new_int(0).into(), vm)?;

dict.set_item("cache_full", vm.ctx.new_int(0).into(), vm)?;

Ok(dict.into())

}

#[pymethod]

fn _wrap_socket(

_zelf: &Py<Self>,

_args: FuncArgs,

vm: &VirtualMachine,

) -> PyResult<PyObjectRef> {

ssl_error(vm, UNAVAILABLE)

}

#[pymethod]

fn _wrap_bio(

zelf: &Py<Self>,

args: WrapBioArgs,

vm: &VirtualMachine,

) -> PyResult<PyObjectRef> {

let server_side = args.server_side.map_or(false, ArgIntoBool::into_bool);

if let Some(hostname) = args.server_hostname {

validate_hostname(hostname.as_str(), vm)?;

}

if server_side && zelf.protocol == PROTOCOL_TLS_CLIENT {

return ssl_error(

vm,

"Cannot create a server socket with a PROTOCOL_TLS_CLIENT context",

);

}

if !server_side && zelf.protocol == PROTOCOL_TLS_SERVER {

return ssl_error(

vm,

"Cannot create a client socket with a PROTOCOL_TLS_SERVER context",

);

}

ssl_error(vm, UNAVAILABLE)

}

}

impl Representable for PySSLContext {

#[inline]

fn repr_str(zelf: &Py<Self>, _vm: &VirtualMachine) -> PyResult<String> {

Ok(format!("<SSLContext(protocol={})>", zelf.protocol))

}

}

impl Constructor for PySSLContext {

type Args = (i32,);

fn py_new(

_cls: &Py<PyType>,

(protocol,): Self::Args,

vm: &VirtualMachine,

) -> PyResult<Self> {

let deprecated_protocol = match protocol {

PROTOCOL_TLS => Some("PROTOCOL_TLS"),

PROTOCOL_TLSv1_2 => Some("PROTOCOL_TLSv1_2"),

PROTOCOL_TLS_CLIENT | PROTOCOL_TLS_SERVER | PROTOCOL_TLSv1_3 => None,

PROTOCOL_TLSv1 | PROTOCOL_TLSv1_1 => {

return Err(vm.new_value_error(

"TLS 1.0 and 1.1 are not supported by rustls for security reasons",

));

}

_ => {

return Err(vm.new_value_error(format!("invalid protocol version: {protocol}")));

}

};

if let Some(protocol_name) = deprecated_protocol {

_warnings::warn(

vm.ctx.exceptions.deprecation_warning,

format!("ssl.{protocol_name} is deprecated"),

2,

vm,

)?;

}

let default_options = OP_ALL

| OP_NO_SSLv2

| OP_NO_SSLv3

| OP_NO_COMPRESSION

| OP_CIPHER_SERVER_PREFERENCE

| OP_SINGLE_DH_USE

| OP_SINGLE_ECDH_USE

| OP_ENABLE_MIDDLEBOX_COMPAT;

let default_verify_mode = if protocol == PROTOCOL_TLS_CLIENT {

CERT_REQUIRED

} else {

CERT_NONE

};

let (min_version, max_version) = match protocol {

PROTOCOL_TLSv1_2 => (PROTO_TLSv1_2, PROTO_TLSv1_2),

PROTOCOL_TLSv1_3 => (PROTO_TLSv1_3, PROTO_TLSv1_3),

_ => (PROTO_MINIMUM_SUPPORTED, PROTO_MAXIMUM_SUPPORTED),

};

Ok(Self {

protocol,

check_hostname: PyRwLock::new(protocol == PROTOCOL_TLS_CLIENT),

host_flags: PyRwLock::new(0),

verify_mode: PyRwLock::new(default_verify_mode),

verify_flags: PyRwLock::new(VERIFY_DEFAULT | VERIFY_X509_TRUSTED_FIRST),

options: PyRwLock::new(default_options),

alpn_protocols: PyRwLock::new(Vec::new()),

post_handshake_auth: PyRwLock::new(false),

num_tickets: PyRwLock::new(2),

minimum_version: PyRwLock::new(min_version),

maximum_version: PyRwLock::new(max_version),

sni_callback: PyRwLock::new(None),

msg_callback: PyRwLock::new(None),

keylog_filename: PyRwLock::new(None),

})

}

}

#[derive(FromArgs)]

struct GetCertArgs {

#[pyarg(any, optional)]

binary_form: OptionalArg<ArgIntoBool>,

}

#[derive(FromArgs)]

struct LoadVerifyLocationsArgs {

#[pyarg(any, optional)]

cafile: Option<PyObjectRef>,

#[pyarg(any, optional)]

capath: Option<PyObjectRef>,

#[pyarg(any, optional)]

cadata: Option<PyObjectRef>,

}

#[derive(FromArgs)]

struct WrapBioArgs {

#[allow(dead_code)]

incoming: PyRef<PyMemoryBIO>,

#[allow(dead_code)]

outgoing: PyRef<PyMemoryBIO>,

#[pyarg(named, optional)]

server_side: OptionalArg<ArgIntoBool>,

#[pyarg(named, optional)]

server_hostname: Option<PyUtf8StrRef>,

#[pyarg(named, optional)]

#[allow(dead_code)]

owner: OptionalArg<PyObjectRef>,

#[pyarg(named, optional)]

#[allow(dead_code)]

session: OptionalArg<PyObjectRef>,

}

#[pyattr]

#[pyclass(name = "MemoryBIO", module = "_ssl")]

#[derive(Debug, PyPayload)]

struct PyMemoryBIO {

inner: PyMutex<rustpython_host_env::ssl::MemoryBio>,

}

#[pyclass(with(Constructor, Representable), flags(BASETYPE))]

impl PyMemoryBIO {

#[pymethod]

fn read(

zelf: &Py<Self>,

len: OptionalArg<i32>,

vm: &VirtualMachine,

) -> PyResult<PyBytesRef> {

let mut bio = zelf.inner.lock();

let read_len = match len {

OptionalArg::Present(n) if n >= 0 => n as usize,

OptionalArg::Present(_) | OptionalArg::Missing => bio.pending(),

};

Ok(vm.ctx.new_bytes(bio.read(read_len)))

}

#[pymethod]

fn write(zelf: &Py<Self>, buf: PyObjectRef, vm: &VirtualMachine) -> PyResult<usize> {

if let Ok(mem_view) = buf.get_attr("c_contiguous", vm) {

let is_contiguous: bool = mem_view.try_to_bool(vm)?;

if !is_contiguous {

return Err(vm.new_buffer_error("non-contiguous buffer is not supported"));

}

}

let bytes_like = ArgBytesLike::try_from_object(vm, buf)?;

let data = bytes_like.borrow_buf();

zelf.inner.lock().write(&data).map_err(|err| {

vm.new_os_subtype_error(

PySSLError::class(&vm.ctx).to_owned(),

None,

err.to_string(),

)

.upcast()

})

}

#[pymethod]

fn write_eof(zelf: &Py<Self>, _vm: &VirtualMachine) {

zelf.inner.lock().write_eof();

}

#[pygetset]

fn pending(zelf: &Py<Self>) -> i32 {

zelf.inner.lock().pending() as i32

}

#[pygetset]

fn eof(zelf: &Py<Self>) -> bool {

zelf.inner.lock().eof()

}

}

impl Representable for PyMemoryBIO {

#[inline]

fn repr_str(_zelf: &Py<Self>, _vm: &VirtualMachine) -> PyResult<String> {

Ok("<MemoryBIO>".to_owned())

}

}

impl Constructor for PyMemoryBIO {

type Args = ();

fn py_new(_cls: &Py<PyType>, _args: Self::Args, _vm: &VirtualMachine) -> PyResult<Self> {

Ok(Self {

inner: PyMutex::new(rustpython_host_env::ssl::MemoryBio::new()),

})

}

}

#[pyattr]

#[pyclass(name = "SSLSession", module = "_ssl", unhashable = true)]

#[derive(Debug, PyPayload)]

struct PySSLSession {

session_id: Vec<u8>,

lifetime: u64,

has_ticket: bool,

}