atomicshop 3.3.8__py3-none-any.whl → 3.10.0__py3-none-any.whl

atomicshop/wrappers/socketw/creator.py

@@ -2,7 +2,7 @@ import os
 import socket
 import ssl
 
-from . import base, exception_wrapper
+from . import socket_base, exception_wrapper
 from ...print_api import print_api
 
 
@@ -25,28 +25,63 @@ def add_reusable_address_option(socket_instance):
     socket_instance.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
 
 
-def create_ssl_context_for_server() -> ssl.SSLContext:
+def create_ssl_context_for_server(
+        enable_sslkeylogfile_env_to_client_ssl_context: bool = False,
+        sslkeylog_file_path: str = None,
+        allow_legacy: bool = False
+) -> ssl.SSLContext:
+    """
+    This function creates the SSL context for the server.
+    Meaning that your script will act like a server, and the client will connect to it.
+    """
     # Creating context with SSL certificate and the private key before the socket
     # https://docs.python.org/3/library/ssl.html
     # Creating context for SSL wrapper, specifying "PROTOCOL_TLS_SERVER" will pick the best TLS version protocol for
     # the server.
 
-    ssl_context: ssl.SSLContext = ssl.create_default_context(ssl.Purpose.CLIENT_AUTH)
+    # ssl_context: ssl.SSLContext = ssl.create_default_context(ssl.Purpose.CLIENT_AUTH)
 
     # # Enforce the use of TLS 1.2 only (disable TLS 1.0, TLS 1.1, and TLS 1.3)
     # ssl_context.options |= ssl.OP_NO_TLSv1           # Disable TLS 1.0
     # ssl_context.options |= ssl.OP_NO_TLSv1_1         # Disable TLS 1.1
     # ssl_context.options |= ssl.OP_NO_TLSv1_3         # Disable TLS 1.3
 
-    # return ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
+    # Correct factory for servers
+    ssl_context: ssl.SSLContext = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
+
+    # Modern default; relax only if you must
+    ssl_context.minimum_version = ssl.TLSVersion.TLSv1_2
+
+    # Don't verify client certificates.
+    ssl_context.verify_mode = ssl.CERT_NONE
+    ssl_context.check_hostname = False
+
+    if enable_sslkeylogfile_env_to_client_ssl_context:
+        if sslkeylog_file_path is None:
+            sslkeylog_file_path = os.environ.get('SSLKEYLOGFILE')
+
+        if not os.path.exists(sslkeylog_file_path):
+            open(sslkeylog_file_path, "a").close()
+
+        ssl_context.keylog_filename = sslkeylog_file_path
+
+    # If you must support old clients that only offer TLS_RSA_* suites under OpenSSL 3:
+    if allow_legacy:
+        # This enables RSA key exchange and other legacy bits at security level 1
+        ssl_context.set_ciphers('DEFAULT:@SECLEVEL=1')
+        # If you truly have TLS 1.0/1.1 clients, uncomment the next line (not recommended):
+        ssl_context.minimum_version = ssl.TLSVersion.TLSv1
+
     return ssl_context
 
 
 def create_ssl_context_for_client(
-        enable_sslkeylogfile_env_to_client_ssl_context: bool = False
+        enable_sslkeylogfile_env_to_client_ssl_context: bool = False,
+        sslkeylog_file_path: str = None
 ) -> ssl.SSLContext:
     """
     This function creates the SSL context for the client.
+    This means that your script will act like a client, and will connect to a server.
     The SSL context is created with the "PROTOCOL_TLS_CLIENT" protocol.
 
     :param enable_sslkeylogfile_env_to_client_ssl_context: boolean, enables the SSLKEYLOGFILE environment variable
@@ -56,15 +91,23 @@ def create_ssl_context_for_client(
         This is useful for debugging SSL/TLS connections with WireShark.
         Since WireShark also uses this environment variable to read the key log file and apply to the SSL/TLS
         connections, so you can see the decrypted traffic.
+    :param sslkeylog_file_path: string, full file path for the SSL key log file. Default is None.
 
     :return: ssl.SSLContext
     """
     ssl_context: ssl.SSLContext = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
 
     if enable_sslkeylogfile_env_to_client_ssl_context:
-        ssl_key_logfile = os.environ.get('SSLKEYLOGFILE')
-        if ssl_key_logfile:
-            ssl_context.keylog_filename = ssl_key_logfile
+        if sslkeylog_file_path is None:
+            sslkeylog_file_path = os.environ.get('SSLKEYLOGFILE')
+
+        if not os.path.exists(sslkeylog_file_path):
+            open(sslkeylog_file_path, "a").close()
+
+        ssl_context.keylog_filename = sslkeylog_file_path
+
+    current_ciphers = 'AES256-GCM-SHA384:' + ssl._DEFAULT_CIPHERS
+    ssl_context.set_ciphers(current_ciphers)
 
     return ssl_context
 
@@ -138,9 +181,48 @@ def load_certificate_and_key_into_server_ssl_context(
             print_api(message, error_type=True, logger_method="critical", **print_kwargs)
 
 
-def create_server_ssl_context___load_certificate_and_key(certificate_file_path: str, key_file_path) -> ssl.SSLContext:
+def copy_server_ctx_settings(src: ssl.SSLContext, dst: ssl.SSLContext) -> None:
+    # Versions & options
+    try: dst.minimum_version = src.minimum_version
+    except Exception: pass
+    try: dst.maximum_version = src.maximum_version
+    except Exception: pass
+    try: dst.options = src.options
+    except Exception: pass
+
+    # Verification knobs (server usually CERT_NONE unless you do mTLS)
+    try: dst.verify_mode = src.verify_mode
+    except Exception: pass
+    try: dst.check_hostname = src.check_hostname
+    except Exception: pass
+
+    # Cipher policy – replicate current enabled list
+    try:
+        cipher_names = ':'.join(c['name'] for c in src.get_ciphers())
+        if cipher_names:
+            dst.set_ciphers(cipher_names)
+    except Exception:
+        pass
+
+    # (ALPN/curves/etc. don’t have public getters; set them the same way you set them on src, if applicable)
+
+
+def create_server_ssl_context___load_certificate_and_key(
+        certificate_file_path: str,
+        key_file_path: str | None,
+        inherit_from: ssl.SSLContext | None = None,
+        enable_sslkeylogfile_env_to_client_ssl_context: bool = False,
+        sslkeylog_file_path: str = None,
+) -> ssl.SSLContext:
     # Create and set ssl context for server.
-    ssl_context: ssl.SSLContext = create_ssl_context_for_server()
+    ssl_context: ssl.SSLContext = create_ssl_context_for_server(
+        allow_legacy=True, enable_sslkeylogfile_env_to_client_ssl_context=enable_sslkeylogfile_env_to_client_ssl_context,
+        sslkeylog_file_path=sslkeylog_file_path)
+
+    # If you replaced contexts during SNI, copy policy from the old one
+    if inherit_from is not None:
+        copy_server_ctx_settings(inherit_from, ssl_context)
+
     # Load certificate into context.
     load_certificate_and_key_into_server_ssl_context(ssl_context, certificate_file_path, key_file_path)
     # Return ssl context only.
@@ -231,7 +313,7 @@ def set_listen_on_socket(socket_object, **kwargs):
     # To determine the maximum listening sockets, you may use the 'socket' library and 'SOMAXCONN' parameter
     # from it.
     socket_object.listen(socket.SOMAXCONN)
-    ip_address, port = base.get_destination_address_from_socket(socket_object)
+    ip_address, port = socket_base.get_destination_address_from_socket(socket_object)
 
     print_api(f"Listening for new connections on: {ip_address}:{port}", **kwargs)
 
@@ -243,8 +325,9 @@ def wrap_socket_with_ssl_context_client___default_certs___ignore_verification(
         socket_object,
         server_hostname: str = None,
         custom_pem_client_certificate_file_path: str = None,
-        enable_sslkeylogfile_env_to_client_ssl_context: bool = False
-):
+        enable_sslkeylogfile_env_to_client_ssl_context: bool = False,
+        sslkeylog_file_path: str = None
+) -> ssl.SSLSocket:
     """
     This function is a preset for wrapping the socket with SSL context for the client.
     It sets the CA default certificates, and ignores the server's certificate verification.
@@ -255,9 +338,13 @@ def wrap_socket_with_ssl_context_client___default_certs___ignore_verification(
         Default is None.
     :param enable_sslkeylogfile_env_to_client_ssl_context: boolean, enables the SSLKEYLOGFILE environment variable
         to the SSL context. Default is False.
+    :param sslkeylog_file_path: string, full file path for the SSL key log file. Default is None.
+
+    :return: ssl.SSLSocket object
     """
     ssl_context: ssl.SSLContext = create_ssl_context_for_client(
-        enable_sslkeylogfile_env_to_client_ssl_context=enable_sslkeylogfile_env_to_client_ssl_context)
+        enable_sslkeylogfile_env_to_client_ssl_context=enable_sslkeylogfile_env_to_client_ssl_context
+        ,sslkeylog_file_path=sslkeylog_file_path)
     set_client_ssl_context_ca_default_certs(ssl_context)
     set_client_ssl_context_certificate_verification_ignore(ssl_context)
 

atomicshop/wrappers/socketw/dns_server.py

@@ -13,6 +13,7 @@ from ..loggingw import loggingw
 from ..psutilw import psutil_networks
 from ...basics import booleans, tracebacks
 from ...file_io import csvs
+from ... import networks
 
 # noinspection PyPackageRequirements
 import dnslib
@@ -302,6 +303,17 @@ class DnsServer:
             time.sleep(1)
             raise DnsConfigurationValuesError(e)
 
+        # If the listening interface is not localhost, check if the interface can be bound to.
+        if not self.listening_interface.startswith('127.'):
+            host_ips: list[str] = networks.get_host_ips_psutil(ipv6=False)
+            if self.listening_interface not in host_ips:
+                message = (f"Listening interface [{self.listening_interface}] is not assigned to any of the host "
+                           f"network interfaces. Current host IPv4 addresses: {host_ips}")
+                print_api(f'DnsConfigurationValuesError: {str(message)}', error_type=True, color="red", logger=self.logger)
+                # Wait for the message to be printed and saved to file.
+                time.sleep(1)
+                raise DnsConfigurationValuesError(message)
+
         ips_ports: list[str] = [f'{self.listening_interface}:{self.listening_port}']
         port_in_use = psutil_networks.get_processes_using_port_list(ips_ports)
         if port_in_use:
@@ -466,7 +478,7 @@ class DnsServer:
                     dns_cached_request = False
                     # Check if the received data request from client is already in the cache
                     if client_data in self.dns_questions_to_answers_cache:
-                        # message = "!!! Question / Answer is already in the dictionary..."
+                        # message = "!!! Request / Response is already in the dictionary..."
                         # self.logger.info(message)
 
                         # Get the response from the cached answers list
@@ -549,7 +561,7 @@ class DnsServer:
                                                 f'{self.offline_route_ipv6}')
                                         )
 
-                                        message = f"!!! Question / Answer is in offline mode returning " \
+                                        message = f"!!! Request / Response is in offline mode returning " \
                                                   f"{self.offline_route_ipv6}."
                                         self.logger.info(message)
 
@@ -565,7 +577,7 @@ class DnsServer:
                                     elif qtype_string == "SRV" or qtype_string == "SOA" or qtype_string == "HTTPS":
                                         dns_built_response.add_answer(*RR.fromZone(self.offline_srv_answer))
 
-                                        message = f"!!! Question / Answer is in offline mode returning: " \
+                                        message = f"!!! Request / Response is in offline mode returning: " \
                                                   f"{self.offline_srv_answer}."
                                         self.logger.info(message)
                                     elif qtype_string == "ANY":
@@ -574,7 +586,7 @@ class DnsServer:
                                                          self.offline_route_domain)
                                         )
 
-                                        message = f"!!! Question / Answer is in offline mode returning " \
+                                        message = f"!!! Request / Response is in offline mode returning " \
                                                   f"{self.offline_route_domain}."
                                         self.logger.info(message)
                                     else:
@@ -584,7 +596,7 @@ class DnsServer:
                                                 " " + self.offline_route_ipv4)
                                         )
 
-                                        message = f"!!! Question / Answer is in offline mode returning " \
+                                        message = f"!!! Request / Response is in offline mode returning " \
                                                   f"{self.offline_route_ipv4}."
                                         self.logger.info(message)
                                 # Values error means in most cases that you create wrong response

atomicshop/wrappers/socketw/exception_wrapper.py

@@ -1,7 +1,7 @@
 import ssl
 import functools
 
-from . import base
+from . import socket_base
 from ...print_api import print_api
 from ...inspect_wrapper import get_target_function_default_args_and_combine_with_current
 
@@ -75,18 +75,25 @@ def connection_exception_decorator(function_name):
                 pass
             pass
         except ssl.SSLError as exception_object:
-            # Getting the exact reason of "ssl.SSLError"
-            if exception_object.reason == "HTTP_REQUEST":
-                message = f"Socket Accept: HTTP Request on SSL Socket: " \
-                          f"{base.get_source_destination(kwargs['socket_object'])}"
-                wrapper_handle_connection_exceptions.message = message
-                print_api(message, logger_method='error', traceback_string=True, oneline=True, **kwargs['print_kwargs'])
-            elif exception_object.reason == "TSV1_ALERT_UNKNOWN_CA":
-                message = f"Socket Accept: Check CA certificate on the client " \
-                          f"{base.get_source_destination(kwargs['socket_object'])}"
-                wrapper_handle_connection_exceptions.message = message
-                print_api(message, logger_method='error', traceback_string=True, oneline=True, **kwargs['print_kwargs'])
-            else:
+            excepted: bool = False
+            if getattr(exception_object, "reason", None):
+                # Getting the exact reason of "ssl.SSLError"
+                if exception_object.reason == "HTTP_REQUEST":
+                    message = f"Socket Accept: HTTP Request on SSL Socket: " \
+                              f"{socket_base.get_source_destination(kwargs['socket_object'])}"
+                    wrapper_handle_connection_exceptions.message = message
+                    print_api(message, logger_method='error', traceback_string=True, oneline=True, **kwargs['print_kwargs'])
+
+                    excepted = True
+                elif exception_object.reason == "TSV1_ALERT_UNKNOWN_CA":
+                    message = f"Socket Accept: Check CA certificate on the client " \
+                              f"{socket_base.get_source_destination(kwargs['socket_object'])}"
+                    wrapper_handle_connection_exceptions.message = message
+                    print_api(message, logger_method='error', traceback_string=True, oneline=True, **kwargs['print_kwargs'])
+
+                    excepted = True
+
+            if not excepted:
                 # Not all requests have the server name passed through Client Hello.
                 # If it is not passed an error of undefined variable will be raised.
                 # So, we'll check if the variable as a string is in the "locals()" variable pool.
@@ -102,21 +109,19 @@ def connection_exception_decorator(function_name):
                     f"Socket Accept: {domain_from_dns_server}:{port}: {message}"
                 wrapper_handle_connection_exceptions.message = message
                 print_api(message, logger_method='error', oneline=True, **kwargs['print_kwargs'])
-            pass
+
         except FileNotFoundError:
             message = "'SSLSocket.accept()' crashed: 'FileNotFoundError'. Some problem with SSL during Handshake - " \
                       "Could be certificate, client, or server."
             message = f"Socket Accept: {domain_from_dns_server}:{port}: {message}"
             wrapper_handle_connection_exceptions.message = message
             print_api(message, logger_method='error', traceback_string=True, oneline=True, **kwargs['print_kwargs'])
-            pass
         except Exception as e:
             _ = e
             message = "Undocumented exception on accept."
             message = f"Socket Accept: {domain_from_dns_server}:{port}: {message}"
             wrapper_handle_connection_exceptions.message = message
             print_api(message, logger_method='error', traceback_string=True, oneline=True, **kwargs['print_kwargs'])
-            pass
 
     wrapper_handle_connection_exceptions.message = None
     return wrapper_handle_connection_exceptions

atomicshop/wrappers/socketw/process_getter.py

@@ -0,0 +1,86 @@
+import logging
+
+from . import socket_base
+from ...print_api import print_api
+from ...ssh_remote import SSHRemote
+from ... import package_mains_processor
+
+
+GET_LOCALHOST_FUNCTION_NAME = 'find_cmdline_by_port'
+
+
+class GetCommandLine:
+    def __init__(
+            self,
+            client_ip: str,
+            client_port: int = None,
+            package_processor: package_mains_processor.PackageMainsProcessor = None,
+            ssh_client: SSHRemote = None,
+            logger: logging.Logger = None
+    ):
+        self.client_ip: str = client_ip
+        self.client_port: int = client_port
+        self.package_processor: package_mains_processor.PackageMainsProcessor = package_processor
+        self.ssh_client: SSHRemote = ssh_client
+        self.logger: logging.Logger = logger
+
+    def get_process_name(self, print_kwargs: dict = None):
+        if print_kwargs is None:
+            print_kwargs = {}
+
+        # Checking if we're on localhost. If not, we'll execute SSH connection to get calling process name.
+        if self.client_ip not in socket_base.THIS_DEVICE_IP_LIST:
+            # Tried using paramiko SSH concurrently within threads, but with bigger loads it just breaks.
+            # So, better using it separately for each thread.
+
+            print_api(f"Initializing SSH connection to [{self.client_ip}]", **print_kwargs)
+
+            script_string: str = self.package_processor.read_script_file_to_string()
+
+            execution_output, execution_error = self.ssh_client.connect_get_client_commandline(port=self.client_port, script_string=script_string)
+        # Else, if we're on localhost, then execute the script directly without SSH.
+        else:
+            print_api(f"Executing LOCALHOST command to get the calling process.", **print_kwargs)
+            # execution_output, execution_error, rc = self.package_processor.execute_script_with_subprocess(arguments=[str(client_port)])
+            execution_output = self.package_processor.execute_script_file(
+                function_name=GET_LOCALHOST_FUNCTION_NAME, args=(self.client_port,))
+            execution_error = None
+
+        # This section is generic for both remote SSH and localhost executions of the script.
+        process_name = self.get_commandline_and_error(execution_output, execution_error, print_kwargs=print_kwargs)
+
+        return process_name
+
+    @staticmethod
+    def get_commandline_and_error(
+            execution_output,
+            execution_error,
+            print_kwargs: dict = None
+    ):
+        # If there was known error on localhost / known error on remote or any kind of error on remote, it was
+        # already logged, so we'll just put the error into 'process_name'.
+        if execution_error:
+            process_name = execution_error
+            print_api(
+                f"Error During Command Execution: {process_name}", error_type=True,
+                logger_method='error', **(print_kwargs or {}))
+        # If there wasn't any error of above types, then we can put the output from either local or remote script
+        # execution into 'process_name' and log it / output to console.
+        else:
+            # If the output that was returned is not empty.
+            if execution_output:
+                # Replacing '\r\n' escape lines with string, so that the line will not be escaped in logs.
+                if '\r\n' in execution_output:
+                    execution_output = execution_output.replace('\r\n', '')
+                elif '\n' in execution_output:
+                    execution_output = execution_output.replace('\n', '')
+
+                process_name = execution_output
+                print_api(f"Client Process Command Line: {process_name}", **(print_kwargs or {}))
+            # Else if the script output came back empty.
+            else:
+                process_name = ''
+                message = "Client Process Command Line came back empty after script execution."
+                print_api(message, error_type=True, logger_method='error', **(print_kwargs or {}))
+
+        return process_name

atomicshop/wrappers/socketw/receiver.py

@@ -1,26 +1,44 @@
 import logging
 import socket
 import ssl
-import time
 
 import select
 from pathlib import Path
 
 from ...print_api import print_api
+from ...basics import tracebacks
 from ..loggingw import loggingw
 
 
-def peek_first_bytes(client_socket, bytes_amount: int = 1) -> bytes:
+def peek_first_bytes(
+        client_socket,
+        bytes_amount: int = 1,
+        timeout: float = None
+) -> bytes:
     """
     Peek first byte from the socket without removing it from the buffer.
 
     :param client_socket: Socket object.
     :param bytes_amount: Amount of bytes to peek.
+    :param timeout: float, Timeout in seconds.
 
     :return: the first X bytes from the socket buffer.
     """
 
-    return client_socket.recv(bytes_amount, socket.MSG_PEEK)
+    error: bool = False
+    client_socket.settimeout(timeout)
+
+    try:
+        peek_a_bytes: bytes = client_socket.recv(bytes_amount, socket.MSG_PEEK)
+    except socket.timeout:
+        error = True
+    finally:
+        client_socket.settimeout(None)
+
+    if error:
+        raise TimeoutError
+
+    return peek_a_bytes
 
 
 def is_socket_ready_for_read(socket_instance, timeout: float = 0) -> bool:
@@ -93,14 +111,16 @@ class Receiver:
             # A signal to close connection will be empty bytes string: b''.
             received_data = self.ssl_socket.recv(self.buffer_size_receive)
         except ConnectionAbortedError:
-            error_message = "ConnectionAbortedError: * Connection was aborted by the other side..."
-            print_api(error_message, logger=self.logger, logger_method='critical', traceback_string=False)
+            error_message = "ConnectionAbortedError: Connection was aborted by local TCP stack (not remote close)..."
         except ConnectionResetError:
-            error_message = "ConnectionResetError: * Connection was forcibly closed by the other side..."
-            print_api(error_message, logger=self.logger, logger_method='critical', traceback_string=False)
+            error_message = "ConnectionResetError: Connection was forcibly closed by the other side..."
+        except TimeoutError as e:
+            if e.errno == 10060:
+                error_message = "TimeoutError: [WinError 10060] Socket receive operation timed out..."
+            else:
+                raise e
         except ssl.SSLError:
-            error_message = "ssl.SSLError: * Encountered SSL error on receive..."
-            print_api(error_message, logger=self.logger, logger_method='critical', traceback_string=True)
+            error_message = f"ssl.SSLError: Encountered SSL error on receive...\n{tracebacks.get_as_string()}"
 
         if received_data == b'':
             self.logger.info("Empty message received, socket closed on the other side.")

atomicshop/wrappers/socketw/sender.py

@@ -1,3 +1,4 @@
+import socket
 import ssl
 import logging
 from pathlib import Path
@@ -6,18 +7,18 @@ from ...print_api import print_api
 from ..loggingw import loggingw
 from ...basics import tracebacks
 
-from . import base
+from . import socket_base
 
 
 class Sender:
     def __init__(
             self,
-            ssl_socket: ssl.SSLSocket,
-            class_message: bytes,
+            ssl_socket: ssl.SSLSocket | socket.socket,
+            bytes_to_send: bytes,
             logger: logging.Logger = None
     ):
-        self.class_message: bytes = class_message
-        self.ssl_socket: ssl.SSLSocket = ssl_socket
+        self.bytes_to_send: bytes = bytes_to_send
+        self.ssl_socket: ssl.SSLSocket | socket.socket = ssl_socket
 
         if logger:
             # Create child logger for the provided logger with the module's name.
@@ -42,7 +43,7 @@ class Sender:
 
         try:
             # Getting byte length of current message
-            current_message_length = len(self.class_message)
+            current_message_length = len(self.bytes_to_send)
 
             self.logger.info(
                 f"Sending message to "
@@ -51,7 +52,7 @@ class Sender:
             # Looping through "socket.send()" method while total sent bytes are less than message length
             while total_sent_bytes < current_message_length:
                 # Sending the message and getting the amount of bytes sent
-                sent_bytes = self.ssl_socket.send(self.class_message[total_sent_bytes:])
+                sent_bytes = self.ssl_socket.send(self.bytes_to_send[total_sent_bytes:])
                 # If there were only "0" bytes sent, then connection on the other side was terminated
                 if sent_bytes == 0:
                     error_message = (
@@ -61,13 +62,13 @@ class Sender:
                     break
 
                 # Adding amount of currently sent bytes to the total amount of bytes sent
-                total_sent_bytes = total_sent_bytes + sent_bytes
+                total_sent_bytes += sent_bytes
                 self.logger.info(f"Sent {total_sent_bytes} bytes out of {current_message_length}")
 
             # At this point the sending loop finished successfully
             self.logger.info(f"Sent the message to destination.")
         except Exception as e:
-            source_tuple, destination_tuple = base.get_source_destination(self.ssl_socket)
+            source_tuple, destination_tuple = socket_base.get_source_destination(self.ssl_socket)
             source_address, source_port = source_tuple
             destination_address, destination_port = destination_tuple
             if self.ssl_socket.server_hostname:

atomicshop/wrappers/socketw/sni.py

@@ -47,7 +47,9 @@ class SNISetup:
             tls: bool,
             domain_from_dns_server: str = None,
             skip_extension_id_list: list = None,
-            exceptions_logger: loggingw.ExceptionCsvLogger = None
+            exceptions_logger: loggingw.ExceptionCsvLogger = None,
+            enable_sslkeylogfile_env_to_client_ssl_context: bool = False,
+            sslkeylog_file_path: str = None
     ):
         self.ca_certificate_name = ca_certificate_name
         self.ca_certificate_filepath = ca_certificate_filepath
@@ -73,8 +75,9 @@ class SNISetup:
         self.skip_extension_id_list = skip_extension_id_list
         self.tls = tls
         self.exceptions_logger = exceptions_logger
-
         self.certificator_instance = None
+        self.enable_sslkeylogfile_env_to_client_ssl_context: bool = enable_sslkeylogfile_env_to_client_ssl_context
+        self.sslkeylog_file_path: str = sslkeylog_file_path
 
     def wrap_socket_with_ssl_context_server_sni_extended(
             self,
@@ -83,7 +86,9 @@ class SNISetup:
     ):
 
         # Create SSL Socket to wrap the raw socket with.
-        ssl_context: ssl.SSLContext = creator.create_ssl_context_for_server()
+        ssl_context: ssl.SSLContext = creator.create_ssl_context_for_server(
+            allow_legacy=True, enable_sslkeylogfile_env_to_client_ssl_context=self.enable_sslkeylogfile_env_to_client_ssl_context,
+            sslkeylog_file_path=self.sslkeylog_file_path)
 
         self.certificator_instance = certificator.Certificator(
             ca_certificate_name=self.ca_certificate_name,
@@ -102,7 +107,9 @@ class SNISetup:
             forwarding_dns_service_ipv4_list___only_for_localhost=(
                 self.forwarding_dns_service_ipv4_list___only_for_localhost),
             skip_extension_id_list=self.skip_extension_id_list,
-            tls=self.tls
+            tls=self.tls,
+            enable_sslkeylogfile_env_to_client_ssl_context=self.enable_sslkeylogfile_env_to_client_ssl_context,
+            sslkeylog_file_path=self.sslkeylog_file_path
         )
 
         # Add SNI callback function to the SSL context.
@@ -150,7 +157,8 @@ class SNISetup:
         # The function is actually called at "accept()" method of the "ssl.SSLSocket"
         # This needs to be set only once on the listening socket
         if self.sni_custom_callback_function:
-            ssl_context.sni_callback = self.sni_custom_callback_function
+            # ssl_context.sni_callback = self.sni_custom_callback_function
+            ssl_context.set_servername_callback(self.sni_custom_callback_function)
 
         if self.sni_use_default_callback_function:
             sni_handler_instance = SNIHandler(
@@ -160,8 +168,10 @@ class SNISetup:
                 certificator_instance=self.certificator_instance,
                 domain_from_dns_server=self.domain_from_dns_server,
                 default_certificate_domain_list=self.default_certificate_domain_list,
-                exceptions_logger=self.exceptions_logger
-            )
+                exceptions_logger=self.exceptions_logger,
+                enable_sslkeylogfile_env_to_client_ssl_context=(
+                    self.certificator_instance.enable_sslkeylogfile_env_to_client_ssl_context),
+                sslkeylog_file_path=self.certificator_instance.sslkeylog_file_path)
             ssl_context.set_servername_callback(
                 sni_handler_instance.setup_sni_callback(print_kwargs=print_kwargs))
 
@@ -179,7 +189,9 @@ class SNIHandler:
             certificator_instance: certificator.Certificator,
             domain_from_dns_server: str,
             default_certificate_domain_list: list,
-            exceptions_logger: loggingw.ExceptionCsvLogger
+            exceptions_logger: loggingw.ExceptionCsvLogger,
+            enable_sslkeylogfile_env_to_client_ssl_context: bool,
+            sslkeylog_file_path: str
     ):
         self.sni_use_default_callback_function_extended = sni_use_default_callback_function_extended
         self.sni_add_new_domains_to_default_server_certificate = sni_add_new_domains_to_default_server_certificate
@@ -188,6 +200,8 @@ class SNIHandler:
         self.domain_from_dns_server: str = domain_from_dns_server
         self.default_certificate_domain_list = default_certificate_domain_list
         self.exceptions_logger = exceptions_logger
+        self.enable_sslkeylogfile_env_to_client_ssl_context: bool = enable_sslkeylogfile_env_to_client_ssl_context
+        self.sslkeylog_file_path: str = sslkeylog_file_path
 
         # noinspection PyTypeChecker
         self.sni_received_parameters: SNIReceivedParameters = None
@@ -322,8 +336,15 @@ class SNIHandler:
                 # Since new default certificate was created we need to create new SSLContext and add the certificate.
                 # You need to build new context and exchange the context that being inherited from the main socket,
                 # or else the context will receive previous certificate each time.
-                self.sni_received_parameters.ssl_socket.context = \
-                    creator.create_server_ssl_context___load_certificate_and_key(default_server_certificate_path, None)
+                self.sni_received_parameters.ssl_socket.context = (
+                    creator.create_server_ssl_context___load_certificate_and_key(
+                        default_server_certificate_path,
+                        None,
+                        inherit_from=self.sni_received_parameters.ssl_socket.context,
+                        enable_sslkeylogfile_env_to_client_ssl_context=self.enable_sslkeylogfile_env_to_client_ssl_context,
+                        sslkeylog_file_path=self.sslkeylog_file_path
+                    )
+                )
             else:
                 message = f"Couldn't create / overwrite Default Server Certificate: {default_server_certificate_path}"
                 raise SNIDefaultCertificateCreationError(message)