ssl2 1.1.0__tar.gz → 2.0.0__tar.gz

{ssl2-1.1.0 → ssl2-2.0.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: ssl2
-Version: 1.1.0
+Version: 2.0.0
 Summary: PEP 748 TLS interface: typed ClientHello model and parser, JA3, JA4 and Akamai fingerprints, proxies, sockets and asyncio streams
 Requires-Python: >=3.14
 Project-URL: Repository, https://github.com/baobien-dev/ssl2
@@ -126,7 +126,7 @@ print(JA3.parse(JA3.of(chrome).text) == JA3.of(chrome))  # True
 
 `JA3.builder()` starts a `ClientHelloBuilder` from the JA3 fields; the payloads JA3 does not carry, such as signature schemes, key shares and ALPN, go in before `build()`.
 
-`.trust_anchor_ids("44947.2.1", ...)` lists the trust anchor identifiers of draft-ietf-tls-trust-anchor-ids in dotted form, which the parser reads back from the wire. `CHROME_TRUST_ANCHOR_IDS` is the 28 Chrome 155 requests, and `TrustAnchorIdentifier.encode` and `.decode` move between the dotted form and the wire bytes.
+`.trust_anchor_ids("44947.2.1", ...)` lists the trust anchor identifiers of draft-ietf-tls-trust-anchor-ids in dotted form, which the parser reads back from the wire. `TrustAnchorIdentifier.encode` and `.decode` move between the dotted form and the wire bytes.
 
 ## Configuration, credentials, trust
 
@@ -175,8 +175,8 @@ async def main() -> None:
 asyncio.run(main())
 ```
 
-`context` is an engine's `ClientContext`. A peer that drops TCP without close_notify reads as `b""`, the same default the `ssl` module has.
+`context` is an engine's `ClientContext`. A peer that drops TCP without close_notify reads as `b""`, the same default the `ssl` module has. On a direct connection, and behind an HTTP or SOCKS proxy, both hand the TCP socket to the engine through `TLSBuffer.attach`, so records move between the kernel and the TLS state without a stop in Python; behind an HTTPS proxy, or over any other `AsyncTransport`, the records go through the buffer's memory BIOs instead. A socket timeout applies to every wait.
 
 ## Writing an engine
 
-An engine implements `ClientContext`, `ServerContext` and `TLSBuffer` from `ssl2.interface` and exposes `TLSImplementation(ClientContext, ServerContext, validate_config)`. `TLSSocket` and `TLSStream` drive any such `TLSBuffer`; `SessionCache` stores what the engine records.
+An engine implements `ClientContext`, `ServerContext` and `TLSBuffer` from `ssl2.interface` and exposes `TLSImplementation(ClientContext, ServerContext, validate_config)`. `TLSSocket` and `TLSStream` drive any such `TLSBuffer`, through its memory BIOs or, when the buffer implements `attach(fileno)`, by handing it the socket; `getpeerchain()` returns the certificates the peer sent, leaf first. `SessionCache` stores what the engine records.

{ssl2-1.1.0 → ssl2-2.0.0}/README.md

@@ -118,7 +118,7 @@ print(JA3.parse(JA3.of(chrome).text) == JA3.of(chrome))  # True
 
 `JA3.builder()` starts a `ClientHelloBuilder` from the JA3 fields; the payloads JA3 does not carry, such as signature schemes, key shares and ALPN, go in before `build()`.
 
-`.trust_anchor_ids("44947.2.1", ...)` lists the trust anchor identifiers of draft-ietf-tls-trust-anchor-ids in dotted form, which the parser reads back from the wire. `CHROME_TRUST_ANCHOR_IDS` is the 28 Chrome 155 requests, and `TrustAnchorIdentifier.encode` and `.decode` move between the dotted form and the wire bytes.
+`.trust_anchor_ids("44947.2.1", ...)` lists the trust anchor identifiers of draft-ietf-tls-trust-anchor-ids in dotted form, which the parser reads back from the wire. `TrustAnchorIdentifier.encode` and `.decode` move between the dotted form and the wire bytes.
 
 ## Configuration, credentials, trust
 
@@ -167,8 +167,8 @@ async def main() -> None:
 asyncio.run(main())
 ```
 
-`context` is an engine's `ClientContext`. A peer that drops TCP without close_notify reads as `b""`, the same default the `ssl` module has.
+`context` is an engine's `ClientContext`. A peer that drops TCP without close_notify reads as `b""`, the same default the `ssl` module has. On a direct connection, and behind an HTTP or SOCKS proxy, both hand the TCP socket to the engine through `TLSBuffer.attach`, so records move between the kernel and the TLS state without a stop in Python; behind an HTTPS proxy, or over any other `AsyncTransport`, the records go through the buffer's memory BIOs instead. A socket timeout applies to every wait.
 
 ## Writing an engine
 
-An engine implements `ClientContext`, `ServerContext` and `TLSBuffer` from `ssl2.interface` and exposes `TLSImplementation(ClientContext, ServerContext, validate_config)`. `TLSSocket` and `TLSStream` drive any such `TLSBuffer`; `SessionCache` stores what the engine records.
+An engine implements `ClientContext`, `ServerContext` and `TLSBuffer` from `ssl2.interface` and exposes `TLSImplementation(ClientContext, ServerContext, validate_config)`. `TLSSocket` and `TLSStream` drive any such `TLSBuffer`, through its memory BIOs or, when the buffer implements `attach(fileno)`, by handing it the socket; `getpeerchain()` returns the certificates the peer sent, leaf first. `SessionCache` stores what the engine records.

{ssl2-1.1.0 → ssl2-2.0.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "ssl2"
-version = "1.1.0"
+version = "2.0.0"
 description = "PEP 748 TLS interface: typed ClientHello model and parser, JA3, JA4 and Akamai fingerprints, proxies, sockets and asyncio streams"
 readme = "README.md"
 requires-python = ">=3.14"
@@ -9,6 +9,9 @@ dependencies = []
 [project.urls]
 Repository = "https://github.com/baobien-dev/ssl2"
 
+[tool.basedpyright]
+typeCheckingMode = "strict"
+
 [build-system]
 requires = ["uv_build>=0.13.0,<0.14.0"]
 build-backend = "uv_build"

{ssl2-1.1.0 → ssl2-2.0.0}/pyproject.toml.orig

@@ -1,6 +1,6 @@
 [project]
 name = "ssl2"
-version = "1.1.0"
+version = "2.0.0"
 description = "PEP 748 TLS interface: typed ClientHello model and parser, JA3, JA4 and Akamai fingerprints, proxies, sockets and asyncio streams"
 readme = "README.md"
 requires-python = ">=3.14"
@@ -9,6 +9,9 @@ dependencies = []
 [project.urls]
 Repository = "https://github.com/baobien-dev/ssl2"
 
+[tool.basedpyright]
+typeCheckingMode = "strict"
+
 [build-system]
 requires = ["uv_build>=0.13.0,<0.14.0"]
 build-backend = "uv_build"

{ssl2-1.1.0 → ssl2-2.0.0}/src/ssl2/__init__.py

@@ -1,6 +1,11 @@
-from ssl2.asynchronous import AsyncTransport, StreamTransport, TLSStream
+from ssl2.asynchronous import (
+    AsyncTransport,
+    SocketTransport,
+    StreamTransport,
+    TLSStream,
+    Tunnel,
+)
 from ssl2.client_hello import (
-    CHROME_TRUST_ANCHOR_IDS,
     ClientHello,
     ClientHelloBuilder,
     ClientHelloParser,
@@ -59,7 +64,6 @@ from ssl2.parameters import (
 from ssl2.proxy import Proxy, ProxyCredentials, ProxyError, ProxyScheme
 
 __all__ = (
-    "CHROME_TRUST_ANCHOR_IDS",
     "JA3",
     "JA4",
     "AkamaiFingerprint",
@@ -97,6 +101,7 @@ __all__ = (
     "SessionCache",
     "SignatureScheme",
     "SigningChain",
+    "SocketTransport",
     "StreamTransport",
     "TLSBuffer",
     "TLSClientConfiguration",
@@ -109,6 +114,7 @@ __all__ = (
     "Transport",
     "TrustAnchorIdentifier",
     "TrustStore",
+    "Tunnel",
     "WantReadError",
     "WantWriteError",
 )

{ssl2-1.1.0 → ssl2-2.0.0}/src/ssl2/asynchronous.py

@@ -1,15 +1,16 @@
 import asyncio
 import socket
 from collections.abc import Callable, Generator
+from dataclasses import dataclass
 from functools import partial
-from typing import Final, Protocol, Self, cast, final
+from typing import Protocol, Self, cast
 
 from ssl2.errors import RaggedEOF, WantReadError, WantWriteError
 from ssl2.interface import RECEIVE_SIZE, ClientContext, ServerContext, TLSBuffer
 from ssl2.parameters import CipherSuite, NextProtocol, TLSVersion
 from ssl2.proxy import Proxy, ProxyError, ProxyScheme
 
-SHUTDOWN_TIMEOUT: Final = 5.0
+SHUTDOWN_TIMEOUT = 5.0
 
 
 class AsyncTransport(Protocol):
@@ -20,7 +21,6 @@ class AsyncTransport(Protocol):
     async def close(self) -> None: ...
 
 
-@final
 class StreamTransport:
     def __init__(
         self, reader: asyncio.StreamReader, writer: asyncio.StreamWriter
@@ -39,17 +39,67 @@ class StreamTransport:
         self._writer.close()
 
 
-@final
+class SocketTransport:
+    def __init__(self, sock: socket.socket) -> None:
+        self._socket = sock
+        self._loop = asyncio.get_running_loop()
+
+    @classmethod
+    async def connect(cls, address: tuple[str, int]) -> Self:
+        loop = asyncio.get_running_loop()
+        host, port = address
+        failure = OSError(f"{host}:{port} resolves to no address")
+        for family, kind, protocol, _, resolved in await loop.getaddrinfo(
+            host, port, type=socket.SOCK_STREAM
+        ):
+            sock = socket.socket(family, kind, protocol)
+            sock.setblocking(False)
+            sock.setsockopt(socket.IPPROTO_TCP, socket.TCP_NODELAY, 1)
+            try:
+                await loop.sock_connect(sock, resolved)
+            except OSError as error:
+                sock.close()
+                failure = error
+                continue
+            return cls(sock)
+        raise failure
+
+    @property
+    def socket(self) -> socket.socket:
+        return self._socket
+
+    async def read(self, limit: int) -> bytes:
+        return await self._loop.sock_recv(self._socket, limit)
+
+    async def write(self, data: bytes) -> None:
+        await self._loop.sock_sendall(self._socket, data)
+
+    async def close(self) -> None:
+        self._socket.close()
+
+
+@dataclass(frozen=True, slots=True)
+class Tunnel:
+    transport: AsyncTransport
+    leftover: bytes
+    # the TCP socket under the transport, when TLS can take it over; None behind a TLS hop
+    socket: socket.socket | None
+
+
 class TLSStream:
     def __init__(
         self,
         context: ClientContext | ServerContext,
         buffer: TLSBuffer,
         transport: AsyncTransport,
+        sock: socket.socket | None = None,
     ) -> None:
         self._context = context
         self._buffer = buffer
         self._transport = transport
+        # with a socket, BoringSSL reads and writes the kernel itself; without one the records go through the transport
+        self._socket = sock
+        self._loop = asyncio.get_running_loop()
 
     @classmethod
     async def connect(
@@ -61,33 +111,39 @@ class TLSStream:
         timeout: float | None = None,
     ) -> Self:
         async with asyncio.timeout(timeout):
-            transport, leftover = await cls.tunnel(context, address, proxy)
+            tunnel = await cls.tunnel(context, address, proxy)
             try:
+                buffer = context.create_buffer(address[0])
+                if tunnel.socket is not None and not tunnel.leftover:
+                    return await cls.open_socket(context, buffer, tunnel.socket)
                 return await cls.open(
-                    context, context.create_buffer(address[0]), transport, leftover
+                    context, buffer, tunnel.transport, tunnel.leftover
                 )
             except BaseException:
-                await transport.close()
+                await tunnel.transport.close()
                 raise
 
     @classmethod
     async def tunnel(
         cls, context: ClientContext, address: tuple[str, int], proxy: Proxy | None
-    ) -> tuple[AsyncTransport, bytes]:
+    ) -> Tunnel:
         if proxy is None:
-            return StreamTransport(*await asyncio.open_connection(*address)), b""
-        transport: AsyncTransport
+            direct = await SocketTransport.connect(address)
+            return Tunnel(direct, b"", direct.socket)
+        hop: AsyncTransport
+        sock: socket.socket | None
         if proxy.scheme is ProxyScheme.HTTPS:
-            transport = await cls.connect(context, (proxy.host, proxy.port))
+            hop = await cls.connect(context, (proxy.host, proxy.port))
+            sock = None
         else:
-            transport = StreamTransport(
-                *await asyncio.open_connection(proxy.host, proxy.port)
-            )
+            plain = await SocketTransport.connect((proxy.host, proxy.port))
+            hop, sock = plain, plain.socket
         try:
-            return transport, await cls._tunnel(proxy, address, transport)
+            leftover = await cls._tunnel(proxy, address, hop)
         except BaseException:
-            await transport.close()
+            await hop.close()
             raise
+        return Tunnel(hop, leftover, sock)
 
     @classmethod
     async def open(
@@ -103,6 +159,18 @@ class TLSStream:
         await self._run(buffer.do_handshake)
         return self
 
+    @classmethod
+    async def open_socket(
+        cls,
+        context: ClientContext | ServerContext,
+        buffer: TLSBuffer,
+        sock: socket.socket,
+    ) -> Self:
+        buffer.attach(sock.fileno())
+        self = cls(context, buffer, SocketTransport(sock), sock)
+        await self._run(buffer.do_handshake)
+        return self
+
     @property
     def context(self) -> ClientContext | ServerContext:
         return self._context
@@ -118,10 +186,9 @@ class TLSStream:
             return b""
 
     async def write(self, data: bytes) -> None:
-        view = memoryview(data)
-        while view:
-            written = await self._run(partial(self._buffer.write, view))
-            view = view[written:]
+        while data:
+            written = await self._run(partial(self._buffer.write, data))
+            data = data[written:]
 
     async def close(self) -> None:
         try:
@@ -196,15 +263,37 @@ class TLSStream:
             try:
                 result = operation()
             except WantReadError:
-                await self._flush()
-                await self._fill()
+                if self._socket is None:
+                    await self._flush()
+                    await self._fill()
+                else:
+                    await self._ready(self._loop.add_reader, self._loop.remove_reader)
                 continue
             except WantWriteError:
-                await self._flush()
+                if self._socket is None:
+                    await self._flush()
+                else:
+                    await self._ready(self._loop.add_writer, self._loop.remove_writer)
                 continue
-            await self._flush()
+            if self._socket is None:
+                await self._flush()
             return result
 
+    async def _ready(
+        self,
+        watch: Callable[[int, Callable[[], None]], object],
+        unwatch: Callable[[int], object],
+    ) -> None:
+        if self._socket is None:
+            return
+        fileno = self._socket.fileno()
+        waiter: asyncio.Future[None] = self._loop.create_future()
+        watch(fileno, lambda: None if waiter.done() else waiter.set_result(None))
+        try:
+            await waiter
+        finally:
+            unwatch(fileno)
+
     async def _flush(self) -> None:
         # one take of everything buffered: draining a memory BIO in small pieces moves the remainder each time
         while pending := self._buffer.outgoing_bytes_buffered():

{ssl2-1.1.0 → ssl2-2.0.0}/src/ssl2/client_hello.py

@@ -1,6 +1,6 @@
 from collections.abc import Iterable
 from dataclasses import dataclass, replace
-from typing import Final, Self, final
+from typing import Self
 
 from ssl2.parameters import (
     CertificateCompressionAlgorithm,
@@ -107,41 +107,9 @@ class ClientHello:
         return position == len(part)
 
 
-EMPTY_CLIENT_HELLO: Final = ClientHello(cipher_suites=(), extensions=())
-# the trust anchor identifiers Chrome 155 requests: its root store, in the dotted form of draft-ietf-tls-trust-anchor-ids
-CHROME_TRUST_ANCHOR_IDS: Final = (
-    "44947.2.1",
-    "44947.2.6",
-    "44947.2.13",
-    "44947.2.14",
-    "44947.2.15",
-    "44947.2.18",
-    "44947.2.19",
-    "44947.2.20",
-    "52580.200109.1.7",
-    "52580.200109.1.8",
-    "52580.200109.1.9",
-    "52580.200109.1.10",
-    "52580.200109.1.11",
-    "52580.200109.1.12",
-    "52580.200109.1.13",
-    "52580.200109.1.18",
-    "52580.200109.1.19",
-    "11129.9.1",
-    "11129.9.4",
-    "11129.9.5",
-    "11129.9.6",
-    "11129.9.7",
-    "11129.9.8",
-    "11129.9.10",
-    "11129.9.11",
-    "11129.9.12",
-    "11129.9.13",
-    "11129.9.15",
-)
+EMPTY_CLIENT_HELLO = ClientHello(cipher_suites=(), extensions=())
 
 
-@final
 class TrustAnchorIdentifier:
     # draft-ietf-tls-trust-anchor-ids: a relative object identifier, dotted in the model and base-128 arcs on the wire
     @staticmethod
@@ -264,7 +232,6 @@ class ClientHelloBuilder:
         )
 
 
-@final
 class ByteReader:
     def __init__(self, data: bytes) -> None:
         self._data = data
@@ -304,7 +271,6 @@ class ByteReader:
         return tuple(items)
 
 
-@final
 class ClientHelloParser:
     def __init__(self) -> None:
         self._fields: dict[str, object] = {}
@@ -329,7 +295,7 @@ class ClientHelloParser:
         message = bytearray()
         while reader.remaining:
             content_type = reader.integer(1)
-            _ = reader.take(2)
+            reader.take(2)
             fragment = reader.vector(2)
             if content_type != ContentType.handshake:
                 raise ValueError("record is not a handshake record")
@@ -342,12 +308,12 @@ class ClientHelloParser:
 
     def _read_body(self, body: ByteReader) -> None:
         legacy_version = ProtocolVersion(body.integer(2))
-        _ = body.take(32)
-        _ = body.vector(1)
+        body.take(32)
+        body.vector(1)
         self._fields["legacy_version"] = legacy_version
         self._fields["supported_versions"] = (legacy_version,)
         self._fields["cipher_suites"] = self._typed(CipherSuite, body.integers(2, 2))
-        _ = body.vector(1)
+        body.vector(1)
         extensions: list[ExtensionType] = []
         if body.remaining:
             block = ByteReader(body.vector(2))
@@ -391,7 +357,7 @@ class ClientHelloParser:
                 groups: list[int] = []
                 while shares.remaining:
                     groups.append(shares.integer(2))
-                    _ = shares.vector(2)
+                    shares.vector(2)
                 self._fields["key_share_groups"] = self._typed(
                     NamedGroup, tuple(groups)
                 )

{ssl2-1.1.0 → ssl2-2.0.0}/src/ssl2/credentials.py

@@ -5,11 +5,11 @@ import sys
 from collections.abc import Callable, Sequence
 from dataclasses import dataclass
 from pathlib import Path
-from typing import Final, Self
+from typing import Self
 
 from ssl2.errors import ConfigurationError
 
-LINUX_CANDIDATES: Final = (
+LINUX_CANDIDATES = (
     Path("/etc/ssl/certs/ca-certificates.crt"),
     Path("/etc/pki/tls/certs/ca-bundle.crt"),
     Path("/etc/ssl/ca-bundle.pem"),
@@ -20,11 +20,11 @@ LINUX_CANDIDATES: Final = (
     Path("/etc/pki/tls/certs"),
     Path("/system/etc/security/cacerts"),
 )
-DARWIN_CANDIDATES: Final = (
+DARWIN_CANDIDATES = (
     Path("/etc/ssl/cert.pem"),
     Path("/private/etc/ssl/cert.pem"),
 )
-X509_ASN_ENCODING: Final = 0x00000001
+X509_ASN_ENCODING = 0x00000001
 
 
 @dataclass(frozen=True, slots=True)
@@ -115,7 +115,7 @@ class TrustStore(Credential):
                         + b"-----END CERTIFICATE-----\n"
                     )
                 context = enumerate_store(store, context)
-            _ = close_store(store, 0)
+            close_store(store, 0)
         return b"".join(chunks)
 
 

{ssl2-1.1.0 → ssl2-2.0.0}/src/ssl2/fingerprint.py

@@ -1,7 +1,7 @@
 import hashlib
 from dataclasses import dataclass
 from enum import StrEnum
-from typing import Final, Self
+from typing import Self
 
 from ssl2.client_hello import ClientHello, ClientHelloBuilder
 from ssl2.parameters import (
@@ -15,8 +15,8 @@ from ssl2.parameters import (
     SignatureScheme,
 )
 
-JA4_HASH_LENGTH: Final = 12
-JA4_UNHASHED_EXTENSIONS: Final = frozenset(
+JA4_HASH_LENGTH = 12
+JA4_UNHASHED_EXTENSIONS = frozenset(
     {ExtensionType.server_name, ExtensionType.application_layer_protocol_negotiation}
 )
 

{ssl2-1.1.0 → ssl2-2.0.0}/src/ssl2/interface.py

@@ -1,10 +1,11 @@
 import errno
+import select
 import socket
 from collections import OrderedDict
 from collections.abc import Buffer, Callable, Sequence
 from dataclasses import dataclass
 from threading import Lock
-from typing import Final, Protocol, Self, final, overload
+from typing import Protocol, Self, overload
 
 from ssl2.client_hello import ClientHello
 from ssl2.credentials import SigningChain, TrustStore
@@ -12,7 +13,7 @@ from ssl2.errors import ConfigurationError, RaggedEOF, WantReadError, WantWriteE
 from ssl2.parameters import CipherSuite, NextProtocol, TLSVersion
 from ssl2.proxy import Proxy, ProxyError, ProxyScheme
 
-RECEIVE_SIZE: Final = 65536
+RECEIVE_SIZE = 65536
 
 
 @dataclass(frozen=True, slots=True)
@@ -84,6 +85,10 @@ class TLSBuffer(Protocol):
 
     def getpeercert(self) -> bytes | None: ...
 
+    def getpeerchain(self) -> tuple[bytes, ...]: ...
+
+    def attach(self, fileno: int, /) -> None: ...
+
 
 class ClientContext(Protocol):
     def __init__(self, configuration: TLSClientConfiguration) -> None: ...
@@ -114,7 +119,6 @@ class TLSImplementation[ClientContextT: ClientContext, ServerContextT: ServerCon
     validate_config: Callable[[TLSClientConfiguration | TLSServerConfiguration], None]
 
 
-@final
 class SessionCache:
     def __init__(self, limit: int = 1024) -> None:
         self._entries: OrderedDict[str, tuple[bytes, bool]] = OrderedDict()
@@ -126,7 +130,7 @@ class SessionCache:
             self._entries[key] = (session, single_use)
             self._entries.move_to_end(key)
             while len(self._entries) > self._limit:
-                _ = self._entries.popitem(last=False)
+                self._entries.popitem(last=False)
 
     def take(self, key: str) -> bytes | None:
         with self._lock:
@@ -170,9 +174,10 @@ class Listening:
 class Connected:
     buffer: TLSBuffer
     transport: Transport
+    # the socket BoringSSL reads and writes itself; None when the records go through the transport in Python
+    socket: socket.socket | None = None
 
 
-@final
 class TLSSocket:
     def __init__(
         self, context: ClientContext | ServerContext, state: Listening | Connected
@@ -180,6 +185,8 @@ class TLSSocket:
         self._context = context
         self._state = state
         self._unsent = b""
+        # the timeout of an attached socket lives here: the socket itself stays non-blocking for BoringSSL
+        self._timeout: float | None = None
 
     @classmethod
     def connect(
@@ -190,22 +197,26 @@ class TLSSocket:
         proxy: Proxy | None = None,
         timeout: float | None = None,
     ) -> Self:
-        transport: Transport
+        buffer = context.create_buffer(address[0])
         if proxy is None:
-            transport = socket.create_connection(address, timeout=timeout)
-        elif proxy.scheme is ProxyScheme.HTTPS:
-            transport = cls.connect(context, (proxy.host, proxy.port), timeout=timeout)
-        else:
-            transport = socket.create_connection(
-                (proxy.host, proxy.port), timeout=timeout
+            return cls.open_socket(
+                context, buffer, socket.create_connection(address, timeout=timeout)
             )
+        if proxy.scheme is ProxyScheme.HTTPS:
+            hop = cls.connect(context, (proxy.host, proxy.port), timeout=timeout)
+            try:
+                return cls.open(context, buffer, hop, cls._tunnel(proxy, address, hop))
+            except BaseException:
+                hop.close()
+                raise
+        plain = socket.create_connection((proxy.host, proxy.port), timeout=timeout)
         try:
-            leftover = b"" if proxy is None else cls._tunnel(proxy, address, transport)
-            return cls.open(
-                context, context.create_buffer(address[0]), transport, leftover
-            )
+            leftover = cls._tunnel(proxy, address, plain)
+            if leftover:
+                return cls.open(context, buffer, plain, leftover)
+            return cls.open_socket(context, buffer, plain)
         except BaseException:
-            transport.close()
+            plain.close()
             raise
 
     @classmethod
@@ -222,6 +233,24 @@ class TLSSocket:
         self._run(buffer.do_handshake)
         return self
 
+    @classmethod
+    def open_socket(
+        cls,
+        context: ClientContext | ServerContext,
+        buffer: TLSBuffer,
+        sock: socket.socket,
+    ) -> Self:
+        buffer.attach(sock.fileno())
+        self = cls(context, Connected(buffer, sock, sock))
+        self._timeout = sock.gettimeout()
+        sock.setblocking(False)
+        try:
+            self._run(buffer.do_handshake)
+        except BaseException:
+            sock.close()
+            raise
+        return self
+
     @classmethod
     def bind(cls, context: ServerContext, address: tuple[str | None, int]) -> Self:
         host, port = address
@@ -276,7 +305,7 @@ class TLSSocket:
         accepted: tuple[socket.socket, tuple[str | None, int]] = (
             listening.listener.accept()
         )
-        return type(self).open(
+        return type(self).open_socket(
             self._context, listening.accept(), accepted[0]
         ), accepted[1]
 
@@ -289,6 +318,9 @@ class TLSSocket:
     def getpeercert(self) -> bytes | None:
         return self._connected().buffer.getpeercert()
 
+    def getpeerchain(self) -> tuple[bytes, ...]:
+        return self._connected().buffer.getpeerchain()
+
     def cipher(self) -> CipherSuite | int | None:
         return self._connected().buffer.cipher()
 
@@ -300,9 +332,14 @@ class TLSSocket:
         return self._connected().buffer.negotiated_tls_version
 
     def settimeout(self, value: float | None) -> None:
-        self._endpoint().settimeout(value)
+        if isinstance(self._state, Connected) and self._state.socket is not None:
+            self._timeout = value
+        else:
+            self._endpoint().settimeout(value)
 
     def gettimeout(self) -> float | None:
+        if isinstance(self._state, Connected) and self._state.socket is not None:
+            return self._timeout
         return self._endpoint().gettimeout()
 
     def fileno(self) -> int:
@@ -358,19 +395,38 @@ class TLSSocket:
 
     def _run[ResultT](self, operation: Callable[[], ResultT]) -> ResultT:
         connection = self._connected()
+        sock = connection.socket
         while True:
             try:
                 result = operation()
             except WantReadError:
-                self._flush(connection)
-                self._fill(connection)
+                if sock is None:
+                    self._flush(connection)
+                    self._fill(connection)
+                elif self._timeout == 0:
+                    raise
+                else:
+                    self._wait(sock, reading=True)
                 continue
             except WantWriteError:
-                self._flush(connection)
+                if sock is None:
+                    self._flush(connection)
+                elif self._timeout == 0:
+                    raise
+                else:
+                    self._wait(sock, reading=False)
                 continue
-            self._flush(connection)
+            if sock is None:
+                self._flush(connection)
             return result
 
+    def _wait(self, sock: socket.socket, *, reading: bool) -> None:
+        readable, writable, _ = select.select(
+            [sock] if reading else [], [] if reading else [sock], [], self._timeout
+        )
+        if not readable and not writable:
+            raise TimeoutError("timed out")
+
     def _flush(self, connection: Connected) -> None:
         while self._unsent or connection.buffer.outgoing_bytes_buffered():
             if not self._unsent:
@@ -393,6 +449,7 @@ class TLSSocket:
     def _shutdown_once(self, connection: Connected) -> None:
         try:
             connection.buffer.shutdown()
-        except WantReadError:
+        except WantReadError, WantWriteError:
             pass
-        self._flush(connection)
+        if connection.socket is None:
+            self._flush(connection)

{ssl2-1.1.0 → ssl2-2.0.0}/src/ssl2/parameters.py

@@ -1,6 +1,6 @@
 # generated from the IANA registry CSV files and BoringSSL tls1.h at 8f77af2e, so regenerate rather than edit
 from enum import Enum, IntEnum
-from typing import Final, Self, override
+from typing import Self, override
 
 
 class CodePoint(IntEnum):
@@ -55,13 +55,13 @@ class ProtocolVersion(CodePoint):
         return TLS_VERSIONS.get(self)
 
 
-PROTOCOL_VERSIONS: Final = {
+PROTOCOL_VERSIONS = {
     TLSVersion.TLSv1_0: ProtocolVersion.TLS_1_0,
     TLSVersion.TLSv1_1: ProtocolVersion.TLS_1_1,
     TLSVersion.TLSv1_2: ProtocolVersion.TLS_1_2,
     TLSVersion.TLSv1_3: ProtocolVersion.TLS_1_3,
 }
-TLS_VERSIONS: Final = {protocol: named for named, protocol in PROTOCOL_VERSIONS.items()}
+TLS_VERSIONS = {protocol: named for named, protocol in PROTOCOL_VERSIONS.items()}
 
 
 class ServerNameType(CodePoint):

{ssl2-1.1.0 → ssl2-2.0.0}/src/ssl2/proxy.py

@@ -5,15 +5,15 @@ import struct
 from collections.abc import Generator
 from dataclasses import dataclass
 from enum import IntEnum, StrEnum
-from typing import Final, Self
+from typing import Self
 from urllib.parse import unquote, urlsplit
 
 type Conversation = Generator[tuple[bytes, int | bytes], bytes, object]
 type Association = Generator[tuple[bytes, int | bytes], bytes, tuple[str, int]]
 
-REPLY_LIMIT: Final = 65536
-USERNAME_PASSWORD_VERSION: Final = 0x01
-SOCKS4A_NAME_FOLLOWS: Final = bytes((0, 0, 0, 1))
+REPLY_LIMIT = 65536
+USERNAME_PASSWORD_VERSION = 0x01
+SOCKS4A_NAME_FOLLOWS = bytes((0, 0, 0, 1))
 
 
 class ProxyError(ConnectionError):