tigrcorn-security 0.3.16.dev13__tar.gz → 0.3.17.dev1__tar.gz

{tigrcorn_security-0.3.16.dev13 → tigrcorn_security-0.3.17.dev1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: tigrcorn-security
-Version: 0.3.16.dev13
+Version: 0.3.17.dev1
 Summary: TLS 1.3, mTLS, X.509, ALPN, OCSP, CRL, and certificate policy surfaces for the Tigrcorn Python web server.
 Author-email: Jacob Stewart <jacob@swarmauri.com>
 License: Apache License
@@ -187,8 +187,8 @@ Classifier: Typing :: Typed
 Requires-Python: <3.15,>=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: tigrcorn-core==0.3.16.dev13
-Requires-Dist: tigrcorn-config==0.3.16.dev13
+Requires-Dist: tigrcorn-core==0.3.17.dev1
+Requires-Dist: tigrcorn-config==0.3.17.dev1
 Provides-Extra: x509
 Requires-Dist: cryptography>=46.0.0; extra == "x509"
 Dynamic: license-file

{tigrcorn_security-0.3.16.dev13 → tigrcorn_security-0.3.17.dev1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "tigrcorn-security"
-version = "0.3.16.dev13"
+version = "0.3.17.dev1"
 description = "TLS 1.3, mTLS, X.509, ALPN, OCSP, CRL, and certificate policy surfaces for the Tigrcorn Python web server."
 readme = "README.md"
 requires-python = ">=3.10,<3.15"
@@ -30,8 +30,8 @@ classifiers = [
   "Typing :: Typed",
 ]
 dependencies = [
-  "tigrcorn-core==0.3.16.dev13",
-  "tigrcorn-config==0.3.16.dev13",
+  "tigrcorn-core==0.3.17.dev1",
+  "tigrcorn-config==0.3.17.dev1",
 ]
 
 [project.optional-dependencies]

tigrcorn_security-0.3.17.dev1/src/tigrcorn_security/tls/__init__.py

@@ -0,0 +1,34 @@
+from __future__ import annotations
+
+from .imports import *
+from .models import *
+from .ssl_object import *
+from .records import *
+from .certificates import *
+from .connection import *
+from .context import *
+from .wrapping import *
+
+build_server_tls_context = build_server_ssl_context
+
+__all__ = [
+    'PackageOwnedSSLObject',
+    'PackageOwnedTLSConnection',
+    'ServerTLSContext',
+    'build_server_ssl_context',
+    'build_server_tls_context',
+    'wrap_server_tls_connection',
+    'tls_extension_payload',
+    'CertificatePurpose',
+    'CertificateValidationPolicy',
+    'RevocationCache',
+    'RevocationCacheEntry',
+    'RevocationFetchPolicy',
+    'RevocationFreshnessPolicy',
+    'RevocationMaterial',
+    'RevocationMode',
+    'load_pem_certificates',
+    'verify_certificate_validity',
+    'verify_certificate_hostname',
+    'verify_certificate_chain',
+]

tigrcorn_security-0.3.17.dev1/src/tigrcorn_security/tls/certificates.py

@@ -0,0 +1,56 @@
+from __future__ import annotations
+
+from .imports import *
+
+def describe_peer_certificate(certificate: x509.Certificate) -> dict[str, Any]:
+    return {
+        'subject': certificate.subject.rfc4514_string(),
+        'issuer': certificate.issuer.rfc4514_string(),
+        'serial_number': hex(certificate.serial_number),
+        'not_valid_before': _iso_utc(
+            certificate.not_valid_before_utc if hasattr(certificate, 'not_valid_before_utc') else certificate.not_valid_before
+        ),
+        'not_valid_after': _iso_utc(
+            certificate.not_valid_after_utc if hasattr(certificate, 'not_valid_after_utc') else certificate.not_valid_after
+        ),
+    }
+
+
+def tls_extension_payload(writer: Any) -> dict[str, Any] | None:
+    ssl_object = getattr(writer, 'get_extra_info', lambda *args, **kwargs: None)('ssl_object')
+    if ssl_object is None:
+        return None
+    payload: dict[str, Any] = {}
+    selected_alpn = getattr(ssl_object, 'selected_alpn_protocol', lambda: None)()
+    if selected_alpn is not None:
+        payload['selected_alpn_protocol'] = selected_alpn
+    getpeercert = getattr(ssl_object, 'getpeercert', None)
+    if callable(getpeercert):
+        peer_cert = getpeercert(binary_form=False)
+        if peer_cert is not None:
+            payload['peer_cert'] = peer_cert
+    return payload or None
+
+
+def verify_certificate_chain(
+    chain_pems: Iterable[bytes],
+    trust_roots_pems: Iterable[bytes],
+    *,
+    server_name: str = '',
+    moment: datetime | None = None,
+    policy: CertificateValidationPolicy | None = None,
+) -> x509.Certificate:
+    return _verify_certificate_chain(
+        chain_pems,
+        trust_roots_pems,
+        server_name=server_name,
+        moment=moment,
+        policy=policy,
+    )
+
+def _iso_utc(moment: datetime) -> str:
+    if moment.tzinfo is None:
+        moment = moment.replace(tzinfo=timezone.utc)
+    return moment.astimezone(timezone.utc).isoformat().replace('+00:00', 'Z')
+
+__all__ = [name for name in globals() if not name.startswith('__')]

tigrcorn_security-0.3.16.dev13/src/tigrcorn_security/tls.py → tigrcorn_security-0.3.17.dev1/src/tigrcorn_security/tls/connection.py

@@ -1,128 +1,10 @@
 from __future__ import annotations
 
-import asyncio
-import contextlib
-import threading
-from dataclasses import dataclass
-from datetime import datetime, timezone
-from pathlib import Path
-from typing import Any, Iterable
-
-class _MissingDependencyProxy:
-    def __init__(self, package: str) -> None:
-        self._package = package
-
-    def __getattr__(self, name: str):
-        raise ModuleNotFoundError(
-            f"{self._package} is required for this TLS/X.509 operation; install tigrcorn[tls-x509]"
-        )
-
-
-try:
-    from cryptography import x509
-    from cryptography.hazmat.primitives import serialization
-except ModuleNotFoundError:  # pragma: no cover - exercised in dependency-light environments
-    x509 = _MissingDependencyProxy("cryptography")  # type: ignore[assignment]
-    serialization = _MissingDependencyProxy("cryptography")  # type: ignore[assignment]
-
-from tigrcorn_config.model import ListenerConfig
-from tigrcorn_core.errors import ProtocolError
-from tigrcorn_security.tls13.handshake import QuicTlsHandshakeDriver, TlsAlertError
-from tigrcorn_security.tls13.key_schedule import Tls13KeySchedule
-from tigrcorn_security.tls13.messages import decode_handshake_message
-from tigrcorn_security.policies import build_validation_policy_for_listener
-from tigrcorn_security.x509.path import (
-    CertificatePurpose,
-    CertificateValidationPolicy,
-    RevocationCache,
-    RevocationCacheEntry,
-    RevocationFetchPolicy,
-    RevocationFreshnessPolicy,
-    RevocationMaterial,
-    RevocationMode,
-    load_pem_certificates,
-    verify_certificate_chain as _verify_certificate_chain,
-    verify_certificate_hostname,
-    verify_certificate_validity,
-)
-from tigrcorn_transports.quic.crypto import aes_gcm_decrypt, aes_gcm_encrypt
-
-_TLS_CONTENT_CHANGE_CIPHER_SPEC = 20
-_TLS_CONTENT_ALERT = 21
-_TLS_CONTENT_HANDSHAKE = 22
-_TLS_CONTENT_APPLICATION_DATA = 23
-_TLS_LEGACY_RECORD_VERSION = 0x0303
-_TLS_MAX_PLAINTEXT = 16384
-_TLS_ALERT_LEVEL_FATAL = 2
-_TLS_ALERT_CLOSE_NOTIFY = 0
-
-_CIPHER_NAMES = {
-    0x1301: ('TLS_AES_128_GCM_SHA256', 128),
-    0x1302: ('TLS_AES_256_GCM_SHA384', 256),
-}
-
-
-@dataclass(frozen=True, slots=True)
-class ServerTLSContext:
-    certificate_pem: bytes
-    private_key_pem: bytes
-    private_key_password: bytes | None
-    trusted_certificates: tuple[bytes, ...]
-    alpn_protocols: tuple[str, ...]
-    require_client_certificate: bool
-    validation_policy: CertificateValidationPolicy
-    cipher_suites: tuple[int, ...] = (0x1302, 0x1301)
-    server_name: str = 'localhost'
-
-
-@dataclass(slots=True)
-class _RecordProtectionState:
-    key: bytes
-    iv: bytes
-    sequence_number: int = 0
-
-    def next_nonce(self) -> bytes:
-        sequence = self.sequence_number.to_bytes(8, 'big')
-        padded = b'\x00' * (len(self.iv) - len(sequence)) + sequence
-        nonce = bytes(left ^ right for left, right in zip(self.iv, padded))
-        self.sequence_number += 1
-        return nonce
-
-
-class PackageOwnedSSLObject:
-    def __init__(
-        self,
-        *,
-        selected_alpn_protocol: str | None,
-        cipher_suite: int,
-        peer_certificate: x509.Certificate | None,
-    ) -> None:
-        self._selected_alpn_protocol = selected_alpn_protocol
-        self._cipher_suite = cipher_suite
-        self._peer_certificate = peer_certificate
-        self._peer_certificate_der = (
-            peer_certificate.public_bytes(serialization.Encoding.DER)
-            if peer_certificate is not None
-            else None
-        )
-
-    def selected_alpn_protocol(self) -> str | None:
-        return self._selected_alpn_protocol
-
-    def version(self) -> str:
-        return 'TLSv1.3'
-
-    def cipher(self) -> tuple[str, str, int]:
-        name, bits = _CIPHER_NAMES.get(self._cipher_suite, ('TLS_UNKNOWN', 0))
-        return name, 'TLSv1.3', bits
-
-    def getpeercert(self, binary_form: bool = False) -> dict[str, Any] | bytes | None:
-        if self._peer_certificate is None:
-            return None
-        if binary_form:
-            return self._peer_certificate_der
-        return describe_peer_certificate(self._peer_certificate)
-
+from .imports import *
+from .models import *
+from .ssl_object import *
+from .records import *
+from .certificates import *
 
 class PackageOwnedTLSConnection:
     def __init__(
@@ -415,169 +297,4 @@ class PackageOwnedTLSConnection:
         )
         await self._raw_writer.drain()
 
-
-def _build_record_state(secret: bytes, *, key_length: int, iv_length: int, hash_name: str) -> _RecordProtectionState:
-    schedule = Tls13KeySchedule(hash_name=hash_name)
-    return _RecordProtectionState(
-        key=schedule.expand_label(secret, 'key', b'', key_length),
-        iv=schedule.expand_label(secret, 'iv', b'', iv_length),
-    )
-
-
-def _encode_plain_record(content_type: int, payload: bytes) -> bytes:
-    return bytes([content_type]) + _TLS_LEGACY_RECORD_VERSION.to_bytes(2, 'big') + len(payload).to_bytes(2, 'big') + payload
-
-
-def _encrypt_record(payload: bytes, inner_content_type: int, state: _RecordProtectionState) -> bytes:
-    inner = payload + bytes([inner_content_type])
-    nonce = state.next_nonce()
-    body_length = len(inner) + 16
-    header = (
-        bytes([_TLS_CONTENT_APPLICATION_DATA])
-        + _TLS_LEGACY_RECORD_VERSION.to_bytes(2, 'big')
-        + body_length.to_bytes(2, 'big')
-    )
-    ciphertext, tag = aes_gcm_encrypt(state.key, nonce, inner, aad=header)
-    return header + ciphertext + tag
-
-
-def _decrypt_record(payload: bytes, state: _RecordProtectionState) -> tuple[bytes, int]:
-    if len(payload) < 16:
-        raise ProtocolError('truncated TLS application-data record')
-    header = (
-        bytes([_TLS_CONTENT_APPLICATION_DATA])
-        + _TLS_LEGACY_RECORD_VERSION.to_bytes(2, 'big')
-        + len(payload).to_bytes(2, 'big')
-    )
-    ciphertext = payload[:-16]
-    tag = payload[-16:]
-    nonce = state.next_nonce()
-    plaintext = aes_gcm_decrypt(state.key, nonce, ciphertext, tag, aad=header)
-    index = len(plaintext) - 1
-    while index >= 0 and plaintext[index] == 0:
-        index -= 1
-    if index < 0:
-        raise ProtocolError('TLS inner plaintext is missing a content type')
-    return plaintext[:index], plaintext[index]
-
-
-def describe_peer_certificate(certificate: x509.Certificate) -> dict[str, Any]:
-    return {
-        'subject': certificate.subject.rfc4514_string(),
-        'issuer': certificate.issuer.rfc4514_string(),
-        'serial_number': hex(certificate.serial_number),
-        'not_valid_before': _iso_utc(
-            certificate.not_valid_before_utc if hasattr(certificate, 'not_valid_before_utc') else certificate.not_valid_before
-        ),
-        'not_valid_after': _iso_utc(
-            certificate.not_valid_after_utc if hasattr(certificate, 'not_valid_after_utc') else certificate.not_valid_after
-        ),
-    }
-
-
-def tls_extension_payload(writer: Any) -> dict[str, Any] | None:
-    ssl_object = getattr(writer, 'get_extra_info', lambda *args, **kwargs: None)('ssl_object')
-    if ssl_object is None:
-        return None
-    payload: dict[str, Any] = {}
-    selected_alpn = getattr(ssl_object, 'selected_alpn_protocol', lambda: None)()
-    if selected_alpn is not None:
-        payload['selected_alpn_protocol'] = selected_alpn
-    getpeercert = getattr(ssl_object, 'getpeercert', None)
-    if callable(getpeercert):
-        peer_cert = getpeercert(binary_form=False)
-        if peer_cert is not None:
-            payload['peer_cert'] = peer_cert
-    return payload or None
-
-
-def build_server_ssl_context(listener: ListenerConfig) -> ServerTLSContext | None:
-    if not listener.ssl_enabled:
-        return None
-    assert listener.ssl_certfile is not None
-    assert listener.ssl_keyfile is not None
-    certificate_pem = Path(listener.ssl_certfile).read_bytes()
-    private_key_pem = Path(listener.ssl_keyfile).read_bytes()
-    private_key_password = getattr(listener, 'ssl_keyfile_password', None)
-    if private_key_password is not None and not isinstance(private_key_password, bytes):
-        private_key_password = str(private_key_password).encode('utf-8')
-    trusted = (Path(listener.ssl_ca_certs).read_bytes(),) if listener.ssl_ca_certs else ()
-    validation_policy = build_validation_policy_for_listener(listener)
-    server_name = _listener_server_name(listener)
-    return ServerTLSContext(
-        certificate_pem=certificate_pem,
-        private_key_pem=private_key_pem,
-        private_key_password=private_key_password,
-        trusted_certificates=trusted,
-        alpn_protocols=tuple(listener.alpn_protocols),
-        require_client_certificate=listener.ssl_require_client_cert,
-        validation_policy=validation_policy,
-        cipher_suites=tuple(int(item) for item in (getattr(listener, 'resolved_cipher_suites', ()) or (0x1302, 0x1301))),
-        server_name=server_name,
-    )
-
-
-async def wrap_server_tls_connection(
-    raw_reader: asyncio.StreamReader,
-    raw_writer: asyncio.StreamWriter,
-    context: ServerTLSContext,
-) -> PackageOwnedTLSConnection:
-    connection = PackageOwnedTLSConnection(raw_reader, raw_writer, context)
-    await connection.handshake()
-    return connection
-
-
-build_server_tls_context = build_server_ssl_context
-
-
-def verify_certificate_chain(
-    chain_pems: Iterable[bytes],
-    trust_roots_pems: Iterable[bytes],
-    *,
-    server_name: str = '',
-    moment: datetime | None = None,
-    policy: CertificateValidationPolicy | None = None,
-) -> x509.Certificate:
-    return _verify_certificate_chain(
-        chain_pems,
-        trust_roots_pems,
-        server_name=server_name,
-        moment=moment,
-        policy=policy,
-    )
-
-
-def _listener_server_name(listener: ListenerConfig) -> str:
-    host = listener.host or 'localhost'
-    if host in {'0.0.0.0', '::', ''}:
-        return 'localhost'
-    return host
-
-
-def _iso_utc(moment: datetime) -> str:
-    if moment.tzinfo is None:
-        moment = moment.replace(tzinfo=timezone.utc)
-    return moment.astimezone(timezone.utc).isoformat().replace('+00:00', 'Z')
-
-
-__all__ = [
-    'PackageOwnedSSLObject',
-    'PackageOwnedTLSConnection',
-    'ServerTLSContext',
-    'build_server_ssl_context',
-    'build_server_tls_context',
-    'wrap_server_tls_connection',
-    'tls_extension_payload',
-    'CertificatePurpose',
-    'CertificateValidationPolicy',
-    'RevocationCache',
-    'RevocationCacheEntry',
-    'RevocationFetchPolicy',
-    'RevocationFreshnessPolicy',
-    'RevocationMaterial',
-    'RevocationMode',
-    'load_pem_certificates',
-    'verify_certificate_validity',
-    'verify_certificate_hostname',
-    'verify_certificate_chain',
-]
+__all__ = [name for name in globals() if not name.startswith('__')]

tigrcorn_security-0.3.17.dev1/src/tigrcorn_security/tls/context.py

@@ -0,0 +1,38 @@
+from __future__ import annotations
+
+from .imports import *
+from .models import *
+
+def build_server_ssl_context(listener: ListenerConfig) -> ServerTLSContext | None:
+    if not listener.ssl_enabled:
+        return None
+    assert listener.ssl_certfile is not None
+    assert listener.ssl_keyfile is not None
+    certificate_pem = Path(listener.ssl_certfile).read_bytes()
+    private_key_pem = Path(listener.ssl_keyfile).read_bytes()
+    private_key_password = getattr(listener, 'ssl_keyfile_password', None)
+    if private_key_password is not None and not isinstance(private_key_password, bytes):
+        private_key_password = str(private_key_password).encode('utf-8')
+    trusted = (Path(listener.ssl_ca_certs).read_bytes(),) if listener.ssl_ca_certs else ()
+    validation_policy = build_validation_policy_for_listener(listener)
+    server_name = _listener_server_name(listener)
+    return ServerTLSContext(
+        certificate_pem=certificate_pem,
+        private_key_pem=private_key_pem,
+        private_key_password=private_key_password,
+        trusted_certificates=trusted,
+        alpn_protocols=tuple(listener.alpn_protocols),
+        require_client_certificate=listener.ssl_require_client_cert,
+        validation_policy=validation_policy,
+        cipher_suites=tuple(int(item) for item in (getattr(listener, 'resolved_cipher_suites', ()) or (0x1302, 0x1301))),
+        server_name=server_name,
+    )
+
+
+def _listener_server_name(listener: ListenerConfig) -> str:
+    host = listener.host or 'localhost'
+    if host in {'0.0.0.0', '::', ''}:
+        return 'localhost'
+    return host
+
+__all__ = [name for name in globals() if not name.startswith('__')]

tigrcorn_security-0.3.17.dev1/src/tigrcorn_security/tls/imports.py

@@ -0,0 +1,66 @@
+from __future__ import annotations
+
+
+
+import asyncio
+import contextlib
+import threading
+from dataclasses import dataclass
+from datetime import datetime, timezone
+from pathlib import Path
+from typing import Any, Iterable
+
+class _MissingDependencyProxy:
+    def __init__(self, package: str) -> None:
+        self._package = package
+
+    def __getattr__(self, name: str):
+        raise ModuleNotFoundError(
+            f"{self._package} is required for this TLS/X.509 operation; install tigrcorn[tls-x509]"
+        )
+
+
+try:
+    from cryptography import x509
+    from cryptography.hazmat.primitives import serialization
+except ModuleNotFoundError:  # pragma: no cover - exercised in dependency-light environments
+    x509 = _MissingDependencyProxy("cryptography")  # type: ignore[assignment]
+    serialization = _MissingDependencyProxy("cryptography")  # type: ignore[assignment]
+
+from tigrcorn_config.model import ListenerConfig
+from tigrcorn_core.errors import ProtocolError
+from tigrcorn_security.tls13.handshake import QuicTlsHandshakeDriver, TlsAlertError
+from tigrcorn_security.tls13.key_schedule import Tls13KeySchedule
+from tigrcorn_security.tls13.messages import decode_handshake_message
+from tigrcorn_security.policies import build_validation_policy_for_listener
+from tigrcorn_security.x509.path import (
+    CertificatePurpose,
+    CertificateValidationPolicy,
+    RevocationCache,
+    RevocationCacheEntry,
+    RevocationFetchPolicy,
+    RevocationFreshnessPolicy,
+    RevocationMaterial,
+    RevocationMode,
+    load_pem_certificates,
+    verify_certificate_chain as _verify_certificate_chain,
+    verify_certificate_hostname,
+    verify_certificate_validity,
+)
+from tigrcorn_transports.quic.crypto import aes_gcm_decrypt, aes_gcm_encrypt
+
+_TLS_CONTENT_CHANGE_CIPHER_SPEC = 20
+_TLS_CONTENT_ALERT = 21
+_TLS_CONTENT_HANDSHAKE = 22
+_TLS_CONTENT_APPLICATION_DATA = 23
+_TLS_LEGACY_RECORD_VERSION = 0x0303
+_TLS_MAX_PLAINTEXT = 16384
+_TLS_ALERT_LEVEL_FATAL = 2
+_TLS_ALERT_CLOSE_NOTIFY = 0
+
+_CIPHER_NAMES = {
+    0x1301: ('TLS_AES_128_GCM_SHA256', 128),
+    0x1302: ('TLS_AES_256_GCM_SHA384', 256),
+}
+
+__all__ = [name for name in globals() if not name.startswith('__')]

tigrcorn_security-0.3.17.dev1/src/tigrcorn_security/tls/models.py

@@ -0,0 +1,31 @@
+from __future__ import annotations
+
+from .imports import *
+
+@dataclass(frozen=True, slots=True)
+class ServerTLSContext:
+    certificate_pem: bytes
+    private_key_pem: bytes
+    private_key_password: bytes | None
+    trusted_certificates: tuple[bytes, ...]
+    alpn_protocols: tuple[str, ...]
+    require_client_certificate: bool
+    validation_policy: CertificateValidationPolicy
+    cipher_suites: tuple[int, ...] = (0x1302, 0x1301)
+    server_name: str = 'localhost'
+
+
+@dataclass(slots=True)
+class _RecordProtectionState:
+    key: bytes
+    iv: bytes
+    sequence_number: int = 0
+
+    def next_nonce(self) -> bytes:
+        sequence = self.sequence_number.to_bytes(8, 'big')
+        padded = b'\x00' * (len(self.iv) - len(sequence)) + sequence
+        nonce = bytes(left ^ right for left, right in zip(self.iv, padded))
+        self.sequence_number += 1
+        return nonce
+
+__all__ = [name for name in globals() if not name.startswith('__')]

tigrcorn_security-0.3.17.dev1/src/tigrcorn_security/tls/records.py

@@ -0,0 +1,50 @@
+from __future__ import annotations
+
+from .imports import *
+from .models import *
+
+def _build_record_state(secret: bytes, *, key_length: int, iv_length: int, hash_name: str) -> _RecordProtectionState:
+    schedule = Tls13KeySchedule(hash_name=hash_name)
+    return _RecordProtectionState(
+        key=schedule.expand_label(secret, 'key', b'', key_length),
+        iv=schedule.expand_label(secret, 'iv', b'', iv_length),
+    )
+
+
+def _encode_plain_record(content_type: int, payload: bytes) -> bytes:
+    return bytes([content_type]) + _TLS_LEGACY_RECORD_VERSION.to_bytes(2, 'big') + len(payload).to_bytes(2, 'big') + payload
+
+
+def _encrypt_record(payload: bytes, inner_content_type: int, state: _RecordProtectionState) -> bytes:
+    inner = payload + bytes([inner_content_type])
+    nonce = state.next_nonce()
+    body_length = len(inner) + 16
+    header = (
+        bytes([_TLS_CONTENT_APPLICATION_DATA])
+        + _TLS_LEGACY_RECORD_VERSION.to_bytes(2, 'big')
+        + body_length.to_bytes(2, 'big')
+    )
+    ciphertext, tag = aes_gcm_encrypt(state.key, nonce, inner, aad=header)
+    return header + ciphertext + tag
+
+
+def _decrypt_record(payload: bytes, state: _RecordProtectionState) -> tuple[bytes, int]:
+    if len(payload) < 16:
+        raise ProtocolError('truncated TLS application-data record')
+    header = (
+        bytes([_TLS_CONTENT_APPLICATION_DATA])
+        + _TLS_LEGACY_RECORD_VERSION.to_bytes(2, 'big')
+        + len(payload).to_bytes(2, 'big')
+    )
+    ciphertext = payload[:-16]
+    tag = payload[-16:]
+    nonce = state.next_nonce()
+    plaintext = aes_gcm_decrypt(state.key, nonce, ciphertext, tag, aad=header)
+    index = len(plaintext) - 1
+    while index >= 0 and plaintext[index] == 0:
+        index -= 1
+    if index < 0:
+        raise ProtocolError('TLS inner plaintext is missing a content type')
+    return plaintext[:index], plaintext[index]
+
+__all__ = [name for name in globals() if not name.startswith('__')]

tigrcorn_security-0.3.17.dev1/src/tigrcorn_security/tls/ssl_object.py

@@ -0,0 +1,40 @@
+from __future__ import annotations
+
+from .imports import *
+from .models import *
+
+class PackageOwnedSSLObject:
+    def __init__(
+        self,
+        *,
+        selected_alpn_protocol: str | None,
+        cipher_suite: int,
+        peer_certificate: x509.Certificate | None,
+    ) -> None:
+        self._selected_alpn_protocol = selected_alpn_protocol
+        self._cipher_suite = cipher_suite
+        self._peer_certificate = peer_certificate
+        self._peer_certificate_der = (
+            peer_certificate.public_bytes(serialization.Encoding.DER)
+            if peer_certificate is not None
+            else None
+        )
+
+    def selected_alpn_protocol(self) -> str | None:
+        return self._selected_alpn_protocol
+
+    def version(self) -> str:
+        return 'TLSv1.3'
+
+    def cipher(self) -> tuple[str, str, int]:
+        name, bits = _CIPHER_NAMES.get(self._cipher_suite, ('TLS_UNKNOWN', 0))
+        return name, 'TLSv1.3', bits
+
+    def getpeercert(self, binary_form: bool = False) -> dict[str, Any] | bytes | None:
+        if self._peer_certificate is None:
+            return None
+        if binary_form:
+            return self._peer_certificate_der
+        return describe_peer_certificate(self._peer_certificate)
+
+__all__ = [name for name in globals() if not name.startswith('__')]

tigrcorn_security-0.3.17.dev1/src/tigrcorn_security/tls/wrapping.py

@@ -0,0 +1,16 @@
+from __future__ import annotations
+
+from .imports import *
+from .models import *
+from .connection import *
+
+async def wrap_server_tls_connection(
+    raw_reader: asyncio.StreamReader,
+    raw_writer: asyncio.StreamWriter,
+    context: ServerTLSContext,
+) -> PackageOwnedTLSConnection:
+    connection = PackageOwnedTLSConnection(raw_reader, raw_writer, context)
+    await connection.handshake()
+    return connection
+
+__all__ = [name for name in globals() if not name.startswith('__')]