"""
A drop-in replacement for Python's ``ssl`` module, backed by rustls.
rtls stands for "rustls-backed TLS".

Usage::

    import rtls as ssl

    ctx = ssl.create_default_context()
    # ... use exactly like the ssl module
"""

from __future__ import annotations

from ._bio import MemoryBIO
from ._certificate import TLSCertificate as Certificate
from ._constants import (
    ALERT_DESCRIPTION_ACCESS_DENIED,
    ALERT_DESCRIPTION_BAD_CERTIFICATE,
    ALERT_DESCRIPTION_BAD_RECORD_MAC,
    ALERT_DESCRIPTION_CERTIFICATE_EXPIRED,
    ALERT_DESCRIPTION_CERTIFICATE_REVOKED,
    ALERT_DESCRIPTION_CERTIFICATE_UNKNOWN,
    ALERT_DESCRIPTION_CLOSE_NOTIFY,
    ALERT_DESCRIPTION_DECODE_ERROR,
    ALERT_DESCRIPTION_DECOMPRESSION_FAILURE,
    ALERT_DESCRIPTION_DECRYPT_ERROR,
    ALERT_DESCRIPTION_HANDSHAKE_FAILURE,
    ALERT_DESCRIPTION_ILLEGAL_PARAMETER,
    ALERT_DESCRIPTION_INSUFFICIENT_SECURITY,
    ALERT_DESCRIPTION_INTERNAL_ERROR,
    ALERT_DESCRIPTION_NO_RENEGOTIATION,
    ALERT_DESCRIPTION_PROTOCOL_VERSION,
    ALERT_DESCRIPTION_RECORD_OVERFLOW,
    ALERT_DESCRIPTION_UNEXPECTED_MESSAGE,
    ALERT_DESCRIPTION_UNKNOWN_CA,
    ALERT_DESCRIPTION_UNSUPPORTED_CERTIFICATE,
    ALERT_DESCRIPTION_UNSUPPORTED_EXTENSION,
    ALERT_DESCRIPTION_USER_CANCELLED,
    CERT_NONE,
    CERT_OPTIONAL,
    CERT_REQUIRED,
    # Channel binding
    CHANNEL_BINDING_TYPES,
    # Feature flags
    HAS_ALPN,
    HAS_ECDH,
    HAS_NEVER_CHECK_COMMON_NAME,
    HAS_NPN,
    HAS_PHA,
    HAS_PSK,
    HAS_SNI,
    OP_ALL,
    OP_CIPHER_SERVER_PREFERENCE,
    OP_ENABLE_KTLS,
    OP_ENABLE_MIDDLEBOX_COMPAT,
    OP_IGNORE_UNEXPECTED_EOF,
    OP_LEGACY_SERVER_CONNECT,
    OP_NO_COMPRESSION,
    OP_NO_RENEGOTIATION,
    OP_NO_TICKET,
    OP_SINGLE_DH_USE,
    OP_SINGLE_ECDH_USE,
    # OpenSSL version compat
    OPENSSL_VERSION,
    OPENSSL_VERSION_INFO,
    OPENSSL_VERSION_NUMBER,
    # Protocol constants
    PROTOCOL_TLS,
    PROTOCOL_TLS_CLIENT,
    PROTOCOL_TLS_SERVER,
    SSL_ERROR_EOF,
    SSL_ERROR_INVALID_ERROR_CODE,
    # SSL error numbers
    SSL_ERROR_SSL,
    SSL_ERROR_SYSCALL,
    SSL_ERROR_WANT_CONNECT,
    SSL_ERROR_WANT_READ,
    SSL_ERROR_WANT_WRITE,
    SSL_ERROR_WANT_X509_LOOKUP,
    SSL_ERROR_ZERO_RETURN,
    VERIFY_ALLOW_PROXY_CERTS,
    VERIFY_CRL_CHECK_CHAIN,
    VERIFY_CRL_CHECK_LEAF,
    VERIFY_DEFAULT,
    VERIFY_X509_PARTIAL_CHAIN,
    VERIFY_X509_STRICT,
    VERIFY_X509_TRUSTED_FIRST,
    # Alert descriptions
    AlertDescription,
    # DefaultVerifyPaths
    DefaultVerifyPaths,
    HAS_SSLv2,
    HAS_SSLv3,
    HAS_TLSv1,
    HAS_TLSv1_1,
    HAS_TLSv1_2,
    HAS_TLSv1_3,
    OP_NO_SSLv2,
    OP_NO_SSLv3,
    OP_NO_TLSv1,
    OP_NO_TLSv1_1,
    OP_NO_TLSv1_2,
    OP_NO_TLSv1_3,
    # Options
    Options,
    PROTOCOL_SSLv23,
    PROTOCOL_TLSv1,
    PROTOCOL_TLSv1_1,
    PROTOCOL_TLSv1_2,
    # Purpose
    Purpose,
    # TLSVersion enum
    TLSVersion,
    # Verify flags
    VerifyFlags,
    # Verify mode
    VerifyMode,
)
from ._context import TLSContext as SSLContext
from ._exceptions import (
    CertificateError,
    SSLCertVerificationError,
    SSLEOFError,
    SSLError,
    SSLSyscallError,
    SSLWantReadError,
    SSLWantWriteError,
    SSLZeroReturnError,
)
from ._object import TLSObject as SSLObject
from ._socket import TLSSocket as SSLSocket
from ._utils import (
    DER_cert_to_PEM_cert,
    PEM_cert_to_DER_cert,
    RAND_add,
    RAND_bytes,
    RAND_status,
    cert_time_to_seconds,
    create_default_context,
    get_default_verify_paths,
    get_server_certificate,
    match_hostname,
)

__version__ = "2026.4.24"

__all__ = [
    # Classes
    "SSLContext",
    "SSLSocket",
    "SSLObject",
    "MemoryBIO",
    "Certificate",
    # Exceptions
    "SSLError",
    "SSLZeroReturnError",
    "SSLWantReadError",
    "SSLWantWriteError",
    "SSLSyscallError",
    "SSLEOFError",
    "SSLCertVerificationError",
    "CertificateError",
    # Constants
    "PROTOCOL_TLS",
    "PROTOCOL_TLS_CLIENT",
    "PROTOCOL_TLS_SERVER",
    "PROTOCOL_SSLv23",
    "PROTOCOL_TLSv1",
    "PROTOCOL_TLSv1_1",
    "PROTOCOL_TLSv1_2",
    "TLSVersion",
    "VerifyMode",
    "CERT_NONE",
    "CERT_OPTIONAL",
    "CERT_REQUIRED",
    "VerifyFlags",
    "VERIFY_DEFAULT",
    "VERIFY_CRL_CHECK_LEAF",
    "VERIFY_CRL_CHECK_CHAIN",
    "VERIFY_X509_STRICT",
    "VERIFY_X509_TRUSTED_FIRST",
    "VERIFY_X509_PARTIAL_CHAIN",
    "VERIFY_ALLOW_PROXY_CERTS",
    "Options",
    "OP_ALL",
    "OP_NO_SSLv2",
    "OP_NO_SSLv3",
    "OP_NO_TLSv1",
    "OP_NO_TLSv1_1",
    "OP_NO_TLSv1_2",
    "OP_NO_TLSv1_3",
    "OP_NO_RENEGOTIATION",
    "OP_CIPHER_SERVER_PREFERENCE",
    "OP_SINGLE_DH_USE",
    "OP_SINGLE_ECDH_USE",
    "OP_ENABLE_MIDDLEBOX_COMPAT",
    "OP_NO_COMPRESSION",
    "OP_NO_TICKET",
    "OP_IGNORE_UNEXPECTED_EOF",
    "OP_ENABLE_KTLS",
    "OP_LEGACY_SERVER_CONNECT",
    "SSL_ERROR_SSL",
    "SSL_ERROR_WANT_READ",
    "SSL_ERROR_WANT_WRITE",
    "SSL_ERROR_WANT_X509_LOOKUP",
    "SSL_ERROR_SYSCALL",
    "SSL_ERROR_ZERO_RETURN",
    "SSL_ERROR_WANT_CONNECT",
    "SSL_ERROR_EOF",
    "SSL_ERROR_INVALID_ERROR_CODE",
    "HAS_ALPN",
    "HAS_ECDH",
    "HAS_SNI",
    "HAS_TLSv1_2",
    "HAS_TLSv1_3",
    "HAS_NEVER_CHECK_COMMON_NAME",
    "HAS_NPN",
    "HAS_SSLv2",
    "HAS_SSLv3",
    "HAS_TLSv1",
    "HAS_TLSv1_1",
    "HAS_PSK",
    "HAS_PHA",
    "Purpose",
    "AlertDescription",
    "ALERT_DESCRIPTION_ACCESS_DENIED",
    "ALERT_DESCRIPTION_BAD_CERTIFICATE",
    "ALERT_DESCRIPTION_BAD_RECORD_MAC",
    "ALERT_DESCRIPTION_CERTIFICATE_EXPIRED",
    "ALERT_DESCRIPTION_CERTIFICATE_REVOKED",
    "ALERT_DESCRIPTION_CERTIFICATE_UNKNOWN",
    "ALERT_DESCRIPTION_CLOSE_NOTIFY",
    "ALERT_DESCRIPTION_DECODE_ERROR",
    "ALERT_DESCRIPTION_DECOMPRESSION_FAILURE",
    "ALERT_DESCRIPTION_DECRYPT_ERROR",
    "ALERT_DESCRIPTION_HANDSHAKE_FAILURE",
    "ALERT_DESCRIPTION_ILLEGAL_PARAMETER",
    "ALERT_DESCRIPTION_INSUFFICIENT_SECURITY",
    "ALERT_DESCRIPTION_INTERNAL_ERROR",
    "ALERT_DESCRIPTION_NO_RENEGOTIATION",
    "ALERT_DESCRIPTION_PROTOCOL_VERSION",
    "ALERT_DESCRIPTION_RECORD_OVERFLOW",
    "ALERT_DESCRIPTION_UNEXPECTED_MESSAGE",
    "ALERT_DESCRIPTION_UNKNOWN_CA",
    "ALERT_DESCRIPTION_UNSUPPORTED_CERTIFICATE",
    "ALERT_DESCRIPTION_UNSUPPORTED_EXTENSION",
    "ALERT_DESCRIPTION_USER_CANCELLED",
    "CHANNEL_BINDING_TYPES",
    "OPENSSL_VERSION",
    "OPENSSL_VERSION_NUMBER",
    "OPENSSL_VERSION_INFO",
    "DefaultVerifyPaths",
    # Functions
    "create_default_context",
    "cert_time_to_seconds",
    "DER_cert_to_PEM_cert",
    "PEM_cert_to_DER_cert",
    "get_server_certificate",
    "get_default_verify_paths",
    "match_hostname",
    "RAND_bytes",
    "RAND_status",
    "RAND_add",
]
