from OpenSSL import SSL
from twisted.internet import ssl

MOZILLA_INTERMEDIATE_CIPHERS = (
    'ECDHE-RSA-AES128-GCM-SHA256:'
    'ECDHE-ECDSA-AES128-GCM-SHA256:'
    'ECDHE-RSA-AES256-GCM-SHA384:'
    'ECDHE-ECDSA-AES256-GCM-SHA384:'
    'DHE-RSA-AES128-GCM-SHA256:'
    'DHE-DSS-AES128-GCM-SHA256:'
    'ECDHE-RSA-AES128-SHA256:'
    'ECDHE-ECDSA-AES128-SHA256:'
    'ECDHE-RSA-AES128-SHA:'
    'ECDHE-ECDSA-AES128-SHA:'
    'ECDHE-RSA-AES256-SHA384:'
    'ECDHE-ECDSA-AES256-SHA384:'
    'ECDHE-RSA-AES256-SHA:'
    'ECDHE-ECDSA-AES256-SHA:'
    'DHE-RSA-AES128-SHA256:'
    'DHE-RSA-AES128-SHA:'
    'DHE-DSS-AES128-SHA256:'
    'DHE-RSA-AES256-SHA256:'
    'DHE-DSS-AES256-SHA:'
    'DHE-RSA-AES256-SHA:'
    'AES128-GCM-SHA256:'
    'AES256-GCM-SHA384:'
    'AES128-SHA256:'
    'AES256-SHA256:'
    'AES128-SHA:'
    'AES256-SHA:'
    'AES:'
    'CAMELLIA:DES-CBC3-SHA:'
    '!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:'
    '!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA'
)


class AutopushSSLContextFactory(ssl.DefaultOpenSSLContextFactory):
    def cacheContext(self):
        if self._context is None:
            ctx = self._contextFactory(self.sslmethod)

            ctx.set_cipher_list(MOZILLA_INTERMEDIATE_CIPHERS)
            ctx.set_options(SSL.OP_CIPHER_SERVER_PREFERENCE)
            ctx.set_options(SSL.OP_NO_SSLv2)
            ctx.set_options(SSL.OP_NO_SSLv3)

            ctx.use_certificate_chain_file(self.certificateFileName)
            ctx.use_privatekey_file(self.privateKeyFileName)

            self._context = ctx

@@ -49,16 +49,47 @@
 port ssl
+%0Afrom twisted.python import log
 %0A%0AMOZILL
@@ -1430,16 +1430,53 @@
 SSLv3)%0A%0A
+            disableSSLCompression()%0A%0A
         
@@ -1630,8 +1630,681 @@
 t = ctx%0A
+%0A%0Adef disableSSLCompression():%0A    try:%0A        import ctypes%0A        import glob%0A        openssl = ctypes.CDLL(None, ctypes.RTLD_GLOBAL)%0A        try:%0A            f = openssl.SSL_COMP_get_compression_methods # flake8: noqa%0A        except AttributeError:%0A            ssllib = sorted(glob.glob(%22/usr/lib/libssl.so.*%22))%5B0%5D%0A            openssl = ctypes.CDLL(ssllib, ctypes.RTLD_GLOBAL)%0A%0A        openssl.SSL_COMP_get_compression_methods.restype = ctypes.c_void_p%0A        openssl.sk_zero.argtypes = %5Bctypes.c_void_p%5D%0A        openssl.sk_zero(openssl.SSL_COMP_get_compression_methods())%0A    except Exception, e:%0A        log.msg('disableSSLCompression: Failed:')%0A        log.msg(e)%0A

Disable ssl compression