def getSecureConnection(self, fromAddress, toAddress, port=port,
                            usePrivateCertificate=None,
                            authorize=True):
        """
        Establish or retrieven an already-established L{Q2Q}-protocol
        connection from C{fromAddress} to I{the q2q proxy provider} for
        C{toAddress}; i.e. the entity responsible for the I{domain party only}
        of C{toAddress}.

        The connection is "from" C{fromAddress} in the sense that it will use a
        certificate and private key associated with that address to
        authenticate itself.

        For example, if we want to connect from C{foo@bar.com} to
        C{baz@qux.com}, this will establish a connection to C{qux.com}.

        @param fromAddress: The address of the party represented by the local
            host.
        @type fromAddress: L{Q2QAddress}

        @param toAddress: The address of the party whose proxy we are trying to
            connect to.  The domain part of this address is the DNS name to
            connect to, and also the source (in our local certificate store, or
            via a TOFU DNS lookup) of the certificate authority to use to
            verify the connection.
        @type toAddress: L{Q2QAddress}

        @param port: The TCP port number on which to make the outgoing
            connection.
        @type port: L{int}

        @param usePrivateCertificate:
        @param authorize: 

        @return: A L{Deferred} firing with a connected L{Q2Q} where the peer is
            the I{domain part} of the given C{toAddress}.
        """

        # Secure connections using users as clients will have to be established
        # using the 'secure' method differently than this does: we are ONLY
        # capable of connecting to other domains (supernodes)

        toDomain = toAddress.domainAddress()
        resolveme = reactor.resolve(str(toDomain))
        def cb(toIPAddress, authorize=authorize):
            GPS = self.certificateStorage.getPrivateCertificate
            if usePrivateCertificate:
                ourCert = usePrivateCertificate
                cacheFrom = fromAddress
                log.msg(
                    'Using fakie private cert:',
                    fromAddress,
                    ourCert,
                    cacheFrom
                )
            elif fromAddress.domain == '':
                assert all( 
                    (fromAddress.resource == '',
                    "No domain means anonymous, %r" % (fromAddress,))
                )
                
                # We are actually anonymous, whoops!
                authorize = False
                # We need to create our own certificate
                ourCert = KeyPair.generate().selfSignedCert(218374, CN='@')
                # Feel free to cache the anonymous certificate we just made
                cacheFrom = fromAddress
                log.msg("Using anonymous cert for anonymous user.")
            else:
                try:
                    # Are we in fact a domain, operating on behalf of a user?
                    x = fromAddress.domainAddress()
                    ourCert = GPS(str(x))
                    cacheFrom = x
                    log.msg(
                        'domain on behalf of user:',
                        fromAddress,
                        ourCert,
                        cacheFrom
                    )
                except KeyError:
                    # Nope, guess not.  Are we actually that user?
                    try:
                        x = fromAddress
                        ourCert = GPS(str(x))
                        cacheFrom = x
                        log.msg(
                            'actual user:',
                            fromAddress,
                            ourCert,
                            cacheFrom
                        )
                    except KeyError:
                        # Hmm.  We're not that user either.  Are we trying to
                        # pretend to be a user from a *different* domain, to
                        # ourselves?  (We've got to be a domain to "make
                        # believe", since this is effectively a clustering
                        # feature...)

                        try:
                            x = toDomain
                            ourCert = GPS(str(x))
                            cacheFrom = x
                            log.msg(
                                'fakie domain cert:',
                                fromAddress,
                                ourCert,
                                cacheFrom
                            )
                        except KeyError:
                            raise VerifyError(
                                "We tried to secure a connection "
                                "between %s and %s, "
                                "but we don't have any certificates "
                                "that could be used." % (fromAddress,
                                                         toAddress))

            def connected(proto):
                certD = self.certificateStorage.getSelfSignedCertificate(
                    str(toDomain))
                def nocert(failure):
                    failure.trap(KeyError)
                    identD = proto.callRemote(
                        Identify, subject=toDomain
                    ).addCallback(
                            lambda x: x['certificate'])
                    def storeit(certificate):
                        return (
                            self.certificateStorage.storeSelfSignedCertificate(
                                str(toDomain),
                                certificate
                            ).addCallback(lambda x: certificate)
                        )
                    return identD.addCallback(storeit)
                certD.addErrback(nocert)
                def gotcert(foreignCA):
                    secdef = proto.secure(cacheFrom, toDomain,
                                          ourCert, foreignCA,
                                          authorize=authorize)
                    return secdef
                certD.addCallback(gotcert)
                return certD
            return self.secureConnectionCache.connectCached(
                endpoint.TCPEndpoint(toIPAddress, port),
                Q2QClientFactory(self),
                extraWork=connected,
                extraHash=(cacheFrom, toDomain, authorize)
                )
        return resolveme.addCallback(cb)
def getSecureConnection ( self , fromAddress , toAddress , port = port , usePrivateCertificate = None , authorize = True ) : toDomain = toAddress . domainAddress ( ) resolveme = reactor . resolve ( str ( toDomain ) ) def cb ( toIPAddress , authorize = authorize ) : GPS = self . certificateStorage . getPrivateCertificate if usePrivateCertificate : ourCert = usePrivateCertificate cacheFrom = fromAddress log . msg ( 'Using fakie private cert:' , fromAddress , ourCert , cacheFrom ) elif fromAddress . domain == '' : assert all ( ( fromAddress . resource == '' , "No domain means anonymous, %r" % ( fromAddress , ) ) ) authorize = False ourCert = KeyPair . generate ( ) . selfSignedCert ( 218374 , CN = '@' ) cacheFrom = fromAddress log . msg ( "Using anonymous cert for anonymous user." ) else : try : x = fromAddress . domainAddress ( ) ourCert = GPS ( str ( x ) ) cacheFrom = x log . msg ( 'domain on behalf of user:' , fromAddress , ourCert , cacheFrom ) except KeyError : try : x = fromAddress ourCert = GPS ( str ( x ) ) cacheFrom = x log . msg ( 'actual user:' , fromAddress , ourCert , cacheFrom ) except KeyError : try : x = toDomain ourCert = GPS ( str ( x ) ) cacheFrom = x log . msg ( 'fakie domain cert:' , fromAddress , ourCert , cacheFrom ) except KeyError : raise VerifyError ( "We tried to secure a connection " "between %s and %s, " "but we don't have any certificates " "that could be used." % ( fromAddress , toAddress ) ) def connected ( proto ) : certD = self . certificateStorage . getSelfSignedCertificate ( str ( toDomain ) ) def nocert ( failure ) : failure . trap ( KeyError ) identD = proto . callRemote ( Identify , subject = toDomain ) . addCallback ( lambda x : x [ 'certificate' ] ) def storeit ( certificate ) : return ( self . certificateStorage . storeSelfSignedCertificate ( str ( toDomain ) , certificate ) . addCallback ( lambda x : certificate ) ) return identD . addCallback ( storeit ) certD . addErrback ( nocert ) def gotcert ( foreignCA ) : secdef = proto . secure ( cacheFrom , toDomain , ourCert , foreignCA , authorize = authorize ) return secdef certD . addCallback ( gotcert ) return certD return self . secureConnectionCache . connectCached ( endpoint . TCPEndpoint ( toIPAddress , port ) , Q2QClientFactory ( self ) , extraWork = connected , extraHash = ( cacheFrom , toDomain , authorize ) ) return resolveme . addCallback ( cb )
Establish or retrieven an already-established L{Q2Q}-protocol
        connection from C{fromAddress} to I{the q2q proxy provider} for
        C{toAddress}; i.e. the entity responsible for the I{domain party only}
        of C{toAddress}.

        The connection is "from" C{fromAddress} in the sense that it will use a
        certificate and private key associated with that address to
        authenticate itself.

        For example, if we want to connect from C{foo@bar.com} to
        C{baz@qux.com}, this will establish a connection to C{qux.com}.

        @param fromAddress: The address of the party represented by the local
            host.
        @type fromAddress: L{Q2QAddress}

        @param toAddress: The address of the party whose proxy we are trying to
            connect to.  The domain part of this address is the DNS name to
            connect to, and also the source (in our local certificate store, or
            via a TOFU DNS lookup) of the certificate authority to use to
            verify the connection.
        @type toAddress: L{Q2QAddress}

        @param port: The TCP port number on which to make the outgoing
            connection.
        @type port: L{int}

        @param usePrivateCertificate:
        @param authorize: 

        @return: A L{Deferred} firing with a connected L{Q2Q} where the peer is
            the I{domain part} of the given C{toAddress}.