switch on newly negotiated encryption parameters for inbound traffic
517437
def _activate_inbound(self):
        """"""
        block_size = self._cipher_info[self.remote_cipher]['block-size']
        if self.server_mode:
            IV_in = self._compute_key('A', block_size)
            key_in = self._compute_key('C', self._cipher_info[self.remote_cipher]['key-size'])
        else:
            IV_in = self._compute_key('B', block_size)
            key_in = self._compute_key('D', self._cipher_info[self.remote_cipher]['key-size'])
        engine = self._get_cipher(self.remote_cipher, key_in, IV_in)
        mac_size = self._mac_info[self.remote_mac]['size']
        mac_engine = self._mac_info[self.remote_mac]['class']
        # initial mac keys are done in the hash's natural size (not the potentially truncated
        # transmission size)
        if self.server_mode:
            mac_key = self._compute_key('E', mac_engine().digest_size)
        else:
            mac_key = self._compute_key('F', mac_engine().digest_size)
        self.packetizer.set_inbound_cipher(engine, block_size, mac_engine, mac_size, mac_key)
        compress_in = self._compression_info[self.remote_compression][1]
        if (compress_in is not None) and ((self.remote_compression != 'zlib@openssh.com') or self.authenticated):
            self._log(DEBUG, 'Switching on inbound compression ...')
            self.packetizer.set_inbound_compressor(compress_in())
1326233
private void readyInbound(VirtualConnection inVC) {
        if (TraceComponent.isAnyTracingEnabled() && tc.isEntryEnabled()) {
            Tr.entry(tc, "readyInbound, vc=" + getVCHash());
        }

        // Encrypted buffer from the network.
        WsByteBuffer netBuffer = getDeviceReadInterface().getBuffer();
        // Verify the buffer is not null first.
        if (netBuffer == null) {
            // Unable to handle this condition. TCP could not get any more data
            // and looked to punt to the only available channel above.
            if (TraceComponent.isAnyTracingEnabled() && tc.isDebugEnabled()) {
                Tr.debug(tc, "Received null buffer so closing connection.");
            }
            close(inVC, null);
            if (TraceComponent.isAnyTracingEnabled() && tc.isEntryEnabled()) {
                Tr.exit(tc, "readyInbound, vc=" + getVCHash());
            }
            return;
        }
        netBuffer.flip();
        // Unencrypted buffer from the ssl engine output to be handed up to the application.
        WsByteBuffer decryptedNetBuffer = null;
        // Encrypted buffer from the ssl engine to be sent sent out on the network.
        WsByteBuffer encryptedAppBuffer = null;
        // Result output from the SSL engine.
        SSLEngineResult result = null;
        // Indicate that an error occurred and buffers should be cleaned up.
        boolean errorOccurred = false;

        if (TraceComponent.isAnyTracingEnabled() && tc.isEventEnabled()) {
            Tr.event(tc, "Initial read bytes: " + netBuffer.limit());
        }

        // Note, net and decNet buffers will always be one buffer for discrimination.
        // See if discrimination happened. Init method saved discState if so.
        if (discState == null) {
            // Allocate a new buffer for the results of decrypting the network buffer.
            decryptedNetBuffer = SSLUtils.allocateByteBuffer(
                                                             getAppBufferSize(), sslChannel.getConfig().getDecryptBuffersDirect());
        } else {
            // Extract the results of the call to the engine during discrimination.
            result = discState.getEngineResult();
            // Extract output buffer used during discrimination.
            decryptedNetBuffer = discState.getDecryptedNetBuffer();
            // Determine the resulting position and limit of networkBuffer after unwrap in discrimination.
            netBuffer.position(discState.getNetBufferPosition());
            netBuffer.limit(discState.getNetBufferLimit());
        }
        // Line up buffers needed for the SSL handshake. These are temporary.
        encryptedAppBuffer = SSLUtils.allocateByteBuffer(getPacketBufferSize(), true);

        try {
            if (discState == null) {
                // Since data is ready now, we can't call handleHandshake yet, unwrap first.
                if (TraceComponent.isAnyTracingEnabled() && tc.isEventEnabled()) {
                    Tr.event(tc, "Before unwrap\r\n\tnetBuf: " + SSLUtils.getBufferTraceInfo(netBuffer)
                                 + "\r\n\tdecBuf: " + SSLUtils.getBufferTraceInfo(decryptedNetBuffer));
                }
                // Should not get any app data until handshake is done
                // Protect JSSE from potential SSL packet sizes that are too big.
                int savedLimit = SSLUtils.adjustBufferForJSSE(netBuffer, getPacketBufferSize());

                // Have the SSL engine inspect the first packet.
                result = getSSLEngine().unwrap(
                                               netBuffer.getWrappedByteBuffer(),
                                               decryptedNetBuffer.getWrappedByteBuffer());
                if (0 < result.bytesProduced()) {
                    decryptedNetBuffer.flip();
                }
                if (TraceComponent.isAnyTracingEnabled() && tc.isEventEnabled()) {
                    Tr.event(tc,
                             "After unwrap\r\n\tnetBuf: " + SSLUtils.getBufferTraceInfo(netBuffer)
                                 + "\r\n\tdecBuf: " + SSLUtils.getBufferTraceInfo(decryptedNetBuffer)
                                 + "\r\n\tstatus=" + result.getStatus()
                                 + " HSstatus=" + result.getHandshakeStatus()
                                 + " consumed=" + result.bytesConsumed()
                                 + " produced=" + result.bytesProduced());
                }

                // If adjustments were made for the JSSE, restore them.
                if (-1 != savedLimit) {
                    netBuffer.limit(savedLimit);
                }
                // If all data was consumed, clear the buffer.
                if (netBuffer.remaining() == 0) {
                    netBuffer.clear();
                }
            }

            // Build a callback for the asynchronous SSL handshake
            MyHandshakeCompletedCallback callback = new MyHandshakeCompletedCallback(this, netBuffer, decryptedNetBuffer, encryptedAppBuffer, FlowType.INBOUND);
            // Continue the SSL handshake. Do this with asynchronous handShake
            result = SSLUtils.handleHandshake(this, netBuffer, decryptedNetBuffer,
                                              encryptedAppBuffer, result, callback, false);
            // Check to see if the work was able to be done synchronously.
            if (result != null) {
                // Handshake is done.
                readyInboundPostHandshake(netBuffer, decryptedNetBuffer,
                                          encryptedAppBuffer, result.getHandshakeStatus());
            } else {
                // Handshake is being done asynchronously.
                if (TraceComponent.isAnyTracingEnabled() && tc.isEntryEnabled()) {
                    Tr.exit(tc, "readyInbound");
                }
                return;
            }

        } catch (IOException ioe) {
            // no FFDC required
            if (TraceComponent.isAnyTracingEnabled() && tc.isDebugEnabled()) {
                Tr.debug(tc, "Caught ioexception, " + ioe);
            }
            errorOccurred = true;
            // Handle the handshake error.
            getChannel().getHandshakeErrorTracker().noteHandshakeError(ioe);
            close(inVC, ioe);
        } catch (ReadOnlyBufferException robe) {
            FFDCFilter.processException(robe, getClass().getName(), "359", this);
            if (TraceComponent.isAnyTracingEnabled() && tc.isDebugEnabled()) {
                Tr.debug(tc, "Caught read-only exception, " + robe);
            }
            errorOccurred = true;
            close(inVC, robe);
        }

        // Clean up buffers if an error occurred. Note, connection was already closed.
        if (errorOccurred) {
            if (decryptedNetBuffer != null) {
                decryptedNetBuffer.release();
                decryptedNetBuffer = null;
            }
            netBuffer.release();
            netBuffer = null;
            getDeviceReadInterface().setBuffers(null);
            if (encryptedAppBuffer != null) {
                encryptedAppBuffer.release();
                encryptedAppBuffer = null;
            }
        }

        if (TraceComponent.isAnyTracingEnabled() && tc.isEntryEnabled()) {
            Tr.exit(tc, "readyInbound");
        }
    }
738960
def _secret_event_lifecycle_cb(conn, secret, event, detail, opaque):
    '''
    
    '''
    _salt_send_event(opaque, conn, {
        'secret': {
            'uuid': secret.UUIDString()
        },
        'event': _get_libvirt_enum_string('VIR_SECRET_EVENT_', event),
        'detail': 'unknown'  # currently unused
    })
308471
function SecretSubkey(date=new Date()) {
  secretKey.call(this, date);
  this.tag = enums.packet.secretSubkey;
}
743903
public void setTlsClientParameters(TLSClientParameters params) {
        this.tlsClientParameters = params;
        if (this.tlsClientParameters != null) {
            if (LOG.isLoggable(Level.FINE)) {
                LOG.log(Level.FINE, "Conduit '" + getConduitName()
                    + "' has been (re) configured for TLS "
                    + "keyManagers " + Arrays.toString(tlsClientParameters.getKeyManagers())
                    + "trustManagers " + Arrays.toString(tlsClientParameters.getTrustManagers())
                    + "secureRandom " + tlsClientParameters.getSecureRandom());
            }
            CertificateConstraintsType constraints = params.getCertConstraints();
            if (constraints != null) {
                certConstraints = CertConstraintsJaxBUtils.createCertConstraints(constraints);
            }
        } else {
            if (LOG.isLoggable(Level.FINE)) {
                LOG.log(Level.FINE, "Conduit '" + getConduitName()
                    + "' has been (re)configured for plain http.");
            }
        }
    }
849889
function encryptPQInnerDataWithRSA(context) {
    // Create the data with hash to be encrypt
    var hash = utility.createSHAHash(context.pqInnerData);
    var dataWithHash = Buffer.concat([hash, context.pqInnerData]);
    if (logger.isDebugEnabled()) {
        logger.debug('Data to be encrypted contains: hash(%s), pqInnerData(%s), total length %s',
            hash.length, context.pqInnerData.length, dataWithHash.length);
    }
    // Encrypt data with RSA
    context.encryptedData = security.cipher.rsaEncrypt(dataWithHash, context.publicKey);
    return context;
}
559937
def _encoded_routing_key(self):
        """"""
        topic = self.topic
        if config.conf["topic_prefix"]:
            topic = ".".join((config.conf["topic_prefix"].rstrip("."), topic))
        return topic.encode("utf-8")
963906
@Override
    public String incomingCrypted(String st, HBCIMsgStatus msgStatus, String msgName) {
        int idx = st.indexOf("'");
        if (idx != -1) {
            try {
                String msghead_st = st.substring(0, idx);
                int plusidx = 0;
                for (int i = 0; i < 5; i++)
                    plusidx = msghead_st.indexOf("+", plusidx + 1);
                if (plusidx == -1) {
                    log.warn("MsgRef is missing, adding it");
                    String[] des = {"dialogid", "msgnum"};
                    for (int i = 0; i < 2; i++) {
                        String temp = (msgStatus.getData().get("orig_" + msgName + ".MsgHead." + des[i]));
                        log.warn("setting MsgRef." + des[i] + " to " + temp);
                        msghead_st += (i == 0 ? "+" : ":");
                        msghead_st += temp;
                    }
                    st = new StringBuffer(st).replace(0, idx, msghead_st).toString();
                }
            } catch (Exception ex) {
                throw new HBCI_Exception("*** error while fixing missing MsgRef", ex);
            }
        }
        return st;
    }
1171046
function _encryptBlock($in)
    {
        $S0 = $this->S0;
        $S1 = $this->S1;
        $S2 = $this->S2;
        $S3 = $this->S3;
        $K  = $this->K;

        $in = unpack("V4", $in);
        $R0 = $K[0] ^ $in[1];
        $R1 = $K[1] ^ $in[2];
        $R2 = $K[2] ^ $in[3];
        $R3 = $K[3] ^ $in[4];

        $ki = 7;
        while ($ki < 39) {
            $t0 = $S0[ $R0        & 0xff] ^
                  $S1[($R0 >>  8) & 0xff] ^
                  $S2[($R0 >> 16) & 0xff] ^
                  $S3[($R0 >> 24) & 0xff];
            $t1 = $S0[($R1 >> 24) & 0xff] ^
                  $S1[ $R1        & 0xff] ^
                  $S2[($R1 >>  8) & 0xff] ^
                  $S3[($R1 >> 16) & 0xff];
            $R2^= $this->safe_intval($t0 + $t1 + $K[++$ki]);
            $R2 = ($R2 >> 1 & 0x7fffffff) | ($R2 << 31);
            $R3 = ((($R3 >> 31) & 1) | ($R3 << 1)) ^ $this->safe_intval($t0 + ($t1 << 1) + $K[++$ki]);

            $t0 = $S0[ $R2        & 0xff] ^
                  $S1[($R2 >>  8) & 0xff] ^
                  $S2[($R2 >> 16) & 0xff] ^
                  $S3[($R2 >> 24) & 0xff];
            $t1 = $S0[($R3 >> 24) & 0xff] ^
                  $S1[ $R3        & 0xff] ^
                  $S2[($R3 >>  8) & 0xff] ^
                  $S3[($R3 >> 16) & 0xff];
            $R0^= $this->safe_intval($t0 + $t1 + $K[++$ki]);
            $R0 = ($R0 >> 1 & 0x7fffffff) | ($R0 << 31);
            $R1 = ((($R1 >> 31) & 1) | ($R1 << 1)) ^ $this->safe_intval($t0 + ($t1 << 1) + $K[++$ki]);
        }

        // @codingStandardsIgnoreStart
        return pack("V4", $K[4] ^ $R2,
                          $K[5] ^ $R3,
                          $K[6] ^ $R0,
                          $K[7] ^ $R1);
        // @codingStandardsIgnoreEnd
    }
1035973
function Forwarded(ip, port, secured) {
  this.ip = ip || '127.0.0.1';
  this.secure = !!secured;
  this.port = +port || 0;
}
1179857
function pubKeyHashToAddress (pubKeyHash, network, type) {
  pubKeyHash = ensureBuffer(pubKeyHash)
  const prefixHash = Buffer.concat([Buffer.from(networks[network][type], 'hex'), pubKeyHash])
  const checksum = Buffer.from(sha256(sha256(prefixHash)).slice(0, 8), 'hex')
  const addr = base58.encode(Buffer.concat([prefixHash, checksum]).slice(0, 25))
  return addr
}
788346
def _activate_outbound(self):
        """"""
        m = Message()
        m.add_byte(cMSG_NEWKEYS)
        self._send_message(m)
        block_size = self._cipher_info[self.local_cipher]["block-size"]
        if self.server_mode:
            IV_out = self._compute_key("B", block_size)
            key_out = self._compute_key(
                "D", self._cipher_info[self.local_cipher]["key-size"]
            )
        else:
            IV_out = self._compute_key("A", block_size)
            key_out = self._compute_key(
                "C", self._cipher_info[self.local_cipher]["key-size"]
            )
        engine = self._get_cipher(
            self.local_cipher, key_out, IV_out, self._ENCRYPT
        )
        mac_size = self._mac_info[self.local_mac]["size"]
        mac_engine = self._mac_info[self.local_mac]["class"]
        # initial mac keys are done in the hash's natural size (not the
        # potentially truncated transmission size)
        if self.server_mode:
            mac_key = self._compute_key("F", mac_engine().digest_size)
        else:
            mac_key = self._compute_key("E", mac_engine().digest_size)
        sdctr = self.local_cipher.endswith("-ctr")
        self.packetizer.set_outbound_cipher(
            engine, block_size, mac_engine, mac_size, mac_key, sdctr
        )
        compress_out = self._compression_info[self.local_compression][0]
        if compress_out is not None and (
            self.local_compression != "zlib@openssh.com" or self.authenticated
        ):
            self._log(DEBUG, "Switching on outbound compression ...")
            self.packetizer.set_outbound_compressor(compress_out())
        if not self.packetizer.need_rekey():
            self.in_kex = False
        # we always expect to receive NEWKEYS now
        self._expect_packet(MSG_NEWKEYS)
199988
def _domain_event_pmsuspend_cb(conn, domain, reason, opaque):
    '''
    
    '''
    _salt_send_domain_event(opaque, conn, domain, opaque['event'], {
        'reason': 'unknown'  # currently unused
    })
320308
def _split_optional_netmask(address):
    """"""
    addr = _compat_str(address).split('/')
    if len(addr) > 2:
        raise AddressValueError("Only one '/' permitted in %r" % address)
    return addr
115873
function Sec(transport, fastPathTransport) {
	this.transport = transport;
	this.fastPathTransport = fastPathTransport;
	// init at connect event from transport layer
	this.gccClient = null;
	this.gccServer = null;
	var self = this;
	this.infos = rdpInfos(function() {
		return self.gccClient.core.rdpVersion.value === gcc.VERSION.RDP_VERSION_5_PLUS;
	});
	this.machineName = '';
	
	
	// basic encryption
	this.enableEncryption = false;
	
	if (this.fastPathTransport) {
		this.fastPathTransport.on('fastPathData', function (secFlag, s) {
			self.recvFastPath(secFlag, s);
		});
	}
}
1095448
private static Collection<String> toWsBalancerURIs(Collection<String> uris,
                                                    AcceptOptionsContext acceptOptionsCtx,
                                                    TransportFactory transportFactory) throws Exception {
        List<String> httpURIs = new ArrayList<>(uris.size());
        for (String uri : uris) {
            String schemeFromAcceptURI = uri.substring(0, uri.indexOf(':'));
            Protocol protocol = transportFactory.getProtocol(schemeFromAcceptURI);
            if( WsProtocol.WS.equals(protocol) || WsProtocol.WSS.equals(protocol)) {
                for (String scheme: Arrays.asList("wsn", "wsx")) {
                    boolean secure = protocol.isSecure();
                    String wsBalancerUriScheme = secure ? scheme+"+ssl" : scheme;
                    String httpAuthority = getAuthority(uri);
                    String httpPath = getPath(uri);
                    String httpQuery = getQuery(uri);
                    httpURIs.add(buildURIAsString(wsBalancerUriScheme, httpAuthority, httpPath, httpQuery, null));

                    // ensure that the accept-options is updated with bindings if they exist for ws and/or wss
                    // so that the Gateway binds to the correct host:port as per the service configuration.
                    String internalURI = acceptOptionsCtx.getInternalURI(uri);
                    if ((internalURI != null) && !internalURI.equals(uri)) {
                        String authority = getAuthority(internalURI);
                        acceptOptionsCtx.addBind(wsBalancerUriScheme, authority);
                    }
                }
            }
        }
        return httpURIs;
    }
69989
function HAPEncryption() {
  // initialize member vars with null-object values
  this.clientPublicKey = bufferShim.alloc(0);
  this.secretKey = bufferShim.alloc(0);
  this.publicKey = bufferShim.alloc(0);
  this.sharedSec = bufferShim.alloc(0);
  this.hkdfPairEncKey = bufferShim.alloc(0);
  this.accessoryToControllerCount = { value: 0 };
  this.controllerToAccessoryCount = { value: 0 };
  this.accessoryToControllerKey = bufferShim.alloc(0);
  this.controllerToAccessoryKey = bufferShim.alloc(0);
  this.extraInfo = {};
}