cpython-lru_cache-weakref: Modules/

annotate Modules/_ssl.c @ 65035:87f4b32905df 2.7

Cosmetic fix to use print function.

author	Hirokazu Yamamoto <ocean-city@m2.ccsnet.ne.jp>
date	Fri, 01 Oct 2010 10:48:47 +0000
parents	0420f547f3bf
children	f2f7b70fc5eb

rev	line source
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	1 /* SSL socket module
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	2
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	3 SSL support based on patches by Brian E Gallew and Laszlo Kovacs.
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	4 Re-worked a bit by Bill Janssen to add server-side support and
47848 8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 47527 diff changeset	5 certificate decoding. Chris Stawarz contributed some non-blocking
8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 47527 diff changeset	6 patches.
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	7
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	8 This module is imported by ssl.py. It should not be used
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	9 directly.
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	10
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	11 XXX should partial writes be enabled, SSL_MODE_ENABLE_PARTIAL_WRITE?
60882 c9a32edd2ba7 Issue #8108: Fix the unwrap() method of SSL objects when the socket has Antoine Pitrou <solipsis@pitrou.net> parents: 60814 diff changeset	12
c9a32edd2ba7 Issue #8108: Fix the unwrap() method of SSL objects when the socket has Antoine Pitrou <solipsis@pitrou.net> parents: 60814 diff changeset	13 XXX integrate several "shutdown modes" as suggested in
c9a32edd2ba7 Issue #8108: Fix the unwrap() method of SSL objects when the socket has Antoine Pitrou <solipsis@pitrou.net> parents: 60814 diff changeset	14 http://bugs.python.org/issue8108#msg102867 ?
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	15 */
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	16
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	17 #include "Python.h"
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	18
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	19 #ifdef WITH_THREAD
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	20 #include "pythread.h"
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	21 #define PySSL_BEGIN_ALLOW_THREADS { \
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	22 PyThreadState *_save = NULL; \
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	23 if (_ssl_locks_count>0) {_save = PyEval_SaveThread();}
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	24 #define PySSL_BLOCK_THREADS if (_ssl_locks_count>0){PyEval_RestoreThread(_save)};
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	25 #define PySSL_UNBLOCK_THREADS if (_ssl_locks_count>0){_save = PyEval_SaveThread()};
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	26 #define PySSL_END_ALLOW_THREADS if (_ssl_locks_count>0){PyEval_RestoreThread(_save);} \
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	27 }
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	28
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	29 #else /* no WITH_THREAD */
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	30
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	31 #define PySSL_BEGIN_ALLOW_THREADS
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	32 #define PySSL_BLOCK_THREADS
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	33 #define PySSL_UNBLOCK_THREADS
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	34 #define PySSL_END_ALLOW_THREADS
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	35
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	36 #endif
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	37
23190 0bc3a41d4e40 Forward port of patch # 500311: Work around for buggy https servers. Martin v. Löwis <martin@v.loewis.de> parents: 21959 diff changeset	38 enum py_ssl_error {
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	39 /* these mirror ssl.h */
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	40 PY_SSL_ERROR_NONE,
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	41 PY_SSL_ERROR_SSL,
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	42 PY_SSL_ERROR_WANT_READ,
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	43 PY_SSL_ERROR_WANT_WRITE,
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	44 PY_SSL_ERROR_WANT_X509_LOOKUP,
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	45 PY_SSL_ERROR_SYSCALL, /* look at error stack/return value/errno */
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	46 PY_SSL_ERROR_ZERO_RETURN,
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	47 PY_SSL_ERROR_WANT_CONNECT,
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	48 /* start of non ssl.h errorcodes */
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	49 PY_SSL_ERROR_EOF, /* special case of SSL_ERROR_SYSCALL */
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	50 PY_SSL_ERROR_INVALID_ERROR_CODE
23190 0bc3a41d4e40 Forward port of patch # 500311: Work around for buggy https servers. Martin v. Löwis <martin@v.loewis.de> parents: 21959 diff changeset	51 };
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	52
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	53 enum py_ssl_server_or_client {
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	54 PY_SSL_CLIENT,
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	55 PY_SSL_SERVER
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	56 };
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	57
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	58 enum py_ssl_cert_requirements {
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	59 PY_SSL_CERT_NONE,
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	60 PY_SSL_CERT_OPTIONAL,
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	61 PY_SSL_CERT_REQUIRED
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	62 };
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	63
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	64 enum py_ssl_version {
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	65 PY_SSL_VERSION_SSL2,
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	66 PY_SSL_VERSION_SSL3,
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	67 PY_SSL_VERSION_SSL23,
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	68 PY_SSL_VERSION_TLS1
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	69 };
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	70
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	71 /* Include symbols from _socket module */
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	72 #include "socketmodule.h"
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	73
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	74 #if defined(HAVE_POLL_H)
39059 52a8738f5ab4 #1494314: Fix a regression with high-numbered sockets in 2.4.3. This Anthony Baxter <anthonybaxter@gmail.com> parents: 38152 diff changeset	75 #include <poll.h>
52a8738f5ab4 #1494314: Fix a regression with high-numbered sockets in 2.4.3. This Anthony Baxter <anthonybaxter@gmail.com> parents: 38152 diff changeset	76 #elif defined(HAVE_SYS_POLL_H)
52a8738f5ab4 #1494314: Fix a regression with high-numbered sockets in 2.4.3. This Anthony Baxter <anthonybaxter@gmail.com> parents: 38152 diff changeset	77 #include <sys/poll.h>
52a8738f5ab4 #1494314: Fix a regression with high-numbered sockets in 2.4.3. This Anthony Baxter <anthonybaxter@gmail.com> parents: 38152 diff changeset	78 #endif
52a8738f5ab4 #1494314: Fix a regression with high-numbered sockets in 2.4.3. This Anthony Baxter <anthonybaxter@gmail.com> parents: 38152 diff changeset	79
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	80 /* Include OpenSSL header files */
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	81 #include "openssl/rsa.h"
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	82 #include "openssl/crypto.h"
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	83 #include "openssl/x509.h"
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	84 #include "openssl/x509v3.h"
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	85 #include "openssl/pem.h"
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	86 #include "openssl/ssl.h"
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	87 #include "openssl/err.h"
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	88 #include "openssl/rand.h"
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	89
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	90 /* SSL error object */
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	91 static PyObject *PySSLErrorObject;
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	92
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	93 #ifdef WITH_THREAD
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	94
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	95 /* serves as a flag to see whether we've initialized the SSL thread support. */
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	96 /* 0 means no, greater than 0 means yes */
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	97
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	98 static unsigned int _ssl_locks_count = 0;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	99
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	100 #endif /* def WITH_THREAD */
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	101
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	102 /* SSL socket object */
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	103
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	104 #define X509_NAME_MAXLEN 256
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	105
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	106 /* RAND_* APIs got added to OpenSSL in 0.9.5 */
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	107 #if OPENSSL_VERSION_NUMBER >= 0x0090500fL
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	108 # define HAVE_OPENSSL_RAND 1
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	109 #else
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	110 # undef HAVE_OPENSSL_RAND
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	111 #endif
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	112
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	113 typedef struct {
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	114 PyObject_HEAD
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	115 PySocketSockObject Socket; / Socket on which we're layered */
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	116 SSL_CTX* ctx;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	117 SSL* ssl;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	118 X509* peer_cert;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	119 char server[X509_NAME_MAXLEN];
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	120 char issuer[X509_NAME_MAXLEN];
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	121 int shutdown_seen_zero;
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	122
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	123 } PySSLObject;
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	124
24280 1598a1e473e2 staticforward bites the dust. Jeremy Hylton <jeremy@alum.mit.edu> parents: 24086 diff changeset	125 static PyTypeObject PySSL_Type;
1598a1e473e2 staticforward bites the dust. Jeremy Hylton <jeremy@alum.mit.edu> parents: 24086 diff changeset	126 static PyObject PySSL_SSLwrite(PySSLObject self, PyObject *args);
1598a1e473e2 staticforward bites the dust. Jeremy Hylton <jeremy@alum.mit.edu> parents: 24086 diff changeset	127 static PyObject PySSL_SSLread(PySSLObject self, PyObject *args);
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	128 static int check_socket_and_wait_for_timeout(PySocketSockObject *s,
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	129 int writing);
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	130 static PyObject PySSL_peercert(PySSLObject self, PyObject *args);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	131 static PyObject PySSL_cipher(PySSLObject self);
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	132
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	133 #define PySSLObject_Check(v) (Py_TYPE(v) == &PySSL_Type)
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	134
32599 598a5ce63322 [Patch #945642] Fix non-blocking SSL sockets, which blocked on reads/writes in Python 2.3. Andrew M. Kuchling <amk@amk.ca> parents: 31790 diff changeset	135 typedef enum {
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	136 SOCKET_IS_NONBLOCKING,
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	137 SOCKET_IS_BLOCKING,
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	138 SOCKET_HAS_TIMED_OUT,
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	139 SOCKET_HAS_BEEN_CLOSED,
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	140 SOCKET_TOO_LARGE_FOR_SELECT,
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	141 SOCKET_OPERATION_OK
32599 598a5ce63322 [Patch #945642] Fix non-blocking SSL sockets, which blocked on reads/writes in Python 2.3. Andrew M. Kuchling <amk@amk.ca> parents: 31790 diff changeset	142 } timeout_state;
598a5ce63322 [Patch #945642] Fix non-blocking SSL sockets, which blocked on reads/writes in Python 2.3. Andrew M. Kuchling <amk@amk.ca> parents: 31790 diff changeset	143
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	144 /* Wrap error strings with filename and line # */
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	145 #define STRINGIFY1(x) #x
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	146 #define STRINGIFY2(x) STRINGIFY1(x)
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	147 #define ERRSTR1(x,y,z) (x ":" y ": " z)
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	148 #define ERRSTR(x) ERRSTR1("_ssl.c", STRINGIFY2(__LINE__), x)
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	149
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	150 /* XXX It might be helpful to augment the error message generated
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	151 below with the name of the SSL function that generated the error.
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	152 I expect it's obvious most of the time.
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	153 */
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	154
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	155 static PyObject *
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	156 PySSL_SetError(PySSLObject obj, int ret, char filename, int lineno)
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	157 {
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	158 PyObject *v;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	159 char buf[2048];
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	160 char *errstr;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	161 int err;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	162 enum py_ssl_error p = PY_SSL_ERROR_NONE;
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	163
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	164 assert(ret <= 0);
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	165
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	166 if (obj->ssl != NULL) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	167 err = SSL_get_error(obj->ssl, ret);
23190 0bc3a41d4e40 Forward port of patch # 500311: Work around for buggy https servers. Martin v. Löwis <martin@v.loewis.de> parents: 21959 diff changeset	168
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	169 switch (err) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	170 case SSL_ERROR_ZERO_RETURN:
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	171 errstr = "TLS/SSL connection has been closed";
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	172 p = PY_SSL_ERROR_ZERO_RETURN;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	173 break;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	174 case SSL_ERROR_WANT_READ:
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	175 errstr = "The operation did not complete (read)";
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	176 p = PY_SSL_ERROR_WANT_READ;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	177 break;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	178 case SSL_ERROR_WANT_WRITE:
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	179 p = PY_SSL_ERROR_WANT_WRITE;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	180 errstr = "The operation did not complete (write)";
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	181 break;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	182 case SSL_ERROR_WANT_X509_LOOKUP:
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	183 p = PY_SSL_ERROR_WANT_X509_LOOKUP;
61534 e1836a7b6b6e Improve _ssl.c formatting Antoine Pitrou <solipsis@pitrou.net> parents: 61243 diff changeset	184 errstr = "The operation did not complete (X509 lookup)";
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	185 break;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	186 case SSL_ERROR_WANT_CONNECT:
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	187 p = PY_SSL_ERROR_WANT_CONNECT;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	188 errstr = "The operation did not complete (connect)";
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	189 break;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	190 case SSL_ERROR_SYSCALL:
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	191 {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	192 unsigned long e = ERR_get_error();
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	193 if (e == 0) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	194 if (ret == 0 \|\| !obj->Socket) {
61534 e1836a7b6b6e Improve _ssl.c formatting Antoine Pitrou <solipsis@pitrou.net> parents: 61243 diff changeset	195 p = PY_SSL_ERROR_EOF;
e1836a7b6b6e Improve _ssl.c formatting Antoine Pitrou <solipsis@pitrou.net> parents: 61243 diff changeset	196 errstr = "EOF occurred in violation of protocol";
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	197 } else if (ret == -1) {
61534 e1836a7b6b6e Improve _ssl.c formatting Antoine Pitrou <solipsis@pitrou.net> parents: 61243 diff changeset	198 /* underlying BIO reported an I/O error */
61643 8a0079d8d1ce Clear the OpenSSL error queue each time an error is signalled. Antoine Pitrou <solipsis@pitrou.net> parents: 61534 diff changeset	199 ERR_clear_error();
61534 e1836a7b6b6e Improve _ssl.c formatting Antoine Pitrou <solipsis@pitrou.net> parents: 61243 diff changeset	200 return obj->Socket->errorhandler();
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	201 } else { /* possible? */
61534 e1836a7b6b6e Improve _ssl.c formatting Antoine Pitrou <solipsis@pitrou.net> parents: 61243 diff changeset	202 p = PY_SSL_ERROR_SYSCALL;
e1836a7b6b6e Improve _ssl.c formatting Antoine Pitrou <solipsis@pitrou.net> parents: 61243 diff changeset	203 errstr = "Some I/O error occurred";
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	204 }
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	205 } else {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	206 p = PY_SSL_ERROR_SYSCALL;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	207 /* XXX Protected by global interpreter lock */
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	208 errstr = ERR_error_string(e, NULL);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	209 }
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	210 break;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	211 }
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	212 case SSL_ERROR_SSL:
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	213 {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	214 unsigned long e = ERR_get_error();
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	215 p = PY_SSL_ERROR_SSL;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	216 if (e != 0)
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	217 /* XXX Protected by global interpreter lock */
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	218 errstr = ERR_error_string(e, NULL);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	219 else { /* possible? */
61534 e1836a7b6b6e Improve _ssl.c formatting Antoine Pitrou <solipsis@pitrou.net> parents: 61243 diff changeset	220 errstr = "A failure in the SSL library occurred";
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	221 }
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	222 break;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	223 }
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	224 default:
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	225 p = PY_SSL_ERROR_INVALID_ERROR_CODE;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	226 errstr = "Invalid error code";
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	227 }
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	228 } else {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	229 errstr = ERR_error_string(ERR_peek_last_error(), NULL);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	230 }
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	231 PyOS_snprintf(buf, sizeof(buf), "_ssl.c:%d: %s", lineno, errstr);
61643 8a0079d8d1ce Clear the OpenSSL error queue each time an error is signalled. Antoine Pitrou <solipsis@pitrou.net> parents: 61534 diff changeset	232 ERR_clear_error();
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	233 v = Py_BuildValue("(is)", p, buf);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	234 if (v != NULL) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	235 PyErr_SetObject(PySSLErrorObject, v);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	236 Py_DECREF(v);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	237 }
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	238 return NULL;
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	239 }
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	240
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	241 static PyObject *
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	242 _setSSLError (char errstr, int errcode, char filename, int lineno) {
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	243
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	244 char buf[2048];
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	245 PyObject *v;
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	246
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	247 if (errstr == NULL) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	248 errcode = ERR_peek_last_error();
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	249 errstr = ERR_error_string(errcode, NULL);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	250 }
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	251 PyOS_snprintf(buf, sizeof(buf), "_ssl.c:%d: %s", lineno, errstr);
61643 8a0079d8d1ce Clear the OpenSSL error queue each time an error is signalled. Antoine Pitrou <solipsis@pitrou.net> parents: 61534 diff changeset	252 ERR_clear_error();
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	253 v = Py_BuildValue("(is)", errcode, buf);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	254 if (v != NULL) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	255 PyErr_SetObject(PySSLErrorObject, v);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	256 Py_DECREF(v);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	257 }
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	258 return NULL;
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	259 }
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	260
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	261 static PySSLObject *
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	262 newPySSLObject(PySocketSockObject Sock, char key_file, char *cert_file,
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	263 enum py_ssl_server_or_client socket_type,
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	264 enum py_ssl_cert_requirements certreq,
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	265 enum py_ssl_version proto_version,
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	266 char cacerts_file, char ciphers)
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	267 {
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	268 PySSLObject *self;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	269 char *errstr = NULL;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	270 int ret;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	271 int verification_mode;
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	272
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	273 self = PyObject_New(PySSLObject, &PySSL_Type); /* Create new object */
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	274 if (self == NULL)
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	275 return NULL;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	276 memset(self->server, '\0', sizeof(char) * X509_NAME_MAXLEN);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	277 memset(self->issuer, '\0', sizeof(char) * X509_NAME_MAXLEN);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	278 self->peer_cert = NULL;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	279 self->ssl = NULL;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	280 self->ctx = NULL;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	281 self->Socket = NULL;
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	282
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	283 /* Make sure the SSL error state is initialized */
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	284 (void) ERR_get_state();
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	285 ERR_clear_error();
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	286
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	287 if ((key_file && !cert_file) \|\| (!key_file && cert_file)) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	288 errstr = ERRSTR("Both the key & certificate files "
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	289 "must be specified");
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	290 goto fail;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	291 }
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	292
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	293 if ((socket_type == PY_SSL_SERVER) &&
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	294 ((key_file == NULL) \|\| (cert_file == NULL))) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	295 errstr = ERRSTR("Both the key & certificate files "
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	296 "must be specified for server-side operation");
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	297 goto fail;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	298 }
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	299
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	300 PySSL_BEGIN_ALLOW_THREADS
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	301 if (proto_version == PY_SSL_VERSION_TLS1)
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	302 self->ctx = SSL_CTX_new(TLSv1_method()); /* Set up context */
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	303 else if (proto_version == PY_SSL_VERSION_SSL3)
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	304 self->ctx = SSL_CTX_new(SSLv3_method()); /* Set up context */
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	305 else if (proto_version == PY_SSL_VERSION_SSL2)
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	306 self->ctx = SSL_CTX_new(SSLv2_method()); /* Set up context */
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	307 else if (proto_version == PY_SSL_VERSION_SSL23)
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	308 self->ctx = SSL_CTX_new(SSLv23_method()); /* Set up context */
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	309 PySSL_END_ALLOW_THREADS
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	310
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	311 if (self->ctx == NULL) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	312 errstr = ERRSTR("Invalid SSL protocol variant specified.");
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	313 goto fail;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	314 }
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	315
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	316 if (ciphers != NULL) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	317 ret = SSL_CTX_set_cipher_list(self->ctx, ciphers);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	318 if (ret == 0) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	319 errstr = ERRSTR("No cipher can be selected.");
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	320 goto fail;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	321 }
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	322 }
60659 7462e752f0fa Issue #8322: Add a ciphers argument to SSL sockets, so as to change the Antoine Pitrou <solipsis@pitrou.net> parents: 60466 diff changeset	323
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	324 if (certreq != PY_SSL_CERT_NONE) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	325 if (cacerts_file == NULL) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	326 errstr = ERRSTR("No root certificates specified for "
61534 e1836a7b6b6e Improve _ssl.c formatting Antoine Pitrou <solipsis@pitrou.net> parents: 61243 diff changeset	327 "verification of other-side certificates.");
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	328 goto fail;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	329 } else {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	330 PySSL_BEGIN_ALLOW_THREADS
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	331 ret = SSL_CTX_load_verify_locations(self->ctx,
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	332 cacerts_file,
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	333 NULL);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	334 PySSL_END_ALLOW_THREADS
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	335 if (ret != 1) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	336 _setSSLError(NULL, 0, __FILE__, __LINE__);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	337 goto fail;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	338 }
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	339 }
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	340 }
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	341 if (key_file) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	342 PySSL_BEGIN_ALLOW_THREADS
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	343 ret = SSL_CTX_use_PrivateKey_file(self->ctx, key_file,
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	344 SSL_FILETYPE_PEM);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	345 PySSL_END_ALLOW_THREADS
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	346 if (ret != 1) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	347 _setSSLError(NULL, ret, __FILE__, __LINE__);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	348 goto fail;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	349 }
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	350
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	351 PySSL_BEGIN_ALLOW_THREADS
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	352 ret = SSL_CTX_use_certificate_chain_file(self->ctx,
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	353 cert_file);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	354 PySSL_END_ALLOW_THREADS
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	355 if (ret != 1) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	356 /*
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	357 fprintf(stderr, "ret is %d, errcode is %lu, %lu, with file \"%s\"\n",
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	358 ret, ERR_peek_error(), ERR_peek_last_error(), cert_file);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	359 */
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	360 if (ERR_peek_last_error() != 0) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	361 _setSSLError(NULL, ret, __FILE__, __LINE__);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	362 goto fail;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	363 }
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	364 }
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	365 }
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	366
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	367 /* ssl compatibility */
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	368 SSL_CTX_set_options(self->ctx, SSL_OP_ALL);
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	369
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	370 verification_mode = SSL_VERIFY_NONE;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	371 if (certreq == PY_SSL_CERT_OPTIONAL)
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	372 verification_mode = SSL_VERIFY_PEER;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	373 else if (certreq == PY_SSL_CERT_REQUIRED)
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	374 verification_mode = (SSL_VERIFY_PEER \|
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	375 SSL_VERIFY_FAIL_IF_NO_PEER_CERT);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	376 SSL_CTX_set_verify(self->ctx, verification_mode,
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	377 NULL); /* set verify lvl */
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	378
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	379 PySSL_BEGIN_ALLOW_THREADS
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	380 self->ssl = SSL_new(self->ctx); /* New ssl struct */
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	381 PySSL_END_ALLOW_THREADS
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	382 SSL_set_fd(self->ssl, Sock->sock_fd); /* Set the socket for SSL */
60461 a1628bd97bb6 SSL_MODE_AUTO_RETRY has been added in OpenSSL 0.9.6. Fix compilation Antoine Pitrou <solipsis@pitrou.net> parents: 60372 diff changeset	383 #ifdef SSL_MODE_AUTO_RETRY
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	384 SSL_set_mode(self->ssl, SSL_MODE_AUTO_RETRY);
60461 a1628bd97bb6 SSL_MODE_AUTO_RETRY has been added in OpenSSL 0.9.6. Fix compilation Antoine Pitrou <solipsis@pitrou.net> parents: 60372 diff changeset	385 #endif
27557 5eefec94a784 SF patch 676472 by Geoff Talvola, reviewed by Ben Laurie. Guido van Rossum <guido@python.org> parents: 27430 diff changeset	386
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	387 /* If the socket is in non-blocking mode or timeout mode, set the BIO
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	388 * to non-blocking mode (blocking is the default)
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	389 */
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	390 if (Sock->sock_timeout >= 0.0) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	391 /* Set both the read and write BIO's to non-blocking mode */
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	392 BIO_set_nbio(SSL_get_rbio(self->ssl), 1);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	393 BIO_set_nbio(SSL_get_wbio(self->ssl), 1);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	394 }
27557 5eefec94a784 SF patch 676472 by Geoff Talvola, reviewed by Ben Laurie. Guido van Rossum <guido@python.org> parents: 27430 diff changeset	395
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	396 PySSL_BEGIN_ALLOW_THREADS
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	397 if (socket_type == PY_SSL_CLIENT)
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	398 SSL_set_connect_state(self->ssl);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	399 else
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	400 SSL_set_accept_state(self->ssl);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	401 PySSL_END_ALLOW_THREADS
24398 c7ed925c75b3 Patch #575827: allow threads inside SSL creation. Martin v. Löwis <martin@v.loewis.de> parents: 24280 diff changeset	402
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	403 self->Socket = Sock;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	404 Py_INCREF(self->Socket);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	405 return self;
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	406 fail:
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	407 if (errstr)
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	408 PyErr_SetString(PySSLErrorObject, errstr);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	409 Py_DECREF(self);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	410 return NULL;
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	411 }
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	412
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	413 static PyObject *
42908 5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	414 PySSL_sslwrap(PyObject self, PyObject args)
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	415 {
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	416 PySocketSockObject *Sock;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	417 int server_side = 0;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	418 int verification_mode = PY_SSL_CERT_NONE;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	419 int protocol = PY_SSL_VERSION_SSL23;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	420 char *key_file = NULL;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	421 char *cert_file = NULL;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	422 char *cacerts_file = NULL;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	423 char *ciphers = NULL;
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	424
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	425 if (!PyArg_ParseTuple(args, "O!i\|zziizz:sslwrap",
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	426 PySocketModule.Sock_Type,
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	427 &Sock,
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	428 &server_side,
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	429 &key_file, &cert_file,
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	430 &verification_mode, &protocol,
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	431 &cacerts_file, &ciphers))
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	432 return NULL;
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	433
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	434 /*
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	435 fprintf(stderr,
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	436 "server_side is %d, keyfile %p, certfile %p, verify_mode %d, "
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	437 "protocol %d, certs %p\n",
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	438 server_side, key_file, cert_file, verification_mode,
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	439 protocol, cacerts_file);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	440 */
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	441
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	442 return (PyObject *) newPySSLObject(Sock, key_file, cert_file,
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	443 server_side, verification_mode,
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	444 protocol, cacerts_file,
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	445 ciphers);
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	446 }
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	447
23832 ed1ba37a46b7 Patch #568124: Add doc string macros. Martin v. Löwis <martin@v.loewis.de> parents: 23295 diff changeset	448 PyDoc_STRVAR(ssl_doc,
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	449 "sslwrap(socket, server_side, [keyfile, certfile, certs_mode, protocol,\n"
60659 7462e752f0fa Issue #8322: Add a ciphers argument to SSL sockets, so as to change the Antoine Pitrou <solipsis@pitrou.net> parents: 60466 diff changeset	450 " cacertsfile, ciphers]) -> sslobject");
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	451
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	452 /* SSL object methods */
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	453
47848 8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 47527 diff changeset	454 static PyObject PySSL_SSLdo_handshake(PySSLObject self)
8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 47527 diff changeset	455 {
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	456 int ret;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	457 int err;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	458 int sockstate, nonblocking;
60932 a09d7f414cd1 The do_handshake() method of SSL objects now adjusts the blocking mode of Antoine Pitrou <solipsis@pitrou.net> parents: 60882 diff changeset	459
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	460 /* just in case the blocking state of the socket has been changed */
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	461 nonblocking = (self->Socket->sock_timeout >= 0.0);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	462 BIO_set_nbio(SSL_get_rbio(self->ssl), nonblocking);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	463 BIO_set_nbio(SSL_get_wbio(self->ssl), nonblocking);
47848 8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 47527 diff changeset	464
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	465 /* Actually negotiate SSL connection */
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	466 /* XXX If SSL_do_handshake() returns 0, it's also a failure. */
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	467 do {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	468 PySSL_BEGIN_ALLOW_THREADS
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	469 ret = SSL_do_handshake(self->ssl);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	470 err = SSL_get_error(self->ssl, ret);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	471 PySSL_END_ALLOW_THREADS
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	472 if(PyErr_CheckSignals()) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	473 return NULL;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	474 }
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	475 if (err == SSL_ERROR_WANT_READ) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	476 sockstate = check_socket_and_wait_for_timeout(self->Socket, 0);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	477 } else if (err == SSL_ERROR_WANT_WRITE) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	478 sockstate = check_socket_and_wait_for_timeout(self->Socket, 1);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	479 } else {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	480 sockstate = SOCKET_OPERATION_OK;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	481 }
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	482 if (sockstate == SOCKET_HAS_TIMED_OUT) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	483 PyErr_SetString(PySSLErrorObject,
61534 e1836a7b6b6e Improve _ssl.c formatting Antoine Pitrou <solipsis@pitrou.net> parents: 61243 diff changeset	484 ERRSTR("The handshake operation timed out"));
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	485 return NULL;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	486 } else if (sockstate == SOCKET_HAS_BEEN_CLOSED) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	487 PyErr_SetString(PySSLErrorObject,
61534 e1836a7b6b6e Improve _ssl.c formatting Antoine Pitrou <solipsis@pitrou.net> parents: 61243 diff changeset	488 ERRSTR("Underlying socket has been closed."));
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	489 return NULL;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	490 } else if (sockstate == SOCKET_TOO_LARGE_FOR_SELECT) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	491 PyErr_SetString(PySSLErrorObject,
61534 e1836a7b6b6e Improve _ssl.c formatting Antoine Pitrou <solipsis@pitrou.net> parents: 61243 diff changeset	492 ERRSTR("Underlying socket too large for select()."));
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	493 return NULL;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	494 } else if (sockstate == SOCKET_IS_NONBLOCKING) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	495 break;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	496 }
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	497 } while (err == SSL_ERROR_WANT_READ \|\| err == SSL_ERROR_WANT_WRITE);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	498 if (ret < 1)
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	499 return PySSL_SetError(self, ret, __FILE__, __LINE__);
47848 8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 47527 diff changeset	500
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	501 if (self->peer_cert)
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	502 X509_free (self->peer_cert);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	503 PySSL_BEGIN_ALLOW_THREADS
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	504 if ((self->peer_cert = SSL_get_peer_certificate(self->ssl))) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	505 X509_NAME_oneline(X509_get_subject_name(self->peer_cert),
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	506 self->server, X509_NAME_MAXLEN);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	507 X509_NAME_oneline(X509_get_issuer_name(self->peer_cert),
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	508 self->issuer, X509_NAME_MAXLEN);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	509 }
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	510 PySSL_END_ALLOW_THREADS
47848 8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 47527 diff changeset	511
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	512 Py_INCREF(Py_None);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	513 return Py_None;
47848 8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 47527 diff changeset	514 }
8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 47527 diff changeset	515
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	516 static PyObject *
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	517 PySSL_server(PySSLObject *self)
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	518 {
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	519 return PyString_FromString(self->server);
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	520 }
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	521
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	522 static PyObject *
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	523 PySSL_issuer(PySSLObject *self)
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	524 {
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	525 return PyString_FromString(self->issuer);
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	526 }
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	527
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	528 static PyObject *
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	529 _create_tuple_for_attribute (ASN1_OBJECT name, ASN1_STRING value) {
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	530
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	531 char namebuf[X509_NAME_MAXLEN];
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	532 int buflen;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	533 PyObject *name_obj;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	534 PyObject *value_obj;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	535 PyObject *attr;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	536 unsigned char *valuebuf = NULL;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	537
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	538 buflen = OBJ_obj2txt(namebuf, sizeof(namebuf), name, 0);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	539 if (buflen < 0) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	540 _setSSLError(NULL, 0, __FILE__, __LINE__);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	541 goto fail;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	542 }
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	543 name_obj = PyString_FromStringAndSize(namebuf, buflen);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	544 if (name_obj == NULL)
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	545 goto fail;
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	546
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	547 buflen = ASN1_STRING_to_UTF8(&valuebuf, value);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	548 if (buflen < 0) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	549 _setSSLError(NULL, 0, __FILE__, __LINE__);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	550 Py_DECREF(name_obj);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	551 goto fail;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	552 }
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	553 value_obj = PyUnicode_DecodeUTF8((char *) valuebuf,
61534 e1836a7b6b6e Improve _ssl.c formatting Antoine Pitrou <solipsis@pitrou.net> parents: 61243 diff changeset	554 buflen, "strict");
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	555 OPENSSL_free(valuebuf);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	556 if (value_obj == NULL) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	557 Py_DECREF(name_obj);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	558 goto fail;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	559 }
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	560 attr = PyTuple_New(2);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	561 if (attr == NULL) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	562 Py_DECREF(name_obj);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	563 Py_DECREF(value_obj);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	564 goto fail;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	565 }
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	566 PyTuple_SET_ITEM(attr, 0, name_obj);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	567 PyTuple_SET_ITEM(attr, 1, value_obj);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	568 return attr;
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	569
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	570 fail:
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	571 return NULL;
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	572 }
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	573
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	574 static PyObject *
43243 e2b4fc960830 SSL certificate distinguished names should be represented by tuples Bill Janssen <janssen@parc.com> parents: 42908 diff changeset	575 _create_tuple_for_X509_NAME (X509_NAME *xname)
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	576 {
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	577 PyObject dn = NULL; / tuple which represents the "distinguished name" */
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	578 PyObject rdn = NULL; / tuple to hold a "relative distinguished name" */
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	579 PyObject *rdnt;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	580 PyObject attr = NULL; / tuple to hold an attribute */
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	581 int entry_count = X509_NAME_entry_count(xname);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	582 X509_NAME_ENTRY *entry;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	583 ASN1_OBJECT *name;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	584 ASN1_STRING *value;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	585 int index_counter;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	586 int rdn_level = -1;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	587 int retcode;
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	588
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	589 dn = PyList_New(0);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	590 if (dn == NULL)
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	591 return NULL;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	592 /* now create another tuple to hold the top-level RDN */
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	593 rdn = PyList_New(0);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	594 if (rdn == NULL)
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	595 goto fail0;
42908 5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	596
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	597 for (index_counter = 0;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	598 index_counter < entry_count;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	599 index_counter++)
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	600 {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	601 entry = X509_NAME_get_entry(xname, index_counter);
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	602
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	603 /* check to see if we've gotten to a new RDN */
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	604 if (rdn_level >= 0) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	605 if (rdn_level != entry->set) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	606 /* yes, new RDN */
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	607 /* add old RDN to DN */
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	608 rdnt = PyList_AsTuple(rdn);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	609 Py_DECREF(rdn);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	610 if (rdnt == NULL)
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	611 goto fail0;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	612 retcode = PyList_Append(dn, rdnt);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	613 Py_DECREF(rdnt);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	614 if (retcode < 0)
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	615 goto fail0;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	616 /* create new RDN */
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	617 rdn = PyList_New(0);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	618 if (rdn == NULL)
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	619 goto fail0;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	620 }
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	621 }
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	622 rdn_level = entry->set;
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	623
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	624 /* now add this attribute to the current RDN */
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	625 name = X509_NAME_ENTRY_get_object(entry);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	626 value = X509_NAME_ENTRY_get_data(entry);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	627 attr = _create_tuple_for_attribute(name, value);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	628 /*
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	629 fprintf(stderr, "RDN level %d, attribute %s: %s\n",
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	630 entry->set,
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	631 PyString_AS_STRING(PyTuple_GET_ITEM(attr, 0)),
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	632 PyString_AS_STRING(PyTuple_GET_ITEM(attr, 1)));
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	633 */
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	634 if (attr == NULL)
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	635 goto fail1;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	636 retcode = PyList_Append(rdn, attr);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	637 Py_DECREF(attr);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	638 if (retcode < 0)
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	639 goto fail1;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	640 }
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	641 /* now, there's typically a dangling RDN */
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	642 if ((rdn != NULL) && (PyList_Size(rdn) > 0)) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	643 rdnt = PyList_AsTuple(rdn);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	644 Py_DECREF(rdn);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	645 if (rdnt == NULL)
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	646 goto fail0;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	647 retcode = PyList_Append(dn, rdnt);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	648 Py_DECREF(rdnt);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	649 if (retcode < 0)
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	650 goto fail0;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	651 }
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	652
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	653 /* convert list to tuple */
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	654 rdnt = PyList_AsTuple(dn);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	655 Py_DECREF(dn);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	656 if (rdnt == NULL)
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	657 return NULL;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	658 return rdnt;
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	659
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	660 fail1:
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	661 Py_XDECREF(rdn);
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	662
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	663 fail0:
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	664 Py_XDECREF(dn);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	665 return NULL;
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	666 }
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	667
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	668 static PyObject *
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	669 _get_peer_alt_names (X509 *certificate) {
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	670
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	671 /* this code follows the procedure outlined in
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	672 OpenSSL's crypto/x509v3/v3_prn.c:X509v3_EXT_print()
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	673 function to extract the STACK_OF(GENERAL_NAME),
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	674 then iterates through the stack to add the
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	675 names. */
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	676
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	677 int i, j;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	678 PyObject *peer_alt_names = Py_None;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	679 PyObject v, t;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	680 X509_EXTENSION *ext = NULL;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	681 GENERAL_NAMES *names = NULL;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	682 GENERAL_NAME *name;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	683 X509V3_EXT_METHOD *method;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	684 BIO *biobuf = NULL;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	685 char buf[2048];
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	686 char *vptr;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	687 int len;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	688 /* Issue #2973: ASN1_item_d2i() API changed in OpenSSL 0.9.6m */
59276 c31a7c0c6399 Issue #2973: Fix gcc warning on the 2nd argument of ASN1_item_d2i() and Victor Stinner <victor.stinner@haypocalc.com> parents: 56626 diff changeset	689 #if OPENSSL_VERSION_NUMBER >= 0x009060dfL
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	690 const unsigned char *p;
59276 c31a7c0c6399 Issue #2973: Fix gcc warning on the 2nd argument of ASN1_item_d2i() and Victor Stinner <victor.stinner@haypocalc.com> parents: 56626 diff changeset	691 #else
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	692 unsigned char *p;
59276 c31a7c0c6399 Issue #2973: Fix gcc warning on the 2nd argument of ASN1_item_d2i() and Victor Stinner <victor.stinner@haypocalc.com> parents: 56626 diff changeset	693 #endif
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	694
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	695 if (certificate == NULL)
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	696 return peer_alt_names;
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	697
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	698 /* get a memory buffer */
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	699 biobuf = BIO_new(BIO_s_mem());
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	700
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	701 i = 0;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	702 while ((i = X509_get_ext_by_NID(
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	703 certificate, NID_subject_alt_name, i)) >= 0) {
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	704
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	705 if (peer_alt_names == Py_None) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	706 peer_alt_names = PyList_New(0);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	707 if (peer_alt_names == NULL)
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	708 goto fail;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	709 }
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	710
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	711 /* now decode the altName */
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	712 ext = X509_get_ext(certificate, i);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	713 if(!(method = X509V3_EXT_get(ext))) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	714 PyErr_SetString(PySSLErrorObject,
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	715 ERRSTR("No method for internalizing subjectAltName!"));
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	716 goto fail;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	717 }
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	718
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	719 p = ext->value->data;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	720 if (method->it)
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	721 names = (GENERAL_NAMES*) (ASN1_item_d2i(NULL,
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	722 &p,
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	723 ext->value->length,
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	724 ASN1_ITEM_ptr(method->it)));
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	725 else
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	726 names = (GENERAL_NAMES*) (method->d2i(NULL,
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	727 &p,
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	728 ext->value->length));
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	729
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	730 for(j = 0; j < sk_GENERAL_NAME_num(names); j++) {
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	731
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	732 /* get a rendering of each name in the set of names */
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	733
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	734 name = sk_GENERAL_NAME_value(names, j);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	735 if (name->type == GEN_DIRNAME) {
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	736
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	737 /* we special-case DirName as a tuple of tuples of attributes */
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	738
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	739 t = PyTuple_New(2);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	740 if (t == NULL) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	741 goto fail;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	742 }
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	743
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	744 v = PyString_FromString("DirName");
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	745 if (v == NULL) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	746 Py_DECREF(t);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	747 goto fail;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	748 }
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	749 PyTuple_SET_ITEM(t, 0, v);
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	750
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	751 v = _create_tuple_for_X509_NAME (name->d.dirn);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	752 if (v == NULL) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	753 Py_DECREF(t);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	754 goto fail;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	755 }
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	756 PyTuple_SET_ITEM(t, 1, v);
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	757
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	758 } else {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	759
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	760 /* for everything else, we use the OpenSSL print form */
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	761
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	762 (void) BIO_reset(biobuf);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	763 GENERAL_NAME_print(biobuf, name);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	764 len = BIO_gets(biobuf, buf, sizeof(buf)-1);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	765 if (len < 0) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	766 _setSSLError(NULL, 0, __FILE__, __LINE__);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	767 goto fail;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	768 }
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	769 vptr = strchr(buf, ':');
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	770 if (vptr == NULL)
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	771 goto fail;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	772 t = PyTuple_New(2);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	773 if (t == NULL)
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	774 goto fail;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	775 v = PyString_FromStringAndSize(buf, (vptr - buf));
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	776 if (v == NULL) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	777 Py_DECREF(t);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	778 goto fail;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	779 }
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	780 PyTuple_SET_ITEM(t, 0, v);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	781 v = PyString_FromStringAndSize((vptr + 1), (len - (vptr - buf + 1)));
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	782 if (v == NULL) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	783 Py_DECREF(t);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	784 goto fail;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	785 }
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	786 PyTuple_SET_ITEM(t, 1, v);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	787 }
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	788
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	789 /* and add that rendering to the list */
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	790
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	791 if (PyList_Append(peer_alt_names, t) < 0) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	792 Py_DECREF(t);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	793 goto fail;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	794 }
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	795 Py_DECREF(t);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	796 }
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	797 }
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	798 BIO_free(biobuf);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	799 if (peer_alt_names != Py_None) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	800 v = PyList_AsTuple(peer_alt_names);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	801 Py_DECREF(peer_alt_names);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	802 return v;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	803 } else {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	804 return peer_alt_names;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	805 }
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	806
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	807
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	808 fail:
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	809 if (biobuf != NULL)
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	810 BIO_free(biobuf);
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	811
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	812 if (peer_alt_names != Py_None) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	813 Py_XDECREF(peer_alt_names);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	814 }
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	815
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	816 return NULL;
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	817 }
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	818
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	819 static PyObject *
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	820 _decode_certificate (X509 *certificate, int verbose) {
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	821
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	822 PyObject *retval = NULL;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	823 BIO *biobuf = NULL;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	824 PyObject *peer;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	825 PyObject *peer_alt_names = NULL;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	826 PyObject *issuer;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	827 PyObject *version;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	828 PyObject *sn_obj;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	829 ASN1_INTEGER *serialNumber;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	830 char buf[2048];
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	831 int len;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	832 ASN1_TIME notBefore, notAfter;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	833 PyObject pnotBefore, pnotAfter;
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	834
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	835 retval = PyDict_New();
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	836 if (retval == NULL)
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	837 return NULL;
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	838
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	839 peer = _create_tuple_for_X509_NAME(
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	840 X509_get_subject_name(certificate));
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	841 if (peer == NULL)
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	842 goto fail0;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	843 if (PyDict_SetItemString(retval, (const char *) "subject", peer) < 0) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	844 Py_DECREF(peer);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	845 goto fail0;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	846 }
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	847 Py_DECREF(peer);
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	848
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	849 if (verbose) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	850 issuer = _create_tuple_for_X509_NAME(
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	851 X509_get_issuer_name(certificate));
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	852 if (issuer == NULL)
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	853 goto fail0;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	854 if (PyDict_SetItemString(retval, (const char *)"issuer", issuer) < 0) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	855 Py_DECREF(issuer);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	856 goto fail0;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	857 }
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	858 Py_DECREF(issuer);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	859
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	860 version = PyInt_FromLong(X509_get_version(certificate) + 1);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	861 if (PyDict_SetItemString(retval, "version", version) < 0) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	862 Py_DECREF(version);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	863 goto fail0;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	864 }
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	865 Py_DECREF(version);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	866 }
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	867
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	868 /* get a memory buffer */
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	869 biobuf = BIO_new(BIO_s_mem());
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	870
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	871 if (verbose) {
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	872
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	873 (void) BIO_reset(biobuf);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	874 serialNumber = X509_get_serialNumber(certificate);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	875 /* should not exceed 20 octets, 160 bits, so buf is big enough */
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	876 i2a_ASN1_INTEGER(biobuf, serialNumber);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	877 len = BIO_gets(biobuf, buf, sizeof(buf)-1);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	878 if (len < 0) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	879 _setSSLError(NULL, 0, __FILE__, __LINE__);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	880 goto fail1;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	881 }
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	882 sn_obj = PyString_FromStringAndSize(buf, len);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	883 if (sn_obj == NULL)
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	884 goto fail1;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	885 if (PyDict_SetItemString(retval, "serialNumber", sn_obj) < 0) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	886 Py_DECREF(sn_obj);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	887 goto fail1;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	888 }
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	889 Py_DECREF(sn_obj);
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	890
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	891 (void) BIO_reset(biobuf);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	892 notBefore = X509_get_notBefore(certificate);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	893 ASN1_TIME_print(biobuf, notBefore);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	894 len = BIO_gets(biobuf, buf, sizeof(buf)-1);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	895 if (len < 0) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	896 _setSSLError(NULL, 0, __FILE__, __LINE__);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	897 goto fail1;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	898 }
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	899 pnotBefore = PyString_FromStringAndSize(buf, len);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	900 if (pnotBefore == NULL)
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	901 goto fail1;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	902 if (PyDict_SetItemString(retval, "notBefore", pnotBefore) < 0) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	903 Py_DECREF(pnotBefore);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	904 goto fail1;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	905 }
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	906 Py_DECREF(pnotBefore);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	907 }
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	908
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	909 (void) BIO_reset(biobuf);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	910 notAfter = X509_get_notAfter(certificate);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	911 ASN1_TIME_print(biobuf, notAfter);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	912 len = BIO_gets(biobuf, buf, sizeof(buf)-1);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	913 if (len < 0) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	914 _setSSLError(NULL, 0, __FILE__, __LINE__);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	915 goto fail1;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	916 }
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	917 pnotAfter = PyString_FromStringAndSize(buf, len);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	918 if (pnotAfter == NULL)
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	919 goto fail1;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	920 if (PyDict_SetItemString(retval, "notAfter", pnotAfter) < 0) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	921 Py_DECREF(pnotAfter);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	922 goto fail1;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	923 }
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	924 Py_DECREF(pnotAfter);
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	925
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	926 /* Now look for subjectAltName */
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	927
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	928 peer_alt_names = _get_peer_alt_names(certificate);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	929 if (peer_alt_names == NULL)
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	930 goto fail1;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	931 else if (peer_alt_names != Py_None) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	932 if (PyDict_SetItemString(retval, "subjectAltName",
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	933 peer_alt_names) < 0) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	934 Py_DECREF(peer_alt_names);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	935 goto fail1;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	936 }
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	937 Py_DECREF(peer_alt_names);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	938 }
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	939
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	940 BIO_free(biobuf);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	941 return retval;
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	942
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	943 fail1:
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	944 if (biobuf != NULL)
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	945 BIO_free(biobuf);
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	946 fail0:
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	947 Py_XDECREF(retval);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	948 return NULL;
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	949 }
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	950
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	951
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	952 static PyObject *
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	953 PySSL_test_decode_certificate (PyObject mod, PyObject args) {
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	954
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	955 PyObject *retval = NULL;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	956 char *filename = NULL;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	957 X509 *x=NULL;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	958 BIO *cert;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	959 int verbose = 1;
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	960
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	961 if (!PyArg_ParseTuple(args, "s\|i:test_decode_certificate", &filename, &verbose))
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	962 return NULL;
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	963
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	964 if ((cert=BIO_new(BIO_s_file())) == NULL) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	965 PyErr_SetString(PySSLErrorObject, "Can't malloc memory to read file");
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	966 goto fail0;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	967 }
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	968
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	969 if (BIO_read_filename(cert,filename) <= 0) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	970 PyErr_SetString(PySSLErrorObject, "Can't open file");
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	971 goto fail0;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	972 }
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	973
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	974 x = PEM_read_bio_X509_AUX(cert,NULL, NULL, NULL);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	975 if (x == NULL) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	976 PyErr_SetString(PySSLErrorObject, "Error decoding PEM-encoded file");
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	977 goto fail0;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	978 }
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	979
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	980 retval = _decode_certificate(x, verbose);
63695 0420f547f3bf Merged revisions 83677 via svnmerge from Mark Dickinson <dickinsm@gmail.com> parents: 62486 diff changeset	981 X509_free(x);
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	982
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	983 fail0:
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	984
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	985 if (cert != NULL) BIO_free(cert);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	986 return retval;
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	987 }
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	988
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	989
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	990 static PyObject *
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	991 PySSL_peercert(PySSLObject self, PyObject args)
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	992 {
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	993 PyObject *retval = NULL;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	994 int len;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	995 int verification;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	996 PyObject *binary_mode = Py_None;
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	997
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	998 if (!PyArg_ParseTuple(args, "\|O:peer_certificate", &binary_mode))
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	999 return NULL;
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1000
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1001 if (!self->peer_cert)
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1002 Py_RETURN_NONE;
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1003
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1004 if (PyObject_IsTrue(binary_mode)) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1005 /* return cert in DER-encoded format */
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1006
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1007 unsigned char *bytes_buf = NULL;
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1008
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1009 bytes_buf = NULL;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1010 len = i2d_X509(self->peer_cert, &bytes_buf);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1011 if (len < 0) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1012 PySSL_SetError(self, len, __FILE__, __LINE__);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1013 return NULL;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1014 }
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1015 retval = PyString_FromStringAndSize((const char *) bytes_buf, len);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1016 OPENSSL_free(bytes_buf);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1017 return retval;
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1018
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1019 } else {
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1020
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1021 verification = SSL_CTX_get_verify_mode(self->ctx);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1022 if ((verification & SSL_VERIFY_PEER) == 0)
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1023 return PyDict_New();
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1024 else
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1025 return _decode_certificate (self->peer_cert, 0);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1026 }
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1027 }
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1028
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1029 PyDoc_STRVAR(PySSL_peercert_doc,
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1030 "peer_certificate([der=False]) -> certificate\n\
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1031 \n\
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1032 Returns the certificate for the peer. If no certificate was provided,\n\
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1033 returns None. If a certificate was provided, but not validated, returns\n\
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1034 an empty dictionary. Otherwise returns a dict containing information\n\
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1035 about the peer certificate.\n\
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1036 \n\
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1037 If the optional argument is True, returns a DER-encoded copy of the\n\
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1038 peer certificate, or None if no certificate was provided. This will\n\
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1039 return the certificate even if it wasn't validated.");
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1040
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1041 static PyObject PySSL_cipher (PySSLObject self) {
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1042
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1043 PyObject retval, v;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1044 SSL_CIPHER *current;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1045 char *cipher_name;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1046 char *cipher_protocol;
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1047
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1048 if (self->ssl == NULL)
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1049 return Py_None;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1050 current = SSL_get_current_cipher(self->ssl);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1051 if (current == NULL)
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1052 return Py_None;
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1053
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1054 retval = PyTuple_New(3);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1055 if (retval == NULL)
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1056 return NULL;
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1057
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1058 cipher_name = (char *) SSL_CIPHER_get_name(current);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1059 if (cipher_name == NULL) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1060 PyTuple_SET_ITEM(retval, 0, Py_None);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1061 } else {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1062 v = PyString_FromString(cipher_name);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1063 if (v == NULL)
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1064 goto fail0;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1065 PyTuple_SET_ITEM(retval, 0, v);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1066 }
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1067 cipher_protocol = SSL_CIPHER_get_version(current);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1068 if (cipher_protocol == NULL) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1069 PyTuple_SET_ITEM(retval, 1, Py_None);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1070 } else {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1071 v = PyString_FromString(cipher_protocol);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1072 if (v == NULL)
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1073 goto fail0;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1074 PyTuple_SET_ITEM(retval, 1, v);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1075 }
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1076 v = PyInt_FromLong(SSL_CIPHER_get_bits(current, NULL));
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1077 if (v == NULL)
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1078 goto fail0;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1079 PyTuple_SET_ITEM(retval, 2, v);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1080 return retval;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1081
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1082 fail0:
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1083 Py_DECREF(retval);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1084 return NULL;
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1085 }
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1086
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1087 static void PySSL_dealloc(PySSLObject *self)
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1088 {
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1089 if (self->peer_cert) /* Possible not to have one? */
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1090 X509_free (self->peer_cert);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1091 if (self->ssl)
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1092 SSL_free(self->ssl);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1093 if (self->ctx)
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1094 SSL_CTX_free(self->ctx);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1095 Py_XDECREF(self->Socket);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1096 PyObject_Del(self);
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1097 }
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1098
39059 52a8738f5ab4 #1494314: Fix a regression with high-numbered sockets in 2.4.3. This Anthony Baxter <anthonybaxter@gmail.com> parents: 38152 diff changeset	1099 /* If the socket has a timeout, do a select()/poll() on the socket.
27430 1ae0b142370e Support socket timeout in SSL, by Geoff Talvola. Guido van Rossum <guido@python.org> parents: 24471 diff changeset	1100 The argument writing indicates the direction.
32599 598a5ce63322 [Patch #945642] Fix non-blocking SSL sockets, which blocked on reads/writes in Python 2.3. Andrew M. Kuchling <amk@amk.ca> parents: 31790 diff changeset	1101 Returns one of the possibilities in the timeout_state enum (above).
27430 1ae0b142370e Support socket timeout in SSL, by Geoff Talvola. Guido van Rossum <guido@python.org> parents: 24471 diff changeset	1102 */
32599 598a5ce63322 [Patch #945642] Fix non-blocking SSL sockets, which blocked on reads/writes in Python 2.3. Andrew M. Kuchling <amk@amk.ca> parents: 31790 diff changeset	1103
27430 1ae0b142370e Support socket timeout in SSL, by Geoff Talvola. Guido van Rossum <guido@python.org> parents: 24471 diff changeset	1104 static int
32599 598a5ce63322 [Patch #945642] Fix non-blocking SSL sockets, which blocked on reads/writes in Python 2.3. Andrew M. Kuchling <amk@amk.ca> parents: 31790 diff changeset	1105 check_socket_and_wait_for_timeout(PySocketSockObject *s, int writing)
27430 1ae0b142370e Support socket timeout in SSL, by Geoff Talvola. Guido van Rossum <guido@python.org> parents: 24471 diff changeset	1106 {
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1107 fd_set fds;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1108 struct timeval tv;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1109 int rc;
27430 1ae0b142370e Support socket timeout in SSL, by Geoff Talvola. Guido van Rossum <guido@python.org> parents: 24471 diff changeset	1110
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1111 /* Nothing to do unless we're in timeout mode (not non-blocking) */
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1112 if (s->sock_timeout < 0.0)
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1113 return SOCKET_IS_BLOCKING;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1114 else if (s->sock_timeout == 0.0)
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1115 return SOCKET_IS_NONBLOCKING;
27430 1ae0b142370e Support socket timeout in SSL, by Geoff Talvola. Guido van Rossum <guido@python.org> parents: 24471 diff changeset	1116
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1117 /* Guard against closed socket */
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1118 if (s->sock_fd < 0)
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1119 return SOCKET_HAS_BEEN_CLOSED;
27430 1ae0b142370e Support socket timeout in SSL, by Geoff Talvola. Guido van Rossum <guido@python.org> parents: 24471 diff changeset	1120
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1121 /* Prefer poll, if available, since you can poll() any fd
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1122 * which can't be done with select(). */
39059 52a8738f5ab4 #1494314: Fix a regression with high-numbered sockets in 2.4.3. This Anthony Baxter <anthonybaxter@gmail.com> parents: 38152 diff changeset	1123 #ifdef HAVE_POLL
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1124 {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1125 struct pollfd pollfd;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1126 int timeout;
39059 52a8738f5ab4 #1494314: Fix a regression with high-numbered sockets in 2.4.3. This Anthony Baxter <anthonybaxter@gmail.com> parents: 38152 diff changeset	1127
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1128 pollfd.fd = s->sock_fd;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1129 pollfd.events = writing ? POLLOUT : POLLIN;
39059 52a8738f5ab4 #1494314: Fix a regression with high-numbered sockets in 2.4.3. This Anthony Baxter <anthonybaxter@gmail.com> parents: 38152 diff changeset	1130
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1131 /* s->sock_timeout is in seconds, timeout in ms */
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1132 timeout = (int)(s->sock_timeout * 1000 + 0.5);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1133 PySSL_BEGIN_ALLOW_THREADS
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1134 rc = poll(&pollfd, 1, timeout);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1135 PySSL_END_ALLOW_THREADS
39059 52a8738f5ab4 #1494314: Fix a regression with high-numbered sockets in 2.4.3. This Anthony Baxter <anthonybaxter@gmail.com> parents: 38152 diff changeset	1136
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1137 goto normal_return;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1138 }
39059 52a8738f5ab4 #1494314: Fix a regression with high-numbered sockets in 2.4.3. This Anthony Baxter <anthonybaxter@gmail.com> parents: 38152 diff changeset	1139 #endif
52a8738f5ab4 #1494314: Fix a regression with high-numbered sockets in 2.4.3. This Anthony Baxter <anthonybaxter@gmail.com> parents: 38152 diff changeset	1140
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1141 /* Guard against socket too large for select*/
36476 c073dffbe70e Introduce Py_SOCKET_FD_CAN_BE_GE_FD_SETSIZE. Martin v. Löwis <martin@v.loewis.de> parents: 36452 diff changeset	1142 #ifndef Py_SOCKET_FD_CAN_BE_GE_FD_SETSIZE
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1143 if (s->sock_fd >= FD_SETSIZE)
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1144 return SOCKET_TOO_LARGE_FOR_SELECT;
36476 c073dffbe70e Introduce Py_SOCKET_FD_CAN_BE_GE_FD_SETSIZE. Martin v. Löwis <martin@v.loewis.de> parents: 36452 diff changeset	1145 #endif
36452 7789cc557e1e Bug #876637, prevent stack corruption when socket descriptor Neal Norwitz <nnorwitz@gmail.com> parents: 36451 diff changeset	1146
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1147 /* Construct the arguments to select */
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1148 tv.tv_sec = (int)s->sock_timeout;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1149 tv.tv_usec = (int)((s->sock_timeout - tv.tv_sec) * 1e6);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1150 FD_ZERO(&fds);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1151 FD_SET(s->sock_fd, &fds);
27430 1ae0b142370e Support socket timeout in SSL, by Geoff Talvola. Guido van Rossum <guido@python.org> parents: 24471 diff changeset	1152
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1153 /* See if the socket is ready */
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1154 PySSL_BEGIN_ALLOW_THREADS
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1155 if (writing)
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1156 rc = select(s->sock_fd+1, NULL, &fds, NULL, &tv);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1157 else
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1158 rc = select(s->sock_fd+1, &fds, NULL, NULL, &tv);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1159 PySSL_END_ALLOW_THREADS
27430 1ae0b142370e Support socket timeout in SSL, by Geoff Talvola. Guido van Rossum <guido@python.org> parents: 24471 diff changeset	1160
47848 8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 47527 diff changeset	1161 #ifdef HAVE_POLL
39059 52a8738f5ab4 #1494314: Fix a regression with high-numbered sockets in 2.4.3. This Anthony Baxter <anthonybaxter@gmail.com> parents: 38152 diff changeset	1162 normal_return:
47848 8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 47527 diff changeset	1163 #endif
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1164 /* Return SOCKET_TIMED_OUT on timeout, SOCKET_OPERATION_OK otherwise
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1165 (when we are able to write or when there's something to read) */
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1166 return rc == 0 ? SOCKET_HAS_TIMED_OUT : SOCKET_OPERATION_OK;
27430 1ae0b142370e Support socket timeout in SSL, by Geoff Talvola. Guido van Rossum <guido@python.org> parents: 24471 diff changeset	1167 }
1ae0b142370e Support socket timeout in SSL, by Geoff Talvola. Guido van Rossum <guido@python.org> parents: 24471 diff changeset	1168
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1169 static PyObject PySSL_SSLwrite(PySSLObject self, PyObject *args)
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1170 {
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1171 Py_buffer buf;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1172 int len;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1173 int sockstate;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1174 int err;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1175 int nonblocking;
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1176
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1177 if (!PyArg_ParseTuple(args, "s*:write", &buf))
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1178 return NULL;
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1179
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1180 /* just in case the blocking state of the socket has been changed */
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1181 nonblocking = (self->Socket->sock_timeout >= 0.0);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1182 BIO_set_nbio(SSL_get_rbio(self->ssl), nonblocking);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1183 BIO_set_nbio(SSL_get_wbio(self->ssl), nonblocking);
47848 8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 47527 diff changeset	1184
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1185 sockstate = check_socket_and_wait_for_timeout(self->Socket, 1);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1186 if (sockstate == SOCKET_HAS_TIMED_OUT) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1187 PyErr_SetString(PySSLErrorObject,
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1188 "The write operation timed out");
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1189 goto error;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1190 } else if (sockstate == SOCKET_HAS_BEEN_CLOSED) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1191 PyErr_SetString(PySSLErrorObject,
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1192 "Underlying socket has been closed.");
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1193 goto error;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1194 } else if (sockstate == SOCKET_TOO_LARGE_FOR_SELECT) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1195 PyErr_SetString(PySSLErrorObject,
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1196 "Underlying socket too large for select().");
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1197 goto error;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1198 }
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1199 do {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1200 PySSL_BEGIN_ALLOW_THREADS
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1201 len = SSL_write(self->ssl, buf.buf, buf.len);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1202 err = SSL_get_error(self->ssl, len);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1203 PySSL_END_ALLOW_THREADS
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1204 if (PyErr_CheckSignals()) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1205 goto error;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1206 }
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1207 if (err == SSL_ERROR_WANT_READ) {
61534 e1836a7b6b6e Improve _ssl.c formatting Antoine Pitrou <solipsis@pitrou.net> parents: 61243 diff changeset	1208 sockstate = check_socket_and_wait_for_timeout(self->Socket, 0);
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1209 } else if (err == SSL_ERROR_WANT_WRITE) {
61534 e1836a7b6b6e Improve _ssl.c formatting Antoine Pitrou <solipsis@pitrou.net> parents: 61243 diff changeset	1210 sockstate = check_socket_and_wait_for_timeout(self->Socket, 1);
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1211 } else {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1212 sockstate = SOCKET_OPERATION_OK;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1213 }
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1214 if (sockstate == SOCKET_HAS_TIMED_OUT) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1215 PyErr_SetString(PySSLErrorObject,
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1216 "The write operation timed out");
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1217 goto error;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1218 } else if (sockstate == SOCKET_HAS_BEEN_CLOSED) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1219 PyErr_SetString(PySSLErrorObject,
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1220 "Underlying socket has been closed.");
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1221 goto error;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1222 } else if (sockstate == SOCKET_IS_NONBLOCKING) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1223 break;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1224 }
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1225 } while (err == SSL_ERROR_WANT_READ \|\| err == SSL_ERROR_WANT_WRITE);
56626 43d0b47106df Issue #7133: SSL objects now support the new buffer API. Antoine Pitrou <solipsis@pitrou.net> parents: 54412 diff changeset	1226
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1227 PyBuffer_Release(&buf);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1228 if (len > 0)
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1229 return PyInt_FromLong(len);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1230 else
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1231 return PySSL_SetError(self, len, __FILE__, __LINE__);
56626 43d0b47106df Issue #7133: SSL objects now support the new buffer API. Antoine Pitrou <solipsis@pitrou.net> parents: 54412 diff changeset	1232
43d0b47106df Issue #7133: SSL objects now support the new buffer API. Antoine Pitrou <solipsis@pitrou.net> parents: 54412 diff changeset	1233 error:
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1234 PyBuffer_Release(&buf);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1235 return NULL;
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1236 }
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1237
23832 ed1ba37a46b7 Patch #568124: Add doc string macros. Martin v. Löwis <martin@v.loewis.de> parents: 23295 diff changeset	1238 PyDoc_STRVAR(PySSL_SSLwrite_doc,
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1239 "write(s) -> len\n\
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1240 \n\
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1241 Writes the string s into the SSL object. Returns the number\n\
23832 ed1ba37a46b7 Patch #568124: Add doc string macros. Martin v. Löwis <martin@v.loewis.de> parents: 23295 diff changeset	1242 of bytes written.");
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1243
47848 8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 47527 diff changeset	1244 static PyObject PySSL_SSLpending(PySSLObject self)
8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 47527 diff changeset	1245 {
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1246 int count = 0;
47848 8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 47527 diff changeset	1247
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1248 PySSL_BEGIN_ALLOW_THREADS
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1249 count = SSL_pending(self->ssl);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1250 PySSL_END_ALLOW_THREADS
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1251 if (count < 0)
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1252 return PySSL_SetError(self, count, __FILE__, __LINE__);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1253 else
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1254 return PyInt_FromLong(count);
47848 8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 47527 diff changeset	1255 }
8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 47527 diff changeset	1256
8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 47527 diff changeset	1257 PyDoc_STRVAR(PySSL_SSLpending_doc,
8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 47527 diff changeset	1258 "pending() -> count\n\
8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 47527 diff changeset	1259 \n\
8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 47527 diff changeset	1260 Returns the number of already decrypted bytes available for read,\n\
8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 47527 diff changeset	1261 pending on the connection.\n");
8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 47527 diff changeset	1262
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1263 static PyObject PySSL_SSLread(PySSLObject self, PyObject *args)
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1264 {
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1265 PyObject *buf;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1266 int count = 0;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1267 int len = 1024;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1268 int sockstate;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1269 int err;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1270 int nonblocking;
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1271
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1272 if (!PyArg_ParseTuple(args, "\|i:read", &len))
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1273 return NULL;
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1274
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1275 if (!(buf = PyString_FromStringAndSize((char *) 0, len)))
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1276 return NULL;
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	1277
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1278 /* just in case the blocking state of the socket has been changed */
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1279 nonblocking = (self->Socket->sock_timeout >= 0.0);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1280 BIO_set_nbio(SSL_get_rbio(self->ssl), nonblocking);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1281 BIO_set_nbio(SSL_get_wbio(self->ssl), nonblocking);
47848 8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 47527 diff changeset	1282
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1283 /* first check if there are bytes ready to be read */
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1284 PySSL_BEGIN_ALLOW_THREADS
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1285 count = SSL_pending(self->ssl);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1286 PySSL_END_ALLOW_THREADS
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1287
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1288 if (!count) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1289 sockstate = check_socket_and_wait_for_timeout(self->Socket, 0);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1290 if (sockstate == SOCKET_HAS_TIMED_OUT) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1291 PyErr_SetString(PySSLErrorObject,
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1292 "The read operation timed out");
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1293 Py_DECREF(buf);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1294 return NULL;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1295 } else if (sockstate == SOCKET_TOO_LARGE_FOR_SELECT) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1296 PyErr_SetString(PySSLErrorObject,
61534 e1836a7b6b6e Improve _ssl.c formatting Antoine Pitrou <solipsis@pitrou.net> parents: 61243 diff changeset	1297 "Underlying socket too large for select().");
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1298 Py_DECREF(buf);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1299 return NULL;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1300 } else if (sockstate == SOCKET_HAS_BEEN_CLOSED) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1301 if (SSL_get_shutdown(self->ssl) !=
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1302 SSL_RECEIVED_SHUTDOWN)
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1303 {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1304 Py_DECREF(buf);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1305 PyErr_SetString(PySSLErrorObject,
61534 e1836a7b6b6e Improve _ssl.c formatting Antoine Pitrou <solipsis@pitrou.net> parents: 61243 diff changeset	1306 "Socket closed without SSL shutdown handshake");
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1307 return NULL;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1308 } else {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1309 /* should contain a zero-length string */
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1310 _PyString_Resize(&buf, 0);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1311 return buf;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1312 }
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1313 }
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1314 }
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1315 do {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1316 PySSL_BEGIN_ALLOW_THREADS
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1317 count = SSL_read(self->ssl, PyString_AsString(buf), len);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1318 err = SSL_get_error(self->ssl, count);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1319 PySSL_END_ALLOW_THREADS
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1320 if(PyErr_CheckSignals()) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1321 Py_DECREF(buf);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1322 return NULL;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1323 }
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1324 if (err == SSL_ERROR_WANT_READ) {
61534 e1836a7b6b6e Improve _ssl.c formatting Antoine Pitrou <solipsis@pitrou.net> parents: 61243 diff changeset	1325 sockstate = check_socket_and_wait_for_timeout(self->Socket, 0);
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1326 } else if (err == SSL_ERROR_WANT_WRITE) {
61534 e1836a7b6b6e Improve _ssl.c formatting Antoine Pitrou <solipsis@pitrou.net> parents: 61243 diff changeset	1327 sockstate = check_socket_and_wait_for_timeout(self->Socket, 1);
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1328 } else if ((err == SSL_ERROR_ZERO_RETURN) &&
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1329 (SSL_get_shutdown(self->ssl) ==
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1330 SSL_RECEIVED_SHUTDOWN))
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1331 {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1332 _PyString_Resize(&buf, 0);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1333 return buf;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1334 } else {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1335 sockstate = SOCKET_OPERATION_OK;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1336 }
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1337 if (sockstate == SOCKET_HAS_TIMED_OUT) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1338 PyErr_SetString(PySSLErrorObject,
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1339 "The read operation timed out");
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1340 Py_DECREF(buf);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1341 return NULL;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1342 } else if (sockstate == SOCKET_IS_NONBLOCKING) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1343 break;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1344 }
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1345 } while (err == SSL_ERROR_WANT_READ \|\| err == SSL_ERROR_WANT_WRITE);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1346 if (count <= 0) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1347 Py_DECREF(buf);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1348 return PySSL_SetError(self, count, __FILE__, __LINE__);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1349 }
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1350 if (count != len)
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1351 _PyString_Resize(&buf, count);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1352 return buf;
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1353 }
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1354
23832 ed1ba37a46b7 Patch #568124: Add doc string macros. Martin v. Löwis <martin@v.loewis.de> parents: 23295 diff changeset	1355 PyDoc_STRVAR(PySSL_SSLread_doc,
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1356 "read([len]) -> string\n\
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1357 \n\
23832 ed1ba37a46b7 Patch #568124: Add doc string macros. Martin v. Löwis <martin@v.loewis.de> parents: 23295 diff changeset	1358 Read up to len bytes from the SSL socket.");
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1359
47848 8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 47527 diff changeset	1360 static PyObject PySSL_SSLshutdown(PySSLObject self)
8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 47527 diff changeset	1361 {
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1362 int err, ssl_err, sockstate, nonblocking;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1363 int zeros = 0;
47848 8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 47527 diff changeset	1364
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1365 /* Guard against closed socket */
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1366 if (self->Socket->sock_fd < 0) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1367 PyErr_SetString(PySSLErrorObject,
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1368 "Underlying socket has been closed.");
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1369 return NULL;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1370 }
47848 8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 47527 diff changeset	1371
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1372 /* Just in case the blocking state of the socket has been changed */
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1373 nonblocking = (self->Socket->sock_timeout >= 0.0);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1374 BIO_set_nbio(SSL_get_rbio(self->ssl), nonblocking);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1375 BIO_set_nbio(SSL_get_wbio(self->ssl), nonblocking);
60882 c9a32edd2ba7 Issue #8108: Fix the unwrap() method of SSL objects when the socket has Antoine Pitrou <solipsis@pitrou.net> parents: 60814 diff changeset	1376
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1377 while (1) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1378 PySSL_BEGIN_ALLOW_THREADS
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1379 /* Disable read-ahead so that unwrap can work correctly.
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1380 * Otherwise OpenSSL might read in too much data,
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1381 * eating clear text data that happens to be
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1382 * transmitted after the SSL shutdown.
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1383 * Should be safe to call repeatedly everytime this
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1384 * function is used and the shutdown_seen_zero != 0
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1385 * condition is met.
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1386 */
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1387 if (self->shutdown_seen_zero)
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1388 SSL_set_read_ahead(self->ssl, 0);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1389 err = SSL_shutdown(self->ssl);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1390 PySSL_END_ALLOW_THREADS
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1391 /* If err == 1, a secure shutdown with SSL_shutdown() is complete */
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1392 if (err > 0)
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1393 break;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1394 if (err == 0) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1395 /* Don't loop endlessly; instead preserve legacy
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1396 behaviour of trying SSL_shutdown() only twice.
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1397 This looks necessary for OpenSSL < 0.9.8m */
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1398 if (++zeros > 1)
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1399 break;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1400 /* Shutdown was sent, now try receiving */
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1401 self->shutdown_seen_zero = 1;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1402 continue;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1403 }
60882 c9a32edd2ba7 Issue #8108: Fix the unwrap() method of SSL objects when the socket has Antoine Pitrou <solipsis@pitrou.net> parents: 60814 diff changeset	1404
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1405 /* Possibly retry shutdown until timeout or failure */
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1406 ssl_err = SSL_get_error(self->ssl, err);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1407 if (ssl_err == SSL_ERROR_WANT_READ)
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1408 sockstate = check_socket_and_wait_for_timeout(self->Socket, 0);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1409 else if (ssl_err == SSL_ERROR_WANT_WRITE)
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1410 sockstate = check_socket_and_wait_for_timeout(self->Socket, 1);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1411 else
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1412 break;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1413 if (sockstate == SOCKET_HAS_TIMED_OUT) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1414 if (ssl_err == SSL_ERROR_WANT_READ)
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1415 PyErr_SetString(PySSLErrorObject,
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1416 "The read operation timed out");
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1417 else
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1418 PyErr_SetString(PySSLErrorObject,
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1419 "The write operation timed out");
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1420 return NULL;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1421 }
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1422 else if (sockstate == SOCKET_TOO_LARGE_FOR_SELECT) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1423 PyErr_SetString(PySSLErrorObject,
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1424 "Underlying socket too large for select().");
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1425 return NULL;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1426 }
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1427 else if (sockstate != SOCKET_OPERATION_OK)
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1428 /* Retain the SSL error code */
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1429 break;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1430 }
47848 8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 47527 diff changeset	1431
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1432 if (err < 0)
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1433 return PySSL_SetError(self, err, __FILE__, __LINE__);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1434 else {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1435 Py_INCREF(self->Socket);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1436 return (PyObject *) (self->Socket);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1437 }
47848 8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 47527 diff changeset	1438 }
8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 47527 diff changeset	1439
8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 47527 diff changeset	1440 PyDoc_STRVAR(PySSL_SSLshutdown_doc,
8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 47527 diff changeset	1441 "shutdown(s) -> socket\n\
8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 47527 diff changeset	1442 \n\
8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 47527 diff changeset	1443 Does the SSL shutdown handshake with the remote end, and returns\n\
8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 47527 diff changeset	1444 the underlying socket object.");
8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 47527 diff changeset	1445
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1446 static PyMethodDef PySSLMethods[] = {
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1447 {"do_handshake", (PyCFunction)PySSL_SSLdo_handshake, METH_NOARGS},
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1448 {"write", (PyCFunction)PySSL_SSLwrite, METH_VARARGS,
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1449 PySSL_SSLwrite_doc},
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1450 {"read", (PyCFunction)PySSL_SSLread, METH_VARARGS,
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1451 PySSL_SSLread_doc},
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1452 {"pending", (PyCFunction)PySSL_SSLpending, METH_NOARGS,
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1453 PySSL_SSLpending_doc},
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1454 {"server", (PyCFunction)PySSL_server, METH_NOARGS},
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1455 {"issuer", (PyCFunction)PySSL_issuer, METH_NOARGS},
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1456 {"peer_certificate", (PyCFunction)PySSL_peercert, METH_VARARGS,
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1457 PySSL_peercert_doc},
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1458 {"cipher", (PyCFunction)PySSL_cipher, METH_NOARGS},
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1459 {"shutdown", (PyCFunction)PySSL_SSLshutdown, METH_NOARGS,
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1460 PySSL_SSLshutdown_doc},
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1461 {NULL, NULL}
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1462 };
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1463
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1464 static PyObject PySSL_getattr(PySSLObject self, char *name)
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1465 {
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1466 return Py_FindMethod(PySSLMethods, (PyObject *)self, name);
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1467 }
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1468
24280 1598a1e473e2 staticforward bites the dust. Jeremy Hylton <jeremy@alum.mit.edu> parents: 24086 diff changeset	1469 static PyTypeObject PySSL_Type = {
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1470 PyVarObject_HEAD_INIT(NULL, 0)
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1471 "ssl.SSLContext", /tp_name/
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1472 sizeof(PySSLObject), /tp_basicsize/
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1473 0, /tp_itemsize/
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1474 /* methods */
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1475 (destructor)PySSL_dealloc, /tp_dealloc/
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1476 0, /tp_print/
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1477 (getattrfunc)PySSL_getattr, /tp_getattr/
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1478 0, /tp_setattr/
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1479 0, /tp_compare/
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1480 0, /tp_repr/
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1481 0, /tp_as_number/
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1482 0, /tp_as_sequence/
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1483 0, /tp_as_mapping/
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1484 0, /tp_hash/
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1485 };
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1486
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1487 #ifdef HAVE_OPENSSL_RAND
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1488
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1489 /* helper routines for seeding the SSL PRNG */
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1490 static PyObject *
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1491 PySSL_RAND_add(PyObject self, PyObject args)
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1492 {
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1493 char *buf;
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1494 int len;
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1495 double entropy;
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1496
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1497 if (!PyArg_ParseTuple(args, "s#d:RAND_add", &buf, &len, &entropy))
61534 e1836a7b6b6e Improve _ssl.c formatting Antoine Pitrou <solipsis@pitrou.net> parents: 61243 diff changeset	1498 return NULL;
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1499 RAND_add(buf, len, entropy);
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1500 Py_INCREF(Py_None);
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1501 return Py_None;
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1502 }
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1503
23832 ed1ba37a46b7 Patch #568124: Add doc string macros. Martin v. Löwis <martin@v.loewis.de> parents: 23295 diff changeset	1504 PyDoc_STRVAR(PySSL_RAND_add_doc,
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1505 "RAND_add(string, entropy)\n\
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1506 \n\
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1507 Mix string into the OpenSSL PRNG state. entropy (a float) is a lower\n\
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1508 bound on the entropy contained in string. See RFC 1750.");
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1509
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1510 static PyObject *
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1511 PySSL_RAND_status(PyObject *self)
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1512 {
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1513 return PyInt_FromLong(RAND_status());
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1514 }
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1515
23832 ed1ba37a46b7 Patch #568124: Add doc string macros. Martin v. Löwis <martin@v.loewis.de> parents: 23295 diff changeset	1516 PyDoc_STRVAR(PySSL_RAND_status_doc,
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1517 "RAND_status() -> 0 or 1\n\
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1518 \n\
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1519 Returns 1 if the OpenSSL PRNG has been seeded with enough data and 0 if not.\n\
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1520 It is necessary to seed the PRNG with RAND_add() on some platforms before\n\
23832 ed1ba37a46b7 Patch #568124: Add doc string macros. Martin v. Löwis <martin@v.loewis.de> parents: 23295 diff changeset	1521 using the ssl() function.");
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1522
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1523 static PyObject *
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1524 PySSL_RAND_egd(PyObject self, PyObject arg)
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1525 {
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1526 int bytes;
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1527
47527 52294af4b663 This reverts r63675 based on the discussion in this thread: Gregory P. Smith <greg@mad-scientist.com> parents: 47294 diff changeset	1528 if (!PyString_Check(arg))
61534 e1836a7b6b6e Improve _ssl.c formatting Antoine Pitrou <solipsis@pitrou.net> parents: 61243 diff changeset	1529 return PyErr_Format(PyExc_TypeError,
e1836a7b6b6e Improve _ssl.c formatting Antoine Pitrou <solipsis@pitrou.net> parents: 61243 diff changeset	1530 "RAND_egd() expected string, found %s",
e1836a7b6b6e Improve _ssl.c formatting Antoine Pitrou <solipsis@pitrou.net> parents: 61243 diff changeset	1531 Py_TYPE(arg)->tp_name);
47527 52294af4b663 This reverts r63675 based on the discussion in this thread: Gregory P. Smith <greg@mad-scientist.com> parents: 47294 diff changeset	1532 bytes = RAND_egd(PyString_AS_STRING(arg));
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1533 if (bytes == -1) {
61534 e1836a7b6b6e Improve _ssl.c formatting Antoine Pitrou <solipsis@pitrou.net> parents: 61243 diff changeset	1534 PyErr_SetString(PySSLErrorObject,
e1836a7b6b6e Improve _ssl.c formatting Antoine Pitrou <solipsis@pitrou.net> parents: 61243 diff changeset	1535 "EGD connection failed or EGD did not return "
e1836a7b6b6e Improve _ssl.c formatting Antoine Pitrou <solipsis@pitrou.net> parents: 61243 diff changeset	1536 "enough data to seed the PRNG");
e1836a7b6b6e Improve _ssl.c formatting Antoine Pitrou <solipsis@pitrou.net> parents: 61243 diff changeset	1537 return NULL;
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1538 }
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1539 return PyInt_FromLong(bytes);
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1540 }
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1541
23832 ed1ba37a46b7 Patch #568124: Add doc string macros. Martin v. Löwis <martin@v.loewis.de> parents: 23295 diff changeset	1542 PyDoc_STRVAR(PySSL_RAND_egd_doc,
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1543 "RAND_egd(path) -> bytes\n\
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1544 \n\
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1545 Queries the entropy gather daemon (EGD) on the socket named by 'path'.\n\
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1546 Returns number of bytes read. Raises SSLError if connection to EGD\n\
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1547 fails or if it does provide enough data to seed PRNG.");
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1548
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1549 #endif
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1550
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1551 /* List of functions exported by this module. */
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1552
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1553 static PyMethodDef PySSL_methods[] = {
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1554 {"sslwrap", PySSL_sslwrap,
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1555 METH_VARARGS, ssl_doc},
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1556 {"_test_decode_cert", PySSL_test_decode_certificate,
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1557 METH_VARARGS},
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1558 #ifdef HAVE_OPENSSL_RAND
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1559 {"RAND_add", PySSL_RAND_add, METH_VARARGS,
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1560 PySSL_RAND_add_doc},
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1561 {"RAND_egd", PySSL_RAND_egd, METH_O,
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1562 PySSL_RAND_egd_doc},
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1563 {"RAND_status", (PyCFunction)PySSL_RAND_status, METH_NOARGS,
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1564 PySSL_RAND_status_doc},
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1565 #endif
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1566 {NULL, NULL} /* Sentinel */
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1567 };
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1568
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1569
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1570 #ifdef WITH_THREAD
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1571
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1572 /* an implementation of OpenSSL threading operations in terms
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1573 of the Python C thread library */
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1574
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1575 static PyThread_type_lock *_ssl_locks = NULL;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1576
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1577 static unsigned long _ssl_thread_id_function (void) {
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1578 return PyThread_get_thread_ident();
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1579 }
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1580
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1581 static void _ssl_thread_locking_function (int mode, int n, const char *file, int line) {
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1582 /* this function is needed to perform locking on shared data
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1583 structures. (Note that OpenSSL uses a number of global data
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1584 structures that will be implicitly shared whenever multiple threads
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1585 use OpenSSL.) Multi-threaded applications will crash at random if
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1586 it is not set.
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1587
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1588 locking_function() must be able to handle up to CRYPTO_num_locks()
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1589 different mutex locks. It sets the n-th lock if mode & CRYPTO_LOCK, and
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1590 releases it otherwise.
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1591
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1592 file and line are the file number of the function setting the
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1593 lock. They can be useful for debugging.
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1594 */
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1595
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1596 if ((_ssl_locks == NULL) \|\|
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1597 (n < 0) \|\| ((unsigned)n >= _ssl_locks_count))
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1598 return;
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1599
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1600 if (mode & CRYPTO_LOCK) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1601 PyThread_acquire_lock(_ssl_locks[n], 1);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1602 } else {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1603 PyThread_release_lock(_ssl_locks[n]);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1604 }
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1605 }
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1606
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1607 static int _setup_ssl_threads(void) {
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1608
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1609 unsigned int i;
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1610
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1611 if (_ssl_locks == NULL) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1612 _ssl_locks_count = CRYPTO_num_locks();
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1613 _ssl_locks = (PyThread_type_lock *)
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1614 malloc(sizeof(PyThread_type_lock) * _ssl_locks_count);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1615 if (_ssl_locks == NULL)
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1616 return 0;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1617 memset(_ssl_locks, 0, sizeof(PyThread_type_lock) * _ssl_locks_count);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1618 for (i = 0; i < _ssl_locks_count; i++) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1619 _ssl_locks[i] = PyThread_allocate_lock();
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1620 if (_ssl_locks[i] == NULL) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1621 unsigned int j;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1622 for (j = 0; j < i; j++) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1623 PyThread_free_lock(_ssl_locks[j]);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1624 }
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1625 free(_ssl_locks);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1626 return 0;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1627 }
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1628 }
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1629 CRYPTO_set_locking_callback(_ssl_thread_locking_function);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1630 CRYPTO_set_id_callback(_ssl_thread_id_function);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1631 }
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1632 return 1;
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1633 }
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1634
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1635 #endif /* def HAVE_THREAD */
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1636
23832 ed1ba37a46b7 Patch #568124: Add doc string macros. Martin v. Löwis <martin@v.loewis.de> parents: 23295 diff changeset	1637 PyDoc_STRVAR(module_doc,
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1638 "Implementation module for SSL socket operations. See the socket module\n\
23832 ed1ba37a46b7 Patch #568124: Add doc string macros. Martin v. Löwis <martin@v.loewis.de> parents: 23295 diff changeset	1639 for documentation.");
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1640
24471 f66b3a3509c7 Excise DL_EXPORT/DL_IMPORT from Modules/. Required adding a prototype Mark Hammond <mhammond@skippinet.com.au>* parents: 24398 diff changeset	1641 PyMODINIT_FUNC
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1642 init_ssl(void)
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1643 {
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1644 PyObject m, d, *r;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1645 unsigned long libver;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1646 unsigned int major, minor, fix, patch, status;
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1647
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1648 Py_TYPE(&PySSL_Type) = &PyType_Type;
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1649
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1650 m = Py_InitModule3("_ssl", PySSL_methods, module_doc);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1651 if (m == NULL)
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1652 return;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1653 d = PyModule_GetDict(m);
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1654
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1655 /* Load _socket module and its C API */
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1656 if (PySocketModule_ImportModuleAndAPI())
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1657 return;
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1658
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1659 /* Init OpenSSL */
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1660 SSL_load_error_strings();
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1661 SSL_library_init();
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1662 #ifdef WITH_THREAD
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1663 /* note that this will start threading if not already started */
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1664 if (!_setup_ssl_threads()) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1665 return;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1666 }
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1667 #endif
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1668 OpenSSL_add_all_algorithms();
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1669
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1670 /* Add symbols to module dict */
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1671 PySSLErrorObject = PyErr_NewException("ssl.SSLError",
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1672 PySocketModule.error,
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1673 NULL);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1674 if (PySSLErrorObject == NULL)
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1675 return;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1676 if (PyDict_SetItemString(d, "SSLError", PySSLErrorObject) != 0)
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1677 return;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1678 if (PyDict_SetItemString(d, "SSLType",
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1679 (PyObject *)&PySSL_Type) != 0)
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1680 return;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1681 PyModule_AddIntConstant(m, "SSL_ERROR_ZERO_RETURN",
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1682 PY_SSL_ERROR_ZERO_RETURN);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1683 PyModule_AddIntConstant(m, "SSL_ERROR_WANT_READ",
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1684 PY_SSL_ERROR_WANT_READ);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1685 PyModule_AddIntConstant(m, "SSL_ERROR_WANT_WRITE",
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1686 PY_SSL_ERROR_WANT_WRITE);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1687 PyModule_AddIntConstant(m, "SSL_ERROR_WANT_X509_LOOKUP",
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1688 PY_SSL_ERROR_WANT_X509_LOOKUP);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1689 PyModule_AddIntConstant(m, "SSL_ERROR_SYSCALL",
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1690 PY_SSL_ERROR_SYSCALL);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1691 PyModule_AddIntConstant(m, "SSL_ERROR_SSL",
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1692 PY_SSL_ERROR_SSL);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1693 PyModule_AddIntConstant(m, "SSL_ERROR_WANT_CONNECT",
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1694 PY_SSL_ERROR_WANT_CONNECT);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1695 /* non ssl.h errorcodes */
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1696 PyModule_AddIntConstant(m, "SSL_ERROR_EOF",
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1697 PY_SSL_ERROR_EOF);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1698 PyModule_AddIntConstant(m, "SSL_ERROR_INVALID_ERROR_CODE",
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1699 PY_SSL_ERROR_INVALID_ERROR_CODE);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1700 /* cert requirements */
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1701 PyModule_AddIntConstant(m, "CERT_NONE",
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1702 PY_SSL_CERT_NONE);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1703 PyModule_AddIntConstant(m, "CERT_OPTIONAL",
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1704 PY_SSL_CERT_OPTIONAL);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1705 PyModule_AddIntConstant(m, "CERT_REQUIRED",
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1706 PY_SSL_CERT_REQUIRED);
23190 0bc3a41d4e40 Forward port of patch # 500311: Work around for buggy https servers. Martin v. Löwis <martin@v.loewis.de> parents: 21959 diff changeset	1707
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1708 /* protocol versions */
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1709 PyModule_AddIntConstant(m, "PROTOCOL_SSLv2",
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1710 PY_SSL_VERSION_SSL2);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1711 PyModule_AddIntConstant(m, "PROTOCOL_SSLv3",
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1712 PY_SSL_VERSION_SSL3);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1713 PyModule_AddIntConstant(m, "PROTOCOL_SSLv23",
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1714 PY_SSL_VERSION_SSL23);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1715 PyModule_AddIntConstant(m, "PROTOCOL_TLSv1",
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1716 PY_SSL_VERSION_TLS1);
60372 664173984f2d Issue #8321: Give access to OpenSSL version numbers from the `ssl` module, Antoine Pitrou <solipsis@pitrou.net> parents: 60033 diff changeset	1717
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1718 /* OpenSSL version */
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1719 /* SSLeay() gives us the version of the library linked against,
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1720 which could be different from the headers version.
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1721 */
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1722 libver = SSLeay();
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1723 r = PyLong_FromUnsignedLong(libver);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1724 if (r == NULL)
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1725 return;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1726 if (PyModule_AddObject(m, "OPENSSL_VERSION_NUMBER", r))
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1727 return;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1728 status = libver & 0xF;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1729 libver >>= 4;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1730 patch = libver & 0xFF;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1731 libver >>= 8;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1732 fix = libver & 0xFF;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1733 libver >>= 8;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1734 minor = libver & 0xFF;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1735 libver >>= 8;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1736 major = libver & 0xFF;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1737 r = Py_BuildValue("IIIII", major, minor, fix, patch, status);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1738 if (r == NULL \|\| PyModule_AddObject(m, "OPENSSL_VERSION_INFO", r))
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1739 return;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1740 r = PyString_FromString(SSLeay_version(SSLEAY_VERSION));
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1741 if (r == NULL \|\| PyModule_AddObject(m, "OPENSSL_VERSION", r))
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1742 return;
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1743 }

Mercurial > cpython-lru_cache-weakref

annotate Modules/_ssl.c @ 65035:87f4b32905df 2.7